zshrs 0.13.42

//! ZLE main routines - Direct port from zsh/Src/Zle/zle_main.c
//!
//! Core event loop, initialization, and main entry points for the line editor.
//!
//! Implements:
//! - zleread() - main entry point for line reading
//! - zlecore() - core editing loop
//! - zsetterm() - terminal setup
//! - getbyte(), getfullchar() - input reading with UTF-8 support
//! - ungetbyte(), ungetbytes() - input pushback
//! - calc_timeout() - key timeout handling
//! - trashzle(), resetprompt() - display management
//! - recursive_edit() - nested editing
//! - bin_vared() - vared builtin
//! - zle_main_entry() - module entry point

use std::collections::VecDeque;
use std::io::{self, Read, Write};
use std::os::unix::io::{AsRawFd, RawFd};
use std::sync::atomic::Ordering;
use std::sync::atomic::Ordering::SeqCst;
use std::time::{Duration, Instant};

use super::zle_h::{
    widget, MOD_CHAR, MOD_CLIP, MOD_LINE, MOD_MULT, MOD_NEG, MOD_NULL, MOD_OSSEL, MOD_PRI,
    MOD_TMULT, MOD_VIAPP, MOD_VIBUF, ZLE_LASTCOL, ZLE_NOTCOMMAND,
};
use super::zle_keymap::Keymap;
use super::zle_thingy::Thingy;
use crate::ported::builtin::LASTVAL;
use crate::ported::builtins::sched::zleactive;
use crate::ported::init::SHTTY;
use crate::ported::mem::unqueue_signals;
use crate::ported::module::{addhookfunc, deletehookfunc};
use crate::ported::params::getsparam;
use crate::ported::utils::{errflag, getshfunc, write_loop, zwarnnam};
use crate::ported::zle::compcore::LASTCHAR;
use crate::ported::zle::termquery::mark_output;
use crate::ported::zle::zle_keymap::{
    curkeymap, curkeymapname, keymapnamtab, linkkeymap, openkeymap, selectkeymap, LOCALKEYMAP,
};
use crate::ported::zle::zle_misc::DONE;
use crate::ported::zle::zle_thingy::rthingy_nocreate;
use crate::ported::zsh_h::{
    hashtable, hookdef, module, HashTable, OPT_ARG_SAFE, OPT_ISSET, PM_ARRAY, PM_HASHED, PM_SCALAR,
    ZLCON_LINE_START, ZLE_CMD_ADD_TO_LINE, ZLE_CMD_CHPWD, ZLE_CMD_GET_KEY, ZLE_CMD_GET_LINE,
    ZLE_CMD_POSTEXEC, ZLE_CMD_PREEXEC, ZLE_CMD_READ, ZLE_CMD_REFRESH, ZLE_CMD_RESET_PROMPT,
    ZLE_CMD_SET_HIST_LINE, ZLE_CMD_SET_KEYMAP, ZLE_CMD_TRASH, ZLRF_HISTORY, ZLRF_NOSETTY,
};

use crate::ported::zle::zle_h::{change, modifier};
#[allow(unused_imports)]
use crate::ported::zle::{
    deltochar::*, textobjects::*, zle_h::*, zle_hist::*, zle_misc::*, zle_move::*, zle_params::*,
    zle_refresh::*, zle_tricky::*, zle_utils::*, zle_vi::*, zle_word::*,
};

/// Configure the terminal for ZLE input.
/// Port of `zsetterm()` from Src/Zle/zle_main.c:210. The C source
/// disables ICANON + ECHO, sets VMIN=1 / VTIME=0 (one-byte
/// blocking reads), captures VEOF as `eofchar` for the empty-line
/// EOF detection in zlecore (zle_main.c:1139), and disables TAB3
/// output mapping plus VQUIT/VSUSP/VDSUSP so the keymap can rebind
/// those control chars. Our Rust port covers ICANON+ECHO+FLUSHO
/// off, VMIN/VTIME, eofchar capture from VEOF, IXON flow-control
// set up terminal                                                       // c:210
/// disable, output TAB expansion disable (TAB3/OXTABS/XTABS), and
/// VQUIT/VDISCARD/VSUSP/VDSUSP/VSWTCH/VLNEXT/VSTART/VSTOP disables.
/// Only the fetchttyinfo/attachtty save state stays on the host side.
pub fn zsetterm() -> io::Result<()> {
    // c:210
    // c:Src/init.c setupshttyinfo — `gettyinfo(&shttyinfo)` snapshots the
    // cooked baseline BEFORE the first raw-mode switch so `trashzle()` can
    // restore it around command execution (fixes `cat` + `^D` EOF being
    // ignored because the tty stayed raw). Guarded to capture only once,
    // while the terminal is still cooked.
    if let Ok(mut g) = crate::ported::utils::SHTTYINFO.lock() {
        if g.is_none() {
            *g = crate::ported::utils::gettyinfo(); // c: gettyinfo(&shttyinfo)
        }
    }
    // c:210 — zsh's setterm() targets SHTTY (the ZLE tty), not fd 0. The
    // completion machinery closes fd 0 while running completer subprocesses, so
    // a `tcsetattr(fd 0)` here fails with EBADF and the re-raw (VMIN=1) is
    // silently skipped — leaving the tty non-blocking, so the list-prompt
    // pager's read on SHTTY returned EOF immediately and never blocked. Target
    // SHTTY with an fd-0 fallback for the non-interactive case (where at the
    // normal prompt SHTTY == dup(0), so this is a no-op).
    let tty_fd = {
        let s = SHTTY.load(SeqCst);
        if s >= 0 {
            s
        } else {
            TTYFD.load(SeqCst)
        }
    };
    let mut termios = termios::Termios::from_fd(tty_fd)?;

    // c:240 — disable canonical + echo + flusho.
    termios.c_lflag &= !(termios::ICANON | termios::ECHO);
    // c:241-244 — `| FLUSHO` (guarded by `#ifdef FLUSHO`). Clear the
    // "output being flushed" bit so queued terminal output isn't
    // discarded out from under zle. FLUSHO lives in libc, not the
    // termios crate; route through libc directly.
    termios.c_lflag &= !(libc::FLUSHO as libc::tcflag_t);

    // c:280 — capture VEOF before VMIN/VTIME overrides it. zlecore at
    // c:1139 compares lastchar against EOFCHAR for the empty-line EOF
    // path.
    let veof = termios.c_cc[termios::VEOF];
    if veof != 0 {
        EOFCHAR.store(veof as i32, SeqCst);
    }

    // c:238-239 — `if (unset(FLOWCONTROL)) ti.tio.c_iflag &= ~IXON;`.
    // termios crate doesn't re-export IXON/INLCR/ICRNL/ONLCR/VQUIT
    // etc.; route through libc directly.
    if !crate::ported::zsh_h::isset(crate::ported::zsh_h::FLOWCONTROL) {
        termios.c_iflag &= !(libc::IXON as libc::tcflag_t);
    }

    // c:245-255 — disable kernel output TAB expansion so a literal
    // \t written to the tty is NOT expanded to spaces behind zle's
    // back (which corrupts column tracking in the refresh code). C's
    // `#ifdef TAB3 ... #else #ifdef OXTABS ... #else #ifdef XTABS`
    // ladder: Linux exposes TAB3 (== XTABS), macOS/BSD expose OXTABS.
    #[cfg(target_os = "linux")]
    {
        termios.c_oflag &= !(libc::TAB3 as libc::tcflag_t);
    }
    #[cfg(not(target_os = "linux"))]
    {
        termios.c_oflag &= !(libc::OXTABS as libc::tcflag_t);
    }

    // c:256-258 — `ti.tio.c_oflag |= ONLCR;` translate \n to \r\n on
    // output so prompt/error writes land cleanly.
    termios.c_oflag |= libc::ONLCR as libc::tcflag_t;

    // c:259-275 — disable VQUIT (^\), VSUSP (^Z), VDISCARD (^O),
    // VLNEXT (^V) — zsh handles them itself via the key buffer.
    let vdisable: libc::cc_t = {
        let v = unsafe { libc::fpathconf(0, libc::_PC_VDISABLE) };
        if v >= 0 {
            v as libc::cc_t
        } else {
            0xff
        }
    };
    termios.c_cc[libc::VQUIT] = vdisable;
    termios.c_cc[libc::VDISCARD] = vdisable;
    termios.c_cc[libc::VSUSP] = vdisable;
    // c:266-268 — `#ifdef VDSUSP ti.tio.c_cc[VDSUSP] =` — the BSD/macOS
    // delayed-suspend char (^Y). Absent on Linux.
    #[cfg(any(
        target_os = "macos",
        target_os = "ios",
        target_os = "freebsd",
        target_os = "netbsd",
        target_os = "openbsd",
        target_os = "dragonfly"
    ))]
    {
        termios.c_cc[libc::VDSUSP] = vdisable;
    }
    // c:269-271 — `#ifdef VSWTCH ti.tio.c_cc[VSWTCH] =` — the Linux
    // switch-shell-layer char; libc exposes it as VSWTC. Absent on macOS.
    #[cfg(target_os = "linux")]
    {
        termios.c_cc[libc::VSWTC] = vdisable;
    }
    termios.c_cc[libc::VLNEXT] = vdisable;
    // c:276-278 — when nflowcontrol, also disable VSTART/VSTOP (^Q/^S).
    if !crate::ported::zsh_h::isset(crate::ported::zsh_h::FLOWCONTROL) {
        termios.c_cc[libc::VSTART] = vdisable;
        termios.c_cc[libc::VSTOP] = vdisable;
    }

    // c:281-282 — raw-mode VMIN=1 / VTIME=0.
    termios.c_cc[termios::VMIN] = 1;
    termios.c_cc[termios::VTIME] = 0;

    // c:283 — INLCR|ICRNL: swap \n/\r on input. getbyte at c:382
    // reverses the swap so the net effect inside zsh is none.
    termios.c_iflag |= (libc::INLCR | libc::ICRNL) as libc::tcflag_t;

    termios::tcsetattr(tty_fd, termios::TCSANOW, &termios)?;
    Ok(())
}

/// Push one byte back to the head of the input queue.
/// Port of `ungetbyte(int ch)` from Src/Zle/zle_main.c:348. Used by
/// keymap-trie resolution and `quoted-insert` to put back a byte
/// the loop already read but isn't ready to consume.
pub fn ungetbyte(ch: u8) {
    // c:348
    KUNGETBUF.lock().unwrap().push_front(ch);
}

/// Push a byte slice back onto the input queue, preserving order.
/// Port of `ungetbytes(char *s, int len)` from Src/Zle/zle_main.c:357. Iterates
/// the slice in reverse so that a subsequent forward read returns
/// `s[0]` first — matches the C source's `while(len--) ungetbyte(s[len])`
/// pattern.
/// WARNING: param names don't match C — Rust=(s) vs C=(s, len)
pub fn ungetbytes(s: &[u8]) {
    for &b in s.iter().rev() {
        KUNGETBUF.lock().unwrap().push_front(b);
    }
}

/// Port of `ungetbytes_unmeta(char *s, int len)` from `Src/Zle/zle_main.c:365`.
/// ```c
/// void
/// ungetbytes_unmeta(char *s, int len)
/// {
///     s += len;
///     while (len--) {
///         if (len && s[-2] == Meta) {
///             ungetbyte(*--s ^ 32);
///             len--;
///             s--;
///         } else
///             ungetbyte(*--s);
///     }
/// }
/// ```
/// Push back a byte slice that may contain `Meta`-quoted (0x83 ch
/// XOR 0x20) sequences, decoding them as we go. C walks backward
/// through `s` because `ungetbyte` is a stack push — to surface
/// `s[0]` first on subsequent read, the last byte goes on first.
/// WARNING: param names don't match C — Rust=(zle, s) vs C=(s, len)
pub fn ungetbytes_unmeta(s: &[u8]) {
    // c:366
    let mut i = s.len(); // c:366 s += len
    while i > 0 {
        // c:369 while (len--)
        // c:370 — `if (len && s[-2] == Meta)`. We check the byte
        // BEFORE the current s-1 position. After `*--s`, the index
        // becomes i-1. So `s[-2]` is `s[i-2]`.
        if i >= 2 && s[i - 2] == 0x83 {
            // c:370 Meta = 0x83
            // c:371-373 — decode Meta-escape: emit (s[i-1] XOR 32),
            // skip the Meta byte.
            ungetbyte(s[i - 1] ^ 32);
            i -= 2;
        } else {
            // c:375 — emit raw byte.
            ungetbyte(s[i - 1]);
            i -= 1;
        }
    }
}

// `ZleReadFlags` deleted — Rust-only struct wrapping what C carries
// as bare `int flags` with `ZLRF_HISTORY` / `ZLRF_NOSETTY` /
// `ZLRF_IGNOREEOF` bits (Src/zsh.h:3203-3205). The fake fields
// (no_history / completion / vared) had no C counterpart; C uses
// `!(zlereadflags & ZLRF_HISTORY)` inline for the no-history test
// and a separate `zlecontext == ZLCON_VARED` check for vared mode.
// `zlereadflags` is now `i32` matching C's `int zlereadflags`
// (Src/Zle/zle_main.c:90).

// `ZleContext` deleted — Rust-named enum duplicating the legit C
// enum at Src/zsh.h:3211-3216 (`ZLCON_LINE_START` / `ZLCON_LINE_CONT`
// / `ZLCON_SELECT` / `ZLCON_VARED`), already ported in zsh_h.rs:3162-3165.
// `ZLECONTEXT` is now an `AtomicI32` static matching C's `int
// zlecontext` (zle_main.c:163).

// RUST-ONLY sync watermarks for the zleread ZLE-history adapter (see
// the ZLRF_HISTORY block in zleread): the last (firsthist, curhist)
// pair the navigation list was synced against. C needs none of this —
// its ZLE walks the live ring; the adapter list must not be rebuilt
// (566k entries) on every prompt.
static ZLE_HIST_SYNC_FIRST: std::sync::atomic::AtomicI64 = std::sync::atomic::AtomicI64::new(-1);
static ZLE_HIST_SYNC_CUR: std::sync::atomic::AtomicI64 = std::sync::atomic::AtomicI64::new(-1);

impl Default for modifier {
    fn default() -> Self {
        // c:1604 initmodifier — mult=1, tmult=1, base=10.
        modifier {
            flags: 0,
            mult: 1,
            tmult: 1,
            vibuf: 0,
            base: 10,
        }
    }
}

/// Port of `breakread(int fd, char *buf, int n)` from Src/Zle/zle_main.c:381.
pub fn breakread(fd: i32, buf: &mut [u8], n: usize) -> isize {
    // c:381
    // C body (c:381-389): `#if defined(pyr) && defined(HAVE_SELECT)`
    // wrapper around select+read for the Pyramid (legacy) build.
    // zshrs targets only modern Unices where read(2) is restartable —
    // direct passthrough via libc::read (no File-from-fd ownership game).
    if n == 0 || buf.is_empty() {
        return 0;
    }
    let count = n.min(buf.len());
    let r = unsafe { libc::read(fd, buf.as_mut_ptr() as *mut libc::c_void, count) };
    r as isize
}

/// Port of `enum ztmouttp` from `Src/Zle/zle_main.c:398`. Discriminator
/// for the active read-timeout source: none, key (do_keytmout), function
/// (timedfns), or maxed-out (re-arm needed).
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[repr(i32)]
#[allow(non_camel_case_types)]
pub enum ztmouttp {
    // c:398
    ZTM_NONE = 0, // c:401
    ZTM_KEY = 1,  // c:406
    ZTM_FUNC = 2, // c:412
    ZTM_MAX = 3,  // c:428
}

// `ModifierFlags` bitflags wrapper deleted — C uses bare `int flags`
// in `struct modifier` (zle.h:246) with the `MOD_*` bit constants
// at zle.h:253-263, already legit-ported in zle_h.rs:371-381.
// modifier.flags is now `i32` matching C verbatim.

/// Direct port of `struct change` from `Src/Zle/zle.h:284-294`.
/// Undo change record. `ChangeFlags` bitflags wrapper deleted —
/// C uses bare `int flags` with `CH_NEXT` (1<<0) and `CH_PREV`
/// (1<<1) bits (zle.h:297-298, ported in zle_h.rs as i32).
// `WatchFd` deleted — duplicate of `struct watch_fd` already legit-
// ported at zle_h.rs:781 (Src/Zle/zle.h:572). The Rust port uses
// `super::zle_h::watch_fd` directly.

// `TimeoutType` / `Timeout` deleted — Rust-named duplicates of the
// legit `ztmouttp` enum + `ztmout` struct already ported at
// `zle_main.c:398/432`. See definitions below.

/// Maximum timeout value (about 24 days in 100ths of a second)
/// Port of `ZMAXTIMEOUT` macro from `Src/Zle/zle_main.c:429`.
/// `#define ZMAXTIMEOUT ((time_t)1 << (sizeof(int)*8-11))`.
/// Maximum keytimeout value clamped before passing to select(2),
/// keeps the (microseconds * 100) product within `time_t` range.
/// On a 32-bit `int` platform: `1 << 21` (~2.1M centiseconds = 21k sec).
pub const ZMAXTIMEOUT: u64 = 1 << 21; // c:429

/// Port of `struct ztmout` from `Src/Zle/zle_main.c:432`. Carries the
/// active timeout type plus expiration in 100ths of a second.
#[derive(Debug, Clone, Copy)]
#[allow(non_camel_case_types)]
pub struct ztmout {
    // c:432
    pub tp: ztmouttp,   // c:434 enum ztmouttp tp
    pub exp100ths: i64, // c:438 time_t exp100ths
}

/// Direct port of `static void calc_timeout(struct ztmout *tmoutp,
/// long do_keytmout, int full)` from `Src/Zle/zle_main.c:454`.
/// Picks the next read timeout based on do_keytmout + the
/// timedfns list. Truncated to the keymap timeout subset until
/// timedfns wiring lands.
fn calc_timeout(do_keytmout: i64) -> ztmout {
    // c:454
    let kt = KEYTIMEOUT.load(SeqCst);
    // c:456 — `if (do_keytmout && (keytimeout > 0 || do_keytmout < 0))`.
    // A negative `do_keytmout` is an explicit timeout in 100ths of a second
    // (termquery.c's probe_terminal passes `TIMEOUT`, -51), honoured
    // whatever `$KEYTIMEOUT` says.
    let mut out = if do_keytmout != 0 && (kt > 0 || do_keytmout < 0) {
        let exp = if do_keytmout < 0 {
            -do_keytmout // c:457-458
        } else if kt > ZMAXTIMEOUT * 100 {
            (ZMAXTIMEOUT * 100) as i64 // c:459-460
        } else {
            kt as i64 // c:462
        };
        ztmout {
            tp: ztmouttp::ZTM_KEY,
            exp100ths: exp,
        }
    } else {
        ztmout {
            tp: ztmouttp::ZTM_NONE,
            exp100ths: 0,
        }
    };

    // c:465-491 — fold in the timedfns list (the `sched` wakeups register
    // there via addtimedfn). The list is time-sorted, so the head is the
    // soonest deadline. If it is due sooner than the key timeout — or there
    // is no key timeout at all — the read must wake at that deadline and run
    // the function; otherwise a `sched +N …` armed while sitting idle at the
    // prompt (e.g. zinit turbo's `@zinit-scheduler following` chain) never
    // fires until the next keypress. Without this the input loop blocks
    // forever in read() and the turbo scheduler stalls after a handler abort.
    if let Some(&(when, _)) = crate::ported::utils::TIMED_FNS.lock().unwrap().first() {
        let now = unsafe { libc::time(std::ptr::null_mut()) } as i64;
        let diff = (when - now).max(0);
        let exp100 = diff.saturating_mul(100);
        if out.tp == ztmouttp::ZTM_NONE || exp100 < out.exp100ths {
            out.tp = ztmouttp::ZTM_FUNC;
            out.exp100ths = exp100;
        }
    }
    out
}

/// Read one byte from the input queue (or stdin) with optional
/// keymap-timeout semantics.
/// Port of `raw_getbyte(long do_keytmout, char *cptr, int full)` from Src/Zle/zle_main.c:506.
/// Reads the terminal only; pushed-back bytes are served by `getbyte`
/// (c:880-881) before it calls here. A poll/select wait against SHTTY honouring
/// `do_keytmout * KEYTIMEOUT`. Returns None on timeout/EOF — the
/// C source uses EOF as the same sentinel.
/// WARNING: param names don't match C — Rust=(do_keytmout) vs C=(do_keytmout, cptr, full)
pub fn raw_getbyte(do_keytmout: i64) -> Option<u8> {
    use std::os::unix::io::AsRawFd;

    let mut timeout = calc_timeout(do_keytmout);
    let have_timeout = timeout.tp != ztmouttp::ZTM_NONE;

    // c:531-577 — ZLE reads keystrokes from SHTTY, never fd 0. init.rs relocated
    // the terminal to a high, FD_CLOEXEC fd via movefd precisely so that fd-0
    // redirection (a `$(...)`, an external command's stdin) cannot break keyboard
    // input. Reading io::stdin() (fd 0) here re-exposed that hazard: once a command
    // substitution left a pipe on fd 0, raw_getbyte blocked forever on a dead fd
    // while the tty still delivered SIGINT — hang with only C-c alive. Read SHTTY;
    // fall back to fd 0 only when SHTTY is unset (non-interactive).
    let shtty = {
        let fd = SHTTY.load(Ordering::Relaxed);
        if fd >= 0 {
            fd
        } else {
            io::stdin().as_raw_fd()
        }
    };

    // c:531-577 — poll SHTTY together with any `zle -F` watched fds,
    // dispatching their handlers as they fire. Replaces a busy-wait sleep
    // loop with a real poll(2).
    let initial_nwatch = WATCH_FDS.lock().map(|t| t.len()).unwrap_or(0);

    // c:532 — `if (nwatch || tmout.tp != ZTM_NONE)`.
    if initial_nwatch > 0 || have_timeout {
        let ready = libc::POLLIN | libc::POLLERR | libc::POLLHUP | libc::POLLNVAL;
        // c:302-303 — a watched fd that reports POLLERR/POLLHUP/POLLNVAL is dead
        // (peer write end closed). C marks it `fds[i+1].events = 0` so it is
        // serviced ONCE then never polled again. The port rebuilds the poll set
        // from WATCH_FDS each pass, so it needs a persistent skip-set instead;
        // without it a hung-up fd (e.g. zinit's @zinit-scheduler pipe, whose
        // handler aborts on a nomatch before its `zle -F $fd; exec {fd}<&-`
        // self-removal) re-fires every pass forever, starving the SHTTY read →
        // input hang.
        let mut dont_poll_fds: Vec<i32> = Vec::new();
        loop {
            // Recompute the timeout each pass: a fired watch-fd handler or a
            // just-run timed function may have armed a new `sched` wakeup with
            // a different deadline (or cleared the last one). c:604 recomputes
            // `calc_timeout` inside the poll loop for exactly this reason.
            timeout = calc_timeout(do_keytmout);
            let have_to = timeout.tp != ztmouttp::ZTM_NONE;
            // Re-snapshot WATCH_FDS on EVERY pass. A fired `zle -F` handler
            // may add, remove, or CLOSE a watched fd: zinit's
            // @zinit-scheduler runs `zle -F $fd; exec {fd}<&-`, removing its
            // handler and closing the fd. Polling a STALE snapshot would then
            // see the now-closed fd as POLLNVAL and re-fire the handler, which
            // does `zle -F` on an fd that is no longer watched → the
            // "No handler installed for fd N" warning (and a spurious re-run
            // of the scheduler). Rebuilding each pass reflects the handler's
            // mutations to the same WATCH_FDS the poll set is derived from.
            let watches: Vec<(i32, String, i32, u64)> = WATCH_FDS
                .lock()
                .unwrap()
                .iter()
                .filter(|w| !dont_poll_fds.contains(&w.fd))
                .map(|w| (w.fd, w.func.clone(), w.widget, w.gen))
                .collect();
            // c:565-577 — pollfd array: SHTTY first, then each watch fd.
            let mut fds: Vec<libc::pollfd> = Vec::with_capacity(1 + watches.len());
            fds.push(libc::pollfd {
                fd: shtty,
                events: libc::POLLIN,
                revents: 0,
            });
            for w in &watches {
                fds.push(libc::pollfd {
                    fd: w.0,
                    events: libc::POLLIN,
                    revents: 0,
                });
            }
            // c:579-583 — poll timeout in ms (-1 = block forever).
            let poll_timeout: libc::c_int = if have_to {
                (timeout.exp100ths * 10) as libc::c_int
            } else {
                -1
            };
            // c:588-590 — `winch_unblock(); selret = poll(...); winch_block();`
            // SIGWINCH is BLOCKED for the whole prompt cycle (preprompt,
            // Src/utils.c:1538-1543, unblocks then re-blocks it), and C
            // opens exactly this window — the blocking wait for input — for
            // a resize to be delivered. The port dropped both calls, so a
            // SIGWINCH raised while ZLE waited for a key was held pending
            // indefinitely: `zhandler` never ran, `adjustwinsize` never ran,
            // and nothing repainted after the terminal reflowed.
            crate::ported::signals_h::winch_unblock(); // c:588
            let selret =
                unsafe { libc::poll(fds.as_mut_ptr(), fds.len() as libc::nfds_t, poll_timeout) };
            crate::ported::signals_h::winch_block(); // c:590

            // c:632-634 — let a user interrupt through immediately.
            if selret < 0 && crate::ported::utils::errflag.load(Ordering::SeqCst) != 0 {
                // c:630-631 then c:825 — C breaks out of the poll loop and
                // `return selret`, a NEGATIVE value: getbyte's errno arm
                // (EINTR here) turns it into EOF without exiting the shell.
                RAW_GETBYTE_ERRNO.store(
                    std::io::Error::last_os_error().raw_os_error().unwrap_or(0),
                    Ordering::SeqCst,
                );
                RAW_GETBYTE_R.store(-1, Ordering::SeqCst);
                return None;
            }
            // c:638-643 — EINTR retries; any other poll error gives up.
            if selret < 0 {
                let e = std::io::Error::last_os_error().raw_os_error();
                if e == Some(libc::EINTR) {
                    crate::signal_queue_guard::settle_deferred_signals(shtty);
                    continue;
                }
                // c:825 — `return selret`, negative: an error, not EOF.
                RAW_GETBYTE_ERRNO.store(e.unwrap_or(0), Ordering::SeqCst);
                RAW_GETBYTE_R.store(-1, Ordering::SeqCst);
                return None;
            }
            // c:646-660 — timed out, nothing ready.
            if selret == 0 {
                // c:648-658 — a ZTM_FUNC deadline means a timed function (the
                // `sched` wakeup) is due: run it and keep waiting for a key.
                // Only a ZTM_KEY (keymap) timeout ends the read. checksched()
                // drains every due `sched` command and re-arms the timedfn for
                // the next one, so one call fully services this deadline; the
                // loop then recomputes calc_timeout for whatever it armed.
                if timeout.tp == ztmouttp::ZTM_FUNC {
                    crate::ported::builtins::sched::checksched();
                    continue;
                }
                // c:656-657 — `selret = -2`, "nothing ready": a key timeout,
                // NOT EOF. getbyte returns EOF to the caller and the shell
                // stays alive.
                RAW_GETBYTE_R.store(-2, Ordering::SeqCst);
                return None;
            }
            // c:710-714 — terminal input ready: break out and read it.
            if fds[0].revents & ready != 0 {
                break;
            }
            // c:715-772 — service each ready watch fd's handler.
            let mut fired_any = false;
            for (i, w) in watches.iter().enumerate() {
                let re = fds[i + 1].revents;
                if re & ready == 0 {
                    continue;
                }
                let fdbuf = w.0.to_string(); // c:739 — convbase(buf, fd, 10)
                if w.2 != 0 {
                    // c:747-748 — call the handler as a widget.
                    crate::ported::zle::zle_utils::zlecallhook(&w.1, Some(&fdbuf));
                } else {
                    // c:750-771 — call as a function: name, fd, then flags.
                    let mut args: Vec<String> = vec![w.1.clone(), fdbuf];
                    if re & libc::POLLERR != 0 {
                        args.push("err".to_string()); // c:758
                    }
                    if re & libc::POLLHUP != 0 {
                        args.push("hup".to_string()); // c:762
                    }
                    if re & libc::POLLNVAL != 0 {
                        args.push("nval".to_string()); // c:766
                    }
                    crate::ported::utils::callhookfunc(&w.1, Some(&args), 0, std::ptr::null_mut());
                    // c:770
                }
                // c:776-778 — clear any handler error; nothing to recover.
                crate::ported::utils::errflag
                    .fetch_and(!crate::ported::zsh_h::ERRFLAG_ERROR, Ordering::SeqCst);
                // c:302-303 — this fd hung up / errored. C sets `fds[i+1].events
                // = 0` to skip it for the rest of THIS getbyte, relying on the
                // handler's own `zle -F $fd; exec {fd}<&-` to remove it for good.
                // When the handler aborts before that (e.g. zinit's
                // @zinit-scheduler hitting a nomatch), the fd stays in WATCH_FDS
                // and is re-serviced once per getbyte forever — a fork+redraw
                // churn that never lets the prompt settle. A POLLHUP/POLLNVAL fd
                // is permanently dead (peer write end closed / fd invalid), so
                // drop its watcher here; POLLERR alone only skips for the call
                // (transient errors may clear). Without this the shell hangs.
                //
                // But the handler routinely closes this fd and re-arms a fresh
                // watcher (zinit turbo: `zle -F $fd; exec {fd}<&-; exec {new}<
                // <(...); zle -F $new $handler`), and the OS hands back the same
                // fd number for `$new`. Removing by fd number alone would delete
                // that re-armed watcher and stall the turbo scheduler after one
                // task. Key the removal on the fired watcher's `gen` id so only
                // the exact dead watcher is dropped, never a handler-reinstalled
                // one on the reused number.
                if re & (libc::POLLHUP | libc::POLLNVAL) != 0 {
                    // Drop only the exact dead watcher. If the handler re-armed
                    // a fresh one on the reused fd number it has a new `gen` and
                    // survives — and must stay pollable THIS getbyte so idle-time
                    // turbo draining continues, so it is NOT added to
                    // `dont_poll_fds`. The gen-keyed retain already prevents the
                    // dead fd from being re-serviced (it is gone from WATCH_FDS,
                    // hence absent from the next re-snapshot).
                    WATCH_FDS
                        .lock()
                        .unwrap()
                        .retain(|x| !(x.fd == w.0 && x.gen == w.3));
                } else if re & libc::POLLERR != 0 {
                    dont_poll_fds.push(w.0);
                }
                fired_any = true;
            }
            // c:787-788 — `/* Function may have invalidated the display. */
            //              if (resetneeded) zrefresh();`
            // A `zle -F` handler routinely repaints state — e.g.
            // zsh-autosuggestions' async response handler reads the
            // suggestion from its fd and runs `zle autosuggest-suggest`
            // (POSTDISPLAY + region_highlight). Without this refresh the
            // ghost text only appeared on the NEXT keystroke's frame —
            // async suggestions permanently lagged one key behind.
            if fired_any {
                crate::ported::zle::zle_refresh::zrefresh();
            }
            // loop: re-poll now that the handlers have run.
        }
        // c:560 — terminal input is ready; read one byte. Use a RAW
        // unbuffered `read(2)`, NOT Rust's `io::stdin()` (which wraps an
        // internal BufReader that slurps the rest of an escape sequence
        // into its private buffer — invisible to the poll above — so the
        // next byte never arrives and multi-byte keys like arrows break).
        let mut buf = [0u8; 1];
        // c:915-918 — EINTR with no pending shell condition retries the
        // read instead of reporting EOF (see the simple-read path below
        // for the full rationale; SIGCHLD from prompt-segment
        // subprocesses interrupts this read constantly).
        let mut eintr_retries = 0i32;
        let mut die = false; // c:865 — bounds the EIO tty-reattach retry to one pass
        let n = loop {
            // c:850-852 — `winch_unblock(); ret = read(SHTTY, cptr, 1);
            // winch_block();` (and the identical c:837-839 pair on the
            // timed-read path). Same window as the poll above.
            crate::ported::signals_h::winch_unblock(); // c:850
            let n = unsafe { libc::read(shtty, buf.as_mut_ptr() as *mut libc::c_void, 1) };
            let errno = std::io::Error::last_os_error().raw_os_error();
            // Publish the read's errno HERE: winch_block() below (and any
            // later call) may clobber the real one before getbyte branches.
            RAW_GETBYTE_ERRNO.store(errno.unwrap_or(0), Ordering::SeqCst);
            crate::ported::signals_h::winch_block(); // c:852
            // c:917 — retry a signal-interrupted read unless a shell condition
            // is pending. On macOS/BSD a blocking tty read interrupted by a
            // signal (SIGCHLD from p10k's per-prompt subprocesses) can return
            // 0 with errno=EINTR — Linux returns -1. Treating that 0 as hard
            // EOF aborted the read mid-escape-sequence, so arrow keys (\e[A …)
            // self-inserted. Retry BOTH the -1 and the spurious-0 EINTR case.
            // Only the zero-byte case is bounded (to 20, C's getbyte icnt
            // guard) — see the simple-read path below for why the -1 case
            // must not be.
            if (n == -1 || n == 0)
                && errno == Some(libc::EINTR)
                && (n == -1 || eintr_retries < 20)
                // c:917 — `if (!errflag && …)`: the WHOLE errflag, not just
                // ERRFLAG_ERROR. A user interrupt sets ERRFLAG_INT
                // (signals.c:457), so masking with ERRFLAG_ERROR retried the
                // read after ^C and the editor stayed blocked until the next
                // keystroke — the aborted line kept its text on screen and no
                // fresh prompt appeared until a key was pressed.
                && crate::ported::utils::errflag.load(Ordering::Relaxed) == 0
                && crate::ported::builtin::RETFLAG.load(Ordering::Relaxed) == 0
                && crate::ported::builtin::BREAKS.load(Ordering::Relaxed) == 0
                && crate::ported::builtin::EXIT_PENDING.load(Ordering::Relaxed) == 0
            {
                // c:914 — `icnt = 0;`: a real interruption resets the count.
                eintr_retries = if n == 0 { eintr_retries + 1 } else { 0 };
                crate::signal_queue_guard::settle_deferred_signals(shtty);
                continue; // c:917 — retry the interrupted read
            }
            // c:929-936 — EIO means the shell lost the terminal's foreground
            // process group (a completer helper subprocess got the tty via
            // tcsetpgrp under job control and exited without restoring it).
            // C reattaches (attachtty(mypgrp)) with MONITOR forced on,
            // repaints, and retries once (bounded by `die`) rather than
            // reporting EOF. See the simple-read path below for the full
            // rationale — without this, tar/docker <tab> exited the editor.
            if n == -1 && errno == Some(libc::EIO) && !die {
                let mon = crate::ported::zsh_h::isset(crate::ported::zsh_h::MONITOR); // c:929
                crate::ported::options::opt_state_set("monitor", true); // c:930
                crate::ported::utils::attachtty(
                    crate::ported::modules::clone::mypgrp.load(Ordering::Relaxed),
                ); // c:931
                crate::ported::zle::zle_refresh::zrefresh(); // c:932
                crate::ported::options::opt_state_set("monitor", mon); // c:933
                die = true; // c:934
                continue; // c:865 for(;;) re-reads after the reattach
            }
            break n;
        };
        if n != 1 {
            tracing::warn!(
                "DIAG raw_getbyte poll-path returns None (EOF): read({})=={} errno={}",
                shtty,
                n,
                std::io::Error::last_os_error().raw_os_error().unwrap_or(0)
            );
        }
        // c:854 — `return ret`: 1 (byte), 0 (EOF) or -1 (error) verbatim.
        RAW_GETBYTE_R.store(n as i32, Ordering::SeqCst);
        return if n == 1 { Some(buf[0]) } else { None };
    }

