`nx_parse.nx` source

↩ module page · 5077 lines · 262144 B
1// parse.nx -- NishiLang recursive-descent parser, in NishiLang.
2// 2026-04-23: full monomorphization port landed; stdlib.nx's
3// Option<T> / Result<T, E> now instantiate to distinct cached
4// Types here the same way parse.c does.
5//
6// Port of parse.c's core: precedence expression parsing, function
7// declarations, and the common statements (return, let, var, if,
8// while).  Struct / enum / const / match / pattern-matching are
9// deferred to a second port turn so this file stays bounded.
10//
11// Produces IR using the emitter functions defined in ir.nx: for
12// full compilation the driver (main.nx) passes the lex output
13// here, then onto opt -> regalloc -> riscv.
14
15// nx_safety_envelope:  (schema: nishi-library/seeds/safety-critical-standards.toml)
16//   intended_use:       "NishiLang substrate parser -- self-host
17//                        replacement for parse.c (C anchor).  All
18//                        substrate code goes through this parser
19//                        when nxc.elf builds; correctness here
20//                        affects every downstream primitive."
21//   sil_target:         SIL2     (compiler correctness; bugs here
22//                                 manifest as miscompilation of
23//                                 every consumer)
24//   asil_target:        QM
25//   dal_target:         DAL B    (avionics-targeted substrate code
26//                                 inherits the parser's correctness;
27//                                 DO-178C DAL B chain depends on it)
28//   iec_62304_class:    NONE     (substrate-tool, not deployed runtime)
29//   evidence:           [single_pass_no_backtrack, bounded_recursion,
30//                        sealed_token_kinds_TK_complete,
31//                        differential_check_via_bench_ir_diff_sh,
32//                        F16_prevention_via_self_host_gauntlet]
33//   hazard_register:    [bug-tape-parse-codegen-IR-divergence-F13,
34//                        bug-tape-F16-self-compile-reentry-hazard,
35//                        bug-tape-stmt-boundary-false-positive-F-meta-2,
36//                        bug-tape-struct-field-chain-load-elision]
37//   residual_risk:      "Self-compile reentry hazard (F16) is the
38//                        dominant residual risk.  ANY change to this
39//                        file MUST run bench/self_host_gauntlet.sh
40//                        before commit -- cardinal feedback-self-
41//                        compile-reentry-prevention-pillar."
42//   verdict:            NOT_YET_EVALUATED
43
44// Shared IR layouts (Type, Value, Instr, BasicBlock, Function, ...).
45import "nx_types.nx"
46import "nx_quant.nx"
47import "nx_f64.nx"
48import "nx_f64_div.nx"
49
50// Shared Tok record + TK_* TokenKind constants.
51import "nx_lex_kinds.nx"
52
53// Real IR builders.  Previously stubbed here; since the module-
54// library split, parse.nx directly emits into ir.nx's Module/Function
55// pools.  Still-missing builders (load/store/alloca/br_cond) remain
56// stubbed at the bottom of this file until ir.nx grows them.
57import "nx_ir.nx"
58
59// Expanded-line -> (file, source-line) map. Consumed by nx_diag_at below; produced by
60// nx_import.nx. Imported in BOTH so neither file depends on the other's import list.
61import "nx_linemap.nx"
62
63// ---- runtime helpers ----
64// sys_mmap comes from syscalls.nx (via ir.nx); no local copy.
65
66func tok_at(toks: *Tok, i: i64) -> *Tok {
  let base: i64 = toks as i64
  return (base + i * TOK_BYTES) as *Tok
69}
70
71// One-char marker for tracing parser dispatch.  Caller picks a unique
72// character per function entry; sequence on stderr reveals the exact
73// dispatch path taken at runtime.  Cheap (1 syscall, 1 byte) so we
74// can drop it on every parse_* function without bloating output.
75// Switch to a no-op (just `return 0`) once the parser is bug-free.
76func tr(c: i64) -> i64 {
  let buf: *u8 = sys_mmap(8)
  buf[0] = c
  sys_write(2, buf, 1)
  return 0
81}
82
83// Bits-up equivalent of parse.c's die(P, msg).  Emits a stderr line
84// then sys_exit(2).  Added 2026-05-19 with the mconsts cap bump so
85// the NishiLang self-host fails LOUDLY on parser-table overflow
86// instead of silently corrupting the heap past the mmap'd capacity.
87// Per Cardinal 12 (defensive at boundaries): the parser is the
88// boundary between input source and compiled IR; overflow there is
89// the kind of silent-corruption false-OK class [[feedback-no-false-
90// ok-substrate-honesty-audit]] explicitly names.
91// Cap on type arguments in a generic instantiation `Name<A, B, ...>` (2026-08-07). The array that
92// receives them was allocated 8 * 8 + 16 = 80 bytes and the append loop had NO bound of any kind,
93// so a deep or malformed instantiation wrote straight past it. Page granularity hid that for as long
94// as an 80-byte request got its own 4096-byte page; the small-allocation arena packs neighbours and
95// turned it into silent corruption of the parser's type table, which surfaced as type diagnostics
96// fired against declarations that were CORRECT. The cap and the allocation are now derived from the
97// same constant so they cannot drift apart again, and a breach REFUSES rather than truncating.
98const NX_GENERIC_MAX_ARGS: i64 = 8
99
100// Cap on DECLARED PARAMETERS in a function signature (2026-08-07). Derived from the IR call
101// operand ceiling: ir_emit_call fills op0..op23, so 24 is the widest signature the whole pipeline
102// can actually carry, and the two must not drift apart.
103const NX_PARSE_MAX_PARAMS: i64 = 24
104
105// LN42 position statics: declared BEFORE parse_die because a static, like a const, must be declared
106// before the first function that reads it.
107static nx_pd_line: i64
108static nx_pd_col: i64
109// LN42: the same refusal, now with WHERE and a caret. A site reached before any token was consumed has no
110// honest position, so it keeps the bare form rather than pointing at line 0 -- A LOCATION THAT WAS GUESSED IS
111// WORSE THAN NO LOCATION, BECAUSE THE READER WILL GO THERE.
112func parse_die(msg: *u8, msg_len: i64) -> i64 {
  if nx_pd_line > 0 {
      nx_diag_organ_at(nx_pd_line)
      nx_diag_puts(": " as *u8)
      nx_diag_puts(msg)
      nx_diag_puts("\n" as *u8)
      nx_diag_caret(nx_pd_line, nx_pd_col)
      nx_diag_puts("  why the build stopped: the parser refused this construct, so there is no program to emit here. The caret is on the last token it consumed -- the construct that broke is at or just before it.\n" as *u8)
      nx_diag_puts("  fix: read the sentence above as the rule that was broken. If this line looks correct, the real break is usually just before it: an unclosed brace, a missing comma, or a name that is not declared yet.\n" as *u8)
      sys_exit(2)
      return 0
  }
  sys_write(2, "nx_parse: " as *u8, 10)
  sys_write(2, msg, msg_len)
  sys_write(2, "\n" as *u8, 1)
  sys_exit(2)
  return 0
129}
130
131// ---- CARET + SOURCE SNIPPET (2026-08-05) ----------------------------------
132// Toks have carried line AND col all along; what the Parser never had was the SOURCE, so a
133// diagnostic could say WHERE but never SHOW it. rustc and Elm both show the offending line with a
134// caret under the column, and that is most of why their errors feel different.
135// PLUMBED ADDITIVELY: a module static the driver fills right after it reads the input, so NO
136// existing caller of parse_module changes signature, and any caller that does not set it simply
137// gets no snippet (the diagnostic still carries line/col). Degrades to exactly today's behaviour.
138// NOTE ON LINE NUMBERS: nx_cc parses PRE-EXPANDED source (imports inlined), so the line is the
139// expanded-source line -- which is the line the caret must point at to be truthful about what the
140// compiler actually read. Mapping back to per-file lines is a separate rung.
141// ---- MULTI-ERROR RECOVERY (2026-08-05) ------------------------------------
142// Every semantic diagnostic used to sys_exit(2) on the spot, so one broken
143// build reported ONE error and charged the author a full rebuild per mistake.
144// rustc and Elm report everything they can see. RECOVERY CONTRACT: a site
145// whose parser POSITION is already sane (the construct was fully consumed
146// before the verdict) calls nx_diag_note_error() and continues with a safe
147// placeholder value; parse_module then REFUSES to return the module while
148// nx_diag_nerr > 0, so recovered (poisoned) IR can NEVER reach codegen --
149// the SITES-LIVE silent-value-id-0 lesson stays intact because recovery
150// values exist only on builds that are already doomed to exit 2.
151// Parser-DESYNC sites (reserved keyword in name position, operator at
152// expression start, parse_die table overflow) stay FATAL BY DESIGN: past a
153// desync every further diagnostic would point at innocent code.
154const NX_DIAG_MAX_ERRS: i64 = 20
155static nx_diag_nerr: i64
156
157func nx_diag_note_error() -> i64 {
  nx_diag_nerr = nx_diag_nerr + 1
  if nx_diag_nerr >= NX_DIAG_MAX_ERRS {
      nx_diag_puts("error: too many problems (20) -- fix the ones above and build again.\n" as *u8)
      nx_diag_puts("  why the build stopped: after twenty errors the parser is usually reporting consequences of the first few, not new defects, and a longer list hides the cause.\n" as *u8)
      nx_diag_puts("  fix: start with the FIRST error above (it names the file and line with a caret); one fix there often clears many of the rest, then build again.\n" as *u8)
      sys_exit(2)
  }
  return 0
166}
167
168// VOICE HELPER (2026-08-06, the 5W+H / Elm-class cardinals): every diagnostic sentence goes
169// through here, length computed at runtime -- the whole hand-counted sys_write length bug
170// class (which twice silently truncated messages) cannot exist on this path.
171func nx_diag_puts(s: *u8) -> i64 {
  var n: i64 = 0
  while s[n] != (0 as u8) { n = n + 1 }
  sys_write(2, s, n)
  return 0
176}
177
178// The WHY for the whole undefined-name class, said once, in user language (5W+H: a message
179// that names WHAT but not WHY once cost a 3-hour debug -- the rule exists for this line).
180func nx_diag_why_undefined() -> i64 {
  nx_diag_puts("  why the build stopped: this name has no definition, so the program would have nothing to run here -- building on would ship a crash or a wrong value at this exact spot.\n" as *u8)
  return 0
183}
184
185static nx_diag_src: *u8
186static nx_diag_src_len: i64
187
188func nx_diag_set_source(p: *u8, n: i64) -> i64 {
  nx_diag_src = p
  nx_diag_src_len = n
  return 0
192}
193
194// Print "  <source line>" then "  <spaces>^" under column col (1-based). Silent when the source
195// was never registered or the line cannot be found -- a caret pointing at the wrong place would be
196// worse than none.
197func nx_diag_caret(line: i64, col: i64) -> i64 {
  if (nx_diag_src as i64) == 0 { return 0 }
  if nx_diag_src_len <= 0 { return 0 }
  if line <= 0 { return 0 }
  let s: *u8 = nx_diag_src
  var start: i64 = 0 - 1
  if line == 1 { start = 0 }
  var i: i64 = 0
  var cur: i64 = 1
  while i < nx_diag_src_len {
      if s[i] == (10 as u8) {
          cur = cur + 1
          if cur == line { start = i + 1; i = nx_diag_src_len }
      }
      if i < nx_diag_src_len { i = i + 1 }
  }
  if start < 0 { return 0 }
  var e: i64 = start
  var go: i64 = 1
  while go == 1 {
      if e >= nx_diag_src_len { go = 0 } else {
          if s[e] == (10 as u8) { go = 0 } else { e = e + 1 }
      }
  }
  var n: i64 = e - start
  if n > 200 { n = 200 }
  if n <= 0 { return 0 }
  sys_write(2, "  " as *u8, 2)
  sys_write(2, ((s as i64) + start) as *u8, n)
  sys_write(2, "\n  " as *u8, 3)
  var c: i64 = 1
  while c < col {
      var ch: *u8 = " " as *u8
      if c - 1 < n { if s[start + c - 1] == (9 as u8) { ch = "\t" as *u8 } }
      sys_write(2, ch, 1)
      c = c + 1
  }
  sys_write(2, "^\n" as *u8, 2)
  return 1
236}
237
238// Print source line N indented, NO caret -- the quoting half of the caret machinery, used by
239// nx_dym_note to SHOW a suggestion's declaration instead of describing it in shorthand.
240func nx_diag_show_line(line: i64) -> i64 {
  if (nx_diag_src as i64) == 0 { return 0 }
  if nx_diag_src_len <= 0 { return 0 }
  let s: *u8 = nx_diag_src
  var cur: i64 = 1
  var start: i64 = 0 - 1
  if line == 1 { start = 0 }
  var i: i64 = 0
  while i < nx_diag_src_len {
      if s[i] == (10 as u8) {
          cur = cur + 1
          if cur == line { start = i + 1; i = nx_diag_src_len }
      }
      if i < nx_diag_src_len { i = i + 1 }
  }
  if start < 0 { return 0 }
  var e: i64 = start
  var go: i64 = 1
  while go == 1 {
      if e >= nx_diag_src_len { go = 0 } else {
          if s[e] == (10 as u8) { go = 0 } else { e = e + 1 }
      }
  }
  var n: i64 = e - start
  if n > 200 { n = 200 }
  if n <= 0 { return 0 }
  sys_write(2, "      " as *u8, 6)
  sys_write(2, ((s as i64) + start) as *u8, n)
  sys_write(2, "\n" as *u8, 1)
  return 1
270}
271
272// ---- DID-YOU-MEAN (2026-08-05) --------------------------------------------
273// rustc and Elm both answer a misspelled name with the name you meant; nx_cc used to answer
274// "call to undefined function: sys_wrte" and stop, which tells the author WHAT is wrong and
275// nothing about what to type. The names are all already in the module: this is a scan, not a
276// new index. Bounded Levenshtein (classic two-row DP) with an early length filter.
277// COST CONTROL: only runs on the ERROR path, immediately before exiting.
278func nx_dym_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
279
280// Edit distance between a (len la) and b (len lb), capped: any pair whose lengths differ by more
281// than udget is rejected without the DP. Returns a large number when over budget.
282func nx_dym_dist(a: *u8, la: i64, b: *u8, lb: i64, budget: i64) -> i64 {
  var d: i64 = la - lb
  if d < 0 { d = 0 - d }
  if d > budget { return 999 }
  if la > 64 { return 999 }
  if lb > 64 { return 999 }
  let prev: *u8 = sys_mmap(80)
  let cur: *u8 = sys_mmap(80)
  var j: i64 = 0
  while j <= lb { prev[j] = j as u8; j = j + 1 }
  var i: i64 = 1
  while i <= la {
      cur[0] = i as u8
      var k: i64 = 1
      while k <= lb {
          var cost: i64 = 1
          if a[i - 1] == b[k - 1] { cost = 0 }
          var best: i64 = (prev[k] as i64) + 1
          let ins: i64 = (cur[k - 1] as i64) + 1
          if ins < best { best = ins }
          let sub: i64 = (prev[k - 1] as i64) + cost
          if sub < best { best = sub }
          cur[k] = best as u8
          k = k + 1
      }
      var c: i64 = 0
      while c <= lb { prev[c] = cur[c]; c = c + 1 }
      i = i + 1
  }
  return prev[lb] as i64
312}
313
314// DYM WINNER CONTEXT (2026-08-05, operator bar: "did-you-mean is the floor -- the suggestion
315// must take the reader to what the recommended spelling DOES, so an AI or a human judges by
316// CONTEXT, not naming"). The suggesters stash the winning candidate here; the diagnostic site
317// calls nx_dym_note(P) after the caret to print ONE `note:` line with the winner's declaration
318// facts. kind: 0 none, 1 function, 2 module const, 3 local, 4 struct, 5 generic type param.
319static nx_dym_last_kind: i64
320static nx_dym_last_p: *u8
321static nx_dym_last_l: i64
322static nx_dym_last_aux: i64
323
324// Print " -- did you mean 'X'?" for the closest DEFINED function name, if one is close enough.
325// Silent when nothing is near: a wrong suggestion is worse than none.
326func nx_dym_suggest_fn(m: *Module, name: *u8, nlen: i64) -> i64 {
  if m == (0 as *Module) { return 0 }
  var budget: i64 = 2
  if nlen <= 4 { budget = 1 }
  var best_d: i64 = 999
  var best_p: *u8 = 0 as *u8
  var best_l: i64 = 0
  var best_np: i64 = 0
  var i: i64 = 0
  while i < m.n_functions {
      let base: i64 = m.functions as i64
      let f: *Function = (base + i * 176) as *Function
      let fn_p: *u8 = f.name_start as *u8
      let fn_l: i64 = f.name_len
      if fn_l > 0 {
          let dd: i64 = nx_dym_dist(name, nlen, fn_p, fn_l, budget)
          if dd < best_d { best_d = dd; best_p = fn_p; best_l = fn_l; best_np = f.n_params }
      }
      i = i + 1
  }
  if best_d > budget { return 0 }
  if best_d == 0 { return 0 }
  if (best_p as i64) == 0 { return 0 }
  nx_dym_last_kind = 1
  nx_dym_last_p = best_p
  nx_dym_last_l = best_l
  nx_dym_last_aux = best_np
  return 1
354}
355
356// Decimal-print an i64 to stderr (for line numbers in diagnostics).
357func nx_put_dec_err(n: i64) -> i64 {
  if n == 0 { sys_write(2, "0" as *u8, 1) return 0 }
  var m: i64 = n
  if m < 0 { sys_write(2, "-" as *u8, 1) m = 0 - m }
  let digits: *u8 = sys_mmap(24)
  var k: i64 = 0
  while m > 0 {
      digits[k] = (0x30 + (m % 10)) as u8
      m = m / 10
      k = k + 1
  }
  var i: i64 = k - 1
  while i >= 0 {
      let one: *u8 = sys_mmap(1)
      one[0] = digits[i]
      sys_write(2, one, 1)
      i = i - 1
  }
  return 0
376}
377
378// ---- PER-FILE LOCATION (2026-08-06) ---------------------------------------
379// nx_cc parses PRE-EXPANDED source, so every `line` in this file has always been a
380// line in the FLATTENED buffer: truthful about what the compiler read, and useless
381// for finding the file to edit. The note above nx_diag_caret said it plainly --
382// "Mapping back to per-file lines is a separate rung". nx_linemap.nx is that rung;
383// the driver hands the map over the same additive way it hands over the source text.
384static nx_diag_lm: *LineMap
385static nx_diag_lm_scratch: *i64
386
387func nx_diag_set_linemap(lm: *LineMap) -> i64 {
  nx_diag_lm = lm
  // Publish the SAME map to the module that owns the type, so the x86 emitter can reach it
  // without depending on where nx_parse happens to land in the expanded unit. One setter,
  // two consumers, no ordering assumption.
  lm_set_active(lm)
  return 0
394}
395
396// Emit a diagnostic's location: `nx_parse.nx:412` when the map can PROVE it, and
397// `line 1118` -- today's exact bytes -- when it cannot. Returns 1 if a file was named.
398//
399// TWO CONTRACTS ARE LOAD-BEARING HERE.
400// (1) The literal "error at " prefix is shared by BOTH forms on purpose. nx_mgmt_api
401//     anchors its diag_errors window on that string to lift errors out of a build log;
402//     a writer and a reader that must agree should agree on the SHORTEST stable form,
403//     so widening the anchor beats a flag day on both sides.
404// (2) Falling back is not a failure mode, it is the design. A WRONG file name sends
405//     the author to edit a file that is not the problem -- the same class as a caret
406//     under the wrong line, which this compiler shipped, caught, and fixed before
407//     promotion (2026-08-05). Unknown prints the old form; it never guesses.
408// SHARED LOCATION RENDERER. Both voices below call this, so they can never drift apart on
409// what a location looks like -- the failure mode where a log-scraper learns one shape and a
410// second emitter quietly ships another.
411// Prints "<file>:<line>" when the map can PROVE it, else "line <line>" (today's exact bytes).
412// Returns 1 if a file was named.
413func nx_diag_loc(line: i64) -> i64 {
  if (nx_diag_lm as i64) != 0 {
      if (nx_diag_lm_scratch as i64) == 0 { nx_diag_lm_scratch = sys_mmap(32) as *i64 }
      let sc: *i64 = nx_diag_lm_scratch
      let fp: *i64 = sc
      let sp: *i64 = ((sc as i64) + 8) as *i64
      *fp = 0
      *sp = 0
      if lm_lookup(nx_diag_lm, line, fp, sp) == 1 {
          let path: *u8 = lm_file_path(nx_diag_lm, *fp)
          if (path as i64) != 0 {
              nx_diag_puts(lm_basename(path))
              nx_diag_puts(":" as *u8)
              nx_put_dec_err(*sp)
              return 1
          }
      }
  }
  nx_diag_puts("line " as *u8)
  nx_put_dec_err(line)
  return 0
434}
435
436// THE 5W+H VOICE. "error at " is the anchor nx_mgmt_api uses to lift the error window out of
437// a build log, and it is a strict prefix of BOTH the mapped and unmapped forms -- so widening
438// the reader's anchor beat a flag day on both sides.
439func nx_diag_at(line: i64) -> i64 {
  nx_diag_puts("error at " as *u8)
  return nx_diag_loc(line)
442}
443
444// THE OLDER ORGAN-PREFIXED VOICE, for the sites whose message text has not been rewritten yet
445// (arity, argument type, reserved keyword, unreachable arm, non-exhaustive match,
446// const-before-declaration, duplicate definition). These gain FILE ATTRIBUTION today without
447// touching the "nx_parse:" prefix that same scraper also anchors on, which keeps the voice
448// rewrite a separate, independently reviewable change instead of a prerequisite.
449func nx_diag_organ_at(line: i64) -> i64 {
  nx_diag_puts("nx_parse: " as *u8)
  return nx_diag_loc(line)
452}
453
454// Print one token's inline text to stderr (printable bytes only, capped).
455func nx_put_tok_text_err(t: *Tok) -> i64 {
  let txt: *u8 = tok_text_ptr(t)
  let one: *u8 = sys_mmap(1)
  var k: i64 = 0
  var stop: i64 = 0
  while stop == 0 {
      let c: i64 = txt[k] as i64
      if c < 0x20 { stop = 1 }
      if c > 0x7E { stop = 1 }
      if stop == 0 {
          one[0] = txt[k] as u8
          sys_write(2, one, 1)
          k = k + 1
      }
      if k >= 40 { stop = 1 }
  }
  if k == 0 { sys_write(2, "." as *u8, 1) }   // punctuation w/ empty inline text
  return 0
473}
474
475// Diagnostic context: print a window of source tokens around `name_tok`
476// so the offending statement is visible even before full snippet+caret
477// (NDX-1 spec interim).  Token text is inline in each Tok, so this works
478// without threading the source buffer through the parser.
479func nx_diag_token_window(P: *Parser, tidx: i64) -> i64 {
  var ci: i64 = tidx - 8
  if ci < 0 { ci = 0 }
  sys_write(2, "  near: " as *u8, 8)
  while ci <= tidx + 2 {
      let ct: *Tok = tok_at(P.toks, ci)
      nx_put_tok_text_err(ct)
      sys_write(2, " " as *u8, 1)
      ci = ci + 1
  }
  sys_write(2, "\n" as *u8, 1)
  return 0
491}
492
493// ---- Parser state ----
494
495struct Local {
  // Name stored as first 8 chars in text0..text7 (matches Tok layout).
  name0: i64, name1: i64, name2: i64, name3: i64,
  name4: i64, name5: i64, name6: i64, name7: i64,
  value_id:   i64,
  is_alloca:  i64,
  ty_kind:    i64,      // 5 = i64, etc. (legacy fast tag)
  // Full type carried so parse_field_chain can pick the right
  // pointer stride.  *u8 indexing must use stride 1, not the
  // default i64 stride 8.  Closes T#types-001's parser side.
  ty:         *Type,
  // LN3 raw-pointer provenance (bck_ptr_provenance): the allocation extent in BYTES when this
  // local is a `let`-bound pointer whose initializer the compiler could SEE allocate -- today
  // that is `sys_mmap(<compile-time-const>)`, optionally through an `as *T` cast chain.  0 =
  // no visible provenance (the honest default; a param, a loaded field, a runtime-sized mmap).
  // Only `let` locals ever carry one: a `let` is SSA (parse_stmt_ident_assign refuses stores),
  // so the extent can never go stale.  Checks are injected ONLY under --ptrprov (g_ptrprov_live).
  ext_bytes:  i64,
  // LN2 option enforcement (opt_enforce_unwrap): 1 = this pointer-typed local is PROVEN non-null on
  // the current path (bound from &x / a string literal, or narrowed by `if p != 0 {`, an early-exit
  // `if p == 0 { return }`, `while p != 0 {`, or nx_assert_ptr(p ...)).  0 = possibly null (the
  // honest default: a call result, a param, a loaded field, a `0 as *T`).  Read ONLY under
  // --optenforce (g_optenforce_live); a reassignment re-derives it from the new value.
  nn_checked: i64,
  // LN4/LN5 OWNERSHIP (own_check_move / own_check_uaf): the ownership state of this local when it
  // is a pointer bound to a VISIBLE ALLOCATION -- a sys_mmap call, optionally through an `as *T`
  // cast chain (the same origin recogniser LN2/LN3 use, no second copy).
  //   0 OWN_NONE     not an owner; this rung says NOTHING about it (the honest default)
  //   1 OWN_LIVE     owns a live allocation
  //   2 OWN_MOVED    ownership was transferred away by __move(p) -- the name is dead (LN4)
  //   3 OWN_RELEASED the allocation was handed to sys_munmap(p, n) -- the pages are gone (LN5)
  // Read ONLY under --ownership (g_ownership_live).  own_line carries the line of the move or the
  // release, so a refusal can name BOTH ends -- the use AND the statement that ended the local's
  // life.  A diagnostic that names only the use makes the reader hunt for the other half.
  own_state:  i64,
  own_line:   i64,
531}
532
533// HAND-MAINTAINED MIRROR of `struct Local`'s size: 8 name slots + value_id + is_alloca + ty_kind +
534// ty + ext_bytes + nn_checked + own_state + own_line = 16 * 8.  It is the ONE stride (parser_loc_at)
535// and the ONE pool size (parse_module's sys_mmap), so those two can never disagree -- but it is a
536// MIRROR of the struct, so adding a field without bumping it reads every local at the wrong offset.
537// COST OF THE LN4/LN5 BUMP 112 -> 128, named rather than left for someone to discover: the locals
538// pool is NX_PARSE_LOCALS_CAP * LOCAL_BYTES, so this is +131,072 B of address space per compiler
539// invocation (917,504 -> 1,048,576), mmapped once at parse_module entry and never grown.
540const LOCAL_BYTES: i64 = 128
541
542// Per-function locals pool capacity.  Reset to 0 per function, so this is
543// the MAX simultaneous locals any single function may declare.  Was 64 --
544// missed when the mconsts pool was bumped off the C-bootstrap limit
545// (2026-05-20).  64 silently overflowed the locals pool into the ADJACENT
546// globals pool (consecutive anonymous mmaps share a boundary), corrupting
547// m.globals/m.n_globals -> garbage .rodata emission, for any function with
548// >64 locals (e.g. the ACME issuance drive's main).  Bumped to 8192 (the
549// daily-driver cap belongs to NishiLang, not the bootstrap) + add_local now
550// die()s loudly on exhaustion instead of corrupting silently.
551const NX_PARSE_LOCALS_CAP: i64 = 8192
552
553// ONE NAMED CAP PER POOL, READ BY BOTH THE ALLOCATION AND EVERY GUARD.
554// These were bare literals written at the mmap and again at each `>=` check -- two rulers for one
555// invariant -- and they had ALREADY DRIFTED: the mconsts allocation was bumped 2048 -> 8192 on
556// 2026-05-19 and its two guards were left at 2048, so 6144 of the new slots were unreachable and the
557// very overflow that bump was written to fix still died at the old number. A cap written twice is two
558// caps, and the copy nobody updates is the one that decides.
559const NX_PARSE_STRUCTS_CAP: i64 = 1024
560const NX_PARSE_STATICS_CAP: i64 = 512
561const NX_PARSE_ENUMS_CAP:   i64 = 256
562const NX_PARSE_MCONSTS_CAP: i64 = 8192
563// GLOBALS POOL: DERIVED FROM THE TOKEN STREAM (2026-09-05). The old text here said there was "no single token kind
564// to count" and left a DECLARED bound of 4096 -- and on 2026-09-05 a unit (nx_wgsl: the shader front-end + both
565// backends + the world and cast shaders) reached 4097 and the build stopped, the same class as the 256-slot
566// function pool this file already derived out of existence. There is no single kind, but there is a SUM: every
567// global the IR ever creates is anchored to a token -- a string literal (TK_STRING), a `static` (TK_STATIC), a
568// float literal (TK_FLOAT, the x86 constant pool) -- or is synthesised per function (TK_FUNC). count_global_tokens
569// sums those, and NX_PARSE_GLOBALS_SLACK is the one figure not derived from the input: headroom for entries the
570// backend synthesises without any of those tokens, named for that purpose and NOT load-bearing -- ir_add_global_*
571// still asserts against globals_cap, so exceeding it REFUSES LOUDLY instead of writing past the pool.
572// Surplus slots cost address space that is never faulted in (mmap); a shortfall used to cost a build.
573const NX_PARSE_GLOBALS_SLACK: i64 = 256
574// Headroom over the COUNTED `func` keywords for Functions the IR synthesises rather than parses. This
575// is the only figure here that is not derived from the input, so it is named for that one purpose and
576// it is deliberately NOT load-bearing: ir_new_function asserts against m.fn_cap, so exceeding it
577// REFUSES LOUDLY instead of running past the pool into the adjacent globals region.
578const NX_PARSE_FN_SLACK: i64 = 64
579
580struct Parser {
  toks:       *Tok,
  pos:        i64,
  module:     *Module,       // parent module; owns Functions and Globals
  current_fn: *Function,
  current_bb: *BasicBlock,
  locals:     *Local,
  n_locals:   i64,
  // First local index of the INNERMOST block. A redeclaration is only a duplicate within
  // THIS block; shadowing an enclosing scope is legal and the estate relies on it.
  block_base: i64,
591
  // Innermost loop context
  loop_head:  *BasicBlock,
  loop_exit:  *BasicBlock,
595
  // Module-level integer constants.  `const NAME: i64 = N` registers
  // here; parse_primary consults this list when an identifier misses
  // the local table so const uses inside functions fold to literals.
  mconsts:    *MConst,
  n_mconsts:  i64,
601
  // Module-level struct types.  Each TY_STRUCT we parse is registered
  // here so parse_type can resolve user struct names to their layout.
  // STUB(parser, T#parser-002): pool capped at 64 entries.
  //   Plan: grow dynamically (mirror globals-pool growth in
  //   ir_module_new) + bounds-check in register_struct.
  //   Closes when: any nxc.nx self-compile with >64 struct decls.
  structs:    *StructEntry,
  n_structs:  i64,
610
  // Module-level `static` declarations.  Each maps an inline-name
  // copy + its global id.  On parse_function entry we inject one
  // synthesised Local per static with a VAL_GLOBAL_ADDR Value, so
  // use sites inside functions lower via the standard local-lookup
  // path (is_alloca=1 => auto-load / indexed write / field chain).
  statics:    *StaticEntry,
  n_statics:  i64,
618
  // Module-level enums.  Tracks per-enum whether any variant has a
  // payload: tagged enums get an auto-generated shadow struct
  // (tag + payload fields) so constructors + match can build and
  // deconstruct the ADT.  Plain enums stay as int discriminants.
  enums:      *EnumEntry,
  n_enums:    i64,
625
  // Active generic type parameters.  Populated while parsing
  // inside `struct Name<T, U> { ... }` so that parse_type can
  // detect an identifier like `T` and produce a TY_PARAM node.
