u280_shell_rhdl/

shell.rs

//! Production U280 shell controller and typed signer boundary.

use rhdl::prelude::*;
use rhdl_fpga::core::{dff::DFF, ram::synchronous::Write as SyncBramWrite};
use rhdl_primitives::NoResetDff;
use wots_rhdl::{SignerOutputBeat, SignerTopInput, SignerTopOutput};

use crate::{
    abi::{
        self, ERROR_BUFFER, ERROR_CONFIGURATION, ERROR_COUNT, ERROR_FRAME, ERROR_INPUT_AXI,
        ERROR_OUTPUT_AXI, ERROR_SCOREBOARD, ERROR_SIGNER_COMPLETION, ERROR_SIGNER_FAULT,
        ERROR_SOFT_ABORT, ERROR_SUMMARY_AXI, OUTPUT_AXI_LEN, TERMINAL_ABORTED_BITS,
        TERMINAL_CONFIGURATION_BITS, TERMINAL_INPUT_AXI_BITS, TERMINAL_OUTPUT_AXI_BITS,
        TERMINAL_PROTOCOL_BITS, TERMINAL_SIGNER_BITS, TERMINAL_SUCCESS_BITS,
        TERMINAL_SUMMARY_AXI_BITS,
    },
    axi::{
        AXI_BURST_INCR, AXI_CACHE_NORMAL, AXI_LOCK_NORMAL, AXI_RESP_DECERR, AXI_RESP_OKAY,
        AXI_RESP_SLVERR, AXI_SIZE_64_BYTES, Axi512ReadKernelToMemory, Axi512ReadMemoryToKernel,
        Axi512WriteKernelToMemory, Axi512WriteMemoryToKernel, AxiLiteHostToKernel,
        AxiLiteKernelToHost, idle_read_master_kernel,
    },
    control::{
        LaunchConfig, RunState, SummaryFields, SummaryWriteStatus, apply_write_strobes_kernel,
        high_word_kernel, last_status_kernel, low_word_kernel, replace_high_word_kernel,
        replace_low_word_kernel, summary_line_kernel, validate_config_kernel,
    },
    frame_store::{
        FRAME_STORE_ADDRESS_BITS, FrameStore, FrameStoreInput, captured_beat_is_canonical_kernel,
        frame_store_address_kernel,
    },
    reader::{InputJob, ReaderState, input_job_address_kernel, input_response_is_canonical_kernel},
    scoreboard::{
        JobEntry, ScoreboardEvents, scoreboard_occupancy_kernel, scoreboard_update_kernel,
    },
    writer::{
        FrameQueue, FrameQueueOperation, MemoryCompletionTiming, WriterState,
        frame_queue_update_kernel, frame_slot_is_reserved_kernel, output_job_address_kernel,
        output_response_is_canonical_kernel, record_memory_completion_kernel,
    },
};

/// Stable generated module name consumed by the wire-only U280 adapter.
pub const U280_HBM_SHELL_MODULE: &str = "hashsigs_u280_hbm_shell_rhdl";

/// Render the complete shell hierarchy without claiming parser or implementation evidence.
///
/// The caller must independently parse, simulate, synthesize, implement, and
/// execute the returned RTL before making claims at those evidence tiers.
///
/// # Errors
///
/// Returns an error when RHDL cannot construct or render the shell descriptor.
pub fn try_u280_hbm_shell_unchecked_verilog() -> Result<String, RHDLError> {
    let descriptor = U280HbmShell::default().descriptor(U280_HBM_SHELL_MODULE.into())?;
    let hdl = descriptor.hdl_unchecked()?;
    Ok(hdl.modules.pretty())
}

/// All external inputs to the RHDL shell.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct HbmShellInput {
    /// AXI4-Lite control slave request channels.
    pub control: AxiLiteHostToKernel,
    /// HBM0 response channels.
    pub input_hbm: Axi512ReadMemoryToKernel,
    /// HBM1 response channels.
    pub output_hbm: Axi512WriteMemoryToKernel,
    /// Separately generated SHA-profile signer outputs.
    pub signer: SignerTopOutput,
}

/// All external outputs from the RHDL shell.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct HbmShellOutput {
    /// AXI4-Lite control slave response channels.
    pub control: AxiLiteKernelToHost,
    /// HBM0 read request channels.
    pub input_hbm: Axi512ReadKernelToMemory,
    /// HBM1 write request channels.
    pub output_hbm: Axi512WriteKernelToMemory,
    /// Inputs to the separately generated SHA-profile signer.
    pub signer: SignerTopInput,
    /// Synchronous signer-only reset, asserted for exactly two drain-complete cycles.
    pub signer_soft_reset: bool,
    /// Level interrupt after global and per-source masking.
    pub interrupt: bool,
}

/// Resettable shell ownership and audit state.
#[allow(clippy::struct_excessive_bools)] // Each bit represents independent protocol ownership.
#[derive(Clone, Copy, Debug, Digital, Eq, PartialEq)]
pub struct ShellControl {
    /// Whole-run state.
    pub run_state: RunState,
    /// Host launch arguments.
    pub config: LaunchConfig,
    /// HLS-compatible sticky completion bit.
    pub ap_done: bool,
    /// Global interrupt enable.
    pub gier: bool,
    /// Done/error interrupt mask.
    pub ier: b2,
    /// Toggle-on-write sticky done/error status.
    pub isr: b2,
    /// Most recent terminal code.
    pub terminal_code: b8,
    /// Sticky union of run error causes.
    pub error_flags: b16,
    /// First job associated with an error.
    pub first_error_job: b32,
    /// First error detail.
    pub first_error_detail: b32,
    /// Terminal summary address was accepted.
    pub summary_aw_handshake: bool,
    /// Terminal summary data was accepted.
    pub summary_w_handshake: bool,
    /// Terminal summary response was drained.
    pub summary_b_handshake: bool,
    /// Terminal summary response was exact ID-zero `OKAY`.
    pub summary_b_canonical: bool,
    /// Independently retained AXI4-Lite write address.
    pub axil_aw_pending: bool,
    /// Retained AXI4-Lite write address.
    pub axil_awaddr: b8,
    /// Configuration/run lock state sampled when the write address transferred.
    pub axil_aw_locked_at_accept: bool,
    /// Independently retained AXI4-Lite write data.
    pub axil_w_pending: bool,
    /// Retained AXI4-Lite write data.
    pub axil_wdata: b32,
    /// Retained AXI4-Lite byte strobes.
    pub axil_wstrb: b4,
    /// Configuration/run lock state sampled when the write data transferred.
    pub axil_w_locked_at_accept: bool,
    /// Retained AXI4-Lite write response.
    pub axil_bvalid: bool,
    /// Retained AXI4-Lite write response code.
    pub axil_bresp: b2,
    /// Retained AXI4-Lite read response.
    pub axil_rvalid: bool,
    /// Retained AXI4-Lite read data.
    pub axil_rdata: b32,
    /// Retained AXI4-Lite read response code.
    pub axil_rresp: b2,
    /// The retained read response came from `AP_CTRL`.
    pub axil_r_ap_ctrl: bool,
    /// HBM0 single-outstanding state.
    pub reader_state: ReaderState,
    /// Sequential job currently owned by the reader.
    pub reader_job: b32,
    /// A checked HBM0 line is retained.
    pub input_job_valid: bool,
    /// Signer ownership table.
    pub scoreboard: [JobEntry; abi::LIVE_JOB_SLOTS],
    /// One registered signer beat is retained before validation.
    pub ingress_valid: bool,
    /// A frame currently owns one BRAM slot.
    pub capture_active: bool,
    /// BRAM slot owned by capture.
    pub capture_slot: b1,
    /// Next capture beat in `0..=34`.
    pub capture_beat: b6,
    /// Frame job identity retained from beat zero.
    pub capture_job: b32,
    /// Frame source cluster retained from beat zero.
    pub capture_cluster: b2,
    /// Oldest-first queue of complete BRAM frames.
    pub frame_queue: FrameQueue,
    /// HBM1 payload writer state.
    pub writer_state: WriterState,
    /// Committed writer slot.
    pub writer_slot: b1,
    /// Committed writer job.
    pub writer_job: b32,
    /// Next data beat to transfer.
    pub writer_beat: b6,
    /// Next BRAM beat to request.
    pub read_issue_beat: b6,
    /// The current BRAM output belongs to the writer prefetch.
    pub read_pending: bool,
    /// Registered write-prefetch occupancy in `0..=2`.
    pub prefetch_count: b2,
    /// A protocol-invalid payload B was drained before final W acceptance.
    pub writer_early_b_drained: bool,
    /// Abort-mode uncommitted-state cleanup has occurred.
    pub abort_cleaned: bool,
    /// Accepted HBM0 addresses.
    pub input_ar_count: b16,
    /// Checked HBM0 responses.
    pub input_r_count: b16,
    /// Signer admissions.
    pub core_admission_count: b16,
    /// Complete canonical frames captured.
    pub frame_capture_count: b16,
    /// Explicit signer error completions.
    pub core_error_count: b16,
    /// Accepted payload write addresses.
    pub payload_aw_count: b16,
    /// Drained payload write responses.
    pub payload_b_count: b16,
    /// Accepted payload data beats.
    pub payload_w_count: b32,
    /// Payloads retired by exact ID-zero `OKAY` B responses.
    pub memory_completed_count: b16,
    /// Canonical payload B retirement timing, excluding the summary response.
    pub memory_completion_timing: MemoryCompletionTiming,
    /// Execute/abort cycle cursor.
    pub run_cycle: b64,
    /// Execute/abort payload interval.
    pub payload_cycles: b64,
    /// Cycles the signer output was unable to enter the ingress register.
    pub output_stall_cycles: b64,
    /// At least one signer admission has occurred.
    pub first_admission_seen: bool,
    /// Cycle of first signer admission.
    pub first_admission_cycle: b64,
    /// At least one complete frame has reached BRAM.
    pub first_capture_seen: bool,
    /// Cycle of first complete frame capture.
    pub first_capture_cycle: b64,
    /// First admission through last complete frame, inclusive.
    pub core_latency_cycles: b64,
    /// First-to-last complete-frame span.
    pub capture_span_cycles: b64,
}

impl Default for ShellControl {
    fn default() -> Self {
        Self {
            run_state: RunState::Idle,
            config: LaunchConfig::default(),
            ap_done: false,
            gier: false,
            ier: b2(0),
            isr: b2(0),
            terminal_code: TERMINAL_SUCCESS_BITS,
            error_flags: b16(0),
            first_error_job: b32(0xffff_ffff),
            first_error_detail: b32(0),
            summary_aw_handshake: false,
            summary_w_handshake: false,
            summary_b_handshake: false,
            summary_b_canonical: false,
            axil_aw_pending: false,
            axil_awaddr: b8(0),
            axil_aw_locked_at_accept: false,
            axil_w_pending: false,
            axil_wdata: b32(0),
            axil_wstrb: b4(0),
            axil_w_locked_at_accept: false,
            axil_bvalid: false,
            axil_bresp: AXI_RESP_OKAY,
            axil_rvalid: false,
            axil_rdata: b32(0),
            axil_rresp: AXI_RESP_OKAY,
            axil_r_ap_ctrl: false,
            reader_state: ReaderState::Idle,
            reader_job: b32(0),
            input_job_valid: false,
            scoreboard: [JobEntry::default(); abi::LIVE_JOB_SLOTS],
            ingress_valid: false,
            capture_active: false,
            capture_slot: b1(0),
            capture_beat: b6(0),
            capture_job: b32(0),
            capture_cluster: b2(0),
            frame_queue: FrameQueue::default(),
            writer_state: WriterState::Idle,
            writer_slot: b1(0),
            writer_job: b32(0),
            writer_beat: b6(0),
            read_issue_beat: b6(0),
            read_pending: false,
            prefetch_count: b2(0),
            writer_early_b_drained: false,
            abort_cleaned: false,
            input_ar_count: b16(0),
            input_r_count: b16(0),
            core_admission_count: b16(0),
            frame_capture_count: b16(0),
            core_error_count: b16(0),
            payload_aw_count: b16(0),
            payload_b_count: b16(0),
            payload_w_count: b32(0),
            memory_completed_count: b16(0),
            memory_completion_timing: MemoryCompletionTiming::default(),
            run_cycle: b64(0),
            payload_cycles: b64(0),
            output_stall_cycles: b64(0),
            first_admission_seen: false,
            first_admission_cycle: b64(0),
            first_capture_seen: false,
            first_capture_cycle: b64(0),
            core_latency_cycles: b64(0),
            capture_span_cycles: b64(0),
        }
    }
}

