wots_rhdl/

benchmark.rs

//! On-chip U280 benchmark control for the SHA-256 WOTS signer.
//!
//! This module keeps the benchmark workload, one-time seed allocation, signer
//! handshakes, frame validation, counters, checksum, and AXI4-Lite control in
//! Rust/RHDL.  The generated Vitis-facing Verilog wrapper is wiring only: it
//! maps named ports to the packed [`AxiLiteBenchmarkInput`] and
//! [`AxiLiteBenchmarkOutput`] fields using RHDL `Digital` metadata.
//!
//! # One-time-key boundary
//!
//! A launch snapshots a 192-bit test nonce and a 64-bit base index.  Job `j`
//! receives the private seed `nonce || big_endian(base + j)`.  A nonzero batch
//! is accepted only when `base + batch` fits in 64 bits, so the half-open range
//! `[base, base + batch)` is injective and a representable next index remains.
//! The continuously loaded kernel advances its configured base atomically when
//! the launch is accepted.  That is not durable allocation: software must
//! reserve and persist the nonce/range before every launch, including warmups
//! and retries, and must restore a never-before-used range after reset or
//! reprogramming.
//!
//! This is an on-chip compute benchmark.  It does not include `PCIe`, HBM, DDR,
//! or result-DMA traffic, and its 512-bit XOR fold is an observability checksum,
//! not a cryptographic authenticator.

use rhdl::{core::circuit::descriptor::SyncKind, prelude::*};
use rhdl_fpga::core::dff::DFF;
use sha256_rhdl::lane::{ExternalFullCompressionLane, InlineCompressionLane};

use crate::{
    CompressionLaneComponent, HashBytes, LANE_LOCAL_CONTEXTS, MessageBytes, SIGNER_CLUSTER_COUNT,
    SIGNER_FRAME_BEATS, SignerOutputBeat, SignerTop, SignerTopInput,
    global_beat_is_canonical_kernel,
};

/// Number of 32-bit words in the test-only 192-bit nonce prefix.
pub const BENCHMARK_NONCE_WORDS: usize = 6;
/// Number of 32-bit words in the observable 512-bit checksum.
pub const BENCHMARK_CHECKSUM_WORDS: usize = 16;
/// Exact number of live signer contexts represented by the ownership scoreboard.
pub const BENCHMARK_LIVE_JOB_SLOTS: usize = SIGNER_CLUSTER_COUNT * LANE_LOCAL_CONTEXTS;
/// AXI4-Lite address width used by the named Vitis wrapper.
pub const BENCHMARK_AXI_ADDR_BITS: usize = 12;
/// AXI4-Lite register aperture in bytes.
pub const BENCHMARK_AXI_RANGE_BYTES: u16 = 4096;
/// Stable register-map version: major 1, minor 0.
pub const BENCHMARK_ABI_VERSION: u32 = 0x0001_0000;

/// Canonical separately generated production signer module used by Phase A.
///
/// The modular benchmark exposes this name as an unresolved HDL child. The
/// Phase-A generator must supply the exact RHDL-generated signer skeleton under
/// the same name before the benchmark bundle is complete.
pub const BENCHMARK_SIGNER_TOP_MODULE: &str = "wots_sha256_signer_top";

/// Exact synchronous signer interface accepted by the benchmark engine.
///
/// Implementations are copyable type-level adapters. Their simulation state is
/// carried by [`Synchronous::S`], while the adapter value selects whether HDL
/// lowering expands the signer inline or leaves the separately generated
/// production signer unresolved.
pub trait BenchmarkSignerComponent:
    Synchronous<I = SignerTopInput, O = crate::SignerTopOutput>
    + Clone
    + Copy
    + Default
    + PartialEq
    + core::fmt::Debug
{
}

impl<T> BenchmarkSignerComponent for T where
    T: Synchronous<I = SignerTopInput, O = crate::SignerTopOutput>
        + Clone
        + Copy
        + Default
        + PartialEq
        + core::fmt::Debug
{
}

/// Copyable adapter that expands an ordinary [`SignerTop`] into its parent.
///
/// This preserves the historical const-generic benchmark API while keeping
/// the injected component copyable for the pinned RHDL derive macros.
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub struct InlineBenchmarkSigner<
    const ROUNDS: usize,
    const ADDRESS_BITS: usize,
    L = InlineCompressionLane<ROUNDS, ADDRESS_BITS>,
>(core::marker::PhantomData<L>)
where
    rhdl::bits::W<ROUNDS>: BitWidth,
    rhdl::bits::W<ADDRESS_BITS>: BitWidth,
    L: CompressionLaneComponent + Default;

impl<const ROUNDS: usize, const ADDRESS_BITS: usize, L> Default
    for InlineBenchmarkSigner<ROUNDS, ADDRESS_BITS, L>
where
    rhdl::bits::W<ROUNDS>: BitWidth,
    rhdl::bits::W<ADDRESS_BITS>: BitWidth,
    L: CompressionLaneComponent + Default,
{
    fn default() -> Self {
        Self(core::marker::PhantomData)
    }
}

impl<const ROUNDS: usize, const ADDRESS_BITS: usize, L> SynchronousDQ
    for InlineBenchmarkSigner<ROUNDS, ADDRESS_BITS, L>
where
    rhdl::bits::W<ROUNDS>: BitWidth,
    rhdl::bits::W<ADDRESS_BITS>: BitWidth,
    L: CompressionLaneComponent + Default,
{
    type D = <SignerTop<ROUNDS, ADDRESS_BITS, L> as SynchronousDQ>::D;
    type Q = <SignerTop<ROUNDS, ADDRESS_BITS, L> as SynchronousDQ>::Q;
}

impl<const ROUNDS: usize, const ADDRESS_BITS: usize, L> SynchronousIO
    for InlineBenchmarkSigner<ROUNDS, ADDRESS_BITS, L>
where
    rhdl::bits::W<ROUNDS>: BitWidth,
    rhdl::bits::W<ADDRESS_BITS>: BitWidth,
    L: CompressionLaneComponent + Default,
{
    type I = SignerTopInput;
    type O = crate::SignerTopOutput;
    type Kernel = <SignerTop<ROUNDS, ADDRESS_BITS, L> as SynchronousIO>::Kernel;
}

impl<const ROUNDS: usize, const ADDRESS_BITS: usize, L> Synchronous
    for InlineBenchmarkSigner<ROUNDS, ADDRESS_BITS, L>
where
    rhdl::bits::W<ROUNDS>: BitWidth,
    rhdl::bits::W<ADDRESS_BITS>: BitWidth,
    L: CompressionLaneComponent + Default,
{
    type S = <SignerTop<ROUNDS, ADDRESS_BITS, L> as Synchronous>::S;

    fn init(&self) -> Self::S {
        SignerTop::<ROUNDS, ADDRESS_BITS, L>::default().init()
    }

    fn sim(&self, clock_reset: ClockReset, input: Self::I, state: &mut Self::S) -> Self::O {
        SignerTop::<ROUNDS, ADDRESS_BITS, L>::default().sim(clock_reset, input, state)
    }

    fn descriptor(&self, scoped_name: ScopedName) -> Result<Descriptor<SyncKind>, RHDLError> {
        SignerTop::<ROUNDS, ADDRESS_BITS, L>::default().descriptor(scoped_name)
    }
}

/// Behavioral production signer with an unresolved external HDL definition.
///
/// Simulation delegates to the exact 64-round modular signer, including its
/// full state and external-lane behavioral model. HDL lowering emits only a
/// typed reference to [`BENCHMARK_SIGNER_TOP_MODULE`]; the Phase-A generator
/// separately lowers and checksum-binds that production signer skeleton.
#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
pub struct ExternalModularSha256SignerTop;

impl SynchronousDQ for ExternalModularSha256SignerTop {
    type D = ();
    type Q = ();
}

impl SynchronousIO for ExternalModularSha256SignerTop {
    type I = SignerTopInput;
    type O = crate::SignerTopOutput;
    type Kernel = NoSynchronousKernel<ClockReset, SignerTopInput, (), (crate::SignerTopOutput, ())>;
}

impl Synchronous for ExternalModularSha256SignerTop {
    type S = <SignerTop<64, 6, ExternalFullCompressionLane> as Synchronous>::S;

    fn init(&self) -> Self::S {
        SignerTop::<64, 6, ExternalFullCompressionLane>::default().init()
    }

    fn sim(&self, clock_reset: ClockReset, input: Self::I, state: &mut Self::S) -> Self::O {
        SignerTop::<64, 6, ExternalFullCompressionLane>::default().sim(clock_reset, input, state)
    }

    fn descriptor(&self, scoped_name: ScopedName) -> Result<Descriptor<SyncKind>, RHDLError> {
        Descriptor::<SyncKind> {
            name: scoped_name,
            input_kind: SignerTopInput::static_kind(),
            output_kind: crate::SignerTopOutput::static_kind(),
            d_kind: Kind::Empty,
            q_kind: Kind::Empty,
            kernel: None,
            netlist: None,
            hdl: Some(HDLDescriptor {
                name: BENCHMARK_SIGNER_TOP_MODULE.into(),
                modules: vlog::ModuleList { modules: vec![] },
            }),
            _phantom: core::marker::PhantomData,
        }
        .with_external_netlist_black_box()
    }
}

/// AXI4-Lite `OKAY` response.
pub const AXI_RESP_OKAY: u8 = 0;
/// AXI4-Lite `SLVERR` response.
pub const AXI_RESP_SLVERR: u8 = 2;

/// No launch rejection.
pub const BENCHMARK_REJECT_NONE: u8 = 0;
/// A zero-length batch was rejected.
pub const BENCHMARK_REJECT_ZERO_BATCH: u8 = 1;
/// `base + batch` required a 65th bit and was rejected.
pub const BENCHMARK_REJECT_INDEX_OVERFLOW: u8 = 2;

/// No structural fault.
pub const BENCHMARK_FAULT_NONE: u8 = 0;
/// The wrapped signer reported a sticky structural fault.
pub const BENCHMARK_FAULT_SIGNER: u8 = 0x10;
/// A signer admission pulse violated the benchmark ownership contract.
pub const BENCHMARK_FAULT_ADMISSION: u8 = 0x11;
/// A transferred output beat violated canonical control or frame identity.
pub const BENCHMARK_FAULT_FRAME: u8 = 0x12;
/// A transferred error completion had invalid identity or handshake metadata.
pub const BENCHMARK_FAULT_ERROR: u8 = 0x13;
/// A completion counter exceeded the accepted batch contract.
pub const BENCHMARK_FAULT_COUNTER: u8 = 0x14;

/// Standard Vitis control register.
pub const REG_AP_CTRL: u16 = 0x000;
/// Global interrupt enable.
pub const REG_GIE: u16 = 0x004;
/// Per-event interrupt enable (`done`, `fault`).
pub const REG_IER: u16 = 0x008;
/// Toggle-on-write interrupt status (`done`, `fault`).
pub const REG_ISR: u16 = 0x00c;
/// Requested batch size.
pub const REG_BATCH: u16 = 0x010;
/// Read-only ABI version.
pub const REG_ABI_VERSION: u16 = 0x014;
/// First nonce-prefix word; words are consecutive through `0x02c`.
pub const REG_NONCE_0: u16 = 0x018;
/// Current base/next-index low word.
pub const REG_BASE_LO: u16 = 0x030;
/// Current base/next-index high word.
pub const REG_BASE_HI: u16 = 0x034;
/// Base index latched by the most recently accepted launch, low word.
pub const REG_RUN_BASE_LO: u16 = 0x038;
/// Base index latched by the most recently accepted launch, high word.
pub const REG_RUN_BASE_HI: u16 = 0x03c;
/// Packed busy/fault/rejection status.
pub const REG_STATUS: u16 = 0x040;
/// Low byte is structural fault code; next byte is last rejection code.
pub const REG_CODES: u16 = 0x044;
/// Accepted-job counter, low word; high word follows.
pub const REG_ACCEPTED_LO: u16 = 0x048;
/// Successful-frame completion counter, low word; high word follows.
pub const REG_COMPLETED_LO: u16 = 0x050;
/// Transferred-beat counter, low word; high word follows.
pub const REG_BEATS_LO: u16 = 0x058;
/// Identified error-completion counter, low word; high word follows.
pub const REG_ERRORS_LO: u16 = 0x060;
/// Active run cycles, low word; high word follows.
pub const REG_ELAPSED_LO: u16 = 0x068;
/// Zero-based cycle of the first successful final beat, low word.
pub const REG_FIRST_COMPLETION_LO: u16 = 0x070;
/// Zero-based cycle of the last successful final beat, low word.
pub const REG_LAST_COMPLETION_LO: u16 = 0x078;
/// Last-minus-first successful completion span, low word.
pub const REG_COMPLETION_SPAN_LO: u16 = 0x080;
/// Inclusive first-to-last transferred-payload span, low word.
pub const REG_PAYLOAD_CYCLES_LO: u16 = 0x088;
/// First checksum word; sixteen consecutive words end at `0x0cc`.
pub const REG_CHECKSUM_0: u16 = 0x090;

const _: () = {
    assert!(SIGNER_FRAME_BEATS == 35);
    assert!(BENCHMARK_NONCE_WORDS * 32 == 192);
    assert!(BENCHMARK_CHECKSUM_WORDS * 32 == 512);
    assert!(SIGNER_CLUSTER_COUNT == 3);
    assert!(LANE_LOCAL_CONTEXTS == 4);
    assert!(BENCHMARK_LIVE_JOB_SLOTS == 12);
    assert!(BENCHMARK_AXI_RANGE_BYTES == 1 << BENCHMARK_AXI_ADDR_BITS);
    assert!(REG_CHECKSUM_0 + 64 <= BENCHMARK_AXI_RANGE_BYTES);
};

