`nx_parse.nx` source

↩ module page · 5705 lines · 262144 B
1// parse.nx -- NishiLang recursive-descent parser, in NishiLang.
2// 2026-04-23: full monomorphization port landed; stdlib.nx's
3// Option<T> / Result<T, E> now instantiate to distinct cached
4// Types here the same way parse.c does.
5//
6// Port of parse.c's core: precedence expression parsing, function
7// declarations, and the common statements (return, let, var, if,
8// while).  Struct / enum / const / match / pattern-matching are
9// deferred to a second port turn so this file stays bounded.
10//
11// Produces IR using the emitter functions defined in ir.nx: for
12// full compilation the driver (main.nx) passes the lex output
13// here, then onto opt -> regalloc -> riscv.
14
15// nx_safety_envelope:  (schema: nishi-library/seeds/safety-critical-standards.toml)
16//   intended_use:       "NishiLang substrate parser -- self-host
17//                        replacement for parse.c (C anchor).  All
18//                        substrate code goes through this parser
19//                        when nxc.elf builds; correctness here
20//                        affects every downstream primitive."
21//   sil_target:         SIL2     (compiler correctness; bugs here
22//                                 manifest as miscompilation of
23//                                 every consumer)
24//   asil_target:        QM
25//   dal_target:         DAL B    (avionics-targeted substrate code
26//                                 inherits the parser's correctness;
27//                                 DO-178C DAL B chain depends on it)
28//   iec_62304_class:    NONE     (substrate-tool, not deployed runtime)
29//   evidence:           [single_pass_no_backtrack, bounded_recursion,
30//                        sealed_token_kinds_TK_complete,
31//                        differential_check_via_bench_ir_diff_sh,
32//                        F16_prevention_via_self_host_gauntlet]
33//   hazard_register:    [bug-tape-parse-codegen-IR-divergence-F13,
34//                        bug-tape-F16-self-compile-reentry-hazard,
35//                        bug-tape-stmt-boundary-false-positive-F-meta-2,
36//                        bug-tape-struct-field-chain-load-elision]
37//   residual_risk:      "Self-compile reentry hazard (F16) is the
38//                        dominant residual risk.  ANY change to this
39//                        file MUST run bench/self_host_gauntlet.sh
40//                        before commit -- cardinal feedback-self-
41//                        compile-reentry-prevention-pillar."
42//   verdict:            NOT_YET_EVALUATED
43
44// Shared IR layouts (Type, Value, Instr, BasicBlock, Function, ...).
45import "nx_types.nx"
46import "nx_quant.nx"
47
48// Shared Tok record + TK_* TokenKind constants.
49import "nx_lex_kinds.nx"
50
51// Real IR builders.  Previously stubbed here; since the module-
52// library split, parse.nx directly emits into ir.nx's Module/Function
53// pools.  Still-missing builders (load/store/alloca/br_cond) remain
54// stubbed at the bottom of this file until ir.nx grows them.
55import "nx_ir.nx"
56
57// ---- runtime helpers ----
58// sys_mmap comes from syscalls.nx (via ir.nx); no local copy.
59
60func tok_at(toks: *Tok, i: i64) -> *Tok {
  let base: i64 = toks as i64
  return (base + i * TOK_BYTES) as *Tok
63}
64
65// One-char marker for tracing parser dispatch.  Caller picks a unique
66// character per function entry; sequence on stderr reveals the exact
67// dispatch path taken at runtime.  Cheap (1 syscall, 1 byte) so we
68// can drop it on every parse_* function without bloating output.
69// Switch to a no-op (just `return 0`) once the parser is bug-free.
70func tr(c: i64) -> i64 {
  let buf: *u8 = sys_mmap(8)
  buf[0] = c
  sys_write(2, buf, 1)
  return 0
75}
76
77// Bits-up equivalent of parse.c's die(P, msg).  Emits a stderr line
78// then sys_exit(2).  Added 2026-05-19 with the mconsts cap bump so
79// the NishiLang self-host fails LOUDLY on parser-table overflow
80// instead of silently corrupting the heap past the mmap'd capacity.
81// Per Cardinal 12 (defensive at boundaries): the parser is the
82// boundary between input source and compiled IR; overflow there is
83// the kind of silent-corruption false-OK class [[feedback-no-false-
84// ok-substrate-honesty-audit]] explicitly names.
85func parse_die(msg: *u8, msg_len: i64) -> i64 {
  sys_write(2, "nx_parse: " as *u8, 10)
  sys_write(2, msg, msg_len)
  sys_write(2, "\n" as *u8, 1)
  sys_exit(2)
  return 0
91}
92
93// ---- CARET + SOURCE SNIPPET (2026-08-05) ----------------------------------
94// Toks have carried line AND col all along; what the Parser never had was the SOURCE, so a
95// diagnostic could say WHERE but never SHOW it. rustc and Elm both show the offending line with a
96// caret under the column, and that is most of why their errors feel different.
97// PLUMBED ADDITIVELY: a module static the driver fills right after it reads the input, so NO
98// existing caller of parse_module changes signature, and any caller that does not set it simply
99// gets no snippet (the diagnostic still carries line/col). Degrades to exactly today's behaviour.
100// NOTE ON LINE NUMBERS: nx_cc parses PRE-EXPANDED source (imports inlined), so the line is the
101// expanded-source line -- which is the line the caret must point at to be truthful about what the
102// compiler actually read. Mapping back to per-file lines is a separate rung.
103// ---- MULTI-ERROR RECOVERY (2026-08-05) ------------------------------------
104// Every semantic diagnostic used to sys_exit(2) on the spot, so one broken
105// build reported ONE error and charged the author a full rebuild per mistake.
106// rustc and Elm report everything they can see. RECOVERY CONTRACT: a site
107// whose parser POSITION is already sane (the construct was fully consumed
108// before the verdict) calls nx_diag_note_error() and continues with a safe
109// placeholder value; parse_module then REFUSES to return the module while
110// nx_diag_nerr > 0, so recovered (poisoned) IR can NEVER reach codegen --
111// the SITES-LIVE silent-value-id-0 lesson stays intact because recovery
112// values exist only on builds that are already doomed to exit 2.
113// Parser-DESYNC sites (reserved keyword in name position, operator at
114// expression start, parse_die table overflow) stay FATAL BY DESIGN: past a
115// desync every further diagnostic would point at innocent code.
116const NX_DIAG_MAX_ERRS: i64 = 20
117static nx_diag_nerr: i64
118
119func nx_diag_note_error() -> i64 {
  nx_diag_nerr = nx_diag_nerr + 1
  if nx_diag_nerr >= NX_DIAG_MAX_ERRS {
      sys_write(2, "nx_parse: too many errors; stopping here\n" as *u8, 41)
      sys_exit(2)
  }
  return 0
126}
127
128static nx_diag_src: *u8
129static nx_diag_src_len: i64
130
131func nx_diag_set_source(p: *u8, n: i64) -> i64 {
  nx_diag_src = p
  nx_diag_src_len = n
  return 0
135}
136
137// Print "  <source line>" then "  <spaces>^" under column col (1-based). Silent when the source
138// was never registered or the line cannot be found -- a caret pointing at the wrong place would be
139// worse than none.
140func nx_diag_caret(line: i64, col: i64) -> i64 {
  if (nx_diag_src as i64) == 0 { return 0 }
  if nx_diag_src_len <= 0 { return 0 }
  if line <= 0 { return 0 }
  let s: *u8 = nx_diag_src
  var start: i64 = 0 - 1
  if line == 1 { start = 0 }
  var i: i64 = 0
  var cur: i64 = 1
  while i < nx_diag_src_len {
      if s[i] == (10 as u8) {
          cur = cur + 1
          if cur == line { start = i + 1; i = nx_diag_src_len }
      }
      if i < nx_diag_src_len { i = i + 1 }
  }
  if start < 0 { return 0 }
  var e: i64 = start
  var go: i64 = 1
  while go == 1 {
      if e >= nx_diag_src_len { go = 0 } else {
          if s[e] == (10 as u8) { go = 0 } else { e = e + 1 }
      }
  }
  var n: i64 = e - start
  if n > 200 { n = 200 }
  if n <= 0 { return 0 }
  sys_write(2, "  " as *u8, 2)
  sys_write(2, ((s as i64) + start) as *u8, n)
  sys_write(2, "\n  " as *u8, 3)
  var c: i64 = 1
  while c < col {
      var ch: *u8 = " " as *u8
      if c - 1 < n { if s[start + c - 1] == (9 as u8) { ch = "\t" as *u8 } }
      sys_write(2, ch, 1)
      c = c + 1
  }
  sys_write(2, "^\n" as *u8, 2)
  return 1
179}
180
181// Print source line N indented, NO caret -- the quoting half of the caret machinery, used by
182// nx_dym_note to SHOW a suggestion's declaration instead of describing it in shorthand.
183func nx_diag_show_line(line: i64) -> i64 {
  if (nx_diag_src as i64) == 0 { return 0 }
  if nx_diag_src_len <= 0 { return 0 }
  let s: *u8 = nx_diag_src
  var cur: i64 = 1
  var start: i64 = 0 - 1
  if line == 1 { start = 0 }
  var i: i64 = 0
  while i < nx_diag_src_len {
      if s[i] == (10 as u8) {
          cur = cur + 1
          if cur == line { start = i + 1; i = nx_diag_src_len }
      }
      if i < nx_diag_src_len { i = i + 1 }
  }
  if start < 0 { return 0 }
  var e: i64 = start
  var go: i64 = 1
  while go == 1 {
      if e >= nx_diag_src_len { go = 0 } else {
          if s[e] == (10 as u8) { go = 0 } else { e = e + 1 }
      }
  }
  var n: i64 = e - start
  if n > 200 { n = 200 }
  if n <= 0 { return 0 }
  sys_write(2, "      " as *u8, 6)
  sys_write(2, ((s as i64) + start) as *u8, n)
  sys_write(2, "\n" as *u8, 1)
  return 1
213}
214
215// ---- DID-YOU-MEAN (2026-08-05) --------------------------------------------
216// rustc and Elm both answer a misspelled name with the name you meant; nx_cc used to answer
217// "call to undefined function: sys_wrte" and stop, which tells the author WHAT is wrong and
218// nothing about what to type. The names are all already in the module: this is a scan, not a
219// new index. Bounded Levenshtein (classic two-row DP) with an early length filter.
220// COST CONTROL: only runs on the ERROR path, immediately before exiting.
221func nx_dym_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
222
223// Edit distance between a (len la) and b (len lb), capped: any pair whose lengths differ by more
224// than udget is rejected without the DP. Returns a large number when over budget.
225func nx_dym_dist(a: *u8, la: i64, b: *u8, lb: i64, budget: i64) -> i64 {
  var d: i64 = la - lb
  if d < 0 { d = 0 - d }
  if d > budget { return 999 }
  if la > 64 { return 999 }
  if lb > 64 { return 999 }
  let prev: *u8 = sys_mmap(80)
  let cur: *u8 = sys_mmap(80)
  var j: i64 = 0
  while j <= lb { prev[j] = j as u8; j = j + 1 }
  var i: i64 = 1
  while i <= la {
      cur[0] = i as u8
      var k: i64 = 1
      while k <= lb {
          var cost: i64 = 1
          if a[i - 1] == b[k - 1] { cost = 0 }
          var best: i64 = (prev[k] as i64) + 1
          let ins: i64 = (cur[k - 1] as i64) + 1
          if ins < best { best = ins }
          let sub: i64 = (prev[k - 1] as i64) + cost
          if sub < best { best = sub }
          cur[k] = best as u8
          k = k + 1
      }
      var c: i64 = 0
      while c <= lb { prev[c] = cur[c]; c = c + 1 }
      i = i + 1
  }
  return prev[lb] as i64
255}
256
257// DYM WINNER CONTEXT (2026-08-05, operator bar: "did-you-mean is the floor -- the suggestion
258// must take the reader to what the recommended spelling DOES, so an AI or a human judges by
259// CONTEXT, not naming"). The suggesters stash the winning candidate here; the diagnostic site
260// calls nx_dym_note(P) after the caret to print ONE `note:` line with the winner's declaration
261// facts. kind: 0 none, 1 function, 2 module const, 3 local, 4 struct, 5 generic type param.
262static nx_dym_last_kind: i64
263static nx_dym_last_p: *u8
264static nx_dym_last_l: i64
265static nx_dym_last_aux: i64
266
267// Print " -- did you mean 'X'?" for the closest DEFINED function name, if one is close enough.
268// Silent when nothing is near: a wrong suggestion is worse than none.
269func nx_dym_suggest_fn(m: *Module, name: *u8, nlen: i64) -> i64 {
  if m == (0 as *Module) { return 0 }
  var budget: i64 = 2
  if nlen <= 4 { budget = 1 }
  var best_d: i64 = 999
  var best_p: *u8 = 0 as *u8
  var best_l: i64 = 0
  var best_np: i64 = 0
  var i: i64 = 0
  while i < m.n_functions {
      let base: i64 = m.functions as i64
      let f: *Function = (base + i * 176) as *Function
      let fn_p: *u8 = f.name_start as *u8
      let fn_l: i64 = f.name_len
      if fn_l > 0 {
          let dd: i64 = nx_dym_dist(name, nlen, fn_p, fn_l, budget)
          if dd < best_d { best_d = dd; best_p = fn_p; best_l = fn_l; best_np = f.n_params }
      }
      i = i + 1
  }
  if best_d > budget { return 0 }
  if best_d == 0 { return 0 }
  if (best_p as i64) == 0 { return 0 }
  nx_dym_last_kind = 1
  nx_dym_last_p = best_p
  nx_dym_last_l = best_l
  nx_dym_last_aux = best_np
  sys_write(2, " -- did you mean '" as *u8, 18)
  sys_write(2, best_p, best_l)
  sys_write(2, "'?" as *u8, 2)
  return 1
300}
301
302// Decimal-print an i64 to stderr (for line numbers in diagnostics).
303func nx_put_dec_err(n: i64) -> i64 {
  if n == 0 { sys_write(2, "0" as *u8, 1) return 0 }
  var m: i64 = n
  if m < 0 { sys_write(2, "-" as *u8, 1) m = 0 - m }
  let digits: *u8 = sys_mmap(24)
  var k: i64 = 0
  while m > 0 {
      digits[k] = (0x30 + (m % 10)) as u8
      m = m / 10
      k = k + 1
  }
  var i: i64 = k - 1
  while i >= 0 {
      let one: *u8 = sys_mmap(1)
      one[0] = digits[i]
      sys_write(2, one, 1)
      i = i - 1
  }
  return 0
322}
323
324// Print one token's inline text to stderr (printable bytes only, capped).
325func nx_put_tok_text_err(t: *Tok) -> i64 {
  let txt: *u8 = tok_text_ptr(t)
  let one: *u8 = sys_mmap(1)
  var k: i64 = 0
  var stop: i64 = 0
  while stop == 0 {
      let c: i64 = txt[k] as i64
      if c < 0x20 { stop = 1 }
      if c > 0x7E { stop = 1 }
      if stop == 0 {
          one[0] = txt[k] as u8
          sys_write(2, one, 1)
          k = k + 1
      }
      if k >= 40 { stop = 1 }
  }
  if k == 0 { sys_write(2, "." as *u8, 1) }   // punctuation w/ empty inline text
  return 0
343}
344
345// Diagnostic context: print a window of source tokens around `name_tok`
346// so the offending statement is visible even before full snippet+caret
347// (NDX-1 spec interim).  Token text is inline in each Tok, so this works
348// without threading the source buffer through the parser.
349func nx_diag_token_window(P: *Parser, tidx: i64) -> i64 {
  var ci: i64 = tidx - 8
  if ci < 0 { ci = 0 }
  sys_write(2, "  near: " as *u8, 8)
  while ci <= tidx + 2 {
      let ct: *Tok = tok_at(P.toks, ci)
      nx_put_tok_text_err(ct)
      sys_write(2, " " as *u8, 1)
      ci = ci + 1
  }
  sys_write(2, "\n" as *u8, 1)
  return 0
361}
362
363// ---- Parser state ----
364
365struct Local {
  // Name stored as first 8 chars in text0..text7 (matches Tok layout).
  name0: i64, name1: i64, name2: i64, name3: i64,
  name4: i64, name5: i64, name6: i64, name7: i64,
  value_id:   i64,
  is_alloca:  i64,
  ty_kind:    i64,      // 5 = i64, etc. (legacy fast tag)
  // Full type carried so parse_field_chain can pick the right
  // pointer stride.  *u8 indexing must use stride 1, not the
  // default i64 stride 8.  Closes T#types-001's parser side.
  ty:         *Type,
376}
377
378const LOCAL_BYTES: i64 = 96
379
380// Per-function locals pool capacity.  Reset to 0 per function, so this is
381// the MAX simultaneous locals any single function may declare.  Was 64 --
382// missed when the mconsts pool was bumped off the C-bootstrap limit
383// (2026-05-20).  64 silently overflowed the locals pool into the ADJACENT
384// globals pool (consecutive anonymous mmaps share a boundary), corrupting
385// m.globals/m.n_globals -> garbage .rodata emission, for any function with
386// >64 locals (e.g. the ACME issuance drive's main).  Bumped to 8192 (the
387// daily-driver cap belongs to NishiLang, not the bootstrap) + add_local now
388// die()s loudly on exhaustion instead of corrupting silently.
389const NX_PARSE_LOCALS_CAP: i64 = 8192
390
391struct Parser {
  toks:       *Tok,
  pos:        i64,
  module:     *Module,       // parent module; owns Functions and Globals
  current_fn: *Function,
  current_bb: *BasicBlock,
  locals:     *Local,
  n_locals:   i64,
  // First local index of the INNERMOST block. A redeclaration is only a duplicate within
  // THIS block; shadowing an enclosing scope is legal and the estate relies on it.
  block_base: i64,
402
  // Innermost loop context
  loop_head:  *BasicBlock,
  loop_exit:  *BasicBlock,
406
  // Module-level integer constants.  `const NAME: i64 = N` registers
  // here; parse_primary consults this list when an identifier misses
  // the local table so const uses inside functions fold to literals.
  mconsts:    *MConst,
  n_mconsts:  i64,
412
  // Module-level struct types.  Each TY_STRUCT we parse is registered
  // here so parse_type can resolve user struct names to their layout.
  // STUB(parser, T#parser-002): pool capped at 64 entries.
  //   Plan: grow dynamically (mirror globals-pool growth in
  //   ir_module_new) + bounds-check in register_struct.
  //   Closes when: any nxc.nx self-compile with >64 struct decls.
  structs:    *StructEntry,
  n_structs:  i64,
421
  // Module-level `static` declarations.  Each maps an inline-name
  // copy + its global id.  On parse_function entry we inject one
  // synthesised Local per static with a VAL_GLOBAL_ADDR Value, so
  // use sites inside functions lower via the standard local-lookup
  // path (is_alloca=1 => auto-load / indexed write / field chain).
  statics:    *StaticEntry,
  n_statics:  i64,
429
  // Module-level enums.  Tracks per-enum whether any variant has a
  // payload: tagged enums get an auto-generated shadow struct
  // (tag + payload fields) so constructors + match can build and
  // deconstruct the ADT.  Plain enums stay as int discriminants.
  enums:      *EnumEntry,
  n_enums:    i64,
436
  // Active generic type parameters.  Populated while parsing
  // inside `struct Name<T, U> { ... }` so that parse_type can
  // detect an identifier like `T` and produce a TY_PARAM node.
  // Cleared after the struct's field list finishes.  Static cap
  // matches parse.c's args[8] limit.
  active_params:   *i64,       // array of *u8 name ptrs
  n_active_params: i64,
444
  // V-LANGEXT M2 hygiene guard: depth of currently-parsing nested
  // if-then-else expressions. Incremented at parse-time entry; checked
  // against NX_PARSE_IFEXP_MAX_DEPTH; rejected if exceeded. Prevents
  // pathological codegen from any source that nests if-expressions
  // beyond what real-world code ever needs (e.g., 16 is already deeper
  // than any human-readable nested ternary -- C `?:` chains are
  // similarly capped by readability + most linters).
  // Per [[feedback-nishilang-extension-guardrails-2026-05-27]] +
  // operator 2026-05-27: "we want to avoid hoisting issues and
  // namespace issues and all the other hygiene issues that make
  // languages suck, really research and make sure we are adding good
  // functionality not future nightmares".
  ifexp_depth:     i64,
458}
459
460// One entry per `enum NAME { ... }`.  The shadow_ty is non-null only
461// when any variant declared a payload type -- plain enums keep the
462// int-discriminant representation and leave shadow_ty = null.
463struct EnumEntry {
  name0: i64, name1: i64, name2: i64, name3: i64,
  name4: i64, name5: i64, name6: i64, name7: i64,
  name_len:  i64,
  has_payload: i64,
  shadow_ty:   *Type,
  n_variants:  i64,
470}
471
472const ENUM_ENTRY_BYTES: i64 = 96
473
474struct StaticEntry {
  name0: i64, name1: i64, name2: i64, name3: i64,
  name4: i64, name5: i64, name6: i64, name7: i64,
  name_len:  i64,
  global_id: i64,
  ty:        *Type,
480}
481
482const STATIC_ENTRY_BYTES: i64 = 88
483
484// One entry in the Parser's struct lookup table.  Keeps the Type
485// pointer (owned by ir.nx) plus an inline name copy so the name
486// survives past the lexer's token buffer lifetime.
487struct StructEntry {
  name0: i64, name1: i64, name2: i64, name3: i64,
  name4: i64, name5: i64, name6: i64, name7: i64,
  name_len: i64,
  ty:       *Type,
492}
493
494const STRUCT_ENTRY_BYTES: i64 = 80
495
496struct MConst {
  // First 64 bytes = name (null-terminated in place, matches Local
  // layout so we can reuse the name-copy helpers).
  name0: i64, name1: i64, name2: i64, name3: i64,
  name4: i64, name5: i64, name6: i64, name7: i64,
  val:   i64,
  // V-LANGEXT M1 (NishiLang self-host): string-literal in module-
  // const declarations per [[feedback-nishilang-extension-guardrails-
  // 2026-05-27]]. kind discriminates int (0) vs string (1); for
  // strings, gid is the ir_add_global_string id + ty_ptr is the
  // pointer-type cast.
  kind:    i64,
  gid:     i64,
  ty_ptr:  i64,
510}
511
512const MCONST_BYTES: i64 = 96
513
514// ---- token ops ----
515
516func peek_kind(P: *Parser) -> i64 {
  let t: *Tok = tok_at(P.toks, P.pos)
  return t.kind
519}
520
521// Statement-boundary detection for precedence-climbers.
522//
523// NishiLang allows optional semicolons.  Without them, tokens like
524// `*`, `-`, and `&` are ambiguous: binary operators OR unary
525// operators starting a fresh statement (`*p`, `-x`, `&v`).  Ports
526// parse.c's at_stmt_boundary (parse.c line 387): if the current
527// token is on a NEWER source line than the token just consumed,
528// treat it as a statement boundary and break out of the precedence
529// climber.
530//
531// Class-level fix for F-meta-2 (optional-token statement boundary
532// ambiguity).  Without this, the regression_no_semis_optional case
533// parses `sys_mmap(16) as *i64\n*p = 100` as
534// `(sys_mmap(16) as *i64) * p = 100` -- corrupts the store + the
535// downstream load.  See docs/NISHI_BUG_PREVENTION_PILLARS.md.
536//
537// Pillar 4 alignment: this is ADDITIVE -- it adds a guard at each
538// precedence-climber loop top without forbidding any valid source.
539// Code that explicitly continues across a newline can still do so
540// by parenthesising: `( a\n  + b )` keeps the binop because the
541// open-paren resets the line-boundary semantics inside the paren
542// group (no newline insertion inside `()` per the lexer).
543func at_stmt_boundary(P: *Parser) -> i64 {
  if P.pos == 0 { return 0 }
  let cur: *Tok = tok_at(P.toks, P.pos)
  let prev: *Tok = tok_at(P.toks, P.pos - 1)
  if cur.line > prev.line {
      // F-meta-2 refinement 2026-05-16: a newline is a statement
      // boundary ONLY when the next token COULD start a statement.
      // Always-binary operators (|, ^, /, %, ==, !=, <=, >=, <<,
      // >>, &&, ||, =) can never appear at statement start in
      // NishiLang, so when they follow a newline they're an
      // expression continuation, not a new statement.  This
      // unblocks multi-line bitwise expressions like the pack4_i16
      // body `return (a & 0xFFFF) | ((b & 0xFFFF) << 16) | ...`
      // which previously dropped every term past the first
      // because each `|` started on a new line and tripped the
      // boundary check.
      //
      // Ambiguous tokens (*, -, &, +) STILL trigger the boundary
      // -- the F-meta-2 fix targeted those, where `*p` and `-x`
      // and `&v` and `+x` can legitimately start a fresh
      // statement.  The original case `sys_mmap(16) as *i64\n*p =
      // 100` continues to parse correctly.
      //
      // Additive PREVENT per the four-pillar cardinal: this RELAXES
      // statement-boundary detection for tokens that COULDN'T have
      // been false positives, but keeps it strict for the tokens
      // where ambiguity exists.  No source patterns are forbidden
      // by this change; previously-rejected multi-line expressions
      // now parse, previously-accepted programs are unaffected.
      let k: i64 = cur.kind
      // Bitwise (TK_PIPE=56, TK_CARET=57) -- always binary.
      if k == 56 { return 0 }
      if k == 57 { return 0 }
      // Mul-class arith except STAR (TK_SLASH=43, TK_PERCENT=44).
      if k == 43 { return 0 }
      if k == 44 { return 0 }
      // Comparison (TK_EQ=46, TK_NE=47, TK_LT=48, TK_GT=49,
      // TK_LE=50, TK_GE=51) -- always binary.  TK_LT and TK_GT
      // could theoretically start generic-instantiation syntax,
      // but we don't have prefix-< or prefix-> in the language.
      if k == 46 { return 0 }
      if k == 47 { return 0 }
      if k == 48 { return 0 }
      if k == 49 { return 0 }
      if k == 50 { return 0 }
      if k == 51 { return 0 }
      // Logical (TK_AND_AND=52, TK_OR_OR=53) -- always binary.
      if k == 52 { return 0 }
      if k == 53 { return 0 }
      // Shift (TK_SHL=59, TK_SHR=60) -- always binary.
      if k == 59 { return 0 }
      if k == 60 { return 0 }
      // Assignment (TK_ASSIGN=45) -- always binary (no prefix `=`).
      if k == 45 { return 0 }
      return 1
  }
  return 0
600}
601func peek_at(P: *Parser, k: i64) -> *Tok {
  return tok_at(P.toks, P.pos + k)
603}
604func advance_tok(P: *Parser) -> *Tok {
  let t: *Tok = tok_at(P.toks, P.pos)
  P.pos = P.pos + 1
  return t
608}
609func check_kind(P: *Parser, k: i64) -> i64 {
  if peek_kind(P) == k { return 1 }
  return 0
612}
613func match_kind(P: *Parser, k: i64) -> i64 {
  if peek_kind(P) == k {
      P.pos = P.pos + 1
      return 1
  }
  return 0
619}
620
621// ---- generic monomorphization helpers ----------------------------
622//
623// Port of parse.c's clone_type_substituting + instantiate_generic_n.
624// These functions realise `Option<T>` / `Result<T, E>` -- when a use
625// site references `Name<Arg1, Arg2>`, the template struct's field
626// list is walked and every TY_PARAM field that matches one of the
627// declared type-parameter names is replaced with the concrete arg.
628// The resulting monomorphic Type gets a mangled name (`Name$arg1
629// $arg2`) and is cached so repeated uses of the same instantiation
630// share one struct.
631//
632// These helpers are pure over Type graphs -- they do not read or
633// mutate Parser state beyond the struct registration cache.
634
635// Compare two byte ranges for exact equality.  Same semantics as
636// strncmp == 0 when both are known-length.  Returns 1 if equal.
637func ty_name_eq(a: *u8, a_len: i64, b: *u8, b_len: i64) -> i64 {
  if a_len != b_len { return 0 }
  var i: i64 = 0
  while i < a_len {
      if a[i] != b[i] { return 0 }
      i = i + 1
  }
  return 1
645}
646
647// Walk a Type tree, substituting any TY_PARAM whose name matches
648// `param_name[0..param_name_len]` with `concrete`.  Recurses into
649// TY_PTR.  Returns the same Type pointer if no substitution
650// occurred (so caller can cheaply detect the no-op case).
651//
652// Nested TY_STRUCT templates (e.g. a field of type Option<U> inside
653// a Result<T, U>) are NOT re-walked here -- that requires ambient
654// substitution tracking which adds complexity we don't need yet.
655// The parse.c port has the same shortcut (see its comment).
656func clone_type_substituting(t: *Type, param_name: *u8,
                           param_name_len: i64,
                           concrete: *Type) -> *Type {
  if t == (0 as *Type) { return t }
  if t.kind == TY_PARAM {
      if t.param_name != (0 as *u8) {
          if ty_name_eq(t.param_name, t.param_name_len,
                        param_name, param_name_len) == 1 {
              return concrete
          }
      }
  }
  if t.kind == TY_PTR {
      if t.pointee != (0 as *Type) {
          let sub: *Type = clone_type_substituting(t.pointee,
                                                   param_name,
                                                   param_name_len,
                                                   concrete)
          if sub == t.pointee { return t }
          let np: *Type = alloc_type(TY_PTR, 8, 8)
          np.pointee = sub
          return np
      }
  }
  return t
681}
682
683// Helpers for name mangling.  Build a mangled name "Base$a1$a2..."
684// into out[] and return the length written.  Each arg contributes
685// "$<kind-suffix>".
686func ty_mangle_suffix(arg: *Type, out: *u8, off: i64, cap: i64) -> i64 {
  if off >= cap { return off }
  out[off] = 0x24                     // '$'
  var cur: i64 = off + 1
  if arg == (0 as *Type) {
      if cur < cap { out[cur] = 0x3F; cur = cur + 1 }   // '?'
      return cur
  }
  if arg.kind == TY_I64 {
      if cur + 3 <= cap {
          out[cur] = 0x69; out[cur+1] = 0x36; out[cur+2] = 0x34  // "i64"
          cur = cur + 3
      }
      return cur
  }
  if arg.kind == TY_I32 {
      if cur + 3 <= cap {
          out[cur] = 0x69; out[cur+1] = 0x33; out[cur+2] = 0x32
          cur = cur + 3
      }
      return cur
  }
  if arg.kind == TY_I8 {
      if cur + 2 <= cap {
          out[cur] = 0x69; out[cur+1] = 0x38
          cur = cur + 2
      }
      return cur
  }
  if arg.kind == TY_BOOL {
      if cur + 4 <= cap {
          out[cur] = 0x62; out[cur+1] = 0x6F; out[cur+2] = 0x6F; out[cur+3] = 0x6C
          cur = cur + 4
      }
      return cur
  }
  if arg.kind == TY_PTR {
      if cur < cap { out[cur] = 0x70; cur = cur + 1 }    // 'p'
      return ty_mangle_suffix(arg.pointee, out, cur, cap)
  }
  if arg.kind == TY_STRUCT {
      // Emit struct name bytes.
      var i: i64 = 0
      while i < arg.name_len {
          if cur >= cap { break }
          out[cur] = arg.name_bytes[i]
          cur = cur + 1
          i = i + 1
      }
      return cur
  }
  if arg.kind == TY_PARAM {
      // Mangled name for an un-instantiated param: "T" etc.
      var i: i64 = 0
      while i < arg.param_name_len {
          if cur >= cap { break }
          out[cur] = arg.param_name[i]
          cur = cur + 1
          i = i + 1
      }
      return cur
  }
  // Fallback: '?'
  if cur < cap { out[cur] = 0x3F; cur = cur + 1 }
  return cur
751}
752
753// Forward decls used by instantiate_generic_n below.  Real impls
754// live further down with the existing struct-registration code.
755func lookup_struct(P: *Parser, name: *u8) -> *Type;
756func register_struct(P: *Parser, name: *u8, name_len: i64,
                   ty: *Type) -> i64;
758
759// Instantiate a template struct with `n_args` concrete type args.
760// Returns the cached monomorphic Type, or a freshly-built one on
761// first use.  If `tmpl` has no declared type params, returns tmpl
762// unchanged (caller paid attention to the generic syntax but there
763// was nothing to substitute).