/// RHDL shell with resetless payload registers and BRAM frame storage.
#[derive(Clone, Debug, Synchronous, SynchronousDQ)]
pub struct U280HbmShell {
    control: DFF<ShellControl>,
    input_job: NoResetDff<InputJob>,
    ingress: NoResetDff<SignerOutputBeat>,
    prefetch0: NoResetDff<[b8; 64]>,
    prefetch1: NoResetDff<[b8; 64]>,
    frame_store: FrameStore,
}

impl Default for U280HbmShell {
    fn default() -> Self {
        Self {
            control: DFF::new(ShellControl::default()),
            input_job: NoResetDff::new(),
            ingress: NoResetDff::new(),
            prefetch0: NoResetDff::new(),
            prefetch1: NoResetDff::new(),
            frame_store: FrameStore::default(),
        }
    }
}

impl SynchronousIO for U280HbmShell {
    type I = HbmShellInput;
    type O = HbmShellOutput;
    type Kernel = u280_hbm_shell_kernel;
}

/// Pack live queue state for the read-only diagnostic register.
#[kernel]
pub fn queue_status_kernel(control: ShellControl) -> b32 {
    let scoreboard: b32 = scoreboard_occupancy_kernel(control.scoreboard).resize();
    let frames: b32 = control.frame_queue.count.resize();
    let reader: b32 = match control.reader_state {
        ReaderState::Idle => b32(0),
        ReaderState::Address => b32(1),
        ReaderState::Response => b32(2),
        ReaderState::Hold => b32(3),
    };
    let writer: b32 = match control.writer_state {
        WriterState::Idle => b32(0),
        WriterState::Address => b32(1),
        WriterState::Data => b32(2),
        WriterState::Response => b32(3),
    };
    scoreboard
        | (frames << 4)
        | (bool_word_kernel(control.ingress_valid) << 6)
        | (bool_word_kernel(control.capture_active) << 7)
        | (reader << 8)
        | (writer << 10)
        | (control.prefetch_count.resize() << 12)
}

/// Convert one control bit to a diagnostic word without a Rust-only cast.
#[kernel]
pub fn bool_word_kernel(value: bool) -> b32 {
    if value { b32(1) } else { b32(0) }
}

/// Transition for the complete U280 transport shell.
#[kernel]
#[allow(
    clippy::assign_op_pattern,
    clippy::field_reassign_with_default,
    clippy::if_not_else,
    clippy::match_same_arms,
    clippy::needless_range_loop,
    clippy::too_many_lines
)] // Preserve the audited fail-first decode, reserved-address inventory, and staged output priority.
pub fn u280_hbm_shell_kernel(
    clock_reset: ClockReset,
    input: HbmShellInput,
    q: U280HbmShellQ,
) -> (HbmShellOutput, U280HbmShellD) {
    let resetting = clock_reset.reset.any();
    let mut control = q.control;
    let mut input_job = q.input_job;
    let mut ingress = q.ingress;
    let mut prefetch0 = q.prefetch0;
    let mut prefetch1 = q.prefetch1;
    let mut frame_store = FrameStoreInput::default();

    let idle_for_registers = q.control.run_state == RunState::Idle;
    let axil_awready = !q.control.axil_aw_pending && !q.control.axil_bvalid;
    let axil_wready = !q.control.axil_w_pending && !q.control.axil_bvalid;
    let axil_arready = !q.control.axil_rvalid;
    let axil_b_handshake = q.control.axil_bvalid && input.control.bready;
    let axil_r_handshake = q.control.axil_rvalid && input.control.rready;
    let mut start_command = false;
    let mut abort_command = false;

    if axil_b_handshake {
        control.axil_bvalid = false;
    }
    if axil_r_handshake {
        control.axil_rvalid = false;
        if q.control.axil_r_ap_ctrl {
            control.ap_done = false;
        }
    }
    if axil_awready && input.control.awvalid {
        control.axil_aw_pending = true;
        control.axil_awaddr = input.control.awaddr;
        control.axil_aw_locked_at_accept = !idle_for_registers;
    }
    if axil_wready && input.control.wvalid {
        control.axil_w_pending = true;
        control.axil_wdata = input.control.wdata;
        control.axil_wstrb = input.control.wstrb;
        control.axil_w_locked_at_accept = !idle_for_registers;
    }

    if q.control.axil_aw_pending && q.control.axil_w_pending && !q.control.axil_bvalid {
        let address = q.control.axil_awaddr;
        let aligned = address & b8(3) == b8(0);
        let lane0_written = q.control.axil_wstrb & b4(1) != b4(0);
        let locked = q.control.axil_aw_locked_at_accept
            || q.control.axil_w_locked_at_accept
            || !idle_for_registers;
        let mut response = AXI_RESP_OKAY;
        if !aligned {
            response = AXI_RESP_DECERR;
        } else {
            match address {
                Bits::<8>(0x00) => {
                    if lane0_written && q.control.axil_wdata & b32(1) != b32(0) {
                        if !locked {
                            start_command = true;
                        } else {
                            response = AXI_RESP_SLVERR;
                        }
                    }
                }
                Bits::<8>(0x04) => {
                    if lane0_written {
                        control.gier = q.control.axil_wdata & b32(1) != b32(0);
                    }
                }
                Bits::<8>(0x08) => {
                    if lane0_written {
                        control.ier = q.control.axil_wdata.resize();
                    }
                }
                Bits::<8>(0x0c) => {
                    if lane0_written {
                        let toggles: b2 = q.control.axil_wdata.resize();
                        control.isr = q.control.isr ^ toggles;
                    }
                }
                Bits::<8>(0x10) => {
                    if !locked {
                        control.config.input_base = replace_low_word_kernel(
                            q.control.config.input_base,
                            q.control.axil_wdata,
                            q.control.axil_wstrb,
                        );
                    } else {
                        response = AXI_RESP_SLVERR;
                    }
                }
                Bits::<8>(0x14) => {
                    if !locked {
                        control.config.input_base = replace_high_word_kernel(
                            q.control.config.input_base,
                            q.control.axil_wdata,
                            q.control.axil_wstrb,
                        );
                    } else {
                        response = AXI_RESP_SLVERR;
                    }
                }
                Bits::<8>(0x1c) => {
                    if !locked {
                        control.config.output_base = replace_low_word_kernel(
                            q.control.config.output_base,
                            q.control.axil_wdata,
                            q.control.axil_wstrb,
                        );
                    } else {
                        response = AXI_RESP_SLVERR;
                    }
                }
                Bits::<8>(0x20) => {
                    if !locked {
                        control.config.output_base = replace_high_word_kernel(
                            q.control.config.output_base,
                            q.control.axil_wdata,
                            q.control.axil_wstrb,
                        );
                    } else {
                        response = AXI_RESP_SLVERR;
                    }
                }
                Bits::<8>(0x28) => {
                    if !locked {
                        control.config.summary_base = replace_low_word_kernel(
                            q.control.config.summary_base,
                            q.control.axil_wdata,
                            q.control.axil_wstrb,
                        );
                    } else {
                        response = AXI_RESP_SLVERR;
                    }
                }
                Bits::<8>(0x2c) => {
                    if !locked {
                        control.config.summary_base = replace_high_word_kernel(
                            q.control.config.summary_base,
                            q.control.axil_wdata,
                            q.control.axil_wstrb,
                        );
                    } else {
                        response = AXI_RESP_SLVERR;
                    }
                }
                Bits::<8>(0x34) => {
                    if !locked {
                        control.config.batch = apply_write_strobes_kernel(
                            q.control.config.batch,
                            q.control.axil_wdata,
                            q.control.axil_wstrb,
                        );
                    } else {
                        response = AXI_RESP_SLVERR;
                    }
                }
                Bits::<8>(0x38) => {
                    if !locked {
                        control.config.abi_word = apply_write_strobes_kernel(
                            q.control.config.abi_word,
                            q.control.axil_wdata,
                            q.control.axil_wstrb,
                        );
                    } else {
                        response = AXI_RESP_SLVERR;
                    }
                }
                Bits::<8>(0x3c) => {
                    if !locked {
                        control.config.nonce = replace_low_word_kernel(
                            q.control.config.nonce,
                            q.control.axil_wdata,
                            q.control.axil_wstrb,
                        );
                    } else {
                        response = AXI_RESP_SLVERR;
                    }
                }
                Bits::<8>(0x40) => {
                    if !locked {
                        control.config.nonce = replace_high_word_kernel(
                            q.control.config.nonce,
                            q.control.axil_wdata,
                            q.control.axil_wstrb,
                        );
                    } else {
                        response = AXI_RESP_SLVERR;
                    }
                }
                Bits::<8>(0x18) => {}
                Bits::<8>(0x24) => {}
                Bits::<8>(0x30) => {}
                Bits::<8>(0x44) => {}
                Bits::<8>(0x48) => {
                    if lane0_written && q.control.axil_wdata & b32(1) != b32(0) {
                        let abortable_now = q.control.run_state == RunState::Validate
                            || q.control.run_state == RunState::Execute;
                        if locked && abortable_now {
                            abort_command = true;
                        } else {
                            // A split command accepted during a run must never
                            // turn into a successful no-op after that run has
                            // crossed its terminal boundary.
                            response = AXI_RESP_SLVERR;
                        }
                    }
                }
                Bits::<8>(0x4c) => response = AXI_RESP_SLVERR,
                Bits::<8>(0x50) => response = AXI_RESP_SLVERR,
                Bits::<8>(0x54) => response = AXI_RESP_SLVERR,
                Bits::<8>(0x58) => response = AXI_RESP_SLVERR,
                Bits::<8>(0x5c) => response = AXI_RESP_SLVERR,
                Bits::<8>(0x60) => response = AXI_RESP_SLVERR,
                Bits::<8>(0x64) => response = AXI_RESP_SLVERR,
                Bits::<8>(0x68) => response = AXI_RESP_SLVERR,
                Bits::<8>(0x6c) => response = AXI_RESP_SLVERR,
                Bits::<8>(0x70) => response = AXI_RESP_SLVERR,
                Bits::<8>(0x74) => response = AXI_RESP_SLVERR,
                Bits::<8>(0x78) => response = AXI_RESP_SLVERR,
                Bits::<8>(0x7c) => response = AXI_RESP_SLVERR,
                Bits::<8>(0x80) => response = AXI_RESP_SLVERR,
                _ => {
                    response = AXI_RESP_DECERR;
                }
            }
        }
        control.axil_aw_pending = false;
        control.axil_aw_locked_at_accept = false;
        control.axil_w_pending = false;
        control.axil_w_locked_at_accept = false;
        control.axil_bvalid = true;
        control.axil_bresp = response;
    }