/// Configuration offered to the on-chip benchmark engine.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct BenchmarkEngineInput {
    /// Hold high until either `launch_accepted` or `launch_rejected` pulses.
    pub launch_valid: bool,
    /// Number of one-time signatures requested; zero is rejected.
    pub batch: b32,
    /// Six little-endian register words forming 24 seed bytes in word order.
    pub nonce_prefix: [b32; BENCHMARK_NONCE_WORDS],
    /// First one-time index in the requested half-open range.
    pub base_index: b64,
}

/// Complete benchmark status retained for AXI4-Lite reads.
#[allow(clippy::struct_excessive_bools)] // Independent protocol and audit indications.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct BenchmarkEngineOutput {
    /// The engine can inspect a launch offer.
    pub launch_ready: bool,
    /// A valid launch reserved its complete one-time range this cycle.
    pub launch_accepted: bool,
    /// An invalid launch was rejected without consuming its range this cycle.
    pub launch_rejected: bool,
    /// Reason for `launch_rejected`.
    pub reject_code: b8,
    /// One benchmark batch is active.
    pub busy: bool,
    /// A valid batch completed, a launch was rejected, or a fault terminated work.
    pub done: bool,
    /// Sticky structural fault; shared reset is required.
    pub fault: bool,
    /// First retained structural fault code.
    pub fault_code: b8,
    /// Base latched by the latest accepted launch.
    pub run_base_index: b64,
    /// First unused index after the accepted batch.
    pub next_base_index: b64,
    /// Number of jobs admitted by the signer.
    pub accepted: b64,
    /// Number of canonical successful frames completed.
    pub completed: b64,
    /// Number of signer output beats transferred into the checker.
    pub beats: b64,
    /// Number of identified signer error completions accepted.
    pub errors: b64,
    /// Run cycles including fill, payload, and drain.
    pub elapsed_cycles: b64,
    /// Zero-based active cycle containing the first successful final beat.
    pub first_completion_cycle: b64,
    /// Zero-based active cycle containing the latest successful final beat.
    pub last_completion_cycle: b64,
    /// `last_completion_cycle - first_completion_cycle`, or zero for fewer than two.
    pub completion_span_cycles: b64,
    /// Inclusive span from the first through latest transferred data beat.
    pub payload_cycles: b64,
    /// Wide deterministic fold over every transferred payload and frame identity.
    pub checksum: [b32; BENCHMARK_CHECKSUM_WORDS],
}

/// Launch-range validation input.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct BenchmarkLaunchValidationInput {
    /// Requested batch.
    pub batch: b32,
    /// Requested first index.
    pub base_index: b64,
}

/// Launch-range validation result.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct BenchmarkLaunchValidationOutput {
    /// The nonempty half-open range is representable.
    pub valid: bool,
    /// First unused index, meaningful only when `valid`.
    pub next_base_index: b64,
    /// Rejection reason, zero only when `valid`.
    pub reject_code: b8,
}

/// Reject zero batches and any reservation whose exclusive end needs 65 bits.
#[kernel]
pub fn benchmark_launch_validation_kernel(
    input: BenchmarkLaunchValidationInput,
) -> BenchmarkLaunchValidationOutput {
    let wide_base: b65 = input.base_index.resize();
    let wide_batch: b65 = input.batch.resize();
    let wide_next = wide_base + wide_batch;
    let overflow = (wide_next >> 64) != b65(0);
    let zero = input.batch == b32(0);
    let valid = !zero && !overflow;
    BenchmarkLaunchValidationOutput {
        valid,
        next_base_index: wide_next.resize(),
        reject_code: if zero {
            b8(1)
        } else if overflow {
            b8(2)
        } else {
            b8(0)
        },
    }
}

/// Deterministic private seed and already-hashed benchmark message.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct BenchmarkJobMaterial {
    /// Injective one-time seed `nonce || big_endian(index)`.
    pub private_seed: HashBytes,
    /// Distinct deterministic test-message domain.
    pub message: MessageBytes,
}

/// Construct one deterministic benchmark job.
///
/// Nonce register word zero contributes bytes zero through three, least
/// significant byte first.  The final eight seed bytes are the index in network
/// (big-endian) order.  The message is an injective bytewise domain transform
/// of the seed; it is test data, not an application prehash construction.
#[kernel]
#[allow(clippy::needless_range_loop)] // Constant loops are directly lowered by pinned RHDL.
pub fn benchmark_job_material_kernel(
    nonce_prefix: [b32; BENCHMARK_NONCE_WORDS],
    index: b64,
) -> BenchmarkJobMaterial {
    let mut private_seed = [b8(0); 32];
    for word in 0..BENCHMARK_NONCE_WORDS {
        private_seed[word * 4] = nonce_prefix[word].resize();
        private_seed[word * 4 + 1] = (nonce_prefix[word] >> 8).resize();
        private_seed[word * 4 + 2] = (nonce_prefix[word] >> 16).resize();
        private_seed[word * 4 + 3] = (nonce_prefix[word] >> 24).resize();
    }
    private_seed[24] = (index >> 56).resize();
    private_seed[25] = (index >> 48).resize();
    private_seed[26] = (index >> 40).resize();
    private_seed[27] = (index >> 32).resize();
    private_seed[28] = (index >> 24).resize();
    private_seed[29] = (index >> 16).resize();
    private_seed[30] = (index >> 8).resize();
    private_seed[31] = index.resize();

    let mut message = [b8(0); 32];
    for lane in 0..32 {
        message[lane] = private_seed[lane] ^ b8(0xa5);
    }
    BenchmarkJobMaterial {
        private_seed,
        message,
    }
}

/// Input to the benchmark's independent frame checker.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct BenchmarkFrameValidationInput {
    /// Candidate signer output.
    pub output: SignerOutputBeat,
    /// Whether a frame is already active.
    pub frame_active: bool,
    /// Next expected beat number.
    pub expected_beat: b6,
    /// Job identity captured from beat zero.
    pub frame_job_id: b32,
    /// Cluster identity captured from beat zero.
    pub frame_cluster: b2,
    /// Latched batch bound for job identities.
    pub batch: b32,
}

/// Independently validate canonical framing and batch identity.
#[kernel]
pub fn benchmark_frame_is_canonical_kernel(input: BenchmarkFrameValidationInput) -> bool {
    let continuity = !input.frame_active
        || (input.output.beat.job_id == input.frame_job_id
            && input.output.cluster == input.frame_cluster);
    input.output.beat.job_id < input.batch
        && input.output.cluster < b2(3)
        && continuity
        && global_beat_is_canonical_kernel(crate::GlobalBeatValidationInput {
            beat: input.output.beat,
            expected_beat: input.expected_beat,
            expected_job_id: input.frame_job_id,
            check_job_id: input.frame_active,
        })
}

/// Input to the 512-bit observability fold.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct BenchmarkChecksumInput {
    /// Previous fold.
    pub checksum: [b32; BENCHMARK_CHECKSUM_WORDS],
    /// Transferred signer output.
    pub output: SignerOutputBeat,
    /// Independently tracked frame beat number.
    pub beat_index: b6,
}

/// XOR-fold one transferred 512-bit beat plus its job/cluster/beat identity.
///
/// The fold is deliberately cheap and completely observable.  It is not
/// collision resistant and must never be used to authenticate a signature.
#[kernel]
#[allow(clippy::needless_range_loop)] // Constant word packing is lowered directly.
pub fn benchmark_checksum_kernel(input: BenchmarkChecksumInput) -> [b32; BENCHMARK_CHECKSUM_WORDS] {
    let mut checksum = input.checksum;
    let identity = input.output.beat.job_id
        ^ input.beat_index.resize::<32>()
        ^ input.output.cluster.resize::<32>();
    for word in 0..BENCHMARK_CHECKSUM_WORDS {
        let byte_zero: b32 = input.output.beat.data[word * 4].resize();
        let byte_one: b32 = input.output.beat.data[word * 4 + 1].resize();
        let byte_two: b32 = input.output.beat.data[word * 4 + 2].resize();
        let byte_three: b32 = input.output.beat.data[word * 4 + 3].resize();
        let packed = byte_zero | (byte_one << 8) | (byte_two << 16) | (byte_three << 24);
        checksum[word] = input.checksum[word] ^ packed ^ identity;
    }
    checksum
}

/// One exact live-job ownership record in the three-cluster/four-context signer.
///
/// Slots `0..=3`, `4..=7`, and `8..=11` are reserved for clusters zero, one,
/// and two respectively.  The physical context number is deliberately not
/// trusted as returned metadata on successful frames, so ownership is matched
/// by the unique `(job_id, cluster)` pair retained at admission.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct BenchmarkLiveJob {
    /// This signer-context capacity slot owns a job.
    pub live: bool,
    /// Unique job identity offered on the accepted start.
    pub job_id: b32,
    /// Admitting cluster, redundantly checked against the slot partition.
    pub cluster: b2,
    /// Beat zero of this job's successful frame has transferred.
    pub frame_started: bool,
}

/// Input to the live-job scoreboard integrity audit.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct BenchmarkScoreboardAuditInput {
    /// Exact twelve-entry ownership scoreboard.
    pub live_jobs: [BenchmarkLiveJob; BENCHMARK_LIVE_JOB_SLOTS],
}

/// Integrity and population summary for the live-job scoreboard.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct BenchmarkScoreboardAuditOutput {
    /// Every live entry occupies its statically assigned cluster partition.
    pub valid: bool,
    /// Number of live owners, in `0..=12`.
    pub live_count: b4,
    /// No signer context remains owned by the benchmark.
    pub empty: bool,
}

/// Map one of the exact twelve capacity slots to its owning cluster partition.
#[kernel]
fn benchmark_scoreboard_slot_cluster_kernel(slot: b4) -> b2 {
    if slot < b4(4) {
        b2(0)
    } else if slot < b4(8) {
        b2(1)
    } else {
        b2(2)
    }
}

/// Audit cluster partitioning and count live ownership in one linear pass.
#[kernel]
#[allow(clippy::assign_op_pattern, clippy::needless_range_loop)] // Preserve reviewed explicit accumulation and fixed-loop source shape.
pub fn benchmark_scoreboard_audit_kernel(
    input: BenchmarkScoreboardAuditInput,
) -> BenchmarkScoreboardAuditOutput {
    let mut valid = true;
    let mut live_count = b4(0);
    for slot in 0..BENCHMARK_LIVE_JOB_SLOTS {
        if input.live_jobs[slot].live {
            live_count = live_count + b4(1);
            let expected_cluster = benchmark_scoreboard_slot_cluster_kernel(b4(slot as u128));
            if input.live_jobs[slot].cluster != expected_cluster {
                valid = false;
            }
        }
    }
    BenchmarkScoreboardAuditOutput {
        valid,
        live_count,
        empty: live_count == b4(0),
    }
}

/// Candidate signer admission offered to the exact ownership scoreboard.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct BenchmarkScoreboardAdmissionInput {
    /// Current scoreboard before the admission pulse.
    pub live_jobs: [BenchmarkLiveJob; BENCHMARK_LIVE_JOB_SLOTS],
    /// Job identity accepted by the signer.
    pub job_id: b32,
    /// Cluster reported by the signer admission handshake.
    pub cluster: b2,
}

/// Allocation decision for one accepted signer start.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct BenchmarkScoreboardAdmissionOutput {
    /// A unique free slot exists in the reported cluster partition.
    pub valid: bool,
    /// Exact scoreboard slot to allocate when `valid` is true.
    pub slot: b4,
}