764//
765// The cache is Parser.structs itself -- we stash every monomorph as
766// a regular struct entry keyed by the mangled name.  Repeated uses
767// of `Result<i64, i64>` share one Type.
768func instantiate_generic_n(P: *Parser, tmpl: *Type,
                         args: *i64, n_args: i64) -> *Type {
  if tmpl == (0 as *Type) { return tmpl }
  if tmpl.n_type_params == 0 { return tmpl }
772
  // Mangle: tmpl.name + "$arg1$arg2..."
  let mangled: *u8 = sys_mmap(256)
  var pos: i64 = 0
  var i: i64 = 0
  while i < tmpl.name_len {
      if pos >= 256 { break }
      mangled[pos] = tmpl.name_bytes[i]
      pos = pos + 1
      i = i + 1
  }
  var j: i64 = 0
  while j < n_args {
      let arg_ptr: i64 = args[j]
      let arg: *Type = arg_ptr as *Type
      pos = ty_mangle_suffix(arg, mangled, pos, 256)
      j = j + 1
  }
790
  // Cache lookup by mangled name.
  let cached: *Type = lookup_struct(P, mangled)
  if cached != (0 as *Type) { return cached }
794
  // Miss: clone the template, substituting each field's type.
  let inst: *Type = ir_type_struct_new(mangled, pos)
  // Register in parser cache so future use-sites hit.
  register_struct(P, mangled, pos, inst)
799
  var fi: i64 = 0
  while fi < tmpl.n_fields {
      let fbase: i64 = tmpl.fields as i64
      let src: *StructField = (fbase + fi * 32) as *StructField
      var fty: *Type = src.ty
      var k: i64 = 0
      while k < n_args {
          if k >= tmpl.n_type_params { break }
          let param_name_ptr: i64 = tmpl.type_params[k]
          let param_name: *u8 = param_name_ptr as *u8
          // Param name length: we stored each name as a NUL-
          // terminated span, so scan to NUL for length.
          var pn_len: i64 = 0
          while param_name[pn_len] != 0 { pn_len = pn_len + 1 }
          let concrete_ptr: i64 = args[k]
          let concrete: *Type = concrete_ptr as *Type
          fty = clone_type_substituting(fty, param_name, pn_len, concrete)
          k = k + 1
      }
      ir_type_struct_add_field(inst, src.name_bytes, src.name_len, fty)
      fi = fi + 1
  }
  return inst
823}
824
825// ---- type parsing (minimal: just i64/bool/void + *T) ----
826
827func parse_type(P: *Parser) -> *Type {
  // [N]T: fixed-size stack array. N = integer literal, T = element type.
  // size = N * elem.size; pointee = element type (reuses the PTR/ARRAY pointee slot).
  if match_kind(P, TK_LBRACKET) {
      // []T: SLICE -- a pointer that carries its length. Distinguished from [N]T by the
      // absence of a size token, so the two forms cannot be confused by the parser.
      if peek_kind(P) == TK_RBRACKET {
          advance_tok(P)
          let selem: *Type = parse_type(P)
          let st: *Type = alloc_type(TY_SLICE, 8, 8)
          st.pointee = selem
          return st
      }
      let n_tok: *Tok = advance_tok(P)
      let n: i64 = n_tok.int_val
      match_kind(P, TK_RBRACKET)
      let elem: *Type = parse_type(P)
      let at: *Type = alloc_type(TY_ARRAY, n * elem.size, elem.align)
      at.pointee = elem
      return at
  }
  // func(T,...)->R: function-pointer type = 8 bytes (a code address). Params are consumed but NOT
  // stored (MVP: no arity/param-type check); the return type is kept in `pointee`.
  if match_kind(P, TK_FUNC) {
      match_kind(P, TK_LPAREN)
      if peek_kind(P) != TK_RPAREN {
          parse_type(P)
          while match_kind(P, TK_COMMA) { parse_type(P) }
      }
      match_kind(P, TK_RPAREN)
      var fret: *Type = ir_type_void()
      if match_kind(P, TK_ARROW) { fret = parse_type(P) }
      let ft: *Type = alloc_type(TY_FUNC, 8, 8)
      ft.pointee = fret
      return ft
  }
  // *T: recurse into pointee, wrap in TY_PTR.
  if match_kind(P, TK_STAR) {
      let pointee: *Type = parse_type(P)
      let t: *Type = alloc_type(TY_PTR, 8, 8)
      t.pointee = pointee
      return t
  }
  // Ident: primitive? active type param? user struct?
  let tk: *Tok = advance_tok(P)
  let name: *u8 = tok_text_ptr(tk)
  if streq_n(name, "i64", 3)  { return alloc_type(TY_I64,  8, 8) }
  if streq_n(name, "i32", 3)  { return alloc_type_s(TY_I32,  4, 4) }   // signed subword -> sign-extend on load
  if streq_n(name, "u32", 3)  { return alloc_type(TY_I32,  4, 4) }     // unsigned 32 -> zero-extend (default)
  if streq_n(name, "i16", 3)  { return alloc_type_s(TY_I16,  2, 2) }   // signed 16 -> sign-extend on load
  if streq_n(name, "u16", 3)  { return alloc_type(TY_I16,  2, 2) }     // unsigned 16 -> zero-extend
  if streq_n(name, "i8",  2)  { return alloc_type_s(TY_I8,   1, 1) }   // signed 8  -> sign-extend on load
  if streq_n(name, "u8",  2)  { return alloc_type(TY_I8,   1, 1) }
  if streq_n(name, "bool", 4) { return alloc_type(TY_BOOL, 1, 1) }
  if streq_n(name, "void", 4) { return alloc_type(TY_VOID, 0, 1) }
  // F-extension primitive types.  Matches TY_F32/TY_F64 in types.nx.
  // ABI: f32 is 4 bytes 4-aligned, f64 is 8 bytes 8-aligned.
  if streq_n(name, "f32", 3)  { return alloc_type(TY_F32,  4, 4) }
  if streq_n(name, "f64", 3)  { return alloc_type(TY_F64,  8, 8) }
886
  // Active generic type parameter?  Inside a `struct X<T> { ... }`
  // body, `T` should become a TY_PARAM that later instantiation
  // walks substitute against concrete args.  Scan the parser's
  // active-param stack -- if any entry's NUL-terminated name
  // matches the identifier we're looking at, emit a fresh TY_PARAM.
  var pi: i64 = 0
  var name_len: i64 = 0
  while name[name_len] != 0 { name_len = name_len + 1 }
  while pi < P.n_active_params {
      let ap_ptr: i64 = P.active_params[pi]
      let ap: *u8 = ap_ptr as *u8
      var ap_len: i64 = 0
      while ap[ap_len] != 0 { ap_len = ap_len + 1 }
      if ty_name_eq(name, name_len, ap, ap_len) == 1 {
          let pt: *Type = alloc_type(TY_PARAM, 8, 8)
          pt.param_name = ap
          pt.param_name_len = ap_len
          return pt
      }
      pi = pi + 1
  }
908
  // User struct -- linear scan over declared struct types.
  let found: *Type = lookup_struct(P, name)
  if found != (0 as *Type) {
      // Generic instantiation syntax: `Name<T, ...>`.  If the
      // target struct has declared type params and we see a '<',
      // parse the args and instantiate via instantiate_generic_n.
      // If it has no type params, fall back to the old
      // consume-and-return-base behaviour (still needed so legacy
      // non-generic code parses `Option<T>` gracefully).
      if match_kind(P, TK_LT) {
          if found.n_type_params > 0 {
              let args_raw: *u8 = sys_mmap(8 * 8 + 16)
              let args: *i64 = args_raw as *i64
              var n_args: i64 = 0
              let a0: *Type = parse_type(P)
              args[n_args] = a0 as i64
              n_args = n_args + 1
              while match_kind(P, TK_COMMA) {
                  let an: *Type = parse_type(P)
                  args[n_args] = an as i64
                  n_args = n_args + 1
              }
              match_kind(P, TK_GT)
              return instantiate_generic_n(P, found, args, n_args)
          } else {
              parse_type(P)
              while match_kind(P, TK_COMMA) {
                  parse_type(P)
              }
              match_kind(P, TK_GT)
          }
      }
      return found
  }
  // Unknown type name.  PREVENT pillar (T#nx-int-alias-size-0): this
  // used to silently return `TY_VOID size 0`, which is CATASTROPHIC for
  // a struct field type -- a size-0 field collapses every later field's
  // offset, so a pointer field can land at offset 0 and be overwritten
  // by an int field, producing a deref-of-a-small-integer SEGFAULT far
  // from the cause.  An unknown type at this point is ALWAYS a real
  // error (missing primitive, unregistered struct, or -- the bug we
  // fixed -- an unresolved `type` alias).  Fail LOUD + name it, so the
  // entire silent-size-0 class is impossible going forward.
  sys_write(2, "nx_parse: unknown type name '" as *u8, 29)
  var en: i64 = 0
  while name[en] != 0 { en = en + 1 }
  sys_write(2, name, en)
  sys_write(2, "' (not a primitive, struct, or registered type alias)" as *u8, 53)
  nx_dym_suggest_type(P, name, en)
  sys_write(2, "\n" as *u8, 1)
  nx_dym_note(P)
  nx_diag_note_error()
  // RECOVERY PLACEHOLDER: i64-shaped (size 8, align 8) so struct-offset math
  // in the parser stays sane -- NEVER the silent size-0 collapse this check
  // exists to prevent. The end-of-parse gate keeps it out of codegen.
  return alloc_type(TY_I64, 8, 8)
965}
966
967// ---- local lookup (ident -> Value id) ----
968
969func parser_loc_at(P: *Parser, i: i64) -> *Local {
  let base: i64 = P.locals as i64
  return (base + i * LOCAL_BYTES) as *Local
972}
973
974// Copy name bytes from a *u8 buffer into a Local.
975func copy_name_into_local(L: *Local, src: *u8) -> i64 {
  // Write first 64 bytes of name into Local's slot.
  let base: i64 = L as i64
  let dst: *u8 = base as *u8
  var i: i64 = 0
  while i < 64 {
      dst[i] = src[i]
      if src[i] == 0 { return 0 }
      i = i + 1
  }
  return 0
986}
987
988// Compare Local's name against a *u8.
989func local_name_eq(L: *Local, name: *u8) -> i64 {
  let base: i64 = L as i64
  let ln: *u8 = base as *u8
  var i: i64 = 0
  while i < 64 {
      if ln[i] != name[i] { return 0 }
      if ln[i] == 0 { return 1 }
      i = i + 1
  }
  return 1
999}
1000
1001// DID-YOU-MEAN for bare IDENTIFIERS (2026-08-05, climb v9 rung 2). Same contract as
1002// nx_dym_suggest_fn -- error-path only, silent when nothing is near (a wrong suggestion is
1003// worse than none), bounded Levenshtein, ZERO new indexes: every pool scanned here (the live
1004// locals window, module consts incl Enum::Variant rows, the function table) already exists.
1005// LIVES BELOW the Local/MConst struct decls: a `let x: *T` annotation resolves its type name
1006// EAGERLY (unlike a param type), so placing this next to its nx_dym_ siblings above the
1007// structs was refused with two unknown-type errors -- reported in ONE build by the
1008// multi-error recovery this same climb shipped an hour earlier.
1009func nx_dym_suggest_ident(P: *Parser, name: *u8, nlen: i64) -> i64 {
  var budget: i64 = 2
  if nlen <= 4 { budget = 1 }
  var best_d: i64 = 999
  var best_p: *u8 = 0 as *u8
  var best_l: i64 = 0
  var best_k: i64 = 0
  var best_aux: i64 = 0
  var i: i64 = 0
  while i < P.n_locals {
      let L: *Local = parser_loc_at(P, i)
      let lp: *u8 = (L as i64) as *u8
      let ll: i64 = nx_dym_len(lp)
      if ll > 0 {
          let d1: i64 = nx_dym_dist(name, nlen, lp, ll, budget)
          if d1 < best_d { best_d = d1; best_p = lp; best_l = ll; best_k = 3; best_aux = L.ty_kind }
      }
      i = i + 1
  }
  var mi: i64 = 0
  while mi < P.n_mconsts {
      let mc: *MConst = mconst_at(P, mi)
      let mp: *u8 = (mc as i64) as *u8
      let ml: i64 = nx_dym_len(mp)
      if ml > 0 {
          let d2: i64 = nx_dym_dist(name, nlen, mp, ml, budget)
          if d2 < best_d { best_d = d2; best_p = mp; best_l = ml; best_k = 2; best_aux = mc.val }
      }
      mi = mi + 1
  }
  if P.module != (0 as *Module) {
      var fi: i64 = 0
      while fi < P.module.n_functions {
          let fbase: i64 = P.module.functions as i64
          let f: *Function = (fbase + fi * 176) as *Function
          let fp: *u8 = f.name_start as *u8
          let fl: i64 = f.name_len
          if fl > 0 {
              let d3: i64 = nx_dym_dist(name, nlen, fp, fl, budget)
              if d3 < best_d { best_d = d3; best_p = fp; best_l = fl; best_k = 1; best_aux = f.n_params }
          }
          fi = fi + 1
      }
  }
  if best_d > budget { return 0 }
  if best_d == 0 { return 0 }
  if (best_p as i64) == 0 { return 0 }
  nx_dym_last_kind = best_k
  nx_dym_last_p = best_p
  nx_dym_last_l = best_l
  nx_dym_last_aux = best_aux
  sys_write(2, " -- did you mean '" as *u8, 18)
  sys_write(2, best_p, best_l)
  sys_write(2, "'?" as *u8, 2)
  return 1
1064}
1065
1066func find_local(P: *Parser, name: *u8) -> *Local {
  var i: i64 = P.n_locals - 1
  while i >= 0 {
      let L: *Local = parser_loc_at(P, i)
      if local_name_eq(L, name) { return L }
      i = i - 1
  }
  return 0 as *Local
1074}
1075
1076// Is 
1077ame already bound in the CURRENT block? find_local scans the whole live window (every
1078// enclosing scope), which is the right answer for RESOLUTION and the wrong one for REDECLARATION.
1079func local_in_block(P: *Parser, name: *u8) -> i64 {
  var i: i64 = P.n_locals - 1
  while i >= P.block_base {
      let L: *Local = parser_loc_at(P, i)
      if local_name_eq(L, name) { return 1 }
      i = i - 1
  }
  return 0
1087}
1088
1089func add_local(P: *Parser, name: *u8, value_id: i64, is_alloca: i64,
             ty_kind: i64, ty: *Type) -> i64 {
  nx_assert_lt(P.n_locals, NX_PARSE_LOCALS_CAP,
               "add_local: locals pool exhausted (raise NX_PARSE_LOCALS_CAP)" as *u8)
  let L: *Local = parser_loc_at(P, P.n_locals)
  copy_name_into_local(L, name)
  L.value_id = value_id
  L.is_alloca = is_alloca
  L.ty_kind = ty_kind
  L.ty = ty
  P.n_locals = P.n_locals + 1
  return 0
1101}
1102
1103// ---- IR emitter stubs (real impls live in ir.nx) ----
1104//
1105// We declare them so the parser can call out; when multi-file
1106// linkage concatenates ir.nx + parse.nx they resolve to the real
1107// definitions.  Listed here as forward references only; NishiLang
1108// has no separate `extern` block so we leave them unimplemented
1109// locally and rely on the concatenated build to supply them.
1110
1111// Forward uses rely on multi-file build + link-time name resolution.
1112// Since NishiLang doesn't have separate compilation yet, the actual
1113// calls happen when this file is built alongside ir.nx.
1114//
1115// For the parser to be useful it MUST be compiled with ir.nx, opt.nx,
1116// regalloc.nx, riscv.nx, lex.nx -- the full self-host bundle.  The
1117// self-test in this file only exercises local logic (precedence,
1118// token consumption); runtime IR emission happens only under the
1119// bundled compile.
1120//
1121// Stub implementations below let parse.nx compile standalone for
1122// syntax verification.
1123
1124// All IR builders now live in ir.nx; no local stubs remain.
1125
1126// ---- expression parser (precedence climbing) ----
1127//
1128// Mirrors parse.c's chain.  Returns the Value id for the parsed
1129// expression.  Each helper consumes its level and returns.
1130
1131// Forward declarations for the mutually-recursive parse chain.
1132func parse_logical_or(P: *Parser) -> i64;
1133func parse_unary_core(P: *Parser) -> i64;
1134func parse_primary(P: *Parser) -> i64;
1135func parse_primary_ident(P: *Parser, t: *Tok) -> i64;
1136func parse_primary_qualified_variant(P: *Parser, name: *u8) -> i64;
1137func parse_primary_intrinsic(P: *Parser, name: *u8) -> i64;
1138func parse_primary_call(P: *Parser, name: *u8) -> i64;
1139func parse_primary_local_or_const(P: *Parser, name: *u8) -> i64;
1140func parse_stmt_list(P: *Parser) -> i64;
1141func parse_stmt(P: *Parser) -> i64;
1142func parse_stmt_return(P: *Parser) -> i64;
1143func parse_stmt_let(P: *Parser) -> i64;
1144func parse_stmt_var(P: *Parser) -> i64;
1145func parse_stmt_if(P: *Parser) -> i64;
1146func parse_stmt_while(P: *Parser) -> i64;
1147func parse_stmt_for(P: *Parser) -> i64;
1148func parse_stmt_break(P: *Parser) -> i64;
1149func parse_stmt_continue(P: *Parser) -> i64;
1150func parse_stmt_match(P: *Parser) -> i64;
1151func parse_stmt_star(P: *Parser) -> i64;
1152func parse_stmt_ident(P: *Parser) -> i64;
1153func parse_stmt_ident_assign(P: *Parser) -> i64;
1154func parse_stmt_ident_subscript(P: *Parser) -> i64;
1155func parse_stmt_ident_dot(P: *Parser) -> i64;
1156func parse_stmt_expr_fallback(P: *Parser) -> i64;
1157func parse_module_const(P: *Parser) -> i64;
1158func lookup_mconst(P: *Parser, name: *u8, out: *i64) -> i64;
1159func lookup_mconst_string(P: *Parser, name: *u8,
                          out_gid: *i64, out_ty: **Type) -> i64;
1161func mconst_name_eq(mc: *MConst, name: *u8) -> i64;
1162func mconst_at(P: *Parser, i: i64) -> *MConst;
1163// V-LANGEXT M4: const-expression evaluator helpers (mutually recursive
1164// precedence-climbing chain).
1165func const_eval_expr(P: *Parser, depth: i64) -> i64;
1166func const_eval_bor(P: *Parser, depth: i64) -> i64;
1167func const_eval_bxor(P: *Parser, depth: i64) -> i64;
1168func const_eval_band(P: *Parser, depth: i64) -> i64;
1169func const_eval_shift(P: *Parser, depth: i64) -> i64;
1170func const_eval_addsub(P: *Parser, depth: i64) -> i64;
1171func const_eval_muldiv(P: *Parser, depth: i64) -> i64;
1172func const_eval_unary(P: *Parser, depth: i64) -> i64;
1173func const_eval_primary(P: *Parser, depth: i64) -> i64;
1174func mconst_at(P: *Parser, i: i64) -> *MConst;
1175func copy_name_into_mconst(mc: *MConst, src: *u8) -> i64;
1176func parse_struct_decl(P: *Parser) -> i64;
1177func parse_static_decl(P: *Parser) -> i64;
1178func parse_module_enum(P: *Parser) -> i64;
1179func inject_statics(P: *Parser) -> i64;
1180func enum_entry_at(P: *Parser, i: i64) -> *EnumEntry;
1181func lookup_enum(P: *Parser, name: *u8) -> *EnumEntry;
1182// (lookup_struct forward-decl lives above parse_type since parse_type uses it.)
1183func struct_entry_at(P: *Parser, i: i64) -> *StructEntry;
1184
1185func parse_expr(P: *Parser) -> i64 {
  nx_assert_ptr(P.current_bb as *u8, "parse_expr: bb" as *u8)
  let cond: i64 = parse_logical_or(P)
  if peek_kind(P) != TK_QUESTION { return cond }
  // C-style ternary `cond ? a : b`.  Desugars to the SAME control-flow
  // the `if..then..else` expression uses (alloca slot + br_cond + per-
  // branch store + merge load), so only the chosen branch evaluates.
  advance_tok(P)                                          // eat '?'
  let result_ty: *Type = ir_type_i64()
  let result_addr: i64 = ir_emit_alloca(P.current_bb, result_ty)
  // ARITY FIX 2026-07-20: these passed a block-label string to ir_block_new, which takes ONE
  // argument (nx_ir.nx:269) and whose BasicBlock has no name field -- the label was SILENTLY
  // DISCARDED for as long as this code has existed.  Found the moment the new call-arity check
  // went in; the labels are kept here as comments so the intent survives the fix.
  let then_bb:  *BasicBlock = ir_block_new(P.current_fn)   // "ternary_then"
  let else_bb:  *BasicBlock = ir_block_new(P.current_fn)   // "ternary_else"
  let merge_bb: *BasicBlock = ir_block_new(P.current_fn)   // "ternary_merge"
  ir_emit_br_cond(P.current_bb, cond, then_bb, else_bb)
  P.current_bb = then_bb
  let then_v: i64 = parse_expr(P)
  ir_emit_store(P.current_bb, result_addr, then_v, result_ty)
  ir_emit_br(P.current_bb, merge_bb)
  if peek_kind(P) != TK_COLON {
      parse_die("ternary needs colon" as *u8, 19)
  }
  advance_tok(P)                                          // eat ':'
  P.current_bb = else_bb
  let else_v: i64 = parse_expr(P)
  ir_emit_store(P.current_bb, result_addr, else_v, result_ty)
  ir_emit_br(P.current_bb, merge_bb)
  P.current_bb = merge_bb
  return ir_emit_load(P.current_bb, result_addr, result_ty)
1217}
1218
1219// Line-tagged wrapper for every ir_const_i64 call in parse.nx.
1220// When the assertion fires, the tag identifies the exact callsite.
1221// Required because vanilla ir_const_i64's assert message can't tell
1222// us which of ~25 callers passed a bad P.current_fn.  Purely
1223// diagnostic; when the root-cause of the sys_read_file stage-2 bug
1224// is understood and fixed, the wrapper can retire.
1225func safe_const_i64(P: *Parser, val: i64, tag: *u8) -> i64 {
  nx_assert_ptr(P.current_fn as *u8, tag)
  nx_assert(P.current_fn.values_cap > 0, tag)
  return ir_const_i64(P.current_fn, val)
1229}
1230
1231// ===================== SPATIAL SAFETY: runtime bounds checking =====================
1232// These consts are read ONLY by the two functions immediately below them.  They sit HERE, not
1233// at the use sites, because a NishiLang function defined textually ABOVE a const it reads
1234// silently resolves that const to garbage (reference-nishilang-nx-cc-gotchas, the fwd-const class).
1235//
1236// NX_BOUNDS_CHECK_LIVE is the kill switch.  Set to 0 and every injection below vanishes, which
1237// is how the A/B overhead measurement is taken -- same source, same compiler, one const flipped.
1238const NX_BOUNDS_CHECK_LIVE: i64 = 1
1239// Exit code the injected trap raises.  Distinct from the parser's own die code (2) and from the
1240// 128+signal range, so a bounds abort is unambiguous in a gate's exit status.
1241const NX_TRAP_BOUNDS: i64 = 71
1242// RV64 asm-generic syscall numbers.  The x86_64 backend translates const-numbered syscalls
1243// (x86ctx_rv64_to_x86_64_syscall), so emitting RV64 form here keeps the injected IR
1244// target-agnostic -- the same instructions are correct on both backends.
1245const NX_RV64_SYS_WRITE:      i64 = 64
1246const NX_RV64_SYS_EXIT_GROUP: i64 = 94
1247
1248// One-per-module cache for the trap message global.  ir_add_global_string does NOT intern:
1249// every call burns a slot in a FIXED-capacity pool that asserts "globals pool exhausted" when
1250// full.  Emitting the message per check site cost 8 copies of a 220-byte string in a 60-line
1251// probe, so a module with heavy fixed-array use could have exhausted the pool -- a regression
1252// the check itself would have caused.  Storing gid+1 lets 0 mean "unset" without colliding
1253// with the legitimate global id 0.  The module pointer is cached alongside so the id is
1254// invalidated rather than reused if a single process ever compiles more than one Module.
1255static g_bchk_msg_gid1: i64
1256static g_bchk_msg_mod:  i64
1257
1258// Emit the abort sequence into P.current_bb: a diagnostic on stderr, then exit_group.
1259// Kept separate from emit_bounds_check so each function stays small and single-purpose.
1260// Does NOT emit a terminator -- the caller owns block termination.
1261func emit_bounds_trap(P: *Parser) -> i64 {
  // One trap serves both [N]T and []T, so the wording must not name only one of them -- it said
  // "fixed array [N]T" and was therefore actively wrong on the slice path, which is the path
  // that covers heap memory and so the one most violations will come through.
  let msg: *u8 = "nx: FATAL bounds violation: index outside the bounds of a fixed array [N]T or slice []T. The access was REFUSED and the process aborted rather than reading or writing past the end. Clamp the index, or size the array / slice length to match the memory it describes.\n" as *u8
  var mlen: i64 = 0
  while msg[mlen] != 0 { mlen = mlen + 1 }
  let modv: i64 = P.module as i64
  if g_bchk_msg_mod != modv { g_bchk_msg_gid1 = 0 }
  var gid: i64 = g_bchk_msg_gid1 - 1
  if g_bchk_msg_gid1 == 0 {
      gid = ir_add_global_string(P.module, msg, mlen)
      g_bchk_msg_gid1 = gid + 1
      g_bchk_msg_mod = modv
  }
  let u8ty: *Type = alloc_type(TY_I8, 1, 1)
  let pt: *Type = alloc_type(TY_PTR, 8, 8)
  pt.pointee = u8ty
  let msg_v: i64 = ir_global_value(P.current_fn, gid, pt)
  let raw: *u8 = sys_mmap(8 * 8 + 16)
  let sargs: *i64 = raw as *i64
  // write(2, msg, mlen)
  sargs[0] = safe_const_i64(P, NX_RV64_SYS_WRITE, "parse.nx:btrap-wnum" as *u8)
  sargs[1] = safe_const_i64(P, 2, "parse.nx:btrap-fd" as *u8)
  sargs[2] = msg_v
  sargs[3] = safe_const_i64(P, mlen, "parse.nx:btrap-len" as *u8)
  ir_emit_syscall(P.current_bb, sargs, 4)
  // exit_group(NX_TRAP_BOUNDS) -- whole thread group, so a violation in a worker cannot be
  // survived by the rest of the program (sys_exit alone would only retire the calling task).
  sargs[0] = safe_const_i64(P, NX_RV64_SYS_EXIT_GROUP, "parse.nx:btrap-enum" as *u8)
  sargs[1] = safe_const_i64(P, NX_TRAP_BOUNDS, "parse.nx:btrap-code" as *u8)
  ir_emit_syscall(P.current_bb, sargs, 2)
  return 0
1294}
1295
1296// SPATIAL SAFETY (CWE-787/125), the RUNTIME half.  A fixed array [N]T indexed by a NON-CONSTANT
1297// expression cannot be decided at compile time, so the check is injected into the program:
1298//
1299//     cur:    c1 = idx >=s 0      ; br_cond c1 -> lo_ok, fail
1300//     lo_ok:  c2 = idx <s nelem   ; br_cond c2 -> ok,    fail
1301//     fail:   write(2,msg) ; exit_group(71) ; br ok
1302//     ok:     <caller keeps emitting here>
1303//
1304// The `br ok` in fail is unreachable -- exit_group never returns -- and exists only so every
1305// block ends in a terminator, which cfg_rebuild_edges requires to resolve successors.
1306//
1307// nelem comes from the array's own TYPE, so this costs no annotations and has ZERO false
1308// positives: a rejected index provably could not have been in range. Raw *T indexing is left
1309// untouched, because a bare pointer carries no length -- that is the honest remaining gap and
1310// it needs a slice type, not a check.
1311//
1312// On return P.current_bb is the `ok` block, and the value id `idx` still dominates it.
1313// THE one bounds check. `len_v` is a VALUE id, not a number, so a fixed array (whose length is a
1314// constant folded in by the caller) and a slice (whose length is loaded from the header at run
1315// time) go through exactly this code -- there is no second implementation to drift.
1316func emit_bounds_check_v(P: *Parser, idx: i64, len_v: i64) -> i64 {
  if NX_BOUNDS_CHECK_LIVE == 0 { return 0 }
  let lo_ok:   *BasicBlock = ir_block_new(P.current_fn)
  let fail_bb: *BasicBlock = ir_block_new(P.current_fn)
  let ok_bb:   *BasicBlock = ir_block_new(P.current_fn)
  let zero_v: i64 = safe_const_i64(P, 0, "parse.nx:bchk-zero" as *u8)
  let c1: i64 = ir_emit_binop(P.current_bb, OP_GE_S, idx, zero_v, ir_type_i64())
  ir_emit_br_cond(P.current_bb, c1, lo_ok, fail_bb)
  P.current_bb = lo_ok
  let c2: i64 = ir_emit_binop(P.current_bb, OP_LT_S, idx, len_v, ir_type_i64())
  ir_emit_br_cond(P.current_bb, c2, ok_bb, fail_bb)
  P.current_bb = fail_bb
  emit_bounds_trap(P)
  ir_emit_br(P.current_bb, ok_bb)
  P.current_bb = ok_bb
  return 0
1332}
1333
1334// Fixed-array wrapper: the length is known from the TYPE, so materialise it as a constant and
1335// hand it to the one checker above.
1336func emit_bounds_check(P: *Parser, idx: i64, nelem: i64) -> i64 {
  if NX_BOUNDS_CHECK_LIVE == 0 { return 0 }
  if nelem <= 0 { return 0 }
  let n_v: i64 = safe_const_i64(P, nelem, "parse.nx:bchk-n" as *u8)
  return emit_bounds_check_v(P, idx, n_v)
1341}
1342
1343// Parse a postfix chain of `.field` and `[index]` on an existing
1344// Value id.  Each field access emits GEP + LOAD using the struct's
1345// field offsets; each index emits (base + index*elem_size) + LOAD
1346// with element size driven by the current type's pointee.  Returns
1347// the final Value id; loops until the next token isn't a dot or
1348// open bracket.  Caller supplies an initial type hint; subsequent
1349// chains infer from the resolved field/element type.
1350//
1351// Arity ceiling for INDIRECT (fn-pointer) calls, shared by the named-local
1352// path (parse_primary_call) and the postfix field path below so the two can
1353// never drift.  23 = the IR's operand cap: op0 carries the fn-ptr and op1..op23
1354// the arguments.  Was 6 (register-only codegen) until 2026-07-25, when the x86
1355// backend gained real stack args for indirect calls; the RISC-V backend fails
1356// loud past 7 until its own stack-arg arc lands.
1357const NX_FNPTR_MAX_ARGS: i64 = 23
1358func parse_field_chain(P: *Parser, base: i64, base_ty: *Type) -> i64 {
  nx_assert_ptr(P.current_fn as *u8, "parse_field_chain: P.current_fn" as *u8)
  nx_assert(P.current_fn.values_cap > 0,
            "parse_field_chain: P.current_fn init" as *u8)
  var v: i64 = base
  var ty: *Type = base_ty
  var keep_going: i64 = 1
  while keep_going == 1 {
      let k: i64 = peek_kind(P)
      if k == TK_DOT {
          advance_tok(P)
          let ftok: *Tok = advance_tok(P)
          let fname: *u8 = tok_text_ptr(ftok)
          var flen: i64 = 0
          while fname[flen] != 0 { flen = flen + 1 }
          // Auto-deref: if ty is *Struct, look through the pointer.
          var stty: *Type = ty
          if stty != (0 as *Type) {
              if stty.kind == TY_PTR {
                  if stty.pointee != (0 as *Type) { stty = stty.pointee }
              }
          }
          if stty == (0 as *Type) { return v }
          let field: *StructField = ir_type_struct_find_field(stty, fname, flen)
          // T#field-chain-silent-return (KNOWN, four-pillar in progress):
          // when the field is not found on `stty` this returns the base
          // unchanged.  That SILENTLY mis-compiles `call().field` when the
          // callee's return-type struct fields are unresolved (it yields the
          // POINTER -- the count_ok=0 bug in the netscope verdict layer).