    if axil_arready && input.control.arvalid {
        let address = input.control.araddr;
        let aligned = address & b8(3) == b8(0);
        let idle = q.control.run_state == RunState::Idle || q.control.run_state == RunState::Done;
        let ready = q.control.run_state == RunState::Idle;
        let ap_ctrl: b32 = (bool_word_kernel(q.control.ap_done) << 1)
            | (bool_word_kernel(idle) << 2)
            | (bool_word_kernel(ready) << 3);
        let last_status = last_status_kernel(
            q.control.terminal_code,
            q.control.error_flags,
            SummaryWriteStatus {
                aw: q.control.summary_aw_handshake,
                w: q.control.summary_w_handshake,
                b: q.control.summary_b_handshake,
                b_canonical: q.control.summary_b_canonical,
            },
        );
        let progress0: b32 = q.control.core_admission_count.resize()
            | (q.control.frame_capture_count.resize() << 16);
        let progress1: b32 =
            q.control.memory_completed_count.resize() | (q.control.core_error_count.resize() << 16);
        let mut response = AXI_RESP_OKAY;
        let mut data = b32(0);
        let mut is_ap_ctrl = false;
        if !aligned {
            response = AXI_RESP_DECERR;
        } else {
            match address {
                Bits::<8>(0x00) => {
                    data = ap_ctrl;
                    is_ap_ctrl = true;
                }
                Bits::<8>(0x04) => data = bool_word_kernel(q.control.gier),
                Bits::<8>(0x08) => data = q.control.ier.resize(),
                Bits::<8>(0x0c) => data = q.control.isr.resize(),
                Bits::<8>(0x10) => data = low_word_kernel(q.control.config.input_base),
                Bits::<8>(0x14) => data = high_word_kernel(q.control.config.input_base),
                Bits::<8>(0x1c) => data = low_word_kernel(q.control.config.output_base),
                Bits::<8>(0x20) => data = high_word_kernel(q.control.config.output_base),
                Bits::<8>(0x28) => data = low_word_kernel(q.control.config.summary_base),
                Bits::<8>(0x2c) => data = high_word_kernel(q.control.config.summary_base),
                Bits::<8>(0x34) => data = q.control.config.batch,
                Bits::<8>(0x38) => data = q.control.config.abi_word,
                Bits::<8>(0x3c) => data = low_word_kernel(q.control.config.nonce),
                Bits::<8>(0x40) => data = high_word_kernel(q.control.config.nonce),
                Bits::<8>(0x18) => {}
                Bits::<8>(0x24) => {}
                Bits::<8>(0x30) => {}
                Bits::<8>(0x44) => {}
                Bits::<8>(0x48) => {}
                Bits::<8>(0x4c) => data = last_status,
                Bits::<8>(0x50) => data = progress0,
                Bits::<8>(0x54) => data = progress1,
                Bits::<8>(0x58) => data = low_word_kernel(q.control.output_stall_cycles),
                Bits::<8>(0x5c) => data = high_word_kernel(q.control.output_stall_cycles),
                Bits::<8>(0x60) => data = queue_status_kernel(q.control),
                Bits::<8>(0x64) => data = q.control.first_error_job,
                Bits::<8>(0x68) => data = q.control.first_error_detail,
                Bits::<8>(0x6c) => {
                    data = low_word_kernel(q.control.memory_completion_timing.first);
                }
                Bits::<8>(0x70) => {
                    data = high_word_kernel(q.control.memory_completion_timing.first);
                }
                Bits::<8>(0x74) => {
                    data = low_word_kernel(q.control.memory_completion_timing.last);
                }
                Bits::<8>(0x78) => {
                    data = high_word_kernel(q.control.memory_completion_timing.last);
                }
                Bits::<8>(0x7c) => {
                    data = low_word_kernel(q.control.memory_completion_timing.span);
                }
                Bits::<8>(0x80) => {
                    data = high_word_kernel(q.control.memory_completion_timing.span);
                }
                _ => response = AXI_RESP_DECERR,
            }
        }
        control.axil_rvalid = true;
        control.axil_rdata = data;
        control.axil_rresp = response;
        control.axil_r_ap_ctrl = is_ap_ctrl;
    }

    if q.control.run_state == RunState::Done {
        control.run_state = RunState::Idle;
    }

    if start_command {
        let retained_config = control.config;
        let retained_gier = control.gier;
        let retained_ier = control.ier;
        let retained_isr = control.isr;
        let retained_axil_aw_pending = control.axil_aw_pending;
        let retained_axil_awaddr = control.axil_awaddr;
        let retained_axil_aw_locked_at_accept = control.axil_aw_locked_at_accept;
        let retained_axil_w_pending = control.axil_w_pending;
        let retained_axil_wdata = control.axil_wdata;
        let retained_axil_wstrb = control.axil_wstrb;
        let retained_axil_w_locked_at_accept = control.axil_w_locked_at_accept;
        let retained_axil_bvalid = control.axil_bvalid;
        let retained_axil_bresp = control.axil_bresp;
        let retained_axil_rvalid = control.axil_rvalid;
        let retained_axil_rdata = control.axil_rdata;
        let retained_axil_rresp = control.axil_rresp;
        let retained_axil_r_ap_ctrl = control.axil_r_ap_ctrl;
        control = ShellControl::default();
        control.config = retained_config;
        control.gier = retained_gier;
        control.ier = retained_ier;
        control.isr = retained_isr;
        control.axil_aw_pending = retained_axil_aw_pending;
        control.axil_awaddr = retained_axil_awaddr;
        control.axil_aw_locked_at_accept = retained_axil_aw_locked_at_accept;
        control.axil_w_pending = retained_axil_w_pending;
        control.axil_wdata = retained_axil_wdata;
        control.axil_wstrb = retained_axil_wstrb;
        control.axil_w_locked_at_accept = retained_axil_w_locked_at_accept;
        control.axil_bvalid = retained_axil_bvalid;
        control.axil_bresp = retained_axil_bresp;
        control.axil_rvalid = retained_axil_rvalid;
        control.axil_rdata = retained_axil_rdata;
        control.axil_rresp = retained_axil_rresp;
        control.axil_r_ap_ctrl = retained_axil_r_ap_ctrl;
        control.run_state = RunState::Validate;
        control.ap_done = false;
    }

    let scoreboard_occupancy = scoreboard_occupancy_kernel(q.control.scoreboard);
    let slot0_free = !frame_slot_is_reserved_kernel(
        q.control.frame_queue,
        q.control.capture_active,
        q.control.capture_slot,
        b1(0),
    );
    let slot1_free = !frame_slot_is_reserved_kernel(
        q.control.frame_queue,
        q.control.capture_active,
        q.control.capture_slot,
        b1(1),
    );
    let capture_has_capacity = q.control.capture_active || slot0_free || slot1_free;
    let ingress_consumed = q.control.run_state == RunState::Execute
        && q.control.error_flags == b16(0)
        && q.control.ingress_valid
        && !abort_command;
    let ingress_elastic_capacity = !q.control.ingress_valid || ingress_consumed;
    let hold_final_without_refill = q.control.ingress_valid && q.ingress.beat.last;
    let signer_output_ready = q.control.run_state == RunState::Execute
        && q.control.error_flags == b16(0)
        && capture_has_capacity
        && ingress_elastic_capacity
        && !hold_final_without_refill
        && !abort_command;
    let signer_start_valid = q.control.run_state == RunState::Execute
        && q.control.error_flags == b16(0)
        && q.control.input_job_valid
        && scoreboard_occupancy < b4(abi::LIVE_JOB_SLOTS as u128)
        && !abort_command;
    let signer_start_handshake = signer_start_valid && input.signer.start_ready;
    let signer_output_handshake = signer_output_ready && input.signer.output_valid;
    let signer_error_ready = q.control.run_state == RunState::Execute
        && q.control.error_flags == b16(0)
        && !abort_command;
    let signer_error_handshake = signer_error_ready && input.signer.error_valid;
    let transport_active = q.control.run_state == RunState::Validate
        || q.control.run_state == RunState::Execute
        || q.control.run_state == RunState::AbortDrain;
    let input_ar_handshake =
        q.control.reader_state == ReaderState::Address && input.input_hbm.arready && !resetting;
    let input_response_owned =
        q.control.reader_state == ReaderState::Response || input_ar_handshake;
    let input_r_handshake = input_response_owned && input.input_hbm.rvalid && !resetting;
    let writer_w_handshake = q.control.writer_state == WriterState::Data
        && q.control.prefetch_count != b2(0)
        && input.output_hbm.wready
        && !resetting;
    let writer_final_w_handshake = writer_w_handshake && q.control.writer_beat == b6(34);
    let output_response_owned = q.control.writer_state == WriterState::Response
        || (writer_final_w_handshake && !q.control.writer_early_b_drained);
    let output_b_handshake = output_response_owned && input.output_hbm.bvalid && !resetting;
    let early_final_b_handshake = q.control.writer_state == WriterState::Data
        && q.control.writer_beat == b6(34)
        && !q.control.writer_early_b_drained
        && input.output_hbm.bvalid
        && !writer_final_w_handshake
        && !resetting;
    let summary_aw_handshake =
        q.control.run_state == RunState::SummaryAw && input.output_hbm.awready && !resetting;
    let summary_w_handshake = q.control.run_state == RunState::SummaryW
        && q.control.summary_aw_handshake
        && input.output_hbm.wready
        && !resetting;
    // A response belongs to the terminal write only after both request
    // channels have transferred.  Preserve the legal zero-latency case in
    // which W and B transfer together, but never let an older held B become
    // evidence for a write whose W channel is still stalled.
    let summary_response_owned = (q.control.run_state == RunState::SummaryB
        && q.control.summary_aw_handshake
        && q.control.summary_w_handshake)
        || summary_w_handshake;
    let summary_b_handshake = summary_response_owned && input.output_hbm.bvalid && !resetting;
    let summary_sequence_active = q.control.run_state == RunState::CoreReset0
        || q.control.run_state == RunState::CoreReset1
        || q.control.run_state == RunState::SummaryAw
        || q.control.run_state == RunState::SummaryW
        || q.control.run_state == RunState::SummaryB;
    let premature_summary_b_handshake =
        summary_sequence_active && !summary_response_owned && input.output_hbm.bvalid && !resetting;
    let unexpected_input_r = transport_active && input.input_hbm.rvalid && !input_response_owned;
    let unexpected_output_b = transport_active && input.output_hbm.bvalid && !output_response_owned;
    let drain_orphan_input_r = transport_active
        && (q.control.reader_state == ReaderState::Idle
            || q.control.reader_state == ReaderState::Hold);
    let drain_orphan_output_b = transport_active && q.control.writer_state == WriterState::Idle;

    let mut new_failure = false;
    let mut new_error_flags = b16(0);
    let mut new_terminal_code = TERMINAL_SUCCESS_BITS;
    let mut new_error_job = b32(0xffff_ffff);
    let mut new_error_detail = b32(0);
    let mut scoreboard_events = ScoreboardEvents::default();
    let mut enqueue_frame = false;
    let mut enqueue_slot = b1(0);
    let mut enqueue_job = b32(0);
    let mut dequeue_frame = false;

    if q.control.run_state == RunState::Validate {
        let validation = validate_config_kernel(q.control.config);
        if validation.valid && !abort_command {
            control.run_state = RunState::Execute;
            if q.control.config.batch != b32(0) {
                control.reader_state = ReaderState::Address;
            }
        } else if !validation.valid {
            if !new_failure {
                new_terminal_code = TERMINAL_CONFIGURATION_BITS;
                new_error_job = b32(0xffff_ffff);
                new_error_detail = validation.detail;
            }
            new_failure = true;
            new_error_flags = new_error_flags | b16(ERROR_CONFIGURATION);
        }
    }

    if q.control.run_state == RunState::Execute || q.control.run_state == RunState::AbortDrain {
        control.run_cycle = q.control.run_cycle + b64(1);
        control.payload_cycles = q.control.payload_cycles + b64(1);
    }