/// Allocate the first free capacity slot in the admitted cluster.
#[kernel]
#[allow(clippy::needless_range_loop)] // Fixed scoreboard loops are lowered directly.
pub fn benchmark_scoreboard_admission_kernel(
    input: BenchmarkScoreboardAdmissionInput,
) -> BenchmarkScoreboardAdmissionOutput {
    let mut partition_valid = true;
    let mut duplicate = false;
    let mut free_found = false;
    let mut slot = b4(0);
    for candidate in 0..BENCHMARK_LIVE_JOB_SLOTS {
        let candidate_cluster = benchmark_scoreboard_slot_cluster_kernel(b4(candidate as u128));
        if input.live_jobs[candidate].live
            && input.live_jobs[candidate].cluster != candidate_cluster
        {
            partition_valid = false;
        }
        if input.live_jobs[candidate].live && input.live_jobs[candidate].job_id == input.job_id {
            duplicate = true;
        }
        if !free_found && candidate_cluster == input.cluster && !input.live_jobs[candidate].live {
            free_found = true;
            slot = b4(candidate as u128);
        }
    }
    BenchmarkScoreboardAdmissionOutput {
        valid: partition_valid && input.cluster < b2(3) && !duplicate && free_found,
        slot,
    }
}

/// Lookup request for a data or error completion owner.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct BenchmarkScoreboardLookupInput {
    /// Current scoreboard before this cycle's events.
    pub live_jobs: [BenchmarkLiveJob; BENCHMARK_LIVE_JOB_SLOTS],
    /// Returned job identity.
    pub job_id: b32,
    /// Returned source cluster.
    pub cluster: b2,
}

/// Exact live-owner lookup result.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct BenchmarkScoreboardLookupOutput {
    /// Exactly one well-formed live entry owns the returned identity.
    pub valid: bool,
    /// Matching scoreboard slot when `valid` is true.
    pub slot: b4,
    /// Whether the matching job has already started a successful frame.
    pub frame_started: bool,
    /// Raw number of matching live owners, retained for audit tests.
    pub match_count: b4,
}

/// Match a returned `(job_id, cluster)` against exactly one live owner.
#[kernel]
#[allow(clippy::assign_op_pattern, clippy::needless_range_loop)] // Preserve reviewed explicit accumulation and fixed-loop source shape.
pub fn benchmark_scoreboard_lookup_kernel(
    input: BenchmarkScoreboardLookupInput,
) -> BenchmarkScoreboardLookupOutput {
    let mut slot = b4(0);
    let mut frame_started = false;
    let mut match_count = b4(0);
    let mut exact_count = b4(0);
    for candidate in 0..BENCHMARK_LIVE_JOB_SLOTS {
        if input.live_jobs[candidate].live && input.live_jobs[candidate].job_id == input.job_id {
            match_count = match_count + b4(1);
            let candidate_cluster = benchmark_scoreboard_slot_cluster_kernel(b4(candidate as u128));
            if input.live_jobs[candidate].cluster == input.cluster
                && input.live_jobs[candidate].cluster == candidate_cluster
            {
                slot = b4(candidate as u128);
                frame_started = input.live_jobs[candidate].frame_started;
                exact_count = exact_count + b4(1);
            }
        }
    }
    BenchmarkScoreboardLookupOutput {
        valid: input.cluster < b2(3) && match_count == b4(1) && exact_count == b4(1),
        slot,
        frame_started,
        match_count,
    }
}

/// Counter/ownership audit after all current-cycle admissions and terminals.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct BenchmarkCounterAuditInput {
    /// Updated exact live-job scoreboard.
    pub live_jobs: [BenchmarkLiveJob; BENCHMARK_LIVE_JOB_SLOTS],
    /// Updated admitted-job count.
    pub accepted: b64,
    /// Updated successful-frame count.
    pub completed: b64,
    /// Updated error-terminal count.
    pub errors: b64,
    /// Updated transferred-data-beat count.
    pub beats: b64,
    /// Latched batch size.
    pub batch: b32,
    /// Whether a successful frame remains partially transferred.
    pub frame_active: bool,
}

/// Counter/ownership invariants and exact healthy terminal predicate.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct BenchmarkCounterAuditOutput {
    /// Running counters and ownership agree exactly.
    pub valid: bool,
    /// All batch jobs terminated with exact beat accounting and no live owner.
    pub terminal_exact: bool,
    /// Number of live scoreboard owners.
    pub live_count: b4,
}

/// Cross-check counters against the exact live-job scoreboard.
#[kernel]
pub fn benchmark_counter_audit_kernel(
    input: BenchmarkCounterAuditInput,
) -> BenchmarkCounterAuditOutput {
    let scoreboard = benchmark_scoreboard_audit_kernel(BenchmarkScoreboardAuditInput {
        live_jobs: input.live_jobs,
    });
    let terminal_total = input.completed + input.errors;
    let live_count: b64 = scoreboard.live_count.resize();
    let batch: b64 = input.batch.resize();
    let expected_beats = (input.completed << 5) + (input.completed << 1) + input.completed;
    let valid = scoreboard.valid
        && input.accepted <= batch
        && terminal_total <= input.accepted
        && terminal_total + live_count == input.accepted;
    BenchmarkCounterAuditOutput {
        valid,
        terminal_exact: valid
            && terminal_total == batch
            && input.accepted == batch
            && scoreboard.empty
            && !input.frame_active
            && input.beats == expected_beats,
        live_count: scoreboard.live_count,
    }
}

/// Resettable benchmark ownership and counter state.
#[allow(clippy::struct_excessive_bools)] // Independent ownership markers are intentional.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct BenchmarkEngineControl {
    /// One batch owns the engine.
    pub busy: bool,
    /// Sticky structural failure.
    pub fault: bool,
    /// First structural fault code.
    pub fault_code: b8,
    /// Number of signer admissions.
    pub accepted: b64,
    /// Number of canonical successful final transfers.
    pub completed: b64,
    /// Number of data-beat transfers.
    pub beats: b64,
    /// Number of error-completion transfers.
    pub errors: b64,
    /// Exact live ownership of all three-by-four signer contexts.
    pub live_jobs: [BenchmarkLiveJob; BENCHMARK_LIVE_JOB_SLOTS],
    /// Zero-based active cycle counter while busy; total cycles after done.
    pub elapsed_cycles: b64,
    /// A payload beat has transferred.
    pub payload_started: bool,
    /// Cycle of the first payload beat.
    pub first_payload_cycle: b64,
    /// Inclusive first-through-latest payload span.
    pub payload_cycles: b64,
    /// At least one successful final beat transferred.
    pub completion_started: bool,
    /// Cycle of first successful final beat.
    pub first_completion_cycle: b64,
    /// Cycle of latest successful final beat.
    pub last_completion_cycle: b64,
    /// Last-minus-first successful completion span.
    pub completion_span_cycles: b64,
    /// An output frame is being checked.
    pub frame_active: bool,
    /// Next expected frame beat.
    pub expected_beat: b6,
    /// Job captured at frame beat zero.
    pub frame_job_id: b32,
    /// Cluster captured at frame beat zero.
    pub frame_cluster: b2,
}

/// Resettable run data and retained results.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct BenchmarkEngineData {
    /// Latched batch size.
    pub batch: b32,
    /// Latched nonce.
    pub nonce_prefix: [b32; BENCHMARK_NONCE_WORDS],
    /// Latched first index.
    pub run_base_index: b64,
    /// First unused index after the batch.
    pub next_base_index: b64,
    /// Observable checksum.
    pub checksum: [b32; BENCHMARK_CHECKSUM_WORDS],
}

/// On-chip workload generator, injected signer driver, checker, and counter bank.
#[derive(Clone, Debug, Synchronous, SynchronousDQ)]
pub struct BenchmarkEngineWithSigner<S = InlineBenchmarkSigner<64, 6>>
where
    S: BenchmarkSignerComponent,
{
    signer: S,
    control: DFF<BenchmarkEngineControl>,
    data: DFF<BenchmarkEngineData>,
}

impl<S> Default for BenchmarkEngineWithSigner<S>
where
    S: BenchmarkSignerComponent,
{
    fn default() -> Self {
        Self {
            signer: S::default(),
            control: DFF::new(BenchmarkEngineControl::default()),
            data: DFF::new(BenchmarkEngineData::default()),
        }
    }
}

impl<S> SynchronousIO for BenchmarkEngineWithSigner<S>
where
    S: BenchmarkSignerComponent,
{
    type I = BenchmarkEngineInput;
    type O = BenchmarkEngineOutput;
    type Kernel = benchmark_engine_kernel<S>;
}

/// State transition for [`BenchmarkEngineWithSigner`].
#[kernel]
#[allow(clippy::if_not_else, clippy::needless_range_loop)] // Preserve first-event branch order and constant-loop lowering.
pub fn benchmark_engine_kernel<S: BenchmarkSignerComponent>(
    clock_reset: ClockReset,
    input: BenchmarkEngineInput,
    q: BenchmarkEngineWithSignerQ<S>,
) -> (BenchmarkEngineOutput, BenchmarkEngineWithSignerD<S>) {
    let resetting = clock_reset.reset.any();
    let launch = benchmark_launch_validation_kernel(BenchmarkLaunchValidationInput {
        batch: input.batch,
        base_index: input.base_index,
    });
    let launch_ready = !resetting && !q.control.busy && !q.control.fault && !q.signer.fault;
    let launch_offered = launch_ready && input.launch_valid;
    let launch_accepted = launch_offered && launch.valid;
    let launch_rejected = launch_offered && !launch.valid;

    let mut control = q.control;
    let mut data = q.data;
    let mut done = false;

    if launch_accepted {
        control = BenchmarkEngineControl {
            busy: true,
            ..BenchmarkEngineControl::default()
        };
        data = BenchmarkEngineData {
            batch: input.batch,
            nonce_prefix: input.nonce_prefix,
            run_base_index: input.base_index,
            next_base_index: launch.next_base_index,
            checksum: [b32(0); BENCHMARK_CHECKSUM_WORDS],
        };
    }
    if launch_rejected {
        done = true;
    }

    let active = q.control.busy && !q.control.fault && !q.signer.fault;
    let active_cycle = q.control.elapsed_cycles;
    if active {
        control.elapsed_cycles = q.control.elapsed_cycles + b64(1);
    }

    let current_index = q.data.run_base_index + q.control.accepted;
    let material = benchmark_job_material_kernel(q.data.nonce_prefix, current_index);
    let offer_job = active && q.control.accepted < q.data.batch.resize::<64>();
    let signer_input = SignerTopInput {
        start_valid: offer_job,
        private_seed: material.private_seed,
        message: material.message,
        job_id: q.control.accepted.resize(),
        output_ready: active,
        error_ready: active,
    };

    let admitted_cluster_ready = match q.signer.start_cluster {
        Bits::<2>(0) => q.signer.cluster_start_ready[0],
        Bits::<2>(1) => q.signer.cluster_start_ready[1],
        Bits::<2>(2) => q.signer.cluster_start_ready[2],
        _ => false,
    };
    let admission = benchmark_scoreboard_admission_kernel(BenchmarkScoreboardAdmissionInput {
        live_jobs: q.control.live_jobs,
        job_id: q.control.accepted.resize(),
        cluster: q.signer.start_cluster,
    });
    let admission_fault = q.signer.start_accepted
        && (!active
            || !offer_job
            || !q.signer.start_ready
            || !admitted_cluster_ready
            || !admission.valid);
    let admission_event_valid = q.signer.start_accepted && !admission_fault;
    if admission_event_valid {
        control.accepted = q.control.accepted + b64(1);
    }

    let beat_transfer = active && q.signer.output_valid;
    let error_transfer = active && q.signer.error_valid;
    let same_terminal_identity = beat_transfer
        && error_transfer
        && q.signer.output.beat.job_id == q.signer.error.job_id
        && q.signer.output.cluster == q.signer.error.cluster;
    let mut frame_fault = false;
    let mut error_fault = false;
    let frame_owner = benchmark_scoreboard_lookup_kernel(BenchmarkScoreboardLookupInput {
        live_jobs: q.control.live_jobs,
        job_id: q.signer.output.beat.job_id,
        cluster: q.signer.output.cluster,
    });
    let error_owner = benchmark_scoreboard_lookup_kernel(BenchmarkScoreboardLookupInput {
        live_jobs: q.control.live_jobs,
        job_id: q.signer.error.job_id,
        cluster: q.signer.error.cluster,
    });
    let final_beat = q.control.expected_beat == b6(34);
    let frame_owner_phase = if q.control.frame_active {
        frame_owner.frame_started
    } else {
        !frame_owner.frame_started && q.control.expected_beat == b6(0)
    };
    let mut frame_event_valid = false;
    let mut error_event_valid = false;

