sv_sim_sim/process/

cfg.rs

//! Task S3a (`docs/superpowers/plans/2026-09-26-wave-A2-slice.md`): the CPS
//! control-flow-graph builder and its Segment IR lowering, restricted to
//! exactly the A2-slice's two suspend kinds (`Delay`, `Edge` -- i.e.
//! `SignalEventControl` with `posedge`/`negedge`). Ledger PR-004, PR-005,
//! PR-006 (Delay/SignalEvent half only), PR-007, PR-008, PR-041, PR-042,
//! PR-043, PR-044, PR-048, PR-069, PR-074, PR-114, CG-098, CG-099. See
//! `docs/design/process.md` §§1-6.
//!
//! **Task 1 (`docs/superpowers/plans/2026-09-26-wave-A2-process-kernels.md`,
//! ledger PR-006/PR-045) extends the above** with the rest of the
//! suspend-relevant `StatementKind` taxonomy: `Wait` (level-sensitive,
//! `SuspendPoint::Level` -- CFG shape only, the "sometimes there's no
//! suspend at all" re-check behavior is Task 3's), `EventTrigger` (split
//! only when it carries a `DelayControl` timing; an undelayed `->`/`->>`
//! never suspends), a fork/join `Block` (`Terminator::ForkJoin`,
//! construction only -- never scheduled, see `docs/design/process.md` §7),
//! and `Terminator::Loop{header,body,exit,entry}` for `for`/`while`/
//! `do-while`/`forever`/`foreach` (PR-045). `WaitFork`/`WaitOrder`/
//! `DisableFork` remain named [`LoweringError`]s (recognized, never silently
//! ignored, but not yet schedulable -- fork/join has no runtime semantics
//! this wave either way). Two more `TimingControlKind`s get real handling:
//! `EventList` (as `SuspendPoint::EdgeList`) and `CycleDelay` (lowered like
//! `Delay` against a single inferred clock, matching `docs/design/
//! process.md` §2's own explicitly-flagged stub scope).
//! `ImplicitEvent`/`RepeatedEvent`/`Delay3`/`OneStepDelay`/`BlockEventList`
//! remain named `LoweringError`s: `docs/design/process.md` §2's own
//! `SuspendPoint` enum (the binding design record) has exactly six variants
//! (`Delay`/`Edge`/`EdgeList`/`ImplicitComb`/`Level`/`CycleDelay`) and does
//! not admit these five as first-class suspend shapes at all, and this
//! file's own extension policy (below) forbids adding a placeholder variant
//! ahead of a real implementation -- so PR-006 stays `"partial"` in
//! `docs/ledger.json` after this task, not `"done"` (see this task's own
//! deviations note for the full accounting).
//!
//! **Task 6 (`docs/superpowers/plans/2026-09-27-run-wiring.md`, ledger
//! CG-081/CG-171) closes most of the above gap.** `SuspendPoint` gains real
//! variants for `ImplicitEvent` (`ImplicitComb`) and `OneStepDelay`
//! (`OneStep`), and `CycleDelay` is revised to carry its inferred clock
//! signal/edge as real payload (see that variant's own doc comment for the
//! full CG-171 reasoning, including a recorded deviation from the plan's
//! literal `analysis::ClockDomainId`-carrying wire design). Two kinds stay
//! named `LoweringError`s after this task too, each for a DIFFERENT,
//! verified reason -- neither is "no `SuspendPoint` variant exists for it"
//! any more: `BlockEventList` is only a covergroup sampling event (LRM 19.3;
//! slang rejects it as a procedural timing control at parse, see the
//! `BlockEventList` arm in `walk_timed`); `RepeatedEvent` is structurally UNREACHABLE at this dispatch
//! point at all -- verified empirically (a throwaway AST-dumping test) that
//! `RepeatedEventControl` is never the outer `TimingControl` of a
//! `StatementKind::Timed` node, only ever an intra-assignment timing control
//! embedded in an `Assignment` expression's own children, a structurally
//! different position needing a `Temporary`-frame-slot CFG-splitting
//! mechanism this AST-only layer does not have -- see the `RepeatedEvent`
//! arm in `walk_timed` for the full citation and this task's deviations for
//! the full accounting. `Delay3` remains rejected unconditionally too, but
//! because it is semantically inapplicable to a procedural suspend point at
//! all (gate-primitive delay syntax), not a gap.
//!
//! **Task 3 (`docs/superpowers/plans/2026-09-26-wave-A2-process-kernels.md`
//! "A2-part2", ledger CG-169/CG-170/PR-106/CG-115) gives `Wait`/`SignalEvent`
//! their real, previously-deferred semantics.** [`Self::walk_wait`] no
//! longer closes `cur` with an unconditional `Terminator::Suspend` -- see its
//! own doc comment for the `Terminator::Branch`-based "immediate check,
//! conditional suspend" shape LRM 9.4.3/CG-169 requires. `SuspendPoint::Edge`
//! gains an `iff: Option<Expression<'d>>` field (CG-170,
//! `SignalEventControl.iffCondition`), extracted positionally from
//! `TimingControl::children()` by [`extract_iff`] -- see that function's own
//! doc comment for the verified-live `sv-lang`=0.1.9 binding shape this
//! relies on. Neither change touches `SuspendPoint::EdgeList`: Task 1's own
//! doc comment on that variant already scopes `iff` extraction to the
//! narrower `(Expression, EdgeKind)` pair with no `iff`, and this task does
//! not revisit that decision.
//!
//! **`disable label;` (`StatementKind::Disable`, distinct from
//! `DisableFork`).** The pinned `sv-lang`=0.1.9 binding exposes no way to
//! read `DisableStatement::target`: the C API has no `slang_stmt_disable_*`
//! accessor, and the generic `children()`/`expressions()` walk never
//! reaches `target` (`DisableStatement` defines no `visitExprs`) -- a
//! `disable label;` statement's own `children().len()` is `0`. The label is
//! therefore read from the statement's source span in the design's source
//! text (registered by the caller, [`set_source_text`]), accepted only when
//! the span reads exactly `disable <identifier> ;` (see `disable_label`).
//! A named sequential block containing a `disable` gets its own exit block
//! (`disable_targets`), and `disable blk;` inside it is a jump there, like
//! `break` (LRM 1800-2023 §9.6.2). In a branch of the named fork block `f`,
//! `disable f;` stays a statement (codegen: `sv_rt_disable_fork_block`,
//! ending every branch of the fork) followed by the branch's end. Any other
//! target -- another process's block, a task, an outer fork, an unreadable
//! span -- is a named `LoweringError`.
//!
//! **Algorithm (PR-007):** [`build_cfg`] is a single recursive-descent walk
//! of a process body's `Statement` tree (`children()`/`statements()`/
//! `then_branch()`/`else_branch()`/`body()`/`condition()`/`expr()`) -- an
//! ordinary CFG builder -- with the ONE addition that entering a `Timed`
//! node wrapping a `Delay` or `SignalEvent` (posedge/negedge only) timing
//! control closes the current [`BasicBlock`] with `Terminator::Suspend` and
//! opens a fresh block for the guarded statement that follows. Every other
//! suspend-relevant `StatementKind` (`Wait`, `WaitFork`, `WaitOrder`,
//! `EventTrigger`, `DisableFork`, a fork/join `Block`) and every other
//! `TimingControlKind` a `Timed` node could wrap (`EventList`,
//! `ImplicitEvent`, `RepeatedEvent`, `Delay3`, `OneStepDelay`, `CycleDelay`,
//! `BlockEventList`) is a named [`LoweringError`], never silently treated as
//! ordinary control flow (PR-006's slice-scope half) -- Task 1 above lifts
//! this restriction for `Wait`/`EventTrigger`/fork-join `Block`/`EventList`/
//! `CycleDelay` specifically.
//!
//! **Extension policy (PR-069):** [`Terminator`] and [`SuspendPoint`]
//! intentionally have exactly the variants a task has actually implemented
//! -- no placeholder variant is ever added ahead of a real implementation,
//! because an unused variant would force every `match` in this file (and
//! every future consumer's) to either wildcard it (forbidden by ARCHITECTURE
//! §7 item 9) or handle a case that can never actually be constructed (a
//! "gate that cannot fail", forbidden by this wave's correctness posture).
//! Instead: a task adding a new suspend kind or terminator shape adds the
//! variant *and* is required to re-audit every `match` site in this file,
//! since none has a wildcard arm to silently swallow it -- Task 1 did
//! exactly this for `Loop`/`ForkJoin`/`EdgeList`/`Level`/`CycleDelay` (but
//! deliberately NOT `Disable` -- see above). Until a shape has a real
//! implementation, every code path that *would* need it returns a named
//! [`LoweringError`] instead. `SegTerminator` (PR-041/042/043,
//! `lower_terminator` below) deliberately keeps its *own* variant set frozen
//! at `Goto`/`CondGoto`/`Suspend`/`End` -- it is exhaustively matched by
//! `sv-sim-codegen` (a different track's contract) with no wildcard arm, so
//! `Terminator::Loop` lowers losslessly to `SegTerminator::Goto` (a real,
//! already-populated successor block -- `entry` -- always carries the
//! actual decision, whether that is `header`'s own `Branch` or a plain
//! `Fallthrough`) rather than adding a new `SegTerminator` variant that
//! would break that exhaustive match. A `Terminator::ForkJoin` reaching
//! `lower_terminator` is a caller-discipline precondition violation (see
//! [`contains_unschedulable_fork_join`]), not a shape `SegTerminator` can
//! represent at all this wave -- fork/join has no runtime scheduling
//! semantics yet, so no `SegTerminator` value would be honest here; every
//! real caller must check that predicate first.
use crate::symid::SymbolUid;
use std::collections::HashSet;
use std::fmt;

use sv_lang::kinds::{ExpressionKind, StatementKind, SymbolKind, TimingControlKind};
use sv_lang::{
    EdgeKind, Expression, KnownSystemName, SemNode, Statement, StatementBlockKind, Symbol,
    TimingControl, UniquePriorityCheck,
};

/// Every unhandled AST shape this file's builders encounter produces one of
/// these -- never `panic!`/`unimplemented!`/a silent no-op. Deliberately a
/// separate type from `sv-sim-codegen::error::LoweringError`: this crate must
/// never depend on `sv-sim-codegen` (the dependency edge runs the other way
/// once Task S3c lands), so it cannot reuse that one.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct LoweringError {
    pub message: String,
}

impl LoweringError {
    // `pub(crate)` (Task S3b deviation, not `fn`-private as Task S3a left
    // them): `process::liveness` is a sibling module that needs to construct
    // the same error shape (declared-local width/shape rejections, malformed
    // block-scope walks) rather than inventing a second `LoweringError`-like
    // type just for one module boundary. Still crate-private -- no outside
    // crate constructs one of these directly, only ever sees it through
    // `Result::Err`.
    pub(crate) fn unsupported(what: impl Into<String>) -> Self {
        Self {
            message: format!("unsupported: {}", what.into()),
        }
    }

    pub(crate) fn malformed(what: impl Into<String>) -> Self {
        Self {
            message: format!("malformed AST: {}", what.into()),
        }
    }

    /// PR-022's hard, typed self-check failure: `process::liveness::
    /// compute_liveness`'s backward fixpoint computed a live-in symbol that
    /// `AnalyzedProcedure::read_set()` (or, absent a live `Analysis` handle,
    /// this crate's own AST-derived read-set aggregate -- see that module's
    /// doc comment) never reports as read anywhere in the whole procedure.
    /// Kept as a named constructor on this same flat `LoweringError` shape
    /// (deviation from the plan's literal `LoweringError::
    /// LivenessOracleMismatch` enum-variant phrasing: Task S3a already
    /// committed `LoweringError` as a message-carrying struct with named
    /// constructors, not an enum, so this follows that established pattern
    /// rather than introducing a second, incompatible error type mid-crate)
    /// -- the message names the offending symbol, so a test asserts on
    /// content, not just `is_err()`, per this file's own established
    /// discipline.
    pub(crate) fn liveness_oracle_mismatch(symbol_name: impl Into<String>) -> Self {
        Self {
            message: format!(
                "LivenessOracleMismatch: computed live-in symbol {:?} is absent from the \
                 whole-procedure read_set -- this is a hard bug in the liveness walk, never \
                 a legitimate program (PR-022)",
                symbol_name.into()
            ),
        }
    }
}

impl fmt::Display for LoweringError {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        write!(f, "{}", self.message)
    }
}

impl std::error::Error for LoweringError {}

/// Dense, per-process `ProcessCfg::blocks` index, assigned in AST pre-order
/// (first-appearance-in-source) allocation order (CG-098, CG-099, PR-114) --
/// completely independent of any later LLVM basic-block layout order, since
/// no LLVM `Context`/`Module` exists yet when `build_cfg` runs.
#[derive(Clone, Copy, PartialEq, Eq, Hash, Debug)]
pub struct BlockId(pub u32);

/// Dense `Segment` index -- see [`BlockId`]'s doc comment; `lower_to_segments`
/// assigns `SegId(i)` to the block at index `i`, a 1:1, order-preserving
/// mapping (PR-041..PR-043).
#[derive(Clone, Copy, PartialEq, Eq, Hash, Debug)]
pub struct SegId(pub u32);

/// R-run Task 8 (PR-045/PR-006): a `repeat(N) body;` loop's compiler-
/// synthesized iteration counter, minted once per `RepeatLoop` statement
/// [`CfgBuilder::walk_repeat_loop`] decomposes into a real CFG shape (i.e.
/// only when `body` contains a suspend point somewhere in its own subtree --
/// the suspend-free case stays the pre-existing opaque leaf `stmt_shared::
/// lower_repeat_loop` already handles unchanged, see `walk_stmt`'s own
/// dispatch comment). Unlike a `for` loop's user-visible control variable
/// (a real `sv_lang::Symbol`, `FrameSlotSource::DeclaredVar`), `repeat`'s
/// count has no corresponding declared local at all -- there is nothing a
/// `Branch`'s `cond: Expression` could re-evaluate every iteration the way
/// `while`/`for` do. This id is this crate's own, `sv_lang`-free handle for
/// that counter's eventual `FrameSlotSource::SyntheticCounter` frame slot
/// (`process::liveness`) -- dense per-`ProcessCfg`, assigned in allocation
/// order (mirrors [`BlockId`]/[`SegId`]'s own numbering discipline), never
/// reused across two distinct `repeat` statements in the same process (so a
/// nested or sibling `repeat` gets its own, independent counter slot).
#[derive(Clone, Copy, PartialEq, Eq, Hash, Debug)]
pub struct RepeatCounterId(pub u32);

/// The suspend kinds this file implements. `Delay`/`Edge` are PR-006's
/// slice-scope half (Task S3a); `EdgeList`/`Level`/`CycleDelay` are Task 1's
/// addition (PR-006's Part 2 half). `ImplicitComb` remains unimplemented --
/// see the module doc comment's PR-006 accounting.
#[derive(Debug, Clone)]
pub enum SuspendPoint<'d> {
    /// `#<delay>`. The second field is the inlined subroutine whose body holds the delay, when
    /// one does: a delay's time unit is the unit of the scope that DECLARES it (LRM 3.14.2.1),
    /// not the caller's.
    Delay(Expression<'d>, Option<Symbol<'d>>),
    Edge {
        signal: Expression<'d>,
        edge: EdgeKind,
        /// `SignalEventControl.iffCondition` (LRM `@(posedge clk iff en)`,
        /// Task 3/CG-170): `None` when no `iff` qualifier is present. The
        /// kernel's resume prologue for a suspend point carrying `Some(_)`
        /// ALWAYS re-evaluates it on wake and, if false, immediately
        /// re-returns `Suspended` with the identical `WaitSpec` unchanged --
        /// it does not advance the PC and does not re-run the segment body
        /// (`docs/design/process.md` §2's own "iff re-check" paragraph;
        /// `compile_iff_guard`'s doc comment in `sv-sim-codegen::
        /// process_lower` is the codegen half of this same contract).
        iff: Option<Expression<'d>>,
    },
    /// `EventListControl` (`@(a or b or c)`): wake on any member. Deviation
    /// from `docs/design/process.md` §2's literal `Vec<{edge,signal,iff}>`
    /// triple -- Task 1's own "Public names/types introduced" text specifies
    /// the narrower `(Expression, EdgeKind)` pair with no `iff` (matching
    /// how `Level`'s own `iff`/re-check contract is deferred to Task 3);
    /// this is the more specific, more recent spec and is followed exactly.
    ///
    /// The second field holds each member's `iff` guard (LRM 1800-2023
    /// 9.4.2.3: `@(posedge a iff c or b)`): always the same length as the
    /// member list, empty for an unguarded member. The list wakes on a
    /// member's event only if every one of that member's guards holds then
    /// (more than one when an `iff` meets an `$inferred_clock` whose own
    /// clocking event has an `iff`, a conjunction: LRM 17.4, 9.4.2.3).
    EdgeList(Vec<(Expression<'d>, EdgeKind)>, Vec<Vec<Expression<'d>>>),
    /// `wait(expr)` (LRM 9.4.3, level-sensitive). Task 3: [`CfgBuilder::
    /// walk_wait`] wires this as the `else_blk` of a `Terminator::Branch` on
    /// `expr` itself (never unconditionally) -- "evaluate immediately,
    /// suspend only if false" (`docs/design/process.md` §2's own "wait(expr)
    /// special case", CG-169). The per-wake re-check (re-suspending
    /// unchanged on a spurious wake, CG-115) is entirely codegen's job
    /// (`sv-sim-codegen::process_lower::compile_iff_guard`'s resume
    /// prologue) -- this crate never evaluates `expr`.
    Level(Expression<'d>),
    /// `##N` (clocking-block-relative cycle delay) -- **Task 6 (CG-171)
    /// revision:** no longer a bare cycle count. ARCHITECTURE §6.5 represents
    /// `CycleDelayControl` as "kept as an unresolved expression + ClockDomain
    /// for the scheduler to convert cycles->ticks at runtime", i.e. codegen
    /// must never precompute an absolute tick offset (a clock's period can
    /// change dynamically -- see `sched::mod::EventTerm::Repeat`'s own SC-053
    /// doc comment for the differentiating behavior this rules out). This
    /// variant carries `count` (the compile-time-constant cycle count --
    /// still restricted the same way `##N` always was, see
    /// [`CfgBuilder::walk_timed`]'s `CycleDelay` arm) plus the syntactically
    /// inferred single clock this process suspends against, `clock`/
    /// `edge` (or, with a default clocking block in scope, that block
    /// itself with `BothEdges`: `##N` counts its events) -- the SAME `inferred_clock` this file already tracked before
    /// this task (previously computed then silently discarded once
    /// ambiguity-checked; now threaded through as real payload). Resolving
    /// `clock` to a concrete `StateCellId` still happens at codegen
    /// time (`sv-sim-codegen::process_lower::resolve_suspend_point`, exactly
    /// like `Edge`'s own signal) -- what does NOT happen at codegen time is
    /// converting `count` cycles into an absolute tick number: that stays a
    /// live, per-edge `EventTerm::Repeat{count, inner: Edge{cell, edge}}`
    /// wait the SCHEDULER counts down at runtime (already built and tested,
    /// SC-052/SC-053), so a clock whose period later changes still produces
    /// the correct absolute timing by construction, with no cached tick
    /// offset to go stale.
    ///
    /// **Deviation from the plan's literal `analysis::ClockDomainId`-carrying
    /// wire design, and a real, verified SCOPE LIMIT (both recorded in full
    /// in this task's deviations -- not silently narrowed):** the plan's own
    /// text describes resolving `clock` against a live `sv-lang`-
    /// `Analysis`-backed WOCB partition result (`analysis::
    /// StaticAnalysisResult::clock_domains()`) threaded all the way from
    /// `sv-sim-bin::run`'s elaboration pipeline through to the scheduler's
    /// `Engine`. That plumbing does not exist anywhere in this tree yet
    /// (`analysis::analyze()` is never called from `run.rs`/`aot.rs`/
    /// `pipeline.rs` today), and building it is a genuinely separate,
    /// `run.rs`-touching undertaking this task's own binding rules forbid
    /// risking (wave-B-runtime is concurrently landing in that exact file).
    /// This variant instead reuses the clock inference this crate ALREADY
    /// performed for every `##N` before this task (the same
    /// `inferred_clock` ambiguity check, now threaded through as real
    /// payload instead of discarded) -- **which is genuinely narrower than
    /// "the process's own inferred clock domain," not merely a smaller-but-
    /// equivalent instance of it, and this narrowing is load-bearing, not
    /// cosmetic:** it resolves `##N` written inside a process that ALSO
    /// itself syntactically sights a `posedge`/`negedge` edge somewhere
    /// earlier (the common `always_ff @(posedge clk) ... ##N ...` idiom),
    /// but does NOT resolve a `##N` relative to a `default clocking`/named
    /// `clocking cb @(posedge clk); endclocking` block referenced from a
    /// process with NO local edge sighting of its own -- verified directly
    /// (a throwaway test compiling ARCHITECTURE §6.5's own canonical
    /// clocking-block fixture, `default clocking cb; ... initial ##3 x=1;`,
    /// with no `@(posedge clk)` anywhere in that second `initial` block):
    /// `walk_timed`'s `CycleDelay` arm returns the SAME "no unambiguous
    /// single inferred clock in scope" `LoweringError` for it that a
    /// genuinely unclocked `##N` gets, because `default clocking`/
    /// `ClockingBlock` declarations are never read by this mechanism at
    /// all. Reading them is also a `session.rs`-owned, pre-existing,
    /// verified-separately-blocked gap regardless (`sv-sim-codegen::
    /// session.rs`'s own structural-symbol classification already places
    /// `SymbolKind::ClockingBlock` in its "no correct lowering exists yet"
    /// bucket -- a design containing one fails upstream of this crate
    /// entirely), so closing it is not a smaller extension of this task's
    /// own mechanism, it needs a different, cross-track-blocked one. CG-171
    /// therefore closes for real, common `##N` usage (a clock edge
    /// syntactically visible in the SAME process) but stays open for the
    /// `default clocking`-bound shape -- see this task's deviations for the
    /// full accounting, and `crates/sv-sim-harness/tests/
    /// slice_vs_iverilog.rs::clocking_cycle_delay_matches_iverilog_bit_for_bit`
    /// for the still-`#[ignore]`d e2e proof (updated by this task to name
    /// this exact, narrower residual, not the stale "CG-171 unimplemented"
    /// reason it carried before). See `sched::reschedule_req_proposal::
    /// KIND_REPEAT_EDGE`'s own doc comment for the wire shape the resolved
    /// (local-edge) case resolves into -- a single-cell, single-edge repeat
    /// wait that fits the frozen 24-byte budget inline (no out-of-line
    /// table needed, unlike `EdgeList`/`ImplicitComb`).
    ///
    /// **Verified, separately-recorded finding (not this task's bug to fix,
    /// but load-bearing for why no NEW oracle-diffed e2e fixture proves this
    /// closure end-to-end):** `##N` outside a `default clocking` context is
    /// not accepted as valid SystemVerilog by either reference tool this
    /// crate uses -- `iverilog -g2012` rejects a bare `##2` inside an
    /// ordinary `always_ff` body with a flat parser "syntax error", and
    /// `verilator --binary -sv` rejects the identical construct with
    /// "Usage of cycle delays requires default clocking (IEEE 1800-2023
    /// 14.11)" (both verified directly, by hand, against a throwaway
    /// fixture). This mechanism's "syntactically inferred single clock"
    /// acceptance criterion PRE-DATES this task (an earlier task's own
    /// `inferred_clock` field, which this task only threads through as real
    /// payload instead of discarding) -- this task neither introduces nor
    /// revisits that acceptance decision, only documents, empirically, that
    /// no available reference oracle can differentially validate it end to
    /// end: the codegen-level JIT+run round trip (`crates/sv-sim-codegen/
    /// tests/frame_roundtrip_matrix.rs`) is therefore the strongest
    /// available proof of this specific closure, not an iverilog/Verilator
    /// diff.
    CycleDelay {
        count: u32,
        /// The clock: a signal (the process's inferred clock, counted on
        /// `edge`), or the default clocking block (its event counter,
        /// counted on any change).
        clock: Symbol<'d>,
        edge: EdgeKind,
        /// A clocking drive THROUGH a virtual interface (`v.sb.c <= ##1 1`,
        /// LRM 25.9.1): the clock variable's member access. `clock` is then
        /// the template clocking block, which has no signal; the run time
        /// counts the events of the clocking block of the instance `v` holds.
        via: Option<Expression<'d>>,
    },
    /// **Task 6 (CG-081):** `ImplicitEventControl` (`@*`/`@(*)`). Fieldless
    /// per `docs/design/process.md` §2's own `SuspendPoint` sketch would
    /// suggest (`WaitSpec::ImplicitComb(SubscriptionSetId)` is resolved
    /// against a separate table, not embedded read-set data) -- deviates by
    /// carrying the guarded body's own AST-derived read-set directly
    /// (`Vec<Expression<'d>>`, computed by [`implicit_comb_read_set`]) rather
    /// than being truly fieldless, because this crate's `build_cfg` has no
    /// live `sv_lang::Analysis`/`AnalyzedProcedure` handle to later re-derive
    /// it from at codegen time (see [`implicit_comb_read_set`]'s own doc
    /// comment for the full reasoning) -- the read-set has to be captured
    /// HERE, while the guarded body is in hand, or nowhere in this crate.
    ImplicitComb(Vec<Expression<'d>>),
    /// **Task 6 (CG-081):** `OneStepDelayControl` (the LRM's built-in
    /// `1step` delay, one global-precision tick, SC-123). Fieldless -- the AST node itself carries no
    /// expression (confirmed against the vendored slang C++:
    /// `OneStepDelayControl` declares no field and no `visitExprs` override
    /// at all, so `TimingControl::children()` is always empty for this
    /// kind). Resolved at codegen time to `Suspend::Delay(1)` (LRM 3.14.3: a
    /// step is the global time precision) -- see
    /// `sv-sim-codegen::process_lower::resolve_suspend_point`'s `OneStep`
    /// arm.
    OneStep,
    /// `wait fork;` (LRM 9.6.1, SC-125): resume once every child this process
    /// forked has finished. Payload-free -- the scheduler tracks the children.
    WaitFork,
    /// Classes plan Task 13 (LRM 9.7): `p.await();` / `p.suspend();` as a
    /// statement. The call itself queues a process request; this suspend
    /// yields so the scheduler applies it before the next statement runs
    /// (`Suspend::ByRequest`). Payload-free.
    ByRequest,
}

/// Task 7 (PR-116, XC-044): a fieldless, `'static`-safe mirror of
/// [`SuspendPoint`]'s discriminants. `SuspendPoint<'d>` itself cannot be
/// named `&'static [SuspendPoint]` -- every payload-carrying variant embeds
/// a borrowed `sv_lang::Expression<'d>`, which is only ever alive for the
/// lifetime of a real, already-compiled `Design`, so no `'static` instance
/// of it can exist independent of one. This type is exactly the
/// "which shape" tag [`suspending_statement_kinds`]'s two callers (the
/// frame-slot round-trip matrix in `sv-sim-sim`'s own tests and the JIT+run
/// matrix in `sv-sim-codegen`'s tests) both need, without requiring either
/// to fabricate a borrowed `Expression` from nothing.
#[derive(Clone, Copy, PartialEq, Eq, Hash, Debug)]
pub enum SuspendPointKind {
    Delay,
    Edge,
    EdgeList,
    Level,
    CycleDelay,
    /// Task 6 (CG-081): `ImplicitEventControl` (`@*`/`@(*)`).
    ImplicitComb,
    /// Task 6 (CG-081): `OneStepDelayControl` (`#0`).
    OneStep,
    /// `wait fork;` (SC-125).
    WaitFork,
    /// `process::await()` / `process::suspend()` (Classes plan Task 13).
    ByRequest,
}

impl<'d> SuspendPoint<'d> {
    /// Exhaustive, no-wildcard match (ARCHITECTURE §7 item 9): if a future
    /// task adds a new `SuspendPoint` variant without extending
    /// [`SuspendPointKind`] and this match, the crate fails to COMPILE, not
    /// merely under-tests -- a stronger guarantee than
    /// [`suspending_statement_kinds`]'s own length alone could give.
    pub fn kind(&self) -> SuspendPointKind {
        match self {
            SuspendPoint::Delay(..) => SuspendPointKind::Delay,
            SuspendPoint::Edge { .. } => SuspendPointKind::Edge,
            SuspendPoint::EdgeList(..) => SuspendPointKind::EdgeList,
            SuspendPoint::Level(_) => SuspendPointKind::Level,
            SuspendPoint::CycleDelay { .. } => SuspendPointKind::CycleDelay,
            SuspendPoint::ImplicitComb(_) => SuspendPointKind::ImplicitComb,
            SuspendPoint::OneStep => SuspendPointKind::OneStep,
            SuspendPoint::WaitFork => SuspendPointKind::WaitFork,
            SuspendPoint::ByRequest => SuspendPointKind::ByRequest,
        }
    }
}

/// Task 7 (PR-116, XC-044): every `SuspendPoint` kind this file's CFG
/// builder currently gives a real shape to (i.e. every variant
/// [`SuspendPoint`] itself has -- see that enum's own doc comment for the
/// still-open `ImplicitEvent`/`RepeatedEvent`/`Delay3`/`OneStepDelay`/
/// `BlockEventList` gap PR-069's extension policy keeps out of the enum
/// entirely). One definition, promoted from a test-only helper to real
/// production code specifically so both `sv-sim-sim`'s own meta-test and
/// `sv-sim-codegen`'s JIT+run matrix enumerate the identical list, never two
/// independently-maintained copies that could silently drift apart (this
/// project's own "duplicate pure-function eval diverges" lesson).
///
/// **Not every kind in this list is yet resolvable by
/// `sv-sim-codegen::process_lower::resolve_suspend_point`** --
/// `EdgeList`/`CycleDelay` are real CFG shapes (this file's own Task 1) but
/// still a named, codegen-side `LoweringError` ("this SuspendPoint kind has
/// no codegen-side resolution yet"), a pre-existing, documented scope
/// boundary from that same task, not something this row's own file list
/// (`crates/sv-sim-sim/tests/frame_roundtrip_matrix.rs`, `crates/
/// sv-sim-codegen/tests/frame_roundtrip_matrix.rs`, this file) can close
/// without expanding into `sv-sim-codegen::process_lower`'s own `Files`
/// scope. `sv-sim-codegen`'s own round-trip matrix asserts the SPECIFIC,
/// named rejection for these two kinds (never silently skipping them), so
/// the gate still fails loudly in both directions: if a kind that should
/// round-trip stops doing so, or if a kind that should still be rejected
/// silently starts "succeeding" with an unreviewed codegen change.
pub fn suspending_statement_kinds() -> &'static [SuspendPointKind] {
    &[
        SuspendPointKind::Delay,
        SuspendPointKind::Edge,
        SuspendPointKind::EdgeList,
        SuspendPointKind::Level,
        SuspendPointKind::CycleDelay,
        SuspendPointKind::ImplicitComb,
        SuspendPointKind::OneStep,
        SuspendPointKind::WaitFork,
        SuspendPointKind::ByRequest,
    ]
}

/// A `BasicBlock`'s single exit (PR-008, extended by Task 1).
#[derive(Debug, Clone)]
pub enum Terminator<'d> {
    /// Falls straight into `BlockId` with no branch/suspend (e.g. the merge
    /// point after an `if`/`else`).
    Fallthrough(BlockId),
    /// Goes to `arms[i]` when `on` evaluates to `i`, else to `default_blk`
    /// -- reporting an `$error` at source offset `report` first, when set
    /// (a `wait_order` with no `else`).
    Switch {
        on: SwitchOn<'d>,
        arms: Vec<BlockId>,
        default_blk: BlockId,
        report: Option<sv_lang::SourceLoc>,
    },
    /// `if`/`case` (PR-044 -- expanded to a br-chain at the `Terminator`
    /// level; the ternary operator `?:` never appears here, only inside a
    /// straight-line expression within a [`BasicBlock`]'s `stmts`).
    Branch {
        cond: Expression<'d>,
        then_blk: BlockId,
        else_blk: BlockId,
    },
    /// An immediate assertion (LRM 16.3) whose pass or fail statement waits,
    /// so the statement cannot stay a straight-line leaf. Goes to `pass_blk`
    /// (`fail_blk`) when the expression is true (not true) and the assertion
    /// is checking with that action on (20.11), else to `done_blk`; the
    /// default `$error` of an assert/assume with no fail statement is
    /// reported inline before `done_blk`.
    Assertion {
        stmt: Statement<'d>,
        pass_blk: BlockId,
        fail_blk: BlockId,
        done_blk: BlockId,
    },
    Suspend {
        point: SuspendPoint<'d>,
        resume_blk: BlockId,
    },
    /// PR-048: `loop_back` is `None` for `initial`/`final` procedures and
    /// `Some(entry)` for `always`/`always_ff`/`always_comb`/`always_latch`
    /// procedures -- see [`ProcessLoopKind`].
    End { loop_back: Option<BlockId> },
    /// PR-045 (Task 1): `for`/`while`/`do-while`/`forever`/`foreach`.
    /// `header`'s own terminator (a plain `Branch` for a real per-iteration
    /// condition, or `Fallthrough` when there is none -- `forever`) carries
    /// the actual per-iteration decision, and `body`'s own terminator closes
    /// the back edge to `header`. `entry` is the block `cur` (the one this
    /// `Terminator::Loop` closes) actually transfers control to on first
    /// entry -- `header` for `while`/`for`/`forever`/`foreach` (the
    /// condition, if any, is checked before the first iteration), but
    /// `body` for `do-while` (the body always runs once before any check) --
    /// a deviation from `docs/design/process.md` §2's literal 3-field
    /// `Loop{header,body,exit}` (recorded in this task's deviations): a
    /// `do-while`'s real entry edge genuinely cannot be recovered from
    /// `header`/`body`/`exit` alone once `header` is required (as this
    /// task's own tests require) to remain a distinct, inspectable
    /// post-body recheck block rather than being aliased to `body`. Codegen
    /// may fully unroll a static-bound `for`, but the CFG representation
    /// itself always has a real `Loop` terminator so the liveness/segment-
    /// lowering passes never special-case "was this unrolled" (this file's
    /// own `lower_terminator` maps it losslessly to
    /// `SegTerminator::Goto(entry)`, since whichever real block `entry`
    /// names already carries its own correct terminator). `foreach`'s
    /// per-dimension bound is a `ConstantRange`, not an `Expression` slang
    /// exposes anywhere on the statement -- see `walk_foreach_loop`'s own
    /// doc comment for why that one kind's `body` is a chain of unrolled
    /// copies rather than a real back edge (a second, separately-recorded
    /// deviation).
    Loop {
        header: BlockId,
        body: BlockId,
        exit: BlockId,
        entry: BlockId,
    },
    /// `fork ... join`/`join_any`/`join_none` (Task 1, PR-069/docs/design/
    /// process.md §7): construction only, never scheduled. Each
    /// `branches[i]` is a full nested [`ProcessCfg`] (a fork branch can
    /// contain its own suspends). See [`contains_unschedulable_fork_join`]
    /// -- a real caller must check this before calling [`lower_to_segments`]
    /// on a CFG that might contain one.
    ForkJoin {
        kind: StatementBlockKind,
        branches: Vec<ProcessCfg<'d>>,
        join_blk: BlockId,
    },
    /// R-run Task 8 (PR-045/PR-006): a `repeat(N) body;` loop's `header`
    /// terminator, when `body` contains a suspend point (see
    /// [`RepeatCounterId`]'s own doc comment for why this is a distinct
    /// shape from `Branch`, never a fabricated `cond: Expression`). Mirrors
    /// `while`'s own `header`/`Branch` role exactly -- `then_blk` is the
    /// loop body, `else_blk` is the loop's exit -- except the re-checked
    /// condition is `counter != 0` against this loop's own compiler-
    /// synthesized [`RepeatCounterId`] slot, not a re-evaluated user
    /// expression.
    RepeatCheck {
        counter: RepeatCounterId,
        then_blk: BlockId,
        else_blk: BlockId,
    },
    /// A `case`/`casez`/`casex`/`case ... inside` statement whose arms
    /// cannot stay one straight-line leaf (an arm suspends, or `break`s /
    /// `continue`s an enclosing process loop, or `return`s from an inlined
    /// task): `stmt` supplies the selector and labels, matched in item
    /// order, `arms[i]` is `stmt.case_items()[i]`'s block and `default_blk`
    /// runs when no item matches. Also a `unique`/`unique0`/`priority` `if`
    /// series: `stmt` is its first `if` ([`if_chain`]), `arms[i]` the
    /// then-statement of the i-th condition and `default_blk` the final `else`,
    /// so the dispatch can report a violation where the series executes.
    /// Also an `if` with a pattern-matching or `&&&`-chained predicate (one
    /// arm, [`is_clause_if`]) and a `case ... matches` (`arms[i]` is
    /// `pattern_case_items()[i]`'s block, `default_blk` its `default`).
    Case {
        stmt: Statement<'d>,
        arms: Vec<BlockId>,
        default_blk: BlockId,
    },
}

/// One argument transfer of a task call inlined into the process CFG
/// (`CfgBuilder::inline_task_call`): a task whose body can suspend (`@`, `#`,
/// `wait`, ...) cannot be an ordinary compiled function, so its body is
/// walked in place and these run at the start of the inlined region's
/// blocks. Every symbol named here is one of `ProcessCfg::inlined_locals`.
#[derive(Debug, Clone)]
pub enum ArgBinding<'d> {
    /// `formal = actual`: an input (or the copy-in of an inout) formal.
    In {
        formal: Symbol<'d>,
        actual: Expression<'d>,
    },
    /// `var` = its declaration initializer, or its type's default: an
    /// `output` formal or one of the task's own locals, at task entry.
    Init { var: Symbol<'d> },
    /// `actual = formal`: an output/inout formal's copy-back after the body
    /// (`actual` is the lvalue expression).
    Out {
        actual: Expression<'d>,
        formal: Symbol<'d>,
    },
    /// `var = value`: a `foreach` loop variable's starting value.
    Const { var: Symbol<'d>, value: i64 },
    /// `var` = the current object: the `this` of a class-method task inlined
    /// for an implicit-`this` call (`run()` inside another method), bound in
    /// the caller's context. An explicit receiver (`obj.run()`) binds through
    /// [`ArgBinding::In`] instead.
    ThisOf { var: Symbol<'d> },
    /// An inlined task's input formal or entry-initialized local ending
    /// with the call (an automatic variable ends with its scope, LRM 6.21):
    /// whatever class / collection handles it holds are released (LRM
    /// 13.5.1). Runs at the call's exit block, so `return` and `disable`
    /// release too.
    Release { var: Symbol<'d> },
    /// `var += by`: a `foreach` loop variable's per-iteration step.
    Step { var: Symbol<'d>, by: i64 },
    /// `void'(arr.first(var))`, or with `next` `void'(arr.next(var))`: a
    /// `foreach` over the associative array `arr` walking its keys.
    ///
    /// For an associative array nested in a collection (`int m[int][string]`,
    /// `int q[$][int]`), `path` holds the enclosing `foreach` levels that
    /// select the array from `arr` (as [`RepeatCount::NestedSize`]); empty
    /// for `arr` itself.
    AssocKey {
        var: Symbol<'d>,
        arr: Expression<'d>,
        path: Vec<NestStep<'d>>,
        next: bool,
    },
    /// `lhs = #d rhs;` and the other intra-assignment timing controls (LRM
    /// 1800-2023 §10.4.1): the right-hand side is evaluated before the wait
    /// into the compiler temporary `temp` (a `FrameSlotSource::Temporary`
    /// frame slot, sized by [`ProcessCfg::captures`]`[temp]`)...
    Capture { temp: u32, value: Expression<'d> },
    /// ...and assigned to its target after it.
    ///
    /// With `nba` (`lhs <= @(e) rhs;`, LRM 1800-2023 §10.4.2) the assignment
    /// is a nonblocking one, staged for the NBA region: it runs in the
    /// synthetic fork branch [`CfgBuilder::walk_nba_event`] spawns.
    AssignCaptured {
        temp: u32,
        target: Expression<'d>,
        nba: bool,
    },
    /// `formal = temp`: a recursive task's input formal, copied from the
    /// call's evaluated argument ([`InheritedSlot::Temp`]) as the forked
    /// activation starts ([`CfgBuilder::inline_recursive_task`]).
    FromCaptured { temp: u32, formal: Symbol<'d> },
    /// `temp = formal`: a recursive task's `output`/`inout` formal, parked in
    /// a compiler temporary as the activation ends so the spawner can copy
    /// it back ([`InheritedSlot::Return`]).
    ToCaptured { temp: u32, formal: Symbol<'d> },
    /// Marks capture temporary `temp` as the value of the inlined call `call`
    /// of a function that spawns processes: the call's expression reads the
    /// temporary (keyed by [`call_result_key`]) instead of the function's
    /// shared result variable, which a second call of the same function in
    /// the statement, or another override of a virtual method, overwrites.
    /// A no-op at run time; [`ArgBinding::ToCaptured`] parks the value.
    CallResult { temp: u32, call: Expression<'d> },
    /// The resume of a mixed `@(class_event or signal ...)` wait (LRM 1800-2023
    /// 9.4.2.1, 15.5): the process leaves the class-event queues it is still
    /// queued on (the signal side woke it), so a later trigger of one of those
    /// events cannot wake a wait it is no longer in.
    ClassEventLeave,
    /// `temp` = the caller's current object: the receiver slot of a recursive
    /// class-method activation called with an implicit `this` (LRM 1800-2023
    /// 8.11, 13.4.1); an explicit receiver is an ordinary
    /// [`ArgBinding::Capture`].
    CaptureThis { temp: u32 },
    /// A `ref` formal bound to element `actual = c[i]` of a queue or dynamic
    /// array (LRM 1800-2023 13.5.2, 7.10.3): opens a runtime reference to the
    /// element into the 64-bit temporary `temp` (the collection's tracking
    /// outdates it on delete / pop / clear / resize), then `formal` = the
    /// element.
    RefOpen {
        temp: u32,
        formal: Symbol<'d>,
        actual: Expression<'d>,
    },
    /// The copy-out of [`ArgBinding::RefOpen`]: `actual` = `formal` unless
    /// the reference `temp` was outdated meanwhile.
    RefClose {
        temp: u32,
        formal: Symbol<'d>,
        actual: Expression<'d>,
    },
}

/// A frame slot a spawned branch copies by value from its parent
/// ([`ProcessCfg::inherited`]).
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum InheritedSlot {
    /// Capture temporary `parent` of the forking process -> `child` of the branch.
    Temp { parent: u32, child: u32 },
    /// Repeat counter `parent` -> `child`.
    Counter {
        parent: RepeatCounterId,
        child: RepeatCounterId,
    },
    /// The other way round, when the branch is done: its capture temporary
    /// `child` -> temporary `parent` of the process that forked it (a
    /// recursive task's `output`/`inout` formals, LRM 1800-2023 13.5).
    Return { parent: u32, child: u32 },
}

/// What a [`Terminator::Switch`] selects on.
#[derive(Clone)]
pub enum SwitchOn<'d> {
    /// The index of the wait term that woke the process at the suspend just
    /// before (`sv_rt_fired_term`): `wait_order`.
    FiredTerm,
    /// A virtual interface's instance id minus one (`netlist::vif`): an
    /// interface task called through it.
    VifId(Expression<'d>),
    /// A `randcase`'s item, picked at random by the items' weights (none
    /// when every weight is 0).
    RandCase(Statement<'d>),
    /// The arm whose class template ids hold the dynamic class of the object
    /// `receiver` names (the current object when `None`): a virtual class
    /// task that can suspend, one inlined override per arm (LRM 8.20).
    ObjClass {
        receiver: Option<Expression<'d>>,
        ids: Vec<Vec<u32>>,
    },
    /// No arm is ever taken: the switch only reports its error (`what` is the
    /// message) and continues at the default -- a call to an `extern forkjoin`
    /// task no module implements (LRM 25.7.5).
    NoTarget { what: String },
    /// The arm of the named block (`labels[i]`, innermost first) that the
    /// subroutine call just before disabled with `disable <block>;` from
    /// inside a function (LRM 9.6.2, 35.9), else the default
    /// (`sv_rt_dpi_fn_disable_index`).
    FnDisable { labels: Vec<String> },
}

impl std::fmt::Debug for SwitchOn<'_> {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            SwitchOn::NoTarget { what } => write!(f, "NoTarget({what})"),
            SwitchOn::FnDisable { labels } => write!(f, "FnDisable({labels:?})"),
            SwitchOn::FiredTerm => write!(f, "FiredTerm"),
            SwitchOn::VifId(e) => write!(f, "VifId({:?})", e.kind()),
            SwitchOn::RandCase(_) => write!(f, "RandCase"),
            SwitchOn::ObjClass { ids, .. } => write!(f, "ObjClass({ids:?})"),
        }
    }
}

impl<'d> SwitchOn<'d> {
    /// Every expression the selection reads.
    pub fn reads(&self) -> Vec<Expression<'d>> {
        match self {
            SwitchOn::FiredTerm | SwitchOn::NoTarget { .. } | SwitchOn::FnDisable { .. } => {
                Vec::new()
            }
            SwitchOn::VifId(e) => vec![*e],
            SwitchOn::RandCase(s) => s.randcase_items().iter().map(|i| i.expr()).collect(),
            SwitchOn::ObjClass { receiver, .. } => receiver.iter().copied().collect(),
        }
    }
}

/// One enclosing `foreach` dimension on the way to a nested collection
/// ([`RepeatCount::NestedSize`]): its index variable and, for a fixed-size
/// dimension, its `(left, right)` bounds (`None`: a queue / dynamic array
/// dimension, indexed from 0).
#[derive(Debug, Clone, Copy)]
pub struct NestStep<'d> {
    pub var: Symbol<'d>,
    pub fixed: Option<(i32, i32)>,
    /// The dimension is an associative array: `var` holds a key, not a
    /// position.
    pub assoc: bool,
}

/// A counted loop's iteration count: a `repeat (N)` loop's count
/// expression, a `foreach` loop's static element count, or the number of
/// elements a queue or dynamic array has when its `foreach` starts.
#[derive(Debug, Clone)]
pub enum RepeatCount<'d> {
    Expr(Expression<'d>),
    Const(u64),
    /// The size of this queue / dynamic array expression.
    Size(Expression<'d>),
    /// The size of the queue / dynamic array reached from `arr` by the
    /// enclosing `foreach` indices `path` (`a[i][j]` of `foreach (a[i, j,
    /// k])` over `int a[2][3][]`), read when the loop is entered.
    NestedSize {
        arr: Expression<'d>,
        path: Vec<NestStep<'d>>,
    },
    /// A count the forking process already evaluated: the counter slot is
    /// copied in at the spawn ([`InheritedSlot::Counter`]), never
    /// initialized here. `0` is the count expression, which sizes the slot.
    Inherited(Expression<'d>),
}

impl<'d> RepeatCount<'d> {
    /// The expression the count is computed from, if the count is not a
    /// constant (for `Size`, the collection).
    pub fn expr(&self) -> Option<Expression<'d>> {
        match self {
            RepeatCount::Expr(e) | RepeatCount::Size(e) => Some(*e),
            RepeatCount::NestedSize { arr, .. } => Some(*arr),
            RepeatCount::Const(_) | RepeatCount::Inherited(_) => None,
        }
    }
}