    if unexpected_input_r {
        if !new_failure {
            new_terminal_code = TERMINAL_INPUT_AXI_BITS;
            new_error_job = if q.control.reader_state == ReaderState::Address {
                q.control.reader_job
            } else {
                b32(0xffff_ffff)
            };
            new_error_detail = b32(0x6001)
                | (input.input_hbm.rresp.resize() << 16)
                | (input.input_hbm.rid.resize() << 24)
                | (bool_word_kernel(input.input_hbm.rlast) << 25);
        }
        new_failure = true;
        new_error_flags = new_error_flags | b16(ERROR_INPUT_AXI);
        if q.control.reader_state == ReaderState::Address && !input_ar_handshake {
            // RREADY is pre-armed from the registered Address state.  If the
            // response arrives before AR acceptance, it is drained as an
            // orphan and no read transaction remains to complete.
            control.reader_state = ReaderState::Idle;
        }
    }
    if unexpected_output_b {
        if !new_failure {
            new_terminal_code = TERMINAL_OUTPUT_AXI_BITS;
            new_error_job = if q.control.writer_state == WriterState::Idle {
                b32(0xffff_ffff)
            } else {
                q.control.writer_job
            };
            new_error_detail = b32(0x6002)
                | (input.output_hbm.bresp.resize() << 16)
                | (input.output_hbm.bid.resize() << 24);
        }
        new_failure = true;
        new_error_flags = new_error_flags | b16(ERROR_OUTPUT_AXI);
    }
    if premature_summary_b_handshake {
        if !new_failure {
            new_terminal_code = TERMINAL_SUMMARY_AXI_BITS;
            new_error_job = b32(0xffff_ffff);
            new_error_detail = b32(0x6003)
                | (input.output_hbm.bresp.resize() << 16)
                | (input.output_hbm.bid.resize() << 24);
        }
        new_failure = true;
        new_error_flags = new_error_flags | b16(ERROR_SUMMARY_AXI);
    }

    if input_ar_handshake {
        control.input_ar_count = q.control.input_ar_count + b16(1);
        control.reader_state = ReaderState::Response;
    }
    if input_r_handshake {
        let response_ok = input_response_is_canonical_kernel(
            input.input_hbm.rid,
            input.input_hbm.rresp,
            input.input_hbm.rlast,
        );
        if response_ok {
            control.input_r_count = q.control.input_r_count + b16(1);
            if q.control.run_state == RunState::Execute {
                input_job = InputJob {
                    data: input.input_hbm.rdata,
                    job_id: q.control.reader_job,
                };
                control.input_job_valid = true;
                control.reader_state = ReaderState::Hold;
            } else {
                control.reader_state = ReaderState::Idle;
            }
        } else {
            control.reader_state = ReaderState::Idle;
            if q.control.run_state == RunState::Execute
                || q.control.run_state == RunState::AbortDrain
            {
                if !new_failure {
                    new_terminal_code = TERMINAL_INPUT_AXI_BITS;
                    new_error_job = q.control.reader_job;
                    new_error_detail = input.input_hbm.rresp.resize()
                        | (input.input_hbm.rid.resize() << 8)
                        | (bool_word_kernel(input.input_hbm.rlast) << 9);
                }
                new_failure = true;
                new_error_flags = new_error_flags | b16(ERROR_INPUT_AXI);
            }
        }
    }

    if q.control.reader_state == ReaderState::Hold {
        if q.control.run_state == RunState::AbortDrain {
            control.input_job_valid = false;
            control.reader_state = ReaderState::Idle;
        } else if signer_start_handshake {
            control.input_job_valid = false;
            control.core_admission_count = q.control.core_admission_count + b16(1);
            scoreboard_events.admit = true;
            scoreboard_events.admit_job = q.input_job.job_id;
            scoreboard_events.admit_cluster = input.signer.start_cluster;
            if !q.control.first_admission_seen {
                control.first_admission_seen = true;
                control.first_admission_cycle = q.control.run_cycle;
            }
            let next_job = q.control.reader_job + b32(1);
            control.reader_job = next_job;
            if next_job < q.control.config.batch {
                control.reader_state = ReaderState::Address;
            } else {
                control.reader_state = ReaderState::Idle;
            }
        }
    }

    if q.control.run_state == RunState::Execute && q.control.error_flags == b16(0) {
        if input.signer.start_accepted != signer_start_handshake {
            if !new_failure {
                new_terminal_code = TERMINAL_SIGNER_BITS;
                new_error_job = if signer_start_valid {
                    q.input_job.job_id
                } else {
                    b32(0xffff_ffff)
                };
                new_error_detail = b32(0x1001);
            }
            new_failure = true;
            new_error_flags = new_error_flags | b16(ERROR_SIGNER_FAULT);
        }
        if input.signer.delivered_final
            != (signer_output_handshake && input.signer.output.beat.last)
        {
            if !new_failure {
                new_error_job = input.signer.output.beat.job_id;
                new_error_detail = b32(0x1002);
                new_terminal_code = TERMINAL_SIGNER_BITS;
            }
            new_failure = true;
            new_error_flags = new_error_flags | b16(ERROR_SIGNER_FAULT);
        }
        if input.signer.delivered_error != signer_error_handshake {
            if !new_failure {
                new_error_job = input.signer.error.job_id;
                new_error_detail = b32(0x1003);
                new_terminal_code = TERMINAL_SIGNER_BITS;
            }
            new_failure = true;
            new_error_flags = new_error_flags | b16(ERROR_SIGNER_FAULT);
        }
        if input.signer.fault {
            if !new_failure {
                new_error_job = b32(0xffff_ffff);
                new_error_detail = b32(0x1004);
                new_terminal_code = TERMINAL_SIGNER_BITS;
            }
            new_failure = true;
            new_error_flags = new_error_flags | b16(ERROR_SIGNER_FAULT);
        }
        if input.signer.output_valid && !signer_output_ready {
            control.output_stall_cycles = q.control.output_stall_cycles + b64(1);
        }
    }

    if ingress_consumed {
        let expected_beat = if q.control.capture_active {
            q.control.capture_beat
        } else {
            b6(0)
        };
        let canonical = captured_beat_is_canonical_kernel(
            q.ingress,
            expected_beat,
            q.control.capture_active,
            q.control.capture_job,
            q.control.capture_cluster,
        );
        control.ingress_valid = false;
        if canonical {
            let selected_slot = if q.control.capture_active {
                q.control.capture_slot
            } else if slot0_free {
                b1(0)
            } else {
                b1(1)
            };
            frame_store.write = SyncBramWrite::<[b8; 64], FRAME_STORE_ADDRESS_BITS> {
                addr: frame_store_address_kernel(selected_slot, expected_beat),
                value: q.ingress.beat.data,
                enable: true,
            };
            if !q.control.capture_active {
                control.capture_active = true;
                control.capture_slot = selected_slot;
                control.capture_job = q.ingress.beat.job_id;
                control.capture_cluster = q.ingress.cluster;
                control.capture_beat = b6(1);
                scoreboard_events.frame_start = true;
                scoreboard_events.frame_start_job = q.ingress.beat.job_id;
                scoreboard_events.frame_start_cluster = q.ingress.cluster;
            } else if expected_beat == b6(34) {
                control.capture_active = false;
                control.capture_beat = b6(0);
                control.frame_capture_count = q.control.frame_capture_count + b16(1);
                enqueue_frame = true;
                enqueue_slot = q.control.capture_slot;
                enqueue_job = q.control.capture_job;
                scoreboard_events.frame_finish = true;
                scoreboard_events.frame_finish_job = q.control.capture_job;
                if q.control.first_admission_seen {
                    control.core_latency_cycles =
                        q.control.run_cycle - q.control.first_admission_cycle + b64(1);
                }
                if q.control.first_capture_seen {
                    control.capture_span_cycles =
                        q.control.run_cycle - q.control.first_capture_cycle;
                } else {
                    control.first_capture_seen = true;
                    control.first_capture_cycle = q.control.run_cycle;
                    control.capture_span_cycles = b64(0);
                }
            } else {
                control.capture_beat = expected_beat + b6(1);
            }
        } else {
            if !new_failure {
                new_error_job = q.ingress.beat.job_id;
                new_error_detail = expected_beat.resize()
                    | (q.ingress.cluster.resize() << 8)
                    | (bool_word_kernel(q.ingress.beat.last) << 16);
                new_terminal_code = TERMINAL_PROTOCOL_BITS;
            }
            new_failure = true;
            new_error_flags = new_error_flags | b16(ERROR_FRAME);
        }
    }

    if signer_output_handshake {
        ingress = input.signer.output;
        control.ingress_valid = true;
    }

    if signer_error_handshake {
        scoreboard_events.error = true;
        scoreboard_events.error_job = input.signer.error.job_id;
        scoreboard_events.error_cluster = input.signer.error.cluster;
        control.core_error_count = q.control.core_error_count + b16(1);
        if !new_failure {
            new_error_job = input.signer.error.job_id;
            new_error_detail =
                input.signer.error.context.resize() | (input.signer.error.cluster.resize() << 8);
            new_terminal_code = TERMINAL_SIGNER_BITS;
        }
        new_failure = true;
        new_error_flags = new_error_flags | b16(ERROR_SIGNER_COMPLETION);
    }

    let mut next_prefetch_count = q.control.prefetch_count;
    let prefetch_push = q.control.read_pending;
    if writer_w_handshake && prefetch_push {
        if q.control.prefetch_count == b2(1) {
            prefetch0 = q.frame_store;
            next_prefetch_count = b2(1);
        } else if q.control.prefetch_count == b2(2) {
            prefetch0 = q.prefetch1;
            prefetch1 = q.frame_store;
            next_prefetch_count = b2(2);
        } else {
            if !new_failure {
                new_error_job = q.control.writer_job;
                new_error_detail = b32(0x2001);
                new_terminal_code = TERMINAL_PROTOCOL_BITS;
            }
            new_failure = true;
            new_error_flags = new_error_flags | b16(ERROR_BUFFER);
        }
    } else if writer_w_handshake {
        if q.control.prefetch_count == b2(1) {
            next_prefetch_count = b2(0);
        } else if q.control.prefetch_count == b2(2) {
            prefetch0 = q.prefetch1;
            next_prefetch_count = b2(1);
        } else {
            if !new_failure {
                new_error_job = q.control.writer_job;
                new_error_detail = b32(0x2002);
                new_terminal_code = TERMINAL_PROTOCOL_BITS;
            }
            new_failure = true;
            new_error_flags = new_error_flags | b16(ERROR_BUFFER);
        }
    } else if prefetch_push {
        if q.control.prefetch_count == b2(0) {
            prefetch0 = q.frame_store;
            next_prefetch_count = b2(1);
        } else if q.control.prefetch_count == b2(1) {
            prefetch1 = q.frame_store;
            next_prefetch_count = b2(2);
        } else {
            if !new_failure {
                new_error_job = q.control.writer_job;
                new_error_detail = b32(0x2003);
                new_terminal_code = TERMINAL_PROTOCOL_BITS;
            }
            new_failure = true;
            new_error_flags = new_error_flags | b16(ERROR_BUFFER);
        }
    }
    control.prefetch_count = next_prefetch_count;
    control.read_pending = false;

    if q.control.writer_state == WriterState::Idle
        && q.control.run_state == RunState::Execute
        && q.control.error_flags == b16(0)
        && q.control.frame_queue.count != b2(0)
        && !new_failure
        && !abort_command
    {
        control.writer_state = WriterState::Address;
        control.writer_slot = q.control.frame_queue.head_slot;
        control.writer_job = q.control.frame_queue.head_job;
        control.writer_beat = b6(0);
        control.read_issue_beat = b6(1);
        control.read_pending = true;
        control.prefetch_count = b2(0);
        control.writer_early_b_drained = false;
        frame_store.read_addr = frame_store_address_kernel(q.control.frame_queue.head_slot, b6(0));
    } else if q.control.writer_state == WriterState::Address && input.output_hbm.awready {
        control.writer_state = WriterState::Data;
        control.payload_aw_count = q.control.payload_aw_count + b16(1);
    }

    if writer_w_handshake {
        control.payload_w_count = q.control.payload_w_count + b32(1);
        if q.control.writer_beat == b6(34) {
            if q.control.writer_early_b_drained {
                // The invalid early response was already consumed and
                // counted.  Completing WLAST closes the owned payload without
                // waiting forever for a second response.
                control.writer_state = WriterState::Idle;
                control.writer_early_b_drained = false;
                dequeue_frame = true;
            } else {
                control.writer_state = WriterState::Response;
            }
            control.writer_beat = b6(0);
        } else {
            control.writer_beat = q.control.writer_beat + b6(1);
        }
    }

    if early_final_b_handshake {
        control.payload_b_count = q.control.payload_b_count + b16(1);
        control.writer_early_b_drained = true;
    }

