radiance · Radiance self-hosting compiler

compiler/ lib/ examples/ std/ arch/ char/ collections/ graph/ lang/ alloc/ ast/ gen/ il/ module/ parser/ resolver/ scanner/ alloc.rad 7.1 KiB ast.rad 26.9 KiB gen.rad 513 B il.rad 20.4 KiB lower.rad 321.7 KiB module.rad 17.3 KiB package.rad 1.3 KiB parser.rad 92.2 KiB resolver.rad 511.1 KiB scanner.rad 17.9 KiB sexpr.rad 6.7 KiB strings.rad 2.2 KiB types.rad 1.6 KiB sys/ arch.rad 68 B char.rad 855 B collections.rad 39 B fmt.rad 8.3 KiB graph.rad 4.3 KiB intrinsics.rad 467 B io.rad 1.7 KiB lang.rad 276 B mem.rad 2.3 KiB sys.rad 179 B testing.rad 2.4 KiB tests.rad 15.7 KiB vec.rad 3.2 KiB std.rad 299 B scripts/ seed/ sublime/ test/ vim/ .gitignore 336 B .gitsigners 112 B CELL_PERMISSIONS 6.8 KiB CONTRIBUTING 2.1 KiB LICENSE 1.1 KiB Makefile 5.4 KiB README 2.5 KiB STYLE 2.5 KiB std.lib 1.5 KiB std.lib.test 808 B
lib/std/lang/resolver.rad 511.1 KiB raw
//! Radiance semantic analyzer and type resolver.
//!
//! This module performs scope construction, symbol binding, and identifier
//! resolution on top of the AST produced by the parser.

export mod printer;

/// Unit tests for the resolver.
@test mod tests;

/// Tests for module-owned record representations.
@test mod opaqueTests;

// TODO: Move to raw vectors to reduce list duplication?
// TODO: When a function declaration fails to typecheck, it should still "exist".
// TODO: `ensureNominalResolved` should just run when you call `typeFor`.
// TODO: Have different types for positional vs. named field records.

use std::mem;
use std::io;
use std::lang::alloc;
use std::lang::types;
use std::lang::ast;
use std::lang::parser;
use std::lang::module;

/// Maximum number of diagnostics recorded.
export constant MAX_ERRORS: u32 = 64;

/// Power-of-two bucket count for interned type lookup chains.
constant TYPE_BUCKETS: u32 = 1024;
/// Power-of-two bucket count for exact nominal application lookup chains.
constant APPLICATION_BUCKETS: u32 = 1024;
/// Odd multiplier that combines cache key components.
constant CACHE_HASH_PRIME: u32 = 16777619;

/// Synthetic function name used when wrapping a bare expression for analysis.
export constant ANALYZE_EXPR_FN_NAME: *[u8] = "__expr__";
/// Synthetic function name used when wrapping a block for analysis.
export constant ANALYZE_BLOCK_FN_NAME: *[u8] = "__block__";

/// Maximum number of symbols stored within a module scope.
export constant MAX_MODULE_SYMBOLS: u32 = 528;
/// Maximum number of symbols stored within a local scope.
export constant MAX_LOCAL_SYMBOLS: u32 = 32;
/// Maximum function parameters.
export constant MAX_FN_PARAMS: u32 = 8;
/// Maximum function thrown types.
export constant MAX_FN_THROWS: u32 = 8;
/// Maximum number of variants in a union.
/// Nb. This should not be raised above `255`,
/// as tags are stored using 8-bits only.
export constant MAX_UNION_VARIANTS: u32 = 128;
/// Maximum nesting of loops.
export constant MAX_LOOP_DEPTH: u32 = 16;
/// Maximum trait instances.
export constant MAX_INSTANCES: u32 = 128;
/// Maximum standalone methods (across all types).
export constant MAX_METHODS: u32 = 256;
/// Maximum number of linear bindings active in one function.
constant MAX_LINEAR_BINDINGS: u32 = 32;
/// Maximum full-region projections active in nested lexical regions.
constant MAX_REGIONAL_LOANS: u32 = 32;
/// Maximum inline field depth used to prove borrow separation.
constant MAX_BORROW_FIELDS: u32 = 16;
/// Maximum nesting depth tracked for loops.
constant MAX_LINEAR_LOOP_DEPTH: u32 = 16;