/// A straight-line run of non-suspending statements ending in exactly one
/// [`Terminator`] (PR-008).
#[derive(Debug, Clone)]
pub struct BasicBlock<'d> {
    /// Inlined-task argument transfers, run before `stmts` (see
    /// [`ArgBinding`]).
    pub bindings: Vec<ArgBinding<'d>>,
    /// The `this` of the innermost class-method task inlined at this block
    /// (its body's blocks; its binding and continuation blocks belong to the
    /// caller): what an implicit-`this` member access or method call in the
    /// block resolves against when the process itself is not a method.
    pub this_var: Option<Symbol<'d>>,
    /// The `ref` formals of the tasks inlined at this block that name a
    /// static variable or net of their call (LRM 13.5.2), with that storage:
    /// the formal reads and writes the actual itself in this block, so one
    /// process may bind the same formal to different actuals per call.
    pub ref_aliases: Vec<(Symbol<'d>, Symbol<'d>)>,
    pub stmts: Vec<Statement<'d>>,
    /// VPI `cbStmt` probe points (IEEE 1800-2023 38.36.1): `(i, s)` means the
    /// statement `s` is about to execute and the probe runs just before
    /// `stmts[i]` (`i == stmts.len()` is after the last one, still before
    /// `step_exprs` and the terminator). Only statements this CFG decomposes
    /// (or keeps as a leaf, which codegen then does not probe again) appear
    /// here; codegen emits a probe for them only when a VPI library is loaded.
    pub probes: Vec<(usize, Statement<'d>)>,
    /// VPI `cbDisable` probe points (38.36.1): `(i, s)` means the `disable`
    /// statement `s`, which this CFG turned into a jump out of the named block
    /// it names (so it is not in `stmts`), has taken effect; the probe runs
    /// where `probes` at index `i` do, after them.
    pub disable_probes: Vec<(usize, Statement<'d>)>,
    /// VPI frame probe points (37.43) of the blocking tasks inlined into this
    /// CFG: they run where `probes` at the same index do, after them (and
    /// after any `disable_probes`).
    pub frame_probes: Vec<(usize, FrameProbe<'d>)>,
    /// Covergroup block events (LRM 19.3 `@@(begin t)` / `@@(end t)`) of the
    /// blocking tasks inlined into this CFG: `(i, task, is_end)` signals the
    /// begin (or end) of `task`'s activation where `probes` at index `i` run.
    /// Codegen emits only those whose task a covergroup names.
    pub block_events: Vec<(usize, Symbol<'d>, bool)>,
    /// `(i, subroutine)`: `stmts[i]` was written in the body of the inlined `subroutine`, whose
    /// time unit its delays (`q <= #d v`) are in (LRM 3.14.2.1). Absent for the process's own.
    pub stmt_scopes: Vec<(usize, Symbol<'d>)>,
    /// A `for` loop's per-iteration step expressions (e.g. `i++`), run after
    /// `stmts` and before `terminator` fires (Task 1, `walk_for_loop`).
    /// Empty for every block that is not a `for` loop's step block. A
    /// separate field, not folded into `stmts: Vec<Statement<'d>>`, because
    /// `Statement::for_loop_steps()` returns bare `Expression<'d>`s (`i++`
    /// is an expression in this grammar position, never a `Statement` --
    /// confirmed against the pinned `sv-lang`=0.1.9 binding, which has no
    /// expression-to-statement wrapper) and this crate never fabricates AST
    /// nodes. Every slot this task's `for` fixture writes through
    /// (`i` itself) is a `FrameSlotSource::DeclaredVar` permanent slot
    /// (`lower_to_segments`'s own doc comment), so omitting these from
    /// `liveness::compute_liveness`'s backward read/write walk does not
    /// under-approximate any frame-slot's live range -- codegen consumption
    /// of this field is future work, tracked in this task's deviations, not
    /// a silent drop (the expressions are still here, in the CFG, for
    /// whichever pass reads `step_exprs` next).
    pub step_exprs: Vec<Expression<'d>>,
    /// R-run Task 8: `Some((counter, count_expr))` iff this block is a
    /// suspend-containing `repeat(N)` loop's own entry block -- `count_expr`
    /// (`RepeatLoop::condition()`, per LRM the loop's iteration COUNT, not a
    /// boolean) is evaluated exactly ONCE, run after `stmts` and before
    /// `terminator` fires (mirrors [`Self::step_exprs`]'s own "run after
    /// stmts, before terminator" placement), its result (clamped to
    /// non-negative) becoming `counter`'s starting value. `None` for every
    /// other block, including a suspend-free `repeat` (which stays the
    /// pre-existing opaque leaf `stmt_shared::lower_repeat_loop` already
    /// handles -- see [`RepeatCounterId`]'s own doc comment).
    pub repeat_init: Option<(RepeatCounterId, RepeatCount<'d>)>,
    /// R-run Task 8: `Some(counter)` iff this block is a suspend-containing
    /// `repeat(N)` loop's body's own back-edge block -- decrements
    /// `counter` by exactly one, run after `stmts`/`step_exprs` and before
    /// `terminator` fires. `None` for every other block.
    pub repeat_decrement: Option<RepeatCounterId>,
    /// `true` iff this block is the one an `expect` statement's wait resumes
    /// into (LRM 1800-2023 §16.17): its first statement is that `expect` again,
    /// whose resume half (the pass/`else` action, selected by the outcome the
    /// process was woken with) codegen lowers there.
    pub expect_resume: bool,
    pub terminator: Terminator<'d>,
}

/// PR-004, PR-008: the CFG built by [`build_cfg`] -- one LLVM function per
/// process (Task S3c) will eventually `switch` on `resume_pc` with one case
/// per segment derived from `blocks` below.
#[derive(Debug, Clone)]
pub struct ProcessCfg<'d> {
    pub blocks: Vec<BasicBlock<'d>>,
    pub entry: BlockId,
    /// The process body's original root `Statement` (Task S3b deviation,
    /// not in Task S3a's original field list): `process::liveness::
    /// compute_liveness`'s declared-local discovery needs to walk the
    /// *pre-flattening* statement tree looking for `Block` statements'
    /// `block_symbol()` scopes -- `blocks`/`stmts` above only ever retain
    /// the leaf statements `CfgBuilder::walk_seq` flattened into each
    /// `BasicBlock`, which discards every intervening `begin`/`end` `Block`
    /// statement node (and, with it, that block's `StatementBlockSymbol` --
    /// the ONLY place `sv-lang`=0.1.9's pinned C API exposes a declared
    /// local's `Symbol`; there is no per-`VariableDeclaration`-statement
    /// symbol accessor at all, confirmed against the real binding). Keeping
    /// the untouched root here, alongside the flattened `blocks`, is the
    /// minimal way to make both queries possible without re-walking from
    /// the caller.
    pub body: Statement<'d>,
    /// The formals and locals of every task inlined into this CFG
    /// ([`ArgBinding`]) -- declared locals of the process for frame-layout
    /// purposes, though no `Block` under `body` declares them.
    pub inlined_locals: Vec<Symbol<'d>>,
    /// The target of each intra-assignment-timed assignment's captured
    /// right-hand side ([`ArgBinding::Capture`]), indexed by `temp`: its
    /// type sizes the temporary's frame slot.
    pub captures: Vec<Expression<'d>>,
    /// For a fork branch: the variables of the forking activation it uses
    /// (LRM 1800-2023 §9.3.2, §6.21) -- shared with it, not copied: their
    /// frame slots, here and in the parent, hold a pointer to one cell.
    pub captured: Vec<Symbol<'d>>,
    /// `(formal, actual)`: a `ref` formal of an inlined task that every call
    /// in this process binds to the same static variable or net (LRM
    /// 1800-2023 §13.5.2). The formal names the actual's storage -- it has no
    /// frame slot and no copy-in/copy-out -- so a wait on it (`@(posedge
    /// clk)` with `ref logic clk`) sees the actual change.
    pub ref_bindings: Vec<(Symbol<'d>, Symbol<'d>)>,
    /// The name(s) a `disable <label>;` ANYWHERE (this process, a sibling
    /// branch, an ancestor fork, or a genuinely different process) may
    /// single this CFG's own live process out by (LRM 9.6.2): the
    /// enclosing `fork : NAME`'s name, if this CFG is one of its branches,
    /// and/or this CFG's own named outermost block (`peer_block(body)`),
    /// if it has one. Empty when nothing could ever name this process this
    /// way. `sv-sim-codegen::process_lower`'s fork/join lowering copies this
    /// into each branch's own [`super::super::sched::SpawnSpec::
    /// disable_name`].
    pub disable_names: Vec<String>,
    /// Every name [`Self::disable_names`] of a fork branch this CFG's own
    /// walk resolved a `disable <label>;` against WITHOUT a same-process
    /// lexical match (not an enclosing [`BasicBlock`], not this CFG's own
    /// `fork_name`, not a procedural-assertion label): the kept `disable`
    /// statement's codegen (`sv-sim-codegen::process_lower`) reads this to
    /// tell such a statement apart from the ones that resolve to the OLDER,
    /// same-fork-only `sv_rt_disable_fork_block` path -- see
    /// [`CfgBuilder::fork_branch_names`]'s own doc comment for how it
    /// accumulates (parent-to-branch, branch-to-branch, and forward past
    /// the fork statement that spawned them).
    pub fork_branch_names: Vec<String>,
    /// `(resume, label, exit)`: while the process is suspended and will resume
    /// at block `resume`, it is inside the named block or task activation
    /// `label`, which a `disable label;` of another process ends by resuming
    /// the process at block `exit` instead (LRM 9.6.2). Only labels some
    /// `disable` of the design names ([`is_disabled_somewhere`]) are listed.
    /// A segment index is a valid resume point of the compiled kernel.
    pub disable_scopes: Vec<(BlockId, String, BlockId)>,
    /// The labels of the `disable` statements this CFG keeps as statements
    /// because they must also reach the processes other than this one that
    /// are inside the named block or task (`sv_rt_disable_named`), with
    /// whether the statement is the whole effect of the disable (an
    /// unresolved target: no jump follows, so codegen emits the VPI
    /// `cbDisable` probe itself).
    pub disable_broadcast: Vec<(String, bool)>,
    /// For a synthetic fork branch ([`CfgBuilder::walk_nba_event`]): the
    /// frame slots of the forking process copied BY VALUE into this
    /// branch's own at the spawn (LRM 1800-2023 §10.4.2: the right-hand
    /// side and the repeat count are evaluated when the assignment is
    /// reached, not when its event fires).
    pub inherited: Vec<InheritedSlot>,
    /// Per capture temporary (`captures`), the formal whose type sizes its
    /// frame slot instead of the captured expression's (a recursive task's
    /// call arguments, [`CfgBuilder::inline_recursive_task`]); entries past
    /// the end are `None`.
    pub capture_types: Vec<Option<Symbol<'d>>>,
    /// Whether this CFG is a recursive task's activation ([`Recursion`]).
    pub recursion: Recursion,
    /// Two fork branches carrying the same id were built from the same
    /// statement in the same inherited context ([`ForkBranchKey`]), so
    /// they are the same CFG and lower to the same kernel: the lowering
    /// compiles it once per process and points every spawn at that code
    /// (a UVM testbench otherwise cloned each branch once per path of
    /// nested forks leading to it, tens of GB of IR). `None` for a branch
    /// that is not shared.
    pub share_id: Option<u64>,
}

/// A fork branch's part in a recursive task with timing controls (LRM
/// 1800-2023 §13.4, §13.4.1): every call is a `join` of one forked child
/// running the task body in a frame of its own.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum Recursion {
    /// An ordinary CFG.
    None,
    /// The task's body: the branch the first call forks. Its kernel is
    /// compiled once and also serves every recursive call inside it.
    Root,
    /// A placeholder branch (no blocks of its own): a recursive call inside
    /// the enclosing [`Recursion::Root`], which spawns that root's kernel again.
    SelfSpawn,
    /// A placeholder branch: a call, inside one recursive activation, of the
    /// task of an enclosing activation (mutual recursion: `a` calls `b` calls
    /// `a`). It spawns that activation's kernel again; the number says how
    /// many [`Recursion::Root`] levels out it is (1 = the activation this one
    /// was forked from).
    AncestorSpawn(u32),
}

/// Whether the process re-triggers from `entry` after finishing one pass
/// through its body (`always`/`always_ff`/`always_comb`/`always_latch`) or
/// runs exactly once (`initial`/`final`) -- PR-048's `Terminator::End{
/// loop_back}` distinction. Deliberately **not**
/// `sv-sim-codegen::module::SliceProcKind`: this crate must never depend on
/// `sv-sim-codegen` (see [`LoweringError`]'s doc comment for the same
/// reasoning); a caller that already has a `SliceProcKind` (module
/// discovery, Task S2/S7) maps it down to this coarser 2-value distinction
/// itself (`Initial` -> `OneShot`, `Always`/`AlwaysFF` -> `Looping`).
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum ProcessLoopKind {
    OneShot,
    Looping,
}

/// PR-007: the single recursive-descent CFG builder entry point.
pub fn build_cfg<'d>(
    body: &Statement<'d>,
    loop_kind: ProcessLoopKind,
) -> Result<ProcessCfg<'d>, LoweringError> {
    build_cfg_in(
        body,
        loop_kind,
        None,
        None,
        None,
        None,
        Inherited::default(),
        None,
    )
}

/// The CFG of a one-shot process that runs the body of `task` once, for a
/// task exported to C (`export "DPI-C" task`, LRM 1800-2023 35.7) whose body
/// consumes time (or stages a nonblocking assignment): C cannot run it as a
/// function, so each call from C spawns a process of this CFG and the
/// importing task blocks until it finishes (35.5.3).
///
/// The formals are ordinary locals of the process's frame, with NO entry
/// binding: the spawner stores the C arguments into their frame slots before
/// the process starts and reads the `output`/`inout` ones back when it ends
/// (the process's frame is what a copy-in/copy-out call has in a caller).
/// Other automatic locals get their declaration initialisers as usual.
/// `static` formals are module state, not frame slots; they stay out of
/// `inlined_locals`, exactly as a call inlined into a process treats them.
///
/// Fails by name for a task that calls itself (a recursive activation needs
/// the fork-per-call machinery of [`Recursion::Root`], whose argument
/// capture an export cannot supply).
pub fn build_export_task_cfg<'d>(
    task: &Symbol<'d>,
    global_clock: Option<InferredClockEvent<'d>>,
) -> Result<ProcessCfg<'d>, LoweringError> {
    let body = proc_body(task).ok_or_else(|| {
        LoweringError::malformed(format!("exported task `{}` has no body", task.name()))
    })?;
    let mut b = CfgBuilder::new();
    b.global_clock = global_clock;
    let entry = b.alloc_block();
    // Calling itself from its own body would inline without end; the
    // recursion machinery needs a caller's actuals to type its captures.
    b.rec_outer.push(task.uid());
    for f in task.subroutine_arguments() {
        if !crate::netlist::is_static_procedural_var(&f) {
            b.inlined_locals.push(f);
        }
    }
    for local in task_locals(task) {
        if crate::netlist::is_static_procedural_var(&local) {
            continue;
        }
        if !is_automatic_block_var(&local) {
            b.blocks[entry.0 as usize]
                .bindings
                .push(ArgBinding::Init { var: local });
        }
        b.inlined_locals.push(local);
    }
    for v in crate::patterns::pattern_vars(body.as_sem_node()) {
        if !b.inlined_locals.iter().any(|l| l.uid() == v.uid()) {
            b.inlined_locals.push(v);
        }
    }
    let after = b.alloc_block();
    b.target_depth.insert(after, 0);
    b.return_targets.push(after);
    let exit = b.walk_stmt(body, entry)?;
    b.close(exit, Terminator::Fallthrough(after));
    b.close(after, Terminator::End { loop_back: None });
    let inlined_locals = std::mem::take(&mut b.inlined_locals);
    let captures = std::mem::take(&mut b.captures);
    let capture_types = std::mem::take(&mut b.capture_types);
    let ref_bindings = b.take_ref_bindings();
    let disable_scopes = b.take_disable_scopes();
    let disable_broadcast = std::mem::take(&mut b.disable_broadcast);
    let fork_branch_names = std::mem::take(&mut b.fork_branch_names);
    Ok(ProcessCfg {
        blocks: b.finish(),
        entry,
        body,
        inlined_locals,
        captures,
        captured: Vec::new(),
        ref_bindings,
        disable_names: Vec::new(),
        fork_branch_names,
        disable_scopes,
        disable_broadcast,
        inherited: Vec::new(),
        capture_types,
        recursion: Recursion::None,
        share_id: None,
    })
}

/// The one-shot process a task called from a sequence match item runs as
/// (LRM 1800-2023 16.11: "the subroutine call is scheduled in the Reactive
/// region ... as a thread of its own"). Its body is the call `call` (a user
/// task that can suspend, [`subroutine_can_suspend`]) inlined the way a call
/// statement of an ordinary process is: the formals are bound from the actual
/// expressions by [`ArgBinding::In`] in the entry block, so the process reads
/// its by-value actuals when it starts (the assertion kernel lowers each as the
/// value the engine sampled at the end point, `sva::proc::call_arg_key`) and
/// every call is its own activation with its own frame.
///
/// Fails by name for a task that calls itself (a recursive activation needs the
/// fork-per-call machinery of [`Recursion::Root`], whose argument capture a
/// spawned call cannot supply).
pub fn build_match_item_task_cfg<'d>(
    call: Expression<'d>,
) -> Result<ProcessCfg<'d>, LoweringError> {
    let task = call.call_subroutine().ok_or_else(|| {
        LoweringError::malformed("a match-item call of a task has no subroutine symbol")
    })?;
    let body = proc_body(&task)
        .ok_or_else(|| LoweringError::malformed(format!("task `{}` has no body", task.name())))?;
    let mut b = CfgBuilder::new();
    let entry = b.alloc_block();
    let exit = b.inline_task_call(call, task, entry)?;
    b.close(exit, Terminator::End { loop_back: None });
    let inlined_locals = std::mem::take(&mut b.inlined_locals);
    let captures = std::mem::take(&mut b.captures);
    let capture_types = std::mem::take(&mut b.capture_types);
    let ref_bindings = b.take_ref_bindings();
    let disable_scopes = b.take_disable_scopes();
    let disable_broadcast = std::mem::take(&mut b.disable_broadcast);
    let fork_branch_names = std::mem::take(&mut b.fork_branch_names);
    Ok(ProcessCfg {
        blocks: b.finish(),
        entry,
        body,
        inlined_locals,
        captures,
        captured: Vec::new(),
        ref_bindings,
        disable_names: Vec::new(),
        fork_branch_names,
        disable_scopes,
        disable_broadcast,
        inherited: Vec::new(),
        capture_types,
        recursion: Recursion::None,
        share_id: None,
    })
}

/// The clocking event a checker's `$inferred_clock` (LRM 17.4) stands for: the
/// signal and edge of the default clocking of the scope that instantiates the
/// checker (14.12), which a checker procedure's `@clock` waits on when `clock`
/// kept its default. The third member is the event's `iff` condition
/// (`default clocking @(posedge clk iff en);`, 9.4.2.3), which gates every wait
/// on it; `None` for `@$global_clock`.
pub type InferredClockEvent<'d> = (Expression<'d>, EdgeKind, Option<Expression<'d>>);

/// Whether `signal` (the expression of a signal event control) is a call of
/// `$global_clock` (14.14).
pub fn is_global_clock_call(signal: &Expression<'_>) -> bool {
    signal.kind() == ExpressionKind::Call
        && signal.is_system_call() == Some(true)
        && signal
            .system_subroutine()
            .is_some_and(|s| s.known_name_id() == sv_lang::KnownSystemName::GlobalClock)
}

/// Whether `signal` (the expression of a signal event control) is a call of
/// `$inferred_clock`: a checker's `event clock = $inferred_clock` formal, used as
/// `@clock` by a procedure of an instance that did not bind it (17.4).
pub fn is_inferred_clock_call(signal: &Expression<'_>) -> bool {
    signal.kind() == ExpressionKind::Call
        && signal.is_system_call() == Some(true)
        && signal
            .system_subroutine()
            .is_some_and(|s| s.known_name_id() == sv_lang::KnownSystemName::InferredClock)
}

/// The clocking block of a drive target rooted in a clock variable
/// (`cb.q`, `cb.q[3:0]`; LRM 1800-2023 14.16), else `None`.
fn drive_clocking_of<'d>(mut target: Expression<'d>) -> Option<Symbol<'d>> {
    while matches!(
        target.kind(),
        ExpressionKind::ElementSelect | ExpressionKind::RangeSelect
    ) {
        target = target.select_value()?;
    }
    let var = target.referenced_symbol()?;
    if var.kind() != SymbolKind::ClockVar {
        return None;
    }
    var.parent()
        .filter(|p| p.kind() == SymbolKind::ClockingBlock)
}

/// The clock variable of a drive target rooted in a virtual interface member
/// access (`v.sb.c`, `v.sb.c[3:0]`), else `None`.
fn drive_via_of<'d>(mut target: Expression<'d>) -> Option<Expression<'d>> {
    while matches!(
        target.kind(),
        ExpressionKind::ElementSelect | ExpressionKind::RangeSelect
    ) {
        target = target.select_value()?;
    }
    (crate::netlist::vif::is_member_access(&target)).then_some(target)
}

/// [`build_cfg`] for a process of an instance whose default clocking block
/// is `default_clocking` (what `##N` counts).
pub fn build_cfg_clocked<'d>(
    body: &Statement<'d>,
    loop_kind: ProcessLoopKind,
    default_clocking: Option<Symbol<'d>>,
) -> Result<ProcessCfg<'d>, LoweringError> {
    build_cfg_scoped(body, loop_kind, default_clocking, &[], None)
}

/// [`build_cfg_clocked`] for a process that shares its instance with the
/// processes whose outermost named blocks are `peers`: a `disable` of one of
/// them is accepted when it cannot be inside the block (see [`PeerBlock`]).
/// `inferred_clock` is the event a checker procedure's `@clock` waits on when its
/// `clock` formal kept the default `$inferred_clock` (17.4); `None` for a process
/// that is not a checker's or whose instantiation context infers no clock.
pub fn build_cfg_scoped<'d>(
    body: &Statement<'d>,
    loop_kind: ProcessLoopKind,
    default_clocking: Option<Symbol<'d>>,
    peers: &[PeerBlock],
    inferred_clock: Option<InferredClockEvent<'d>>,
) -> Result<ProcessCfg<'d>, LoweringError> {
    build_cfg_in(
        body,
        loop_kind,
        None,
        default_clocking,
        Some(peers),
        inferred_clock,
        Inherited::default(),
        None,
    )
}

/// [`build_cfg_scoped`] that can dispatch a virtual class task that suspends
/// over the class templates of `virtual_tasks`.
pub fn build_cfg_scoped_with_virtuals<'d>(
    body: &Statement<'d>,
    loop_kind: ProcessLoopKind,
    default_clocking: Option<Symbol<'d>>,
    peers: &[PeerBlock],
    inferred_clock: Option<InferredClockEvent<'d>>,
    global_clock: Option<InferredClockEvent<'d>>,
    virtual_tasks: Option<std::rc::Rc<VirtualTasks<'d>>>,
) -> Result<ProcessCfg<'d>, LoweringError> {
    build_cfg_in(
        body,
        loop_kind,
        None,
        default_clocking,
        Some(peers),
        inferred_clock,
        Inherited {
            global_clock,
            ..Inherited::default()
        },
        virtual_tasks,
    )
}

/// The outermost named block of another process of the instance, which a
/// `disable` may target (LRM 9.6.2, 16.14.6.4).
#[derive(Clone, Debug, PartialEq, Eq)]
pub struct PeerBlock {
    pub name: String,
    /// The block contains a suspend point, so its process may be inside it. A
    /// `disable` then has to terminate the process's activity (9.6.2), which
    /// the scheduler cannot do; when the block cannot suspend, the process is
    /// never inside it while another runs, and the disable's only effect is the
    /// flush of the process's pending procedural assertion queue.
    pub can_suspend: bool,
    /// The block is the outermost block of a fork branch (its own process,
    /// tagged by name): any number of those may share a name, and `disable
    /// <name>;` ends every one (LRM 9.6.2).
    pub fork_branch: bool,
}

/// The outermost scope of a process body (LRM 16.14.6.2): the block statement
/// the body is, looking through the leading timing controls of an `always`
/// (`always @(a or b) begin : b2 ... end`). `None` when the body is not a block.
pub fn outermost_block<'d>(body: &Statement<'d>) -> Option<Statement<'d>> {
    let mut cur = *body;
    loop {
        // Not a `match` over the kind: every other statement kind means "the body
        // is not a block", which is an answer, not an unimplemented case.
        let kind = cur.kind();
        if kind == StatementKind::Block {
            return Some(cur);
        }
        if kind == StatementKind::Timed {
            cur = cur.body()?;
        } else if kind == StatementKind::List {
            let list = live_statements(&cur);
            let [only] = list.as_slice() else {
                return None;
            };
            cur = *only;
        } else {
            return None;
        }
    }
}

/// The named outermost block of the process body `body`, as another process
/// sees it ([`PeerBlock`]); `None` for an unnamed one.
pub fn peer_block<'d>(body: &Statement<'d>) -> Option<PeerBlock> {
    let block = outermost_block(body)?;
    let name = block_name(&block);
    if name.is_empty() {
        return None;
    }
    Some(PeerBlock {
        name,
        can_suspend: contains_suspend_trigger_in(
            block.as_sem_node(),
            &mut std::collections::HashSet::new(),
            true,
            false,
        ),
        fork_branch: false,
    })
}

/// The hierarchical path of every named block (sequential or fork) in the
/// process body `body`, dotted from its outermost named block down
/// (`a`, `a.b`, `a.b.c`, `a.f.br1`): what a `disable s.a.b.c.inner;` from
/// another instance names, however deep (LRM 9.6.2, 23.6).
pub fn named_block_paths(body: &Statement<'_>) -> Vec<String> {
    let mut out = Vec::new();
    let mut stack: Vec<(SemNode<'_>, String)> = vec![(body.as_sem_node(), String::new())];
    while let Some((n, prefix)) = stack.pop() {
        let mut here = prefix.clone();
        if let Some(s) = n.as_statement()
            && s.kind() == StatementKind::Block
        {
            let name = block_name(&s);
            if !name.is_empty() {
                here = if prefix.is_empty() {
                    name
                } else {
                    format!("{prefix}.{name}")
                };
                out.push(here.clone());
            }
        }
        stack.extend(live_children(&n).into_iter().map(|c| (c, here.clone())));
    }
    out
}

/// The named sequential blocks nested in the process body `body` below its
/// outermost scope, as another process sees them ([`PeerBlock`]): a `disable`
/// of one of them from another process ends the activity inside it (LRM
/// 9.6.2). A fork's branches are processes of their own and are not entered.
pub fn nested_peer_blocks<'d>(body: &Statement<'d>) -> Vec<PeerBlock> {
    let outermost = outermost_block(body).map(|b| b.source_range().start.offset);
    let mut out = Vec::new();
    let mut stack = vec![body.as_sem_node()];
    while let Some(n) = stack.pop() {
        if let Some(s) = n.as_statement()
            && s.kind() == StatementKind::Block
        {
            match s.block_kind() {
                Some(StatementBlockKind::Sequential) => {
                    let name = block_name(&s);
                    if !name.is_empty() && outermost != Some(s.source_range().start.offset) {
                        out.push(PeerBlock {
                            name,
                            can_suspend: contains_suspend_trigger_in(
                                n,
                                &mut std::collections::HashSet::new(),
                                true,
                                false,
                            ),
                            fork_branch: false,
                        });
                    }
                }
                Some(
                    StatementBlockKind::JoinAll
                    | StatementBlockKind::JoinAny
                    | StatementBlockKind::JoinNone,
                ) => {
                    fork_branch_peers(n, &mut out);
                    continue;
                }
                None => {}
            }
        }
        stack.extend(live_children(&n));
    }
    out
}

/// The named outermost blocks of the branches of the fork `fork` and of every
/// fork nested in those branches: each branch is a process of its own tagged
/// with its block's name ([`ProcessCfg::disable_names`]), which `disable
/// <name>;` of another process ends (LRM 9.6.2). A branch's process may be
/// anywhere, so these always `can_suspend`. Named blocks nested deeper in a
/// branch are listed as ordinary nested peers.
fn fork_branch_peers(fork: SemNode<'_>, out: &mut Vec<PeerBlock>) {
    let mut branches = fork.children();
    if let [only] = branches.as_slice()
        && only
            .as_statement()
            .is_some_and(|s| s.kind() == StatementKind::List)
    {
        branches = only.children();
    }
    for b in branches {
        let Some(s) = b.as_statement() else { continue };
        if let Some(mut p) = peer_block(&s) {
            p.can_suspend = true;
            p.fork_branch = true;
            out.push(p);
        }
        // Blocks nested in the branch (and in forks nested in it) are blocks
        // of the branch's process: its kernel carries their disable scopes
        // (`ProcessCfg::disable_scopes`, `ForkKernel::disable_scopes`).
        out.extend(nested_peer_blocks(&s));
    }
}

impl ProcessCfg<'_> {
    /// The labels of the disable scopes of every fork branch under this CFG
    /// (nested forks included): the blocks of the branch kernels a
    /// `disable` of another process can end (LRM 9.6.2).
    pub fn branch_disable_labels(&self) -> Vec<String> {
        let mut out = Vec::new();
        for b in &self.blocks {
            if let Terminator::ForkJoin { branches, .. } = &b.terminator {
                for br in branches {
                    out.extend(br.disable_scopes.iter().map(|(_, l, _)| l.clone()));
                    out.extend(br.branch_disable_labels());
                }
            }
        }
        out
    }

    /// The `disable` broadcast targets of every fork branch under this CFG
    /// (nested forks included), as [`ProcessCfg::disable_broadcast`]: a
    /// `disable u1.blk;` inside a branch must resolve as one in the process
    /// itself does, or be refused (LRM 9.6.2).
    pub fn branch_disable_broadcast(&self) -> Vec<(String, bool)> {
        let mut out = Vec::new();
        for b in &self.blocks {
            if let Terminator::ForkJoin { branches, .. } = &b.terminator {
                for br in branches {
                    out.extend(br.disable_broadcast.iter().cloned());
                    out.extend(br.branch_disable_broadcast());
                }
            }
        }
        out
    }
}

/// The label of every procedural concurrent assertion (not an `expect`, which
/// blocks) in the subtree of `body`, with the assertion statement: a labeled
/// statement is a block of that name holding it, which `disable <label>;`
/// names (16.14.6.4).
pub fn assertion_labels<'d>(body: &Statement<'d>) -> Vec<(String, Statement<'d>)> {
    let mut out = Vec::new();
    let mut stack = vec![body.as_sem_node()];
    while let Some(n) = stack.pop() {
        if let Some(s) = n.as_statement()
            && s.kind() == StatementKind::Block
            && let name = block_name(&s)
            && !name.is_empty()
            && let [only] = s.statements().as_slice()
            && only.kind() == StatementKind::ConcurrentAssertion
            && !is_expect(only)
        {
            out.push((name, *only));
        }
        stack.extend(live_children(&n));
    }
    out
}

/// The label of every deferred immediate assertion (`L: assert #0 (c) ...;`,
/// `assert final`) in the subtree of `body`, with the assertion statement: a
/// labeled statement is a block of that name holding it, which `disable L;`
/// names (LRM 16.4.4: cancels that assertion's pending reports).
pub fn deferred_assertion_labels<'d>(body: &Statement<'d>) -> Vec<(String, Statement<'d>)> {
    let mut out = Vec::new();
    let mut stack = vec![body.as_sem_node()];
    while let Some(n) = stack.pop() {
        if let Some(s) = n.as_statement()
            && s.kind() == StatementKind::Block
            && let name = block_name(&s)
            && !name.is_empty()
            && let [only] = s.statements().as_slice()
            && only.kind() == StatementKind::ImmediateAssertion
            && only.is_deferred_assertion() == Some(true)
        {
            out.push((name, *only));
        }
        stack.extend(live_children(&n));
    }
    out
}

/// The label of every plain (non-deferred) immediate assertion in the subtree
/// of `body`: a labeled statement is a block of that name holding it. A
/// `disable L;` outside that block (LRM 9.6.2) finds the block already
/// finished -- an immediate assertion's own block has no suspend point the
/// disable could catch from the same process.
pub fn immediate_assertion_labels(body: &Statement<'_>) -> Vec<String> {
    let mut out = Vec::new();
    let mut stack = vec![body.as_sem_node()];
    while let Some(n) = stack.pop() {
        if let Some(s) = n.as_statement()
            && s.kind() == StatementKind::Block
            && let name = block_name(&s)
            && !name.is_empty()
            && let [only] = s.statements().as_slice()
            && only.kind() == StatementKind::ImmediateAssertion
            && only.is_deferred_assertion() != Some(true)
        {
            out.push(name);
        }
        stack.extend(live_children(&n));
    }
    out
}

/// Whether `stmt` is a labeled immediate assertion (`L: assert (c) begin
/// ... disable L; ... end`, a block named `L` holding only the assertion)
/// whose only `disable` targets `L` itself and which contains no other
/// suspend point. Disabling the label ends the assertion statement (LRM
/// 9.6.2: a labeled statement is a named scope), so the whole block is one
/// straight-line leaf for the CFG and codegen leaves it through an exit
/// block (`process_lower`'s `List | Block` arm).
pub fn self_disabling_assertion_block(stmt: &Statement<'_>) -> bool {
    if stmt.kind() != StatementKind::Block {
        return false;
    }
    let name = block_name(stmt);
    if name.is_empty() {
        return false;
    }
    let children = stmt.statements();
    let [only] = children.as_slice() else {
        return false;
    };
    if only.kind() != StatementKind::ImmediateAssertion {
        return false;
    }
    let mut disables = 0usize;
    let mut stack = vec![only.as_sem_node()];
    while let Some(n) = stack.pop() {
        if let Some(s) = n.as_statement()
            && s.kind() == StatementKind::Disable
        {
            match disable_label(&s) {
                Ok(l) if l == name => disables += 1,
                _ => return false,
            }
        }
        stack.extend(live_children(&n));
    }
    disables > 0
        && !contains_suspend_trigger_in(
            only.as_sem_node(),
            &mut std::collections::HashSet::new(),
            true,
            false,
        )
}

/// The CFG of the plan that hosts the `expect` statement `stmt` for the
/// assertion engine (LRM 1800-2023 §16.17): `stmt` is an ordinary leaf of it,
/// not a wait -- the process that blocks on the `expect` is another plan, built
/// by [`build_cfg_clocked`].
pub fn build_cfg_hosted_assertion<'d>(
    stmt: &Statement<'d>,
    default_clocking: Option<Symbol<'d>>,
) -> Result<ProcessCfg<'d>, LoweringError> {
    let mut builder = CfgBuilder::new();
    builder.default_clocking = default_clocking;
    builder.expect_as_leaf = true;
    let entry = builder.alloc_block();
    let exit = builder.walk_stmt(*stmt, entry)?;
    builder.close(exit, Terminator::End { loop_back: None });
    Ok(ProcessCfg {
        blocks: builder.finish(),
        entry,
        body: *stmt,
        inlined_locals: Vec::new(),
        captures: Vec::new(),
        captured: Vec::new(),
        ref_bindings: Vec::new(),
        disable_names: Vec::new(),
        fork_branch_names: Vec::new(),
        disable_scopes: Vec::new(),
        disable_broadcast: Vec::new(),
        inherited: Vec::new(),
        capture_types: Vec::new(),
        recursion: Recursion::None,
        share_id: None,
    })
}

/// Whether a call was written `super.m(...)` (LRM 8.15: not virtual).
pub type SuperDetector = fn(Expression<'_>) -> bool;

thread_local! {
    /// The [`SuperDetector`]: recovering `super.` needs the design's syntax,
    /// which codegen holds (`sv_sim_codegen::classes::call_is_explicit_super`);
    /// the run installs it.
    static EXPLICIT_SUPER: std::cell::Cell<Option<SuperDetector>> =
        const { std::cell::Cell::new(None) };
}

/// Installs (or, with `None`, removes) the `super.`-call detector
/// [`CfgBuilder::inline_task_call`] uses for virtual class tasks.
pub fn set_explicit_super_detector(f: Option<SuperDetector>) {
    EXPLICIT_SUPER.with(|c| c.set(f));
}

fn is_explicit_super(call: Expression<'_>) -> bool {
    EXPLICIT_SUPER.with(|c| c.get().is_some_and(|f| f(call)))
}

/// The design's class templates a dynamic type can be (every `new()`-reachable
/// class and its ancestors, with their dense template ids), for dispatching a
/// virtual class task that can suspend: such a task is inlined, so a call
/// through a base handle becomes a switch over the overrides the possible
/// dynamic classes resolve it to.
pub struct VirtualTasks<'d> {
    pub classes: Vec<(u32, sv_lang::Type<'d>)>,
    /// Per entry of `classes`, its base chain (root first, itself last) and
    /// the chain's symbol keys, filled on first use: `implementations` runs
    /// once per virtual method per fixed-point round, and rebuilding the
    /// chain and every ancestor's hierarchical path each time dominated the
    /// compile of a deep class library (`import uvm_pkg::*`).
    chains: std::cell::OnceCell<Vec<ClassChain<'d>>>,
    /// Per task, whether its body reaches itself ([`task_reaches`] with the
    /// task as target): decided once per task, not per call site, because
    /// each query walks every task reachable through virtual dispatch (a
    /// UVM testbench compiled for over an hour re-walking `uvm_pkg`).
    self_reach: std::cell::RefCell<std::collections::HashMap<crate::symid::SymbolId, bool>>,
}

/// One class's base chain and the keys of its members ([`VirtualTasks`]).
struct ClassChain<'d> {
    chain: Vec<sv_lang::Type<'d>>,
    keys: std::collections::HashSet<crate::symid::SymbolId>,
}

thread_local! {
    /// Every virtual method one of whose implementations (in the classes a
    /// dynamic type can be) can suspend ([`set_suspending_virtuals`]).
    static SUSPENDING_VIRTUALS: std::cell::RefCell<std::collections::HashSet<crate::symid::SymbolId>> =
        std::cell::RefCell::new(std::collections::HashSet::new());
}

fn is_suspending_virtual(sub: &Symbol<'_>) -> bool {
    SUSPENDING_VIRTUALS.with(|s| s.borrow().contains(&sub.uid()))
}

/// Records which virtual methods can suspend through an override (LRM 8.20:
/// a call runs the dynamic class's implementation, so it suspends when any
/// implementation can): such a call is inlined as a dispatch over the
/// overrides. To a fixed point, since an implementation may suspend only
/// through another virtual call. Clears the previous design's record.
pub fn set_suspending_virtuals(vt: &VirtualTasks<'_>) {
    SUSPENDING_VIRTUALS.with(|s| s.borrow_mut().clear());
    let mut methods: Vec<(crate::symid::SymbolId, Symbol<'_>)> = Vec::new();
    for (_, ty) in &vt.classes {
        for m in ty.as_symbol().members() {
            let m = if m.kind() == SymbolKind::MethodPrototype {
                match m.method_prototype_subroutine() {
                    Some(real) => real,
                    None => continue,
                }
            } else {
                m
            };
            if m.kind() == SymbolKind::Subroutine
                && (m.subroutine_this_var().is_some()
                    || m.subroutine_flags().contains(sv_lang::MethodFlags::PURE))
                && (m.subroutine_flags().contains(sv_lang::MethodFlags::VIRTUAL)
                    || m.subroutine_override().is_some())
                && !methods.iter().any(|(_, x)| *x == m)
            {
                methods.push((m.uid(), m));
            }
        }
    }
    loop {
        let mut changed = false;
        for (uid, m) in &methods {
            if SUSPENDING_VIRTUALS.with(|s| s.borrow().contains(uid)) {
                continue;
            }
            if vt
                .implementations(m)
                .iter()
                .any(|(_, imp)| subroutine_can_suspend(imp))
            {
                SUSPENDING_VIRTUALS.with(|s| s.borrow_mut().insert(uid.clone()));
                changed = true;
            }
        }
        if !changed {
            break;
        }
    }
}

impl<'d> VirtualTasks<'d> {
    /// The possible dynamic classes (template id, class type).
    pub fn new(classes: Vec<(u32, sv_lang::Type<'d>)>) -> Self {
        VirtualTasks {
            classes,
            chains: std::cell::OnceCell::new(),
            self_reach: std::cell::RefCell::new(std::collections::HashMap::new()),
        }
    }

    /// The implementations of `method` the dynamic classes derived from (or
    /// equal to) its declaring class run, each with the template ids that
    /// run it: per class, the most-derived declaration of the name with a
    /// body.
    pub fn implementations(&self, method: &Symbol<'d>) -> Vec<(Vec<u32>, Symbol<'d>)> {
        let Some(decl) = method.parent() else {
            return Vec::new();
        };
        let name = method.name();
        let decl_key = decl.uid();
        let chains = self.chains.get_or_init(|| {
            self.classes
                .iter()
                .map(|(_, ty)| {
                    let mut chain = crate::netlist::base_chain(*ty);
                    chain.push(*ty);
                    let keys = chain.iter().map(|c| c.as_symbol().uid()).collect();
                    ClassChain { chain, keys }
                })
                .collect()
        });
        let mut out: Vec<(Vec<u32>, Symbol<'d>)> = Vec::new();
        for ((id, _), cc) in self.classes.iter().zip(chains) {
            if !cc.keys.contains(&decl_key) {
                continue;
            }
            let found = cc.chain.iter().rev().find_map(|c| {
                let s = c.as_symbol().find(name)?;
                let s = if s.kind() == SymbolKind::MethodPrototype {
                    s.method_prototype_subroutine()?
                } else {
                    s
                };
                (s.kind() == SymbolKind::Subroutine
                    && s.body().is_some()
                    && !s.subroutine_flags().contains(sv_lang::MethodFlags::PURE))
                .then_some(s)
            });
            let Some(imp) = found else { continue };
            match out.iter_mut().find(|(_, s)| *s == imp) {
                Some((ids, _)) => ids.push(*id),
                None => out.push((vec![*id], imp)),
            }
        }
        out
    }
}

/// [`build_cfg`] for one branch of the fork block named `fork_name`, if
/// named: a `disable` of that name inside the branch ends the fork.
#[allow(clippy::too_many_arguments)]
fn build_cfg_in<'d>(
    body: &Statement<'d>,
    loop_kind: ProcessLoopKind,
    fork_name: Option<String>,
    default_clocking: Option<Symbol<'d>>,
    peers: Option<&[PeerBlock]>,
    checker_clock: Option<InferredClockEvent<'d>>,
    inherited: Inherited<'d>,
    virtual_tasks: Option<std::rc::Rc<VirtualTasks<'d>>>,
) -> Result<ProcessCfg<'d>, LoweringError> {
    // LRM 9.6.2: the name(s) a `disable` ANYWHERE may single this CFG's own
    // process out by -- computed before `fork_name` moves into `builder`.
    let mut disable_names: Vec<String> = Vec::new();
    disable_names.extend(fork_name.clone());
    disable_names.extend(peer_block(body).map(|p| p.name));

    let mut builder = CfgBuilder::new();
    builder.this_stack.extend(inherited.this_var);
    builder.ref_stack = inherited.ref_aliases;
    builder.global_clock = inherited.global_clock;
    builder.detached_trigger = inherited.detached_trigger;
    builder.forced_extern = inherited.forced_extern;
    builder.rec_outer = inherited.rec_outer;
    if let Some(memo) = inherited.fork_memo {
        builder.fork_memo = memo;
    }
    if let Some(rec) = inherited.rec {
        // The same capture temporaries the activation reserves.
        for _ in 0..rec.groups {
            for &(a, f) in &rec.proto {
                builder.set_capture_type(a, f);
            }
        }
        builder.rec = Some(rec);
    }
    builder.rec_up = inherited.rec_up;
    builder.virtual_tasks = virtual_tasks;
    builder.fork_name = fork_name;
    builder.fork_branch_names = inherited.known_fork_labels;
    // LRM 9.6.2: a branch also answers to `disable` of any block enclosing
    // its fork (it is an activity enabled within that block), so a block that
    // ends with detached branches still running ends them. Only names some
    // `disable` of the design mentions are tagged.
    builder.disable_names_extra(&inherited.ancestor_blocks, &mut disable_names);
    builder.body_node = Some(body.as_sem_node());
    builder.ancestor_blocks = inherited.ancestor_blocks;
    builder.default_clocking = default_clocking;
    builder.checker_clock = checker_clock;
    if let Some(peers) = peers {
        // A fork branch is not the process's own scope: only a whole process
        // has an outermost scope, assertion labels and peers.
        builder.peers = peers.to_vec();
        builder.assertion_labels = assertion_labels(body)
            .into_iter()
            .map(|(name, _)| name)
            .collect();
        builder.deferred_labels = deferred_assertion_labels(body)
            .into_iter()
            .map(|(name, _)| name)
            .collect();
        builder.immediate_labels = immediate_assertion_labels(body);
        builder.outermost = peer_block(body).map(|p| p.name);
    }
    let entry = builder.alloc_block();
    let exit = builder.walk_stmt(*body, entry)?;
    let loop_back = match loop_kind {
        ProcessLoopKind::OneShot => None,
        ProcessLoopKind::Looping => Some(entry),
    };
    builder.close(exit, Terminator::End { loop_back });
    let ref_bindings = builder.take_ref_bindings();
    let inlined_locals = std::mem::take(&mut builder.inlined_locals);
    let captures = std::mem::take(&mut builder.captures);
    let capture_types = std::mem::take(&mut builder.capture_types);
    let fork_branch_names = std::mem::take(&mut builder.fork_branch_names);
    let disable_scopes = builder.take_disable_scopes();
    let disable_broadcast = std::mem::take(&mut builder.disable_broadcast);
    Ok(ProcessCfg {
        blocks: builder.finish(),
        entry,
        body: *body,
        inlined_locals,
        captures,
        captured: Vec::new(),
        ref_bindings,
        disable_names,
        fork_branch_names,
        disable_scopes,
        disable_broadcast,
        inherited: Vec::new(),
        capture_types,
        recursion: Recursion::None,
        share_id: None,
    })
}

/// The recursive task whose activation a builder is walking.
#[derive(Clone)]
struct RecursiveTask<'d> {
    task: crate::symid::SymbolId,
    /// The [`ProcessCfg::share_id`] of this activation's Root (unique per
    /// distinct [`RootKey`]); part of the key of every Root nested in it.
    share: u64,
    /// The first call's actuals and the formals they shape (the capture
    /// temporaries' types, [`CfgBuilder::set_capture_type`]), so a fork
    /// branch inside the activation can reserve the same temporaries.
    proto: Vec<(Expression<'d>, Symbol<'d>)>,
    /// The number of formals: capture temporaries `0..n` hold the incoming
    /// arguments, `n..2n` the arguments of a recursive call.
    n: u32,
    /// The number of temporary groups of `n`: 2, or 4 when a formal is an
    /// `output`/`inout` (`2n..3n` the activation's results, `3n..4n` those
    /// of a recursive call).
    groups: u32,
    /// Per formal: whether it is an `output`/`inout`.
    outs: Vec<bool>,
    /// Per formal: the static storage an aliased `ref` formal names.
    refs: Vec<Option<Symbol<'d>>>,
    /// A class method: capture temporary 0 (formal 0) is its `this`.
    has_this: bool,
    body: Statement<'d>,
}

/// Everything a fork branch's CFG is a function of besides its statement:
/// the key of [`CfgBuilder::fork_memo`]. A branch is walked by a fresh
/// builder seeded only from [`Inherited`], so equal keys give equal CFGs.
#[derive(PartialEq, Eq, Hash)]
struct ForkBranchKey {
    /// Address and kind of the branch statement's AST node.
    stmt: (usize, u16),
    fork_name: Option<String>,
    default_clocking: Option<crate::symid::SymbolId>,
    this_var: Option<crate::symid::SymbolId>,
    ref_aliases: Vec<(crate::symid::SymbolId, crate::symid::SymbolId)>,
    rec_outer: Vec<crate::symid::SymbolId>,
    labels: Vec<String>,
    ancestors: Vec<String>,
}