    if beat_transfer {
        control.beats = q.control.beats + b64(1);
        data.checksum = benchmark_checksum_kernel(BenchmarkChecksumInput {
            checksum: q.data.checksum,
            output: q.signer.output,
            beat_index: q.control.expected_beat,
        });
        if !q.control.payload_started {
            control.payload_started = true;
            control.first_payload_cycle = active_cycle;
            control.payload_cycles = b64(1);
        } else {
            control.payload_cycles = active_cycle - q.control.first_payload_cycle + b64(1);
        }

        let canonical = benchmark_frame_is_canonical_kernel(BenchmarkFrameValidationInput {
            output: q.signer.output,
            frame_active: q.control.frame_active,
            expected_beat: q.control.expected_beat,
            frame_job_id: q.control.frame_job_id,
            frame_cluster: q.control.frame_cluster,
            batch: q.data.batch,
        });
        frame_event_valid = canonical
            && frame_owner.valid
            && frame_owner_phase
            && q.signer.delivered_final == final_beat;
        frame_fault = !frame_event_valid;
        if frame_event_valid {
            if !q.control.frame_active {
                control.frame_active = true;
                control.frame_job_id = q.signer.output.beat.job_id;
                control.frame_cluster = q.signer.output.cluster;
            }
            if final_beat {
                control.frame_active = false;
                control.expected_beat = b6(0);
                control.completed = q.control.completed + b64(1);
                if !q.control.completion_started {
                    control.completion_started = true;
                    control.first_completion_cycle = active_cycle;
                    control.last_completion_cycle = active_cycle;
                    control.completion_span_cycles = b64(0);
                } else {
                    control.last_completion_cycle = active_cycle;
                    control.completion_span_cycles =
                        active_cycle - q.control.first_completion_cycle;
                }
            } else {
                control.expected_beat = q.control.expected_beat + b6(1);
            }
        }
    } else if q.signer.delivered_final {
        frame_fault = true;
    }

    if error_transfer {
        error_event_valid = q.signer.delivered_error
            && error_owner.valid
            && !error_owner.frame_started
            && !same_terminal_identity
            && q.signer.error.job_id < q.data.batch
            && q.signer.error.cluster < b2(3);
        error_fault = !error_event_valid;
        if error_event_valid {
            control.errors = q.control.errors + b64(1);
        }
    } else if q.signer.delivered_error {
        error_fault = true;
    }

    let mut live_jobs = q.control.live_jobs;
    if frame_event_valid {
        for slot in 0..BENCHMARK_LIVE_JOB_SLOTS {
            if b4(slot as u128) == frame_owner.slot {
                if final_beat {
                    live_jobs[slot] = BenchmarkLiveJob::default();
                } else if !q.control.frame_active {
                    live_jobs[slot].frame_started = true;
                }
            }
        }
    }
    if error_event_valid {
        for slot in 0..BENCHMARK_LIVE_JOB_SLOTS {
            if b4(slot as u128) == error_owner.slot {
                live_jobs[slot] = BenchmarkLiveJob::default();
            }
        }
    }
    if admission_event_valid {
        for slot in 0..BENCHMARK_LIVE_JOB_SLOTS {
            if b4(slot as u128) == admission.slot {
                live_jobs[slot] = BenchmarkLiveJob {
                    live: true,
                    job_id: q.control.accepted.resize(),
                    cluster: q.signer.start_cluster,
                    frame_started: false,
                };
            }
        }
    }
    control.live_jobs = live_jobs;

    let counter_audit = benchmark_counter_audit_kernel(BenchmarkCounterAuditInput {
        live_jobs,
        accepted: control.accepted,
        completed: control.completed,
        errors: control.errors,
        beats: control.beats,
        batch: q.data.batch,
        frame_active: control.frame_active,
    });
    let terminal_total = control.completed + control.errors;
    let batch_total: b64 = q.data.batch.resize();
    let protocol_fault = q.signer.fault || admission_fault || frame_fault || error_fault;
    let counter_fault = active
        && !protocol_fault
        && (!counter_audit.valid
            || (terminal_total == batch_total && !counter_audit.terminal_exact));
    let observed_fault = protocol_fault || counter_fault;
    if active && !observed_fault && counter_audit.terminal_exact {
        control.busy = false;
        done = true;
    }
    if q.control.busy && observed_fault {
        control.fault = true;
        control.fault_code = if q.signer.fault {
            b8(0x10)
        } else if admission_fault {
            b8(0x11)
        } else if frame_fault {
            b8(0x12)
        } else if error_fault {
            b8(0x13)
        } else {
            b8(0x14)
        };
        control.busy = false;
        done = true;
    }

    if resetting {
        control = BenchmarkEngineControl::default();
        data = BenchmarkEngineData::default();
        done = false;
    }

    let output = BenchmarkEngineOutput {
        launch_ready,
        launch_accepted: !resetting && launch_accepted,
        launch_rejected: !resetting && launch_rejected,
        reject_code: if launch_rejected {
            launch.reject_code
        } else {
            b8(0)
        },
        busy: !resetting && control.busy,
        done: !resetting && done,
        fault: !resetting && control.fault,
        fault_code: control.fault_code,
        run_base_index: data.run_base_index,
        next_base_index: data.next_base_index,
        accepted: control.accepted,
        completed: control.completed,
        beats: control.beats,
        errors: control.errors,
        elapsed_cycles: control.elapsed_cycles,
        first_completion_cycle: control.first_completion_cycle,
        last_completion_cycle: control.last_completion_cycle,
        completion_span_cycles: control.completion_span_cycles,
        payload_cycles: control.payload_cycles,
        checksum: data.checksum,
    };
    let d = BenchmarkEngineWithSignerD::<S> {
        signer: signer_input,
        control,
        data,
    };
    (output, d)
}

/// Const-generic inline-signer benchmark engine retained for source compatibility.
#[allow(type_alias_bounds)] // Bounds make the adapter well formed; the target repeats them.
pub type BenchmarkEngine<
    const ROUNDS: usize,
    const ADDRESS_BITS: usize,
    L: CompressionLaneComponent + Default = InlineCompressionLane<ROUNDS, ADDRESS_BITS>,
> where
    rhdl::bits::W<ROUNDS>: BitWidth,
    rhdl::bits::W<ADDRESS_BITS>: BitWidth,
= BenchmarkEngineWithSigner<InlineBenchmarkSigner<ROUNDS, ADDRESS_BITS, L>>;

/// Production inline-lane benchmark engine.
pub type WotsSha256BenchmarkEngine = BenchmarkEngine<64, 6>;
/// Production benchmark engine linked to the separately generated signer top.
pub type ModularWotsSha256BenchmarkEngine =
    BenchmarkEngineWithSigner<ExternalModularSha256SignerTop>;

/// Packed AXI4-Lite slave inputs consumed by the RHDL kernel adapter.
#[allow(clippy::struct_excessive_bools)] // Independent AXI channel handshakes define this ABI.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct AxiLiteBenchmarkInput {
    /// Write-address channel valid.
    pub aw_valid: bool,
    /// Byte address within the 4 KiB register aperture.
    pub aw_addr: b12,
    /// Write-data channel valid.
    pub w_valid: bool,
    /// Write data.
    pub w_data: b32,
    /// Per-byte write strobes.
    pub w_strb: b4,
    /// Host accepts the registered write response.
    pub b_ready: bool,
    /// Read-address channel valid.
    pub ar_valid: bool,
    /// Byte address within the 4 KiB register aperture.
    pub ar_addr: b12,
    /// Host accepts the registered read response.
    pub r_ready: bool,
}

/// Packed AXI4-Lite slave outputs produced by the RHDL kernel adapter.
#[allow(clippy::struct_excessive_bools)] // Independent AXI channel handshakes.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct AxiLiteBenchmarkOutput {
    /// Write-address channel ready.
    pub aw_ready: bool,
    /// Write-data channel ready.
    pub w_ready: bool,
    /// Registered write response valid.
    pub b_valid: bool,
    /// Write response (`OKAY` or `SLVERR`).
    pub b_resp: b2,
    /// Read-address channel ready.
    pub ar_ready: bool,
    /// Registered read response valid.
    pub r_valid: bool,
    /// Registered read data, stable under backpressure.
    pub r_data: b32,
    /// Read response (`OKAY` or `SLVERR`).
    pub r_resp: b2,
    /// Level interrupt from enabled sticky event bits.
    pub interrupt: bool,
}

/// Resettable AXI channel ownership and interrupt state.
#[allow(clippy::struct_excessive_bools)] // Each bit is an independent protocol owner.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct AxiLiteBenchmarkControl {
    /// One write address is buffered.
    pub aw_pending: bool,
    /// Buffered write address.
    pub aw_addr: b12,
    /// Engine/configuration lock state sampled when AW transferred.
    pub aw_locked_at_accept: bool,
    /// One write data beat is buffered.
    pub w_pending: bool,
    /// Buffered write data.
    pub w_data: b32,
    /// Buffered byte strobes.
    pub w_strb: b4,
    /// Engine/configuration lock state sampled when W transferred.
    pub w_locked_at_accept: bool,
    /// Registered write response is owned by the B channel.
    pub b_valid: bool,
    /// Registered write response.
    pub b_resp: b2,
    /// Registered read response is owned by the R channel.
    pub r_valid: bool,
    /// Registered read data.
    pub r_data: b32,
    /// Registered read response.
    pub r_resp: b2,
    /// `AP_START` is waiting for engine acceptance/rejection.
    pub start_pending: bool,
    /// Sticky `AP_DONE`, clear on `AP_CTRL` read.
    pub done: bool,
    /// Global interrupt enable.
    pub gie: bool,
    /// Done/fault interrupt enables.
    pub ier: b2,
    /// Done/fault sticky interrupt status.
    pub isr: b2,
    /// Prevent repeated fault-event assertion after software clears ISR.
    pub fault_seen: bool,
    /// Most recent invalid-launch reason.
    pub last_reject_code: b8,
}

/// Mutable launch configuration.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct AxiLiteBenchmarkConfig {
    /// Requested batch.
    pub batch: b32,
    /// 192-bit nonce as six register words.
    pub nonce_prefix: [b32; BENCHMARK_NONCE_WORDS],
    /// Current base/next index; auto-advanced on accepted launch.
    pub base_index: b64,
}

/// Merge one AXI write word according to byte strobes.
#[kernel]
#[allow(clippy::assign_op_pattern)] // Preserve the reviewed explicit bit-mask expression.
pub fn benchmark_merge_write_kernel(old: b32, new: b32, strb: b4) -> b32 {
    let mut mask = b32(0);
    if strb & b4(1) != b4(0) {
        mask = mask | b32(0x0000_00ff);
    }
    if strb & b4(2) != b4(0) {
        mask = mask | b32(0x0000_ff00);
    }
    if strb & b4(4) != b4(0) {
        mask = mask | b32(0x00ff_0000);
    }
    if strb & b4(8) != b4(0) {
        mask = mask | b32(0xff00_0000);
    }
    (old & !mask) | (new & mask)
}

/// Select one half of a 64-bit counter.
#[kernel]
fn benchmark_counter_word_kernel(value: b64, high: bool) -> b32 {
    if high {
        (value >> 32).resize()
    } else {
        value.resize()
    }
}

/// Convert one control predicate to a register bit without a Rust integer cast.
#[kernel]
fn benchmark_bool_word_kernel(value: bool) -> b32 {
    if value { b32(1) } else { b32(0) }
}

/// Read-decode input assembled entirely from RHDL state.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct BenchmarkReadDecodeInput {
    /// Requested byte address.
    pub address: b12,
    /// Current `AP_START` state.
    pub start_pending: bool,
    /// Sticky `AP_DONE` state.
    pub done: bool,
    /// Global interrupt enable.
    pub gie: bool,
    /// Interrupt enables.
    pub ier: b2,
    /// Interrupt status.
    pub isr: b2,
    /// Mutable configuration.
    pub config: AxiLiteBenchmarkConfig,
    /// Most recent rejection code.
    pub last_reject_code: b8,
    /// Engine status/results.
    pub engine: BenchmarkEngineOutput,
}

/// Read-decode result.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct BenchmarkReadDecodeOutput {
    /// Register exists and is word aligned.
    pub valid: bool,
    /// Selected read data.
    pub data: b32,
}