    if output_b_handshake {
        control.payload_b_count = q.control.payload_b_count + b16(1);
        control.writer_state = WriterState::Idle;
        control.prefetch_count = b2(0);
        control.read_pending = false;
        control.writer_early_b_drained = false;
        dequeue_frame = true;
        let response_ok =
            output_response_is_canonical_kernel(input.output_hbm.bid, input.output_hbm.bresp);
        if response_ok {
            control.memory_completed_count = q.control.memory_completed_count + b16(1);
            control.memory_completion_timing = record_memory_completion_kernel(
                q.control.memory_completion_timing,
                q.control.run_cycle,
                true,
            );
        } else {
            if !new_failure {
                new_error_job = q.control.writer_job;
                new_error_detail =
                    input.output_hbm.bresp.resize() | (input.output_hbm.bid.resize() << 8);
                new_terminal_code = TERMINAL_OUTPUT_AXI_BITS;
            }
            new_failure = true;
            new_error_flags = new_error_flags | b16(ERROR_OUTPUT_AXI);
        }
    }

    let writer_still_prefetching = (control.writer_state == WriterState::Address
        || control.writer_state == WriterState::Data)
        && control.read_issue_beat < b6(35);
    if !control.read_pending && writer_still_prefetching && control.prefetch_count < b2(2) {
        frame_store.read_addr =
            frame_store_address_kernel(control.writer_slot, control.read_issue_beat);
        control.read_issue_beat = control.read_issue_beat + b6(1);
        control.read_pending = true;
    }

    let scoreboard_update = scoreboard_update_kernel(q.control.scoreboard, scoreboard_events);
    control.scoreboard = scoreboard_update.entries;
    if scoreboard_update.fatal {
        if !new_failure {
            new_error_job = scoreboard_update.failing_job;
            new_error_detail = scoreboard_update.detail.resize();
            new_terminal_code = TERMINAL_PROTOCOL_BITS;
        }
        new_failure = true;
        new_error_flags = new_error_flags | b16(ERROR_SCOREBOARD);
    }

    let queue_update = frame_queue_update_kernel(
        q.control.frame_queue,
        FrameQueueOperation {
            dequeue: dequeue_frame,
            enqueue: enqueue_frame,
            slot: enqueue_slot,
            job: enqueue_job,
        },
    );
    control.frame_queue = queue_update.queue;
    if queue_update.fatal {
        if !new_failure {
            new_error_job = enqueue_job;
            new_error_detail = b32(0x3001);
            new_terminal_code = TERMINAL_PROTOCOL_BITS;
        }
        new_failure = true;
        new_error_flags = new_error_flags | b16(ERROR_BUFFER);
    }

    if abort_command
        && (q.control.run_state == RunState::Validate || q.control.run_state == RunState::Execute)
    {
        if !new_failure {
            new_error_job = b32(0xffff_ffff);
            new_error_detail = b32(0x4001);
            new_terminal_code = TERMINAL_ABORTED_BITS;
        }
        new_failure = true;
        new_error_flags = new_error_flags | b16(ERROR_SOFT_ABORT);
    }

    if new_failure {
        if q.control.error_flags == b16(0) {
            control.first_error_job = new_error_job;
            control.first_error_detail = new_error_detail;
            control.terminal_code = new_terminal_code;
        }
        control.error_flags = q.control.error_flags | new_error_flags;
        if q.control.run_state == RunState::Execute || q.control.run_state == RunState::Validate {
            control.run_state = RunState::AbortDrain;
            control.abort_cleaned = false;
        }
        // Roll back only work that was not already asserted from q-state.
        // Address/response states remain owned and therefore continue below.
        if q.control.reader_state == ReaderState::Hold {
            control.reader_state = ReaderState::Idle;
            control.input_job_valid = false;
        }
        if q.control.writer_state == WriterState::Idle {
            control.writer_state = WriterState::Idle;
            control.read_pending = false;
            control.prefetch_count = b2(0);
            control.writer_early_b_drained = false;
        }
    }

    if q.control.run_state == RunState::AbortDrain && !q.control.abort_cleaned {
        control.abort_cleaned = true;
        control.input_job_valid = false;
        control.ingress_valid = false;
        control.capture_active = false;
        control.capture_beat = b6(0);
        if control.reader_state == ReaderState::Hold {
            control.reader_state = ReaderState::Idle;
        }
        if control.writer_state == WriterState::Idle {
            control.frame_queue = FrameQueue::default();
            control.prefetch_count = b2(0);
            control.read_pending = false;
            control.writer_early_b_drained = false;
        } else {
            control.frame_queue = FrameQueue {
                count: b2(1),
                head_slot: control.writer_slot,
                head_job: control.writer_job,
                tail_slot: b1(0),
                tail_job: b32(0),
            };
        }
    }

    if q.control.run_state == RunState::AbortDrain
        && control.abort_cleaned
        && control.reader_state == ReaderState::Idle
        && control.writer_state == WriterState::Idle
        && !control.read_pending
    {
        control.run_state = RunState::CoreReset0;
    }
    if q.control.run_state == RunState::CoreReset0 {
        control.scoreboard = [JobEntry::default(); abi::LIVE_JOB_SLOTS];
        control.run_state = RunState::CoreReset1;
    }
    if q.control.run_state == RunState::CoreReset1 {
        control.run_state = RunState::SummaryAw;
    }

    if q.control.run_state == RunState::Execute && !new_failure {
        let batch16: b16 = q.control.config.batch.resize();
        let expected_w =
            (q.control.config.batch << 5) + (q.control.config.batch << 1) + q.control.config.batch;
        let next_occupancy = scoreboard_occupancy_kernel(control.scoreboard);
        let closed = control.reader_state == ReaderState::Idle
            && !control.input_job_valid
            && !control.ingress_valid
            && !control.capture_active
            && control.frame_queue.count == b2(0)
            && control.writer_state == WriterState::Idle
            && !control.read_pending
            && control.prefetch_count == b2(0)
            && next_occupancy == b4(0)
            && control.core_admission_count == batch16;
        if closed {
            let exact = control.input_ar_count == batch16
                && control.input_r_count == batch16
                && control.core_admission_count == batch16
                && control.frame_capture_count == batch16
                && control.core_error_count == b16(0)
                && control.payload_aw_count == batch16
                && control.payload_b_count == batch16
                && control.payload_w_count == expected_w
                && control.memory_completed_count == batch16
                && control.error_flags == b16(0);
            if exact {
                control.terminal_code = TERMINAL_SUCCESS_BITS;
                control.run_state = RunState::SummaryAw;
            } else {
                control.error_flags = control.error_flags | b16(ERROR_COUNT);
                control.terminal_code = TERMINAL_PROTOCOL_BITS;
                control.first_error_job = b32(0xffff_ffff);
                control.first_error_detail = b32(0x5001);
                control.run_state = RunState::AbortDrain;
                control.abort_cleaned = false;
            }
        }
    }

    if summary_aw_handshake {
        control.summary_aw_handshake = true;
        control.run_state = RunState::SummaryW;
    }
    if summary_w_handshake {
        control.summary_w_handshake = true;
        control.run_state = RunState::SummaryB;
    }
    if summary_b_handshake {
        let summary_ok =
            output_response_is_canonical_kernel(input.output_hbm.bid, input.output_hbm.bresp);
        control.summary_b_handshake = true;
        control.summary_b_canonical = summary_ok;
        if !summary_ok {
            if q.control.error_flags == b16(0) {
                control.first_error_job = b32(0xffff_ffff);
                control.first_error_detail =
                    input.output_hbm.bresp.resize() | (input.output_hbm.bid.resize() << 8);
            }
            control.error_flags = q.control.error_flags | b16(ERROR_SUMMARY_AXI);
            control.terminal_code = TERMINAL_SUMMARY_AXI_BITS;
        }
        control.ap_done = true;
        control.isr = control.isr | b2(1);
        if !summary_ok || q.control.error_flags != b16(0) {
            control.isr = control.isr | b2(2);
        }
        control.run_state = RunState::Done;
    }
    if q.control.run_state == RunState::SummaryB && premature_summary_b_handshake {
        // A malformed state image without both request handshakes cannot own a
        // response or issue another request.  Drain the orphan, publish only
        // failure evidence, and terminate instead of waiting forever.
        control.ap_done = true;
        control.isr = control.isr | b2(3);
        control.run_state = RunState::Done;
    }

    let mut seed = [b8(0); 32];
    let mut message = [b8(0); 32];
    for lane in 0..32 {
        seed[lane] = q.input_job.data[lane];
        message[lane] = q.input_job.data[32 + lane];
    }
    let signer = SignerTopInput {
        start_valid: signer_start_valid && !resetting,
        private_seed: seed,
        message,
        job_id: q.input_job.job_id,
        output_ready: signer_output_ready && !resetting,
        error_ready: signer_error_ready && !resetting,
    };

    let mut input_hbm = idle_read_master_kernel();
    input_hbm.rready = (drain_orphan_input_r
        || q.control.reader_state == ReaderState::Address
        || q.control.reader_state == ReaderState::Response)
        && !resetting;
    if q.control.reader_state == ReaderState::Address {
        input_hbm.arvalid = !resetting;
        input_hbm.araddr =
            input_job_address_kernel(q.control.config.input_base, q.control.reader_job);
    }
    if q.control.reader_state == ReaderState::Response {
        input_hbm.rready = !resetting;
    }

    let summary_fields = SummaryFields {
        terminal_code: q.control.terminal_code,
        nonce: q.control.config.nonce,
        payload_cycles: q.control.payload_cycles,
        core_latency_cycles: q.control.core_latency_cycles,
        capture_span_cycles: q.control.capture_span_cycles,
        batch: q.control.config.batch.resize(),
        input_ar: q.control.input_ar_count,
        input_r: q.control.input_r_count,
        core_admissions: q.control.core_admission_count,
        frames_captured: q.control.frame_capture_count,
        core_errors: q.control.core_error_count,
        payload_aw: q.control.payload_aw_count,
        payload_b: q.control.payload_b_count,
        payload_w: q.control.payload_w_count,
        memory_completed: q.control.memory_completed_count,
        error_flags: q.control.error_flags,
    };
    let mut output_hbm = Axi512WriteKernelToMemory::default();
    output_hbm.bready = (drain_orphan_output_b
        || q.control.writer_state == WriterState::Response
        || (q.control.writer_state == WriterState::Data
            && q.control.writer_beat == b6(34)
            && !q.control.writer_early_b_drained)
        // READY may be asserted before VALID.  Keeping it asserted across the
        // terminal sequence drains an illegal stale response immediately and
        // also permits a compliant zero-latency W/B response.
        || summary_sequence_active)
        && !resetting;
    if q.control.writer_state == WriterState::Address {
        output_hbm.awvalid = !resetting;
        output_hbm.awaddr =
            output_job_address_kernel(q.control.config.output_base, q.control.writer_job);
        output_hbm.awlen = OUTPUT_AXI_LEN;
    } else if q.control.writer_state == WriterState::Data {
        output_hbm.wvalid = q.control.prefetch_count != b2(0) && !resetting;
        output_hbm.wdata = q.prefetch0;
        output_hbm.wstrb = if q.control.writer_beat == b6(34) {
            b64(0x0000_0000_ffff_ffff)
        } else {
            b64(0xffff_ffff_ffff_ffff)
        };
        output_hbm.wlast = q.control.writer_beat == b6(34);
    } else if q.control.writer_state == WriterState::Response {
        output_hbm.bready = !resetting;
    } else if q.control.run_state == RunState::SummaryAw {
        output_hbm.awvalid = !resetting;
        output_hbm.awaddr = q.control.config.summary_base;
        output_hbm.awlen = b8(0);
    } else if q.control.run_state == RunState::SummaryW {
        output_hbm.wvalid = !resetting;
        output_hbm.wdata = summary_line_kernel(summary_fields);
        output_hbm.wstrb = b64(0xffff_ffff_ffff_ffff);
        output_hbm.wlast = true;
    } else if q.control.run_state == RunState::SummaryB {
        output_hbm.bready = !resetting;
    }
    output_hbm.awid = b1(0);
    output_hbm.awsize = AXI_SIZE_64_BYTES;
    output_hbm.awburst = AXI_BURST_INCR;
    output_hbm.awlock = AXI_LOCK_NORMAL;
    output_hbm.awcache = AXI_CACHE_NORMAL;
    output_hbm.awprot = b3(0);
    output_hbm.awqos = b4(0);
    output_hbm.awregion = b4(0);

    let output = HbmShellOutput {
        control: AxiLiteKernelToHost {
            awready: axil_awready && !resetting,
            wready: axil_wready && !resetting,
            bvalid: q.control.axil_bvalid && !resetting,
            bresp: q.control.axil_bresp,
            arready: axil_arready && !resetting,
            rvalid: q.control.axil_rvalid && !resetting,
            rdata: q.control.axil_rdata,
            rresp: q.control.axil_rresp,
        },
        input_hbm,
        output_hbm,
        signer,
        signer_soft_reset: !resetting
            && (q.control.run_state == RunState::CoreReset0
                || q.control.run_state == RunState::CoreReset1),
        interrupt: !resetting && q.control.gier && ((q.control.ier & q.control.isr) != b2(0)),
    };

    if resetting {
        control = ShellControl::default();
        frame_store = FrameStoreInput::default();
    }
    let d = U280HbmShellD {
        control,
        input_job,
        ingress,
        prefetch0,
        prefetch1,
        frame_store,
    };
    (output, d)
}