/// Everything a [`Recursion::Root`] activation's CFG is a function of: the
/// key of its entry in [`CfgBuilder::fork_memo`]. A Root is walked by a fresh
/// builder seeded from exactly these fields (the call site's actuals only
/// supply per-site capture bindings; the capture temporaries are typed by
/// the formals), so equal keys give equal CFGs. `chain` is the
/// [`RecursiveTask::share`] ids of the enclosing activations, which pins
/// each one's CFG (and so its entry block and frame layout, which an
/// [`Recursion::AncestorSpawn`] inside this Root copies from).
#[derive(PartialEq, Eq, Hash)]
struct RootKey {
    task: crate::symid::SymbolId,
    this_var: Option<crate::symid::SymbolId>,
    default_clocking: Option<crate::symid::SymbolId>,
    rec_outer: Vec<crate::symid::SymbolId>,
    chain: Vec<u64>,
    ref_aliases: Vec<(crate::symid::SymbolId, crate::symid::SymbolId)>,
    labels: Vec<String>,
    ancestors: Vec<String>,
}

/// A [`CfgBuilder::fork_memo`] key: a fork branch or a recursive-task Root.
#[derive(PartialEq, Eq, Hash)]
enum MemoKey {
    Fork(ForkBranchKey),
    Root(RootKey),
}

/// The fork branches and recursive-task Roots of one process already built,
/// by [`MemoKey`].
type ForkMemo<'d> =
    std::rc::Rc<std::cell::RefCell<std::collections::HashMap<MemoKey, ProcessCfg<'d>>>>;

/// Source of [`ProcessCfg::share_id`]s (unique across the program).
static NEXT_SHARE_ID: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(1);

/// The AST node address of a statement handle (a handle is a copy of the
/// FFI node pointer; two handles to one node compare equal here).
fn stmt_addr(s: &Statement<'_>) -> usize {
    // SAFETY: `Statement` wraps one `repr(C)` `slang_ast` whose first field
    // is the node pointer; reading that word reads the pointer.
    unsafe { *std::ptr::from_ref(s).cast::<usize>() }
}

/// What a fork branch inherits from the inlined task it is forked in: its
/// `this` and its aliased `ref` formals.
#[derive(Default)]
struct Inherited<'d> {
    this_var: Option<Symbol<'d>>,
    ref_aliases: Vec<(Symbol<'d>, Symbol<'d>)>,
    /// [`CfgBuilder::global_clock`].
    global_clock: Option<InferredClockEvent<'d>>,
    /// [`CfgBuilder::detached_trigger`].
    detached_trigger: bool,
    /// [`CfgBuilder::forced_extern`].
    forced_extern: Option<Symbol<'d>>,
    /// [`CfgBuilder::rec_outer`].
    rec_outer: Vec<crate::symid::SymbolId>,
    /// [`CfgBuilder::fork_memo`], shared by a whole process's builders.
    fork_memo: Option<ForkMemo<'d>>,
    /// [`CfgBuilder::rec`]: a fork branch inside a recursive activation can
    /// itself call the task (each such call spawns the activation again).
    rec: Option<RecursiveTask<'d>>,
    /// [`CfgBuilder::rec_up`].
    rec_up: Vec<RecursiveTask<'d>>,
    /// [`CfgBuilder::fork_branch_names`]'s own starting point: every label
    /// already known reachable from here (the parent's own accumulated list
    /// at the fork site, plus this fork's sibling branches) before this
    /// CFG's own walk adds any it discovers deeper in its own body.
    known_fork_labels: Vec<String>,
    /// [`CfgBuilder::ancestor_blocks`]' starting point.
    ancestor_blocks: Vec<String>,
}

/// A VPI frame probe of an inlined blocking task (37.43): its activation
/// begins (after its arguments and locals are set up) or ends.
#[derive(Clone, Debug)]
pub enum FrameProbe<'d> {
    Enter {
        task: Symbol<'d>,
        /// Its automatic variables: formals, then locals.
        vars: Vec<Symbol<'d>>,
        /// The `ref` formals the call bound by copy-in/copy-out (an actual
        /// that is not static storage) with their actuals, in formal order
        /// (37.15 detail 3). They are ref objs of the frame, not variables
        /// (so absent from `vars`).
        bound: Vec<(Symbol<'d>, Expression<'d>)>,
    },
    Exit {
        task: Symbol<'d>,
        vars: Vec<Symbol<'d>>,
    },
}

struct PartialBlock<'d> {
    bindings: Vec<ArgBinding<'d>>,
    this_var: Option<Symbol<'d>>,
    ref_aliases: Vec<(Symbol<'d>, Symbol<'d>)>,
    stmts: Vec<Statement<'d>>,
    probes: Vec<(usize, Statement<'d>)>,
    disable_probes: Vec<(usize, Statement<'d>)>,
    frame_probes: Vec<(usize, FrameProbe<'d>)>,
    block_events: Vec<(usize, Symbol<'d>, bool)>,
    stmt_scopes: Vec<(usize, Symbol<'d>)>,
    step_exprs: Vec<Expression<'d>>,
    repeat_init: Option<(RepeatCounterId, RepeatCount<'d>)>,
    repeat_decrement: Option<RepeatCounterId>,
    expect_resume: bool,
    terminator: Option<Terminator<'d>>,
}

struct CfgBuilder<'d> {
    blocks: Vec<PartialBlock<'d>>,
    /// Task 1: the single clock signal+edge `##N` (`CycleDelay`) is lowered
    /// against, inferred from the first `posedge`/`negedge` `SuspendPoint::
    /// Edge` this walk encounters (in practice, the enclosing `always_ff`'s
    /// own edge). `None` until seen; becomes permanently ambiguous
    /// (`Some(None)`) the moment a *second*, differently-referenced edge
    /// signal (or the SAME signal with a different edge -- Task 6 extends
    /// the ambiguity check to cover this too, since `CycleDelay` now carries
    /// a real `edge` field it must be unambiguous about) is seen, so a later
    /// `##N` inside a multi-clock or unclocked-context process is a named
    /// `LoweringError`, never a silent guess (`walk_timed`'s `CycleDelay`
    /// arm). Task 6: also threaded through as real `SuspendPoint::
    /// CycleDelay{clock, edge, ..}` payload -- previously computed
    /// then discarded once the ambiguity check passed.
    inferred_clock: Option<Option<(Expression<'d>, EdgeKind)>>,
    /// R-run Task 8: the next fresh [`RepeatCounterId`] this builder will
    /// mint -- dense, allocation-order-numbered, mirrors [`Self::blocks`]'s
    /// own `len()`-as-next-id discipline for [`BlockId`].
    next_repeat_counter: u32,
    /// Formals/locals of every task inlined so far (`ProcessCfg::
    /// inlined_locals`).
    inlined_locals: Vec<Symbol<'d>>,
    /// Every inlined call's `ref` formal with the symbol its actual names
    /// (`None` for an actual that is not a plain name): resolved into
    /// `ProcessCfg::ref_bindings` once the whole process is walked.
    ref_candidates: Vec<(Symbol<'d>, Option<Symbol<'d>>)>,
    /// Set while walking a block whose automatic variables were just
    /// bound on entry (so the block itself is walked normally).
    entering_block: bool,
    /// The call being inlined, whose type shapes the `this` capture of a
    /// recursive method call with an implicit receiver.
    call_anchor: Option<Expression<'d>>,
    /// The capture temporary the next [`Self::inline_task_call`] parks the
    /// called function's result in ([`ArgBinding::CallResult`]).
    pending_result_temp: Option<(u32, Expression<'d>)>,
    /// Where a `return;` inside the innermost task being inlined goes.
    return_targets: Vec<BlockId>,
    /// The result variable of each inlined function (`None` for a task or void
    /// function), parallel to the inlined entries of [`Self::return_targets`]:
    /// `return expr;` assigns it (LRM 1800-2023 13.4.1).
    ret_var_stack: Vec<Option<Symbol<'d>>>,
    /// The `this` of each class-method task being inlined, innermost last
    /// ([`BasicBlock::this_var`]).
    this_stack: Vec<Symbol<'d>>,
    /// The `ref` formals of the tasks being inlined that alias their call's
    /// storage ([`BasicBlock::ref_aliases`]), innermost last.
    ref_stack: Vec<(Symbol<'d>, Symbol<'d>)>,
    /// The class templates a virtual suspending task can dispatch over.
    virtual_tasks: Option<std::rc::Rc<VirtualTasks<'d>>>,
    /// The type source of each capture temporary ([`ProcessCfg::capture_types`]).
    capture_types: Vec<Option<Symbol<'d>>>,
    /// Tasks currently being inlined (recursion guard).
    inline_stack: Vec<crate::symid::SymbolId>,
    /// While building a recursive task's activation
    /// ([`Self::inline_recursive_task`]): the task, whose calls are forks.
    rec: Option<RecursiveTask<'d>>,
    /// The recursive activations enclosing [`Self::rec`]'s (outermost first):
    /// a call of one of their tasks is a spawn of that activation
    /// ([`Recursion::AncestorSpawn`]).
    rec_up: Vec<RecursiveTask<'d>>,
    /// The recursive tasks whose activation encloses this builder's CFG (a
    /// fork branch inside one cannot start another activation of it).
    rec_outer: Vec<crate::symid::SymbolId>,
    /// The innermost enclosing loop's `continue` and `break` targets.
    loop_targets: Vec<(BlockId, BlockId)>,
    /// The sequential blocks being walked that declare automatic variables
    /// holding class or collection handles, innermost last (LRM 6.21: such a
    /// variable ends with its block, and a handle is released then).
    owned_scopes: Vec<Vec<Symbol<'d>>>,
    /// For each jump target (`break`/`continue`/`return`/`disable` exit), how
    /// many [`Self::owned_scopes`] were open outside it: a jump to it
    /// releases the scopes above that depth ([`Self::jump`]).
    target_depth: std::collections::HashMap<BlockId, usize>,
    /// The enclosing named blocks a `disable` may leave: `(name, exit)`,
    /// innermost last.
    /// `(label, exit, frames)`: `frames` is how many inlined tasks were
    /// active (`frame_stack`) when the block was entered.
    disable_targets: Vec<(String, BlockId, usize)>,
    /// The body this builder walks, for the lazy [`Self::body_forks`] scan.
    body_node: Option<SemNode<'d>>,
    /// The names of the fork blocks this builder walked (a subset of
    /// [`Self::fork_branch_names`]): a `fl.b.x` path through one is an
    /// instance-path-style label, not a branch name.
    fork_block_names: Vec<String>,
    /// Whether the body (or a task it calls) holds a fork block: decided on
    /// the first `disable` that jumps out of a named block, since only then
    /// can detached branches need ending with it (LRM 9.6.2).
    body_forks: Option<bool>,
    /// The covergroup-event blocks and inlined tasks being walked, innermost
    /// last, each with `disable_targets.len()` when it was entered: a
    /// `disable` that jumps out of them ends them there (LRM 9.6.2, 19.3), so
    /// [`Self::left_block_events`] signals their `end` at the jump.
    event_stack: Vec<(Symbol<'d>, usize)>,
    /// The tasks being inlined, innermost last, with their automatic
    /// variables (for the VPI frame probes a `disable` jumping out of them
    /// owes).
    frame_stack: Vec<(Symbol<'d>, Vec<Symbol<'d>>)>,
    /// The named blocks and inlined task activations being walked whose name
    /// some `disable` of the design targets, `(label, exit)`, innermost last:
    /// every block allocated while one is open is inside it
    /// ([`Self::block_scopes`], [`ProcessCfg::disable_scopes`]).
    /// `frames` is how many inlined tasks were active ([`Self::frame_stack`])
    /// outside the scope.
    scope_chain: Vec<(String, BlockId, usize)>,
    /// The names of the named sequential blocks being walked, outermost first
    /// (the path `disable p.b.x;` names, LRM 9.6.2).
    name_path: Vec<String>,
    /// [`Self::scope_chain`] as it was when each block was allocated.
    block_scopes: Vec<Vec<(String, BlockId, usize)>>,
    /// [`Self::frame_stack`] as it was when each block was allocated (empty
    /// outside every scope).
    block_frames: Vec<Vec<(Symbol<'d>, Vec<Symbol<'d>>)>>,
    /// [`ProcessCfg::disable_broadcast`].
    disable_broadcast: Vec<(String, bool)>,
    /// When this CFG is one branch of a named fork block: that name, which
    /// a `disable` inside it may target (`sv_rt_disable_fork_block`).
    fork_name: Option<String>,
    /// Every fork-branch [`ProcessCfg::disable_names`] a `disable <label>;`
    /// written anywhere in THIS CFG's own remaining walk may legitimately
    /// target (LRM 9.6.2), besides a same-process lexically enclosing block
    /// or this CFG's own `fork_name`: seeded from [`Inherited::
    /// known_fork_labels`] (what the parent already knew, plus this fork's
    /// siblings, when this CFG is itself a branch), then extended, going
    /// forward, by every later fork THIS walk itself builds branches for --
    /// never popped (unlike `disable_targets`): LRM 9.6.2 lets a branch's
    /// name be disabled for the rest of the process's life, not only while
    /// the `fork` statement that spawned it is still being walked.
    fork_branch_names: Vec<String>,
    /// The named blocks enclosing the fork statement(s) this CFG is a branch of,
    /// in the forking process(es) (LRM 9.6.2): a `disable` of one from inside
    /// the branch ends that block's whole activity, the forking process
    /// suspended at the join included, which resumes after the block.
    ancestor_blocks: Vec<String>,
    /// The name of the process's outermost scope (LRM 16.14.6.4), if it is a
    /// named block: a `disable` of it flushes the pending procedural assertion
    /// queue.
    outermost: Option<String>,
    /// The labels of the procedural concurrent assertions of this process: a
    /// `disable <label>;` clears the pending instances of that assertion
    /// (16.14.6.4).
    assertion_labels: Vec<String>,
    /// Labels of the process's deferred immediate assertions: `disable L;`
    /// cancels their pending reports (16.4.4), codegen lowers the kept statement.
    deferred_labels: Vec<String>,
    /// Labels of the process's plain immediate assertions: `disable L;` from
    /// outside the labeled statement is a no-op (it already finished).
    immediate_labels: Vec<String>,
    /// The outermost named blocks of the instance's other processes, which this
    /// process may `disable` (16.14.6.4, the `b3` example).
    peers: Vec<PeerBlock>,
    /// [`ProcessCfg::captures`].
    captures: Vec<Expression<'d>>,
    /// The instance's default clocking block, which `##N` counts.
    default_clocking: Option<Symbol<'d>>,
    /// While lowering the timing control of a clocking drive (`cb.q <= ##N v`):
    /// the drive target's own clocking block, whose event `##N` counts (LRM
    /// 1800-2023 14.16) instead of the default clocking's.
    drive_clocking: Option<Symbol<'d>>,
    /// The clock variable (`v.sb.c`) of that drive when it goes through a
    /// virtual interface member access, else `None` (see
    /// [`SuspendPoint::CycleDelay`]'s `via`).
    drive_via: Option<Expression<'d>>,
    /// Set by [`Self::walk_timed`] around its [`Self::suspend_point`] call: a
    /// run-time `##(expr)` count is then accepted (as a single `##1` wait the
    /// caller wraps in a counted loop) and its expression left in
    /// `dynamic_cycle_count`; every other caller still refuses it by name.
    allow_dynamic_cycle: bool,
    /// Set by [`Self::walk_timed`] around the [`Self::suspend_point`] of a
    /// mixed class-event / signal `@(a or b)` list: the class terms are then
    /// skipped (the leaf statement queues the process on them) and only the
    /// signal terms form the suspend point. Every other caller keeps the class
    /// term, so it cannot be dropped silently.
    skip_class_event_terms: bool,
    dynamic_cycle_count: Option<Expression<'d>>,
    /// What a checker procedure's `@clock` waits on when `clock` is the default
    /// `$inferred_clock` ([`InferredClockEvent`]).
    checker_clock: Option<InferredClockEvent<'d>>,
    /// What `@$global_clock` waits on: the event of the global clocking in
    /// effect for the process (14.14), when one is declared in its instance.
    global_clock: Option<InferredClockEvent<'d>>,
    /// Walking the body of the plan that hosts an `expect` statement for the
    /// assertion engine ([`build_cfg_hosted_assertion`]): the `expect` is then
    /// an ordinary leaf, not a blocking wait.
    expect_as_leaf: bool,
    /// This CFG is the detached process of a `->> @(ctl) e;` (LRM 1800-2023
    /// 15.5.2): its body statement is that trigger, which waits on `ctl` and
    /// then stages the nonblocking trigger, while the issuing process
    /// continues. Cleared once the body statement is walked.
    detached_trigger: bool,
    /// The fork branches this process has built so far ([`ForkBranchKey`]):
    /// a task inlined at many call sites repeats the same forks, and each
    /// distinct branch is built (and later lowered) once.
    fork_memo: ForkMemo<'d>,
    /// This CFG is one branch of a call to an `extern forkjoin` task (LRM
    /// 25.7.5): its body statement is that call, and it runs this one
    /// implementation. Cleared once the body statement is walked.
    forced_extern: Option<Symbol<'d>>,
}

impl<'d> CfgBuilder<'d> {
    fn new() -> Self {
        Self {
            expect_as_leaf: false,
            detached_trigger: false,
            fork_memo: ForkMemo::default(),
            forced_extern: None,
            blocks: Vec::new(),
            inferred_clock: None,
            next_repeat_counter: 0,
            inlined_locals: Vec::new(),
            ref_candidates: Vec::new(),
            entering_block: false,
            return_targets: Vec::new(),
            ret_var_stack: Vec::new(),
            this_stack: Vec::new(),
            ref_stack: Vec::new(),
            virtual_tasks: None,
            inline_stack: Vec::new(),
            capture_types: Vec::new(),
            rec: None,
            rec_up: Vec::new(),
            rec_outer: Vec::new(),
            loop_targets: Vec::new(),
            owned_scopes: Vec::new(),
            target_depth: std::collections::HashMap::new(),
            disable_targets: Vec::new(),
            body_node: None,
            fork_block_names: Vec::new(),
            body_forks: None,
            event_stack: Vec::new(),
            call_anchor: None,
            pending_result_temp: None,
            frame_stack: Vec::new(),
            scope_chain: Vec::new(),
            name_path: Vec::new(),
            block_scopes: Vec::new(),
            block_frames: Vec::new(),
            disable_broadcast: Vec::new(),
            ancestor_blocks: Vec::new(),
            fork_name: None,
            fork_branch_names: Vec::new(),
            outermost: None,
            assertion_labels: Vec::new(),
            deferred_labels: Vec::new(),
            immediate_labels: Vec::new(),
            peers: Vec::new(),
            captures: Vec::new(),
            default_clocking: None,
            drive_clocking: None,
            drive_via: None,
            allow_dynamic_cycle: false,
            skip_class_event_terms: false,
            dynamic_cycle_count: None,
            checker_clock: None,
            global_clock: None,
        }
    }

    fn alloc_block(&mut self) -> BlockId {
        let id = BlockId(self.blocks.len() as u32);
        let this_var = self.this_stack.last().copied();
        let ref_aliases = self.ref_stack.clone();
        self.block_scopes.push(self.scope_chain.clone());
        self.block_frames.push(if self.scope_chain.is_empty() {
            Vec::new()
        } else {
            self.frame_stack.clone()
        });
        self.blocks.push(PartialBlock {
            bindings: Vec::new(),
            this_var,
            ref_aliases,
            stmts: Vec::new(),
            probes: Vec::new(),
            disable_probes: Vec::new(),
            frame_probes: Vec::new(),
            block_events: Vec::new(),
            stmt_scopes: Vec::new(),
            step_exprs: Vec::new(),
            repeat_init: None,
            repeat_decrement: None,
            expect_resume: false,
            terminator: None,
        });
        id
    }

    /// After a statement that called a subroutine, in a design where some
    /// function has `disable <block>;` (LRM 9.6.2, 35.9): leaves the enclosing
    /// named block the call disabled, if any ([`SwitchOn::FnDisable`]).
    /// Returns the block the statements go on in.
    fn fn_disable_check(&mut self, cur: BlockId) -> BlockId {
        let targets: Vec<(usize, String, BlockId, usize)> = self
            .disable_targets
            .iter()
            .enumerate()
            .rev()
            .filter(|(_, (n, _, _))| is_function_disable_label(n))
            .map(|(pos, (n, exit, frames))| (pos, n.clone(), *exit, *frames))
            .collect();
        if targets.is_empty() {
            return cur;
        }
        let next = self.alloc_block();
        let mut arms = Vec::new();
        let mut labels = Vec::new();
        for (pos, label, exit, frames) in targets {
            let arm = self.alloc_block();
            // The inlined tasks the jump leaves end here, innermost first.
            let left: Vec<_> = self.frame_stack[frames..].iter().rev().cloned().collect();
            for (task, vars) in left {
                self.frame_probe(arm, FrameProbe::Exit { task, vars });
            }
            self.left_block_events(arm, pos);
            self.jump(arm, exit);
            arms.push(arm);
            labels.push(label);
        }
        self.close(
            cur,
            Terminator::Switch {
                on: SwitchOn::FnDisable { labels },
                arms,
                default_blk: next,
                report: None,
            },
        );
        next
    }

    fn push(&mut self, blk: BlockId, stmt: Statement<'d>) {
        let scope = self.frame_stack.last().map(|f| f.0);
        let b = &mut self.blocks[blk.0 as usize];
        if let Some(scope) = scope {
            b.stmt_scopes.push((b.stmts.len(), scope));
        }
        b.stmts.push(stmt);
    }

    /// Records that `stmt` is about to execute at the current end of block
    /// `blk`'s statements ([`BasicBlock::probes`]).
    fn probe(&mut self, blk: BlockId, stmt: Statement<'d>) {
        let b = &mut self.blocks[blk.0 as usize];
        let at = b.stmts.len();
        b.probes.push((at, stmt));
    }

    /// Records that the `disable` statement `stmt`, turned into a jump, has
    /// taken effect at the current end of block `blk`'s statements
    /// ([`BasicBlock::disable_probes`]).
    fn disable_probe(&mut self, blk: BlockId, stmt: Statement<'d>) {
        let b = &mut self.blocks[blk.0 as usize];
        let at = b.stmts.len();
        b.disable_probes.push((at, stmt));
    }

    /// Appends to `out` the `blocks` some `disable` of the design names (a
    /// fork branch's extra [`ProcessCfg::disable_names`]).
    fn disable_names_extra(&self, blocks: &[String], out: &mut Vec<String>) {
        for b in blocks {
            if is_disabled_somewhere(b) && !out.contains(b) {
                out.push(b.clone());
            }
        }
    }

    /// Whether the body being walked holds a fork block, in itself or in a
    /// task it calls (cached).
    fn forks_in_body(&mut self) -> bool {
        if let Some(v) = self.body_forks {
            return v;
        }
        let v = self.body_node.is_some_and(contains_fork_through_calls);
        self.body_forks = Some(v);
        v
    }

    /// `disable a.b;` (LRM 9.6.2) whose segments are a contiguous chain of
    /// this process's lexically enclosing named blocks: a jump to the last
    /// one's exit, exactly like `disable b;`. Any other hierarchical target
    /// (an instance path, a block not enclosing the statement, or the
    /// outermost block / a task frame, whose lowering needs the plain label)
    /// stays loud.
    fn walk_hier_disable_of_enclosing(
        &mut self,
        stmt: Statement<'d>,
        cur: BlockId,
        path: &[String],
    ) -> Result<Option<BlockId>, LoweringError> {
        let loud = || {
            LoweringError::unsupported(format!(
                "disable of `{}` (a hierarchical name is supported only as a chain of the \
                 statement's own lexically enclosing named blocks, not the process's \
                 outermost block or a task frame; IEEE 1800-2023 9.6.2)",
                path.join(".")
            ))
        };
        let last = path.last().ok_or_else(loud)?;
        let Some(pos) = self.disable_targets.iter().rposition(|(n, _, _)| n == last) else {
            return Ok(None);
        };
        let chain_ok = pos + 1 >= path.len()
            && path
                .iter()
                .enumerate()
                .all(|(i, seg)| self.disable_targets[pos + 1 - path.len() + i].0 == *seg);
        if !chain_ok {
            return Ok(None);
        }
        let (_, exit, frames) = self.disable_targets[pos].clone();
        let outermost = pos == 0 && self.outermost.as_deref() == Some(last.as_str());
        if outermost || frames > 0 {
            return Err(loud());
        }
        self.disable_probe(cur, stmt);
        self.left_block_events(cur, pos);
        self.jump(cur, exit);
        Ok(Some(self.alloc_block()))
    }

    /// The target of `disable a.b.c;` (LRM 9.6.2) when every segment names a
    /// block of ANOTHER process of this instance ([`PeerBlock`]): the last
    /// segment, handled like the plain `disable c;` of that peer. An instance
    /// path (or any segment that is not a peer block) stays loud, since the
    /// runtime resolves a label within the requester's own instance only.
    fn hier_peer_leaf(&self, path: &[String]) -> Result<String, LoweringError> {
        if path
            .iter()
            .all(|seg| self.peers.iter().any(|p| &p.name == seg))
        {
            return Ok(path[path.len() - 1].clone());
        }
        // `disable outer.inner;` / `disable top.outer.inner;` where `inner` is
        // a fork branch's own named block (a sibling or a later branch of this
        // process) or a block enclosing the fork, reached through blocks of
        // this process family (LRM 9.6.2): the same target as the plain
        // `disable inner;`. A leading segment that names none of them is the
        // instance's own name (only when a block segment follows it). Left as
        // the dotted text it would name a block of a child instance and match
        // nothing, a silent no-op.
        let known = |s: &String| {
            self.ancestor_blocks.contains(s)
                || self.fork_branch_names.contains(s)
                || self.disable_targets.iter().any(|(n, _, _)| n == s)
                || self.outermost.as_deref() == Some(s.as_str())
        };
        if let Some((leaf, mid)) = path.split_last()
            && known(leaf)
        {
            let skip = usize::from(mid.len() >= 2 && !known(&mid[0]));
            if mid[skip..].iter().all(known) {
                return Ok(leaf.clone());
            }
        }
        // `disable u1.blk;` (an instance path): the first segment names
        // neither a block of this or another process nor a task, so it is a
        // child instance. Kept as the dotted text; the runtime resolves it from
        // the requester's instance (the extra scope keys run.rs registers).
        let first = &path[0];
        if !self.peers.iter().any(|p| &p.name == first)
            && !self.disable_targets.iter().any(|(n, _, _)| n == first)
            && !is_task_name(first)
            && self.fork_name.as_deref() != Some(first.as_str())
            && !self
                .fork_branch_names
                .iter()
                .any(|n| n == first && !self.fork_block_names.contains(n))
        {
            return Ok(path.join("."));
        }
        // `disable p.b.x;` where `x` also names a block elsewhere: the dotted
        // path from another process's outermost block `p`, which the runtime
        // finds under the path-qualified scope label (`CfgBuilder::name_path`).
        if self.peers.iter().any(|p| &p.name == first) {
            return Ok(path.join("."));
        }
        Err(LoweringError::unsupported(format!(
            "disable of `{}` (a hierarchical name is supported only as a chain of the \
             statement's own lexically enclosing named blocks or of the named blocks of \
             another process of the same instance, not an instance path, the process's \
             outermost block or a task frame; IEEE 1800-2023 9.6.2)",
            path.join(".")
        )))
    }

    /// Records the frame probe `probe` at the current end of block `blk`'s
    /// statements ([`BasicBlock::frame_probes`]).
    fn frame_probe(&mut self, blk: BlockId, probe: FrameProbe<'d>) {
        let b = &mut self.blocks[blk.0 as usize];
        let at = b.stmts.len();
        b.frame_probes.push((at, probe));
    }

    /// Records the covergroup block event of `task` (LRM 19.3) at the current
    /// end of block `blk`'s statements ([`BasicBlock::block_events`]).
    fn block_event(&mut self, blk: BlockId, task: Symbol<'d>, is_end: bool) {
        let b = &mut self.blocks[blk.0 as usize];
        let at = b.stmts.len();
        b.block_events.push((at, task, is_end));
    }

    /// A `disable` jumping to `disable_targets[pos]` ends every block and
    /// inlined task entered inside that target (LRM 9.6.2): records their
    /// `end` covergroup events (LRM 19.3) at the jump, innermost first. The
    /// target's own end event is the one at its exit block.
    fn left_block_events(&mut self, cur: BlockId, pos: usize) {
        let left: Vec<_> = self
            .event_stack
            .iter()
            .rev()
            .take_while(|(_, depth)| *depth > pos)
            .map(|(s, _)| *s)
            .collect();
        for s in left {
            self.block_event(cur, s, true);
        }
    }

    fn push_step_expr(&mut self, blk: BlockId, expr: Expression<'d>) {
        self.blocks[blk.0 as usize].step_exprs.push(expr);
    }

    /// R-run Task 8: mints a fresh, process-unique [`RepeatCounterId`] for a
    /// suspend-containing `repeat(N)` loop's own synthetic counter.
    fn alloc_repeat_counter(&mut self) -> RepeatCounterId {
        let id = RepeatCounterId(self.next_repeat_counter);
        self.next_repeat_counter += 1;
        id
    }

    /// R-run Task 8: records `blk`'s own `repeat_init` -- see
    /// [`BasicBlock::repeat_init`]'s doc comment. `blk` must not already
    /// carry one (a builder-internal consistency check, like [`Self::close`]'s
    /// own "not already closed" invariant: every call site is
    /// `walk_repeat_loop`'s own `cur`, which allocates/owns exactly one
    /// `repeat_init` per call).
    fn set_repeat_init(&mut self, blk: BlockId, counter: RepeatCounterId, count: RepeatCount<'d>) {
        let slot = &mut self.blocks[blk.0 as usize].repeat_init;
        debug_assert!(
            slot.is_none(),
            "cfg builder tried to set block {blk:?}'s repeat_init twice"
        );
        *slot = Some((counter, count));
    }

    /// R-run Task 8: records `blk`'s own `repeat_decrement` -- see
    /// [`BasicBlock::repeat_decrement`]'s doc comment.
    fn set_repeat_decrement(&mut self, blk: BlockId, counter: RepeatCounterId) {
        let slot = &mut self.blocks[blk.0 as usize].repeat_decrement;
        debug_assert!(
            slot.is_none(),
            "cfg builder tried to set block {blk:?}'s repeat_decrement twice"
        );
        *slot = Some(counter);
    }

    /// Records `signal`/`edge` (from a just-built `SuspendPoint::Edge`) as
    /// the process's inferred single clock -- see `inferred_clock`'s own doc
    /// comment. Compares *by referenced symbol identity*, since two
    /// `Expression` handles for the same `clk` are not otherwise comparable;
    /// an edge with no resolvable symbol (e.g. a bit-select or expression,
    /// not a plain name) can never disambiguate a later `##N`, so it does
    /// not overwrite an already-known clock but also never establishes one
    /// on its own. Task 6: a second sighting of the SAME signal with a
    /// DIFFERENT edge also becomes ambiguous now (`CycleDelay` carries a
    /// real `edge` field it must be unambiguous about, unlike the
    /// pre-Task-6 bare cycle count).
    fn note_edge_signal(&mut self, signal: Expression<'d>, edge: EdgeKind) {
        let this_sym = signal.referenced_symbol().map(|s| s.uid());
        match &self.inferred_clock {
            None => {
                self.inferred_clock = Some(this_sym.is_some().then_some((signal, edge)));
            }
            Some(Some((existing, existing_edge))) => {
                let existing_sym = existing.referenced_symbol().map(|s| s.uid());
                if existing_sym.is_none() || this_sym != existing_sym || *existing_edge != edge {
                    self.inferred_clock = Some(None); // now ambiguous
                }
            }
            Some(None) => {} // already ambiguous; stays ambiguous
        }
    }

    /// Closes `blk` with `term`. `blk` must not already be closed -- every
    /// call site in this file only ever passes a `BlockId` it just allocated
    /// or one a nested `walk_stmt` call returned (which is itself always
    /// still-open by the same invariant), so this is a builder-internal
    /// consistency check, not a condition reachable from malformed SV source.
    fn close(&mut self, blk: BlockId, term: Terminator<'d>) {
        let slot = &mut self.blocks[blk.0 as usize].terminator;
        debug_assert!(
            slot.is_none(),
            "cfg builder tried to close block {blk:?} twice"
        );
        *slot = Some(term);
    }

    /// Closes `cur` with a jump to `target`, releasing on the way the handles
    /// of the block-scoped automatic variables the jump leaves (a `break`,
    /// `continue`, `return` or `disable` out of a block, LRM 6.21).
    fn jump(&mut self, cur: BlockId, target: BlockId) {
        let open = self.owned_scopes.len();
        let depth = self.target_depth.get(&target).copied().unwrap_or(open);
        let vars: Vec<Symbol<'d>> = self.owned_scopes[depth.min(open)..]
            .iter()
            .rev()
            .flat_map(|s| s.iter().rev().copied())
            .collect();
        if vars.is_empty() {
            self.close(cur, Terminator::Fallthrough(target));
            return;
        }
        let leave = self.alloc_block();
        self.close(cur, Terminator::Fallthrough(leave));
        for var in vars {
            self.blocks[leave.0 as usize]
                .bindings
                .push(ArgBinding::Release { var });
        }
        self.close(leave, Terminator::Fallthrough(target));
    }

    /// The static variable or net a `ref` actual names: itself, or what an
    /// enclosing inlined call's aliased `ref` formal it names stands for.
    fn ref_storage(&self, actual: Expression<'d>) -> Option<Symbol<'d>> {
        if !crate::symid::is_value_name(actual.kind()) {
            return None;
        }
        let sym = actual.referenced_symbol()?;
        if sym.kind() == SymbolKind::Net
            || (sym.kind() == SymbolKind::Variable
                && sym.variable_lifetime() == sv_lang::VariableLifetime::Static)
        {
            return Some(sym);
        }
        self.ref_stack
            .iter()
            .rev()
            .find(|(f, _)| f.uid() == sym.uid())
            .map(|&(_, a)| a)
    }

    /// Resolves [`Self::ref_candidates`] into `ProcessCfg::ref_bindings`: a
    /// `ref` formal every call binds to one static variable or net (directly,
    /// or through an enclosing inlined task's `ref` formal that is itself
    /// bound) names that storage, so its copy-in/copy-out bindings and its
    /// frame local are dropped. A formal bound to different actuals, or to
    /// an automatic variable or a select, keeps the copy semantics.
    fn take_ref_bindings(&mut self) -> Vec<(Symbol<'d>, Symbol<'d>)> {
        use std::collections::HashMap;
        let storage = |s: &Symbol<'d>| {
            s.kind() == SymbolKind::Net
                || (s.kind() == SymbolKind::Variable
                    && s.variable_lifetime() == sv_lang::VariableLifetime::Static)
        };
        // formal uid -> (formal, the one target symbol every call names), or
        // None once two calls disagree or one names no plain symbol.
        let mut targets: HashMap<crate::symid::SymbolId, (Symbol<'d>, Option<Symbol<'d>>)> =
            HashMap::new();
        let mut order = Vec::new();
        for (formal, named) in &self.ref_candidates {
            match targets.get_mut(&formal.uid()) {
                None => {
                    order.push(formal.uid());
                    targets.insert(formal.uid(), (*formal, *named));
                }
                Some((_, cur)) => {
                    if cur.map(|c| c.uid()) != named.map(|n| n.uid()) {
                        *cur = None;
                    }
                }
            }
        }
        // Follow a chain through enclosing tasks' bound `ref` formals.
        let resolve = |start: Symbol<'d>| -> Option<Symbol<'d>> {
            let mut cur = start;
            for _ in 0..=targets.len() {
                if storage(&cur) {
                    return Some(cur);
                }
                cur = targets.get(&cur.uid())?.1?;
            }
            None
        };
        let mut out = Vec::new();
        for uid in order {
            let (formal, named) = targets[&uid];
            if let Some(actual) = named.and_then(resolve) {
                out.push((formal, actual));
            }
        }
        let bound: std::collections::HashSet<crate::symid::SymbolId> =
            out.iter().map(|(f, _)| f.uid()).collect();
        for b in &mut self.blocks {
            b.bindings.retain(|x| match x {
                ArgBinding::In { formal, .. } | ArgBinding::Out { formal, .. } => {
                    !bound.contains(&formal.uid())
                }
                _ => true,
            });
        }
        self.inlined_locals.retain(|l| !bound.contains(&l.uid()));
        out
    }

    /// [`ProcessCfg::disable_scopes`] from the scopes each block was allocated in.
    ///
    /// A resume point inside inlined tasks the disabled scope does not contain
    /// goes through a block of its own that ends their VPI frames first,
    /// innermost first (37.43), like a `disable` jump inside the process does.
    fn take_disable_scopes(&mut self) -> Vec<(BlockId, String, BlockId)> {
        let scopes = std::mem::take(&mut self.block_scopes);
        let frames = std::mem::take(&mut self.block_frames);
        let mut out = Vec::new();
        for (i, (chain, active)) in scopes.into_iter().zip(frames).enumerate() {
            for (label, exit, outside) in chain {
                let target = if active.len() > outside {
                    let leave = self.alloc_block();
                    for (task, vars) in active[outside..].iter().rev().cloned() {
                        self.frame_probe(leave, FrameProbe::Exit { task, vars });
                    }
                    self.close(leave, Terminator::Fallthrough(exit));
                    leave
                } else {
                    exit
                };
                out.push((BlockId(i as u32), label, target));
            }
        }
        out
    }

    fn finish(self) -> Vec<BasicBlock<'d>> {
        self.blocks
            .into_iter()
            .map(|b| BasicBlock {
                bindings: b.bindings,
                this_var: b.this_var,
                ref_aliases: b.ref_aliases,
                stmts: b.stmts,
                probes: b.probes,
                disable_probes: b.disable_probes,
                frame_probes: b.frame_probes,
                block_events: b.block_events,
                stmt_scopes: b.stmt_scopes,
                step_exprs: b.step_exprs,
                repeat_init: b.repeat_init.clone(),
                repeat_decrement: b.repeat_decrement,
                expect_resume: b.expect_resume,
                terminator: b.terminator.expect(
                    "internal invariant: build_cfg must close every block it allocates \
                     before returning Ok",
                ),
            })
            .collect()
    }

    /// PR-007's single recursive-descent walk. Returns the [`BlockId`] that
    /// is "current" for whatever statement follows `stmt` in its enclosing
    /// sequence. Every construct reachable in the A2 slice's restricted
    /// grammar falls through -- there is no `return`/`disable`/`break`/
    /// `continue` meaningfully reachable from a process body here (loops,
    /// functions and tasks are out of slice scope), so this never needs to
    /// signal "does not fall through".
    ///
    /// `sv_lang::kinds::StatementKind` is `#[non_exhaustive]` upstream (a
    /// `sv-lang-kinds` version bump can add a variant without breaking this
    /// crate's build), so a literal Rust `match` over it cannot itself be
    /// exhaustive-without-a-wildcard -- the compiler mandates a catch-all
    /// arm. Per this workspace's already-established pattern for these
    /// generated kind enums (`sv-sim-codegen::module`'s `TimingControlKind`/
    /// `StatementKind` handling, `determinism::kind_guard`'s doc comment),
    /// this is instead an `if`/`else-if` chain that names every one of
    /// today's 32 variants explicitly (`StatementKind::COUNT`, pinned by
    /// `determinism::kind_guard::statement_kind_count_matches_pinned_sv_lang_
    /// version`), falling through to a named [`LoweringError`] -- never a
    /// silent no-op -- only if a future version bump adds a 33rd variant
    /// this file has not been reviewed against (which that pinned-count test
    /// catches first).
    fn walk_stmt(&mut self, stmt: Statement<'d>, cur: BlockId) -> Result<BlockId, LoweringError> {
        // A statically dead `if`/`case` arm slang could not bind demotes the
        // enclosing statements to `Invalid` wrappers; the real statement is
        // recoverable (see [`unwrap_invalid`]).
        let stmt = unwrap_invalid(stmt);
        let kind = stmt.kind();

        if kind == StatementKind::Invalid {
            return Err(LoweringError::malformed(
                "Invalid statement node -- slang rejected this statement; an error inside a \
                 statically dead `if`/`case` arm (e.g. a reversed range select `v[7:8]` of a \
                 descending vector under a false parameter condition) is suppressed by slang \
                 but still invalidates the whole enclosing procedure",
            ));
        }
        if kind == StatementKind::List {
            return self.walk_seq(live_statements(&stmt), cur);
        }
        // VPI `cbStmt` (38.36.1, Table 38-6): the statement is about to
        // execute. The detached process of `->> @(ctl) e;` runs the same
        // statement the issuer already probed. Loops are probed per iteration
        // by their own walkers (or by codegen when they stay a leaf).
        if is_entry_probe_kind(&stmt) && !self.detached_trigger {
            self.probe(cur, stmt);
        }
        if kind == StatementKind::Block {
            return self.walk_block(stmt, cur);
        }
        if kind == StatementKind::Conditional {
            return self.walk_conditional(stmt, cur);
        }
        if kind == StatementKind::Timed {
            return self.walk_timed(stmt, cur);
        }
        if kind == StatementKind::Wait {
            return self.walk_wait(stmt, cur);
        }
        if kind == StatementKind::WaitFork {
            // SC-125: a real suspend -- the scheduler resumes the process once
            // every child it forked has finished (`Suspend::WaitFork`).
            let resume = self.alloc_block();
            self.close(
                cur,
                Terminator::Suspend {
                    point: SuspendPoint::WaitFork,
                    resume_blk: resume,
                },
            );
            return Ok(resume);
        }
        if kind == StatementKind::ExpressionStatement && is_process_by_request_stmt(&stmt) {
            // Classes plan Task 13: `p.await();` / `p.suspend();`. The call
            // (an ordinary leaf statement) queues the request; the suspend
            // after it lets the scheduler apply it -- block in `await`,
            // park a self-suspend -- before the next statement runs.
            self.push(cur, stmt);
            let resume = self.alloc_block();
            self.close(
                cur,
                Terminator::Suspend {
                    point: SuspendPoint::ByRequest,
                    resume_blk: resume,
                },
            );
            // Classes plan Task 18: a mailbox `get`/`peek` delivers its message
            // into a variable, which a process that blocked cannot have done
            // when the call returned. The statement runs a second time after
            // the resume; the runtime tells the two phases apart (the first one
            // of a call that did not block leaves a marker, so the second is a
            // no-op: `sv_sim_sim::sched::mailbox`).
            if is_mailbox_two_phase_stmt(&stmt) {
                self.push(resume, stmt);
            }
            return Ok(resume);
        }
        if kind == StatementKind::WaitOrder {
            return self.walk_wait_order(stmt, cur);
        }
        if is_expect(&stmt) && !self.expect_as_leaf {
            return self.walk_expect(stmt, cur);
        }
        if kind == StatementKind::RandCase
            && (contains_suspend_trigger(stmt.as_sem_node())
                || escapes(
                    stmt.as_sem_node(),
                    !self.loop_targets.is_empty(),
                    !self.return_targets.is_empty(),
                ))
        {
            return self.walk_randcase(stmt, cur);
        }
        if kind == StatementKind::EventTrigger {
            return self.walk_event_trigger(stmt, cur);
        }
        if kind == StatementKind::ExpressionStatement && async_pla_call(&stmt).is_some() {
            return self.walk_async_pla(stmt, cur);
        }
        if kind == StatementKind::DisableFork {
            // SC-125: never suspends -- an ordinary straight-line statement
            // that codegen lowers to a `sv_rt_disable_fork` call.
            self.push(cur, stmt);
            return Ok(cur);
        }
        if kind == StatementKind::Disable {
            // `disable blk;` inside `blk`: leave the block, like `break`
            // leaves a loop (LRM 1800-2023 §9.6.2). The target is read from
            // the statement's source text (`disable_label`).
            // `disable outer.inner;` (9.6.2 hierarchical block name) naming a
            // chain of this process's own lexically enclosing blocks is the
            // same jump as `disable inner;`.
            let mut label_override = None;
            if let Some(path) = disable_path(&stmt) {
                if let Some(next) = self.walk_hier_disable_of_enclosing(stmt, cur, &path)? {
                    return Ok(next);
                }
                // A block nested in another process's scope, named through
                // that scope's blocks (`disable p.inner;`).
                label_override = Some(self.hier_peer_leaf(&path)?);
            }
            let label = match label_override {
                Some(l) => l,
                None => disable_label(&stmt)?,
            };
            // `disable f;` inside a branch of fork `f`: ends every branch
            // (codegen's runtime call), this one included.
            if !self.disable_targets.iter().any(|(n, _, _)| *n == label)
                && self.fork_name.as_deref() == Some(label.as_str())
            {
                self.push(cur, stmt);
                self.close(cur, Terminator::End { loop_back: None });
                return Ok(self.alloc_block());
            }
            if let Some(pos) = self
                .disable_targets
                .iter()
                .rposition(|(n, _, _)| *n == label)
            {
                let (_, exit, frames) = self.disable_targets[pos].clone();
                // 16.14.6.4: disabling the process's outermost scope also
                // flushes its pending procedural assertion queue; a nested
                // block does not. Codegen turns the kept statement into the
                // flush.
                let flush = pos == 0 && self.outermost.as_deref() == Some(label.as_str());
                // A task activation, or a block inside one, can be live in
                // other processes too (LRM 9.6.2: every activation ends): the
                // kept statement also reaches them at run time.
                let broadcast = frames > 0;
                // LRM 9.6.2: leaving the block ends the activities enabled
                // within it, the fork branches still running among them
                // (tagged with the block's name, `disable_names`).
                let ends_branches =
                    !broadcast && self.forks_in_body() && is_disabled_somewhere(&label);
                if flush || broadcast || ends_branches {
                    self.push(cur, stmt);
                }
                if broadcast || ends_branches {
                    self.disable_broadcast.push((label.clone(), false));
                }
                self.disable_probe(cur, stmt);
                // The inlined tasks the jump leaves end here, innermost first.
                let left: Vec<_> = self.frame_stack[frames..].iter().rev().cloned().collect();
                for (task, vars) in left {
                    self.frame_probe(cur, FrameProbe::Exit { task, vars });
                }
                self.left_block_events(cur, pos);
                self.jump(cur, exit);
                return Ok(self.alloc_block());
            }
            // `disable a1;` of a procedural concurrent assertion's label
            // (16.14.6.4) clears that assertion's pending instances and goes
            // on: the statement is kept for codegen.
            if self.assertion_labels.contains(&label) {
                self.push(cur, stmt);
                return Ok(cur);
            }
            // `disable a1;` of a deferred immediate assertion's label (16.4.4):
            // cancels its pending reports and goes on; kept for codegen.
            if self.deferred_labels.contains(&label) {
                self.push(cur, stmt);
                return Ok(cur);
            }
            // `disable L;` of a plain immediate assertion's label from outside
            // its statement: the statement has finished, nothing to end.
            if self.immediate_labels.contains(&label) {
                return Ok(cur);
            }
            // `disable b2;` of another process's outermost block (16.14.6.4,
            // the `b3` example): the other process cannot be inside a block
            // without a suspend point, so the disable's whole effect is that
            // process's queue flush.
            if let Some(can_suspend) = self
                .peers
                .iter()
                .find(|p| p.name == label)
                .map(|p| p.can_suspend)
            {
                self.push(cur, stmt);
                // A block with a suspend point may have its process inside it:
                // the disable then resumes that process after the block
                // (`sv_rt_disable_named`, `ProcessCfg::disable_scopes`).
                if can_suspend {
                    self.disable_broadcast.push((label, true));
                }
                return Ok(cur);
            }
            // `disable u1.blk;` of a block of a child instance: every process
            // of that instance suspended inside the block resumes after it.
            if label.contains('.') {
                self.push(cur, stmt);
                self.disable_broadcast.push((label, true));
                return Ok(cur);
            }
            // `disable t;` of a task of the design that this process is not in:
            // it ends every activation of `t` in the other processes (LRM
            // 9.6.2) and the process goes on.
            if is_task_name(&label) {
                self.push(cur, stmt);
                self.disable_broadcast.push((label, true));
                return Ok(cur);
            }
            // LRM 9.6.2: `label` is a fork branch's own named outermost
            // block reachable from here -- the fork's parent (continuing
            // past it), a sibling branch, or a descendant of an ancestor
            // fork -- but not through a same-process lexically enclosing
            // block or this CFG's own `fork_name` (both already checked
            // above). Kept as an ordinary statement: codegen (`sv-sim-
            // codegen::process_lower`) tells this case apart from the ones
            // above by `ProcessLoweringPlan::fork_branch_names` and lowers
            // it to a runtime scan/kill of every live, so-tagged process
            // reachable from the caller's own fork family
            // (`sv_sim_sim::sched::SchedulerOps::disable_named`) -- never a
            // silent no-op when nothing is currently live (the same
            // "already finished, nothing to do" convention `disable fork;`
            // itself uses, LRM 9.6.3).
            if self.fork_branch_names.iter().any(|n| n == &label) {
                self.push(cur, stmt);
                return Ok(cur);
            }
            // LRM 9.6.2: `label` is a named block of the forking process
            // that encloses the fork this branch belongs to. The disable
            // ends all activity in the block: the siblings, this branch, and
            // the parent's wait at the join, which resumes after the block
            // (`sv_rt_disable_named`, the parent's `disable_scopes`). This
            // branch ends here, like `disable <fork name>;` above.
            if self.ancestor_blocks.iter().any(|n| n == &label) {
                self.push(cur, stmt);
                self.disable_broadcast.push((label, true));
                self.close(cur, Terminator::End { loop_back: None });
                return Ok(self.alloc_block());
            }
            return Err(LoweringError::unsupported(format!(
                "disable {label}; where `{label}` is not a named block or task enclosing it \
                 in the same process, a procedural assertion label of it, a uniquely named \
                 sequential block of another process or a task of the design (not a block \
                 inside a fork branch of another process, nor a name shared by two blocks), \
                 or a fork branch's own name reachable from here"
            )));
        }
        if kind == StatementKind::ForLoop {
            return self.walk_for_loop(stmt, cur);
        }
        if kind == StatementKind::WhileLoop {
            return self.walk_while_loop(stmt, cur);
        }
        if kind == StatementKind::DoWhileLoop {
            return self.walk_do_while_loop(stmt, cur);
        }
        if kind == StatementKind::ForeverLoop {
            return self.walk_forever_loop(stmt, cur);
        }
        if kind == StatementKind::ForeachLoop {
            return self.walk_foreach_loop(stmt, cur);
        }
        // R-run Task 8 (PR-045/PR-006): `repeat(N) body;` gets a real CFG
        // `Loop` shape ONLY when `body` contains a suspend point somewhere
        // in its own subtree -- a suspend inside a `repeat` needs its own
        // iteration counter to survive the resulting suspend/resume call
        // boundary (see `RepeatCounterId`'s own doc comment), which only a
        // real CFG split can provide. The suspend-free case stays exactly
        // the pre-existing opaque leaf `is_ordinary_statement_kind` already
        // routes to `stmt_shared::lower_repeat_loop` (R-run Task 4) --
        // falling through to that check below, unchanged, whenever this
        // condition is false, deliberately preserving
        // `repeat_loop_control_flow_shape_matches_between_function_and_
        // process_paths`'s own "a suspend-free repeat loop stays an
        // ordinary, un-decomposed leaf statement" invariant
        // (`shared_stmt_lowering.rs`).
        if kind == StatementKind::RepeatLoop
            && (contains_suspend_trigger(stmt.as_sem_node())
                || escapes(stmt.as_sem_node(), false, !self.return_targets.is_empty()))
        {
            return self.walk_repeat_loop(stmt, cur);
        }