    // c:560 — no watches and no timeout: a simple blocking read. Outside a
    // live ZLE session (e.g. unit tests) stdin may be in canonical mode,
    // where a bare read blocks until a full line; detect that via isatty +
    // ICANON and return None instead of deadlocking. Only the C-faithful
    // blocking read runs when the fd is genuinely in raw mode.
    let mut buf = [0u8; 1];
    let is_tty = unsafe { libc::isatty(shtty) } != 0;
    let in_raw_mode = if is_tty {
        let mut t: libc::termios = unsafe { std::mem::zeroed() };
        if unsafe { libc::tcgetattr(shtty, &mut t) } == 0 {
            (t.c_lflag & libc::ICANON) == 0
        } else {
            false
        }
    } else {
        // Pipe / file / closed — read returns Ok(0) on EOF immediately.
        true
    };
    if !in_raw_mode {
        RAW_GETBYTE_R.store(-2, Ordering::SeqCst);
        tracing::warn!(
            "DIAG raw_getbyte simple-read returns None (EOF): NOT in raw mode. shtty={} is_tty={}",
            shtty,
            is_tty
        );
        return None;
    }
    // RAW unbuffered read (see the poll-path note above): going through
    // `io::stdin()`'s BufReader would swallow trailing escape-sequence
    // bytes into a buffer the poll/typeahead path can't see.
    // c:915-918 — `if (errno == EINTR) { die = 0; if (!errflag &&
    // !retflag && !breaks && !exit_pending) continue; }` — a read
    // interrupted by a signal (SIGCHLD from prompt-segment
    // subprocesses, SIGWINCH, …) RETRIES unless a shell condition is
    // pending. Returning None here treated every EINTR as EOF: the
    // editor abandoned the read and the pending keystroke was lost
    // (native-p10k renders spawn subprocesses per prompt, so SIGCHLD
    // made this fire constantly).
    let mut eintr_retries = 0i32;
    let mut die = false; // c:865 — bounds the EIO tty-reattach retry to one pass
    let n = loop {
        // c:850-852 — `winch_unblock(); ret = read(SHTTY, cptr, 1);
        // winch_block();` See the poll-path pair above: this is the other
        // window C opens for a resize while ZLE waits for input.
        crate::ported::signals_h::winch_unblock(); // c:850
        let n = unsafe { libc::read(shtty, buf.as_mut_ptr() as *mut libc::c_void, 1) };
        let errno = std::io::Error::last_os_error().raw_os_error();
        // See the poll-path read above: capture before winch_block().
        RAW_GETBYTE_ERRNO.store(errno.unwrap_or(0), Ordering::SeqCst);
        crate::ported::signals_h::winch_block(); // c:852
        // c:917 — retry a signal-interrupted read unless a shell condition is
        // pending. On macOS/BSD a blocking tty read interrupted by a signal
        // (SIGCHLD from p10k's per-prompt subprocesses) can return 0 with
        // errno=EINTR — Linux returns -1. Treating that spurious 0 as hard EOF
        // aborted the read mid-escape-sequence, so arrow keys (\e[A, \e[B, …)
        // self-inserted as literal `^[[A`. Retry BOTH the -1 and the 0 EINTR
        // case. This was the "all arrow keys broken" regression.
        //
        // Only the zero-byte case is bounded — to 20, C's getbyte icnt guard
        // (c:907), so a genuine hangup EOF still terminates. A real
        // interruption (-1/EINTR) is retried without limit, exactly as C's
        // getbyte `continue`s at c:917-918 with no counter (and resets icnt at
        // c:914). Bounding it too made every 21st consecutive signal during
        // one idle read end the read as EOF, and the shell exited: under
        // `TMOUT=1` with a TRAPALRM, zshrs died after 21 alarms (about 21
        // idle seconds) while zsh ran the trap indefinitely.
        if (n == -1 || n == 0)
            && errno == Some(libc::EINTR)
            && (n == -1 || eintr_retries < 20)
            // c:917 — the WHOLE errflag, as in the poll-path read above:
            // ERRFLAG_INT (a user interrupt, signals.c:457) has to end the
            // read too, otherwise ^C leaves the editor blocked.
            && crate::ported::utils::errflag.load(Ordering::Relaxed) == 0
            && crate::ported::builtin::RETFLAG.load(Ordering::Relaxed) == 0
            && crate::ported::builtin::BREAKS.load(Ordering::Relaxed) == 0
            && crate::ported::builtin::EXIT_PENDING.load(Ordering::Relaxed) == 0
        {
            // c:914 — `icnt = 0;`: a real interruption resets the count.
            eintr_retries = if n == 0 { eintr_retries + 1 } else { 0 };
            crate::signal_queue_guard::settle_deferred_signals(shtty);
            continue; // c:917 — retry the interrupted read
        }
        // c:929-936 — `else if (errno == EIO && !die) { ret = opts[MONITOR];
        // opts[MONITOR] = 1; attachtty(mypgrp); zrefresh(); opts[MONITOR] =
        // ret; die = 1; }`. A read that fails with EIO means the shell is no
        // longer the foreground process group of its controlling terminal: a
        // completer helper (tar/docker `_call_program` subprocess run under
        // job control) was granted the tty via tcsetpgrp and exited without
        // handing it back, so ttpgrp != mypgrp and read() → EIO. C does NOT
        // treat this as EOF — it forces MONITOR on so attachtty runs, reclaims
        // the tty for the shell pgrp, repaints, and retries the read once
        // (bounded by `die`). Returning None here instead made ZLE see a
        // spurious EOF and exit the line editor mid-completion (tar/docker
        // <tab> drew the match list then the shell terminated).
        if n == -1 && errno == Some(libc::EIO) && !die {
            let mon = crate::ported::zsh_h::isset(crate::ported::zsh_h::MONITOR); // c:929
            crate::ported::options::opt_state_set("monitor", true); // c:930
            crate::ported::utils::attachtty(
                crate::ported::modules::clone::mypgrp.load(Ordering::Relaxed),
            ); // c:931
            crate::ported::zle::zle_refresh::zrefresh(); // c:932
            crate::ported::options::opt_state_set("monitor", mon); // c:933
            die = true; // c:934
            continue; // c:865 for(;;) re-reads after the reattach
        }
        break n;
    };
    // c:854 — `return ret` verbatim: 1, 0 (EOF) or -1 (error).
    RAW_GETBYTE_R.store(n as i32, Ordering::SeqCst);
    if n == 1 {
        Some(buf[0])
    } else {
        tracing::warn!(
            "DIAG raw_getbyte simple-read returns None (EOF): read({})=={} errno={}",
            shtty,
            n,
            std::io::Error::last_os_error().raw_os_error().unwrap_or(0)
        );
        None
    }
}

/// Read one byte from input with the kernel's CR/LF swap reversed.
/// Port of `getbyte(long do_keytmout, int *timeout, int full)` from Src/Zle/zle_main.c:861. The C source's
/// `\n` ↔ `\r` swap is the inverse of the IO mapping that
/// zsetterm() installs (`tio.c_iflag |= INLCR | ICRNL`) so the
/// keymap dispatcher always sees a consistent newline byte. The
/// final byte is also stashed in `lastchar` for widgets that
/// inspect what triggered them (digit-argument, vi-find-char).
/// Rust idiom replacement: delegates to `raw_getbyte` (which owns
/// the live read path) + a small \n↔\r typeahead swap; the C
/// `timeout`/`full` args are folded into the raw reader.
/// WARNING: param names don't match C — Rust=(do_keytmout) vs C=(do_keytmout, timeout, full)
pub fn getbyte(do_keytmout: i64) -> Option<u8> {
    // c:877 — `lastchar_wide_valid = 0;` at entry. Every byte read
    // invalidates the cached wide character so the next `selfinsert`
    // (zle_misc.c:119) refills `lastchar_wide` from the FRESH `lastchar`
    // instead of reinserting the previous key. Without this, the first
    // key set the wide cache and every subsequent self-insert re-emitted
    // it (typing "world" produced "wwwwwww").
    LASTCHAR_WIDE_VALID.store(0, SeqCst);
    // c:889-938 — the read dispatch. A missing byte is not one condition
    // but four, and C treats them differently; see RAW_GETBYTE_R for how
    // the port carries the distinction across `Option<u8>`.
    // c:884-887 —
    // ```c
    //     int q = queue_signal_level();
    //     dont_queue_signals();
    //     r = raw_getbyte(do_keytmout, &cc, full);
    //     restore_queue_signals(q);
    // ```
    // The main loop runs with a queueing BASELINE of 1 (init.c:118
    // `queue_signals()`, matched at init.rs:2085), so without dropping the
    // level across the blocking read every signal that arrives while ZLE waits
    // for a key is pushed onto the deferred queue by zhandler
    // (signals.c:410-424) and never acted on. ^C at the prompt did nothing at
    // all: the handler ran, saw queueing_enabled == 1, queued SIGINT, and the
    // line kept its buffer — where zsh clears the line, runs TRAPINT and sets
    // $ZLE_LINE_ABORTED. `dont_queue_signals()` also DRAINS what is already
    // queued (run_queued_signals), which is how a SIGCHLD that arrived during
    // the previous keystroke gets reaped here.
    // c:865 — `for (;;)`: the read is retried for IGNOREEOF and EINTR, so
    // the signal-queue dance belongs INSIDE the loop, as in C.
    let mut icnt = 0i32; // c:866 — bounds the IGNOREEOF retries
    // c:880-881 — `if (kungetct) ret = kungetbuf[--kungetct]; else { … }`:
    // a pushed-back byte (`zle -U`, ungetbytes) is returned as it is. Only a
    // byte read from the terminal goes through the \r/\n exchange below.
    let ungot = KUNGETBUF.lock().unwrap().pop_front();
    let from_tty = ungot.is_none();
    let b = if let Some(u) = ungot { u } else { loop {
        let q = crate::ported::signals_h::queue_signal_level();
        crate::ported::signals_h::dont_queue_signals();
        let raw = raw_getbyte(do_keytmout);
        crate::ported::signals_h::restore_queue_signals(q);
        if let Some(b) = raw {
            break b; // c:894 — `if (r == 1) break;`
        }
        let r = RAW_GETBYTE_R.load(SeqCst);
        // c:888-893 — `if (r == -2) { *timeout = 1; return lastchar = EOF; }`
        // A key timeout ends this read and nothing more.
        if r == -2 {
            LASTCHAR.store(-1, SeqCst); // c:892 — `lastchar = EOF` (EOF == -1)
            return None;
        }
        if r == 0 {
            // c:895-908 — read() returned 0: the terminal is at EOF.
            //
            //   "shells that lost their xterm (e.g. if it was killed with -9)
            //    didn't fail to read from the terminal but instead happily
            //    continued to read EOFs, so that the above read returned with
            //    0, and, with IGNOREEOF set, this caused an infinite loop.
            //    The simple way around this was to add the counter (icnt) so
            //    that this happens 20 times and than the shell gives up"
            //
            // c:907 — under IGNOREEOF the first 20 EOFs are ignored (a ^D
            // typed while a command ran), and the 21st is fatal.
            if (ZLEREADFLAGS.load(SeqCst) & crate::ported::zsh_h::ZLRF_IGNOREEOF) != 0 && icnt < 20
            {
                icnt += 1;
                continue;
            }
            // c:909-910 — `stopmsg = 1; zexit(1, ZEXIT_NORMAL);`. THIS is what
            // terminates a shell whose terminal has gone away: without it the
            // EOF is handed back to the caller, and any caller that keeps
            // editing (a non-empty line, or IGNOREEOF) reads EOF again
            // immediately — a 100%-CPU loop that never ends.
            // RUST-ONLY GATE: C reaches getbyte only from a live interactive
            // ZLE session, so `interact` is always true there. In this port
            // getbyte is also reachable from unit tests, whose stdin is a pipe
            // at EOF — exiting the process would kill the test harness.
            if crate::ported::zsh_h::interact() {
                crate::ported::builtin::STOPMSG.store(1, SeqCst); // c:909
                crate::ported::builtin::zexit(1, crate::ported::zsh_h::ZEXIT_NORMAL);
                // c:912 — "If called from an exit hook, zexit() returns, so:"
            }
            LASTCHAR.store(-1, SeqCst);
            return None;
        }
        // r < 0: a read error. c:914 — `icnt = 0` (only EOFs accumulate).
        icnt = 0;
        let e = RAW_GETBYTE_ERRNO.load(SeqCst);
        // c:915-921 — EINTR with a shell condition pending (or none of the
        // above) reports EOF to the caller; the bare retry already happened
        // inside raw_getbyte, which owns the read loop in this port.
        if e == libc::EINTR || e == 0 {
            LASTCHAR.store(-1, SeqCst); // c:920 — `return lastchar = EOF`
            return None;
        }
        // c:922-923 — `else if (errno == EWOULDBLOCK) fcntl(0, F_SETFL, 0);`
        // A non-blocking fd 0 inherited from whoever started the shell: clear
        // the flag and read again rather than treating it as a failure.
        if e == libc::EWOULDBLOCK || e == libc::EAGAIN {
            unsafe { libc::fcntl(0, libc::F_SETFL, 0) }; // c:923
            continue;
        }
        // c:931-937 — every other TTY read error is fatal, EIO included: the
        // one-shot reattach for EIO already ran inside raw_getbyte (c:924-930,
        // bounded by its `die` flag), so reaching here means it did not help.
        // Same interactive gate as the EOF arm above.
        if crate::ported::zsh_h::interact() {
            crate::ported::utils::zerrmsg("error on TTY read: %e", Some(e)); // c:932
            crate::ported::builtin::STOPMSG.store(1, SeqCst); // c:933
            crate::ported::builtin::zexit(1, crate::ported::zsh_h::ZEXIT_NORMAL); // c:934
        }
        LASTCHAR.store(-1, SeqCst); // c:936 — zexit returns from an exit hook
        return None;
    } };

    // c:940-943 — undo the exchange of \n and \r determined by zsetterm().
    let b = if from_tty && b == b'\n' {
        b'\r'
    } else if from_tty && b == b'\r' {
        b'\n'
    } else {
        b
    };

    // c:947-955 — `curvichg.buf` is raw bytes, not wide characters, so
    // the byte just read is recorded here while a vi change (`.`) is
    // being tracked (`vichgflag` set). C grows the buffer by doubling
    // `bufsz` when full, then `curvichg.buf[curvichg.bufptr++] = ret`.
    // The append uses the post-swap byte, matching C's `ret`/`lastchar`.
    if VICHGFLAG.load(SeqCst) != 0 {
        let mut cur = CURVICHG.lock().unwrap();
        if cur.bufptr == cur.bufsz {
            cur.bufsz *= 2; // c:953 — realloc(buf, bufsz *= 2)
        }
        // c:954 — `buf[bufptr++] = ret`. bufptr tracks the in-use size;
        // startvichange keeps buf.len() == bufptr, so this appends.
        let idx = cur.bufptr as usize;
        if idx < cur.buf.len() {
            cur.buf[idx] = b;
        } else {
            cur.buf.push(b);
        }
        cur.bufptr += 1;
    }

    LASTCHAR.store((b as i32) as i32, SeqCst);
    Some(b)
}

/// Read one complete (possibly multi-byte) character from input.
/// Port of `getfullchar(int do_keytmout)` from Src/Zle/zle_main.c:967. The C
/// source delegates to `getrestchar()` (zle_main.c:990) for the
/// wide-char assembly when the lead byte signals a UTF-8 sequence.
/// Our Rust port reads continuation bytes directly until the UTF-8
/// envelope is complete, then `str::from_utf8` produces the char.
/// Updates `lastchar_wide` so widgets can inspect the triggering
/// codepoint regardless of byte width.
/// ```c
/// int
/// getfullchar(int do_keytmout)
/// {
///     int inchar = getbyte((long)do_keytmout, NULL, 1);
///     return getrestchar(inchar, NULL, NULL);
/// }
/// ```
pub fn getfullchar(do_keytmout: bool) -> Option<char> {
    // c:967
    let inchar = getbyte(do_keytmout as i64).map(|b| b as i32).unwrap_or(-1); // c:969
    let r = getrestchar(inchar); // c:972
    if r < 0 {
        None
    } else {
        char::from_u32(r as u32)
    }
}

/// Port of `int getrestchar(int inchar, char *outstr, int *outcount)`
/// from `Src/Zle/zle_main.c:990`. Given the first byte returned by
/// `getbyte`, feeds bytes one at a time to `mbrtowc` until the
/// character is complete, then writes it to `lastchar_wide` and
/// returns it.
///
/// ```c
/// mod_export ZLE_INT_T
/// getrestchar(int inchar, char *outstr, int *outcount)
/// {
///     char c = inchar;
///     wchar_t outchar;
///     int timeout;
///     static mbstate_t mbs;
///
///     lastchar_wide_valid = 1;
///     if (outcount) *outcount = 0;
///     if (inchar == EOF) { memset(&mbs, 0, sizeof mbs); return lastchar_wide = WEOF; }
///
///     while (1) {
///         size_t cnt = mbrtowc(&outchar, &c, 1, &mbs);
///         if (cnt == MB_INVALID) { memset(&mbs, 0, sizeof mbs); return lastchar_wide = WEOF; }
///         if (cnt != MB_INCOMPLETE) break;
///         inchar = getbyte(1L, &timeout, 1);
///         lastchar_wide_valid = 1;
///         if (inchar == EOF) {
///             memset(&mbs, 0, sizeof mbs);
///             if (timeout) { lastchar = '?'; return lastchar_wide = L'?'; }
///             else return lastchar_wide = WEOF;
///         }
///         c = inchar;
///         if (outstr) { *outstr++ = c; (*outcount)++; }
///     }
///     return lastchar_wide = (ZLE_INT_T)outchar;
/// }
/// ```
///
/// The conversion is `mbrtowc` and therefore LOCALE-DRIVEN, which is the
/// whole of zsh's byte-vs-multibyte behaviour on the input path: under
/// `LC_ALL=C` (`MB_CUR_MAX == 1`) `mbrtowc` consumes exactly one byte and
/// hands back that byte's value, so typing `Ã` (`c3 83`) puts TWO
/// characters — U+00C3 and U+0083 — in the line, exactly as zsh does.
/// Under a UTF-8 locale the same call assembles the full sequence into
/// one character. An earlier port hard-coded the UTF-8 lead/continuation
/// arithmetic here, so it produced one character in EVERY locale and
/// every multibyte line diverged from zsh under `LC_ALL=C` — on the
/// character count, on `$CURSOR`, and on the `<00xx>` rendering of the
/// bytes the C locale leaves unprintable.
///
/// Two deliberate deviations, both forced by the surrounding port:
///   - C's `static mbstate_t mbs` is a file-static; the Rust port uses a
///     zeroed state per call. Equivalent: every exit path out of the C
///     loop leaves `mbs` clean (a complete character consumes its own
///     state; the `MB_INVALID`, EOF and timeout paths all `memset` it).
///   - C's `getbyte(1L, &timeout, 1)` reports via `timeout` whether the
///     rest of the character failed to arrive within `KEYTIMEOUT`, and
///     returns `'?'` for that case (c:1039-1049). This port's `getbyte`
///     has no `timeout` out-parameter, so a truncated character returns
///     `WEOF` — the `timeout == 0` arm — rather than `'?'`.
///
/// WARNING: param names don't match C — Rust=(inchar) vs C=(inchar, outstr, outcount)
pub fn getrestchar(inchar: i32) -> i32 {
    // c:990
    use crate::ported::utils::{mbrtowc, MbStateBuf, MBSTATE_ZERO, MB_INCOMPLETE, MB_INVALID};

    LASTCHAR_WIDE_VALID.store(1, SeqCst); // c:1002
    if inchar < 0 {
        // c:1006 — `if (inchar == EOF)`; the mbstate reset at c:1008 is
        // implicit here since the state is per call.
        LASTCHAR_WIDE.store(-1, SeqCst); // c:1009 — `lastchar_wide = WEOF`
        return -1;
    }

    let mut mbs: MbStateBuf = MBSTATE_ZERO;
    let mut c = inchar as u8; // c:992 — `char c = inchar;`
    loop {
        // c:1016
        let mut outchar: libc::wchar_t = 0;
        // c:1017 — `size_t cnt = mbrtowc(&outchar, &c, 1, &mbs);`
        let cnt = unsafe {
            mbrtowc(
                &mut outchar,
                &c as *const u8 as *const libc::c_char,
                1,
                &mut mbs as *mut MbStateBuf as *mut libc::c_void,
            )
        };
        if cnt == MB_INVALID {
            // c:1018-1024 — invalid input: reset state, WEOF.
            LASTCHAR_WIDE.store(-1, SeqCst); // c:1023
            return -1;
        }
        if cnt != MB_INCOMPLETE {
            // c:1025-1026 — complete (`cnt == 0` for a NUL lands here too).
            // c:1059 — `return lastchar_wide = (ZLE_INT_T)outchar;`
            LASTCHAR_WIDE.store(outchar as i32, SeqCst);
            return outchar as i32;
        }
        // c:1034 — `inchar = getbyte(1L, &timeout, 1);`
        match getbyte(1) {
            Some(n) => {
                LASTCHAR_WIDE_VALID.store(1, SeqCst); // c:1036
                c = n; // c:1053 — `c = inchar;`
            }
            None => {
                // c:1037-1051 — EOF mid-character. Without a `timeout`
                // out-parameter this is always the `else` arm (WEOF).
                LASTCHAR_WIDE.store(-1, SeqCst); // c:1051
                return -1;
            }
        }
    }
}

/// Run the `zle-line-pre-redraw` widget before a redisplay.
/// Direct port of `void redrawhook(void)` from `Src/Zle/zle_main.c:1066`.
///
/// The previous port pushed the name onto `PENDING_HOOKS`, which nothing
/// in the shell ever drains, so `zle-line-pre-redraw` never ran: a hook
/// that set `$BUFFER` or `$region_highlight` had no effect on the screen.
pub fn redrawhook() {
    // c:1066
    let name = "zle-line-pre-redraw";
    // c:1069 — `if ((initthingy = rthingy_nocreate("zle-line-pre-redraw")))`
    if !crate::ported::zle::zle_thingy::rthingy_nocreate(name) {
        return;
    }
    /* Duplicating most of zlecallhook() to save additional state */
    // c:1071-1076
    let saverrflag = errflag.load(Ordering::Relaxed);
    let savretflag = crate::ported::builtin::RETFLAG.load(Ordering::Relaxed);
    let lastcmd_prev = LASTCMD.load(SeqCst);
    let old_incompfunc = crate::ported::utils::INCOMPFUNC.load(SeqCst);
    let old_viinrepeat = crate::ported::zle::zle_vi::VIINREPEAT.load(SeqCst);
    let lbindk_save = LBINDK.lock().unwrap().clone(); // c:1076-1078
    let bindk_save = BINDK.lock().unwrap().clone(); // c:1076-1079
    // c:1080-1081 — `args[0] = initthingy->nam; args[1] = NULL;`
    let args = vec![name.to_string()];

    /* The generic redraw hook cannot be a completion function, so
     * temporarily reset state for special variable handling etc.
     */
    crate::ported::utils::INCOMPFUNC.store(0, SeqCst); // c:1086
    execzlefunc(name, &args, 1, 0); // c:1087
    crate::ported::utils::INCOMPFUNC.store(old_incompfunc, SeqCst); // c:1088
    crate::ported::zle::zle_vi::VIINREPEAT.store(old_viinrepeat, SeqCst); // c:1089

    /* Restore errflag and retflag as zlecallhook() does */
    let cur = errflag.load(Ordering::Relaxed);
    errflag.store(
        saverrflag | (cur & crate::ported::zsh_h::ERRFLAG_INT),
        Ordering::Relaxed,
    ); // c:1092
    crate::ported::builtin::RETFLAG.store(savretflag, Ordering::Relaxed); // c:1093

    crate::ported::zle::zle_thingy::unrefthingy(name); // c:1095
    *LBINDK.lock().unwrap() = lbindk_save; // c:1096-1098
    *BINDK.lock().unwrap() = bindk_save; // c:1097-1099

    /* we can't set ZLE_NOTCOMMAND since it's not a legit widget, so
     * restore lastcmd manually so that we don't mess up the global state
     */
    LASTCMD.store(lastcmd_prev, SeqCst); // c:1104
}

/// Core ZLE loop.
/// Port of `zlecore()` from Src/Zle/zle_main.c:1110. The C source
/// loops until `done || errflag || exit_pending`, calling
/// `getkeycmd()` to resolve a multi-byte key sequence into a Thingy,
/// dispatching via `execzlefunc()`, then running `handleprefixes()`,
/// vi-cursor cleanup, `handleundo()`, and `redrawhook()` between
/// iterations. This Rust port mirrors that flow with our single-char
/// keymap lookup as the resolver — multi-byte sequences flow through
/// `getfullchar` + UTF-8 decode, while bound key sequences (e.g.
/// `^X^E`) currently rely on the binding's first byte; the
/// keymap-trie walk is a follow-up port.
pub fn zlecore() {
    // c:1110
    DONE.store(0, SeqCst);

    // c:1128 — `while (!done && !errflag && !exit_pending)`. All THREE gates,
    // not just `done`. `errflag` is how every abort widget leaves the editor:
    // `sendbreak` (^G, zle_misc.c:1144-1147) does nothing but
    // `errflag |= ERRFLAG_ERROR|ERRFLAG_INT` and return, and the loop
    // condition is the entire mechanism that turns that into an aborted line.
    // Testing only `done` meant ^G set the flag and the editor kept reading:
    // the line was never abandoned, so `zleread`'s epilogue (c:1379-1380
    // `invalidatelist(); trashzle();`) never ran and a displayed completion
    // list was never erased. That is every `tab_ctrl_g` cell in the compsys
    // parity corpus — 46 of 81 failures — plus ^G being inert at a plain
    // prompt with no completion pending at all.
    // `exit_pending` is the same story for `exit` run from a widget.
    while DONE.load(SeqCst) == 0
        && errflag.load(Ordering::Relaxed) == 0
        && crate::ported::builtin::EXIT_PENDING.load(SeqCst) == 0
    {
        // EOF handling: empty line + Ctrl-D (eofchar) => terminate.
        // Mirrors zle_main.c:1139-1150 (lastchar == eofchar guard).
        // We can only check this *after* reading a char, so the
        // detection lives below.