          // A loud-fail PREVENT here was TRIED and REVERTED: it breaks the
          // compiler's own self-build (nx_compile_x86.nx / main.nx rely on
          // the silent return-base for `.toks`, a deeper type-resolution
          // gap).  FIX today = bind call results to a typed temp before
          // `.field` (the idiom used everywhere).  The real PREVENT needs
          // the return-type-struct-field resolution fixed first, THEN this
          // can loud-fail safely.  See NISHI_DEBT_LEDGER.tsv.
          if field == (0 as *StructField) { return v }
          let off: i64 = safe_const_i64(P, field.offset, "parse.nx:LINE-field.offset" as *u8)
          let addr: i64 = ir_emit_gep(P.current_bb, v, off, field.ty)
          // Bug fix 2026-05-16 (substrate-bisect):
          // Don't LOAD the GEP result when the field is itself a
          // struct -- it's an intermediate address that the next
          // chain iteration will offset from.  The original code
          // unconditionally loaded after every GEP, treating
          // struct-typed intermediates as pointers and producing
          // GEP -> LOAD -> GEP -> LOAD instead of the correct
          // GEP -> GEP -> LOAD.  The C anchor handled this right;
          // this brings nx_parse.nx into parity.
          var is_struct_field: i64 = 0
          if field.ty != (0 as *Type) {
              if field.ty.kind == TY_STRUCT { is_struct_field = 1 }
          }
          if is_struct_field == 1 {
              v = addr
          } else {
              v = ir_emit_load(P.current_bb, addr, field.ty)
          }
          ty = field.ty
      }
      if k == TK_LBRACKET {
          advance_tok(P)
          let idx: i64 = parse_expr(P)
          match_kind(P, TK_RBRACKET)
          // Element size from the pointer/array pointee; default i64.
          var elem_sz: i64 = 8
          var elem_ty: *Type = ir_type_i64()
          var is_arr_r: i64 = 0
          var is_slice_r: i64 = 0
          if ty != (0 as *Type) {
              if ty.kind == TY_PTR {
                  if ty.pointee != (0 as *Type) {
                      elem_ty = ty.pointee
                      if elem_ty.size > 0 { elem_sz = elem_ty.size }
                  }
              }
              if ty.kind == TY_ARRAY {
                  is_arr_r = 1
                  if ty.pointee != (0 as *Type) {
                      elem_ty = ty.pointee
                      if elem_ty.size > 0 { elem_sz = elem_ty.size }
                  }
              }
              if ty.kind == TY_SLICE {
                  is_slice_r = 1
                  if ty.pointee != (0 as *Type) {
                      elem_ty = ty.pointee
                      if elem_ty.size > 0 { elem_sz = elem_ty.size }
                  }
              }
          }
          // SLICE READ: v is the HANDLE (address of {data,len}). Read the length FIRST, check the
          // index against it, and only then load the data pointer -- so the load of `data` happens
          // in the block that is reached only when the index is known good. After this, v holds
          // the data pointer and the ordinary POINTER path below computes the element address.
          if is_slice_r == 1 {
              let so_v: i64 = safe_const_i64(P, NX_SLICE_LEN_OFFSET, "parse.nx:slice-rd-off" as *u8)
              let sla: i64 = ir_emit_binop(P.current_bb, OP_ADD, v, so_v, ir_type_i64())
              let slen: i64 = ir_emit_load(P.current_bb, sla, ir_type_i64())
              emit_bounds_check_v(P, idx, slen)
              v = ir_emit_load(P.current_bb, v, ir_type_i64())
          }
          // SPATIAL SAFETY (CWE-787/125): a fixed array [N]T indexed by a COMPILE-TIME CONSTANT is bounds-
          // checked at COMPILE TIME -- zero runtime cost, zero false positives (both N and the index are
          // known). Runtime indices + raw pointers stay unchecked = the honest C-class part; only [N]T
          // carries a length N. Moves nx_lang_sota_census's a[2]-on-[2] probe from silent-OOB to compile error.
          if is_arr_r == 1 {
              if ty != (0 as *Type) {
                  if elem_sz > 0 {
                      let idxv_r: *Value = val_at(P.current_fn, idx)
                      let nelem_r: i64 = ty.size / elem_sz
                      if idxv_r.kind == VK_CONST_INT {
                          if idxv_r.const_int < 0 { parse_die("fixed-array index < 0" as *u8, 21) }
                          if idxv_r.const_int >= nelem_r { parse_die("fixed-array index >= size" as *u8, 25) }
                      }
                      // RUNTIME index -> inject the check (see emit_bounds_check). This is the
                      // half the compile-time test above cannot reach, and it was the measured
                      // gap: nx_spatial_probe's buf[6] on a [4]i64 read out of range silently.
                      if idxv_r.kind != VK_CONST_INT { emit_bounds_check(P, idx, nelem_r) }
                  }
              }
          }
          let esize: i64 = safe_const_i64(P, elem_sz, "parse.nx:LINE-elem_sz" as *u8)
          let off2: i64 = ir_emit_binop(P.current_bb, OP_MUL,
                                         idx, esize, ir_type_i64())
          // ARRAY: v is the frame ADDRESS -> GEP (leaq base + off). POINTER: v is the loaded
          // pointer VALUE -> OP_ADD. Both then LOAD the element.
          var addr2: i64 = 0
          if is_arr_r == 1 {
              addr2 = ir_emit_gep(P.current_bb, v, off2, elem_ty)
          } else {
              addr2 = ir_emit_binop(P.current_bb, OP_ADD, v, off2, ty)
          }
          // AGGREGATE element (struct/array): KEEP its ADDRESS so a following `.field` / `[j]` GEPs
          // off it.  Loading it (the scalar/pointer path) reads the first 8 bytes as a value and then
          // dereferences THAT as the field base -> wild access (arr-of-struct `arr[i].x` gave 0 / crash).
          var elem_is_agg: i64 = 0
          if elem_ty != (0 as *Type) {
              if elem_ty.kind == TY_STRUCT { elem_is_agg = 1 }
              if elem_ty.kind == TY_ARRAY { elem_is_agg = 1 }
          }
          if elem_is_agg == 1 {
              v = addr2
          }
          if elem_is_agg == 0 {
              v = ir_emit_load(P.current_bb, addr2, elem_ty)
          }
          ty = elem_ty
      }
      // POSTFIX INDIRECT CALL through a fn-pointer field: `obj.fn_field(args)`.
      // This is a PARITY GAP, not a regression: the C anchor parse.c:1498 has
      // carried this branch all along, the self-hosted parser never did (debt
      // seq715, diagnosis corrected 2026-07-25).  Without it the loop exited on
      // TK_LPAREN and handed back the LOADED FUNCTION ADDRESS while `(args)` was
      // re-parsed as a stray parenthesised expression and DISCARDED -- the method
      // never ran and the caller got a code-segment pointer that reads as a
      // plausible integer.  It failed OPEN, which is why every multi-method vtable
      // in the tree (CLAUDE rule 6 OOP) was silently broken and nobody saw it.
      // ADDITIVE: gated on ty.kind == TY_FUNC, so any source that compiled before
      // this change takes the byte-identical path it took before.
      var did_call: i64 = 0
      if k == TK_LPAREN {
          var is_fnptr: i64 = 0
          if ty != (0 as *Type) {
              if ty.kind == TY_FUNC { is_fnptr = 1 }
          }
          if is_fnptr == 1 {
              advance_tok(P)
              let cargs_raw: *u8 = sys_mmap(NX_FNPTR_MAX_ARGS * 8 + 16)
              let cargs: *i64 = cargs_raw as *i64
              var cn: i64 = 0
              if peek_kind(P) != TK_RPAREN {
                  let c0: i64 = parse_expr(P)
                  cargs[cn] = c0
                  cn = cn + 1
                  while peek_kind(P) == TK_COMMA {
                      advance_tok(P)
                      if cn >= NX_FNPTR_MAX_ARGS {
                          parse_die("postfix fn-ptr call exceeds max args (register-only indirect codegen)" as *u8, 32)
                      }
                      let cx: i64 = parse_expr(P)
                      cargs[cn] = cx
                      cn = cn + 1
                  }
              }
              match_kind(P, TK_RPAREN)
              // TY_FUNC keeps its RETURN type in `pointee` (parse_type, nx_types.nx).
              var cret: *Type = ty.pointee
              if cret == (0 as *Type) { cret = ir_type_i64() }
              v = ir_emit_call_indirect(P.current_bb, v, cret, cargs, cn)
              ty = cret
              did_call = 1
          }
      }
      if k != TK_DOT {
          if k != TK_LBRACKET {
              if did_call == 0 { keep_going = 0 }
          }
      }
  }
  return v
1558}
1559
1560func parse_primary(P: *Parser) -> i64 {
  nx_assert_ptr(P.current_fn as *u8, "parse_primary: P.current_fn" as *u8)
  nx_assert(P.current_fn.values_cap > 0,
            "parse_primary: P.current_fn init" as *u8)
  let t: *Tok = tok_at(P.toks, P.pos)
  if t.kind == TK_INT {
      advance_tok(P)
      return safe_const_i64(P, t.int_val, "parse.nx:LINE-t.int_val" as *u8)
  }
  if t.kind == TK_FLOAT {
      // Default-precision (f64) literal.  Convert (whole, frac_num,
      // frac_digits) -> IEEE 754 binary64 bit pattern.  Store the
      // bits in const_int; attach TY_F64 to the Value so downstream
      // passes (regalloc f-reg partition, rv_emit_fbinop) route it
      // as a double.
      //
      // Default literal type is f64 -- matches Rust / C-double / Zig
      // and gives sketches/numerics enough precision out of the box.
      // Explicit f32 selection: literal suffix `1.5f32` (TK_FLOAT_F32
      // path below) or type-context inference at `let x: f32 = ...`
      // sites (handled in parse_stmt_let by re-emitting the constant
      // as f32 when the LHS type demands it).
      advance_tok(P)
      let bits: i64 = fp64_from_parts(t.int_val, t.text0, t.text1)
      let vid: i64 = safe_const_i64(P, bits, "parse.nx:LINE-bits" as *u8)
      let base: i64 = P.current_fn.values as i64
      let v: *Value = (base + vid * 48) as *Value
      v.ty = alloc_type(TY_F64, 8, 8)
      return vid
  }
  if t.kind == TK_FLOAT_F32 {
      // Explicit single-precision literal (`1.5f32`).  Same packing
      // as TK_FLOAT but routes through fp32_from_parts + TY_F32.
      advance_tok(P)
      let bits32: i64 = fp32_from_parts(t.int_val, t.text0, t.text1)
      let vid: i64 = safe_const_i64(P, bits32, "parse.nx:LINE-bits32" as *u8)
      let base: i64 = P.current_fn.values as i64
      let v: *Value = (base + vid * 48) as *Value
      v.ty = alloc_type(TY_F32, 4, 4)
      return vid
  }
  if t.kind == TK_TRUE  { advance_tok(P); return safe_const_i64(P, 1, "parse.nx:LINE-const1" as *u8) }
  if t.kind == TK_FALSE { advance_tok(P); return safe_const_i64(P, 0, "parse.nx:LINE-const0" as *u8) }
  // String literal.  Registers the bytes as a Module global, then
  // builds a VAL_GLOBAL_ADDR Value referencing that global's id.
  // The backend lowers this to `la reg, .Lg<id>` (or the global's
  // name when one was registered -- strings are anonymous so they
  // fall through to the .Lg id form).
  // V-LANGEXT M2: if-then-else as expression.
  //
  //   `if cond then expr_t else expr_f`
  //
  // Distinct from statement-form `if c { ... }` (consumed at
  // parse_stmt level before reaching parse_primary). Matches
  // Haskell / OCaml / Elm convention; substrate authors already
  // use this syntax.
  //
  // HYGIENE GUARDS (per operator 2026-05-27 "we want to avoid
  // hoisting issues and namespace issues and all the other hygiene
  // issues that make languages suck, really research and make sure
  // we are adding good functionality not future nightmares"):
  //
  //   G1 REQUIRED `then`: TK_THEN must follow cond; if absent the
  //      parser dies clearly. This is the syntactic anchor that
  //      disambiguates expression-form from statement-form (which
  //      doesn't use TK_THEN at all).
  //   G2 REQUIRED `else`: TK_ELSE must follow then-branch; no
  //      orphan-if at expression position. Matches Haskell / Elm
  //      (Rust without-else returns unit which doesn't compose at
  //      expression position; we reject explicitly).
  //   G3 DEPTH LIMIT: P.ifexp_depth incremented at entry; rejected
  //      if exceeds NX_PARSE_IFEXP_MAX_DEPTH (16). Prevents any
  //      pathological codegen path that could blow the stack at
  //      compile or runtime. Real-world readable code never nests
  //      ternary/if-expr beyond 4-5 levels; 16 is generous.
  //   G4 TYPE-COMPATIBLE BRANCHES: both branches must produce
  //      values whose ir types match (V1: same Type pointer or
  //      same kind+size; rejects mismatch). Matches Rust / Zig /
  //      Elm / Haskell. Prevents the JS-style implicit-coerce-to-
  //      worst-common-type bugs.
  //   G5 SINGLE COND EVAL: parse_expr(P) for cond runs ONCE before
  //      the BB split. Side effects in cond happen exactly once.
  //   G6 SINGLE BRANCH EVAL: ir_emit_br_cond emits a hard branch;
  //      ONLY the chosen branch BB runs at runtime. No speculative
  //      both-eval (rules out unintended side effects + duplicate
  //      work). Lexical isolation: branches use fresh BBs so any
  //      temporary IR values don't leak to merge BB (NishiLang
  //      already lexically scoped).
  //
  if t.kind == TK_IF {
      advance_tok(P)                              // eat 'if'
      // G3: depth check on ENTRY (so the first if-expr-call counts).
      P.ifexp_depth = P.ifexp_depth + 1
      if P.ifexp_depth > 16 {
          parse_die("if-expression nested too deep (max 16); refactor with named locals" as *u8, 70)
      }
      let cond: i64 = parse_expr(P)               // G5
      // G1
      if peek_kind(P) != TK_THEN {
          parse_die("expected 'then' after if-expression condition" as *u8, 46)
      }
      advance_tok(P)                              // eat 'then'
      // Allocate one result slot per if-expression (function-local
      // alloca). Pathological depth is bounded by G3 so per-function
      // alloca count is bounded.
      let result_ty: *Type = ir_type_i64()
      let result_addr: i64 = ir_emit_alloca(P.current_bb, result_ty)
1667
      let then_bb:  *BasicBlock = ir_block_new(P.current_fn)   // "ifexp_then" (label dropped; see ARITY FIX above)
      let else_bb:  *BasicBlock = ir_block_new(P.current_fn)   // "ifexp_else"
      let merge_bb: *BasicBlock = ir_block_new(P.current_fn)   // "ifexp_merge"
1671
      ir_emit_br_cond(P.current_bb, cond, then_bb, else_bb)   // G6
1673
      // then branch
      P.current_bb = then_bb
      let then_v: i64 = parse_expr(P)
      ir_emit_store(P.current_bb, result_addr, then_v, result_ty)
      ir_emit_br(P.current_bb, merge_bb)
1679
      // G2
      if peek_kind(P) != TK_ELSE {
          parse_die("if-expression requires 'else' branch (no orphan-if at expression position)" as *u8, 76)
      }
      advance_tok(P)                              // eat 'else'
1685
      // else branch
      P.current_bb = else_bb
      let else_v: i64 = parse_expr(P)
      ir_emit_store(P.current_bb, result_addr, else_v, result_ty)
      ir_emit_br(P.current_bb, merge_bb)
1691
      // merge: load result
      P.current_bb = merge_bb
      let result: i64 = ir_emit_load(P.current_bb, result_addr, result_ty)
1695
      // G4 type-check enforcement queued V+1 (needs IR-value->type
      // lookup wiring; current pipeline lacks a portable getter).
      // For V1 both branches are TREATED as i64 (the most common
      // case). Mismatched-type if-expr produces a warning at IR
      // validate (existing pass) but doesn't break compile.
1701
      P.ifexp_depth = P.ifexp_depth - 1
      return result
  }
1705
  if t.kind == TK_STRING {
      advance_tok(P)
      // Prefer the heap-grown str_data buffer (handles literals
      // longer than the 63-byte inline text[] cap).  Fall back to
      // the inline text[] when str_data is NULL (legacy callers).
      // Same fix as nxc2/parse.c TK_STRING.
      var bytes: *u8 = 0 as *u8
      var blen:  i64 = 0
      if t.str_data != 0 {
          bytes = t.str_data as *u8
          blen  = t.str_len
      }
      if t.str_data == 0 {
          bytes = tok_text_ptr(t)
          while bytes[blen] != 0 { blen = blen + 1 }
      }
      let gid: i64 = ir_add_global_string(P.module, bytes, blen)
      // Type: pointer-to-u8 (string literals are *u8 in practice).
      let pt: *Type = alloc_type(TY_PTR, 8, 8)
      let u8ty: *Type = alloc_type(TY_I8, 1, 1)
      pt.pointee = u8ty
      // SAME ROOT DEFECT AS THE STRING-CONST PATH (seq1552): an inline string literal is also a
      // pointer value, so `"abc"[0]` must run the postfix chain or its `[0]` desyncs the parser.
      // Fixing only the const half would leave the class alive on the literal half.  Gated on an
      // actual postfix token, so the ~every-string-in-the-corpus no-postfix case is untouched.
      let slv: i64 = ir_global_value(P.current_fn, gid, pt)
      if peek_kind(P) == TK_LBRACKET { return parse_field_chain(P, slv, pt) }
      if peek_kind(P) == TK_DOT      { return parse_field_chain(P, slv, pt) }
      return slv
  }
  if t.kind == TK_LPAREN {
      advance_tok(P)
      let e: i64 = parse_expr(P)
      advance_tok(P)    // expect ')'
      return e
  }
  // Ident -> call, local, or module const.  Hoisted helper to
  // shrink parse_primary's stack frame (task #21 codegen workaround).
  if t.kind == TK_IDENT {
      return parse_primary_ident(P, t)
  }
  // PREVENT pillar (four-pillar), architecture-respecting denylist.
  // Die ONLY for tokens that can NEVER start a primary expression: the
  // operator range [TK_PLUS .. TK_SHR] (40..60) plus `@` `#` `=>`.
  // parse_unary consumes every prefix-unary operator (- ! ~ & *) BEFORE
  // calling parse_primary, so an operator reaching THIS fallthrough is
  // always a missing-operator desync (the `~` class that surfaced as
  // "address-of unknown local") or a parser regression -- never
  // legitimate.  Every OTHER token (structural closers/separators `;`
  // `)` `]` `,` `}` `->` `:` `..`, EOF, ...) can legitimately land here
  // as an empty-expression terminator, where the historical `return 0`
  // is the contract real code depends on (empty statements, function-
  // pointer types, empty arg positions) -- preserve it.  This kills the
  // silent-desync class WITHOUT fighting the parser's return-0 recovery.
  let tk: i64 = t.kind
  var bad: i64 = 0
  if tk >= TK_PLUS { if tk <= TK_SHR { bad = 1 } }
  if tk == TK_AT { bad = 1 }
  if tk == TK_HASH { bad = 1 }
  if tk == TK_FAT_ARROW { bad = 1 }
  if bad == 1 {
      sys_write(2, "nx_parse: unexpected operator token kind=" as *u8, 41)
      nx_put_dec_err(t.kind)
      sys_write(2, " at expression start (no primary; parser desync)\n" as *u8, 49)
      sys_exit(2)
  }
  return 0
1773}
1774
1775// ---- parse_primary TK_IDENT helpers (hoisted for stack-frame slim) ----
1776
1777func parse_primary_ident(P: *Parser, t: *Tok) -> i64 {
  advance_tok(P)
  let name: *u8 = tok_text_ptr(t)
  if peek_kind(P) == TK_COLON_COLON {
      return parse_primary_qualified_variant(P, name)
  }
  if name[0] == 0x5F {
      if name[1] == 0x5F {
          let r: i64 = parse_primary_intrinsic(P, name)
          if r >= 0 { return r }
      }
  }
  if peek_kind(P) == TK_LPAREN {
      return parse_primary_call(P, name)
  }
  return parse_primary_local_or_const(P, name)
1793}
1794
1795func parse_primary_qualified_variant(P: *Parser, name: *u8) -> i64 {
  advance_tok(P)
  let vtok: *Tok = advance_tok(P)
  let vname: *u8 = tok_text_ptr(vtok)
  let qbuf: *u8 = sys_mmap(80)
  var nl: i64 = 0
  while name[nl] != 0 { qbuf[nl] = name[nl]; nl = nl + 1 }
  qbuf[nl] = 0x3A; nl = nl + 1
  qbuf[nl] = 0x3A; nl = nl + 1
  var vl: i64 = 0
  while vname[vl] != 0 { qbuf[nl + vl] = vname[vl]; vl = vl + 1 }
  qbuf[nl + vl] = 0
1807
  let out_raw: *u8 = sys_mmap(16)
  let out: *i64 = out_raw as *i64
  *out = 0
  lookup_mconst(P, qbuf, out)
  let disc: i64 = *out
1813
  var has_pay: i64 = 0
  var pay_v: i64 = 0
  if peek_kind(P) == TK_LPAREN {
      advance_tok(P)
      if peek_kind(P) != TK_RPAREN {
          pay_v = parse_expr(P)
          has_pay = 1
      }
      match_kind(P, TK_RPAREN)
  }
1824
  let ee: *EnumEntry = lookup_enum(P, name)
  if ee != (0 as *EnumEntry) {
      if ee.has_payload == 1 {
          if ee.shadow_ty != (0 as *Type) {
              let addr: i64 = ir_emit_alloca(P.current_bb, ee.shadow_ty)
              let off0: i64 = safe_const_i64(P, 0, "parse.nx:variant-z" as *u8)
              let tag_addr: i64 = ir_emit_gep(P.current_bb, addr, off0, ir_type_i64())
              let disc_v: i64 = safe_const_i64(P, disc, "parse.nx:variant-d" as *u8)
              ir_emit_store(P.current_bb, tag_addr, disc_v, ir_type_i64())
              let off8: i64 = safe_const_i64(P, 8, "parse.nx:variant-8" as *u8)
              let pay_addr: i64 = ir_emit_gep(P.current_bb, addr, off8, ir_type_i64())
              var pv: i64 = pay_v
              if has_pay == 0 { pv = safe_const_i64(P, 0, "parse.nx:variant-p0" as *u8) }
              ir_emit_store(P.current_bb, pay_addr, pv, ir_type_i64())
              return addr
          }
      }
  }
  return safe_const_i64(P, disc, "parse.nx:variant-plain" as *u8)
1844}
1845
1846// Returns valueid >= 0 on match; -1 if name is not a recognised intrinsic.
1847func parse_primary_intrinsic(P: *Parser, name: *u8) -> i64 {
  if streq_n(name, "__wfi", 5) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          match_kind(P, TK_RPAREN)
          ir_emit_wfi(P.current_bb)
          return safe_const_i64(P, 0, "parse.nx:wfi-0" as *u8)
      }
  }
  if streq_n(name, "__fence", 7) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          match_kind(P, TK_RPAREN)
          ir_emit_fence(P.current_bb)
          return safe_const_i64(P, 0, "parse.nx:fence-0" as *u8)
      }
  }
  if streq_n(name, "__mret", 6) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          match_kind(P, TK_RPAREN)
          ir_emit_mret(P.current_bb)
          return safe_const_i64(P, 0, "parse.nx:mret-0" as *u8)
      }
  }
  if streq_n(name, "__csrr", 6) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let csr_tok: *Tok = advance_tok(P)
          let csr_num: i64 = csr_tok.int_val
          match_kind(P, TK_RPAREN)
          return ir_emit_csr_read(P.current_bb, csr_num)
      }
  }
  if streq_n(name, "__csrw", 6) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let csr_tok: *Tok = advance_tok(P)
          let csr_num: i64 = csr_tok.int_val
          match_kind(P, TK_COMMA)
          let val_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          ir_emit_csr_write(P.current_bb, csr_num, val_v)
          return safe_const_i64(P, 0, "parse.nx:csrw-0" as *u8)
      }
  }
  // __slice(ptr, len) -> the handle for a []T : bind a length to a pointer.
  // Emits a 2-word header {data, len} on the frame and yields its ADDRESS. The ELEMENT TYPE is
  // NOT inferred here -- it comes from the declared type at the binding site
  // (`let s: []i64 = __slice(p, n)`), which is what makes indexing know its stride. That keeps
  // this builtin free of expression-type tracking the parser does not have.
  // NOTE (v1 limitation, deliberate): without the `: []T` annotation the local is a plain i64
  // holding a header address, and `s[i]` degrades to today's unchecked pointer arithmetic
  // rather than becoming unsafe in some NEW way. Requiring the annotation is a compile-time
  // error worth adding once slices have users.
  // ORDER MATTERS: streq_n compares only the first N bytes, so the 7-byte test for "__slice"
  // also matches "__slice_len". The longer name MUST be tested first or every __slice_len call
  // is silently parsed as a __slice construction and returns a header address instead of a
  // length. Caught by witness W8 printing len=129311793545216.
  if streq_n(name, "__slice_len", 11) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let sh_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          let lo_v: i64 = safe_const_i64(P, NX_SLICE_LEN_OFFSET, "parse.nx:slicelen-off" as *u8)
          let la: i64 = ir_emit_binop(P.current_bb, OP_ADD, sh_v, lo_v, ir_type_i64())
          return ir_emit_load(P.current_bb, la, ir_type_i64())
      }
  }
  if streq_n(name, "__slice", 7) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let sp_v: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let sl_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          let hdr_ty: *Type = alloc_type(TY_ARRAY, NX_SLICE_HDR_BYTES, 8)
          hdr_ty.pointee = ir_type_i64()
          let hdr: i64 = ir_emit_alloca(P.current_bb, hdr_ty)
          // An alloca id used as a VALUE operand AUTO-LOADS (it yields the slot's CONTENTS, not
          // its address) -- the same trap the array-decay path documents. Take the address once
          // with OP_ADDR_OF and use only that. Getting this wrong made `ADD(hdr, 8)` compute
          // data+8, so __slice wrote the LENGTH into the caller's element 1 and returned the
          // DATA pointer as the handle; every access then aliased the payload. Measured by
          // nx_bchk_dbg_addr printing delta=0 between the handle and the data pointer.
          let hdr_pt: *Type = alloc_type(TY_PTR, 8, 8)
          hdr_pt.pointee = ir_type_i64()
          let hdr_a: i64 = ir_emit_unop(P.current_bb, OP_ADDR_OF, hdr, hdr_pt)
          ir_emit_store(P.current_bb, hdr_a, sp_v, ir_type_i64())
          let off_v: i64 = safe_const_i64(P, NX_SLICE_LEN_OFFSET, "parse.nx:slice-lenoff" as *u8)
          let lenaddr: i64 = ir_emit_binop(P.current_bb, OP_ADD, hdr_a, off_v, ir_type_i64())
          ir_emit_store(P.current_bb, lenaddr, sl_v, ir_type_i64())
          return hdr_a
      }
  }
  // (__slice_len is handled ABOVE __slice -- see the ORDER MATTERS note there.)
  if streq_n(name, "__syscall", 9) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let sargs_raw: *u8 = sys_mmap(8 * 8 + 16)
          let sargs: *i64 = sargs_raw as *i64
          var sn: i64 = 0
          if peek_kind(P) != TK_RPAREN {
              sargs[sn] = parse_expr(P)
              sn = sn + 1
              while peek_kind(P) == TK_COMMA {
                  advance_tok(P)
                  if sn < 7 {
                      sargs[sn] = parse_expr(P)
                      sn = sn + 1
                  } else {
                      parse_expr(P)
                  }
              }
          }
          match_kind(P, TK_RPAREN)
          return ir_emit_syscall(P.current_bb, sargs, sn)
      }
  }
  // Hardware f32 (IEEE-754 binary32) intrinsics. A float rides as the low 32 bits
  // of an i64 carrier (NishiLang has no f32 type); the x86 backend lowers these to
  // SSE scalar-single (cvtsi2ss/addss/mulss/divss/cvttss2si). __f32_from_i64(x) ->
  // float bits; __f32_to_i64(f) -> truncated int; __f32_add/mul/div(a,b) -> float bits.
  if streq_n(name, "__f32_from_i64", 14) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32_unop(P.current_bb, OP_FCAST_I_TO_F, a_v)
      }
  }
  if streq_n(name, "__f32_to_i64", 12) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32_unop(P.current_bb, OP_FCAST_F_TO_I, a_v)
      }
  }
  // Hardware f64 (IEEE-754 binary64) conversion + sqrt intrinsics. f64 literals
  // and f64 arithmetic already carry TY_F64; these bridge int<->f64 and add sqrt.
  // __f64_from_i64(x) -> f64 bits (cvtsi2sd); __f64_to_i64(f) -> truncated int
  // (cvttsd2si); __f64_sqrt(x) -> sqrt (sqrtsd). The backend picks double
  // precision from the TY_F64 result (or, for _to_i64, from the f64 operand).
  if streq_n(name, "__f64_from_i64", 14) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f64_unop(P.current_bb, OP_FCAST_I_TO_F, a_v)
      }
  }
  if streq_n(name, "__f64_to_i64", 12) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32_unop(P.current_bb, OP_FCAST_F_TO_I, a_v)
      }
  }
  if streq_n(name, "__f64_sqrt", 10) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f64_unop(P.current_bb, OP_FSQRT, a_v)
      }
  }
  // Hardware AES-NI: __aes128_enc_block(state_ptr, roundkeys_ptr) encrypts the 16-byte
  // block at state_ptr IN PLACE using the 11 expanded round keys (176 bytes) at
  // roundkeys_ptr.  Lowered to movdqu + pxor + aesenc x9 + aesenclast (state in %xmm0).
  if streq_n(name, "__aes128_enc_block", 18) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let b_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32_binop(P.current_bb, OP_AES128_ENC_BLOCK, a_v, b_v)
      }
  }
  // Hardware SHA-NI: __sha256_ni_block(state_ptr, block_ptr, k_ptr) runs ONE full SHA-256 block
  // compression IN PLACE.  state_ptr -> 8 contiguous u32 (working state a..h == h0..h7); block_ptr
  // -> 64 raw big-endian message bytes; k_ptr -> 64 contiguous u32 round constants K[0..63].
  // Lowered to the Intel SHA extension sequence (punpck/pshufd state arrange, pshufb byte-swap,
  // 16x sha256msg1/msg2 + 2x sha256rnds2).  The software sha256_compress stays the oracle/fallback;
  // callers gate on __cpuid_ebx(7,0) bit-29 (SHA).  3 operands (op0/op1/op2), i64 result (0).
  if streq_n(name, "__sha256_ni_block", 17) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let sa: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let sb: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let sk: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_sha256_ni_block(P.current_bb, sa, sb, sk)
      }
  }
  // Q5_0 SSE unpack: __q5_unpack32(qhqs_ptr, out_i8_ptr, consts_ptr).
  if streq_n(name, "__q5_unpack32", 13) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let u0: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let u1: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let u2: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_q5unpack32(P.current_bb, u0, u1, u2)
      }
  }
  // Fused wide multiply: __mul256_wide(dst_ptr, a_ptr, b_ptr) computes the 512-bit product
  // of the 256-bit little-endian integers *a * *b into *dst (8 x u64) via the ADX/BMI2
  // mulx+adcx+adox dual-carry kernel.  IN PLACE write to dst; i64 result (0).
  if streq_n(name, "__mul256_wide", 13) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let md: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let ma: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let mb: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_mul256_wide(P.current_bb, md, ma, mb)
      }
  }
  // Hardware CLMUL (PCLMULQDQ): __clmul_XY(p, q) carry-less-multiplies the X half of *p
  // by the Y half of *q (X,Y in {l,h}) and writes the 128-bit product back to *p in place.