  // Cleared after the struct's field list finishes.  Static cap
  // matches parse.c's args[8] limit.
  active_params:   *i64,       // array of *u8 name ptrs
  n_active_params: i64,
633
  // V-LANGEXT M2 hygiene guard: depth of currently-parsing nested
  // if-then-else expressions. Incremented at parse-time entry; checked
  // against NX_PARSE_IFEXP_MAX_DEPTH; rejected if exceeded. Prevents
  // pathological codegen from any source that nests if-expressions
  // beyond what real-world code ever needs (e.g., 16 is already deeper
  // than any human-readable nested ternary -- C `?:` chains are
  // similarly capped by readability + most linters).
  // Per [[feedback-nishilang-extension-guardrails-2026-05-27]] +
  // operator 2026-05-27: "we want to avoid hoisting issues and
  // namespace issues and all the other hygiene issues that make
  // languages suck, really research and make sure we are adding good
  // functionality not future nightmares".
  ifexp_depth:     i64,
647}
648
649// One entry per `enum NAME { ... }`.  The shadow_ty is non-null only
650// when any variant declared a payload type -- plain enums keep the
651// int-discriminant representation and leave shadow_ty = null.
652struct EnumEntry {
  name0: i64, name1: i64, name2: i64, name3: i64,
  name4: i64, name5: i64, name6: i64, name7: i64,
  name_len:  i64,
  has_payload: i64,
  shadow_ty:   *Type,
  n_variants:  i64,
659}
660
661const ENUM_ENTRY_BYTES: i64 = 96
662
663struct StaticEntry {
  name0: i64, name1: i64, name2: i64, name3: i64,
  name4: i64, name5: i64, name6: i64, name7: i64,
  name_len:  i64,
  global_id: i64,
  ty:        *Type,
669}
670
671const STATIC_ENTRY_BYTES: i64 = 88
672
673// One entry in the Parser's struct lookup table.  Keeps the Type
674// pointer (owned by ir.nx) plus an inline name copy so the name
675// survives past the lexer's token buffer lifetime.
676struct StructEntry {
  name0: i64, name1: i64, name2: i64, name3: i64,
  name4: i64, name5: i64, name6: i64, name7: i64,
  name_len: i64,
  ty:       *Type,
681}
682
683const STRUCT_ENTRY_BYTES: i64 = 80
684
685struct MConst {
  // First 64 bytes = name (null-terminated in place, matches Local
  // layout so we can reuse the name-copy helpers).
  name0: i64, name1: i64, name2: i64, name3: i64,
  name4: i64, name5: i64, name6: i64, name7: i64,
  val:   i64,
  // V-LANGEXT M1 (NishiLang self-host): string-literal in module-
  // const declarations per [[feedback-nishilang-extension-guardrails-
  // 2026-05-27]]. kind discriminates int (0) vs string (1); for
  // strings, gid is the ir_add_global_string id + ty_ptr is the
  // pointer-type cast.
  kind:    i64,
  gid:     i64,
  ty_ptr:  i64,
699}
700
701const MCONST_BYTES: i64 = 96
702
703// ---- token ops ----
704
705// LN15: TK_STAR is the ONE line-leading operator that is genuinely ambiguous --
706// `*p = v` is a pointer store (a real statement, parse_stmt_star), while `* b` can
707// only be a multiply continuing the line above. tok_line_continuation returns
708// TLC_STORE_OR_JOIN for it and hands the decision here, because deciding it needs
709// the token STREAM and not just the kind.
710//
711// Decide by looking for the store's `=` at bracket depth 0. The scan is bounded by
712// THIS PHYSICAL LINE, not by a chosen constant: a store statement lives on its own
713// line, so leaving the line is itself the answer. TK_EOF terminates unconditionally,
714// so the loop cannot run away on a malformed stream.
715//
716// Wrong-in-the-direction-of-the-incumbent by construction: anything this cannot
717// prove to be a store falls through to 0 = JOIN only for TK_STAR, the kind whose
718// old behaviour was already a boundary, so a miss costs a diagnostic, never silence.
719func sb_star_starts_store(P: *Parser) -> i64 {
  let start: *Tok = tok_at(P.toks, P.pos)
  let ln: i64 = start.line
  var i: i64 = P.pos
  var depth: i64 = 0
  var scanning: i64 = 1
  while scanning {
      let t: *Tok = tok_at(P.toks, i)
      if t.kind == TK_EOF { return 0 }
      if t.line > ln { return 0 }
      if t.kind == TK_SEMI { return 0 }
      if t.kind == TK_LBRACE { return 0 }
      if t.kind == TK_RBRACE { return 0 }
      if t.kind == TK_LPAREN { depth = depth + 1 }
      if t.kind == TK_LBRACKET { depth = depth + 1 }
      if t.kind == TK_RPAREN { depth = depth - 1 }
      if t.kind == TK_RBRACKET { depth = depth - 1 }
      if depth == 0 {
          if t.kind == TK_ASSIGN { return 1 }
      }
      i = i + 1
  }
  return 0
742}
743
744func peek_kind(P: *Parser) -> i64 {
  let t: *Tok = tok_at(P.toks, P.pos)
  return t.kind
747}
748
749// Statement-boundary detection for precedence-climbers.
750//
751// NishiLang allows optional semicolons.  Without them, tokens like
752// `*`, `-`, and `&` are ambiguous: binary operators OR unary
753// operators starting a fresh statement (`*p`, `-x`, `&v`).  Ports
754// parse.c's at_stmt_boundary (parse.c line 387): if the current
755// token is on a NEWER source line than the token just consumed,
756// treat it as a statement boundary and break out of the precedence
757// climber.
758//
759// Class-level fix for F-meta-2 (optional-token statement boundary
760// ambiguity).  Without this, the regression_no_semis_optional case
761// parses `sys_mmap(16) as *i64\n*p = 100` as
762// `(sys_mmap(16) as *i64) * p = 100` -- corrupts the store + the
763// downstream load.  See docs/NISHI_BUG_PREVENTION_PILLARS.md.
764//
765// Pillar 4 alignment: this is ADDITIVE -- it adds a guard at each
766// precedence-climber loop top without forbidding any valid source.
767// Code that explicitly continues across a newline can still do so
768// by parenthesising: `( a\n  + b )` keeps the binop because the
769// open-paren resets the line-boundary semantics inside the paren
770// group (no newline insertion inside `()` per the lexer).
771func at_stmt_boundary(P: *Parser) -> i64 {
  if P.pos == 0 { return 0 }
  let cur: *Tok = tok_at(P.toks, P.pos)
  let prev: *Tok = tok_at(P.toks, P.pos - 1)
  if cur.line > prev.line {
      // F-meta-2 refinement 2026-05-16: a newline is a statement
      // boundary ONLY when the next token COULD start a statement.
      // Always-binary operators (|, ^, /, %, ==, !=, <=, >=, <<,
      // >>, &&, ||, =) can never appear at statement start in
      // NishiLang, so when they follow a newline they're an
      // expression continuation, not a new statement.  This
      // unblocks multi-line bitwise expressions like the pack4_i16
      // body `return (a & 0xFFFF) | ((b & 0xFFFF) << 16) | ...`
      // which previously dropped every term past the first
      // because each `|` started on a new line and tripped the
      // boundary check.
      //
      // Ambiguous tokens (*, -, &, +) STILL trigger the boundary
      // -- the F-meta-2 fix targeted those, where `*p` and `-x`
      // and `&v` and `+x` can legitimately start a fresh
      // statement.  The original case `sys_mmap(16) as *i64\n*p =
      // 100` continues to parse correctly.
      //
      // Additive PREVENT per the four-pillar cardinal: this RELAXES
      // statement-boundary detection for tokens that COULDN'T have
      // been false positives, but keeps it strict for the tokens
      // where ambiguity exists.  No source patterns are forbidden
      // by this change; previously-rejected multi-line expressions
      // now parse, previously-accepted programs are unaffected.
      // LN15: ONE SHARED RULER decides this now -- tok_line_continuation in
      // nx_lex_kinds.nx, which lex.nx and parse.nx both already import. The
      // bare token NUMBERS this function used to carry (56, 57, 43 ...) went
      // with it: a kind spelled as a literal here and as TK_PIPE in the lexer
      // is one constant written two ways, and two spellings drift silently.
      //
      // The three kinds LN15 adds -- TK_PLUS, TK_MINUS, TK_AMP -- are the ones
      // this function used to call ambiguous. They are not: no statement FORM
      // begins with them, so at statement level they can only ever have been a
      // continuation of the line above. The reasoning is banked beside the
      // predicate, where the next reader of it will actually find it.
      let tlc: i64 = tok_line_continuation(cur.kind)
      if tlc == TLC_CONTINUATION { return 0 }
      if tlc == TLC_STORE_OR_JOIN { return sb_star_starts_store(P) }
      return 1
  }
  return 0
817}
818func peek_at(P: *Parser, k: i64) -> *Tok {
  return tok_at(P.toks, P.pos + k)
820}
821// LN42 (2026-09-03): THE POSITION parse_die NEVER HAD. nx_diag_organ_at has existed since the file-attribution
822// pass, waiting for a line number; parse_die had none, so 35 refusal sites printed a bare one-line sentence with
823// no file, no line, no caret and no fix -- and a whole-population census grouped 90 of them into a single blank
824// "no recognised diagnostic marker" class because there was nothing in them to key on. Every token in the unit
825// passes through advance_tok, so recording its line/col here costs two stores on the one chokepoint and gives
826// every parse_die site a truthful location without touching a single call site.
827// A DIAGNOSTIC WITHOUT A LOCATION IS A SENTENCE, NOT A DIAGNOSTIC -- AND IT IS ALSO UNGROUPABLE, SO IT HIDES
828// ITS OWN FREQUENCY FROM EVERY CENSUS THAT WOULD HAVE RANKED IT.
829func advance_tok(P: *Parser) -> *Tok {
  let t: *Tok = tok_at(P.toks, P.pos)
  nx_pd_line = t.line
  nx_pd_col = t.col
  P.pos = P.pos + 1
  return t
835}
836func check_kind(P: *Parser, k: i64) -> i64 {
  if peek_kind(P) == k { return 1 }
  return 0
839}
840func match_kind(P: *Parser, k: i64) -> i64 {
  if peek_kind(P) == k {
      P.pos = P.pos + 1
      return 1
  }
  return 0
846}
847
848// ---- generic monomorphization helpers ----------------------------
849//
850// Port of parse.c's clone_type_substituting + instantiate_generic_n.
851// These functions realise `Option<T>` / `Result<T, E>` -- when a use
852// site references `Name<Arg1, Arg2>`, the template struct's field
853// list is walked and every TY_PARAM field that matches one of the
854// declared type-parameter names is replaced with the concrete arg.
855// The resulting monomorphic Type gets a mangled name (`Name$arg1
856// $arg2`) and is cached so repeated uses of the same instantiation
857// share one struct.
858//
859// These helpers are pure over Type graphs -- they do not read or
860// mutate Parser state beyond the struct registration cache.
861
862// Compare two byte ranges for exact equality.  Same semantics as
863// strncmp == 0 when both are known-length.  Returns 1 if equal.
864func ty_name_eq(a: *u8, a_len: i64, b: *u8, b_len: i64) -> i64 {
  if a_len != b_len { return 0 }
  var i: i64 = 0
  while i < a_len {
      if a[i] != b[i] { return 0 }
      i = i + 1
  }
  return 1
872}
873
874// Walk a Type tree, substituting any TY_PARAM whose name matches
875// `param_name[0..param_name_len]` with `concrete`.  Recurses into
876// TY_PTR.  Returns the same Type pointer if no substitution
877// occurred (so caller can cheaply detect the no-op case).
878//
879// Nested TY_STRUCT templates (e.g. a field of type Option<U> inside
880// a Result<T, U>) are NOT re-walked here -- that requires ambient
881// substitution tracking which adds complexity we don't need yet.
882// The parse.c port has the same shortcut (see its comment).
883func clone_type_substituting(t: *Type, param_name: *u8,
                           param_name_len: i64,
                           concrete: *Type) -> *Type {
  if t == (0 as *Type) { return t }
  if t.kind == TY_PARAM {
      if t.param_name != (0 as *u8) {
          if ty_name_eq(t.param_name, t.param_name_len,
                        param_name, param_name_len) == 1 {
              return concrete
          }
      }
  }
  if t.kind == TY_PTR {
      if t.pointee != (0 as *Type) {
          let sub: *Type = clone_type_substituting(t.pointee,
                                                   param_name,
                                                   param_name_len,
                                                   concrete)
          if sub == t.pointee { return t }
          let np: *Type = alloc_type(TY_PTR, 8, 8)
          np.pointee = sub
          return np
      }
  }
  return t
908}
909
910// Helpers for name mangling.  Build a mangled name "Base$a1$a2..."
911// into out[] and return the length written.  Each arg contributes
912// "$<kind-suffix>".
913func ty_mangle_suffix(arg: *Type, out: *u8, off: i64, cap: i64) -> i64 {
  if off >= cap { return off }
  out[off] = 0x24                     // '$'
  var cur: i64 = off + 1
  if arg == (0 as *Type) {
      if cur < cap { out[cur] = 0x3F; cur = cur + 1 }   // '?'
      return cur
  }
  if arg.kind == TY_I64 {
      if cur + 3 <= cap {
          out[cur] = 0x69; out[cur+1] = 0x36; out[cur+2] = 0x34  // "i64"
          cur = cur + 3
      }
      return cur
  }
  if arg.kind == TY_I32 {
      if cur + 3 <= cap {
          out[cur] = 0x69; out[cur+1] = 0x33; out[cur+2] = 0x32
          cur = cur + 3
      }
      return cur
  }
  if arg.kind == TY_I8 {
      if cur + 2 <= cap {
          out[cur] = 0x69; out[cur+1] = 0x38
          cur = cur + 2
      }
      return cur
  }
  if arg.kind == TY_BOOL {
      if cur + 4 <= cap {
          out[cur] = 0x62; out[cur+1] = 0x6F; out[cur+2] = 0x6F; out[cur+3] = 0x6C
          cur = cur + 4
      }
      return cur
  }
  if arg.kind == TY_PTR {
      if cur < cap { out[cur] = 0x70; cur = cur + 1 }    // 'p'
      return ty_mangle_suffix(arg.pointee, out, cur, cap)
  }
  if arg.kind == TY_STRUCT {
      // Emit struct name bytes.
      var i: i64 = 0
      while i < arg.name_len {
          if cur >= cap { break }
          out[cur] = arg.name_bytes[i]
          cur = cur + 1
          i = i + 1
      }
      return cur
  }
  if arg.kind == TY_PARAM {
      // Mangled name for an un-instantiated param: "T" etc.
      var i: i64 = 0
      while i < arg.param_name_len {
          if cur >= cap { break }
          out[cur] = arg.param_name[i]
          cur = cur + 1
          i = i + 1
      }
      return cur
  }
  // Fallback: '?'
  if cur < cap { out[cur] = 0x3F; cur = cur + 1 }
  return cur
978}
979
980// Forward decls used by instantiate_generic_n below.  Real impls
981// live further down with the existing struct-registration code.
982func lookup_struct(P: *Parser, name: *u8) -> *Type;
983func register_struct(P: *Parser, name: *u8, name_len: i64,
                   ty: *Type) -> i64;
985// Resolve an enum NAME used in a TYPE position.  Declared here, beside
986// lookup_struct, because parse_type sits above the enum table code.
987func lookup_enum_type(P: *Parser, name: *u8) -> *Type;
988
989// Instantiate a template struct with `n_args` concrete type args.
990// Returns the cached monomorphic Type, or a freshly-built one on
991// first use.  If `tmpl` has no declared type params, returns tmpl
992// unchanged (caller paid attention to the generic syntax but there
993// was nothing to substitute).
994//
995// The cache is Parser.structs itself -- we stash every monomorph as
996// a regular struct entry keyed by the mangled name.  Repeated uses
997// of `Result<i64, i64>` share one Type.
998func instantiate_generic_n(P: *Parser, tmpl: *Type,
                         args: *i64, n_args: i64) -> *Type {
  if tmpl == (0 as *Type) { return tmpl }
  if tmpl.n_type_params == 0 { return tmpl }
1002
  // Mangle: tmpl.name + "$arg1$arg2..."
  let mangled: *u8 = sys_mmap(256)
  var pos: i64 = 0
  var i: i64 = 0
  while i < tmpl.name_len {
      if pos >= 256 { break }
      mangled[pos] = tmpl.name_bytes[i]
      pos = pos + 1
      i = i + 1
  }
  var j: i64 = 0
  while j < n_args {
      let arg_ptr: i64 = args[j]
      let arg: *Type = arg_ptr as *Type
      pos = ty_mangle_suffix(arg, mangled, pos, 256)
      j = j + 1
  }
1020
  // Cache lookup by mangled name.
  let cached: *Type = lookup_struct(P, mangled)
  if cached != (0 as *Type) { return cached }
1024
  // Miss: clone the template, substituting each field's type.
  let inst: *Type = ir_type_struct_new(mangled, pos)
  // Register in parser cache so future use-sites hit.
  register_struct(P, mangled, pos, inst)
1029
  var fi: i64 = 0
  while fi < tmpl.n_fields {
      let fbase: i64 = tmpl.fields as i64
      let src: *StructField = (fbase + fi * 32) as *StructField
      var fty: *Type = src.ty
      var k: i64 = 0
      while k < n_args {
          if k >= tmpl.n_type_params { break }
          let param_name_ptr: i64 = tmpl.type_params[k]
          let param_name: *u8 = param_name_ptr as *u8
          // Param name length: we stored each name as a NUL-
          // terminated span, so scan to NUL for length.
          var pn_len: i64 = 0
          while param_name[pn_len] != 0 { pn_len = pn_len + 1 }
          let concrete_ptr: i64 = args[k]
          let concrete: *Type = concrete_ptr as *Type
          fty = clone_type_substituting(fty, param_name, pn_len, concrete)
          k = k + 1
      }
      ir_type_struct_add_field(inst, src.name_bytes, src.name_len, fty)
      fi = fi + 1
  }
  return inst
1053}
1054
1055// ---- type parsing (minimal: just i64/bool/void + *T) ----
1056
1057func parse_type(P: *Parser) -> *Type {
  // [N]T: fixed-size stack array. N = integer literal, T = element type.
  // size = N * elem.size; pointee = element type (reuses the PTR/ARRAY pointee slot).
  if match_kind(P, TK_LBRACKET) {
      // []T: SLICE -- a pointer that carries its length. Distinguished from [N]T by the
      // absence of a size token, so the two forms cannot be confused by the parser.
      if peek_kind(P) == TK_RBRACKET {
          advance_tok(P)
          let selem: *Type = parse_type(P)
          let st: *Type = alloc_type(TY_SLICE, 8, 8)
          st.pointee = selem
          return st
      }
      let n_tok: *Tok = advance_tok(P)
      let n: i64 = n_tok.int_val
      match_kind(P, TK_RBRACKET)
      let elem: *Type = parse_type(P)
      let at: *Type = alloc_type(TY_ARRAY, n * elem.size, elem.align)
      at.pointee = elem
      return at
  }
  // func(T,...)->R: function-pointer type = 8 bytes (a code address). Params are consumed but NOT
  // stored (MVP: no arity/param-type check); the return type is kept in `pointee`.
  if match_kind(P, TK_FUNC) {
      match_kind(P, TK_LPAREN)
      if peek_kind(P) != TK_RPAREN {
          parse_type(P)
          while match_kind(P, TK_COMMA) { parse_type(P) }
      }
      match_kind(P, TK_RPAREN)
      var fret: *Type = ir_type_void()
      if match_kind(P, TK_ARROW) { fret = parse_type(P) }
      let ft: *Type = alloc_type(TY_FUNC, 8, 8)
      ft.pointee = fret
      return ft
  }
  // *T: recurse into pointee, wrap in TY_PTR.
  if match_kind(P, TK_STAR) {
      let pointee: *Type = parse_type(P)
      let t: *Type = alloc_type(TY_PTR, 8, 8)
      t.pointee = pointee
      return t
  }
  // Ident: primitive? active type param? user struct?
  let tk: *Tok = advance_tok(P)
  let name: *u8 = tok_text_ptr(tk)
  if streq_n(name, "i64", 3)  { return alloc_type(TY_I64,  8, 8) }
  if streq_n(name, "i32", 3)  { return alloc_type_s(TY_I32,  4, 4) }   // signed subword -> sign-extend on load
  if streq_n(name, "u32", 3)  { return alloc_type(TY_I32,  4, 4) }     // unsigned 32 -> zero-extend (default)
  if streq_n(name, "i16", 3)  { return alloc_type_s(TY_I16,  2, 2) }   // signed 16 -> sign-extend on load
  if streq_n(name, "u16", 3)  { return alloc_type(TY_I16,  2, 2) }     // unsigned 16 -> zero-extend
  if streq_n(name, "i8",  2)  { return alloc_type_s(TY_I8,   1, 1) }   // signed 8  -> sign-extend on load
  if streq_n(name, "u8",  2)  { return alloc_type(TY_I8,   1, 1) }
  if streq_n(name, "bool", 4) { return alloc_type(TY_BOOL, 1, 1) }
  if streq_n(name, "void", 4) { return alloc_type(TY_VOID, 0, 1) }
  // F-extension primitive types.  Matches TY_F32/TY_F64 in types.nx.
  // ABI: f32 is 4 bytes 4-aligned, f64 is 8 bytes 8-aligned.
  if streq_n(name, "f32", 3)  { return alloc_type(TY_F32,  4, 4) }
  if streq_n(name, "f64", 3)  { return alloc_type(TY_F64,  8, 8) }
1116
  // Active generic type parameter?  Inside a `struct X<T> { ... }`
  // body, `T` should become a TY_PARAM that later instantiation
  // walks substitute against concrete args.  Scan the parser's
  // active-param stack -- if any entry's NUL-terminated name
  // matches the identifier we're looking at, emit a fresh TY_PARAM.
  var pi: i64 = 0
  var name_len: i64 = 0
  while name[name_len] != 0 { name_len = name_len + 1 }
  while pi < P.n_active_params {
      let ap_ptr: i64 = P.active_params[pi]
      let ap: *u8 = ap_ptr as *u8
      var ap_len: i64 = 0
      while ap[ap_len] != 0 { ap_len = ap_len + 1 }
      if ty_name_eq(name, name_len, ap, ap_len) == 1 {
          let pt: *Type = alloc_type(TY_PARAM, 8, 8)
          pt.param_name = ap
          pt.param_name_len = ap_len
          return pt
      }
      pi = pi + 1
  }
1138
  // User struct -- linear scan over declared struct types.
  let found: *Type = lookup_struct(P, name)
  if found != (0 as *Type) {
      // Generic instantiation syntax: `Name<T, ...>`.  If the
      // target struct has declared type params and we see a '<',
      // parse the args and instantiate via instantiate_generic_n.
      // If it has no type params, fall back to the old
      // consume-and-return-base behaviour (still needed so legacy
      // non-generic code parses `Option<T>` gracefully).
      if match_kind(P, TK_LT) {
          if found.n_type_params > 0 {
              let args_raw: *u8 = sys_mmap(NX_GENERIC_MAX_ARGS * 8 + 16)
              let args: *i64 = args_raw as *i64
              var n_args: i64 = 0
              let a0: *Type = parse_type(P)
              args[n_args] = a0 as i64
              n_args = n_args + 1
              while match_kind(P, TK_COMMA) {
                  if n_args >= NX_GENERIC_MAX_ARGS { parse_die("generic instantiation exceeds the type-argument cap" as *u8, 51) }
                  let an: *Type = parse_type(P)
                  args[n_args] = an as i64
                  n_args = n_args + 1
              }
              match_kind(P, TK_GT)
              return instantiate_generic_n(P, found, args, n_args)
          } else {
              parse_type(P)
              while match_kind(P, TK_COMMA) {
                  parse_type(P)
              }
              match_kind(P, TK_GT)
          }
      }
      return found
  }
  // User enum -- a name declared by `enum NAME { ... }` used in a TYPE
  // position.  A TAGGED enum (some variant carries a payload) publishes a
  // shadow struct under its own name, so lookup_struct above already
  // resolved it; only a PLAIN enum falls through to here, and before this
  // existed it died as "I do not know a type named X".  That made every
  // payload-free enum a value namespace that could not be NAMED in a
  // signature: `enum NetError { ... }` parsed, `NetError::ConnRefused`
  // evaluated, and `-> *Result<i64, NetError>` did not compile.  Measured
  // 2026-09-04 on runtime/nx_net.nx (8 errors) and runtime/fs.nx (10).
  let ety: *Type = lookup_enum_type(P, name)
  if ety != (0 as *Type) {
      // An enum name takes no type arguments.  Consume a stray `<...>`
      // the same way the no-type-params struct path does, so a malformed
      // use yields one clear error instead of cascading through the
      // caller's parse.
      if match_kind(P, TK_LT) {
          parse_type(P)
          while match_kind(P, TK_COMMA) {
              parse_type(P)
          }
          match_kind(P, TK_GT)
      }
      return ety
  }
  // Unknown type name.  PREVENT pillar (T#nx-int-alias-size-0): this
  // used to silently return `TY_VOID size 0`, which is CATASTROPHIC for
  // a struct field type -- a size-0 field collapses every later field's
  // offset, so a pointer field can land at offset 0 and be overwritten
  // by an int field, producing a deref-of-a-small-integer SEGFAULT far
  // from the cause.  An unknown type at this point is ALWAYS a real
  // error (missing primitive, unregistered struct, or -- the bug we
  // fixed -- an unresolved `type` alias).  Fail LOUD + name it, so the
  // entire silent-size-0 class is impossible going forward.
  var en: i64 = 0
  while name[en] != 0 { en = en + 1 }
  nx_dym_suggest_type(P, name, en)
  // Line anchor: parse_type consumed the type-name token just before resolving it, so it
  // sits one slot back (same anchoring as calls and identifiers; verified by witness bite).
  var uty_ln: i64 = 0
  if P.pos > 0 {
      let uty_tok: *Tok = tok_at(P.toks, P.pos - 1)
      uty_ln = uty_tok.line
  }
  nx_diag_at(uty_ln)
  nx_diag_puts(": I do not know a type named '" as *u8)
  sys_write(2, name, en)
  nx_diag_puts("' -- it is not a built-in type, and no struct or alias declares it.\n" as *u8)
  nx_diag_puts("  why the build stopped: a type that does not exist has no size or shape, so nothing can be laid out in memory for it.\n" as *u8)
  nx_dym_note2(P, name, en)
  nx_diag_note_error()
  // RECOVERY PLACEHOLDER: i64-shaped (size 8, align 8) so struct-offset math
  // in the parser stays sane -- NEVER the silent size-0 collapse this check
  // exists to prevent. The end-of-parse gate keeps it out of codegen.
  return alloc_type(TY_I64, 8, 8)
1228}
1229
1230// ---- local lookup (ident -> Value id) ----
1231
1232func parser_loc_at(P: *Parser, i: i64) -> *Local {
  let base: i64 = P.locals as i64
  return (base + i * LOCAL_BYTES) as *Local
1235}
1236
1237// Copy name bytes from a *u8 buffer into a Local.
1238func copy_name_into_local(L: *Local, src: *u8) -> i64 {
  // Write first 64 bytes of name into Local's slot.
  let base: i64 = L as i64
  let dst: *u8 = base as *u8
  var i: i64 = 0
  while i < 64 {
      dst[i] = src[i]
      if src[i] == 0 { return 0 }
      i = i + 1
  }
  return 0
1249}
1250
1251// Compare Local's name against a *u8.
1252func local_name_eq(L: *Local, name: *u8) -> i64 {
  let base: i64 = L as i64
  let ln: *u8 = base as *u8
  var i: i64 = 0
  while i < 64 {
      if ln[i] != name[i] { return 0 }
      if ln[i] == 0 { return 1 }
      i = i + 1
  }
  return 1
1262}
1263
1264// DID-YOU-MEAN for bare IDENTIFIERS (2026-08-05, climb v9 rung 2). Same contract as
1265// nx_dym_suggest_fn -- error-path only, silent when nothing is near (a wrong suggestion is
1266// worse than none), bounded Levenshtein, ZERO new indexes: every pool scanned here (the live
1267// locals window, module consts incl Enum::Variant rows, the function table) already exists.
1268// LIVES BELOW the Local/MConst struct decls: a `let x: *T` annotation resolves its type name
1269// EAGERLY (unlike a param type), so placing this next to its nx_dym_ siblings above the
1270// structs was refused with two unknown-type errors -- reported in ONE build by the
1271// multi-error recovery this same climb shipped an hour earlier.
1272func nx_dym_suggest_ident(P: *Parser, name: *u8, nlen: i64) -> i64 {
  var budget: i64 = 2
  if nlen <= 4 { budget = 1 }
  var best_d: i64 = 999
  var best_p: *u8 = 0 as *u8
  var best_l: i64 = 0
  var best_k: i64 = 0
  var best_aux: i64 = 0
  var i: i64 = 0
  while i < P.n_locals {
      let L: *Local = parser_loc_at(P, i)
      let lp: *u8 = (L as i64) as *u8
      let ll: i64 = nx_dym_len(lp)
      if ll > 0 {
          let d1: i64 = nx_dym_dist(name, nlen, lp, ll, budget)
          if d1 < best_d { best_d = d1; best_p = lp; best_l = ll; best_k = 3; best_aux = L.ty_kind }
      }
      i = i + 1
  }
  var mi: i64 = 0
  while mi < P.n_mconsts {
      let mc: *MConst = mconst_at(P, mi)
      let mp: *u8 = (mc as i64) as *u8
      let ml: i64 = nx_dym_len(mp)
      if ml > 0 {
          let d2: i64 = nx_dym_dist(name, nlen, mp, ml, budget)
          if d2 < best_d { best_d = d2; best_p = mp; best_l = ml; best_k = 2; best_aux = mc.val }
      }
      mi = mi + 1
  }
  if P.module != (0 as *Module) {
      var fi: i64 = 0
      while fi < P.module.n_functions {
          let fbase: i64 = P.module.functions as i64
          let f: *Function = (fbase + fi * 176) as *Function
          let fp: *u8 = f.name_start as *u8
          let fl: i64 = f.name_len
          if fl > 0 {
              let d3: i64 = nx_dym_dist(name, nlen, fp, fl, budget)
              if d3 < best_d { best_d = d3; best_p = fp; best_l = fl; best_k = 1; best_aux = f.n_params }
          }
          fi = fi + 1
      }
  }
  if best_d > budget { return 0 }
  if best_d == 0 { return 0 }
  if (best_p as i64) == 0 { return 0 }
  nx_dym_last_kind = best_k
  nx_dym_last_p = best_p
  nx_dym_last_l = best_l
  nx_dym_last_aux = best_aux
  return 1
1324}
1325
1326func find_local(P: *Parser, name: *u8) -> *Local {
  var i: i64 = P.n_locals - 1
  while i >= 0 {
      let L: *Local = parser_loc_at(P, i)
      if local_name_eq(L, name) { return L }
      i = i - 1
  }
  return 0 as *Local
1334}
1335
1336// Is 
1337ame already bound in the CURRENT block? find_local scans the whole live window (every
1338// enclosing scope), which is the right answer for RESOLUTION and the wrong one for REDECLARATION.
1339func local_in_block(P: *Parser, name: *u8) -> i64 {
  var i: i64 = P.n_locals - 1
  while i >= P.block_base {
      let L: *Local = parser_loc_at(P, i)
      if local_name_eq(L, name) { return 1 }
      i = i - 1
  }
  return 0
1347}
1348
1349func add_local(P: *Parser, name: *u8, value_id: i64, is_alloca: i64,
             ty_kind: i64, ty: *Type) -> i64 {
  nx_assert_lt(P.n_locals, NX_PARSE_LOCALS_CAP,
               "add_local: locals pool exhausted (raise NX_PARSE_LOCALS_CAP)" as *u8)
  let L: *Local = parser_loc_at(P, P.n_locals)
  copy_name_into_local(L, name)
  L.value_id = value_id
  L.is_alloca = is_alloca
  L.ty_kind = ty_kind
  L.ty = ty
  // LN3: the locals pool is RESET per function (n_locals=0) and slots are REUSED, so a stale
  // ext_bytes from the previous function's local at this index would be read as provenance.
  // Zero it here; parse_stmt_let sets the real extent on the just-added local when it binds one.