        // c:1132 — `vilinerange = 0;` — per-key reset.
        crate::ported::zle::zle_vi::VILINERANGE.store(0, SeqCst);
        // c:1133 — `reselectkeymap();`. A widget (or a shell function it
        // ran) may have relinked or deleted the keymap we're editing
        // under; re-open it by name before every key read.
        crate::ported::zle::zle_keymap::reselectkeymap();

        // c:1134-1135 — `selectlocalmap(invicmdmode() && region_active
        // && (km = openkeymap("visual")) ? km : NULL);` — while a
        // visual selection is active in vicmd mode, the `visual` local
        // keymap resolves keys first (iw/aw text objects, `o`
        // exchange, `S` surround-style rebinds). Without it, `vaw`
        // dispatched vicmd's `a` (vi-add-next) and dropped to insert
        // mode mid-selection.
        {
            let kn = crate::ported::zle::zle_keymap::curkeymapname().clone();
            let vis =
                if crate::ported::zle::zle_h::invicmdmode(&kn) && REGION_ACTIVE.load(SeqCst) != 0 {
                    crate::ported::zle::zle_keymap::openkeymap("visual")
                } else {
                    None
                };
            crate::ported::zle::zle_keymap::selectlocalmap(vis);
        }

        // c:1136 — `bindk = getkeycmd();`. Goes through `getkeycmd`
        // (zle_keymap.rs:2916), not straight to the keymap walk, so a
        // `bindkey -s` send-string is replayed into the input
        // (zle_keymap.c:1783) instead of resolving to no widget, and
        // `execute-named-command` gets its c:1786-1796 redirection.
        let thingy = crate::ported::zle::zle_keymap::getkeycmd();
        // c:1137 — `selectlocalmap(NULL);`
        crate::ported::zle::zle_keymap::selectlocalmap(None);
        let thingy = match thingy {
            Some(t) => t,
            None => {
                EOFSENT.store(1, SeqCst);
                DONE.store(1, SeqCst);
                continue;
            }
        };

        // EOF on empty line: matches C's eofchar branch
        // (zle_main.c:1139-1150 — guarded by ZLRF_IGNOREEOF too).
        if ZLELL.load(SeqCst) == 0
            && LASTCHAR.load(SeqCst) == EOFCHAR.load(SeqCst)
            && (ZLEREADFLAGS.load(SeqCst) & ZLRF_HISTORY) != 0
        {
            EOFSENT.store(1, SeqCst);
            DONE.store(1, SeqCst);
            continue;
        }

        *LBINDK.lock().unwrap() = BINDK.lock().unwrap().take();
        *BINDK.lock().unwrap() = Some(thingy.clone());

        // Keymaps store a cloned Thingy whose `.widget` is a snapshot
        // taken when the key was bound. A later `zle -C` / `zle -N`
        // rebind (e.g. compinit rebinding `expand-or-complete` to a
        // completion widget) updates the thingytab entry but NOT the
        // keymap's snapshot, so dispatch would keep running the stale
        // builtin. Re-resolve the CURRENT widget from thingytab by name;
        // fall back to the snapshot if the name is no longer in the table.
        let current_widget = crate::ported::zle::zle_thingy::thingytab()
            .lock()
            .ok()
            .and_then(|t| t.get(&thingy.nam).and_then(|th| th.widget.clone()))
            .or_else(|| thingy.widget.clone());
        if thingy.nam.contains("complete") {
            tracing::debug!(
                target: "compsys_args",
                name = %thingy.nam,
                variant = current_widget.as_ref().map(|w| match &w.u {
                    crate::ported::zle::zle_h::WidgetImpl::Comp { .. } => "Comp",
                    crate::ported::zle::zle_h::WidgetImpl::Internal(_) => "Internal",
                    _ => "Other",
                }),
                "zlecore widget resolution"
            );
        }
        // c:1151-1152 — `if (execzlefunc(bindk, ...)) handlefeep();`. Ring
        // the bell when the widget returns non-zero (e.g. an ambiguous
        // completion with LISTBEEP), or when the Thingy has no widget at all.
        // Native ZLE effects (extensions/zle_fx.rs) get first refusal: suggestion
        // accept and history-search keys are handled without running the widget,
        // the way fish's reader commands intercept before readline dispatch.
        if crate::zle_fx::on_pre_widget(&thingy.nam) {
            // handled natively
        } else if let Some(widget) = &current_widget {
            if execute_widget(widget) != 0 {
                handle_feep();
            }
        } else {
            handle_feep();
        }

        // Post-widget processing matches zle_main.c:1156-1167:
        //   handleprefixes()  → promote TMULT, otherwise reset
        //   vi cursor adjust  → don't sit on '\n' in vi cmd mode
        //   handleundo()      → record what the widget changed
        //   redrawhook()      → queue zle-line-pre-redraw
        handleprefixes();
        if in_vi_cmd_mode()
            && ZLECS.load(SeqCst) > findbol()
            && (ZLECS.load(SeqCst) == ZLELL.load(SeqCst)
                || ZLELINE.lock().unwrap().get(ZLECS.load(SeqCst)).copied() == Some('\n'))
            && ZLECS.load(SeqCst) > 0
        {
            ZLECS.fetch_sub(1, SeqCst);
        }
        // c:1161 — `handleundo();`, here in the key loop and nowhere else on
        // the per-key path. It used to be split across `execute_widget` as a
        // `setlastline()` BEFORE the widget and a `mkundoent()` after it; the
        // pre-call snapshot silently discarded anything that changed the line
        // outside a widget, and the natively handled keys above (zle_fx)
        // skipped the capture entirely.
        crate::ported::zle::zle_utils::handleundo(); // c:1161
        // Native ZLE effects recompute (extensions/zle_fx.rs): autosuggestion +
        // syntax highlight refresh on every widget, before the repaint — the
        // fish reader does the same per readline command (reader.rs
        // update_autosuggestion / super_highlight_me_plenty).
        crate::zle_fx::on_post_widget(&thingy.nam);
        // Native p10k engine: SHOW_ON_COMMAND / keymap / region refresh,
        // the role of p10k's own `zle-line-pre-redraw` hook (p10k:8020-8050).
        crate::p10k::on_zle_redraw();
        redrawhook();

        // c:1192-1194 — `if (!kungetct) zrefresh();`. Repaint after EVERY
        // widget so cursor motions (vi-backward-char, forward-char,
        // up/down-line) become visible — not just inserts. The previous
        // `if ZLE_RESET_NEEDED` gate skipped the repaint for movement
        // widgets, so arrow keys moved the internal cursor but the screen
        // never updated. Skip only when there's still buffered input
        // (mid escape sequence) to coalesce the paint, exactly as C's
        // `!kungetct` guard does.
        if KUNGETBUF.lock().unwrap().is_empty() {
            zrefresh();
        }
        ZLE_RESET_NEEDED.store(0, SeqCst);
    }
}

/// Run a line edit and return the user's accepted line.
/// Port of `zleread(char **lp, char **rp, int flags, int context, char *init, char *finish)` from Src/Zle/zle_main.c:1216 — the
/// canonical entry point for "read one line interactively". The C
/// source's full chain is: setup tty + signals → run zle-line-init
/// hook → zlecore loop until done → run zle-line-finish hook →
/// restore tty + return the line. Our Rust port stashes the
// - finish: "zle-line-finish"                                          // c:1216
/// prompt templates, expands them, sets the read flags + context,
/// then enters zlecore; the host (bin) handles the line-init /
/// line-finish hooks via pending_hooks.
/// WARNING: param names don't match C — Rust=(lprompt, rprompt) vs C=(lp, rp)
pub fn zleread(
    // c:1216
    lprompt: &str,
    rprompt: &str,
    flags: i32,
    context: i32,
    init: &str,
    finish: &str,
) -> io::Result<String> {
    // c:1220 — `int tmout = getiparam("TMOUT");`. Read once on entry; the
    // alarm it arms is set further down (c:1323-1324), and a TMOUT the
    // user changes while this line is being edited takes effect on the
    // next line or at the next SIGALRM re-arm (handletrap, c:1002-1003),
    // exactly as in C.
    // c:Src/init.c:1791-1806 — `zleentry` loads zsh/zle before it hands
    // the call to zleread, so `setup_` (zle_main.c:2252-2291) runs first:
    // `$zle_bracketed_paste` for start_edit() below, and the terminal
    // probe (`if (shout) query_terminal();`) while the tty is still in
    // the shell's own mode, before the prompt is drawn. zshrs links zle
    // statically; run it once on first entry.
    ZLE_MODULE_SETUP.call_once(|| {
        let _ = setup_(std::ptr::null());
    });
    let tmout = crate::ported::params::getiparam("TMOUT") as i32; // c:1220
    // Stash the unexpanded templates so reexpandprompt() can re-run
    // expansion later. C zsh saves these in the global raw_lp/raw_rp
    // slots — the Rust port keeps the same shape as file-scope
    // `RAW_LP`/`RAW_RP` statics (zle_main.rs).
    *RAW_LP.lock().unwrap() = lprompt.to_string();
    *RAW_RP.lock().unwrap() = rprompt.to_string();
    // c:1250 — `keytimeout = (time_t)getiparam("KEYTIMEOUT");`. The
    // ZLE-side global is refreshed from the parameter once per edit
    // session, so a `KEYTIMEOUT=1` in .zshrc (or a mid-session change)
    // takes effect on the NEXT line, not retroactively. Without this
    // the static below kept its startup value forever and `$KEYTIMEOUT`
    // was decorative.
    KEYTIMEOUT.store(
        crate::ported::params::getiparam("KEYTIMEOUT").max(0) as u64,
        SeqCst,
    ); // c:1250

    // c:1260-1261 — `if (termflags & TERM_UNKNOWN) init_term();` —
    // make sure the terminal caps are set up before the first paint.
    if crate::ported::params::TERMFLAGS.load(SeqCst) & crate::ported::zsh_h::TERM_UNKNOWN != 0 {
        crate::ported::init::init_term();
    }
    // c:1267 — `insmode = unset(OVERSTRIKE);` — every line starts in the
    // mode the option selects; the initial vi change is recorded as `R`
    // (not `i`/`a`) from this (zle_vi.c:104-105).
    INSMODE.store(
        (!crate::ported::zsh_h::isset(crate::ported::zsh_h::OVERSTRIKE)) as i32,
        SeqCst,
    );
    // c:1273 — `txtcurrentattrs = txtpendingattrs = txtunknownattrs = 0;`
    // before the prompts are expanded: ZLE knows the terminal's attributes.
    *crate::ported::prompt::current_attrs_lock().lock().unwrap() = 0;
    crate::ported::prompt::set_pending_text_attrs(0);
    crate::ported::prompt::txtunknownattrs.store(0, SeqCst);
    *LPROMPT.lock().unwrap() = crate::prompt::expand_prompt(lprompt);
    *RPROMPT.lock().unwrap() = crate::prompt::expand_prompt(rprompt);
    // Fresh edit session on a fresh terminal row — the multiline
    // repaint anchor must not climb into the previous command's
    // output (see LAST_PAINT_ROWS in zle_refresh.rs).
    crate::ported::zle::zle_refresh::LAST_PAINT_ROWS.store(0, Ordering::Relaxed);
    ZLEREADFLAGS.store(flags, SeqCst);
    ZLECONTEXT.store(context, SeqCst);

    // Initialize line
    ZLELINE.lock().unwrap().clear();
    ZLECS.store(0, SeqCst);
    ZLELL.store(0, SeqCst);
    MARK.store(0, SeqCst);
    DONE.store(0, SeqCst);
    EOFSENT.store(0, SeqCst); // c:1294 eofsent = 0 (cleared before zlecore)
                              // c:1285 — `histline = curhist;` — vi `G` (vifetchhistory) and the
                              // getvirange modified-line check compare against this.
    crate::ported::zle::zle_hist::histline
        .store(crate::ported::hist::curhist.load(SeqCst) as i32, SeqCst);
    // c:1289-1291 — `virangeflag = lastcmd = … = 0; vichgflag = 0;
    // viinrepeat = 0;` — stale vi-change state from an interrupted
    // edit must not leak into the next line (a leftover vichgflag
    // blocks startvichange from ever recording again, killing `.`).
    crate::ported::zle::zle_vi::VIRANGEFLAG.store(0, SeqCst); // c:1289
    crate::ported::zle::zle_vi::VICHGFLAG.store(0, SeqCst); // c:1290
    crate::ported::zle::zle_vi::VIINREPEAT.store(0, SeqCst); // c:1291

    // c:1294 — `selectkeymap("main", 1);`. Re-resolve `main` at the start
    // of EVERY line edit: `curkeymap` caches the keymap the last edit ran
    // under, so a `setopt vi` / `setopt emacs` / `bindkey -A … main`
    // between lines (which relinks the name `main` to a different keymap)
    // would otherwise never reach the key loop.
    selectkeymap("main", 1);
    // c:1295 — `initundo();`: a fresh change list and `undo_changeno = 0` for
    // every line. Never called before, so undo history (and the change
    // counter) carried over from every earlier line.
    crate::ported::zle::zle_utils::initundo(); // c:1295

    // c:1297-1312 — drain ONE entry off the buffer stack into the fresh
    // line, which is the entire mechanism behind `push-line`, `run-help`
    // (`processcmd`), `accept-and-hold`, `print -z` and `printf -z`: each
    // of those pushes the text and returns, trusting the NEXT `zleread`
    // to hand it back. Nothing here ever popped, so every one of them
    // dropped the line permanently.
    //
    // ```c
    //     if ((s = getlinknode(bufstack))) {
    //         setline(s, ZSL_TOEND);
    //         zsfree(s);
    //         if (stackcs != -1) {
    //             zlecs = stackcs;
    //             stackcs = -1;
    //             if (zlecs > zlell)
    //                 zlecs = zlell;
    //             CCLEFT();
    //         }
    //         if (stackhist != -1) {
    //             histline = stackhist;
    //             stackhist = -1;
    //         }
    //         handleundo();
    //     }
    // ```
    //
    // Position: C runs this after `selectkeymap("main", 1)` (c:1294),
    // `initundo()` (c:1295) and `fixsuffix()` (c:1296). This port calls
    // `initundo` just above and has no `fixsuffix` call here, so the slot
    // right after them IS C's. It must also stay AFTER the
    // `zleline`/`zlecs`/`zlell` clear at c:1287-1289 (above) — that clear
    // would otherwise wipe the line we just restored.
    //
    // `getlinknode` unlinks the list's FIRST node and `zpushnode` inserts
    // at the head (`zsh.h:591` — `zinsertlinknode(X,&(X)->node,Y)`), so the
    // stack is LIFO: two stacked `push-line`s come back newest-first.
    // `Vec::remove(0)` matches, given pushes use `insert(0, …)`.
    let stacked = {
        let mut bs = BUFSTACK.lock().unwrap();
        if bs.is_empty() {
            None
        } else {
            Some(bs.remove(0)) // c:1297 getlinknode(bufstack)
        }
    };
    if let Some(s) = stacked {
        crate::ported::zle::zle_utils::setline(&s, crate::ported::zle::zle_h::ZSL_TOEND); // c:1298
        // c:1299 `zsfree(s)` — `s` is an owned String; Drop covers it.
        let stackcs = STACKCS.load(SeqCst);
        if stackcs != -1 {
            // c:1300
            // c:1301-1302 — take the saved column, then disarm the slot so a
            // later pop that carries no cursor (e.g. `print -z`) leaves
            // `setline`'s end-of-line position alone.
            STACKCS.store(-1, SeqCst); // c:1302
            let zlell = ZLELL.load(SeqCst);
            // c:1303-1304 — `if (zlecs > zlell) zlecs = zlell;`
            ZLECS.store((stackcs as usize).min(zlell), SeqCst); // c:1301
            ZLE_RESET_NEEDED.store(1, SeqCst); // c:1305 CCLEFT
        }
        let stackhist = STACKHIST.load(SeqCst);
        if stackhist != -1 {
            // c:1307
            crate::ported::zle::zle_hist::histline.store(stackhist, SeqCst); // c:1308
            STACKHIST.store(-1, SeqCst); // c:1309
        }
        crate::ported::zle::zle_utils::handleundo(); // c:1311
    }
    // c:1313-1319 — If main is linked to the viins keymap, we need to
    // register explicitly that we're now in vi insert mode as there's
    // no user operation to indicate this.
    {
        use crate::ported::zle::zle_keymap::openkeymap;
        let main = openkeymap("main");
        if main.is_some()
            && match (&main, &openkeymap("viins")) {
                (Some(a), Some(b)) => std::sync::Arc::ptr_eq(a, b),
                _ => false,
            }
        {
            // c:1318
            crate::ported::zle::zle_vi::viinsert_init(); // c:1319
        }
    }

    // Sync the ZLE history-navigation list from the LIVE command history
    // (hist.rs `curhist`/`quietgethist`). zle_goto_hist (up/down-line-or-
    // history, history-search) reads `zle_hist::history()`, which is only
    // fed by `zle` parameter writes — never by the interactive accept-line
    // path — so without this, up-arrow found an empty list and recalled
    // nothing even though `$history` was populated. Rebuild it each line
    // edit from the real ring so it always reflects what was actually run.
    if (flags & crate::ported::zsh_h::ZLRF_HISTORY) != 0 {
        let first = crate::ported::hist::firsthist();
        let cur = crate::ported::hist::curhist.load(SeqCst);
        let mut h = history().lock().unwrap();
        // INCREMENTAL sync. The original rebuild cleared and re-walked
        // the ENTIRE ring on EVERY zleread — with a 566k-entry history
        // that was 566k binary searches + entry clones PER PROMPT
        // (~5s of dead time before each prompt returned; C has no
        // rebuild at all — its ZLE navigates the live ring lazily).
        // The session ring is append-only between line edits, so:
        //   - same (first, cur) as last sync → nothing to do;
        //   - cur advanced → append only the new events;
        //   - first moved / cur went backwards (HIST_IGNORE trims,
        //     history -p, SHARE_HISTORY import) → full rebuild.
        let last_first = ZLE_HIST_SYNC_FIRST.load(SeqCst);
        let last_cur = ZLE_HIST_SYNC_CUR.load(SeqCst);
        // Still-synced when the window only moved FORWARD: cur grows
        // by one per accepted line and, at HISTSIZE capacity, first
        // advances in lockstep (ring trim). Handle the trim by
        // draining the aged entries off the FRONT of the list —
        // rebuilding on every first-advance would be a full 566k pass
        // per prompt again.
        let synced =
            last_cur >= 0 && !h.entries.is_empty() && first >= last_first && cur >= last_cur;
        let (start_ev, full) = if synced {
            if first > last_first {
                let cut = h.entries.partition_point(|e| e.num < first);
                h.entries.drain(..cut);
            }
            (last_cur + 1, false)
        } else {
            (first, true)
        };
        if full {
            // One O(n) pass over the ring directly — per-event
            // `quietgethist` would be n binary searches + n FULL entry
            // clones (words vecs included): ~8s at 566k entries for
            // the first prompt. Only the line string is needed here.
            h.entries.clear();
            let ring = crate::ported::hist::hist_ring.lock().unwrap();
            h.entries.reserve(ring.len());
            let mut items: Vec<(i64, String)> = ring
                .iter()
                .filter(|he| he.histnum >= first && he.histnum <= cur && !he.node.nam.is_empty())
                .map(|he| (he.histnum, he.node.nam.clone()))
                .collect();
            drop(ring);
            // Ring storage order is an implementation detail; the
            // navigation list contract is ascending event number.
            items.sort_unstable_by_key(|(n, _)| *n);
            for (num, line) in items {
                h.entries.push(crate::ported::zle::zle_hist::HistEntry {
                    line,
                    num,
                    time: None,
                });
            }
        } else {
            let mut ev = start_ev;
            while ev <= cur {
                if let Some(he) = crate::ported::hist::quietgethist(ev) {
                    let t = he.node.nam;
                    // Dedupe guard: an event can only append once
                    // (protects against a committed `cur` at sync time
                    // being re-fetched by the next prompt's pass).
                    if !t.is_empty() && h.entries.last().map_or(true, |e| e.num < ev) {
                        h.entries.push(crate::ported::zle::zle_hist::HistEntry {
                            line: t,
                            num: ev,
                            time: None,
                        });
                    }
                }
                ev += 1;
            }
        }
        ZLE_HIST_SYNC_FIRST.store(first, SeqCst);
        // `cur` is the IN-FLIGHT event (curhist points at the line being
        // edited; its text commits only after execution), so it can never
        // be synced now. Watermark one behind so the next prompt's append
        // pass re-fetches it — storing `cur` skipped every accepted
        // command and up-arrow recalled stale entries.
        ZLE_HIST_SYNC_CUR.store(cur - 1, SeqCst);
        h.cursor = h.entries.len(); // start at the live (newest) end
        h.saved_line = None;
    }

    // Set up terminal
    zsetterm()?;

    // c:1323-1324 — `if (tmout) alarm(tmout);`. This is the ONLY place
    // `$TMOUT` starts the clock: SIGALRM then reaches zhandler
    // (Src/signals.c:474-491), which runs TRAPALRM via handletrap — whose
    // tail re-arms `alarm(tmout)` for the next period (c:1002-1003) — or,
    // with no trap, logs the shell out once the tty has been idle for
    // TMOUT seconds. Without this call nothing ever armed the first alarm,
    // so TRAPALRM never ran at an idle prompt and an untrapped TMOUT never
    // timed the shell out. C arms it before `zleactive = 1` (c:1337); it
    // sits after `zsetterm()` here only so that function's early `?`
    // return cannot leave an alarm running with no matching `alarm(0)`.
    if tmout != 0 {
        unsafe {
            libc::alarm(tmout as libc::c_uint); // c:1324
        }
    }

    // c:1337-1338 — `zleactive = 1; resetneeded = 1;`. zleactive marks ZLE
    // as running so widgets/trashzle/signal handlers act on the live line;
    // it was previously never set in the live path (only in tests), which
    // silently disabled trashzle's `zleactive && !trashedzle` gate — so a
    // completion list never parked the cursor below the command line.
    // resetneeded arms the first frame to home the video cursor and draw the
    // whole prompt+line from column 0 (a fresh line — the previous command's
    // accept emitted a trailing CRLF; the incremental refresh otherwise
    // carries VCS/VLN across frames within a single line edit).
    //
    // MUST precede the `zle-line-init` hook below (C: c:1337 `zleactive = 1`,
    // then c:1356 `zlecallhook(init, NULL)`). Calling the hook first left
    // `zle_usable()` (zle_thingy.c:634) false for the whole widget, so any
    // wrapper that re-dispatches with `zle .widget` — every
    // zsh-syntax-highlighting / fast-syntax-highlighting binding goes through
    // `_zsh_highlight_call_widget` → `builtin zle "$@"` — hit
    // "widgets can only be called when ZLE is active" (zle_thingy.c:714) on
    // every prompt.
    zleactive.store(1, SeqCst);
    crate::ported::zle::zle_refresh::RESETNEEDED.store(1, SeqCst);
    // c:1339-1347 — Start of the main zle read. Fully reset error
    // conditions, including user interrupt; a region left active by the
    // previous line (a widget that accepted mid-selection) must not carry
    // into this one.
    crate::utils::errflag.store(0, SeqCst); // c:1343
    crate::ported::builtin::RETFLAG.store(0, SeqCst); // c:1343
    LASTCOL.store(-1, SeqCst); // c:1344
    initmodifier(); // c:1345
    PREFIXFLAG.store(0, SeqCst); // c:1346
    REGION_ACTIVE.store(0, SeqCst); // c:1347

    // c:1356 — `zlecallhook(init, NULL)` — runs user's zle-line-init widget
    // before the editing loop (e.g. for bindkey installation / zle -A wiring).
    if crate::ported::zle::zle_thingy::rthingy_nocreate(init) {
        let _ = execzlefunc(init, &[init.to_string()], 1, 0);
    }

    // c:1366 — `zrefresh()` paints the initial frame BEFORE the loop, so
    // the prompt shown is the fully EXPANDED one (e.g. `codelabs-arm% `,
    // not the raw `%m%# ` template) and the buffer/cursor are positioned.
    // The previous manual `write_loop(SHTTY, lprompt)` drew the raw,
    // unexpanded template until the first keypress triggered a refresh.

    // c:1362 — `start_edit()` (termquery.c:737-741 → collate_seq(0, 1)):
    // emits the edit-mode enter sequences, most importantly bracketed
    // paste enable (`$zle_bracketed_paste[1]` = \e[?2004h). Without this
    // the terminal never brackets pastes, so a multi-line paste executed
    // line-by-line instead of inserting into the buffer.
    crate::ported::zle::termquery::start_edit();

    zrefresh();
    // First paint of the first prompt — the end of "time to first prompt".
    // One-shot: `mark_first_prompt` fires once per process, so this costs a
    // relaxed atomic load per redraw when tracing is off.
    crate::startup_trace::mark_first_prompt();

    // Enter core loop
    zlecore();

    // c:1368-1371 —
    // ```c
    //     if (errflag)
    //         setsparam((zlecontext == ZLCON_VARED) ?
    //                   "ZLE_VARED_ABORTED" :
    //                   "ZLE_LINE_ABORTED", zlegetline(NULL, NULL));
    // ```
    // The name was registered as a module feature (the `p:ZLE_LINE_ABORTED`
    // entry in this file's feature table) but nothing ever set it, so the
    // documented recovery path — `print -zr -- $ZLE_LINE_ABORTED` after a
    // ^C/^G-aborted line — had nothing to recover. Comparing
    // `${+parameters[ZLE_LINE_ABORTED]}` after an aborted line: zsh 1, zshrs 0.
    if crate::utils::errflag.load(SeqCst) != 0 {
        let mut ll = 0i32;
        let mut cs = 0i32;
        let line = crate::ported::zle::zle_utils::zlegetline(&mut ll, &mut cs);
        let name = if ZLECONTEXT.load(SeqCst) == crate::ported::zsh_h::ZLCON_VARED {
            "ZLE_VARED_ABORTED"
        } else {
            "ZLE_LINE_ABORTED"
        };
        let _ = crate::ported::params::setsparam(name, &line);
    }

    // c:1373 — `end_edit()` (termquery.c:744-748 → collate_seq(1, -1)):
    // leave sequences in reverse order — bracketed paste disable
    // (\e[?2004l) so pastes at the command's own stdin stay raw.
    crate::ported::zle::termquery::end_edit();

    // c:1375-1376 — `if (done && !exit_pending && !errflag)
    //                    zlecallhook(finish, NULL);`
    // Runs the user's zle-line-finish widget while ZLE is STILL ACTIVE —
    // before invalidatelist()/trashzle() (c:1379-1380) and before
    // `zleactive = 0` (c:1383). The hook used to run after `zleactive = 0`,
    // which made `zle_usable()` (zle_thingy.c:634) false inside it, so a
    // wrapped zle-line-finish (`_zsh_highlight_call_widget` →
    // `builtin zle "$@"`) printed "widgets can only be called when ZLE is
    // active" (zle_thingy.c:714) after every accepted command. The C gate is
    // also new here: an aborted (errflag) or exiting line skips the hook.
    //
    // !!! WARNING: RUST-ONLY — NO C COUNTERPART !!!
    // An `@ <code>` line is stryke source, not shell text: like text after
    // a `#`, nothing in the shell may read or rewrite it. `zle-line-finish`
    // hooks edit BUFFER (spacing around `|`/`>`, expansion), which turned
    // `@ 5 |> p` into `5 |  > p` before `stryke_line` saw it, so the hook
    // is skipped for such a line.
    let stryke_line = {
        let z = ZLELINE.lock().unwrap();
        z.first() == Some(&'@') && z.get(1).map_or(true, |c| c.is_whitespace())
    };
    if DONE.load(SeqCst) != 0
        && !stryke_line
        && crate::ported::builtin::EXIT_PENDING.load(Ordering::Relaxed) == 0
        && crate::utils::errflag.load(SeqCst) == 0
        && crate::ported::zle::zle_thingy::rthingy_nocreate(finish)
    {
        let _ = execzlefunc(finish, &[finish.to_string()], 1, 0);
    }

    // c:1380 — `trashzle()` after the loop parks the cursor below the edited
    // line so the accepted command's output starts on a fresh row, AND — when
    // a completion list is on screen — clears it (moveto(nlnct,0) followed by
    // TCCLEAREOD while clearflag is set). The previous manual `\r\n` only
    // dropped one row, so a shown list was left stranded and the command
    // output overwrote just its first row, leaving trailing entries on screen.
    // Must run while `zleactive` is still 1 — trashzle's `zleactive &&
    // !trashedzle` gate — matching C's order (c:1380 trashzle, c:1383
    // zleactive = 0).
    //
    // !!! WARNING: RUST-ONLY — NO C COUNTERPART !!!
    // Native p10k transient prompt (src/extensions/p10k/transient.rs):
    // when enabled, the just-accepted prompt block repaints CONDENSED
    // (prompt_char-only last line) before the command's output. The
    // zsh theme does this from its zle-line-finish hook; the native
    // hook point is here, right before trashzle's final repaint —
    // swapping the ZLE prompt buffers makes that repaint paint the
    // condensed block.
    if let Some((tp, trp)) = crate::p10k::transient::transient_swap_for_accept() {
        *LPROMPT.lock().unwrap() = crate::prompt::expand_prompt(&tp);
        *RPROMPT.lock().unwrap() = crate::prompt::expand_prompt(&trp);
    }
    // c:1378-1379 — `statusline = NULL; invalidatelist();` before trashzle().
    // Without it a completion list left displayed when the line ends (^C, ^G
    // aside) stayed valid, and the next zleread's first zrefresh repainted it
    // below the fresh prompt.
    *STATUSLINE.lock().unwrap() = None; // c:1378
    crate::ported::zle::zle_h::invalidatelist(); // c:1379
    trashzle();

    // c:1383 — `zleactive = zlereadflags = lastlistlen = zlecontext = 0;`.
    // ZLE is no longer editing; clear zleactive so a later trashzle (e.g.
    // from output/precmd) doesn't try to redraw an inactive line.
    zleactive.store(0, SeqCst);
    // c:1384 — `alarm(0);`. The TMOUT clock only runs while the editor
    // waits for input; cancel it before the accepted line executes, so a
    // command that runs longer than TMOUT is never interrupted by it.
    unsafe {
        libc::alarm(0); // c:1384
    }
    // c:1386 — `freeundo();` — the change list belongs to this line only.
    crate::ported::zle::zle_utils::freeundo(); // c:1386

    // Native ZLE effects teardown (extensions/zle_fx.rs): drop the highlight
    // overlay, ghost text, and any active history search so nothing bleeds
    // into the next prompt.
    crate::zle_fx::on_line_finish();

    // c:1387-1399 — `if (eofsent || errflag || exit_pending) { s = NULL; }
    //   else { zleline[zlell++] = ZWC('\n'); s = zlegetline(NULL, NULL); }`.
    // EOF (^D on an empty line), an error, or a pending `exit` yield NULL
    // so the caller (inputline) sees end-of-input; otherwise the accepted
    // line gets a trailing newline appended — matching shingetline, which
    // returns "…\n" — so a bare Enter is an empty COMMAND ("\n"), not EOF.
    // The Rust entry returns the empty string for the NULL case; inputline
    // treats an empty (no-newline) result as EOF, a "\n" result as an
    // empty command line.
    let is_eof = EOFSENT.load(SeqCst) != 0
        // c:1387 — `if (eofsent || errflag || exit_pending)`: the whole
        // errflag again. With the ERRFLAG_ERROR mask an interrupted line
        // (ERRFLAG_INT) was not treated as EOF, so zleread handed the
        // aborted buffer back as a command to run.
        || errflag.load(SeqCst) != 0
        || crate::ported::builtin::EXIT_PENDING.load(SeqCst) != 0;
    if is_eof {
        Ok(String::new()) // c:1388 s = NULL
    } else {
        let mut s: String = ZLELINE.lock().unwrap().iter().collect();
        s.push('\n'); // c:1390 zleline[zlell++] = '\n'
        Ok(s) // c:1391 s = zlegetline(...)
    }
}

/// Port of `execimmortal(Thingy func, char **args)` from Src/Zle/zle_main.c:1404.
pub fn execimmortal(func: &str, args: &[String]) -> i32 {
    // c:1404
    // C body (c:1404-1410): `Thingy immortal = rthingy_nocreate(dyncat(".", func));
    //                       if (immortal) return execzlefunc(immortal, args, 0, 0);
    //                       return 1`.
    // Look up `.NAME` and dispatch to execzlefunc; the dot-prefixed
    // func guarantees we hit the immortal/canonical thingy.
    let dotted = format!(".{}", func);
    if rthingy_nocreate(&dotted) {
        // c:1406
        // c:1407 — `return execzlefunc(immortal, args, 0, 0)`.
        return execzlefunc(&dotted, args, 0, 0);
    }
    1 // c:1409
}

/// Direct port of `int execzlefunc(Thingy func, char **args, int set_bindk,
///                                  int may_cd)` from `Src/Zle/zle_main.c:1420-1601`.
/// Widget invocation pipeline. C body walks the `Widget` union and
/// dispatches to either an internal widget fn (`WIDGET_INT`) or a
/// shell function (`WIDGET_FUNCTION`), wrapping the call in
/// metafy/unmetafy of `zlemetaline` and tracking `bindk`/`lastcmd`.
///
/// Rust port covers:
///   - Internal widget lookup via thingytab (read-side already
///     ported).
///   - Shell-function dispatch via the canonical getshfunc + LASTVAL
///     read path (mirrors C's `doshfunc` invocation).
///   - lastcmd update from the widget's flag mask.
/// Bindk/metafy boundary management lives on the per-thread Zle
/// struct already.
/// Port of `execzlefunc(Thingy func, char **args, int set_bindk, int set_lbindk)` from `Src/Zle/zle_main.c:1420`.
pub fn execzlefunc(name: &str, args: &[String], set_bindk: i32, set_lbindk: i32) -> i32 {
    // c:1420
    // c:1420 — `if (!func) return 1`.
    if !rthingy_nocreate(name) {
        // c:1422 — C's `func` is a Thingy pointer, so this gate is just
        // a NULL check. The Rust adaptation is name-based and gets called
        // in TWO shapes: with a thingy name (C shape, e.g. from
        // bin_zle_call) or with a bare shell-function name from
        // execute_widget's UserFunc arm (`zle -N widget fn` — `fn` never
        // gets a thingy; C resolves it via `w->u.fnnam` → shfunctab at
        // zle_main.c:1503). Fall through to the shfunc path below when
        // the name is a known shell function; otherwise fail as before.
        // Without this, EVERY user-defined widget feeped and no-opped —
        // f-sy-h wraps all widgets (self-insert included), so the whole
        // keyboard died with fast-syntax-highlighting loaded.
        if getshfunc(name).is_none() {
            return 1;
        }
    }

    // c:1423-1424 — `int nestedvichg = vichgflag; int isrepeat =
    // (viinrepeat == 3);` — vi-change bookkeeping for `.` repeat.
    let nestedvichg = crate::ported::zle::zle_vi::VICHGFLAG.load(SeqCst);
    let isrepeat = crate::ported::zle::zle_vi::VIINREPEAT.load(SeqCst) == 3;
    if isrepeat {
        // c:1437-1438 — `if (isrepeat) viinrepeat = 2;`
        crate::ported::zle::zle_vi::VIINREPEAT.store(2, SeqCst);
    }

    // c:1426-1427 — `Thingy save_bindk = bindk; Thingy save_lbindk = lbindk;`.
    let save_bindk = BINDK.lock().ok().and_then(|b| b.clone());
    let save_lbindk = LBINDK.lock().ok().and_then(|b| b.clone());