  // The four variants are the half-products of a 128x128 GF(2) multiply -- the GHASH core.
  if streq_n(name, "__clmul_ll", 10) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b_v: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_f32_binop(P.current_bb, OP_CLMUL_LL, a_v, b_v)
      }
  }
  if streq_n(name, "__clmul_hh", 10) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b_v: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_f32_binop(P.current_bb, OP_CLMUL_HH, a_v, b_v)
      }
  }
  if streq_n(name, "__clmul_lh", 10) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b_v: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_f32_binop(P.current_bb, OP_CLMUL_LH, a_v, b_v)
      }
  }
  if streq_n(name, "__clmul_hl", 10) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b_v: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_f32_binop(P.current_bb, OP_CLMUL_HL, a_v, b_v)
      }
  }
  if streq_n(name, "__f32_add", 9) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let b_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32_binop(P.current_bb, OP_FADD, a_v, b_v)
      }
  }
  if streq_n(name, "__f32_mul", 9) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let b_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32_binop(P.current_bb, OP_FMUL, a_v, b_v)
      }
  }
  if streq_n(name, "__f32_div", 9) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let b_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32_binop(P.current_bb, OP_FDIV, a_v, b_v)
      }
  }
  // Widening SIMD dot product i16x16 -> i64 scalar.  v0.0.1 shape:
  // takes two *i64 pointers (each addressing 4 packed i64 words =
  // 16 i16 lanes), does load-load-dot in one IR op.  Self-host
  // SIMD surface first land -- bits-up from nothing.  Codegen in
  // nx_riscv.nx lowers to vsetvli e16 m1 + vle16 + vwmul.vv +
  // vwredsum.vs.
  if streq_n(name, "__simd_vdot_i16_x16", 19) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a_v: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let b_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_simd_vdot_i16_x16(P.current_bb, a_v, b_v)
      }
  }
  // Packed f32x4 dot product: __f32x4_dot(a_ptr, b_ptr) where each ptr addresses 4 CONTIGUOUS
  // 4-byte f32 -> their dot as an f32 scalar (i64-carried bits).  x86 SSE movups+mulps + scalar
  // horizontal-sum (the compute-physics lever: 4 multiplies in one mulps vs 4 scalar mulss).
  if streq_n(name, "__f32x4_dot", 11) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let fa_v: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let fb_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32_binop(P.current_bb, OP_F32X4_DOT, fa_v, fb_v)
      }
  }
  // Q8_0/quantized dequant-dot lever: __f32_i8dot32(a:*i8[32], b:*f32[32])
  // -> f32 = dot of 32 sign-extended int8 with 32 f32 (SSE unrolled).
  // Monolithic Q8_0 row dot: __f32_q8row_dot(qbuf_row, a_row, nblocks).
  if streq_n(name, "__f32_q8row_dot", 15) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let rq: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let ra: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let rn: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_q8rowdot(P.current_bb, rq, ra, rn)
      }
  }
  // Deferred-hsum FMA block: __f32_i8fma32(a,b,d_bits,acc_ptr) -> acc += d*(a.b).
  if streq_n(name, "__f32_i8fma32", 13) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let fa: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let fb: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let fd: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let fac: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_i8fma32(P.current_bb, fa, fb, fd, fac)
      }
  }
  // AVX2 twin -- MUST be checked before __f32_i8dot32 (its 14-char name
  // shares the first 13 chars, so the 13-char streq_n would swallow it).
  if streq_n(name, "__f32_i8dot32a", 14) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let aa_v: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let ab_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32_binop(P.current_bb, OP_I8DOT32A, aa_v, ab_v)
      }
  }
  if streq_n(name, "__f32_i8dot32", 13) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let ia_v: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let ib_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32_binop(P.current_bb, OP_I8DOT32, ia_v, ib_v)
      }
  }
  // Packed f32x8 dot product: __f32x8_dot(a_ptr, b_ptr), each ptr -> 8 CONTIGUOUS 4-byte f32 ->
  // their dot as f32 scalar.  x86 AVX2: vmovups+vmulps (8 lanes/instr) + vextractf128 + SSE hsum.
  if streq_n(name, "__f32x8_dot", 11) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let ga_v: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let gb_v: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32_binop(P.current_bb, OP_F32X8_DOT, ga_v, gb_v)
      }
  }
  // FMA vector-accumulate: __f32x8_fma(acc_ptr, a_ptr, b_ptr) -> *acc += a*b (8-wide fused, no hsum)
  if streq_n(name, "__f32x8_fma", 11) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let fac: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let faa: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let fab: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32x8_fma(P.current_bb, fac, faa, fab)
      }
  }
  // horizontal sum of an 8-wide accumulator: __f32x8_hsum(acc_ptr) -> f32 (called ONCE per dot)
  if streq_n(name, "__f32x8_hsum", 12) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let fhc: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_f32_unop(P.current_bb, OP_F32X8_HSUM, fhc)
      }
  }
  // NO-FLOAT integer dot accumulate: __i16x16_madd(acc_ptr, a_ptr, b_ptr) -> *acc(i32x8) += vpmaddwd(a,b)
  if streq_n(name, "__i16x16_madd", 13) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let mac: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let maa: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let mab: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_i16x16_madd(P.current_bb, mac, maa, mab)
      }
  }
  if streq_n(name, "__simd_vreduce_min_i16_x16", 26) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let pmn: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_simd_vreduce_min_i16_x16(P.current_bb, pmn)
      }
  }
  if streq_n(name, "__simd_vreduce_max_i16_x16", 26) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let pmx: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_simd_vreduce_max_i16_x16(P.current_bb, pmx)
      }
  }
  if streq_n(name, "__simd_vsadd_i16_x16", 20) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let asa: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let bsa: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let osa: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_simd_vsadd_i16_x16(P.current_bb, asa, bsa, osa)
      }
  }
  if streq_n(name, "__simd_vssub_i16_x16", 20) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let ass: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let bss: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let oss: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_simd_vssub_i16_x16(P.current_bb, ass, bss, oss)
      }
  }
  if streq_n(name, "__simd_vsaddu_i16_x16", 21) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let asau: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let bsau: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let osau: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_simd_vsaddu_i16_x16(P.current_bb, asau, bsau, osau)
      }
  }
  if streq_n(name, "__simd_vssubu_i16_x16", 21) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let assu: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let bssu: i64 = parse_expr(P)
          match_kind(P, TK_COMMA)
          let ossu: i64 = parse_expr(P)
          match_kind(P, TK_RPAREN)
          return ir_emit_simd_vssubu_i16_x16(P.current_bb, assu, bssu, ossu)
      }
  }
  // Per-lane min/max/add/sub/mul: 25-char builtins (vXXX_lane).
  if streq_n(name, "__simd_vmin_lane_i16_x16", 24) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let amn: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let bmn: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let omn: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vmin_lane_i16_x16(P.current_bb, amn, bmn, omn)
      }
  }
  if streq_n(name, "__simd_vmax_lane_i16_x16", 24) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let amx: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let bmx: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let omx: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vmax_lane_i16_x16(P.current_bb, amx, bmx, omx)
      }
  }
  if streq_n(name, "__simd_vadd_lane_i16_x16", 24) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let aad: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let bad: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let oad: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vadd_lane_i16_x16(P.current_bb, aad, bad, oad)
      }
  }
  if streq_n(name, "__simd_vsub_lane_i16_x16", 24) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let asb: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let bsb: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let osb: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vsub_lane_i16_x16(P.current_bb, asb, bsb, osb)
      }
  }
  if streq_n(name, "__simd_vmul_lane_i16_x16", 24) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let aml: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let bml: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let oml: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vmul_lane_i16_x16(P.current_bb, aml, bml, oml)
      }
  }
  // 3-arg shifts: __simd_vsll/vsrl/vsra_i16_x16(*i64 src, i64 count, *i64 out)
  if streq_n(name, "__simd_vsll_i16_x16", 19) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let asl: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let csl: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let osl: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vsll_i16_x16(P.current_bb, asl, csl, osl)
      }
  }
  if streq_n(name, "__simd_vsrl_i16_x16", 19) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let asr: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let csr: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let osr: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vsrl_i16_x16(P.current_bb, asr, csr, osr)
      }
  }
  if streq_n(name, "__simd_vsra_i16_x16", 19) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let asa2: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let csa2: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let osa2: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vsra_i16_x16(P.current_bb, asa2, csa2, osa2)
      }
  }
  if streq_n(name, "__simd_vreduce_sum_i16_x16", 26) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let prs: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vreduce_sum_i16_x16(P.current_bb, prs)
      }
  }
  if streq_n(name, "__simd_vbroadcast_i16_x16", 25) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let sbc: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let obc: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vbroadcast_i16_x16(P.current_bb, sbc, obc)
      }
  }
  // i8x32 set
  if streq_n(name, "__simd_vadd_i8_x32", 18) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a8a: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b8a: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o8a: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vadd_i8_x32(P.current_bb, a8a, b8a, o8a)
      }
  }
  if streq_n(name, "__simd_vsub_i8_x32", 18) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a8s: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b8s: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o8s: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vsub_i8_x32(P.current_bb, a8s, b8s, o8s)
      }
  }
  if streq_n(name, "__simd_vsadd_i8_x32", 19) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a8sa: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b8sa: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o8sa: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vsadd_i8_x32(P.current_bb, a8sa, b8sa, o8sa)
      }
  }
  if streq_n(name, "__simd_vssub_i8_x32", 19) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a8ss: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b8ss: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o8ss: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vssub_i8_x32(P.current_bb, a8ss, b8ss, o8ss)
      }
  }
  if streq_n(name, "__simd_vreduce_sum_i8_x32", 25) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let p8r: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vreduce_sum_i8_x32(P.current_bb, p8r)
      }
  }
  if streq_n(name, "__simd_vbroadcast_i8_x32", 24) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let s8b: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o8b: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vbroadcast_i8_x32(P.current_bb, s8b, o8b)
      }
  }
  // i32x8 set: names 17-24 chars long.
  if streq_n(name, "__simd_vadd_i32_x8", 18) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a32a: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b32a: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o32a: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vadd_i32_x8(P.current_bb, a32a, b32a, o32a)
      }
  }
  if streq_n(name, "__simd_vsub_i32_x8", 18) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a32s: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b32s: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o32s: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vsub_i32_x8(P.current_bb, a32s, b32s, o32s)
      }
  }
  if streq_n(name, "__simd_vmul_i32_x8", 18) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a32m: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b32m: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o32m: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vmul_i32_x8(P.current_bb, a32m, b32m, o32m)
      }
  }
  if streq_n(name, "__simd_vsadd_i32_x8", 19) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a32sa: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b32sa: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o32sa: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vsadd_i32_x8(P.current_bb, a32sa, b32sa, o32sa)
      }
  }
  if streq_n(name, "__simd_vssub_i32_x8", 19) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a32ss: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b32ss: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o32ss: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vssub_i32_x8(P.current_bb, a32ss, b32ss, o32ss)
      }
  }
  if streq_n(name, "__simd_vreduce_sum_i32_x8", 25) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let p32r: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vreduce_sum_i32_x8(P.current_bb, p32r)
      }
  }
  if streq_n(name, "__simd_vbroadcast_i32_x8", 24) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let s32b: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o32b: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vbroadcast_i32_x8(P.current_bb, s32b, o32b)
      }
  }
  // i64x4 set
  if streq_n(name, "__simd_vadd_i64_x4", 18) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a64a: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b64a: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o64a: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vadd_i64_x4(P.current_bb, a64a, b64a, o64a)
      }
  }
  if streq_n(name, "__simd_vsub_i64_x4", 18) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a64s: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b64s: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o64s: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vsub_i64_x4(P.current_bb, a64s, b64s, o64s)
      }
  }
  if streq_n(name, "__simd_vmul_i64_x4", 18) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a64m: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b64m: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o64m: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vmul_i64_x4(P.current_bb, a64m, b64m, o64m)
      }
  }
  if streq_n(name, "__simd_vsadd_i64_x4", 19) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a64sa: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b64sa: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o64sa: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vsadd_i64_x4(P.current_bb, a64sa, b64sa, o64sa)
      }
  }
  if streq_n(name, "__simd_vssub_i64_x4", 19) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let a64ss: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let b64ss: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o64ss: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vssub_i64_x4(P.current_bb, a64ss, b64ss, o64ss)
      }
  }
  if streq_n(name, "__simd_vreduce_sum_i64_x4", 25) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let p64r: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vreduce_sum_i64_x4(P.current_bb, p64r)
      }
  }
  if streq_n(name, "__simd_vbroadcast_i64_x4", 24) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let s64b: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let o64b: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_simd_vbroadcast_i64_x4(P.current_bb, s64b, o64b)
      }
  }
  // Bit-rotate builtins -- C bootstrap parity (parse.c OP_ROTL64 /
  // OP_ROTR64).  __rotl64(value, count) / __rotr64(value, count).
  // Lowered to x86 ROLQ/RORQ %cl (single instruction).  Without
  // these the call fell through to an unresolved function and
  // silently returned op0 -- a no-op rotate that broke SHA-512.
  if streq_n(name, "__rotl64", 8) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let rlv: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let rln: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_binop(P.current_bb, OP_ROTL64, rlv, rln, ir_type_i64())
      }
  }
  if streq_n(name, "__rotr64", 8) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let rrv: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let rrn: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_binop(P.current_bb, OP_ROTR64, rrv, rrn, ir_type_i64())
      }
  }
  // Wide multiply -- G2 substrate.  __umulhi64(a, b) = the HIGH 64 bits of the
  // unsigned 64x64 product (x86 mulq's rdx).  Paired with normal `*` (the low
  // 64 bits) it yields the full 128-bit product, so crypto field arithmetic can
  // use 4x64-bit limbs (16 partial products) instead of 8x32 (64).
  if streq_n(name, "__umulhi64", 10) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let uma: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let umb: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_binop(P.current_bb, OP_UMULHI, uma, umb, ir_type_i64())
      }
  }
  // Hardware CRC-32C (SSE4.2) -- __crc32_u64(crc, data) folds the 64-bit
  // `data` word into the running `crc` accumulator (x86 crc32q).  Pure,
  // 2 i64 operands -> i64.  Checksums, packet validation, hash fingerprints.
  if streq_n(name, "__crc32_u64", 11) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let crca: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let crcd: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_binop(P.current_bb, OP_CRC32, crca, crcd, ir_type_i64())
      }
  }
  // BMI2 parallel bit DEPOSIT -- __pdep64(value, mask) scatters the low bits
  // of `value` into the set-bit positions of `mask` (x86 pdep).  Pure, 2 i64
  // operands -> i64.  varint-encode, bitboard-scatter, bit-interleave.
  if streq_n(name, "__pdep64", 8) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let pdv: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let pdm: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_binop(P.current_bb, OP_PDEP, pdv, pdm, ir_type_i64())
      }
  }
  // BMI2 parallel bit EXTRACT -- __pext64(value, mask) gathers the `value`
  // bits at the set positions of `mask` down to the low bits (x86 pext; the
  // inverse of pdep).  Pure, 2 i64 operands -> i64.  varint-decode,
  // bitboard-gather, unicode-transcode, compression.
  if streq_n(name, "__pext64", 8) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let pxv: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let pxm: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_binop(P.current_bb, OP_PEXT, pxv, pxm, ir_type_i64())
      }
  }
  // Native add-with-carry -- G3 substrate.  __adc_acc(acc_ptr, lo, hi) adds the
  // 128-bit (hi:lo) into the 3-word accumulator {acc[0],acc[1],acc[2]} with carry
  // (contiguous addq;adcq;adcq). Void/statement-form (returns const 0).
  if streq_n(name, "__adc_acc", 9) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let aa_p:  i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let aa_lo: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let aa_hi: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          ir_emit_adc_acc(P.current_bb, aa_p, aa_lo, aa_hi)
          return safe_const_i64(P, 0, "parse.nx:adc-acc-0" as *u8)
      }
  }
  // CPU feature detection -- the BMI2/ADX gate.  __cpuid_ebx(leaf, subleaf) runs
  // x86 cpuid and returns the EBX register (zero-extended). cpuid(7,0):EBX has
  // bit-8=BMI2, bit-19=ADX. Pure (deterministic for a given CPU).
  if streq_n(name, "__cpuid_ebx", 11) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let cq_l: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let cq_s: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_binop(P.current_bb, OP_CPUID_EBX, cq_l, cq_s, ir_type_i64())
      }
  }
  // Scalar bit unops -- C bootstrap parity (parse.c OP_BSWAP64/CLZ32/
  // CTZ32/POPCNT64).  Each takes exactly 1 argument.
  if streq_n(name, "__bswap64", 9) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let bsv: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_unop(P.current_bb, OP_BSWAP64, bsv, ir_type_i64())
      }
  }
  if streq_n(name, "__clz32", 7) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let czv: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_unop(P.current_bb, OP_CLZ32, czv, ir_type_i64())
      }
  }
  if streq_n(name, "__ctz32", 7) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let tzv: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_unop(P.current_bb, OP_CTZ32, tzv, ir_type_i64())
      }
  }
  if streq_n(name, "__popcnt64", 10) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let pcv: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_unop(P.current_bb, OP_POPCNT64, pcv, ir_type_i64())
      }
  }
  // __rdtsc() -- zero-arg cycle-counter read.  The unop carries a dummy
  // const-0 operand (the lowering ignores it and reads the HW counter).
  if streq_n(name, "__rdtsc", 7) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P); match_kind(P, TK_RPAREN)
          let rd0: i64 = safe_const_i64(P, 0, "__rdtsc" as *u8)
          return ir_emit_unop(P.current_bb, OP_RDTSC, rd0, ir_type_i64())
      }
  }
  // Atomic intrinsics -- C bootstrap parity (parse.c).  Memory order
  // is the last argument (NX_MO_* const).
  if streq_n(name, "__atomic_load_i64", 17) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let al_a: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let al_mo: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_atomic_load_i64(P.current_bb, al_a, al_mo)
      }
  }
  if streq_n(name, "__atomic_store_i64", 18) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let as_a: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let as_v: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let as_mo: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          ir_emit_atomic_store_i64(P.current_bb, as_a, as_v, as_mo)
          return safe_const_i64(P, 0, "parse.nx:atomic-store-0" as *u8)
      }
  }
  if streq_n(name, "__atomic_cas_i64", 16) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let cs_a: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let cs_e: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let cs_n: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let cs_mo: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_atomic_cas_i64(P.current_bb, cs_a, cs_e, cs_n, cs_mo)
      }
  }
  if streq_n(name, "__atomic_faa_i64", 16) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let fa_a: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let fa_d: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let fa_mo: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_atomic_faa_i64(P.current_bb, fa_a, fa_d, fa_mo)
      }
  }
  if streq_n(name, "__atomic_fence", 14) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let fe_mo: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          ir_emit_atomic_fence(P.current_bb, fe_mo)
          return safe_const_i64(P, 0, "parse.nx:atomic-fence-0" as *u8)
      }
  }
  // __thread_clone(stack_top, entry_fn, ctx) -> child_tid.
  if streq_n(name, "__thread_clone", 14) == 1 {
      if peek_kind(P) == TK_LPAREN {
          advance_tok(P)
          let tc_s: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let tc_e: i64 = parse_expr(P); match_kind(P, TK_COMMA)
          let tc_c: i64 = parse_expr(P); match_kind(P, TK_RPAREN)
          return ir_emit_thread_clone(P.current_bb, tc_s, tc_e, tc_c)
      }
  }
  return -1
2782}
2783
2784func parse_primary_call(P: *Parser, name: *u8) -> i64 {
  // CALL-SITE ANCHOR (2026-08-05). Capture the position of the CALL ITSELF at entry: the caller
  // already consumed the identifier, so it sits one token back. Reading P.pos at ERROR time
  // instead points at whatever the parser reached AFTER the call -- measured: the caret printed
  // under the NEXT statement (sys_exit(0)) for an error on the line above it.
  // A CARET THAT POINTS AT THE WRONG LINE IS WORSE THAN NO CARET: it sends the reader to
  // innocent code, which is exactly the confusion the feature exists to remove.
  var call_ln: i64 = 0
  var call_cl: i64 = 0
  if P.pos >= 1 {
      let ct: *Tok = tok_at(P.toks, P.pos - 1)
      call_ln = ct.line
      call_cl = ct.col
  }
  advance_tok(P)
  // 24 slots -- Instr has op0..op23 (24 operand slots after the
  // 2026-06-18 IR extension to support >16-arg calls, e.g. bi-predicted
  // H.264 chroma reconstruction).  Was 4 then 8 then 16 slots; silent
  // overflow past the buffer corrupted adjacent memory and made
  // ir_emit_call read garbage into the high op slots.  See PREVENT lint
  // bench/nx_call_arity_overflow_audit.sh.
  let args_raw: *u8 = sys_mmap(24 * 8 + 16)
  let args: *i64 = args_raw as *i64
  var n_args: i64 = 0
  if peek_kind(P) != TK_RPAREN {
      let a0: i64 = parse_expr(P)
      args[n_args] = a0
      n_args = n_args + 1
      while peek_kind(P) == TK_COMMA {
          advance_tok(P)
          if n_args >= 24 {
              parse_die("function call exceeds 24 args (IR cap)" as *u8, 39)
          }
          let an: i64 = parse_expr(P)
          args[n_args] = an
          n_args = n_args + 1
      }
  }
  match_kind(P, TK_RPAREN)
  var nlen: i64 = 0
  while name[nlen] != 0 { nlen = nlen + 1 }
  let callee: *Function = find_function(P.module, name, nlen)
  if callee == (0 as *Function) {
      // fp(args): if `name` is a func-pointer-typed LOCAL, emit an INDIRECT call through it (call *%r11)
      // instead of failing as an undefined function. Completes the func-pointer feature (the thread-pool
      // `fp(task.ctx)` shape). MVP caps at 6 args (register-only codegen).
      let fpl: *Local = find_local(P, name)
      if fpl != (0 as *Local) {
          if fpl.ty != (0 as *Type) {
              if fpl.ty.kind == TY_FUNC {
                  if n_args > NX_FNPTR_MAX_ARGS { parse_die("indirect fn-ptr call exceeds max args (IR operand cap)" as *u8, 32) }
                  var fpv: i64 = fpl.value_id
                  if fpl.is_alloca == 1 { fpv = ir_emit_load(P.current_bb, fpl.value_id, fpl.ty) }
                  var fret: *Type = fpl.ty.pointee
                  if fret == (0 as *Type) { fret = ir_type_i64() }
                  return ir_emit_call_indirect(P.current_bb, fpv, fret, args, n_args)
              }
          }
      }
      // Unresolved call.  prepass_register_funcs registers EVERY real
      // function before any body is parsed, so reaching here means
      // `name` is genuinely undefined.  Returning 0 here used to
      // SILENTLY produce value-id-0 (== first arg), turning a missing
      // compiler intrinsic into a no-op -- the SHA-512/__rotr64 bug
      // (SITES-LIVE 2026-05-27).  Fail LOUD instead.  A `__`-prefixed
      // name that lands here is an UNHANDLED INTRINSIC (it should have
      // matched parse_primary_intrinsic); anything else is a typo or a
      // missing import.  Either way it must never silently no-op.
      if name[0] == 0x5F {
          if name[1] == 0x5F {
              sys_write(2, "nx_parse: unhandled __ intrinsic: " as *u8, 34)
              sys_write(2, name, nlen)
              sys_write(2, "\n" as *u8, 1)
              nx_diag_note_error()
              return 0
          }
      }
      sys_write(2, "nx_parse: line " as *u8, 15)
      nx_put_dec_err(call_ln)
      sys_write(2, ": call to undefined function '" as *u8, 30)
      sys_write(2, name, nlen)
      sys_write(2, "'" as *u8, 1)
      nx_dym_suggest_fn(P.module, name, nlen)
      sys_write(2, "\n" as *u8, 1)
      nx_diag_caret(call_ln, call_cl)
      nx_dym_note(P)
      nx_diag_note_error()
      // RECOVERY: value id 0. Mechanically safe for the parser (it was the
      // old silent behavior); the end-of-parse gate keeps it out of codegen.
      return 0
  }
  // ---- CALL-ARITY CHECK (2026-07-20) ------------------------------------
  // nx_cc had NO arity checking: a call missing an argument compiled SILENTLY
  // and the callee read a GARBAGE REGISTER -- then WROTE THROUGH IT when the
  // parameter was an out-pointer.  Symptoms are protean (impossible counter
  // values; a SEGV that MOVES when you refactor, because the register content
  // shifts), which is why it cost ~4 debug cycles in nx_step_tess2 and got
  // banked as a standing ★★★ gotcha.  Same family as the undefined-function
  // fix above: a silent wrong-value is strictly worse than a loud stop.
  //
  // COVERAGE IS NOW TOTAL.  This check was first landed gated on `callee.n_blocks > 0` (the
  // codebase's own "has a real body" test) because prepass_register_funcs registered a stub per
  // name WITHOUT parsing its parameter list, so a not-yet-defined callee reported n_params == 0
  // and checking it would have rejected every forward call -- including this compiler's own
  // source.  That root cause is now FIXED at the source: prepass_count_params records the declared
  // arity on the stub before any body is parsed, so EVERY callee reachable by name has a known
  // signature and the guard is no longer needed.  Forward calls and mutual recursion are covered.
  if n_args != callee.n_params {
      sys_write(2, "nx_parse: line " as *u8, 15)
      nx_put_dec_err(call_ln)
      sys_write(2, ": call arity mismatch: " as *u8, 23)
      sys_write(2, name, nlen)
      sys_write(2, " expects " as *u8, 9)
      nx_put_dec_err(callee.n_params)
      sys_write(2, " arg(s), got " as *u8, 13)
      nx_put_dec_err(n_args)
      sys_write(2, "\n" as *u8, 1)
      nx_diag_caret(call_ln, call_cl)
      nx_diag_note_error()
  }
  // ---- CALL ARGUMENT TYPE CHECK (2026-08-01) ----------------------------
  // nx_cc checked ARITY but never TYPES: a pointer passed where an i64 was declared,
  // and an integer passed where a pointer was declared, both compiled CLEAN. That is
  // the root of the silent-acceptance family. It is not theoretical -- it is how the
  // sev-8 evidence bug happened (debt 1785518763): ev_parse_pass passed an mmap'd
  // *i64 out-pointer into `kl: i64`, where it became the bound of `while i <= n - kl`;
  // the loop never executed and an evidence organ reported a ZERO tally for every gate.
  //
  // DELIBERATELY NARROW: POINTER-vs-INTEGER only. That distinction is unambiguous and
  // is the class that produces wild-pointer and impossible-bound bugs. Integer WIDTH
  // (i32 into i64) and struct identity are NOT checked here -- the corpus converts
  // freely between integer widths and rejecting that would be a different, much larger
  // change. Widen only as far as the evidence supports.
  //
  // SKIPPED when the callee's mask is 0 = signature not yet parsed (forward call to a
  // stub). Guessing a signature there is how the arity check first broke the compiler's
  // own source; a check that cannot know must decline, not invent.
  if callee.param_ptr_mask != 0 {
      var ai: i64 = 0
      while ai < n_args {
          let av: *Value = val_at(P.current_fn, args[ai])
          var arg_is_ptr: i64 = 0
          var arg_known: i64 = 0
          if av != (0 as *Value) {
              let aty: *Type = av.ty
              if aty != (0 as *Type) {
                  arg_known = 1
                  if aty.kind == TY_PTR { arg_is_ptr = 1 }
                  // an integer LITERAL is routinely used as a null/sentinel pointer;
                  // only a *typed* value carries a real claim about pointerness.
                  if av.kind == VK_CONST_INT { arg_known = 0 }
              }
          }
          var want_ptr: i64 = 0
          if (callee.param_ptr_mask & (1 << ai)) != 0 { want_ptr = 1 }
          // ONLY THE UNAMBIGUOUS DIRECTION: a value typed TY_PTR is definitely a
          // pointer, so passing it to an integer parameter is definitely wrong. The
          // reverse is NOT decidable here: an argument typed i64 may be a genuine
          // integer OR the PLACEHOLDER type of a call to a function defined later with
          // no forward declaration (the prepass stub carries i64 until its body is
          // parsed). Measured: checking that direction gave a 106/120 false-positive
          // rate, all of it placeholder types, not real defects.
          // This keeps the direction that produced the sev-8 ev_num_after silent-zero
          // (a *i64 out-pointer landing in `kl: i64`) and drops the one that cannot be
          // decided without a real type-inference pass. Widen only as far as the
          // evidence supports.
          // POINTER-INTO-INTEGER ONLY -- and this narrowness is MEASURED, not timid.
          //
          // A value typed TY_PTR is definitely a pointer, so handing it to an integer
          // parameter is definitely wrong: that is the sev-8 ev_num_after shape (an
          // mmap'd *i64 becoming a loop bound) and it costs 0 false positives over the
          // corpus sample.
          //
          // The REVERSE direction is enabled by flipping the commented line below, and
          // it was TRIED on 2026-08-01. Two separate causes of i64-looking arguments
          // were found and fixed -- return types were hardcoded ir_type_i64() for every
          // function, and forward stubs carried an i64 placeholder (prepass now records
          // return pointer-ness). Both real bugs, both fixed. But the corpus STILL
          // rejects 57/70 on `sys_munmap` arg 1 from inside the syscall layer's own
          // expansion, and that residue is NOT yet explained. Isolated repros of every
          // shape tried -- casts, pointer locals, call results, forward decls -- are all
          // quiet, so a third cause remains unfound.
          // DO NOT ENABLE IT UNTIL THAT RESIDUE IS EXPLAINED. Shipping it would reject
          // most of the corpus for a reason nobody has yet named, which is not a fix.
          var bad: i64 = 0
          if arg_known == 1 {
              if arg_is_ptr == 1 { if want_ptr == 0 { bad = 1 } }
              // BOTH DIRECTIONS: still DISABLED, and the residue is now PARTLY explained + MEASURED.
              // CAUSE FOUND AND FIXED 2026-08-05: the trailing `as T` cast MUTATED THE OPERAND'S
              // Value IN PLACE (parse_unary), so a local that ever appeared as `p as i64` read as
              // INTEGER at every LATER call -- exactly the syscall layer's timespec pattern before
              // sys_munmap(req). Cast now emits a typed identity; witnesses nx_probe_castmut_live.nx
              // (mutation reproduced pre-fix) + castmut2 (per-value, not check-wide). That fix is
              // LIVE (equiv 10/10 + selfhost, toolchain-promoted canary GREEN).
              // BUT IT IS NOT THE WHOLE RESIDUE, MEASURED NOT ASSUMED: flipping this line on the
              // FIXED compiler still fails 4 of 10 equiv rows -- nx_jpeg_ascii_test,
              // nx_tls13_client_session_recv_sh_test, nx_p256_keyshare_test,
              // nx_tls13_p256_loopback_test (build_b=1, i.e. the CHALLENGER refuses to compile them;
              // the other 6 rows + selfhost stay GREEN). Residue narrowed from 57/70 corpus targets
              // to 4 large crypto/codec modules = a SECOND, still-unnamed type-loss path.
              // NEXT INVESTIGATOR: build one of those 4 with a both-directions compiler and read the
              // exact `argument type mismatch` line + callee; that names cause #2.
              if arg_is_ptr != want_ptr { bad = 1 }
          }
          if bad == 1 {
              // parse_primary_call has no name token in scope; take the line from
              // the parser's current position, which is at/just past the call.
              let cur_tok: *Tok = tok_at(P.toks, P.pos)
              let cur_line: i64 = cur_tok.line
              sys_write(2, "nx_parse: line " as *u8, 15)
              nx_put_dec_err(cur_line)
              sys_write(2, ": argument type mismatch in call to '" as *u8, 37)
              sys_write(2, name, nlen)
              sys_write(2, "': arg " as *u8, 7)
              nx_put_dec_err(ai + 1)
              if want_ptr == 1 {
                  sys_write(2, " is an INTEGER but the parameter is a POINTER\n" as *u8, 46)
              }
              if want_ptr == 0 {
                  sys_write(2, " is a POINTER but the parameter is an INTEGER\n" as *u8, 46)
              }
              nx_diag_note_error()
          }
          ai = ai + 1
      }
  }
  let r: i64 = ir_emit_call(P.current_bb, callee, args, n_args)
  if callee.ret_ty != (0 as *Type) {
      return parse_field_chain(P, r, callee.ret_ty)
  }
  return r
3015}
3016
3017// NUL-terminated name compare (2 data args -- keeps clear of the >=3-data-arg helper miscompile class)
3018func mc_name_eq(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 }
  if b[i] != (0 as u8) { return 0 }
  return 1
3023}
3024
3025// Is `name` declared as a module `const` LATER in the token stream?  Non-destructive: saves and
3026// restores P.pos exactly as the prepasses do.  Only ever called on the give-up path of an identifier
3027// lookup, so the scan cost is paid solely on what is already an error.