  L.ext_bytes = 0
  // LN2: same reuse hazard for the non-null bit -- a stale 1 here would ACQUIT an unchecked deref.
  L.nn_checked = 0
  // LN4/LN5: same reuse hazard again, and it fails the OTHER way -- a stale OWN_MOVED/OWN_RELEASED
  // here would REFUSE a brand-new local in the next function that never owned anything.  That is
  // the loud direction rather than the silent one, but it is still a false positive, and a mode
  // that refuses innocent code is the one everybody turns off.  These two lines ARE the whole
  // per-function reset for this rung: the state lives on Locals, and the locals pool is reset by
  // n_locals = 0, so unlike LN2/LN3 there is no global handshake needing an oe_reset_fn sibling.
  L.own_state = 0
  L.own_line = 0
  P.n_locals = P.n_locals + 1
  return 0
1375}
1376
1377// ---- IR emitter stubs (real impls live in ir.nx) ----
1378//
1379// We declare them so the parser can call out; when multi-file
1380// linkage concatenates ir.nx + parse.nx they resolve to the real
1381// definitions.  Listed here as forward references only; NishiLang
1382// has no separate `extern` block so we leave them unimplemented
1383// locally and rely on the concatenated build to supply them.
1384
1385// Forward uses rely on multi-file build + link-time name resolution.
1386// Since NishiLang doesn't have separate compilation yet, the actual
1387// calls happen when this file is built alongside ir.nx.
1388//
1389// For the parser to be useful it MUST be compiled with ir.nx, opt.nx,
1390// regalloc.nx, riscv.nx, lex.nx -- the full self-host bundle.  The
1391// self-test in this file only exercises local logic (precedence,
1392// token consumption); runtime IR emission happens only under the
1393// bundled compile.
1394//
1395// Stub implementations below let parse.nx compile standalone for
1396// syntax verification.
1397
1398// All IR builders now live in ir.nx; no local stubs remain.
1399
1400// ---- expression parser (precedence climbing) ----
1401//
1402// Mirrors parse.c's chain.  Returns the Value id for the parsed
1403// expression.  Each helper consumes its level and returns.
1404
1405// Forward declarations for the mutually-recursive parse chain.
1406func parse_logical_or(P: *Parser) -> i64;
1407func parse_unary_core(P: *Parser) -> i64;
1408func parse_primary(P: *Parser) -> i64;
1409func parse_primary_ident(P: *Parser, t: *Tok) -> i64;
1410func parse_primary_qualified_variant(P: *Parser, name: *u8) -> i64;
1411func parse_primary_intrinsic(P: *Parser, name: *u8) -> i64;
1412func parse_primary_call(P: *Parser, name: *u8) -> i64;
1413func parse_primary_local_or_const(P: *Parser, name: *u8) -> i64;
1414func parse_stmt_list(P: *Parser) -> i64;
1415func parse_stmt(P: *Parser) -> i64;
1416func parse_stmt_return(P: *Parser) -> i64;
1417func parse_stmt_let(P: *Parser) -> i64;
1418func parse_stmt_var(P: *Parser) -> i64;
1419func parse_stmt_if(P: *Parser) -> i64;
1420func parse_stmt_while(P: *Parser) -> i64;
1421func parse_stmt_for(P: *Parser) -> i64;
1422func parse_stmt_break(P: *Parser) -> i64;
1423func parse_stmt_continue(P: *Parser) -> i64;
1424func parse_stmt_match(P: *Parser) -> i64;
1425func parse_stmt_star(P: *Parser) -> i64;
1426func parse_stmt_ident(P: *Parser) -> i64;
1427func parse_stmt_ident_assign(P: *Parser) -> i64;
1428func parse_stmt_ident_subscript(P: *Parser) -> i64;
1429func parse_stmt_ident_dot(P: *Parser) -> i64;
1430func parse_stmt_expr_fallback(P: *Parser) -> i64;
1431func parse_module_const(P: *Parser) -> i64;
1432func lookup_mconst(P: *Parser, name: *u8, out: *i64) -> i64;
1433func lookup_mconst_f64(P: *Parser, name: *u8, out: *i64) -> i64;
1434func const_eval_f64_addsub(P: *Parser, depth: i64) -> i64;
1435func const_eval_f64_unary(P: *Parser, depth: i64) -> i64;
1436func lookup_mconst_string(P: *Parser, name: *u8,
                          out_gid: *i64, out_ty: **Type) -> i64;
1438func mconst_name_eq(mc: *MConst, name: *u8) -> i64;
1439func mconst_at(P: *Parser, i: i64) -> *MConst;
1440// V-LANGEXT M4: const-expression evaluator helpers (mutually recursive
1441// precedence-climbing chain).
1442func const_eval_expr(P: *Parser, depth: i64) -> i64;
1443func const_eval_bor(P: *Parser, depth: i64) -> i64;
1444func const_eval_bxor(P: *Parser, depth: i64) -> i64;
1445func const_eval_band(P: *Parser, depth: i64) -> i64;
1446func const_eval_shift(P: *Parser, depth: i64) -> i64;
1447func const_eval_addsub(P: *Parser, depth: i64) -> i64;
1448func const_eval_muldiv(P: *Parser, depth: i64) -> i64;
1449func const_eval_unary(P: *Parser, depth: i64) -> i64;
1450func const_eval_primary(P: *Parser, depth: i64) -> i64;
1451func mconst_at(P: *Parser, i: i64) -> *MConst;
1452func copy_name_into_mconst(mc: *MConst, src: *u8) -> i64;
1453func parse_struct_decl(P: *Parser) -> i64;
1454func parse_static_decl(P: *Parser) -> i64;
1455func parse_module_enum(P: *Parser) -> i64;
1456func inject_statics(P: *Parser) -> i64;
1457func enum_entry_at(P: *Parser, i: i64) -> *EnumEntry;
1458func lookup_enum(P: *Parser, name: *u8) -> *EnumEntry;
1459// (lookup_struct forward-decl lives above parse_type since parse_type uses it.)
1460func struct_entry_at(P: *Parser, i: i64) -> *StructEntry;
1461
1462func parse_expr(P: *Parser) -> i64 {
  nx_assert_ptr(P.current_bb as *u8, "parse_expr: bb" as *u8)
  let cond: i64 = parse_logical_or(P)
  if peek_kind(P) != TK_QUESTION { return cond }
  // C-style ternary `cond ? a : b`.  Desugars to the SAME control-flow
  // the `if..then..else` expression uses (alloca slot + br_cond + per-
  // branch store + merge load), so only the chosen branch evaluates.
  advance_tok(P)                                          // eat '?'
  let result_ty: *Type = ir_type_i64()
  let result_addr: i64 = ir_emit_alloca(P.current_bb, result_ty)
  // ARITY FIX 2026-07-20: these passed a block-label string to ir_block_new, which takes ONE
  // argument (nx_ir.nx:269) and whose BasicBlock has no name field -- the label was SILENTLY
  // DISCARDED for as long as this code has existed.  Found the moment the new call-arity check
  // went in; the labels are kept here as comments so the intent survives the fix.
  let then_bb:  *BasicBlock = ir_block_new(P.current_fn)   // "ternary_then"
  let else_bb:  *BasicBlock = ir_block_new(P.current_fn)   // "ternary_else"
  let merge_bb: *BasicBlock = ir_block_new(P.current_fn)   // "ternary_merge"
  ir_emit_br_cond(P.current_bb, cond, then_bb, else_bb)
  P.current_bb = then_bb
  let then_v: i64 = parse_expr(P)
  ir_emit_store(P.current_bb, result_addr, then_v, result_ty)
  ir_emit_br(P.current_bb, merge_bb)
  if peek_kind(P) != TK_COLON {
      parse_die("ternary needs colon" as *u8, 19)
  }
  advance_tok(P)                                          // eat ':'
  P.current_bb = else_bb
  let else_v: i64 = parse_expr(P)
  ir_emit_store(P.current_bb, result_addr, else_v, result_ty)
  ir_emit_br(P.current_bb, merge_bb)
  P.current_bb = merge_bb
  return ir_emit_load(P.current_bb, result_addr, result_ty)
1494}
1495
1496// Line-tagged wrapper for every ir_const_i64 call in parse.nx.
1497// When the assertion fires, the tag identifies the exact callsite.
1498// Required because vanilla ir_const_i64's assert message can't tell
1499// us which of ~25 callers passed a bad P.current_fn.  Purely
1500// diagnostic; when the root-cause of the sys_read_file stage-2 bug
1501// is understood and fixed, the wrapper can retire.
1502func safe_const_i64(P: *Parser, val: i64, tag: *u8) -> i64 {
  nx_assert_ptr(P.current_fn as *u8, tag)
  nx_assert(P.current_fn.values_cap > 0, tag)
  return ir_const_i64(P.current_fn, val)
1506}
1507
1508// ===================== SPATIAL SAFETY: runtime bounds checking =====================
1509// These consts are read ONLY by the two functions immediately below them.  They sit HERE, not
1510// at the use sites, because a NishiLang function defined textually ABOVE a const it reads
1511// silently resolves that const to garbage (reference-nishilang-nx-cc-gotchas, the fwd-const class).
1512//
1513// NX_BOUNDS_CHECK_LIVE is the kill switch.  Set to 0 and every injection below vanishes, which
1514// is how the A/B overhead measurement is taken -- same source, same compiler, one const flipped.
1515const NX_BOUNDS_CHECK_LIVE: i64 = 1
1516// Exit code the injected trap raises.  Distinct from the parser's own die code (2) and from the
1517// 128+signal range, so a bounds abort is unambiguous in a gate's exit status.
1518const NX_TRAP_BOUNDS: i64 = 71
1519// RV64 asm-generic syscall numbers.  The x86_64 backend translates const-numbered syscalls
1520// (x86ctx_rv64_to_x86_64_syscall), so emitting RV64 form here keeps the injected IR
1521// target-agnostic -- the same instructions are correct on both backends.
1522const NX_RV64_SYS_WRITE:      i64 = 64
1523const NX_RV64_SYS_EXIT_GROUP: i64 = 94
1524
1525// One-per-module cache for the trap message global.  ir_add_global_string does NOT intern:
1526// every call burns a slot in a FIXED-capacity pool that asserts "globals pool exhausted" when
1527// full.  Emitting the message per check site cost 8 copies of a 220-byte string in a 60-line
1528// probe, so a module with heavy fixed-array use could have exhausted the pool -- a regression
1529// the check itself would have caused.  Storing gid+1 lets 0 mean "unset" without colliding
1530// with the legitimate global id 0.  The module pointer is cached alongside so the id is
1531// invalidated rather than reused if a single process ever compiles more than one Module.
1532static g_bchk_msg_gid1: i64
1533static g_bchk_msg_mod:  i64
1534
1535// Emit the abort sequence into P.current_bb: a diagnostic on stderr, then exit_group.
1536// Kept separate from emit_bounds_check so each function stays small and single-purpose.
1537// Does NOT emit a terminator -- the caller owns block termination.
1538func emit_bounds_trap(P: *Parser) -> i64 {
  // One trap serves both [N]T and []T, so the wording must not name only one of them -- it said
  // "fixed array [N]T" and was therefore actively wrong on the slice path, which is the path
  // that covers heap memory and so the one most violations will come through.
  let msg: *u8 = "nx: FATAL bounds violation: index outside the bounds of a fixed array [N]T or slice []T. The access was REFUSED and the process aborted rather than reading or writing past the end. Clamp the index, or size the array / slice length to match the memory it describes.\n" as *u8
  var mlen: i64 = 0
  while msg[mlen] != 0 { mlen = mlen + 1 }
  let modv: i64 = P.module as i64
  if g_bchk_msg_mod != modv { g_bchk_msg_gid1 = 0 }
  var gid: i64 = g_bchk_msg_gid1 - 1
  if g_bchk_msg_gid1 == 0 {
      gid = ir_add_global_string(P.module, msg, mlen)
      g_bchk_msg_gid1 = gid + 1
      g_bchk_msg_mod = modv
  }
  let u8ty: *Type = alloc_type(TY_I8, 1, 1)
  let pt: *Type = alloc_type(TY_PTR, 8, 8)
  pt.pointee = u8ty
  let msg_v: i64 = ir_global_value(P.current_fn, gid, pt)
  return emit_trap_syscalls(P, msg_v, mlen, NX_TRAP_BOUNDS)
1558}
1559
1560// THE ONE TRAP EMITTER: write(2, msg, mlen) then exit_group(code).  Shared by the bounds trap
1561// (NX_TRAP_BOUNDS) and the LN1 overflow trap (NX_TRAP_OVERFLOW) so the abort sequence exists
1562// once.  Value-creation ORDER is load-bearing for byte-identical output: the caller creates the
1563// message global value first, then this emits 64, 2, mlen, then 94, code -- exactly the order
1564// emit_bounds_trap emitted inline before the extraction (2026-08-23), so every default build
1565// keeps its value-id numbering and its bytes.
1566// exit_group, not exit -- whole thread group, so a violation in a worker cannot be survived by
1567// the rest of the program (sys_exit alone would only retire the calling task).
1568func emit_trap_syscalls(P: *Parser, msg_v: i64, mlen: i64, code: i64) -> i64 {
  let raw: *u8 = sys_mmap(8 * 8 + 16)
  let sargs: *i64 = raw as *i64
  // write(2, msg, mlen)
  sargs[0] = safe_const_i64(P, NX_RV64_SYS_WRITE, "parse.nx:btrap-wnum" as *u8)
  sargs[1] = safe_const_i64(P, 2, "parse.nx:btrap-fd" as *u8)
  sargs[2] = msg_v
  sargs[3] = safe_const_i64(P, mlen, "parse.nx:btrap-len" as *u8)
  ir_emit_syscall(P.current_bb, sargs, 4)
  sargs[0] = safe_const_i64(P, NX_RV64_SYS_EXIT_GROUP, "parse.nx:btrap-enum" as *u8)
  sargs[1] = safe_const_i64(P, code, "parse.nx:btrap-code" as *u8)
  ir_emit_syscall(P.current_bb, sargs, 2)
  return 0
1581}
1582
1583// SPATIAL SAFETY (CWE-787/125), the RUNTIME half.  A fixed array [N]T indexed by a NON-CONSTANT
1584// expression cannot be decided at compile time, so the check is injected into the program:
1585//
1586//     cur:    c1 = idx >=s 0      ; br_cond c1 -> lo_ok, fail
1587//     lo_ok:  c2 = idx <s nelem   ; br_cond c2 -> ok,    fail
1588//     fail:   write(2,msg) ; exit_group(71) ; br ok
1589//     ok:     <caller keeps emitting here>
1590//
1591// The `br ok` in fail is unreachable -- exit_group never returns -- and exists only so every
1592// block ends in a terminator, which cfg_rebuild_edges requires to resolve successors.
1593//
1594// nelem comes from the array's own TYPE, so this costs no annotations and has ZERO false
1595// positives: a rejected index provably could not have been in range. Raw *T indexing is left
1596// untouched, because a bare pointer carries no length -- that is the honest remaining gap and
1597// it needs a slice type, not a check.
1598//
1599// On return P.current_bb is the `ok` block, and the value id `idx` still dominates it.
1600// THE one bounds check. `len_v` is a VALUE id, not a number, so a fixed array (whose length is a
1601// constant folded in by the caller) and a slice (whose length is loaded from the header at run
1602// time) go through exactly this code -- there is no second implementation to drift.
1603func emit_bounds_check_v(P: *Parser, idx: i64, len_v: i64) -> i64 {
  if NX_BOUNDS_CHECK_LIVE == 0 { return 0 }
  let lo_ok:   *BasicBlock = ir_block_new(P.current_fn)
  let fail_bb: *BasicBlock = ir_block_new(P.current_fn)
  let ok_bb:   *BasicBlock = ir_block_new(P.current_fn)
  let zero_v: i64 = safe_const_i64(P, 0, "parse.nx:bchk-zero" as *u8)
  let c1: i64 = ir_emit_binop(P.current_bb, OP_GE_S, idx, zero_v, ir_type_i64())
  ir_emit_br_cond(P.current_bb, c1, lo_ok, fail_bb)
  P.current_bb = lo_ok
  let c2: i64 = ir_emit_binop(P.current_bb, OP_LT_S, idx, len_v, ir_type_i64())
  ir_emit_br_cond(P.current_bb, c2, ok_bb, fail_bb)
  P.current_bb = fail_bb
  emit_bounds_trap(P)
  ir_emit_br(P.current_bb, ok_bb)
  P.current_bb = ok_bb
  return 0
1619}
1620
1621// Fixed-array wrapper: the length is known from the TYPE, so materialise it as a constant and
1622// hand it to the one checker above.
1623func emit_bounds_check(P: *Parser, idx: i64, nelem: i64) -> i64 {
  if NX_BOUNDS_CHECK_LIVE == 0 { return 0 }
  if nelem <= 0 { return 0 }
  let n_v: i64 = safe_const_i64(P, nelem, "parse.nx:bchk-n" as *u8)
  return emit_bounds_check_v(P, idx, n_v)
1628}
1629
1630// ===================== LN3: RAW-POINTER PROVENANCE (bck_ptr_provenance) =====================
1631// The comment on emit_bounds_check_v names the gap this closes: "Raw *T indexing is left
1632// untouched, because a bare pointer carries no length".  Where the compiler can SEE the
1633// allocation -- `let p: *T = sys_mmap(<const>)`, optionally through an `as *T` cast chain --
1634// the extent is recorded on the Local (Local.ext_bytes) and every `p[i]` read/write is checked
1635// through the SAME emit_bounds_check ruler as typed arrays (one checker, no second drift copy).
1636//
1637// DECLARED MODE, OFF BY DEFAULT: injections happen only under the `--ptrprov` compiler flag
1638// (g_ptrprov_live, set by nx_compile_x86 main).  Under the default every build is byte-identical
1639// to the pre-LN3 compiler BY CONSTRUCTION -- the lang.plan risk row demands the corpus build
1640// unchanged until the per-class ratchet flips the default after a clean corpus census.
1641//
1642// SOUNDNESS OF THE VALUE-ID KEY: a `let` local is SSA (is_alloca=0; parse_stmt_ident_assign
1643// REFUSES stores to it), so every use of the name IS the initializer's value id and the extent
1644// can never go stale.  Aliases inherit for free: `let b = a` binds b to the same value id, so
1645// the same table row covers it.  Value ids are per-function and monotonic, so an id can only
1646// match its own binding; g_prov/g_pp state is reset at parse_function entry because a FRESH
1647// function's ids restart and could otherwise collide with a stale id from the previous one.
1648//
1649// DECLARED IMPRECISION (floors, each sound in the do-nothing direction -- a miss skips a check,
1650// never emits a wrong one): runtime-sized sys_mmap(n) is not tracked (needs a dominating value,
1651// not a constant); `var` pointers are not tracked (reassignable); arena/allocator helpers other
1652// than sys_mmap are not yet name-keyed; chained `s.f[i]` and nested `p[q[i]]` bases are not
1653// matched (the handshake carries exactly one base).  The trap message shared with arrays/slices
1654// still names only those two forms -- reword it in the same change that flips the ratchet, since
1655// any message edit shows as a diff in every rebuilt organ and would break this rung's
1656// byte-neutrality proof today.
1657static g_ptrprov_live: i64
1658static g_prov_val:     i64      // value id of the newest sys_mmap(<const>) result (or its cast chain)
1659static g_prov_bytes:   i64      // that allocation's extent in bytes
1660static g_pp_base_val:  i64      // handshake: value id of the let-local base parse_primary just resolved
1661static g_pp_base_ext:  i64      // its extent in bytes; 0 = none
1662
1663// Setter for the driver (nx_compile_x86 main), mirroring lm_set_debug / nx_cg_arm.
1664func nx_ptrprov_set(v: i64) -> i64 { g_ptrprov_live = v; return 0 }
1665
1666// Per-function reset -- value ids restart per function, so stale ids must not be matchable.
1667func nx_ptrprov_reset_fn() -> i64 {
  g_prov_val = 0 - 1
  g_pp_base_val = 0 - 1
  g_pp_base_ext = 0
  return 0
1672}
1673
1674// THE one provenance check, shared by the read path (parse_field_chain) and the write path
1675// (parse_stmt_ident_subscript).  Early-return shape on purpose: the 5-deep-nested-if with a
1676// multi-statement innermost block is a documented silent-mismatch class (nx-cc gotchas).
1677// A COMPILE-TIME-CONSTANT index is decided here with no runtime cost (diag voice, parsing
1678// continues, the end-of-parse gate keeps the poisoned build from emitting); a runtime index
1679// injects the standard trap (exit NX_TRAP_BOUNDS).
1680func pp_idx_check(P: *Parser, idx: i64, nelem: i64, ln: i64) -> i64 {
  if g_ptrprov_live != 1 { return 0 }
  if nelem <= 0 { return 0 }
  let iv: *Value = val_at(P.current_fn, idx)
  if iv != (0 as *Value) {
      if iv.kind == VK_CONST_INT {
          if iv.const_int >= 0 { if iv.const_int < nelem { return 0 } }
          nx_diag_at(ln)
          nx_diag_puts(": this index is outside the allocation this pointer provably refers to (index " as *u8)
          nx_put_dec_err(iv.const_int)
          nx_diag_puts(", allocation holds " as *u8)
          nx_put_dec_err(nelem)
          nx_diag_puts(" element(s) -- --ptrprov mode).\n" as *u8)
          nx_diag_puts("  why the build stopped: the pointer was bound to a sys_mmap of a known size, so this access provably reads or writes past the end of that allocation -- the silent over-run class (CWE-787/125) that --ptrprov exists to refuse.\n" as *u8)
          nx_diag_puts("  fix: clamp the index below the allocation's element count, or size the allocation to cover the access.\n" as *u8)
          nx_diag_note_error()
          return 0
      }
  }
  emit_bounds_check(P, idx, nelem)
  return 0
1701}
1702
1703// The rung's public predicate: is raw-pointer provenance enforcement live in this build of the
1704// compiler?  Kept trivially readable so the fixture organ (runtime/nx_boundscheck.nx) and any
1705// census can name the mode without reaching into parser internals.
1706func bck_ptr_provenance_live() -> i64 { return g_ptrprov_live }
1707
1708// ===================== LN1: CHECKED INTEGER ARITHMETIC (chk_add_overflow) =====================
1709// CWE-190, the class the /compare/lang row "Integer overflow checked" has carried as a gap since
1710// 2026-08-14 (the constant-shift-count rung was its first half).  MEASURED before writing this:
1711// `9223372036854775807 + 1` compiles clean and returns -9223372036854775808; the program keeps
1712// running on a silently WRAPPED value -- the worst class this estate tracks (silent wrong value).
1713//
1714// DECLARED MODE, OFF BY DEFAULT, the LN3 shape exactly: checks are injected only under the
1715// `--chkarith` compiler flag (g_chkarith_live, set by nx_compile_x86 main).  Under the default
1716// every build is byte-identical by construction (nothing below emits), so the corpus keeps
1717// building unchanged; the per-class ratchet flips the default only after a clean corpus census.
1718//
1719// WHAT IS CHECKED: every `+ - *` whose RESULT TYPE is i64 and whose operands are not pointers
1720// (pointer arithmetic is the LN3/provenance axis, i32 wraps mod 2^32 by declared semantics and
1721// stays out of this rung).  Three legs, one injection point (emit_typed_binop -- the ONE typed
1722// binop ruler, so there is no second site to drift):
1723//   ADD  r = a + b  overflows iff ((a ^ r) & (b ^ r)) < 0     (signs agree, result sign differs)
1724//   SUB  r = a - b  overflows iff ((a ^ b) & (a ^ r)) < 0     (signs differ, result sign != a)
1725//   MUL  r = a * b  overflows iff a != 0 and (a == -1 ? b == MIN : r / a != b)
1726//        -- the a == -1 case is branched around BEFORE the division because MIN / -1 raises #DE
1727//        on x86 (SIGFPE), which would turn the check itself into the crash it exists to prevent.
1728//        Division is used rather than a mul-high intrinsic because OP_UMULHI exists on the x86
1729//        backend only (measured: absent from nx_riscv.nx and nx_wasm.nx); the IR below is
1730//        backend-agnostic, like the bounds check.
1731// Each leg is control flow + the shared trap emitter (emit_trap_syscalls), so no opt pass can
1732// fold the trap away while keeping the overflowing value.
1733//
1734// COMPILE-TIME LEG: a literal `+ - *` of two CONSTANTS that provably overflows is REFUSED at
1735// parse time naming the rule (chk_const_overflow_refuse), the same voice as the constant
1736// shift-count refusal -- a constant overflow in source is never intent.
1737//
1738// WRAP-AROUND BY INTENT: `__wrap_add/__wrap_sub/__wrap_mul(a, b)` emit the plain binop with no
1739// check under either mode (hashes, ring counters, LCGs).  Under the default they are `+ - *`.
1740// This is the Zig `+%` / Rust `wrapping_add` contract, so the mode is usable on real code.
1741//
1742// Exit code 72: adjacent to the bounds trap (71) in the trap namespace, distinct from the
1743// parser die code (2), from the 128+signal range and from every gate exit the estate uses
1744// (searched 2026-08-23: no sys_exit(72)/exit_group(72) in the runtime tree).
1745const NX_TRAP_OVERFLOW: i64 = 72
1746
1747static g_chkarith_live: i64
1748func nx_chkarith_set(v: i64) -> i64 { g_chkarith_live = v; return 0 }
1749
1750// ---- LN6 (2026-09-02): DATA-RACE TYPING AT THE ONE PLACE A VALUE CROSSES A THREAD -------------------
1751// The thread pool takes its per-task context as an opaque i64 (nx_pool_submit(pool, fn, ctx)), and every
1752// caller in the estate hands it `p as i64` where p points at a per-task struct -- measured 2026-09-02:
1753// 40 call sites, ~30 of that exact shape. Nothing says whether that struct may be read on another
1754// thread; the cast erases the type and the pool forgets it. THE MARKER: a struct declares itself safe to
1755// hand across a thread by writing `send` between its name and its body (`struct Job send { ... }`) --
1756// the author's assertion, the same act as Rust's `unsafe impl Send`. THE CHECK (sync_send_check, the
1757// symbol the lang.matrix watch names): under --sendcheck, an argument to nx_pool_submit that is a cast
1758// FROM a pointer to a struct NOT marked `send` is refused in the teaching voice, naming the struct.
1759// DECLARED IMPRECISION, wrong in the direction of doing nothing: a ctx that is not a cast (an integer,
1760// an address already in i64), or a cast from *u8 / *i64 (an untyped buffer), is ABSTAINED -- the check
1761// can only judge what the type system can see, and it says so here rather than pretending. Default
1762// builds are byte-identical by construction (nothing is emitted under either mode); the per-class
1763// ratchet flips the default only after the 40-site corpus census is marked, the same contract as
1764// --ptrprov, --chkarith, --optenforce, --ownership and --bckelide.
1765static g_sendcheck_live: i64
1766static g_send_names: *u8            // SEND_NAME_W bytes per marked struct name, NUL-terminated
1767static g_send_n: i64
1768static g_last_cast_val: i64          // the value id the most recent `as` chain produced
1769static g_last_cast_src_ty: *Type     // the static type of that chain's OPERAND (what the cast erased)
1770const SEND_NAME_W: i64 = 64
1771const SEND_MAX: i64 = 256
1772const SEND_CALLEE_LEN: i64 = 14      // strlen("nx_pool_submit"), the one callee this check keys on
1773func nx_sendcheck_set(v: i64) -> i64 { g_sendcheck_live = v; return 0 }
1774func sync_send_mark(name: *u8, len: i64) -> i64 {
  if (g_send_names as i64) == 0 { g_send_names = sys_mmap(SEND_MAX * SEND_NAME_W) }
  if g_send_n >= SEND_MAX { return 0 }
  let dst: *u8 = ((g_send_names as i64) + g_send_n * SEND_NAME_W) as *u8
  var k: i64 = 0
  while k < len { if k < SEND_NAME_W - 1 { dst[k] = name[k] } k = k + 1 }
  if len < SEND_NAME_W { dst[len] = 0 as u8 } else { dst[SEND_NAME_W - 1] = 0 as u8 }
  g_send_n = g_send_n + 1
  return 1
1783}
1784func sync_send_is_marked(name: *u8, len: i64) -> i64 {
  var i: i64 = 0
  while i < g_send_n {
      let e: *u8 = ((g_send_names as i64) + i * SEND_NAME_W) as *u8
      var k: i64 = 0
      var eq: i64 = 1
      while k < len { if e[k] != name[k] { eq = 0; k = len } else { k = k + 1 } }
      if eq == 1 { if e[len] == (0 as u8) { return 1 } }
      i = i + 1
  }
  return 0
1795}
1796// returns 1 when it refused (the error is already voiced), 0 when it accepted or abstained.
1797func sync_send_check(P: *Parser, name: *u8, nlen: i64, args: *i64, n_args: i64, ln: i64, cl: i64) -> i64 {
  if nlen != SEND_CALLEE_LEN { return 0 }
  if streq_n(name, "nx_pool_submit" as *u8, SEND_CALLEE_LEN) == 0 { return 0 }
  if n_args < 3 { return 0 }
  if args[2] != g_last_cast_val { return 0 }              // not a cast: abstain (declared above)
  let st: *Type = g_last_cast_src_ty
  if st == (0 as *Type) { return 0 }
  if st.kind != TY_PTR { return 0 }
  let pt: *Type = st.pointee
  if pt == (0 as *Type) { return 0 }
  if pt.kind != TY_STRUCT { return 0 }                    // *u8 / *i64 buffer: abstain (declared above)
  if sync_send_is_marked(pt.name_bytes, pt.name_len) == 1 { return 0 }
  nx_diag_at(ln)
  nx_diag_puts(": struct '" as *u8)
  sys_write(2, pt.name_bytes, pt.name_len)
  nx_diag_puts("' is handed to another thread here, and it is not marked send.\n" as *u8)
  nx_diag_caret(ln, cl)
  nx_diag_puts("  why the build stopped: nx_pool_submit runs this task on a worker thread, so every field of this struct is read (and possibly written) concurrently with the thread that built it -- a data race the compiler cannot see through an i64. Nothing declares that this struct is safe to share.\n" as *u8)
  nx_diag_puts("  fix: if every field is either immutable after submit or owned by exactly one thread at a time, mark the declaration `struct " as *u8)
  sys_write(2, pt.name_bytes, pt.name_len)
  nx_diag_puts(" send { ... }` -- that is your assertion, the compiler records it; otherwise hand the worker a copy, or a struct that is.\n" as *u8)
  nx_diag_note_error()
  return 1
1820}
1821// The rung's public predicate (the watch-symbol family): is checked arithmetic live in this
1822// build of the compiler?  The fixture organ runtime/nx_checked_arith.nx carries the runnable
1823// witness under the watch symbol chk_add_overflow itself.
1824func chk_add_overflow_live() -> i64 { return g_chkarith_live }
1825
1826static g_ovf_msg_gid1: i64
1827static g_ovf_msg_mod:  i64
1828
1829// Emit the overflow abort into P.current_bb (diagnostic then exit_group(NX_TRAP_OVERFLOW)).
1830// Message global interned once per module, the emit_bounds_trap discipline -- a fixed-capacity
1831// globals pool must not be spent once per arithmetic site.
1832func emit_overflow_trap(P: *Parser) -> i64 {
  let msg: *u8 = "nx: FATAL integer overflow: a 64-bit add, subtract or multiply produced a result outside the i64 range (CWE-190) under --chkarith. The operation was REFUSED and the process aborted rather than continuing on a silently wrapped value. Fix: check the operands before the operation or widen the representation; where wrap-around IS the intent (hashes, ring counters) use __wrap_add / __wrap_sub / __wrap_mul, which are exempt.\n" as *u8
  var mlen: i64 = 0
  while msg[mlen] != 0 { mlen = mlen + 1 }
  let modv: i64 = P.module as i64
  if g_ovf_msg_mod != modv { g_ovf_msg_gid1 = 0 }
  var gid: i64 = g_ovf_msg_gid1 - 1
  if g_ovf_msg_gid1 == 0 {
      gid = ir_add_global_string(P.module, msg, mlen)
      g_ovf_msg_gid1 = gid + 1
      g_ovf_msg_mod = modv
  }
  let u8ty: *Type = alloc_type(TY_I8, 1, 1)
  let pt: *Type = alloc_type(TY_PTR, 8, 8)
  pt.pointee = u8ty
  let msg_v: i64 = ir_global_value(P.current_fn, gid, pt)
  return emit_trap_syscalls(P, msg_v, mlen, NX_TRAP_OVERFLOW)
1849}
1850
1851// Shared tail of every leg: `cond` true means OVERFLOW.  Emits  br_cond cond -> fail, ok ;
1852// fail: trap ; br ok ; ok: <caller continues>.  The `br ok` after exit_group is unreachable and
1853// exists only so every block ends in a terminator (cfg_rebuild_edges requires it), exactly as
1854// emit_bounds_check_v does.  On return P.current_bb is `ok`.