    // c:1429-1430 — `if (set_bindk) bindk = func;`. Install the
    // active Thingy on BINDK so bin_zle_flags + other widgets see the
    // correct "current key binding".
    if set_bindk != 0 {
        // c:1429
        let t = crate::ported::zle::zle_thingy::thingytab()
            .lock()
            .ok()
            .and_then(|tab| tab.get(name).cloned());
        if let Some(t) = t {
            *BINDK.lock().unwrap() = Some(t); // c:1430
        }
    }
    // c:1435-1436 — `if (set_lbindk) refthingy(save_lbindk);`. The
    // refthingy only pins the node against a free by an inner widget; the
    // owned clone `save_lbindk` already does that. Restored at c:1560.
    // c:1560-1567 — the `lbindk` update C runs once at its single exit:
    // ```c
    //     if (set_lbindk) {
    //         unrefthingy(lbindk);
    //         lbindk = save_lbindk;
    //     } else if (r) {
    //         unrefthingy(lbindk);
    //         refthingy(func);
    //         lbindk = func;
    //     }
    // ```
    // `r` is 1 when a widget body ran (c:1500 internal, c:1556 shell
    // function). The port has three exits, so the block is a closure.
    // Without it `$LASTWIDGET` never named a widget run through `zle NAME`
    // inside another widget, and `zle NAME -f nolast` had nothing to keep.
    let set_lastbindk = |r: bool| {
        if set_lbindk != 0 {
            *LBINDK.lock().unwrap() = save_lbindk.clone(); // c:1562
        } else if r {
            let func = crate::ported::zle::zle_thingy::thingytab()
                .lock()
                .ok()
                .and_then(|tab| tab.get(name).cloned());
            if func.is_some() {
                *LBINDK.lock().unwrap() = func; // c:1566
            }
        }
    };

    // c:1437 — `if ((w = func->widget)->flags & (WIDGET_INT|WIDGET_NCOMP))`.
    // Resolve the widget bound to this thingy via the thingytab; if
    // present, dispatch per the C three-way switch (NCOMP →
    // completecall; INT → call u.fn directly; else → shfunc).
    let widget_opt = crate::ported::zle::zle_thingy::thingytab()
        .lock()
        .ok()
        .and_then(|tab| tab.get(name).and_then(|t| t.widget.clone()));

    if let Some(w) = widget_opt.as_ref() {
        let wflags = w.flags;
        // c:1455-1469 — WIDGET_INT | WIDGET_NCOMP branch.
        if (wflags
            & (crate::ported::zle::zle_h::WIDGET_INT | crate::ported::zle::zle_h::WIDGET_NCOMP))
            != 0
        {
            // c:1468-1473 — the same per-widget suffix/list teardown the key
            // loop performs, repeated here because this is the path a shell
            // widget's `zle <internal-widget>` takes (bin_zle_call →
            // execzlefunc). C runs it in this branch too; without it a
            // wrapper widget (`w() { zle expand-or-complete }`, the shape
            // fzf-tab and zsh-autosuggestions use) never tore the suffix
            // down at all, because the outer user widget correctly skips it.
            if (wflags & crate::ported::zle::zle_h::ZLE_KEEPSUFFIX) == 0 {
                let _ = crate::ported::zle::zle_h::removesuffix(); // c:1469
            }
            if (wflags & crate::ported::zle::zle_h::ZLE_MENUCMP) == 0 {
                crate::ported::zle::zle_misc::fixsuffix(); // c:1471
                crate::ported::zle::zle_h::invalidatelist(); // c:1472
            }
            if (wflags & crate::ported::zle::zle_h::ZLE_LINEMOVE) != 0 {
                // c:1474
                crate::ported::zle::zle_vi::VILINERANGE.store(1, SeqCst); // c:1475
            }
            if (wflags & ZLE_LASTCOL) == 0 {
                // c:1476
                LASTCOL.store(-1, SeqCst); // c:1477
            }
            let rc = if (wflags & crate::ported::zle::zle_h::WIDGET_NCOMP) != 0 {
                // c:1481-1486 — `compwidget = w; ret = completecall(args)`.
                *COMPWIDGET.lock().unwrap() = Some((**w).clone()); // c:1483
                let r = crate::ported::zle::zle_tricky::completecall(args); // c:1484
                *COMPWIDGET.lock().unwrap() = None;
                r
            } else {
                // c:1487-1489 — `if (!w->u.fn) handlefeep; else ret = w->u.fn(args)`.
                match &w.u {
                    crate::ported::zle::zle_h::WidgetImpl::Internal(f) => f(args), // c:1489
                    _ => 0,
                }
            };
            if (wflags & ZLE_NOTCOMMAND) == 0 {
                // c:1498
                LASTCMD.store(wflags as u32, SeqCst); // c:1499 `lastcmd = wflags;`
            }
            LASTVAL.store(rc, Ordering::Relaxed);
            set_lastbindk(true); // c:1500 r = 1; c:1560-1567
            if set_bindk != 0 {
                *BINDK.lock().unwrap() = save_bindk; // c:1597
            }
            crate::zle_param_sync::end_vichg_frame(nestedvichg, isrepeat, rc); // c:1579-1595
            return rc;
        }
    }

    // c:1490-1530 — else branch: user-defined shfunc widget. Route
    // via the canonical crate::ported::exec::dispatch_function_call fn-ptr
    // installed by fusevm_bridge at startup; direct ShellExecutor
    // reach-in from src/ported/ is forbidden per
    // feedback_no_exec_script_from_ported.
    let shfunc_name = widget_opt.as_ref().and_then(|w| match &w.u {
        crate::ported::zle::zle_h::WidgetImpl::UserFunc(s) => Some(s.clone()),
        _ => None,
    });
    let call_name = shfunc_name.as_deref().unwrap_or(name);
    if let Some(mut shf) = getshfunc(call_name) {
        // c:1514 — `int osc = sfcontext`.
        let osc = crate::ported::exec::sfcontext.load(Ordering::Relaxed);
        // c:1514 `int osi = movefd(0);` + c:1521-1526:
        //     if (osi > 0) {
        //         /*
        //          * Many commands don't like having a closed stdin, open on
        //          * /dev/null instead
        //          */
        //         open("/dev/null", O_RDWR | O_NOCTTY); /* ignore failure */
        //     }
        // The port ran the widget body with the shell's own stdin still on
        // fd 0. zsh deliberately parks fd 0 on /dev/null for the duration of
        // a widget so a command inside it can never eat the keyboard input
        // ZLE is about to read.
        // zle -f bits belong to THIS widget invocation; stash an outer widget's.
        let outer_widget_flags =
            crate::ported::zle::zle_thingy::USER_WIDGET_FLAGS.swap(0, Ordering::SeqCst);
        let osi = crate::ported::utils::movefd(0);
        if osi > 0 {
            unsafe {
                let devnull = std::ffi::CString::new("/dev/null").unwrap();
                let _ = libc::open(devnull.as_ptr(), libc::O_RDWR | libc::O_NOCTTY);
            }
        }
        // c:1515 — `int oxt = isset(XTRACE);`.
        let oxt = crate::ported::zsh_h::isset(crate::ported::zsh_h::XTRACE);
        // c:1537 — `ret = doshfunc(shf, largs, 1);`. Direct doshfunc
        // call mirrors C — argv[0] = widget name, argv[1..] = args.
        let mut largs: Vec<String> = vec![call_name.to_string()];
        largs.extend(args.iter().cloned());
        let name_for_body = call_name.to_string();
        let body_args: Vec<String> = args.to_vec();
        let body_runner = move || -> i32 {
            let ret =
                crate::ported::exec::run_function_body(&name_for_body, &body_args).unwrap_or(0);
            // RUST-ONLY WRITE-BACK (C: live GSU setters — see
            // crate::zle_param_sync): apply the widget's pending
            // $BUFFER/$LBUFFER/$RBUFFER/$CURSOR/... writes to the editor,
            // then drop the widget scope. It runs HERE, still inside
            // doshfunc's param scope, because makezleparams stamps the
            // family at C's `locallevel + 1` (zle_params.c:206) — the
            // widget function's own level — so doshfunc's endparamscope
            // deletes them before control returns to execzlefunc.
            crate::zle_param_sync::sync_from_paramtab();
            crate::zle_param_sync::clear_snapshot();
            ret
        };
        // c:1533 — `startparamscope();`. Same fresh-table shape as
        // zlebeforetrap (c:2107) below.
        let mut local_scope: crate::ported::zsh_h::HashTable =
            Box::new(crate::ported::zsh_h::hashtable {
                hsize: 0,
                ct: 0,
                nodes: Vec::new(),
                tmpdata: 0,
                parnodes: Default::default(),
                hash: None,
                emptytable: None,
                filltable: None,
                cmpnodes: None,
                addnode: None,
                getnode: None,
                getnode2: None,
                removenode: None,
                disablenode: None,
                enablenode: None,
                freenode: None,
                printnode: None,
                scantab: None,
            });
        crate::ported::params::startparamscope(&mut local_scope); // c:1533
                                                                  // c:1534 — `makezleparams(0);` — expose $BUFFER / $LBUFFER /
                                                                  // $RBUFFER / $CURSOR / … to the widget body. Without this,
                                                                  // every user widget saw an EMPTY $BUFFER: zpwr's MagicEnter
                                                                  // (`[[ -z $BUFFER ]]`) took its empty-line branch on every
                                                                  // Enter press and never accepted the line — the Enter key
                                                                  // appeared dead with the zpwr ZLE overrides loaded.
        makezleparams(0); // c:1534 — also arms the RUST-ONLY
                          // ZLE_PARAM_SNAPSHOT (see zle_params.rs) that
                          // zleparams_sync_from_paramtab diffs against.
                          // c:1535 — `sfcontext = SFC_WIDGET;`.
        crate::ported::exec::sfcontext.store(crate::ported::zsh_h::SFC_WIDGET, Ordering::Relaxed); // c:1535
                                                                                                   // c:1536 — `opts[XTRACE] = 0;`.
        crate::ported::options::opt_state_set(
            &crate::ported::zsh_h::opt_name(crate::ported::zsh_h::XTRACE),
            false,
        ); // c:1536
        let rc = crate::ported::exec::doshfunc(&mut shf, largs, true, body_runner); // c:1537
                                                                                    // c:1538 — `opts[XTRACE] = oxt;`.
        crate::ported::options::opt_state_set(
            &crate::ported::zsh_h::opt_name(crate::ported::zsh_h::XTRACE),
            oxt,
        ); // c:1538
           // c:1539 — `sfcontext = osc;`.
        crate::ported::exec::sfcontext.store(osc, Ordering::Relaxed); // c:1539
        // RUST-ONLY: the body runner already synced and cleared the
        // widget snapshot; this clear covers a doshfunc that returned
        // without running the body (e.g. the FUNCNEST limit), so the
        // snapshot never outlives the widget.
        crate::zle_param_sync::clear_snapshot();
        // c:1540 — `endparamscope();`.
        crate::ported::params::endparamscope(); // c:1540
        // c:1541 — `lastcmd = w->flags & ~(WIDGET_INUSE|WIDGET_FREE);` then
        // c:1547 `w->flags = 0` (the widget is not in use by an outer call).
        let uflags = crate::ported::zle::zle_thingy::USER_WIDGET_FLAGS
            .swap(outer_widget_flags, Ordering::SeqCst);
        let wf = widget_opt.as_ref().map_or(0, |w| w.flags);
        LASTCMD.store(
            ((wf | uflags) & !(crate::ported::zle::zle_h::WIDGET_INUSE
                | crate::ported::zle::zle_h::WIDGET_FREE)) as u32,
            SeqCst,
        );
                                                // c:1530 — capture LASTVAL after the call.
        LASTVAL.store(rc, Ordering::Relaxed);
        set_lastbindk(true); // c:1556 r = 1; c:1560-1567
        // c:1597 — restore BINDK.
        if set_bindk != 0 {
            *BINDK.lock().unwrap() = save_bindk;
        }
        let _ = crate::ported::utils::redup(osi, 0); // c:1556 redup(osi, 0)
        crate::zle_param_sync::end_vichg_frame(nestedvichg, isrepeat, rc); // c:1579-1595
        return rc;
    }

    // c:1597 — fall through: widget exists in thingytab but has no
    // shfunc binding. Restore BINDK and return.
    set_lastbindk(false); // c:1560-1567, r = 0
    if set_bindk != 0 {
        *BINDK.lock().unwrap() = save_bindk; // c:1597
    }
    crate::zle_param_sync::end_vichg_frame(nestedvichg, isrepeat, 0); // c:1579-1595
    0
}

/// Initialize ZLE modifiers
/// Reset zmod to its starting state (port of `initmodifier()` from
/// Src/Zle/zle_main.c:1604). The C source sets mult=1, tmult=1,
/// vibuf=0, base=10 — `tmult=1` is what makes successive C-u
/// invocations multiply (1→4→16→64) instead of staying at 0.
pub fn initmodifier() {
    *ZMOD.lock().unwrap() = modifier {
        flags: 0,
        mult: 1,
        tmult: 1,
        vibuf: 0,
        base: 10,
    };
}

/// Handle the prefix-command flag after each widget invocation.
/// Port of `handleprefixes()` from Src/Zle/zle_main.c:1618. If
/// `prefixflag` is set the previous widget was a prefix (e.g.
/// digit-argument, universal-argument); promote the temp multiplier
/// (TMULT) into the live multiplier (MULT) and clear the flag. If
/// `prefixflag` is *not* set we entered this loop iteration after a
/// non-prefix widget, so reset the modifier to its default state via
/// `initmodifier`.
pub fn handleprefixes() {
    if (PREFIXFLAG.load(SeqCst) != 0) {
        PREFIXFLAG.store(0, SeqCst);
        // c:1622 — MOD_TMULT stays set: the next digit-argument keeps
        // accumulating into tmult (zle_misc.c:972-973), which is how a
        // multi-digit count like `12`, or vi `10` through
        // vi-digit-or-beginning-of-line (zle_vi.c:1136), is built.
        if ZMOD.lock().unwrap().flags & MOD_TMULT != 0 {
            ZMOD.lock().unwrap().flags |= MOD_MULT; // c:1623
            let mut __g_zmod = ZMOD.lock().unwrap();
            __g_zmod.mult = __g_zmod.tmult;
        }
    } else {
        initmodifier();
    }
}

/// Port of `savekeymap(char *cmdname, char *oldname, char *newname, Keymap *savemapptr)` from Src/Zle/zle_main.c:1632.
pub fn savekeymap(
    cmdname: &str,
    oldname: &str,
    newname: &str,
    savemapptr: &mut Option<std::sync::Arc<Keymap>>,
) -> i32 {
    // c:1632
    let km = openkeymap(newname); // c:1634

    if let Some(km) = km {
        // c:1636
        *savemapptr = openkeymap(oldname); // c:1637
        /* I love special cases */
        // c:1638
        if savemapptr
            .as_ref()
            .map(|s| std::sync::Arc::ptr_eq(s, &km))
            .unwrap_or(false)
        {
            *savemapptr = None; // c:1640
        } else {
            /* make sure this doesn't get deleted. */
            // c:1643 — `refkeymap(*savemapptr)`: the Arc held in
            // *savemapptr is the reference.
            linkkeymap(km, oldname, 0); // c:1645
        }
        0 // c:1647
    } else {
        zwarnnam(cmdname, &format!("no such keymap: {}", newname)); // c:1649
        1 // c:1650
    }
}

/// Port of `restorekeymap(char *cmdname, char *oldname, char *newname, Keymap savemap)` from Src/Zle/zle_main.c:1656.
pub fn restorekeymap(
    cmdname: &str,
    oldname: &str,
    newname: Option<&str>,
    savemap: Option<std::sync::Arc<Keymap>>,
) {
    // c:1656
    if let Some(savemap) = savemap {
        // c:1658
        linkkeymap(savemap, oldname, 0); // c:1659
        /* we incremented the reference count above */
        // c:1661 — `unrefkeymap(savemap)`: the Arc drops here.
    } else if newname.is_some() {
        /* urr... can this happen? */
        // c:1663
        zwarnnam(
            cmdname,
            &format!("keymap {} was not defined, not restored", oldname),
        ); // c:1664
    }
}

/// Direct port of `bin_vared(char *name, char **args, Options ops, UNUSED(int func))` from `Src/Zle/zle_main.c:1678`.
/// BUILTIN spec at zle_main.c:2186 takes `"AaceghM:m:p:r:i:f:"`.
/// WARNING: param names don't match C — Rust=(name, args, ops, _func) vs C=(name, args, ops, func)
pub fn bin_vared(
    name: &str,
    args: &[String], // c:1678
    ops: &crate::ported::zsh_h::options,
    _func: i32,
) -> i32 {
    use crate::ported::zsh_h::{
        value, ASSPM_WARN, ERRFLAG_ERROR, PM_TYPE, SCANPM_MATCHMANY, SCANPM_WANTKEYS,
        SCANPM_WANTVALS, USEZLE, ZLCON_VARED,
    };
    use crate::ported::ztype_h::{ISEP, WC_ZISTYPE};

    let ova: Option<String> = varedarg.lock().unwrap().clone(); // c:1680
    let mut type_: u32 = PM_SCALAR; // c:1685
    let obreaks = crate::ported::builtin::BREAKS.load(SeqCst); // c:1685
    let mut haso = false; // c:1685
    let mut oshtty: i32 = 0; // c:1685 oSHTTY
    let mut oshout: usize = 0; // c:1689
    let mut main_keymapsave: Option<std::sync::Arc<Keymap>> = None; // c:1688
    let mut vicmd_keymapsave: Option<std::sync::Arc<Keymap>> = None; // c:1688

    // c:1691 — `term` is the shell's $TERM param (Src/init.c:777).
    let term = getsparam("TERM").unwrap_or_default();
    if (crate::ported::zsh_h::interact() && crate::ported::zsh_h::unset(USEZLE)) || term == "emacs"
    {
        // c:1691
        zwarnnam(name, "ZLE not enabled"); // c:1692
        return 1; // c:1693
    }
    if zleactive.load(Ordering::Relaxed) != 0 {
        // c:1695
        zwarnnam(name, "ZLE cannot be used recursively (yet)"); // c:1696
        return 1; // c:1697
    }

    let warn_flags = if OPT_ISSET(ops, b'g') { 0 } else { ASSPM_WARN }; // c:1700
    if OPT_ISSET(ops, b'A') {
        // c:1701
        if OPT_ISSET(ops, b'a') {
            // c:1703
            zwarnnam(name, "specify only one of -a and -A"); // c:1705
            return 1; // c:1706
        }
        type_ = PM_HASHED; // c:1708
    } else if OPT_ISSET(ops, b'a') {
        // c:1710
        type_ = PM_ARRAY; // c:1711
    }
    let p1: &str = OPT_ARG_SAFE(ops, b'p').unwrap_or(""); // c:1712
    let p2: &str = OPT_ARG_SAFE(ops, b'r').unwrap_or(""); // c:1713
    let mut main_keymapname = OPT_ARG_SAFE(ops, b'M'); // c:1714
    let mut vicmd_keymapname = OPT_ARG_SAFE(ops, b'm'); // c:1715
    let init = OPT_ARG_SAFE(ops, b'i'); // c:1716
    let finish = OPT_ARG_SAFE(ops, b'f'); // c:1717

    if type_ != PM_SCALAR && !OPT_ISSET(ops, b'c') {
        // c:1719
        zwarnnam(
            name,
            &format!("-{} ignored", if type_ == PM_ARRAY { "a" } else { "A" }),
        ); // c:1720
    }

    /* handle non-existent parameter */
    // c:1723
    if args.is_empty() {
        zwarnnam(name, "not enough arguments");
        return 1;
    }
    let mut vbuf = value {
        pm: None,
        arr: Vec::new(),
        scanflags: 0,
        valflags: 0,
        start: 0,
        end: -1,
    };
    let mut cursor: &str = &args[0]; // c:1724 s = args[0]
    let s: String;
    crate::ported::mem::queue_signals(); // c:1725
    let v = crate::ported::params::fetchvalue(
        Some(&mut vbuf),
        &mut cursor,
        (!OPT_ISSET(ops, b'c') || type_ == PM_SCALAR) as i32,
        (SCANPM_WANTKEYS | SCANPM_WANTVALS | SCANPM_MATCHMANY) as i32,
    ); // c:1726
    if v.is_none() && !OPT_ISSET(ops, b'c') {
        // c:1728
        unqueue_signals(); // c:1729
        zwarnnam(name, &format!("no such variable: {}", args[0])); // c:1730
        return 1; // c:1731
    } else if let Some(v) = v {
        // c:1732
        if !cursor.is_empty() {
            // c:1733
            unqueue_signals(); // c:1734
            zwarnnam(name, &format!("not an identifier: `{}'", args[0])); // c:1735
            return 1; // c:1736
        }
        if v.scanflags != 0 {
            // c:1738
            /* Array: check for separators and quote them. */
            // c:1739
            let arr = crate::ported::params::getvaluearr(Some(&mut *v)); // c:1740
            let mut tmparr: Vec<String> = Vec::with_capacity(arr.len()); // c:1741
            for aptr in arr.iter() {
                // c:1742
                let mut sepcount = 0; // c:1743
                /*
                 * See if this word contains a separator character
                 * or backslash
                 */
                // c:1745-1748
                for c in aptr.chars() {
                    // c:1750
                    if c == '\\' || WC_ZISTYPE(c, ISEP as u32) {
                        // c:1751-1756
                        sepcount += 1; // c:1753, c:1757
                    }
                }
                if sepcount != 0 {
                    // c:1760
                    /* Yes, so allocate enough space to quote it. */
                    // c:1761
                    let mut newstr = String::with_capacity(aptr.len() + sepcount + 1); // c:1763
                    /* Go through string quoting separators */
                    // c:1764
                    for c in aptr.chars() {
                        // c:1766
                        if c == '\\' {
                            // c:1767
                            newstr.push('\\'); // c:1768
                            newstr.push(c); // c:1769
                        } else {
                            if WC_ZISTYPE(c, ISEP as u32) {
                                // c:1772
                                newstr.push('\\'); // c:1773
                            }
                            newstr.push(c); // c:1774-1775
                        }
                    }
                    /* Stick this into the array of words to join up */
                    // c:1779
                    tmparr.push(newstr); // c:1780
                } else {
                    tmparr.push(aptr.clone()); /* No, keep original array element */
                    // c:1782
                }
            }
            s = crate::ported::utils::sepjoin(&tmparr, None); // c:1785
        } else {
            s = crate::ported::params::getstrvalue(Some(&mut *v)); // c:1787 ztrdup(getstrvalue(v))
        }
        unqueue_signals(); // c:1789
    } else if !cursor.is_empty() {
        // c:1790
        unqueue_signals(); // c:1791
        zwarnnam(name, &format!("invalid parameter name: {}", args[0])); // c:1792
        return 1; // c:1793
    } else {
        unqueue_signals(); // c:1795
        s = String::new(); // c:1796 ztrdup(s), *s == '\0'
    }

    if SHTTY.load(SeqCst) == -1 || OPT_ISSET(ops, b't') {
        // c:1799
        /* need to open /dev/tty specially */
        // c:1800
        oshtty = SHTTY.load(SeqCst); // c:1801
        let tpath = OPT_ARG_SAFE(ops, b't').unwrap_or("/dev/tty");
        let ctpath = std::ffi::CString::new(tpath).unwrap_or_default();
        let fd = unsafe { libc::open(ctpath.as_ptr(), libc::O_RDWR | libc::O_NOCTTY) };
        SHTTY.store(fd, SeqCst); // c:1802
        if fd == -1 {
            // c:1803
            zwarnnam(name, "can't access terminal"); // c:1804
            return 1; // c:1806
        }
        if unsafe { libc::isatty(SHTTY.load(SeqCst)) } == 0 {
            // c:1808
            zwarnnam(name, &format!("{}: not a terminal", tpath)); // c:1809
            unsafe {
                libc::close(SHTTY.load(SeqCst)); // c:1810
            }
            SHTTY.store(oshtty, SeqCst); // c:1811
            return 1; // c:1813
        }
        oshout = *crate::ported::init::shout.lock().unwrap(); // c:1815
        crate::ported::init::init_shout(); // c:1816

        haso = true; // c:1818
    }

    /* edit the parameter value */
    // c:1821
    BUFSTACK.lock().unwrap().insert(0, s); // c:1822 zpushnode(bufstack, s)

    if let Some(n) = main_keymapname {
        // c:1824
        if savekeymap(name, "main", n, &mut main_keymapsave) != 0 {
            main_keymapname = None; // c:1826
        }
    }
    if let Some(n) = vicmd_keymapname {
        // c:1827
        if savekeymap(name, "vicmd", n, &mut vicmd_keymapsave) != 0 {
            vicmd_keymapname = None; // c:1829
        }
    }

    *varedarg.lock().unwrap() = Some(args[0].clone()); // c:1831
    let ifl = crate::ported::lex::LEX_ISFIRSTLN.with(|c| c.get()); // c:1832
    if OPT_ISSET(ops, b'h') {
        // c:1833
        crate::ported::hist::hbegin(2); // c:1834
    }
    crate::ported::lex::LEX_ISFIRSTLN.with(|c| c.set(OPT_ISSET(ops, b'e'))); // c:1835

    // c:1837 — `zleread` hands back "" for C's NULL (a finished line always
    // ends in a newline, so a real result is never empty).
    let t: Option<String> = match zleread(
        p1,
        p2,
        if OPT_ISSET(ops, b'h') { ZLRF_HISTORY } else { 0 },
        ZLCON_VARED,
        init.unwrap_or("zle-line-init"),
        finish.unwrap_or("zle-line-finish"),
    ) {
        Ok(line) if !line.is_empty() => Some(line),
        _ => None,
    };
    if OPT_ISSET(ops, b'h') {
        // c:1840
        crate::ported::hist::hend(None); // c:1841
    }
    crate::ported::lex::LEX_ISFIRSTLN.with(|c| c.set(ifl)); // c:1842
    *varedarg.lock().unwrap() = ova; // c:1843

    restorekeymap(name, "main", main_keymapname, main_keymapsave); // c:1845
    restorekeymap(name, "vicmd", vicmd_keymapname, vicmd_keymapsave); // c:1846

    if haso {
        // c:1848
        unsafe {
            libc::close(SHTTY.load(SeqCst)); // c:1849 fclose(shout) /* close(SHTTY) */
        }
        *crate::ported::init::shout.lock().unwrap() = oshout; // c:1850
        SHTTY.store(oshtty, SeqCst); // c:1851
    }
    if t.is_none() || errflag.load(SeqCst) != 0 {
        // c:1853
        /* error in editing */
        // c:1854
        errflag.fetch_and(!ERRFLAG_ERROR, SeqCst); // c:1855
        crate::ported::builtin::BREAKS.store(obreaks, SeqCst); // c:1856
        return 1; // c:1859
    }
    let mut t = t.unwrap_or_default();
    /* strip off trailing newline, if any */
    // c:1861
    if t.ends_with('\n') {
        // c:1862
        t.pop(); // c:1863
    }
    /* final assignment of parameter value */
    // c:1864
    if OPT_ISSET(ops, b'c') {
        // c:1865
        crate::ported::params::unsetparam(&args[0]); // c:1866
        crate::ported::params::createparam(&args[0], type_ as i32); // c:1867
    }
    crate::ported::mem::queue_signals(); // c:1869
    let pm_type = crate::ported::params::paramtab()
        .read()
        .unwrap()
        .get(&args[0])
        .map(|pm| PM_TYPE(pm.node.flags as u32)); // c:1870
    if let Some(pt) = pm_type.filter(|pt| (pt & (PM_ARRAY | PM_HASHED)) != 0) {
        // c:1871
        /*
         * Use spacesplit with fourth argument 1: identify quoted separators,
         * and unquote.  This duplicates the string, so we still need to free.
         */
        // c:1874-1877
        let a: Vec<String> = crate::ported::utils::spacesplit(&t, true, true); // c:1878
        if pt == PM_ARRAY {
            // c:1880
            crate::ported::params::assignaparam(&args[0], a, warn_flags); // c:1881
        } else {
            crate::ported::params::sethparam(&args[0], a); // c:1883
        }
    } else {
        crate::ported::params::assignsparam(&args[0], &t, warn_flags); // c:1885
    }
    unqueue_signals(); // c:1886
    0 // c:1887
}

/// Direct port of `int describekeybriefly(char **args)` from
/// `Src/Zle/zle_main.c:1892`. Prompts for a key sequence,
/// resolves it through the current keymap, and prints the bound
/// widget name via `showmsg`.
///
/// Delegates to the live-substrate implementation at
/// `describe_key_briefly()` (snake-cased Rust name) which reads the
/// full key sequence via `getkeymapcmd`, drives the status-line
/// prompt, and emits the binding name via `showmsg`. This C-name-parity
/// entry stays so widget-dispatch callers can find it; it forwards the
/// delegate's exit code (0 success, 1 on the C early-exit paths).
pub fn describekeybriefly() -> i32 {
    // c:1892
    describe_key_briefly() // c:1929 — real-substrate entry.
}

/// Port of `MAXFOUND` from `Src/Zle/zle_main.c:1925`.
/// Hash-search saturation cap: stop walking after this many matches
/// in the brief-key-description scan — keeps the prompt-line summary
/// short enough to fit on screen.
pub const MAXFOUND: usize = 4; // c:1925

/// Port of `struct findfunc` from `Src/Zle/zle_main.c:1927`. Closure
/// state for the `describe-key-briefly` widget — accumulates the
/// found-binding hits up to `MAXFOUND` and a status message.
#[derive(Debug, Default)]
#[allow(non_camel_case_types)]
pub struct findfunc {
    // c:1927
    /// Target Thingy we're searching for; matched against each binding.
    /// !!! WARNING: TYPE DIVERGENCE — C holds the `Thingy` pointer and
    /// compares pointers (c:1939). zshrs's keymap entries are separate
    /// `Thingy` values per binding, so identity is the thingy NAME, the
    /// same key `thingytab` uses.
    pub func: Option<String>, // c:1928
    /// Hit counter; capped at MAXFOUND.
    pub found: usize, // c:1929
    /// Accumulated message: " is on KEY1 KEY2 ..." or similar.
    pub msg: String, // c:1930
}

/// Direct port of `static void scanfindfunc(char *seq, Thingy func,
///                                          char *str, void *magic)`
/// from `Src/Zle/zle_main.c:1935`. Per-keymap scan callback for
/// `describe-key-briefly`: when `func` matches the target in `ff`,
/// appends `" <seq>"` to `ff.msg`, capped at MAXFOUND hits.
pub fn scanfindfunc(seq: &[u8], func: Option<&Thingy>, ff: &mut findfunc) {
    // c:1935
    // c:1939 — `if(func != ff->func) return;` (identity by name, see findfunc).
    if func.map(|t| t.nam.as_str()) != ff.func.as_deref() {
        return;
    }
    // c:1941-1942 — `if (!ff->found++) ff->msg = appstr(ff->msg, " is on");`
    if ff.found == 0 {
        ff.msg.push_str(" is on");
    }
    ff.found += 1;
    if ff.found <= MAXFOUND {
        // c:1943
        let b = crate::ported::zle::zle_utils::bindztrdup(seq); // c:1944
        ff.msg.push(' '); // c:1946
        ff.msg.push_str(&b); // c:1947
    }
}

/// Port of `int whereis(UNUSED(char **args))` from
/// `Src/Zle/zle_main.c:1954-1972` — the `where-is` widget.
pub fn whereis() -> i32 {
    // c:1954
    let mut ff = findfunc::default(); // c:1956
    // c:1958-1959 — `if (!(ff.func = executenamedcommand("Where is: "))) return 1;`
    let Some(name) = crate::ported::zle::zle_misc::executenamedcommand("Where is: ") else {
        return 1; // c:1959
    };
    ff.found = 0; // c:1960
    ff.msg = crate::ported::utils::nicedup(&name, 0); // c:1961
    ff.func = Some(name);
    // c:1962 — `scankeymap(curkeymap, 1, scanfindfunc, &ff);`
    let km_name = curkeymapname().clone();
    if let Some(km) = openkeymap(&km_name) {
        crate::ported::zle::zle_keymap::scankeymap(&km, 1, &mut |seq, func, _str| {
            scanfindfunc(seq, func, &mut ff)
        });
    }
    if ff.found == 0 {
        ff.msg.push_str(" is not bound to any key"); // c:1963-1964
    } else if ff.found > MAXFOUND {
        ff.msg.push_str(" et al"); // c:1965-1966
    }
    crate::ported::zle::zle_utils::showmsg(&ff.msg); // c:1967
    0 // c:1969
}

/// Port of `int recursiveedit(UNUSED(char **args))` from
/// `Src/Zle/zle_main.c:1974`. Drive a nested ZLE edit session —
/// bump zle_recursive, redraw the line, run the editor mainloop,
/// then restore.
pub fn recursiveedit() -> i32 {
    // c:1974
    ZLE_RECURSIVE.fetch_add(1, SeqCst); // c:1976
    redrawhook(); // c:1984
    crate::ported::zle::zle_refresh::zrefresh(); // c:1985
    zlecore(); // c:1986
    ZLE_RECURSIVE.fetch_sub(1, SeqCst); // c:1988
    let cur_errflag = errflag.load(Ordering::Relaxed);
    let locerror = if cur_errflag != 0 { 1 } else { 0 }; // c:1990
    errflag.store(0, Ordering::Relaxed); // c:1992
    DONE.store(0, SeqCst); // c:1993
    locerror // c:1995
}