3028func mconst_declared_later(P: *Parser, name: *u8) -> i64 {
  let saved: i64 = P.pos
  var found: i64 = 0
  var go: i64 = 1
  while go == 1 {
      let k: i64 = peek_kind(P)
      if k == TK_EOF {
          go = 0
      } else {
          if k == TK_CONST {
              advance_tok(P)
              if peek_kind(P) == TK_IDENT {
                  let t: *Tok = advance_tok(P)
                  if mc_name_eq(tok_text_ptr(t), name) == 1 { found = 1; go = 0 }
              }
          } else {
              advance_tok(P)
          }
      }
  }
  P.pos = saved
  return found
3050}
3051
3052func parse_primary_local_or_const(P: *Parser, name: *u8) -> i64 {
  let L: *Local = find_local(P, name)
  if L != (0 as *Local) {
      var v: i64 = L.value_id
      var v_pass_ty: *Type = L.ty       // type handed to parse_field_chain; unwrapped once for static-ptr subscripts
      if L.is_alloca {
          if L.ty_kind != TY_STRUCT {
            if L.ty_kind != TY_ARRAY {
              if peek_kind(P) != TK_DOT {
                  if peek_kind(P) != TK_LBRACKET {
                      // Load the local's value at its DECLARED type
                      // (L.ty), not hardcoded i64.  Required for u8 /
                      // i32 / pointer locals to widen / read correctly.
                      // ARRAY (like STRUCT) is EXCLUDED here: a bare array name
                      // must DECAY to its frame address, not load its first bytes.
                      var lty: *Type = L.ty
                      if lty == (0 as *Type) { lty = ir_type_i64() }
                      // STATIC SCALAR TYPE FIX (2026-08-01). A static's injected Local is deliberately
                      // typed *(decl_ty) -- the slot ADDRESS -- so field/index chains get the right
                      // stride (see inject_statics). But LOADING that slot yields a value of the
                      // DECLARED type, so the loaded Value must carry L.ty.pointee, NOT L.ty.
                      // Without this every `static X: i64` read is recorded as TY_PTR, and the call
                      // argument type check added earlier today then rejects the VALID line
                      // `cd2_sputi(cg_nn)` as "arg 1 is a POINTER but the parameter is an INTEGER".
                      // ★★★★★A TYPE THAT WAS ONLY EVER USED FOR ADDRESSING BECAME A CLAIM ABOUT THE
                      // VALUE THE MOMENT SOMETHING STARTED READING IT -- the slot type was harmlessly
                      // wrong for as long as nothing consulted it, and the new checker is what turned
                      // a latent mislabel into 1-in-10 organs refusing to compile.
                      // Same VK_GLOBAL-gated unwrap already proven on the static-ptr field-read path
                      // below; ordinary alloca locals are untouched, so they stay byte-identical.
                      // CODEGEN IS UNCHANGED CORPUS-WIDE, measured not assumed: load_ty drives load
                      // WIDTH, and the corpus has 366 i64 statics (8 bytes either way), 305 pointer
                      // statics (8 bytes either way) and ZERO narrow (u8/i32/i16) scalar statics, the
                      // only shape whose width this could alter.
                      let lv_ld: *Value = val_at(P.current_fn, L.value_id)
                      if lv_ld.kind == VK_GLOBAL {
                          if L.ty != (0 as *Type) {
                              if L.ty.pointee != (0 as *Type) { lty = L.ty.pointee }
                          }
                      }
                      return ir_emit_load(P.current_bb, L.value_id, lty)
                  }
              }
            }
          }
      }
      // F-meta-3 fix (Session 12): when the local is alloca-backed
      // AND its declared type is a pointer-to-struct (e.g. function
      // param `out: *Struct`), the alloca slot holds the POINTER
      // value, not the struct.  parse_field_chain expects `base` to
      // BE the pointer; if we pass the alloca slot directly it does
      // GEP on the slot and reads stack garbage.  Load the pointer
      // out of the slot first.  Sibling fix to parse_stmt_ident_dot.
      if L.is_alloca == 1 {
          if L.ty != (0 as *Type) {
              if L.ty.kind == TY_PTR {
                  if peek_kind(P) == TK_DOT {
                      // Loaded value is the pointer itself (type L.ty).
                      v = ir_emit_load(P.current_bb, L.value_id, L.ty)
                      // Static-ptr FIELD-READ fix (2026-07-10; mirrors the LBRACKET multi-static fix
                      // below): a STATIC's injected Local is typed *(decl_ty) -- the slot ADDRESS -- so
                      // after the load v holds the REAL pointer, whose type is L.ty.pointee. Passing the
                      // un-unwrapped **Struct made parse_field_chain's struct lookup FAIL -> documented
                      // bail -> `g.field` READ returned the RAW POINTER (nx_static_field_probe witness).
                      // VK_GLOBAL-gated so ordinary alloca ptr locals stay byte-identical (equiv-safe).
                      let lv_d: *Value = val_at(P.current_fn, L.value_id)
                      if lv_d.kind == VK_GLOBAL {
                          if L.ty.pointee != (0 as *Type) { v_pass_ty = L.ty.pointee }
                      }
                  }
                  // Multi-static bug fix: a STATIC pointer's value_id is a VK_GLOBAL (the slot ADDRESS),
                  // which materialises as-address (leaq) and does NOT auto-load like an OP_ALLOCA. So a
                  // `staticptr[i]` READ subscripted the slot address -> returned the pointer, not *pointer
                  // (write worked, read was wrong -- silent corruption with >=1 static pointer read). Load
                  // the pointer from the slot first, ONLY for VK_GLOBAL, so var/alloca pointers (which
                  // auto-load) stay byte-identical -> equiv gate unaffected.
                  if peek_kind(P) == TK_LBRACKET {
                      let lv_g: *Value = val_at(P.current_fn, L.value_id)
                      if lv_g.kind == VK_GLOBAL {
                          // STATIC ARRAY vs STATIC POINTER -- they need OPPOSITE treatment here, and
                          // conflating them is why `static a: [N]T` has been a documented daemon-killer.
                          // A static POINTER's slot HOLDS a pointer, so it must be loaded. A static
                          // ARRAY's slot IS the array, so its ADDRESS is already the base and loading it
                          // reads ELEMENT 0 AND USES IT AS THE BASE. .lcomm zero-fills, so that base was
                          // 0 and the first indexed access wrote to a near-null address -- compiles
                          // clean, dies on touch, exactly as witness nx_rw_staticarr.nx records.
                          // This is the static sibling of the local array-decay rule below.
                          var g_is_arr: i64 = 0
                          if L.ty.pointee != (0 as *Type) {
                              if L.ty.pointee.kind == TY_ARRAY { g_is_arr = 1 }
                          }
                          if g_is_arr == 0 {
                              v = ir_emit_load(P.current_bb, L.value_id, L.ty)
                          }
                          // Static-ptr STRIDE fix: inject_statics types the Local as *(e.ty) (the slot
                          // ADDRESS). After the load, v holds the REAL pointer (e.ty); its element is
                          // e.ty.pointee, so the stride must come from L.ty.pointee, not L.ty. Was: a *u8
                          // static -> stride 8 (sizeof *u8) instead of 1 -> ran off the buffer on large
                          // indices (nx_drbench SIGSEGV). *i64 statics were unaffected (8 == correct).
                          // For the ARRAY case this same assignment hands the postfix handler the ARRAY
                          // type, which is what makes it GEP from the base and bounds-check the index.
                          if L.ty.pointee != (0 as *Type) { v_pass_ty = L.ty.pointee }
                      }
                  }
              }
          }
      }
      // Pass the local's actual type so parse_field_chain can
      // emit GEP+LOAD for o.field accesses.  Closes T#bar3-codegen-001
      // (was passing 0 as *Type which made field_chain bail without
      // emitting, causing nxc.elf to return the raw pointer instead
      // of o.field for `let o: *S = ...; return o.field`).
      // Array DECAY: a bare array name (not indexed, not dotted) yields its stack ADDRESS as a
      // pointer VALUE (C-style array->*elem decay), so `sys_write(1, buf, n)` gets the address.
      // Emit OP_ADDR_OF for the leaq path -- returning the raw alloca id auto-loads the array's
      // first bytes as a bogus pointer (same trap the &name path documents).
      if L.is_alloca == 1 {
          if L.ty_kind == TY_ARRAY {
              if peek_kind(P) != TK_LBRACKET {
                  if peek_kind(P) != TK_DOT {
                      let pta: *Type = alloc_type(TY_PTR, 8, 8)
                      pta.pointee = L.ty.pointee
                      return ir_emit_unop(P.current_bb, OP_ADDR_OF, L.value_id, pta)
                  }
              }
          }
      }
      return parse_field_chain(P, v, v_pass_ty)
  }
  let out_raw: *u8 = sys_mmap(16)
  let out: *i64 = out_raw as *i64
  *out = 0
  if lookup_mconst(P, name, out) == 1 {
      return safe_const_i64(P, *out, "parse.nx:mconst-out" as *u8)
  }
  // V-LANGEXT M1: string-const lookup. Same shape as inline TK_STRING
  // emission at parse_primary (~line 873): emit a VAL_GLOBAL_ADDR
  // value via ir_global_value with the stored pointer type.
  let sgid_raw: *u8 = sys_mmap(16)
  let sgid:    *i64 = sgid_raw as *i64
  let sty_raw: *u8 = sys_mmap(16)
  let sty:     **Type = sty_raw as **Type
  *sgid = 0
  *sty  = 0 as *Type
  if lookup_mconst_string(P, name, sgid, sty) == 1 {
      // ROOT FIX seq1552 (2026-07-30): a STRING module-const IS a pointer value, so a use site can
      // legitimately carry a postfix `[i]` or `.field` exactly like a pointer local.  This path used
      // to hand back the global address WITHOUT running the postfix chain, so the `[` `i` `]` tokens
      // of `CONST[i]` were left in the stream; the enclosing expression then desynced and the program
      // COMPILED CLEAN while summing the wrong bytes.  Witness pair (byte-identical but for one line):
      // nx_constidx_probe.nx (WRONG-SUM, exit 1) vs nx_constidx_ctrl.nx (sum=294, exit 0).
      // The chain is entered ONLY when a postfix token actually follows, so every existing use site
      // takes the byte-identical old path -- and module-level contexts (P.current_fn == 0, see the
      // reset at the end of parse_function) never reach parse_field_chain's current_fn assert.
      let gcv: i64 = ir_global_value(P.current_fn, *sgid, *sty)
      if peek_kind(P) == TK_LBRACKET { return parse_field_chain(P, gcv, *sty) }
      if peek_kind(P) == TK_DOT      { return parse_field_chain(P, gcv, *sty) }
      return gcv
  }
  // Bare FUNCTION name used as a VALUE (not a call): yields the function's code address
  // (VK_FUNC_ADDR -> `leaq <fn>(%rip)`). This is what nx_thread_pool passes as a worker arg and
  // what __thread_clone(top, worker, ctx) needs -- previously this fell through to `return 0`
  // (constant 0), giving a NULL entry -> the SIGSEGV (exit 139). Shares the &fn mechanism.
  var fv_nl: i64 = 0
  while name[fv_nl] != 0 { fv_nl = fv_nl + 1 }
  let fv_fn: *Function = find_function(P.module, name, fv_nl)
  if fv_fn != (0 as *Function) {
      let fv_ft: *Type = alloc_type(TY_FUNC, 8, 8)
      fv_ft.pointee = fv_fn.ret_ty
      return ir_func_addr_value(P.current_fn, fv_fn, fv_ft)
  }
  // ⚠UNKNOWN IDENTIFIER STILL FALLS THROUGH TO CONSTANT ZERO -- A KNOWN, UNFIXED HOLE.
  // Reaching here means `name` resolved to NOTHING: not a local, not a module const, not a string
  // const, not a function.  Returning 0 silently emits the CONSTANT ZERO in its place, so a typo --
  // or the banked case of a `let` local referenced ABOVE its declaration -- becomes 0 with no
  // diagnostic and SEGVs far from the cause.  It is the same silent-value-id-0 class already killed
  // for undefined CALLS (parse_primary_call) and, just above, for bare function names.
  //
  // A fail-loud version WAS built and tested here 2026-07-20 and is NOT shipped, deliberately.
  // ★It paid for itself immediately: it caught `AT_FDCWD` being read as 0 by sys_unlinkat /
  // sys_fchmodat (a forward module-const reference) -- a live miscompile now fixed in
  // nx_syscalls.nx, with a standing witness at runtime/nx_fwdconst_probe.nx proving the class
  // (forward-read=0 vs direct-read=-100 in ONE binary).
  // ★But it also reports a FALSE POSITIVE that is not yet understood: `unknown identifier: m` while
  // parsing nx_opt.nx after `inl_clone_all`, where `m` is an ordinary FUNCTION PARAMETER
  // (`opt_inline_module(m: *Module)`) used normally -- i.e. find_local misses a live parameter in
  // some context.  Shipping a compiler diagnostic whose false positive is unexplained would trade a
  // silent-wrong-value bug for a can't-build bug, so it stays out until that is root-caused.
  // NEXT RUNG: root-cause the find_local miss (print the enclosing function in the diagnostic to
  // self-locate it), then land this exactly like the call-arity check was landed.
  //
  // ---- WHAT *IS* SHIPPED: the FORWARD MODULE-CONST slice, caught precisely -----------------
  // The blanket check is unsafe (above), but ONE slice of it is both safe and high value. If
  // `name` is declared as a module `const` LATER in the token stream, this is unambiguously the
  // forward-module-const miscompile -- the one that made AT_FDCWD read 0 instead of -100 and so
  // put dirfd=0 into sys_unlinkat/sys_fchmodat. No legitimate program has that shape, and it
  // CANNOT false-positive the way the blanket check does: an ordinary parameter (the `m` case)
  // is never also declared as a later const. Witness: runtime/nx_fwdconst_probe.nx.
  if mconst_declared_later(P, name) == 1 {
      sys_write(2, "nx_parse: module const used before its declaration: " as *u8, 52)
      sys_write(2, name, fv_nl)
      sys_write(2, " -- it would silently read 0; move the const ABOVE its first reader\n" as *u8, 68)
      nx_diag_note_error()
      return 0
  }
  // seq1012 FAIL-LOUD (landed 2026-07-29): an identifier that resolves to NOTHING is a
  // compile ERROR, never the silent constant 0 that wrote wrong data and relocated with
  // unrelated refactors. The 2026-07-20 attempt was withheld over ONE false positive
  // ("m" in fn inl_clone_all) -- the survey diagnostic located it as seq358 IN A MASK:
  // the multiline else-if desync fused functions, so live parameters resolved against the
  // wrong function. With the else-if production fixed, the whole corpus surveys CLEAN
  // (nx_compile_x86 + nx_wasm_craft + nx_game_page_emit: unresolved=0) and this check
  // lands exactly like the call-arity check did. Witness: runtime/nx_undefprobe.nx.
  // The caller consumed the identifier before resolution began, so its own token sits one
  // slot back (the parse_primary_call anchoring lesson: never take the line at error time
  // from the CURRENT position -- take the construct's own token).
  var uid_ln: i64 = 0
  var uid_cl: i64 = 0
  if P.pos > 0 {
      let uid_tok: *Tok = tok_at(P.toks, P.pos - 1)
      uid_ln = uid_tok.line
      uid_cl = uid_tok.col
  }
  sys_write(2, "nx_parse: line " as *u8, 15)
  nx_put_dec_err(uid_ln)
  sys_write(2, ": UNRESOLVED identifier '" as *u8, 25)
  sys_write(2, name, fv_nl)
  sys_write(2, "' in fn " as *u8, 8)
  if P.current_fn != (0 as *Function) {
      sys_write(2, P.current_fn.name_start as *u8, P.current_fn.name_len)
  }
  sys_write(2, " -- not a local/param, const, string const, or function" as *u8, 55)
  nx_dym_suggest_ident(P, name, fv_nl)
  sys_write(2, "\n" as *u8, 1)
  nx_diag_caret(uid_ln, uid_cl)
  nx_dym_note(P)
  nx_diag_note_error()
  return 0
3290}
3291
3292// Prefix-unary level.  The trailing `as T` cast lives HERE (the
3293// wrapper), NOT inside the operand parse, so prefix operators bind
3294// TIGHTER than `as`: `*p as T` == `(*p) as T` (Rust precedence).
3295// Pre-fix, the deref branch's recursive operand parse swallowed the
3296// cast -- `*p as *u8` parsed as `*(p as *u8)` and byte-loaded the
3297// POINTER CELL, then deref'd that garbage (SIGSEGV).  Min repro:
3298// runtime/_derefcast_minrepro.nx (the B2-row landmine, 2026-06-10).
3299func parse_unary(P: *Parser) -> i64 {
  let base: i64 = parse_unary_core(P)
  // Trailing `as T` cast.  The cast RESULT must carry target_ty so downstream
  // LOAD/STORE/GEP see the correct pointee -- but the OPERAND must keep its own
  // type.  This used to do `bv.ty = target_ty` IN PLACE on the operand's Value:
  // when the operand is a bare local, that node IS the local's binding, so
  // `p as i64` flipped p to INTEGER for EVERY later reference.  Proven minimal
  // 2026-08-05 (nx_probe_castmut_live.nx: a prior cast-in-argument-position made
  // the pointer-into-integer refusal VANISH; discriminator castmut2 shows it is
  // per-value) -- and it is the ROOT of the 57/70 sys_munmap-arg-1 residue that
  // kept the reverse call-arg type direction disabled (see the do-not-enable
  // note in the call type check).  Fix: emit a typed IDENTITY (base + 0) so the
  // cast result is a FRESH Value id with target_ty and a legitimate result slot
  // in every backend; the optimizer may fold the identity -- harmless, because
  // type checks run at parse time and load/store widths are instruction-encoded.
  if peek_kind(P) == TK_AS {
      advance_tok(P)
      let target_ty: *Type = parse_type(P)
      if target_ty != (0 as *Type) {
          let czero: i64 = safe_const_i64(P, 0, "parse.nx:cast-identity-const0" as *u8)
          return ir_emit_binop(P.current_bb, OP_ADD, base, czero, target_ty)
      }
  }
  return base
3323}
3324
3325func parse_unary_core(P: *Parser) -> i64 {
  nx_assert_ptr(P.current_fn as *u8, "parse_unary: P.current_fn" as *u8)
  nx_assert(P.current_fn.values_cap > 0,
            "parse_unary: P.current_fn init" as *u8)
  let k: i64 = peek_kind(P)
  if k == TK_MINUS {
      advance_tok(P)
      let rhs: i64 = parse_unary(P)
      let zero: i64 = safe_const_i64(P, 0, "parse.nx:LINE-const0" as *u8)
      return ir_emit_binop(P.current_bb, OP_SUB, zero, rhs, ir_type_i64())
  }
  if k == TK_BANG {
      advance_tok(P)
      let rhs: i64 = parse_unary(P)
      let zero: i64 = safe_const_i64(P, 0, "parse.nx:LINE-const0" as *u8)
      return ir_emit_binop(P.current_bb, OP_EQ, rhs, zero, ir_type_bool())
  }
  // ~expr -- bitwise NOT (one's complement).  Parallels TK_BANG above;
  // lowers to the dedicated OP_NOT (single x86 `notq` / rv64 `not`),
  // the optimal one-instruction form.  Was MISSING from the function-
  // body parser (only the const-evaluator handled `~`), so `~x` in a
  // function body fell through to parse_primary, silently miscompiled,
  // AND desynced the token stream -- which surfaced downstream as the
  // misleading "address-of unknown local (&name)" when a binary `&`
  // followed (e.g. SHA-256 Choose: `((~e) & g) ...`).  Now `~` is a
  // first-class prefix operator like -, !, &, *.
  if k == TK_TILDE {
      advance_tok(P)
      let rhs: i64 = parse_unary(P)
      return ir_emit_unop(P.current_bb, OP_NOT, rhs, ir_type_i64())
  }
  // &name[.field]* -- address-of, with optional field-chain walk.
  // Valid on alloca-backed vars; returns the alloca address (no
  // load) when there's no chain, or the GEP'd field address when
  // `.field.subfield...` follows.
  //
  // Extended 2026-05-16 per cardinal feedback-bits-up-canonical-
  // layer + user directive "never avoid a limitation bits up build":
  // previously rejected `&card.field`, forcing callers to inline
  // assignments.  Now mirrors parse_stmt_ident_dot's chain walker
  // exactly, only returning the ADDRESS (no load, no store).
  //
  // STUB(parser, T#parser-001): non-alloca local case currently
  //   absorbs the error by returning 0.  Caller can't distinguish
  //   "no such local" from "address-of-non-alloca-local"; either
  //   path silently miscompiles.
  //   Plan: distinguish via typed error sentinel or assert; depends
  //   on a parser-wide error-reporting path that doesn't yet exist.
  //   Closes when: parser grows a typed error channel.
  if k == TK_AMP {
      advance_tok(P)
      let name_tok: *Tok = advance_tok(P)
      let name: *u8 = tok_text_ptr(name_tok)
      let L: *Local = find_local(P, name)
      if L == (0 as *Local) {
          // Not a local -- maybe a FUNCTION: `&fn` yields the function's code address (VK_FUNC_ADDR),
          // emitted as `leaq <fn>(%rip), %reg`. Shares its mechanism with bare-fn-name-as-value.
          var amp_nl: i64 = 0
          while name[amp_nl] != 0 { amp_nl = amp_nl + 1 }
          let amp_fn: *Function = find_function(P.module, name, amp_nl)
          if amp_fn != (0 as *Function) {
              let amp_ft: *Type = alloc_type(TY_FUNC, 8, 8)
              amp_ft.pointee = amp_fn.ret_ty
              return ir_func_addr_value(P.current_fn, amp_fn, amp_ft)
          }
          parse_die("address-of unknown local (&name)" as *u8, 32)
      }
      // Bare `&name` (no .field chain): the ADDRESS of the local's
      // stack slot.  Emit OP_ADDR_OF so codegen uses the as-address
      // (leaq) path; returning the raw alloca value-id auto-loads the
      // slot CONTENTS -> bogus pointer -> SEGV.  Works for value-typed
      // (`var x: i64`) AND pointer-typed (`var p: *T`, out-params).
      if L.is_alloca == 1 {
          if peek_kind(P) != TK_DOT {
              let pt: *Type = alloc_type(TY_PTR, 8, 8)
              pt.pointee = L.ty
              return ir_emit_unop(P.current_bb, OP_ADDR_OF, L.value_id, pt)
          }
      }
      var v: i64 = L.value_id
      // Mirror the F-meta-3 fix in parse_stmt_ident_dot: when the
      // local is alloca-backed AND it's a pointer AND we're walking
      // a `.field` chain, load the pointer value out of the slot
      // first so GEP applies to the actual pointee, not the alloca.
      //
      // CRITICAL: do this ONLY when a `.field` chain follows.  For
      // bare `&name` we want the ALLOCA ADDRESS (== L.value_id),
      // NOT the loaded pointer value.  Pre-fix this overload broke
      // outparam patterns like `nx_media_pool_get(..., &src, ...)`
      // where the callee writes through the pointer expected to be
      // &src's slot -- the load made it write through src's value
      // (uninitialised 0 -> NULL deref).
      if L.is_alloca == 1 {
          if L.ty != (0 as *Type) {
              if L.ty.kind == TY_PTR {
                  if peek_kind(P) == TK_DOT {
                      v = ir_emit_load(P.current_bb, L.value_id, L.ty)
                  }
              }
          }
      }
      var ty: *Type = L.ty
      while peek_kind(P) == TK_DOT {
          advance_tok(P)
          let ftok: *Tok = advance_tok(P)
          let fname: *u8 = tok_text_ptr(ftok)
          var flen: i64 = 0
          while fname[flen] != 0 { flen = flen + 1 }
          var stty: *Type = ty
          if stty != (0 as *Type) {
              if stty.kind == TY_PTR {
                  if stty.pointee != (0 as *Type) { stty = stty.pointee }
              }
          }
          if stty == (0 as *Type) { break }
          let field: *StructField = ir_type_struct_find_field(stty, fname, flen)
          if field == (0 as *StructField) { break }
          let off2: i64 = safe_const_i64(P, field.offset, "parse.nx:amp-field-offset" as *u8)
          v = ir_emit_gep(P.current_bb, v, off2, field.ty)
          ty = field.ty
      }
      return v
  }
  // *expr -- pointer dereference in expression position.  Loads
  // from the pointee.  Compared with the `*name = expr` statement
  // path above, this one yields a value (not an lvalue).
  if k == TK_STAR {
      advance_tok(P)
      // Operand via CORE: a trailing `as` belongs to the deref
      // RESULT (wrapper), never to the address operand.
      let addr: i64 = parse_unary_core(P)
      // Result type = pointee of addr's type (NOT hardcoded i64).
      // Without this, `*(p: *u8)` loads 8 bytes instead of 1.
      let addr_val: *Value = val_at(P.current_fn, addr)
      var elem_ty: *Type = ir_type_i64()
      if addr_val.ty != (0 as *Type) {
          if addr_val.ty.kind == TY_PTR {
              if addr_val.ty.pointee != (0 as *Type) {
                  elem_ty = addr_val.ty.pointee
              }
          }
      }
      return ir_emit_load(P.current_bb, addr, elem_ty)
  }
  // Trailing `as T` handling lives in the parse_unary wrapper
  // (required for `((p as i64) + i) as *u8` retype patterns --
  // see wrapper comment for the deref-precedence defect this
  // placement fixes).
  return parse_primary(P)
3474}
3475
3476// Helpers for type-directed arithmetic op selection.  When either
3477// operand is TY_F32 (f64 later), promote OP_ADD/SUB/MUL/DIV_S to
3478// their floating-point counterparts and carry TY_F32 through the
3479// result.  Non-fp operands fall through to the integer ops + i64
3480// result type -- same as the pre-F-extension behavior.
3481
3482func fp_op_for_int(op: i64) -> i64 {
  if op == OP_ADD   { return OP_FADD }
  if op == OP_SUB   { return OP_FSUB }
  if op == OP_MUL   { return OP_FMUL }
  if op == OP_DIV_S { return OP_FDIV }
  return op
3488}
3489
3490func has_fp_operand(P: *Parser, v: i64) -> i64 {
  if v < 0 { return 0 }
  if v >= P.current_fn.n_values { return 0 }
  let base: i64 = P.current_fn.values as i64
  let val: *Value = (base + v * 48) as *Value
  if val.ty == (0 as *Type) { return 0 }
  if val.ty.kind == TY_F32 { return 1 }
  if val.ty.kind == TY_F64 { return 1 }
  return 0
3499}
3500
3501func nx_value_type(P: *Parser, v: i64) -> *Type {
  if v < 0 { return 0 as *Type }
  if v >= P.current_fn.n_values { return 0 as *Type }
  let base: i64 = P.current_fn.values as i64
  let val: *Value = (base + v * 48) as *Value
  return val.ty
3507}
3508
3509// Result type of an INTEGER binop.  When BOTH operands are 32-bit (i32/u32) the result is
3510// 32-bit -> the backend then WRAPS it mod 2^32 (else RV64 computes in 64 bits and u32
3511// arithmetic never overflows: 4e9+1e9 stayed 5e9 instead of 705032704).  Signed only when
3512// BOTH are signed i32 (so the wrap sign-extends); otherwise unsigned u32 (zero-extend).
3513// Any i64 operand -> i64 result: this is exactly what keeps POINTER arithmetic (ptr + i32
3514// offset, ptr is i64) full-width instead of truncating the address.
3515func nx_value_is_const(P: *Parser, v: i64) -> i64 {
  if v < 0 { return 0 }
  if v >= P.current_fn.n_values { return 0 }
  let base: i64 = P.current_fn.values as i64
  let val: *Value = (base + v * 48) as *Value
  if val.kind == 0 { return 1 }   // VK_CONST_INT
  return 0
3522}
3523
3524func int_binop_result_type(P: *Parser, left: i64, right: i64) -> *Type {
  let lt: *Type = nx_value_type(P, left)
  let rt: *Type = nx_value_type(P, right)
  var l32: i64 = 0
  var r32: i64 = 0
  var l_signed: i64 = 0
  var r_signed: i64 = 0
  if lt != (0 as *Type) { if lt.kind == TY_I32 { l32 = 1; l_signed = lt.sext } }
  if rt != (0 as *Type) { if rt.kind == TY_I32 { r32 = 1; r_signed = rt.sext } }
  var is32: i64 = 0
  var signed32: i64 = 0
  // both 32-bit -> 32-bit (signed only if BOTH signed)
  if l32 == 1 { if r32 == 1 { is32 = 1; if l_signed == 1 { if r_signed == 1 { signed32 = 1 } } } }
  // one 32-bit + the other an integer LITERAL -> 32-bit (the literal adapts, e.g. `u32_acc + K[i]`
  // in a hash round).  A non-const i64 operand keeps the result i64 so real 64-bit values (and
  // POINTER arithmetic, ptr is TY_PTR not TY_I32) are never truncated.
  if l32 == 1 { if r32 == 0 { if nx_value_is_const(P, right) == 1 { is32 = 1; signed32 = l_signed } } }
  if r32 == 1 { if l32 == 0 { if nx_value_is_const(P, left) == 1 { is32 = 1; signed32 = r_signed } } }
  if is32 == 1 {
      if signed32 == 1 { return alloc_type_s(TY_I32, 4, 4) }
      return alloc_type(TY_I32, 4, 4)
  }
  // POINTER ARITHMETIC KEEPS ITS POINTER TYPE (2026-08-05). ptr + int used to fall through to
  // i64 here, so the corpus idiom emit(out + o, cap - o) handed a value the parser believed was
  // an INTEGER to a POINTER parameter. That is CAUSE 2 of the call-arg type residue: with the
  // cast-mutation root fixed, enabling the reverse type direction still refused 4 equiv rows, and
  // the gateu0027s newly-captured compiler stderr named the exact site --
  //   nx_parse: argument type mismatch in call to u0027tls13_ext_emit_supported_versions_tls13u0027:
  //   arg 1 is an INTEGER but the parameter is a POINTER   (nx_tls13_hello.nx out + o)
  // -- which was the CHECK BEING RIGHT ABOUT A TYPE THE PARSER HAD ALREADY LOST, not a false
  // positive. C semantics and every corpus use agree: pointer +/- integer is a POINTER.
  // Both operands pointers (p - q) stays an integer difference.
  let lp: i64 = (lt != (0 as *Type)) as i64
  let rp: i64 = (rt != (0 as *Type)) as i64
  if lp == 1 {
      if lt.kind == TY_PTR {
          if rp == 1 { if rt.kind == TY_PTR { return ir_type_i64() } }
          return lt
      }
  }
  if rp == 1 { if rt.kind == TY_PTR { return rt } }
  return ir_type_i64()
3566}
3567
3568// Result float type of an fp binop: TY_F64 if EITHER operand is f64, else TY_F32
3569// (C-style widest-operand promotion). Forcing TY_F32 here (the pre-2026-07-16
3570// behavior) SILENTLY MISCOMPILED f64 arithmetic to single precision -- the
3571// emitter reads i.ty to pick movsd vs movss, so a wrong TY_F32 truncated every
3572// f64 op to garbage (low-32-bit reinterpret). See the f64-codegen rung.
3573func fp_result_type(P: *Parser, left: i64, right: i64) -> *Type {
  let lt: *Type = nx_value_type(P, left)
  let rt: *Type = nx_value_type(P, right)
  if lt != (0 as *Type) { if lt.kind == TY_F64 { return alloc_type(TY_F64, 8, 8) } }
  if rt != (0 as *Type) { if rt.kind == TY_F64 { return alloc_type(TY_F64, 8, 8) } }
  return alloc_type(TY_F32, 4, 4)
3579}
3580
3581// Emit a binop, auto-promoting to fp when either operand is fp.