        // R-run Task 1: `$finish`/`$stop`/`$fatal` are a segment-closing
        // point, same category as a suspend -- LRM 1800-2023 §20.2/§20.10:
        // once one of these executes, none of the calling process's own
        // textually-following statements may ever run (not just the next
        // one in a flat statement list -- also not one nested arbitrarily
        // deep inside an `if`/`case`/loop branch this "ordinary straight-
        // line" arm below would otherwise happily keep pushing into the
        // SAME still-open block). This is checked before the generic
        // `is_ordinary_statement_kind` dispatch below (an `ExpressionStatement`
        // wrapping one of these calls is itself an ordinary-kind statement,
        // so without this earlier check it would fall straight into that
        // arm and keep accumulating every statement that follows it into
        // `cur`).
        //
        // Reuses the existing `Terminator::End { loop_back: None }` shape
        // (PR-069's "no new enum catch-all" extension policy) rather than a
        // new `Terminator::Halt`/`Terminator::Finish` variant: this closes
        // `cur` as a real process-kernel exit (`SegTerminator::End{loop_back:
        // None}` -> the compiled kernel returns `SEG_FINISHED` for this
        // call, per `lower_terminator`'s existing 1:1 mapping), unconditionally
        // `loop_back: None` even inside an `always`/`always_ff` process
        // (`ProcessLoopKind::Looping` would otherwise close the process's
        // FINAL block with `Some(entry)`) -- once `$finish`/`$stop`/`$fatal`
        // runs, the calling process itself must never be re-entered again,
        // regardless of what kind of process it is; the *global* simulation
        // shutdown that a bare `$finish`/`$stop` also requests is a
        // scheduler-level concern (`SchedulerOps::request_finish`,
        // `sv_rt_finish`'s own doc comment) this file has no visibility
        // into and does not need to model.
        //
        // Any statement textually following the call (whether later in this
        // same flat list, as `walk_seq`'s next loop iteration, or -- via
        // this function's own caller chain, e.g. `walk_conditional` closing
        // `then_exit`/`else_exit` with `Terminator::Fallthrough(join)` --
        // structurally nested deeper) is walked into a FRESH block instead
        // of `cur`: `cur` is already closed, so it can never be reached
        // again, and neither can anything later routed into the fresh
        // block, since nothing in this builder ever branches to a block
        // this function itself did not just hand back as "the current
        // exit" to some earlier, still-open predecessor -- there is none
        // here. The fresh block still gets a real terminator from whatever
        // caller eventually closes it (a plain, harmless `Fallthrough`/
        // `End` on dead code), satisfying `finish()`'s "every block must be
        // closed" invariant without special-casing unreachable blocks.
        // A call to a task whose body can suspend is inlined here, so its
        // timing controls become real suspend points of this process.
        if kind == StatementKind::ExpressionStatement
            && let Some(e) = stmt.expr()
            && crate::netlist::itf::is_vif_extern_call(&e)
        {
            return Err(LoweringError::unsupported(
                crate::netlist::itf::vif_extern_message(&e),
            ));
        }
        if kind == StatementKind::ExpressionStatement
            && let Some(e) = stmt.expr()
            && let Some(targets) = crate::netlist::itf::call_extern_targets(&e)
            && let Some(next) = self.walk_extern_call(stmt, e, &targets, cur)?
        {
            return Ok(next);
        }
        if kind == StatementKind::ExpressionStatement
            && let Some(e) = stmt.expr()
            && let Some(callee) = suspending_task_callee(&e)
        {
            return self.inline_task_call(e, callee, cur);
        }
        if matches!(kind, StatementKind::Break | StatementKind::Continue) {
            let &(cont, brk) = self
                .loop_targets
                .last()
                .ok_or_else(|| LoweringError::malformed(format!("{kind:?} outside any loop")))?;
            let target = if kind == StatementKind::Break {
                brk
            } else {
                cont
            };
            self.jump(cur, target);
            return Ok(self.alloc_block());
        }
        if (kind == StatementKind::Case || kind == StatementKind::PatternCase)
            && (contains_suspend_trigger(stmt.as_sem_node())
                || constant_case_live_arm(&stmt).is_some()
                || escapes(
                    stmt.as_sem_node(),
                    !self.loop_targets.is_empty(),
                    !self.return_targets.is_empty(),
                ))
        {
            return self.walk_case(stmt, cur);
        }
        if kind == StatementKind::ImmediateAssertion
            && let Some(actions) = suspending_assertion_actions(&stmt)
        {
            return self.walk_immediate_assertion(stmt, actions, cur);
        }
        if kind == StatementKind::ExpressionStatement
            && let Some(e) = stmt.expr()
            && e.kind() == ExpressionKind::Assignment
            && e.is_nonblocking() != Some(true)
            && e.assignment_timing().is_some()
        {
            return self.walk_intra_assignment_timing(e, cur);
        }
        // `q <= @(e) v;` / `q <= repeat (n) @(e) v;` (LRM 10.4.2). A plain
        // delay stays a statement: the staged write carries it.
        if kind == StatementKind::ExpressionStatement
            && let Some(e) = stmt.expr()
            && e.kind() == ExpressionKind::Assignment
            && e.is_nonblocking() == Some(true)
            && e.assignment_timing()
                .and_then(|n| n.as_timing_control())
                .is_some_and(|tc| tc.kind() != TimingControlKind::Delay)
        {
            return self.walk_nba_event(stmt, e, cur);
        }
        if kind == StatementKind::Return
            && let Some(&target) = self.return_targets.last()
        {
            // `return;` inside an inlined task: jump past the task body.
            // `return expr;` of an inlined function first assigns its result
            // variable (in a block of its own: bindings run on block entry).
            let mut cur = cur;
            if self.ret_var_stack.len() == self.return_targets.len()
                && let Some(Some(rv)) = self.ret_var_stack.last().copied()
                && let Some(value) = stmt.expr()
            {
                if let Some(next) = self.hoist_suspending_calls_in(value.as_sem_node(), cur)? {
                    cur = next;
                }
                let set = self.alloc_block();
                self.close(cur, Terminator::Fallthrough(set));
                self.blocks[set.0 as usize].bindings.push(ArgBinding::In {
                    formal: rv,
                    actual: value,
                });
                cur = set;
            }
            self.jump(cur, target);
            return Ok(self.alloc_block());
        }
        if kind == StatementKind::ExpressionStatement && is_finish_or_stop_call(&stmt) {
            self.push(cur, stmt);
            self.close(cur, Terminator::End { loop_back: None });
            return Ok(self.alloc_block());
        }

        // PR-006's own acceptance text: "any other kind is ordinary
        // straight-line code". Kept as one opaque `Statement` leaf unless it
        // secretly contains a suspend-triggering construct somewhere in its
        // subtree, in which case there is no `Terminator::Loop`/`Case` to
        // represent the needed split (see this file's module doc comment's
        // extension policy) -- a named `LoweringError`, never a
        // silently-wrong CFG.
        if is_ordinary_statement_kind(kind) {
            if kind == StatementKind::ExpressionStatement
                && contains_suspend_trigger(stmt.as_sem_node())
                && let Some(next) = self.hoist_suspending_function_calls(stmt, cur)?
            {
                return Ok(next);
            }
            return if contains_suspend_trigger(stmt.as_sem_node())
                && !(is_expect(&stmt) && self.expect_as_leaf)
            {
                Err(LoweringError::unsupported(format!(
                    "suspend point nested inside a {kind:?} statement (no CFG terminator \
                     for this construct is implemented in this task, PR-069)"
                )))
            } else {
                self.push(cur, stmt);
                if kind == StatementKind::ExpressionStatement
                    && has_function_disables()
                    && contains_subroutine_call(stmt.as_sem_node())
                {
                    return Ok(self.fn_disable_check(cur));
                }
                Ok(cur)
            };
        }

        // Unreachable as long as `determinism::kind_guard`'s pinned
        // `StatementKind::COUNT == 32` still holds -- every one of today's 32
        // variants is named above or in `is_ordinary_statement_kind`. A
        // `sv-lang-kinds` bump that adds a 33rd fails that pinned-count test
        // loudly; until this file is reviewed and updated, reaching here is a
        // named error, never a silent fallthrough.
        Err(LoweringError::malformed(format!(
            "unrecognized StatementKind {kind:?} (sv-lang-kinds version drift -- see \
             determinism::kind_guard's StatementKind pin)"
        )))
    }

    /// `expect (property) pass else fail;` (LRM 1800-2023 §16.17): blocks the
    /// process until the assertion engine has decided the property.
    ///
    /// The statement appears twice, as the assertion's two halves. In the block
    /// it is reached in, it queues the evaluation (codegen's
    /// `sv_rt_proc_assert`); the process then parks with no sensitivity at all
    /// (an empty [`SuspendPoint::EdgeList`]) until the engine, in the Observed
    /// region of the step it decides in, wakes it. In the block it resumes into
    /// ([`BasicBlock::expect_resume`]) it runs the pass or `else` statement, and
    /// whatever follows the `expect` goes on from there.
    fn walk_expect(&mut self, stmt: Statement<'d>, cur: BlockId) -> Result<BlockId, LoweringError> {
        let blocking = [stmt.assertion_if_true(), stmt.assertion_if_false()]
            .into_iter()
            .flatten()
            .any(|a| contains_suspend_trigger(a.as_sem_node()));
        if blocking {
            return self.walk_expect_blocking(stmt, cur);
        }
        self.push(cur, stmt);
        let resume = self.alloc_block();
        self.blocks[resume.0 as usize].expect_resume = true;
        self.close(
            cur,
            Terminator::Suspend {
                point: SuspendPoint::EdgeList(Vec::new(), Vec::new()),
                resume_blk: resume,
            },
        );
        self.push(resume, stmt);
        Ok(resume)
    }

    /// An `expect` whose pass or `else` action blocks (a delay, an event
    /// control, a wait, another `expect`; LRM 1800-2023 16.17 allows any
    /// statement there). The action cannot run inline in the resume
    /// segment, so the resume block switches on the outcome the engine woke
    /// the process with (`sv_rt_fired_term`: 0 pass, 1 fail, 2 -- actions
    /// switched off by `$assertcontrol`, 20.11 -- neither) and walks each
    /// action as ordinary blocks. A fail with no `else` reports the `$error`
    /// through a zero-arm switch, as `wait_order` does.
    fn walk_expect_blocking(
        &mut self,
        stmt: Statement<'d>,
        cur: BlockId,
    ) -> Result<BlockId, LoweringError> {
        self.push(cur, stmt);
        let resume = self.alloc_block();
        self.close(
            cur,
            Terminator::Suspend {
                point: SuspendPoint::EdgeList(Vec::new(), Vec::new()),
                resume_blk: resume,
            },
        );
        let join = self.alloc_block();
        let pass = self.alloc_block();
        let fail = self.alloc_block();
        let pass_exit = match stmt.assertion_if_true() {
            Some(s) => self.walk_stmt(s, pass)?,
            None => pass,
        };
        self.close(pass_exit, Terminator::Fallthrough(join));
        let fail_exit = match stmt.assertion_if_false() {
            Some(s) => self.walk_stmt(s, fail)?,
            None => {
                self.close(
                    fail,
                    Terminator::Switch {
                        on: SwitchOn::FiredTerm,
                        arms: Vec::new(),
                        default_blk: join,
                        report: Some(stmt.source_range().start),
                    },
                );
                self.alloc_block()
            }
        };
        self.close(fail_exit, Terminator::Fallthrough(join));
        self.close(
            resume,
            Terminator::Switch {
                on: SwitchOn::FiredTerm,
                arms: vec![pass, fail, join],
                default_blk: join,
                report: None,
            },
        );
        Ok(join)
    }

    /// A `randcase` whose items need their own blocks (one suspends, or
    /// escapes an enclosing loop or task): [`SwitchOn::RandCase`] picks one.
    fn walk_randcase(
        &mut self,
        stmt: Statement<'d>,
        cur: BlockId,
    ) -> Result<BlockId, LoweringError> {
        let join = self.alloc_block();
        let mut arms = Vec::new();
        for item in stmt.randcase_items() {
            let arm = self.alloc_block();
            arms.push(arm);
            let exit = self.walk_stmt(item.stmt(), arm)?;
            self.close(exit, Terminator::Fallthrough(join));
        }
        self.close(
            cur,
            Terminator::Switch {
                on: SwitchOn::RandCase(stmt),
                arms,
                default_blk: join,
                report: None,
            },
        );
        Ok(join)
    }

    /// `wait_order(e1, ..., en) pass else fail;` (LRM 1800-2023 §15.5.4):
    /// step `i` waits on `e_i` .. `e_n`, and goes on only if `e_i` is the one
    /// that fired (the wait's term 0, [`SwitchOn::FiredTerm`]) -- any other
    /// fires out of order and fails. After `e_n`, the pass action; a
    /// failure without an `else` reports `$error`.
    fn walk_wait_order(
        &mut self,
        stmt: Statement<'d>,
        cur: BlockId,
    ) -> Result<BlockId, LoweringError> {
        let events = stmt.wait_order_events();
        if events.is_empty() {
            return Err(LoweringError::malformed("wait_order with no events"));
        }
        let pass = self.alloc_block();
        let fail = self.alloc_block();
        let join = self.alloc_block();
        let if_false = stmt.wait_order_if_false();
        let report = if_false.is_none().then(|| stmt.source_range().start);
        let mut at = cur;
        for i in 0..events.len() {
            let resume = self.alloc_block();
            self.close(
                at,
                Terminator::Suspend {
                    point: SuspendPoint::EdgeList(
                        events[i..]
                            .iter()
                            .map(|e| (*e, sv_lang::EdgeKind::None))
                            .collect(),
                        vec![Vec::new(); events.len() - i],
                    ),
                    resume_blk: resume,
                },
            );
            let next = if i + 1 == events.len() {
                pass
            } else {
                self.alloc_block()
            };
            self.close(
                resume,
                Terminator::Switch {
                    on: SwitchOn::FiredTerm,
                    arms: vec![next],
                    default_blk: fail,
                    report,
                },
            );
            at = next;
        }
        let pass_exit = match stmt.wait_order_if_true() {
            Some(s) => self.walk_stmt(s, pass)?,
            None => pass,
        };
        self.close(pass_exit, Terminator::Fallthrough(join));
        let fail_exit = match if_false {
            Some(s) => self.walk_stmt(s, fail)?,
            None => fail,
        };
        self.close(fail_exit, Terminator::Fallthrough(join));
        Ok(join)
    }

    /// Inlines `call` (to `task`, whose body can suspend) at `cur`: a fresh
    /// entry block binds the formals ([`ArgBinding::In`]/[`ArgBinding::
    /// Init`]) and initializes the task's locals, the body is walked in
    /// place (a `return;` jumps to the continuation), and the continuation
    /// block starts with the output copy-backs ([`ArgBinding::Out`]).
    fn inline_task_call(
        &mut self,
        call: Expression<'d>,
        task: Symbol<'d>,
        cur: BlockId,
    ) -> Result<BlockId, LoweringError> {
        let result_temp = self.pending_result_temp.take();
        // Through a virtual interface (`vif.t(...)`): the task of the
        // instance it selects -- one inlined copy per candidate instance
        // (`netlist::vif`), picked by its id; `null` runs nothing.
        if let Some((vif, targets)) = crate::netlist::vif::call_targets(&call) {
            let actuals: Vec<Expression<'d>> = call.operands()[1..].to_vec();
            let join = self.alloc_block();
            let mut arms = Vec::new();
            for target in targets {
                let arm = self.alloc_block();
                arms.push(arm);
                match target {
                    Some(t) => {
                        let exit = self.inline_task_body(&actuals, t, arm, None)?;
                        self.park_call_result(exit, result_temp, t);
                        self.close(exit, Terminator::Fallthrough(join));
                    }
                    None => self.close(arm, Terminator::Fallthrough(join)),
                }
            }
            self.close(
                cur,
                Terminator::Switch {
                    on: SwitchOn::VifId(vif),
                    arms,
                    default_blk: join,
                    report: None,
                },
            );
            return Ok(join);
        }
        // A class-method task (LRM 8.6): its `this` is bound to the receiver
        // (`obj.run()`), or for an implicit-`this` call (`run()` inside
        // another method) to the caller's current object, and kept in a frame
        // local across the suspend points.
        self.call_anchor = Some(call);
        let receiver = call.call_this_class();
        let mut actuals = call.operands();
        if receiver.is_some() && !actuals.is_empty() {
            actuals.remove(0);
        }
        // A `pure virtual` task has no body and so no `this` of its own; its
        // calls still dispatch over the implementations below (LRM 8.21).
        let pure = task.subroutine_flags().contains(sv_lang::MethodFlags::PURE);
        let this_var = task.subroutine_this_var();
        if this_var.is_none() && !pure {
            let exit = self.inline_task_body(&actuals, task, cur, None)?;
            self.park_call_result(exit, result_temp, task);
            return Ok(exit);
        }
        // A virtual task is bound by the object's class at run time (LRM
        // 8.20): one inlined override per implementation the possible dynamic
        // classes resolve it to, picked by the object's class. A call through
        // `super.` is not virtual.
        if !(receiver.is_none() && is_explicit_super(call))
            && (task
                .subroutine_flags()
                .contains(sv_lang::MethodFlags::VIRTUAL)
                || task.subroutine_override().is_some())
        {
            let impls = self
                .virtual_tasks
                .as_ref()
                .map(|v| v.implementations(&task))
                .unwrap_or_default();
            // No class the design creates implements it: no object can
            // reach the call, so it can only run on a null handle (an
            // error at run time, as for any call through `null`). E.g. UVM's
            // `uvm_sequencer_base::start_phase_sequence` in a bench with no
            // sequencer.
            let join = self.alloc_block();
            let mut arms = Vec::new();
            let mut ids = Vec::new();
            for (class_ids, imp) in impls {
                let this_var = imp.subroutine_this_var().ok_or_else(|| {
                    LoweringError::malformed(format!(
                        "override of virtual task `{}` has no `this`",
                        task.name()
                    ))
                })?;
                let arm = self.alloc_block();
                arms.push(arm);
                ids.push(class_ids);
                let exit = self.inline_task_body(&actuals, imp, arm, Some((this_var, receiver)))?;
                self.park_call_result(exit, result_temp, imp);
                self.close(exit, Terminator::Fallthrough(join));
            }
            self.close(
                cur,
                Terminator::Switch {
                    on: SwitchOn::ObjClass { receiver, ids },
                    arms,
                    default_blk: join,
                    // A null (or dead) handle runs no override: an error.
                    report: Some(call.source_range().start),
                },
            );
            return Ok(join);
        }
        let this_var = this_var.ok_or_else(|| {
            LoweringError::malformed(format!("method task `{}` has no `this`", task.name()))
        })?;
        let exit = self.inline_task_body(&actuals, task, cur, Some((this_var, receiver)))?;
        self.park_call_result(exit, result_temp, task);
        Ok(exit)
    }

    /// At the end of an inlined function `imp` (block `exit`): copies its
    /// result variable into the call's capture temporary, when it has one.
    fn park_call_result(
        &mut self,
        exit: BlockId,
        result_temp: Option<(u32, Expression<'d>)>,
        imp: Symbol<'d>,
    ) {
        if let Some((temp, _)) = result_temp
            && let Some(rv) = imp.subroutine_return_val_var()
        {
            self.blocks[exit.0 as usize]
                .bindings
                .push(ArgBinding::ToCaptured { temp, formal: rv });
        }
    }

    /// The first call of a task that calls itself (directly or through other
    /// tasks) and contains timing controls (LRM 1800-2023 §13.4, §13.4.1):
    /// inlining cannot bound the depth, so each activation is a forked child
    /// of its caller that the caller joins. The caller evaluates the
    /// arguments now ([`ArgBinding::Capture`]), the child copies them into
    /// its own formals ([`ArgBinding::FromCaptured`]) and runs the body in a
    /// frame of its own (automatic variables, §6.21); a call inside the body
    /// forks the same kernel again ([`Self::recursive_self_call`]).
    ///
    /// `output` and `inout` formals (LRM 1800-2023 13.5) are copied out when
    /// the activation ends: parked in a temporary ([`ArgBinding::ToCaptured`]),
    /// handed to the spawner's own temporary ([`InheritedSlot::Return`]) and
    /// assigned to the actual after the join ([`ArgBinding::AssignCaptured`]).
    /// They are limited to what a capture temporary holds (a packed value of
    /// at most 128 bits).
    ///
    /// A class method (LRM 1800-2023 8.11) also takes its `this` as capture 0
    /// (an implicit receiver by [`ArgBinding::CaptureThis`]). A recursive
    /// void function that spawns processes is handled the same way; its
    /// `join_none` children may then start earlier than in a call that never
    /// yields (the caller waits at each recursive join).
    ///
    /// Deviation: the activation is a fork child, so `disable fork` and
    /// `wait fork` of the caller see it; only tasks with automatic lifetime
    /// are supported (`ref` / static formals and a `disable` of the task fail
    /// by name).
    fn inline_recursive_task(
        &mut self,
        actuals: &[Expression<'d>],
        task: Symbol<'d>,
        cur: BlockId,
        this: Option<(Symbol<'d>, Option<Expression<'d>>)>,
    ) -> Result<BlockId, LoweringError> {
        let refuse = |why: &str| {
            LoweringError::unsupported(format!(
                "recursive call to task `{}`, which contains timing controls: {why} \
                 (LRM 1800-2023 13.4.1)",
                task.name()
            ))
        };
        let body = proc_body(&task).ok_or_else(|| {
            LoweringError::malformed(format!("task `{}` has no body", task.name()))
        })?;
        let mut formals: Vec<Symbol<'d>> = task.subroutine_arguments().collect();
        if formals.len() != actuals.len() {
            return Err(LoweringError::malformed(format!(
                "call to task `{}` has {} arguments for {} formals",
                task.name(),
                actuals.len(),
                formals.len()
            )));
        }
        if task.subroutine_kind() == Some(sv_lang::SubroutineKind::Function)
            && task.subroutine_return_type().is_some_and(|t| !t.is_void())
        {
            return Err(refuse("a value-returning function is not supported"));
        }
        for f in &formals {
            if crate::netlist::is_static_procedural_var(f) {
                return Err(refuse("a recursive task must be `automatic`"));
            }
        }
        // slang binds an output/inout actual as `actual = <formal>`: the
        // actual is its target.
        let mut actuals: Vec<Expression<'d>> = actuals
            .iter()
            .zip(&formals)
            .map(|(&a, f)| {
                if f.formal_argument_direction() == sv_lang::ArgumentDirection::In {
                    a
                } else {
                    call_actual_lvalue(a)
                }
            })
            .collect();
        // A class method: its `this` is formal 0, an input handle.
        let has_this = this.is_some();
        let mut implicit_this = false;
        if let Some((this_var, recv)) = this {
            let anchor = self.call_anchor.ok_or_else(|| {
                LoweringError::malformed("recursive method call without a call expression")
            })?;
            implicit_this = recv.is_none();
            formals.insert(0, this_var);
            actuals.insert(0, recv.unwrap_or(anchor));
        }
        let n = formals.len() as u32;
        let actuals = &actuals[..];
        // A `ref` formal bound to static storage (a variable or a net, directly or
        // through an enclosing call's aliased `ref`) is that storage in every
        // activation (LRM 1800-2023 13.5.2): no capture, no copy-back. Every
        // recursive call must bind it to the same storage
        // ([`Self::recursive_self_call`]); anything else is refused by name.
        let mut ref_alias: Vec<Option<Symbol<'d>>> = vec![None; formals.len()];
        for (i, f) in formals.iter().enumerate() {
            if f.formal_argument_direction() != sv_lang::ArgumentDirection::Ref {
                continue;
            }
            let is_event = f
                .value_type()
                .as_ref()
                .is_some_and(|t| crate::state::event_pool::event_count(t).is_some());
            match self.ref_storage(actuals[i]) {
                Some(t) if !is_event => ref_alias[i] = Some(t),
                _ => {
                    return Err(refuse(
                        "a `ref` argument must name a static variable or net (or an \
                         enclosing task's aliased `ref` formal)",
                    ));
                }
            }
        }
        let is_in = |i: usize| {
            (has_this && i == 0)
                || formals[i].formal_argument_direction() == sv_lang::ArgumentDirection::In
                || ref_alias[i].is_some()
        };
        let outs: Vec<usize> = (0..formals.len()).filter(|&i| !is_in(i)).collect();
        let groups = if outs.is_empty() { 2 } else { 4 };

        // The branch: its own builder. Capture temporaries `0..n` hold the
        // incoming arguments, `n..2n` those of a recursive call; with
        // `output`/`inout` formals `2n..3n` hold this activation's results
        // and `3n..4n` those of a recursive call.
        // The same task activated from the same context builds the same
        // Root: build it once per process ([`RootKey`]) and the lowering
        // compiles it once ([`ProcessCfg::share_id`]); only the call site's
        // bindings below are per site. Not under a clock inference.
        let key = (self.global_clock.is_none() && self.checker_clock.is_none()).then(|| {
            MemoKey::Root(RootKey {
                task: task.uid(),
                this_var: this.map(|(t, _)| t.uid()),
                default_clocking: self.default_clocking.map(|c| c.uid()),
                rec_outer: self.rec_outer.clone(),
                chain: self
                    .rec_up
                    .iter()
                    .chain(self.rec.iter())
                    .map(|r| r.share)
                    .collect(),
                ref_aliases: self
                    .ref_stack
                    .iter()
                    .map(|(f, t)| (f.uid(), t.uid()))
                    .chain(
                        formals
                            .iter()
                            .zip(&ref_alias)
                            .filter_map(|(f, t)| t.map(|t| (f.uid(), t.uid()))),
                    )
                    .collect(),
                labels: self.fork_branch_names.clone(),
                ancestors: self.ancestor_blocks.clone(),
            })
        });
        let cached = key
            .as_ref()
            .and_then(|k| self.fork_memo.borrow().get(k).cloned());
        let mut branch = if let Some(hit) = cached {
            hit
        } else {
            let share = NEXT_SHARE_ID.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
            let mut b = CfgBuilder::new();
            b.fork_memo = self.fork_memo.clone();
            b.global_clock = self.global_clock;
            b.virtual_tasks = self.virtual_tasks.clone();
            b.fork_branch_names = self.fork_branch_names.clone();
            b.ancestor_blocks = self.ancestor_blocks.clone();
            b.default_clocking = self.default_clocking;
            b.checker_clock = self.checker_clock;
            b.rec_outer = self.rec_outer.clone();
            b.rec_outer.push(task.uid());
            b.rec_up = self.rec_up.clone();
            b.rec_up.extend(self.rec.clone());
            b.rec = Some(RecursiveTask {
                task: task.uid(),
                share,
                proto: actuals
                    .iter()
                    .copied()
                    .zip(formals.iter().copied())
                    .collect(),
                n,
                groups,
                outs: (0..formals.len()).map(|i| !is_in(i)).collect(),
                refs: ref_alias.clone(),
                has_this,
                body,
            });
            b.ref_stack = self.ref_stack.clone();
            for (f, t) in formals.iter().zip(&ref_alias) {
                if let Some(t) = t {
                    b.ref_stack.push((*f, *t));
                    b.ref_candidates.push((*f, Some(*t)));
                }
            }
            if let Some((this_var, _)) = this {
                b.this_stack.push(this_var);
            }
            for _ in 0..groups {
                for (f, &a) in formals.iter().zip(actuals) {
                    b.set_capture_type(a, *f);
                }
            }
            let entry = b.alloc_block();
            for (i, f) in formals.iter().enumerate() {
                // An `output` formal starts out as its type's default.
                if ref_alias[i].is_some() {
                    continue;
                }
                b.blocks[entry.0 as usize].bindings.push(
                    if !is_in(i) && f.formal_argument_direction() == sv_lang::ArgumentDirection::Out
                    {
                        ArgBinding::Init { var: *f }
                    } else {
                        ArgBinding::FromCaptured {
                            temp: i as u32,
                            formal: *f,
                        }
                    },
                );
                b.inlined_locals.push(*f);
            }
            for local in task_locals(&task) {
                // A method's `this` is bound above (formal 0).
                if this.is_some_and(|(t, _)| t.uid() == local.uid()) {
                    continue;
                }
                if crate::netlist::is_static_procedural_var(&local) {
                    continue;
                }
                if !is_automatic_block_var(&local) {
                    b.blocks[entry.0 as usize]
                        .bindings
                        .push(ArgBinding::Init { var: local });
                }
                b.inlined_locals.push(local);
            }
            for v in crate::patterns::pattern_vars(body.as_sem_node()) {
                if !b.inlined_locals.iter().any(|l| l.uid() == v.uid()) {
                    b.inlined_locals.push(v);
                }
            }
            let after = b.alloc_block();
            b.target_depth.insert(after, 0);
            b.return_targets.push(after);
            // `disable task;` ends every activation (LRM 9.6.2): each one's exit
            // is the end of its own kernel.
            let task_name = task.name().to_string();
            let task_scoped = is_disabled_somewhere(&task_name);
            if task_scoped {
                b.scope_chain
                    .push((task_name.clone(), after, b.frame_stack.len()));
                b.disable_targets
                    .push((task_name, after, b.frame_stack.len()));
            }
            // LRM 19.3 / 19.5.5: every activation signals the task's `begin` at
            // its first statement and `end` at its exit block (also reached by a
            // `disable task;`), like an inlined call.
            b.block_event(entry, task, false);
            b.event_stack.push((task, b.disable_targets.len()));
            let exit = b.walk_stmt(body, entry);
            b.event_stack.pop();
            if task_scoped {
                b.scope_chain.pop();
                b.disable_targets.pop();
            }
            let exit = exit?;
            b.close(exit, Terminator::Fallthrough(after));
            b.block_event(after, task, true);
            for &i in &outs {
                b.blocks[after.0 as usize]
                    .bindings
                    .push(ArgBinding::ToCaptured {
                        temp: 2 * n + i as u32,
                        formal: formals[i],
                    });
            }
            b.close(after, Terminator::End { loop_back: None });
            let inlined_locals = std::mem::take(&mut b.inlined_locals);
            let captures = std::mem::take(&mut b.captures);
            let capture_types = std::mem::take(&mut b.capture_types);
            let b_ref_formals: Vec<Symbol<'d>> = b.ref_stack.iter().map(|&(f, _)| f).collect();
            let ref_bindings = b.take_ref_bindings();
            let disable_scopes = b.take_disable_scopes();
            let disable_broadcast = std::mem::take(&mut b.disable_broadcast);
            let fork_branch_names = std::mem::take(&mut b.fork_branch_names);
            let mut built = ProcessCfg {
                blocks: b.finish(),
                entry,
                body,
                inlined_locals,
                captures,
                captured: Vec::new(),
                ref_bindings,
                disable_names: Vec::new(),
                fork_branch_names,
                disable_scopes,
                disable_broadcast,
                inherited: Vec::new(),
                capture_types,
                recursion: Recursion::Root,
                share_id: None,
            };
            built.captured = captured_vars(&built);
            built
                .captured
                .retain(|c| !b_ref_formals.iter().any(|f| f.uid() == c.uid()));
            if let Some(k) = key {
                built.share_id = Some(share);
                self.fork_memo.borrow_mut().insert(k, built.clone());
            }
            built
        };

        // The caller: the arguments, evaluated now, into temporaries the
        // child inherits by value.
        let call = self.alloc_block();
        self.close(cur, Terminator::Fallthrough(call));
        for (i, (f, &a)) in formals.iter().zip(actuals).enumerate() {
            let temp = self.set_capture_type(a, *f);
            self.blocks[call.0 as usize]
                .bindings
                .push(if i == 0 && implicit_this {
                    ArgBinding::CaptureThis { temp }
                } else {
                    ArgBinding::Capture { temp, value: a }
                });
            branch.inherited.push(InheritedSlot::Temp {
                parent: temp,
                child: i as u32,
            });
        }
        let join_blk = self.alloc_block();
        // The results, back into the actuals once the activation is done.
        for &i in &outs {
            let ret = self.set_capture_type(actuals[i], formals[i]);
            branch.inherited.push(InheritedSlot::Return {
                parent: ret,
                child: 2 * n + i as u32,
            });
            self.blocks[join_blk.0 as usize]
                .bindings
                .push(ArgBinding::AssignCaptured {
                    temp: ret,
                    target: actuals[i],
                    nba: false,
                });
        }
        self.close(
            call,
            Terminator::ForkJoin {
                kind: StatementBlockKind::JoinAll,
                branches: vec![branch],
                join_blk,
            },
        );
        Ok(join_blk)
    }

    /// A call of the recursive task inside its own activation
    /// ([`Self::inline_recursive_task`]): the arguments go to capture
    /// temporaries `n..2n`, and a placeholder branch forks the activation's
    /// own kernel again ([`Recursion::SelfSpawn`]), joined at once.
    fn recursive_self_call(
        &mut self,
        actuals: &[Expression<'d>],
        cur: BlockId,
        recv: Option<Option<Expression<'d>>>,
    ) -> Result<BlockId, LoweringError> {
        let rec = self
            .rec
            .as_ref()
            .ok_or_else(|| LoweringError::malformed("recursive call outside its activation"))?;
        let (n, body, rec_outs) = (rec.n, rec.body, rec.outs.clone());
        let skip = usize::from(rec.has_this);
        for (a, t) in actuals.iter().zip(&rec.refs[skip..]) {
            if let Some(t) = t
                && self.ref_storage(call_actual_lvalue(*a)).map(|s| s.uid()) != Some(t.uid())
            {
                return Err(LoweringError::unsupported(
                    "recursive call whose `ref` argument is not the storage the first call \
                     bound (a recursive task's `ref` formal is an alias of one static \
                     variable or net; LRM 1800-2023 13.5.2)",
                ));
            }
        }
        let mut actuals: Vec<Expression<'d>> = actuals
            .iter()
            .zip(&rec_outs[skip..])
            .map(|(&a, &out)| if out { call_actual_lvalue(a) } else { a })
            .collect();
        // The receiver of a method call is capture 0.
        let mut implicit_this = false;
        if let Some(r) = recv {
            let anchor = self.call_anchor.ok_or_else(|| {
                LoweringError::malformed("recursive method call without a call expression")
            })?;
            implicit_this = r.is_none();
            actuals.insert(0, r.unwrap_or(anchor));
        }
        let actuals = &actuals[..];
        if actuals.len() as u32 != n {
            return Err(LoweringError::malformed(
                "recursive call with the wrong number of arguments",
            ));
        }
        let call = self.alloc_block();
        self.close(cur, Terminator::Fallthrough(call));
        let mut inherited = Vec::new();
        for (i, &a) in actuals.iter().enumerate() {
            let temp = n + i as u32;
            self.blocks[call.0 as usize]
                .bindings
                .push(if i == 0 && implicit_this {
                    ArgBinding::CaptureThis { temp }
                } else {
                    ArgBinding::Capture { temp, value: a }
                });
            inherited.push(InheritedSlot::Temp {
                parent: temp,
                child: i as u32,
            });
        }
        // The results of the callee, back into the actuals after the join.
        let join_blk = self.alloc_block();
        for (i, &a) in actuals.iter().enumerate() {
            if rec_outs[i] {
                let ret = 3 * n + i as u32;
                inherited.push(InheritedSlot::Return {
                    parent: ret,
                    child: 2 * n + i as u32,
                });
                self.blocks[join_blk.0 as usize]
                    .bindings
                    .push(ArgBinding::AssignCaptured {
                        temp: ret,
                        target: a,
                        nba: false,
                    });
            }
        }
        let mut stub = CfgBuilder::new();
        let entry = stub.alloc_block();
        stub.close(entry, Terminator::End { loop_back: None });
        let branch = ProcessCfg {
            blocks: stub.finish(),
            entry,
            body,
            inlined_locals: Vec::new(),
            captures: Vec::new(),
            captured: Vec::new(),
            ref_bindings: Vec::new(),
            disable_names: Vec::new(),
            fork_branch_names: Vec::new(),
            disable_scopes: Vec::new(),
            disable_broadcast: Vec::new(),
            inherited,
            capture_types: Vec::new(),
            recursion: Recursion::SelfSpawn,
            share_id: None,
        };
        self.close(
            call,
            Terminator::ForkJoin {
                kind: StatementBlockKind::JoinAll,
                branches: vec![branch],
                join_blk,
            },
        );
        Ok(join_blk)
    }

    /// A call, inside one activation, of the task of the enclosing activation
    /// `self.rec_up[k]` (mutual recursion, LRM 1800-2023 13.4.1): the
    /// arguments go to fresh capture temporaries and a placeholder branch
    /// forks that activation's kernel again ([`Recursion::AncestorSpawn`]),
    /// joined at once.
    fn recursive_ancestor_call(
        &mut self,
        k: usize,
        actuals: &[Expression<'d>],
        cur: BlockId,
        recv: Option<Option<Expression<'d>>>,
    ) -> Result<BlockId, LoweringError> {
        let anc = self.rec_up[k].clone();
        if anc.refs.iter().any(Option::is_some) {
            return Err(LoweringError::unsupported(
                "mutually recursive tasks with a `ref` formal (LRM 1800-2023 13.4.1, 13.5.2)",
            ));
        }
        let skip = usize::from(anc.has_this);
        let mut actuals: Vec<Expression<'d>> = actuals
            .iter()
            .zip(&anc.outs[skip..])
            .map(|(&a, &out)| if out { call_actual_lvalue(a) } else { a })
            .collect();
        let mut implicit_this = false;
        if let Some(r) = recv {
            let anchor = self.call_anchor.ok_or_else(|| {
                LoweringError::malformed("recursive method call without a call expression")
            })?;
            implicit_this = r.is_none();
            actuals.insert(0, r.unwrap_or(anchor));
        }
        if actuals.len() as u32 != anc.n {
            return Err(LoweringError::malformed(
                "recursive call with the wrong number of arguments",
            ));
        }
        let call = self.alloc_block();
        self.close(cur, Terminator::Fallthrough(call));
        let mut inherited = Vec::new();
        for (i, &a) in actuals.iter().enumerate() {
            let temp = self.set_capture_type(a, anc.proto[i].1);
            self.blocks[call.0 as usize]
                .bindings
                .push(if i == 0 && implicit_this {
                    ArgBinding::CaptureThis { temp }
                } else {
                    ArgBinding::Capture { temp, value: a }
                });
            inherited.push(InheritedSlot::Temp {
                parent: temp,
                child: i as u32,
            });
        }
        // The ancestor's results, back into the actuals after the join.
        let join_blk = self.alloc_block();
        for (i, &a) in actuals.iter().enumerate() {
            if anc.outs[i] {
                let ret = self.set_capture_type(a, anc.proto[i].1);
                inherited.push(InheritedSlot::Return {
                    parent: ret,
                    child: 2 * anc.n + i as u32,
                });
                self.blocks[join_blk.0 as usize]
                    .bindings
                    .push(ArgBinding::AssignCaptured {
                        temp: ret,
                        target: a,
                        nba: false,
                    });
            }
        }
        let mut stub = CfgBuilder::new();
        let entry = stub.alloc_block();
        stub.close(entry, Terminator::End { loop_back: None });
        let branch = ProcessCfg {
            blocks: stub.finish(),
            entry,
            body: anc.body,
            inlined_locals: Vec::new(),
            captures: Vec::new(),
            captured: Vec::new(),
            ref_bindings: Vec::new(),
            disable_names: Vec::new(),
            fork_branch_names: Vec::new(),
            disable_scopes: Vec::new(),
            disable_broadcast: Vec::new(),
            inherited,
            capture_types: Vec::new(),
            recursion: Recursion::AncestorSpawn((self.rec_up.len() - k) as u32),
            share_id: None,
        };
        self.close(
            call,
            Terminator::ForkJoin {
                kind: StatementBlockKind::JoinAll,
                branches: vec![branch],
                join_blk,
            },
        );
        Ok(join_blk)
    }

    /// A new capture temporary shaped like `formal`, holding `value`.
    fn set_capture_type(&mut self, value: Expression<'d>, formal: Symbol<'d>) -> u32 {
        let temp = self.captures.len() as u32;
        self.captures.push(value);
        self.capture_types.resize(temp as usize, None);
        self.capture_types.push(Some(formal));
        temp
    }

    /// [`Self::inline_task_call`] of `task` with the arguments `actuals`.
    /// An expression statement that calls a value-returning function whose
    /// body spawns processes (`fork ... join_none` in a function, LRM
    /// 1800-2023 13.4.4), which cannot be compiled: each such call is inlined
    /// ahead of the statement (arguments first, in source order) and the
    /// statement reads the function's result variable instead of calling it
    /// (codegen `lower_user_subroutine_call_of`). `None` when the statement
    /// has no such call. The same function twice in one statement, or a call
    /// to a virtual method, is refused by name.
    fn hoist_suspending_function_calls(
        &mut self,
        stmt: Statement<'d>,
        cur: BlockId,
    ) -> Result<Option<BlockId>, LoweringError> {
        let Some(cur) = self.hoist_suspending_calls_in(stmt.as_sem_node(), cur)? else {
            return Ok(None);
        };
        self.push(cur, stmt);
        Ok(Some(cur))
    }