/// Re-run prompt expansion against the saved templates.
/// Port of `reexpandprompt()` from `Src/Zle/zle_main.c:2000`.
pub fn reexpandprompt() {
    // c:2000
    // c:2002 — static int reexpanding;
    // c:2003 — static int looping;
    // Per-thread recursion counter (bucket 1 — file-static in C).
    thread_local! {
        static REEXPANDING: std::cell::Cell<i32> = const { std::cell::Cell::new(0) };
        static LOOPING: std::cell::Cell<i32> = const { std::cell::Cell::new(0) };
    }
    // c:2005 — if (!reexpanding++) {
    let prev = REEXPANDING.with(|c| {
        let v = c.get();
        c.set(v + 1);
        v
    });
    if prev == 0 {
        // c:2006 — const char **markers = prompt_markers();
        //          (markers[0] = lprompt status, markers[2] = rprompt status —
        //           Rust port doesn't surface markers yet, so they collapse.)
        // c:2012 — int local_lastval = lastval;
        let local_lastval = LASTVAL.load(SeqCst);
        // c:2013 — lastval = pre_zle_status;
        let pre_zs = PRE_ZLE_STATUS.load(SeqCst);
        LASTVAL.store(pre_zs, SeqCst);

        // c:2025/2033 — zsh's `raw_lp`/`raw_rp` are `char **` pointing at
        // the LIVE prompt globals (`&prompt`/`&rprompt`), so
        // `promptexpand(*raw_rp)` re-reads the CURRENT PS1/RPS1/RPROMPT on
        // every reexpand — that is how `zle reset-prompt` (from a
        // `zle-keymap-select` hook) repaints a vim-mode right-prompt
        // indicator mid-line. zshrs stashes RAW_LP/RAW_RP as string COPIES
        // at zleread, so a mid-line `RPROMPT=…` change was invisible and the
        // right prompt never updated. For a normal command-line edit
        // (ZLCON_LINE_START — NOT vared/select, whose prompts are
        // caller-supplied and must not be clobbered), refresh the stash from
        // the live parameters here, matching the inputline read (PS1/RPS1 on
        // the first line, PS2/RPS2 on a continuation, RPROMPT/RPROMPT2 as the
        // classic-name fallback). This is the faithful equivalent of C's
        // live-pointer deref. Bug #654.
        if ZLECONTEXT.load(SeqCst) == crate::ported::zsh_h::ZLCON_LINE_START {
            let first = crate::ported::lex::LEX_ISFIRSTLN.with(|c| c.get());
            let (ps, rp_primary, rp_legacy) = if first {
                ("PS1", "RPS1", "RPROMPT")
            } else {
                ("PS2", "RPS2", "RPROMPT2")
            };
            if let Some(lp) = crate::ported::params::getsparam(ps) {
                *RAW_LP.lock().unwrap() = lp;
            }
            let rp = match crate::ported::params::getsparam(rp_primary) {
                Some(s) if !s.is_empty() => Some(s),
                _ => crate::ported::params::getsparam(rp_legacy),
            };
            *RAW_RP.lock().unwrap() = rp.unwrap_or_default();
        }

        // c:2015-2038 — do { ... } while (looping != reexpanding);
        //               The loop guards against SIGWINCH-during-promptexpand.
        //               Without the SIGWINCH/promptexpand interleave hook
        //               wired into our expander, one pass suffices; mirror
        //               the structure so a future SIGWINCH-aware expander
        //               drops in via the LOOPING counter.
        loop {
            // c:2022 — looping = reexpanding;
            let reexp = REEXPANDING.with(|c| c.get());
            LOOPING.with(|c| c.set(reexp));

            // c:2024 — txtcurrentattrs = txtpendingattrs = txtunknownattrs = 0;
            *crate::ported::prompt::current_attrs_lock().lock().unwrap() = 0;
            *crate::ported::prompt::pending_attrs_lock().lock().unwrap() = 0;
            crate::ported::prompt::txtunknownattrs.store(0, Ordering::Relaxed);

            // c:2025 — new_lprompt = promptexpand(raw_lp ? *raw_lp : NULL, 1, markers[0], NULL, NULL);
            let raw_lp = RAW_LP.lock().unwrap().clone();
            let new_lp = crate::prompt::expand_prompt(&raw_lp);
            // c:2026 — `pmpt_attr = txtcurrentattrs;`
            crate::ported::zle::zle_refresh::PMPT_ATTR.store(
                *crate::ported::prompt::current_attrs_lock().lock().unwrap(),
                Ordering::SeqCst,
            );
            // c:2027-2028 — free(lpromptbuf); lpromptbuf = new_lprompt;
            *LPROMPT.lock().unwrap() = new_lp;

            // c:2030-2031 — if (looping != reexpanding) continue;
            if LOOPING.with(|c| c.get()) != REEXPANDING.with(|c| c.get()) {
                continue;
            }

            // c:2033 — new_rprompt = promptexpand(raw_rp ? *raw_rp : NULL, 1, markers[2], NULL, NULL);
            let raw_rp = RAW_RP.lock().unwrap().clone();
            let new_rp = crate::prompt::expand_prompt(&raw_rp);
            // c:2034 — `rpmpt_attr = txtcurrentattrs;`
            crate::ported::zle::zle_refresh::RPMPT_ATTR.store(
                *crate::ported::prompt::current_attrs_lock().lock().unwrap(),
                Ordering::SeqCst,
            );
            // c:2036-2037 — free(rpromptbuf); rpromptbuf = new_rprompt;
            *RPROMPT.lock().unwrap() = new_rp;

            // c:2038 — } while (looping != reexpanding);
            if LOOPING.with(|c| c.get()) == REEXPANDING.with(|c| c.get()) {
                break;
            }
        }

        // c:2040 — lastval = local_lastval;
        LASTVAL.store(local_lastval, SeqCst);
        ZLE_RESET_NEEDED.store(1, SeqCst);
    } else {
        // c:2041-2042 — } else looping = reexpanding;
        let reexp = REEXPANDING.with(|c| c.get());
        LOOPING.with(|c| c.set(reexp));
    }
    // c:2043 — reexpanding--;
    REEXPANDING.with(|c| c.set(c.get() - 1));
}

/// Mark the prompt as needing a re-expand on next refresh.
/// Port of `resetprompt(UNUSED(char **args))` from Src/Zle/zle_main.c:2048. The C
/// source calls `zle_resetprompt()` which sets `resetneeded` and
/// `clearflag` so the next zrefresh emits the TCCLEAREOD escape.
/// WARNING: param names don't match C — Rust=() vs C=(args)
pub fn resetprompt() {
    ZLE_RESET_NEEDED.store(1, SeqCst);
    CLEARFLAG.store(1, SeqCst);
}

/// Direct port of `void zle_resetprompt(void)` from
/// `Src/Zle/zle_main.c:2058`.
/// ```c
/// reexpandprompt();
/// if (zleactive)
///     redisplay(NULL);
/// ```
/// Triggers a prompt re-expansion + redraw.
pub fn zle_resetprompt() {
    // c:2058
    reexpandprompt(); // c:2060
                      // Flag for deferred-redisplay observers that still consult it
                      // (zlecore reads ZLE_RESET_NEEDED to know a redraw happened).
    ZLE_RESET_NEEDED.store(1, SeqCst);
    if zleactive.load(Ordering::Relaxed) != 0 {
        // c:2061-2062 — `if (zleactive) redisplay(NULL);`
        crate::ported::zle::zle_refresh::redisplay(); // c:2062
        SHOWINGLIST.store(-2, SeqCst);
    }
}

/// Move past the ZLE display so non-ZLE output (a child command's
/// output, an error message, etc.) doesn't overwrite the prompt.
/// Port of `trashzle()` from Src/Zle/zle_main.c:2068. The C source
/// runs a final zrefresh, applies the prompt's text attributes,
/// moves to the bottom of the displayed lines (`moveto(nlnct, 0)`),
/// optionally clears to end-of-display via the TCCLEAREOD termcap,
/// emits postedit if set, then flags `resetneeded` and restores tty
/// state. Our simplified version does the equivalent for a
/// single-line display: emit \\r + clear-to-EOL, flush stdout, then
/// arm `resetneeded` so the next zlecore iteration redraws.
/// Rust idiom replacement: single-line display means the full C
/// `moveto(nlnct, 0)` + `tcout(TCCLEAREOD)` + `postedit` sequence
/// collapses to `\r` + cleareol + SGR-reset; multi-line teardown
/// belongs to the live widget tick.
pub fn trashzle() {
    // c:2068
    use crate::ported::prompt::{applytextattributes, treplaceattrs};
    use crate::ported::utils::errflag;
    use crate::ported::zle::zle_refresh::{
        moveto, tcout, NLNCT, PROMPT_ATTR, SHOWINGLIST, TRASHEDZLE,
    };
    use crate::ported::zsh_h::{TCCLEAREOD, ZLRF_NOSETTY};

    // c:2072 — `if (zleactive && !trashedzle)`. Both gates required.
    if zleactive.load(Ordering::Relaxed) != 0 && TRASHEDZLE.load(Ordering::Relaxed) == 0 {
        // c:2078-2081 — `int sl = showinglist; showinglist = 0;
        //                trashedzle = 1; zrefresh(); showinglist = sl;`
        // Suppress list-display in the redraw to prevent infinite
        // recursion (zrefresh would re-call trashzle for the list).
        let sl = SHOWINGLIST.load(Ordering::Relaxed); // c:2078
        SHOWINGLIST.store(0, Ordering::Relaxed); // c:2079
        TRASHEDZLE.store(1, Ordering::Relaxed); // c:2080
        crate::ported::zle::zle_refresh::zrefresh(); // c:2081
        SHOWINGLIST.store(sl, Ordering::Relaxed); // c:2082

        // c:2083 — `treplaceattrs(prompt_attr);`. Restore the prompt
        // attribute set (so post-edit output inherits the right SGR).
        treplaceattrs(PROMPT_ATTR.load(Ordering::Relaxed));
        // c:2084 — `applytextattributes(0);`. Emit the SGR diff bytes
        // to take the pending attrs live.
        crate::shout::write(applytextattributes(0).as_bytes());
        // c:2085 — `moveto(nlnct, 0);`. Park cursor one row past the
        // last drawn line, column 0.
        moveto(NLNCT.load(Ordering::Relaxed) as usize, 0);

        // c:2086-2087 — `if (clearflag && tccan(TCCLEAREOD))
        //                  { tcout(TCCLEAREOD); clearflag = listshown = 0; }`
        // tcout() short-circuits on absent caps in the Rust port so
        // the tccan guard collapses into the call itself.
        if crate::ported::zle::zle_refresh::CLEARFLAG.load(Ordering::Relaxed) != 0 {
            tcout(TCCLEAREOD); // c:2087
            crate::ported::zle::zle_refresh::CLEARFLAG.store(0, Ordering::Relaxed);
            crate::ported::zle::zle_refresh::LISTSHOWN.store(0, Ordering::Relaxed);
        }

        // c:2088-2089 — `if (postedit) fprintf(shout, "%s", unmeta(postedit));`
        // Emit $POSTEDIT from the param table (typically empty;
        // users override to clean up modes / colors after editing).
        let postedit = crate::ported::params::paramtab()
            .read()
            .ok()
            .and_then(|t| t.get("POSTEDIT").and_then(|p| p.u_str.clone()))
            .unwrap_or_default();
        if !postedit.is_empty() {
            let fd = SHTTY.load(Ordering::Relaxed);
            let out = if fd >= 0 { fd } else { 1 };
            let _ = write_loop(out, postedit.as_bytes());
        }
        // c:2090 — `fflush(shout);`. Display output now goes through the
        // buffered `shout` stream (crate::shout), so the flush is real:
        // whatever the caller drew has to be on screen before the shell
        // hands the terminal back.
        crate::shout::flush();

        // c:2091 — `resetneeded = 1;`. Mark for full redraw on the
        // next zlecore iteration. Set the REAL refresh-owned RESETNEEDED
        // (which zrefresh consumes to home the video cursor, clear OBUF,
        // clear trashedzle, and re-emit the prompt) — this is what lets the
        // recursive post-listmatches zrefresh redraw the command line BELOW
        // the completion grid, and clears trashedzle so the next asklist
        // trashzle can park below the line again. ZLE_RESET_NEEDED is also
        // set for the `zle -R`/reset-prompt param readers that watch it.
        crate::ported::zle::zle_refresh::RESETNEEDED.store(1, SeqCst);
        ZLE_RESET_NEEDED.store(1, SeqCst);

        // c:2092-2093 — `if (!(zlereadflags & ZLRF_NOSETTY))
        //                  settyinfo(&shttyinfo);`
        // Restore the cooked terminal baseline captured by
        // `save_shttyinfo_once()` (in zsetterm) so the accepted command
        // executes with a normal tty: `^D` is EOF, `^C` is SIGINT, line
        // editing works. Previously a no-op stub, which left the tty in
        // ZLE raw mode across command execution — so `cat` never saw EOF
        // on `^D`, and interactive programs got raw single-byte input.
        if (ZLEREADFLAGS.load(Ordering::Relaxed) & ZLRF_NOSETTY) == 0 {
            // c:2092 settyinfo(&shttyinfo) — restore the cooked baseline.
            // Fires for non-NOSETTY ZLE reads (e.g. `vared`); the main
            // interactive read sets ZLRF_NOSETTY and defers the restore to
            // hend() (hist.rs) per input.c:418.
            if let Some(ti) = crate::ported::utils::SHTTYINFO.lock().ok().and_then(|g| *g) {
                crate::ported::utils::settyinfo(&ti);
            }
        }
    }

    // c:2095-2096 — `if (errflag) kungetct = 0;`. Discard pending
    // input on error so the next prompt starts clean.
    if errflag.load(Ordering::Relaxed) != 0 {
        KUNGETCT.store(0, Ordering::Relaxed);
    }
}

/// Port of `zlebeforetrap(UNUSED(Hookdef dummy), UNUSED(void *dat))` from `Src/Zle/zle_main.c:2103`.
/// ```c
/// static int
/// zlebeforetrap(UNUSED(Hookdef dummy), UNUSED(void *dat))
/// {
///     if (zleactive) {
///         startparamscope();
///         makezleparams(1);
///     }
///     return 0;
/// }
/// ```
/// Hook callback fired BEFORE a trap handler runs — pushes a
/// param scope and exposes ZLE state to the trap function (when
/// zle is active). Hookfn signature `(Hookdef, void *) -> int`.
/// Both params are unused (C: `UNUSED(Hookdef dummy), UNUSED(void *dat)`).
pub fn zlebeforetrap(
    // c:2104
    _dummy: *mut hookdef,
    _dat: *mut std::ffi::c_void,
) -> i32 {
    use std::sync::atomic::Ordering;
    if zleactive.load(Ordering::Relaxed) != 0 {
        // c:2106
        // c:2107 — `startparamscope()`. Push a param scope so trap
        // function locals don't leak into the outer shell state.
        // C uses the global `params` HashTable directly; the Rust
        // paramtab API takes a HashTable arg so we pass a fresh
        // empty one matching the C scope-push semantics.
        let mut local_scope: HashTable = Box::new(hashtable {
            hsize: 0,
            ct: 0,
            nodes: Vec::new(),
            tmpdata: 0,
            parnodes: Default::default(),
            hash: None,
            emptytable: None,
            filltable: None,
            cmpnodes: None,
            addnode: None,
            getnode: None,
            getnode2: None,
            removenode: None,
            disablenode: None,
            enablenode: None,
            freenode: None,
            printnode: None,
            scantab: None,
        });
        crate::ported::params::startparamscope(&mut local_scope);
        // c:2108 — `makezleparams(1)`. Snapshot the ZLE state ($BUFFER
        // etc.) into the paramtab as readonly so trap ported observe
        // the live editor state.
        makezleparams(1);
    }
    0 // c:2110 return 0
}

/// Port of `zleaftertrap(UNUSED(Hookdef dummy), UNUSED(void *dat))` from `Src/Zle/zle_main.c:2114`.
/// ```c
/// static int
/// zleaftertrap(UNUSED(Hookdef dummy), UNUSED(void *dat))
/// {
///     if (zleactive)
///         endparamscope();
///     return 0;
/// }
/// ```
/// Hook callback fired AFTER a trap handler runs — pops the
/// param scope that `zlebeforetrap` pushed (if zle is active).
/// Hookfn signature `(Hookdef, void *) -> int`. Both params unused
/// (C: `UNUSED(Hookdef dummy), UNUSED(void *dat)`).
pub fn zleaftertrap(
    // c:2114
    _dummy: *mut hookdef,
    _dat: *mut std::ffi::c_void,
) -> i32 {
    use std::sync::atomic::Ordering;
    if zleactive.load(Ordering::Relaxed) != 0 {
        // c:2116
        crate::ported::params::endparamscope(); // c:2117
    }
    0 // c:2119 return 0
}

/// Direct port of `int setup_(UNUSED(Module m))` from
/// `Src/Zle/zle_main.c:2243`. Module-load init: registers thingies +
/// queries terminal capabilities + assigns `$zle_bracketed_paste`.
#[allow(unused_variables)]
/// Guards the one-shot `setup_` run. C loads `zsh/zle` through the normal
/// module chain, so `setup_` (c:zle_main.c:2246-2288) runs at MODULE LOAD;
/// zshrs links zle statically and used to run it lazily on first `zleread`.
/// That left `$zle_bracketed_paste` unset in any shell that had loaded the
/// module but not yet entered the editor:
///
/// ```text
///     zmodload zsh/zle; print ${+zle_bracketed_paste}
///     zsh 1    zshrs 0
/// ```
///
/// Shared by both call sites so `init_thingies()` cannot run twice.
pub(crate) static ZLE_MODULE_SETUP: std::sync::Once = std::sync::Once::new();

pub fn setup_(m: *const module) -> i32 {
    // c:zle_main.c setup_
    // c:2252 — `init_thingies()` registers the built-in widgets.
    crate::ported::zle::zle_thingy::init_thingies();
    // c:2256 — `stackhist = stackcs = -1`. These exist as atomics.
    /* detect terminal color and features */
    // c:2271-2272 — `if (shout) query_terminal();`
    if *crate::ported::init::shout.lock().unwrap() != 0 {
        crate::ported::zle::termquery::query_terminal();
    }
    // c:2275-2279 — set `$zle_bracketed_paste` to the bracketed-paste
    // mode toggle escapes.
    let bpaste = vec![
        "\u{1b}[?2004h".to_string(), // c:2276
        "\u{1b}[?2004l".to_string(), // c:2277
    ];
    let _ = crate::ported::params::assignaparam("zle_bracketed_paste", bpaste, 0); // c:2279
    0 // c:2281
}

/// Direct port of `static int features_(Module m, char ***features)`
/// from `Src/Zle/zle_main.c:2286`. Returns the module's
/// feature-name array via `featuresarray(m, &module_features)`,
/// matching the C body line-for-line.
pub fn features_(m: *const module, features: &mut Vec<String>) -> i32 {
    // c:2286
    // c:2287-2288 — `*features = featuresarray(m, &module_features); return 0`.
    // `module_features` (c:2234-2240) carries `bintab` ALONE — `NULL, 0` for
    // the cd/mf/pd blocks — and `bintab` (c:2209-2213) is the three builtins
    // below. The 25 `p:` rows a prior port added here have no counterpart:
    // ZLE's special parameters are created by `zle`'s own setup (the
    // `zleparams` table, c:Src/Zle/zle_params.c), NOT by the module feature
    // interface, so `zsh -f -c "zmodload zsh/zle; zmodload -lF zsh/zle"`
    // lists exactly `+b:bindkey +b:vared +b:zle`.
    let _ = m;
    features.clear();
    features.extend([
        "b:bindkey".to_string(), // c:2210
        "b:vared".to_string(),   // c:2211
        "b:zle".to_string(),     // c:2212
    ]);
    0 // c:2288
}

/// Port of `enables_(UNUSED(Module m), UNUSED(int **enables))` from Src/Zle/zle_main.c:2294.
#[allow(unused_variables)]
pub fn enables_(m: *const module, enables: &mut Option<Vec<i32>>) -> i32 {
    // c:2294 — `return handlefeatures(m, &module_features, enables);`.
    // Returning 0 without touching `enables` left the caller's
    // `unwrap_or(vec![0; …])` fallback in place, so a LOADED zsh/zle
    // reported `-b:bindkey -b:vared -b:zle` where zsh reports all three
    // `+`. The name-keyed handlefeatures in module.rs holds the per-feature
    // ADDED bit for the ports with no `Features` descriptor table.
    let mut feats: Vec<String> = Vec::new();
    features_(m, &mut feats); // c:2287 featuresarray(m, &module_features)
    crate::ported::module::handlefeatures("zsh/zle", &feats, enables)
}

// ===========================================================
// Methods moved verbatim from src/ported/vm_helper because their
// C counterpart's source file maps 1:1 to this Rust module.
// Rust permits multiple inherent impl blocks for the same
// type within a crate, so call sites in vm_helper are unchanged.
// ===========================================================

// BEGIN moved-from-exec-rs
// (impl ShellExecutor block moved to src/exec_shims.rs — see file marker)

// END moved-from-exec-rs

/// Direct port of `static int boot_(Module m)` from
/// `Src/Zle/zle_main.c:2301`.
/// ```c
/// addhookfunc("before_trap", zlebeforetrap);
/// addhookfunc("after_trap",  zleaftertrap);
/// addhookdefs(m, zlehooks, sizeof(zlehooks)/sizeof(*zlehooks));
/// return 0;
/// ```
pub fn boot_(_m: *const module) -> i32 {
    // c:2301
    // c:2303-2304 — `addhookfunc("before_trap", zlebeforetrap);
    //                addhookfunc("after_trap",  zleaftertrap);`
    // The trap hookdefs are registered as part of init.rs's `zshhooks[]`
    // (entries 1 and 2). With real Hookfn fn pointers now flowing
    // through `addhookfunc`, the trap thunks attach directly.
    addhookfunc("before_trap", zlebeforetrap); // c:2303
    addhookfunc("after_trap", zleaftertrap); // c:2304

    // Register comphooks defs. C zsh's complete-module setup_() does
    // `addhookdefs(m, comphooks, ...)` (complete.c:1766) with the
    // 5-entry comphooks[] table (complete.c:1702). The zle and complete
    // modules are statically linked together in zshrs so the
    // registration happens here. Each name is registered as a fresh
    // hookdef in the global `hooktab` so the canonical
    // `runhookdef(gethookdef(NAME), &dat)` dispatch path in compcore /
    // compresult / zle_tricky finds them. Re-entry is guarded by
    // `addhookdef`'s duplicate check (c:866) — second boot_() returns
    // 1 per hook and we ignore.
    // c:1702-1707 — comphooks[] carries per-hook (default fn, flags). The
    // earlier port blanket-registered all 5 with `def=None, HOOKF_ALL`,
    // which broke `comp_list_matches`: C gives it `def=ilistmatches, 0`
    // (complete.c:1717) so `runhookdef` falls back to the plain renderer
    // when zsh/complist isn't loaded, and runs only the LAST func
    // (complistmatches) — not all-funcs-then-default — when it is.
    let comphooks: [(&str, Option<crate::ported::zsh_h::Hookfn>, i32); 5] = [
        ("insert_match", None, crate::ported::zsh_h::HOOKF_ALL), // c:1703
        ("menu_start", None, crate::ported::zsh_h::HOOKF_ALL),   // c:1704
        ("compctl_make", None, 0),                               // c:1705
        ("compctl_cleanup", None, 0),                            // c:1706
        (
            "comp_list_matches", // c:1707
            Some(crate::ported::zle::compresult::ilistmatches),
            0,
        ),
    ];
    // c:2306 — `addhookdefs(m, zlehooks, …)`. The six ZLE hookdefs
    // (zle_main.c:2219) all `HOOKDEF(name, NULL, 0)`. These were NEVER
    // registered (zle_main::boot_ wasn't called and only the comphooks were
    // added here), so `gethookdef("after_complete")` returned null and the
    // AFTERCOMPLETEHOOK never fired → menucmp-driven menu_start (→
    // domenuselect / interactive menu-select) never started. Register them
    // with def=None so `complete::boot_` can attach the real funcs.
    let zlehooks = [
        "list_matches",      // c:2221 LISTMATCHESHOOK
        "complete",          // c:2223 COMPLETEHOOK
        "before_complete",   // c:2225 BEFORECOMPLETEHOOK
        "after_complete",    // c:2227 AFTERCOMPLETEHOOK
        "accept_completion", // c:2229 ACCEPTCOMPHOOK
        "invalidate_list",   // c:2231 INVALIDATELISTHOOK
    ];
    let all: Vec<(&str, Option<crate::ported::zsh_h::Hookfn>, i32)> = comphooks
        .into_iter()
        .chain(zlehooks.into_iter().map(|n| (n, None, 0)))
        .collect();
    for (name, def, flags) in all {
        let h = Box::into_raw(Box::new(hookdef {
            next: std::ptr::null_mut(),
            name: name.to_string(),
            def,
            flags,
            funcs: std::ptr::null_mut(),
        }));
        if crate::ported::module::addhookdef(h) != 0 {
            // Already present from a prior boot_(); reclaim the Box.
            unsafe {
                drop(Box::from_raw(h));
            }
        }
    }
    0 // c:2309
}

/// Direct port of `static int cleanup_(Module m)` from
/// `Src/Zle/zle_main.c:2312`.
/// ```c
/// if (zleactive) { zerrnam(...); return 1; }
/// deletehookfunc("before_trap", zlebeforetrap);
/// deletehookfunc("after_trap", zleaftertrap);
/// // delete keymaps + restore old entry points
/// return 0;
/// ```
pub fn cleanup_(_m: *const module) -> i32 {
    // c:2312
    // c:2314 — refuse to unload while ZLE is active.
    if zleactive.load(Ordering::Relaxed) != 0 {
        return 1;
    }
    // c:2318-2319 — `deletehookfunc("before_trap", zlebeforetrap);
    //                deletehookfunc("after_trap",  zleaftertrap);`
    deletehookfunc("before_trap", zlebeforetrap); // c:2318
    deletehookfunc("after_trap", zleaftertrap); // c:2319
                                                // c:2321-2324 — `deletekeymap(...)`. Drop is automatic on Arc<Keymap>;
                                                // explicit-name unlink from keymapnamtab so the next module load starts
                                                // fresh.
    if let Ok(mut tab) = keymapnamtab().lock() {
        tab.clear();
    }
    0 // c:2325
}

/// Direct port of `int finish_(UNUSED(Module m))` from
/// `Src/Zle/zle_main.c:2327`. Releases per-module state: incremental
/// search spots, vi-buffer slots, killring entries, clwords array,
/// and runs the refresh-state finalizer.
#[allow(unused_variables)]
pub fn finish_(m: *const module) -> i32 {
    // c:zle_main.c finish_
    // c:2338 — `free_isrch_spots()`.
    free_isrch_spots();
    // c:2342-2346 — kring entries: in Rust the KILLRING is a
    // `Mutex<VecDeque<cutbuffer>>` owned by the runtime; clearing
    // it drops the entries.
    if let Ok(mut ring) = KILLRING.lock() {
        ring.clear();
    }
    // c:2347 — `for(i=36;i--;) zfree(vibuf[i].buf,...)`. The vibuf()
    // mutex owns its slots; Drop will fire when the static is replaced.
    if let Ok(mut vb) = vibuf().lock() {
        for slot in vb.iter_mut() {
            *slot = crate::ported::zle::zle_h::cutbuffer::default();
        }
    }
    // c:2351-2352 — `zle_entry_ptr = NULL; zle_load_state = 0`. Our
    // runtime doesn't dispatch via fn-pointer; the call surface is
    // direct, so this collapses to no-op.
    0 // c:2357
}

// `pub type ZleChar = char;`, `pub type ZleString = Vec<ZleChar>;`,
// `pub type ZleInt = i32;` — three Rust-only type aliases with no C
// counterpart, DELETED per PORT.md Rule 0. C uses the canonical
// `ZLE_CHAR_T` / `ZLE_STRING_T` typedefs in `Src/Zle/zle.h:31-32`
// (ported at `zle_h.rs:45/48`), and plain `int` for the integer
// case. Callers now use `char` / `Vec<char>` / `i32` directly.

// `pub struct Zle;` deleted along with `impl Default for Zle` and
// `impl Zle { fn new() }`. The unit marker had no C counterpart and
// served only as a per-instance dispatch tag for the now-deleted
// methods. State init lives in `zle_reset()` below, the C-equivalent
// of `zleread()`'s reset block at `Src/Zle/zle_main.c:1216`.

// `CompletionRequest` enum deleted along with the matching field.
// C dispatches completion-widget variants via separate function
// pointers in `Src/Zle/zle_tricky.c` — no enum type.