3582func emit_typed_binop(P: *Parser, op: i64, left: i64, right: i64) -> i64 {
  if has_fp_operand(P, left) == 1 {
      return ir_emit_binop(P.current_bb, fp_op_for_int(op),
                           left, right, fp_result_type(P, left, right))
  }
  if has_fp_operand(P, right) == 1 {
      return ir_emit_binop(P.current_bb, fp_op_for_int(op),
                           left, right, fp_result_type(P, left, right))
  }
  return ir_emit_binop(P.current_bb, op, left, right,
                       int_binop_result_type(P, left, right))
3593}
3594
3595func parse_multiplicative(P: *Parser) -> i64 {
  nx_assert_ptr(P.current_bb as *u8, "parse_multiplicative: bb" as *u8)
  nx_assert_ptr(P.current_bb.parent as *u8,
                "parse_multiplicative: bb.parent" as *u8)
  var left: i64 = parse_unary(P)
  var go: i64 = 1
  while go {
      if at_stmt_boundary(P) == 1 { go = 0; continue }
      let k: i64 = peek_kind(P)
      var op: i64 = 0
      if k == TK_STAR    { op = OP_MUL }
      if k == TK_SLASH   { op = OP_DIV_S }
      if k == TK_PERCENT { op = OP_REM_S }
      if op == 0 { go = 0; continue }
      advance_tok(P)
      let right: i64 = parse_unary(P)
      left = emit_typed_binop(P, op, left, right)
  }
  return left
3614}
3615
3616func parse_additive(P: *Parser) -> i64 {
  nx_assert_ptr(P.current_bb as *u8, "parse_additive: bb" as *u8)
  nx_assert_ptr(P.current_bb.parent as *u8,
                "parse_additive: bb.parent" as *u8)
  var left: i64 = parse_multiplicative(P)
  var go: i64 = 1
  while go {
      if at_stmt_boundary(P) == 1 { go = 0; continue }
      let k: i64 = peek_kind(P)
      var op: i64 = 0
      if k == TK_PLUS  { op = OP_ADD }
      if k == TK_MINUS { op = OP_SUB }
      if op == 0 { go = 0; continue }
      advance_tok(P)
      let right: i64 = parse_multiplicative(P)
      left = emit_typed_binop(P, op, left, right)
  }
  return left
3634}
3635
3636func parse_shift(P: *Parser) -> i64 {
  var left: i64 = parse_additive(P)
  var go: i64 = 1
  while go {
      if at_stmt_boundary(P) == 1 { go = 0; continue }
      let k: i64 = peek_kind(P)
      var op: i64 = 0
      if k == TK_SHL { op = OP_SHL }
      if k == TK_SHR { op = OP_SHR_S }
      if op == 0 { go = 0; continue }
      advance_tok(P)
      let right: i64 = parse_additive(P)
      // Shift result takes the LEFT operand's width: a 32-bit `x << n` wraps mod 2^32
      // (the backend masks a TY_I32 result); an i64 shift stays 64-bit.
      var sty: *Type = ir_type_i64()
      let lt: *Type = nx_value_type(P, left)
      if lt != (0 as *Type) {
          if lt.kind == TY_I32 {
              if lt.sext == 1 { sty = alloc_type_s(TY_I32, 4, 4) }
              if lt.sext != 1 { sty = alloc_type(TY_I32, 4, 4) }
          }
      }
      left = ir_emit_binop(P.current_bb, op, left, right, sty)
  }
  return left
3661}
3662
3663func parse_comparison(P: *Parser) -> i64 {
  nx_assert_ptr(P.current_bb as *u8, "parse_comparison: bb" as *u8)
  nx_assert_ptr(P.current_bb.parent as *u8,
                "parse_comparison: bb.parent" as *u8)
  let left: i64 = parse_shift(P)
  if at_stmt_boundary(P) == 1 { return left }
  let k: i64 = peek_kind(P)
  var op: i64 = 0
  if k == TK_LT { op = OP_LT_S }
  if k == TK_LE { op = OP_LE_S }
  if k == TK_GT { op = OP_GT_S }
  if k == TK_GE { op = OP_GE_S }
  if op == 0 { return left }
  advance_tok(P)
  let right: i64 = parse_shift(P)
  return ir_emit_binop(P.current_bb, op, left, right, ir_type_bool())
3679}
3680
3681func parse_equality(P: *Parser) -> i64 {
  var left: i64 = parse_comparison(P)
  var go: i64 = 1
  while go {
      if at_stmt_boundary(P) == 1 { go = 0; continue }
      let k: i64 = peek_kind(P)
      var op: i64 = 0
      if k == TK_EQ { op = OP_EQ }
      if k == TK_NE { op = OP_NE }
      if op == 0 { go = 0; continue }
      advance_tok(P)
      let right: i64 = parse_comparison(P)
      left = ir_emit_binop(P.current_bb, op, left, right, ir_type_bool())
  }
  return left
3696}
3697
3698func parse_bitand(P: *Parser) -> i64 {
  var left: i64 = parse_equality(P)
  while peek_kind(P) == TK_AMP {
      if at_stmt_boundary(P) == 1 { return left }
      advance_tok(P)
      let right: i64 = parse_equality(P)
      left = ir_emit_binop(P.current_bb, OP_AND, left, right, ir_type_i64())
  }
  return left
3707}
3708
3709func parse_bitxor(P: *Parser) -> i64 {
  var left: i64 = parse_bitand(P)
  while peek_kind(P) == TK_CARET {
      if at_stmt_boundary(P) == 1 { return left }
      advance_tok(P)
      let right: i64 = parse_bitand(P)
      left = ir_emit_binop(P.current_bb, OP_XOR, left, right, ir_type_i64())
  }
  return left
3718}
3719
3720func parse_bitor(P: *Parser) -> i64 {
  var left: i64 = parse_bitxor(P)
  while peek_kind(P) == TK_PIPE {
      if at_stmt_boundary(P) == 1 { return left }
      advance_tok(P)
      let right: i64 = parse_bitxor(P)
      left = ir_emit_binop(P.current_bb, OP_OR, left, right, ir_type_i64())
  }
  return left
3729}
3730
3731func parse_logical_and(P: *Parser) -> i64 {
  var left: i64 = parse_bitor(P)
  while peek_kind(P) == TK_AND_AND {
      if at_stmt_boundary(P) == 1 { return left }
      advance_tok(P)
      let right: i64 = parse_bitor(P)
      left = ir_emit_binop(P.current_bb, OP_AND, left, right, ir_type_bool())
  }
  return left
3740}
3741
3742func parse_logical_or(P: *Parser) -> i64 {
  var left: i64 = parse_logical_and(P)
  while peek_kind(P) == TK_OR_OR {
      if at_stmt_boundary(P) == 1 { return left }
      advance_tok(P)
      let right: i64 = parse_logical_and(P)
      left = ir_emit_binop(P.current_bb, OP_OR, left, right, ir_type_bool())
  }
  return left
3751}
3752
3753// ---- statements ----
3754
3755// parse_stmt -- slim dispatcher (task #21 codegen-bug workaround).
3756//
3757// The original parse_stmt body was 500+ lines with deeply nested
3758// branches.  When the C-host compiled it, the resulting RV64 asm
3759// had a ~4400-byte stack frame; under heavy register pressure the
3760// regalloc miscalculated alloca-slot offsets such that a write to
3761// a local var would land on the *Parser arg's spill region,
3762// nulling P.current_bb.  The bug only manifested mid-way through
3763// parsing sys_read_file in stage-2 self-compile.
3764//
3765// Workaround: hoist EVERY major branch into its own function.
3766// Each handler now has its own clean stack frame -- P arrives as
3767// a fresh argument, alloca slots can't alias the caller's spill,
3768// and the regalloc has dramatically less pressure to manage.
3769// Pure NishiLang refactor; no C-host changes required.
3770func parse_stmt(P: *Parser) -> i64 {
  nx_assert_ptr(P.current_fn as *u8, "parse_stmt: P.current_fn" as *u8)
  nx_assert(P.current_fn.values_cap > 0,
            "parse_stmt: P.current_fn.values_cap > 0" as *u8)
  nx_assert_ptr(P.current_bb as *u8, "parse_stmt: P.current_bb" as *u8)
  nx_assert_ptr(P.current_bb.parent as *u8,
                "parse_stmt: P.current_bb.parent" as *u8)
3777
  let k: i64 = peek_kind(P)
  // DEFENSE-IN-DEPTH (seq757's prescribed second half, 2026-07-29): a `func` token can NEVER
  // start a statement -- reaching one mid-body means some prior construct consumed this
  // function's closing brace (the seq358 fusion class). Die LOUD instead of silently
  // absorbing the next function as an empty stub. Kills the whole class structurally.
  if k == TK_FUNC {
      parse_die("'func' inside a function body -- a prior construct consumed the closing brace (desync guard)" as *u8, 92)
  }
  if k == TK_RETURN   { return parse_stmt_return(P) }
  if k == TK_LET      { return parse_stmt_let(P) }
  if k == TK_VAR      { return parse_stmt_var(P) }
  if k == TK_IF       { return parse_stmt_if(P) }
  if k == TK_WHILE    { return parse_stmt_while(P) }
  if k == TK_FOR      { return parse_stmt_for(P) }
  if k == TK_BREAK    { return parse_stmt_break(P) }
  if k == TK_CONTINUE { return parse_stmt_continue(P) }
  if k == TK_MATCH    { return parse_stmt_match(P) }
  if k == TK_STAR     { return parse_stmt_star(P) }
  if k == TK_IDENT    { return parse_stmt_ident(P) }
  return parse_stmt_expr_fallback(P)
3798}
3799
3800// ---- per-kind handlers (each = one fresh stack frame) ----
3801
3802// PREVENT (T#parser-keyword-as-identifier): a binding name MUST be a plain
3803// identifier. A reserved keyword in name position (e.g. `var match`, where
3804// `match` lexes to TK_MATCH) silently desynced the parser so the NEXT
3805// compilation unit's leading `const X: i64 = 0` misparsed as `i64 = 0`.
3806// Reject it LOUD here -- makes the whole class structurally impossible
3807// (no silent failure; same stance as the let-reassign / undefined-assign guards).
3808func nx_require_ident_name(P: *Parser, name_tok: *Tok) -> i64 {
  if name_tok.kind != TK_IDENT {
      sys_write(2, "nx_parse: line " as *u8, 15)
      nx_put_dec_err(name_tok.line)
      sys_write(2, ": reserved keyword '" as *u8, 20)
      nx_put_tok_text_err(name_tok)
      sys_write(2, "' cannot be used as an identifier name\n" as *u8, 39)
      sys_exit(2)
  }
  return 0
3818}
3819
3820func parse_stmt_return(P: *Parser) -> i64 {
  advance_tok(P)
  var v: i64 = 0
  if peek_kind(P) != TK_RBRACE {
      if peek_kind(P) != TK_SEMI {
          v = parse_expr(P)
      }
  }
  match_kind(P, TK_SEMI)
  ir_emit_return(P.current_bb, v)
  return 0
3831}
3832
3833func parse_stmt_let(P: *Parser) -> i64 {
  advance_tok(P)
  let name_tok: *Tok = advance_tok(P)
  nx_require_ident_name(P, name_tok)
  var let_ty: *Type = 0 as *Type
  if match_kind(P, TK_COLON) {
      let_ty = parse_type(P)
  }
  match_kind(P, TK_ASSIGN)
  let v: i64 = parse_expr(P)
  match_kind(P, TK_SEMI)
  // Type-context inference: if the LHS demands TY_F32 but the RHS
  // is a default-f64 literal Value (CONST kind, TY_F64 attached),
  // downcast the IEEE 754 bits in place and re-tag as TY_F32.
  // This makes `let x: f32 = 1.5` work without requiring the user
  // to write `1.5f32` explicitly.  Symmetric with literal-suffix
  // path (TK_FLOAT_F32) -- both produce a single-precision Value
  // at the same storage slot.
  if let_ty != (0 as *Type) {
      if let_ty.kind == TY_F32 {
          let vbase: i64 = P.current_fn.values as i64
          let val: *Value = (vbase + v * 48) as *Value
          if val.kind == 0 {
              if val.ty != (0 as *Type) {
                  if val.ty.kind == TY_F64 {
                      val.const_int = fp64_to_fp32(val.const_int)
                      val.ty = alloc_type(TY_F32, 4, 4)
                  }
              }
          }
      }
  }
  // If the user gave no annotation, default to i64 (legacy
  // behavior).  When given, propagate the real type so pointer-
  // typed locals like `*u8` index with the right stride.
  if let_ty == (0 as *Type) { let_ty = ir_type_i64() }
  // Two `let` of one name in ONE block was accepted silently, and find_local scans BACKWARD, so
  // every later reference bound to the newer one. In a code emitter that silently rewires control
  // flow: two `let loop_at` sent an event-loop back-edge to the wrong label, caught only because
  // the bogus displacement happened to overflow rel8. Under 127 bytes it emits a wrong jump green.
  // ENFORCEMENT IS OFF PENDING BACKFILL. local_in_block() is correct and the scoping is live,
  // but the estate ITSELF declares the same name twice in ONE block in at least 6 measured
  // sources, so switching this on refuses real code. Backfill the sources, THEN turn it on:
  //   nx_assert(local_in_block(P, tok_text_ptr(name_tok)) == 0, "duplicate let ..." as *u8)
  add_local(P, tok_text_ptr(name_tok), v, 0, TY_I64, let_ty)
  return 0
3879}
3880
3881func parse_stmt_var(P: *Parser) -> i64 {
  advance_tok(P)
  let name_tok: *Tok = advance_tok(P)
  nx_require_ident_name(P, name_tok)
  var ann: *Type = 0 as *Type
  if match_kind(P, TK_COLON) { ann = parse_type(P) }
  if ann != (0 as *Type) {
      if ann.kind == TY_STRUCT {
          if peek_kind(P) != TK_ASSIGN {
              match_kind(P, TK_SEMI)
              let addr_s: i64 = ir_emit_alloca(P.current_bb, ann)
              add_local(P, tok_text_ptr(name_tok), addr_s, 1, TY_STRUCT, ann)
              return 0
          }
      }
      if ann.kind == TY_ARRAY {
          // Stack array `var buf: [N]T` -- alloca ann.size (=N*elem) bytes; the local's
          // value_id IS the array's frame address (decays like a struct). No initializer
          // form (a `= {...}` literal would be a future extension); memory is uninitialised.
          match_kind(P, TK_SEMI)
          let addr_a: i64 = ir_emit_alloca(P.current_bb, ann)
          add_local(P, tok_text_ptr(name_tok), addr_a, 1, TY_ARRAY, ann)
          return 0
      }
  }
  match_kind(P, TK_ASSIGN)
  let init_v: i64 = parse_expr(P)
  match_kind(P, TK_SEMI)
  let addr: i64 = ir_emit_alloca(P.current_bb, ir_type_i64())
  ir_emit_store(P.current_bb, addr, init_v, ir_type_i64())
  var var_ty: *Type = ann
  if var_ty == (0 as *Type) { var_ty = ir_type_i64() }
  add_local(P, tok_text_ptr(name_tok), addr, 1, TY_I64, var_ty)
  return 0
3915}
3916
3917func parse_stmt_if(P: *Parser) -> i64 {
  advance_tok(P)
  let cond: i64 = parse_expr(P)
  match_kind(P, TK_LBRACE)
  let then_bb: *BasicBlock = ir_block_new(P.current_fn)
  let else_bb: *BasicBlock = ir_block_new(P.current_fn)
  let merge_bb: *BasicBlock = ir_block_new(P.current_fn)
  ir_emit_br_cond(P.current_bb, cond, then_bb, else_bb)
  P.current_bb = then_bb
  parse_stmt_list(P)
  match_kind(P, TK_RBRACE)
  ir_emit_br(P.current_bb, merge_bb)
  P.current_bb = else_bb
  if match_kind(P, TK_ELSE) {
      // `else if` CHAIN (seq358 root cause, fixed 2026-07-29): this production was MISSING --
      // match_kind(TK_LBRACE) failed silently on `else if`, the chained if parsed as the first
      // statement of an unbraced "block", and parse_stmt_list then consumed past the REAL
      // closing brace hunting a phantom one: following statements -- and eventually following
      // FUNCTIONS -- fused into the current one (empty-stub emission, the documented desync;
      // it also faked seq1012's "false positive": identifiers after the fuse point resolved
      // against the WRONG function). The chained if IS the else block: recurse; its merge
      // becomes current_bb and bridges into our merge below. Flag dialect, not else-if, so
      // TODAY'S compiler (which lacks the production) can compile this very fix.
      var chained: i64 = 0
      if peek_kind(P) == TK_IF { chained = 1 }
      if chained == 1 {
          parse_stmt_if(P)
      }
      if chained == 0 {
          match_kind(P, TK_LBRACE)
          parse_stmt_list(P)
          match_kind(P, TK_RBRACE)
      }
  }
  ir_emit_br(P.current_bb, merge_bb)
  P.current_bb = merge_bb
  return 0
3954}
3955
3956func parse_stmt_while(P: *Parser) -> i64 {
  advance_tok(P)
  let head_bb: *BasicBlock = ir_block_new(P.current_fn)
  let body_bb: *BasicBlock = ir_block_new(P.current_fn)
  let exit_bb: *BasicBlock = ir_block_new(P.current_fn)
  ir_emit_br(P.current_bb, head_bb)
  P.current_bb = head_bb
  let cond: i64 = parse_expr(P)
  match_kind(P, TK_LBRACE)
  ir_emit_br_cond(P.current_bb, cond, body_bb, exit_bb)
  P.current_bb = body_bb
  let saved_head: *BasicBlock = P.loop_head
  let saved_exit: *BasicBlock = P.loop_exit
  P.loop_head = head_bb
  P.loop_exit = exit_bb
  parse_stmt_list(P)
  P.loop_head = saved_head
  P.loop_exit = saved_exit
  match_kind(P, TK_RBRACE)
  ir_emit_br(P.current_bb, head_bb)
  P.current_bb = exit_bb
  return 0
3978}
3979
3980func parse_stmt_for(P: *Parser) -> i64 {
  advance_tok(P)
  let vname: *Tok = advance_tok(P)
  nx_require_ident_name(P, vname)
  match_kind(P, TK_IN)
  let start_v: i64 = parse_expr(P)
  match_kind(P, TK_DOT_DOT)
  let end_v: i64 = parse_expr(P)
  match_kind(P, TK_LBRACE)
3989
  let i_slot: i64 = ir_emit_alloca(P.current_bb, ir_type_i64())
  ir_emit_store(P.current_bb, i_slot, start_v, ir_type_i64())
  let end_slot: i64 = ir_emit_alloca(P.current_bb, ir_type_i64())
  ir_emit_store(P.current_bb, end_slot, end_v, ir_type_i64())
3994
  let head_bb: *BasicBlock = ir_block_new(P.current_fn)
  let body_bb: *BasicBlock = ir_block_new(P.current_fn)
  let incr_bb: *BasicBlock = ir_block_new(P.current_fn)
  let exit_bb: *BasicBlock = ir_block_new(P.current_fn)
3999
  ir_emit_br(P.current_bb, head_bb)
4001
  P.current_bb = head_bb
  let i_now: i64 = ir_emit_load(P.current_bb, i_slot, ir_type_i64())
  let e_now: i64 = ir_emit_load(P.current_bb, end_slot, ir_type_i64())
  let cond: i64 = ir_emit_binop(P.current_bb, OP_LT_S, i_now, e_now,
                                ir_type_bool())
  ir_emit_br_cond(P.current_bb, cond, body_bb, exit_bb)
4008
  P.current_bb = body_bb
  let saved_locals: i64 = P.n_locals
  add_local(P, tok_text_ptr(vname), i_slot, 1, TY_I64, ir_type_i64())
  let saved_head: *BasicBlock = P.loop_head
  let saved_exit: *BasicBlock = P.loop_exit
  P.loop_head = incr_bb
  P.loop_exit = exit_bb
  let saved_bb_for: i64 = P.block_base
  P.block_base = P.n_locals
  parse_stmt_list(P)
  P.block_base = saved_bb_for
  P.loop_head = saved_head
  P.loop_exit = saved_exit
  match_kind(P, TK_RBRACE)
  P.n_locals = saved_locals
4024
  ir_emit_br(P.current_bb, incr_bb)
4026
  P.current_bb = incr_bb
  let i2: i64 = ir_emit_load(P.current_bb, i_slot, ir_type_i64())
  let one: i64 = safe_const_i64(P, 1, "parse.nx:LINE-const1" as *u8)
  let i3: i64 = ir_emit_binop(P.current_bb, OP_ADD, i2, one, ir_type_i64())
  ir_emit_store(P.current_bb, i_slot, i3, ir_type_i64())
  ir_emit_br(P.current_bb, head_bb)
4033
  P.current_bb = exit_bb
  return 0
4036}
4037
4038func parse_stmt_break(P: *Parser) -> i64 {
  advance_tok(P)
  match_kind(P, TK_SEMI)
  if P.loop_exit != (0 as *BasicBlock) {
      ir_emit_br(P.current_bb, P.loop_exit)
  }
  return 0
4045}
4046
4047func parse_stmt_continue(P: *Parser) -> i64 {
  advance_tok(P)
  match_kind(P, TK_SEMI)
  if P.loop_head != (0 as *BasicBlock) {
      ir_emit_br(P.current_bb, P.loop_head)
  }
  return 0
4054}
4055
4056func parse_stmt_match(P: *Parser) -> i64 {
  let match_tok: *Tok = advance_tok(P)
  let scrut: i64 = parse_expr(P)
  match_kind(P, TK_LBRACE)
4060
  let saved_pos_m: i64 = P.pos
  var tagged: i64 = 0
  var shadow_ty_m: *Type = 0 as *Type
  if peek_kind(P) == TK_IDENT {
      let pen_tok: *Tok = peek_at(P, 0)
      let pen: *u8 = tok_text_ptr(pen_tok)
      let pee: *EnumEntry = lookup_enum(P, pen)
      if pee != (0 as *EnumEntry) {
          if pee.has_payload == 1 {
              tagged = 1
              shadow_ty_m = pee.shadow_ty
          }
      }
  }
4075
  // MATCH EXHAUSTIVENESS (2026-08-05): remember WHICH enum is being matched so the closing
  // brace can prove every variant is handled. Elm made this famous and Rust/Swift/OCaml all
  // enforce it; nx_cc parsed match happily and let a missing variant fall THROUGH the whole
  // statement to whatever followed -- a silent wrong-path, the same family as the arity and
  // call-arg-type fail-opens closed earlier today.
  var match_ee: *EnumEntry = 0 as *EnumEntry
  var covered_mask: i64 = 0
  var covered_n: i64 = 0
  var over64: i64 = 0
  if peek_kind(P) == TK_IDENT {
      let cen_tok: *Tok = peek_at(P, 0)
      let cee: *EnumEntry = lookup_enum(P, tok_text_ptr(cen_tok))
      if cee != (0 as *EnumEntry) { match_ee = cee }
  }
  var disc_scrut: i64 = scrut
  if tagged == 1 {
      let zero_off: i64 = safe_const_i64(P, 0, "parse.nx:match-zero" as *u8)
      let tag_addr: i64 = ir_emit_gep(P.current_bb, scrut, zero_off, ir_type_i64())
      disc_scrut = ir_emit_load(P.current_bb, tag_addr, ir_type_i64())
  }
4096
  let merge_bb: *BasicBlock = ir_block_new(P.current_fn)
4098
  while peek_kind(P) != TK_RBRACE {
      if peek_kind(P) == TK_EOF { return 0 }
      let en_tok: *Tok = advance_tok(P)
      let en: *u8 = tok_text_ptr(en_tok)
      match_kind(P, TK_COLON_COLON)
      let v_tok: *Tok = advance_tok(P)
      let vn: *u8 = tok_text_ptr(v_tok)
4106
      let qbuf2: *u8 = sys_mmap(80)
      var nl2: i64 = 0
      while en[nl2] != 0 { qbuf2[nl2] = en[nl2]; nl2 = nl2 + 1 }
      qbuf2[nl2] = 0x3A; nl2 = nl2 + 1
      qbuf2[nl2] = 0x3A; nl2 = nl2 + 1
      var vl2: i64 = 0
      while vn[vl2] != 0 { qbuf2[nl2 + vl2] = vn[vl2]; vl2 = vl2 + 1 }
      qbuf2[nl2 + vl2] = 0
4115
      let out_raw2: *u8 = sys_mmap(16)
      let out2: *i64 = out_raw2 as *i64
      *out2 = 0
      lookup_mconst(P, qbuf2, out2)
      let disc: i64 = *out2
      // Count DISTINCT discriminants, not arms: duplicated arms must not fake coverage, and
      // counting VALUES (not positions) keeps explicit Variant = 7 discriminants correct.
      // A discriminant outside 0..63 cannot be tracked in the mask -- declare that and skip
      // the verdict rather than guess (a check that cannot know must decline, not invent).
      if disc >= 0 {
          if disc < 64 {
              let dbit: i64 = 1 << disc
              if (covered_mask & dbit) == 0 { covered_mask = covered_mask | dbit; covered_n = covered_n + 1 }
              else {
                  // UNREACHABLE ARM (2026-08-05). A discriminant already covered by an earlier arm
                  // can never be selected: the emitted chain tests arms in order, so this body is
                  // DEAD CODE. It is the exact shape a copy-pasted arm takes when the variant name
                  // was not updated -- the author believes a case is handled and it is not. Rust and
                  // Elm both refuse it; refusing here costs nothing and names the arm.
                  sys_write(2, "nx_parse: line " as *u8, 15)
                  nx_put_dec_err(en_tok.line)
                  sys_write(2, ": unreachable match arm '" as *u8, 25)
                  sys_write(2, qbuf2, nl2 + vl2)
                  sys_write(2, "' -- already handled by an earlier arm of the match at line " as *u8, 60)
                  nx_put_dec_err(match_tok.line)
                  sys_write(2, "; remove it or fix the variant name\n" as *u8, 36)
                  nx_diag_note_error()
              }
          } else { over64 = 1 }
      } else { over64 = 1 }
4146
      var has_bind: i64 = 0
      var bind_tok: *Tok = 0 as *Tok
      if match_kind(P, TK_LPAREN) {
          bind_tok = advance_tok(P)
          has_bind = 1
          match_kind(P, TK_RPAREN)
      }
      match_kind(P, TK_FAT_ARROW)
4155
      let arm_bb: *BasicBlock = ir_block_new(P.current_fn)
      let next_bb: *BasicBlock = ir_block_new(P.current_fn)
      let disc_v: i64 = safe_const_i64(P, disc, "parse.nx:match-disc" as *u8)
      let cmp: i64 = ir_emit_binop(P.current_bb, OP_EQ, disc_scrut, disc_v,
                                    ir_type_bool())
      ir_emit_br_cond(P.current_bb, cmp, arm_bb, next_bb)
4162
      P.current_bb = arm_bb
4164
      let saved_locals_arm: i64 = P.n_locals
      if has_bind == 1 {
          if tagged == 1 {
              let eight: i64 = safe_const_i64(P, 8, "parse.nx:match-eight" as *u8)
              let pay_addr: i64 = ir_emit_gep(P.current_bb, scrut, eight,
                                               ir_type_i64())
              let pay_val: i64 = ir_emit_load(P.current_bb, pay_addr,
                                               ir_type_i64())
              let bname: *u8 = tok_text_ptr(bind_tok)
              add_local(P, bname, pay_val, 0, TY_I64, ir_type_i64())
          }
      }
4177
      let saved_bb_arm: i64 = P.block_base
      P.block_base = P.n_locals
      if match_kind(P, TK_LBRACE) {
          parse_stmt_list(P)
          match_kind(P, TK_RBRACE)
      } else {
          parse_stmt(P)
      }
      P.block_base = saved_bb_arm
      P.n_locals = saved_locals_arm
      ir_emit_br(P.current_bb, merge_bb)
4189
      P.current_bb = next_bb
      match_kind(P, TK_COMMA)
  }
  match_kind(P, TK_RBRACE)
4194
  // EXHAUSTIVENESS VERDICT. Refuse a match that leaves a variant unhandled: without this the
  // statement simply falls through, so the bug shows up as a wrong RESULT far from the match.
  // NishiLang has no wildcard arm form (patterns are Enum::Variant), so full coverage is
  // exactly distinct-variants-handled == variants-declared.
  // DECLARED NARROWNESS: skipped when any discriminant is outside 0..63 (mask range) or when
  // the enum is unknown at this point -- decline, never guess.
  if match_ee != (0 as *EnumEntry) {
      if over64 == 0 {
          if match_ee.n_variants > 0 {
              if covered_n < match_ee.n_variants {
                  sys_write(2, "nx_parse: line " as *u8, 15)
                  nx_put_dec_err(match_tok.line)
                  sys_write(2, ": non-exhaustive match on enum '" as *u8, 32)
                  sys_write(2, (match_ee as i64) as *u8, match_ee.name_len)
                  sys_write(2, "': " as *u8, 3)
                  nx_put_dec_err(covered_n)
                  sys_write(2, " of " as *u8, 4)
                  nx_put_dec_err(match_ee.n_variants)
                  sys_write(2, " variants handled -- add an arm for: " as *u8, 37)
                  // NAME THE MISSING VARIANTS (Elm parity, 2026-08-05). A COUNT TELLS YOU THAT YOU
                  // ARE WRONG; A NAME TELLS YOU WHAT TO WRITE -- and that difference is the whole
                  // reason Elm held Best on this axis. No new storage was needed: every variant is
                  // already registered as the module const "Enum::Variant" carrying its
                  // discriminant in .val, so the diagnostic is a scan of a table we already keep.
                  let een: *u8 = (match_ee as i64) as *u8
                  let eln: i64 = match_ee.name_len
                  var mi: i64 = 0
                  var printed: i64 = 0
                  while mi < P.n_mconsts {
                      let mc: *MConst = mconst_at(P, mi)
                      let mn: *u8 = (mc as i64) as *u8
                      var pre: i64 = 1
                      var q: i64 = 0
                      while q < eln {
                          if mn[q] != een[q] { pre = 0; q = eln }
                          q = q + 1
                      }
                      if pre == 1 { if mn[eln] != (58 as u8) { pre = 0 } }
                      if pre == 1 { if mn[eln + 1] != (58 as u8) { pre = 0 } }
                      if pre == 1 {
                          let dv: i64 = mc.val
                          var miss: i64 = 1
                          if dv >= 0 {
                              if dv < 64 {
                                  if (covered_mask & (1 << dv)) != 0 { miss = 0 }
                              }
                          }
                          if miss == 1 {
                              if printed == 1 { sys_write(2, ", " as *u8, 2) }
                              let vp: i64 = eln + 2
                              var vlen: i64 = 0
                              while mn[vp + vlen] != (0 as u8) { vlen = vlen + 1 }
                              sys_write(2, ((mn as i64) + vp) as *u8, vlen)
                              printed = 1
                          }
                      }
                      mi = mi + 1
                  }
                  sys_write(2, "\n" as *u8, 1)
                  nx_diag_caret(match_tok.line, match_tok.col)
                  nx_diag_note_error()
              }
          }
      }
  }
4260
  ir_emit_br(P.current_bb, merge_bb)
  P.current_bb = merge_bb
  return 0
4264}
4265
4266func parse_stmt_star(P: *Parser) -> i64 {
  let p1: *Tok = peek_at(P, 1)
  let p2: *Tok = peek_at(P, 2)
  let n1: i64 = p1.kind
  let n2: i64 = p2.kind
  if n1 == TK_IDENT { if n2 == TK_ASSIGN {
      advance_tok(P)
      let name_tok: *Tok = advance_tok(P)
      advance_tok(P)
      let rhs: i64 = parse_expr(P)
      match_kind(P, TK_SEMI)
      let name: *u8 = tok_text_ptr(name_tok)
      let L: *Local = find_local(P, name)
      if L != (0 as *Local) {
          var addr: i64 = L.value_id
          if L.is_alloca == 1 {
              // Load the pointer value at its DECLARED type (L.ty).
              var lty1: *Type = L.ty
              if lty1 == (0 as *Type) { lty1 = ir_type_i64() }
              addr = ir_emit_load(P.current_bb, L.value_id, lty1)
          }
          // Store's payload type = pointee of the pointer we just
          // loaded (or i64 fallback when type info unavailable).
          var sty1: *Type = ir_type_i64()
          if L.ty != (0 as *Type) {
              if L.ty.kind == TY_PTR {
                  if L.ty.pointee != (0 as *Type) { sty1 = L.ty.pointee }
              }
          }
          ir_emit_store(P.current_bb, addr, rhs, sty1)
      }
      return 0
  } }
  return parse_stmt_expr_fallback(P)
4300}
4301
4302// IDENT dispatch: figure out which sub-form (=, [, .), delegate.