    /// [`Self::hoist_suspending_function_calls`]' inlining half over any
    /// expression tree: inlines every spawning function call under `node`
    /// ahead of the caller, which then reads their result variables. Also
    /// used for an inlined function's `return expr;` (`return m(...)`).
    fn hoist_suspending_calls_in(
        &mut self,
        node: SemNode<'d>,
        cur: BlockId,
    ) -> Result<Option<BlockId>, LoweringError> {
        let mut calls = Vec::new();
        collect_suspending_function_calls(node, &mut calls);
        if calls.is_empty() {
            return Ok(None);
        }
        let mut count: std::collections::HashMap<_, usize> = std::collections::HashMap::new();
        for call in &calls {
            if let Some(callee) = user_task_callee(call) {
                *count.entry(callee.uid()).or_default() += 1;
            }
        }
        let mut cur = cur;
        for call in calls {
            let Some(callee) = user_task_callee(&call) else {
                continue;
            };
            // A method (LRM 8.6) is inlined with its `this` bound to the
            // receiver (`inline_task_call`). A virtual one picks among
            // several overrides, each with a result variable of its own.
            let is_method =
                callee.subroutine_this_var().is_some() || call.call_this_class().is_some();
            let flags = callee.subroutine_flags();
            let is_virtual = is_method
                && (flags.contains(sv_lang::MethodFlags::VIRTUAL)
                    || flags.contains(sv_lang::MethodFlags::PURE)
                    || callee.subroutine_override().is_some());
            // The function's result variable is shared by its calls (and a
            // virtual method's overrides have one each): a call that cannot
            // read it straight after its inlining parks the value in a
            // temporary of its own, which the call's expression reads.
            let temp = (is_virtual || count.get(&callee.uid()).copied().unwrap_or(0) > 1)
                .then(|| {
                    callee
                        .subroutine_return_val_var()
                        .map(|rv| self.set_capture_type(call, rv))
                })
                .flatten();
            if let Some(temp) = temp {
                self.pending_result_temp = Some((temp, call));
            }
            cur = if is_method {
                self.inline_task_call(call, callee, cur)?
            } else {
                let actuals = call.operands();
                let exit = self.inline_task_body(&actuals, callee, cur, None)?;
                self.park_call_result(exit, temp.map(|t| (t, call)), callee);
                exit
            };
            self.pending_result_temp = None;
            if let Some(temp) = temp {
                self.blocks[cur.0 as usize]
                    .bindings
                    .push(ArgBinding::CallResult { temp, call });
            }
        }
        Ok(Some(cur))
    }

    fn inline_task_body(
        &mut self,
        actuals: &[Expression<'d>],
        task: Symbol<'d>,
        cur: BlockId,
        this: Option<(Symbol<'d>, Option<Expression<'d>>)>,
    ) -> Result<BlockId, LoweringError> {
        if let Some(rec) = &self.rec
            && rec.task == task.uid()
            && this.is_some() == rec.has_this
        {
            return self.recursive_self_call(actuals, cur, this.map(|t| t.1));
        }
        if let Some(k) = self
            .rec_up
            .iter()
            .rposition(|r| r.task == task.uid() && r.has_this == this.is_some())
        {
            return self.recursive_ancestor_call(k, actuals, cur, this.map(|t| t.1));
        }
        if self.rec.is_none() && self.rec_outer.contains(&task.uid()) {
            // A fork branch the activation does not hand its recursion to
            // (a virtual-task or detached branch): inlining would not end.
            return Err(LoweringError::unsupported(format!(
                "call to task `{}` from a branch of its own recursive activation that cannot \
                 spawn it (LRM 1800-2023 13.4.1)",
                task.name()
            )));
        }
        if self.inline_stack.contains(&task.uid()) {
            return Err(LoweringError::unsupported(format!(
                "recursive call to task `{}`, which contains timing controls (it has to be \
                 inlined into the calling process)",
                task.name()
            )));
        }
        if !self.rec_outer.contains(&task.uid())
            && task_reaches_itself(&task, self.virtual_tasks.as_deref())
        {
            return self.inline_recursive_task(actuals, task, cur, this);
        }
        let body = proc_body(&task).ok_or_else(|| {
            LoweringError::malformed(format!("task `{}` has no body", task.name()))
        })?;
        let formals: Vec<Symbol<'d>> = task.subroutine_arguments().collect();
        if formals.len() != actuals.len() {
            return Err(LoweringError::malformed(format!(
                "call to task `{}` has {} arguments for {} formals",
                task.name(),
                actuals.len(),
                formals.len()
            )));
        }
        let entry = self.alloc_block();
        self.close(cur, Terminator::Fallthrough(entry));
        let after = self.alloc_block();
        self.target_depth.insert(after, self.owned_scopes.len());
        let frame_mark = self.inlined_locals.len();
        let mut releases = Vec::new();
        if let Some((this_var, receiver)) = this {
            let binding = match receiver {
                Some(r) => ArgBinding::In {
                    formal: this_var,
                    actual: r,
                },
                None => ArgBinding::ThisOf { var: this_var },
            };
            self.blocks[entry.0 as usize].bindings.push(binding);
            self.inlined_locals.push(this_var);
            // Both bindings hold one count on the object for the call.
            releases.push(ArgBinding::Release { var: this_var });
        }
        let mut copy_backs = Vec::new();
        let mut aliases = Vec::new();
        let mut bound_refs: Vec<(Symbol<'d>, Expression<'d>)> = Vec::new();
        for (formal, &actual) in formals.iter().zip(actuals) {
            // slang binds an output/inout actual as `actual = <formal>`.
            let lvalue = if actual.kind() == ExpressionKind::Assignment {
                actual.left().ok_or_else(|| {
                    LoweringError::malformed("output argument with no target expression")
                })?
            } else {
                actual
            };
            // A `ref` naming static storage (directly or through an
            // enclosing call's aliased `ref`) is that storage in the body.
            // (An `event` (or event array) ref formal is a handle: copied in and back out, like
            // `inout`, so the body's `r = e` merges the actual's event.)
            if formal.formal_argument_direction() == sv_lang::ArgumentDirection::Ref
                && !formal
                    .value_type()
                    .as_ref()
                    .is_some_and(|t| crate::state::event_pool::event_count(t).is_some())
                && let Some(target) = self.ref_storage(lvalue)
            {
                self.ref_candidates.push((*formal, Some(target)));
                aliases.push((*formal, target));
                continue;
            }
            // A `ref` to a queue / dynamic-array element of a packed or real
            // type (LRM 1800-2023 13.5.2): the formal is a live alias, every
            // access of it goes through a runtime reference
            // ([`ArgBinding::RefOpen`]); other element types keep the
            // copy-in/copy-out of `inout`.
            if formal.formal_argument_direction() == sv_lang::ArgumentDirection::Ref
                && lvalue.kind() == ExpressionKind::ElementSelect
                && formal
                    .value_type()
                    .is_some_and(|t| t.is_integral() || t.is_floating())
                && lvalue
                    .select_value()
                    .and_then(|b| b.expr_type())
                    .is_some_and(|t| t.is_dynamically_sized_array() || t.is_associative_array())
            {
                // One reference-id slot per formal, shared by every call
                // site: the body reaches the reference through the formal.
                let prior =
                    self.blocks
                        .iter()
                        .flat_map(|b| b.bindings.iter())
                        .find_map(|b| match b {
                            ArgBinding::RefOpen {
                                temp, formal: f, ..
                            } if f.uid() == formal.uid() => Some(*temp),
                            _ => None,
                        });
                let temp = prior.unwrap_or_else(|| {
                    self.captures.push(lvalue);
                    self.captures.len() as u32 - 1
                });
                self.blocks[entry.0 as usize]
                    .bindings
                    .push(ArgBinding::RefOpen {
                        temp,
                        formal: *formal,
                        actual: lvalue,
                    });
                copy_backs.push(ArgBinding::RefClose {
                    temp,
                    formal: *formal,
                    actual: lvalue,
                });
                self.ref_candidates.push((*formal, None));
                if !crate::netlist::is_static_procedural_var(formal) {
                    self.inlined_locals.push(*formal);
                }
                continue;
            }
            let binding = match formal.formal_argument_direction() {
                sv_lang::ArgumentDirection::In => ArgBinding::In {
                    formal: *formal,
                    actual,
                },
                sv_lang::ArgumentDirection::Out => ArgBinding::Init { var: *formal },
                sv_lang::ArgumentDirection::InOut | sv_lang::ArgumentDirection::Ref => {
                    ArgBinding::In {
                        formal: *formal,
                        actual: lvalue,
                    }
                }
            };
            self.blocks[entry.0 as usize].bindings.push(binding);
            if formal.formal_argument_direction() == sv_lang::ArgumentDirection::Ref {
                bound_refs.push((*formal, lvalue));
                let named = (crate::symid::is_value_name(lvalue.kind())
                    && !formal
                        .value_type()
                        .as_ref()
                        .is_some_and(|t| crate::state::event_pool::event_count(t).is_some()))
                .then(|| lvalue.referenced_symbol())
                .flatten();
                self.ref_candidates.push((*formal, named));
            }
            if formal.formal_argument_direction() != sv_lang::ArgumentDirection::In {
                copy_backs.push(ArgBinding::Out {
                    actual: lvalue,
                    formal: *formal,
                });
            }
            // A static task's formal is the instance's (a signal).
            if !crate::netlist::is_static_procedural_var(formal) {
                self.inlined_locals.push(*formal);
                if formal.formal_argument_direction() == sv_lang::ArgumentDirection::In {
                    releases.push(ArgBinding::Release { var: *formal });
                }
            }
        }
        // A method's body (and its locals' initializers) runs against its
        // own `this`, in blocks of its own; the bindings above ran in the
        // caller's.
        if let Some((this_var, _)) = this {
            self.this_stack.push(this_var);
        }
        let n_aliases = aliases.len();
        self.ref_stack.extend(aliases);
        let body_entry = if this.is_some() || n_aliases > 0 {
            let b = self.alloc_block();
            self.close(entry, Terminator::Fallthrough(b));
            b
        } else {
            entry
        };
        for local in task_locals(&task) {
            // A method's `this` is bound above, never a default-initialized
            // local.
            if this.is_some_and(|(t, _)| t.uid() == local.uid()) {
                continue;
            }
            // A static variable is the instance's (a signal); a block's
            // automatic variables are initialized on entry to it.
            if crate::netlist::is_static_procedural_var(&local) {
                continue;
            }
            if !is_automatic_block_var(&local) {
                self.blocks[body_entry.0 as usize]
                    .bindings
                    .push(ArgBinding::Init { var: local });
                releases.push(ArgBinding::Release { var: local });
            }
            self.inlined_locals.push(local);
        }
        // An inlined value-returning function (a `fork` in its body cannot be
        // compiled, LRM 13.4.4): its result variable is a local of the
        // process, which `return expr;` / `f = expr;` assign and the hoisted
        // call's expression reads (`hoist_suspending_function_calls`).
        let ret_var = if task.subroutine_kind() == Some(sv_lang::SubroutineKind::Function)
            && task.subroutine_return_type().is_some_and(|t| !t.is_void())
        {
            task.subroutine_return_val_var()
        } else {
            None
        };
        if let Some(rv) = ret_var {
            self.blocks[body_entry.0 as usize]
                .bindings
                .push(ArgBinding::Init { var: rv });
            self.inlined_locals.push(rv);
        }
        // The pattern variables of the body's `matches` (LRM 12.6).
        for v in crate::patterns::pattern_vars(body.as_sem_node()) {
            if !self.inlined_locals.iter().any(|l| l.uid() == v.uid()) {
                self.inlined_locals.push(v);
            }
        }
        // VPI frame (37.43): the formals and locals this inlining made
        // automatic variables of the process, in that order.
        let frame_vars: Vec<Symbol<'d>> = self.inlined_locals[frame_mark..]
            .iter()
            .copied()
            .filter(|v| this.is_none_or(|(t, _)| t.uid() != v.uid()))
            .filter(|v| !bound_refs.iter().any(|(f, _)| f.uid() == v.uid()))
            .collect();
        self.frame_probe(
            body_entry,
            FrameProbe::Enter {
                task,
                vars: frame_vars.clone(),
                bound: bound_refs,
            },
        );
        self.block_event(body_entry, task, false);
        self.event_stack.push((task, self.disable_targets.len()));
        self.frame_stack.push((task, frame_vars.clone()));
        self.inline_stack.push(task.uid());
        self.return_targets.push(after);
        self.ret_var_stack.push(ret_var);
        // `disable task;` ends this activation (LRM 9.6.2), from inside it or
        // from another process: the exit is the block after the call, whose
        // frame probe ends the activation's VPI frame.
        let task_name = task.name().to_string();
        let task_scoped = is_disabled_somewhere(&task_name);
        let mut n_tags = 0;
        if task_scoped {
            self.scope_chain
                .push((task_name.clone(), after, self.frame_stack.len()));
            self.disable_targets
                .push((task_name, after, self.frame_stack.len()));
            // LRM 25.7.4: an `extern` method's activation is also the scope
            // `disable m1.a.t;` (this module instance's call) and `disable
            // b.t;` (every call through the interface instance) name.
            for tag in crate::netlist::itf::extern_scope_tags(&task) {
                self.scope_chain.push((tag, after, self.frame_stack.len()));
                n_tags += 1;
            }
        }
        let exit = self.walk_stmt(body, body_entry);
        if task_scoped {
            self.scope_chain.pop();
            self.disable_targets.pop();
            for _ in 0..n_tags {
                self.scope_chain.pop();
            }
        }
        self.event_stack.pop();
        self.return_targets.pop();
        self.ret_var_stack.pop();
        self.inline_stack.pop();
        self.frame_stack.pop();
        if this.is_some() {
            self.this_stack.pop();
        }
        self.ref_stack.truncate(self.ref_stack.len() - n_aliases);
        let exit = exit?;
        self.close(exit, Terminator::Fallthrough(after));
        self.blocks[after.0 as usize].bindings.extend(copy_backs);
        self.blocks[after.0 as usize].bindings.extend(releases);
        self.block_event(after, task, true);
        self.frame_probe(
            after,
            FrameProbe::Exit {
                task,
                vars: frame_vars,
            },
        );
        Ok(after)
    }

    /// An immediate assertion whose pass or fail statement waits (LRM 16.3):
    /// [`Terminator::Assertion`] over the two statements' own blocks.
    fn walk_immediate_assertion(
        &mut self,
        stmt: Statement<'d>,
        (pass_stmt, fail_stmt): (Option<Statement<'d>>, Option<Statement<'d>>),
        cur: BlockId,
    ) -> Result<BlockId, LoweringError> {
        if stmt.is_deferred_assertion() == Some(true) {
            return Err(LoweringError::unsupported(
                "a deferred assertion (LRM 16.4) whose action block waits (the action must be \
                 a subroutine call that is queued)"
                    .to_string(),
            ));
        }
        let pass_blk = self.alloc_block();
        let fail_blk = self.alloc_block();
        let done_blk = self.alloc_block();
        self.close(
            cur,
            Terminator::Assertion {
                stmt,
                pass_blk,
                fail_blk,
                done_blk,
            },
        );
        for (action, blk) in [(pass_stmt, pass_blk), (fail_stmt, fail_blk)] {
            let exit = match action {
                Some(a) => self.walk_stmt(a, blk)?,
                None => blk,
            };
            self.close(exit, Terminator::Fallthrough(done_blk));
        }
        Ok(done_blk)
    }

    /// A `case` whose arms need their own blocks ([`Terminator::Case`]).
    fn walk_case(&mut self, stmt: Statement<'d>, cur: BlockId) -> Result<BlockId, LoweringError> {
        // A `case ... matches` has its own item and default accessors.
        let is_pattern = stmt.kind() == StatementKind::PatternCase;
        // A constant selector over arms one of which slang demoted to
        // `Invalid` (a statically dead arm): only the matching arm can run
        // (LRM 12.5), so lower just it.
        if !is_pattern && let Some(live) = constant_case_live_arm(&stmt) {
            return match live {
                Some(arm) => self.walk_stmt(arm, cur),
                None => Ok(cur),
            };
        }
        let arm_stmts: Vec<Statement<'d>> = if is_pattern {
            stmt.pattern_case_items().iter().map(|i| i.stmt()).collect()
        } else {
            stmt.case_items().iter().map(|i| i.stmt()).collect()
        };
        let arms: Vec<BlockId> = arm_stmts.iter().map(|_| self.alloc_block()).collect();
        let default_blk = self.alloc_block();
        let join = self.alloc_block();
        self.close(
            cur,
            Terminator::Case {
                stmt,
                arms: arms.clone(),
                default_blk,
            },
        );
        for (arm_stmt, &arm) in arm_stmts.iter().zip(&arms) {
            let exit = self.walk_stmt(*arm_stmt, arm)?;
            self.close(exit, Terminator::Fallthrough(join));
        }
        let default_stmt = if is_pattern {
            stmt.pattern_case_default()
        } else {
            stmt.default_case()
        };
        let default_exit = match default_stmt {
            Some(d) => self.walk_stmt(d, default_blk)?,
            None => default_blk,
        };
        self.close(default_exit, Terminator::Fallthrough(join));
        Ok(join)
    }

    /// Walks a loop body with `continue` going to `cont` and `break` to
    /// `brk`.
    fn walk_loop_body(
        &mut self,
        body_stmt: Statement<'d>,
        body: BlockId,
        cont: BlockId,
        brk: BlockId,
    ) -> Result<BlockId, LoweringError> {
        self.loop_targets.push((cont, brk));
        let open = self.owned_scopes.len();
        self.target_depth.insert(cont, open);
        self.target_depth.insert(brk, open);
        let exit = self.walk_stmt(body_stmt, body);
        self.loop_targets.pop();
        exit
    }

    /// Walks a block, keeping [`Self::name_path`] current for the sequential
    /// block's own name.
    fn walk_block(&mut self, stmt: Statement<'d>, cur: BlockId) -> Result<BlockId, LoweringError> {
        // `L: assert (..) ... disable L; ...`: one leaf (see the helper).
        if !self.entering_block && self_disabling_assertion_block(&stmt) {
            self.push(cur, stmt);
            return Ok(cur);
        }
        let name = (!self.entering_block
            && stmt.block_kind() == Some(StatementBlockKind::Sequential))
        .then(|| block_name(&stmt))
        .filter(|n| !n.is_empty());
        let pushed = name.is_some();
        if let Some(n) = name {
            self.name_path.push(n);
        }
        // LRM 19.3: `@@(begin blk)` / `@@(end blk)` of a named block, signalled
        // at its first statement and after its last (the codegen drops the
        // ones no covergroup names). Only a block that is walked into the CFG
        // gets here; a leaf block's events are emitted where it is lowered.
        let blk = (!self.entering_block
            && stmt.block_kind() == Some(StatementBlockKind::Sequential))
        .then(|| stmt.block_symbol())
        .flatten()
        .filter(|b| !b.name().is_empty());
        if let Some(b) = blk {
            self.block_event(cur, b, false);
            self.event_stack.push((b, self.disable_targets.len()));
        }
        let r = self.walk_block_inner(stmt, cur);
        if blk.is_some() {
            self.event_stack.pop();
        }
        if pushed {
            self.name_path.pop();
        }
        if let (Some(b), Ok(end)) = (blk, &r) {
            self.block_event(*end, b, true);
        }
        r
    }

    fn walk_block_inner(
        &mut self,
        stmt: Statement<'d>,
        cur: BlockId,
    ) -> Result<BlockId, LoweringError> {
        // `StatementBlockKind` is a plain (non-`#[non_exhaustive]`) enum
        // hand-authored in `sv-lang`, so this literal `match` is genuinely,
        // compiler-checked exhaustive -- no wildcard needed or used.
        match stmt.block_kind() {
            // A named block some `disable` inside it can leave: its own exit.
            // A block declaring automatic variables: they are created and
            // initialized on each entry (LRM 1800-2023 §6.21), at the
            // start of a CFG block of its own.
            Some(_) if !self.entering_block && !block_automatic_vars(&stmt, true).is_empty() => {
                // A CFG block with no statements yet takes the bindings
                // itself (they run before its statements).
                let fresh = &self.blocks[cur.0 as usize];
                let entry = if fresh.stmts.is_empty() && fresh.step_exprs.is_empty() {
                    cur
                } else {
                    let entry = self.alloc_block();
                    self.close(cur, Terminator::Fallthrough(entry));
                    entry
                };
                for var in block_automatic_vars(&stmt, true) {
                    self.blocks[entry.0 as usize]
                        .bindings
                        .push(ArgBinding::Init { var });
                }
                // A sequential block's handle-holding variables end with it.
                let owned: Vec<Symbol<'d>> =
                    if stmt.block_kind() == Some(StatementBlockKind::Sequential) {
                        block_automatic_vars(&stmt, true)
                            .into_iter()
                            .filter(|v| v.value_type().is_some_and(|t| may_hold_handles(&t)))
                            .collect()
                    } else {
                        Vec::new()
                    };
                let scoped = !owned.is_empty();
                if scoped {
                    self.owned_scopes.push(owned.clone());
                }
                self.entering_block = true;
                let r = self.walk_block(stmt, entry);
                self.entering_block = false;
                if !scoped {
                    return r;
                }
                self.owned_scopes.pop();
                let end = r?;
                let leave = self.alloc_block();
                self.close(end, Terminator::Fallthrough(leave));
                for var in owned.into_iter().rev() {
                    self.blocks[leave.0 as usize]
                        .bindings
                        .push(ArgBinding::Release { var });
                }
                Ok(leave)
            }
            Some(StatementBlockKind::Sequential)
                if let name = block_name(&stmt)
                    && !name.is_empty()
                    && (is_disabled_somewhere(&name)
                        || is_disabled_somewhere(&self.name_path.join("."))
                        || contains_disable_through_calls(stmt.as_sem_node())) =>
            {
                self.entering_block = false;
                let exit = self.alloc_block();
                self.target_depth.insert(exit, self.owned_scopes.len());
                // LRM 9.6.2: another process's `disable` of this block resumes
                // the process at `exit`, wherever in the block it is suspended.
                let scoped = is_disabled_somewhere(&name);
                if scoped {
                    self.scope_chain
                        .push((name.clone(), exit, self.frame_stack.len()));
                }
                // `disable p.b.x;` of another process names the block by its
                // path from the process's outermost block: a second scope
                // under that dotted label tells same-named blocks apart.
                let dotted = self.name_path.join(".");
                let path_scoped = dotted.contains('.') && is_disabled_somewhere(&dotted);
                if path_scoped {
                    self.scope_chain
                        .push((dotted.clone(), exit, self.frame_stack.len()));
                }
                // `disable fl.b1.blk;` goes through the fork's own label `fl`
                // (9.6.2): the branch's path under that label tells the
                // same-named blocks of sibling branches apart.
                let fork_key = self
                    .fork_name
                    .as_ref()
                    .map(|f| format!("{f}.{dotted}"))
                    .filter(|k| is_disabled_somewhere(k));
                let fork_scoped = fork_key.is_some();
                if let Some(key) = fork_key {
                    self.scope_chain.push((key, exit, self.frame_stack.len()));
                }
                self.disable_targets
                    .push((name, exit, self.frame_stack.len()));
                let end = self.walk_seq(live_statements(&stmt), cur);
                self.disable_targets.pop();
                if fork_scoped {
                    self.scope_chain.pop();
                }
                if path_scoped {
                    self.scope_chain.pop();
                }
                if scoped {
                    self.scope_chain.pop();
                }
                self.close(end?, Terminator::Fallthrough(exit));
                Ok(exit)
            }
            Some(StatementBlockKind::Sequential) => {
                self.entering_block = false;
                self.walk_seq(live_statements(&stmt), cur)
            }
            Some(
                kind @ (StatementBlockKind::JoinAll
                | StatementBlockKind::JoinAny
                | StatementBlockKind::JoinNone),
            ) => {
                // Task 1 (PR-069/`docs/design/process.md` §7): construction
                // only, never scheduled. Each branch is walked as its own,
                // fully independent `ProcessCfg` (`OneShot` -- a fork
                // branch runs to completion or suspends, but never
                // re-triggers the way an `always` process does).
                //
                // Verified live: `>1` un-`begin`/`end`-wrapped branches
                // (`fork a; b; join`) are NOT `stmt.statements()`'s direct
                // elements -- slang groups them into one `List` node first
                // (the same generic multi-statement wrapper `walk_stmt`'s
                // own `StatementKind::List` arm already flattens elsewhere),
                // so `statements()` here returns exactly one `List` element,
                // not one element per branch. A single, un-wrapped branch
                // (`fork a; join`) has no such wrapper. Flatten exactly one
                // `List` level when present, never more (a `List`
                // containing a nested `List` is not a shape any fixture
                // this task constructs, so silently over-flattening would
                // risk merging two real branches into one).
                let branch_stmts = live_statements(&stmt);
                let branch_stmts = match branch_stmts.as_slice() {
                    [only] if only.kind() == StatementKind::List => live_statements(only),
                    _ => branch_stmts,
                };
                self.entering_block = false;
                let fork_name = Some(block_name(&stmt)).filter(|n| !n.is_empty());
                // LRM 9.6.2: a `disable` of one branch's own named outermost
                // block, reachable from the parent (after this fork
                // statement), a sibling branch, or deeper still (threaded
                // into each branch's own `Inherited::known_fork_labels`
                // below) -- see `CfgBuilder::fork_branch_names`'s own doc
                // comment. Computed from a reference: `branch_stmts` is
                // still needed, un-consumed, by the `.into_iter()` build
                // below.
                // The fork block's own name (`fork : NAME`) tags every branch
                // process too (`ProcessCfg::disable_names`), so a later
                // `disable NAME;` of the parent, after the join, ends the
                // branches still running (LRM 9.6.2: all activities enabled
                // within the named block end).
                let new_branch_names: Vec<String> = branch_stmts
                    .iter()
                    .filter_map(|s| peer_block(s).map(|p| p.name))
                    .collect();
                let known_fork_labels: Vec<String> = self
                    .fork_branch_names
                    .iter()
                    .filter(|n| !self.fork_block_names.contains(n))
                    .cloned()
                    .chain(new_branch_names.iter().cloned())
                    .collect();
                let ancestor_blocks: Vec<String> = self
                    .ancestor_blocks
                    .iter()
                    .cloned()
                    .chain(self.disable_targets.iter().map(|(n, _, _)| n.clone()))
                    .collect();
                // Equal inherited context and statement give an equal CFG
                // (a fresh builder is seeded from `Inherited` alone), so a
                // task inlined at many call sites builds each of its forks'
                // branches once and the lowering compiles each once
                // ([`ProcessCfg::share_id`]). Not inside a recursive
                // activation (its capture temporaries are per site) or
                // under a clock inference.
                let memoizable = self.rec.is_none()
                    && self.rec_up.is_empty()
                    && self.global_clock.is_none()
                    && self.checker_clock.is_none();
                let mut branches: Vec<ProcessCfg<'d>> = branch_stmts
                    .into_iter()
                    .map(|branch_stmt| {
                        let key = memoizable.then(|| {
                            MemoKey::Fork(ForkBranchKey {
                                stmt: (stmt_addr(&branch_stmt), branch_stmt.kind() as u16),
                                fork_name: fork_name.clone(),
                                default_clocking: self.default_clocking.map(|c| c.uid()),
                                this_var: self.this_stack.last().map(|t| t.uid()),
                                ref_aliases: self
                                    .ref_stack
                                    .iter()
                                    .map(|(a, b)| (a.uid(), b.uid()))
                                    .collect(),
                                rec_outer: self.rec_outer.clone(),
                                labels: known_fork_labels.clone(),
                                ancestors: ancestor_blocks.clone(),
                            })
                        });
                        if let Some(k) = &key
                            && let Some(hit) = self.fork_memo.borrow().get(k)
                        {
                            return Ok(hit.clone());
                        }
                        let mut cfg = build_cfg_in(
                            &branch_stmt,
                            ProcessLoopKind::OneShot,
                            fork_name.clone(),
                            self.default_clocking,
                            None,
                            self.checker_clock,
                            Inherited {
                                this_var: self.this_stack.last().copied(),
                                ref_aliases: self.ref_stack.clone(),
                                global_clock: self.global_clock,
                                detached_trigger: false,
                                forced_extern: None,
                                rec_outer: self.rec_outer.clone(),
                                fork_memo: Some(self.fork_memo.clone()),
                                rec: self.rec.clone(),
                                rec_up: self.rec_up.clone(),
                                known_fork_labels: known_fork_labels.clone(),
                                ancestor_blocks: ancestor_blocks.clone(),
                            },
                            self.virtual_tasks.clone(),
                        )?;
                        if let Some(k) = key {
                            cfg.share_id = Some(
                                NEXT_SHARE_ID.fetch_add(1, std::sync::atomic::Ordering::Relaxed),
                            );
                            self.fork_memo.borrow_mut().insert(k, cfg.clone());
                        }
                        Ok(cfg)
                    })
                    .collect::<Result<_, LoweringError>>()?;
                for b in &mut branches {
                    b.captured = captured_vars(b);
                    // An aliased `ref` formal is the branch's storage too.
                    b.captured
                        .retain(|c| !self.ref_stack.iter().any(|(f, _)| f.uid() == c.uid()));
                    // A branch inside an inlined class-method task shares the
                    // forking activation's `this`.
                    if let Some(t) = self.this_stack.last()
                        && !b.captured.iter().any(|c| c.uid() == t.uid())
                    {
                        b.captured.push(*t);
                    }
                }
                // The parent keeps these labels resolvable for the rest of
                // its own walk (not popped like `disable_targets`): LRM
                // 9.6.2 lets a branch be disabled for the rest of the
                // process's life, not only while this `fork` statement is
                // still being walked.
                self.fork_branch_names.extend(new_branch_names);
                if let Some(f) = &fork_name {
                    self.fork_branch_names.push(f.clone());
                    self.fork_block_names.push(f.clone());
                }
                let join_blk = self.alloc_block();
                self.close(
                    cur,
                    Terminator::ForkJoin {
                        kind,
                        branches,
                        join_blk,
                    },
                );
                Ok(join_blk)
            }
            None => Err(LoweringError::malformed(
                "Block statement with no block_kind (unexpected AST shape)",
            )),
        }
    }

    fn walk_seq(
        &mut self,
        stmts: Vec<Statement<'d>>,
        mut cur: BlockId,
    ) -> Result<BlockId, LoweringError> {
        // LRM 14.11: a `##0` whose clocking event already occurred in this
        // time step "shall have no effect". Statically known exactly when the
        // process was just released by that event (`##N;` or
        // `@(cb);` on the default clocking, a `##0` included once it has waited) and only untimed, call-free
        // statements ran since; any other `##0` waits for the event (which is
        // right whenever the event has not yet fired this step).
        let mut released = false;
        for s in stmts {
            let s = unwrap_invalid(s);
            match self.default_clocking_wait(&s) {
                Some(0) if released => {
                    if let Some(body) = s.body()
                        && body.kind() != StatementKind::Empty
                    {
                        cur = self.walk_stmt(body, cur)?;
                    }
                    continue;
                }
                Some(_) => released = s.body().is_none_or(|b| b.kind() == StatementKind::Empty),
                None => {
                    released = released && Self::untimed_simple(&s);
                }
            }
            cur = self.walk_stmt(s, cur)?;
        }
        Ok(cur)
    }

    /// The cycle count of `##N` / `@(cb)` (count 1) on the default clocking
    /// when `stmt` is such a timed statement (see [`Self::walk_seq`]).
    fn default_clocking_wait(&self, stmt: &Statement<'d>) -> Option<u32> {
        let cb = self.default_clocking?;
        if stmt.kind() != StatementKind::Timed {
            return None;
        }
        let tc = stmt.timing_control()?;
        // A predicate, not a lowering: any other timing control is simply not
        // a wait on the default clocking (the next `##0` then waits).
        if tc.kind() == TimingControlKind::CycleDelay {
            first_expression_child(&tc)?
                .constant_value()?
                .as_i64()
                .and_then(|v| u32::try_from(v).ok())
        } else if tc.kind() == TimingControlKind::SignalEvent && tc.edge() == EdgeKind::None {
            let sym = first_expression_child(&tc)?.referenced_symbol()?;
            (sym.kind() == SymbolKind::ClockingBlock && sym.uid() == cb.uid()).then_some(1)
        } else {
            None
        }
    }

    /// A statement that takes no time and calls no user subroutine: a system
    /// call or an untimed assignment.
    fn untimed_simple(stmt: &Statement<'d>) -> bool {
        stmt.kind() == StatementKind::ExpressionStatement
            && stmt.expr().is_some_and(|e| {
                (e.kind() == ExpressionKind::Call && e.is_system_call() == Some(true))
                    || (e.kind() == ExpressionKind::Assignment && e.assignment_timing().is_none())
            })
    }

    /// PR-044: `if`/`else` always expands to `Terminator::Branch`, regardless
    /// of whether either branch contains a suspend -- this is orthogonal to
    /// (never triggers) suspend splitting, which is exactly what
    /// `if_else_does_not_split_the_cfg` (`tests/process_cfg.rs`) proves: the
    /// number of *additional* blocks a wrapping suspend contributes is the
    /// same with or without the branch present.
    fn walk_conditional(
        &mut self,
        stmt: Statement<'d>,
        cur: BlockId,
    ) -> Result<BlockId, LoweringError> {
        if violation_check(&stmt).is_some() || is_clause_if(&stmt) {
            return self.walk_checked_if(stmt, cur);
        }
        let cond = stmt.expressions().into_iter().next().ok_or_else(|| {
            LoweringError::malformed("Conditional statement with no condition expression")
        })?;
        let then_stmt = stmt
            .then_branch()
            .ok_or_else(|| LoweringError::malformed("Conditional statement with no then-branch"))?;
        let else_stmt = stmt.else_branch();

        // A constant predicate picks its arm at elaboration; only the live
        // arm becomes blocks (see `constant_if_arm`).
        if let Some(taken) = constant_if_arm(&stmt) {
            return match if taken { Some(then_stmt) } else { else_stmt } {
                Some(live) => self.walk_stmt(live, cur),
                None => Ok(cur),
            };
        }

        // A call in the condition to a function that is inlined (a `fork` in
        // its body, an event output formal) runs ahead of the test; the
        // condition reads its result variable.
        let cur = self
            .hoist_suspending_calls_in(cond.as_sem_node(), cur)?
            .unwrap_or(cur);
        let then_blk = self.alloc_block();
        let else_blk = self.alloc_block();
        self.close(
            cur,
            Terminator::Branch {
                cond,
                then_blk,
                else_blk,
            },
        );

        let then_exit = self.walk_stmt(then_stmt, then_blk)?;
        let else_exit = match else_stmt {
            Some(e) => self.walk_stmt(e, else_blk)?,
            None => else_blk,
        };

        let join = self.alloc_block();
        self.close(then_exit, Terminator::Fallthrough(join));
        self.close(else_exit, Terminator::Fallthrough(join));
        Ok(join)
    }

    /// A `unique`/`unique0`/`priority` `if` series (§12.4.2): one
    /// [`Terminator::Case`] over the whole series, `arms[i]` the then-statement
    /// of its i-th condition, `default_blk` the final `else` (empty without
    /// one), so the dispatch can report a violation (§12.4.2.1) where the
    /// series executes.
    fn walk_checked_if(
        &mut self,
        stmt: Statement<'d>,
        cur: BlockId,
    ) -> Result<BlockId, LoweringError> {
        let chain = if_series(stmt).map_err(|why| {
            LoweringError::unsupported(format!("{why} in an if series (malformed statement)"))
        })?;
        let arms: Vec<BlockId> = chain.thens.iter().map(|_| self.alloc_block()).collect();
        let default_blk = self.alloc_block();
        let join = self.alloc_block();
        self.close(
            cur,
            Terminator::Case {
                stmt,
                arms: arms.clone(),
                default_blk,
            },
        );
        for (then_stmt, &arm) in chain.thens.iter().zip(&arms) {
            let exit = self.walk_stmt(*then_stmt, arm)?;
            self.close(exit, Terminator::Fallthrough(join));
        }
        let default_exit = match chain.otherwise {
            Some(e) => self.walk_stmt(e, default_blk)?,
            None => default_blk,
        };
        self.close(default_exit, Terminator::Fallthrough(join));
        Ok(join)
    }

    /// PR-006/PR-007: the one place a `BasicBlock` closes with
    /// `Terminator::Suspend` from a `Timed` statement. `Delay`/`SignalEvent`
    /// (posedge/negedge only) are the slice-scope half; Task 1 adds
    /// `EventList` (as `SuspendPoint::EdgeList`) and `CycleDelay`. **Task 6
    /// (CG-081/CG-171)** adds real handling for `ImplicitEvent` (as
    /// `SuspendPoint::ImplicitComb`) and `OneStepDelay` (as `SuspendPoint::
    /// OneStep`), and revises `CycleDelay` to carry its inferred clock
    /// signal/edge as real payload instead of discarding it. `Delay3` (not
    /// applicable to a procedural suspend point at all), `BlockEventList` (a
    /// verified, hard upstream `sv-lang`=0.1.9 API gap) and `RepeatedEvent`
    /// (verified structurally unreachable at this dispatch point -- see that
    /// arm below) remain named [`LoweringError`]s.
    /// See [`Self::walk_stmt`]'s doc comment: `TimingControlKind` is also
    /// `#[non_exhaustive]` upstream, so this dispatch is likewise an
    /// `if`/`else-if` chain (pinned by
    /// `determinism::kind_guard::timing_control_kind_count_matches_pinned_
    /// sv_lang_version`, `TimingControlKind::COUNT == 10`), not a literal
    /// `match`.
    fn walk_timed(&mut self, stmt: Statement<'d>, cur: BlockId) -> Result<BlockId, LoweringError> {
        let tc = stmt
            .timing_control()
            .ok_or_else(|| LoweringError::malformed("Timed statement with no timing control"))?;
        if !class_event_wait_terms(&tc)?.is_empty() && class_event_wait_is_mixed(&tc) {
            // `@(ce or sig ...)` (LRM 1800-2023 9.4.2.1, 15.5): the process
            // waits on a class event (a runtime queue) and on signals (the
            // sensitivity table) at once. The leaf statement queues it on the
            // class events without blocking, the suspend is the signal
            // wait, and whichever wakes it first wins: the resume block leaves
            // the class queues (`ClassEventLeave`), and a class trigger
            // desensitises the signal side (`Engine::apply_sync_wake`).
            let guarded = stmt
                .body()
                .ok_or_else(|| LoweringError::malformed("Timed statement with no guarded body"))?;
            self.skip_class_event_terms = true;
            let point = self.suspend_point(tc, None);
            self.skip_class_event_terms = false;
            let point = point?;
            self.push(cur, stmt);
            let resume = self.alloc_block();
            self.blocks[resume.0 as usize]
                .bindings
                .push(ArgBinding::ClassEventLeave);
            self.close(
                cur,
                Terminator::Suspend {
                    point,
                    resume_blk: resume,
                },
            );
            return self.walk_stmt(guarded, resume);
        }
        if !class_event_wait_terms(&tc)?.is_empty() {
            // `@e` on a class event (LRM 1800-2023 15.5): the statement is the
            // leaf that queues the process on the event's runtime object; the
            // suspend after it lets the scheduler apply the block request,
            // like a blocking `semaphore.get`. Codegen lowers only the wait of
            // this leaf (the guarded body follows in the resumed block).
            let guarded = stmt
                .body()
                .ok_or_else(|| LoweringError::malformed("Timed statement with no guarded body"))?;
            if let Some(iff) = extract_iff(&tc) {
                // `@(e iff c)` (LRM 1800-2023 9.4.2.3): the event wakes the
                // process, which continues only if `c` holds then; otherwise
                // it waits for the event again. A loop around the plain wait.
                let header = self.alloc_block();
                let body = self.alloc_block();
                let exit = self.alloc_block();
                let resume = self.alloc_block();
                self.close(
                    cur,
                    Terminator::Loop {
                        header,
                        body,
                        exit,
                        entry: header,
                    },
                );
                self.close(header, Terminator::Fallthrough(body));
                self.push(body, stmt);
                self.close(
                    body,
                    Terminator::Suspend {
                        point: SuspendPoint::ByRequest,
                        resume_blk: resume,
                    },
                );
                self.close(
                    resume,
                    Terminator::Branch {
                        cond: iff,
                        then_blk: exit,
                        else_blk: header,
                    },
                );
                return self.walk_stmt(guarded, exit);
            }
            self.push(cur, stmt);
            let resume = self.alloc_block();
            self.close(
                cur,
                Terminator::Suspend {
                    point: SuspendPoint::ByRequest,
                    resume_blk: resume,
                },
            );
            return self.walk_stmt(guarded, resume);
        }
        self.allow_dynamic_cycle = true;
        let point = self.suspend_point(tc, stmt.body());
        self.allow_dynamic_cycle = false;
        let point = point?;
        let guarded = stmt
            .body()
            .ok_or_else(|| LoweringError::malformed("Timed statement with no guarded body"))?;
        if let Some(count) = self.dynamic_cycle_count.take() {
            // `##(expr)` with a run-time count (LRM 14.11): `repeat (expr)`
            // around one `##1` wait, the count evaluated once on entry. A
            // count <= 0 waits for no clock event.
            let entry = self.alloc_block();
            self.close(cur, Terminator::Fallthrough(entry));
            let counter = self.alloc_repeat_counter();
            self.set_repeat_init(entry, counter, RepeatCount::Expr(count));
            let header = self.alloc_block();
            let body = self.alloc_block();
            let exit = self.alloc_block();
            let resume = self.alloc_block();
            self.close(
                entry,
                Terminator::Loop {
                    header,
                    body,
                    exit,
                    entry: header,
                },
            );
            self.close(
                header,
                Terminator::RepeatCheck {
                    counter,
                    then_blk: body,
                    else_blk: exit,
                },
            );
            self.close(
                body,
                Terminator::Suspend {
                    point,
                    resume_blk: resume,
                },
            );
            self.set_repeat_decrement(resume, counter);
            self.close(resume, Terminator::Fallthrough(header));
            return self.walk_stmt(guarded, exit);
        }
        let resume = self.alloc_block();
        self.close(
            cur,
            Terminator::Suspend {
                point,
                resume_blk: resume,
            },
        );
        self.walk_stmt(guarded, resume)
    }

    /// `lhs = #d rhs;`, `lhs = @(e) rhs;`, `lhs = repeat (n) @(e) rhs;` (LRM
    /// 1800-2023 §10.4.1): the right-hand side is evaluated now into a
    /// compiler temporary ([`ArgBinding::Capture`]), the process waits, then
    /// the temporary is assigned ([`ArgBinding::AssignCaptured`]).
    fn walk_intra_assignment_timing(
        &mut self,
        assign: Expression<'d>,
        cur: BlockId,
    ) -> Result<BlockId, LoweringError> {
        let tc = assign
            .assignment_timing()
            .and_then(|n| n.as_timing_control())
            .ok_or_else(|| LoweringError::malformed("assignment timing is not a timing control"))?;
        let target = assign
            .left()
            .ok_or_else(|| LoweringError::malformed("assignment with no target"))?;
        let value = assign
            .right()
            .ok_or_else(|| LoweringError::malformed("assignment with no value"))?;
        let temp = self.captures.len() as u32;
        self.captures.push(target);
        // A fresh block: its bindings run before anything else in it, and
        // the capture must follow `cur`'s own statements.
        let capture = self.alloc_block();
        self.close(cur, Terminator::Fallthrough(capture));
        self.blocks[capture.0 as usize]
            .bindings
            .push(ArgBinding::Capture { temp, value });
        self.drive_clocking = drive_clocking_of(target);
        self.drive_via = drive_via_of(target);
        let after = if tc.kind() == TimingControlKind::RepeatedEvent {
            // `repeat (n) @(e)`: wait for `n` occurrences of `e` -- a counted
            // loop around one suspend (a count <= 0 waits for none).
            let count = first_expression_child(&tc).ok_or_else(|| {
                LoweringError::malformed("repeated event control with no count expression")
            })?;
            let event = tc
                .children()
                .into_iter()
                .find_map(|n| n.as_timing_control())
                .ok_or_else(|| {
                    LoweringError::malformed("repeated event control with no event control")
                })?;
            let point = self.suspend_point(event, None)?;
            let counter = self.alloc_repeat_counter();
            self.set_repeat_init(capture, counter, RepeatCount::Expr(count));
            let header = self.alloc_block();
            let body = self.alloc_block();
            let exit = self.alloc_block();
            let resume = self.alloc_block();
            self.close(
                capture,
                Terminator::Loop {
                    header,
                    body,
                    exit,
                    entry: header,
                },
            );
            self.close(
                header,
                Terminator::RepeatCheck {
                    counter,
                    then_blk: body,
                    else_blk: exit,
                },
            );
            self.close(
                body,
                Terminator::Suspend {
                    point,
                    resume_blk: resume,
                },
            );
            self.set_repeat_decrement(resume, counter);
            self.close(resume, Terminator::Fallthrough(header));
            exit
        } else {
            let point = self.suspend_point(tc, None)?;
            let resume = self.alloc_block();
            self.close(
                capture,
                Terminator::Suspend {
                    point,
                    resume_blk: resume,
                },
            );
            resume
        };
        self.drive_clocking = None;
        self.drive_via = None;
        self.blocks[after.0 as usize]
            .bindings
            .push(ArgBinding::AssignCaptured {
                temp,
                target,
                nba: false,
            });
        Ok(after)
    }

    /// `lhs <= @(e) rhs;`, `lhs <= repeat (n) @(e) rhs;` (LRM 1800-2023
    /// §10.4.2, §9.4.5): the right-hand side (and the repeat count) are
    /// evaluated now into the compiler temporaries of this process, which
    /// goes straight on; a synthetic `join_none` branch, spawned here with
    /// copies of those temporaries ([`ProcessCfg::inherited`]), waits for
    /// the event control and then stages the nonblocking update.
    ///
    /// Deviation: the branch is a child of this process like any forked
    /// one, so a later `wait fork;` waits for the pending update and
    /// `disable fork;` cancels it.
    fn walk_nba_event(
        &mut self,
        stmt: Statement<'d>,
        assign: Expression<'d>,
        cur: BlockId,
    ) -> Result<BlockId, LoweringError> {
        let tc = assign
            .assignment_timing()
            .and_then(|n| n.as_timing_control())
            .ok_or_else(|| LoweringError::malformed("assignment timing is not a timing control"))?;
        let target = assign
            .left()
            .ok_or_else(|| LoweringError::malformed("assignment with no target"))?;
        let value = assign
            .right()
            .ok_or_else(|| LoweringError::malformed("assignment with no value"))?;
        let temp = self.captures.len() as u32;
        self.captures.push(target);
        let capture = self.alloc_block();
        self.close(cur, Terminator::Fallthrough(capture));
        self.blocks[capture.0 as usize]
            .bindings
            .push(ArgBinding::Capture { temp, value });

        // The branch: its own builder, with this walk's context.
        let mut b = CfgBuilder::new();
        b.this_stack.extend(self.this_stack.last().copied());
        b.ref_stack = self.ref_stack.clone();
        b.global_clock = self.global_clock;
        b.virtual_tasks = self.virtual_tasks.clone();
        b.fork_branch_names = self.fork_branch_names.clone();
        b.ancestor_blocks = self.ancestor_blocks.clone();
        b.default_clocking = self.default_clocking;
        b.drive_clocking = drive_clocking_of(target);
        b.drive_via = drive_via_of(target);
        b.checker_clock = self.checker_clock;
        b.captures.push(target);
        let mut inherited = vec![InheritedSlot::Temp {
            parent: temp,
            child: 0,
        }];
        let entry = b.alloc_block();
        let event_roots = vec![target.as_sem_node(), tc.as_sem_node()];
        // `lhs <= ##(n) v` with a run-time count (LRM 14.11, 14.16): the count
        // is evaluated here and the branch loops one `##1` wait that often,
        // like `repeat (n) @(clk)`.
        let mut dyn_cycle: Option<(Expression<'d>, SuspendPoint)> = None;
        let mut const_point: Option<SuspendPoint> = None;
        if tc.kind() == TimingControlKind::CycleDelay {
            b.allow_dynamic_cycle = true;
            let point = b.suspend_point(tc, None);
            b.allow_dynamic_cycle = false;
            let point = point?;
            match b.dynamic_cycle_count.take() {
                Some(count) => dyn_cycle = Some((count, point)),
                None => const_point = Some(point),
            }
        }
        let after = if dyn_cycle.is_some() || tc.kind() == TimingControlKind::RepeatedEvent {
            let (count, point) = if let Some(d) = dyn_cycle.take() {
                d
            } else {
                let count = first_expression_child(&tc).ok_or_else(|| {
                    LoweringError::malformed("repeated event control with no count expression")
                })?;
                let event = tc
                    .children()
                    .into_iter()
                    .find_map(|n| n.as_timing_control())
                    .ok_or_else(|| {
                        LoweringError::malformed("repeated event control with no event control")
                    })?;
                (count, b.suspend_point(event, None)?)
            };
            // The count is evaluated here, in this process.
            let parent_counter = self.alloc_repeat_counter();
            self.set_repeat_init(capture, parent_counter, RepeatCount::Expr(count));
            let counter = b.alloc_repeat_counter();
            inherited.push(InheritedSlot::Counter {
                parent: parent_counter,
                child: counter,
            });
            b.set_repeat_init(entry, counter, RepeatCount::Inherited(count));
            let header = b.alloc_block();
            let body = b.alloc_block();
            let exit = b.alloc_block();
            let resume = b.alloc_block();
            b.close(
                entry,
                Terminator::Loop {
                    header,
                    body,
                    exit,
                    entry: header,
                },
            );
            b.close(
                header,
                Terminator::RepeatCheck {
                    counter,
                    then_blk: body,
                    else_blk: exit,
                },
            );
            b.close(
                body,
                Terminator::Suspend {
                    point,
                    resume_blk: resume,
                },
            );
            b.set_repeat_decrement(resume, counter);
            b.close(resume, Terminator::Fallthrough(header));
            exit
        } else {
            let point = match const_point.take() {
                Some(p) => p,
                None => b.suspend_point(tc, None)?,
            };
            let resume = b.alloc_block();
            b.close(
                entry,
                Terminator::Suspend {
                    point,
                    resume_blk: resume,
                },
            );
            resume
        };
        b.blocks[after.0 as usize]
            .bindings
            .push(ArgBinding::AssignCaptured {
                temp: 0,
                target,
                nba: true,
            });
        b.close(after, Terminator::End { loop_back: None });
        let inlined_locals = std::mem::take(&mut b.inlined_locals);
        let captures = std::mem::take(&mut b.captures);
        let ref_bindings = b.take_ref_bindings();
        let disable_scopes = b.take_disable_scopes();
        let disable_broadcast = std::mem::take(&mut b.disable_broadcast);
        let fork_branch_names = std::mem::take(&mut b.fork_branch_names);
        let mut branch = ProcessCfg {
            blocks: b.finish(),
            entry,
            body: stmt,
            inlined_locals,
            captures,
            captured: Vec::new(),
            ref_bindings,
            disable_names: Vec::new(),
            fork_branch_names,
            disable_scopes,
            disable_broadcast,
            inherited,
            capture_types: Vec::new(),
            recursion: Recursion::None,
            share_id: None,
        };
        // It shares the variables its event control and target name.
        branch.captured = captured_in(event_roots);
        branch
            .captured
            .retain(|c| !self.ref_stack.iter().any(|(f, _)| f.uid() == c.uid()));
        if let Some(t) = self.this_stack.last()
            && !branch.captured.iter().any(|c| c.uid() == t.uid())
        {
            branch.captured.push(*t);
        }
        let join_blk = self.alloc_block();
        self.close(
            capture,
            Terminator::ForkJoin {
                kind: StatementBlockKind::JoinNone,
                branches: vec![branch],
                join_blk,
            },
        );
        Ok(join_blk)
    }