/// Trait definition stored in the resolver.
export record TraitType: Copy {
    /// Trait name.
    name: *[u8],
    /// Module that declares the trait.
    moduleId: u16,
    /// Method signatures, including from supertraits.
    methods: *unsafe mut [TraitMethod],
    /// Supertraits that must also be implemented.
    supertraits: *unsafe mut [*unsafe TraitType],
}

/// A single method signature within a trait.
export record TraitMethod: Copy {
    /// Method name.
    name: *[u8],
    /// Function type for the method, excluding the receiver.
    fnType: *FnType,
    /// Whether the receiver is mutable.
    mutable: bool,
    /// Pointer-like class used by the receiver.
    receiverClass: types::PointerClass,
    /// V-table slot index.
    index: u32,
}

/// An entry in the trait instance registry.
export record InstanceEntry: Copy {
    /// Trait type descriptor.
    traitType: *unsafe TraitType,
    /// Concrete type that implements the trait.
    concreteType: Type,
    /// Name of the concrete type.
    concreteTypeName: *[u8],
    /// Module where this instance was declared.
    moduleId: u16,
    /// Method symbols for each trait method, in declaration order.
    methods: *unsafe mut [*unsafe mut Symbol],
}

/// An entry in the method registry.
export record MethodEntry: Copy {
    /// Module where the method is defined.
    moduleId: u16,
    /// Concrete type that owns the method.
    concreteType: Type,
    /// Name of the concrete type.
    concreteTypeName: *[u8],
    /// Method name.
    name: *[u8],
    /// Function type excluding the receiver.
    fnType: *FnType,
    /// Whether the receiver is mutable.
    mutable: bool,
    /// Pointer-like class used by the receiver.
    receiverClass: types::PointerClass,
    /// Resolver-local identity of the method symbol.
    symbolId: u32,
    /// Function type including the receiver, used for emitted calls.
    fullFnType: *FnType,
}

/// Identifier for the synthetic `len` field.
export constant LEN_FIELD: *[u8] = "len";
/// Identifier for the synthetic `ptr` field.
export constant PTR_FIELD: *[u8] = "ptr";
/// Identifier for the synthetic `cap` field.
export constant CAP_FIELD: *[u8] = "cap";

/// Maximum `u16` value.
constant U16_MAX: u16 = 0xFFFF;
/// Maximum `u8` value.
constant U8_MAX: u16 = 0xFF;

/// Minimum `i8` value.
constant I8_MIN: i32 = -128;
/// Maximum `i8` value.
constant I8_MAX: i32 = 127;
/// Minimum `i16` value.
constant I16_MIN: i32 = -32768;
/// Maximum `i16` value.
constant I16_MAX: i32 = 32767;

/// Minimum `i32` value.
constant I32_MIN: i32 = -2147483648;
/// Maximum `i32` value.
constant I32_MAX: i32 = 2147483647;
/// Minimum `i64` value: -(2^63).
constant I64_MIN: i64 = -9223372036854775808;
/// Maximum `i64` value: 2^63 - 1.
constant I64_MAX: i64 = 9223372036854775807;

/// Size of a pointer in bytes.
export constant PTR_SIZE: u32 = 8;

/// Information about a record or tuple field.
export record RecordField: Copy {
    /// Field name, `nil` for positional fields.
    name: ?*[u8],
    /// Field type.
    fieldType: Type,
    /// Byte offset from the start of the record.
    offset: i32,
}

/// Information about a union variant.
record UnionVariant: Copy {
    name: *[u8],
    valueType: Type,
    symbol: *unsafe mut Symbol,
}

/// Array type payload.
export record ArrayType: Copy {
    item: *Type,
    length: u32,
}

/// Record nominal type.
export record RecordType: Copy {
    /// Module that can access the representation, or `nil` for public fields.
    privateModule: ?u16,
    /// Region parameters of the source declaration.
    regions: ?*RegionScope,
    /// Exact region arguments, if this is an applied type.
    application: ?*unsafe mut NominalApplication,
    fields: *unsafe [RecordField],
    labeled: bool,
    /// Shared layout of the source declaration.
    layout: *Layout,
    /// Whether the declaration explicitly carries the `Once` marker.
    declaredLinear: bool,
    /// Whether the declaration explicitly carries the `Copy` marker.
    declaredCopy: bool,
}