/// Process-wide lock that serialises ZLE-touching tests. The ZLE
/// session state lives in file-scope statics (ZLELINE/ZLECS/etc.);
/// `cargo test` runs tests in parallel by default which races on
/// those shared statics. Tests acquire this lock at the top
/// (typically via `zle_test_setup()` below) so the parallel runner
/// effectively serialises just the ZLE-touching subset. No C
/// counterpart — C is single-threaded so the question doesn't arise.
#[doc(hidden)]
pub static ZLE_TEST_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());

/// Test-only setup helper: acquires `ZLE_TEST_LOCK` and resets state.
/// Returns the lock guard which holds for the test body's lifetime.
/// Pattern: `let _g = zle_test_setup();`
/// at the top of every `#[test]` that mutates ZLE statics.
#[doc(hidden)]
pub fn zle_test_setup() -> std::sync::MutexGuard<'static, ()> {
    // Poison-tolerant: if a prior test panicked while holding the
    // lock, recover the guard rather than poisoning every subsequent
    // test. Tests reset state via zle_reset() anyway.
    let guard = ZLE_TEST_LOCK.lock().unwrap_or_else(|e| e.into_inner());

    // Drop the poison flag from every `complete.c` string global before
    // the test body runs.
    //
    // The C originals (`char *compprefix` et al, `Src/Zle/complete.c:
    // 47-73`) are plain pointers; the port wraps each in a `Mutex` so the
    // same process-wide storage is shared safely. That wrapper adds a
    // failure mode C does not have: a test that panics INSIDE
    // `assert_eq!(*X.lock().unwrap(), …)` still holds the guard while the
    // assertion unwinds, so the mutex stays poisoned for the rest of the
    // test binary and every later `.lock().unwrap()` panics with
    // `PoisonError` before reaching a single assertion.
    //
    // Observed: one failing `compcore` test poisoned `COMPPREFIX` and
    // nine unrelated `compcore`/`complete`/`computil` tests then reported
    // `PoisonError` instead of running. Clearing the flag bounds the
    // damage to the test that actually failed. It cannot mask a bug — the
    // guarded data is a `String` that each of these tests seeds before
    // use, and the test that failed still fails.
    //
    // Inlined here rather than factored into a helper: `src/ported/` is a
    // port and build.rs rejects functions with no C counterpart.
    {
        use crate::ported::zle::complete::{
            COMPCONTEXT, COMPIPREFIX, COMPISUFFIX, COMPLASTPREFIX, COMPLASTSUFFIX, COMPLIST,
            COMPPARAMETER, COMPPATINSERT, COMPPREFIX, COMPQIPREFIX, COMPQISUFFIX, COMPQSTACK,
            COMPQUOTE, COMPQUOTING, COMPREDIRECT, COMPSUFFIX, COMPVARED, COMPWORDS,
        };
        for g in [
            &COMPPREFIX,
            &COMPSUFFIX,
            &COMPLASTPREFIX,
            &COMPLASTSUFFIX,
            &COMPIPREFIX,
            &COMPISUFFIX,
            &COMPQIPREFIX,
            &COMPQISUFFIX,
            &COMPQUOTE,
            &COMPQUOTING,
            &COMPQSTACK,
            &COMPLIST,
            &COMPCONTEXT,
            &COMPPARAMETER,
            &COMPREDIRECT,
            &COMPPATINSERT,
            &COMPVARED,
        ] {
            // An un-initialised OnceLock holds no mutex, so nothing to clear.
            if let Some(m) = g.get() {
                m.clear_poison();
            }
        }
        if let Some(m) = COMPWORDS.get() {
            m.clear_poison();
        }
    }

    zle_reset();
    guard
}

/// Reset every ZLE-session file-scope static to its zero-state.
/// Equivalent to the global state initialisation that `zleread()`
/// performs at the start of each line edit in Src/Zle/zle_main.c:1216
/// — `zleline = NULL; zlecs = zlell = 0; done = 0; eofsent = 0; ...`.
/// Called by tests and by the host before entering a new edit
/// session. No C counterpart name; the equivalent C reset is the
/// inline assignment block at the head of `zleread`.
pub fn zle_reset() {
    // Seed the global keymap table on first reset call. The C source
    // fires `createkeymapnamtab()` + `default_bindings()` once at
    // module init (zle.c:init_zle).
    crate::ported::zle::zle_keymap::createkeymapnamtab();
    crate::ported::zle::zle_keymap::default_bindings();
    ZLELINE.lock().unwrap().clear();
    ZLECS.store(0, SeqCst);
    ZLELL.store(0, SeqCst);
    MARK.store(0, SeqCst);
    *LBINDK.lock().unwrap() = None;
    *BINDK.lock().unwrap() = None;
    *ZMOD.lock().unwrap() = modifier {
        flags: 0,
        mult: 1,
        tmult: 1,
        vibuf: 0,
        base: 10,
    };
    *STATUSLINE.lock().unwrap() = None;
    // c:2257 — `stackhist = stackcs = -1;`. The INACTIVE sentinel, not 0.
    STACKHIST.store(-1, SeqCst);
    STACKCS.store(-1, SeqCst);
    // c:1286 — `vistartchange = -1`. The INACTIVE sentinel, which the
    // readers spell `u64::MAX` (zle_utils.rs:1907, :1937) because the port
    // holds a signed C `zlong` in an AtomicU64. Storing 0 here said
    // "an insert session is open, and it began at change 0" on every fresh
    // line, so `splitundo` took its active arm and `mergeundo` chained
    // change records from a session that never started — which is what
    // decided how far a single `u` unwound.
    VISTARTCHANGE.store(u64::MAX, SeqCst);
    UNDO_STACK.lock().unwrap().clear();
    CHANGENO.store(0, SeqCst);
    KUNGETBUF.lock().unwrap().clear();
    BAUD.store(38400, SeqCst);
    WATCH_FDS.lock().unwrap().clear();
    *COMPWIDGET.lock().unwrap() = None;
    HASCOMPMOD.store(false, SeqCst);
    TTYFD.store(0, SeqCst);
    LPROMPT.lock().unwrap().clear();
    RPROMPT.lock().unwrap().clear();
    PRE_ZLE_STATUS.store(0, SeqCst);
    for slot in vibuf().lock().unwrap().iter_mut() {
        *slot = crate::ported::zle::zle_h::cutbuffer::default();
    }
    KILLRING.lock().unwrap().clear();
    KILLRINGMAX.store(8, SeqCst);
    *CUTBUF.lock().unwrap() = crate::ported::zle::zle_h::cutbuffer::default();
    crate::ported::zle::zle_misc::KCT.store(-1, SeqCst);
    crate::ported::zle::zle_misc::KCTBUF_SEL.store(-2, SeqCst);
    YANKLAST.store(false, SeqCst);
    NEG_ARG.store(false, SeqCst);
    MULT.store(1, SeqCst);
    *history().lock().unwrap() = History::new(2000);
    LASTCOL.store(-1, SeqCst);
    BUFSTACK.lock().unwrap().clear();
    VICHGBUF.lock().unwrap().clear();
    *SRCH_STR.lock().unwrap() = None;
    LASTLINE.lock().unwrap().clear();
    LASTLL.store(0, SeqCst);
    LASTCS.store(0, SeqCst);
    CURCHANGE.store(0, SeqCst);
    UNDO_CHANGENO.store(0, SeqCst);
    UNDO_LIMITNO.store(0, SeqCst);
    VIINSBEGIN.store(0, SeqCst);
    YANKB.store(0, SeqCst);
    YANKE.store(0, SeqCst);
    YANKCS.store(0, SeqCst);
    *KCT.lock().unwrap() = None;
    *vimarks().lock().unwrap() = [None; 27];
    REGION_ACTIVE.store(0, SeqCst);
    PENDING_HOOKS.lock().unwrap().clear();
    RAW_LP.lock().unwrap().clear();
    RAW_RP.lock().unwrap().clear();
    *highlight().lock().unwrap() = HighlightManager::new();
}

/// Try to read a byte non-blocking
fn try_read_byte(buf: &mut [u8]) -> io::Result<bool> {
    let mut fds = [libc::pollfd {
        fd: io::stdin().as_raw_fd(),
        events: libc::POLLIN,
        revents: 0,
    }];

    let ret = unsafe { libc::poll(fds.as_mut_ptr(), 1, 0) };

    if ret > 0 && (fds[0].revents & libc::POLLIN) != 0 {
        match io::stdin().read(buf) {
            Ok(1) => Ok(true),
            Ok(_) => Ok(false),
            Err(e) => Err(e),
        }
    } else {
        Ok(false)
    }
}

// `VaredOpts` deleted — Rust-invented options struct that bundled
// the per-flag args bin_vared parses (-p/-r/-e/-h). C reads them
// from `Options ops` via OPT_ARG/OPT_ISSET inline, no separate
// struct. The fake had no users after `vared_zle_run` was deleted.

/// Args carried into `zle_main_entry` — replaces C's `va_list ap`
/// (Rust has no ergonomic va_list). Each variant maps to the
/// matching ZLE_CMD_* arm in the C switch at Src/Zle/zle_main.c:2125.
///
/// WARNING: RUST-ONLY — no C counterpart; the C source uses `va_arg`
/// to pull per-cmd args from the va_list at lines 2128-2197.
pub enum zle_main_entry_args<'a> {
    // c:2123 va_list ap shape
    /// `GetLine` variant.
    GetLine { ll: &'a mut i32, cs: &'a mut i32 }, // c:2127
    /// `Read` variant.
    Read {
        lp: &'a mut Option<String>,
        rp: &'a mut Option<String>,
        flags: i32,
        context: i32,
    }, // c:2135
    /// `AddToLine` variant.
    AddToLine(i32), // c:2149
    /// `Trash` variant.
    Trash, // c:2152
    /// `ResetPrompt` variant.
    ResetPrompt, // c:2156
    /// `Refresh` variant.
    Refresh, // c:2160
    /// `SetKeymap` variant.
    SetKeymap(i32), // c:2164
    /// `GetKey` variant.
    GetKey {
        do_keytmout: i64,
        timeout: &'a mut i32,
        chrp: &'a mut i32,
    }, // c:2168
    /// `SetHistLine` variant.
    SetHistLine(i64), // c:2180
    /// `Preexec` variant.
    Preexec, // c:2187
    /// `Postexec` variant.
    Postexec, // c:2191
    /// `Chpwd` variant.
    Chpwd, // c:2195
}

/// Port of `static char *zle_main_entry(int cmd, va_list ap)` from
/// `Src/Zle/zle_main.c:2123`. Per-module dispatcher invoked through the
/// `zle_entry_ptr` indirection set up at c:2248. Routes ZLE_CMD_* into
/// the underlying ZLE primitives (`zlegetline`, `zleread`, `zleaddtoline`,
/// `trashzle`, `zle_resetprompt`, `zrefresh`, `zlesetkeymap`, `getbyte`,
/// `mark_output`, `notify_pwd`).
///
/// ```c
/// static char *
/// zle_main_entry(int cmd, va_list ap)
/// {
///     switch (cmd) {
///     case ZLE_CMD_GET_LINE:
///     {
///         int *ll, *cs;
///         ll = va_arg(ap, int *);
///         cs = va_arg(ap, int *);
///         return zlegetline(ll, cs);
///     }
///     case ZLE_CMD_READ: ... return zleread(lp, rp, flags, context, "zle-line-init", "zle-line-finish");
///     case ZLE_CMD_ADD_TO_LINE: zleaddtoline(va_arg(ap, int)); break;
///     case ZLE_CMD_TRASH: trashzle(); break;
///     case ZLE_CMD_RESET_PROMPT: zle_resetprompt(); break;
///     case ZLE_CMD_REFRESH: zrefresh(); break;
///     case ZLE_CMD_SET_KEYMAP: zlesetkeymap(va_arg(ap, int)); break;
///     case ZLE_CMD_GET_KEY: { ... *chrp = getbyte(do_keytmout, timeout, 0); break; }
///     case ZLE_CMD_SET_HIST_LINE: histline = va_arg(ap, zlong); break;
///     case ZLE_CMD_PREEXEC: mark_output(1); break;
///     case ZLE_CMD_POSTEXEC: mark_output(0); break;
///     case ZLE_CMD_CHPWD: notify_pwd(); break;
///     default:
/// #ifdef DEBUG
///         dputs("Bad command %d in zle_main_entry", cmd);
/// #endif
///         break;
///     }
///     return NULL;
/// }
/// ```
pub fn zle_main_entry(cmd: i32, ap: &mut zle_main_entry_args) -> Option<String> {
    // c:2123

    match cmd {
        // c:2125 switch (cmd)
        x if x == ZLE_CMD_GET_LINE => {
            // c:2126
            if let zle_main_entry_args::GetLine { ll, cs } = ap {
                // c:2128-2130
                let mut ll_i: i32 = 0;
                let mut cs_i: i32 = 0;
                let line = zlegetline(&mut ll_i, &mut cs_i); // c:2131
                **ll = ll_i;
                **cs = cs_i;
                return Some(line); // c:2131 return char*
            }
        }
        x if x == ZLE_CMD_READ => {
            // c:2134
            if let zle_main_entry_args::Read {
                lp,
                rp,
                flags,
                context,
            } = ap
            {
                // c:2139-2142
                // c:2144 — `return zleread(lp, rp, flags, context,
                //                          "zle-line-init", "zle-line-finish");`
                let lprompt = lp.as_deref().unwrap_or("");
                let rprompt = rp.as_deref().unwrap_or("");
                let r = zleread(
                    lprompt,
                    rprompt,
                    *flags,
                    *context,
                    "zle-line-init",
                    "zle-line-finish",
                );
                return r.ok();
            }
        }
        x if x == ZLE_CMD_ADD_TO_LINE => {
            // c:2148
            if let zle_main_entry_args::AddToLine(c) = ap {
                // c:2149 va_arg(ap, int)
                zleaddtoline(*c); // c:2149
            }
        }
        x if x == ZLE_CMD_TRASH => {
            // c:2152
            trashzle(); // c:2153
        }
        x if x == ZLE_CMD_RESET_PROMPT => {
            // c:2156
            zle_resetprompt(); // c:2157
        }
        x if x == ZLE_CMD_REFRESH => {
            // c:2160
            zrefresh(); // c:2161
        }
        x if x == ZLE_CMD_SET_KEYMAP => {
            // c:2164
            if let zle_main_entry_args::SetKeymap(m) = ap {
                // c:2165 va_arg(ap, int)
                crate::ported::zle::zle_keymap::zlesetkeymap(*m); // c:2165
            }
        }
        x if x == ZLE_CMD_GET_KEY => {
            // c:2168
            if let zle_main_entry_args::GetKey {
                do_keytmout,
                timeout: _,
                chrp,
            } = ap
            {
                // c:2173-2175
                // c:2176 — `*chrp = getbyte(do_keytmout, timeout, 0);`
                let byte = getbyte(
                    // c:2176
                    *do_keytmout,
                )
                .unwrap_or(0);
                **chrp = byte as i32;
            }
        }
        x if x == ZLE_CMD_SET_HIST_LINE => {
            // c:2180
            if let zle_main_entry_args::SetHistLine(v) = ap {
                // c:2182 histline = va_arg
                histline.store(*v as i32, SeqCst);
            }
        }
        x if x == ZLE_CMD_PREEXEC => {
            // c:2187
            mark_output(true); // c:2188 mark_output(1)
        }
        x if x == ZLE_CMD_POSTEXEC => {
            // c:2191
            mark_output(false); // c:2192 mark_output(0)
        }
        x if x == ZLE_CMD_CHPWD => {
            // c:2195
            crate::ported::zle::termquery::notify_pwd(); // c:2196
        }
        _ => {
            // c:2199 default
            // c:2200-2202 — DEBUG: dputs("Bad command %d in zle_main_entry", cmd);
            tracing::debug!("Bad command {} in zle_main_entry", cmd);
        }
    }
    None // c:2205 return NULL
}

// `histline` lives at `Src/Zle/zle_hist.c:42` (`int histline;`) —
// ported to `crate::ported::zle::zle_hist::histline`. ZLE_CMD_SET_HIST_LINE
// above writes to that canonical location per PORT.md Rule C.

/// Module for termios operations
mod termios {
    pub use libc::{ECHO, ICANON, TCSANOW, VEOF, VMIN, VTIME};
    use std::io;
    use std::os::unix::io::RawFd;
    /// `Termios` — see fields for layout.
    #[derive(Clone)]
    pub struct Termios {
        /// `inner` field.
        inner: libc::termios,
    }

    impl Termios {
        /// `from_fd` — see implementation.
        pub fn from_fd(fd: RawFd) -> io::Result<Self> {
            let mut termios = std::mem::MaybeUninit::uninit();
            let ret = unsafe { libc::tcgetattr(fd, termios.as_mut_ptr()) };
            if ret != 0 {
                return Err(io::Error::last_os_error());
            }
            Ok(Termios {
                inner: unsafe { termios.assume_init() },
            })
        }
    }

    impl std::ops::Deref for Termios {
        type Target = libc::termios;
        fn deref(&self) -> &Self::Target {
            &self.inner
        }
    }

    impl std::ops::DerefMut for Termios {
        fn deref_mut(&mut self) -> &mut Self::Target {
            &mut self.inner
        }
    }

    /// Apply the given termios settings to the fd.
    /// Thin libc wrapper. Equivalent to the `settyinfo()` helper at
    /// Src/utils.c which fronts the same `tcsetattr(3)` call zsh
    /// uses to install / restore tty modes around `zsetterm` and
    /// `trashzle`.
    pub fn tcsetattr(fd: RawFd, action: i32, termios: &Termios) -> io::Result<()> {
        let ret = unsafe { libc::tcsetattr(fd, action, &termios.inner) };
        if ret != 0 {
            return Err(io::Error::last_os_error());
        }
        Ok(())
    }
}

#[cfg(test)]
mod ztmout_findfunc_tests {
    use super::*;

    #[test]
    fn ztmouttp_discriminant_values() {
        let _g = crate::test_util::global_state_lock();
        let _g = zle_test_setup();
        // c:401-428 — sequential 0..=3.
        assert_eq!(ztmouttp::ZTM_NONE as i32, 0);
        assert_eq!(ztmouttp::ZTM_KEY as i32, 1);
        assert_eq!(ztmouttp::ZTM_FUNC as i32, 2);
        assert_eq!(ztmouttp::ZTM_MAX as i32, 3);
    }

    #[test]
    fn ztmout_default_carries_none_type() {
        let _g = crate::test_util::global_state_lock();
        let _g = zle_test_setup();
        let t = ztmout {
            tp: ztmouttp::ZTM_NONE,
            exp100ths: 0,
        };
        assert_eq!(t.tp, ztmouttp::ZTM_NONE);
    }

    #[test]
    fn findfunc_default_is_empty() {
        let _g = crate::test_util::global_state_lock();
        let _g = zle_test_setup();
        // c:1927 — fresh state: no func, zero hits, no msg.
        let f = findfunc::default();
        assert_eq!(f.func, None);
        assert_eq!(f.found, 0);
        assert!(f.msg.is_empty());
    }

    #[test]
    fn findfunc_can_accumulate_message() {
        let _g = crate::test_util::global_state_lock();
        let _g = zle_test_setup();
        let mut f = findfunc {
            func: Some("beginning-of-line".to_string()),
            found: 0,
            msg: String::new(),
        };
        f.found += 1;
        f.msg.push_str(" is on KEY1");
        assert_eq!(f.found, 1);
        assert!(f.msg.contains("is on"));
    }
}

/// Are we currently in the vi command keymap?
/// Port of `invicmdmode()` from Src/Zle/zle_main.c (the C macro just
/// compares the active keymap pointer against `vicmd`).
pub fn in_vi_cmd_mode() -> bool {
    *curkeymapname() == "vicmd"
}

/// Read a multi-byte key sequence from input and resolve it against
/// the current keymap. Returns the bound `Thingy` or `None` on EOF.
///
/// Port of `getkeymapcmd(Keymap km, Thingy *funcp, char **strp)` from Src/Zle/zle_keymap.c:1581 + the
/// thin `getkeycmd()` wrapper at zle_keymap.c:1768. The C source
/// reads bytes into a `keybuf`, looks up the partial sequence after
/// each byte, tracks the longest prefix that hit a binding, and
/// stops when either (a) the current sequence is no longer a prefix
/// of any binding, or (b) the input read times out while waiting
/// for the next byte. Excess bytes past the matched prefix are
/// unget back into the input buffer.
///
/// Simplified compared to the C source: skips the CSI-sequence
/// special handling at zle_keymap.c:1645. The
/// `t_executenamedcmd` redirection at zle_keymap.c:1787 lives in
/// `getkeycmd` (zle_keymap.rs:2916), as in C.
///
/// Return value mirrors C's two out-params (`Thingy *funcp, char
/// **strp`, c:1581): `None` is C's `!*seq` end-of-input, and the pair
/// is `(func, str)`. A `bindkey -s` entry resolves to
/// `(None, Some(string))` — C's `keybind` returns a NULL Thingy with
/// `*strp` set (c:673-674) — which `getkeycmd` turns into
/// `ungetbytes_unmeta(str)` + re-walk (c:1783-1784).
pub fn get_key_cmd() -> Option<(Option<Thingy>, Option<String>)> {
    // c:zle_keymap.c:1607-1616 — a selected LOCAL keymap (viopp/visual/
    // isearch) does NOT replace the global keymap wholesale: each key is
    // looked up in the local map first, and when it is neither bound nor
    // a prefix there, the GLOBAL map resolves it (`if (!loc && !ispfx)
    // f = keybind(km, keybuf, &s);`). Collapsing to `local.or(cur)`
    // made every key unbound in viopp (y/d/c motions, yy doubling) die
    // as EOF, aborting vi operators and leaking the viopp map.
    let local_km = LOCALKEYMAP.lock().unwrap().clone();
    let global_km = curkeymap.lock().unwrap().clone();
    let km = match (&local_km, &global_km) {
        (None, None) => return None,
        (Some(l), None) => l.clone(),
        (_, Some(g)) => g.clone(),
    };
    let mut buf: Vec<u8> = Vec::with_capacity(8);
    let mut last_match: Option<Thingy> = None;
    // c:1584 — `char *str = NULL;` — the send-string of the longest
    // binding matched so far, carried out alongside `func`.
    let mut last_str: Option<String> = None;
    // c:1618 — whether anything at all matched. A send-string binding
    // matches with `func == NULL`, so `last_match.is_some()` can no
    // longer stand in for "matched".
    let mut matched = false;
    let mut last_match_len = 0usize;
    // c:zle_keymap.c:1585 — `int lastlen = 0, lastc = lastchar;` —
    // remember lastchar as of the LAST RECORDED MATCH. When the walk
    // reads past the match probing a longer binding (`bindkey 'fj'
    // …` makes `f` a prefix), the probe byte overwrites LASTCHAR;
    // dispatching the shorter match must restore it or self-insert
    // inserts the PROBE byte: typing `df80` with `f`-prefix bindings
    // inserted `d880` (every f/j replaced by its follower).
    let mut lastc = LASTCHAR.load(SeqCst); // c:1585
    // c:1586 — `int timeout = 0, csi = 0, oscdcs = 0;`. `csi`/`oscdcs` are
    // offsets into the METAFIED global keybuf, as in C; `csi_raw` is the
    // same position in the raw `buf` this walk drives.
    let mut timeout = false;
    let mut csi: usize = 0;
    let mut csi_raw: usize = 0;
    let mut oscdcs: usize = 0;
    let mut oscdcs_raw: usize = 0;
    // c:1585 `lastlen` in METAFIED bytes, for the CSI test at c:1656-1657.
    let mut lastlen_meta: usize = 0;

    // c:zle_keymap.c:1588-1589 — `keybuflen = 0; keybuf[0] = 0;` —
    // reset the GLOBAL keybuf at sequence start. The local `buf`
    // drives the raw-byte keymap walk; the global mirrors it METAFIED
    // via addkeybuf so `$KEYS` (get_keys → keybuf, zle_params.c:463)
    // reports the sequence that invoked the widget. Without it $KEYS
    // was empty and zsh-expand's `[[ $KEYS == " " ]]` space dispatch
    // never fired.
    crate::ported::zle::zle_keymap::keybuf
        .lock()
        .unwrap()
        .clear(); // c:1588
    crate::ported::zle::zle_keymap::keybuflen.store(0, SeqCst); // c:1588

    loop {
        // c:1591 `getkeybuf(timeout)` — timed read once a binding matched
        // (c:1626-1627), otherwise block.
        let do_keytmout = timeout;
        let b = match getbyte(do_keytmout as i64) {
            Some(b) => b,
            None => {
                // c:zle_keymap.c:1614+ — a KEY TIMEOUT while waiting for
                // the rest of a multi-byte sequence is NOT end-of-input:
                // getkeymapcmd stops reading and dispatches the longest
                // binding matched so far (the unget below pushes back any
                // trailing bytes). Only a None from the BLOCKING read
                // (no partial match in flight) is genuine EOF — returning
                // None there is what lets ^D exit. Propagating a timeout
                // as None made a slow/split arrow-key escape sequence exit
                // the whole shell.
                if do_keytmout || !buf.is_empty() {
                    break;
                }
                return None;
            }
        };
        buf.push(b);
        // c:zle_keymap.c:1604 — getkeybuf → addkeybuf (global, metafied).
        crate::ported::zle::zle_keymap::addkeybuf(b as i32);
        crate::ported::zle::zle_keymap::keybuflen.store(
            crate::ported::zle::zle_keymap::keybuf.lock().unwrap().len() as i32,
            SeqCst,
        );

        // Look up the current buffer in one keymap: ((binding, str), is_prefix).
        // c:659-675 `keybind(km, keybuf, &s)` — `first[f]` wins for a
        // single char (c:663-668), otherwise the `multi` node supplies
        // BOTH `k->bind` and `k->str` (c:670-674). The str half used to
        // be dropped here, so every `bindkey -s` binding resolved to
        // "no widget" and the macro never played back.
        type Bound = (Option<Thingy>, Option<String>);
        let lookup = |m: &crate::ported::zle::zle_keymap::Keymap| -> (Option<Bound>, bool) {
            if buf.len() == 1 {
                // c:663-668 — single char bound in `first[]`.
                if let Some(t) = m.first[b as usize].clone() {
                    let pfx = m.multi.keys().any(|k| k.len() > 1 && k[0] == b);
                    return (Some((Some(t), None)), pfx);
                }
                // c:670-674 — not in `first[]`: a single-char
                // `bindkey -s` lives in `multi` (bindkey() clears the
                // `first[]` slot for it, zle_keymap.rs:766-768).
                let entry = m.multi.get(&buf[..]);
                let bind = entry.map(|e| (e.bind.clone(), e.str.clone()));
                let pfx = m.multi.keys().any(|k| k.len() > 1 && k[0] == b);
                (bind, pfx)
            } else {
                let entry = m.multi.get(&buf[..]);
                let bind = entry.map(|e| (e.bind.clone(), e.str.clone()));
                // Whether the current sequence is a PREFIX of a longer binding.
                // The entry's `prefixct` only counts when `multi` holds an
                // intermediate node for `buf`; if it stores full sequences
                // only (e.g. `^[[A` but no `^[[` node), prefixct is 0 and the
                // walk broke after `^[` — leaking `[A`/`[D` so arrow keys
                // dispatched ESC + literal bytes (left "deleted", up did
                // nothing). Detect prefix the same way the single-byte arm
                // does: ANY bound sequence longer than `buf` that starts with
                // `buf`.
                let pfx = entry.map(|e| e.prefixct > 0).unwrap_or(false)
                    || m.multi
                        .keys()
                        .any(|k| k.len() > buf.len() && k.starts_with(&buf[..]));
                (bind, pfx)
            }
        };
        // c:1607-1616 — local keymap first; fall back to the effective
        // map (`km` — global when present) when the sequence is neither
        // bound nor a prefix locally; `km`'s prefix status always
        // extends the walk.
        let (mut current_match, mut is_prefix) = match (&local_km, &global_km) {
            (Some(l), Some(_)) => lookup(l), // c:1610-1612
            _ => (None, false),
        };
        let (km_match, km_pfx) = lookup(&km);
        if current_match.is_none() && !is_prefix {
            // c:1614-1615 `if (!loc && !ispfx) f = keybind(km, keybuf, &s);`
            current_match = km_match;
        }
        is_prefix |= km_pfx; // c:1616 `ispfx |= keyisprefix(km, keybuf);`

        // c:1618 — `if (f != t_undefinedkey)` — an unbound sequence
        // (keybind's t_undefinedkey) is NOT a match: recording it armed
        // the key timeout, so a bare ESC dispatched alone as
        // undefined-key before the rest of an `^[f`-style Meta binding
        // arrived (M-f / M-DEL dead for any typist slower than
        // KEYTIMEOUT). C keeps the read BLOCKING until a real binding
        // or a non-prefix byte resolves the sequence.
        // A send-string node has `bind == None, str == Some` — that IS a
        // match (C's keybind returns a NULL Thingy, which is not
        // t_undefinedkey). An intermediate PREFIX node has both None
        // (C gives those `t_undefinedkey`, c:639) and is not a match.
        if let Some((bind, s)) = current_match {
            let is_undef = bind
                .as_ref()
                .map(|t| t.nam == "undefined-key")
                .unwrap_or(false);
            if !is_undef && (bind.is_some() || s.is_some()) {
                // c:1626-1627 — "can be patient with vi commands that need
                // a motion operator: they wait till a key is pressed for
                // the movement anyway".
                let vioper = bind
                    .as_ref()
                    .and_then(|t| t.widget.as_ref())
                    .map(|w| w.flags & crate::ported::zle::zle_h::ZLE_VIOPER != 0)
                    .unwrap_or(false);
                timeout = !(crate::ported::zle::zle_vi::VIRANGEFLAG.load(SeqCst) == 0
                    && REGION_ACTIVE.load(SeqCst) == 0
                    && vioper);
                let selfins = bind
                    .as_ref()
                    .map(|t| t.nam == "self-insert" || t.nam == "self-insert-unmeta")
                    .unwrap_or(false);
                last_match = bind; // c:1620 `func = f;`
                last_str = s; // c:1621 `str = s;`
                matched = true;
                last_match_len = buf.len();
                lastlen_meta = crate::ported::zle::zle_keymap::keybuf.lock().unwrap().len();
                lastc = LASTCHAR.load(SeqCst); // c:1622 — `lastc = lastchar;`
                // c:1634-1639 — a multibyte key sequence bound to self-insert:
                // assemble the wide character from keybuf (reading any
                // continuation bytes still in flight) so selfinsert inserts
                // the character rather than waiting for bytes the keymap
                // walk already consumed.
                if selfins && LASTCHAR_WIDE_VALID.load(SeqCst) == 0 && !is_prefix {
                    crate::ported::zle::zle_keymap::getrestchar_keybuf(); // c:1636
                    // c:1637 `lastlen = keybuflen;` — getrestchar_keybuf may
                    // have appended bytes (addkeybuf); keep `buf` in step.
                    let mut raw = crate::ported::zle::zle_keymap::keybuf.lock().unwrap().clone();
                    lastlen_meta = raw.len();
                    crate::ported::utils::unmetafy(&mut raw);
                    buf = raw;
                    last_match_len = buf.len();
                }
            }
        }

        let kb: Vec<u8> = crate::ported::zle::zle_keymap::keybuf.lock().unwrap().clone();
        let kl = kb.len();
        // c:1642-1644 — "CSI key sequences have a well defined structure so
        // if we currently have an incomplete one, loop so the rest of it
        // will be included in the key sequence if that arrives within the
        // timeout."
        if csi == 0 && kl >= 3 && kb[kl - 3] == 0x1b && kb[kl - 2] == b'[' {
            csi = kl - 1; // c:1647
            csi_raw = buf.len() - 1;
        }
        if csi != 0 {
            // c:1648
            if kb[kl - 2] == crate::ported::zsh_h::Meta || kb[kl - 1] < 0x20 || kb[kl - 1] > 0x3f {
                // c:1649-1650
                // c:1651-1654 — "If we reach the end of a valid CSI sequence
                // and the matched key binding is for part of the CSI
                // introduction, select instead the undefined-key widget and
                // consume the full sequence from the input buffer."
                if kb[kl - 1] >= 0x40
                    && kb[kl - 1] <= 0x7e
                    && lastlen_meta + 2 > csi
                    && lastlen_meta <= csi
                {
                    // c:1655-1657
                    if kb[csi] == b'?' && (kb[kl - 1] == b'c' || kb[kl - 1] == b'u') {
                        // c:1658-1659 — "is a terminal query response - discard"
                        buf.truncate(csi_raw - 2);
                        crate::ported::zle::zle_keymap::keybuf.lock().unwrap().truncate(csi - 2); // c:1661
                        crate::ported::zle::zle_keymap::keybuflen.store((csi - 2) as i32, SeqCst);
                        timeout = false; // c:1662
                        csi = 0;
                        continue; // c:1663
                    }
                    last_match = crate::ported::zle::zle_thingy::thingytab()
                        .lock()
                        .ok()
                        .and_then(|t| t.get("undefined-key").cloned())
                        .or_else(|| Some(Thingy::new("undefined-key"))); // c:1665 `func = t_undefinedkey;`
                    last_str = None;
                    matched = true;
                    last_match_len = buf.len(); // c:1666 `lastlen = keybuflen;`
                    lastlen_meta = kl;
                }
                csi = 0; // c:1668
            }
        }
        // c:1671-1673 — "An OSC or DCS sequence is likely a late arriving
        // terminal query response. Keep looping; if we reach an ST, discard
        // the sequence - unless we first match a keybinding or a keytimeout
        // elapses."
        if oscdcs != 0 {
            // c:1674
            if kb[kl - 1] == 0x07 // c:1675 "BEL sometimes used"
                || (kl >= 2 && kb[kl - 2] == 0x1b && kb[kl - 1] == b'\\')
                || (kl >= 2 && kb[kl - 2] == crate::ported::zsh_h::Meta && kb[kl - 1] == (0x9c ^ 32))
            {
                // c:1676-1679
                buf.truncate(oscdcs_raw - 2);
                crate::ported::zle::zle_keymap::keybuf.lock().unwrap().truncate(oscdcs - 2); // c:1681 "discard"
                crate::ported::zle::zle_keymap::keybuflen.store((oscdcs - 2) as i32, SeqCst);
                timeout = false; // c:1682
                oscdcs = 0;
                continue; // c:1683
            }
        } else if kl >= 2 && kb[kl - 2] == 0x1b && (kb[kl - 1] == b']' || kb[kl - 1] == b'P') {
            // c:1685-1686
            oscdcs = kl; // c:1687
            oscdcs_raw = buf.len();
        }

        // c:1689 — `if (!ispfx && !csi && !oscdcs) break;`
        if !is_prefix && csi == 0 && oscdcs == 0 {
            break;
        }
    }

    // c:1692-1695 — `if(!lastlen && keybuflen) lastlen = keybuflen;
    // else lastchar = lastc;` — when a shorter match is being
    // dispatched after probe bytes were read, restore lastchar to
    // its match-time value so self-insert inserts the MATCHED key,
    // not the probe byte.
    if !(last_match_len == 0 && !buf.is_empty()) {
        LASTCHAR.store(lastc, SeqCst); // c:1695
    }

    // Unget any bytes past the matched prefix so the next read sees
    // them. Mirrors the lastlen / keybuflen accounting in
    // zle_keymap.c:1696-1708 (`keybuf[keybuflen = lastlen] = 0`).
    if matched && buf.len() > last_match_len {
        let extra = buf[last_match_len..].to_vec();
        ungetbytes(&extra);
        // c:1706-1707 — `if(vichgflag) curvichg.bufptr -= keybuflen;` — the
        // ungotten bytes were recorded by getbyte; they will be recorded
        // again when re-read, so drop them from the change being tracked.
        if crate::ported::zle::zle_vi::VICHGFLAG.load(std::sync::atomic::Ordering::SeqCst) != 0 {
            let mut cur = crate::ported::zle::zle_vi::CURVICHG.lock().unwrap();
            cur.bufptr -= extra.len() as i32;
            let keep = cur.bufptr.max(0) as usize;
            cur.buf.truncate(keep);
        }
        buf.truncate(last_match_len);
        // Rebuild the global metafied mirror from the kept raw bytes.
        crate::ported::zle::zle_keymap::keybuf
            .lock()
            .unwrap()
            .clear();
        for &kb in &buf {
            crate::ported::zle::zle_keymap::addkeybuf(kb as i32);
        }
        crate::ported::zle::zle_keymap::keybuflen.store(
            crate::ported::zle::zle_keymap::keybuf.lock().unwrap().len() as i32,
            SeqCst,
        ); // c:1708
    }