    /// A signal event's `(signal, edge)` with a checker's `$inferred_clock` (17.4)
    /// replaced by the clocking event of the instantiation context. Any other
    /// event is returned as written. A checker instantiated where no clock is
    /// inferred is a loud error, never a wait on nothing.
    fn resolve_inferred_clock(
        &self,
        signal: Expression<'d>,
        edge: EdgeKind,
    ) -> Result<InferredClockEvent<'d>, LoweringError> {
        if is_global_clock_call(&signal) {
            // `@$global_clock` (14.14, 17.7's counter_model): the global
            // clocking's event.
            return self.global_clock.ok_or_else(|| {
                LoweringError::unsupported(
                    "`@$global_clock` as a procedural event control needs a `global clocking` \
                     declared in the process's instance or an enclosing one (LRM 14.14); none \
                     is in scope",
                )
            });
        }
        if !is_inferred_clock_call(&signal) {
            return Ok((signal, edge, None));
        }
        self.checker_clock.ok_or_else(|| {
            LoweringError::unsupported(
                "`$inferred_clock` (LRM 17.4) as the event control of a checker procedure: the \
                 checker is instantiated where no default clocking applies (14.12), so no \
                 clock is inferred",
            )
        })
    }

    /// The suspend point a timing control waits on; `guarded` is the
    /// statement an `@*` implicit event control guards (its reads are the
    /// sensitivity).
    fn suspend_point(
        &mut self,
        tc: TimingControl<'d>,
        guarded: Option<Statement<'d>>,
    ) -> Result<SuspendPoint<'d>, LoweringError> {
        let tc_kind = tc.kind();

        let point = if tc_kind == TimingControlKind::Invalid {
            return Err(LoweringError::malformed("Invalid timing control kind"));
        } else if tc_kind == TimingControlKind::Delay {
            let expr = first_expression_child(&tc).ok_or_else(|| {
                LoweringError::malformed("Delay timing control with no delay expression")
            })?;
            SuspendPoint::Delay(expr, self.frame_stack.last().map(|f| f.0))
        } else if tc_kind == TimingControlKind::SignalEvent {
            let edge = tc.edge();
            let signal = first_expression_child(&tc).ok_or_else(|| {
                LoweringError::malformed("SignalEvent timing control with no signal expression")
            })?;
            reject_chandle_event(&signal)?;
            let iff = extract_iff(&tc);
            let (signal, edge, inferred_iff) = self.resolve_inferred_clock(signal, edge)?;
            // `@clock iff c` on an inferred clock that itself has an `iff`
            // needs both guards (a conjunction, LRM 17.4): a one-member
            // event list carries them; `Edge` has room for one only.
            if let (Some(a), Some(b)) = (iff, inferred_iff) {
                if edge == EdgeKind::PosEdge || edge == EdgeKind::NegEdge {
                    self.note_edge_signal(signal, edge);
                }
                return Ok(SuspendPoint::EdgeList(
                    vec![(signal, edge)],
                    vec![vec![a, b]],
                ));
            }
            let iff = iff.or(inferred_iff);
            if edge != EdgeKind::PosEdge && edge != EdgeKind::NegEdge {
                // `@(a)` (any change) / `@(edge a)`: a one-entry event list,
                // resolved through the program's wait table like `@(a or b)`.
                // With `iff` (LRM 1800-2023 9.4.2.3: `@(e iff c)` waits for a
                // change of `e`, or for the event, and then for `c`) it is a
                // single `Edge` term carrying its guard.
                if iff.is_some() {
                    SuspendPoint::Edge { signal, edge, iff }
                } else {
                    SuspendPoint::EdgeList(vec![(signal, edge)], vec![Vec::new()])
                }
            } else {
                self.note_edge_signal(signal, edge);
                SuspendPoint::Edge { signal, edge, iff }
            }
        } else if tc_kind == TimingControlKind::EventList {
            // Task 1: `@(a or b or c)` -- wake on any member. Each child is
            // itself a nested `TimingControl` (in practice always
            // `SignalEvent`, per the grammar). A member's `iff` (LRM
            // 1800-2023 9.4.2.3) rides along per member in the point's
            // second field.
            let mut entries = Vec::new();
            let mut iffs = Vec::new();
            for child in tc.children() {
                let sub_tc = child.as_timing_control().ok_or_else(|| {
                    LoweringError::malformed(
                        "EventList timing control with a non-timing-control child",
                    )
                })?;
                let edge = sub_tc.edge();
                let signal = first_expression_child(&sub_tc).ok_or_else(|| {
                    LoweringError::malformed(
                        "EventList member timing control with no signal expression",
                    )
                })?;
                if self.skip_class_event_terms && is_class_event_expr(&signal) {
                    continue;
                }
                reject_chandle_event(&signal)?;
                let iff = extract_iff(&sub_tc);
                let (signal, edge, inferred_iff) = self.resolve_inferred_clock(signal, edge)?;
                if edge == EdgeKind::PosEdge || edge == EdgeKind::NegEdge {
                    self.note_edge_signal(signal, edge);
                }
                entries.push((signal, edge));
                iffs.push(iff.into_iter().chain(inferred_iff).collect());
            }
            if entries.is_empty() {
                return Err(LoweringError::malformed(
                    "EventList timing control with no member event controls",
                ));
            }
            SuspendPoint::EdgeList(entries, iffs)
        } else if tc_kind == TimingControlKind::CycleDelay {
            // Task 1 shape, Task 6 (CG-171) revised semantics -- see
            // `SuspendPoint::CycleDelay`'s own doc comment for the full
            // reasoning. Still a named `LoweringError`, never a silent
            // "assume 1 clock unit", when there is no unambiguous single
            // clock in scope.
            let count_expr = first_expression_child(&tc).ok_or_else(|| {
                LoweringError::malformed("CycleDelay timing control with no count expression")
            })?;
            let constant = count_expr
                .constant_value()
                .and_then(|v| v.as_i64())
                .and_then(|v| u32::try_from(v).ok());
            let count = match constant {
                Some(c) => c,
                None if self.allow_dynamic_cycle => {
                    self.dynamic_cycle_count = Some(count_expr);
                    1
                }
                None => {
                    return Err(LoweringError::unsupported(
                        "a non-constant cycle delay `##(expr)` in an intra-assignment timing \
                         control (LRM 14.11 allows a run-time count only as a statement \
                         delay; this simulator needs a compile-time constant here)",
                    ));
                }
            };
            // The default clocking block's event (LRM 1800-2023 §14.11),
            // else the process's own inferred clock.
            let (clock, edge) = match (
                self.drive_clocking.or(self.default_clocking),
                self.inferred_clock,
            ) {
                (Some(cb), _) => (cb, EdgeKind::BothEdges),
                (None, Some(Some((signal, edge)))) => (
                    signal.referenced_symbol().ok_or_else(|| {
                        LoweringError::unsupported("CycleDelay (`##N`) clock with no symbol")
                    })?,
                    edge,
                ),
                _ => {
                    return Err(LoweringError::unsupported(
                        "CycleDelay (`##N`) with no unambiguous single inferred clock in scope \
                         (no enclosing posedge/negedge edge, or more than one distinct clock \
                         signal/edge seen) -- ARCHITECTURE §6.5's own \"ClockDomain the scheduler \
                         needs\" requirement",
                    ));
                }
            };
            let via = if self.drive_clocking.is_some() {
                self.drive_via
            } else {
                None
            };
            SuspendPoint::CycleDelay {
                count,
                clock,
                edge,
                via,
            }
        } else if tc_kind == TimingControlKind::ImplicitEvent {
            // Task 6 (CG-081): `@*`/`@(*)`. See `SuspendPoint::ImplicitComb`'s
            // own doc comment for why the read-set is captured here (AST-only,
            // no live Analysis handle reaches this crate).
            let body_stmt = guarded.ok_or_else(|| {
                LoweringError::unsupported(
                    "an `@*` event control with no guarded statement (an intra-assignment `@*`)",
                )
            })?;
            SuspendPoint::ImplicitComb(implicit_comb_read_set(&body_stmt))
        } else if tc_kind == TimingControlKind::RepeatedEvent {
            // Task 6 (CG-081): `repeat(count) @(...)`. **Verified,
            // structurally unreachable at this dispatch point, never a scope
            // choice** -- empirically probed against the pinned
            // `sv-lang`=0.1.9 parser (a throwaway test compiling `initial q
            // <= repeat(3) @(posedge clk) 1;` and dumping the AST): a
            // `RepeatedEventControl` node is NEVER the outer `TimingControl`
            // of a `StatementKind::Timed` node at all. Two independent
            // parser facts combine to make this so: (1) `Parser::
            // parseStatement`'s own dispatch switch (`Parser_statements.cpp`)
            // sends a leading `repeat` keyword straight to
            // `parseLoopStatement` (producing `StatementKind::RepeatLoop`,
            // already handled by `walk_stmt`/`is_ordinary_statement_kind`) --
            // it never reaches `parseTimingControl()` at all, so
            // `repeat(3) @(posedge clk) q = 1;` used directly as a statement
            // parses as "run `@(posedge clk) q = 1;` 3 times", not "wait for
            // clk's 3rd posedge, then run `q = 1;` once". (2) The ONLY
            // grammar position `parseTimingControl()`'s own `RepeatKeyword`
            // case (`Parser_expressions.cpp`) is ever reached from is
            // `parseSubExpression`'s `isPossibleDelayOrEventControl` check --
            // i.e. `RepeatedEventControl` is only ever constructible as an
            // INTRA-ASSIGNMENT timing control embedded in an `Assignment`
            // expression's own `.children()` (confirmed empirically: `q <=
            // repeat(3) @(posedge clk) 1;` parses as one
            // `StatementKind::ExpressionStatement` whose `Assignment`
            // expression's `children()` is `[TimingControl(RepeatedEvent),
            // NamedValue, Conversion]` -- verified against
            // `AssignmentExpression::visitExprs` in the vendored slang C++,
            // `if (timingControl) timingControl->visit(visitor); left()...;
            // right()...;`), never a `Statement::timing_control()` at all.
            // The intra-assignment form is lowered by
            // `walk_intra_assignment_timing` (the right-hand side captured in
            // a `Temporary` frame slot before the counted wait), which asks
            // this function only for the inner event control's suspend
            // point -- so reaching this arm means a malformed AST.
            return Err(LoweringError::unsupported(
                "RepeatedEvent timing control (`repeat(n) @(...)`) can never be the outer \
                 TimingControlKind of a Timed statement -- `repeat` at statement-position \
                 always parses as StatementKind::RepeatLoop instead, and RepeatedEventControl \
                 is only ever producible as an intra-assignment timing control, which \
                 walk_intra_assignment_timing lowers",
            ));
        } else if tc_kind == TimingControlKind::OneStepDelay {
            // Task 6 (CG-081): `#0` / the built-in `1step` delay -- see
            // `SuspendPoint::OneStep`'s own doc comment.
            SuspendPoint::OneStep
        } else if tc_kind == TimingControlKind::BlockEventList {
            // LRM 19.3: a block event list `@@(begin f)` is only ever a
            // covergroup's sampling event (lowered by `covergroup` block-event
            // registration); slang rejects it as a procedural timing control
            // at parse ("expected statement"), so this arm is unreachable.
            return Err(LoweringError::unsupported(
                "a block event list `@@(...)` as a procedural timing control (LRM 19.3: \
                 only a covergroup sampling event)",
            ));
        } else if tc_kind == TimingControlKind::Delay3 {
            // Delay3Control (`#(d1,d2,d3)`) is gate-primitive rise/fall/
            // turn-off delay syntax (LRM 28.14) -- not applicable to a
            // procedural `Timed` statement's suspend point at all (CG-081's
            // own 8-kind enumeration excludes it), so this stays a named
            // `LoweringError` unconditionally, not a gap this task closes.
            return Err(LoweringError::unsupported(
                "Delay3 timing control (gate-primitive rise/fall/turn-off delay syntax -- not \
                 applicable to a procedural statement's suspend point)",
            ));
        } else {
            // Unreachable as long as `determinism::kind_guard`'s pinned
            // `TimingControlKind::COUNT == 10` still holds -- see
            // `walk_stmt`'s identical reasoning for `StatementKind`.
            return Err(LoweringError::malformed(format!(
                "unrecognized TimingControlKind {tc_kind:?} (sv-lang-kinds version drift -- \
                 see determinism::kind_guard's TimingControlKind pin)"
            )));
        };
        Ok(point)
    }

    /// Task 3 (PR-006's shape from Task 1, real semantics from CG-169/
    /// CG-115 here): `wait(expr) stmt;` (LRM 9.4.3). Unlike every other
    /// `Timed`/`Wait`-family suspend point, this one does NOT
    /// unconditionally close `cur` with `Terminator::Suspend` -- LRM 9.4.3 is
    /// an *immediate check with a conditional suspend*: if `expr` is already
    /// true the moment execution reaches it, there is NO suspend/resume
    /// round-trip at all (straight fallthrough into the guarded body, same
    /// call); only a false evaluation actually suspends. This is
    /// structurally the same "sometimes there's no suspend point at all"
    /// shape `docs/design/process.md` §2 calls out by name, and it is
    /// represented here exactly like any other runtime-decided branch: a
    /// `Terminator::Branch` whose `then_blk` is the guarded body's own entry
    /// block (`resume`) and whose `else_blk` is a fresh block that alone
    /// carries the real `Terminator::Suspend{point: SuspendPoint::Level(cond),
    /// resume_blk: resume}` -- `resume` is deliberately the SAME `BlockId` on
    /// both edges, so there genuinely is a suspend-free path from `cur` to
    /// the guarded body in the built `ProcessCfg` (a purely structural,
    /// compile-time fact -- codegen decides which edge is taken at
    /// simulation runtime by reusing the exact same generic branch-condition
    /// lowering `if`/`while` already use, `docs/design/process.md`'s own
    /// `is_definitely_true` reduction list explicitly includes "wait()
    /// condition" alongside "if"/"while" for this reason, PR-069's
    /// `Terminator`/`SuspendPoint` "cross-check against
    /// contains_suspend_trigger" extension policy). `resume`'s own entry is
    /// therefore executed either way (already-true fallthrough, or a genuine
    /// resume from the scheduler after the `Suspend` fires) -- the
    /// resume-prologue re-check that makes a spurious wake re-suspend
    /// without running the body is CG-115's own job, entirely on the
    /// codegen side (`sv-sim-codegen::process_lower::compile_iff_guard`);
    /// this crate never evaluates `expr` itself (no runtime state reaches
    /// this AST-only builder).
    fn walk_wait(&mut self, stmt: Statement<'d>, cur: BlockId) -> Result<BlockId, LoweringError> {
        let cond = stmt.condition().ok_or_else(|| {
            LoweringError::malformed("Wait statement with no condition expression")
        })?;
        let resume = self.alloc_block();
        let suspend_blk = self.alloc_block();
        self.close(
            cur,
            Terminator::Branch {
                cond,
                then_blk: resume,
                else_blk: suspend_blk,
            },
        );
        self.close(
            suspend_blk,
            Terminator::Suspend {
                point: SuspendPoint::Level(cond),
                resume_blk: resume,
            },
        );
        let guarded = stmt
            .body()
            .ok_or_else(|| LoweringError::malformed("Wait statement with no guarded body"))?;
        self.walk_stmt(guarded, resume)
    }

    /// `-> ev;` / `->> ev;` / `->> #d ev;` / `->> @(ctl) ev;` (LRM 1800-2023
    /// 15.5.1, 15.5.2). An `EventTrigger` with no timing, or with a `#d`
    /// delay, never suspends the issuer -- it is one ordinary leaf (codegen
    /// stages the delayed trigger as a nonblocking update). One with an event
    /// control (`->> @(ctl) ev;`) forks a detached one-shot process that
    /// waits on `ctl` and then triggers, so the issuer continues at once
    /// (`spawn_detached_trigger`).
    fn walk_event_trigger(
        &mut self,
        stmt: Statement<'d>,
        cur: BlockId,
    ) -> Result<BlockId, LoweringError> {
        let detached = std::mem::take(&mut self.detached_trigger);
        let Some(timing_node) = stmt.timing() else {
            self.push(cur, stmt);
            return Ok(cur);
        };
        let tc = timing_node.as_timing_control().ok_or_else(|| {
            LoweringError::malformed("EventTrigger timing is not a TimingControl node")
        })?;
        if tc.kind() == TimingControlKind::Delay {
            // `->> #d e;` never blocks the issuer: the trigger is staged as a
            // nonblocking update `d` ticks out (codegen reads the delay).
            self.push(cur, stmt);
            return Ok(cur);
        }
        if !detached {
            // `->> @(ctl) e;`: the issuer continues at once; a detached
            // process waits for `ctl`, then stages the trigger.
            return self.spawn_detached_trigger(stmt, cur, ProcessLoopKind::OneShot);
        }
        let point = self.suspend_point(tc, None)?;
        let resume = self.alloc_block();
        self.close(
            cur,
            Terminator::Suspend {
                point,
                resume_blk: resume,
            },
        );
        self.push(resume, stmt);
        Ok(resume)
    }

    /// Forks the detached one-shot process of `->> @(ctl) e;` (see
    /// [`Self::detached_trigger`]) and continues the issuer past it.
    fn spawn_detached_trigger(
        &mut self,
        stmt: Statement<'d>,
        cur: BlockId,
        loop_kind: ProcessLoopKind,
    ) -> Result<BlockId, LoweringError> {
        let mut branch = build_cfg_in(
            &stmt,
            loop_kind,
            None,
            self.default_clocking,
            None,
            self.checker_clock,
            Inherited {
                this_var: self.this_stack.last().copied(),
                ref_aliases: self.ref_stack.clone(),
                global_clock: self.global_clock,
                detached_trigger: true,
                forced_extern: None,
                rec_outer: self.rec_outer.clone(),
                fork_memo: Some(self.fork_memo.clone()),
                rec: None,
                rec_up: Vec::new(),
                known_fork_labels: Vec::new(),
                ancestor_blocks: Vec::new(),
            },
            self.virtual_tasks.clone(),
        )?;
        branch.captured = captured_vars(&branch);
        branch
            .captured
            .retain(|c| !self.ref_stack.iter().any(|(f, _)| f.uid() == c.uid()));
        if let Some(t) = self.this_stack.last()
            && !branch.captured.iter().any(|c| c.uid() == t.uid())
        {
            branch.captured.push(*t);
        }
        let join_blk = self.alloc_block();
        self.close(
            cur,
            Terminator::ForkJoin {
                kind: StatementBlockKind::JoinNone,
                branches: vec![branch],
                join_blk,
            },
        );
        Ok(join_blk)
    }

    /// `$async$and$array(mem, in, out);` and its seven siblings (LRM 1800-2023
    /// 20.16.1): the logic array is evaluated at the call, and again whenever
    /// an input term or any word of the personality memory changes. The
    /// issuer evaluates once (the call is an ordinary leaf) and forks a
    /// detached looping process that evaluates, waits on the operands' read
    /// set, and re-runs the same statement on each wake (the
    /// `detached_trigger` flag marks that process's own copy, so it does not
    /// fork again).
    fn walk_async_pla(
        &mut self,
        stmt: Statement<'d>,
        cur: BlockId,
    ) -> Result<BlockId, LoweringError> {
        let detached = std::mem::take(&mut self.detached_trigger);
        if !detached {
            self.push(cur, stmt);
            return self.spawn_detached_trigger(stmt, cur, ProcessLoopKind::Looping);
        }
        // Evaluate first, then wait: an input that changed between the fork
        // and this process's first run (same time step) is not missed.
        let reads = async_pla_read_set(&stmt);
        let resume = self.alloc_block();
        self.push(cur, stmt);
        self.close(
            cur,
            Terminator::Suspend {
                point: SuspendPoint::ImplicitComb(reads),
                resume_blk: resume,
            },
        );
        Ok(resume)
    }

    /// A call statement `stmt` to the interface `extern` method `targets`
    /// (LRM 25.7), when the call needs the CFG: it runs the implementation
    /// inline (one), or as the branches of a `fork`...`join` (an `extern
    /// forkjoin` task with several, 25.7.5), or reports the run-time error of
    /// a forkjoin task nothing implements and returns with no effect.
    /// `None` when the call is an ordinary leaf (every implementation runs
    /// without suspending: the code generator calls them in turn).
    fn walk_extern_call(
        &mut self,
        stmt: Statement<'d>,
        call: Expression<'d>,
        targets: &crate::netlist::itf::ExternTargets<'d>,
        cur: BlockId,
    ) -> Result<Option<BlockId>, LoweringError> {
        // One branch of an enclosing fork: this implementation only.
        if let Some(imp) = self.forced_extern.take() {
            return self.inline_task_call(call, imp, cur).map(Some);
        }
        if targets.impls.is_empty() {
            let join = self.alloc_block();
            self.close(
                cur,
                Terminator::Switch {
                    on: SwitchOn::NoTarget {
                        what: format!(
                            "no module connected to the interface implements extern forkjoin \
                             task `{}`; the call has no effect",
                            targets.proto.name()
                        ),
                    },
                    arms: Vec::new(),
                    default_blk: join,
                    report: Some(call.source_range().start),
                },
            );
            return Ok(Some(join));
        }
        if !targets.impls.iter().any(subroutine_can_suspend) {
            return Ok(None);
        }
        if targets.impls.len() == 1 {
            return self.inline_task_call(call, targets.impls[0], cur).map(Some);
        }
        // Every implementation as a branch of one `fork`...`join` (the call
        // returns when all have).
        let mut branches = Vec::with_capacity(targets.impls.len());
        for imp in &targets.impls {
            let mut branch = build_cfg_in(
                &stmt,
                ProcessLoopKind::OneShot,
                None,
                self.default_clocking,
                None,
                self.checker_clock,
                Inherited {
                    this_var: self.this_stack.last().copied(),
                    ref_aliases: self.ref_stack.clone(),
                    global_clock: self.global_clock,
                    detached_trigger: false,
                    forced_extern: Some(*imp),
                    rec_outer: self.rec_outer.clone(),
                    fork_memo: Some(self.fork_memo.clone()),
                    rec: None,
                    rec_up: Vec::new(),
                    known_fork_labels: self.fork_branch_names.clone(),
                    ancestor_blocks: self.ancestor_blocks.clone(),
                },
                self.virtual_tasks.clone(),
            )?;
            branch.captured = captured_vars(&branch);
            branch
                .captured
                .retain(|c| !self.ref_stack.iter().any(|(f, _)| f.uid() == c.uid()));
            if let Some(t) = self.this_stack.last()
                && !branch.captured.iter().any(|c| c.uid() == t.uid())
            {
                branch.captured.push(*t);
            }
            branches.push(branch);
        }
        let join_blk = self.alloc_block();
        self.close(
            cur,
            Terminator::ForkJoin {
                kind: StatementBlockKind::JoinAll,
                branches,
                join_blk,
            },
        );
        Ok(Some(join_blk))
    }

    /// PR-045 (Task 1): `while (cond) body;`. `header` evaluates `cond`
    /// every iteration (re-checked, not cached) and branches to `body` or
    /// `exit`; `body`'s own exit closes the back edge to `header`; the real
    /// entry from `cur` is `header` (the condition is checked before the
    /// first iteration).
    fn walk_while_loop(
        &mut self,
        stmt: Statement<'d>,
        cur: BlockId,
    ) -> Result<BlockId, LoweringError> {
        let cond = stmt
            .condition()
            .ok_or_else(|| LoweringError::malformed("WhileLoop with no condition expression"))?;
        let body_stmt = stmt
            .body()
            .ok_or_else(|| LoweringError::malformed("WhileLoop with no body statement"))?;

        let header = self.alloc_block();
        let body = self.alloc_block();
        let exit = self.alloc_block();
        // 38.36.1.2: before the condition, on every iteration.
        self.probe(header, stmt);
        self.close(
            cur,
            Terminator::Loop {
                header,
                body,
                exit,
                entry: header,
            },
        );
        self.close(
            header,
            Terminator::Branch {
                cond,
                then_blk: body,
                else_blk: exit,
            },
        );
        let body_exit = self.walk_loop_body(body_stmt, body, header, exit)?;
        self.close(body_exit, Terminator::Fallthrough(header));
        Ok(exit)
    }

    /// PR-045 (Task 1): `do body; while (cond);`. Unlike `while`, `body`
    /// always runs once *before* any check -- the real entry from `cur` is
    /// `body` itself (`Terminator::Loop::entry`), and `header` (the
    /// post-body recheck, reached only via `body`'s own back edge) branches
    /// back to `body` or out to `exit`.
    fn walk_do_while_loop(
        &mut self,
        stmt: Statement<'d>,
        cur: BlockId,
    ) -> Result<BlockId, LoweringError> {
        let cond = stmt
            .condition()
            .ok_or_else(|| LoweringError::malformed("DoWhileLoop with no condition expression"))?;
        let body_stmt = stmt
            .body()
            .ok_or_else(|| LoweringError::malformed("DoWhileLoop with no body statement"))?;

        let header = self.alloc_block();
        let body = self.alloc_block();
        let exit = self.alloc_block();
        self.close(
            cur,
            Terminator::Loop {
                header,
                body,
                exit,
                entry: body,
            },
        );
        self.close(
            header,
            Terminator::Branch {
                cond,
                then_blk: body,
                else_blk: exit,
            },
        );
        let body_exit = self.walk_loop_body(body_stmt, body, header, exit)?;
        self.close(body_exit, Terminator::Fallthrough(header));
        Ok(exit)
    }

    /// PR-045 (Task 1): `forever body;`. No condition exists at all (LRM:
    /// unconditional) -- `header` unconditionally falls through to `body`,
    /// never to `exit`, so `exit` is allocated (every `Terminator::Loop`
    /// always names one, per PR-045's literal shape) but unreachable by any
    /// statically-analyzable path; only `disable`/`$finish` end a `forever`
    /// loop in practice, neither of which this function needs to wire.
    fn walk_forever_loop(
        &mut self,
        stmt: Statement<'d>,
        cur: BlockId,
    ) -> Result<BlockId, LoweringError> {
        let body_stmt = stmt
            .body()
            .ok_or_else(|| LoweringError::malformed("ForeverLoop with no body statement"))?;

        let header = self.alloc_block();
        let body = self.alloc_block();
        let exit = self.alloc_block();
        // 38.36.1.2: when first encountered and on every iteration.
        self.probe(header, stmt);
        self.close(
            cur,
            Terminator::Loop {
                header,
                body,
                exit,
                entry: header,
            },
        );
        self.close(header, Terminator::Fallthrough(body));
        let body_exit = self.walk_loop_body(body_stmt, body, header, exit)?;
        self.close(body_exit, Terminator::Fallthrough(header));
        Ok(exit)
    }

    /// PR-045 (Task 1): `for (init; cond; step) body;`. The declaration-form
    /// initializer (`for (int i = 0; ...)`) is a separate `VariableDeclaration`
    /// statement slang hoists *before* this `ForLoop` node in an implicit
    /// wrapper `Block` -- already handled for free by the ordinary `List`/
    /// `Block` walk, so this function never sees it. The pre-declared-var
    /// form (`for (i = 0; ...)`, `for_loop_initializers()` non-empty) is a
    /// named `LoweringError`: those initializers are bare `Expression`s, and
    /// (like `for_loop_steps()`, see `BasicBlock::step_exprs`'s doc comment)
    /// this crate has no way to run a bare pre-loop `Expression` as an
    /// ordinary leaf effect without fabricating a `Statement` node it does
    /// not have -- a real, if narrow, gap recorded in this task's
    /// deviations, not a silent drop. The condition (`stop expression`) is
    /// re-checked every iteration in `header`; the step expressions run via
    /// `step_exprs` on a dedicated `step` block between `body` and the back
    /// edge to `header`.
    fn walk_for_loop(
        &mut self,
        stmt: Statement<'d>,
        cur: BlockId,
    ) -> Result<BlockId, LoweringError> {
        // The classic Verilog form `for (i = 0; ...)` (pre-declared `i`):
        // its bare initializer expressions run as `step_exprs` on `cur`
        // itself -- after `cur`'s own statements, before the jump into
        // `header` -- the same bare-expression mechanism the loop's step
        // expressions use below.
        // 38.36.1.2: before any of the control expressions (the initializers
        // run as `cur`'s step expressions, after its statements) ...
        self.probe(cur, stmt);
        for init in stmt.for_loop_initializers() {
            self.push_step_expr(cur, init);
        }
        // `for (;;)`: an omitted stop expression is always true (LRM
        // 1800-2023 12.7.1), so `header` falls through to `body` unconditionally.
        let cond = stmt.condition();
        let body_stmt = stmt
            .body()
            .ok_or_else(|| LoweringError::malformed("ForLoop with no body statement"))?;
        let steps = stmt.for_loop_steps();

        let header = self.alloc_block();
        let body = self.alloc_block();
        let exit = self.alloc_block();
        self.close(
            cur,
            Terminator::Loop {
                header,
                body,
                exit,
                entry: header,
            },
        );
        match cond {
            Some(cond) => self.close(
                header,
                Terminator::Branch {
                    cond,
                    then_blk: body,
                    else_blk: exit,
                },
            ),
            None => self.close(header, Terminator::Fallthrough(body)),
        }
        let step = self.alloc_block();
        let body_exit = self.walk_loop_body(body_stmt, body, step, exit)?;
        self.close(body_exit, Terminator::Fallthrough(step));
        // ... and on every iteration before the incremental statement.
        self.probe(step, stmt);
        for s in steps {
            self.push_step_expr(step, s);
        }
        self.close(step, Terminator::Fallthrough(header));
        Ok(exit)
    }

    /// PR-045: `foreach (arr[i, j, ...]) body;`. A dimension's bound is a
    /// static `ConstantRange` (`Statement::foreach_loop_dims`), never an
    /// `Expression`, so each named dimension is a counted loop on the
    /// `repeat` machinery (`RepeatCount::Const` elements, a `RepeatCheck`
    /// header), its index variable set by `ArgBinding::Const`/`Step`. The
    /// body is lowered once. A dynamically-sized dimension (`range() ==
    /// None`) is a named `LoweringError`.
    fn walk_foreach_loop(
        &mut self,
        stmt: Statement<'d>,
        cur: BlockId,
    ) -> Result<BlockId, LoweringError> {
        // Over a queue, dynamic or associative array: a leaf statement
        // codegen lowers as one loop (`stmt_shared::lower_collection_
        // foreach`) when its body cannot suspend.
        let over_collection = stmt
            .expressions()
            .first()
            .and_then(|a| a.expr_type())
            .is_some_and(|t| crate::state::storage::is_collection(&t));
        // A suspending body over a collection nested in a collection or in a
        // fixed-size array (`int a[2][]`, `int q[$][$]`): `walk_nested_foreach`.
        let nested_dyn = stmt
            .foreach_loop_dims()
            .iter()
            .skip(usize::from(over_collection))
            .any(|d| d.range().is_none());
        // A `return` in the body of an inlined task has to jump out of the
        // CFG's task body (LRM 1800-2023 13.4.1), which a leaf loop cannot do.
        let returns = escapes(stmt.as_sem_node(), false, !self.return_targets.is_empty());
        if nested_dyn && (contains_suspend_trigger(stmt.as_sem_node()) || returns) {
            return self.walk_nested_foreach(stmt, cur);
        }
        if over_collection {
            if contains_suspend_trigger(stmt.as_sem_node()) || returns {
                return self.walk_collection_foreach(stmt, cur);
            }
            self.push(cur, stmt);
            return Ok(cur);
        }
        // A fixed-size array of queues / dynamic arrays (`int a[3][]`): one
        // leaf loop when the body cannot suspend (`stmt_shared::
        // lower_fixed_outer_foreach`).
        if stmt.foreach_loop_dims().iter().any(|d| d.range().is_none())
            && !contains_suspend_trigger(stmt.as_sem_node())
            && !returns
        {
            self.push(cur, stmt);
            return Ok(cur);
        }
        let dims = stmt.foreach_loop_dims();
        let body_stmt = stmt
            .body()
            .ok_or_else(|| LoweringError::malformed("ForeachLoop with no body statement"))?;
        // One counted loop per named dimension, outermost first; a dimension
        // whose loop variable is omitted (`foreach (a[i, ])`) is not
        // iterated (LRM 1800-2023 §12.7.3).
        let mut loops = Vec::new();
        for d in &dims {
            let Some(var) = d.loop_var() else {
                continue;
            };
            let range = d.range().ok_or_else(|| {
                LoweringError::unsupported(
                    "foreach over a dynamically-sized dimension (a dynamic array, queue or \
                     associative array)",
                )
            })?;
            loops.push((var, i64::from(range.left), i64::from(range.right)));
        }
        // Every index omitted: no dimension is iterated, the body never runs.
        if loops.is_empty() {
            return Ok(cur);
        }
        self.walk_foreach_nest(&loops, body_stmt, cur, None)
    }

    /// A suspending `foreach` where a queue / dynamic array is nested in a
    /// fixed-size array or in another collection (`int a[2][3][]`, `int
    /// d[][]`, `int q[2][$]`). One counted loop per named dimension,
    /// outermost first (LRM 1800-2023 12.7.3); a fixed dimension counts its
    /// static range, a collection dimension counts the size of the element
    /// reached through the enclosing indices ([`RepeatCount::NestedSize`]),
    /// read when that loop is entered. An omitted index in front of a
    /// collection dimension and an associative array in the chain are named
    /// errors (the leaf lowering refuses the same shapes).
    fn walk_nested_foreach(
        &mut self,
        stmt: Statement<'d>,
        cur: BlockId,
    ) -> Result<BlockId, LoweringError> {
        let arr = stmt.expressions()[0];
        let body_stmt = stmt
            .body()
            .ok_or_else(|| LoweringError::malformed("ForeachLoop with no body statement"))?;
        let dims = stmt.foreach_loop_dims();
        let last_dyn = dims.iter().rposition(|d| d.range().is_none());
        // Whether each dimension is an associative array (its variable is a
        // key): peel the array type one dimension at a time.
        let mut ty = arr.expr_type();
        let mut assoc_dims = Vec::new();
        for _ in &dims {
            assoc_dims.push(ty.as_ref().is_some_and(|t| t.is_associative_array()));
            ty = ty.and_then(|t| t.element_type());
        }
        let mut levels = Vec::new();
        for (k, d) in dims.iter().enumerate() {
            let Some(var) = d.loop_var() else {
                if last_dyn.is_some_and(|l| l > k) {
                    return Err(LoweringError::unsupported(
                        "foreach whose body waits with an omitted index in front of a nested \
                         queue, dynamic-array or associative-array dimension",
                    ));
                }
                continue;
            };
            let fixed = d.range().map(|r| (r.left, r.right));
            levels.push(NestStep {
                var,
                fixed,
                assoc: assoc_dims[k],
            });
        }
        self.walk_nest_levels(&levels, &mut Vec::new(), arr, body_stmt, cur, None)
    }

    /// The loops of [`Self::walk_nested_foreach`], `levels[0]` outermost;
    /// `prefix` holds the enclosing levels. `break` leaves the whole nest.
    fn walk_nest_levels(
        &mut self,
        levels: &[NestStep<'d>],
        prefix: &mut Vec<NestStep<'d>>,
        arr: Expression<'d>,
        body_stmt: Statement<'d>,
        cur: BlockId,
        outer_exit: Option<BlockId>,
    ) -> Result<BlockId, LoweringError> {
        let Some(&step_info) = levels.first() else {
            return self.walk_stmt(body_stmt, cur);
        };
        let var = step_info.var;
        let entry = self.alloc_block();
        self.close(cur, Terminator::Fallthrough(entry));
        let counter = self.alloc_repeat_counter();
        let (count, first, by) = match step_info.fixed {
            Some((left, right)) => {
                let by: i64 = if left <= right { 1 } else { -1 };
                let n = (i64::from(left) - i64::from(right)).unsigned_abs() + 1;
                (RepeatCount::Const(n), i64::from(left) - by, by)
            }
            None if prefix.is_empty() => (RepeatCount::Size(arr), -1, 1),
            None => (
                RepeatCount::NestedSize {
                    arr,
                    path: prefix.clone(),
                },
                -1,
                1,
            ),
        };
        self.set_repeat_init(entry, counter, count);
        let header = self.alloc_block();
        let body = self.alloc_block();
        let exit = self.alloc_block();
        self.inlined_locals.push(var);
        if step_info.assoc {
            // Keys walk first/next, like a top-level associative array.
            self.blocks[entry.0 as usize]
                .bindings
                .push(ArgBinding::AssocKey {
                    var,
                    arr,
                    path: prefix.clone(),
                    next: false,
                });
        } else {
            self.blocks[entry.0 as usize]
                .bindings
                .push(ArgBinding::Const { var, value: first });
            self.blocks[header.0 as usize]
                .bindings
                .push(ArgBinding::Step { var, by });
        }
        self.close(
            entry,
            Terminator::Loop {
                header,
                body,
                exit,
                entry: header,
            },
        );
        self.close(
            header,
            Terminator::RepeatCheck {
                counter,
                then_blk: body,
                else_blk: exit,
            },
        );
        let latch = self.alloc_block();
        self.set_repeat_decrement(latch, counter);
        if step_info.assoc {
            self.blocks[latch.0 as usize]
                .bindings
                .push(ArgBinding::AssocKey {
                    var,
                    arr,
                    path: prefix.clone(),
                    next: true,
                });
        }
        self.close(latch, Terminator::Fallthrough(header));
        let outer = outer_exit.unwrap_or(exit);
        prefix.push(step_info);
        let body_exit = if levels.len() == 1 {
            self.walk_loop_body(body_stmt, body, latch, outer)?
        } else {
            self.walk_nest_levels(&levels[1..], prefix, arr, body_stmt, body, Some(outer))?
        };
        prefix.pop();
        self.close(body_exit, Terminator::Fallthrough(latch));
        Ok(exit)
    }

    /// A `foreach` over a queue, dynamic or associative array whose body
    /// waits: a counted loop over the size the array has at loop entry (the
    /// `repeat` machinery, as for a fixed-size array). The index walks up
    /// from 0; an associative array's key starts at its first key and moves
    /// to the next one after each iteration (`first`/`next`, which is how
    /// LRM 1800-2023 §12.7.3 orders the keys).
    fn walk_collection_foreach(
        &mut self,
        stmt: Statement<'d>,
        cur: BlockId,
    ) -> Result<BlockId, LoweringError> {
        let arr = stmt.expressions()[0];
        let assoc = arr.expr_type().is_some_and(|t| t.is_associative_array());
        let dims = stmt.foreach_loop_dims();
        let body_stmt = stmt
            .body()
            .ok_or_else(|| LoweringError::malformed("ForeachLoop with no body statement"))?;
        // The inner dimensions are fixed-size ranges (`int d[][3]`): a
        // collection's elements are never themselves collections, so only
        // the outermost dimension is dynamic (LRM 1800-2023 §12.7.3).
        let mut rest = Vec::new();
        for d in dims.iter().skip(1) {
            let Some(v) = d.loop_var() else {
                continue;
            };
            let range = d.range().ok_or_else(|| {
                LoweringError::unsupported(
                    "foreach over a dimension of a queue or dynamic array's element that is \
                     itself a queue, dynamic or associative array",
                )
            })?;
            rest.push((v, i64::from(range.left), i64::from(range.right)));
        }
        let Some(var) = dims.first().and_then(|d| d.loop_var()) else {
            // Outermost index omitted: only the named inner dimensions run.
            return if rest.is_empty() {
                Ok(cur)
            } else {
                self.walk_foreach_nest(&rest, body_stmt, cur, None)
            };
        };
        let entry = self.alloc_block();
        self.close(cur, Terminator::Fallthrough(entry));
        let counter = self.alloc_repeat_counter();
        self.set_repeat_init(entry, counter, RepeatCount::Size(arr));
        let header = self.alloc_block();
        let body = self.alloc_block();
        let exit = self.alloc_block();
        self.inlined_locals.push(var);
        if assoc {
            self.blocks[entry.0 as usize]
                .bindings
                .push(ArgBinding::AssocKey {
                    var,
                    arr,
                    path: Vec::new(),
                    next: false,
                });
        } else {
            self.blocks[entry.0 as usize]
                .bindings
                .push(ArgBinding::Const { var, value: -1 });
            self.blocks[header.0 as usize]
                .bindings
                .push(ArgBinding::Step { var, by: 1 });
        }
        self.close(
            entry,
            Terminator::Loop {
                header,
                body,
                exit,
                entry: header,
            },
        );
        self.close(
            header,
            Terminator::RepeatCheck {
                counter,
                then_blk: body,
                else_blk: exit,
            },
        );
        let latch = self.alloc_block();
        self.set_repeat_decrement(latch, counter);
        if assoc {
            self.blocks[latch.0 as usize]
                .bindings
                .push(ArgBinding::AssocKey {
                    var,
                    arr,
                    path: Vec::new(),
                    next: true,
                });
        }
        self.close(latch, Terminator::Fallthrough(header));
        let body_exit = if rest.is_empty() {
            self.walk_loop_body(body_stmt, body, latch, exit)?
        } else {
            self.walk_foreach_nest(&rest, body_stmt, body, Some(exit))?
        };
        self.close(body_exit, Terminator::Fallthrough(latch));
        Ok(exit)
    }

    /// The counted loops of [`Self::walk_foreach_loop`], `loops[0]`
    /// outermost: each is the `repeat` machinery counting the dimension's
    /// elements, its index variable walking from the left bound to the right
    /// bound (it starts one step before `left`; the header advances it
    /// before each iteration's count check).
    ///
    /// The nest is one loop to `break`/`continue` (LRM 1800-2023 §12.7.3,
    /// Verilator agrees): `continue` advances to the next element (the
    /// innermost dimension's latch) and `break` leaves the whole nest
    /// (`outer_exit`, the outermost dimension's exit).
    fn walk_foreach_nest(
        &mut self,
        loops: &[(Symbol<'d>, i64, i64)],
        body_stmt: Statement<'d>,
        cur: BlockId,
        outer_exit: Option<BlockId>,
    ) -> Result<BlockId, LoweringError> {
        let Some(&(var, left, right)) = loops.first() else {
            return self.walk_stmt(body_stmt, cur);
        };
        let step: i64 = if left <= right { 1 } else { -1 };
        let count = (left - right).unsigned_abs() + 1;
        // A fresh block for this loop's entry: `cur` may already carry
        // another counted loop's `repeat_init` (an enclosing foreach body).
        let entry = self.alloc_block();
        self.close(cur, Terminator::Fallthrough(entry));
        let counter = self.alloc_repeat_counter();
        self.set_repeat_init(entry, counter, RepeatCount::Const(count));
        let header = self.alloc_block();
        let body = self.alloc_block();
        let exit = self.alloc_block();
        self.inlined_locals.push(var);
        self.blocks[entry.0 as usize]
            .bindings
            .push(ArgBinding::Const {
                var,
                value: left - step,
            });
        self.blocks[header.0 as usize]
            .bindings
            .push(ArgBinding::Step { var, by: step });
        self.close(
            entry,
            Terminator::Loop {
                header,
                body,
                exit,
                entry: header,
            },
        );
        self.close(
            header,
            Terminator::RepeatCheck {
                counter,
                then_blk: body,
                else_blk: exit,
            },
        );
        // The latch counts the iteration down; `continue` comes here too.
        let latch = self.alloc_block();
        self.set_repeat_decrement(latch, counter);
        self.close(latch, Terminator::Fallthrough(header));
        let outer = outer_exit.unwrap_or(exit);
        let body_exit = if loops.len() == 1 {
            self.walk_loop_body(body_stmt, body, latch, outer)?
        } else {
            self.walk_foreach_nest(&loops[1..], body_stmt, body, Some(outer))?
        };
        self.close(body_exit, Terminator::Fallthrough(latch));
        Ok(exit)
    }

    /// R-run Task 8 (PR-045/PR-006): `repeat(N) body;` when `body` contains
    /// a suspend point (the gate `walk_stmt`'s own dispatch already checked
    /// before calling this function). Mechanically similar to
    /// [`Self::walk_while_loop`] -- `header`'s own terminator carries the
    /// real per-iteration decision, `body`'s own terminator closes the back
    /// edge, `entry` is `header` (the counter is checked before the first
    /// iteration too, LRM: `repeat(0)` runs zero times) -- except the
    /// decision is [`Terminator::RepeatCheck`] against a compiler-
    /// synthesized [`RepeatCounterId`], not a re-evaluated user `Branch`
    /// condition, and `cur` (this loop's own entry block) additionally
    /// records a [`BasicBlock::repeat_init`] evaluating the count expression
    /// exactly once before ever reaching `header`. The loop body is walked
    /// recursively via the ordinary [`Self::walk_stmt`] entry point, so any
    /// suspend terminator nested inside it composes for free -- exactly the
    /// same reason `disable` "composes correctly across suspend boundaries
    /// for free" per `docs/design/process.md` §2, and the same recursive
    /// shape every other loop-walker in this file already uses.
    fn walk_repeat_loop(
        &mut self,
        stmt: Statement<'d>,
        cur: BlockId,
    ) -> Result<BlockId, LoweringError> {
        // R-run Task 4's `stmt_shared::lower_repeat_loop` already established
        // (and this file's own Task 4-era doc comments confirm) that
        // `RepeatLoop::condition()` is the count expression, not a boolean --
        // slang has no separate accessor for it, this AST node just reuses
        // the `condition()` grammar slot for `repeat`'s own count operand.
        let count_expr = stmt
            .condition()
            .ok_or_else(|| LoweringError::malformed("RepeatLoop with no count expression"))?;
        let body_stmt = stmt
            .body()
            .ok_or_else(|| LoweringError::malformed("RepeatLoop with no body statement"))?;

        let counter = self.alloc_repeat_counter();
        self.set_repeat_init(cur, counter, RepeatCount::Expr(count_expr));

        let header = self.alloc_block();
        let body = self.alloc_block();
        let exit = self.alloc_block();
        // 38.36.1.2: when first encountered and at every iteration (so one
        // more time than the loop body runs, the last one finding the count
        // exhausted -- the same shape the leaf lowering has).
        self.probe(header, stmt);
        self.close(
            cur,
            Terminator::Loop {
                header,
                body,
                exit,
                entry: header,
            },
        );
        self.close(
            header,
            Terminator::RepeatCheck {
                counter,
                then_blk: body,
                else_blk: exit,
            },
        );
        // The latch counts the iteration down; `continue` comes here too.
        let latch = self.alloc_block();
        self.set_repeat_decrement(latch, counter);
        self.close(latch, Terminator::Fallthrough(header));
        let body_exit = self.walk_loop_body(body_stmt, body, latch, exit)?;
        self.close(body_exit, Terminator::Fallthrough(latch));
        Ok(exit)
    }
}