#[cfg(test)]
mod tests {
    use super::*;

    fn pending_abort(mut control: ShellControl) -> ShellControl {
        control.run_state = RunState::Execute;
        control.axil_aw_pending = true;
        control.axil_awaddr = b8(abi::register::COMMAND);
        control.axil_w_pending = true;
        control.axil_wdata = b32(1);
        control.axil_wstrb = b4(1);
        control
    }

    fn shell_q(control: ShellControl) -> U280HbmShellQ {
        U280HbmShellQ {
            control,
            input_job: InputJob::default(),
            ingress: SignerOutputBeat::default(),
            prefetch0: [b8(0); 64],
            prefetch1: [b8(0); 64],
            frame_store: [b8(0); 64],
        }
    }

    fn active_clock() -> ClockReset {
        clock_reset(clock(false), reset(false))
    }

    fn status_for(control: ShellControl) -> b32 {
        last_status_kernel(
            control.terminal_code,
            control.error_flags,
            SummaryWriteStatus {
                aw: control.summary_aw_handshake,
                w: control.summary_w_handshake,
                b: control.summary_b_handshake,
                b_canonical: control.summary_b_canonical,
            },
        )
    }

    fn summary_response_input(
        awready: bool,
        wready: bool,
        bvalid: bool,
        bid: b1,
        bresp: b2,
    ) -> HbmShellInput {
        HbmShellInput {
            output_hbm: Axi512WriteMemoryToKernel {
                awready,
                wready,
                bvalid,
                bid,
                bresp,
            },
            ..HbmShellInput::default()
        }
    }

    #[test]
    fn axil_aw_before_w_cannot_turn_a_busy_start_into_a_stale_idle_start() {
        let mut active = ShellControl::default();
        active.run_state = RunState::Execute;
        active.config.batch = b32(1);
        active.reader_state = ReaderState::Hold;
        active.input_job_valid = true;
        let (_output, aw_d) = u280_hbm_shell_kernel(
            active_clock(),
            HbmShellInput {
                control: AxiLiteHostToKernel {
                    awvalid: true,
                    awaddr: b8(abi::register::AP_CTRL),
                    ..AxiLiteHostToKernel::default()
                },
                ..HbmShellInput::default()
            },
            shell_q(active),
        );
        assert!(aw_d.control.axil_aw_pending);
        assert!(aw_d.control.axil_aw_locked_at_accept);

        let mut crossed_boundary = aw_d.control;
        crossed_boundary.run_state = RunState::Idle;
        let (_output, w_d) = u280_hbm_shell_kernel(
            active_clock(),
            HbmShellInput {
                control: AxiLiteHostToKernel {
                    wvalid: true,
                    wdata: b32(1),
                    wstrb: b4(1),
                    ..AxiLiteHostToKernel::default()
                },
                ..HbmShellInput::default()
            },
            shell_q(crossed_boundary),
        );
        assert!(w_d.control.axil_w_pending);
        assert!(!w_d.control.axil_w_locked_at_accept);

        let (_output, rejected) = u280_hbm_shell_kernel(
            active_clock(),
            HbmShellInput::default(),
            shell_q(w_d.control),
        );
        assert!(rejected.control.axil_bvalid);
        assert_eq!(rejected.control.axil_bresp, AXI_RESP_SLVERR);
        assert_eq!(rejected.control.run_state, RunState::Idle);
    }

    #[test]
    fn axil_w_before_aw_retains_the_busy_configuration_lock() {
        let mut active = ShellControl::default();
        active.run_state = RunState::Execute;
        active.config.batch = b32(7);
        active.reader_state = ReaderState::Hold;
        active.input_job_valid = true;
        let (_output, w_d) = u280_hbm_shell_kernel(
            active_clock(),
            HbmShellInput {
                control: AxiLiteHostToKernel {
                    wvalid: true,
                    wdata: b32(99),
                    wstrb: b4(0xf),
                    ..AxiLiteHostToKernel::default()
                },
                ..HbmShellInput::default()
            },
            shell_q(active),
        );
        assert!(w_d.control.axil_w_locked_at_accept);

        let mut crossed_boundary = w_d.control;
        crossed_boundary.run_state = RunState::Idle;
        let (_output, aw_d) = u280_hbm_shell_kernel(
            active_clock(),
            HbmShellInput {
                control: AxiLiteHostToKernel {
                    awvalid: true,
                    awaddr: b8(abi::register::BATCH),
                    ..AxiLiteHostToKernel::default()
                },
                ..HbmShellInput::default()
            },
            shell_q(crossed_boundary),
        );
        let (_output, rejected) = u280_hbm_shell_kernel(
            active_clock(),
            HbmShellInput::default(),
            shell_q(aw_d.control),
        );
        assert_eq!(rejected.control.axil_bresp, AXI_RESP_SLVERR);
        assert_eq!(rejected.control.config.batch, b32(7));
    }

    #[test]
    fn axil_simultaneous_idle_pair_commits_but_busy_pair_remains_locked() {
        let idle = ShellControl::default();
        let pair = HbmShellInput {
            control: AxiLiteHostToKernel {
                awvalid: true,
                awaddr: b8(abi::register::BATCH),
                wvalid: true,
                wdata: b32(123),
                wstrb: b4(0xf),
                ..AxiLiteHostToKernel::default()
            },
            ..HbmShellInput::default()
        };
        let (_output, captured) = u280_hbm_shell_kernel(active_clock(), pair, shell_q(idle));
        assert!(!captured.control.axil_aw_locked_at_accept);
        assert!(!captured.control.axil_w_locked_at_accept);
        let (_output, committed) = u280_hbm_shell_kernel(
            active_clock(),
            HbmShellInput::default(),
            shell_q(captured.control),
        );
        assert_eq!(committed.control.axil_bresp, AXI_RESP_OKAY);
        assert_eq!(committed.control.config.batch, b32(123));

        let mut active = ShellControl::default();
        active.run_state = RunState::Execute;
        active.config.batch = b32(1);
        active.reader_state = ReaderState::Hold;
        active.input_job_valid = true;
        let (_output, captured_busy) = u280_hbm_shell_kernel(active_clock(), pair, shell_q(active));
        assert!(captured_busy.control.axil_aw_locked_at_accept);
        assert!(captured_busy.control.axil_w_locked_at_accept);
        let mut crossed_boundary = captured_busy.control;
        crossed_boundary.run_state = RunState::Idle;
        let (_output, rejected) = u280_hbm_shell_kernel(
            active_clock(),
            HbmShellInput::default(),
            shell_q(crossed_boundary),
        );
        assert_eq!(rejected.control.axil_bresp, AXI_RESP_SLVERR);
        assert_eq!(rejected.control.config.batch, b32(1));
    }

    #[test]
    fn axil_abort_intent_is_executed_while_active_and_rejected_after_boundary() {
        let mut active = ShellControl::default();
        active.run_state = RunState::Execute;
        active.config.batch = b32(1);
        active.reader_state = ReaderState::Hold;
        active.input_job_valid = true;
        let abort_pair = HbmShellInput {
            control: AxiLiteHostToKernel {
                awvalid: true,
                awaddr: b8(abi::register::COMMAND),
                wvalid: true,
                wdata: b32(1),
                wstrb: b4(1),
                ..AxiLiteHostToKernel::default()
            },
            ..HbmShellInput::default()
        };
        let (_output, captured) =
            u280_hbm_shell_kernel(active_clock(), abort_pair, shell_q(active));
        let (_output, aborted) = u280_hbm_shell_kernel(
            active_clock(),
            HbmShellInput::default(),
            shell_q(captured.control),
        );
        assert_eq!(aborted.control.axil_bresp, AXI_RESP_OKAY);
        assert_eq!(aborted.control.run_state, RunState::AbortDrain);
        assert_ne!(aborted.control.error_flags & b16(ERROR_SOFT_ABORT), b16(0));

        let mut split_active = active;
        let (_output, aw_d) = u280_hbm_shell_kernel(
            active_clock(),
            HbmShellInput {
                control: AxiLiteHostToKernel {
                    awvalid: true,
                    awaddr: b8(abi::register::COMMAND),
                    ..AxiLiteHostToKernel::default()
                },
                ..HbmShellInput::default()
            },
            shell_q(split_active),
        );
        split_active = aw_d.control;
        split_active.run_state = RunState::Idle;
        let (_output, w_d) = u280_hbm_shell_kernel(
            active_clock(),
            HbmShellInput {
                control: AxiLiteHostToKernel {
                    wvalid: true,
                    wdata: b32(1),
                    wstrb: b4(1),
                    ..AxiLiteHostToKernel::default()
                },
                ..HbmShellInput::default()
            },
            shell_q(split_active),
        );
        let (_output, stale) = u280_hbm_shell_kernel(
            active_clock(),
            HbmShellInput::default(),
            shell_q(w_d.control),
        );
        assert_eq!(stale.control.axil_bresp, AXI_RESP_SLVERR);
        assert_eq!(stale.control.run_state, RunState::Idle);
        assert_eq!(stale.control.error_flags & b16(ERROR_SOFT_ABORT), b16(0));
    }

    #[test]
    fn same_cycle_abort_suppresses_signer_admission_and_next_input_ar() {
        let mut control = pending_abort(ShellControl::default());
        control.reader_state = ReaderState::Hold;
        control.input_job_valid = true;
        control.config.batch = b32(2);
        let mut q = shell_q(control);
        q.input_job.job_id = b32(0);
        let input = HbmShellInput {
            signer: SignerTopOutput {
                start_ready: true,
                ..SignerTopOutput::default()
            },
            ..HbmShellInput::default()
        };
        let (output, d) = u280_hbm_shell_kernel(active_clock(), input, q);
        assert!(!output.signer.start_valid);
        assert_eq!(d.control.core_admission_count, b16(0));
        assert_ne!(d.control.reader_state, ReaderState::Address);
        assert_eq!(d.control.run_state, RunState::AbortDrain);
    }

    #[test]
    fn same_cycle_abort_discards_held_ingress_without_starting_a_frame() {
        let mut control = pending_abort(ShellControl::default());
        control.ingress_valid = true;
        let mut q = shell_q(control);
        q.ingress = SignerOutputBeat {
            beat: wots_rhdl::LaneLocalBeat {
                data: [b8(0x5a); 64],
                keep: b64(0xffff_ffff_ffff_ffff),
                last: false,
                job_id: b32(7),
            },
            cluster: b2(0),
        };
        let (output, d) = u280_hbm_shell_kernel(active_clock(), HbmShellInput::default(), q);
        assert!(!output.signer.output_ready);
        assert!(!d.frame_store.write.enable);
        assert!(!d.control.capture_active);
        assert_eq!(d.control.frame_queue.count, b2(0));
        assert_eq!(d.control.run_state, RunState::AbortDrain);
    }