/// Union nominal type.
export record UnionType: Copy {
    /// Region parameters of the source declaration.
    regions: ?*RegionScope,
    /// Exact region arguments, if this is an applied type.
    application: ?*unsafe mut NominalApplication,
    variants: *unsafe [UnionVariant],
    /// Shared layout of the source declaration.
    layout: *Layout,
    /// Cached payload offset within the union aggregate.
    valOffset: u32,
    /// If all variants have void payloads.
    isAllVoid: bool,
    /// Whether the declaration explicitly carries the `Once` marker.
    declaredLinear: bool,
    /// Whether the declaration explicitly carries the `Copy` marker.
    declaredCopy: bool,
}

/// Metadata for user-defined types.
export union NominalType: Copy {
    /// Placeholder for a type that hasn't been fully resolved yet.
    /// Stores the declaration node for lazy resolution.
    Placeholder(*ast::Node),
    /// Declaration whose value layout is under analysis.
    Resolving(*ast::Node),
    /// Applied type whose field or variant view is not yet resolved.
    Application(*unsafe mut NominalApplication),
    Record(RecordType),
    Union(UnionType),
}

/// Coercion plan, when coercion from one type to another.
export union Coercion: Copy {
    /// No coercion, eg. `T -> T`.
    Identity,
    /// Eg. `u8 -> i32`. Stores both source and target types for lowering.
    NumericCast { from: Type, to: Type },
    /// Eg. `T -> ?T`. Stores the inner value type.
    OptionalLift(Type),
    /// Wrap return value in success variant of result type.
    ResultWrap,
    /// Coerce a concrete pointer to a trait object.
    TraitObject {
        /// Trait type information.
        traitInfo: *unsafe TraitType,
        /// Instance entry for v-table lookup.
        inst: *unsafe InstanceEntry,
    },
}

/// Result of resolving a module path.
record ResolvedModule: Copy {
    /// Module entry in the graph.
    entry: *module::ModuleEntry,
    /// Scope containing the module's declarations.
    scope: *unsafe mut Scope,
}

/// Type layout.
export record Layout: Copy {
    /// Size in bytes.
    size: u32,
    /// Alignment in bytes.
    alignment: u32,
}

/// Computed union layout parameters.
record UnionLayoutInfo: Copy {
    layout: Layout,
    valOffset: u32,
    isAllVoid: bool,
}

/// Pre-computed metadata for slice range expressions.
/// Used by the lowerer.
export record SliceRangeInfo: Copy {
    /// Element type of the resulting slice.
    itemType: *Type,
    /// Whether the resulting slice is mutable.
    mutable: bool,
    /// Static capacity if container is an array.
    capacity: ?u32,
}

/// Pre-computed metadata for `for` loop iteration.
/// Used by the lowerer to avoid re-analyzing the iterable type.
export union ForLoopInfo: Copy {
    /// Iterating over a range expression (e.g., `for i in 0..n`).
    Range {
        valType: *Type,
        range: ast::Range,
        bindingName: ?*[u8],
        indexName: ?*[u8]
    },
    /// Iterating over an array or slice. For arrays, the length field is set.
    Collection {
        elemType: *Type,
        length: ?u32,
        bindingName: ?*[u8],
        indexName: ?*[u8]
    },
}

/// Resolved function signature details.
export record FnType: Copy {
    /// Symbolic regions declared by the source function.
    regions: ?*RegionScope,
    /// Parameter types in call order.
    paramTypes: *[*Type],
    /// Return value type.
    returnType: *Type,
    /// Error types that the function can throw.
    throwList: *[*Type],
    /// Whether calling this function requires an unsafe context.
    isUnsafe: bool,
}