1855func chk_branch_on_overflow(P: *Parser, cond: i64) -> i64 {
  let fail_bb: *BasicBlock = ir_block_new(P.current_fn)
  let ok_bb:   *BasicBlock = ir_block_new(P.current_fn)
  ir_emit_br_cond(P.current_bb, cond, fail_bb, ok_bb)
  P.current_bb = fail_bb
  emit_overflow_trap(P)
  ir_emit_br(P.current_bb, ok_bb)
  P.current_bb = ok_bb
  return 0
1864}
1865
1866// ADD leg.  `r` is the already-emitted a + b.
1867func chk_add_overflow(P: *Parser, a: i64, b: i64, r: i64) -> i64 {
  let t1: i64 = ir_emit_binop(P.current_bb, OP_XOR, a, r, ir_type_i64())
  let t2: i64 = ir_emit_binop(P.current_bb, OP_XOR, b, r, ir_type_i64())
  let t3: i64 = ir_emit_binop(P.current_bb, OP_AND, t1, t2, ir_type_i64())
  let zero_v: i64 = safe_const_i64(P, 0, "parse.nx:chk-add-zero" as *u8)
  let c: i64 = ir_emit_binop(P.current_bb, OP_LT_S, t3, zero_v, ir_type_i64())
  return chk_branch_on_overflow(P, c)
1874}
1875
1876// SUB leg.  `r` is the already-emitted a - b.
1877func chk_sub_overflow(P: *Parser, a: i64, b: i64, r: i64) -> i64 {
  let t1: i64 = ir_emit_binop(P.current_bb, OP_XOR, a, b, ir_type_i64())
  let t2: i64 = ir_emit_binop(P.current_bb, OP_XOR, a, r, ir_type_i64())
  let t3: i64 = ir_emit_binop(P.current_bb, OP_AND, t1, t2, ir_type_i64())
  let zero_v: i64 = safe_const_i64(P, 0, "parse.nx:chk-sub-zero" as *u8)
  let c: i64 = ir_emit_binop(P.current_bb, OP_LT_S, t3, zero_v, ir_type_i64())
  return chk_branch_on_overflow(P, c)
1884}
1885
1886// i64 minimum, built by shift so no literal has to spell 2^63 (the tokenizer's i64 literal range
1887// ends one below it).  63 is inside the constant shift-count range this same parser enforces.
1888func chk_i64_min() -> i64 {
  var m: i64 = 1
  m = m << 63
  return m
1892}
1893
1894// MUL leg.  `r` is the already-emitted a * b.
1895//     cur:   c0 = a == 0            ; br_cond c0 -> ok, chk1          (0 * anything cannot overflow)
1896//     chk1:  c1 = a == -1           ; br_cond c1 -> neg1, div
1897//     neg1:  c2 = b == MIN          ; br_cond c2 -> fail, ok          (-1 * MIN is the one a=-1 overflow)
1898//     div:   q = r /s a ; c3 = q != b ; br_cond c3 -> fail, ok
1899//     fail:  trap ; br ok
1900//     ok:
1901func chk_mul_overflow(P: *Parser, a: i64, b: i64, r: i64) -> i64 {
  let chk1_bb: *BasicBlock = ir_block_new(P.current_fn)
  let neg1_bb: *BasicBlock = ir_block_new(P.current_fn)
  let div_bb:  *BasicBlock = ir_block_new(P.current_fn)
  let fail_bb: *BasicBlock = ir_block_new(P.current_fn)
  let ok_bb:   *BasicBlock = ir_block_new(P.current_fn)
  let zero_v: i64 = safe_const_i64(P, 0, "parse.nx:chk-mul-zero" as *u8)
  let c0: i64 = ir_emit_binop(P.current_bb, OP_EQ, a, zero_v, ir_type_i64())
  ir_emit_br_cond(P.current_bb, c0, ok_bb, chk1_bb)
  P.current_bb = chk1_bb
  let m1_v: i64 = safe_const_i64(P, 0 - 1, "parse.nx:chk-mul-m1" as *u8)
  let c1: i64 = ir_emit_binop(P.current_bb, OP_EQ, a, m1_v, ir_type_i64())
  ir_emit_br_cond(P.current_bb, c1, neg1_bb, div_bb)
  P.current_bb = neg1_bb
  let min_v: i64 = safe_const_i64(P, chk_i64_min(), "parse.nx:chk-mul-min" as *u8)
  let c2: i64 = ir_emit_binop(P.current_bb, OP_EQ, b, min_v, ir_type_i64())
  ir_emit_br_cond(P.current_bb, c2, fail_bb, ok_bb)
  P.current_bb = div_bb
  let q: i64 = ir_emit_binop(P.current_bb, OP_DIV_S, r, a, ir_type_i64())
  let c3: i64 = ir_emit_binop(P.current_bb, OP_NE, q, b, ir_type_i64())
  ir_emit_br_cond(P.current_bb, c3, fail_bb, ok_bb)
  P.current_bb = fail_bb
  emit_overflow_trap(P)
  ir_emit_br(P.current_bb, ok_bb)
  P.current_bb = ok_bb
  return 0
1927}
1928
1929// Does this binop qualify for the runtime check?  Mode on, op is + - *, result type i64, and
1930// neither operand is a pointer (p - q is an integer difference over a pointer axis).
1931func chk_arith_applies(P: *Parser, op: i64, left: i64, right: i64, rty: *Type) -> i64 {
  if g_chkarith_live != 1 { return 0 }
  if rty == (0 as *Type) { return 0 }
  if rty.kind != TY_I64 { return 0 }
  var is_arith: i64 = 0
  if op == OP_ADD { is_arith = 1 }
  if op == OP_SUB { is_arith = 1 }
  if op == OP_MUL { is_arith = 1 }
  if is_arith == 0 { return 0 }
  let lt: *Type = nx_value_type(P, left)
  let rt: *Type = nx_value_type(P, right)
  if lt != (0 as *Type) { if lt.kind == TY_PTR { return 0 } }
  if rt != (0 as *Type) { if rt.kind == TY_PTR { return 0 } }
  return 1
1945}
1946
1947// The runtime injection, called by emit_typed_binop right after it emits the binop.
1948func chk_arith_inject(P: *Parser, op: i64, left: i64, right: i64, r: i64) -> i64 {
  if op == OP_ADD { return chk_add_overflow(P, left, right, r) }
  if op == OP_SUB { return chk_sub_overflow(P, left, right, r) }
  if op == OP_MUL { return chk_mul_overflow(P, left, right, r) }
  return 0
1953}
1954
1955// Pure overflow predicates over the compiler's own i64 (which wraps -- the very behaviour this
1956// rung refuses in user programs, used here as the oracle because it is the hardware's answer).
1957func chk_const_add_overflows(a: i64, b: i64) -> i64 {
  let r: i64 = a + b
  if ((a ^ r) & (b ^ r)) < 0 { return 1 }
  return 0
1961}
1962func chk_const_sub_overflows(a: i64, b: i64) -> i64 {
  let r: i64 = a - b
  if ((a ^ b) & (a ^ r)) < 0 { return 1 }
  return 0
1966}
1967func chk_const_mul_overflows(a: i64, b: i64) -> i64 {
  if a == 0 { return 0 }
  if a == 0 - 1 {
      if b == chk_i64_min() { return 1 }
      return 0
  }
  let r: i64 = a * b
  if r / a != b { return 1 }
  return 0
1976}
1977
1978// COMPILE-TIME LEG: both operands constant and the result provably overflows -> refuse, naming
1979// the rule (the shift-count voice).  Called by the additive/multiplicative parsers with the
1980// operator token so the caret lands on the operator.  Mode-gated like the runtime leg, so the
1981// default build of the corpus is untouched.
1982func chk_const_overflow_refuse(P: *Parser, op: i64, left: i64, right: i64, op_tok: *Tok) -> i64 {
  if g_chkarith_live != 1 { return 0 }
  let lv: *Value = val_at(P.current_fn, left)
  let rv: *Value = val_at(P.current_fn, right)
  if lv.kind != VK_CONST_INT { return 0 }
  if rv.kind != VK_CONST_INT { return 0 }
  let lt: *Type = nx_value_type(P, left)
  let rt: *Type = nx_value_type(P, right)
  if lt != (0 as *Type) { if lt.kind != TY_I64 { return 0 } }
  if rt != (0 as *Type) { if rt.kind != TY_I64 { return 0 } }
  var bad: i64 = 0
  if op == OP_ADD { bad = chk_const_add_overflows(lv.const_int, rv.const_int) }
  if op == OP_SUB { bad = chk_const_sub_overflows(lv.const_int, rv.const_int) }
  if op == OP_MUL { bad = chk_const_mul_overflows(lv.const_int, rv.const_int) }
  if bad == 0 { return 0 }
  nx_diag_at(op_tok.line)
  nx_diag_puts(": this constant arithmetic overflows the 64-bit integer range (operands " as *u8)
  nx_put_dec_err(lv.const_int)
  nx_diag_puts(" and " as *u8)
  nx_put_dec_err(rv.const_int)
  nx_diag_puts(").\n" as *u8)
  nx_diag_caret(op_tok.line, op_tok.col)
  nx_diag_puts("  why the build stopped: the processor keeps only the low 64 bits of the result, so this line would silently compute a WRAPPED value that is not the one written (CWE-190) -- and a constant overflow in source is never the intent.\n" as *u8)
  nx_diag_puts("  fix: use operands whose result fits in 64 bits; if wrap-around IS intended (hash constants, ring counters) spell it __wrap_add / __wrap_sub / __wrap_mul, which are exempt from this check.\n" as *u8)
  nx_diag_puts("  capability=checked-arith-const-overflow -- roadmap: nishifamily.com/compare/lang\n" as *u8)
  nx_diag_note_error()
  return 1
2009}
2010
2011// ===================== LN2: OPTION / NULL ENFORCEMENT (opt_enforce_unwrap) =====================
2012// CWE-476, the estate's recurring P2 meta-class ("sentinel-zero-as-null"): a function returns 0 for
2013// not-found / failed, the caller dereferences the result without looking, and the program is right
2014// only by accident of its input.  Option and Result exist in the stdlib but nothing ENFORCES their
2015// use, so they are a convention wearing the shape of a type system (the /compare/lang row).
2016//
2017// DECLARED MODE, OFF BY DEFAULT, the LN3/LN1 shape: enforcement runs only under `--optenforce`
2018// (g_optenforce_live, set by nx_compile_x86 main).  Under the default every build is byte-identical by
2019// construction (nothing below emits IR or refuses).
2020//
2021// WHAT IS ENFORCED: a dereference of a pointer-typed LOCAL that is not PROVEN non-null on the
2022// current path is REFUSED at parse time, naming the local and the line.  Proof is tracked on the
2023// Local (nn_checked) and comes from exactly these sources -- the idioms this corpus already uses:
2024//   bound non-null   `let p = &x`, `let s = "lit"` (address-of / string global / function address)
2025//   narrowed         `if p != 0 {` / `if p != (0 as *T) {` / `if (p as i64) != 0 {`   -> inside then
2026//                    `if p == 0 { ...ends in return/break/continue/sys_exit }`   -> rest of the block
2027//                    `if p == 0 { } else {`                                      -> inside else
2028//                    `while p != 0 {`                                           -> inside the body
2029//                    `nx_assert_ptr(p as *u8, ...)` / `nx_assert_ptr(p, ...)`  -> rest of the block
2030//   un-narrowed      `p = <expr>` re-derives from the new value (a call result is nullable again)
2031// Deref sites covered: `p.f` / `p[i]` reads (parse_field_chain's FIRST link through the handshake
2032// parse_primary sets), `p.f = v`, `p[i] = v`, `*p = v`, and `*p` reads.  DECLARED FLOOR: chained
2033// derefs of pointers loaded from fields or calls (`a.b.c`, `f().x`, `g.rows[i].y`) are not named
2034// locals and are not checked by this rung -- bind them to a local first, the estate's own idiom.
2035// Flow sensitivity is syntactic (token shape of the condition), which is what a reader sees; it does
2036// not chase aliases (`let q = p` after a check carries p's bit at bind time, nothing more).
2037//
2038// The refusal is a diagnostic (nx_diag_note_error), not a die, so multi-error recovery reports every
2039// site in a unit -- the census a ratchet needs.  Exit code / trap: none; this rung is compile-time.
2040static g_optenforce_live: i64
2041func nx_optenforce_set(v: i64) -> i64 { g_optenforce_live = v; return 0 }
2042// The rung's public predicate (watch-symbol family); the fixture organ runtime/nx_option_enforce.nx
2043// carries the runnable witness under the watch symbol opt_enforce_unwrap itself.
2044func opt_enforce_unwrap_live() -> i64 { return g_optenforce_live }
2045
2046// Handshake from parse_primary to parse_field_chain (the LN3 g_pp_base_* shape): the value id the
2047// primary just produced for a pointer-typed local, and whether that local is currently UNCHECKED.
2048// Only the chain's FIRST link can match (value ids are monotonic per function).
2049static g_oe_base_val:  i64
2050static g_oe_base_unchk: i64
2051static g_oe_base_line: i64
2052static g_oe_base_col:  i64
2053static g_oe_base_name: i64          // *u8 of the identifier text (token text lives for the whole parse)
2054// "Did the statement just parsed END the path?"  Set by return/break/continue/sys_exit statements,
2055// cleared at every statement start; compound statements clear it at their end (an `if` as a whole
2056// does not terminate just because its last inner statement did).
2057static g_oe_term: i64
2058func oe_reset_fn() -> i64 { g_oe_base_val = 0 - 1; g_oe_base_unchk = 0; g_oe_term = 0; return 0 }
2059
2060// Is the just-produced value provably non-null?  &x (OP_ADDR_OF), an alloca address, a string
2061// global, a function address.  Everything else -- calls, loads, params, casts of those, and the
2062// literal 0 -- is not.
2063// `as T` is emitted as a typed identity (OP_ADD v, const 0 -- see parse_unary), so the origin is
2064// found by looking through identity-adds whose right operand is the constant 0.  Terminates without
2065// a bound: an operand's value id is always smaller than its result's (SSA order), so each hop
2066// strictly descends.
2067func oe_value_nonnull(P: *Parser, v: i64) -> i64 {
  if v < 0 { return 0 }
  let val: *Value = val_at(P.current_fn, v)
  if val.kind == VK_INSTR {
      if val.instr != (0 as *Instr) {
          if val.instr.op == OP_ADD {
              if val.instr.n_operands == 2 {
                  let rv: *Value = val_at(P.current_fn, val.instr.op1)
                  if rv.kind == VK_CONST_INT { if rv.const_int == 0 {
                      // INTEGER -> POINTER cast (`z as *u8` with z an i64): the programmer's own
                      // assertion that the integer IS an address -- trusted, the computed-address
                      // floor (measured: nx_syscalls.nx:518 `let q: *u8 = z as *u8`).  A POINTER ->
                      // pointer cast carries the operand's origin, so recurse.
                      let ov: *Value = val_at(P.current_fn, val.instr.op0)
                      if ov.ty != (0 as *Type) { if ov.ty.kind != TY_PTR { return 1 } }
                      if val.instr.op0 < v { return oe_value_nonnull(P, val.instr.op0) }
                  } }
              }
          }
          // A COMPUTED ADDRESS is trusted: `(base + off) as *T`, GEP, masked/shifted addresses.  The
          // class this rung refuses is the SENTINEL-RETURNING CALL, the PARAMETER, the LOADED pointer
          // and the REASSIGNMENT (the P2 meta-class); arithmetic on an address is the caller's
          // statement that it owns the base (declared floor, measured: the stdlib's own
          // nxa_dump_printable does `(src + i) as *u8` and must build under the mode).
          if val.instr.op == OP_ADD { return 1 }     // non-identity add (the identity case returned above)
          if val.instr.op == OP_SUB { return 1 }
          if val.instr.op == OP_MUL { return 1 }
          if val.instr.op == OP_AND { return 1 }
          if val.instr.op == OP_OR  { return 1 }
          if val.instr.op == OP_SHL { return 1 }
          if val.instr.op == OP_GEP { return 1 }
      }
  }
  if val.kind == VK_GLOBAL { return 1 }
  if val.kind == VK_FUNC_ADDR { return 1 }
  // A PARAMETER is the callee's contract: the caller owes non-null (no nullable annotation exists
  // in the language yet; a future `?*T` would flip this).  DECLARED FLOOR -- measured: treating
  // params as nullable refuses every string helper in the stdlib (`msg[n]` in nxa_die).
  if val.kind == VK_PARAM { return 1 }
  if val.kind == VK_CONST_INT { if val.const_int != 0 { return 1 } return 0 }
  if val.kind == VK_INSTR {
      if val.instr != (0 as *Instr) {
          if val.instr.op == OP_ADDR_OF { return 1 }
          if val.instr.op == OP_ALLOCA { return 1 }
          // THE ALLOCATOR IS NON-NULL BY CONTRACT: sys_mmap never returns a poisoned pointer -- every
          // failure path ends in nxa_die (sys_exit 12) or degrades to a mapping that was itself
          // checked (nx_syscalls.nx:423-).  Treating its result as nullable would refuse the
          // stdlib itself (measured on the first build of this mode: nx_syscalls.nx:124 `nbox[0]`).
          // sys_mmap_shared returns the raw kernel value (can be negative) and stays nullable.
          if val.instr.op == OP_CALL {
              if val.instr.callee != (0 as *Function) {
                  if oe_callee_is(val.instr.callee, "sys_mmap" as *u8, 8) == 1 { return 1 }
              }
          }
      }
  }
  return 0
2124}
2125
2126// Byte-compare a callee's name against (name, len) -- the find_function idiom (name_start IS the *u8).
2127func oe_callee_is(fn: *Function, name: *u8, len: i64) -> i64 {
  if fn.name_len != len { return 0 }
  let fname: *u8 = fn.name_start as *u8
  var j: i64 = 0
  var eq: i64 = 1
  var go: i64 = 1
  while go == 1 {
      if j >= len { go = 0 } else {
          if fname[j] != name[j] { eq = 0; go = 0 }
          j = j + 1
      }
  }
  return eq
2140}
2141
2142// Record the bit on a just-bound or just-assigned pointer local.
2143func oe_bind_local(P: *Parser, L: *Local, v: i64) -> i64 {
  if L == (0 as *Local) { return 0 }
  if L.ty == (0 as *Type) { return 0 }
  if L.ty.kind != TY_PTR { return 0 }
  L.nn_checked = oe_value_nonnull(P, v)
  return 0
2149}
2150
2151// The refusal, in the shift-count voice.  `name` is the identifier text; line/col anchor the caret.
2152func oe_refuse(name: *u8, line: i64, col: i64) -> i64 {
  nx_diag_at(line)
  nx_diag_puts(": dereference of '" as *u8)
  nx_diag_puts(name)
  nx_diag_puts("', a pointer that may be null on this path (--optenforce mode).\n" as *u8)
  nx_diag_caret(line, col)
  nx_diag_puts("  why the build stopped: this pointer came from a call, a parameter, a loaded field or a reassignment, and nothing on the path to this use has proven it non-zero -- the sentinel-zero deref class (CWE-476), which crashes or reads address 0 only on the input nobody tested.\n" as *u8)
  nx_diag_puts("  fix: guard the use -- `if " as *u8)
  nx_diag_puts(name)
  nx_diag_puts(" != 0 { ... }` around it, or `if " as *u8)
  nx_diag_puts(name)
  nx_diag_puts(" == 0 { return ... }` before it, or nx_assert_ptr(" as *u8)
  nx_diag_puts(name)
  nx_diag_puts(" as *u8, \"why it cannot be null\") when the invariant is yours; bind a pointer loaded from a field or returned by a call to a local first so the guard has a name to narrow.\n" as *u8)
  nx_diag_puts("  capability=option-enforce-unwrap -- roadmap: nishifamily.com/compare/lang\n" as *u8)
  nx_diag_note_error()
  return 1
2169}
2170
2171// A MODULE STATIC pointer (`static p: *T`) is injected as a Local whose value is the slot's global
2172// address (VK_GLOBAL), loaded on use.  DECLARED FLOOR: statics are module state initialised by module
2173// invariants (the arena's nxa_st is null until the first sys_mmap and used only after); this rung
2174// does not model initialisation order, so statics are trusted rather than refused wholesale --
2175// measured: refusing them refuses the stdlib (nx_syscalls.nx:364 nxa_dump_sizes).
2176func oe_local_is_static(P: *Parser, L: *Local) -> i64 {
  if L.value_id < 0 { return 0 }
  let sv: *Value = val_at(P.current_fn, L.value_id)
  if sv.kind == VK_GLOBAL { return 1 }
  return 0
2181}
2182
2183// Statement-level deref of a named local (p.f = / p[i] = / *p = / *p reads): refuse if unchecked.
2184func oe_check_local_deref(P: *Parser, L: *Local, tok: *Tok) -> i64 {
  if g_optenforce_live != 1 { return 0 }
  if L == (0 as *Local) { return 0 }
  if L.ty == (0 as *Type) { return 0 }
  if L.ty.kind != TY_PTR { return 0 }
  if L.nn_checked == 1 { return 0 }
  if oe_local_is_static(P, L) == 1 { return 0 }
  return oe_refuse(tok_text_ptr(tok), tok.line, tok.col)
2192}
2193
2194// parse_primary hands the chain walker the base it just resolved (see parse_field_chain).
2195func oe_handshake_set(P: *Parser, L: *Local, v: i64, tok: *Tok) -> i64 {
  if g_optenforce_live != 1 { return 0 }
  if L.ty == (0 as *Type) { return 0 }
  if L.ty.kind != TY_PTR { return 0 }
  if oe_local_is_static(P, L) == 1 { return 0 }
  g_oe_base_val = v
  g_oe_base_unchk = 1 - L.nn_checked
  g_oe_base_line = tok.line
  g_oe_base_col = tok.col
  g_oe_base_name = tok_text_ptr(tok) as i64
  return 0
2206}
2207
2208// The chain walker's first-link check: `v` is the base being dereferenced right now.
2209func oe_chain_check(P: *Parser, v: i64) -> i64 {
  if g_optenforce_live != 1 { return 0 }
  if v != g_oe_base_val { return 0 }
  if g_oe_base_unchk != 1 { return 0 }
  g_oe_base_unchk = 0           // one refusal per base use, not one per link
  return oe_refuse(g_oe_base_name as *u8, g_oe_base_line, g_oe_base_col)
2215}
2216
2217// TOKEN-SHAPE PROBE for a null test at P.pos (the condition of an `if` / `while`), consuming
2218// nothing.  Recognised:   IDENT (!=|==) 0        IDENT (!=|==) ( 0 as ...)        ( IDENT as i64 ) (!=|==) 0
2219// Returns 0 = not a null test, 1 = "!= 0" shape, 2 = "== 0" shape; the tested local in *outL
2220// (0 when the identifier is not a pointer-typed local -- then the caller does nothing).
2221static g_oe_probe_L: i64            // *Local the last probe matched (0 = none); a static, not an out-param,
                                  // so the hot `if` path allocates nothing per statement
2223func oe_probe_null_test(P: *Parser) -> i64 {
  g_oe_probe_L = 0
  let t0: *Tok = tok_at(P.toks, P.pos)
  let t1: *Tok = tok_at(P.toks, P.pos + 1)
  let t2: *Tok = tok_at(P.toks, P.pos + 2)
  var ident_tok: *Tok = 0 as *Tok
  var op_tok: *Tok = 0 as *Tok
  var zero_tok: *Tok = 0 as *Tok
  // shape A/B:  IDENT op 0 | IDENT op ( 0
  if t0.kind == TK_IDENT {
      if t1.kind == TK_NE { op_tok = t1 }
      if t1.kind == TK_EQ { op_tok = t1 }
      if op_tok != (0 as *Tok) {
          ident_tok = t0
          if t2.kind == TK_INT { zero_tok = t2 }
          if t2.kind == TK_LPAREN {
              let t3: *Tok = tok_at(P.toks, P.pos + 3)
              if t3.kind == TK_INT { zero_tok = t3 }
          }
      }
  }
  // shape C:  ( IDENT as i64 ) op 0
  if t0.kind == TK_LPAREN {
      if t1.kind == TK_IDENT {
          if t2.kind == TK_AS {
              let t4: *Tok = tok_at(P.toks, P.pos + 4)      // ')'
              let t5: *Tok = tok_at(P.toks, P.pos + 5)      // op
              let t6: *Tok = tok_at(P.toks, P.pos + 6)      // 0
              if t4.kind == TK_RPAREN {
                  if t5.kind == TK_NE { op_tok = t5 }
                  if t5.kind == TK_EQ { op_tok = t5 }
                  if op_tok != (0 as *Tok) {
                      ident_tok = t1
                      if t6.kind == TK_INT { zero_tok = t6 }
                  }
              }
          }
      }
  }
  if ident_tok == (0 as *Tok) { return 0 }
  if zero_tok == (0 as *Tok) { return 0 }
  if zero_tok.int_val != 0 { return 0 }
  let L: *Local = find_local(P, tok_text_ptr(ident_tok))
  if L == (0 as *Local) { return 0 }
  if L.ty == (0 as *Type) { return 0 }
  if L.ty.kind != TY_PTR { return 0 }
  g_oe_probe_L = L as i64
  if op_tok.kind == TK_NE { return 1 }
  return 2
2272}
2273
2274// ============== LN4 + LN5: OWNERSHIP MOVES AND USE-AFTER-FREE (own_check_move / own_check_uaf) ==============
2275// CWE-416 and the move half of it.  ONE checker for both rungs on purpose: a move and a release are
2276// the same event seen twice -- the name stops naming a live buffer -- and splitting them would put
2277// two state machines on one Local, which is the duplicate-ruler defect with extra steps.
2278//
2279// DECLARED MODE, OFF BY DEFAULT, the LN1/LN2/LN3 shape: nothing below refuses or emits unless
2280// `--ownership` is passed (g_ownership_live, set by nx_compile_x86 main).  Under the default every
2281// build is byte-identical BY CONSTRUCTION -- this rung emits no IR under EITHER mode, so its whole
2282// footprint is parse-time refusals.  The per-class ratchet flips the default after a clean census.
2283//
2284// WHAT "RELEASED" MEANS HERE, MEASURED RATHER THAN ASSUMED (2026-08-25).  The /compare/lang row
2285// claims an "arena no-free doctrine (nothing frees)".  That is FALSE as written: sys_munmap has
2286// exactly ONE definition (nx_syscalls.nx:294) and 1,431 reference sites across buildroot/runtime
2287// (nx_absent, corpus_complete=1), and there is NO arena reset and NO nxa_free -- both ABSENT-PROVEN
2288// over the same corpus.  So sys_munmap is not one release verb among several, it is THE release
2289// verb this estate has, and it is the only sound oracle available for a use-after-free check.
2290//
2291// AND THE DOCTRINE IS TRUE ONLY BY AN ALLOCATOR ACCIDENT, WHICH IS THE WHOLE ARGUMENT FOR A CHECKER.
2292// sys_munmap's body is `if len <= NXA_SMALL_MAX { return 0 }` -- a release of 256 bytes or fewer is
2293// a NO-OP today because small allocations come from the bump arena, so reading after it happens to
2294// be harmless.  Above 256 bytes the pages really are returned and the read is a genuine SIGSEGV.
2295// THIS RUNG REFUSES BOTH SIZES DELIBERATELY.  Keying the check on NXA_SMALL_MAX would make a safety
2296// checker depend on an allocator tuning constant -- and that constant has ALREADY MOVED once
2297// (256 -> 128, recorded in nx_fsops_write.nx's own CAS diagnostic), which would have silently
2298// un-refused a whole class of real defects the day somebody re-tuned the arena.  A release is a
2299// release.
2300//
2301// WHAT AN OWNER IS: a POINTER-TYPED LOCAL bound to a VISIBLE ALLOCATION -- a call to sys_mmap,
2302// optionally through an `as *T` cast chain.  The origin walk reuses oe_callee_is and the identity-add
2303// look-through that LN2 already established, so there is exactly one "is this an allocation" ruler.
2304// Unlike LN3 the SIZE is irrelevant here, so a runtime-sized sys_mmap(n) IS tracked by this rung
2305// where LN3 declares it a floor.
2306//
2307// WHAT ENDS OWNERSHIP:
2308//   __move(p)          the DECLARED transfer point (LN4).  A pure marker: it returns p's own value
2309//                      and emits no IR, so `f(__move(p))` is byte-for-byte `f(p)`.  This is the
2310//                      __wrap_add contract -- an intrinsic that states intent the type system cannot.
2311//   sys_munmap(p, n)   the release point (LN5), measured above.
2312// After either, ANY read of the name is refused.  A DOUBLE move and a DOUBLE free fall out for free:
2313// the second statement reads the name to pass it, and that read is the use being refused.
2314//
2315// WHAT RE-STARTS IT: `p = <a visible allocation>` on a `var` re-derives OWN_LIVE from the new value,
2316// exactly as LN2 re-derives its non-null bit.  A checker that refused every second use of a name
2317// would be useless, so the accept side is a load-bearing tooth, not a courtesy.
2318//
2319// DECLARED IMPRECISION -- every floor below is sound in the DO-NOTHING direction (a miss skips a
2320// refusal, it never invents one), except the branch case which is called out as deliberate:
2321//   * NAMED LOCALS ONLY.  A buffer living in a struct field or a module static is not tracked; bind
2322//     it to a local first, the estate's own idiom and LN2's identical floor.
2323//   * CROSS-FUNCTION IS NOT MODELLED.  A buffer passed to a callee that frees it is invisible here;
2324//     that needs an ownership annotation on parameters, which the language does not have yet.
2325//   * `var` ALIASES ARE NOT SWEPT.  Two `let` names for one buffer ARE (see own_mark's alias sweep,
2326//     sound because a `let` is SSA so equal value ids mean one allocation), but two `var`s hold
2327//     separate alloca slots and do not share a value id.
2328//   * LOOP BACK-EDGES ARE NOT MODELLED.  The scan is linear over statements, so a release at the
2329//     bottom of a loop body is not seen by a use at the top on the next iteration.
2330//   * BRANCHES POISON, DELIBERATELY.  `if c { __move(p) }` then a use refuses even on the path where
2331//     the move did not happen.  This is not an oversight -- it is the Rust conditional-move rule, and
2332//     Rust is the Best-in-class column this row is measured against.  It is the ONE place this rung
2333//     is wrong in the refusing direction, and it is named here so nobody has to rediscover it.
2334const OWN_NONE:     i64 = 0
2335const OWN_LIVE:     i64 = 1
2336const OWN_MOVED:    i64 = 2
2337const OWN_RELEASED: i64 = 3
2338
2339static g_ownership_live: i64
2340func nx_ownership_set(v: i64) -> i64 { g_ownership_live = v; return 0 }
2341// The rung's public predicate (the watch-symbol family, mirroring bck_ptr_provenance_live and
2342// opt_enforce_unwrap_live): is ownership checking live in this build of the compiler?  The fixture
2343// organ runtime/nx_ownership.nx carries the runnable witnesses under own_check_move / own_check_uaf.
2344// It is ALSO the ONE reader of g_ownership_live -- every gate below asks through it rather than
2345// testing the static directly.  Its two siblings ship defined-and-never-called (measured:
2346// opt_enforce_unwrap_live has exactly one reference in the whole tree, its own definition), which
2347// makes them a standing nx_unwired name; routing the mode test through the accessor gives the
2348// predicate a real job instead of adding a third unwired name to the ratchet.