    // c:1583 — `Thingy func = t_undefinedkey;` — bytes were read but
    // nothing matched: C returns t_undefinedkey (getkeycmd's caller
    // feeps). Returning None here would read as EOF and EXIT the shell
    // on any unbound key.
    if !matched && !buf.is_empty() {
        return Some((
            crate::ported::zle::zle_thingy::thingytab()
                .lock()
                .ok()
                .and_then(|t| t.get("undefined-key").cloned())
                .or_else(|| Some(Thingy::new("undefined-key"))),
            None,
        ));
    }

    if std::env::var_os("ZSHRS_ZLE_LOG").is_some() {
        use std::io::Write;
        if let Ok(mut f) = std::fs::OpenOptions::new()
            .create(true)
            .append(true)
            .open("/tmp/zshrs_zle.log")
        {
            let _ = writeln!(
                f,
                "key: bytes={:?} matchlen={} widget={:?}",
                buf,
                last_match_len,
                last_match.as_ref().map(|t| t.nam.clone())
            );
        }
    }

    if !matched {
        // c:1776 — `if(!*seq) return NULL;` — nothing read at all (EOF).
        return None;
    }
    // c:1710-1711 — `*funcp = func; *strp = str;`
    Some((last_match, last_str))
}

/// Execute a widget. Port of `execzlefunc(Thingy func, char **args, int set_bindk, int set_lbindk)` from Src/Zle/zle_main.c:1420.
///
/// The C source manages a few per-widget side effects we replicate
/// here:
///   * `lastcol = -1` reset for any widget that isn't flagged
///     `LASTCOL` (zle_main.c:1476). The vertical-motion widgets use
///     this to maintain a sticky column across `up-line` / `down-line`.
///   * `lastcmd = widget.flags` unless the widget is `NOTCOMMAND`
///     (zle_main.c:1497). The yank-pop widget consults this to know
///     whether the previous widget was a yank.
/// The undo capture is NOT here: C records it once per key from the
/// zlecore loop (`handleundo()` at zle_main.c:1161), which is where this
/// port calls it too.
fn execute_widget(widget: &widget) -> i32 {
    // c:1423-1424 — `int nestedvichg = vichgflag; int isrepeat =
    // (viinrepeat == 3);` — vi-change bookkeeping for `.` repeat.
    let nestedvichg = crate::ported::zle::zle_vi::VICHGFLAG.load(SeqCst);
    let isrepeat = crate::ported::zle::zle_vi::VIINREPEAT.load(SeqCst) == 3;
    if isrepeat {
        // c:1437-1438 — `if (isrepeat) viinrepeat = 2;`
        crate::ported::zle::zle_vi::VIINREPEAT.store(2, SeqCst);
    }
    // c:1468-1473 — the per-widget suffix/list teardown that runs BEFORE the
    // widget body:
    //     if (!(wflags & ZLE_KEEPSUFFIX)) removesuffix();
    //     if (!(wflags & ZLE_MENUCMP)) { fixsuffix(); invalidatelist(); }
    // This is what makes AUTO_REMOVE_SLASH observable. `do_single` registers
    // the `/` it appended to a completed directory as a REMOVABLE suffix
    // (compresult.c:1116-1119, ported at compresult.rs:1783-1786); the slash
    // only disappears again because the next widget that is not flagged
    // ZLE_KEEPSUFFIX calls `removesuffix()` here. With this block absent the
    // registration had no consumer, so the slash was permanent: `ls /us<TAB>`
    // then any other key left `ls /usr/` where zsh shows `ls /usr`. Same for
    // `echo x > /tm<TAB>` and `git log -- <TAB><TAB>`.
    //
    // The `!ZLE_MENUCMP` arm is the other half: an ordinary (non-completion)
    // widget also drops the completion list, which is why typing a normal
    // character after a listing clears it in zsh.
    //
    // c:1449 — `} else if((w = func->widget)->flags & (WIDGET_INT|WIDGET_NCOMP))`:
    // the teardown lives INSIDE that branch. A user widget (`zle -N`, flags 0
    // per zle_thingy.c:588) takes the `else` arm at c:1501-1557, which runs
    // neither `removesuffix()` nor `fixsuffix()`/`invalidatelist()`. Running it
    // for user widgets too deleted the auto-suffix `do_single` had just
    // inserted, so a `zle -N` widget bound after a completion key saw
    // `$BUFFER` = "echo alpha.txt" where zsh gives "echo alpha.txt " (and
    // "echo dir/Abc" where zsh gives "echo dir/AbcDir/") — and the character
    // was really gone from the line, not merely hidden from the widget.
    if (widget.flags
        & (crate::ported::zle::zle_h::WIDGET_INT | crate::ported::zle::zle_h::WIDGET_NCOMP))
        != 0
    {
        if (widget.flags & crate::ported::zle::zle_h::ZLE_KEEPSUFFIX) == 0 {
            let _ = crate::ported::zle::zle_h::removesuffix(); // c:1469
        }
        if (widget.flags & crate::ported::zle::zle_h::ZLE_MENUCMP) == 0 {
            crate::ported::zle::zle_misc::fixsuffix(); // c:1471
            crate::ported::zle::zle_h::invalidatelist(); // c:1472
        }
        if (widget.flags & crate::ported::zle::zle_h::ZLE_LINEMOVE) != 0 {
            // c:1474
            crate::ported::zle::zle_vi::VILINERANGE.store(1, SeqCst); // c:1475
        }
    }

    // Reset sticky column unless the widget keeps it.
    if (widget.flags & ZLE_LASTCOL) == 0 {
        LASTCOL.store(-1, SeqCst);
    }

    // c:1151 — the widget's return value propagates to zlecore, which rings
    // the bell (handlefeep) when it is non-zero. e.g. an ambiguous completion
    // returns 1 (LISTBEEP) and must beep; the value was previously discarded.
    let ret = match &widget.u {
        // c:1481-1486 — a `zle -C` completion widget dispatches through
        // `completecall`, which plants `compfunc` (`_main_complete`) so
        // `makecomplist` runs the compsys engine instead of the compctl
        // fallback. Without this arm the key loop silently no-ops every
        // completion widget.
        WidgetImpl::Comp { .. } => {
            *COMPWIDGET.lock().unwrap() = Some(widget.clone());
            let r = crate::ported::zle::zle_tricky::completecall(&[]);
            *COMPWIDGET.lock().unwrap() = None;
            r
        }
        WidgetImpl::Internal(f) => f(&[]),
        WidgetImpl::UserFunc(name) => {
            // User-defined widget (`zle -N name shell-fn`): the C
            // source dispatches via execzlefunc() at zle_main.c:1502
            // through executenamedfunc which calls the bound shell
            // function. Direct dispatch through the canonical
            // execzlefunc path now invokes the function via
            // fusevm_bridge inside this same key-loop call frame,
            // so widget side-effects (BUFFER/CURSOR/etc.) land on
            // the live ZLE state synchronously rather than waiting
            // for a host drain pass.
            execzlefunc(name, &[], 0, 0)
        }
        _ => 0,
    };

    // Update lastcmd for yank-pop / next-widget chains, unless the
    // widget is NOTCOMMAND (digit-arg, prefix, etc.) — zle_main.c:1497.
    if (widget.flags & ZLE_NOTCOMMAND) == 0
        // user widgets set lastcmd themselves from `w->flags` (c:1541).
        && !matches!(widget.u, crate::ported::zle::zle_h::WidgetImpl::UserFunc(_))
    {
        LASTCMD.store(widget.flags as u32, SeqCst);
    }

    // c:1579-1595 — if this widget constituted the vi change, end it.
    crate::zle_param_sync::end_vichg_frame(nestedvichg, isrepeat, ret);

    ret
}

/// Self-insert character (internal, used by zlecore)
fn do_self_insert(c: char) {
    if (INSMODE.load(SeqCst) != 0) {
        // Insert mode
        ZLELINE.lock().unwrap().insert(ZLECS.load(SeqCst), c);
        ZLECS.fetch_add(1, SeqCst);
        ZLELL.fetch_add(1, SeqCst);
    } else {
        // Overwrite mode
        if ZLECS.load(SeqCst) < ZLELL.load(SeqCst) {
            ZLELINE.lock().unwrap()[ZLECS.load(SeqCst)] = c;
        } else {
            ZLELINE.lock().unwrap().push(c);
            ZLELL.fetch_add(1, SeqCst);
        }
        ZLECS.fetch_add(1, SeqCst);
    }
    ZLE_RESET_NEEDED.store(1, SeqCst);
}

/// Run a nested edit session — used by user widgets to invoke the
/// editor recursively (e.g. read a sub-line for completion search).
///
/// Port of `recursiveedit(UNUSED(char **args))` from Src/Zle/zle_main.c:1974. The C
/// source increments `zle_recursive`, calls `redrawhook()` +
/// `zrefresh()` to ensure the screen reflects current state,
/// re-enters `zlecore()`, then resets `errflag`/`done`/`eofsent`
/// so the parent edit session continues after the recursive call
/// returns. Returns 1 if the inner edit aborted with errflag set,
/// matching the C `locerror` path at zle_main.c:1992.
pub fn recursive_edit() -> i32 {
    ZLE_RECURSIVE.fetch_add(1, SeqCst);
    // Mirror zle_main.c:1984-1986 — refresh before entering the
    // sub-loop so the user sees current state on enter.
    redrawhook();
    zrefresh();
    zlecore();

    // c:1990 — `--zle_recursive;`
    ZLE_RECURSIVE.fetch_sub(1, SeqCst);

    // c:1992-1993 — `locerror = errflag ? 1 : 0; errflag = done = eofsent = 0;`
    let locerror = i32::from(crate::ported::utils::errflag.load(Ordering::Relaxed) != 0);
    crate::ported::utils::errflag.store(0, Ordering::Relaxed);
    DONE.store(0, SeqCst);
    EOFSENT.store(0, SeqCst);

    locerror
}

/// Mark the line as accepted; zlecore will exit on the next iteration.
/// Port of `acceptline(UNUSED(char **args))` from Src/Zle/zle_misc.c:401 — the C source
/// just sets the global `done` flag.
pub fn finish_line() {
    DONE.store(1, SeqCst);
}

/// Abort the current line edit and exit zlecore with an empty buffer.
/// Port of the Ctrl-C / send-break exit path from Src/Zle/zle_misc.c:1144
/// (`sendbreak`) combined with the abort cleanup at zle_main.c:1162
/// (the `errflag |= ERRFLAG_ERROR; break;` arm). The C source uses
/// errflag globals to communicate the abort; we model it with a bool.
pub fn abort_line() {
    ZLELINE.lock().unwrap().clear();
    ZLECS.store(0, SeqCst);
    ZLELL.store(0, SeqCst);
    DONE.store(1, SeqCst);
}

// `save_keymap` / `restore_keymap` + `SavedKeymap` struct deleted —
// none of those names exist in Src/Zle/zle_main.c. C handles
// keymap save/restore by reading/writing the `curkeymap` and
// `localkeymap` globals directly inside the bindkey paths.

/// Describe key briefly
/// Direct port of `int describekeybriefly(UNUSED(char **args))` from
/// `Src/Zle/zle_main.c:1892`. Reads a full key SEQUENCE through the
/// current keymap (not a single byte), then reports the binding on the
/// status line via `showmsg`:
///
/// ```c
/// if (statusline) return 1;
/// clearlist = 1;
/// statusline = "Describe key briefly: _";
/// start_edit(); zrefresh();
/// if (invicmdmode() && region_active && (km = openkeymap("visual")))
///     selectlocalmap(km);
/// seq = getkeymapcmd(curkeymap, &func, &str);
/// selectlocalmap(NULL); end_edit(); statusline = NULL;
/// if(!*seq) return 1;
/// msg = bindztrdup(seq); msg = appstr(msg, " is ");
/// if (!func) is = bindztrdup(str); else is = nicedup(func->nam, 0);
/// msg = appstr(msg, is); showmsg(msg); return 0;
/// ```
///
/// Substrate mapping:
///   * `statusline` → [`STATUSLINE`]; `clearlist` → `zle_refresh::CLEARLIST`.
///   * `start_edit`/`end_edit` → `termquery::{start_edit, end_edit}`.
///   * `getkeymapcmd(curkeymap, &func, &str)` → `zle_keymap::getkeymapcmd`,
///     which returns `(func, seq, str)` as a tuple. The C call passes
///     `curkeymap` and reads `localkeymap` internally; the Rust
///     `getkeymapcmd` takes one keymap, so the effective map is resolved
///     the same way `get_key_cmd` does — `LOCALKEYMAP.or(curkeymap)` —
///     which honours the visual-mode `selectlocalmap` override below.
///   * C `func == NULL` (a `bindkey -s` send-string binding) is modelled
///     per the sibling `getkeycmd` convention (zle_keymap.rs:2687) as a
///     Thingy whose `nam` is empty; that branch uses `bindztrdup(str)`.
///
/// Returns 0 on success, 1 on the two early-exit paths (status line
/// already in use / empty sequence). Note `getkeymapcmd` collapses an
/// *unbound* sequence into `None` (it only records bound Thingies),
/// whereas C would print "<seq> is undefined-key"; that distinction
/// lives in the shared `getkeymapcmd` substrate, not here.
pub fn describe_key_briefly() -> i32 {
    use crate::ported::utils::nicedup;
    use crate::ported::zle::zle_h::invicmdmode;
    use crate::ported::zle::zle_keymap::{getkeymapcmd, selectlocalmap};
    use crate::ported::zle::zle_refresh::{zrefresh, CLEARLIST};
    use crate::ported::zle::zle_utils::{bindztrdup, showmsg};

    // c:1898-1899 — `if (statusline) return 1;` — refuse to re-enter
    // while another status-line prompt is already displayed.
    if STATUSLINE.lock().unwrap().is_some() {
        return 1;
    }
    // c:1900-1901 — arm the completion-list clear and post the prompt.
    CLEARLIST.store(1, SeqCst);
    *STATUSLINE.lock().unwrap() = Some("Describe key briefly: _".to_string());
    // c:1902-1903 — emit terminal `enter` sequences, then paint.
    let _ = crate::ported::zle::termquery::start_edit();
    zrefresh();

    // c:1904-1905 — in vi command mode with an active region, resolve the
    // key through the `visual` keymap if one is defined.
    if invicmdmode(&curkeymapname()) && REGION_ACTIVE.load(SeqCst) != 0 {
        if let Some(km) = openkeymap("visual") {
            selectlocalmap(Some(km));
        }
    }

    // c:1906 — `seq = getkeymapcmd(curkeymap, &func, &str);`. The
    // effective keymap mirrors get_key_cmd's `LOCALKEYMAP.or(curkeymap)`.
    let effective = {
        let local = LOCALKEYMAP.lock().unwrap().clone();
        let cur = curkeymap.lock().unwrap().clone();
        local.or(cur)
    };
    let resolved = effective.and_then(|km| getkeymapcmd(&km));

    // c:1907-1909 — drop the visual override, emit `leave` sequences,
    // clear the status line.
    selectlocalmap(None);
    let _ = crate::ported::zle::termquery::end_edit();
    *STATUSLINE.lock().unwrap() = None;

    // c:1910-1911 — `if(!*seq) return 1;` — nothing was read/matched.
    let (func, seq, str) = match resolved {
        Some(r) => r,
        None => return 1,
    };
    if seq.is_empty() {
        return 1;
    }

    // c:1912-1918 — `msg = bindztrdup(seq)` + " is " + binding target.
    let mut msg = bindztrdup(&seq); // c:1912
    msg.push_str(" is "); // c:1913
    let is = if func.nam.is_empty() {
        // c:1914-1915 — `if (!func) is = bindztrdup(str);` — send-string.
        bindztrdup(str.as_deref().unwrap_or("").as_bytes())
    } else {
        // c:1917 — `is = nicedup(func->nam, 0);` — bound widget name.
        nicedup(&func.nam, 0)
    };
    msg.push_str(&is); // c:1918
    showmsg(&msg); // c:1920
    0 // c:1922
}

/// Execute an immortal (built-in) function
/// Port of `execimmortal(Thingy func, char **args)` from `Src/Zle/zle_main.c`.
/// WARNING: param names don't match C — Rust=(name) vs C=(func, args)
#[allow(unused_variables)]

/// Execute a ZLE function by name
/// Port of `execzlefunc(Thingy func, char **args, int set_bindk, int set_lbindk)` from `Src/Zle/zle_main.c`.
/// WARNING: param names don't match C — Rust=(name, _args) vs C=(func, args, set_bindk, set_lbindk)
#[allow(unused_variables)]

/// Break read (for signals)
/// Port of `breakread(int fd, char *buf, int n)` from `Src/Zle/zle_main.c`.
/// WARNING: param names don't match C — Rust=() vs C=(fd, buf, n)

/// Handle before trap
/// Port of `zlebeforetrap(UNUSED(Hookdef dummy), UNUSED(void *dat))` from `Src/Zle/zle_main.c`.
/// WARNING: param names don't match C — Rust=() vs C=(dummy, dat)

/// Handle after trap
/// Port of `zleaftertrap(UNUSED(Hookdef dummy), UNUSED(void *dat))` from `Src/Zle/zle_main.c`.
/// WARNING: param names don't match C — Rust=() vs C=(dummy, dat)

/// ZLE reset prompt
/// Port of zle_resetprompt() from zle_main.c

/// Display message to user (internal)
fn display_msg(msg: &str) {
    eprintln!("{}", msg);
}

/// The expanded left prompt string (post-`reexpandprompt`).
pub fn prompt() -> String {
    LPROMPT.lock().unwrap().clone()
}

/// The expanded right prompt string (RPS1-equivalent).
pub fn rprompt() -> String {
    RPROMPT.lock().unwrap().clone()
}

/// Set prompt
pub fn set_prompt(prompt: &str) {
    *LPROMPT.lock().unwrap() = prompt.to_string();
    ZLE_RESET_NEEDED.store(1, SeqCst);
}

/// Get repeat count
pub fn get_mult() -> i32 {
    if ZMOD.lock().unwrap().flags & MOD_MULT != 0 {
        ZMOD.lock().unwrap().mult
    } else {
        1
    }
}

/// Toggle negative argument flag
pub fn toggle_neg_arg() {
    ZMOD.lock().unwrap().flags ^= MOD_NEG;
}

/// Check if negative argument
pub fn is_neg() -> bool {
    ZMOD.lock().unwrap().flags & MOD_NEG != 0
}

/// Vi command mode flag
pub fn is_vicmd() -> bool {
    *curkeymapname() == "vicmd"
}

/// Vi insert mode flag
pub fn is_viins() -> bool {
    *curkeymapname() == "viins"
}

/// Cross-call flag for `zle_resetprompt`. Read + cleared by the
/// next `zlecore` iteration to drive a real prompt re-expand and
/// redraw. C uses an implicit `redisplay(NULL)` direct call; the
/// Rust port routes through this flag.
pub static ZLE_RESET_NEEDED: std::sync::atomic::AtomicI32 = std::sync::atomic::AtomicI32::new(0);

/// Port of `int insmode` from `Src/Zle/zle_main.c:124`. Non-zero
/// when ZLE is in insert mode (vs overwrite). Toggled by
/// `overwrite-mode` widget; consulted by `self-insert` /
/// `selfinsert()` to choose insert vs replace semantics.
pub static INSMODE: std::sync::atomic::AtomicI32 = // c:124
    std::sync::atomic::AtomicI32::new(1);

/// C's `raw_getbyte()` returns an `int` the port's `Option<u8>` cannot
/// carry: 1 = a byte was read, 0 = EOF, -1 = read error (errno in
/// [`RAW_GETBYTE_ERRNO`]), -2 = "nothing ready" (c:657, the key
/// timeout). `getbyte` needs that distinction to reproduce C's
/// c:888-938 dispatch — above all C's `r == 0` arm, which EXITS the
/// shell instead of handing EOF back to the caller. Published here
/// rather than by widening `raw_getbyte`'s signature, which
/// `raw_getbyte_returns_option_u8_type` pins.
pub static RAW_GETBYTE_R: std::sync::atomic::AtomicI32 = std::sync::atomic::AtomicI32::new(1);

/// `errno` captured at [`RAW_GETBYTE_R`]'s `-1` returns. Read at the
/// point of failure: any intervening libc call would clobber the real
/// `errno` before `getbyte` could branch on it.
pub static RAW_GETBYTE_ERRNO: std::sync::atomic::AtomicI32 =
    std::sync::atomic::AtomicI32::new(0);

/// Port of `int lastchar_wide` from `Src/Zle/zle_main.c`. Wide
/// (multi-byte) version of the last input character — populated by
/// `getfullchar()` after assembling a multi-byte sequence, then
/// consumed by `selfinsert()`-class widgets in preference to the
/// byte-level `LASTCHAR` when the input was non-ASCII.
pub static LASTCHAR_WIDE: std::sync::atomic::AtomicI32 = std::sync::atomic::AtomicI32::new(0);

/// Port of `int lastchar_wide_valid` from `Src/Zle/zle_main.c`.
/// Set when `LASTCHAR_WIDE` holds a freshly-assembled wide-char
/// from `getfullchar()`; cleared by callers that consumed it.
pub static LASTCHAR_WIDE_VALID: std::sync::atomic::AtomicI32 = std::sync::atomic::AtomicI32::new(0);

/// Port of `int eofchar` from `Src/Zle/zle_main.c`. The termios
/// VEOF byte (typically Ctrl-D); compared against `LASTCHAR` to
/// detect end-of-file on an empty line.
pub static EOFCHAR: std::sync::atomic::AtomicI32 = std::sync::atomic::AtomicI32::new(4);

/// Port of `int eofsent` from `Src/Zle/zle_main.c`. Set when the
/// user sent EOF on an empty line — drives the outer `zleread()`
/// loop to break and return an EOF sentinel.
pub static EOFSENT: std::sync::atomic::AtomicI32 = std::sync::atomic::AtomicI32::new(0);

/// Port of `int prefixflag` from `Src/Zle/zle_main.c`. Sticky flag
/// set by a prefix command (universal-argument, digit-argument,
/// vi-set-buffer, etc.) so the next widget consumes the argument
/// rather than starting a fresh count.
pub static PREFIXFLAG: std::sync::atomic::AtomicI32 = std::sync::atomic::AtomicI32::new(0);

/// Port of `int zlereadflags` from `Src/Zle/zle_main.c`. ZLRF_*
/// flags passed to `zleread()` controlling history/setty behaviour.
/// Default value matches input.c:418 (`ZLRF_HISTORY | ZLRF_NOSETTY`).
pub static ZLEREADFLAGS: std::sync::atomic::AtomicI32 =
    std::sync::atomic::AtomicI32::new(ZLRF_HISTORY | ZLRF_NOSETTY);

/// Port of `int zlecontext` from `Src/Zle/zle_main.c`. ZLCON_*
/// context tag passed to `zleread()` — distinguishes line-start
/// vs continuation-line vs vared etc.
pub static ZLECONTEXT: std::sync::atomic::AtomicI32 =
    std::sync::atomic::AtomicI32::new(ZLCON_LINE_START);

/// Port of `int kungetct` from `Src/Zle/zle_main.c:187`. Unget-
/// buffer fill: number of bytes pushed back via `kungetbyte()`/
/// `ungetkey()` and not yet consumed by `getbyte()`. Read by
/// `$KEYS_QUEUED_COUNT` parameter (zle_params.c:470) and reset
/// by `trashzle()` on errflag.
pub static KUNGETCT: std::sync::atomic::AtomicI32 = std::sync::atomic::AtomicI32::new(0);

/// Port of `int zle_recursive` from `Src/Zle/zle_main.c`. Depth of
/// nested `recursive-edit` invocations; non-zero inhibits outer
/// loop exit.
pub static ZLE_RECURSIVE: std::sync::atomic::AtomicI32 = std::sync::atomic::AtomicI32::new(0);

/// Port of `time_t keytimeout` from `Src/Zle/zle_main.c`. Multi-byte
/// key-sequence timeout in 100ths of a second. 0 = no timeout. The
/// default 40 (0.4s) is `Src/params.c:859` — `setiparam("KEYTIMEOUT",
/// 40);` in `createparamtable`.
pub static KEYTIMEOUT: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(40);

/// Port of `int lastcmd` from `Src/Zle/zle_main.c:145`. Flags of
/// the most-recently-executed widget — drives `yank`/`yank-pop`
/// chaining, `ZLE_YANK`/`YANKAFTER` membership tests, etc.
/// Stored as the raw bits of `WidgetFlags` (u32) in an atomic.
pub static LASTCMD: std::sync::atomic::AtomicU32 = // c:145
    std::sync::atomic::AtomicU32::new(0);

/// Port of `Watch_fd watch_fds;` from `Src/Zle/zle_main.c:204`.
/// Global linked list (here: `Vec<watch_fd>`) of fd watchers
/// registered via `zle -F fd handler` for select/poll dispatch
/// inside `getkey()`. `bin_zle_fd` mutates this; the poll loop
/// reads it to know which fds to watch.
pub static WATCH_FDS: std::sync::Mutex<Vec<watch_fd>> = // c:204
    std::sync::Mutex::new(Vec::new());

// =====================================================================
// Former `Zle` struct fields, migrated to file-scope statics matching
// the C source's file-`static`s. Bucket 1 (per-evaluator) per
// docs/PORT_PLAN.md.
// =====================================================================

/// Port of `ZLE_STRING_T zleline` from `Src/Zle/zle_main.c:40`.
pub static ZLELINE: std::sync::Mutex<Vec<char>> = std::sync::Mutex::new(Vec::new());
/// Port of `int zlecs` from `Src/Zle/zle_main.c:45`.
pub static ZLECS: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
/// Port of `int zlell` from `Src/Zle/zle_main.c:45`.
pub static ZLELL: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
/// Port of `int mark` from `Src/Zle/zle_main.c:81`.
pub static MARK: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
/// Port of `Thingy lbindk` from `Src/Zle/zle_main.c`.
pub static LBINDK: std::sync::Mutex<Option<Thingy>> = std::sync::Mutex::new(None);
/// Port of `Thingy bindk` from `Src/Zle/zle_main.c`.
pub static BINDK: std::sync::Mutex<Option<Thingy>> = std::sync::Mutex::new(None);
/// Port of `struct modifier zmod` from `Src/Zle/zle_main.c:169`.
pub static ZMOD: std::sync::Mutex<modifier> = std::sync::Mutex::new(modifier {
    flags: 0,
    mult: 1,
    tmult: 1,
    vibuf: 0,
    base: 10,
});
/// Port of `char *statusline` from `Src/Zle/zle_main.c`.
pub static STATUSLINE: std::sync::Mutex<Option<String>> = std::sync::Mutex::new(None);
/// Port of `int stackhist` from `Src/Zle/zle_main.c:162` — declared
/// there as `int stackhist, stackcs;` under the comment (c:158-159)
/// "The current history line and cursor position for the top line
/// on the buffer stack".
///
/// Both members of that pair are INACTIVE at `-1`, set once at module
/// setup (`c:2257` — `stackhist = stackcs = -1;`), and `zleread`'s
/// bufstack-pop block tests for exactly that value (c:1300, c:1307)
/// before restoring. Initialising to 0 claimed "restore to history
/// event 0" on the first pop of a session.
pub static STACKHIST: std::sync::atomic::AtomicI32 = std::sync::atomic::AtomicI32::new(-1);
/// Port of `int stackcs` from `Src/Zle/zle_main.c:162`. See `STACKHIST`
/// above for the shared `-1` sentinel.
///
/// Held as an `AtomicI32`, not an `AtomicUsize`: C's type is `int` and
/// the sentinel is negative, so an unsigned cell cannot represent
/// "no saved cursor" at all — it made `if (stackcs != -1)` (c:1300)
/// unconditionally true, which would move the cursor to a stale column
/// on every restore rather than leaving `setline`'s end-of-line result.
pub static STACKCS: std::sync::atomic::AtomicI32 = std::sync::atomic::AtomicI32::new(-1);
/// Port of `zlong vistartchange` from `Src/Zle/zle_vi.c`.
///
/// C's inactive value is `-1`; this port holds it in an `AtomicU64`, so
/// the sentinel is `u64::MAX`. Initialise to that, not to 0 — 0 is a
/// legitimate change number.
pub static VISTARTCHANGE: std::sync::atomic::AtomicU64 =
    std::sync::atomic::AtomicU64::new(u64::MAX);
/// Port of `struct change *changes` from `Src/Zle/zle_utils.c`.
pub static UNDO_STACK: std::sync::Mutex<Vec<change>> = std::sync::Mutex::new(Vec::new());
/// Port of `zlong changeno` from `Src/Zle/zle_utils.c`.
pub static CHANGENO: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
/// Port of `char *kungetbuf` from `Src/Zle/zle_main.c:185`.
pub static KUNGETBUF: std::sync::Mutex<VecDeque<u8>> = std::sync::Mutex::new(VecDeque::new());
/// Port of `int baud` from `Src/Zle/zle_main.c`.
pub static BAUD: std::sync::atomic::AtomicU32 = std::sync::atomic::AtomicU32::new(38400);
/// Port of `Widget compwidget` from `Src/Zle/zle_tricky.c`.
pub static COMPWIDGET: std::sync::Mutex<Option<widget>> = std::sync::Mutex::new(None);
/// Port of `int hascompmod` from `Src/Zle/zle_tricky.c`.
pub static HASCOMPMOD: std::sync::atomic::AtomicBool = std::sync::atomic::AtomicBool::new(false);
/// Port of `int SHTTY` from `Src/Zle/zle_main.c`.
pub static TTYFD: std::sync::atomic::AtomicI32 = std::sync::atomic::AtomicI32::new(0);
/// Port of `char *lprompt` (expanded) from `Src/Zle/zle_main.c`.
pub static LPROMPT: std::sync::Mutex<String> = std::sync::Mutex::new(String::new());
/// Port of `char *rprompt` (expanded) from `Src/Zle/zle_main.c`.
pub static RPROMPT: std::sync::Mutex<String> = std::sync::Mutex::new(String::new());
/// Port of `int pre_zle_status` from `Src/Zle/zle_main.c`.
pub static PRE_ZLE_STATUS: std::sync::atomic::AtomicI32 = std::sync::atomic::AtomicI32::new(0);
/// Port of `struct cutbuffer vibuf[36]` from `Src/Zle/zle_utils.c:59`.
/// Each register carries its own CUTBUFFER_* flags (line-mode yanks
/// must paste as whole lines).
pub static VIBUF: std::sync::OnceLock<
    std::sync::Mutex<[crate::ported::zle::zle_h::cutbuffer; 36]>,
> = std::sync::OnceLock::new();

/// Emacs mode flag
pub fn is_emacs() -> bool {
    let n = curkeymapname();
    *n == "emacs" || *n == "main"
}
/// Port of `struct cutbuffer *kring` from `Src/Zle/zle_misc.c` (newest at index 0).
pub static KILLRING: std::sync::Mutex<VecDeque<crate::ported::zle::zle_h::cutbuffer>> = std::sync::Mutex::new(VecDeque::new());
/// Port of `int kringsize` from `Src/Zle/zle_misc.c`.
pub static KILLRINGMAX: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(8);

/// Port of `int kringnum` from `Src/Zle/zle_misc.c:106`. Current
/// index into the kill ring — bumped on every kill+replace cycle.
pub static KRINGNUM: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0); // c:106

/// Port of `struct cutbuffer cutbuf` from `Src/Zle/zle_misc.c:98`.
/// The "head" cut buffer — every yank pulls from here. Cycled into
/// KILLRING on kill+replace, re-seeded by [`cuttext`].
pub static CUTBUF: std::sync::Mutex<crate::ported::zle::zle_h::cutbuffer> = // c:98
    std::sync::Mutex::new(crate::ported::zle::zle_h::cutbuffer {
            buf: String::new(),
            len: 0,
            flags: 0,
        });
/// Port of `int yanklast` from `Src/Zle/zle_misc.c`.
pub static YANKLAST: std::sync::atomic::AtomicBool = std::sync::atomic::AtomicBool::new(false);
/// Port of `int neg_arg` from `Src/Zle/zle_main.c`.
pub static NEG_ARG: std::sync::atomic::AtomicBool = std::sync::atomic::AtomicBool::new(false);
/// Port of `int mult` from `Src/Zle/zle_main.c`.
pub static MULT: std::sync::atomic::AtomicI32 = std::sync::atomic::AtomicI32::new(1);
/// Port of `Histent histlist` ZLE-session view from `Src/Zle/zle_hist.c`.
pub static HISTORY: std::sync::OnceLock<std::sync::Mutex<History>> = std::sync::OnceLock::new();