/// Decode the stable benchmark register map.
#[kernel]
#[allow(clippy::too_many_lines)] // Explicit addresses are the auditable hardware ABI.
pub fn benchmark_read_decode_kernel(input: BenchmarkReadDecodeInput) -> BenchmarkReadDecodeOutput {
    let mut output = BenchmarkReadDecodeOutput {
        valid: true,
        data: b32(0),
    };
    match input.address {
        Bits::<12>(0x000) => {
            output.data = benchmark_bool_word_kernel(input.start_pending)
                | (benchmark_bool_word_kernel(input.done) << 1)
                | (benchmark_bool_word_kernel(!input.engine.busy && !input.start_pending) << 2)
                | (benchmark_bool_word_kernel(input.engine.launch_ready && !input.start_pending)
                    << 3);
        }
        Bits::<12>(0x004) => output.data = benchmark_bool_word_kernel(input.gie),
        Bits::<12>(0x008) => output.data = input.ier.resize(),
        Bits::<12>(0x00c) => output.data = input.isr.resize(),
        Bits::<12>(0x010) => output.data = input.config.batch,
        Bits::<12>(0x014) => output.data = b32(0x0001_0000),
        Bits::<12>(0x018) => output.data = input.config.nonce_prefix[0],
        Bits::<12>(0x01c) => output.data = input.config.nonce_prefix[1],
        Bits::<12>(0x020) => output.data = input.config.nonce_prefix[2],
        Bits::<12>(0x024) => output.data = input.config.nonce_prefix[3],
        Bits::<12>(0x028) => output.data = input.config.nonce_prefix[4],
        Bits::<12>(0x02c) => output.data = input.config.nonce_prefix[5],
        Bits::<12>(0x030) => {
            output.data = benchmark_counter_word_kernel(input.config.base_index, false);
        }
        Bits::<12>(0x034) => {
            output.data = benchmark_counter_word_kernel(input.config.base_index, true);
        }
        Bits::<12>(0x038) => {
            output.data = benchmark_counter_word_kernel(input.engine.run_base_index, false);
        }
        Bits::<12>(0x03c) => {
            output.data = benchmark_counter_word_kernel(input.engine.run_base_index, true);
        }
        Bits::<12>(0x040) => {
            output.data = benchmark_bool_word_kernel(input.engine.busy)
                | (benchmark_bool_word_kernel(input.engine.fault) << 1)
                | (benchmark_bool_word_kernel(input.last_reject_code != b8(0)) << 2)
                | (benchmark_bool_word_kernel(input.engine.fault_code == b8(0x10)) << 3)
                | (benchmark_bool_word_kernel(
                    input.engine.fault_code != b8(0) && input.engine.fault_code != b8(0x10),
                ) << 4);
        }
        Bits::<12>(0x044) => {
            output.data = input.engine.fault_code.resize::<32>()
                | (input.last_reject_code.resize::<32>() << 8);
        }
        Bits::<12>(0x048) => {
            output.data = benchmark_counter_word_kernel(input.engine.accepted, false);
        }
        Bits::<12>(0x04c) => {
            output.data = benchmark_counter_word_kernel(input.engine.accepted, true);
        }
        Bits::<12>(0x050) => {
            output.data = benchmark_counter_word_kernel(input.engine.completed, false);
        }
        Bits::<12>(0x054) => {
            output.data = benchmark_counter_word_kernel(input.engine.completed, true);
        }
        Bits::<12>(0x058) => {
            output.data = benchmark_counter_word_kernel(input.engine.beats, false);
        }
        Bits::<12>(0x05c) => {
            output.data = benchmark_counter_word_kernel(input.engine.beats, true);
        }
        Bits::<12>(0x060) => {
            output.data = benchmark_counter_word_kernel(input.engine.errors, false);
        }
        Bits::<12>(0x064) => {
            output.data = benchmark_counter_word_kernel(input.engine.errors, true);
        }
        Bits::<12>(0x068) => {
            output.data = benchmark_counter_word_kernel(input.engine.elapsed_cycles, false);
        }
        Bits::<12>(0x06c) => {
            output.data = benchmark_counter_word_kernel(input.engine.elapsed_cycles, true);
        }
        Bits::<12>(0x070) => {
            output.data = benchmark_counter_word_kernel(input.engine.first_completion_cycle, false);
        }
        Bits::<12>(0x074) => {
            output.data = benchmark_counter_word_kernel(input.engine.first_completion_cycle, true);
        }
        Bits::<12>(0x078) => {
            output.data = benchmark_counter_word_kernel(input.engine.last_completion_cycle, false);
        }
        Bits::<12>(0x07c) => {
            output.data = benchmark_counter_word_kernel(input.engine.last_completion_cycle, true);
        }
        Bits::<12>(0x080) => {
            output.data = benchmark_counter_word_kernel(input.engine.completion_span_cycles, false);
        }
        Bits::<12>(0x084) => {
            output.data = benchmark_counter_word_kernel(input.engine.completion_span_cycles, true);
        }
        Bits::<12>(0x088) => {
            output.data = benchmark_counter_word_kernel(input.engine.payload_cycles, false);
        }
        Bits::<12>(0x08c) => {
            output.data = benchmark_counter_word_kernel(input.engine.payload_cycles, true);
        }
        Bits::<12>(0x090) => output.data = input.engine.checksum[0],
        Bits::<12>(0x094) => output.data = input.engine.checksum[1],
        Bits::<12>(0x098) => output.data = input.engine.checksum[2],
        Bits::<12>(0x09c) => output.data = input.engine.checksum[3],
        Bits::<12>(0x0a0) => output.data = input.engine.checksum[4],
        Bits::<12>(0x0a4) => output.data = input.engine.checksum[5],
        Bits::<12>(0x0a8) => output.data = input.engine.checksum[6],
        Bits::<12>(0x0ac) => output.data = input.engine.checksum[7],
        Bits::<12>(0x0b0) => output.data = input.engine.checksum[8],
        Bits::<12>(0x0b4) => output.data = input.engine.checksum[9],
        Bits::<12>(0x0b8) => output.data = input.engine.checksum[10],
        Bits::<12>(0x0bc) => output.data = input.engine.checksum[11],
        Bits::<12>(0x0c0) => output.data = input.engine.checksum[12],
        Bits::<12>(0x0c4) => output.data = input.engine.checksum[13],
        Bits::<12>(0x0c8) => output.data = input.engine.checksum[14],
        Bits::<12>(0x0cc) => output.data = input.engine.checksum[15],
        _ => output.valid = false,
    }
    output
}

/// AXI4-Lite-only benchmark kernel over an injected signer component.
#[derive(Clone, Debug, Synchronous, SynchronousDQ)]
pub struct AxiLiteBenchmarkKernelWithSigner<S = InlineBenchmarkSigner<64, 6>>
where
    S: BenchmarkSignerComponent,
{
    engine: BenchmarkEngineWithSigner<S>,
    control: DFF<AxiLiteBenchmarkControl>,
    config: DFF<AxiLiteBenchmarkConfig>,
}

impl<S> Default for AxiLiteBenchmarkKernelWithSigner<S>
where
    S: BenchmarkSignerComponent,
{
    fn default() -> Self {
        Self {
            engine: BenchmarkEngineWithSigner::default(),
            control: DFF::new(AxiLiteBenchmarkControl::default()),
            config: DFF::new(AxiLiteBenchmarkConfig::default()),
        }
    }
}

impl<S> SynchronousIO for AxiLiteBenchmarkKernelWithSigner<S>
where
    S: BenchmarkSignerComponent,
{
    type I = AxiLiteBenchmarkInput;
    type O = AxiLiteBenchmarkOutput;
    type Kernel = axi_lite_benchmark_kernel<S>;
}

/// State transition for [`AxiLiteBenchmarkKernelWithSigner`].
#[kernel]
#[allow(clippy::assign_op_pattern, clippy::too_many_lines)] // Preserve the reviewed explicit AXI state-update source shape.
pub fn axi_lite_benchmark_kernel<S: BenchmarkSignerComponent>(
    clock_reset: ClockReset,
    input: AxiLiteBenchmarkInput,
    q: AxiLiteBenchmarkKernelWithSignerQ<S>,
) -> (AxiLiteBenchmarkOutput, AxiLiteBenchmarkKernelWithSignerD<S>) {
    let resetting = clock_reset.reset.any();
    let aw_ready = !resetting && !q.control.aw_pending && !q.control.b_valid;
    let w_ready = !resetting && !q.control.w_pending && !q.control.b_valid;
    let ar_ready = !resetting && !q.control.r_valid;
    let mut control = q.control;
    let mut config = q.config;

    if q.control.b_valid && input.b_ready {
        control.b_valid = false;
    }
    if q.control.r_valid && input.r_ready {
        control.r_valid = false;
    }
    if input.aw_valid && aw_ready {
        control.aw_pending = true;
        control.aw_addr = input.aw_addr;
        control.aw_locked_at_accept = q.engine.busy || q.control.start_pending;
    }
    if input.w_valid && w_ready {
        control.w_pending = true;
        control.w_data = input.w_data;
        control.w_strb = input.w_strb;
        control.w_locked_at_accept = q.engine.busy || q.control.start_pending;
    }

    if q.control.aw_pending && q.control.w_pending && !q.control.b_valid {
        let locked = q.control.aw_locked_at_accept
            || q.control.w_locked_at_accept
            || q.engine.busy
            || q.control.start_pending;
        let mut write_valid = true;
        match q.control.aw_addr {
            Bits::<12>(0x000) => {
                if q.control.w_strb & b4(1) != b4(0) && q.control.w_data & b32(1) != b32(0) {
                    if locked || !q.engine.launch_ready {
                        write_valid = false;
                    } else {
                        control.start_pending = true;
                    }
                }
            }
            Bits::<12>(0x004) => {
                if q.control.w_strb & b4(1) != b4(0) {
                    control.gie = q.control.w_data & b32(1) != b32(0);
                }
            }
            Bits::<12>(0x008) => {
                if q.control.w_strb & b4(1) != b4(0) {
                    control.ier = q.control.w_data.resize();
                }
            }
            Bits::<12>(0x00c) => {
                if q.control.w_strb & b4(1) != b4(0) {
                    control.isr = q.control.isr ^ q.control.w_data.resize::<2>();
                }
            }
            Bits::<12>(0x010) => {
                if locked {
                    write_valid = false;
                } else {
                    config.batch = benchmark_merge_write_kernel(
                        q.config.batch,
                        q.control.w_data,
                        q.control.w_strb,
                    );
                }
            }
            Bits::<12>(0x018) => {
                if locked {
                    write_valid = false;
                } else {
                    config.nonce_prefix[0] = benchmark_merge_write_kernel(
                        q.config.nonce_prefix[0],
                        q.control.w_data,
                        q.control.w_strb,
                    );
                }
            }
            Bits::<12>(0x01c) => {
                if locked {
                    write_valid = false;
                } else {
                    config.nonce_prefix[1] = benchmark_merge_write_kernel(
                        q.config.nonce_prefix[1],
                        q.control.w_data,
                        q.control.w_strb,
                    );
                }
            }
            Bits::<12>(0x020) => {
                if locked {
                    write_valid = false;
                } else {
                    config.nonce_prefix[2] = benchmark_merge_write_kernel(
                        q.config.nonce_prefix[2],
                        q.control.w_data,
                        q.control.w_strb,
                    );
                }
            }
            Bits::<12>(0x024) => {
                if locked {
                    write_valid = false;
                } else {
                    config.nonce_prefix[3] = benchmark_merge_write_kernel(
                        q.config.nonce_prefix[3],
                        q.control.w_data,
                        q.control.w_strb,
                    );
                }
            }
            Bits::<12>(0x028) => {
                if locked {
                    write_valid = false;
                } else {
                    config.nonce_prefix[4] = benchmark_merge_write_kernel(
                        q.config.nonce_prefix[4],
                        q.control.w_data,
                        q.control.w_strb,
                    );
                }
            }
            Bits::<12>(0x02c) => {
                if locked {
                    write_valid = false;
                } else {
                    config.nonce_prefix[5] = benchmark_merge_write_kernel(
                        q.config.nonce_prefix[5],
                        q.control.w_data,
                        q.control.w_strb,
                    );
                }
            }
            Bits::<12>(0x030) => {
                if locked {
                    write_valid = false;
                } else {
                    let low = benchmark_merge_write_kernel(
                        q.config.base_index.resize(),
                        q.control.w_data,
                        q.control.w_strb,
                    );
                    config.base_index =
                        (q.config.base_index & b64(0xffff_ffff_0000_0000)) | low.resize::<64>();
                }
            }
            Bits::<12>(0x034) => {
                if locked {
                    write_valid = false;
                } else {
                    let old_high: b32 = (q.config.base_index >> 32).resize();
                    let high =
                        benchmark_merge_write_kernel(old_high, q.control.w_data, q.control.w_strb);
                    config.base_index = (q.config.base_index & b64(0x0000_0000_ffff_ffff))
                        | (high.resize::<64>() << 32);
                }
            }
            _ => write_valid = false,
        }
        control.aw_pending = false;
        control.aw_locked_at_accept = false;
        control.w_pending = false;
        control.w_locked_at_accept = false;
        control.b_valid = true;
        control.b_resp = if write_valid { b2(0) } else { b2(2) };
    }