2349func own_check_live() -> i64 { return g_ownership_live }
2350
2351// Is value `v` a VISIBLE ALLOCATION?  An OP_CALL to sys_mmap, or an `as *T` cast of one.  `as T` is
2352// emitted as a typed identity (OP_ADD v, const 0 -- see parse_unary), so the origin is found by
2353// looking through identity-adds whose right operand is the constant 0.  Terminates without a bound:
2354// an operand's value id is strictly smaller than its result's (SSA order), so each hop descends.
2355func own_value_is_alloc(P: *Parser, v: i64) -> i64 {
  if v < 0 { return 0 }
  let val: *Value = val_at(P.current_fn, v)
  if val.kind != VK_INSTR { return 0 }
  if val.instr == (0 as *Instr) { return 0 }
  if val.instr.op == OP_CALL {
      if val.instr.callee != (0 as *Function) {
          if oe_callee_is(val.instr.callee, "sys_mmap" as *u8, 8) == 1 { return 1 }
      }
      return 0
  }
  if val.instr.op == OP_ADD {
      if val.instr.n_operands == 2 {
          let rv: *Value = val_at(P.current_fn, val.instr.op1)
          if rv.kind == VK_CONST_INT {
              if rv.const_int == 0 {
                  if val.instr.op0 < v { return own_value_is_alloc(P, val.instr.op0) }
              }
          }
      }
  }
  return 0
2377}
2378
2379// Record ownership on a just-bound or just-assigned pointer local.  Runs under BOTH modes (it only
2380// writes parser state and emits nothing), the oe_bind_local discipline -- so the default build is
2381// unaffected and the hot path carries no extra branch.
2382func own_bind_local(P: *Parser, L: *Local, v: i64) -> i64 {
  if L == (0 as *Local) { return 0 }
  if L.ty == (0 as *Type) { return 0 }
  if L.ty.kind != TY_PTR { return 0 }
  L.own_line = 0
  if own_value_is_alloc(P, v) == 1 { L.own_state = OWN_LIVE; return 0 }
  L.own_state = OWN_NONE
  return 0
2390}
2391
2392// End a local's ownership, and sweep its `let` ALIASES.  `let q = p` binds q to the SAME value id, so
2393// q is a second name for one buffer; marking only the name written in the __move / sys_munmap would
2394// leave every alias reading OWN_LIVE and the use-after-free through `q` would be MISSED.  A `let` is
2395// SSA (parse_stmt_ident_assign refuses stores to it), so equal value ids really do mean one
2396// allocation -- the sweep is sound, not a guess.  COST: one pass over the locals IN SCOPE per move or
2397// release, both of which are rare statements; there is no per-use cost at all.
2398func own_mark(P: *Parser, L: *Local, st: i64, ln: i64) -> i64 {
  L.own_state = st
  L.own_line = ln
  if L.is_alloca == 1 { return 0 }
  if L.value_id < 0 { return 0 }
  var i: i64 = 0
  while i < P.n_locals {
      let A: *Local = parser_loc_at(P, i)
      if (A as i64) != (L as i64) {
          if A.is_alloca == 0 {
              if A.value_id == L.value_id {
                  if A.own_state == OWN_LIVE { A.own_state = st; A.own_line = ln }
              }
          }
      }
      i = i + 1
  }
  return 0
2416}
2417
2418// THE refusal, in the estate's 5W-and-H diagnostic voice.  Both halves share it so the two rungs
2419// cannot drift into two voices, and each stamps its OWN capability= line so a gate can assert WHICH
2420// rule fired rather than merely that something was refused.
2421func own_refuse(name: *u8, line: i64, col: i64, st: i64, from_line: i64) -> i64 {
  nx_diag_at(line)
  if st == OWN_MOVED {
      nx_diag_puts(": use of '" as *u8)
      nx_diag_puts(name)
      nx_diag_puts("' after its ownership was moved away on line " as *u8)
      nx_put_dec_err(from_line)
      nx_diag_puts(" (--ownership mode).\n" as *u8)
      nx_diag_caret(line, col)
      nx_diag_puts("  why the build stopped: __move gave this buffer to somebody else, so this name no longer refers to memory you own -- whoever took it may already have freed it or handed it on, and reading through a name whose owner has changed is the use-after-move half of CWE-416.\n" as *u8)
      nx_diag_puts("  fix: use the value the move produced (bind it: `let taken = __move(" as *u8)
      nx_diag_puts(name)
      nx_diag_puts(")`) and read THAT, or give this name a new allocation before using it again -- `" as *u8)
      nx_diag_puts(name)
      nx_diag_puts(" = sys_mmap(n)` on a `var` restores it; if the move was not meant to transfer anything, delete the __move.\n" as *u8)
      nx_diag_puts("  capability=own-check-move -- roadmap: nishifamily.com/compare/lang\n" as *u8)
      nx_diag_note_error()
      return 1
  }
  nx_diag_puts(": use of '" as *u8)
  nx_diag_puts(name)
  nx_diag_puts("' after the memory it points at was released on line " as *u8)
  nx_put_dec_err(from_line)
  nx_diag_puts(" (--ownership mode).\n" as *u8)
  nx_diag_caret(line, col)
  nx_diag_puts("  why the build stopped: sys_munmap handed these pages back to the kernel, so this pointer now refers to memory this process does not own -- the use-after-free class (CWE-416). Above NXA_SMALL_MAX bytes the pages are really gone and this read is a SIGSEGV; at or below it the arena makes the release a no-op TODAY, which is exactly why the arena no-free doctrine reads as safe and exactly why it is not a guarantee.\n" as *u8)
  nx_diag_puts("  fix: move the release AFTER the last read, or re-allocate before this line -- `" as *u8)
  nx_diag_puts(name)
  nx_diag_puts(" = sys_mmap(n)` on a `var` restores it; if this line is the second release of one buffer, delete it (that is a double free, and the first release already returned the pages).\n" as *u8)
  nx_diag_puts("  capability=own-check-uaf -- roadmap: nishifamily.com/compare/lang\n" as *u8)
  nx_diag_note_error()
  return 1
2453}
2454
2455// THE one use site, shared by the read path (parse_primary_local_or_const, which every bare name goes
2456// through -- deref, call argument, initializer, all of it) and the three statement write paths
2457// (`*p = v`, `p[i] = v`, `p.f = v`, which consume their identifier without reaching parse_primary).
2458// Reports EVERY use rather than one per local: the refusal is a diagnostic, not a die, and a ratchet
2459// needs the census.  NX_DIAG_MAX_ERRS still caps the volume.
2460func own_check_use(P: *Parser, L: *Local, tok: *Tok) -> i64 {
  if own_check_live() != 1 { return 0 }
  if L == (0 as *Local) { return 0 }
  if L.own_state == OWN_MOVED { return own_refuse(tok_text_ptr(tok), tok.line, tok.col, OWN_MOVED, L.own_line) }
  if L.own_state == OWN_RELEASED { return own_refuse(tok_text_ptr(tok), tok.line, tok.col, OWN_RELEASED, L.own_line) }
  return 0
2466}
2467
2468// Resolve an identifier token to a local and end its ownership.  Silent when the name is not a
2469// tracked owner: that is the DECLARED FLOOR speaking (a param, a field-loaded pointer, an allocator
2470// this rung cannot see), not a user error, and refusing there would reject correct code for the sake
2471// of a limitation of this checker.  Already MOVED or RELEASED is silent here too -- the read of the
2472// name in the very statement doing the second move or free was already refused by own_check_use, and
2473// saying it twice would make one defect look like two.
2474func own_mark_named(P: *Parser, tok: *Tok, st: i64) -> i64 {
  if own_check_live() != 1 { return 0 }
  if tok == (0 as *Tok) { return 0 }
  let L: *Local = find_local(P, tok_text_ptr(tok))
  if L == (0 as *Local) { return 0 }
  if L.own_state != OWN_LIVE { return 0 }
  own_mark(P, L, st, tok.line)
  return 0
2482}
2483
2484// __move's argument adjudication.  A NON-NAME argument (`__move(f())`, `__move(s.buf)`) is REFUSED
2485// under the mode: a transfer point that cannot name what it transferred is unreadable to this rung
2486// AND to the next human, and unlike the floors above this one the programmer can fix it in one line.
2487func own_move_arg(P: *Parser, tok: *Tok) -> i64 {
  if own_check_live() != 1 { return 0 }
  if tok.kind != TK_IDENT {
      nx_diag_at(tok.line)
      nx_diag_puts(": __move needs the NAME of an owned buffer, not an expression (--ownership mode).\n" as *u8)
      nx_diag_caret(tok.line, tok.col)
      nx_diag_puts("  why the build stopped: a move has to say which name stops being valid; an expression has no name to invalidate, so nothing after this point could be checked and the mode would silently protect nothing.\n" as *u8)
      nx_diag_puts("  fix: bind the buffer to a local first -- `let buf = <expr>` -- then `__move(buf)`.\n" as *u8)
      nx_diag_puts("  capability=own-check-move -- roadmap: nishifamily.com/compare/lang\n" as *u8)
      nx_diag_note_error()
      return 1
  }
  let L: *Local = find_local(P, tok_text_ptr(tok))
  if L == (0 as *Local) { return 0 }
  if L.own_state != OWN_LIVE { return 0 }
  own_mark(P, L, OWN_MOVED, tok.line)
  return 0
2504}
2505
2506// Parse a postfix chain of `.field` and `[index]` on an existing
2507// Value id.  Each field access emits GEP + LOAD using the struct's
2508// field offsets; each index emits (base + index*elem_size) + LOAD
2509// with element size driven by the current type's pointee.  Returns
2510// the final Value id; loops until the next token isn't a dot or
2511// open bracket.  Caller supplies an initial type hint; subsequent
2512// chains infer from the resolved field/element type.
2513//
2514// Arity ceiling for INDIRECT (fn-pointer) calls, shared by the named-local
2515// path (parse_primary_call) and the postfix field path below so the two can
2516// never drift.  23 = the IR's operand cap: op0 carries the fn-ptr and op1..op23
2517// the arguments.  Was 6 (register-only codegen) until 2026-07-25, when the x86
2518// backend gained real stack args for indirect calls; the RISC-V backend fails
2519// loud past 7 until its own stack-arg arc lands.
2520const NX_FNPTR_MAX_ARGS: i64 = 23
2521// LN29 (2026-09-02): THE ONE FIELD RESOLVER for `x.f` -- the symbol the lang.matrix watch names
2522// (parse_field_of_struct). MEASURED: `f.name_bytes` on a *Function (which declares name_start/name_len)
2523// compiled and printed junk, because every `.f` site returned the BASE unchanged when the field was not
2524// found (T#field-chain-silent-return): the read took the pointer itself as the value. That silent path is
2525// still needed for an UNRESOLVED struct (a forward stub or a call's return type whose fields are not known
2526// yet -- n_fields == 0; the self-build relies on it, a loud fail there was tried and reverted). So the rule
2527// is exact: a struct that DECLARES fields and does not declare this one is refused, in the teaching voice,
2528// naming the struct and the fields it really has. A stub stays silent, as before, by construction.
2529func parse_field_of_struct(P: *Parser, stty: *Type, ftok: *Tok, fname: *u8, flen: i64) -> *StructField {
  let field: *StructField = ir_type_struct_find_field(stty, fname, flen)
  if field != (0 as *StructField) { return field }
  if stty.kind != TY_STRUCT { return field }
  if stty.n_fields <= 0 { return field }
  nx_diag_at(ftok.line)
  nx_diag_puts(": struct '" as *u8)
  if stty.name_len > 0 { sys_write(2, stty.name_bytes, stty.name_len) } else { nx_diag_puts("(anonymous)" as *u8) }
  nx_diag_puts("' has no field named '" as *u8)
  sys_write(2, fname, flen)
  nx_diag_puts("'.\n" as *u8)
  nx_diag_caret(ftok.line, ftok.col)
  nx_diag_puts("  why the build stopped: a field is an offset into this struct's layout, and a name the struct does not declare has no offset -- until today the read silently took the base pointer itself as the value (and a store would have scribbled at offset 0): a wrong value that compiles, links and runs.\n" as *u8)
  nx_diag_puts("  fix: use one of the fields this struct declares: " as *u8)
  let fbase: i64 = stty.fields as i64
  var fi: i64 = 0
  while fi < stty.n_fields {
      let sf: *StructField = (fbase + fi * 32) as *StructField
      if fi > 0 { nx_diag_puts(", " as *u8) }
      sys_write(2, sf.name_bytes, sf.name_len)
      fi = fi + 1
  }
  nx_diag_puts(" -- or read it through the struct that really declares it.\n" as *u8)
  nx_diag_note_error()
  return field
2554}
2555
2556func parse_field_chain(P: *Parser, base: i64, base_ty: *Type) -> i64 {
  nx_assert_ptr(P.current_fn as *u8, "parse_field_chain: P.current_fn" as *u8)
  nx_assert(P.current_fn.values_cap > 0,
            "parse_field_chain: P.current_fn init" as *u8)
  // LN3: snapshot the provenance handshake AT ENTRY.  The index expression inside a `[...]`
  // arm re-enters parse_primary and overwrites the statics (that nested entry snapshots its
  // own base -- recursion is correct by the same rule).  Only the FIRST chain link can match:
  // after one `[i]` or `.f`, v is a fresh value id and the compare below goes quiet.
  let pp_v: i64 = g_pp_base_val
  let pp_ext: i64 = g_pp_base_ext
  var v: i64 = base
  var ty: *Type = base_ty
  var keep_going: i64 = 1
  while keep_going == 1 {
      let k: i64 = peek_kind(P)
      if k == TK_DOT {
          advance_tok(P)
          let ftok: *Tok = advance_tok(P)
          let fname: *u8 = tok_text_ptr(ftok)
          var flen: i64 = 0
          while fname[flen] != 0 { flen = flen + 1 }
          // Auto-deref: if ty is *Struct, look through the pointer.
          var stty: *Type = ty
          if stty != (0 as *Type) {
              if stty.kind == TY_PTR {
                  if stty.pointee != (0 as *Type) { stty = stty.pointee }
                  oe_chain_check(P, v)             // LN2: `p.f` reads through the pointer p
              }
          }
          if stty == (0 as *Type) { return v }
          let field: *StructField = parse_field_of_struct(P, stty, ftok, fname, flen)
          // T#field-chain-silent-return (KNOWN, four-pillar in progress):
          // when the field is not found on `stty` this returns the base
          // unchanged.  That SILENTLY mis-compiles `call().field` when the
          // callee's return-type struct fields are unresolved (it yields the
          // POINTER -- the count_ok=0 bug in the netscope verdict layer).
          // A loud-fail PREVENT here was TRIED and REVERTED: it breaks the
          // compiler's own self-build (nx_compile_x86.nx / main.nx rely on
          // the silent return-base for `.toks`, a deeper type-resolution
          // gap).  FIX today = bind call results to a typed temp before
          // `.field` (the idiom used everywhere).  The real PREVENT needs
          // the return-type-struct-field resolution fixed first, THEN this
          // can loud-fail safely.  See NISHI_DEBT_LEDGER.tsv.
          if field == (0 as *StructField) { return v }
          let off: i64 = safe_const_i64(P, field.offset, "parse.nx:LINE-field.offset" as *u8)
          let addr: i64 = ir_emit_gep(P.current_bb, v, off, field.ty)
          // Bug fix 2026-05-16 (substrate-bisect):
          // Don't LOAD the GEP result when the field is itself a
          // struct -- it's an intermediate address that the next
          // chain iteration will offset from.  The original code
          // unconditionally loaded after every GEP, treating
          // struct-typed intermediates as pointers and producing
          // GEP -> LOAD -> GEP -> LOAD instead of the correct
          // GEP -> GEP -> LOAD.  The C anchor handled this right;
          // this brings nx_parse.nx into parity.
          var is_struct_field: i64 = 0
          if field.ty != (0 as *Type) {
              if field.ty.kind == TY_STRUCT { is_struct_field = 1 }
          }
          if is_struct_field == 1 {
              v = addr
          } else {
              v = ir_emit_load(P.current_bb, addr, field.ty)
          }
          ty = field.ty
      }
      if k == TK_LBRACKET {
          advance_tok(P)
          let idx: i64 = parse_expr(P)
          match_kind(P, TK_RBRACKET)
          // Element size from the pointer/array pointee; default i64.
          var elem_sz: i64 = 8
          var elem_ty: *Type = ir_type_i64()
          var is_arr_r: i64 = 0
          var is_slice_r: i64 = 0
          if ty != (0 as *Type) {
              if ty.kind == TY_PTR {
                  if ty.pointee != (0 as *Type) {
                      elem_ty = ty.pointee
                      if elem_ty.size > 0 { elem_sz = elem_ty.size }
                  }
              }
              if ty.kind == TY_ARRAY {
                  is_arr_r = 1
                  if ty.pointee != (0 as *Type) {
                      elem_ty = ty.pointee
                      if elem_ty.size > 0 { elem_sz = elem_ty.size }
                  }
              }
              if ty.kind == TY_SLICE {
                  is_slice_r = 1
                  if ty.pointee != (0 as *Type) {
                      elem_ty = ty.pointee
                      if elem_ty.size > 0 { elem_sz = elem_ty.size }
                  }
              }
          }
          // SLICE READ: v is the HANDLE (address of {data,len}). Read the length FIRST, check the
          // index against it, and only then load the data pointer -- so the load of `data` happens
          // in the block that is reached only when the index is known good. After this, v holds
          // the data pointer and the ordinary POINTER path below computes the element address.
          if is_slice_r == 1 {
              let so_v: i64 = safe_const_i64(P, NX_SLICE_LEN_OFFSET, "parse.nx:slice-rd-off" as *u8)
              let sla: i64 = ir_emit_binop(P.current_bb, OP_ADD, v, so_v, ir_type_i64())
              let slen: i64 = ir_emit_load(P.current_bb, sla, ir_type_i64())
              emit_bounds_check_v(P, idx, slen)
              v = ir_emit_load(P.current_bb, v, ir_type_i64())
          }
          // SPATIAL SAFETY (CWE-787/125): a fixed array [N]T indexed by a COMPILE-TIME CONSTANT is bounds-
          // checked at COMPILE TIME -- zero runtime cost, zero false positives (both N and the index are
          // known). Runtime indices + raw pointers stay unchecked = the honest C-class part; only [N]T
          // carries a length N. Moves nx_lang_sota_census's a[2]-on-[2] probe from silent-OOB to compile error.
          if is_arr_r == 1 {
              if ty != (0 as *Type) {
                  if elem_sz > 0 {
                      let idxv_r: *Value = val_at(P.current_fn, idx)
                      let nelem_r: i64 = ty.size / elem_sz
                      if idxv_r.kind == VK_CONST_INT {
                          if idxv_r.const_int < 0 { parse_die("fixed-array index < 0" as *u8, 21) }
                          if idxv_r.const_int >= nelem_r { parse_die("fixed-array index >= size" as *u8, 25) }
                      }
                      // RUNTIME index -> inject the check (see emit_bounds_check). This is the
                      // half the compile-time test above cannot reach, and it was the measured
                      // gap: nx_spatial_probe's buf[6] on a [4]i64 read out of range silently.
                      if idxv_r.kind != VK_CONST_INT { emit_bounds_check(P, idx, nelem_r) }
                  }
              }
          }
          // LN3 READ leg (CWE-125): a raw pointer base whose Local carries a provenance extent
          // is checked like a typed array.  v == pp_v holds exactly when this base IS the
          // let-local parse_primary_local_or_const just resolved (value ids are monotonic per
          // function, so no other value can match).  pp_idx_check gates on --ptrprov itself.
          // LN2: `p[i]` reads through a POINTER p (array and slice bases are not pointers).
          if is_arr_r == 0 { if is_slice_r == 0 { oe_chain_check(P, v) } }
          var pp_go_r: i64 = 0
          if is_arr_r == 0 { if is_slice_r == 0 { if v == pp_v { if pp_ext > 0 { pp_go_r = 1 } } } }
          if pp_go_r == 1 { if elem_sz > 0 { if ty != (0 as *Type) { if ty.kind == TY_PTR {
              // fn().field is a documented miscompile class -- hoist the token first.
              let pp_tok_r: *Tok = tok_at(P.toks, P.pos)
              pp_idx_check(P, idx, pp_ext / elem_sz, pp_tok_r.line)
          } } } }
          let esize: i64 = safe_const_i64(P, elem_sz, "parse.nx:LINE-elem_sz" as *u8)
          let off2: i64 = ir_emit_binop(P.current_bb, OP_MUL,
                                         idx, esize, ir_type_i64())
          // ARRAY: v is the frame ADDRESS -> GEP (leaq base + off). POINTER: v is the loaded
          // pointer VALUE -> OP_ADD. Both then LOAD the element.
          var addr2: i64 = 0
          if is_arr_r == 1 {
              addr2 = ir_emit_gep(P.current_bb, v, off2, elem_ty)
          } else {
              addr2 = ir_emit_binop(P.current_bb, OP_ADD, v, off2, ty)
          }
          // AGGREGATE element (struct/array): KEEP its ADDRESS so a following `.field` / `[j]` GEPs
          // off it.  Loading it (the scalar/pointer path) reads the first 8 bytes as a value and then
          // dereferences THAT as the field base -> wild access (arr-of-struct `arr[i].x` gave 0 / crash).
          var elem_is_agg: i64 = 0
          if elem_ty != (0 as *Type) {
              if elem_ty.kind == TY_STRUCT { elem_is_agg = 1 }
              if elem_ty.kind == TY_ARRAY { elem_is_agg = 1 }
          }
          if elem_is_agg == 1 {
              v = addr2
          }
          if elem_is_agg == 0 {
              v = ir_emit_load(P.current_bb, addr2, elem_ty)
          }
          ty = elem_ty
      }
      // POSTFIX INDIRECT CALL through a fn-pointer field: `obj.fn_field(args)`.
      // This is a PARITY GAP, not a regression: the C anchor parse.c:1498 has
      // carried this branch all along, the self-hosted parser never did (debt
      // seq715, diagnosis corrected 2026-07-25).  Without it the loop exited on
      // TK_LPAREN and handed back the LOADED FUNCTION ADDRESS while `(args)` was
      // re-parsed as a stray parenthesised expression and DISCARDED -- the method
      // never ran and the caller got a code-segment pointer that reads as a
      // plausible integer.  It failed OPEN, which is why every multi-method vtable
      // in the tree (CLAUDE rule 6 OOP) was silently broken and nobody saw it.
      // ADDITIVE: gated on ty.kind == TY_FUNC, so any source that compiled before
      // this change takes the byte-identical path it took before.
      var did_call: i64 = 0
      if k == TK_LPAREN {
          var is_fnptr: i64 = 0
          if ty != (0 as *Type) {
              if ty.kind == TY_FUNC { is_fnptr = 1 }
          }
          if is_fnptr == 1 {
              advance_tok(P)
              let cargs_raw: *u8 = sys_mmap(NX_FNPTR_MAX_ARGS * 8 + 16)
              let cargs: *i64 = cargs_raw as *i64
              var cn: i64 = 0
              if peek_kind(P) != TK_RPAREN {
                  let c0: i64 = parse_expr(P)
                  cargs[cn] = c0
                  cn = cn + 1
                  while peek_kind(P) == TK_COMMA {
                      advance_tok(P)
                      if cn >= NX_FNPTR_MAX_ARGS {
                          parse_die("postfix fn-ptr call exceeds max args (register-only indirect codegen)" as *u8, 32)
                      }
                      let cx: i64 = parse_expr(P)
                      cargs[cn] = cx
                      cn = cn + 1
                  }
              }
              match_kind(P, TK_RPAREN)
              // TY_FUNC keeps its RETURN type in `pointee` (parse_type, nx_types.nx).
              var cret: *Type = ty.pointee
              if cret == (0 as *Type) { cret = ir_type_i64() }
              v = ir_emit_call_indirect(P.current_bb, v, cret, cargs, cn)
              ty = cret
              did_call = 1
          }
      }
      if k != TK_DOT {
          if k != TK_LBRACKET {
              if did_call == 0 { keep_going = 0 }
          }
      }
  }
  return v
2776}
2777
2778func parse_primary(P: *Parser) -> i64 {
  nx_assert_ptr(P.current_fn as *u8, "parse_primary: P.current_fn" as *u8)
  nx_assert(P.current_fn.values_cap > 0,
            "parse_primary: P.current_fn init" as *u8)
  let t: *Tok = tok_at(P.toks, P.pos)
  if t.kind == TK_INT {
      advance_tok(P)
      return safe_const_i64(P, t.int_val, "parse.nx:LINE-t.int_val" as *u8)
  }
  if t.kind == TK_FLOAT {
      // Default-precision (f64) literal.  Convert (whole, frac_num,
      // frac_digits) -> IEEE 754 binary64 bit pattern.  Store the
      // bits in const_int; attach TY_F64 to the Value so downstream
      // passes (regalloc f-reg partition, rv_emit_fbinop) route it
      // as a double.
      //
      // Default literal type is f64 -- matches Rust / C-double / Zig
      // and gives sketches/numerics enough precision out of the box.
      // Explicit f32 selection: literal suffix `1.5f32` (TK_FLOAT_F32
      // path below) or type-context inference at `let x: f32 = ...`
      // sites (handled in parse_stmt_let by re-emitting the constant
      // as f32 when the LHS type demands it).
      advance_tok(P)
      let bits: i64 = fp64_from_dec(t.text2, t.text3, t.text4)   // LN36/LN40: (m, e10, sticky)
      let vid: i64 = safe_const_i64(P, bits, "parse.nx:LINE-bits" as *u8)
      let base: i64 = P.current_fn.values as i64
      let v: *Value = (base + vid * 48) as *Value
      v.ty = alloc_type(TY_F64, 8, 8)
      return vid
  }
  if t.kind == TK_FLOAT_F32 {
      // Explicit single-precision literal (`1.5f32`).  Same packing
      // as TK_FLOAT but routes through fp32_from_parts + TY_F32.
      advance_tok(P)
      // LN36: an f32 literal with an exponent packs as f64 and downcasts; the legacy triple stays
      // byte-identical for every f32 literal that has none.
      var bits32: i64 = 0
      if t.text5 == 1 { bits32 = fp64_to_fp32(fp64_from_dec(t.text2, t.text3, t.text4)) }
      if t.text5 == 0 { bits32 = fp32_from_parts(t.int_val, t.text0, t.text1) }
      let vid: i64 = safe_const_i64(P, bits32, "parse.nx:LINE-bits32" as *u8)
      let base: i64 = P.current_fn.values as i64
      let v: *Value = (base + vid * 48) as *Value
      v.ty = alloc_type(TY_F32, 4, 4)
      return vid
  }
  if t.kind == TK_TRUE  { advance_tok(P); return safe_const_i64(P, 1, "parse.nx:LINE-const1" as *u8) }
  if t.kind == TK_FALSE { advance_tok(P); return safe_const_i64(P, 0, "parse.nx:LINE-const0" as *u8) }
  // String literal.  Registers the bytes as a Module global, then
  // builds a VAL_GLOBAL_ADDR Value referencing that global's id.
  // The backend lowers this to `la reg, .Lg<id>` (or the global's
  // name when one was registered -- strings are anonymous so they
  // fall through to the .Lg id form).
  // V-LANGEXT M2: if-then-else as expression.
  //
  //   `if cond then expr_t else expr_f`
  //
  // Distinct from statement-form `if c { ... }` (consumed at
  // parse_stmt level before reaching parse_primary). Matches
  // Haskell / OCaml / Elm convention; substrate authors already
  // use this syntax.
  //
  // HYGIENE GUARDS (per operator 2026-05-27 "we want to avoid
  // hoisting issues and namespace issues and all the other hygiene
  // issues that make languages suck, really research and make sure
  // we are adding good functionality not future nightmares"):
  //
  //   G1 REQUIRED `then`: TK_THEN must follow cond; if absent the
  //      parser dies clearly. This is the syntactic anchor that
  //      disambiguates expression-form from statement-form (which
  //      doesn't use TK_THEN at all).
  //   G2 REQUIRED `else`: TK_ELSE must follow then-branch; no
  //      orphan-if at expression position. Matches Haskell / Elm
  //      (Rust without-else returns unit which doesn't compose at
  //      expression position; we reject explicitly).
  //   G3 DEPTH LIMIT: P.ifexp_depth incremented at entry; rejected
  //      if exceeds NX_PARSE_IFEXP_MAX_DEPTH (16). Prevents any
  //      pathological codegen path that could blow the stack at
  //      compile or runtime. Real-world readable code never nests
  //      ternary/if-expr beyond 4-5 levels; 16 is generous.
  //   G4 TYPE-COMPATIBLE BRANCHES: both branches must produce
  //      values whose ir types match (V1: same Type pointer or
  //      same kind+size; rejects mismatch). Matches Rust / Zig /
  //      Elm / Haskell. Prevents the JS-style implicit-coerce-to-
  //      worst-common-type bugs.
  //   G5 SINGLE COND EVAL: parse_expr(P) for cond runs ONCE before
  //      the BB split. Side effects in cond happen exactly once.
  //   G6 SINGLE BRANCH EVAL: ir_emit_br_cond emits a hard branch;
  //      ONLY the chosen branch BB runs at runtime. No speculative
  //      both-eval (rules out unintended side effects + duplicate
  //      work). Lexical isolation: branches use fresh BBs so any
  //      temporary IR values don't leak to merge BB (NishiLang
  //      already lexically scoped).
  //
  if t.kind == TK_IF {
      advance_tok(P)                              // eat 'if'
      // G3: depth check on ENTRY (so the first if-expr-call counts).
      P.ifexp_depth = P.ifexp_depth + 1
      if P.ifexp_depth > 16 {
          parse_die("if-expression nested too deep (max 16); refactor with named locals" as *u8, 70)
      }
      let cond: i64 = parse_expr(P)               // G5
      // G1
      if peek_kind(P) != TK_THEN {
          parse_die("expected 'then' after if-expression condition" as *u8, 46)
      }
      advance_tok(P)                              // eat 'then'
      // Allocate one result slot per if-expression (function-local
      // alloca). Pathological depth is bounded by G3 so per-function
      // alloca count is bounded.
      let result_ty: *Type = ir_type_i64()
      let result_addr: i64 = ir_emit_alloca(P.current_bb, result_ty)
2889
      let then_bb:  *BasicBlock = ir_block_new(P.current_fn)   // "ifexp_then" (label dropped; see ARITY FIX above)
      let else_bb:  *BasicBlock = ir_block_new(P.current_fn)   // "ifexp_else"
      let merge_bb: *BasicBlock = ir_block_new(P.current_fn)   // "ifexp_merge"
2893
      ir_emit_br_cond(P.current_bb, cond, then_bb, else_bb)   // G6
2895
      // then branch
      P.current_bb = then_bb
      let then_v: i64 = parse_expr(P)
      ir_emit_store(P.current_bb, result_addr, then_v, result_ty)
      ir_emit_br(P.current_bb, merge_bb)
2901
      // G2
      if peek_kind(P) != TK_ELSE {
          parse_die("if-expression requires 'else' branch (no orphan-if at expression position)" as *u8, 76)
      }
      advance_tok(P)                              // eat 'else'
2907
      // else branch
      P.current_bb = else_bb
      let else_v: i64 = parse_expr(P)
      ir_emit_store(P.current_bb, result_addr, else_v, result_ty)
      ir_emit_br(P.current_bb, merge_bb)
2913
      // merge: load result
      P.current_bb = merge_bb
      let result: i64 = ir_emit_load(P.current_bb, result_addr, result_ty)
2917
      // G4 type-check enforcement queued V+1 (needs IR-value->type
      // lookup wiring; current pipeline lacks a portable getter).
      // For V1 both branches are TREATED as i64 (the most common
      // case). Mismatched-type if-expr produces a warning at IR
      // validate (existing pass) but doesn't break compile.
2923
      P.ifexp_depth = P.ifexp_depth - 1
      return result
  }
2927
  if t.kind == TK_STRING {
      advance_tok(P)
      // Prefer the heap-grown str_data buffer (handles literals
      // longer than the 63-byte inline text[] cap).  Fall back to
      // the inline text[] when str_data is NULL (legacy callers).