/// Whether `node` (a statement kept as one straight-line leaf) contains a
/// jump out of itself into the CFG around it: a `break`/`continue` not
/// inside a loop of its own (when `in_loop`, an enclosing CFG loop exists)
/// or a `return` (when `in_task`, the statement is part of an inlined task
/// body).
fn escapes(node: SemNode<'_>, in_loop: bool, in_task: bool) -> bool {
    let mut stack = vec![(node, false)];
    while let Some((n, nested_loop)) = stack.pop() {
        let mut inner = nested_loop;
        if let Some(s) = n.as_statement() {
            let kind = s.kind();
            if matches!(kind, StatementKind::Break | StatementKind::Continue)
                && in_loop
                && !nested_loop
            {
                return true;
            }
            if kind == StatementKind::Return && in_task {
                return true;
            }
            if matches!(
                kind,
                StatementKind::ForLoop
                    | StatementKind::WhileLoop
                    | StatementKind::DoWhileLoop
                    | StatementKind::ForeverLoop
                    | StatementKind::ForeachLoop
                    | StatementKind::RepeatLoop
            ) {
                inner = true;
            }
        }
        stack.extend(n.children().into_iter().map(|c| (c, inner)));
    }
    false
}

/// Whether `stmt` is a statement a VPI `cbStmt` callback fires for once, just
/// before it executes (IEEE 1800-2023 Table 38-6): the blocks, `if`, `case`,
/// `wait`, the procedural assignments / `force` / `release` / `disable` /
/// event triggers, task and system-task calls, and the delay and event
/// controls. This mirrors the statements the VPI model gives an object of
/// those types. The loops (`while`/`for`/`repeat`/`forever`) fire per
/// iteration instead and are not covered here.
pub fn is_entry_probe_kind(stmt: &Statement<'_>) -> bool {
    match stmt.kind() {
        StatementKind::Block
        | StatementKind::Conditional
        | StatementKind::Case
        | StatementKind::PatternCase
        | StatementKind::Wait
        | StatementKind::Disable
        | StatementKind::EventTrigger
        | StatementKind::ProceduralAssign
        | StatementKind::ProceduralDeassign => true,
        StatementKind::ExpressionStatement => stmt.expr().is_some_and(|e| {
            matches!(
                e.kind(),
                ExpressionKind::Assignment | ExpressionKind::Call | ExpressionKind::UnaryOp
            )
        }),
        StatementKind::Timed => {
            stmt.timing_control().map(|t| t.kind()) != Some(TimingControlKind::RepeatedEvent)
        }
        // Not in Table 38-6, or a loop (probed per iteration): no entry probe.
        StatementKind::Invalid
        | StatementKind::Empty
        | StatementKind::List
        | StatementKind::VariableDeclaration
        | StatementKind::Return
        | StatementKind::Continue
        | StatementKind::Break
        | StatementKind::DisableFork
        | StatementKind::ForLoop
        | StatementKind::RepeatLoop
        | StatementKind::ForeachLoop
        | StatementKind::WhileLoop
        | StatementKind::DoWhileLoop
        | StatementKind::ForeverLoop
        | StatementKind::ImmediateAssertion
        | StatementKind::ConcurrentAssertion
        | StatementKind::WaitFork
        | StatementKind::WaitOrder
        | StatementKind::RandCase
        | StatementKind::RandSequence
        | StatementKind::ProceduralChecker => false,
        other => unreachable!("statement kind {other:?} is newer than this classification"),
    }
}

thread_local! {
    /// The text of each source file of the design (as it was parsed, so
    /// offsets of a [`sv_lang::SourceLoc`] index it), which `disable_label`
    /// reads a `disable` statement's target from, by file name. One file
    /// registered without a name ([`set_source_text`]) answers for every
    /// location.
    static DISABLE_SOURCE: std::cell::RefCell<Vec<(Option<String>, std::rc::Rc<str>)>> =
        const { std::cell::RefCell::new(Vec::new()) };
}

/// Registers the text of the source file statements are elaborated from,
/// for `disable label;` (see [`disable_label`]); `None` clears it.
pub fn set_source_text(text: Option<&str>) {
    DISABLE_SOURCE.with(|s| {
        *s.borrow_mut() = text
            .map(|t| (None, std::rc::Rc::from(t)))
            .into_iter()
            .collect();
    });
    scan_disable_names(text.into_iter());
}

thread_local! {
    /// What the registered source text names (see [`scan_disable_names`]):
    /// every `disable <name>;` target, and every task name.
    static DISABLE_NAMES: std::cell::RefCell<(
        std::collections::HashSet<String>,
        std::collections::HashSet<String>,
    )> = std::cell::RefCell::new(Default::default());
}

/// Records which names a `disable <name>;` of the design targets, and which
/// names are tasks, from the registered source text (the binding cannot read a
/// `disable` target, see the module doc). Over-approximate on purpose (a word
/// in a comment counts): a name here only makes the builder keep a scope exit
/// for it ([`CfgBuilder::scope_chain`]) or accept it as a task of the design.
fn scan_disable_names<'a>(texts: impl Iterator<Item = &'a str>) {
    let mut labels = std::collections::HashSet::new();
    let mut tasks = std::collections::HashSet::new();
    let mut fn_labels = std::collections::HashSet::new();
    let ident = |c: u8| c == b'_' || c == b'$' || c.is_ascii_alphanumeric();
    for text in texts {
        let b = text.as_bytes();
        let word_at = |mut i: usize| -> Option<(&str, usize)> {
            while i < b.len() && b[i].is_ascii_whitespace() {
                i += 1;
            }
            let start = i;
            while i < b.len() && ident(b[i]) {
                i += 1;
            }
            (i > start).then(|| (&text[start..i], i))
        };
        let mut i = 0;
        // Inside a `function` body (a DPI prototype or `pure`/`extern`
        // declaration has none, and ends at its `;`).
        let (mut in_fn, mut proto) = (false, false);
        while i < b.len() {
            if !ident(b[i]) {
                if b[i] == b';' {
                    proto = false;
                }
                i += 1;
                continue;
            }
            let start = i;
            while i < b.len() && ident(b[i]) {
                i += 1;
            }
            let boundary = start == 0 || (b[start - 1] != b'.' && b[start - 1] != b'`');
            match &text[start..i] {
                "import" | "export" | "extern" | "pure" if boundary => proto = true,
                "function" if boundary => in_fn = !proto,
                "endfunction" if boundary => in_fn = false,
                "disable" if boundary => {
                    // `disable a.b.c;` (9.6.2) names its last segment.
                    // A generate-block index (`g[0].bk`) is part of a segment.
                    let skip_idx = |mut e: usize| -> usize {
                        loop {
                            let t = text[e..].trim_start();
                            let lead = text[e..].len() - t.len();
                            let Some(inner) = t.strip_prefix('[') else {
                                return e;
                            };
                            match inner.find(']') {
                                Some(c)
                                    if inner[..c].trim().bytes().all(|d| d.is_ascii_digit()) =>
                                {
                                    e += lead + 1 + c + 1;
                                }
                                _ => return e,
                            }
                        }
                    };
                    if let Some((mut name, e0)) = word_at(i)
                        && name != "fork"
                    {
                        let mut end = skip_idx(e0);
                        while text[end..].trim_start().starts_with('.')
                            && let Some((next, e)) = word_at(
                                end + (text[end..].len() - text[end..].trim_start().len()) + 1,
                            )
                        {
                            name = next;
                            end = skip_idx(e);
                        }
                        if text[end..].trim_start().starts_with(';') {
                            labels.insert(name.to_string());
                            if in_fn {
                                fn_labels.insert(name.to_string());
                            }
                            // The whole dotted path too ([`CfgBuilder::name_path`]).
                            let full: String = text[i..end]
                                .chars()
                                .filter(|c| !c.is_ascii_whitespace())
                                .collect();
                            // Every dotted suffix too: `disable u1.main.inner;`
                            // names the block `inner` of `main` by the path
                            // below the instance (9.6.2).
                            let mut rest = full.as_str();
                            while let Some((_, tail)) = rest.split_once('.') {
                                if tail.contains('.') {
                                    labels.insert(tail.to_string());
                                }
                                rest = tail;
                            }
                            if full.contains('.') {
                                labels.insert(full);
                            }
                        }
                    }
                }
                "task" if boundary => {
                    if let Some((mut name, end)) = word_at(i) {
                        if matches!(name, "automatic" | "static")
                            && let Some((n, _)) = word_at(end)
                        {
                            name = n;
                        }
                        tasks.insert(name.to_string());
                    }
                }
                _ => {}
            }
        }
    }
    DISABLE_NAMES.with(|n| *n.borrow_mut() = (labels, tasks));
    FN_DISABLE_LABELS.with(|n| *n.borrow_mut() = fn_labels);
}

thread_local! {
    /// The targets of the `disable <name>;` statements written inside a
    /// `function` body (see [`scan_disable_names`]).
    static FN_DISABLE_LABELS: std::cell::RefCell<std::collections::HashSet<String>> =
        std::cell::RefCell::new(Default::default());
}

/// Whether the design has a `disable <name>;` inside a function body: such a
/// function can end a block of its caller (LRM 9.6.2, 35.9), which the call
/// sites check for ([`SwitchOn::FnDisable`]). Designs without one pay nothing.
pub fn has_function_disables() -> bool {
    FN_DISABLE_LABELS.with(|n| !n.borrow().is_empty())
}

/// Whether a function body of the design has `disable <label>;`.
pub fn is_function_disable_label(label: &str) -> bool {
    FN_DISABLE_LABELS.with(|n| n.borrow().contains(label))
}

/// Whether some `disable` statement of the design names `label`.
fn is_disabled_somewhere(label: &str) -> bool {
    DISABLE_NAMES.with(|n| n.borrow().0.contains(label))
}

/// Every dotted `disable a.b.c;` target (and dotted suffix of one) the design
/// writes, sorted.
pub fn dotted_disable_labels() -> Vec<String> {
    let mut v: Vec<String> = DISABLE_NAMES.with(|n| {
        n.borrow()
            .0
            .iter()
            .filter(|l| l.contains('.'))
            .cloned()
            .collect()
    });
    v.sort();
    v
}

/// Whether `label` is the name of a task of the design.
pub fn is_task_name(label: &str) -> bool {
    DISABLE_NAMES.with(|n| n.borrow().1.contains(label))
}

/// Registers the text of every source file of a multi-file design, each
/// under the file name its locations resolve to ([`set_source_session`]).
pub fn set_source_texts(files: Vec<(String, String)>) {
    scan_disable_names(files.iter().map(|(_, t)| t.as_str()));
    DISABLE_SOURCE.with(|s| {
        *s.borrow_mut() = files
            .into_iter()
            .map(|(name, text)| (Some(name), std::rc::Rc::from(text)))
            .collect();
    });
}

/// Whether two file names denote the same file (equal, or the same file on
/// disk).
fn same_file(a: &str, b: &str) -> bool {
    a == b
        || std::fs::canonicalize(a)
            .ok()
            .is_some_and(|x| std::fs::canonicalize(b).ok() == Some(x))
}

/// The registered text holding `at`: the unnamed one if that is what was
/// registered, else the named file `at` resolves to (through the session
/// registered by [`set_source_session`]).
fn source_text_at(at: sv_lang::SourceLoc) -> Option<std::rc::Rc<str>> {
    let files = DISABLE_SOURCE.with(|s| s.borrow().clone());
    if let [(None, text)] = files.as_slice() {
        return Some(text.clone());
    }
    let file = SOURCE_SESSION
        .with(|s| s.borrow().as_ref().and_then(|se| se.resolve_location(at)))?
        .file;
    files
        .into_iter()
        .find(|(n, _)| n.as_deref().is_some_and(|n| same_file(n, &file)))
        .map(|(_, text)| text)
}

thread_local! {
    /// The main source file's name as given (`$info`'s `file:line`).
    static SOURCE_NAME: std::cell::RefCell<Option<String>> =
        const { std::cell::RefCell::new(None) };
}

/// Registers the main source file's name (see [`source_location`]).
pub fn set_source_name(name: Option<&str>) {
    SOURCE_NAME.with(|s| *s.borrow_mut() = name.map(str::to_owned));
}

/// The source text of `span`, from the file text registered by
/// [`set_source_text`] / [`set_source_texts`] (`None` if that file's text is
/// not registered, e.g. a span in an `` `include `` d file).
pub fn source_text_range(span: sv_lang::SourceSpan) -> Option<String> {
    source_text_at(span.start)?
        .get(span.start.offset as usize..span.end.offset as usize)
        .map(str::to_owned)
}

thread_local! {
    /// The session the design was parsed with: resolves a source location
    /// to its file and line (included files and `` `line `` directives
    /// included).
    static SOURCE_SESSION: std::cell::RefCell<Option<sv_lang::Session>> =
        const { std::cell::RefCell::new(None) };
}

/// Registers the session the design was parsed with (see
/// [`source_location`]); `None` clears it.
pub fn set_source_session(session: Option<sv_lang::Session>) {
    SOURCE_SESSION.with(|s| *s.borrow_mut() = session);
}

/// `file:line` of `loc`, as slang's source manager reports it (honoring
/// `` `include `` and `` `line ``) through the session registered by
/// [`set_source_session`] -- the main source file under the name it was
/// given ([`set_source_name`]); without a session, counted in the main
/// source file registered by [`set_source_name`]/[`set_source_text`].
pub fn source_location(loc: sv_lang::SourceLoc) -> Option<String> {
    if let Some(at) = SOURCE_SESSION.with(|s| {
        s.borrow()
            .as_ref()
            .and_then(|session| session.resolve_location(loc))
    }) {
        let main = SOURCE_NAME.with(|s| s.borrow().clone());
        let file = match main {
            Some(m) if same_file(&at.file, &m) => m,
            _ => at.file,
        };
        return Some(format!("{file}:{}", at.line));
    }
    let name = SOURCE_NAME.with(|s| s.borrow().clone())?;
    let text = source_text_at(loc)?;
    let head = text.get(..(loc.offset as usize).min(text.len()))?;
    let line = head.bytes().filter(|&b| b == b'\n').count() + 1;
    Some(format!("{name}:{line}"))
}

/// The segments of a hierarchical `disable a.b.c;` target (LRM 9.6.2), read
/// from the statement's source text like [`disable_label`]; `None` for a
/// simple or unreadable target.
pub fn disable_path(stmt: &Statement<'_>) -> Option<Vec<String>> {
    let text = source_text_range(stmt.source_range())?;
    let rest = text.trim().strip_prefix("disable")?;
    if !rest.starts_with(char::is_whitespace) {
        return None;
    }
    let label: String = rest
        .trim()
        .trim_end_matches(';')
        .chars()
        .filter(|c| !c.is_whitespace())
        .collect();
    let segs: Vec<String> = label.split('.').map(str::to_string).collect();
    // A generate-block segment carries its index (`g[0]`).
    let ident = |t: &str| {
        let t = match t.find('[') {
            Some(b)
                if t.ends_with(']')
                    && t[b + 1..t.len() - 1].bytes().all(|d| d.is_ascii_digit())
                    && b + 2 < t.len() =>
            {
                &t[..b]
            }
            Some(_) => return false,
            None => t,
        };
        !t.is_empty()
            && t.chars().enumerate().all(|(i, c)| {
                c == '_' || c.is_ascii_alphabetic() || (i > 0 && (c.is_ascii_digit() || c == '$'))
            })
    };
    (segs.len() > 1 && segs.iter().all(|t| ident(t))).then_some(segs)
}

/// The name `disable` acts on in a statement the CFG builder kept: the plain
/// label, or the last segment of a hierarchical `a.b.c` the builder resolved to
/// a block of another process ([`disable_path`]).
pub fn disable_leaf_label(stmt: &Statement<'_>) -> Result<String, LoweringError> {
    match disable_path(stmt).and_then(|p| p.last().cloned()) {
        Some(leaf) => Ok(leaf),
        None => disable_label(stmt),
    }
}

/// The target name of a `disable label;` statement. The pinned sv-lang
/// binding exposes no `DisableStatement::target` (see the module doc), so
/// it is read from the statement's own source span in the text registered
/// by [`set_source_text`] -- accepted only when that span reads exactly
/// `disable <identifier> ;`, so a span into another file (an `` `include ``)
/// is a named error, never a misread label.
pub fn disable_label(stmt: &Statement<'_>) -> Result<String, LoweringError> {
    let span = stmt.source_range();
    let text = source_text_range(span);
    let unreadable = || {
        LoweringError::unsupported(
            "disable statement whose target cannot be read (no registered source text, or \
             the statement is not in a registered source file)",
        )
    };
    let text = text.ok_or_else(unreadable)?;
    let rest = text.trim().strip_prefix("disable").ok_or_else(unreadable)?;
    let label = rest.trim().trim_end_matches(';').trim();
    let ident = !label.is_empty()
        && label.chars().enumerate().all(|(i, c)| {
            c == '_' || c.is_ascii_alphabetic() || (i > 0 && (c.is_ascii_digit() || c == '$'))
        });
    if !ident || !rest.starts_with(char::is_whitespace) {
        let hier = if label.contains('.') {
            "; disabling a task or interface method by hierarchical name would have to \
             end every activation of it in other processes (IEEE 1800-2023 9.6.2)"
        } else {
            ""
        };
        return Err(LoweringError::unsupported(format!(
            "disable of `{label}` (only a simple block name is supported{hier})"
        )));
    }
    Ok(label.to_string())
}

/// Whether `node`'s subtree contains a `disable label;` statement, in itself
/// or in the body of a task it calls (an inlined task's `disable` may target
/// the caller's block, LRM 9.6.2).
fn contains_disable_through_calls(node: SemNode<'_>) -> bool {
    let mut visiting = std::collections::HashSet::new();
    let mut stack = vec![node];
    while let Some(n) = stack.pop() {
        if n.as_statement()
            .is_some_and(|s| s.kind() == StatementKind::Disable)
        {
            return true;
        }
        if let Some(e) = n.as_expression()
            && let Some(callee) = user_task_callee(&e)
            && let Some(body) = proc_body(&callee)
            && visiting.insert(callee.uid())
        {
            stack.push(body.as_sem_node());
        }
        stack.extend(live_children(&n));
    }
    false
}

/// Whether `node`'s subtree holds a `fork`/`join*` block, in itself or in the
/// body of a task it calls.
fn contains_fork_through_calls(node: SemNode<'_>) -> bool {
    let mut visiting = std::collections::HashSet::new();
    let mut stack = vec![node];
    while let Some(n) = stack.pop() {
        if n.as_statement().is_some_and(|s| {
            matches!(
                s.block_kind(),
                Some(
                    StatementBlockKind::JoinAll
                        | StatementBlockKind::JoinAny
                        | StatementBlockKind::JoinNone
                )
            )
        }) {
            return true;
        }
        if let Some(e) = n.as_expression()
            && let Some(callee) = user_task_callee(&e)
            && let Some(body) = proc_body(&callee)
            && visiting.insert(callee.uid())
        {
            stack.push(body.as_sem_node());
        }
        stack.extend(live_children(&n));
    }
    false
}

/// Every `StatementKind` variant [`CfgBuilder::walk_stmt`] treats as ordinary
/// straight-line code (PR-006's own acceptance text) -- i.e. every variant
/// that is not one of the 5 explicitly-named statement kinds
/// (`List`/`Block`/`Conditional`/`Timed`/the 5 suspend-rejecting kinds) it
/// handles directly. Kept as a `matches!` (not a literal `match`, see
/// `walk_stmt`'s doc comment) enumerating all 22 remaining variants of
/// today's pinned `StatementKind::COUNT == 32`.
/// Task 1 removed `ForLoop`/`WhileLoop`/`DoWhileLoop`/`ForeverLoop`/
/// `ForeachLoop`/`Disable` from this set. The five loop kinds now dispatch
/// to dedicated handlers (PR-045's `Terminator::Loop`) instead of being
/// treated as opaque leaves; `Disable` also gets a dedicated `walk_stmt` arm
/// (a jump to its named block's exit -- see this file's module doc comment's
/// `disable label;` section), never the "push as ordinary code" treatment
/// this function's callers give everything below. `RepeatLoop` (a plain statement-level `repeat(N)
/// stmt;`, distinct from the `RepeatedEvent` *timing control*) stays
/// ordinary -- PR-045's own requirement text names exactly `for`/`while`/
/// `do-while`/`forever`/`foreach`, not `repeat`.
fn is_ordinary_statement_kind(kind: StatementKind) -> bool {
    matches!(
        kind,
        StatementKind::Empty
            | StatementKind::ExpressionStatement
            | StatementKind::VariableDeclaration
            | StatementKind::Return
            | StatementKind::Continue
            | StatementKind::Break
            | StatementKind::Case
            | StatementKind::PatternCase
            | StatementKind::RepeatLoop
            | StatementKind::ImmediateAssertion
            | StatementKind::ConcurrentAssertion
            | StatementKind::ProceduralAssign
            | StatementKind::ProceduralDeassign
            | StatementKind::RandCase
            | StatementKind::RandSequence
            | StatementKind::ProceduralChecker
    )
}

/// R-run Task 1: `true` iff `stmt` (already known to be a `StatementKind::
/// ExpressionStatement`) is a bare `$finish`/`$finish(n)`/`$stop`/`$fatal`
/// system-call TASK statement -- the exact same `ExpressionKind::Call` +
/// `is_system_call() == Some(true)` + `system_subroutine().known_name_id()`
/// recognition `sv-sim-codegen::process_lower::lower_system_call_statement`
/// already uses for its own dispatch (mirrored, not re-derived differently:
/// both call sites must agree on what counts as one of these three calls).
/// `$fatal`'s own optional finish_number/message arguments and `$stop`'s own
/// interactive-debugger-break runtime semantics are unaffected by this CFG-
/// level check -- it only ever answers "does the calling process's own
/// control flow end here", never anything about the call's own argument
/// list or its eventual codegen lowering (`$stop`/`$fatal` still lower to a
/// named `LoweringError` in `process_lower.rs` today, exactly as before this
/// task; this predicate firing for them one file earlier changes nothing
/// observable about that until a later task actually lowers them).
fn is_finish_or_stop_call(stmt: &Statement<'_>) -> bool {
    let Some(e) = stmt.expr() else {
        return false;
    };
    if e.kind() != ExpressionKind::Call || e.is_system_call() != Some(true) {
        return false;
    }
    let Some(sub) = e.system_subroutine() else {
        return false;
    };
    matches!(
        sub.known_name_id(),
        KnownSystemName::Finish | KnownSystemName::Stop | KnownSystemName::Fatal
    )
}

/// The `unique`/`unique0`/`priority` qualifier on an `if` or `case` statement
/// (LRM 1800-2023 §12.4.2, §12.5.3), `None` for an unqualified statement or
/// any other kind. A `case ... matches` ([`StatementKind::PatternCase`])
/// carries its qualifier under its own accessor.
pub fn violation_check(stmt: &Statement<'_>) -> Option<UniquePriorityCheck> {
    let check = if stmt.kind() == StatementKind::PatternCase {
        stmt.pattern_case_check()
    } else {
        stmt.check()
    };
    match check {
        Some(UniquePriorityCheck::None) | None => None,
        Some(check) => Some(check),
    }
}

/// The `if` / `else if` series a `unique`/`unique0`/`priority` qualifier on
/// the first `if` applies to (§12.4.2: "the entire series of if-else-if
/// conditions"): the condition and then-statement of each link, in source
/// order, and the final `else` statement if there is one. A nested
/// `else if` carries no qualifier of its own (the grammar has none); an
/// `else` holding a qualified `if` of its own is the final `else` and a
/// separate statement.
pub struct IfChain<'d> {
    /// The `if` statement of each link (its predicate is `links[i]
    /// .conditions()`: plain, `&&&`-chained, or pattern-matching, §12.6).
    pub links: Vec<Statement<'d>>,
    pub thens: Vec<Statement<'d>>,
    pub otherwise: Option<Statement<'d>>,
}

/// Peels `Invalid` wrappers off `stmt` (IEEE 1800-2023 12.4/12.5).
///
/// slang suppresses the error of a construct inside a statically dead `if`
/// or `case` arm (e.g. a reversed range select `v[7:8]` of a descending
/// vector under a false parameter) but demotes every enclosing statement to
/// `Invalid`. Such wrappers nest (an `Invalid` body wraps a `Block` that wraps
/// an `Invalid` wrapping the `Conditional`), so this unwraps recursively via
/// `Statement::invalid_child`. An `Invalid` with no recoverable child is
/// returned unchanged, so the caller's loud "Invalid statement" refusal still
/// fires for it.
pub fn unwrap_invalid<'d>(mut stmt: Statement<'d>) -> Statement<'d> {
    while stmt.kind() == StatementKind::Invalid {
        match stmt.invalid_child() {
            Some(child) => stmt = child,
            None => break,
        }
    }
    stmt
}

/// The child statements of a `List`/`Block`, with each statement slang
/// demoted to `Invalid` (a statically dead `if`/`case` arm it could not
/// bind) unwrapped to the real one. `Statement::statements` skips `Invalid`
/// children, which would silently drop the live statement (LRM 12.4/12.5).
pub fn live_statements<'d>(stmt: &Statement<'d>) -> Vec<Statement<'d>> {
    stmt.as_sem_node()
        .children_with_invalid()
        .into_iter()
        .filter_map(|n| n.as_statement())
        .map(unwrap_invalid)
        .collect()
}

/// The children of `node` for a whole-subtree walk, with each `Invalid`
/// statement or expression (slang's demotion of a construct inside a
/// statically dead `if`/`case` arm it could not bind, LRM 12.4/12.5) replaced
/// by the real node it wraps. `SemNode::children` skips `Invalid` children,
/// so a call or read inside the live arm of such a statement would otherwise
/// be invisible to every discovery walk (called-subroutine discovery, write
/// sets, unsupported-construct scans).
pub fn live_children<'d>(node: &SemNode<'d>) -> Vec<SemNode<'d>> {
    node.children_with_invalid()
        .into_iter()
        .map(|n| {
            if let Some(s) = n.as_statement() {
                return unwrap_invalid(s).as_sem_node();
            }
            if let Some(mut e) = n.as_expression() {
                while e.kind() == ExpressionKind::Invalid
                    && let Some(c) = e.invalid_child()
                {
                    e = c;
                }
                return e.as_sem_node();
            }
            n
        })
        .collect()
}

/// The body statement of a procedural block with any `Invalid` wrappers from
/// a statically dead arm peeled off (see [`unwrap_invalid`]). Every pass that
/// inspects a process's head timing control, read set or statements must go
/// through this rather than `Symbol::body`, so they all see the same live
/// body (otherwise an `always @*` loses its sensitivity).
pub fn proc_body<'d>(block: &Symbol<'d>) -> Option<Statement<'d>> {
    block.body().map(unwrap_invalid)
}

/// The `StatementBlock` scopes whose locals `stmt` (a `Block`) declares.
///
/// Normally that is `Statement::block_symbol()`. slang never attaches the
/// symbol to a block that failed to bind (`Statement::bindBlock` returns the
/// `Invalid` wrapper before setting `blockSymbol`), so a `begin`/`end` that
/// holds a statically dead `if`/`case` arm it could not bind (LRM 12.4/12.5)
/// is recovered through `invalid_child` with no symbol, and its locals would
/// be invisible. For such a block the scopes are recovered from the variables
/// the live subtree references: the `StatementBlock` parents of its
/// `NamedValue` symbols. That can include an enclosing or nested block's
/// scope, which is harmless for the union-style local collections that call
/// this; a local no live statement references is not recovered (it has no
/// observable use).
pub fn block_scopes<'d>(stmt: &Statement<'d>) -> Vec<Symbol<'d>> {
    if let Some(bs) = stmt.block_symbol() {
        return vec![bs];
    }
    let node = stmt.as_sem_node();
    if stmt.kind() != StatementKind::Block || !contains_invalid(node) {
        return Vec::new();
    }
    let mut out: Vec<Symbol<'d>> = Vec::new();
    let mut seen = HashSet::new();
    let mut stack = vec![node];
    while let Some(n) = stack.pop() {
        if let Some(e) = n.as_expression()
            && crate::symid::is_value_name(e.kind())
            && let Some(sym) = e.referenced_symbol()
            && let Some(parent) = sym.parent()
            && parent.kind() == SymbolKind::StatementBlock
            && seen.insert(parent.uid())
        {
            out.push(parent);
        }
        stack.extend(live_children(&n));
    }
    out
}

/// The name of a `begin`/`end` or `fork`/`join` block statement (LRM 9.3.4),
/// empty when unnamed.
///
/// Normally `Statement::block_symbol()`'s name. A block that failed to bind
/// (a statically dead arm slang could not bind, LRM 12.4) carries no symbol,
/// so its name would be lost and `disable blk` (LRM 9.6.2) refused. For such
/// a block the name is read back from the statement's own source span in the
/// text registered by [`set_source_text`]: either the `begin : name` form or
/// a `name : begin` statement label. Anything else reads as unnamed.
pub fn block_name(stmt: &Statement<'_>) -> String {
    if let Some(bs) = stmt.block_symbol() {
        return bs.name().to_string();
    }
    if stmt.kind() != StatementKind::Block || !contains_invalid(stmt.as_sem_node()) {
        return String::new();
    }
    let Some(text) = source_text_range(stmt.source_range()) else {
        return String::new();
    };
    let ident = |s: &str| -> Option<(String, String)> {
        let s = s.trim_start();
        let n = s
            .char_indices()
            .take_while(|&(i, c)| {
                c == '_' || c.is_ascii_alphabetic() || (i > 0 && (c.is_ascii_digit() || c == '$'))
            })
            .count();
        (n > 0).then(|| (s[..n].to_string(), s[n..].to_string()))
    };
    let Some((first, rest)) = ident(&text) else {
        return String::new();
    };
    if matches!(first.as_str(), "begin" | "fork") {
        // `begin : name`; a bare `begin` followed by a statement is unnamed.
        return match rest.trim_start().strip_prefix(':').and_then(ident) {
            Some((name, _)) => name,
            None => String::new(),
        };
    }
    // `name : begin`.
    match rest.trim_start().strip_prefix(':').and_then(ident) {
        Some((kw, _)) if matches!(kw.as_str(), "begin" | "fork") => first,
        _ => String::new(),
    }
}

/// Whether any node under `node` is an `Invalid` statement or expression.
fn contains_invalid(node: SemNode<'_>) -> bool {
    let is_invalid = node
        .as_statement()
        .is_some_and(|s| s.kind() == StatementKind::Invalid)
        || node
            .as_expression()
            .is_some_and(|e| e.kind() == ExpressionKind::Invalid);
    is_invalid
        || node
            .children_with_invalid()
            .into_iter()
            .any(contains_invalid)
}

/// For a plain `case` whose selector and labels are all compile-time
/// constants and whose arms include an `Invalid` one (a statically dead arm
/// slang could not bind, LRM 12.5): `Some(arm)` names the one statement that
/// can ever run (`None` inside: no arm matches and there is no `default`).
/// `None` for any case this does not apply to (non-constant, `casez`/`casex`/
/// `inside`, a call in a label, or no `Invalid` arm), which lowers as usual.
pub fn constant_case_live_arm<'d>(stmt: &Statement<'d>) -> Option<Option<Statement<'d>>> {
    fn has_call(e: Expression<'_>) -> bool {
        e.kind() == ExpressionKind::Call || e.operands().into_iter().any(has_call)
    }
    if stmt.kind() != StatementKind::Case
        || stmt.case_condition() != Some(sv_lang::CaseStatementCondition::Normal)
        || violation_check(stmt).is_some()
    {
        return None;
    }
    let items = stmt.case_items();
    let default = stmt.default_case();
    if !items
        .iter()
        .map(|i| i.stmt())
        .chain(default)
        .any(|a| contains_invalid(a.as_sem_node()))
    {
        return None;
    }
    let sel = stmt.expr()?;
    if has_call(sel) {
        return None;
    }
    let sv = sel.constant_value()?.as_i64()?;
    for item in &items {
        for label in item.expressions() {
            if has_call(label) {
                return None;
            }
            if label.constant_value()?.as_i64()? == sv {
                return Some(Some(item.stmt()));
            }
        }
    }
    Some(default)
}

/// The fixed truth of a plain `if`'s predicate when it is a compile-time
/// constant with no function call in it (`if (PARAM > 0)`): `Some(taken)`
/// names the one arm that can ever run, so the other need not be lowered
/// (LRM 1800-2023 12.4; the dead arm may be legal yet unlowerable once
/// its constants fold, e.g. an out-of-range part-select, 11.5.1). A call is
/// excluded because the evaluator would run it at compile time, skipping
/// its side effects. `None` for any other `if`.
pub fn constant_if_arm(stmt: &Statement<'_>) -> Option<bool> {
    fn has_call(e: Expression<'_>) -> bool {
        e.kind() == ExpressionKind::Call || e.operands().into_iter().any(has_call)
    }
    let conditions = stmt.conditions();
    if stmt.kind() != StatementKind::Conditional
        || conditions.len() != 1
        || conditions[0].pattern().is_some()
        || violation_check(stmt).is_some()
    {
        return None;
    }
    let cond = conditions[0].expr();
    if has_call(cond) {
        return None;
    }
    cond.constant_value()
        .and_then(|c| c.as_i64())
        .map(|c| c != 0)
}

/// Whether `stmt` is an `if` whose predicate is not a single plain
/// expression: a pattern match (`e matches p`) or an `&&&` chain (§12.6.1).
pub fn is_clause_if(stmt: &Statement<'_>) -> bool {
    if stmt.kind() != StatementKind::Conditional {
        return false;
    }
    let conditions = stmt.conditions();
    conditions.len() != 1 || conditions[0].pattern().is_some()
}

/// The links an `if` dispatches over: the whole `else if` series of a
/// `unique`/`unique0`/`priority` `if`, else the one `if` alone (its `else`,
/// if any, is the `otherwise` statement).
pub fn if_series<'d>(head: Statement<'d>) -> Result<IfChain<'d>, &'static str> {
    if violation_check(&head).is_some() {
        return if_chain(head);
    }
    Ok(IfChain {
        links: vec![head],
        thens: vec![head.then_branch().ok_or("an `if` with no then-branch")?],
        otherwise: head.else_branch(),
    })
}

/// Collects the [`IfChain`] of the `if` statement `head`.
pub fn if_chain<'d>(head: Statement<'d>) -> Result<IfChain<'d>, &'static str> {
    let mut chain = IfChain {
        links: Vec::new(),
        thens: Vec::new(),
        otherwise: None,
    };
    let mut link = head;
    loop {
        chain.links.push(link);
        chain
            .thens
            .push(link.then_branch().ok_or("an `if` with no then-branch")?);
        match link.else_branch() {
            Some(next)
                if next.kind() == StatementKind::Conditional
                    && violation_check(&next).is_none() =>
            {
                link = next;
            }
            other => {
                chain.otherwise = other;
                return Ok(chain);
            }
        }
    }
}

fn first_expression_child<'d>(tc: &TimingControl<'d>) -> Option<Expression<'d>> {
    tc.children().into_iter().find_map(|n| n.as_expression())
}

/// Task 6 (CG-081): the AST-derived read-set of `body` -- every distinct
/// (by referenced-symbol identity) `NamedValue` expression `body`'s subtree
/// reads, excluding a plain `NamedValue` LHS of a top-level `Assignment`
/// (mirrors `sv-sim-codegen::process_lower::external_refs_in_segment`'s
/// identical "read vs write position" split, at the granularity of one
/// guarded statement rather than a whole `Segment`).
///
/// **Deliberately AST-only, not `AnalyzedProcedure::
/// implicit_event_read_sets()`:** `sv-lang` exposes exactly this oracle
/// (`slang::analysis::AnalyzedProcedure::getImplicitEventReadSets`), but it
/// needs a live `sv_lang::Analysis` handle, and no `build_cfg` call site in
/// this tree (`sv-sim-bin::run`, `aot.rs`, `pipeline.rs`, `frontend.rs`, this
/// crate's own `liveness.rs` tests) threads one through today -- adding that
/// parameter would be a signature change to `build_cfg` reaching every one
/// of those call sites, including `sv-sim-bin::run.rs`, which this wave's
/// binding rules forbid risking (wave-B-runtime is concurrently landing
/// there). This AST-only walk is a real, if narrower, substitute: an
/// over-approximation (a name reached only through a path this walk cannot
/// prove is write-only) is a safe, LRM-permitted implicit-sensitivity
/// superset (an extra spurious wake, never a missed one) -- never a
/// correctness bug the way under-approximating would be. See this file's
/// module doc comment's Task 6 section and this task's own deviations for
/// the full accounting.
fn implicit_comb_read_set<'d>(body: &Statement<'d>) -> Vec<Expression<'d>> {
    let mut order = Vec::new();
    let mut seen = HashSet::new();
    let mut stack = vec![body.as_sem_node()];
    while let Some(n) = stack.pop() {
        // A subtree slang demoted to `Invalid` inside a statically dead arm
        // is invisible to `children`; recover it (its reads are a harmless
        // superset of the live ones, LRM 9.4.2.2).
        if let Some(st) = n.as_statement()
            && st.kind() == StatementKind::Invalid
        {
            if let Some(c) = st.invalid_child() {
                stack.push(c.as_sem_node());
            }
            continue;
        }
        if let Some(e) = n.as_expression()
            && e.kind() == ExpressionKind::Invalid
        {
            if let Some(c) = e.invalid_child() {
                stack.push(c.as_sem_node());
            }
            continue;
        }
        if let Some(e) = n.as_expression() {
            if crate::symid::is_value_name(e.kind()) {
                if let Some(sym) = e.referenced_symbol()
                    && seen.insert(sym.uid())
                {
                    order.push(e);
                }
                continue;
            }
            if e.kind() == ExpressionKind::Assignment {
                // Skip only the LHS's own bare `NamedValue` node of a PLAIN
                // (`=`/`<=`) assignment (never a "read" for implicit-
                // sensitivity purposes, whether blocking or nonblocking) --
                // a compound lvalue (a bit-select, concatenation, ...) is
                // walked normally instead, so e.g. `arr[i] = x`'s index
                // expression `i` (and `arr`'s own identity) are still
                // collected, matching the "safe over-approximation" posture
                // above.
                //
                // A COMPOUND assignment (`+=`, `-=`, `&=`, ...) is never
                // desugared by slang -- `right()` holds only the RHS
                // operand (e.g. `a` for `q += a`), never `q + a` -- so a
                // bare `NamedValue` LHS genuinely is also a read there (per
                // IEEE 1800's implicit-sensitivity rule: a variable is
                // excluded from the inferred `@*` list only when it is
                // written but never read, which a compound assignment's LHS
                // is not). Detect this via `is_compound_assignment()` and
                // walk the LHS unconditionally in that case.
                let lhs_is_read = e.is_compound_assignment() == Some(true);
                if let Some(lhs) = e.left()
                    && (lhs_is_read || !crate::symid::is_value_name(lhs.kind()))
                {
                    stack.push(lhs.as_sem_node());
                }
                if let Some(rhs) = e.right() {
                    stack.push(rhs.as_sem_node());
                }
                continue;
            }
        }
        stack.extend(n.children_with_invalid());
    }
    order
}

/// LRM 6.14: a chandle "shall not be used ... in sensitivity lists or event
/// expressions"; slang does not diagnose it, so refuse it by name here
/// instead of waiting on a value that can never be observed to change.
fn reject_chandle_event(signal: &Expression<'_>) -> Result<(), LoweringError> {
    if signal.expr_type().is_some_and(|t| t.is_chandle()) {
        return Err(LoweringError::unsupported(
            "a chandle in an event expression (illegal, LRM 1800-2023 6.14)".to_string(),
        ));
    }
    Ok(())
}

/// The operands `(memory, input_terms, output_terms)` of `stmt` when it is a
/// `$async$<and|or|nand|nor>$<array|plane>` call (LRM 20.16), else `None`.
pub fn async_pla_call<'d>(stmt: &Statement<'d>) -> Option<Vec<Expression<'d>>> {
    let e = stmt.expr()?;
    if e.kind() != ExpressionKind::Call || e.is_system_call() != Some(true) {
        return None;
    }
    let name = e.system_subroutine()?.name();
    let rest = name.strip_prefix("$async$")?;
    let (logic, format) = rest.split_once('$')?;
    (matches!(logic, "and" | "or" | "nand" | "nor") && matches!(format, "array" | "plane"))
        .then(|| e.operands())
}

/// What an `$async$...` PLA call re-evaluates on: the personality memory and
/// everything the input terms read, never the output terms it writes.
fn async_pla_read_set<'d>(stmt: &Statement<'d>) -> Vec<Expression<'d>> {
    let ops = async_pla_call(stmt).unwrap_or_default();
    let root = |x: Expression<'d>| {
        let x = if x.kind() == ExpressionKind::Assignment {
            x.left().unwrap_or(x)
        } else {
            x
        };
        crate::symid::is_value_name(x.kind())
            .then(|| x.referenced_symbol())
            .flatten()
            .map(|s| (x, s.uid()))
    };
    let out_uid = ops.get(2).and_then(|o| root(*o)).map(|(_, u)| u);
    let mut reads: Vec<Expression<'d>> = implicit_comb_read_set(stmt)
        .into_iter()
        .filter(|r| r.referenced_symbol().map(|s| s.uid()) != out_uid)
        .collect();
    if let Some((mem, uid)) = ops.first().and_then(|o| root(*o))
        && !reads
            .iter()
            .any(|r| r.referenced_symbol().map(|s| s.uid()) == Some(uid.clone()))
    {
        reads.push(mem);
    }
    reads
}

/// Task 3 (CG-170): extracts a `SignalEventControl`'s optional `iff`
/// condition. **Verified live** against the pinned `sv-lang = "=0.1.9"`
/// source (no `.iffCondition` accessor exists in this binding at all): per
/// slang's own `SignalEventControl::visitExprs` (`include/slang/ast/
/// TimingControl.h`: `expr.visit(visitor); if (iffCondition)
/// iffCondition->visit(visitor);`), which is what backs `children()`
/// (`CApiAst.cpp`'s generic `SemChildCollector`), a `SignalEvent`
/// `TimingControl` node's `children()` returns exactly 1 entry (the event
/// expression only) with no `iff`, or exactly 2 (event expression, then
/// `iff`, in that order) when one is present. Extraction is therefore
/// purely positional: `len() == 2`'s `[1]` is `iff`, `None` otherwise.
fn extract_iff<'d>(tc: &TimingControl<'d>) -> Option<Expression<'d>> {
    let children = tc.children();
    if children.len() == 2 {
        children[1].as_expression()
    } else {
        None
    }
}

/// The pass and fail statements of an immediate assertion when one of them
/// waits (LRM 16.3: they are ordinary statements, so `#d`/`@e`/`wait` are
/// legal there), else `None` (the assertion stays a straight-line leaf). A
/// deferred assertion's action is a subroutine call that is queued (16.4), so
/// a waiting one is refused by name.
fn suspending_assertion_actions<'d>(
    stmt: &Statement<'d>,
) -> Option<(Option<Statement<'d>>, Option<Statement<'d>>)> {
    let pass = stmt.immediate_assertion_if_true();
    let fail = stmt.immediate_assertion_if_false();
    let waits = |s: &Option<Statement<'d>>| {
        s.as_ref()
            .is_some_and(|s| contains_suspend_trigger(s.as_sem_node()))
    };
    (waits(&pass) || waits(&fail)).then_some((pass, fail))
}

/// The expression an immediate assertion checks.
pub fn assertion_cond<'d>(stmt: &Statement<'d>) -> Option<Expression<'d>> {
    stmt.as_sem_node()
        .children()
        .into_iter()
        .find_map(|n| n.as_expression())
}

/// Whether `stmt` is an `expect` statement (LRM 1800-2023 §16.17): slang models
/// it as a concurrent assertion of kind `Expect`.
fn is_expect(stmt: &Statement<'_>) -> bool {
    stmt.kind() == StatementKind::ConcurrentAssertion
        && stmt.assertion_kind() == Some(sv_lang::AssertionKind::Expect)
}

/// Generic depth-first scan (mirrors `sv-sim-codegen::module::
/// reject_unsupported_in_body`'s pattern) for any statement kind
/// [`CfgBuilder::walk_stmt`] treats as suspend-triggering, wherever it sits
/// inside `node`'s subtree. Used only by the "ordinary straight-line" match
/// arm: a construct this task does not decompose (loops, `case`, ...) is
/// safe to keep as one opaque leaf `Statement` only as long as none of its
/// descendants secretly suspends.
fn contains_suspend_trigger(node: SemNode<'_>) -> bool {
    contains_suspend_trigger_in(node, &mut std::collections::HashSet::new(), true, true)
}

/// `contains_suspend_trigger`, also looking through calls to user tasks
/// (whose bodies are inlined when they can suspend); `visiting` breaks
/// recursion through recursive tasks. `by_request` says whether a
/// `p.await();` / `p.suspend();` statement counts: not inside a function
/// body, which cannot be inlined as a suspending task (a `suspend()` there
/// takes effect at the caller's next blocking point instead).
///
/// `disable_is_trigger`: whether a `disable label;` counts (it is a jump the
/// CFG decomposes, but never itself suspends the process).
fn contains_suspend_trigger_in(
    node: SemNode<'_>,
    visiting: &mut std::collections::HashSet<crate::symid::SymbolId>,
    by_request: bool,
    disable_is_trigger: bool,
) -> bool {
    let mut stack = vec![node];
    while let Some(n) = stack.pop() {
        if let Some(e) = n.as_expression()
            && let Some(callee) = user_task_callee(&e)
            && is_suspending_virtual(&callee)
        {
            return true;
        }
        if let Some(e) = n.as_expression()
            && e.kind() == ExpressionKind::Assignment
            && e.assignment_timing().is_some()
            && (e.is_nonblocking() != Some(true)
                || e.assignment_timing()
                    .and_then(|t| t.as_timing_control())
                    .is_some_and(|tc| tc.kind() != TimingControlKind::Delay))
        {
            // `lhs = #d rhs;` / `lhs = @(e) rhs;` / `q <= @(e) rhs;` (LRM 9.4.5,
            // 10.4.2): the assignment itself waits (`walk_intra_assignment_timing`,
            // `walk_nba_event`), so a task holding one suspends and is inlined --
            // otherwise `disable task;` of another process cannot reach it (9.6.2).
            return true;
        }
        if let Some(e) = n.as_expression() {
            // An interface `extern` call runs the module-side
            // implementations (LRM 25.7): their bodies are what can suspend.
            // A call to an `extern forkjoin` task nothing implements is a
            // run-time error the CFG reports (`Terminator::Switch`).
            let callees: Vec<Symbol<'_>> = match crate::netlist::itf::call_extern_targets(&e) {
                Some(t) if t.impls.is_empty() => return true,
                Some(t) => t.impls,
                None => user_task_callee(&e).into_iter().collect(),
            };
            for callee in callees {
                // A function with an `output`/`inout`/`ref` event formal is
                // inlined like a suspending one (`has_event_out_formal`).
                if has_event_out_formal(&callee) {
                    return true;
                }
                if let Some(body) = proc_body(&callee)
                    && visiting.insert(callee.uid())
                    && contains_suspend_trigger_in(
                        body.as_sem_node(),
                        visiting,
                        by_request
                            && callee.subroutine_kind() == Some(sv_lang::SubroutineKind::Task),
                        // A function is compiled, never inlined: its own
                        // `disable blk;` is a branch there (codegen `func`).
                        disable_is_trigger
                            && callee.subroutine_kind() == Some(sv_lang::SubroutineKind::Task),
                    )
                {
                    return true;
                }
            }
        }
        if let Some(s) = n.as_statement() {
            let kind = s.kind();
            if by_request
                && kind == StatementKind::ExpressionStatement
                && is_process_by_request_stmt(&s)
            {
                return true;
            }
            let is_join_block = kind == StatementKind::Block
                && matches!(
                    s.block_kind(),
                    Some(
                        StatementBlockKind::JoinAll
                            | StatementBlockKind::JoinAny
                            | StatementBlockKind::JoinNone
                    )
                );
            if is_join_block
                || is_expect(&s)
                || matches!(
                    kind,
                    StatementKind::Timed
                        | StatementKind::Wait
                        | StatementKind::WaitFork
                        | StatementKind::WaitOrder
                        | StatementKind::EventTrigger
                        | StatementKind::DisableFork
                )
                // `disable label;` is a jump in the CFG (see this file's
                // module doc comment) -- one hidden inside an opaque
                // "ordinary" leaf (e.g. a `case` branch) forces that leaf to
                // be decomposed too.
                || (disable_is_trigger && kind == StatementKind::Disable)
            {
                return true;
            }
            // A static or procedural concurrent assertion (16.14) is evaluated by the
            // assertion engine, never by the process that reaches it: a task its
            // property calls from a sequence match item (16.11) runs as a thread of
            // its own, so it suspends no process here. Only the pass/fail action
            // statements run in the hosting process and can hold a suspend point.
            if kind == StatementKind::ConcurrentAssertion {
                stack.extend(
                    live_children(&n)
                        .into_iter()
                        .filter(|c| c.as_statement().is_some()),
                );
                continue;
            }
        }
        stack.extend(live_children(&n));
    }
    false
}