    if input.ar_valid && ar_ready {
        let decoded = benchmark_read_decode_kernel(BenchmarkReadDecodeInput {
            address: input.ar_addr,
            start_pending: q.control.start_pending,
            done: q.control.done,
            gie: q.control.gie,
            ier: q.control.ier,
            isr: q.control.isr,
            config: q.config,
            last_reject_code: q.control.last_reject_code,
            engine: q.engine,
        });
        control.r_valid = true;
        control.r_data = decoded.data;
        control.r_resp = if decoded.valid { b2(0) } else { b2(2) };
        if input.ar_addr == b12(0) {
            control.done = false;
        }
    }

    if q.engine.launch_accepted {
        control.start_pending = false;
        control.last_reject_code = b8(0);
        config.base_index = q.engine.next_base_index;
    }
    if q.engine.launch_rejected {
        control.start_pending = false;
        control.last_reject_code = q.engine.reject_code;
    }
    if q.engine.done {
        control.done = true;
        control.isr = control.isr | b2(1);
    }
    if q.engine.fault && !q.control.fault_seen {
        control.fault_seen = true;
        control.isr = control.isr | b2(2);
    }

    let engine_input = BenchmarkEngineInput {
        launch_valid: q.control.start_pending,
        batch: q.config.batch,
        nonce_prefix: q.config.nonce_prefix,
        base_index: q.config.base_index,
    };

    if resetting {
        control = AxiLiteBenchmarkControl::default();
        config = AxiLiteBenchmarkConfig::default();
    }

    let output = AxiLiteBenchmarkOutput {
        aw_ready,
        w_ready,
        b_valid: !resetting && q.control.b_valid,
        b_resp: q.control.b_resp,
        ar_ready,
        r_valid: !resetting && q.control.r_valid,
        r_data: q.control.r_data,
        r_resp: q.control.r_resp,
        interrupt: !resetting && q.control.gie && (q.control.isr & q.control.ier) != b2(0),
    };
    let d = AxiLiteBenchmarkKernelWithSignerD::<S> {
        engine: engine_input,
        control,
        config,
    };
    (output, d)
}

/// Const-generic inline-signer AXI kernel retained for source compatibility.
#[allow(type_alias_bounds)] // Bounds make the adapter well formed; the target repeats them.
pub type AxiLiteBenchmarkKernel<
    const ROUNDS: usize,
    const ADDRESS_BITS: usize,
    L: CompressionLaneComponent + Default = InlineCompressionLane<ROUNDS, ADDRESS_BITS>,
> where
    rhdl::bits::W<ROUNDS>: BitWidth,
    rhdl::bits::W<ADDRESS_BITS>: BitWidth,
= AxiLiteBenchmarkKernelWithSigner<InlineBenchmarkSigner<ROUNDS, ADDRESS_BITS, L>>;

/// Production inline-lane AXI4-Lite benchmark kernel.
pub type WotsSha256AxiLiteBenchmarkKernel = AxiLiteBenchmarkKernel<64, 6>;
/// Production AXI4-Lite benchmark linked to the external RHDL signer top.
pub type ModularWotsSha256AxiLiteBenchmarkKernel =
    AxiLiteBenchmarkKernelWithSigner<ExternalModularSha256SignerTop>;

#[cfg(test)]
mod tests {
    use super::*;
    use crate::LaneLocalBeat;

    fn raw8(value: b8) -> u8 {
        value.raw().to_le_bytes()[0]
    }

    fn raw4(value: b4) -> usize {
        usize::from(value.raw().to_le_bytes()[0] & 0x0f)
    }

    fn raw32(value: b32) -> u32 {
        let bytes = value.raw().to_le_bytes();
        u32::from_le_bytes(bytes[..4].try_into().expect("four bytes"))
    }

    #[test]
    fn external_signer_descriptor_is_typed_and_unresolved() -> Result<(), RHDLError> {
        let descriptor =
            ExternalModularSha256SignerTop.descriptor("benchmark_external_signer_probe".into())?;
        assert_eq!(
            descriptor.name.to_string(),
            "benchmark_external_signer_probe"
        );
        assert_eq!(descriptor.input_kind, SignerTopInput::static_kind());
        assert_eq!(
            descriptor.output_kind,
            crate::SignerTopOutput::static_kind()
        );
        assert!(descriptor.hdl().is_err());
        assert!(descriptor.hdl_unchecked()?.modules.modules.is_empty());

        let wrapper = descriptor
            .netlist()?
            .as_vlog("benchmark_external_signer_probe")?
            .modules
            .pretty();
        assert!(wrapper.contains(&format!("{BENCHMARK_SIGNER_TOP_MODULE} bb_0(")));
        assert!(!wrapper.contains(&format!("module {BENCHMARK_SIGNER_TOP_MODULE}(")));
        Ok(())
    }

    #[test]
    fn external_signer_simulation_delegates_to_the_exact_modular_signer() {
        let external = ExternalModularSha256SignerTop;
        let native = SignerTop::<64, 6, ExternalFullCompressionLane>::default();
        let mut external_state = external.init();
        let mut native_state = native.init();
        for clock_reset in [
            clock_reset(clock(false), reset(true)),
            clock_reset(clock(false), reset(false)),
        ] {
            let input = SignerTopInput::default();
            assert_eq!(
                external.sim(clock_reset, input, &mut external_state),
                native.sim(clock_reset, input, &mut native_state)
            );
            assert!(external_state == native_state);
        }
    }

    fn live_job(job_id: u32, cluster: u8, frame_started: bool) -> BenchmarkLiveJob {
        BenchmarkLiveJob {
            live: true,
            job_id: b32(job_id as u128),
            cluster: b2(cluster as u128),
            frame_started,
        }
    }

    fn active_engine_q(batch: u32) -> BenchmarkEngineWithSignerQ<InlineBenchmarkSigner<4, 2>> {
        BenchmarkEngineWithSignerQ::<InlineBenchmarkSigner<4, 2>> {
            signer: crate::SignerTopOutput::default(),
            control: BenchmarkEngineControl {
                busy: true,
                ..BenchmarkEngineControl::default()
            },
            data: BenchmarkEngineData {
                batch: b32(batch as u128),
                ..BenchmarkEngineData::default()
            },
        }
    }

    fn engine_transition(
        mut q: BenchmarkEngineWithSignerQ<InlineBenchmarkSigner<4, 2>>,
        signer: crate::SignerTopOutput,
    ) -> (
        BenchmarkEngineOutput,
        BenchmarkEngineControl,
        BenchmarkEngineData,
    ) {
        q.signer = signer;
        let (output, d) = benchmark_engine_kernel::<InlineBenchmarkSigner<4, 2>>(
            clock_reset(clock(false), reset(false)),
            BenchmarkEngineInput::default(),
            q,
        );
        (output, d.control, d.data)
    }

    fn axi_q(
        engine: BenchmarkEngineOutput,
        control: AxiLiteBenchmarkControl,
        config: AxiLiteBenchmarkConfig,
    ) -> AxiLiteBenchmarkKernelWithSignerQ<InlineBenchmarkSigner<4, 2>> {
        AxiLiteBenchmarkKernelWithSignerQ::<InlineBenchmarkSigner<4, 2>> {
            engine,
            control,
            config,
        }
    }

    fn axi_transition(
        q: AxiLiteBenchmarkKernelWithSignerQ<InlineBenchmarkSigner<4, 2>>,
        input: AxiLiteBenchmarkInput,
    ) -> (
        AxiLiteBenchmarkOutput,
        AxiLiteBenchmarkControl,
        AxiLiteBenchmarkConfig,
    ) {
        let (output, d) = axi_lite_benchmark_kernel::<InlineBenchmarkSigner<4, 2>>(
            clock_reset(clock(false), reset(false)),
            input,
            q,
        );
        (output, d.control, d.config)
    }

    #[test]
    fn launch_validation_reserves_a_representable_exclusive_end() {
        let ordinary = benchmark_launch_validation_kernel(BenchmarkLaunchValidationInput {
            batch: b32(17),
            base_index: b64(41),
        });
        assert!(ordinary.valid);
        assert_eq!(ordinary.next_base_index, b64(58));
        assert_eq!(ordinary.reject_code, b8(BENCHMARK_REJECT_NONE as u128));

        let zero = benchmark_launch_validation_kernel(BenchmarkLaunchValidationInput {
            batch: b32(0),
            base_index: b64(41),
        });
        assert!(!zero.valid);
        assert_eq!(zero.reject_code, b8(BENCHMARK_REJECT_ZERO_BATCH as u128));

        let overflow = benchmark_launch_validation_kernel(BenchmarkLaunchValidationInput {
            batch: b32(2),
            base_index: b64(u64::MAX as u128 - 1),
        });
        assert!(!overflow.valid);
        assert_eq!(
            overflow.reject_code,
            b8(BENCHMARK_REJECT_INDEX_OVERFLOW as u128)
        );
    }

    #[test]
    fn seed_byte_order_is_exact_and_batch_material_is_injective() {
        let nonce_prefix = [
            b32(0x0302_0100),
            b32(0x0706_0504),
            b32(0x0b0a_0908),
            b32(0x0f0e_0d0c),
            b32(0x1312_1110),
            b32(0x1716_1514),
        ];
        let first = benchmark_job_material_kernel(nonce_prefix, b64(0x1829_3a4b_5c6d_7e8f));
        let seed = first.private_seed.map(raw8);
        assert_eq!(
            seed[..24],
            core::array::from_fn::<_, 24, _>(|index| index as u8)
        );
        assert_eq!(&seed[24..], &0x1829_3a4b_5c6d_7e8f_u64.to_be_bytes());
        assert_eq!(
            first.message.map(raw8),
            seed.map(|byte| byte ^ 0xa5),
            "message uses the documented test-only domain transform"
        );

        let mut seeds = std::collections::BTreeSet::new();
        for offset in 0..257_u64 {
            let material = benchmark_job_material_kernel(nonce_prefix, b64(9_000 + offset as u128));
            assert!(seeds.insert(material.private_seed.map(raw8)));
        }
    }

    fn canonical_output(job_id: u32, cluster: u8, beat: usize) -> SignerOutputBeat {
        let mut data = [b8(0); 64];
        for (lane, byte) in data.iter_mut().enumerate() {
            *byte = b8(((job_id as usize + beat * 17 + lane * 29) & 0xff) as u128);
        }
        let final_beat = beat == 34;
        if final_beat {
            for byte in &mut data[32..] {
                *byte = b8(0);
            }
        }
        SignerOutputBeat {
            beat: LaneLocalBeat {
                data,
                keep: if final_beat {
                    b64(0xffff_ffff)
                } else {
                    b64(u64::MAX as u128)
                },
                last: final_beat,
                job_id: b32(job_id as u128),
            },
            cluster: b2(cluster as u128),
        }
    }

    #[test]
    fn independent_frame_checker_enforces_all_thirty_five_beats() {
        let mut active = false;
        let mut job_id = b32(0);
        let mut cluster = b2(0);
        for beat in 0..SIGNER_FRAME_BEATS {
            let output = canonical_output(7, 2, beat);
            assert!(benchmark_frame_is_canonical_kernel(
                BenchmarkFrameValidationInput {
                    output,
                    frame_active: active,
                    expected_beat: b6(beat as u128),
                    frame_job_id: job_id,
                    frame_cluster: cluster,
                    batch: b32(8),
                }
            ));
            if beat == 0 {
                active = true;
                job_id = output.beat.job_id;
                cluster = output.cluster;
            }
        }

        let mut wrong_keep = canonical_output(7, 2, 34);
        wrong_keep.beat.keep = b64(u64::MAX as u128);
        assert!(!benchmark_frame_is_canonical_kernel(
            BenchmarkFrameValidationInput {
                output: wrong_keep,
                frame_active: true,
                expected_beat: b6(34),
                frame_job_id: b32(7),
                frame_cluster: b2(2),
                batch: b32(8),
            }
        ));

        let wrong_job = canonical_output(8, 2, 1);
        assert!(!benchmark_frame_is_canonical_kernel(
            BenchmarkFrameValidationInput {
                output: wrong_job,
                frame_active: true,
                expected_beat: b6(1),
                frame_job_id: b32(7),
                frame_cluster: b2(2),
                batch: b32(8),
            }
        ));
    }