      // Same fix as nxc2/parse.c TK_STRING.
      var bytes: *u8 = 0 as *u8
      var blen:  i64 = 0
      if t.str_data != 0 {
          bytes = t.str_data as *u8
          blen  = t.str_len
      }
      if t.str_data == 0 {
          bytes = tok_text_ptr(t)
          while bytes[blen] != 0 { blen = blen + 1 }
      }
      let gid: i64 = ir_add_global_string(P.module, bytes, blen)
      // Type: pointer-to-u8 (string literals are *u8 in practice).
      let pt: *Type = alloc_type(TY_PTR, 8, 8)
      let u8ty: *Type = alloc_type(TY_I8, 1, 1)
      pt.pointee = u8ty
      // SAME ROOT DEFECT AS THE STRING-CONST PATH (seq1552): an inline string literal is also a
      // pointer value, so `"abc"[0]` must run the postfix chain or its `[0]` desyncs the parser.
      // Fixing only the const half would leave the class alive on the literal half.  Gated on an
      // actual postfix token, so the ~every-string-in-the-corpus no-postfix case is untouched.
      let slv: i64 = ir_global_value(P.current_fn, gid, pt)
      if peek_kind(P) == TK_LBRACKET { return parse_field_chain(P, slv, pt) }
      if peek_kind(P) == TK_DOT      { return parse_field_chain(P, slv, pt) }
      return slv
  }
  if t.kind == TK_LPAREN {
      advance_tok(P)
      let e: i64 = parse_expr(P)
      advance_tok(P)    // expect ')'
      // SAME ROOT DEFECT AS THE STRING-LITERAL PATH ABOVE (seq1552 class): a parenthesized
      // expression is a value like any other, so `(p as *u8)[0]` / `(x).f` must run the
      // postfix chain.  Without this, the pending `[`/`.` silently TERMINATED the expression:
      // the pointer value landed in the receiver truncated and the index was DROPPED
      // (measured: `("AB" as *u8)[0]` compiled clean and returned addr&0xFF=213, not 65;
      // in an if-condition the leftover `[` desynced the parser).  Gated on an actual
      // postfix token so every plain `(expr)` in the corpus is untouched.
      if peek_kind(P) == TK_LBRACKET {
          let epv: *Value = val_at(P.current_fn, e)
          return parse_field_chain(P, e, epv.ty)
      }
      if peek_kind(P) == TK_DOT {
          let epv2: *Value = val_at(P.current_fn, e)
          return parse_field_chain(P, e, epv2.ty)
      }
      return e
  }
  // Ident -> call, local, or module const.  Hoisted helper to
  // shrink parse_primary's stack frame (task #21 codegen workaround).
  if t.kind == TK_IDENT {
      return parse_primary_ident(P, t)
  }
  // PREVENT pillar (four-pillar), architecture-respecting denylist.
  // Die ONLY for tokens that can NEVER start a primary expression: the
  // operator range [TK_PLUS .. TK_SHR] (40..60) plus `@` `#` `=>`.
  // parse_unary consumes every prefix-unary operator (- ! ~ & *) BEFORE
  // calling parse_primary, so an operator reaching THIS fallthrough is
  // always a missing-operator desync (the `~` class that surfaced as
  // "address-of unknown local") or a parser regression -- never
  // legitimate.  Every OTHER token (structural closers/separators `;`
  // `)` `]` `,` `}` `->` `:` `..`, EOF, ...) can legitimately land here
  // as an empty-expression terminator, where the historical `return 0`
  // is the contract real code depends on (empty statements, function-
  // pointer types, empty arg positions) -- preserve it.  This kills the
  // silent-desync class WITHOUT fighting the parser's return-0 recovery.
  // LN13b: a function literal is an EXPRESSION. This must sit BEFORE the fallthrough denylist
  // below: TK_FUNC is outside every deny range, so without it the token reaches `return 0`
  // UNCONSUMED and the parser desyncs into the next statement -- which is why the failure used
  // to surface as a brace-balance complaint pointing at innocent code.
  if t.kind == TK_FUNC { return parse_func_literal(P) }
  let tk: i64 = t.kind
  var bad: i64 = 0
  if tk >= TK_PLUS { if tk <= TK_SHR { bad = 1 } }
  if tk == TK_AT { bad = 1 }
  if tk == TK_HASH { bad = 1 }
  if tk == TK_FAT_ARROW { bad = 1 }
  if bad == 1 {
      // LOCATE IT. This was the ONLY fatal in the parser that printed no file, no line and no caret,
      // while every other diagnostic here says exactly where it is -- and it is the error that
      // TERMINATES a desynced build, so the one message a reader most needs to place was the one that
      // refused to say. MEASURED COST (2026-08-16): an nx_browser COMPILE-FAIL was chased through seven
      // refuted hypotheses and five full-closure builds because its final line carried no location.
      // The anchor is the construct's OWN token, never P.pos at error time -- the parse_primary_call
      // lesson, reused here instead of re-derived.
      nx_diag_at(t.line)
      nx_diag_puts(": an operator starts this expression, so whatever it was meant to continue is not here (parser desync; token kind=" as *u8)
      nx_put_dec_err(t.kind)
      nx_diag_puts(")\n" as *u8)
      nx_diag_caret(t.line, t.col)
      nx_diag_puts("  why the build stopped: an operator can never START an expression at this point --\n" as *u8)
      nx_diag_puts("  parse_unary has already consumed every prefix form (- ! ~ & *), so an operator arriving\n" as *u8)
      nx_diag_puts("  here means the expression it belongs to was already closed off before it.\n" as *u8)
      nx_diag_puts("  fix: the usual cause is one expression split across lines with the operator LEADING the\n" as *u8)
      nx_diag_puts("  continuation line. Put the operator at the END of the previous line, or bind each part to\n" as *u8)
      nx_diag_puts("  a named value and combine them on one line.\n" as *u8)
      sys_exit(2)
  }
  return 0
3030}
3031
3032// ---- parse_primary TK_IDENT helpers (hoisted for stack-frame slim) ----
3033
3034func parse_primary_ident(P: *Parser, t: *Tok) -> i64 {
  advance_tok(P)
  let name: *u8 = tok_text_ptr(t)
  if peek_kind(P) == TK_COLON_COLON {
      return parse_primary_qualified_variant(P, name)
  }
  if name[0] == 0x5F {
      if name[1] == 0x5F {
          let r: i64 = parse_primary_intrinsic(P, name)
          if r >= 0 { return r }
      }
  }
  if peek_kind(P) == TK_LPAREN {
      return parse_primary_call(P, name)
  }
  return parse_primary_local_or_const(P, name)
3050}
3051
3052func parse_primary_qualified_variant(P: *Parser, name: *u8) -> i64 {
  advance_tok(P)
  let vtok: *Tok = advance_tok(P)
  let vname: *u8 = tok_text_ptr(vtok)
  // SIZED FROM ITS INPUTS, not a fixed 80 (2026-08-07). This buffer holds a qualified name plus its terminator,
  // whose length is UNBOUNDED because identifiers are, and there was no length check of any
  // kind. Page granularity hid it -- an 80-byte request used to get a whole 4096-byte page, so
  // the overflow landed in 4KB of private slack. The small-allocation arena packs neighbours
  // together and exposed it: the arena ring canary reported overruns of an 80-byte allocation
  // reaching 33-64 bytes past the end, corrupting the parser's type table and producing 14
  // SPURIOUS type diagnostics against declarations that were correct.
  var qn0: i64 = 0
  while name[qn0] != 0 { qn0 = qn0 + 1 }
  var qv0: i64 = 0
  while vname[qv0] != 0 { qv0 = qv0 + 1 }
  let qbuf: *u8 = sys_mmap(qn0 + qv0 + 3)
  var nl: i64 = 0
  while name[nl] != 0 { qbuf[nl] = name[nl]; nl = nl + 1 }
  qbuf[nl] = 0x3A; nl = nl + 1
  qbuf[nl] = 0x3A; nl = nl + 1
  var vl: i64 = 0
  while vname[vl] != 0 { qbuf[nl + vl] = vname[vl]; vl = vl + 1 }
  qbuf[nl + vl] = 0
3075
  let out_raw: *u8 = sys_mmap(16)
  let out: *i64 = out_raw as *i64
  *out = 0
  lookup_mconst(P, qbuf, out)
  let disc: i64 = *out
3081
  var has_pay: i64 = 0
  var pay_v: i64 = 0
  if peek_kind(P) == TK_LPAREN {
      advance_tok(P)
      if peek_kind(P) != TK_RPAREN {
          pay_v = parse_expr(P)
          has_pay = 1
      }
      match_kind(P, TK_RPAREN)
  }
3092
  let ee: *EnumEntry = lookup_enum(P, name)
  if ee != (0 as *EnumEntry) {
      if ee.has_payload == 1 {
          if ee.shadow_ty != (0 as *Type) {
              let addr: i64 = ir_emit_alloca(P.current_bb, ee.shadow_ty)
              let off0: i64 = safe_const_i64(P, 0, "parse.nx:variant-z" as *u8)
              let tag_addr: i64 = ir_emit_gep(P.current_bb, addr, off0, ir_type_i64())
              let disc_v: i64 = safe_const_i64(P, disc, "parse.nx:variant-d" as *u8)
              ir_emit_store(P.current_bb, tag_addr, disc_v, ir_type_i64())
              let off8: i64 = safe_const_i64(P, 8, "parse.nx:variant-8" as *u8)
              let pay_addr: i64 = ir_emit_gep(P.current_bb, addr, off8, ir_type_i64())
              var pv: i64 = pay_v
              if has_pay == 0 { pv = safe_const_i64(P, 0, "parse.nx:variant-p0" as *u8) }
              ir_emit_store(P.current_bb, pay_addr, pv, ir_type_i64())
              // Hand back the struct's BASE ADDRESS as an ordinary SSA value.
              // Returning the alloca id itself hands the caller a SLOT, and every
              // as-VALUE consumer (return, binop, call argument) DEREFERENCES a
              // slot -- x86ctx_load_value_v emits `movq storage(%rbp)`. So
              // `return Result::Ok(v)` compiled to a load of the shadow's first
              // word and returned the TAG instead of the pointer: Ok(x) came back
              // as 0, indistinguishable from null, and Err(x) as 1, an equally
              // bogus pointer that merely looked non-null. Measured 2026-09-04.
              // A GEP result IS a materialised address -- x86ctx_emit_gep loads
              // the base as-address and stores rax into the result slot -- which
              // is exactly what a pointer-to-shadow value must be. The sibling
              // half of this bug (a GEP whose BASE is an alloca) was already
              // fixed in x86ctx_emit_gep and names this same constructor in its
              // comment; this is the half that was left.
              // Emitted AFTER the stores and consumed ONLY as the return value:
              // a GEP that feeds a load/store can be folded into that
              // instruction's SIB byte and marked dead (G8, sib_dead), which
              // would hand back a slot nothing ever wrote.
              let base_off: i64 = safe_const_i64(P, 0, "parse.nx:variant-base" as *u8)
              let base_addr: i64 = ir_emit_gep(P.current_bb, addr, base_off, ir_type_i64())
              return base_addr
          }
      }
  }
  return safe_const_i64(P, disc, "parse.nx:variant-plain" as *u8)
3132}
3133
3134// Returns valueid >= 0 on match; -1 if name is not a recognised intrinsic.
3135func parse_layout_query_kind(name: *u8) -> i64 {
  var layout_query: i64 = 0
  var layout_name_n: i64 = 0
  while name[layout_name_n] != 0 { layout_name_n = layout_name_n + 1 }
  if layout_name_n == 9 { if streq_n(name, "__size_of", 9) == 1 { layout_query = 1 } }
  if layout_name_n == 10 { if streq_n(name, "__align_of", 10) == 1 { layout_query = 2 } }
  return layout_query
3142}
3143
3144func parse_layout_query_value(P: *Parser, layout_query: i64) -> i64 {
      if match_kind(P, TK_LPAREN) == 0 {
          nx_diag_puts("type-layout query requires parentheses containing a type\n" as *u8)
          nx_diag_note_error()
          return 0
      }
      let layout_type: *Type = parse_type(P)
      if match_kind(P, TK_RPAREN) == 0 {
          nx_diag_puts("type-layout query requires exactly one type, followed by ')'\n" as *u8)
          nx_diag_note_error()
      }
      if layout_type.kind == TY_PARAM {
          nx_diag_puts("type-layout query requires a concrete type; unresolved generic parameter has no qualified layout\n" as *u8)
          nx_diag_note_error()
      }
      if layout_type.size < 0 {
          nx_diag_puts("type-layout query refused an invalid negative size; allocation cannot be generated\n" as *u8)
          nx_diag_note_error()
      }
      // Use the same metadata as field addressing and array strides. This
      // exposes the current Nishi layout; it does not claim a C or WGSL ABI.
      if layout_type.kind == TY_STRUCT {
          if layout_type.size == 0 {
              nx_diag_puts("type-layout query requires a completed nonempty struct definition before use\n" as *u8)
              nx_diag_note_error()
          }
      }
      if layout_query == 1 { return layout_type.size }
      return layout_type.align
3173}
3174
3175func parse_primary_intrinsic(P: *Parser, name: *u8) -> i64 {
  let layout_query: i64 = parse_layout_query_kind(name)
  if layout_query != 0 {
      return safe_const_i64(P, parse_layout_query_value(P, layout_query), "type-layout" as *u8)
  }
  if streq_n(name, "__wfi", 5) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          match_kind(P, TK_RPAREN)
          ir_emit_wfi(P.current_bb)
          return safe_const_i64(P, 0, "parse.nx:wfi-0" as *u8)
      }
  }
  if streq_n(name, "__fence", 7) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          match_kind(P, TK_RPAREN)
          ir_emit_fence(P.current_bb)
          return safe_const_i64(P, 0, "parse.nx:fence-0" as *u8)
      }
  }
  if streq_n(name, "__mret", 6) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          match_kind(P, TK_RPAREN)
          ir_emit_mret(P.current_bb)
          return safe_const_i64(P, 0, "parse.nx:mret-0" as *u8)
      }
  }
  if streq_n(name, "__csrr", 6) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let csr_tok: *Tok = advance_tok(P)
          let csr_num: i64 = csr_tok.int_val
          match_kind(P, TK_RPAREN)
          return ir_emit_csr_read(P.current_bb, csr_num)
      }
  }
  if streq_n(name, "__csrw", 6) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let csr_tok: *Tok = advance_tok(P)
          let csr_num: i64 = csr_tok.int_val
          match_kind(P, TK_COMMA)
          let val_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          ir_emit_csr_write(P.current_bb, csr_num, val_v)
          return safe_const_i64(P, 0, "parse.nx:csrw-0" as *u8)
      }
  }
  // __slice(ptr, len) -> the handle for a []T : bind a length to a pointer.
  // Emits a 2-word header {data, len} on the frame and yields its ADDRESS. The ELEMENT TYPE is
  // NOT inferred here -- it comes from the declared type at the binding site
  // (`let s: []i64 = __slice(p, n)`), which is what makes indexing know its stride. That keeps
  // this builtin free of expression-type tracking the parser does not have.
  // NOTE (v1 limitation, deliberate): without the `: []T` annotation the local is a plain i64
  // holding a header address, and `s[i]` degrades to today's unchecked pointer arithmetic
  // rather than becoming unsafe in some NEW way. Requiring the annotation is a compile-time
  // error worth adding once slices have users.
  // ORDER MATTERS: streq_n compares only the first N bytes, so the 7-byte test for "__slice"
  // also matches "__slice_len". The longer name MUST be tested first or every __slice_len call
  // is silently parsed as a __slice construction and returns a header address instead of a
  // length. Caught by witness W8 printing len=129311793545216.
  if streq_n(name, "__slice_len", 11) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let sh_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          let lo_v: i64 = safe_const_i64(P, NX_SLICE_LEN_OFFSET, "parse.nx:slicelen-off" as *u8)
          let la: i64 = ir_emit_binop(P.current_bb, OP_ADD, sh_v, lo_v, ir_type_i64())
          return ir_emit_load(P.current_bb, la, ir_type_i64())
      }
  }
  if streq_n(name, "__slice", 7) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let sp_v: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let sl_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          let hdr_ty: *Type = alloc_type(TY_ARRAY, NX_SLICE_HDR_BYTES, 8)
          hdr_ty.pointee = ir_type_i64()
          let hdr: i64 = ir_emit_alloca(P.current_bb, hdr_ty)
          // An alloca id used as a VALUE operand AUTO-LOADS (it yields the slot's CONTENTS, not
          // its address) -- the same trap the array-decay path documents. Take the address once
          // with OP_ADDR_OF and use only that. Getting this wrong made `ADD(hdr, 8)` compute
          // data+8, so __slice wrote the LENGTH into the caller's element 1 and returned the
          // DATA pointer as the handle; every access then aliased the payload. Measured by
          // nx_bchk_dbg_addr printing delta=0 between the handle and the data pointer.
          let hdr_pt: *Type = alloc_type(TY_PTR, 8, 8)
          hdr_pt.pointee = ir_type_i64()
          let hdr_a: i64 = ir_emit_unop(P.current_bb, OP_ADDR_OF, hdr, hdr_pt)
          ir_emit_store(P.current_bb, hdr_a, sp_v, ir_type_i64())
          let off_v: i64 = safe_const_i64(P, NX_SLICE_LEN_OFFSET, "parse.nx:slice-lenoff" as *u8)
          let lenaddr: i64 = ir_emit_binop(P.current_bb, OP_ADD, hdr_a, off_v, ir_type_i64())
          ir_emit_store(P.current_bb, lenaddr, sl_v, ir_type_i64())
          return hdr_a
      }
  }
  // (__slice_len is handled ABOVE __slice -- see the ORDER MATTERS note there.)
  if streq_n(name, "__syscall", 9) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let sargs_raw: *u8 = sys_mmap(8 * 8 + 16)
          let sargs: *i64 = sargs_raw as *i64
          var sn: i64 = 0
          if peek_kind(P) != TK_RPAREN {
              sargs[sn] = parse_expr(P)
              sn = sn + 1
              while peek_kind(P) == TK_COMMA {
                  advance_tok(P)
                  if sn < 7 {
                      sargs[sn] = parse_expr(P)
                      sn = sn + 1
                  } else {
                      parse_expr(P)
                  }
              }
          }
          match_kind(P, TK_RPAREN)
          return ir_emit_syscall(P.current_bb, sargs, sn)
      }
  }
  // Hardware f32 (IEEE-754 binary32) intrinsics. A float rides as the low 32 bits
  // of an i64 carrier (NishiLang has no f32 type); the x86 backend lowers these to
  // SSE scalar-single (cvtsi2ss/addss/mulss/divss/cvttss2si). __f32_from_i64(x) ->
  // float bits; __f32_to_i64(f) -> truncated int; __f32_add/mul/div(a,b) -> float bits.
  if streq_n(name, "__f32_from_i64", 14) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32_unop(P.current_bb, OP_FCAST_I_TO_F, a_v)
      }
  }
  if streq_n(name, "__f32_to_i64", 12) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32_unop(P.current_bb, OP_FCAST_F_TO_I, a_v)
      }
  }
  // Hardware f64 (IEEE-754 binary64) conversion + sqrt intrinsics. f64 literals
  // and f64 arithmetic already carry TY_F64; these bridge int<->f64 and add sqrt.
  // __f64_from_i64(x) -> f64 bits (cvtsi2sd); __f64_to_i64(f) -> truncated int
  // (cvttsd2si); __f64_sqrt(x) -> sqrt (sqrtsd). The backend picks double
  // precision from the TY_F64 result (or, for _to_i64, from the f64 operand).
  if streq_n(name, "__f64_from_i64", 14) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f64_unop(P.current_bb, OP_FCAST_I_TO_F, a_v)
      }
  }
  if streq_n(name, "__f64_to_i64", 12) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32_unop(P.current_bb, OP_FCAST_F_TO_I, a_v)
      }
  }
  if streq_n(name, "__f64_sqrt", 10) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f64_unop(P.current_bb, OP_FSQRT, a_v)
      }
  }
  // Hardware AES-NI: __aes128_enc_block(state_ptr, roundkeys_ptr) encrypts the 16-byte
  // block at state_ptr IN PLACE using the 11 expanded round keys (176 bytes) at
  // roundkeys_ptr.  Lowered to movdqu + pxor + aesenc x9 + aesenclast (state in %xmm0).
  if streq_n(name, "__aes128_enc_block", 18) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let b_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32_binop(P.current_bb, OP_AES128_ENC_BLOCK, a_v, b_v)
      }
  }
  // Hardware SHA-NI: __sha256_ni_block(state_ptr, block_ptr, k_ptr) runs ONE full SHA-256 block
  // compression IN PLACE.  state_ptr -> 8 contiguous u32 (working state a..h == h0..h7); block_ptr
  // -> 64 raw big-endian message bytes; k_ptr -> 64 contiguous u32 round constants K[0..63].
  // Lowered to the Intel SHA extension sequence (punpck/pshufd state arrange, pshufb byte-swap,
  // 16x sha256msg1/msg2 + 2x sha256rnds2).  The software sha256_compress stays the oracle/fallback;
  // callers gate on __cpuid_ebx(7,0) bit-29 (SHA).  3 operands (op0/op1/op2), i64 result (0).
  if streq_n(name, "__sha256_ni_block", 17) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let sa: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let sb: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let sk: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_sha256_ni_block(P.current_bb, sa, sb, sk)
      }
  }
  // Q5_0 SSE unpack: __q5_unpack32(qhqs_ptr, out_i8_ptr, consts_ptr).
  if streq_n(name, "__q5_unpack32", 13) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let u0: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let u1: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let u2: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_q5unpack32(P.current_bb, u0, u1, u2)
      }
  }
  // Q4_K AVX2 unpack-and-scale: __q4k_unpack32s(qs_ptr, out_i16x64_ptr, sc_lo | sc_hi<<16).
  if streq_n(name, "__q4k_unpack32s", 15) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let k0: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let k1: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let k2: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_q4kunpack32s(P.current_bb, k0, k1, k2)
      }
  }
  // LN28 (2026-09-03): __q4k_sb_dot(sb, col, scpre, out) -- ONE WHOLE Q4_K SUPER-BLOCK.
  // BUILT AND UNWIRED UNTIL TODAY, on BOTH trees: OP_Q4KSBDOT (nx_types), ir_emit_q4ksbdot (nx_ir) and
  // x86ctx_emit_q4ksbdot (nx_x86_64_ctx) all shipped, but nothing here routed the NAME, so every program
  // calling it refused with "unhandled __ intrinsic" -- 32 of them, found by the whole-population census.
  // ★★★★★★AN INTRINSIC IS NOT SHIPPED UNTIL ITS NAME REACHES ITS EMITTER: THE OPCODE, THE IR BUILDER AND
  // THE CODEGEN CAN ALL EXIST AND THE FEATURE STILL BE UNREACHABLE FROM EVERY PROGRAM.
  if streq_n(name, "__q4k_sb_dot", 12) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let q0: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let q1: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let q2: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let q3: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_q4ksbdot(P.current_bb, q0, q1, q2, q3)
      }
  }
  // Fused wide multiply: __mul256_wide(dst_ptr, a_ptr, b_ptr) computes the 512-bit product
  // of the 256-bit little-endian integers *a * *b into *dst (8 x u64) via the ADX/BMI2
  // mulx+adcx+adox dual-carry kernel.  IN PLACE write to dst; i64 result (0).
  if streq_n(name, "__mul256_wide", 13) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let md: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let ma: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let mb: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_mul256_wide(P.current_bb, md, ma, mb)
      }
  }
  // Hardware CLMUL (PCLMULQDQ): __clmul_XY(p, q) carry-less-multiplies the X half of *p
  // by the Y half of *q (X,Y in {l,h}) and writes the 128-bit product back to *p in place.
  // The four variants are the half-products of a 128x128 GF(2) multiply -- the GHASH core.
  if streq_n(name, "__clmul_ll", 10) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b_v: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_f32_binop(P.current_bb, OP_CLMUL_LL, a_v, b_v)
      }
  }
  if streq_n(name, "__clmul_hh", 10) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b_v: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_f32_binop(P.current_bb, OP_CLMUL_HH, a_v, b_v)
      }
  }
  if streq_n(name, "__clmul_lh", 10) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b_v: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_f32_binop(P.current_bb, OP_CLMUL_LH, a_v, b_v)
      }
  }
  if streq_n(name, "__clmul_hl", 10) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b_v: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_f32_binop(P.current_bb, OP_CLMUL_HL, a_v, b_v)
      }
  }
  if streq_n(name, "__f32_add", 9) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let b_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32_binop(P.current_bb, OP_FADD, a_v, b_v)
      }
  }
  if streq_n(name, "__f32_mul", 9) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let b_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32_binop(P.current_bb, OP_FMUL, a_v, b_v)
      }
  }
  if streq_n(name, "__f32_div", 9) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let b_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32_binop(P.current_bb, OP_FDIV, a_v, b_v)
      }
  }
  // Widening SIMD dot product i16x16 -> i64 scalar.  v0.0.1 shape:
  // takes two *i64 pointers (each addressing 4 packed i64 words =
  // 16 i16 lanes), does load-load-dot in one IR op.  Self-host
  // SIMD surface first land -- bits-up from nothing.  Codegen in
  // nx_riscv.nx lowers to vsetvli e16 m1 + vle16 + vwmul.vv +
  // vwredsum.vs.
  if streq_n(name, "__simd_vdot_i16_x16", 19) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let b_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_simd_vdot_i16_x16(P.current_bb, a_v, b_v)
      }
  }
  // Packed f32x4 dot product: __f32x4_dot(a_ptr, b_ptr) where each ptr addresses 4 CONTIGUOUS
  // 4-byte f32 -> their dot as an f32 scalar (i64-carried bits).  x86 SSE movups+mulps + scalar
  // horizontal-sum (the compute-physics lever: 4 multiplies in one mulps vs 4 scalar mulss).
  if streq_n(name, "__f32x4_dot", 11) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let fa_v: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let fb_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32_binop(P.current_bb, OP_F32X4_DOT, fa_v, fb_v)
      }
  }
  // Q8_0/quantized dequant-dot lever: __f32_i8dot32(a:*i8[32], b:*f32[32])
  // -> f32 = dot of 32 sign-extended int8 with 32 f32 (SSE unrolled).
  // Monolithic Q8_0 row dot: __f32_q8row_dot(qbuf_row, a_row, nblocks).
  if streq_n(name, "__f32_q8row_dot", 15) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let rq: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let ra: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let rn: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_q8rowdot(P.current_bb, rq, ra, rn)
      }
  }
  // Deferred-hsum FMA block: __f32_i8fma32(a,b,d_bits,acc_ptr) -> acc += d*(a.b).
  if streq_n(name, "__f32_i8fma32", 13) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let fa: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let fb: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let fd: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let fac: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_i8fma32(P.current_bb, fa, fb, fd, fac)
      }
  }
  // AVX2 twin -- MUST be checked before __f32_i8dot32 (its 14-char name
  // shares the first 13 chars, so the 13-char streq_n would swallow it).
  if streq_n(name, "__f32_i8dot32a", 14) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let aa_v: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let ab_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32_binop(P.current_bb, OP_I8DOT32A, aa_v, ab_v)
      }
  }
  if streq_n(name, "__f32_i8dot32", 13) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let ia_v: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let ib_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32_binop(P.current_bb, OP_I8DOT32, ia_v, ib_v)
      }
  }
  // Packed f32x8 dot product: __f32x8_dot(a_ptr, b_ptr), each ptr -> 8 CONTIGUOUS 4-byte f32 ->
  // their dot as f32 scalar.  x86 AVX2: vmovups+vmulps (8 lanes/instr) + vextractf128 + SSE hsum.
  if streq_n(name, "__f32x8_dot", 11) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let ga_v: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let gb_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32_binop(P.current_bb, OP_F32X8_DOT, ga_v, gb_v)
      }
  }
  // FMA vector-accumulate: __f32x8_fma(acc_ptr, a_ptr, b_ptr) -> *acc += a*b (8-wide fused, no hsum)
  if streq_n(name, "__f32x8_fma", 11) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let fac: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let faa: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let fab: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32x8_fma(P.current_bb, fac, faa, fab)
      }
  }
  // horizontal sum of an 8-wide accumulator: __f32x8_hsum(acc_ptr) -> f32 (called ONCE per dot)
  if streq_n(name, "__f32x8_hsum", 12) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let fhc: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32_unop(P.current_bb, OP_F32X8_HSUM, fhc)
      }
  }
  // NO-FLOAT whole-chunk integer dot: __i16_dot(a_ptr, b_ptr, n_lanes) -> i64 = sum a[i]*b[i], accumulator register-resident (R0r-b)
  if streq_n(name, "__i16_dot", 9) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let dpa: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let dpb: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let dpn: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_i16dot(P.current_bb, dpa, dpb, dpn)
      }
  }
  // R0s-b: one Q8_0 block's int8 x i16 dot: __q8blk_i16dot(codes_ptr, x_ptr) -> i64 = sum codes[i]*x[i] over 32 lanes
  if streq_n(name, "__q8blk_i16dot", 14) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let qba: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let qbb: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_q8blkdot(P.current_bb, qba, qbb)
      }
  }
  // NO-FLOAT integer dot accumulate: __i16x16_madd(acc_ptr, a_ptr, b_ptr) -> *acc(i32x8) += vpmaddwd(a,b)
  if streq_n(name, "__i16x16_madd", 13) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let mac: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let maa: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let mab: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_i16x16_madd(P.current_bb, mac, maa, mab)
      }
  }
  if streq_n(name, "__simd_vreduce_min_i16_x16", 26) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let pmn: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_simd_vreduce_min_i16_x16(P.current_bb, pmn)
      }
  }
  if streq_n(name, "__simd_vreduce_max_i16_x16", 26) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let pmx: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_simd_vreduce_max_i16_x16(P.current_bb, pmx)
      }
  }
  if streq_n(name, "__simd_vsadd_i16_x16", 20) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let asa: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let bsa: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let osa: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_simd_vsadd_i16_x16(P.current_bb, asa, bsa, osa)
      }
  }
  if streq_n(name, "__simd_vssub_i16_x16", 20) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let ass: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let bss: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let oss: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_simd_vssub_i16_x16(P.current_bb, ass, bss, oss)
      }
  }
  if streq_n(name, "__simd_vsaddu_i16_x16", 21) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let asau: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let bsau: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let osau: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_simd_vsaddu_i16_x16(P.current_bb, asau, bsau, osau)
      }
  }
  if streq_n(name, "__simd_vssubu_i16_x16", 21) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let assu: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let bssu: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let ossu: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_simd_vssubu_i16_x16(P.current_bb, assu, bssu, ossu)
      }
  }
  // Per-lane min/max/add/sub/mul: 25-char builtins (vXXX_lane).