/// Whether `task` can call itself ([`task_reaches`]), memoized per task in
/// `vt` when there is one.
fn task_reaches_itself<'a>(task: &Symbol<'a>, vt: Option<&VirtualTasks<'a>>) -> bool {
    let uid = task.uid();
    if let Some(vt) = vt
        && let Some(r) = vt.self_reach.borrow().get(&uid)
    {
        return *r;
    }
    let r = task_reaches(task, &uid, vt, &mut std::collections::HashSet::new());
    if let Some(vt) = vt {
        vt.self_reach.borrow_mut().insert(uid, r);
    }
    r
}

/// Whether `sub`'s body calls `target` (directly or through the user tasks
/// and functions it calls). A call of a virtual method reaches every
/// implementation `vt` knows of (LRM 1800-2023 8.20), so recursion through
/// dynamic dispatch (`a.f()` -> override -> `a.f()` on a child) is found.
fn task_reaches<'a>(
    sub: &Symbol<'a>,
    target: &crate::symid::SymbolId,
    vt: Option<&VirtualTasks<'a>>,
    visiting: &mut std::collections::HashSet<crate::symid::SymbolId>,
) -> bool {
    let Some(body) = proc_body(sub) else {
        return false;
    };
    let mut stack = vec![body.as_sem_node()];
    while let Some(n) = stack.pop() {
        if let Some(e) = n.as_expression()
            && let Some(callee) = user_task_callee(&e)
        {
            let mut callees = vec![callee];
            // `super.m()` is not virtual (LRM 8.15): it never reaches the
            // overrides, so it must not be seen as recursion through them.
            if let Some(vt) = vt
                && !is_explicit_super(e)
                && (callee
                    .subroutine_flags()
                    .contains(sv_lang::MethodFlags::VIRTUAL)
                    || callee.subroutine_override().is_some())
            {
                callees.extend(vt.implementations(&callee).into_iter().map(|(_, s)| s));
            }
            for c in callees {
                if c.uid() == *target {
                    return true;
                }
                if visiting.insert(c.uid()) && task_reaches(&c, target, vt, visiting) {
                    return true;
                }
            }
        }
        stack.extend(live_children(&n));
    }
    false
}

/// Whether `node`'s subtree calls a subroutine that is not a system task.
fn contains_subroutine_call(node: SemNode<'_>) -> bool {
    let mut stack = vec![node];
    while let Some(n) = stack.pop() {
        if let Some(e) = n.as_expression()
            && e.kind() == ExpressionKind::Call
            && e.is_system_call() != Some(true)
        {
            return true;
        }
        stack.extend(live_children(&n));
    }
    false
}

/// The callee of a call to a user (non-system, non-DPI) task or function.
fn user_task_callee<'d>(e: &Expression<'d>) -> Option<Symbol<'d>> {
    if e.kind() != ExpressionKind::Call || e.is_system_call() == Some(true) {
        return None;
    }
    let callee = e.call_subroutine()?;
    if callee
        .subroutine_flags()
        .contains(sv_lang::MethodFlags::DPI_IMPORT)
    {
        return None;
    }
    Some(callee)
}

/// The callee of `e` when it is a call to a user task whose body can
/// suspend -- such a call is inlined into the calling process's CFG.
fn suspending_task_callee<'d>(e: &Expression<'d>) -> Option<Symbol<'d>> {
    let callee = user_task_callee(e)?;
    subroutine_can_suspend(&callee).then_some(callee)
}

/// The calls to user functions that can suspend (a `fork` in the body)
/// under `node`, innermost (argument) calls first.
fn collect_suspending_function_calls<'d>(node: SemNode<'d>, out: &mut Vec<Expression<'d>>) {
    for c in node.children() {
        collect_suspending_function_calls(c, out);
    }
    if let Some(e) = node.as_expression()
        && let Some(callee) = user_task_callee(&e)
        && callee.subroutine_kind() == Some(sv_lang::SubroutineKind::Function)
        && subroutine_can_suspend(&callee)
    {
        out.push(e);
    }
}

/// Whether `sub` has an `output`/`inout`/`ref` `event` formal: its handle is
/// copied back to the actual (LRM 1800-2023 15.5.5.1), which only an inlined
/// body can do, so every call to it is inlined (value functions through
/// `hoist_suspending_function_calls`).
fn has_event_out_formal(sub: &Symbol<'_>) -> bool {
    sub.subroutine_arguments().any(|a| {
        a.formal_argument_direction() != sv_lang::ArgumentDirection::In
            && a.value_type().is_some_and(|t| t.is_event())
    })
}

/// The key under which the code generator finds the capture temporary that
/// holds the value of the inlined call `call` ([`ArgBinding::CallResult`]).
pub fn call_result_key(call: &Expression<'_>) -> crate::symid::SymbolId {
    let at = call.source_range().start;
    crate::symid::SymbolId::synthetic_tagged(&format!("callret.{}.{}", at.buffer, at.offset))
}

/// Whether `sub`'s body (or a task it calls) contains a suspend point --
/// every call to such a task is inlined into the calling process's CFG
/// instead of being compiled as a function.
pub fn subroutine_can_suspend(sub: &Symbol<'_>) -> bool {
    if is_suspending_virtual(sub) {
        return true;
    }
    let Some(body) = proc_body(sub) else {
        return false;
    };
    // An `output`/`inout`/`ref` event formal is copied back as a handle
    // (LRM 1800-2023 15.5.5.1), which only an inlined task can do.
    if has_event_out_formal(sub) {
        return true;
    }
    let mut visiting = std::collections::HashSet::new();
    visiting.insert(sub.uid());
    let by_request = sub.subroutine_kind() == Some(sv_lang::SubroutineKind::Task);
    contains_suspend_trigger_in(body.as_sem_node(), &mut visiting, by_request, by_request)
        || (sub.subroutine_kind() == Some(sv_lang::SubroutineKind::Task)
            && task_stages_nba(sub, &mut std::collections::HashSet::new()))
}

/// Whether the task `sub` (or a task it calls) runs a nonblocking assignment
/// (LRM 1800-2023 10.4.2). Staging an NBA needs the calling process's
/// scheduler handle, which a compiled function does not have, so such a task
/// is inlined into each calling process like a suspending one -- it just
/// never reaches a suspend point.
fn task_stages_nba(
    sub: &Symbol<'_>,
    visiting: &mut std::collections::HashSet<crate::symid::SymbolId>,
) -> bool {
    let Some(body) = proc_body(sub) else {
        return false;
    };
    let mut stack = vec![body.as_sem_node()];
    while let Some(n) = stack.pop() {
        if let Some(e) = n.as_expression() {
            if e.kind() == ExpressionKind::Assignment && e.is_nonblocking() == Some(true) {
                return true;
            }
            if let Some(callee) = user_task_callee(&e)
                && callee.subroutine_kind() == Some(sv_lang::SubroutineKind::Task)
                && visiting.insert(callee.uid())
                && task_stages_nba(&callee, visiting)
            {
                return true;
            }
        }
        stack.extend(live_children(&n));
    }
    false
}

/// The method name when `callee` is a method of the built-in `std::process`
/// class (LRM 9.7): the class named `process` whose scope chain reaches the
/// `std` package -- scope identity, as `sv-sim-codegen`'s
/// `is_builtin_std_class` does (a user class `process` is not it).
pub fn std_process_method(callee: &Symbol<'_>) -> Option<String> {
    std_class_method(callee, "process")
}

/// The method name when `callee` is a method of the built-in `std` package
/// class named `class_name` (`process`, `semaphore`, `mailbox`): scope
/// identity, so a user class of the same name is not it.
pub fn std_class_method(callee: &Symbol<'_>, class_name: &str) -> Option<String> {
    let class = callee.parent()?;
    if !matches!(
        class.kind(),
        SymbolKind::ClassType | SymbolKind::GenericClassDef
    ) || class.name() != class_name
    {
        return None;
    }
    let mut scope = class.parent();
    while let Some(s) = scope {
        if s.kind() == SymbolKind::Package && s.name() == "std" {
            return Some(callee.name().to_string());
        }
        scope = s.parent();
    }
    None
}

/// Whether event expression `e` names a CLASS event (LRM 1800-2023 15.5): an
/// instance `event` property (`m_event`, `obj.m_event`, `h[k].raised`), or an
/// `event` local or formal declared inside a class method. Such an event is a
/// runtime object (`sched::class_event`), not a row of a module's event pool.
/// Conversions are looked through; `null` is no class event by itself.
pub fn is_class_event_expr(e: &Expression<'_>) -> bool {
    let mut e = *e;
    while e.kind() == ExpressionKind::Conversion
        && let Some(inner) = e.conversion_operand()
    {
        e = inner;
    }
    if !e.expr_type().is_some_and(|t| t.is_event()) {
        return false;
    }
    let sym = if e.kind() == ExpressionKind::MemberAccess {
        e.member_symbol()
    } else if matches!(
        e.kind(),
        ExpressionKind::NamedValue | ExpressionKind::HierarchicalValue
    ) {
        e.referenced_symbol()
    } else {
        None
    };
    let Some(sym) = sym else {
        return false;
    };
    if sym.kind() == SymbolKind::ClassProperty {
        return true;
    }
    // A local/formal: the nearest enclosing subroutine is a class method.
    let mut scope = sym.parent();
    while let Some(s) = scope {
        if s.kind() == SymbolKind::Subroutine {
            return s.parent().is_some_and(|p| {
                matches!(
                    p.kind(),
                    SymbolKind::ClassType | SymbolKind::GenericClassDef
                )
            });
        }
        if matches!(
            s.kind(),
            SymbolKind::ClassType | SymbolKind::GenericClassDef
        ) {
            return false;
        }
        scope = s.parent();
    }
    false
}

/// The class events `tc` waits on when it is `@e` on a class event or an
/// `@(e1 or e2 ...)` list with class events (no edge, no `iff` on a class
/// term): waits that queue through the runtime ([`is_class_event_expr`]).
/// Empty when `tc` waits on no class event. A list that also has signal or
/// module-event terms is [`class_event_wait_is_mixed`]; an edge or `iff` on a
/// class term is a named error.
pub fn class_event_wait_terms<'d>(
    tc: &TimingControl<'d>,
) -> Result<Vec<Expression<'d>>, LoweringError> {
    let kind = tc.kind();
    if kind == TimingControlKind::SignalEvent {
        let Some(sig) = first_expression_child(tc) else {
            return Ok(Vec::new());
        };
        if !is_class_event_expr(&sig) {
            return Ok(Vec::new());
        }
        if tc.edge() != EdgeKind::None {
            return Err(LoweringError::unsupported(
                "an edge event control on a class `event` (LRM 1800-2023 15.5)",
            ));
        }
        return Ok(vec![sig]);
    }
    if kind == TimingControlKind::EventList {
        let mut terms = Vec::new();
        for child in tc.children() {
            let Some(sub) = child.as_timing_control() else {
                continue;
            };
            match first_expression_child(&sub) {
                Some(sig)
                    if sub.kind() == TimingControlKind::SignalEvent
                        && is_class_event_expr(&sig) =>
                {
                    if sub.edge() != EdgeKind::None || extract_iff(&sub).is_some() {
                        return Err(LoweringError::unsupported(
                            "an edge or `iff` term on a class `event` in an `@(a or b)` event list (LRM 1800-2023 15.5)",
                        ));
                    }
                    terms.push(sig);
                }
                _ => {}
            }
        }
        return Ok(terms);
    }
    Ok(Vec::new())
}

/// Whether `tc` is an `@(a or b)` event list that mixes class `event` terms
/// with signal or module-event terms (LRM 1800-2023 9.4.2.1, 15.5): such a
/// wait is both a class-event queue entry and a sensitivity-table wait.
pub fn class_event_wait_is_mixed(tc: &TimingControl<'_>) -> bool {
    if tc.kind() != TimingControlKind::EventList {
        return false;
    }
    let (mut class, mut plain) = (false, false);
    for child in tc.children() {
        let Some(sub) = child.as_timing_control() else {
            continue;
        };
        match first_expression_child(&sub) {
            Some(sig)
                if sub.kind() == TimingControlKind::SignalEvent && is_class_event_expr(&sig) =>
            {
                class = true;
            }
            _ => plain = true,
        }
    }
    class && plain
}

/// Whether `stmt` is `p.await();`, `p.suspend();`, a blocking
/// `semaphore.get(...)` or a mailbox `put(...)`/`get(...)`/`peek(...)` as a
/// statement of its own (not nested in a larger expression): the `std` calls
/// that are a suspend point, because the caller may stop there.
fn is_process_by_request_stmt(stmt: &Statement<'_>) -> bool {
    let Some(e) = stmt.expr() else {
        return false;
    };
    if e.kind() != ExpressionKind::Call || e.is_system_call() == Some(true) {
        return false;
    }
    let Some(callee) = e.call_subroutine() else {
        return false;
    };
    std_process_method(&callee).is_some_and(|m| m == "await" || m == "suspend")
        || std_class_method(&callee, "semaphore").is_some_and(|m| m == "get")
        || std_class_method(&callee, "mailbox")
            .is_some_and(|m| matches!(m.as_str(), "put" | "get" | "peek"))
}

/// Whether `stmt` is a mailbox `get(x);` / `peek(x);`: the blocking calls whose
/// result is delivered after the process resumes (the CFG emits the statement
/// again after its suspend point). A `put` finishes in its one call.
fn is_mailbox_two_phase_stmt(stmt: &Statement<'_>) -> bool {
    let Some(e) = stmt.expr() else {
        return false;
    };
    e.kind() == ExpressionKind::Call
        && e.is_system_call() != Some(true)
        && e.call_subroutine()
            .and_then(|callee| std_class_method(&callee, "mailbox"))
            .is_some_and(|m| m == "get" || m == "peek")
}

/// Whether a call to `sub` can end the calling process from inside it: its
/// body, or a subroutine it calls, runs `$finish`/`$stop`/`$fatal` or a
/// task-form `$cast` that can fail, uses a
/// virtual interface (a `null` one is a fatal error, LRM 1800-2023 §25.9),
/// or calls a DPI import (which may call back into an export that does).
/// A call to a virtual method counts if ANY implementation in its override
/// chain can abort ([`mark_aborting_virtual`]: which override runs is only
/// known at run time), and a `new` expression counts if its constructor
/// chain or a property initializer can ([`class_construction_can_abort`]).
pub fn subroutine_can_abort(sub: &Symbol<'_>) -> bool {
    let mut visiting = std::collections::HashSet::new();
    can_abort_in(sub, &mut visiting)
}

thread_local! {
    /// The uid of every virtual-method symbol (a base declaration, each
    /// override, an interface-class prototype) in a vtable slot at least one
    /// of whose implementations can abort. A call to a virtual method
    /// resolves statically to the BASE declaration, whose own body is empty,
    /// so [`can_abort_in`] cannot learn about an aborting override from the
    /// callee's body: codegen computes this set once, to a fixed point,
    /// before lowering any call site ([`mark_aborting_virtual`]).
    static ABORTING_VIRTUALS: std::cell::RefCell<HashSet<crate::symid::SymbolId>> =
        std::cell::RefCell::new(HashSet::new());
    /// Whether a `randomize()` call can end the process: some class's
    /// `pre_randomize()`/`post_randomize()` hook (which `randomize()` runs
    /// on the receiver or on any object it reaches, chosen by dynamic class)
    /// can abort ([`set_randomize_can_abort`]).
    static RANDOMIZE_CAN_ABORT: std::cell::Cell<bool> = const { std::cell::Cell::new(false) };
}

/// Empties the aborting-virtual set (and the `randomize()` flag); codegen
/// calls this before building a design's vtables.
pub fn reset_aborting_virtuals() {
    ABORTING_VIRTUALS.with(|s| s.borrow_mut().clear());
    RANDOMIZE_CAN_ABORT.with(|c| c.set(false));
}

/// Declares that `randomize()` calls can abort (a `pre_randomize()` or
/// `post_randomize()` hook of the design can). Returns whether this changed the
/// flag, for a caller iterating to a fixed point.
pub fn set_randomize_can_abort() -> bool {
    RANDOMIZE_CAN_ABORT.with(|c| !c.replace(true))
}

/// Whether [`set_randomize_can_abort`] has been called since the last reset.
pub fn randomize_can_abort() -> bool {
    RANDOMIZE_CAN_ABORT.with(|c| c.get())
}

/// Records `uid` (a virtual method belonging to a slot with an aborting
/// implementation) as one whose calls can abort. Returns whether it was newly
/// recorded, so a caller iterating to a fixed point knows when it is done.
pub fn mark_aborting_virtual(uid: crate::symid::SymbolId) -> bool {
    ABORTING_VIRTUALS.with(|s| s.borrow_mut().insert(uid))
}

fn can_abort_in(
    sub: &Symbol<'_>,
    visiting: &mut std::collections::HashSet<crate::symid::SymbolId>,
) -> bool {
    if sub
        .subroutine_flags()
        .contains(sv_lang::MethodFlags::DPI_IMPORT)
    {
        return true;
    }
    if ABORTING_VIRTUALS.with(|s| s.borrow().contains(&sub.uid())) {
        return true;
    }
    if !visiting.insert(sub.uid()) {
        return false;
    }
    let Some(body) = proc_body(sub) else {
        return false;
    };
    if node_can_abort(body.as_sem_node(), Some(sub), visiting) {
        return true;
    }
    // A constructor's class-level work (property initializers, the
    // `extends Base(args)` call) runs with it, as part of the `new` that
    // invokes it.
    sub.subroutine_flags()
        .contains(sv_lang::MethodFlags::CONSTRUCTOR)
        && sub
            .parent()
            .and_then(|class| class.as_type())
            .is_some_and(|ty| class_level_can_abort(ty, visiting))
}

/// Whether constructing an object of class `ty` (`new`: every constructor
/// from the root base class down, every level's property initializers and
/// `extends Base(args)` call) can end the process.
pub fn class_construction_can_abort(ty: sv_lang::Type<'_>) -> bool {
    let mut visiting = std::collections::HashSet::new();
    construction_can_abort(ty, &mut visiting)
}

fn construction_can_abort(
    ty: sv_lang::Type<'_>,
    visiting: &mut std::collections::HashSet<crate::symid::SymbolId>,
) -> bool {
    let mut level = Some(ty);
    while let Some(t) = level {
        if !t.is_class() {
            return false;
        }
        if class_level_can_abort(t, visiting) {
            return true;
        }
        if t.class_constructor()
            .is_some_and(|ctor| can_abort_in(&ctor, visiting))
        {
            return true;
        }
        level = t.class_base();
    }
    false
}

/// Whether the work one class level does around its constructor body can
/// end the process: its property initializers and its `extends Base(args)`
/// call (the explicit-`super.new` form is part of the constructor body).
fn class_level_can_abort(
    ty: sv_lang::Type<'_>,
    visiting: &mut std::collections::HashSet<crate::symid::SymbolId>,
) -> bool {
    let class_sym = ty.as_symbol();
    // `class A; A next = new; endclass` constructs itself: the guard keeps
    // the analysis finite (a class level is recorded once, under its own uid).
    if !visiting.insert(class_sym.uid()) {
        return false;
    }
    if let Some(call) = ty.class_base_constructor_call()
        && node_can_abort(call.as_sem_node(), None, visiting)
    {
        return true;
    }
    for member in class_sym.members() {
        if member.kind() == SymbolKind::ClassProperty
            && let Some(init) = member.initializer()
            && node_can_abort(init.as_sem_node(), None, visiting)
        {
            return true;
        }
    }
    false
}

/// [`can_abort_in`]'s walk over one subtree. `enclosing` is the subroutine
/// the subtree belongs to (a `super.new(...)` finds its base class through
/// it).
fn node_can_abort<'d>(
    root: SemNode<'d>,
    enclosing: Option<&Symbol<'d>>,
    visiting: &mut std::collections::HashSet<crate::symid::SymbolId>,
) -> bool {
    let mut stack = vec![root];
    while let Some(n) = stack.pop() {
        // `$cast(dest, src);` as a task is a run-time error when it fails
        // (LRM 6.24.2), ending the process like `$fatal`.
        if let Some(s) = n.as_statement()
            && s.kind() == StatementKind::ExpressionStatement
            && let Some(e) = s.expr()
            && is_failable_task_cast(&e)
        {
            return true;
        }
        if let Some(e) = n.as_expression() {
            if crate::netlist::vif::is_member_access(&e)
                || crate::netlist::vif::call_targets(&e).is_some()
            {
                return true;
            }
            if e.kind() == ExpressionKind::Call {
                if e.is_system_call() == Some(true) {
                    if e.system_subroutine().is_some_and(|s| {
                        match s.known_name_id() {
                            KnownSystemName::Finish
                            | KnownSystemName::Stop
                            | KnownSystemName::Fatal => true,
                            // `obj.randomize()` runs the class's
                            // `pre_/post_randomize()` hooks (LRM 18.6.2).
                            KnownSystemName::Randomize => randomize_can_abort(),
                            _ => false,
                        }
                    }) {
                        return true;
                    }
                } else if let Some(callee) = e.call_subroutine() {
                    // `p.kill()` ends the caller when `p` is the caller (or
                    // one of its ancestors), which is only known at run time.
                    if std_process_method(&callee).is_some_and(|m| m == "kill") {
                        return true;
                    }
                    // An interface `extern` call runs its implementations.
                    for target in crate::netlist::itf::call_callees(&e) {
                        if can_abort_in(&target, visiting) {
                            return true;
                        }
                    }
                }
            } else if e.kind() == ExpressionKind::NewClass {
                if let Some(ctor_call) = e.new_class_constructor_call() {
                    stack.push(ctor_call.as_sem_node());
                }
                // `super.new(...)`'s expression type is `void`: the class
                // whose construction it continues is the enclosing
                // constructor's base. Any other `new` constructs its type.
                let constructed = if e.new_class_is_super_class() == Some(true) {
                    enclosing
                        .and_then(|sub| sub.parent())
                        .and_then(|class| class.as_type())
                        .and_then(|ty| ty.class_base())
                } else {
                    e.expr_type().map(|t| t.canonical())
                };
                if constructed.is_some_and(|ty| construction_can_abort(ty, visiting)) {
                    return true;
                }
            }
        }
        stack.extend(live_children(&n));
    }
    false
}

/// Whether `e` is the task form of `$cast` whose destination type can reject
/// a value (a class handle or an enum; any other destination accepts every
/// source, so the call can never be the run-time error of LRM 6.24.2).
fn is_failable_task_cast(e: &Expression<'_>) -> bool {
    if e.kind() != ExpressionKind::Call
        || e.is_system_call() != Some(true)
        || !e
            .system_subroutine()
            .is_some_and(|s| s.known_name_id() == KnownSystemName::Cast)
    {
        return false;
    }
    let ops = e.operands();
    let Some(&dest) = ops.first() else {
        return false;
    };
    let dest = if dest.kind() == ExpressionKind::Assignment {
        dest.left().unwrap_or(dest)
    } else {
        dest
    };
    dest.expr_type()
        .is_some_and(|t| t.is_class() || t.is_enum())
}

/// The target of an `output`/`inout` call argument: slang binds it as
/// `actual = <formal>`.
fn call_actual_lvalue<'d>(actual: Expression<'d>) -> Expression<'d> {
    if actual.kind() == ExpressionKind::Assignment {
        actual.left().unwrap_or(actual)
    } else {
        actual
    }
}

/// The variables of the activation that forks `branch` that the branch
/// uses: automatic variables and inlined-task formals it does not declare
/// itself (static ones are the instance's signals).
fn captured_vars<'d>(branch: &ProcessCfg<'d>) -> Vec<Symbol<'d>> {
    let own: std::collections::HashSet<crate::symid::SymbolId> =
        super::liveness::declared_local_ids(branch);
    captured_in_excluding(vec![branch.body.as_sem_node()], &own)
}

/// [`captured_vars`] over explicit AST roots, for a branch that declares nothing.
fn captured_in<'d>(roots: Vec<sv_lang::SemNode<'d>>) -> Vec<Symbol<'d>> {
    captured_in_excluding(roots, &std::collections::HashSet::new())
}

fn captured_in_excluding<'d>(
    roots: Vec<sv_lang::SemNode<'d>>,
    own: &std::collections::HashSet<crate::symid::SymbolId>,
) -> Vec<Symbol<'d>> {
    let mut out: Vec<Symbol<'d>> = Vec::new();
    let mut seen = std::collections::HashSet::new();
    let mut stack = roots;
    while let Some(n) = stack.pop() {
        if let Some(e) = n.as_expression()
            && crate::symid::is_value_name(e.kind())
            && let Some(r) = e.referenced_symbol()
        {
            let procedural = (r.kind() == SymbolKind::Variable
                && r.variable_lifetime() == sv_lang::VariableLifetime::Automatic
                && r.parent().is_some_and(|p| {
                    matches!(
                        p.kind(),
                        SymbolKind::StatementBlock | SymbolKind::Subroutine
                    )
                }))
                || r.kind() == SymbolKind::FormalArgument;
            if procedural && !own.contains(&r.uid()) && seen.insert(r.uid()) {
                out.push(r);
            }
        }
        stack.extend(live_children(&n));
    }
    out
}

/// The automatic variables the block statement `stmt` declares: created and
/// initialized each time the block is entered (LRM 1800-2023 §6.21), in
/// declaration order. A `for (int i = ...)` loop's variables live in the
/// implicit block around it, entered as the loop starts; with
/// `with_loop_vars` false they are left out (for a lowering that sets them
/// as part of the loop).
pub fn block_automatic_vars<'d>(stmt: &Statement<'d>, with_loop_vars: bool) -> Vec<Symbol<'d>> {
    if stmt.kind() != StatementKind::Block {
        return Vec::new();
    }
    let Some(block) = stmt.block_symbol() else {
        return Vec::new();
    };
    let mut loop_vars = std::collections::HashSet::new();
    if !with_loop_vars {
        let mut stack = stmt.statements();
        while let Some(s) = stack.pop() {
            if s.kind() == StatementKind::List {
                stack.extend(s.statements());
            } else if s.kind() == StatementKind::ForLoop {
                loop_vars.extend(s.for_loop_vars().iter().map(|v| v.uid()));
            }
        }
    }
    block
        .members()
        .filter(|m| {
            m.kind() == SymbolKind::Variable
                && m.variable_lifetime() == sv_lang::VariableLifetime::Automatic
                && !loop_vars.contains(&m.uid())
        })
        .collect()
}

/// The prefix of the names sv-sim gives the blocks it introduces into a
/// design (`randsequence`'s expansion): they are not part of any
/// hierarchical name the design prints.
pub const INTERNAL_NAME_PREFIX: &str = "__sv_sim_";

/// `sym`'s hierarchical name as the design sees it (`%m`, a message's
/// scope): the blocks sv-sim introduced ([`INTERNAL_NAME_PREFIX`]) left out.
pub fn shown_path(sym: &Symbol<'_>) -> String {
    let path = sym.hierarchical_path();
    if !path.contains(INTERNAL_NAME_PREFIX) {
        return path;
    }
    let mut out = String::with_capacity(path.len());
    let mut rest = path.as_str();
    while let Some(i) = rest.find(INTERNAL_NAME_PREFIX) {
        let at_segment = i == 0 || rest.as_bytes()[i - 1] == b'.';
        if !at_segment {
            out.push_str(&rest[..i + INTERNAL_NAME_PREFIX.len()]);
            rest = &rest[i + INTERNAL_NAME_PREFIX.len()..];
            continue;
        }
        // Drop the segment and the `.` before it (or after it, at the start).
        let end = rest[i..].find('.').map_or(rest.len(), |e| i + e);
        if i > 0 {
            out.push_str(&rest[..i - 1]);
            rest = &rest[end..];
        } else {
            rest = rest[end..].strip_prefix('.').unwrap_or(&rest[end..]);
        }
    }
    out.push_str(rest);
    out
}

/// Whether a variable of type `ty` can hold a class handle or a queue /
/// dynamic / associative array handle (directly or in a struct field): the
/// variables whose block exit owes a release. A fixed-size array of handles
/// is not covered (its elements are released on overwrite only).
pub fn may_hold_handles(ty: &sv_lang::Type<'_>) -> bool {
    if ty.is_class() || crate::state::storage::is_collection(ty) {
        return true;
    }
    ty.is_unpacked_struct()
        && ty
            .fields()
            .any(|f| f.value_type().is_some_and(|t| may_hold_handles(&t)))
}

/// Whether `var` is an automatic variable a block declares (initialized on
/// entry to that block, [`block_automatic_vars`]).
pub fn is_automatic_block_var(var: &Symbol<'_>) -> bool {
    var.variable_lifetime() == sv_lang::VariableLifetime::Automatic
        && var
            .parent()
            .is_some_and(|p| p.kind() == SymbolKind::StatementBlock)
}

/// A task's own variables: members of the task scope (not its formals or
/// result variable) and of every block inside its body.
fn task_locals<'d>(task: &Symbol<'d>) -> Vec<Symbol<'d>> {
    let formal_ids: std::collections::HashSet<crate::symid::SymbolId> =
        task.subroutine_arguments().map(|a| a.uid()).collect();
    let ret_id = task.subroutine_return_val_var().map(|r| r.uid());
    let mut out = Vec::new();
    let mut seen = std::collections::HashSet::new();
    let mut take = |m: Symbol<'d>, out: &mut Vec<Symbol<'d>>| {
        let id = m.uid();
        if m.kind() == SymbolKind::Variable
            && !formal_ids.contains(&id)
            && Some(&id) != ret_id.as_ref()
            && seen.insert(id)
        {
            out.push(m);
        }
    };
    for m in task.members() {
        take(m, &mut out);
    }
    if let Some(body) = proc_body(task) {
        let mut stack = vec![body.as_sem_node()];
        while let Some(n) = stack.pop() {
            if let Some(s) = n.as_statement() {
                for block in block_scopes(&s) {
                    for m in block.members() {
                        take(m, &mut out);
                    }
                }
            }
            let mut kids = live_children(&n);
            kids.reverse();
            stack.extend(kids);
        }
    }
    out
}

// --- Segment IR (PR-041, PR-042, PR-043; SegId numbering CG-098, CG-099) ---

/// Task S3b's real liveness/frame-layout shape now lives in
/// `process::liveness` (`FrameLayout`/`FrameSlotDesc`/`FrameSlotSource`) --
/// re-exported here under this task's original name so every existing call
/// site (this file's own `lower_to_segments`, `tests/process_cfg.rs`) keeps
/// working unchanged.
pub use super::liveness::FrameLayout;
use super::liveness::FrameSlotSource;

/// The codegen-facing, already-liveness-annotated lowering shape (PR-042).
/// `live_in`/`live_out` are `FrameLayout::slots` indices (Task S3b: see
/// `lower_to_segments`'s doc comment for exactly which slots those are).
#[derive(Debug, Clone)]
pub struct Segment<'d> {
    pub id: SegId,
    pub live_in: Vec<u32>,
    /// Mirrors [`BasicBlock::bindings`] 1:1 -- run before `body`.
    pub bindings: Vec<ArgBinding<'d>>,
    /// Mirrors [`BasicBlock::this_var`] 1:1.
    pub this_var: Option<Symbol<'d>>,
    /// Mirrors [`BasicBlock::ref_aliases`] 1:1.
    pub ref_aliases: Vec<(Symbol<'d>, Symbol<'d>)>,
    pub body: Vec<Statement<'d>>,
    /// Mirrors [`BasicBlock::probes`] 1:1 -- indices are into `body`.
    pub probes: Vec<(usize, Statement<'d>)>,
    /// Mirrors [`BasicBlock::disable_probes`] 1:1 -- indices are into `body`.
    pub disable_probes: Vec<(usize, Statement<'d>)>,
    /// Mirrors [`BasicBlock::frame_probes`] 1:1 -- indices are into `body`.
    pub frame_probes: Vec<(usize, FrameProbe<'d>)>,
    /// Mirrors [`BasicBlock::block_events`] 1:1 -- indices are into `body`.
    pub block_events: Vec<(usize, Symbol<'d>, bool)>,
    /// Mirrors [`BasicBlock::stmt_scopes`] 1:1 -- indices are into `body`.
    pub stmt_scopes: Vec<(usize, Symbol<'d>)>,
    /// Mirrors [`BasicBlock::step_exprs`] 1:1 -- see its doc comment.
    pub step_exprs: Vec<Expression<'d>>,
    /// Mirrors [`BasicBlock::repeat_init`] 1:1 -- see its doc comment.
    pub repeat_init: Option<(RepeatCounterId, RepeatCount<'d>)>,
    /// Mirrors [`BasicBlock::repeat_decrement`] 1:1 -- see its doc comment.
    pub repeat_decrement: Option<RepeatCounterId>,
    /// Mirrors [`BasicBlock::expect_resume`] 1:1 -- see its doc comment.
    pub expect_resume: bool,
    pub terminator: SegTerminator<'d>,
}

/// PR-043: covers every [`Terminator`] variant with no lossy fallback (see
/// [`lower_to_segments`]'s 1:1 mapping).
#[derive(Debug, Clone)]
pub enum SegTerminator<'d> {
    Goto(SegId),
    CondGoto {
        cond: Expression<'d>,
        t: SegId,
        f: SegId,
    },
    Suspend {
        point: SuspendPoint<'d>,
        resume: SegId,
        live_out: Vec<u32>,
    },
    End {
        loop_back: Option<SegId>,
    },
    /// The lowering of [`Terminator::Switch`].
    SwitchGoto {
        on: SwitchOn<'d>,
        arms: Vec<SegId>,
        default: SegId,
        report: Option<sv_lang::SourceLoc>,
    },
    /// R-run Task 8: the lossless lowering of [`Terminator::RepeatCheck`] --
    /// see that variant's own doc comment for why a `repeat(N)` loop's
    /// per-iteration decision cannot be represented as an ordinary
    /// `CondGoto` (no `cond: Expression` exists for "compiler-synthesized
    /// counter != 0"). **Deviation from this file's own module doc comment**
    /// (Task 1's "frozen, codegen-exhausted `SegTerminator`" policy): that
    /// policy was written to rule out `ForkJoin` specifically (which has no
    /// honest `SegTerminator` shape at all, ever, this wave); a suspend
    /// nested inside a `repeat` body is a genuinely new kind of branch
    /// condition this crate had no way to construct before this task, not a
    /// reachability gap in the pre-existing four variants -- recorded in
    /// this task's own deviations.
    CondGotoCounter {
        counter: RepeatCounterId,
        t: SegId,
        f: SegId,
    },
    /// R-run Task 17 (PR-047/PR-061): the lossless lowering of
    /// [`Terminator::ForkJoin`] -- a real, new `SegTerminator` shape, added
    /// for the identical reason `CondGotoCounter` above already documents a
    /// deviation from this file's own "frozen `SegTerminator`" policy note:
    /// that note was written to rule out `ForkJoin` specifically because
    /// NOTHING had implemented fork/join scheduling yet; this task is that
    /// implementation for `StatementBlockKind::JoinAll` (codegen enforces
    /// the JoinAll-only scope with a named `LoweringError` for `JoinAny`/
    /// `JoinNone` -- this type carries `kind` through losslessly so codegen
    /// has it to check, rather than this crate silently narrowing what it
    /// represents). `branches` is exactly [`Terminator::ForkJoin`]'s own
    /// field, carried through unchanged (each branch is still a full,
    /// independently suspend-capable nested [`ProcessCfg`] -- codegen
    /// recursively lowers each one into its own real compiled kernel).
    /// `join_blk`/`live_out` mirror `Suspend`'s own `resume`/`live_out`
    /// fields exactly: a fork/join site suspends the calling process (until
    /// every spawned child completes, for `JoinAll`) just as surely as a
    /// `Suspend` terminator does, so the same permanent-frame-slot
    /// liveness/writeback discipline applies -- see [`lower_to_segments`]'s
    /// own fill rule.
    ForkJoin {
        kind: StatementBlockKind,
        branches: Vec<ProcessCfg<'d>>,
        join_blk: SegId,
        live_out: Vec<u32>,
    },
    /// The lowering of [`Terminator::Assertion`].
    AssertGoto {
        stmt: Statement<'d>,
        pass: SegId,
        fail: SegId,
        done: SegId,
    },
    /// The lowering of [`Terminator::Case`]: goes to `arms[i]` for the first
    /// item of `stmt` whose labels match its selector, else `default`.
    CaseGoto {
        stmt: Statement<'d>,
        arms: Vec<SegId>,
        default: SegId,
    },
}

/// PR-041/042/043: a 1:1, source-order-stable (CG-098, CG-099) lowering of
/// each `ProcessCfg` [`BasicBlock`] into a [`Segment`] -- `blocks[i]` always
/// becomes `SegId(i)`, so segment numbering is fixed the moment `build_cfg`
/// allocates its blocks, well before this function (or any LLVM `Context`)
/// ever runs.
///
/// **Task S3b's `live_in`/`live_out` fill rule:** every `FrameLayout` slot
/// with source `FrameSlotSource::DeclaredVar` is a *permanent* slot
/// (PR-017/018 -- valid for the process's entire lifetime, never
/// added/removed by liveness), so its index belongs in `live_in`/`live_out`
/// at every segment, unconditionally. A `FrameSlotSource::Temporary` slot's
/// index would additionally need to appear only where
/// `liveness::compute_liveness`'s own backward fixpoint says it is actually
/// live; this task's own restricted CFG-level IR never has a positive source
/// for a `Temporary` slot at all (one is only ever minted once CODEGEN's
/// Task S3c starts decomposing expressions into named SSA values with no
/// corresponding `sv_lang` symbol), so `frame.slots` here is, for every
/// fixture this task can construct, exactly the `DeclaredVar` set -- see
/// `liveness.rs`'s own module doc comment for the full reasoning. A future
/// Task S3c revision of this function additionally intersects
/// `compute_liveness`'s per-segment result with whatever `Temporary` slots
/// exist by then; this rule does not change for `DeclaredVar` slots.
pub fn lower_to_segments<'d>(cfg: &ProcessCfg<'d>, frame: &FrameLayout) -> Vec<Segment<'d>> {
    // R-run Task 8: a `repeat` loop's synthetic counter is ALSO permanent --
    // it must survive across a suspend/resume call boundary exactly like a
    // declared local (see `FrameSlotSource::SyntheticCounter`'s own doc
    // comment), so its slot index belongs in `live_in`/`live_out` at every
    // segment unconditionally too, same rule as `DeclaredVar`.
    let permanent: Vec<u32> = frame
        .slots
        .iter()
        .enumerate()
        .filter(|(_, s)| {
            matches!(
                s.source,
                FrameSlotSource::DeclaredVar(_)
                    | FrameSlotSource::SyntheticCounter(_)
                    | FrameSlotSource::Temporary(_)
            )
        })
        .map(|(i, _)| i as u32)
        .collect();

    cfg.blocks
        .iter()
        .enumerate()
        .map(|(i, b)| Segment {
            id: SegId(i as u32),
            live_in: permanent.clone(),
            bindings: b.bindings.clone(),
            this_var: b.this_var,
            ref_aliases: b.ref_aliases.clone(),
            body: b.stmts.clone(),
            probes: b.probes.clone(),
            disable_probes: b.disable_probes.clone(),
            frame_probes: b.frame_probes.clone(),
            block_events: b.block_events.clone(),
            stmt_scopes: b.stmt_scopes.clone(),
            step_exprs: b.step_exprs.clone(),
            repeat_init: b.repeat_init.clone(),
            repeat_decrement: b.repeat_decrement,
            expect_resume: b.expect_resume,
            terminator: lower_terminator(&b.terminator, &permanent),
        })
        .collect()
}

/// Task 1: `true` iff any block in `cfg` closes with `Terminator::ForkJoin`
/// -- fork/join has no runtime scheduling semantics this wave (`docs/
/// design/process.md` §7: "construction only, never scheduled"), so
/// [`lower_to_segments`]/`lower_terminator` cannot honestly produce a
/// `SegTerminator` for one (there is no shape in that frozen, codegen-
/// exhausted enum for "spawn N branches" -- see this file's module doc
/// comment's `SegTerminator`-freeze note). Every real caller (this crate's
/// own `sv-sim-bin::run`) must check this and fail loudly *before* calling
/// `lower_to_segments` on a CFG that might contain one; `lower_terminator`
/// itself still documents and asserts the precondition (`unreachable!`) as
/// a caller-discipline internal invariant, exactly like `finish()`'s own
/// "every block must be closed" `.expect()` -- not a condition reachable
/// from malformed SV source once a caller has checked this predicate first.
pub fn contains_unschedulable_fork_join(cfg: &ProcessCfg<'_>) -> bool {
    cfg.blocks
        .iter()
        .any(|b| matches!(b.terminator, Terminator::ForkJoin { .. }))
}

/// R-run Task 17 (PR-047/PR-061): `true` iff any block in `cfg` closes with
/// a `Terminator::ForkJoin` whose `kind` is `JoinAny`/`JoinNone` -- the two
/// fork/join shapes this task's own scope note ("Scope for this task:
/// `JoinAll` only") leaves unimplemented at the codegen layer.
/// **Deliberately narrower than [`contains_unschedulable_fork_join`]
/// above, which this function does NOT replace or modify** (that
/// function's existing callers -- `sv-sim-bin::aot`, which this task does
/// not extend to support ANY fork/join shape -- keep their original,
/// unchanged "reject every fork/join" behavior unaffected): a `JoinAll`
/// fork/join now has a real [`SegTerminator::ForkJoin`] shape
/// [`lower_to_segments`] can produce, so a caller that DOES support it
/// (`sv-sim-bin::run`) needs a predicate that only rejects the two kinds
/// still genuinely unsupported, letting `JoinAll` flow through to
/// `lower_to_segments`/codegen instead of being rejected pre-emptively.
pub fn contains_unsupported_fork_join_kind(cfg: &ProcessCfg<'_>) -> bool {
    cfg.blocks.iter().any(|b| {
        matches!(
            b.terminator,
            Terminator::ForkJoin {
                kind: StatementBlockKind::JoinAny | StatementBlockKind::JoinNone,
                ..
            }
        )
    })
}

fn lower_terminator<'d>(t: &Terminator<'d>, permanent: &[u32]) -> SegTerminator<'d> {
    match t {
        Terminator::Fallthrough(b) => SegTerminator::Goto(SegId(b.0)),
        Terminator::Switch {
            on,
            arms,
            default_blk,
            report,
        } => SegTerminator::SwitchGoto {
            on: on.clone(),
            arms: arms.iter().map(|b| SegId(b.0)).collect(),
            default: SegId(default_blk.0),
            report: *report,
        },
        Terminator::Branch {
            cond,
            then_blk,
            else_blk,
        } => SegTerminator::CondGoto {
            cond: *cond,
            t: SegId(then_blk.0),
            f: SegId(else_blk.0),
        },
        Terminator::Suspend { point, resume_blk } => SegTerminator::Suspend {
            point: point.clone(),
            resume: SegId(resume_blk.0),
            live_out: permanent.to_vec(),
        },
        Terminator::End { loop_back } => SegTerminator::End {
            loop_back: loop_back.map(|b| SegId(b.0)),
        },
        // Task 1: `Loop` lowers losslessly to `SegTerminator::Goto` -- see
        // the module doc comment's `SegTerminator`-freeze note. Its real
        // per-iteration decision already lives on whichever block `entry`
        // names (a real `Branch`, or `Fallthrough` for `forever`), so
        // nothing this enum could represent is lost.
        Terminator::Loop { entry, .. } => SegTerminator::Goto(SegId(entry.0)),
        // R-run Task 8: see `SegTerminator::CondGotoCounter`'s own doc
        // comment for why this is a real, new lowering (not a lossless
        // `Goto`/`CondGoto` reuse the way `Loop` above is).
        Terminator::RepeatCheck {
            counter,
            then_blk,
            else_blk,
        } => SegTerminator::CondGotoCounter {
            counter: *counter,
            t: SegId(then_blk.0),
            f: SegId(else_blk.0),
        },
        // R-run Task 17: no longer unreachable -- see `SegTerminator::
        // ForkJoin`'s own doc comment. Lossless: `branches`/`kind` carry
        // straight through, `join_blk`/`live_out` get the exact same
        // treatment `Suspend`'s `resume`/`live_out` get above (a fork/join
        // site is a real suspend point too).
        Terminator::ForkJoin {
            kind,
            branches,
            join_blk,
        } => SegTerminator::ForkJoin {
            kind: *kind,
            branches: branches.clone(),
            join_blk: SegId(join_blk.0),
            live_out: permanent.to_vec(),
        },
        Terminator::Assertion {
            stmt,
            pass_blk,
            fail_blk,
            done_blk,
        } => SegTerminator::AssertGoto {
            stmt: *stmt,
            pass: SegId(pass_blk.0),
            fail: SegId(fail_blk.0),
            done: SegId(done_blk.0),
        },
        Terminator::Case {
            stmt,
            arms,
            default_blk,
        } => SegTerminator::CaseGoto {
            stmt: *stmt,
            arms: arms.iter().map(|b| SegId(b.0)).collect(),
            default: SegId(default_blk.0),
        },
    }
}

// --- PR-074: cross-check against AnalyzedProcedure::timing_controls() ---

/// Counts every `Timed` statement anywhere in `body`'s subtree, independent
/// of whether `build_cfg` would actually accept each one (a rejected
/// `TimingControlKind` is still a `Timed` statement) -- this subsystem's own
/// "how many suspend points did the tree walk find" half of PR-074's
/// cross-check.
pub fn count_timed_statements(body: &Statement<'_>) -> usize {
    let mut count = 0usize;
    let mut stack = vec![body.as_sem_node()];
    while let Some(n) = stack.pop() {
        if let Some(s) = n.as_statement()
            && s.kind() == StatementKind::Timed
        {
            count += 1;
        }
        stack.extend(live_children(&n));
    }
    count
}

/// PR-074: "the subsystem's own suspend-point tree walk must be cross-checked
/// against `AnalyzedProcedure::timing_controls()`; a mismatch ... MUST be a
/// hard-fail bug, not a warning." Factored as a pure comparator over two
/// counts (rather than requiring every caller to thread a live
/// `sv_lang::Analysis` through) so a test can fault-inject a mismatch
/// directly -- see `cross_check_hard_fails_on_a_fault_injected_mismatch` in
/// `tests/process_cfg.rs`. The real call site passes
/// `own_walk_count = count_timed_statements(body)` and
/// `analyzed_count = analyzed_procedure.timing_controls().count()`.
pub fn check_suspend_count_matches(
    own_walk_count: usize,
    analyzed_count: usize,
) -> Result<(), LoweringError> {
    if own_walk_count == analyzed_count {
        Ok(())
    } else {
        Err(LoweringError::malformed(format!(
            "PR-074 suspend-point cross-check failed: this subsystem's own tree walk found \
             {own_walk_count} Timed statement(s), but AnalyzedProcedure::timing_controls() \
             found {analyzed_count} -- this is a hard bug (a missed or double-counted \
             suspend point), never a warning"
        )))
    }
}