    #[test]
    fn same_cycle_abort_never_commits_an_idle_writer() {
        let mut control = pending_abort(ShellControl::default());
        control.frame_queue = FrameQueue {
            count: b2(1),
            head_slot: b1(0),
            head_job: b32(9),
            ..FrameQueue::default()
        };
        let q = shell_q(control);
        let (output, d) = u280_hbm_shell_kernel(active_clock(), HbmShellInput::default(), q);
        assert!(!output.output_hbm.awvalid);
        assert_eq!(d.control.writer_state, WriterState::Idle);
        assert_eq!(d.control.payload_aw_count, b16(0));
        assert_eq!(d.control.run_state, RunState::AbortDrain);
    }

    #[test]
    fn orphan_input_response_is_drained_and_fails_closed() {
        let mut control = ShellControl::default();
        control.run_state = RunState::Execute;
        let q = shell_q(control);
        let input = HbmShellInput {
            input_hbm: Axi512ReadMemoryToKernel {
                rvalid: true,
                rlast: true,
                ..Axi512ReadMemoryToKernel::default()
            },
            ..HbmShellInput::default()
        };
        let (output, d) = u280_hbm_shell_kernel(active_clock(), input, q);
        assert!(output.input_hbm.rready);
        assert_eq!(d.control.run_state, RunState::AbortDrain);
        assert_ne!(d.control.error_flags & b16(ERROR_INPUT_AXI), b16(0));
    }

    #[test]
    fn orphan_output_response_is_drained_and_fails_closed() {
        let mut control = ShellControl::default();
        control.run_state = RunState::Execute;
        let q = shell_q(control);
        let input = HbmShellInput {
            output_hbm: Axi512WriteMemoryToKernel {
                bvalid: true,
                ..Axi512WriteMemoryToKernel::default()
            },
            ..HbmShellInput::default()
        };
        let (output, d) = u280_hbm_shell_kernel(active_clock(), input, q);
        assert!(output.output_hbm.bready);
        assert_eq!(d.control.run_state, RunState::AbortDrain);
        assert_ne!(d.control.error_flags & b16(ERROR_OUTPUT_AXI), b16(0));
    }

    #[test]
    fn input_address_and_canonical_response_can_transfer_in_one_cycle() {
        let mut control = ShellControl::default();
        control.run_state = RunState::Execute;
        control.config.batch = b32(1);
        control.reader_state = ReaderState::Address;
        control.reader_job = b32(0);
        let data = [b8(0x5a); 64];
        let input = HbmShellInput {
            input_hbm: Axi512ReadMemoryToKernel {
                arready: true,
                rvalid: true,
                rdata: data,
                rid: b1(0),
                rresp: AXI_RESP_OKAY,
                rlast: true,
            },
            ..HbmShellInput::default()
        };
        let (output, d) = u280_hbm_shell_kernel(active_clock(), input, shell_q(control));
        assert!(output.input_hbm.arvalid);
        assert!(output.input_hbm.rready);
        assert_eq!(d.control.input_ar_count, b16(1));
        assert_eq!(d.control.input_r_count, b16(1));
        assert_eq!(d.control.reader_state, ReaderState::Hold);
        assert!(d.control.input_job_valid);
        assert_eq!(d.input_job.data, data);
        assert_eq!(d.control.error_flags & b16(ERROR_INPUT_AXI), b16(0));
    }

    #[test]
    fn input_response_without_arready_is_prearmed_drained_and_fails_closed() {
        let mut control = ShellControl::default();
        control.run_state = RunState::Execute;
        control.config.batch = b32(1);
        control.reader_state = ReaderState::Address;
        control.reader_job = b32(0);
        let input = HbmShellInput {
            input_hbm: Axi512ReadMemoryToKernel {
                arready: false,
                rvalid: true,
                rid: b1(0),
                rresp: AXI_RESP_OKAY,
                rlast: true,
                ..Axi512ReadMemoryToKernel::default()
            },
            ..HbmShellInput::default()
        };
        let (output, d) = u280_hbm_shell_kernel(active_clock(), input, shell_q(control));
        assert!(output.input_hbm.arvalid);
        assert!(output.input_hbm.rready, "RREADY is pre-armed from q-state");
        assert_eq!(d.control.input_ar_count, b16(0));
        assert_eq!(d.control.input_r_count, b16(0));
        assert_eq!(d.control.reader_state, ReaderState::Idle);
        assert_eq!(d.control.run_state, RunState::AbortDrain);
        assert_ne!(d.control.error_flags & b16(ERROR_INPUT_AXI), b16(0));
    }

    #[test]
    fn final_payload_w_and_canonical_b_can_retire_in_one_cycle() {
        let mut control = ShellControl::default();
        control.run_state = RunState::Execute;
        control.config.batch = b32(1);
        control.writer_state = WriterState::Data;
        control.writer_job = b32(0);
        control.writer_beat = b6(34);
        control.prefetch_count = b2(1);
        control.payload_aw_count = b16(1);
        control.frame_queue = FrameQueue {
            count: b2(1),
            head_slot: b1(0),
            head_job: b32(0),
            ..FrameQueue::default()
        };
        control.run_cycle = b64(91);
        let input = HbmShellInput {
            output_hbm: Axi512WriteMemoryToKernel {
                wready: true,
                bvalid: true,
                bid: b1(0),
                bresp: AXI_RESP_OKAY,
                ..Axi512WriteMemoryToKernel::default()
            },
            ..HbmShellInput::default()
        };
        let (output, d) = u280_hbm_shell_kernel(active_clock(), input, shell_q(control));
        assert!(output.output_hbm.wvalid);
        assert!(output.output_hbm.wlast);
        assert!(output.output_hbm.bready);
        assert_eq!(d.control.writer_state, WriterState::Idle);
        assert_eq!(d.control.payload_w_count, b32(1));
        assert_eq!(d.control.payload_b_count, b16(1));
        assert_eq!(d.control.memory_completed_count, b16(1));
        assert_eq!(d.control.frame_queue.count, b2(0));
        assert_eq!(d.control.error_flags & b16(ERROR_OUTPUT_AXI), b16(0));
    }

    #[test]
    fn final_payload_b_without_wready_is_prearmed_drained_and_does_not_deadlock() {
        let mut control = ShellControl::default();
        control.run_state = RunState::Execute;
        control.config.batch = b32(1);
        control.writer_state = WriterState::Data;
        control.writer_job = b32(0);
        control.writer_beat = b6(34);
        control.prefetch_count = b2(1);
        control.frame_queue = FrameQueue {
            count: b2(1),
            head_slot: b1(0),
            head_job: b32(0),
            ..FrameQueue::default()
        };
        let early_b = HbmShellInput {
            output_hbm: Axi512WriteMemoryToKernel {
                wready: false,
                bvalid: true,
                bid: b1(0),
                bresp: AXI_RESP_OKAY,
                ..Axi512WriteMemoryToKernel::default()
            },
            ..HbmShellInput::default()
        };
        let (early_output, early_d) =
            u280_hbm_shell_kernel(active_clock(), early_b, shell_q(control));
        assert!(early_output.output_hbm.wvalid);
        assert!(early_output.output_hbm.wlast);
        assert!(
            early_output.output_hbm.bready,
            "BREADY is pre-armed from q-state, independent of WREADY"
        );
        assert_eq!(early_d.control.run_state, RunState::AbortDrain);
        assert_eq!(early_d.control.writer_state, WriterState::Data);
        assert!(early_d.control.writer_early_b_drained);
        assert_eq!(early_d.control.payload_b_count, b16(1));
        assert_eq!(early_d.control.memory_completed_count, b16(0));
        assert_ne!(early_d.control.error_flags & b16(ERROR_OUTPUT_AXI), b16(0));

        let (final_output, final_d) = u280_hbm_shell_kernel(
            active_clock(),
            HbmShellInput {
                output_hbm: Axi512WriteMemoryToKernel {
                    wready: true,
                    ..Axi512WriteMemoryToKernel::default()
                },
                ..HbmShellInput::default()
            },
            shell_q(early_d.control),
        );
        assert!(final_output.output_hbm.wvalid);
        assert!(final_output.output_hbm.wlast);
        assert!(!final_output.output_hbm.bready);
        assert_eq!(final_d.control.writer_state, WriterState::Idle);
        assert!(!final_d.control.writer_early_b_drained);
        assert_eq!(final_d.control.frame_queue.count, b2(0));
        assert_eq!(final_d.control.payload_w_count, b32(1));
        assert_eq!(final_d.control.payload_b_count, b16(1));
    }

    #[test]
    fn payload_b_before_wlast_fails_closed_without_accepting_the_response() {
        let mut control = ShellControl::default();
        control.run_state = RunState::Execute;
        control.config.batch = b32(1);
        control.writer_state = WriterState::Data;
        control.writer_job = b32(0);
        control.writer_beat = b6(33);
        control.prefetch_count = b2(1);
        control.frame_queue = FrameQueue {
            count: b2(1),
            head_slot: b1(0),
            head_job: b32(0),
            ..FrameQueue::default()
        };
        let input = HbmShellInput {
            output_hbm: Axi512WriteMemoryToKernel {
                bvalid: true,
                bid: b1(0),
                bresp: AXI_RESP_OKAY,
                ..Axi512WriteMemoryToKernel::default()
            },
            ..HbmShellInput::default()
        };
        let (output, d) = u280_hbm_shell_kernel(active_clock(), input, shell_q(control));
        assert!(!output.output_hbm.bready);
        assert_eq!(d.control.payload_b_count, b16(0));
        assert_eq!(d.control.run_state, RunState::AbortDrain);
        assert_ne!(d.control.error_flags & b16(ERROR_OUTPUT_AXI), b16(0));
    }

    #[test]
    fn held_canonical_b_from_summary_aw_is_drained_and_never_reports_success() {
        let mut control = ShellControl::default();
        control.run_state = RunState::SummaryAw;
        control.config.summary_base = b64(0x0000_0003_0000_0000);

        let (first_output, first_d) = u280_hbm_shell_kernel(
            active_clock(),
            summary_response_input(false, false, true, b1(0), AXI_RESP_OKAY),
            shell_q(control),
        );
        assert!(first_output.output_hbm.awvalid);
        assert!(first_output.output_hbm.bready);
        assert_eq!(first_d.control.run_state, RunState::SummaryAw);
        assert!(!first_d.control.summary_aw_handshake);
        assert!(!first_d.control.summary_w_handshake);
        assert!(!first_d.control.summary_b_handshake);
        assert_ne!(first_d.control.error_flags & b16(ERROR_SUMMARY_AXI), b16(0));
        assert_eq!(first_d.control.terminal_code, TERMINAL_SUMMARY_AXI_BITS);
        assert!(!crate::control::last_status_is_host_success_kernel(
            status_for(first_d.control)
        ));

        let (aw_output, aw_d) = u280_hbm_shell_kernel(
            active_clock(),
            summary_response_input(true, false, true, b1(0), AXI_RESP_OKAY),
            shell_q(first_d.control),
        );
        assert!(aw_output.output_hbm.awvalid);
        assert!(aw_output.output_hbm.bready);
        assert_eq!(aw_d.control.run_state, RunState::SummaryW);
        assert!(aw_d.control.summary_aw_handshake);
        assert!(!aw_d.control.summary_w_handshake);
        assert!(!aw_d.control.summary_b_handshake);

        let (stalled_output, stalled_d) = u280_hbm_shell_kernel(
            active_clock(),
            summary_response_input(false, false, true, b1(0), AXI_RESP_OKAY),
            shell_q(aw_d.control),
        );
        assert!(stalled_output.output_hbm.wvalid);
        assert!(stalled_output.output_hbm.bready);
        assert_eq!(stalled_d.control.run_state, RunState::SummaryW);
        assert!(!stalled_d.control.summary_w_handshake);
        assert!(!stalled_d.control.summary_b_handshake);

        let (close_output, close_d) = u280_hbm_shell_kernel(
            active_clock(),
            summary_response_input(false, true, true, b1(0), AXI_RESP_OKAY),
            shell_q(stalled_d.control),
        );
        assert!(close_output.output_hbm.wvalid);
        assert!(close_output.output_hbm.bready);
        assert_eq!(close_d.control.run_state, RunState::Done);
        assert!(close_d.control.summary_w_handshake);
        assert!(close_d.control.summary_b_handshake);
        assert!(close_d.control.summary_b_canonical);
        assert!(close_d.control.ap_done);
        assert_ne!(close_d.control.error_flags & b16(ERROR_SUMMARY_AXI), b16(0));
        assert_eq!(close_d.control.terminal_code, TERMINAL_SUMMARY_AXI_BITS);
        assert!(!crate::control::last_status_is_host_success_kernel(
            status_for(close_d.control)
        ));
    }