  if streq_n(name, "__simd_vmin_lane_i16_x16", 24) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let amn: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let bmn: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let omn: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vmin_lane_i16_x16(P.current_bb, amn, bmn, omn)
      }
  }
  if streq_n(name, "__simd_vmax_lane_i16_x16", 24) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let amx: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let bmx: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let omx: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vmax_lane_i16_x16(P.current_bb, amx, bmx, omx)
      }
  }
  if streq_n(name, "__simd_vadd_lane_i16_x16", 24) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let aad: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let bad: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let oad: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vadd_lane_i16_x16(P.current_bb, aad, bad, oad)
      }
  }
  if streq_n(name, "__simd_vsub_lane_i16_x16", 24) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let asb: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let bsb: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let osb: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vsub_lane_i16_x16(P.current_bb, asb, bsb, osb)
      }
  }
  if streq_n(name, "__simd_vmul_lane_i16_x16", 24) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let aml: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let bml: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let oml: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vmul_lane_i16_x16(P.current_bb, aml, bml, oml)
      }
  }
  // 3-arg shifts: __simd_vsll/vsrl/vsra_i16_x16(*i64 src, i64 count, *i64 out)
  if streq_n(name, "__simd_vsll_i16_x16", 19) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let asl: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let csl: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let osl: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vsll_i16_x16(P.current_bb, asl, csl, osl)
      }
  }
  if streq_n(name, "__simd_vsrl_i16_x16", 19) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let asr: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let csr: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let osr: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vsrl_i16_x16(P.current_bb, asr, csr, osr)
      }
  }
  if streq_n(name, "__simd_vsra_i16_x16", 19) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let asa2: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let csa2: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let osa2: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vsra_i16_x16(P.current_bb, asa2, csa2, osa2)
      }
  }
  if streq_n(name, "__simd_vreduce_sum_i16_x16", 26) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let prs: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vreduce_sum_i16_x16(P.current_bb, prs)
      }
  }
  if streq_n(name, "__simd_vbroadcast_i16_x16", 25) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let sbc: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let obc: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vbroadcast_i16_x16(P.current_bb, sbc, obc)
      }
  }
  // i8x32 set
  if streq_n(name, "__simd_vadd_i8_x32", 18) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a8a: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b8a: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o8a: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vadd_i8_x32(P.current_bb, a8a, b8a, o8a)
      }
  }
  if streq_n(name, "__simd_vsub_i8_x32", 18) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a8s: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b8s: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o8s: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vsub_i8_x32(P.current_bb, a8s, b8s, o8s)
      }
  }
  if streq_n(name, "__simd_vsadd_i8_x32", 19) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a8sa: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b8sa: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o8sa: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vsadd_i8_x32(P.current_bb, a8sa, b8sa, o8sa)
      }
  }
  if streq_n(name, "__simd_vssub_i8_x32", 19) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a8ss: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b8ss: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o8ss: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vssub_i8_x32(P.current_bb, a8ss, b8ss, o8ss)
      }
  }
  if streq_n(name, "__simd_vreduce_sum_i8_x32", 25) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let p8r: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vreduce_sum_i8_x32(P.current_bb, p8r)
      }
  }
  if streq_n(name, "__simd_vbroadcast_i8_x32", 24) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let s8b: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o8b: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vbroadcast_i8_x32(P.current_bb, s8b, o8b)
      }
  }
  // i32x8 set: names 17-24 chars long.
  if streq_n(name, "__simd_vadd_i32_x8", 18) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a32a: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b32a: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o32a: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vadd_i32_x8(P.current_bb, a32a, b32a, o32a)
      }
  }
  if streq_n(name, "__simd_vsub_i32_x8", 18) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a32s: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b32s: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o32s: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vsub_i32_x8(P.current_bb, a32s, b32s, o32s)
      }
  }
  if streq_n(name, "__simd_vmul_i32_x8", 18) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a32m: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b32m: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o32m: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vmul_i32_x8(P.current_bb, a32m, b32m, o32m)
      }
  }
  if streq_n(name, "__simd_vsadd_i32_x8", 19) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a32sa: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b32sa: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o32sa: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vsadd_i32_x8(P.current_bb, a32sa, b32sa, o32sa)
      }
  }
  if streq_n(name, "__simd_vssub_i32_x8", 19) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a32ss: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b32ss: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o32ss: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vssub_i32_x8(P.current_bb, a32ss, b32ss, o32ss)
      }
  }
  if streq_n(name, "__simd_vreduce_sum_i32_x8", 25) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let p32r: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vreduce_sum_i32_x8(P.current_bb, p32r)
      }
  }
  if streq_n(name, "__simd_vbroadcast_i32_x8", 24) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let s32b: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o32b: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vbroadcast_i32_x8(P.current_bb, s32b, o32b)
      }
  }
  // i64x4 set
  if streq_n(name, "__simd_vadd_i64_x4", 18) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a64a: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b64a: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o64a: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vadd_i64_x4(P.current_bb, a64a, b64a, o64a)
      }
  }
  if streq_n(name, "__simd_vsub_i64_x4", 18) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a64s: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b64s: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o64s: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vsub_i64_x4(P.current_bb, a64s, b64s, o64s)
      }
  }
  if streq_n(name, "__simd_vmul_i64_x4", 18) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a64m: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b64m: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o64m: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vmul_i64_x4(P.current_bb, a64m, b64m, o64m)
      }
  }
  if streq_n(name, "__simd_vsadd_i64_x4", 19) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a64sa: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b64sa: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o64sa: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vsadd_i64_x4(P.current_bb, a64sa, b64sa, o64sa)
      }
  }
  if streq_n(name, "__simd_vssub_i64_x4", 19) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a64ss: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b64ss: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o64ss: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vssub_i64_x4(P.current_bb, a64ss, b64ss, o64ss)
      }
  }
  if streq_n(name, "__simd_vreduce_sum_i64_x4", 25) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let p64r: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vreduce_sum_i64_x4(P.current_bb, p64r)
      }
  }
  if streq_n(name, "__simd_vbroadcast_i64_x4", 24) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let s64b: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o64b: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vbroadcast_i64_x4(P.current_bb, s64b, o64b)
      }
  }
  // Bit-rotate builtins -- C bootstrap parity (parse.c OP_ROTL64 /
  // OP_ROTR64).  __rotl64(value, count) / __rotr64(value, count).
  // Lowered to x86 ROLQ/RORQ %cl (single instruction).  Without
  // these the call fell through to an unresolved function and
  // silently returned op0 -- a no-op rotate that broke SHA-512.
  if streq_n(name, "__rotl64", 8) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let rlv: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let rln: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_binop(P.current_bb, OP_ROTL64, rlv, rln, ir_type_i64())
      }
  }
  if streq_n(name, "__rotr64", 8) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let rrv: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let rrn: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_binop(P.current_bb, OP_ROTR64, rrv, rrn, ir_type_i64())
      }
  }
  // LN1 wrap-around-by-intent intrinsics: __wrap_add/__wrap_sub/__wrap_mul(a, b) emit the plain
  // binop and are EXEMPT from the --chkarith overflow check (the Zig +% / Rust wrapping_* contract).
  // Under the default mode they are exactly `+ - *` (same int_binop_result_type ruler), so a
  // hash written with them builds byte-identically today and keeps building once the mode flips.
  if streq_n(name, "__wrap_add", 10) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let wa1: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let wa2: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_binop(P.current_bb, OP_ADD, wa1, wa2, int_binop_result_type(P, wa1, wa2))
      }
  }
  if streq_n(name, "__wrap_sub", 10) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let ws1: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let ws2: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_binop(P.current_bb, OP_SUB, ws1, ws2, int_binop_result_type(P, ws1, ws2))
      }
  }
  if streq_n(name, "__wrap_mul", 10) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let wm1: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let wm2: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_binop(P.current_bb, OP_MUL, wm1, wm2, int_binop_result_type(P, wm1, wm2))
      }
  }
  // LN4 OWNERSHIP MOVE: `__move(p)` is the DECLARED transfer point for an owned buffer -- the
  // __wrap_add contract, an intrinsic stating an intent the type system cannot express.  It is a
  // PURE MARKER: it returns p's own value id and emits NO IR at all, so `f(__move(p))` is
  // byte-for-byte `f(p)` under BOTH modes and adding a move to real code costs nothing at runtime.
  // The identifier token is captured BEFORE parse_expr consumes it; parse_expr then runs the
  // ordinary read path, so moving an ALREADY moved or released name is refused by own_check_use
  // there rather than by a second rule here -- one use checker, not two.
  if streq_n(name, "__move", 6) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let mv_tok: *Tok = tok_at(P.toks, P.pos)
          let mv_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          own_move_arg(P, mv_tok)
          return mv_v
      }
  }
  // Wide multiply -- G2 substrate.  __umulhi64(a, b) = the HIGH 64 bits of the
  // unsigned 64x64 product (x86 mulq's rdx).  Paired with normal `*` (the low
  // 64 bits) it yields the full 128-bit product, so crypto field arithmetic can
  // use 4x64-bit limbs (16 partial products) instead of 8x32 (64).
  if streq_n(name, "__umulhi64", 10) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let uma: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let umb: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_binop(P.current_bb, OP_UMULHI, uma, umb, ir_type_i64())
      }
  }
  // Hardware CRC-32C (SSE4.2) -- __crc32_u64(crc, data) folds the 64-bit
  // `data` word into the running `crc` accumulator (x86 crc32q).  Pure,
  // 2 i64 operands -> i64.  Checksums, packet validation, hash fingerprints.
  if streq_n(name, "__crc32_u64", 11) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let crca: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let crcd: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_binop(P.current_bb, OP_CRC32, crca, crcd, ir_type_i64())
      }
  }
  // BMI2 parallel bit DEPOSIT -- __pdep64(value, mask) scatters the low bits
  // of `value` into the set-bit positions of `mask` (x86 pdep).  Pure, 2 i64
  // operands -> i64.  varint-encode, bitboard-scatter, bit-interleave.
  if streq_n(name, "__pdep64", 8) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let pdv: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let pdm: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_binop(P.current_bb, OP_PDEP, pdv, pdm, ir_type_i64())
      }
  }
  // BMI2 parallel bit EXTRACT -- __pext64(value, mask) gathers the `value`
  // bits at the set positions of `mask` down to the low bits (x86 pext; the
  // inverse of pdep).  Pure, 2 i64 operands -> i64.  varint-decode,
  // bitboard-gather, unicode-transcode, compression.
  if streq_n(name, "__pext64", 8) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let pxv: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let pxm: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_binop(P.current_bb, OP_PEXT, pxv, pxm, ir_type_i64())
      }
  }
  // Native add-with-carry -- G3 substrate.  __adc_acc(acc_ptr, lo, hi) adds the
  // 128-bit (hi:lo) into the 3-word accumulator {acc[0],acc[1],acc[2]} with carry
  // (contiguous addq;adcq;adcq). Void/statement-form (returns const 0).
  if streq_n(name, "__adc_acc", 9) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let aa_p:  i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let aa_lo: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let aa_hi: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          ir_emit_adc_acc(P.current_bb, aa_p, aa_lo, aa_hi)
          return safe_const_i64(P, 0, "parse.nx:adc-acc-0" as *u8)
      }
  }
  // CPU feature detection -- the BMI2/ADX gate.  __cpuid_ebx(leaf, subleaf) runs
  // x86 cpuid and returns the EBX register (zero-extended). cpuid(7,0):EBX has
  // bit-8=BMI2, bit-19=ADX. Pure (deterministic for a given CPU).
  if streq_n(name, "__cpuid_ebx", 11) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let cq_l: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let cq_s: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_binop(P.current_bb, OP_CPUID_EBX, cq_l, cq_s, ir_type_i64())
      }
  }
  // Scalar bit unops -- C bootstrap parity (parse.c OP_BSWAP64/CLZ32/
  // CTZ32/POPCNT64).  Each takes exactly 1 argument.
  if streq_n(name, "__bswap64", 9) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let bsv: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_unop(P.current_bb, OP_BSWAP64, bsv, ir_type_i64())
      }
  }
  if streq_n(name, "__clz32", 7) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let czv: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_unop(P.current_bb, OP_CLZ32, czv, ir_type_i64())
      }
  }
  if streq_n(name, "__ctz32", 7) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let tzv: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_unop(P.current_bb, OP_CTZ32, tzv, ir_type_i64())
      }
  }
  if streq_n(name, "__popcnt64", 10) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let pcv: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_unop(P.current_bb, OP_POPCNT64, pcv, ir_type_i64())
      }
  }
  // __rdtsc() -- zero-arg cycle-counter read.  The unop carries a dummy
  // const-0 operand (the lowering ignores it and reads the HW counter).
  if streq_n(name, "__rdtsc", 7) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P); match_kind(P, TK_RPAREN)
          let rd0: i64 = safe_const_i64(P, 0, "__rdtsc" as *u8)
          return ir_emit_unop(P.current_bb, OP_RDTSC, rd0, ir_type_i64())
      }
  }
  // Atomic intrinsics -- C bootstrap parity (parse.c).  Memory order
  // is the last argument (NX_MO_* const).
  if streq_n(name, "__atomic_load_i64", 17) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let al_a: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let al_mo: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_atomic_load_i64(P.current_bb, al_a, al_mo)
      }
  }
  if streq_n(name, "__atomic_store_i64", 18) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let as_a: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let as_v: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let as_mo: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          ir_emit_atomic_store_i64(P.current_bb, as_a, as_v, as_mo)
          return safe_const_i64(P, 0, "parse.nx:atomic-store-0" as *u8)
      }
  }
  if streq_n(name, "__atomic_cas_i64", 16) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let cs_a: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let cs_e: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let cs_n: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let cs_mo: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_atomic_cas_i64(P.current_bb, cs_a, cs_e, cs_n, cs_mo)
      }
  }
  if streq_n(name, "__atomic_faa_i64", 16) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let fa_a: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let fa_d: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let fa_mo: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_atomic_faa_i64(P.current_bb, fa_a, fa_d, fa_mo)
      }
  }
  if streq_n(name, "__atomic_fence", 14) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let fe_mo: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          ir_emit_atomic_fence(P.current_bb, fe_mo)
          return safe_const_i64(P, 0, "parse.nx:atomic-fence-0" as *u8)
      }
  }
  // __thread_clone(stack_top, entry_fn, ctx) -> child_tid.
  if streq_n(name, "__thread_clone", 14) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let tc_s: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let tc_e: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let tc_c: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_thread_clone(P.current_bb, tc_s, tc_e, tc_c)
      }
  }
  return -1
4216}
4217
4218func parse_primary_call(P: *Parser, name: *u8) -> i64 {
  // CALL-SITE ANCHOR (2026-08-05). Capture the position of the CALL ITSELF at entry: the caller
  // already consumed the identifier, so it sits one token back. Reading P.pos at ERROR time
  // instead points at whatever the parser reached AFTER the call -- measured: the caret printed
  // under the NEXT statement (sys_exit(0)) for an error on the line above it.
  // A CARET THAT POINTS AT THE WRONG LINE IS WORSE THAN NO CARET: it sends the reader to
  // innocent code, which is exactly the confusion the feature exists to remove.
  var call_ln: i64 = 0
  var call_cl: i64 = 0
  if P.pos >= 1 {
      let ct: *Tok = tok_at(P.toks, P.pos - 1)
      call_ln = ct.line
      call_cl = ct.col
  }
  advance_tok(P)
  // 24 slots -- Instr has op0..op23 (24 operand slots after the
  // 2026-06-18 IR extension to support >16-arg calls, e.g. bi-predicted
  // H.264 chroma reconstruction).  Was 4 then 8 then 16 slots; silent
  // overflow past the buffer corrupted adjacent memory and made
  // ir_emit_call read garbage into the high op slots.  See PREVENT lint
  // bench/nx_call_arity_overflow_audit.sh.
  let args_raw: *u8 = sys_mmap(24 * 8 + 16)
  let args: *i64 = args_raw as *i64
  var n_args: i64 = 0
  // LN2 narrowing by assertion: `nx_assert_ptr(p, ...)` / `nx_assert_ptr(p as *u8, ...)` aborts
  // when p is null, so p is non-null for the rest of the block.  And `sys_exit(...)` ends the path
  // (the early-exit idiom `if p == 0 { sys_exit(1) }`).  Token shape only; inert unless --optenforce.
  if g_optenforce_live == 1 {
      if streq_n(name, "nx_assert_ptr", 13) == 1 {
          let oa0: *Tok = tok_at(P.toks, P.pos)
          let oa1: *Tok = tok_at(P.toks, P.pos + 1)
          if oa0.kind == TK_IDENT {
              var oa_ok: i64 = 0
              if oa1.kind == TK_COMMA { oa_ok = 1 }
              if oa1.kind == TK_AS { oa_ok = 1 }
              if oa_ok == 1 {
                  let oaL: *Local = find_local(P, tok_text_ptr(oa0))
                  if oaL != (0 as *Local) { if oaL.ty != (0 as *Type) { if oaL.ty.kind == TY_PTR { oaL.nn_checked = 1 } } }
              }
          }
      }
      if streq_n(name, "sys_exit", 8) == 1 { g_oe_term = 1 }
  }
  // LN5 RELEASE POINT: `sys_munmap(p, n)` / `sys_munmap(p as *T, n)` ends p's ownership.  The token
  // is captured HERE, BEFORE the arguments are parsed, and the local is marked AFTER the closing
  // paren -- an ordering that is load-bearing twice over.  Capturing first is the only moment the
  // identifier is still at a known position; marking last keeps the release's OWN read of p legal
  // (it is the last legitimate use) and makes a DOUBLE release refuse for free, because the second
  // statement's read of the name is itself the use being checked -- no separate double-free rule.
  // A field or expression argument (`sys_munmap(ctx.buf, n)`) does not match and is a declared
  // floor: this rung tracks named locals only.
  var own_rel_tok: *Tok = 0 as *Tok
  if own_check_live() == 1 {
      if streq_n(name, "sys_munmap", 10) == 1 {
          let or0: *Tok = tok_at(P.toks, P.pos)
          let or1: *Tok = tok_at(P.toks, P.pos + 1)
          if or0.kind == TK_IDENT {
              var or_ok: i64 = 0
              if or1.kind == TK_COMMA { or_ok = 1 }
              if or1.kind == TK_AS { or_ok = 1 }
              if or_ok == 1 { own_rel_tok = or0 }
          }
      }
  }
  if peek_kind(P) != TK_RPAREN {
      let a0: i64 = parse_expr(P)
      args[n_args] = a0
      n_args = n_args + 1
      while peek_kind(P) == TK_COMMA {
          advance_tok(P)
          if n_args >= 24 {
              parse_die("function call exceeds 24 args (IR cap)" as *u8, 39)
          }
          let an: i64 = parse_expr(P)
          args[n_args] = an
          n_args = n_args + 1
      }
  }
  match_kind(P, TK_RPAREN)
  // LN5: the release lands only now -- see the capture block above for why the order matters.
  if own_rel_tok != (0 as *Tok) { own_mark_named(P, own_rel_tok, OWN_RELEASED) }
  var nlen: i64 = 0
  while name[nlen] != 0 { nlen = nlen + 1 }
  let callee: *Function = find_function(P.module, name, nlen)
  if callee == (0 as *Function) {
      // fp(args): if `name` is a func-pointer-typed LOCAL, emit an INDIRECT call through it (call *%r11)
      // instead of failing as an undefined function. Completes the func-pointer feature (the thread-pool
      // `fp(task.ctx)` shape). MVP caps at 6 args (register-only codegen).
      let fpl: *Local = find_local(P, name)
      if fpl != (0 as *Local) {
          if fpl.ty != (0 as *Type) {
              if fpl.ty.kind == TY_FUNC {
                  if n_args > NX_FNPTR_MAX_ARGS { parse_die("indirect fn-ptr call exceeds max args (IR operand cap)" as *u8, 32) }
                  var fpv: i64 = fpl.value_id
                  if fpl.is_alloca == 1 { fpv = ir_emit_load(P.current_bb, fpl.value_id, fpl.ty) }
                  var fret: *Type = fpl.ty.pointee
                  if fret == (0 as *Type) { fret = ir_type_i64() }
                  return ir_emit_call_indirect(P.current_bb, fpv, fret, args, n_args)
              }
          }
      }
      // Unresolved call.  prepass_register_funcs registers EVERY real
      // function before any body is parsed, so reaching here means
      // `name` is genuinely undefined.  Returning 0 here used to
      // SILENTLY produce value-id-0 (== first arg), turning a missing
      // compiler intrinsic into a no-op -- the SHA-512/__rotr64 bug
      // (SITES-LIVE 2026-05-27).  Fail LOUD instead.  A `__`-prefixed
      // name that lands here is an UNHANDLED INTRINSIC (it should have
      // matched parse_primary_intrinsic); anything else is a typo or a
      // missing import.  Either way it must never silently no-op.
      if name[0] == 0x5F {
          if name[1] == 0x5F {
              // LN42 (2026-09-03): this refusal is CORRECT and was unreadable. It printed a bare sentence with
              // no file, no line and no caret, so a census could not group it and a reader could not find it.
              // It also matters WHICH kind of absence this is, and the two need opposite actions: an intrinsic
              // whose emitter exists but whose NAME was never routed here is BUILT AND UNWIRED (that was
              // __q4k_sb_dot, 32 programs, fixed the same day); an intrinsic with no emitter anywhere is simply
              // NOT IMPLEMENTED, and calling it is the program asking for a feature the compiler does not have.
              // Saying "unhandled" for both sent every reader looking for a missing line in this file.
              nx_diag_organ_at(call_ln)
              nx_diag_puts(": this __ intrinsic has no implementation in this compiler: " as *u8)
              nx_diag_puts(name)
              nx_diag_puts("\n" as *u8)
              nx_diag_caret(call_ln, nx_pd_col)
              nx_diag_puts("  why the build stopped: a __-prefixed name is an intrinsic, and intrinsics are matched by NAME here before any call is emitted. Nothing matched, so there is no code to emit and a silent no-op would ship a program that quietly does nothing.\n" as *u8)
              nx_diag_puts("  fix: if this intrinsic is meant to exist, check that its name is routed in parse_primary_intrinsic -- an opcode, an IR builder and a backend emitter can all exist while the NAME is unrouted, which makes the feature unreachable from every program. If it was never implemented, call the ordinary function that does this work instead.\n" as *u8)
              nx_diag_note_error()
              return 0
          }
      }
      nx_dym_suggest_fn(P.module, name, nlen)
      nx_diag_at(call_ln)
      nx_diag_puts(": I do not know the name '" as *u8)
      sys_write(2, name, nlen)
      nx_diag_puts("' -- it is called here, but nothing in this program defines it.\n" as *u8)
      nx_diag_caret(call_ln, call_cl)
      nx_diag_why_undefined()
      nx_dym_note2(P, name, nlen)
      nx_diag_note_error()
      // RECOVERY: value id 0. Mechanically safe for the parser (it was the
      // old silent behavior); the end-of-parse gate keeps it out of codegen.
      return 0
  }
  // ---- CALL-ARITY CHECK (2026-07-20) ------------------------------------
  // nx_cc had NO arity checking: a call missing an argument compiled SILENTLY
  // and the callee read a GARBAGE REGISTER -- then WROTE THROUGH IT when the
  // parameter was an out-pointer.  Symptoms are protean (impossible counter
  // values; a SEGV that MOVES when you refactor, because the register content
  // shifts), which is why it cost ~4 debug cycles in nx_step_tess2 and got
  // banked as a standing ★★★ gotcha.  Same family as the undefined-function
  // fix above: a silent wrong-value is strictly worse than a loud stop.
  //
  // COVERAGE IS NOW TOTAL.  This check was first landed gated on `callee.n_blocks > 0` (the
  // codebase's own "has a real body" test) because prepass_register_funcs registered a stub per
  // name WITHOUT parsing its parameter list, so a not-yet-defined callee reported n_params == 0
  // and checking it would have rejected every forward call -- including this compiler's own
  // source.  That root cause is now FIXED at the source: prepass_count_params records the declared
  // arity on the stub before any body is parsed, so EVERY callee reachable by name has a known
  // signature and the guard is no longer needed.  Forward calls and mutual recursion are covered.
  if n_args != callee.n_params {
      // 5W+H VOICE (2026-08-13): the old text ("call arity mismatch: f expects 2 arg(s), got 1")
      // stated the counts but not the CONSEQUENCE -- and this defect's symptom is protean
      // (garbage register reads that move when unrelated code moves), which is exactly what a
      // reader needs told, because the crash never points here.
      nx_diag_at(call_ln)
      nx_diag_puts(": '" as *u8)
      sys_write(2, name, nlen)
      nx_diag_puts("' is called here with " as *u8)
      nx_put_dec_err(n_args)
      nx_diag_puts(" value(s), but it is defined to take " as *u8)
      nx_put_dec_err(callee.n_params)
      nx_diag_puts(".\n" as *u8)
      nx_diag_caret(call_ln, call_cl)
      nx_diag_puts("  why the build stopped: a missing argument is not empty -- the callee would read whatever happened to be left in that register, so the wrong value moves when unrelated code moves and the crash never points back here.\n" as *u8)
      nx_diag_puts("  fix: pass the number of values the definition declares, or change the definition to take the number you are passing. If the extra values belong together, group them in a struct and pass its pointer.\n" as *u8)
      nx_diag_note_error()
  }
  // ---- CALL ARGUMENT TYPE CHECK (2026-08-01) ----------------------------
  // nx_cc checked ARITY but never TYPES: a pointer passed where an i64 was declared,
  // and an integer passed where a pointer was declared, both compiled CLEAN. That is
  // the root of the silent-acceptance family. It is not theoretical -- it is how the
  // sev-8 evidence bug happened (debt 1785518763): ev_parse_pass passed an mmap'd
  // *i64 out-pointer into `kl: i64`, where it became the bound of `while i <= n - kl`;
  // the loop never executed and an evidence organ reported a ZERO tally for every gate.
  //
  // DELIBERATELY NARROW: POINTER-vs-INTEGER only. That distinction is unambiguous and
  // is the class that produces wild-pointer and impossible-bound bugs. Integer WIDTH
  // (i32 into i64) and struct identity are NOT checked here -- the corpus converts
  // freely between integer widths and rejecting that would be a different, much larger
  // change. Widen only as far as the evidence supports.
  //
  // LN6: a per-task context crossing the thread pool must come from a struct marked `send`
  // (sync_send_check; name-keyed on nx_pool_submit, abstains on anything it cannot type).
  if g_sendcheck_live == 1 { sync_send_check(P, name, nlen, args, n_args, call_ln, call_cl) }
  // SKIPPED when the callee's mask is 0 = signature not yet parsed (forward call to a
  // stub). Guessing a signature there is how the arity check first broke the compiler's
  // own source; a check that cannot know must decline, not invent.
  if callee.param_ptr_mask != 0 {
      var ai: i64 = 0
      while ai < n_args {
          let av: *Value = val_at(P.current_fn, args[ai])
          var arg_is_ptr: i64 = 0
          var arg_known: i64 = 0
          if av != (0 as *Value) {
              let aty: *Type = av.ty
              if aty != (0 as *Type) {
                  arg_known = 1
                  if aty.kind == TY_PTR { arg_is_ptr = 1 }
                  // an integer LITERAL is routinely used as a null/sentinel pointer;
                  // only a *typed* value carries a real claim about pointerness.
                  if av.kind == VK_CONST_INT { arg_known = 0 }
              }
          }
          var want_ptr: i64 = 0
          if (callee.param_ptr_mask & (1 << ai)) != 0 { want_ptr = 1 }
          // ONLY THE UNAMBIGUOUS DIRECTION: a value typed TY_PTR is definitely a
          // pointer, so passing it to an integer parameter is definitely wrong. The
          // reverse is NOT decidable here: an argument typed i64 may be a genuine
          // integer OR the PLACEHOLDER type of a call to a function defined later with
          // no forward declaration (the prepass stub carries i64 until its body is
          // parsed). Measured: checking that direction gave a 106/120 false-positive
          // rate, all of it placeholder types, not real defects.
          // This keeps the direction that produced the sev-8 ev_num_after silent-zero
          // (a *i64 out-pointer landing in `kl: i64`) and drops the one that cannot be
          // decided without a real type-inference pass. Widen only as far as the
          // evidence supports.
          // POINTER-INTO-INTEGER ONLY -- and this narrowness is MEASURED, not timid.
          //
          // A value typed TY_PTR is definitely a pointer, so handing it to an integer
          // parameter is definitely wrong: that is the sev-8 ev_num_after shape (an
          // mmap'd *i64 becoming a loop bound) and it costs 0 false positives over the
          // corpus sample.
          //
          // The REVERSE direction is enabled by flipping the commented line below, and
          // it was TRIED on 2026-08-01. Two separate causes of i64-looking arguments
          // were found and fixed -- return types were hardcoded ir_type_i64() for every
          // function, and forward stubs carried an i64 placeholder (prepass now records
          // return pointer-ness). Both real bugs, both fixed. But the corpus STILL
          // rejects 57/70 on `sys_munmap` arg 1 from inside the syscall layer's own
          // expansion, and that residue is NOT yet explained. Isolated repros of every
          // shape tried -- casts, pointer locals, call results, forward decls -- are all
          // quiet, so a third cause remains unfound.
          // DO NOT ENABLE IT UNTIL THAT RESIDUE IS EXPLAINED. Shipping it would reject
          // most of the corpus for a reason nobody has yet named, which is not a fix.
          var bad: i64 = 0
          if arg_known == 1 {
              if arg_is_ptr == 1 { if want_ptr == 0 { bad = 1 } }
              // BOTH DIRECTIONS: still DISABLED, and the residue is now PARTLY explained + MEASURED.
              // CAUSE FOUND AND FIXED 2026-08-05: the trailing `as T` cast MUTATED THE OPERAND'S
              // Value IN PLACE (parse_unary), so a local that ever appeared as `p as i64` read as
              // INTEGER at every LATER call -- exactly the syscall layer's timespec pattern before
              // sys_munmap(req). Cast now emits a typed identity; witnesses nx_probe_castmut_live.nx
              // (mutation reproduced pre-fix) + castmut2 (per-value, not check-wide). That fix is
              // LIVE (equiv 10/10 + selfhost, toolchain-promoted canary GREEN).
              // BUT IT IS NOT THE WHOLE RESIDUE, MEASURED NOT ASSUMED: flipping this line on the
              // FIXED compiler still fails 4 of 10 equiv rows -- nx_jpeg_ascii_test,
              // nx_tls13_client_session_recv_sh_test, nx_p256_keyshare_test,
              // nx_tls13_p256_loopback_test (build_b=1, i.e. the CHALLENGER refuses to compile them;
              // the other 6 rows + selfhost stay GREEN). Residue narrowed from 57/70 corpus targets
              // to 4 large crypto/codec modules = a SECOND, still-unnamed type-loss path.
              // NEXT INVESTIGATOR: build one of those 4 with a both-directions compiler and read the
              // exact `argument type mismatch` line + callee; that names cause #2.
              if arg_is_ptr != want_ptr { bad = 1 }
          }
          if bad == 1 {
              // parse_primary_call has no name token in scope; take the line from
              // the parser's current position, which is at/just past the call.
              let cur_tok: *Tok = tok_at(P.toks, P.pos)
              let cur_line: i64 = cur_tok.line
              nx_diag_organ_at(cur_line)
              sys_write(2, ": argument type mismatch in call to '" as *u8, 37)
              sys_write(2, name, nlen)
              sys_write(2, "': arg " as *u8, 7)
              nx_put_dec_err(ai + 1)
              if want_ptr == 1 {
                  sys_write(2, " is an INTEGER but the parameter is a POINTER\n" as *u8, 46)
              }
              if want_ptr == 0 {
                  sys_write(2, " is a POINTER but the parameter is an INTEGER\n" as *u8, 46)
              }
              nx_diag_puts("  why the build stopped: a pointer and an integer are passed in the same register but mean different things -- the callee would read the wrong kind of value and fault or compute garbage at this call.\n" as *u8)
              nx_diag_puts("  fix: pass the value the parameter declares -- cast an address with `as i64` or an integer with `as *T` only when that is really what the callee wants, otherwise pass the right variable.\n" as *u8)
              nx_diag_note_error()
          }
          ai = ai + 1
      }
  }
  let r: i64 = ir_emit_call(P.current_bb, callee, args, n_args)
  // LN3 provenance capture: a call to sys_mmap with a COMPILE-TIME-CONSTANT byte count is the
  // one allocation whose extent the compiler can see (mconsts fold to VK_CONST_INT at parse
  // time, so `sys_mmap(CAP_CONST)` qualifies).  Record the result id; the `as *T` cast chain
  // in parse_unary carries it forward and parse_stmt_let binds it onto the local.  Name-keyed
  // on sys_mmap alone for now -- a declared floor, listed in the LN3 block's imprecision note.
  if n_args == 1 {
      if mc_name_eq(name, "sys_mmap" as *u8) == 1 {
          let pav: *Value = val_at(P.current_fn, args[0])
          if pav != (0 as *Value) {
              if pav.kind == VK_CONST_INT {
                  if pav.const_int > 0 { g_prov_val = r; g_prov_bytes = pav.const_int }
              }
          }
      }
  }
  if callee.ret_ty != (0 as *Type) {
      return parse_field_chain(P, r, callee.ret_ty)
  }
  return r
4525}
4526
4527// NUL-terminated name compare (2 data args -- keeps clear of the >=3-data-arg helper miscompile class)
4528func mc_name_eq(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 }
  if b[i] != (0 as u8) { return 0 }
  return 1
4533}
4534
4535// Is `name` declared as a module `const` LATER in the token stream?  Non-destructive: saves and
4536// restores P.pos exactly as the prepasses do.  Only ever called on the give-up path of an identifier
4537// lookup, so the scan cost is paid solely on what is already an error.