/// Describes a type computed during semantic analysis.
export union Type: Copy {
    /// A type that couldn't be decided.
    Unknown,
    /// Types only used during inference.
    Nil, Undefined, Int,
    /// Primitive types.
    Void, Opaque, Never, Bool,
    /// Integer types.
    U8, U16, U32, U64, I8, I16, I32, I64,
    /// Shared cell pointer with controlled payload access.
    Cell {
        /// Storage lifetime and ownership class.
        class: types::PointerClass,
        /// Optional compile-time permission region.
        permission: ?*unsafe types::Region,
        /// Payload type, preserved by all writes.
        payload: *Type,
    },
    /// Affine allocation interface retained by a lexical region.
    Session(*unsafe types::Region),
    /// Range types, eg. `start..end`.
    Range {
        start: ?*Type,
        end: ?*Type,
    },
    /// Owning pointer-like address.
    Pointer {
        class: types::PointerClass,
        target: *Type,
        mutable: bool,
    },
    /// Owning slice.
    Slice {
        class: types::PointerClass,
        item: *Type,
        mutable: bool,
    },
    /// Eg. `[i32; 32]`.
    Array(ArrayType),
    /// Eg. `?T`.
    Optional(*Type),
    /// Eg. `fn id(i32) -> i32`.
    Fn(*FnType),
    /// Named, ie. user-defined types, includes union variants.
    Nominal(*unsafe NominalType),
    /// Owning trait object. An erased type with v-table.
    TraitObject {
        /// Ownership and safety class.
        class: types::PointerClass,
        /// Trait definition.
        traitInfo: *unsafe TraitType,
        /// Whether the pointer is mutable.
        mutable: bool,
    },
}

/// Structured diagnostic payload for type mismatches.
export record TypeMismatch: Copy {
    expected: Type,
    actual: Type,
}

/// Structured diagnostic payload for invalid `as` casts.
export record InvalidAsCast: Copy {
    from: Type,
    to: Type,
}

/// Diagnostic payload for argument count mismatches.
export record CountMismatch: Copy {
    expected: u32,
    actual: u32,
}

/// Detailed payload attached to a symbol, specialized per symbol kind.
export union SymbolData: Copy {
    /// Payload describing mutable bindings like variables or functions.
    Value {
        /// Whether the binding permits mutation.
        mutable: bool,
        /// Custom alignment requirement, or 0 for default.
        alignment: u32,
        /// Resolved type associated with the value.
        type: Type,
        /// Whether the variable's address is taken anywhere (via `&` or `&mut`).
        /// Used by the lowerer to allocate a stack slot eagerly.
        addressTaken: bool,
    },
    /// Payload describing constants.
    Constant {
        /// Resolved type associated with the value.
        type: Type,
        /// Constant value, if any.
        value: ?ConstValue,
    },
    /// Payload describing union variants and the union type they instantiate.
    Variant {
        /// Variant payload type.
        type: Type,
        /// Union declaration.
        decl: *ast::Node,
        /// Variant ordinal in declaration order.
        ordinal: u32,
        /// Variant index within the union.
        index: u32,
    },
    /// Module reference.
    Module {
        /// Module entry in the graph.
        entry: *module::ModuleEntry,
        /// Module scope.
        scope: *unsafe mut Scope,
    },
    /// Payload describing type symbols with their resolved type.
    Type(*unsafe mut NominalType),
    /// Trait symbol.
    Trait(*unsafe mut TraitType),
}

/// Resolved symbol allocated during semantic analysis.
export record Symbol: Copy {
    /// Unique identity within the resolver that created this symbol.
    id: u32,
    /// Symbol name in source code.
    name: *[u8],
    /// Data associated with the symbol.
    data: SymbolData,
    /// Bitset of attributes applied to the declaration.
    attrs: u32,
    /// AST node that introduced the symbol.
    node: *ast::Node,
    /// Module ID this symbol belongs to. Only for module-level symbols.
    moduleId: ?u16,
}

/// Integer constant payload.
export record ConstInt: Copy {
    /// Absolute magnitude of the value.
    magnitude: u64,
    /// Bit width of the integer.
    bits: u8,
    /// Whether the integer is signed.
    signed: bool,
    /// Whether the value is negative (only valid when `signed` is true).
    negative: bool,
}

/// Constant value recorded for literal nodes.
export union ConstValue: Copy {
    Bool(bool),
    Char(u8),
    String(*[u8]),
    Int(ConstInt),
}

/// Integer range metadata for primitive integer types.
union IntegerRange: Copy {
    Signed {
        bits: u8,
        min: i64,
        max: i64,
        lim: u64,
    },
    Unsigned {
        bits: u8,
        max: u64,
    },
}

/// Diagnostic emitted by the analyzer.
export record Error: Copy {
    /// Error category.
    kind: ErrorKind,
    /// Node associated with the error, if known.
    node: ?*ast::Node,
    /// Module ID where this error occurred.
    moduleId: u16,
}