    #[test]
    fn checksum_fold_is_wide_deterministic_and_identity_sensitive() {
        let initial = [b32(0); BENCHMARK_CHECKSUM_WORDS];
        let output = canonical_output(3, 1, 0);
        let first = benchmark_checksum_kernel(BenchmarkChecksumInput {
            checksum: initial,
            output,
            beat_index: b6(0),
        });
        assert!(first.iter().any(|word| *word != b32(0)));
        assert_eq!(
            first,
            benchmark_checksum_kernel(BenchmarkChecksumInput {
                checksum: initial,
                output,
                beat_index: b6(0),
            })
        );
        let different_identity = benchmark_checksum_kernel(BenchmarkChecksumInput {
            checksum: initial,
            output,
            beat_index: b6(1),
        });
        assert_ne!(first, different_identity);
    }

    #[test]
    fn exact_twelve_entry_scoreboard_rejects_duplicates_and_cluster_overfill() {
        let mut live_jobs = [BenchmarkLiveJob::default(); BENCHMARK_LIVE_JOB_SLOTS];
        for job_id in 0..12_u32 {
            let cluster = (job_id % 3) as u8;
            let admission =
                benchmark_scoreboard_admission_kernel(BenchmarkScoreboardAdmissionInput {
                    live_jobs,
                    job_id: b32(job_id as u128),
                    cluster: b2(cluster as u128),
                });
            assert!(
                admission.valid,
                "job {job_id} must fit its four-slot partition"
            );
            let slot = raw4(admission.slot);
            assert_eq!(slot / LANE_LOCAL_CONTEXTS, usize::from(cluster));
            live_jobs[slot] = live_job(job_id, cluster, false);
        }
        let audit = benchmark_scoreboard_audit_kernel(BenchmarkScoreboardAuditInput { live_jobs });
        assert!(audit.valid);
        assert_eq!(audit.live_count, b4(12));
        assert!(!audit.empty);

        let cluster_zero_full =
            benchmark_scoreboard_admission_kernel(BenchmarkScoreboardAdmissionInput {
                live_jobs,
                job_id: b32(12),
                cluster: b2(0),
            });
        assert!(!cluster_zero_full.valid);
        let duplicate = benchmark_scoreboard_admission_kernel(BenchmarkScoreboardAdmissionInput {
            live_jobs,
            job_id: b32(7),
            cluster: b2(1),
        });
        assert!(!duplicate.valid);

        let owner = benchmark_scoreboard_lookup_kernel(BenchmarkScoreboardLookupInput {
            live_jobs,
            job_id: b32(10),
            cluster: b2(1),
        });
        assert!(owner.valid);
        assert_eq!(owner.match_count, b4(1));

        let mut corrupt = live_jobs;
        corrupt[0].job_id = corrupt[1].job_id;
        let corrupt_owner = benchmark_scoreboard_lookup_kernel(BenchmarkScoreboardLookupInput {
            live_jobs: corrupt,
            job_id: corrupt[1].job_id,
            cluster: corrupt[1].cluster,
        });
        assert!(
            !corrupt_owner.valid,
            "duplicate live identity must fail closed"
        );
        assert_eq!(corrupt_owner.match_count, b4(2));
    }

    #[test]
    fn injected_admission_frame_error_and_counter_faults_fail_closed() {
        let active_clock = clock_reset(clock(false), reset(false));

        let mut admission_q = active_engine_q(5);
        admission_q.control.accepted = b64(4);
        for slot in 0..4 {
            admission_q.control.live_jobs[slot] = live_job(slot as u32, 0, false);
        }
        admission_q.signer.start_ready = true;
        admission_q.signer.start_accepted = true;
        admission_q.signer.start_cluster = b2(0);
        admission_q.signer.cluster_start_ready[0] = true;
        let (admission, _) = benchmark_engine_kernel::<InlineBenchmarkSigner<4, 2>>(
            active_clock,
            BenchmarkEngineInput::default(),
            admission_q,
        );
        assert!(admission.fault);
        assert_eq!(admission.fault_code, b8(BENCHMARK_FAULT_ADMISSION as u128));

        let mut frame_q = active_engine_q(1);
        frame_q.signer.output_valid = true;
        frame_q.signer.output = canonical_output(0, 0, 0);
        let (frame, _) = benchmark_engine_kernel::<InlineBenchmarkSigner<4, 2>>(
            active_clock,
            BenchmarkEngineInput::default(),
            frame_q,
        );
        assert!(frame.fault, "premature frame has no live owner");
        assert_eq!(frame.fault_code, b8(BENCHMARK_FAULT_FRAME as u128));

        let mut error_q = active_engine_q(1);
        error_q.signer.error_valid = true;
        error_q.signer.delivered_error = true;
        error_q.signer.error.job_id = b32(0);
        error_q.signer.error.cluster = b2(0);
        let (error, _) = benchmark_engine_kernel::<InlineBenchmarkSigner<4, 2>>(
            active_clock,
            BenchmarkEngineInput::default(),
            error_q,
        );
        assert!(error.fault, "premature error has no live owner");
        assert_eq!(error.fault_code, b8(BENCHMARK_FAULT_ERROR as u128));

        let mut counter_q = active_engine_q(1);
        counter_q.control.accepted = b64(1);
        counter_q.control.completed = b64(1);
        counter_q.control.beats = b64(35);
        counter_q.control.live_jobs[0] = live_job(0, 0, false);
        let (counter, _) = benchmark_engine_kernel::<InlineBenchmarkSigner<4, 2>>(
            active_clock,
            BenchmarkEngineInput::default(),
            counter_q,
        );
        assert!(
            counter.fault,
            "terminal count with a missing retirement must fail"
        );
        assert_eq!(counter.fault_code, b8(BENCHMARK_FAULT_COUNTER as u128));
    }

    #[test]
    fn duplicate_and_success_error_double_terminals_cannot_retire_twice() {
        let active_clock = clock_reset(clock(false), reset(false));
        let mut q = active_engine_q(1);
        q.control.accepted = b64(1);
        q.control.beats = b64(34);
        q.control.frame_active = true;
        q.control.expected_beat = b6(34);
        q.control.frame_job_id = b32(0);
        q.control.frame_cluster = b2(0);
        q.control.live_jobs[0] = live_job(0, 0, true);
        q.signer.output_valid = true;
        q.signer.output = canonical_output(0, 0, 34);
        q.signer.delivered_final = true;
        q.signer.error_valid = true;
        q.signer.error = crate::SignerErrorCompletion {
            job_id: b32(0),
            cluster: b2(0),
            context: b2(0),
        };
        q.signer.delivered_error = true;
        let (double, _) = benchmark_engine_kernel::<InlineBenchmarkSigner<4, 2>>(
            active_clock,
            BenchmarkEngineInput::default(),
            q,
        );
        assert!(double.fault);
        assert_eq!(double.fault_code, b8(BENCHMARK_FAULT_ERROR as u128));
        assert_eq!(double.completed, b64(1));
        assert_eq!(double.errors, b64(0));

        let mut duplicate_q = active_engine_q(2);
        duplicate_q.control.accepted = b64(1);
        duplicate_q.control.completed = b64(1);
        duplicate_q.control.beats = b64(35);
        duplicate_q.control.frame_active = true;
        duplicate_q.control.expected_beat = b6(34);
        duplicate_q.control.frame_job_id = b32(0);
        duplicate_q.control.frame_cluster = b2(0);
        duplicate_q.signer.output_valid = true;
        duplicate_q.signer.output = canonical_output(0, 0, 34);
        duplicate_q.signer.delivered_final = true;
        let (duplicate, _) = benchmark_engine_kernel::<InlineBenchmarkSigner<4, 2>>(
            active_clock,
            BenchmarkEngineInput::default(),
            duplicate_q,
        );
        assert!(duplicate.fault, "a retired owner cannot complete again");
        assert_eq!(duplicate.fault_code, b8(BENCHMARK_FAULT_FRAME as u128));
    }

    fn software_checksum_fold(
        checksum: &mut [u32; BENCHMARK_CHECKSUM_WORDS],
        output: SignerOutputBeat,
        beat: usize,
    ) {
        let cluster: b8 = output.cluster.resize();
        let identity = raw32(output.beat.job_id) ^ beat as u32 ^ u32::from(raw8(cluster));
        for (word, checksum_word) in checksum.iter_mut().enumerate() {
            let bytes = [
                raw8(output.beat.data[word * 4]),
                raw8(output.beat.data[word * 4 + 1]),
                raw8(output.beat.data[word * 4 + 2]),
                raw8(output.beat.data[word * 4 + 3]),
            ];
            *checksum_word ^= u32::from_le_bytes(bytes) ^ identity;
        }
    }

    #[test]
    fn thirteen_synthetic_jobs_reuse_capacity_and_finish_with_exact_beat_oracle() {
        let mut q = active_engine_q(13);
        let mut software_checksum = [0_u32; BENCHMARK_CHECKSUM_WORDS];

        for job_id in 0..12_u32 {
            let cluster = (job_id % 3) as usize;
            let mut signer = crate::SignerTopOutput::default();
            signer.start_ready = true;
            signer.start_accepted = true;
            signer.start_cluster = b2(cluster as u128);
            signer.cluster_start_ready[cluster] = true;
            let (output, control, data) = engine_transition(q, signer);
            assert!(!output.fault, "admitting job {job_id}");
            q = BenchmarkEngineWithSignerQ::<InlineBenchmarkSigner<4, 2>> {
                signer: crate::SignerTopOutput::default(),
                control,
                data,
            };
        }
        assert_eq!(q.control.accepted, b64(12));
        assert_eq!(
            benchmark_scoreboard_audit_kernel(BenchmarkScoreboardAuditInput {
                live_jobs: q.control.live_jobs,
            })
            .live_count,
            b4(12)
        );

        let mut terminal = BenchmarkEngineOutput::default();
        for job_id in 0..13_u32 {
            if job_id == 1 {
                let mut signer = crate::SignerTopOutput::default();
                signer.start_ready = true;
                signer.start_accepted = true;
                signer.start_cluster = b2(0);
                signer.cluster_start_ready[0] = true;
                let (output, control, data) = engine_transition(q, signer);
                assert!(
                    !output.fault,
                    "thirteenth job reuses the retired cluster-zero slot"
                );
                q = BenchmarkEngineWithSignerQ::<InlineBenchmarkSigner<4, 2>> {
                    signer: crate::SignerTopOutput::default(),
                    control,
                    data,
                };
            }
            let actual_job = if job_id == 0 { 0 } else { job_id };
            let cluster = (actual_job % 3) as u8;
            for beat in 0..SIGNER_FRAME_BEATS {
                let frame = canonical_output(actual_job, cluster, beat);
                software_checksum_fold(&mut software_checksum, frame, beat);
                let mut signer = crate::SignerTopOutput::default();
                signer.output_valid = true;
                signer.output = frame;
                signer.delivered_final = beat + 1 == SIGNER_FRAME_BEATS;
                let (output, control, data) = engine_transition(q, signer);
                assert!(!output.fault, "job {actual_job}, beat {beat}");
                terminal = output;
                q = BenchmarkEngineWithSignerQ::<InlineBenchmarkSigner<4, 2>> {
                    signer: crate::SignerTopOutput::default(),
                    control,
                    data,
                };
            }
        }

        assert!(terminal.done);
        assert!(!terminal.busy);
        assert_eq!(terminal.accepted, b64(13));
        assert_eq!(terminal.completed, b64(13));
        assert_eq!(terminal.errors, b64(0));
        assert_eq!(terminal.beats, b64((13 * SIGNER_FRAME_BEATS) as u128));
        assert!(terminal.completion_span_cycles > b64(0));
        assert_eq!(terminal.checksum.map(raw32), software_checksum);
        assert!(
            benchmark_scoreboard_audit_kernel(BenchmarkScoreboardAuditInput {
                live_jobs: q.control.live_jobs,
            })
            .empty
        );
    }

    #[test]
    fn nonce_index_payload_matches_an_independent_software_oracle() {
        let nonce_prefix = [
            b32(0x0123_4567),
            b32(0x89ab_cdef),
            b32(0x1020_3040),
            b32(0x5060_7080),
            b32(0x90a0_b0c0),
            b32(0xd0e0_f000),
        ];
        let software_nonce = nonce_prefix.map(raw32);
        for offset in 0..33_u64 {
            let index = 0x0102_0304_ffff_ff00_u64 + offset;
            let hardware = benchmark_job_material_kernel(nonce_prefix, b64(index as u128));
            let mut seed = [0_u8; 32];
            for (word, value) in software_nonce.iter().enumerate() {
                seed[word * 4..word * 4 + 4].copy_from_slice(&value.to_le_bytes());
            }
            seed[24..].copy_from_slice(&index.to_be_bytes());
            assert_eq!(hardware.private_seed.map(raw8), seed);
            assert_eq!(hardware.message.map(raw8), seed.map(|byte| byte ^ 0xa5));
        }
    }