    #[test]
    fn held_canonical_b_during_stalled_summary_w_is_sticky_failure() {
        let mut control = ShellControl::default();
        control.run_state = RunState::SummaryW;
        control.summary_aw_handshake = true;

        let (first_output, first_d) = u280_hbm_shell_kernel(
            active_clock(),
            summary_response_input(false, false, true, b1(0), AXI_RESP_OKAY),
            shell_q(control),
        );
        assert!(first_output.output_hbm.wvalid);
        assert!(first_output.output_hbm.bready);
        assert_eq!(first_d.control.run_state, RunState::SummaryW);
        assert!(!first_d.control.summary_w_handshake);
        assert!(!first_d.control.summary_b_handshake);
        assert_ne!(first_d.control.error_flags & b16(ERROR_SUMMARY_AXI), b16(0));

        let (held_output, held_d) = u280_hbm_shell_kernel(
            active_clock(),
            summary_response_input(false, false, true, b1(0), AXI_RESP_OKAY),
            shell_q(first_d.control),
        );
        assert!(held_output.output_hbm.wvalid);
        assert!(held_output.output_hbm.bready);
        assert_eq!(held_d.control.run_state, RunState::SummaryW);
        assert!(!held_d.control.summary_w_handshake);
        assert!(!held_d.control.summary_b_handshake);

        let (w_output, w_d) = u280_hbm_shell_kernel(
            active_clock(),
            summary_response_input(false, true, false, b1(0), AXI_RESP_OKAY),
            shell_q(held_d.control),
        );
        assert!(w_output.output_hbm.wvalid);
        assert!(w_output.output_hbm.bready);
        assert_eq!(w_d.control.run_state, RunState::SummaryB);
        assert!(w_d.control.summary_w_handshake);
        assert!(!w_d.control.summary_b_handshake);

        let (b_output, b_d) = u280_hbm_shell_kernel(
            active_clock(),
            summary_response_input(false, false, true, b1(0), AXI_RESP_OKAY),
            shell_q(w_d.control),
        );
        assert!(b_output.output_hbm.bready);
        assert_eq!(b_d.control.run_state, RunState::Done);
        assert!(b_d.control.summary_b_handshake);
        assert!(b_d.control.summary_b_canonical);
        assert_ne!(b_d.control.error_flags & b16(ERROR_SUMMARY_AXI), b16(0));
        assert_eq!(b_d.control.terminal_code, TERMINAL_SUMMARY_AXI_BITS);
        assert!(!crate::control::last_status_is_host_success_kernel(
            status_for(b_d.control)
        ));
    }

    #[test]
    fn premature_summary_b_rejects_wrong_id_and_non_okay_responses() {
        for run_state in [RunState::SummaryAw, RunState::SummaryW] {
            for (bid, bresp) in [
                (b1(1), AXI_RESP_OKAY),
                (b1(0), AXI_RESP_SLVERR),
                (b1(0), AXI_RESP_DECERR),
                (b1(1), AXI_RESP_SLVERR),
            ] {
                let mut control = ShellControl::default();
                control.run_state = run_state;
                control.summary_aw_handshake = run_state == RunState::SummaryW;
                let (output, d) = u280_hbm_shell_kernel(
                    active_clock(),
                    summary_response_input(false, false, true, bid, bresp),
                    shell_q(control),
                );
                assert_eq!(output.output_hbm.awvalid, run_state == RunState::SummaryAw);
                assert_eq!(output.output_hbm.wvalid, run_state == RunState::SummaryW);
                assert!(output.output_hbm.bready);
                assert_eq!(d.control.run_state, run_state);
                assert!(!d.control.summary_b_handshake);
                assert!(!d.control.summary_b_canonical);
                assert_eq!(d.control.terminal_code, TERMINAL_SUMMARY_AXI_BITS);
                assert_ne!(d.control.error_flags & b16(ERROR_SUMMARY_AXI), b16(0));
                assert_eq!(
                    d.control.first_error_detail,
                    b32(0x6003) | (bresp.resize() << 16) | (bid.resize() << 24)
                );
                assert!(!crate::control::last_status_is_host_success_kernel(
                    status_for(d.control)
                ));
            }
        }
    }

    #[test]
    fn legal_same_cycle_summary_w_and_b_retire_as_success() {
        let mut control = ShellControl::default();
        control.run_state = RunState::SummaryW;
        control.summary_aw_handshake = true;
        let (output, d) = u280_hbm_shell_kernel(
            active_clock(),
            summary_response_input(false, true, true, b1(0), AXI_RESP_OKAY),
            shell_q(control),
        );
        assert!(output.output_hbm.wvalid);
        assert!(output.output_hbm.wlast);
        assert!(output.output_hbm.bready);
        assert_eq!(d.control.run_state, RunState::Done);
        assert!(d.control.summary_aw_handshake);
        assert!(d.control.summary_w_handshake);
        assert!(d.control.summary_b_handshake);
        assert!(d.control.summary_b_canonical);
        assert_eq!(d.control.error_flags, b16(0));
        assert_eq!(d.control.terminal_code, TERMINAL_SUCCESS_BITS);
        assert!(crate::control::last_status_is_host_success_kernel(
            status_for(d.control)
        ));
    }

    #[test]
    fn premature_b_during_core_reset_is_drained_before_summary_ownership() {
        let mut control = ShellControl::default();
        control.run_state = RunState::CoreReset0;
        let (output, first_d) = u280_hbm_shell_kernel(
            active_clock(),
            summary_response_input(false, false, true, b1(0), AXI_RESP_OKAY),
            shell_q(control),
        );
        assert!(output.output_hbm.bready);
        assert_eq!(first_d.control.run_state, RunState::CoreReset1);
        assert!(!first_d.control.summary_aw_handshake);
        assert!(!first_d.control.summary_w_handshake);
        assert!(!first_d.control.summary_b_handshake);
        assert_ne!(first_d.control.error_flags & b16(ERROR_SUMMARY_AXI), b16(0));

        let (_output, second_d) = u280_hbm_shell_kernel(
            active_clock(),
            HbmShellInput::default(),
            shell_q(first_d.control),
        );
        assert_eq!(second_d.control.run_state, RunState::SummaryAw);
        assert!(!crate::control::last_status_is_host_success_kernel(
            status_for(second_d.control)
        ));
    }

    #[test]
    fn summary_b_without_request_ownership_drains_and_terminates_failed() {
        let mut control = ShellControl::default();
        control.run_state = RunState::SummaryB;
        let (output, d) = u280_hbm_shell_kernel(
            active_clock(),
            summary_response_input(false, false, true, b1(0), AXI_RESP_OKAY),
            shell_q(control),
        );
        assert!(output.output_hbm.bready);
        assert_eq!(d.control.run_state, RunState::Done);
        assert!(d.control.ap_done);
        assert!(!d.control.summary_aw_handshake);
        assert!(!d.control.summary_w_handshake);
        assert!(!d.control.summary_b_handshake);
        assert!(!d.control.summary_b_canonical);
        assert_ne!(d.control.error_flags & b16(ERROR_SUMMARY_AXI), b16(0));
        assert_eq!(d.control.terminal_code, TERMINAL_SUMMARY_AXI_BITS);
        assert!(!crate::control::last_status_is_host_success_kernel(
            status_for(d.control)
        ));
    }

    #[test]
    fn zero_batch_performs_only_the_successful_summary_transaction() {
        let mut control = ShellControl::default();
        control.run_state = RunState::Validate;
        control.config = LaunchConfig {
            input_base: b64(0x0000_0001_0000_0000),
            output_base: b64(0x0000_0002_0000_0000),
            summary_base: b64(0x0000_0003_0000_0000),
            batch: b32(0),
            abi_word: b32(abi::HASHSIGS_HBM_ABI_V1 as u128),
            nonce: b64(0x0123_4567_89ab_cdef),
        };

        let (validate_output, validate_d) =
            u280_hbm_shell_kernel(active_clock(), HbmShellInput::default(), shell_q(control));
        assert_eq!(validate_d.control.run_state, RunState::Execute);
        assert!(!validate_output.input_hbm.arvalid);
        assert!(!validate_output.output_hbm.awvalid);

        let (close_output, close_d) = u280_hbm_shell_kernel(
            active_clock(),
            HbmShellInput::default(),
            shell_q(validate_d.control),
        );
        assert_eq!(close_d.control.run_state, RunState::SummaryAw);
        assert!(!close_output.input_hbm.arvalid);
        assert!(!close_output.output_hbm.awvalid);

        let (aw_output, aw_d) = u280_hbm_shell_kernel(
            active_clock(),
            HbmShellInput {
                output_hbm: Axi512WriteMemoryToKernel {
                    awready: true,
                    ..Axi512WriteMemoryToKernel::default()
                },
                ..HbmShellInput::default()
            },
            shell_q(close_d.control),
        );
        assert!(aw_output.output_hbm.awvalid);
        assert_eq!(aw_output.output_hbm.awaddr, control.config.summary_base);
        assert_eq!(aw_output.output_hbm.awlen, b8(0));
        assert_eq!(aw_d.control.run_state, RunState::SummaryW);

        let (w_output, w_d) = u280_hbm_shell_kernel(
            active_clock(),
            HbmShellInput {
                output_hbm: Axi512WriteMemoryToKernel {
                    wready: true,
                    ..Axi512WriteMemoryToKernel::default()
                },
                ..HbmShellInput::default()
            },
            shell_q(aw_d.control),
        );
        assert!(w_output.output_hbm.wvalid);
        assert!(w_output.output_hbm.wlast);
        assert_eq!(w_output.output_hbm.wstrb, b64(0xffff_ffff_ffff_ffff));
        assert_eq!(w_d.control.run_state, RunState::SummaryB);

        let (b_output, b_d) = u280_hbm_shell_kernel(
            active_clock(),
            HbmShellInput {
                output_hbm: Axi512WriteMemoryToKernel {
                    bvalid: true,
                    bid: b1(0),
                    bresp: AXI_RESP_OKAY,
                    ..Axi512WriteMemoryToKernel::default()
                },
                ..HbmShellInput::default()
            },
            shell_q(w_d.control),
        );
        assert!(b_output.output_hbm.bready);
        assert_eq!(b_d.control.run_state, RunState::Done);
        assert!(b_d.control.ap_done);
        assert_eq!(b_d.control.terminal_code, TERMINAL_SUCCESS_BITS);
        assert_eq!(b_d.control.error_flags, b16(0));
        assert_eq!(b_d.control.input_ar_count, b16(0));
        assert_eq!(b_d.control.input_r_count, b16(0));
        assert_eq!(b_d.control.core_admission_count, b16(0));
        assert_eq!(b_d.control.frame_capture_count, b16(0));
        assert_eq!(b_d.control.payload_aw_count, b16(0));
        assert_eq!(b_d.control.payload_w_count, b32(0));
        assert_eq!(b_d.control.payload_b_count, b16(0));
        assert_eq!(b_d.control.memory_completed_count, b16(0));
        let status = last_status_kernel(
            b_d.control.terminal_code,
            b_d.control.error_flags,
            SummaryWriteStatus {
                aw: b_d.control.summary_aw_handshake,
                w: b_d.control.summary_w_handshake,
                b: b_d.control.summary_b_handshake,
                b_canonical: b_d.control.summary_b_canonical,
            },
        );
        assert_eq!(status, b32(0x0f00_0000));
        assert!(crate::control::last_status_is_host_success_kernel(status));
    }
}