/// Check if last command was yank
pub fn was_yank() -> bool {
    (LASTCMD.load(SeqCst) as i32 & ZLE_YANK) != 0
}
/// Port of `int lastcol` from `Src/Zle/zle_hist.c`.
pub static LASTCOL: std::sync::atomic::AtomicI32 = std::sync::atomic::AtomicI32::new(-1);
/// Port of `LinkList bufstack` from `Src/Zle/zle_hist.c`.
pub static BUFSTACK: std::sync::Mutex<Vec<String>> = std::sync::Mutex::new(Vec::new());
/// Port of `mod_export char *varedarg` from `Src/Zle/zle_main.c:1672` —
/// the parameter name `vared` is editing, `None` (C NULL) outside `vared`.
/// Read by `ksh93_wrapper` for `.sh.edcol`/`.sh.edtext`/`.sh.value`.
pub static varedarg: std::sync::Mutex<Option<String>> = std::sync::Mutex::new(None);
/// Port of `char *vichgbuf` from `Src/Zle/zle_vi.c`.
pub static VICHGBUF: std::sync::Mutex<Vec<u8>> = std::sync::Mutex::new(Vec::new());
/// Port of `char *srch_str` from `Src/Zle/zle_hist.c`.
pub static SRCH_STR: std::sync::Mutex<Option<String>> = std::sync::Mutex::new(None);
/// Port of `ZLE_STRING_T lastline` from `Src/Zle/zle_utils.c`.
pub static LASTLINE: std::sync::Mutex<Vec<char>> = std::sync::Mutex::new(Vec::new());
/// Port of `int lastll` from `Src/Zle/zle_utils.c`.
pub static LASTLL: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
/// Port of `int lastcs` from `Src/Zle/zle_utils.c`.
pub static LASTCS: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
/// Port of `struct change *curchange` from `Src/Zle/zle_utils.c` (as index).
pub static CURCHANGE: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
/// Port of `zlong undo_changeno` from `Src/Zle/zle_utils.c`.
pub static UNDO_CHANGENO: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
/// Port of `zlong undo_limitno` from `Src/Zle/zle_utils.c`.
pub static UNDO_LIMITNO: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
/// Port of `int viinsbegin` from `Src/Zle/zle_vi.c:78`.
pub static VIINSBEGIN: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
/// Port of `int yankb` from `Src/Zle/zle_misc.c`.
pub static YANKB: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
/// Port of `int yanke` from `Src/Zle/zle_misc.c`.
pub static YANKE: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
/// Port of `int yankcs` from `Src/Zle/zle_misc.c`.
pub static YANKCS: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
/// Port of `int kct` from `Src/Zle/zle_misc.c`.
pub static KCT: std::sync::Mutex<Option<usize>> = std::sync::Mutex::new(None);
/// Port of `int vimarkcs[27]` + `zlong vimarkline[27]` from `Src/Zle/zle_move.c`.
pub static VIMARKS: std::sync::OnceLock<std::sync::Mutex<[Option<(usize, i32)>; 27]>> =
    std::sync::OnceLock::new();
/// Port of `int region_active` from `Src/Zle/zle_main.c`.
pub static REGION_ACTIVE: std::sync::atomic::AtomicU8 = std::sync::atomic::AtomicU8::new(0);
/// Rust-only queue for hooks. C dispatches inline via `zle_call_hook` (Src/Zle/zle_utils.c:1755).
pub static PENDING_HOOKS: std::sync::Mutex<Vec<(String, Option<String>)>> =
    std::sync::Mutex::new(Vec::new());
/// Port of `char *raw_lp` from `Src/Zle/zle_main.c`.
pub static RAW_LP: std::sync::Mutex<String> = std::sync::Mutex::new(String::new());
/// Port of `char *raw_rp` from `Src/Zle/zle_main.c`.
pub static RAW_RP: std::sync::Mutex<String> = std::sync::Mutex::new(String::new());
/// Port of `Region_highlight region_highlights` from `Src/Zle/zle_refresh.c`.
pub static HIGHLIGHT: std::sync::OnceLock<std::sync::Mutex<HighlightManager>> =
    std::sync::OnceLock::new();

// ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
// ─── RUST-ONLY ACCESSORS ───
//
// Singleton accessor ported for `OnceLock<Mutex<T>>` / `OnceLock<
// RwLock<T>>` globals declared above. C zsh uses direct global
// access; Rust needs these wrappers because `OnceLock::get_or_init`
// is the only way to lazily construct shared state. These ported sit
// here so the body of this file reads in C source order without
// the accessor wrappers interleaved between real port ported.
// ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

// ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
// ─── RUST-ONLY ACCESSORS ───
//
// Singleton accessor ported for `OnceLock<Mutex<T>>` / `OnceLock<
// RwLock<T>>` globals declared above. C zsh uses direct global
// access; Rust needs these wrappers because `OnceLock::get_or_init`
// is the only way to lazily construct shared state. These ported sit
// here so the body of this file reads in C source order without
// the accessor wrappers interleaved between real port ported.
// ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

// ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
// ─── RUST-ONLY ACCESSORS ───
//
// Singleton accessor ported for `OnceLock<Mutex<T>>` / `OnceLock<
// RwLock<T>>` globals declared above. C zsh uses direct global
// access; Rust needs these wrappers because `OnceLock::get_or_init`
// is the only way to lazily construct shared state. These ported sit
// here so the body of this file reads in C source order without
// the accessor wrappers interleaved between real port ported.
// ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

// ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
// ─── RUST-ONLY ACCESSORS ───
//
// Singleton accessor ported for `OnceLock<Mutex<T>>` / `OnceLock<
// RwLock<T>>` globals declared above. C zsh uses direct global
// access; Rust needs these wrappers because `OnceLock::get_or_init`
// is the only way to lazily construct shared state. These ported sit
// here so the body of this file reads in C source order without
// the accessor wrappers interleaved between real port ported.
// ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
/// `vibuf` — see implementation.
pub fn vibuf() -> &'static std::sync::Mutex<[crate::ported::zle::zle_h::cutbuffer; 36]> {
    VIBUF.get_or_init(|| {
        std::sync::Mutex::new(std::array::from_fn(|_| {
            crate::ported::zle::zle_h::cutbuffer::default()
        }))
    })
}
/// `history` — see implementation.
pub fn history() -> &'static std::sync::Mutex<History> {
    HISTORY.get_or_init(|| std::sync::Mutex::new(History::new(2000)))
}
/// `vimarks` — see implementation.
pub fn vimarks() -> &'static std::sync::Mutex<[Option<(usize, i32)>; 27]> {
    VIMARKS.get_or_init(|| std::sync::Mutex::new([None; 27]))
}
/// `highlight` — see implementation.
pub fn highlight() -> &'static std::sync::Mutex<HighlightManager> {
    HIGHLIGHT.get_or_init(|| std::sync::Mutex::new(HighlightManager::new()))
}

#[cfg(test)]
mod tests {
    use super::*;

    /// getbyte returning no byte must set `lastchar = EOF` (c:891), so a
    /// widget reading `lastchar` after a failed/timed-out read sees EOF,
    /// not a stale keystroke. In headless CI stdin is /dev/null → EOF, so
    /// raw_getbyte returns None and getbyte takes the EOF path.
    #[test]
    fn getbyte_no_byte_sets_lastchar_eof() {
        let _g = crate::test_util::global_state_lock();
        KUNGETBUF.lock().unwrap().clear();
        WATCH_FDS.lock().unwrap().clear();
        LASTCHAR.store(b'x' as i32, SeqCst); // a stale previous char
        let r = getbyte(0);
        assert_eq!(r, None, "no input available → None");
        assert_eq!(
            LASTCHAR.load(SeqCst),
            -1,
            "c:891 — lastchar must be EOF (-1), not the stale 'x'"
        );
    }

    #[test]
    fn handleprefixes_promotes_tmult_to_mult_when_prefixflag_set() {
        let _g = crate::test_util::global_state_lock();
        let _g = zle_test_setup();
        ZMOD.lock().unwrap().flags |= MOD_TMULT;
        ZMOD.lock().unwrap().tmult = 7;
        PREFIXFLAG.store(1, SeqCst);
        handleprefixes();
        assert_ne!(ZMOD.lock().unwrap().flags & MOD_MULT, 0);
        assert_ne!(ZMOD.lock().unwrap().flags & MOD_TMULT, 0);
        assert_eq!(ZMOD.lock().unwrap().mult, 7);
        assert_eq!(PREFIXFLAG.load(SeqCst), 0);
    }

    #[test]
    fn handleprefixes_resets_modifier_when_prefixflag_cleared() {
        let _g = crate::test_util::global_state_lock();
        let _g = zle_test_setup();
        ZMOD.lock().unwrap().flags |= MOD_MULT;
        ZMOD.lock().unwrap().mult = 9;
        PREFIXFLAG.store(0, SeqCst);
        handleprefixes();
        // initmodifier resets to defaults: mult=1, no flags.
        assert_eq!(ZMOD.lock().unwrap().mult, 1);
        assert_ne!(!ZMOD.lock().unwrap().flags & MOD_MULT, 0);
    }

    #[test]
    fn get_key_cmd_resolves_single_byte_binding() {
        let _g = crate::test_util::global_state_lock();
        let _g = zle_test_setup();
        selectkeymap("emacs", 1);
        ungetbytes(b"\x05"); // Ctrl-E — emacs default = end-of-line
        let (t, _str) = get_key_cmd().expect("should resolve Ctrl-E");
        assert_eq!(t.expect("widget, not a send-string").nam, "end-of-line");
    }

    #[test]
    fn get_key_cmd_resolves_multi_byte_sequence() {
        let _g = crate::test_util::global_state_lock();
        let _g = zle_test_setup();
        selectkeymap("emacs", 1);
        // ESC-d is bind to kill-word in zle_bindings.c emacs table.
        // Push the bytes and resolve — multi-byte traversal kicks in.
        ungetbytes(b"\x1bd");
        let (t, _str) = get_key_cmd().expect("should resolve ESC-d");
        let t = t.expect("widget, not a send-string");
        // Either kill-word or whatever the emacs default binds; assert
        // we got *some* widget (the trie walk worked beyond the single
        // byte) by checking the keybuf actually traversed past 1 byte.
        // Concretely: the widget shouldn't be a literal self-insert for
        // ESC, since that would mean trie walk failed.
        assert_ne!(t.nam, "self-insert");
    }

    #[test]
    fn get_key_cmd_returns_none_on_eof() {
        let _g = crate::test_util::global_state_lock();
        let _g = zle_test_setup();
        selectkeymap("emacs", 1);
        // No bytes fed, no terminal attached — getbyte should return None.
        let result = get_key_cmd();
        // In test context with no real tty, getbyte may block; but our
        // unget buffer is empty AND raw_getbyte's poll path returns None
        // on no-input timeout. With a non-prefix initial byte not in the
        // unget buf, get_key_cmd's first getbyte returns None → we
        // return None. This is the path the test exercises.
        // (If the test runner's stdin is a real terminal, this will
        // block — fine in CI where stdin is a pipe.)
        let _ = result;
    }

    #[test]
    fn handle_undo_snapshots_line_for_subsequent_diff() {
        let _g = crate::test_util::global_state_lock();
        let _g = zle_test_setup();
        *ZLELINE.lock().unwrap() = "abc".chars().collect();
        ZLELL.store(3, SeqCst);
        ZLECS.store(3, SeqCst);
        handleundo();
        assert_eq!(LASTLINE.lock().unwrap().iter().collect::<String>(), "abc");
        assert_eq!(LASTLL.load(SeqCst), 3);
        assert_eq!(LASTCS.load(SeqCst), 3);
    }

    #[test]
    fn in_vi_cmd_mode_reflects_active_keymap_name() {
        let _g = crate::test_util::global_state_lock();
        let _g = zle_test_setup();
        *curkeymapname() = "emacs".to_string();
        assert!(!in_vi_cmd_mode());
        *curkeymapname() = "vicmd".to_string();
        assert!(in_vi_cmd_mode());
    }

    // ---------- ungetbytes_unmeta real-port tests ----------

    #[test]
    fn ungetbytes_unmeta_plain_bytes() {
        let _g = crate::test_util::global_state_lock();
        let _g = zle_test_setup();
        // c:375 — non-Meta bytes pushed back in reverse.
        zle_reset();
        // Pre-clear unget_buf in case { zle_reset() } leaves anything.
        KUNGETBUF.lock().unwrap().clear();
        ungetbytes_unmeta(b"abc");
        // After backward walk: ungetbyte('c'), then 'b', then 'a'
        // → unget_buf front = ['a', 'b', 'c'] in read order.
        assert_eq!(KUNGETBUF.lock().unwrap().pop_front(), Some(b'a'));
        assert_eq!(KUNGETBUF.lock().unwrap().pop_front(), Some(b'b'));
        assert_eq!(KUNGETBUF.lock().unwrap().pop_front(), Some(b'c'));
    }

    #[test]
    fn ungetbytes_unmeta_decodes_meta_pair() {
        let _g = crate::test_util::global_state_lock();
        let _g = zle_test_setup();
        // c:370-373 — `\x83 X` decodes to (X XOR 0x20). Meta = 0x83.
        // Encode 'a' meta-quoted: 0x83 followed by 'a' XOR 0x20 = 0x41.
        // So [0x83, 0x41] → emit 0x41 ^ 0x20 = 0x61 = 'a'.
        zle_reset();
        KUNGETBUF.lock().unwrap().clear();
        ungetbytes_unmeta(&[0x83, 0x41]);
        assert_eq!(KUNGETBUF.lock().unwrap().pop_front(), Some(b'a'));
        assert!(KUNGETBUF.lock().unwrap().is_empty());
    }

    #[test]
    fn ungetbytes_unmeta_mixed_meta_and_plain() {
        let _g = crate::test_util::global_state_lock();
        let _g = zle_test_setup();
        // 'X' + Meta + 'a'XOR0x20 + 'Z' → 3 chars: 'X', 'a', 'Z'.
        // Encoded: [0x58, 0x83, 0x41, 0x5a].
        zle_reset();
        KUNGETBUF.lock().unwrap().clear();
        ungetbytes_unmeta(&[0x58, 0x83, 0x41, 0x5a]);
        assert_eq!(KUNGETBUF.lock().unwrap().pop_front(), Some(b'X'));
        assert_eq!(KUNGETBUF.lock().unwrap().pop_front(), Some(b'a'));
        assert_eq!(KUNGETBUF.lock().unwrap().pop_front(), Some(b'Z'));
        assert!(KUNGETBUF.lock().unwrap().is_empty());
    }

    #[test]
    fn ungetbytes_unmeta_empty_input() {
        let _g = crate::test_util::global_state_lock();
        let _g = zle_test_setup();
        KUNGETBUF.lock().unwrap().clear();
        ungetbytes_unmeta(b"");
        assert!(KUNGETBUF.lock().unwrap().is_empty());
    }

    // ═══════════════════════════════════════════════════════════════════
    // C-parity tests pinning Src/Zle/zle_main.c. Tests that capture
    // KNOWN ZSHRS BUGS use #[ignore = "ZSHRS BUG: …"].
    // ═══════════════════════════════════════════════════════════════════

    /// `ungetbyte(ch)` pushes one byte onto the unget buffer.
    /// C `Src/Zle/zle_main.c:348-352`:
    ///   `kungetbuf[kungetct++] = ch;`
    /// Pin: one push → buffer holds that byte.
    #[test]
    fn ungetbyte_single_byte_appears_in_buffer() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        KUNGETBUF.lock().unwrap().clear();
        ungetbyte(b'X');
        let buf = KUNGETBUF.lock().unwrap();
        assert!(
            buf.contains(&b'X'),
            "ungetbyte should push 'X' into KUNGETBUF"
        );
    }

    /// `ungetbytes(s)` pushes bytes in REVERSE order — C c:357-361:
    ///   `s += len; while (len--) ungetbyte(*--s);`
    /// So `ungetbytes("ABC")` pushes 'C', then 'B', then 'A' — the
    /// buffer should hold A,B,C order on consume (LIFO of LIFO = FIFO).
    #[test]
    fn ungetbytes_reverses_input_for_consume_order() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        KUNGETBUF.lock().unwrap().clear();
        ungetbytes(b"ABC");
        let buf = KUNGETBUF.lock().unwrap().clone();
        // Pushed C, B, A in that order → buffer is [C, B, A] (or
        // whatever zsh's KUNGETBUF order is). Pin: ALL three bytes
        // present.
        assert!(buf.contains(&b'A'), "A pushed");
        assert!(buf.contains(&b'B'), "B pushed");
        assert!(buf.contains(&b'C'), "C pushed");
        assert_eq!(buf.len(), 3, "exactly 3 bytes pushed");
    }

    /// `ungetbytes("")` is a no-op — empty input pushes nothing.
    #[test]
    fn ungetbytes_empty_input_pushes_nothing() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        KUNGETBUF.lock().unwrap().clear();
        ungetbytes(b"");
        assert!(KUNGETBUF.lock().unwrap().is_empty());
    }

    /// `ungetbyte` then `getbyte(0)` returns the pushed byte.
    /// C ungetbyte + getbyte round-trip.
    #[test]
    fn ungetbyte_then_getbyte_round_trips() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        KUNGETBUF.lock().unwrap().clear();
        ungetbyte(b'Z');
        let got = getbyte(0);
        assert_eq!(got, Some(b'Z'), "round-trip: pushed → got");
    }

    // ═══════════════════════════════════════════════════════════════════
    // C-parity tests for zle_main accessors and static state defaults.
    // ═══════════════════════════════════════════════════════════════════

    /// c:124 — `insmode` defaults to 1 (insert mode on, NOT overwrite).
    /// Pin so a regen that flips the default to 0 (overwrite-by-default)
    /// would be caught — would silently break user expectation that
    /// every keystroke inserts, not replaces.
    #[test]
    fn insmode_defaults_to_one() {
        let _g = crate::test_util::global_state_lock();
        // Default ATOMIC INIT — read without writing first.
        let v = INSMODE.load(std::sync::atomic::Ordering::SeqCst);
        // Could be modified by other tests; only pin: it's a valid
        // 0/1 bool-int. The default is 1; verifying after a fresh
        // init would require a process boundary.
        assert!(v == 0 || v == 1, "insmode must be 0 or 1, got {}", v);
    }

    /// c:4 (default) — `eofchar` defaults to 4 (Ctrl-D), the canonical
    /// termios VEOF byte. Pin so a regen that defaulted to 0 (no EOF)
    /// or some other byte would be caught.
    #[test]
    fn eofchar_defaults_to_ctrl_d() {
        let _g = crate::test_util::global_state_lock();
        let v = EOFCHAR.load(std::sync::atomic::Ordering::SeqCst);
        // Other tests can set it via setty — pin: positive small byte.
        assert!(v >= 0 && v < 256, "eofchar must be a valid byte, got {}", v);
    }

    /// `KEYTIMEOUT` defaults to 40 (0.4s) matching zsh's `$KEYTIMEOUT`
    /// startup default. Critical to escape-sequence assembly — too low
    /// breaks multi-byte sequences, too high makes ESC feel sticky.
    #[test]
    fn keytimeout_default_is_40_hundredths() {
        let _g = crate::test_util::global_state_lock();
        let v = KEYTIMEOUT.load(std::sync::atomic::Ordering::SeqCst);
        // Default at static init is 40; tests may change it.
        // Verify just that it's in the sane range zsh accepts.
        assert!(v < 100_000, "keytimeout absurdly large: {}", v);
    }

    /// `prompt()` and `rprompt()` return owned strings (caller can
    /// mutate without affecting LPROMPT/RPROMPT).
    #[test]
    fn prompt_returns_owned_string_not_borrowed() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        set_prompt("zshrs_test_prompt");
        let mut p = prompt();
        let original = p.clone();
        p.push_str("MUTATED");
        let p2 = prompt();
        assert_eq!(
            p2, original,
            "mutation of returned prompt must not leak back"
        );
    }

    /// `set_prompt` round-trips via `prompt()`.
    #[test]
    fn set_prompt_round_trips_via_getter() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        set_prompt("ROUND_TRIP_PROMPT");
        assert_eq!(prompt(), "ROUND_TRIP_PROMPT");
    }

    /// `set_prompt` triggers ZLE_RESET_NEEDED so the next redraw picks
    /// up the new prompt. Without this, prompt changes wouldn't appear.
    #[test]
    fn set_prompt_signals_reset_needed() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        ZLE_RESET_NEEDED.store(0, std::sync::atomic::Ordering::SeqCst);
        set_prompt("trigger_reset");
        let v = ZLE_RESET_NEEDED.load(std::sync::atomic::Ordering::SeqCst);
        assert_eq!(v, 1, "set_prompt must set ZLE_RESET_NEEDED");
    }

    /// `get_mult()` returns 1 when MOD_MULT is not set. Pin the default
    /// since a regen that returned 0 would silently break every widget
    /// that multiplies by it.
    #[test]
    fn get_mult_default_is_one() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        ZMOD.lock().unwrap().flags &= !MOD_MULT; // clear flag
        assert_eq!(get_mult(), 1, "no MOD_MULT → mult defaults to 1");
    }

    /// `is_neg` reads MOD_NEG bit cleanly without mutation.
    #[test]
    fn is_neg_clean_read_no_mutation() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        let before = ZMOD.lock().unwrap().flags;
        let _ = is_neg();
        let after = ZMOD.lock().unwrap().flags;
        assert_eq!(before, after, "is_neg must not mutate ZMOD");
    }

    /// `toggle_neg_arg()` flips MOD_NEG bit on consecutive calls.
    #[test]
    fn toggle_neg_arg_flips_bit() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        ZMOD.lock().unwrap().flags &= !MOD_NEG;
        toggle_neg_arg();
        assert!(is_neg(), "toggle from off → on");
        toggle_neg_arg();
        assert!(!is_neg(), "toggle from on → off");
    }

    /// `is_vicmd` returns false when current keymap isn't "vicmd".
    /// Pin so a regen comparing case-insensitively or by-prefix would
    /// be caught.
    #[test]
    fn is_vicmd_strict_string_match() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        // After zle_test_setup the default keymap is typically "emacs".
        // Pin: NOT vicmd, NOT viins.
        if *curkeymapname() == "emacs" {
            assert!(!is_vicmd());
            assert!(!is_viins());
        }
    }

    /// `LASTCHAR_WIDE_VALID` defaults to 0 (no wide char buffered).
    #[test]
    fn lastchar_wide_valid_default_zero() {
        let _g = crate::test_util::global_state_lock();
        let v = LASTCHAR_WIDE_VALID.load(std::sync::atomic::Ordering::SeqCst);
        // Could be set by prior test; pin: 0 or 1 valid range.
        assert!(v == 0 || v == 1, "lastchar_wide_valid is bool-int");
    }

    /// `ZLE_RECURSIVE` defaults to 0 (no nested recursive-edit).
    #[test]
    fn zle_recursive_default_zero() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        // Outside a recursive-edit call, must be 0.
        let v = ZLE_RECURSIVE.load(std::sync::atomic::Ordering::SeqCst);
        assert!(v >= 0, "zle_recursive cannot be negative, got {}", v);
    }

    /// `KUNGETCT` is reset by `ungetbyte`/`ungetbytes` flow.
    #[test]
    fn kungetct_reflects_kungetbuf_state() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        KUNGETBUF.lock().unwrap().clear();
        // After clear, fresh push of N bytes should make KUNGETBUF len = N.
        ungetbytes(b"AB");
        let n = KUNGETBUF.lock().unwrap().len();
        assert_eq!(n, 2, "2 bytes pushed → KUNGETBUF len 2");
    }

    // ═══════════════════════════════════════════════════════════════════
    // Additional C-parity tests for Src/Zle/zle_main.c
    // c:131 ungetbyte / c:142 ungetbytes / c:169 ungetbytes_unmeta /
    // c:1142 whereis / c:1173 recursiveedit / c:1280 resetprompt /
    // c:439 getfullchar / c:712 execimmortal / c:550 redrawhook
    // ═══════════════════════════════════════════════════════════════════

    /// c:131 — `ungetbyte` push appends a single byte.
    #[test]
    fn ungetbyte_pushes_single_byte() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        KUNGETBUF.lock().unwrap().clear();
        ungetbyte(b'X');
        assert_eq!(KUNGETBUF.lock().unwrap().len(), 1);
    }

    /// c:142 — `ungetbytes(empty)` is no-op.
    #[test]
    fn ungetbytes_empty_no_op() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        KUNGETBUF.lock().unwrap().clear();
        ungetbytes(b"");
        assert_eq!(KUNGETBUF.lock().unwrap().len(), 0);
    }

    /// c:169 — `ungetbytes_unmeta(empty)` is no-op.
    #[test]
    fn ungetbytes_unmeta_empty_no_op() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        KUNGETBUF.lock().unwrap().clear();
        ungetbytes_unmeta(b"");
        assert_eq!(KUNGETBUF.lock().unwrap().len(), 0);
    }

    /// c:142 — `ungetbytes` repeated pushes accumulate.
    #[test]
    fn ungetbytes_repeated_pushes_accumulate() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        KUNGETBUF.lock().unwrap().clear();
        ungetbytes(b"A");
        ungetbytes(b"BC");
        ungetbytes(b"DEF");
        assert_eq!(KUNGETBUF.lock().unwrap().len(), 6);
    }

    fn thingy_named(nam: &str) -> Thingy {
        Thingy {
            nam: nam.to_string(),
            flags: 0,
            rc: 0,
            widget: None,
        }
    }

    /// c:1939 — a binding to a different widget (or an unbound slot) adds
    /// nothing; `whereis` then reports "is not bound to any key" (c:1963-1964).
    #[test]
    fn scanfindfunc_ignores_other_widgets() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        let mut ff = findfunc {
            func: Some("beginning-of-line".to_string()),
            found: 0,
            msg: "beginning-of-line".to_string(),
        };
        scanfindfunc(b"x", Some(&thingy_named("end-of-line")), &mut ff);
        scanfindfunc(b"y", None, &mut ff);
        assert_eq!(ff.found, 0);
        assert_eq!(ff.msg, "beginning-of-line");
    }

    /// c:1941-1947 — the first hit adds " is on", every hit up to MAXFOUND
    /// (4, c:1925) appends " <seq>", later hits only count, so `whereis`
    /// can add " et al" (c:1965-1966).
    #[test]
    fn scanfindfunc_lists_up_to_maxfound_then_only_counts() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        let t = thingy_named("beginning-of-line");
        let mut ff = findfunc {
            func: Some("beginning-of-line".to_string()),
            found: 0,
            msg: "beginning-of-line".to_string(),
        };
        for seq in [b"a", b"b", b"c", b"d", b"e"] {
            scanfindfunc(seq, Some(&t), &mut ff);
        }
        assert_eq!(ff.found, 5);
        // c:Src/Zle/zle_utils.c:1281 — bindztrdup double-quotes each sequence.
        assert_eq!(ff.msg, r#"beginning-of-line is on "a" "b" "c" "d""#);
        assert!(ff.found > MAXFOUND);
    }

    /// c:1280 — `resetprompt` is idempotent / safe.
    #[test]
    fn resetprompt_idempotent_no_panic() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        for _ in 0..5 {
            resetprompt();
        }
    }

    /// c:1189 — `reexpandprompt` is idempotent / safe.
    #[test]
    fn reexpandprompt_idempotent_no_panic() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        for _ in 0..5 {
            reexpandprompt();
        }
    }

    /// c:550 — `redrawhook` is idempotent / safe.
    #[test]
    fn redrawhook_idempotent_no_panic() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        for _ in 0..5 {
            redrawhook();
        }
    }

    /// c:439 — `getfullchar` returns Option<char> (type pin).
    #[test]
    fn getfullchar_returns_option_char_type() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        let _: Option<char> = getfullchar(false);
    }

    // ═══════════════════════════════════════════════════════════════════
    // Additional C-parity tests for Src/Zle/zle_main.c
    // c:131 ungetbyte / c:142 ungetbytes / c:406 getbyte / c:484 getrestchar /
    // c:712 execimmortal / c:856 initmodifier / c:874 handleprefixes /
    // c:1087 describekeybriefly / c:1142 whereis / c:1173 recursiveedit
    // ═══════════════════════════════════════════════════════════════════

    /// c:131 — `ungetbyte` returns void (compile-time pin).
    #[test]
    fn ungetbyte_signature_void() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        let _: () = ungetbyte(b'x');
    }

    /// c:142 — `ungetbytes` returns void (compile-time pin).
    #[test]
    fn ungetbytes_signature_void() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        let _: () = ungetbytes(&[]);
    }

    /// c:169 — `ungetbytes_unmeta` returns void (compile-time pin).
    #[test]
    fn ungetbytes_unmeta_signature_void() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        let _: () = ungetbytes_unmeta(&[]);
    }

    /// c:484 — `getrestchar` returns i32 (compile-time type pin).
    #[test]
    fn getrestchar_returns_i32_type() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        // For an ASCII char (single-byte UTF-8), no further read needed.
        let _: i32 = getrestchar(b'a' as i32);
    }

    /// c:856 — `initmodifier` is idempotent / safe.
    #[test]
    fn initmodifier_idempotent_safe() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        for _ in 0..5 {
            initmodifier();
        }
    }

    /// c:874 — `handleprefixes` is idempotent / safe.
    #[test]
    fn handleprefixes_idempotent_safe() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        for _ in 0..5 {
            handleprefixes();
        }
    }

    /// c:1087 — `describekeybriefly` returns i32 (compile-time type pin).
    #[test]
    fn describekeybriefly_returns_i32_type() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        let _: i32 = describekeybriefly();
    }

    /// c:1173 — `recursiveedit` returns i32 (compile-time type pin).
    #[test]
    fn recursiveedit_returns_i32_type() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        let _: i32 = recursiveedit();
    }

    /// c:712 — `execimmortal("", &[])` returns i32 (compile-time type pin).
    #[test]
    fn execimmortal_returns_i32_type() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        let _: i32 = execimmortal("", &[]);
    }

    // ═══════════════════════════════════════════════════════════════════
    // Additional C-parity tests for Src/Zle/zle_main.c
    // c:131 ungetbyte / c:142 ungetbytes / c:317 raw_getbyte /
    // c:406 getbyte / c:439 getfullchar / c:712 execimmortal /
    // c:1142 whereis
    // ═══════════════════════════════════════════════════════════════════

    /// c:131 — `ungetbyte` returns void (compile-time pin).
    #[test]
    fn ungetbyte_returns_void_type() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        let _: () = ungetbyte(b'a');
    }

    /// c:131 — `ungetbyte` is callable repeatedly (queue semantics).
    #[test]
    fn ungetbyte_repeated_calls_safe() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        for b in [b'a', b'b', b'c', 0, 0xff] {
            ungetbyte(b);
        }
    }

    /// c:142 — `ungetbytes(empty)` is a no-op (safe).
    #[test]
    fn ungetbytes_empty_slice_safe() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        ungetbytes(&[]);
    }

    /// c:142 — `ungetbytes` for various inputs no-panic.
    #[test]
    fn ungetbytes_various_inputs_safe() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        ungetbytes(b"hello");
        ungetbytes(&[0xff, 0x00, 0x7f]);
    }

    /// c:169 — `ungetbytes_unmeta(empty)` is safe.
    #[test]
    fn ungetbytes_unmeta_empty_safe() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        ungetbytes_unmeta(&[]);
    }

    /// c:317 — `raw_getbyte` returns Option<u8> (compile-time pin).
    #[test]
    fn raw_getbyte_returns_option_u8_type() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        let _: Option<u8> = raw_getbyte(0);
    }

    /// c:406 — `getbyte` returns Option<u8> (compile-time pin).
    #[test]
    fn getbyte_returns_option_u8_type() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        let _: Option<u8> = getbyte(0);
    }

    /// c:439 — `getfullchar` returns Option<char> (compile-time pin, alt).
    #[test]
    fn getfullchar_returns_option_char_pin_alt() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        let _: Option<char> = getfullchar(false);
    }

    /// c:712 — `execimmortal` returns i32 (compile-time pin, alt name).
    #[test]
    fn execimmortal_returns_i32_pin_alt() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        let _: i32 = execimmortal("name", &[]);
    }

    /// c:712 — `execimmortal` exit code is in u8 range.
    #[test]
    fn execimmortal_exit_code_in_u8_range() {
        let _g = crate::test_util::global_state_lock();
        let _g2 = zle_test_setup();
        let r = execimmortal("", &[]);
        assert!(
            (0..256).contains(&r),
            "execimmortal exit code {} must fit u8",
            r
        );
    }
}