/// High-level classification for semantic diagnostics.
export union ErrorKind: Copy {
    /// Identifier declared more than once in the same scope.
    DuplicateBinding(*[u8]),
    /// Identifier referenced before it was declared.
    UnresolvedSymbol(*[u8]),
    /// Attempted to assign to an immutable binding.
    ImmutableBinding,
    /// Slice append requires a valid allocator record and callback.
    InvalidSliceAllocator,
    /// Expected a compile-time constant expression.
    ConstExprRequired,
    /// Symbol arena exhausted while binding identifiers.
    SymbolOverflow,
    /// Expression has the wrong type.
    TypeMismatch(TypeMismatch),
    /// Numeric literal does not fit within the required range.
    NumericLiteralOverflow,
    /// Record literal omitted a required field.
    RecordFieldMissing(*[u8]),
    /// Record representation is private to another module.
    OpaqueRecordAccess,
    /// Record literal referenced a field that does not exist.
    RecordFieldUnknown(*[u8]),
    /// Brace syntax used on unlabeled record.
    RecordFieldStyleMismatch,
    /// Record literal supplied the wrong number of fields.
    RecordFieldCountMismatch(CountMismatch),
    /// Record literal fields not in declaration order.
    RecordFieldOutOfOrder { field: *[u8], prev: *[u8] },
    /// Function call supplied the wrong number of arguments.
    FnArgCountMismatch(CountMismatch),
    /// Function throws list has the wrong number of types.
    FnThrowCountMismatch(CountMismatch),
    /// Expected an identifier node.
    ExpectedIdentifier,
    /// Expected any optional type.
    ExpectedOptional,
    /// Expected a numeric type.
    ExpectedNumeric,
    /// Expected a pointer type.
    ExpectedPointer,
    /// Expected a record type.
    ExpectedRecord,
    /// Expected an array or slice value.
    ExpectedIndexable,
    /// Expected an iterable (array, slice, or range) for a `for` loop.
    ExpectedIterable,
    /// Invalid `as` cast between the provided types.
    InvalidAsCast(InvalidAsCast),
    /// Invalid alignment value specified.
    InvalidAlignmentValue(u32),
    /// Invalid module path.
    InvalidModulePath,
    /// Invalid identifier.
    InvalidIdentifier(*ast::Node),
    /// Placeholder used where a value expression is required.
    PlaceholderExpression,
    /// Invalid scope access.
    InvalidScopeAccess,
    /// Referenced an unknown array field.
    ArrayFieldUnknown(*[u8]),
    /// Referenced an unknown slice field.
    SliceFieldUnknown(*[u8]),
    /// Array slicing without taking an address.
    SliceRequiresAddress,
    /// Slice bounds exceed array length.
    SliceRangeOutOfBounds,
    /// Unexpected `return` statement.
    UnexpectedReturn,
    /// Unexpected module name.
    UnexpectedModuleName,
    /// Unexpected node.
    UnexpectedNode(*ast::Node),
    /// Function with non-void return type falls through without returning.
    FnMissingReturn,
    /// Function is missing a body.
    FnMissingBody,
    /// Function body is not expected.
    FnUnexpectedBody,
    /// Intrinsic function must not have a body.
    IntrinsicUnexpectedBody,
    /// Encountered loop control outside of a loop construct.
    InvalidLoopControl,
    /// `try` used when the enclosing function does not declare throws.
    TryRequiresThrows,
    /// `try` used to propagate an error not declared by the enclosing function.
    TryIncompatibleError,
    /// `throw` used when the enclosing function does not declare throws.
    ThrowRequiresThrows,
    /// `throw` used with an error type not declared by the enclosing function.
    ThrowIncompatibleError,
    /// `try` applied to an expression that cannot throw.
    TryNonThrowing,
    /// Inferred catch binding used with multi-error callee.
    TryCatchMultiError,
    /// Duplicate error type in typed catch clauses.
    TryCatchDuplicateType,
    /// Distinct error types have the same tag after region erasure.
    AmbiguousRegionalError,
    /// Typed catch clauses do not cover all error types.
    TryCatchNonExhaustive,
    /// Called a fallible function without using `try`.
    MissingTry,
    /// Cannot use opaque type in this context.
    OpaqueTypeNotAllowed,
    /// Cannot dereference pointer to opaque type.
    OpaqueTypeDeref,
    /// Cannot perform pointer arithmetic on opaque pointer.
    OpaquePointerArithmetic,
    /// Cannot infer type from context.
    CannotInferType,
    /// Cannot assign a void value to a variable.
    CannotAssignVoid,
    /// `default` attribute used on a non-function declaration.
    DefaultAttrOnlyOnFn,
    /// Union variant requires a payload but none was provided.
    UnionVariantPayloadMissing(*[u8]),