4538func mconst_declared_later(P: *Parser, name: *u8) -> i64 {
  let saved: i64 = P.pos
  var found: i64 = 0
  var go: i64 = 1
  while go == 1 {
      let k: i64 = peek_kind(P)
      if k == TK_EOF {
          go = 0
      } else {
          if k == TK_CONST {
              advance_tok(P)
              if peek_kind(P) == TK_IDENT {
                  let t: *Tok = advance_tok(P)
                  if mc_name_eq(tok_text_ptr(t), name) == 1 { found = 1; go = 0 }
              }
          } else {
              advance_tok(P)
          }
      }
  }
  P.pos = saved
  return found
4560}
4561
4562func parse_primary_local_or_const(P: *Parser, name: *u8) -> i64 {
  let L: *Local = find_local(P, name)
  if L != (0 as *Local) {
      // LN4/LN5: THE read hook, and the reason this rung needs only one.  EVERY bare use of a name
      // arrives here -- a deref base, a call argument, an initializer, the right-hand side of an
      // assignment -- because parse_primary_ident routes anything that is not `name(` to this
      // function.  The identifier token is one position back (parse_primary_ident already consumed
      // it), the same idiom oe_handshake_set uses below.  An assignment TARGET does NOT come
      // through here (parse_stmt_ident_assign consumes its own name), which is exactly what makes
      // `p = sys_mmap(n)` a legal re-initialisation after a move rather than a refused use.
      if P.pos >= 1 { own_check_use(P, L, tok_at(P.toks, P.pos - 1)) }
      var v: i64 = L.value_id
      var v_pass_ty: *Type = L.ty       // type handed to parse_field_chain; unwrapped once for static-ptr subscripts
      if L.is_alloca {
          if L.ty_kind != TY_STRUCT {
            if L.ty_kind != TY_ARRAY {
              if peek_kind(P) != TK_DOT {
                  if peek_kind(P) != TK_LBRACKET {
                      // Load the local's value at its DECLARED type
                      // (L.ty), not hardcoded i64.  Required for u8 /
                      // i32 / pointer locals to widen / read correctly.
                      // ARRAY (like STRUCT) is EXCLUDED here: a bare array name
                      // must DECAY to its frame address, not load its first bytes.
                      var lty: *Type = L.ty
                      if lty == (0 as *Type) { lty = ir_type_i64() }
                      // STATIC SCALAR TYPE FIX (2026-08-01). A static's injected Local is deliberately
                      // typed *(decl_ty) -- the slot ADDRESS -- so field/index chains get the right
                      // stride (see inject_statics). But LOADING that slot yields a value of the
                      // DECLARED type, so the loaded Value must carry L.ty.pointee, NOT L.ty.
                      // Without this every `static X: i64` read is recorded as TY_PTR, and the call
                      // argument type check added earlier today then rejects the VALID line
                      // `cd2_sputi(cg_nn)` as "arg 1 is a POINTER but the parameter is an INTEGER".
                      // ★★★★★A TYPE THAT WAS ONLY EVER USED FOR ADDRESSING BECAME A CLAIM ABOUT THE
                      // VALUE THE MOMENT SOMETHING STARTED READING IT -- the slot type was harmlessly
                      // wrong for as long as nothing consulted it, and the new checker is what turned
                      // a latent mislabel into 1-in-10 organs refusing to compile.
                      // Same VK_GLOBAL-gated unwrap already proven on the static-ptr field-read path
                      // below; ordinary alloca locals are untouched, so they stay byte-identical.
                      // CODEGEN IS UNCHANGED CORPUS-WIDE, measured not assumed: load_ty drives load
                      // WIDTH, and the corpus has 366 i64 statics (8 bytes either way), 305 pointer
                      // statics (8 bytes either way) and ZERO narrow (u8/i32/i16) scalar statics, the
                      // only shape whose width this could alter.
                      let lv_ld: *Value = val_at(P.current_fn, L.value_id)
                      if lv_ld.kind == VK_GLOBAL {
                          if L.ty != (0 as *Type) {
                              if L.ty.pointee != (0 as *Type) { lty = L.ty.pointee }
                          }
                      }
                      return ir_emit_load(P.current_bb, L.value_id, lty)
                  }
              }
            }
          }
      }
      // F-meta-3 fix (Session 12): when the local is alloca-backed
      // AND its declared type is a pointer-to-struct (e.g. function
      // param `out: *Struct`), the alloca slot holds the POINTER
      // value, not the struct.  parse_field_chain expects `base` to
      // BE the pointer; if we pass the alloca slot directly it does
      // GEP on the slot and reads stack garbage.  Load the pointer
      // out of the slot first.  Sibling fix to parse_stmt_ident_dot.
      if L.is_alloca == 1 {
          if L.ty != (0 as *Type) {
              if L.ty.kind == TY_PTR {
                  if peek_kind(P) == TK_DOT {
                      // Loaded value is the pointer itself (type L.ty).
                      v = ir_emit_load(P.current_bb, L.value_id, L.ty)
                      // Static-ptr FIELD-READ fix (2026-07-10; mirrors the LBRACKET multi-static fix
                      // below): a STATIC's injected Local is typed *(decl_ty) -- the slot ADDRESS -- so
                      // after the load v holds the REAL pointer, whose type is L.ty.pointee. Passing the
                      // un-unwrapped **Struct made parse_field_chain's struct lookup FAIL -> documented
                      // bail -> `g.field` READ returned the RAW POINTER (nx_static_field_probe witness).
                      // VK_GLOBAL-gated so ordinary alloca ptr locals stay byte-identical (equiv-safe).
                      let lv_d: *Value = val_at(P.current_fn, L.value_id)
                      if lv_d.kind == VK_GLOBAL {
                          if L.ty.pointee != (0 as *Type) { v_pass_ty = L.ty.pointee }
                      }
                  }
                  // Multi-static bug fix: a STATIC pointer's value_id is a VK_GLOBAL (the slot ADDRESS),
                  // which materialises as-address (leaq) and does NOT auto-load like an OP_ALLOCA. So a
                  // `staticptr[i]` READ subscripted the slot address -> returned the pointer, not *pointer
                  // (write worked, read was wrong -- silent corruption with >=1 static pointer read). Load
                  // the pointer from the slot first, ONLY for VK_GLOBAL, so var/alloca pointers (which
                  // auto-load) stay byte-identical -> equiv gate unaffected.
                  if peek_kind(P) == TK_LBRACKET {
                      let lv_g: *Value = val_at(P.current_fn, L.value_id)
                      if lv_g.kind == VK_GLOBAL {
                          // STATIC ARRAY vs STATIC POINTER -- they need OPPOSITE treatment here, and
                          // conflating them is why `static a: [N]T` has been a documented daemon-killer.
                          // A static POINTER's slot HOLDS a pointer, so it must be loaded. A static
                          // ARRAY's slot IS the array, so its ADDRESS is already the base and loading it
                          // reads ELEMENT 0 AND USES IT AS THE BASE. .lcomm zero-fills, so that base was
                          // 0 and the first indexed access wrote to a near-null address -- compiles
                          // clean, dies on touch, exactly as witness nx_rw_staticarr.nx records.
                          // This is the static sibling of the local array-decay rule below.
                          var g_is_arr: i64 = 0
                          if L.ty.pointee != (0 as *Type) {
                              if L.ty.pointee.kind == TY_ARRAY { g_is_arr = 1 }
                          }
                          if g_is_arr == 0 {
                              v = ir_emit_load(P.current_bb, L.value_id, L.ty)
                          }
                          // Static-ptr STRIDE fix: inject_statics types the Local as *(e.ty) (the slot
                          // ADDRESS). After the load, v holds the REAL pointer (e.ty); its element is
                          // e.ty.pointee, so the stride must come from L.ty.pointee, not L.ty. Was: a *u8
                          // static -> stride 8 (sizeof *u8) instead of 1 -> ran off the buffer on large
                          // indices (nx_drbench SIGSEGV). *i64 statics were unaffected (8 == correct).
                          // For the ARRAY case this same assignment hands the postfix handler the ARRAY
                          // type, which is what makes it GEP from the base and bounds-check the index.
                          if L.ty.pointee != (0 as *Type) { v_pass_ty = L.ty.pointee }
                      }
                  }
              }
          }
      }
      // Pass the local's actual type so parse_field_chain can
      // emit GEP+LOAD for o.field accesses.  Closes T#bar3-codegen-001
      // (was passing 0 as *Type which made field_chain bail without
      // emitting, causing nxc.elf to return the raw pointer instead
      // of o.field for `let o: *S = ...; return o.field`).
      // Array DECAY: a bare array name (not indexed, not dotted) yields its stack ADDRESS as a
      // pointer VALUE (C-style array->*elem decay), so `sys_write(1, buf, n)` gets the address.
      // Emit OP_ADDR_OF for the leaq path -- returning the raw alloca id auto-loads the array's
      // first bytes as a bogus pointer (same trap the &name path documents).
      if L.is_alloca == 1 {
          if L.ty_kind == TY_ARRAY {
              if peek_kind(P) != TK_LBRACKET {
                  if peek_kind(P) != TK_DOT {
                      let pta: *Type = alloc_type(TY_PTR, 8, 8)
                      pta.pointee = L.ty.pointee
                      return ir_emit_unop(P.current_bb, OP_ADDR_OF, L.value_id, pta)
                  }
              }
          }
      }
      // LN3 handshake: a `let`-local with visible provenance hands its extent to the chain
      // walker through the statics parse_field_chain snapshots at entry.  Non-alloca only --
      // for a `let`, v IS the binding's value id, so the id-equality key in the chain is exact.
      if L.is_alloca == 0 {
          if L.ext_bytes > 0 { g_pp_base_val = v; g_pp_base_ext = L.ext_bytes }
      }
      // LN2 handshake: the identifier token sits one back (parse_primary_ident consumed it and
      // nothing else before delegating here); the chain walker / `*p` reader checks v against it.
      if g_optenforce_live == 1 {
          if P.pos >= 1 { oe_handshake_set(P, L, v, tok_at(P.toks, P.pos - 1)) }
      }
      return parse_field_chain(P, v, v_pass_ty)
  }
  let out_raw: *u8 = sys_mmap(16)
  let out: *i64 = out_raw as *i64
  *out = 0
  if lookup_mconst(P, name, out) == 1 {
      return safe_const_i64(P, *out, "parse.nx:mconst-out" as *u8)
  }
  // LN39: an f64 const is a typed constant, exactly like an inline float literal.
  if lookup_mconst_f64(P, name, out) == 1 {
      let fvid: i64 = safe_const_i64(P, *out, "parse.nx:mconst-f64" as *u8)
      let fbase: i64 = P.current_fn.values as i64
      let fv: *Value = (fbase + fvid * 48) as *Value
      fv.ty = alloc_type(TY_F64, 8, 8)
      return fvid
  }
  // V-LANGEXT M1: string-const lookup. Same shape as inline TK_STRING
  // emission at parse_primary (~line 873): emit a VAL_GLOBAL_ADDR
  // value via ir_global_value with the stored pointer type.
  let sgid_raw: *u8 = sys_mmap(16)
  let sgid:    *i64 = sgid_raw as *i64
  let sty_raw: *u8 = sys_mmap(16)
  let sty:     **Type = sty_raw as **Type
  *sgid = 0
  *sty  = 0 as *Type
  if lookup_mconst_string(P, name, sgid, sty) == 1 {
      // ROOT FIX seq1552 (2026-07-30): a STRING module-const IS a pointer value, so a use site can
      // legitimately carry a postfix `[i]` or `.field` exactly like a pointer local.  This path used
      // to hand back the global address WITHOUT running the postfix chain, so the `[` `i` `]` tokens
      // of `CONST[i]` were left in the stream; the enclosing expression then desynced and the program
      // COMPILED CLEAN while summing the wrong bytes.  Witness pair (byte-identical but for one line):
      // nx_constidx_probe.nx (WRONG-SUM, exit 1) vs nx_constidx_ctrl.nx (sum=294, exit 0).
      // The chain is entered ONLY when a postfix token actually follows, so every existing use site
      // takes the byte-identical old path -- and module-level contexts (P.current_fn == 0, see the
      // reset at the end of parse_function) never reach parse_field_chain's current_fn assert.
      let gcv: i64 = ir_global_value(P.current_fn, *sgid, *sty)
      if peek_kind(P) == TK_LBRACKET { return parse_field_chain(P, gcv, *sty) }
      if peek_kind(P) == TK_DOT      { return parse_field_chain(P, gcv, *sty) }
      return gcv
  }
  // Bare FUNCTION name used as a VALUE (not a call): yields the function's code address
  // (VK_FUNC_ADDR -> `leaq <fn>(%rip)`). This is what nx_thread_pool passes as a worker arg and
  // what __thread_clone(top, worker, ctx) needs -- previously this fell through to `return 0`
  // (constant 0), giving a NULL entry -> the SIGSEGV (exit 139). Shares the &fn mechanism.
  var fv_nl: i64 = 0
  while name[fv_nl] != 0 { fv_nl = fv_nl + 1 }
  let fv_fn: *Function = find_function(P.module, name, fv_nl)
  if fv_fn != (0 as *Function) {
      let fv_ft: *Type = alloc_type(TY_FUNC, 8, 8)
      fv_ft.pointee = fv_fn.ret_ty
      return ir_func_addr_value(P.current_fn, fv_fn, fv_ft)
  }
  // ⚠UNKNOWN IDENTIFIER STILL FALLS THROUGH TO CONSTANT ZERO -- A KNOWN, UNFIXED HOLE.
  // Reaching here means `name` resolved to NOTHING: not a local, not a module const, not a string
  // const, not a function.  Returning 0 silently emits the CONSTANT ZERO in its place, so a typo --
  // or the banked case of a `let` local referenced ABOVE its declaration -- becomes 0 with no
  // diagnostic and SEGVs far from the cause.  It is the same silent-value-id-0 class already killed
  // for undefined CALLS (parse_primary_call) and, just above, for bare function names.
  //
  // A fail-loud version WAS built and tested here 2026-07-20 and is NOT shipped, deliberately.
  // ★It paid for itself immediately: it caught `AT_FDCWD` being read as 0 by sys_unlinkat /
  // sys_fchmodat (a forward module-const reference) -- a live miscompile now fixed in
  // nx_syscalls.nx, with a standing witness at runtime/nx_fwdconst_probe.nx proving the class
  // (forward-read=0 vs direct-read=-100 in ONE binary).
  // ★But it also reports a FALSE POSITIVE that is not yet understood: `unknown identifier: m` while
  // parsing nx_opt.nx after `inl_clone_all`, where `m` is an ordinary FUNCTION PARAMETER
  // (`opt_inline_module(m: *Module)`) used normally -- i.e. find_local misses a live parameter in
  // some context.  Shipping a compiler diagnostic whose false positive is unexplained would trade a
  // silent-wrong-value bug for a can't-build bug, so it stays out until that is root-caused.
  // NEXT RUNG: root-cause the find_local miss (print the enclosing function in the diagnostic to
  // self-locate it), then land this exactly like the call-arity check was landed.
  //
  // ---- WHAT *IS* SHIPPED: the FORWARD MODULE-CONST slice, caught precisely -----------------
  // The blanket check is unsafe (above), but ONE slice of it is both safe and high value. If
  // `name` is declared as a module `const` LATER in the token stream, this is unambiguously the
  // forward-module-const miscompile -- the one that made AT_FDCWD read 0 instead of -100 and so
  // put dirfd=0 into sys_unlinkat/sys_fchmodat. No legitimate program has that shape, and it
  // CANNOT false-positive the way the blanket check does: an ordinary parameter (the `m` case)
  // is never also declared as a later const. Witness: runtime/nx_fwdconst_probe.nx.
  if mconst_declared_later(P, name) == 1 {
      // LN42 (2026-09-03): the last refusal in this file that printed a bare sentence with no location.
      // A hand-counted length beside each literal (52 and 68) was a second copy of the literal shape, the
      // exact drift LN27 removed elsewhere; nx_diag_puts measures the string itself.
      nx_diag_organ_at(nx_pd_line)
      nx_diag_puts(": this module const is used before it is declared: " as *u8)
      nx_diag_puts(name)
      nx_diag_puts("\n" as *u8)
      nx_diag_caret(nx_pd_line, nx_pd_col)
      nx_diag_puts("  why the build stopped: a module const is folded into its readers at the point of use, so a reader ABOVE the declaration would silently read 0 rather than the value -- a wrong answer compiled without complaint, which is the one outcome this compiler refuses to produce.\n" as *u8)
      nx_diag_puts("  fix: move the const declaration ABOVE its first reader. Forward references are deliberately not allowed here, the same restriction C and Rust place on const-expression ordering.\n" as *u8)
      nx_diag_note_error()
      return 0
  }
  // seq1012 FAIL-LOUD (landed 2026-07-29): an identifier that resolves to NOTHING is a
  // compile ERROR, never the silent constant 0 that wrote wrong data and relocated with
  // unrelated refactors. The 2026-07-20 attempt was withheld over ONE false positive
  // ("m" in fn inl_clone_all) -- the survey diagnostic located it as seq358 IN A MASK:
  // the multiline else-if desync fused functions, so live parameters resolved against the
  // wrong function. With the else-if production fixed, the whole corpus surveys CLEAN
  // (nx_compile_x86 + nx_wasm_craft + nx_game_page_emit: unresolved=0) and this check
  // lands exactly like the call-arity check did. Witness: runtime/nx_undefprobe.nx.
  // The caller consumed the identifier before resolution began, so its own token sits one
  // slot back (the parse_primary_call anchoring lesson: never take the line at error time
  // from the CURRENT position -- take the construct's own token).
  var uid_ln: i64 = 0
  var uid_cl: i64 = 0
  if P.pos > 0 {
      let uid_tok: *Tok = tok_at(P.toks, P.pos - 1)
      uid_ln = uid_tok.line
      uid_cl = uid_tok.col
  }
  nx_dym_suggest_ident(P, name, fv_nl)
  nx_diag_at(uid_ln)
  nx_diag_puts(": I do not know the name '" as *u8)
  sys_write(2, name, fv_nl)
  nx_diag_puts("'" as *u8)
  if P.current_fn != (0 as *Function) {
      nx_diag_puts(" (used inside the function '" as *u8)
      sys_write(2, P.current_fn.name_start as *u8, P.current_fn.name_len)
      nx_diag_puts("')" as *u8)
  }
  nx_diag_puts(" -- no variable, constant, or function defines it.\n" as *u8)
  nx_diag_caret(uid_ln, uid_cl)
  nx_diag_why_undefined()
  nx_dym_note2(P, name, fv_nl)
  nx_diag_note_error()
  return 0
4835}
4836
4837// Prefix-unary level.  The trailing `as T` cast lives HERE (the
4838// wrapper), NOT inside the operand parse, so prefix operators bind
4839// TIGHTER than `as`: `*p as T` == `(*p) as T` (Rust precedence).
4840// Pre-fix, the deref branch's recursive operand parse swallowed the
4841// cast -- `*p as *u8` parsed as `*(p as *u8)` and byte-loaded the
4842// POINTER CELL, then deref'd that garbage (SIGSEGV).  Min repro:
4843// runtime/_derefcast_minrepro.nx (the B2-row landmine, 2026-06-10).
4844func parse_unary(P: *Parser) -> i64 {
  let base: i64 = parse_unary_core(P)
  // Trailing `as T` cast.  The cast RESULT must carry target_ty so downstream
  // LOAD/STORE/GEP see the correct pointee -- but the OPERAND must keep its own
  // type.  This used to do `bv.ty = target_ty` IN PLACE on the operand's Value:
  // when the operand is a bare local, that node IS the local's binding, so
  // `p as i64` flipped p to INTEGER for EVERY later reference.  Proven minimal
  // 2026-08-05 (nx_probe_castmut_live.nx: a prior cast-in-argument-position made
  // the pointer-into-integer refusal VANISH; discriminator castmut2 shows it is
  // per-value) -- and it is the ROOT of the 57/70 sys_munmap-arg-1 residue that
  // kept the reverse call-arg type direction disabled (see the do-not-enable
  // note in the call type check).  Fix: emit a typed IDENTITY (base + 0) so the
  // cast result is a FRESH Value id with target_ty and a legitimate result slot
  // in every backend; the optimizer may fold the identity -- harmless, because
  // type checks run at parse time and load/store widths are instruction-encoded.
  // CHAINED CASTS (2026-08-13 night): `X as *u8 as i64` was HALF-APPLIED for as long as this
  // site has existed -- the single `if` consumed ONE cast and the dangling `as i64` fell into
  // the silent junk-skip, so the second cast never happened (right bits by accident for
  // ptr->int, wrong TYPE always). The new discarded-expression check turned that silence into
  // a refusal with a MISLEADING cause at 15 estate sites (nx_tool_run/nx_mgmt_data closure),
  // which is how the gap finally surfaced. A WHILE makes the chain real: each `as T` wraps the
  // previous value in a typed identity; bits unchanged, final TYPE = the last cast.
  var cast_v: i64 = base
  // LN6: remember what the chain's OPERAND was, so a call site can ask what a cast erased.
  var cast_src: *Type = 0 as *Type
  let bv0: *Value = val_at(P.current_fn, base)
  if bv0 != (0 as *Value) { cast_src = bv0.ty }
  while peek_kind(P) == TK_AS {
      advance_tok(P)
      let target_ty: *Type = parse_type(P)
      if target_ty == (0 as *Type) { break }
      let czero: i64 = safe_const_i64(P, 0, "parse.nx:cast-identity-const0" as *u8)
      // LN3: the cast's typed identity is a FRESH value id, so provenance recorded on the
      // operand (a sys_mmap result, or a prior link of this chain) must follow it -- this is
      // what makes the estate idiom `let s: *i64 = sys_mmap(N) as *i64` bindable.
      var pp_carry: i64 = 0
      if cast_v == g_prov_val { pp_carry = 1 }
      cast_v = ir_emit_binop(P.current_bb, OP_ADD, cast_v, czero, target_ty)
      if pp_carry == 1 { g_prov_val = cast_v }
  }
  if cast_v != base { g_last_cast_val = cast_v; g_last_cast_src_ty = cast_src }
  return cast_v
4886}
4887
4888func parse_unary_core(P: *Parser) -> i64 {
  nx_assert_ptr(P.current_fn as *u8, "parse_unary: P.current_fn" as *u8)
  nx_assert(P.current_fn.values_cap > 0,
            "parse_unary: P.current_fn init" as *u8)
  let k: i64 = peek_kind(P)
  if k == TK_MINUS {
      advance_tok(P)
      let rhs: i64 = parse_unary(P)
      let zero: i64 = safe_const_i64(P, 0, "parse.nx:LINE-const0" as *u8)
      return ir_emit_binop(P.current_bb, OP_SUB, zero, rhs, ir_type_i64())
  }
  if k == TK_BANG {
      advance_tok(P)
      let rhs: i64 = parse_unary(P)
      let zero: i64 = safe_const_i64(P, 0, "parse.nx:LINE-const0" as *u8)
      return ir_emit_binop(P.current_bb, OP_EQ, rhs, zero, ir_type_bool())
  }
  // ~expr -- bitwise NOT (one's complement).  Parallels TK_BANG above;
  // lowers to the dedicated OP_NOT (single x86 `notq` / rv64 `not`),
  // the optimal one-instruction form.  Was MISSING from the function-
  // body parser (only the const-evaluator handled `~`), so `~x` in a
  // function body fell through to parse_primary, silently miscompiled,
  // AND desynced the token stream -- which surfaced downstream as the
  // misleading "address-of unknown local (&name)" when a binary `&`
  // followed (e.g. SHA-256 Choose: `((~e) & g) ...`).  Now `~` is a
  // first-class prefix operator like -, !, &, *.
  if k == TK_TILDE {
      advance_tok(P)
      let rhs: i64 = parse_unary(P)
      return ir_emit_unop(P.current_bb, OP_NOT, rhs, ir_type_i64())
  }
  // &name[.field]* -- address-of, with optional field-chain walk.
  // Valid on alloca-backed vars; returns the alloca address (no
  // load) when there's no chain, or the GEP'd field address when
  // `.field.subfield...` follows.
  //
  // Extended 2026-05-16 per cardinal feedback-bits-up-canonical-
  // layer + user directive "never avoid a limitation bits up build":
  // previously rejected `&card.field`, forcing callers to inline
  // assignments.  Now mirrors parse_stmt_ident_dot's chain walker
  // exactly, only returning the ADDRESS (no load, no store).
  //
  // STUB(parser, T#parser-001): non-alloca local case currently
  //   absorbs the error by returning 0.  Caller can't distinguish
  //   "no such local" from "address-of-non-alloca-local"; either
  //   path silently miscompiles.
  //   Plan: distinguish via typed error sentinel or assert; depends
  //   on a parser-wide error-reporting path that doesn't yet exist.
  //   Closes when: parser grows a typed error channel.
  if k == TK_AMP {
      advance_tok(P)
      let name_tok: *Tok = advance_tok(P)
      let name: *u8 = tok_text_ptr(name_tok)
      let L: *Local = find_local(P, name)
      if L == (0 as *Local) {
          // Not a local -- maybe a FUNCTION: `&fn` yields the function's code address (VK_FUNC_ADDR),
          // emitted as `leaq <fn>(%rip), %reg`. Shares its mechanism with bare-fn-name-as-value.
          var amp_nl: i64 = 0
          while name[amp_nl] != 0 { amp_nl = amp_nl + 1 }
          let amp_fn: *Function = find_function(P.module, name, amp_nl)
          if amp_fn != (0 as *Function) {
              let amp_ft: *Type = alloc_type(TY_FUNC, 8, 8)
              amp_ft.pointee = amp_fn.ret_ty
              return ir_func_addr_value(P.current_fn, amp_fn, amp_ft)
          }
          parse_die("address-of unknown local (&name)" as *u8, 32)
      }
      // Bare `&name` (no .field chain): the ADDRESS of the local's
      // stack slot.  Emit OP_ADDR_OF so codegen uses the as-address
      // (leaq) path; returning the raw alloca value-id auto-loads the
      // slot CONTENTS -> bogus pointer -> SEGV.  Works for value-typed
      // (`var x: i64`) AND pointer-typed (`var p: *T`, out-params).
      if L.is_alloca == 1 {
          if peek_kind(P) != TK_DOT {
              let pt: *Type = alloc_type(TY_PTR, 8, 8)
              pt.pointee = L.ty
              return ir_emit_unop(P.current_bb, OP_ADDR_OF, L.value_id, pt)
          }
      }
      var v: i64 = L.value_id
      // Mirror the F-meta-3 fix in parse_stmt_ident_dot: when the
      // local is alloca-backed AND it's a pointer AND we're walking
      // a `.field` chain, load the pointer value out of the slot
      // first so GEP applies to the actual pointee, not the alloca.
      //
      // CRITICAL: do this ONLY when a `.field` chain follows.  For
      // bare `&name` we want the ALLOCA ADDRESS (== L.value_id),
      // NOT the loaded pointer value.  Pre-fix this overload broke
      // outparam patterns like `nx_media_pool_get(..., &src, ...)`
      // where the callee writes through the pointer expected to be
      // &src's slot -- the load made it write through src's value
      // (uninitialised 0 -> NULL deref).
      if L.is_alloca == 1 {
          if L.ty != (0 as *Type) {
              if L.ty.kind == TY_PTR {
                  if peek_kind(P) == TK_DOT {
                      v = ir_emit_load(P.current_bb, L.value_id, L.ty)
                  }
              }
          }
      }
      var ty: *Type = L.ty
      while peek_kind(P) == TK_DOT {
          advance_tok(P)
          let ftok: *Tok = advance_tok(P)
          let fname: *u8 = tok_text_ptr(ftok)
          var flen: i64 = 0
          while fname[flen] != 0 { flen = flen + 1 }
          var stty: *Type = ty
          if stty != (0 as *Type) {
              if stty.kind == TY_PTR {
                  if stty.pointee != (0 as *Type) { stty = stty.pointee }
              }
          }
          if stty == (0 as *Type) { break }
          let field: *StructField = parse_field_of_struct(P, stty, ftok, fname, flen)
          if field == (0 as *StructField) { break }
          let off2: i64 = safe_const_i64(P, field.offset, "parse.nx:amp-field-offset" as *u8)
          // `&f.b` is an ADDRESS, so its type is POINTER-to-field, not the field's own type.
          // ir_emit_gep uses its 4th arg DIRECTLY as the result value's type (nx_ir.nx:1216), so
          // passing field.ty typed &f.b as i64 -- an INTEGER. The bare `&name` path 40 lines above
          // already builds TY_PTR with pointee = L.ty; this chain path never did.
          // MEASURED 2026-08-10: the DEPLOYED compiler contains no "argument type mismatch" string
          // at all (grep -a, with `address-of unknown local` as the positive control), so it never
          // checked and this mistyping was invisible for as long as it has existed. The gauntlet's
          // addr_of_field tooth only started failing because the CHECK is new -- the BUG is old.
          // ★★★★★ A NEW CHECKER FAILING AN OLD TEST IS NOT A REGRESSION; IT IS THE FIRST TIME
          // ANYTHING LOOKED. Fix the type, not the checker.
          let fpt: *Type = alloc_type(TY_PTR, 8, 8)
          fpt.pointee = field.ty
          v = ir_emit_gep(P.current_bb, v, off2, fpt)
          // the chain walker derefs a TY_PTR itself, so keep `ty` as the field type for the next hop
          ty = field.ty
      }
      return v
  }
  // *expr -- pointer dereference in expression position.  Loads
  // from the pointee.  Compared with the `*name = expr` statement
  // path above, this one yields a value (not an lvalue).
  if k == TK_STAR {
      advance_tok(P)
      // Operand via CORE: a trailing `as` belongs to the deref
      // RESULT (wrapper), never to the address operand.
      let addr: i64 = parse_unary_core(P)
      oe_chain_check(P, addr)                  // LN2: `*p` reads through p
      // Result type = pointee of addr's type (NOT hardcoded i64).
      // Without this, `*(p: *u8)` loads 8 bytes instead of 1.
      let addr_val: *Value = val_at(P.current_fn, addr)
      var elem_ty: *Type = ir_type_i64()
      if addr_val.ty != (0 as *Type) {
          if addr_val.ty.kind == TY_PTR {
              if addr_val.ty.pointee != (0 as *Type) {
                  elem_ty = addr_val.ty.pointee
              }
          }
      }
      return ir_emit_load(P.current_bb, addr, elem_ty)
  }
  // Trailing `as T` handling lives in the parse_unary wrapper
  // (required for `((p as i64) + i) as *u8` retype patterns --
  // see wrapper comment for the deref-precedence defect this
  // placement fixes).
  return parse_primary(P)
5051}
5052
5053// Helpers for type-directed arithmetic op selection.  When either
5054// operand is TY_F32 (f64 later), promote OP_ADD/SUB/MUL/DIV_S to
5055// their floating-point counterparts and carry TY_F32 through the
5056// result.  Non-fp operands fall through to the integer ops + i64
5057// result type -- same as the pre-F-extension behavior.
5058
5059func fp_op_for_int(op: i64) -> i64 {
  if op == OP_ADD   { return OP_FADD }
  if op == OP_SUB   { return OP_FSUB }
  if op == OP_MUL   { return OP_FMUL }
  if op == OP_DIV_S { return OP_FDIV }
  return op
5065}
5066
5067func has_fp_operand(P: *Parser, v: i64) -> i64 {
  if v < 0 { return 0 }
  if v >= P.current_fn.n_values { return 0 }
  let base: i64 = P.current_fn.values as i64
  let val: *Value = (base + v * 48) as *Value
  if val.ty == (0 as *Type) { return 0 }
  if val.ty.kind == TY_F32 { return 1 }
  if val.ty.kind == TY_F64 { return 1 }
  return 0
5076}
5077
5078func nx_value_type(P: *Parser, v: i6
nx_parse.nx source

`nx_parse.nx` source