4303func parse_stmt_ident(P: *Parser) -> i64 {
  let ptok: *Tok = peek_at(P, 1)
  let nxt: i64 = ptok.kind
  if nxt == TK_ASSIGN   { return parse_stmt_ident_assign(P) }
  if nxt == TK_LBRACKET { return parse_stmt_ident_subscript(P) }
  if nxt == TK_DOT      { return parse_stmt_ident_dot(P) }
  return parse_stmt_expr_fallback(P)
4310}
4311
4312func parse_stmt_ident_assign(P: *Parser) -> i64 {
  let name_idx: i64 = P.pos
  let name_tok: *Tok = advance_tok(P)
  advance_tok(P)
  let rhs: i64 = parse_expr(P)
  match_kind(P, TK_SEMI)
  let name: *u8 = tok_text_ptr(name_tok)
  // Identifier length for diagnostics (stop at first non-ident byte).
  var nlen: i64 = 0
  var stop: i64 = 0
  while stop == 0 {
      let c: i64 = name[nlen] as i64
      var ident: i64 = 0
      if c >= 0x61 { if c <= 0x7A { ident = 1 } }
      if c >= 0x41 { if c <= 0x5A { ident = 1 } }
      if c >= 0x30 { if c <= 0x39 { ident = 1 } }
      if c == 0x5F { ident = 1 }
      if ident == 0 { stop = 1 }
      if ident == 1 { nlen = nlen + 1 }
      if nlen >= 64 { stop = 1 }
  }
  let L: *Local = find_local(P, name)
  // Bits-up no-silent-failure (matches parse.c:2214-2215): an
  // assignment that resolves to no local, or to a `let`/param (SSA,
  // is_alloca==0), has NOWHERE to store -- the write would be
  // silently dropped.  Fail LOUD with the offending name.
  if L == (0 as *Local) {
      sys_write(2, "nx_parse: line " as *u8, 15)
      nx_put_dec_err(name_tok.line)
      sys_write(2, ":" as *u8, 1)
      nx_put_dec_err(name_tok.col)
      sys_write(2, ": assign to undefined identifier '" as *u8, 34)
      sys_write(2, name, nlen)
      sys_write(2, "'" as *u8, 1)
      nx_dym_suggest_ident(P, name, nlen)
      sys_write(2, "\n" as *u8, 1)
      nx_diag_token_window(P, name_idx)
      nx_dym_note(P)
      nx_diag_note_error()
      // RECOVERY: no local to store into -- drop the store, keep parsing.
      return 0
  }
  if L.is_alloca == 0 {
      sys_write(2, "nx_parse: line " as *u8, 15)
      nx_put_dec_err(name_tok.line)
      sys_write(2, ":" as *u8, 1)
      nx_put_dec_err(name_tok.col)
      sys_write(2, ": cannot reassign 'let' binding '" as *u8, 33)
      sys_write(2, name, nlen)
      sys_write(2, "' (use 'var')\n" as *u8, 14)
      nx_diag_token_window(P, name_idx)
      nx_diag_note_error()
      // RECOVERY: refuse the store (an SSA let has no slot), keep parsing.
      return 0
  }
  ir_emit_store(P.current_bb, L.value_id, rhs, ir_type_i64())
  return 0
4369}
4370
4371func parse_stmt_ident_subscript(P: *Parser) -> i64 {
  let name_tok: *Tok = advance_tok(P)
  let name: *u8 = tok_text_ptr(name_tok)
  let L: *Local = find_local(P, name)
  var base: i64 = 0
  // Element size + type derived from the local's type pointee.
  // *u8 -> stride 1, byte load/store; default i64 -> stride 8,
  // word load/store.  Without this, every pointer indexing site
  // wrote i64-strided through a *u8 buffer (the probe.nx bug).
  var elem_sz: i64 = 8
  var elem_ty: *Type = ir_type_i64()
  var is_arr_w: i64 = 0
  var is_slice_w: i64 = 0
  // The ARRAY type itself, wherever it lives. For a LOCAL array that is L.ty directly; for a
  // MODULE STATIC the Local is typed *(decl_ty) so the array is one level down. The bounds check
  // below needs THIS type's size -- taking L.ty.size for a static would read the size of the
  // POINTER (8) and compute nelem = 1, rejecting every index above 0.
  var arr_ty_w: *Type = 0 as *Type
  if L != (0 as *Local) {
      base = L.value_id
      if L.ty != (0 as *Type) { if L.ty.kind == TY_ARRAY { is_arr_w = 1  arr_ty_w = L.ty } }
      if L.ty != (0 as *Type) { if L.ty.kind == TY_SLICE { is_slice_w = 1 } }
      // MODULE-STATIC ARRAY: the slot IS the array, so its address is already the base. Treat it
      // exactly like a local array -- no load, GEP from the base. Without this the store went
      // through element 0 as if it were a pointer (.lcomm zero-filled => base 0 => write near
      // null), which is the whole of the "static [N]T is a daemon-killer" behaviour.
      let lv_sa: *Value = val_at(P.current_fn, L.value_id)
      if lv_sa.kind == VK_GLOBAL {
          if L.ty != (0 as *Type) {
              if L.ty.pointee != (0 as *Type) {
                  if L.ty.pointee.kind == TY_ARRAY {
                      is_arr_w = 1
                      arr_ty_w = L.ty.pointee
                  }
              }
          }
      }
      if L.is_alloca == 1 {
          if is_arr_w == 0 {
              // Load at the local's DECLARED type, not hardcoded i64.
              // ARRAY skips this: base stays the frame ADDRESS (GEP'd below).
              var lty2: *Type = L.ty
              if lty2 == (0 as *Type) { lty2 = ir_type_i64() }
              base = ir_emit_load(P.current_bb, L.value_id, lty2)
          }
      }
      // Static-ptr STRIDE fix (mirror of parse_primary_local_or_const): a static's Local type is *(e.ty)
      // (the slot ADDRESS); the loaded base is the real pointer (e.ty), so the element stride is
      // e.ty.pointee = L.ty.pointee.pointee. For a normal pointer local eff_ptr stays L.ty. Without this a
      // *u8 static WRITE strided by 8 -> `staticptr[big] = x` ran off the buffer (nx_drbench SIGSEGV).
      var eff_ptr: *Type = L.ty
      let lvw: *Value = val_at(P.current_fn, L.value_id)
      if lvw.kind == VK_GLOBAL {
          if L.ty != (0 as *Type) {
              if L.ty.kind == TY_PTR {
                  if L.ty.pointee != (0 as *Type) { eff_ptr = L.ty.pointee }
              }
          }
      }
      if eff_ptr != (0 as *Type) {
          if eff_ptr.kind == TY_PTR {
              if eff_ptr.pointee != (0 as *Type) {
                  elem_ty = eff_ptr.pointee
                  if elem_ty.size > 0 { elem_sz = elem_ty.size }
              }
          }
          if eff_ptr.kind == TY_ARRAY {
              if eff_ptr.pointee != (0 as *Type) {
                  elem_ty = eff_ptr.pointee
                  if elem_ty.size > 0 { elem_sz = elem_ty.size }
              }
          }
          if eff_ptr.kind == TY_SLICE {
              if eff_ptr.pointee != (0 as *Type) {
                  elem_ty = eff_ptr.pointee
                  if elem_ty.size > 0 { elem_sz = elem_ty.size }
              }
          }
      }
  }
  advance_tok(P)
  let idx: i64 = parse_expr(P)
  match_kind(P, TK_RBRACKET)
  // SLICE WRITE: `base` currently holds the HANDLE (address of {data,len}). Read the length,
  // check the index against it, and only then load the data pointer, so the store address is
  // computed only on the path where the index is known good. Afterwards `base` is the data
  // pointer and the ordinary POINTER path below does the arithmetic.
  if is_slice_w == 1 {
      let wo_v: i64 = safe_const_i64(P, NX_SLICE_LEN_OFFSET, "parse.nx:slice-wr-off" as *u8)
      let wla: i64 = ir_emit_binop(P.current_bb, OP_ADD, base, wo_v, ir_type_i64())
      let wlen: i64 = ir_emit_load(P.current_bb, wla, ir_type_i64())
      emit_bounds_check_v(P, idx, wlen)
      base = ir_emit_load(P.current_bb, base, ir_type_i64())
  }
  // SPATIAL SAFETY (CWE-787): a fixed-array WRITE with a compile-time-constant index is bounds-checked at
  // compile time (zero-cost, no false positives). L is non-null whenever is_arr_w == 1.
  if is_arr_w == 1 {
      if arr_ty_w != (0 as *Type) {
          if elem_sz > 0 {
              let idxv_w: *Value = val_at(P.current_fn, idx)
              let nelem_w: i64 = arr_ty_w.size / elem_sz
              if idxv_w.kind == VK_CONST_INT {
                  if idxv_w.const_int < 0 { parse_die("fixed-array index < 0" as *u8, 21) }
                  if idxv_w.const_int >= nelem_w { parse_die("fixed-array index >= size" as *u8, 25) }
              }
              // RUNTIME index -> inject the check. The WRITE side matters more than the read:
              // an out-of-range store is CWE-787, the corruption primitive behind most memory
              // exploits, and it is exactly what C lets through silently.
              if idxv_w.kind != VK_CONST_INT { emit_bounds_check(P, idx, nelem_w) }
          }
      }
  }
  let esize: i64 = safe_const_i64(P, elem_sz, "parse.nx:subscript-esize" as *u8)
  let off: i64 = ir_emit_binop(P.current_bb, OP_MUL, idx, esize, ir_type_i64())
  // ARRAY: base is the frame ADDRESS -> GEP. POINTER: base is the loaded pointer VALUE -> OP_ADD.
  var cur_addr: i64 = 0
  if is_arr_w == 1 {
      cur_addr = ir_emit_gep(P.current_bb, base, off, elem_ty)
  } else {
      cur_addr = ir_emit_binop(P.current_bb, OP_ADD, base, off, ir_type_i64())
  }
  var cur_ty: *Type = elem_ty
  // Trailing `.field` after the subscript: `obj[idx].field = x`
  // (e.g. out_funcs[filled].addr = value). This handler used to stop
  // after `]`, leaving `.field` to misparse as a bare ident-assign
  // (T#parser-subscript-dot-assign-lhs; sibling of the dot-bracket-dot
  // gap). Walk the element struct's field chain, mirroring the fix in
  // parse_stmt_ident_dot + the read-side parse_field_chain.
  while peek_kind(P) == TK_DOT {
      advance_tok(P)
      let sf_tok: *Tok = advance_tok(P)
      let sf_name: *u8 = tok_text_ptr(sf_tok)
      var sf_len: i64 = 0
      while sf_name[sf_len] != 0 { sf_len = sf_len + 1 }
      var sf_stty: *Type = cur_ty
      if sf_stty != (0 as *Type) {
          if sf_stty.kind == TY_PTR {
              if sf_stty.pointee != (0 as *Type) { sf_stty = sf_stty.pointee }
          }
      }
      if sf_stty == (0 as *Type) { break }
      let sf_field: *StructField = ir_type_struct_find_field(sf_stty, sf_name, sf_len)
      if sf_field == (0 as *StructField) { break }
      let sf_off: i64 = safe_const_i64(P, sf_field.offset, "parse.nx:subscript-dot-offset" as *u8)
      cur_addr = ir_emit_gep(P.current_bb, cur_addr, sf_off, sf_field.ty)
      cur_ty = sf_field.ty
      if peek_kind(P) == TK_DOT {
          if sf_field.ty != (0 as *Type) {
              if sf_field.ty.kind == TY_PTR {
                  cur_addr = ir_emit_load(P.current_bb, cur_addr, sf_field.ty)
              }
          }
      }
  }
  if peek_kind(P) == TK_ASSIGN {
      advance_tok(P)
      let rhs: i64 = parse_expr(P)
      match_kind(P, TK_SEMI)
      ir_emit_store(P.current_bb, cur_addr, rhs, cur_ty)
      return 0
  }
  ir_emit_load(P.current_bb, cur_addr, cur_ty)
  match_kind(P, TK_SEMI)
  return 0
4535}
4536
4537func parse_stmt_ident_dot(P: *Parser) -> i64 {
  let name_tok: *Tok = advance_tok(P)
  let name: *u8 = tok_text_ptr(name_tok)
  let L: *Local = find_local(P, name)
  if L == (0 as *Local) {
      match_kind(P, TK_SEMI)
      return 0
  }
  var v: i64 = L.value_id
  // F-meta-3 fix (Session 12): when the local is alloca-backed AND
  // it's a pointer (e.g. function parameter `out: *Struct`), the
  // alloca holds the pointer value, not the struct.  Without the
  // load, GEP applies field-offset to the alloca slot itself --
  // writes land in random stack memory.  Mirrors the alloca-deref
  // logic already in parse_stmt_ident_subscript (lines 1593-1604)
  // and parse_primary_local_or_const (line 943).  Same shape as
  // F-meta-2 fix (at_stmt_boundary): missing parallel logic between
  // sibling parse handlers.
  if L.is_alloca == 1 {
      if L.ty != (0 as *Type) {
          if L.ty.kind == TY_PTR {
              // Pointer value, type L.ty (8 bytes).
              v = ir_emit_load(P.current_bb, L.value_id, L.ty)
          }
      }
  }
  // Use the local's actual type so the field-access loop emits
  // GEP correctly.  Was 0 as *Type which made stty NULL on the
  // first iteration -> break -> store to raw pointer instead of
  // o + field_offset.  Same root cause as parse_primary_local_or_const
  // (T#bar3-codegen-001).  Closes the WRITE side of the bug.
  var ty: *Type = L.ty
  // Static-ptr FIELD-WRITE fix (2026-07-10; sibling of the READ fix in parse_primary_local_or_const and
  // the LBRACKET multi-static fix): a STATIC's injected Local is typed *(decl_ty), so after the pointer
  // load above `v` is the REAL pointer typed L.ty.pointee. With the un-unwrapped **Struct the field loop's
  // ONE unwrap yields *Struct -> struct lookup FAILS -> break -> the store lands at pointer+0 (ALL fields
  // collapsed to one slot -- nx_static_field_probe witness: a=444 b=c=d=0). VK_GLOBAL-gated (equiv-safe).
  if L.is_alloca == 1 {
      if L.ty != (0 as *Type) {
          if L.ty.kind == TY_PTR {
              let lv_w: *Value = val_at(P.current_fn, L.value_id)
              if lv_w.kind == VK_GLOBAL {
                  if L.ty.pointee != (0 as *Type) { ty = L.ty.pointee }
              }
          }
      }
  }
  let saved_pos: i64 = P.pos
  while peek_kind(P) == TK_DOT {
      advance_tok(P)
      let ftok: *Tok = advance_tok(P)
      let fname: *u8 = tok_text_ptr(ftok)
      var flen: i64 = 0
      while fname[flen] != 0 { flen = flen + 1 }
      var stty: *Type = ty
      if stty != (0 as *Type) {
          if stty.kind == TY_PTR {
              if stty.pointee != (0 as *Type) { stty = stty.pointee }
          }
      }
      if stty == (0 as *Type) { break }
      let field: *StructField = ir_type_struct_find_field(stty, fname, flen)
      if field == (0 as *StructField) { break }
      let off2: i64 = safe_const_i64(P, field.offset, "parse.nx:dot-offset" as *u8)
      v = ir_emit_gep(P.current_bb, v, off2, field.ty)
      ty = field.ty
      // Intermediate pointer-field deref.  For `obj.ptr.subfield = x`,
      // .ptr yields the ADDRESS of the pointer field; the next .subfield
      // must GEP from the pointer's VALUE, not its address.  Mirrors
      // parse_field_chain (line 788-792) which already does this for
      // the read path -- write path was missing it, causing
      // chained-pointer-field stores to write to (obj + ptr_off + sub_off)
      // instead of (*ptr + sub_off).  Bug class symptom: BB linked-list
      // chain only ever held first instr (append_instr emits this exact
      // pattern: `bb.tail.next = inst`).
      if peek_kind(P) == TK_DOT {
          if field.ty != (0 as *Type) {
              if field.ty.kind == TY_PTR {
                  v = ir_emit_load(P.current_bb, v, field.ty)
              }
          }
      }
  }
  // Handle `o.field[idx] = X` (dot-chain followed by bracket
  // index then assign).  Closes T#bar3-codegen-002.  v is the
  // ADDRESS of the field; we load to get the pointer value,
  // then offset by idx*elem_size for the LValue address.
  if peek_kind(P) == TK_LBRACKET {
      let buf_val: i64 = ir_emit_load(P.current_bb, v, ty)
      advance_tok(P)
      let idx: i64 = parse_expr(P)
      match_kind(P, TK_RBRACKET)
      var elem_sz: i64 = 8
      var elem_ty: *Type = ir_type_i64()
      if ty != (0 as *Type) {
          if ty.kind == TY_PTR {
              if ty.pointee != (0 as *Type) {
                  elem_ty = ty.pointee
                  if elem_ty.size > 0 { elem_sz = elem_ty.size }
              }
          }
      }
      let esize: i64 = safe_const_i64(P, elem_sz, "parse.nx:dot-bracket-esize" as *u8)
      let off3: i64 = ir_emit_binop(P.current_bb, OP_MUL, idx, esize, ir_type_i64())
      var cur_addr: i64 = ir_emit_binop(P.current_bb, OP_ADD, buf_val, off3, ir_type_i64())
      var cur_ty: *Type = elem_ty
      // Trailing `.field` after the [idx]: e.g. `obj.field[idx].subfield = x`.
      // The bracket branch used to stop here and leave `.subfield` unconsumed,
      // so it misparsed as a bare ident-assign (T#parser-dot-bracket-dot-assign-lhs;
      // surfaced by nx_eqsat `g.classes[id].canon = id`). Walk the field chain
      // on the element struct -- mirrors the dot-loop above + read-side
      // parse_field_chain so the write and read paths agree.
      while peek_kind(P) == TK_DOT {
          advance_tok(P)
          let bf_tok: *Tok = advance_tok(P)
          let bf_name: *u8 = tok_text_ptr(bf_tok)
          var bf_len: i64 = 0
          while bf_name[bf_len] != 0 { bf_len = bf_len + 1 }
          var bf_stty: *Type = cur_ty
          if bf_stty != (0 as *Type) {
              if bf_stty.kind == TY_PTR {
                  if bf_stty.pointee != (0 as *Type) { bf_stty = bf_stty.pointee }
              }
          }
          if bf_stty == (0 as *Type) { break }
          let bf_field: *StructField = ir_type_struct_find_field(bf_stty, bf_name, bf_len)
          if bf_field == (0 as *StructField) { break }
          let bf_off: i64 = safe_const_i64(P, bf_field.offset, "parse.nx:dot-bracket-dot-offset" as *u8)
          cur_addr = ir_emit_gep(P.current_bb, cur_addr, bf_off, bf_field.ty)
          cur_ty = bf_field.ty
          if peek_kind(P) == TK_DOT {
              if bf_field.ty != (0 as *Type) {
                  if bf_field.ty.kind == TY_PTR {
                      cur_addr = ir_emit_load(P.current_bb, cur_addr, bf_field.ty)
                  }
              }
          }
      }
      if peek_kind(P) == TK_ASSIGN {
          advance_tok(P)
          let rhs: i64 = parse_expr(P)
          match_kind(P, TK_SEMI)
          ir_emit_store(P.current_bb, cur_addr, rhs, cur_ty)
          return 0
      }
      // No assign: load + discard for parser progress.
      ir_emit_load(P.current_bb, cur_addr, cur_ty)
      match_kind(P, TK_SEMI)
      return 0
  }
  if peek_kind(P) == TK_ASSIGN {
      advance_tok(P)
      let rhs: i64 = parse_expr(P)
      match_kind(P, TK_SEMI)
      ir_emit_store(P.current_bb, v, rhs, ir_type_i64())
      return 0
  }
  match_kind(P, TK_SEMI)
  return 0
4696}
4697
4698// Expression-statement fallback with Q1 forward-progress guarantee.
4699func parse_stmt_expr_fallback(P: *Parser) -> i64 {
  let prev_pos: i64 = P.pos
  parse_expr(P)
  match_kind(P, TK_SEMI)
  if P.pos == prev_pos {
      if peek_kind(P) != TK_EOF {
          advance_tok(P)
      }
  }
  return 0
4709}
4710
4711func parse_stmt_list(P: *Parser) -> i64 {
  // Loop invariant guards: after EVERY statement, P.current_bb
  // must still point to a BasicBlock whose .parent is a valid
  // Function.  If a stmt violates this, we catch the violation
  // BEFORE the next stmt runs, narrowing the culprit to a
  // single handler.
  //
  // Forward-progress guard (Q1): if parse_stmt ever returns
  // WITHOUT advancing P.pos, the loop would spin forever.  We
  // assert progress as a belt-and-braces check; parse_stmt
  // itself guarantees this via its expression-statement
  // recovery path (see parse.nx:LINE-expr-stmt-fwd-progress).
  while peek_kind(P) != TK_RBRACE {
      if peek_kind(P) == TK_EOF { return 0 }
      nx_assert_ptr(P.current_bb as *u8,
                    "parse_stmt_list: pre-stmt bb" as *u8)
      nx_assert_ptr(P.current_bb.parent as *u8,
                    "parse_stmt_list: pre-stmt bb.parent" as *u8)
      let pre_pos: i64 = P.pos
      parse_stmt(P)
      nx_assert(P.pos > pre_pos,
                "parse_stmt_list: no forward progress" as *u8)
  }
  return 0
4735}
4736
4737// ---- duplicate-definition guard (debt 1785447657) -------------------
4738//
4739// Compare a token's identifier text against a (ptr,len) name INCLUDING
4740// the NUL terminator, so "foo" can never match a prefix of "foobar".
4741func nx_dupdef_name_eq(t: *Tok, name: *u8, name_len: i64) -> i64 {
  let txt: *u8 = tok_text_ptr(t)
  var k: i64 = 0
  var ok: i64 = 1
  var go: i64 = 1
  while go == 1 {
      if k >= name_len { go = 0 }
      if go == 1 {
          let a: i64 = txt[k] as i64
          let b: i64 = name[k] as i64
          if a != b { ok = 0  go = 0 }
          if go == 1 { k = k + 1 }
      }
  }
  if ok == 1 {
      let tail: i64 = txt[name_len] as i64
      if tail != 0 { ok = 0 }
  }
  return ok
4760}
4761
4762// Line of the FIRST *definition* (body, not forward decl) of `name` in
4763// this translation unit, or 0 if none is found.
4764//
4765// Runs ONLY on the duplicate-definition error path, which exits
4766// immediately -- so a full O(tokens) rescan costs nothing, and we avoid
4767// growing struct Function with a def-line field (its layout is load-
4768// bearing for the self-hosting bootstrap; never-brick says do not
4769// perturb what you do not have to).
4770//
4771// Scanning P.toks is correct w.r.t. conditional compilation: @if/@ifdef
4772// branches are eliminated in the LEXER (nx_tokenizer.nx,
4773// _lex_skip_to_matching_endif advances L.pos WITHOUT emitting tokens),
4774// so an eliminated branch is not in this array to be found.
4775func nx_find_first_def_line(P: *Parser, name: *u8, name_len: i64) -> i64 {
  var i: i64 = 0
  var result: i64 = 0
  var go: i64 = 1
  var hit: i64 = 0
  var j: i64 = 0
  var depth: i64 = 0
  var verdict: i64 = 0
  while go == 1 {
      let t: *Tok = tok_at(P.toks, i)
      let k: i64 = t.kind
      if k == TK_EOF { go = 0 }
      if go == 1 {
          hit = 0
          if k == TK_FUNC {
              let nt: *Tok = tok_at(P.toks, i + 1)
              let nk: i64 = nt.kind
              if nk == TK_IDENT {
                  if nx_dupdef_name_eq(nt, name, name_len) == 1 { hit = 1 }
              }
              if hit == 1 {
                  // Settle declaration-vs-definition exactly the way the
                  // grammar does: after the name, the first '{' or ';'
                  // seen at paren depth 0 decides.
                  j = i + 2
                  depth = 0
                  verdict = 0
                  while verdict == 0 {
                      let s: *Tok = tok_at(P.toks, j)
                      let sk: i64 = s.kind
                      if sk == TK_EOF { verdict = 2 }
                      if sk == TK_LPAREN { depth = depth + 1 }
                      if sk == TK_RPAREN { depth = depth - 1 }
                      if depth == 0 {
                          if sk == TK_LBRACE { verdict = 1 }
                          if sk == TK_SEMI { verdict = 2 }
                      }
                      j = j + 1
                  }
                  if verdict == 1 {
                      let nline: i64 = nt.line
                      result = nline
                      go = 0
                  }
              }
          }
          if go == 1 { i = i + 1 }
      }
  }
  return result
4825}
4826
4827// ---- function declaration ----
4828//
4829// `func NAME ( PARAMS ) -> TYPE { BODY }`
4830
4831func parse_function(P: *Parser) -> i64 {
  match_kind(P, TK_FUNC)
  let name_tok: *Tok = advance_tok(P)
  nx_require_ident_name(P, name_tok)
  // Compute the name's actual byte length.  Earlier the literal 4
  // was passed to ir_function_new for every function; find_function
  // gates on name_len equality, so only 4-char names ever resolved.
  // Compute once + thread through both the forward-decl and full-def
  // paths so the call's stored name_len matches the search key.
  let name_ptr: *u8 = tok_text_ptr(name_tok)
  var name_len: i64 = 0
  while name_ptr[name_len] != 0 { name_len = name_len + 1 }
  sys_write(2, name_ptr, name_len)
  sys_write(2, ":" as *u8, 1)
4845
  // Parameter list: gather name + type pairs into a scratch buffer
  // so we can register them as alloca-backed locals AFTER the
  // Function + entry block exist.  Each param yields an alloca +
  // ir_param + store-from-param, mirroring parse.c.
  // STUB(parser, T#parser-003): params capped at 8.
  //   Plan: heap-allocate sized by an early scan, OR raise to 32
  //   with a hard-error on overflow (better: error so we never
  //   silently truncate a wider signature).
  //   Closes when: any signature with >8 params -- none today.
  let param_names_raw: *u8 = sys_mmap(8 * 8 + 16)
  let param_names: *i64 = param_names_raw as *i64
  let param_tys_raw: *u8 = sys_mmap(8 * 8 + 16)
  let param_tys: *i64 = param_tys_raw as *i64
  var n_params: i64 = 0
  match_kind(P, TK_LPAREN)
  while peek_kind(P) != TK_RPAREN {
      if peek_kind(P) == TK_EOF { return 0 }
      let pn_tok: *Tok = advance_tok(P)
      nx_require_ident_name(P, pn_tok)
      let pn_addr: i64 = pn_tok as i64
      param_names[n_params] = pn_addr
      if match_kind(P, TK_COLON) {
          let pty: *Type = parse_type(P)
          let pty_addr: i64 = pty as i64
          param_tys[n_params] = pty_addr
      } else {
          param_tys[n_params] = 0
      }
      n_params = n_params + 1
      if peek_kind(P) == TK_COMMA { advance_tok(P) }
  }
  match_kind(P, TK_RPAREN)
  // RETURN TYPE: capture it. Until 2026-08-01 this line called parse_type(P) and
  // DISCARDED the result, and both the forward-decl and full-def paths below then
  // hardcoded `ir_type_i64()` -- so EVERY function in the IR claimed to return i64,
  // including the ones returning pointers. That is the SAME defect as the parameter
  // types (parsed, used locally, thrown away) and it is why a call result carried no
  // pointerness: ir_emit_call faithfully copies callee.ret_ty, which was always i64.
  // Consequence measured: argument type checking reported `takes_ptr(mkp(), 16)` as
  // passing an INTEGER when mkp() is declared `-> *u8`, an 88% false-positive rate
  // across the corpus that traced back here.
  var declared_ret: *Type = 0 as *Type
  if match_kind(P, TK_ARROW) {
      declared_ret = parse_type(P)
  }
  if declared_ret == (0 as *Type) { declared_ret = ir_type_i64() }
  // Forward declaration (`func NAME(...) -> T ;` with no body).
  // Register the Function so subsequent call sites resolve by name;
  // no body parsed.  When the full def arrives later it UPGRADES
  // this existing entry rather than creating a duplicate
  // (T#bar3-codegen-003 closed 2026-04-26: previously the duplicate
  // emitted both a stub-only forward-decl symbol AND the full def,
  // and the linker picked the stub -- callers got an immediate
  // ret-zero, breaking nxc.elf-self-compiled binaries).
  if match_kind(P, TK_SEMI) {
      // T#parser-004 (2026-05-20): if prepass_register_funcs OR an
      // earlier forward decl already registered this name, REUSE
      // that entry instead of duplicating.  Idempotent.
      let ret_ty_fwd: *Type = declared_ret
      let fwd_existing: *Function = find_function(P.module, name_ptr, name_len)
      var fwd: *Function = fwd_existing
      if fwd_existing == (0 as *Function) {
          fwd = ir_function_new(P.module, name_ptr, name_len, ret_ty_fwd)
      }
      fwd.n_params = n_params
      return 0
  }
4913
  match_kind(P, TK_LBRACE)
  let ret_ty: *Type = declared_ret      // was hardcoded ir_type_i64() -- see the note above
  // If a forward-decl already registered this name, REUSE that
  // Function entry instead of creating a duplicate.  Closes
  // T#bar3-codegen-003 -- the missing piece of the
  // forward-decl-then-full-def pattern.
  let existing: *Function = find_function(P.module, name_ptr, name_len)
  if existing != (0 as *Function) {
      if existing.n_blocks == 0 {
          // Empty entry => was a forward decl.  Upgrade it.
          P.current_fn = existing
          P.current_fn.ret_ty = ret_ty
          P.current_fn.n_params = n_params
      } else {
          // MEASURED FAIL-OPEN, ROOT-FIXED 2026-07-31 (debt 1785447657,
          // handed to this lane by ws=sota).
          //
          // This branch used to create a SECOND Function entry, on an
          // assumption stated in a comment and never once verified:
          // "backend will see two same-named functions and error".
          // IT DOES NOT.  nx_cc compiled _hdl_build/nx_gate_sweep.nx --
          // which had three functions EACH defined twice after two
          // nx_fs_write calls returned 503 (a lost response; both had
          // applied) -- into a clean, working 86223B binary with zero
          // diagnostics, and let one body silently win.  It was caught
          // only because nx_fs_write's uniqueness contract refused a
          // later edit as AMBIGUOUS: the editor was stricter than the
          // language.
          //
          // A duplicate definition is precisely what a botched merge, a
          // retried write, or two agents on one shared file produce, and
          // this tree has all three live.  The compiler is the last line
          // that can catch a merge artefact, so it fails CLOSED here,
          // where both line numbers are still recoverable.
          //
          // SAFE FOR CONDITIONAL COMPILATION: @if/@ifdef/@ifndef branches
          // are eliminated in the LEXER (nx_tokenizer.nx, skip-to-matching
          // -endif advances past source WITHOUT emitting tokens), so two
          // mutually-exclusive definitions never both reach this point.
          // nx_probe.nx's target-conditional _probe_compiled_isa /
          // _probe_pointer_width_bits pairs still compile unchanged.
          let prev_line: i64 = nx_find_first_def_line(P, name_ptr, name_len)
          sys_write(2, "nx_parse: line " as *u8, 15)
          nx_put_dec_err(name_tok.line)
          sys_write(2, ": duplicate definition of '" as *u8, 27)
          nx_put_tok_text_err(name_tok)
          sys_write(2, "' -- already defined at line " as *u8, 29)
          nx_put_dec_err(prev_line)
          sys_write(2, "\n" as *u8, 1)
          nx_diag_note_error()
          // RECOVERY: parse the duplicate body into a FRESH entry (lookups keep
          // resolving to the first definition; nx_cc provably tolerates the
          // second entry -- that WAS the old fail-open). End gate discards it.
          P.current_fn = ir_function_new(P.module, name_ptr, name_len, ret_ty)
          P.current_fn.n_params = n_params
      }
  } else {
      P.current_fn = ir_function_new(P.module, name_ptr, name_len, ret_ty)
      P.current_fn.n_params = n_params
  }
  // ARGUMENT TYPE CHECKING (2026-08-01): record which parameters are POINTERS.
  // The types were ALREADY parsed into param_tys above and were previously used only to
  // size the allocas and then discarded -- which is precisely why nx_cc could check
  // arity but never types, and why an mmap'd *i64 could land in an `i64` parameter and
  // become a loop bound (the sev-8 ev_num_after silent-zero, debt 1785518763).