    /// Union variant does not expect a payload but one was provided.
    UnionVariantPayloadUnexpected(*[u8]),
    /// `match` on a union omits a variant without a `default` case.
    UnionMatchNonExhaustive(*[u8]),
    /// `match` on an optional is missing a value case.
    OptionalMatchMissingValue,
    /// `match` on an optional is missing a nil case.
    OptionalMatchMissingNil,
    /// `match` on a bool is missing a case (true or false).
    BoolMatchMissing(bool),
    /// `match` on a non-union type is missing a catch-all.
    MatchNonExhaustive,
    /// `match` has more than one catch-all prongs.
    DuplicateCatchAll,
    /// `match` has a prong after an unguarded catch-all.
    CatchAllMustBeLast,
    /// `match` has a duplicate case pattern.
    DuplicateMatchPattern,
    /// `match` has an unreachable `else`: all cases are already handled.
    UnreachableElse,
    /// Builtin called with wrong number of arguments.
    BuiltinArgCountMismatch(CountMismatch),
    /// Instance method receiver mutability does not match the trait declaration.
    ReceiverMutabilityMismatch,
    /// Duplicate instance declaration for the same (trait, type) pair.
    DuplicateInstance,
    /// Instance declaration is missing a required trait method.
    MissingTraitMethod(*[u8]),
    /// Trait name used as a value expression.
    UnexpectedTraitName,
    /// Trait method receiver does not point to the declaring trait.
    TraitReceiverMismatch,
    /// Trait declaration and instance disagree about unsafe call requirements.
    TraitMethodSafetyMismatch,
    /// Function declaration has too many parameters.
    FnParamOverflow(CountMismatch),
    /// Function declaration has too many throws.
    FnThrowOverflow(CountMismatch),
    /// Trait declaration has too many methods.
    TraitMethodOverflow(CountMismatch),
    /// Instance declaration is missing a required supertrait instance.
    MissingSupertraitInstance(*[u8]),
    /// An affine binding was used after it moved.
    AffineUseAfterMove(*[u8]),
    /// Linear binding was consumed more than once.
    LinearUseAfterConsume(*[u8]),
    /// Linear binding remains available at an exit.
    LinearNotConsumed(*[u8]),
    /// A case-pattern `let-else` fallback must terminate control flow.
    LinearLetElseMustTerminate,
    /// Branches disagree about a linear binding's state.
    LinearBranchMismatch(*[u8]),
    /// A linear field cannot be moved independently.
    LinearPartialMove,
    /// A linear value cannot be discarded.
    LinearDiscard,
    /// Assignment would overwrite a live linear value.
    LinearOverwrite,
    /// `undefined` cannot initialize a linear type.
    LinearUndefined,
    /// A `Copy` declaration contains a non-copy field or variant.
    CopyContainsNonCopy,
    /// A declaration carries both `Copy` and `Once`.
    ConflictingOwnershipMarkers,
    /// A region name is not visible in this declaration or block.
    UnknownRegion(*[u8]),
    /// A region application has the wrong argument count.
    RegionArgumentCount(CountMismatch),
    /// A region parameter has no consistent argument from checked references.
    RegionInference(*[u8]),
    /// A region argument does not satisfy its declared parent relation.
    RegionParent(*[u8]),
    /// A region parent relation contains a cycle.
    RegionCycle(*[u8]),
    /// A value retains a region that has left lexical scope.
    RegionEscape(*[u8]),
    /// A session requires one exclusive borrow of an allocation trait implementer.
    InvalidSessionSource,
    /// Allocation requires a value that can be discarded without destruction.
    InvalidAllocationValue,
    /// Cell payload does not satisfy storage and ownership requirements.
    InvalidCellPayload,
    /// Cell payload access lacks matching lexical permission authority.
    CellPermissionRequired(*[u8]),
    /// The allocated value has an invalid or overflowing layout.
    InvalidAllocationLayout,
    /// A compiler-known allocation trait method has an invalid signature.
    InvalidAllocationRuntime,
    /// The function has too many distinct full-region projections.
    RegionalLoanOverflow,
    /// A nominal value layout contains itself.
    RecursiveType,
    /// A reference appears in a storable or escaping position.
    InvalidRefPosition,
    /// A reference local requires a fixed binding to existing storage.
    RefBinding,
    /// Call arguments contain overlapping incompatible loans.
    BorrowConflict(*[u8]),
    /// Unsafe operation outside an unsafe context.
    UnsafeOperation,
    /// An unsafe call requires an unsafe context.
    UnsafeCall,
    /// Internal error.
    Internal,
}