    #[test]
    fn axi_w_before_aw_and_simultaneous_aw_w_preserve_acceptance_state() {
        let busy_engine = BenchmarkEngineOutput {
            busy: true,
            ..BenchmarkEngineOutput::default()
        };
        let initial_config = AxiLiteBenchmarkConfig {
            batch: b32(7),
            ..AxiLiteBenchmarkConfig::default()
        };
        let (_output, w_control, w_config) = axi_transition(
            axi_q(
                busy_engine,
                AxiLiteBenchmarkControl::default(),
                initial_config,
            ),
            AxiLiteBenchmarkInput {
                w_valid: true,
                w_data: b32(99),
                w_strb: b4(0xf),
                ..AxiLiteBenchmarkInput::default()
            },
        );
        assert!(w_control.w_pending);
        assert!(w_control.w_locked_at_accept);

        let idle_engine = BenchmarkEngineOutput {
            launch_ready: true,
            ..BenchmarkEngineOutput::default()
        };
        let (_output, paired_control, paired_config) = axi_transition(
            axi_q(idle_engine, w_control, w_config),
            AxiLiteBenchmarkInput {
                aw_valid: true,
                aw_addr: b12(REG_BATCH as u128),
                ..AxiLiteBenchmarkInput::default()
            },
        );
        assert!(paired_control.aw_pending);
        assert!(!paired_control.aw_locked_at_accept);
        let (_output, rejected_control, rejected_config) = axi_transition(
            axi_q(idle_engine, paired_control, paired_config),
            AxiLiteBenchmarkInput::default(),
        );
        assert!(rejected_control.b_valid);
        assert_eq!(rejected_control.b_resp, b2(AXI_RESP_SLVERR as u128));
        assert_eq!(rejected_config.batch, b32(7));

        let (_output, simultaneous_control, simultaneous_config) = axi_transition(
            axi_q(
                idle_engine,
                AxiLiteBenchmarkControl::default(),
                initial_config,
            ),
            AxiLiteBenchmarkInput {
                aw_valid: true,
                aw_addr: b12(REG_BATCH as u128),
                w_valid: true,
                w_data: b32(123),
                w_strb: b4(0xf),
                ..AxiLiteBenchmarkInput::default()
            },
        );
        assert!(simultaneous_control.aw_pending);
        assert!(simultaneous_control.w_pending);
        let (_output, accepted_control, accepted_config) = axi_transition(
            axi_q(idle_engine, simultaneous_control, simultaneous_config),
            AxiLiteBenchmarkInput::default(),
        );
        assert_eq!(accepted_control.b_resp, b2(AXI_RESP_OKAY as u128));
        assert_eq!(accepted_config.batch, b32(123));
    }

    #[test]
    fn axi_rejects_misaligned_read_only_and_busy_accepted_writes() {
        for address in [REG_BATCH + 1, REG_ABI_VERSION, REG_STATUS] {
            let control = AxiLiteBenchmarkControl {
                aw_pending: true,
                aw_addr: b12(address as u128),
                w_pending: true,
                w_data: b32(0xfeed_face),
                w_strb: b4(0xf),
                ..AxiLiteBenchmarkControl::default()
            };
            let config = AxiLiteBenchmarkConfig {
                batch: b32(17),
                ..AxiLiteBenchmarkConfig::default()
            };
            let (_output, next_control, next_config) = axi_transition(
                axi_q(BenchmarkEngineOutput::default(), control, config),
                AxiLiteBenchmarkInput::default(),
            );
            assert_eq!(next_control.b_resp, b2(AXI_RESP_SLVERR as u128));
            assert_eq!(next_config, config);
        }

        for address in [REG_AP_CTRL, REG_BATCH, REG_NONCE_0, REG_BASE_LO] {
            let control = AxiLiteBenchmarkControl {
                aw_pending: true,
                aw_addr: b12(address as u128),
                aw_locked_at_accept: true,
                w_pending: true,
                w_data: b32(1),
                w_strb: b4(0xf),
                ..AxiLiteBenchmarkControl::default()
            };
            let (_output, next_control, _) = axi_transition(
                axi_q(
                    BenchmarkEngineOutput::default(),
                    control,
                    AxiLiteBenchmarkConfig::default(),
                ),
                AxiLiteBenchmarkInput::default(),
            );
            assert_eq!(next_control.b_resp, b2(AXI_RESP_SLVERR as u128));
            assert!(!next_control.start_pending);
        }
    }

    #[test]
    fn terminal_cycle_is_idle_but_an_earlier_busy_acceptance_stays_locked() {
        let terminal_engine = BenchmarkEngineOutput {
            done: true,
            launch_ready: false,
            ..BenchmarkEngineOutput::default()
        };
        let (_output, captured, config) = axi_transition(
            axi_q(
                terminal_engine,
                AxiLiteBenchmarkControl::default(),
                AxiLiteBenchmarkConfig::default(),
            ),
            AxiLiteBenchmarkInput {
                aw_valid: true,
                aw_addr: b12(REG_BATCH as u128),
                w_valid: true,
                w_data: b32(5),
                w_strb: b4(0xf),
                ..AxiLiteBenchmarkInput::default()
            },
        );
        assert!(!captured.aw_locked_at_accept);
        assert!(!captured.w_locked_at_accept);
        assert!(captured.done);
        let idle_engine = BenchmarkEngineOutput {
            launch_ready: true,
            ..BenchmarkEngineOutput::default()
        };
        let (_output, decoded, config) = axi_transition(
            axi_q(idle_engine, captured, config),
            AxiLiteBenchmarkInput::default(),
        );
        assert_eq!(decoded.b_resp, b2(AXI_RESP_OKAY as u128));
        assert_eq!(config.batch, b32(5));

        let busy_snapshot = AxiLiteBenchmarkControl {
            aw_pending: true,
            aw_addr: b12(REG_BATCH as u128),
            aw_locked_at_accept: true,
            w_pending: true,
            w_data: b32(9),
            w_strb: b4(0xf),
            ..AxiLiteBenchmarkControl::default()
        };
        let (_output, rejected, unchanged) = axi_transition(
            axi_q(idle_engine, busy_snapshot, config),
            AxiLiteBenchmarkInput::default(),
        );
        assert_eq!(rejected.b_resp, b2(AXI_RESP_SLVERR as u128));
        assert_eq!(unchanged.batch, b32(5));
    }

    #[test]
    fn overflow_rejection_preserves_base_and_interrupt_events_win_races() {
        let base = b64(u64::MAX as u128 - 1);
        let config = AxiLiteBenchmarkConfig {
            batch: b32(2),
            base_index: base,
            ..AxiLiteBenchmarkConfig::default()
        };
        let launch_rejected = BenchmarkEngineOutput {
            launch_rejected: true,
            reject_code: b8(BENCHMARK_REJECT_INDEX_OVERFLOW as u128),
            done: true,
            ..BenchmarkEngineOutput::default()
        };
        let (_output, rejected_control, rejected_config) = axi_transition(
            axi_q(
                launch_rejected,
                AxiLiteBenchmarkControl {
                    start_pending: true,
                    ..AxiLiteBenchmarkControl::default()
                },
                config,
            ),
            AxiLiteBenchmarkInput::default(),
        );
        assert_eq!(rejected_config.base_index, base);
        assert!(!rejected_control.start_pending);
        assert_eq!(
            rejected_control.last_reject_code,
            b8(BENCHMARK_REJECT_INDEX_OVERFLOW as u128)
        );

        let race_control = AxiLiteBenchmarkControl {
            aw_pending: true,
            aw_addr: b12(REG_ISR as u128),
            w_pending: true,
            w_data: b32(3),
            w_strb: b4(1),
            gie: true,
            ier: b2(3),
            isr: b2(3),
            ..AxiLiteBenchmarkControl::default()
        };
        let events = BenchmarkEngineOutput {
            done: true,
            fault: true,
            ..BenchmarkEngineOutput::default()
        };
        let (race_output, raced, _) = axi_transition(
            axi_q(events, race_control, config),
            AxiLiteBenchmarkInput::default(),
        );
        assert!(race_output.interrupt);
        assert!(raced.done);
        assert!(raced.fault_seen);
        assert_eq!(raced.isr, b2(3), "new events win a same-cycle ISR toggle");

        let clear_done = AxiLiteBenchmarkControl {
            done: true,
            ..AxiLiteBenchmarkControl::default()
        };
        let (_output, done_wins, _) = axi_transition(
            axi_q(events, clear_done, config),
            AxiLiteBenchmarkInput {
                ar_valid: true,
                ar_addr: b12(REG_AP_CTRL as u128),
                ..AxiLiteBenchmarkInput::default()
            },
        );
        assert!(done_wins.done, "new AP_DONE wins clear-on-read");

        let seen_fault = AxiLiteBenchmarkControl {
            aw_pending: true,
            aw_addr: b12(REG_ISR as u128),
            w_pending: true,
            w_data: b32(2),
            w_strb: b4(1),
            isr: b2(2),
            fault_seen: true,
            ..AxiLiteBenchmarkControl::default()
        };
        let (_output, cleared, _) = axi_transition(
            axi_q(events, seen_fault, config),
            AxiLiteBenchmarkInput::default(),
        );
        assert_eq!(
            cleared.isr,
            b2(1),
            "fault does not reassert after fault_seen"
        );
    }

    #[test]
    fn gie_and_ier_writes_gate_the_registered_isr_level_without_losing_events() {
        let gie_write = AxiLiteBenchmarkControl {
            aw_pending: true,
            aw_addr: b12(REG_GIE as u128),
            w_pending: true,
            w_data: b32(1),
            w_strb: b4(1),
            ier: b2(3),
            isr: b2(1),
            ..AxiLiteBenchmarkControl::default()
        };
        let (before_gie, gie_enabled, config) = axi_transition(
            axi_q(
                BenchmarkEngineOutput::default(),
                gie_write,
                AxiLiteBenchmarkConfig::default(),
            ),
            AxiLiteBenchmarkInput::default(),
        );
        assert!(
            !before_gie.interrupt,
            "GIE takes effect through registered state"
        );
        assert!(gie_enabled.gie);

        let (after_gie, _, _) = axi_transition(
            axi_q(
                BenchmarkEngineOutput::default(),
                AxiLiteBenchmarkControl {
                    b_valid: false,
                    ..gie_enabled
                },
                config,
            ),
            AxiLiteBenchmarkInput::default(),
        );
        assert!(after_gie.interrupt);

        let ier_disable = AxiLiteBenchmarkControl {
            aw_pending: true,
            aw_addr: b12(REG_IER as u128),
            w_pending: true,
            w_data: b32(0),
            w_strb: b4(1),
            gie: true,
            ier: b2(3),
            isr: b2(0),
            ..AxiLiteBenchmarkControl::default()
        };
        let done_event = BenchmarkEngineOutput {
            done: true,
            ..BenchmarkEngineOutput::default()
        };
        let (_before_disable, disabled, _) = axi_transition(
            axi_q(done_event, ier_disable, config),
            AxiLiteBenchmarkInput::default(),
        );
        assert_eq!(disabled.ier, b2(0));
        assert_eq!(disabled.isr, b2(1), "done remains sticky while masked");
        let (masked, _, _) = axi_transition(
            axi_q(
                BenchmarkEngineOutput::default(),
                AxiLiteBenchmarkControl {
                    b_valid: false,
                    ..disabled
                },
                config,
            ),
            AxiLiteBenchmarkInput::default(),
        );
        assert!(!masked.interrupt);
    }

    #[test]
    fn byte_strobes_and_read_map_are_exact() {
        assert_eq!(
            benchmark_merge_write_kernel(b32(0x1122_3344), b32(0xaabb_ccdd), b4(0b0101)),
            b32(0x11bb_33dd)
        );
        let mut engine = BenchmarkEngineOutput::default();
        engine.completed = b64(0x0123_4567_89ab_cdef);
        engine.checksum[15] = b32(0xfeed_face);
        let common = BenchmarkReadDecodeInput {
            engine,
            ..BenchmarkReadDecodeInput::default()
        };
        let completed_low = benchmark_read_decode_kernel(BenchmarkReadDecodeInput {
            address: b12(0x050),
            ..common
        });
        let completed_high = benchmark_read_decode_kernel(BenchmarkReadDecodeInput {
            address: b12(0x054),
            ..common
        });
        let checksum_last = benchmark_read_decode_kernel(BenchmarkReadDecodeInput {
            address: b12(0x0cc),
            ..common
        });
        let misaligned = benchmark_read_decode_kernel(BenchmarkReadDecodeInput {
            address: b12(0x051),
            ..common
        });
        assert_eq!(raw32(completed_low.data), 0x89ab_cdef);
        assert_eq!(raw32(completed_high.data), 0x0123_4567);
        assert_eq!(raw32(checksum_last.data), 0xfeed_face);
        assert!(!misaligned.valid);
    }
}