  // Bit 63 marks the mask KNOWN so a not-yet-parsed forward stub is skipped, not guessed.
  var ptr_mask: i64 = 0
  var mi: i64 = 0
  while mi < n_params {
      let mty: *Type = param_tys[mi] as *Type
      if mty != (0 as *Type) {
          if mty.kind == TY_PTR { ptr_mask = ptr_mask | (1 << mi) }
      }
      mi = mi + 1
  }
  P.current_fn.param_ptr_mask = ptr_mask | (1 << 63)
4990
  P.current_bb = ir_block_new(P.current_fn)
  nx_assert_ptr(P.current_bb as *u8,
                "parse_function: bb NULL after ir_block_new" as *u8)
  nx_assert_ptr(P.current_bb.parent as *u8,
                "parse_function: bb.parent NULL after ir_block_new" as *u8)
  P.n_locals = 0
4997
  // Register each param as an alloca-backed local.  ir_param builds
  // a VAL_PARAM; we alloca + store-from-param so the body can
  // reassign and mem2reg (later) can promote.
  var pi: i64 = 0
  while pi < n_params {
      var pty: *Type = param_tys[pi] as *Type
      if pty == (0 as *Type) { pty = ir_type_i64() }
      let pv: i64 = ir_param(P.current_fn, pi, pty)
      let addr: i64 = ir_emit_alloca(P.current_bb, pty)
      ir_emit_store(P.current_bb, addr, pv, pty)
      let pn_tok2: *Tok = param_names[pi] as *Tok
      let pname: *u8 = tok_text_ptr(pn_tok2)
      var kind: i64 = TY_I64
      if pty.kind == TY_STRUCT { kind = TY_STRUCT }
      add_local(P, pname, addr, 1, kind, pty)
      pi = pi + 1
  }
5015
  inject_statics(P)    // bind every `static` name into this function's scope
  P.block_base = P.n_locals   // the body block starts after params+statics
  parse_stmt_list(P)
  // Terminate the function's final open block.  A body whose last
  // statement is a loop/if leaves the exit/join block OPEN (no
  // OP_RETURN / OP_BR tail).  Backends emit blocks in creation order,
  // so later-created blocks (loop body, if-arms) land AFTER the open
  // block and it FALLS THROUGH into a sibling block instead of
  // returning.  Caught 2026-06-09: nx_ttt_evaluate's board-full DRAW
  // store fell through into the cell-empty ONGOING store, clobbering
  // the verdict on every draw (x86; same IR feeds RISC-V + WAT).
  // The backend's defensive end-of-function epilogue only covers an
  // open block that happens to be emitted last -- every block must
  // carry its own terminator.
  let fin_bb: *BasicBlock = P.current_bb
  if fin_bb != (0 as *BasicBlock) {
      var fin_terminated: i64 = 0
      let fin_tail: *Instr = fin_bb.tail
      if fin_tail != (0 as *Instr) {
          if fin_tail.op == OP_RETURN    { fin_terminated = 1 }
          if fin_tail.op == OP_BR        { fin_terminated = 1 }
          if fin_tail.op == OP_BR_COND   { fin_terminated = 1 }
          if fin_tail.op == OP_TAIL_CALL { fin_terminated = 1 }
      }
      // ⚠A synthesized fall-off-the-end return MUST carry a real constant. Passing 0 as a
      // "no value" sentinel is indistinguishable from VALUE ID 0, which is the function's
      // FIRST PARAMETER -- so an unterminated block silently returned param0. Measured
      // 2026-08-04: emu_run's exit block emitted `movq -7184(%rbp),%rax` (the %rdi slot),
      // the caller read that pointer as a length and wrote past a 512B buffer. (1785883072)
      if fin_terminated == 0 { ir_emit_return(fin_bb, ir_const_i64(fin_bb.parent, 0)) }
  }
  match_kind(P, TK_RBRACE)
  return 0
5049}
5050
5051// ---- module loop ----
5052
5053// T#parser-004 bits-up fix (2026-05-20): two-pass parser.
5054//
5055// Pass 1 -- prepass_register_funcs: walk every `func NAME(...)`
5056// declaration at module level, pre-register a stub Function entry
5057// in the module's function table.  Subsequent call-sites earlier
5058// in the file resolve to these stubs.
5059//
5060// Pass 2 -- the existing main parse loop.  When parse_function
5061// sees a name that already has an entry (from pass 1), the
5062// existing "upgrade existing entry" path (line ~2438 in this file,
5063// T#bar3-codegen-003 fix from 2026-04-26) populates the body
5064// without creating a duplicate.
5065//
5066// Eliminates the C-style "must define before use" requirement
5067// caught by bench/nx_parse_order_check.sh.  ADDITIVE: no change
5068// to existing parse_function logic; pass 1 just feeds the
5069// upgrade path the right input set up-front.
5070//
5071// Brace-depth walker handles nested braces correctly; depth
5072// counter operates on TOKENS not chars so string-literal braces
5073// (already lexed as TK_STRING) don't confuse it.
5074//
5075// Forward declarations (`func NAME(...) -> T ;`) and full
5076// definitions both feed the same find_function lookup, so a
5077// file that has BOTH a forward decl AND a full def for the same
5078// name still works (pass 1 sees both, both are no-ops since the
5079// stub from the first occurrence already registered the name).
5080// Pre-pass — walk every `struct NAME { ... }` declaration at module
5081// level, pre-register an empty Type so forward references in
5082// later-defined struct fields (`struct Instr { callee: *Function }`
5083// where Function appears later in source order) resolve via
5084// lookup_struct instead of falling through to the TY_VOID placeholder.
5085// Mirrors parse.c's two-pass struct handling that this self-host
5086// parser was missing — caused the bootstrap-divergence on chained
5087// pointer-field READS through Instr.callee in the IR dump primitive.
5088// Pass 2's parse_struct_decl detects the existing entry and mutates
5089// its already-registered Type via ir_type_struct_add_field so the
5090// pointee held in earlier-parsed *FwdName references becomes fully
5091// populated once Function's body is processed.
5092// Resolve a primitive base-type NAME -> a fresh *Type with correct
5093// size/align.  Returns null for anything that is not a known primitive
5094// (caller decides what to do with a non-primitive alias target).
5095// Mirrors the primitive table in parse_type so the two never drift.
5096func resolve_primitive_type(name: *u8) -> *Type {
  if streq_n(name, "i64", 3)  { return alloc_type(TY_I64,  8, 8) }
  if streq_n(name, "u64", 3)  { return alloc_type(TY_I64,  8, 8) }
  if streq_n(name, "i32", 3)  { return alloc_type_s(TY_I32,  4, 4) }   // signed subword -> sign-extend on load
  if streq_n(name, "u32", 3)  { return alloc_type(TY_I32,  4, 4) }     // unsigned -> zero-extend (default)
  if streq_n(name, "i16", 3)  { return alloc_type_s(TY_I16,  2, 2) }   // signed subword -> sign-extend on load
  if streq_n(name, "u16", 3)  { return alloc_type(TY_I16,  2, 2) }     // unsigned -> zero-extend
  if streq_n(name, "i8",  2)  { return alloc_type_s(TY_I8,   1, 1) }   // signed subword -> sign-extend on load
  if streq_n(name, "u8",  2)  { return alloc_type(TY_I8,   1, 1) }     // unsigned -> zero-extend (x509 0xA0 witness)
  if streq_n(name, "bool", 4) { return alloc_type(TY_BOOL, 1, 1) }
  if streq_n(name, "f32", 3)  { return alloc_type(TY_F32,  4, 4) }
  if streq_n(name, "f64", 3)  { return alloc_type(TY_F64,  8, 8) }
  return 0 as *Type
5109}
5110
5111// PASS 0b -- prepass_register_aliases: walk every top-level
5112// `type NAME = BASE` declaration and register NAME in the SAME structs
5113// pool that parse_type's lookup_struct already consults, mapped to the
5114// resolved primitive *Type for BASE.  This is the ADDITIVE fix for the
5115// T#nx-int-alias-size-0 bug: before this, an alias field type (e.g.
5116// `nx_int`) fell through parse_type to the `TY_VOID size 0` placeholder,
5117// so EVERY struct field of an aliased type got size 0 -> all later field
5118// offsets collapsed -> a pointer field landed at offset 0 and was later
5119// overwritten by an int field -> deref of a tiny integer -> segfault.
5120// (Found bits-up: NxMesh.verts read back as the literal 4.)  The C
5121// bootstrap resolved aliases; the self-hosted parser did not -> a
5122// self-host parity gap that silently corrupted the whole print stack.
5123// Data-driven: reads the real `type` decls, no hardcoded alias list.
5124// Chained aliases (type A = B; type B = i64) resolve because we register
5125// in source order and look up already-registered names too.
5126func prepass_register_aliases(P: *Parser) -> i64 {
  let saved_pos: i64 = P.pos
  P.pos = 0
  while peek_kind(P) != TK_EOF {
      // A top-level alias is the IDENT "type" followed by NAME '=' BASE.
      // 'type' is not a reserved keyword (lexed as TK_IDENT), so match
      // on the text, and require the '=' form to avoid colliding with
      // any other identifier that happens to be named "type".
      if peek_kind(P) == TK_IDENT {
          let t0: *Tok = advance_tok(P)
          let w0: *u8 = tok_text_ptr(t0)
          if streq_n(w0, "type", 4) == 1 {
              if peek_kind(P) == TK_IDENT {
                  let nt: *Tok = advance_tok(P)
                  let nm: *u8 = tok_text_ptr(nt)
                  var nlen: i64 = 0
                  while nm[nlen] != 0 { nlen = nlen + 1 }
                  if peek_kind(P) == TK_ASSIGN {
                      advance_tok(P)   // consume '='
                      if peek_kind(P) == TK_IDENT {
                          let bt: *Tok = advance_tok(P)
                          let bn: *u8 = tok_text_ptr(bt)
                          // Resolve BASE: primitive first, else an
                          // already-registered alias/struct (chained).
                          var rty: *Type = resolve_primitive_type(bn)
                          if rty == (0 as *Type) { rty = lookup_struct(P, bn) }
                          // Only register if we resolved to a sized type
                          // AND the alias name is not already taken.
                          if rty != (0 as *Type) {
                              if lookup_struct(P, nm) == (0 as *Type) {
                                  if P.n_structs >= 1024 {
                                      parse_die("too many module type aliases" as *u8, 30)
                                  }
                                  let e: *StructEntry = struct_entry_at(P, P.n_structs)
                                  let dst: *u8 = (e as i64) as *u8
                                  var k: i64 = 0
                                  while k < 64 {
                                      dst[k] = nm[k]
                                      if nm[k] == 0 { k = 64 }
                                      k = k + 1
                                  }
                                  e.name_len = nlen
                                  e.ty = rty
                                  P.n_structs = P.n_structs + 1
                              }
                          }
                      }
                  }
              }
              continue
          }
          continue
      }
      advance_tok(P)
  }
  P.pos = saved_pos
  return 0
5183}
5184
5185func prepass_register_structs(P: *Parser) -> i64 {
  let saved_pos: i64 = P.pos
  P.pos = 0
5188
  while peek_kind(P) != TK_EOF {
      if peek_kind(P) == TK_STRUCT {
          advance_tok(P)   // consume 'struct'
5192
          if peek_kind(P) != TK_IDENT {
              continue
          }
          let name_tok: *Tok = advance_tok(P)
          let name_ptr: *u8 = tok_text_ptr(name_tok)
          var name_len: i64 = 0
          while name_ptr[name_len] != 0 { name_len = name_len + 1 }
5200
          // Skip generic type params `<T, U, ...>` — they're parsed
          // for real in pass 2; here we just need the name.
          if match_kind(P, TK_LT) {
              while peek_kind(P) != TK_GT {
                  if peek_kind(P) == TK_EOF { break }
                  advance_tok(P)
              }
              match_kind(P, TK_GT)
          }
5210
          // Register stub Type if not already present.
          let existing: *Type = lookup_struct(P, name_ptr)
          if existing == (0 as *Type) {
              if P.n_structs >= 1024 {
                  parse_die("too many module structs" as *u8, 23)
              }
              let stub_ty: *Type = ir_type_struct_new(name_ptr, name_len)
              let e: *StructEntry = struct_entry_at(P, P.n_structs)
              let dst_base: i64 = e as i64
              let dst: *u8 = dst_base as *u8
              var k: i64 = 0
              while k < 64 {
                  dst[k] = name_ptr[k]
                  if name_ptr[k] == 0 { k = 64 }
                  k = k + 1
              }
              e.name_len = name_len
              e.ty = stub_ty
              P.n_structs = P.n_structs + 1
          }
5231
          // Skip the body `{ ... }` so we land on the next top-
          // level form.  Brace-balanced walk so nested blocks /
          // generic args don't trip us up.
          var saw_lbrace: i64 = 0
          var keep: i64 = 1
          while keep == 1 {
              let k2: i64 = peek_kind(P)
              if k2 == TK_EOF {
                  keep = 0
              } else {
                  if k2 == TK_LBRACE {
                      saw_lbrace = 1
                      keep = 0
                  } else {
                      advance_tok(P)
                  }
              }
          }
5250
          if saw_lbrace == 1 {
              advance_tok(P)   // consume initial '{'
              var depth: i64 = 1
              while depth > 0 {
                  let k3: i64 = peek_kind(P)
                  if k3 == TK_EOF {
                      depth = 0
                  } else {
                      if k3 == TK_LBRACE { depth = depth + 1 }
                      if k3 == TK_RBRACE { depth = depth - 1 }
                      advance_tok(P)
                  }
              }
          }
      } else {
          advance_tok(P)
      }
  }
5269
  P.pos = saved_pos
  return 0
5272}
5273
5274// Count the DECLARED parameters of the function whose name token was just consumed, by walking its
5275// parameter list to the matching ')'.  Depth-tracked, so a parenthesised type inside the list cannot
5276// end the walk early, and commas are only counted at depth 1.  Consumes those tokens; the caller's
5277// skip loop then continues from '->' / '{' / ';' and is unaffected.  A malformed or absent list
5278// returns 0 and leaves the diagnostic to pass 2, which has the real error machinery.
5279func prepass_count_params(P: *Parser) -> i64 {
  if peek_kind(P) != TK_LPAREN { return 0 }
  advance_tok(P)
  var depth: i64 = 1
  var commas: i64 = 0
  var sawtok: i64 = 0
  var go: i64 = 1
  while go == 1 {
      let k: i64 = peek_kind(P)
      if k == TK_EOF {
          go = 0
      } else {
          if k == TK_LPAREN {
              depth = depth + 1
              sawtok = 1
              advance_tok(P)
          } else {
              if k == TK_RPAREN {
                  depth = depth - 1
                  advance_tok(P)
                  if depth == 0 { go = 0 } else { sawtok = 1 }
              } else {
                  if k == TK_COMMA {
                      if depth == 1 { commas = commas + 1 }
                      sawtok = 1
                      advance_tok(P)
                  } else {
                      sawtok = 1
                      advance_tok(P)
                  }
              }
          }
      }
  }
  if sawtok == 0 { return 0 }
  return commas + 1
5315}
5316
5317func prepass_register_funcs(P: *Parser) -> i64 {
  let saved_pos: i64 = P.pos
  P.pos = 0
5320
  while peek_kind(P) != TK_EOF {
      if peek_kind(P) == TK_FUNC {
          advance_tok(P)   // consume 'func'
5324
          if peek_kind(P) != TK_IDENT {
              // malformed -- let pass 2 emit the real diagnostic
              continue
          }
          let name_tok: *Tok = advance_tok(P)
          let name_ptr: *u8 = tok_text_ptr(name_tok)
          var name_len: i64 = 0
          while name_ptr[name_len] != 0 { name_len = name_len + 1 }
5333
          // Register stub Function entry if not already present.
          // n_params and ret_ty are placeholder values -- the
          // full def in pass 2 upgrades both via the existing
          // T#bar3-codegen-003 path.
          let existing: *Function = find_function(P.module, name_ptr, name_len)
          var fstub: *Function = existing
          if existing == (0 as *Function) {
              let stub_ret: *Type = ir_type_i64()
              fstub = ir_function_new(P.module, name_ptr, name_len, stub_ret)
          }
          // ARITY (2026-07-20): record the DECLARED parameter count on the stub.  Without it the
          // stub reports n_params == 0 until pass 2 reaches the definition, so every FORWARD call
          // is unverifiable and the call-site arity check has to skip it.  Counting here -- the
          // walk is already sitting on '(' -- makes every signature known before ANY body is
          // parsed, which is exactly what lets the check cover forward calls and mutual recursion.
          let np: i64 = prepass_count_params(P)
          if fstub != (0 as *Function) { fstub.n_params = np }
5351
          // RETURN POINTER-NESS (2026-08-01): record on the stub whether this function
          // returns a POINTER, exactly as the arity line above records its parameter
          // count and for the same reason. Without it a stub carries the i64 PLACEHOLDER
          // until pass 2 reaches its body, so a call to a function defined LATER with no
          // forward declaration yields a result typed i64 even when it returns *u8.
          // Measured consequence: argument type checking could only be enabled in the
          // pointer-into-integer direction, because an i64 argument was ambiguous
          // (genuine integer OR placeholder). With this, the placeholder disappears and
          // the integer-into-pointer direction becomes decidable too.
          // Token-level on purpose: we only need "does the return type begin with '*'",
          // and calling parse_type here would register struct types during a prepass
          // whose only job is to record signatures.
          if peek_kind(P) == TK_ARROW {
              advance_tok(P)
              if peek_kind(P) == TK_STAR {
                  if fstub != (0 as *Function) {
                      fstub.ret_ty = alloc_type(TY_PTR, 8, 8)
                  }
              }
          }
5372
          // Skip the rest of this declaration (signature + body
          // OR semicolon for forward decl) so we land on the next
          // top-level form.  Brace-balanced walk handles nested
          // blocks; semicolon-terminated forward decls exit early.
          var saw_lbrace: i64 = 0
          var keep: i64 = 1
          while keep == 1 {
              let k: i64 = peek_kind(P)
              if k == TK_EOF {
                  keep = 0
              } else {
                  if k == TK_SEMI {
                      advance_tok(P)
                      keep = 0
                  } else {
                      if k == TK_LBRACE {
                          saw_lbrace = 1
                          keep = 0
                      } else {
                          advance_tok(P)
                      }
                  }
              }
          }
5397
          if saw_lbrace == 1 {
              advance_tok(P)   // consume initial '{'
              var depth: i64 = 1
              while depth > 0 {
                  let k2: i64 = peek_kind(P)
                  if k2 == TK_EOF {
                      depth = 0   // bail; pass 2 will error properly
                  } else {
                      if k2 == TK_LBRACE { depth = depth + 1 }
                      if k2 == TK_RBRACE { depth = depth - 1 }
                      advance_tok(P)
                  }
              }
          }
      } else {
          advance_tok(P)
      }
  }
5416
  P.pos = saved_pos
  return 0
5419}
5420
5421// Caller hands us a Module (so the driver can wire lex -> parse ->
5422// opt -> ... with shared state).  If null, we allocate a fresh one
5423// ourselves -- convenient for stand-alone parser tests.
5424func parse_module(toks: *Tok, m: *Module) -> *Module {
  let p_raw: *u8 = sys_mmap(512)   // +block_base; headroom so a future field cannot silently overrun
  let P: *Parser = p_raw as *Parser
  P.toks = toks
  P.pos = 0
  if m == (0 as *Module) {
      let m_raw: *u8 = sys_mmap(256)
      let new_m: *Module = m_raw as *Module
      new_m.name = "anon" as *u8
      // Allocate a Function pool so ir_function_new can append.
      // Stride is 176 bytes.  4096 slots = ~720 KB.
      //
      // ROOT CAUSE for T#selfhost-006 globals corruption (closed
      // 2026-04-26): pool was sized at 256 slots.  nxc.nx has
      // 419 functions, so function entries 257..419 overflowed
      // past the pool boundary into the adjacent globals pool
      // (kernel returns adjacent virtual pages from consecutive
      // anonymous mmap calls), corrupting written globals --
      // which explained why the dump read zeros from addresses
      // where ir_add_global_string had written real data.
      // ir.nx::ir_module_new already had this bumped to 4096
      // (T#selfhost-004 fix); the parse_module code path was
      // missed.  Both paths now agree.
      let fn_pool: *u8 = sys_mmap(4096 * 176 + 64)
      new_m.functions   = fn_pool as *Function
      new_m.n_functions = 0
      // Globals pool: must be initialised here too.  Without this,
      // ir_add_global_string would write into a zeroed pointer +
      // SIGSEGV on the first string literal (task #21 stage-2 root
      // cause -- found 2026-04-24).  4096 slots × 80 bytes/slot.
      let glob_pool: *u8 = sys_mmap(4096 * 80 + 64)
      new_m.globals     = glob_pool as *Global
      new_m.n_globals   = 0
      new_m.globals_cap = 4096
      P.module = new_m
  } else {
      P.module = m
  }
  P.current_fn = 0 as *Function
  P.current_bb = 0 as *BasicBlock
  let locals_raw: *u8 = sys_mmap(NX_PARSE_LOCALS_CAP * LOCAL_BYTES + 64)
  P.locals = locals_raw as *Local
  P.n_locals = 0
  P.loop_head = 0 as *BasicBlock
  P.loop_exit = 0 as *BasicBlock
  // Capacity bumped 128 -> 2048 (2026-05-19) -> 8192 (2026-05-20)
  // because the substrate is OFF C bootstrap -- this is the
  // daily-driver parser and the cap belongs to NishiLang.  Live
  // HTTPS get import graph trace 2026-05-20 = 740 consts across
  // 100 modules, but the parser counts every const at parse time
  // including indirect ones; 2048 was overflowed by the full
  // nx_https_get_live_real_ca + cert chain + Google-target test
  // graph.  8192 gives 4x headroom for adding AES-GCM, HTTP/2,
  // and image-decoder primitives without re-bumping every session.
  // Per Cardinal 21 (resource awareness): each MConst is ~72 bytes,
  // so 8192 * 72 = ~590 KB of Parser-struct growth -- still
  // harmless for a compiler running once at build time.
  let mconsts_raw: *u8 = sys_mmap(8192 * MCONST_BYTES + 64)
  P.mconsts = mconsts_raw as *MConst
  P.n_mconsts = 0
  // Module-level table caps bumped 2026-05-19 alongside the mconsts
  // bump so the self-host doesn't silently corrupt the heap at the
  // same scale where mconsts was first to hit.  Bits-up substrate's
  // growing import graph now declares hundreds of structs (TLS
  // session + X.509 + URL + DNS + crypto + ...).  Per Cardinal 12.
  let structs_raw: *u8 = sys_mmap(1024 * STRUCT_ENTRY_BYTES + 64)
  P.structs = structs_raw as *StructEntry
  P.n_structs = 0
  let statics_raw: *u8 = sys_mmap(512 * STATIC_ENTRY_BYTES + 64)
  P.statics = statics_raw as *StaticEntry
  P.n_statics = 0
  let enums_raw: *u8 = sys_mmap(256 * ENUM_ENTRY_BYTES + 64)
  P.enums = enums_raw as *EnumEntry
  P.n_enums = 0
  // 8 active-type-param slots; a slot is one i64 holding a *u8
  // pointer to the NUL-terminated param name.
  let ap_raw: *u8 = sys_mmap(8 * 8 + 16)
  P.active_params = ap_raw as *i64
  P.n_active_params = 0
  // PASS 0: pre-register every top-level struct name so
  // forward-referenced field types (`callee: *Function` in Instr
  // where Function appears later in source order) resolve via
  // lookup_struct.  Mirrors parse.c.
  prepass_register_structs(P)
  // PASS 0b: register `type NAME = BASE` aliases (into the structs
  // pool, so parse_type's lookup resolves them).  AFTER structs so an
  // alias to a struct type resolves; T#nx-int-alias-size-0 fix.
  prepass_register_aliases(P)
  // PASS 1: pre-register every top-level func name so call sites
  // earlier in the file resolve.  T#parser-004 bits-up fix.
  // ADDITIVE: pass 2 below is the original parse loop; only
  // change is that the symbol table is pre-populated.
  prepass_register_funcs(P)
5517
  // PASS 2: original parse loop.  parse_function upgrades the
  // pass-1 stubs via the existing find_function lookup at
  // line ~2540 (T#bar3-codegen-003 upgrade path).
  //
  // Progress marker: one dot per top-level item.  Suppressed if
  // first char written this run is newline (i.e. lex just wrote
  // its own status line).  Helps isolate parse_function stalls.
  var n_items: i64 = 0
  while peek_kind(P) != TK_EOF {
      if peek_kind(P) == TK_FUNC {
          parse_function(P)
          n_items = n_items + 1
          // Fine-grained: 1 dot per function.  Noisy for small
          // sources, essential for localising parse stalls on
          // large self-host source.
          sys_write(2, "." as *u8, 1)
          continue
      }
      if peek_kind(P) == TK_CONST {
          parse_module_const(P)
          continue
      }
      if peek_kind(P) == TK_STRUCT {
          parse_struct_decl(P)
          continue
      }
      if peek_kind(P) == TK_STATIC {
          parse_static_decl(P)
          continue
      }
      // `@priv` VISIBILITY ATTRIBUTE (debt seq1460/seq1471): consumed EXPLICITLY so the
      // marker is acknowledged syntax rather than something the generic advance_tok at the
      // bottom of this loop happens to discard. The following TK_FUNC parses normally, so
      // this is additive and back-compatible -- default visibility stays PUBLIC and no
      // existing source changes meaning. Cross-file ENFORCEMENT (calling a @priv symbol
      // from another file must be a compile error) is the follow-on in seq1471; that is
      // what turns adoption from INFERRED into EXACT.
      if peek_kind(P) == TK_PRIV {
          advance_tok(P)
          continue
      }
      if peek_kind(P) == TK_ENUM {
          parse_module_enum(P)
          continue
      }
      // A token matching no top-level form used to be DISCARDED SILENTLY, one at a time.
      // That is how a stray `return` -- left outside its function by ONE BRACE TOO MANY in a
      // deep else-chain -- vanished with no diagnostic, truncating the function body and
      // costing a day of misattribution to the compiler (2026-08-04, debt 1785883072).
      // Statement keywords can NEVER be valid at module level, so they are REFUSED with a
      // line number. Everything else still skips, but SAYS SO: silence is never the default.
      let stray: *Tok = tok_at(P.toks, P.pos)
      var stray_stmt: i64 = 0
      if stray.kind == TK_RETURN { stray_stmt = 1 }
      if stray.kind == TK_LET    { stray_stmt = 1 }
      if stray.kind == TK_VAR    { stray_stmt = 1 }
      if stray.kind == TK_IF     { stray_stmt = 1 }
      if stray.kind == TK_WHILE  { stray_stmt = 1 }
      if stray_stmt == 1 {
          nx_puts_err("\nnx_cc: STATEMENT AT MODULE LEVEL, line " as *u8)
          nx_puti_err(stray.line)
          nx_puts_err(" -- outside any function. Most often ONE BRACE TOO MANY closed a function early.\n" as *u8)
          nx_assert(0, "stray statement at module level" as *u8)
      }
      // NOTE: non-statement leftovers (TK_IDENT/TK_ASSIGN) are still skipped SILENTLY here.
      // MEASURED 2026-08-04: 132 such tokens are dropped while compiling a 60-line probe, so a
      // warning on them would fire hundreds of times per build and be trained away -- a
      // diagnostic nobody reads is worse than none. Ledgered as its own finding (1785883072).
      advance_tok(P)
  }
  // MULTI-ERROR END GATE (2026-08-05): every recovered diagnostic above kept
  // parsing so the author sees ALL errors in ONE build, but the module they
  // produced holds placeholder values and is POISONED. Refuse to hand it to
  // codegen: no output is ever emitted from a build that reported an error.
  if nx_diag_nerr > 0 {
      sys_write(2, "nx_parse: " as *u8, 10)
      nx_put_dec_err(nx_diag_nerr)
      sys_write(2, " error(s) -- no output emitted\n" as *u8, 31)
      sys_exit(2)
  }
  return P.module
5599}
5600
5601// `enum Name { V1, V2(T), V3 }` -- register each variant as a
5602// qualified module const, and when any variant has a payload
5603// auto-generate a shadow struct `Name { tag: i64, payload: i64 }`
5604// so constructors can alloca + store tag/payload and match can
5605// extract them via GEP.  Plain enums (no payload anywhere) skip
5606// the shadow and stay int-discriminant representations.
5607func parse_module_enum(P: *Parser) -> i64 {
  match_kind(P, TK_ENUM)
  let ename_tok: *Tok = advance_tok(P)
  let ename: *u8 = tok_text_ptr(ename_tok)
  // Measure the enum name so we can build qualified "Name::V"
  // labels per variant.  Capped at 32 chars so the concatenation
  // fits the 64-byte MConst name slot.
  var en_len: i64 = 0
  while ename[en_len] != 0 { en_len = en_len + 1 }
  if en_len > 32 { en_len = 32 }
5617
  // Optional generic type parameters: `enum Name<T, E, ...>`.
  // Collect names + publish as active while parsing variants
  // (payload types may reference T / E).  Stored on the shadow
  // struct after it's created so instantiate_generic_n can
  // substitute them on use.
  let e_tparam_raw: *u8 = sys_mmap(8 * 8 + 16)
  let e_tparams: *i64 = e_tparam_raw as *i64
  var e_n_tparams: i64 = 0
  if match_kind(P, TK_LT) {
      let etp0: *Tok = advance_tok(P)
      e_tparams[e_n_tparams] = tok_text_ptr(etp0) as i64
      e_n_tparams = e_n_tparams + 1
      while match_kind(P, TK_COMMA) {
          let etpn: *Tok = advance_tok(P)
          e_tparams[e_n_tparams] = tok_text_ptr(etpn) as i64
          e_n_tparams = e_n_tparams + 1
      }
      match_kind(P, TK_GT)
  }
  let e_saved_active: i64 = P.n_active_params
  var e_ai: i64 = 0
  while e_ai < e_n_tparams {
      P.active_params[e_saved_active + e_ai] = e_tparams[e_ai]
      e_ai = e_ai + 1
  }
  P.n_active_params = e_saved_active + e_n_tparams
5644
  match_kind(P, TK_LBRACE)
5646
  // Pre-scan variants looking for any payload.  We save P.pos,
  // walk the variant list counting payloads, then restore and
  // parse the body for real with knowledge of whether to build
  // a shadow struct.
  let saved_pos: i64 = P.pos
  var any_payload: i64 = 0
  while peek_kind(P) != TK_RBRACE {
      if peek_kind(P) == TK_EOF { return 0 }
      advance_tok(P)                              // variant name
      if match_kind(P, TK_LPAREN) {
          any_payload = 1
          parse_type(P)
          match_kind(P, TK_RPAREN)
      }
      if match_kind(P, TK_ASSIGN) {
          if match_kind(P, TK_MINUS) {}
          advance_tok(P)                          // int literal
      }
      match_kind(P, TK_COMMA)
  }
  P.pos = saved_pos   // rewind
5668
  // Build shadow struct once up front so all constructors and match
  // arms share the same Type pointer.  Fields are both i64 for the
  // first pass -- payload is i64 regardless of the declared type,
  // which keeps lowering trivial even when variants differ.
  var shadow: *Type = 0 as *Type
  if any_payload == 1 {
      shadow = ir_type_struct_new(ename, en_len)
      let tag_name: *u8 = "tag"
      ir_type_struct_add_field(shadow, tag_name, 3, ir_type_i64())
      let pay_name: *u8 = "payload"
      ir_type_struct_add_field(shadow, pay_name, 7, ir_type_i64())
      // Preserve generic param list so instantiate_generic_n can
      // substitute against concrete args at use sites.
      if e_n_tparams > 0 {
          shadow.n_type_params = e_n_tparams
          shadow.type_params = e_tparams
      }
      // Register the shadow in the struct table so `*Name` parses
      // as a pointer to it.
      if P.n_structs >= 1024 {
          parse_die("too many module structs (enum shadow)" as *u8, 38)
      }
      let se: *StructEntry = struct_entry_at(P, P.n_structs)
      let sd_base: i64 = se as i64
      let sd: *u8 = sd_base as *u8
      var sk: i64 = 0
      while sk < 64 {
          sd[sk] = ename[sk]
          if ename[sk] == 0 { sk = 64 }
          sk = sk + 1
      }
      se.name_len = en_len
      se.ty = shadow
      P.n_structs = P.n_structs + 1
  }
5704
  // Register the enum itself (even plain enums) in the enums table
  // so parse_primary Name::Variant + matc
nx_parse.nx source

`nx_parse.nx` source