/// Diagnostics returned by the analyzer.
export record Diagnostics: Copy {
    /// Immutable errors captured at the end of an analysis operation.
    errors: *[Error],
}

/// Mutable diagnostic storage owned by a resolver.
record DiagnosticBuffer {
    /// Backing entries. Only the prefix below `len` is initialized.
    entries: *mut [Error],
    /// Number of recorded errors.
    len: u32,
}

/// Call context.
union CallCtx: Copy {
    /// Normal function call.
    Normal,
    /// Fallible function call, ie. `try f()`.
    Try,
}

/// Result of resolving a record literal's type name.
record ResolvedRecordLitType: Copy {
    /// The record nominal type to use for field checking.
    recordType: *unsafe NominalType,
    /// The result type of the literal (record type or union type for variants).
    resultType: Type,
}

/// Result of checking for a `super` path prefix.
record SuperAccessResult: Copy {
    scope: *unsafe mut Scope,
    child: *ast::Node,
}

/// Initialization operation performed after session storage reservation.
export union SessionAllocationKind: Copy {
    /// Initialize one object from a value.
    New,
    /// Copy plain Copy elements from a slice.
    Copy,
    /// Fill a slice with a plain Copy value.
    Fill,
}

/// Typed session allocation and its checked runtime reservation function.
export record SessionAllocation: Copy {
    /// Initialization operation.
    kind: SessionAllocationKind,
    /// Initialized element type.
    item: *Type,
    /// Allocation trait used by the session source.
    traitInfo: *unsafe TraitType,
    /// Reservation method slot in the allocation trait.
    methodIndex: u32,
}

/// Node-specific resolver metadata.
export union NodeExtra: Copy {
    /// No extra data for this node.
    None,
    /// Region identities owned by a source declaration.
    Regions(*RegionScope),
    /// Resolved field index for record literal fields.
    RecordField { index: u32 },
    /// Slice range metadata for subscript expressions with ranges.
    SliceRange(SliceRangeInfo),
    /// Cached union variant metadata for patterns/constructors.
    UnionVariant { ordinal: u32, tag: u32 },
    /// Match prong metadata.
    MatchProng { catchAll: bool },
    /// Match expression metadata.
    Match { isConst: bool },
    /// For-loop iteration metadata.
    ForLoop(ForLoopInfo),
    /// Trait method call metadata.
    TraitMethodCall {
        /// Trait definition.
        traitInfo: *unsafe TraitType,
        /// Method index in the v-table.
        methodIndex: u32,
    },
    /// Standalone method call metadata.
    MethodCall { method: *unsafe MethodEntry },
    /// Typed allocation through a session interface.
    SessionAllocation(SessionAllocation),
    /// Slice `.append(val, allocator)` method call.
    SliceAppend { elemType: *Type },
    /// Slice `.delete(index)` method call.
    SliceDelete { elemType: *Type },
}

/// Symbol identity and storage associated with a resolved AST node.
export record ResolvedSymbol: Copy {
    /// Identity within the resolver that owns the node metadata.
    id: u32,
    /// Symbol storage used by type resolution and lowering.
    symbol: *unsafe mut Symbol,
}

/// Combined resolver metadata for a single AST node.
export record NodeData: Copy {
    /// Number of local bindings and internal iteration variables in this function.
    localCount: u32,
    /// Resolved type for this node.
    ty: Type,
    /// Coercion plan applied to this node.
    coercion: Coercion,
    /// Symbol identity and storage associated with this node.
    binding: ?ResolvedSymbol,
    /// Constant value for literal nodes.
    constValue: ?ConstValue,
    /// Lexical scope owned by this node.
    scope: ?*unsafe mut Scope,
    /// Node-specific extra data.
    extra: NodeExtra,
}

/// Table storing all resolver metadata indexed by node ID.
record NodeDataTable {
    /// Semantic data indexed by AST node ID.
    entries: *mut [NodeData],
}

/// Lexical scope.
export record Scope: Copy {
    /// Owning AST node, or `nil` for the root scope.
    owner: ?*ast::Node,
    /// Parent/enclosing scope.
    parent: ?*unsafe mut Scope,
    /// Module ID if this is a module scope.
    moduleId: ?u16,
    /// Symbols introduced inside the scope, allocated from the arena.
    symbols: *unsafe mut [*unsafe mut Symbol],
    /// Number of live symbols.
    symbolsLen: u32,
}

/// An object used by the enter and exit functions for module scopes.
record ModuleScope: Copy {
    /// Module root node.
    root: *ast::Node,
    /// Module entry in graph.
    entry: *module::ModuleEntry,
    /// The newly entered scope.
    newScope: *unsafe mut Scope,
    /// The previous scope.
    prevScope: *unsafe mut Scope,
    /// The previous module.
    prevMod: u16,
}

/// Loop context for tracking control flow within loops.
record LoopCtx: Copy {
    /// Whether a reachable break was encountered in this loop.
    /// This is used to determine whether a loop diverges.
    hasBreak: bool,
}

/// Configuration for semantic analysis.
export record Config: Copy {
    /// Whether we're building in test mode.
    buildTest: bool,
}

/// How pattern bindings are created during match.
export union MatchBy: Copy {
    /// Match by value.
    Value,
    /// Match by immutable reference.
    Ref(types::PointerClass),
    /// Match by mutable reference.
    MutRef,
}

/// State of a match statement being resolved.
// TODO: This is only used because of the maximum function param limitation.
record MatchState: Copy {
    /// Is the match catch-all?
    catchAll: bool,
    /// Is the match constant?
    isConst: bool
}

/// Result of unwrapping a type for pattern matching.
export record MatchSubject: Copy {
    /// The effective type to match against.
    effectiveTy: Type,
    /// How bindings should be created.
    by: MatchBy,
}

/// How an expression uses a linear result.
union LinearUse: Copy {
    /// Consume the value and end its availability.
    Consume,
    /// Read the value without consuming it.
    Observe,
    /// Borrow the value through a reference.
    Borrow,
    /// Discard an unused expression result.
    Discard,
    /// Use the value as an assignment target.
    Place,
    /// Evaluate a place prefix after checking the complete place.
    Locate,
}

/// Region role sought during compile-time type traversal.
union RegionTypeRole: Copy {
    /// Compile-time identity associated with a cell payload.
    CellPermission,
    /// Storage reference that can carry a regional borrow.
    Reference,
    /// Interior storage that can retain a reference after a call returns.
    Retention,
    /// Region dependencies that must cover a destination.
    StorageValidation,
    /// Named storage retained by a value.
    StoragePresence,
}

/// Consumption rule for a tracked move-only binding.
union BindingUse: Copy {
    /// The binding can be consumed at most once.
    Affine,
    /// The binding must be consumed exactly once.
    Linear,
}

/// Resolved binding metadata retained for ownership checks and diagnostics.
record TrackedSymbol: Copy {
    /// Resolver-local symbol identity.
    id: u32,
    /// Source name used in ownership diagnostics.
    name: *[u8],
    /// Declaration used to locate an unconsumed binding.
    node: *ast::Node,
    /// Consumption rule fixed before ownership analysis.
    usage: BindingUse,
}

/// Per-control-flow-path ownership state.
/// Active binding slots below `len` must contain metadata.
record LinearEnv: Copy {
    /// Active full-region loans, indexed by the checker's regional loan table.
    regionalLoans: u64,
    /// Initialized slots for resolved binding metadata.
    symbols: [?TrackedSymbol; MAX_LINEAR_BINDINGS],
    /// Bit set for each binding that remains available.
    available: u64,
    /// Number of active binding slots in `symbols`.
    len: u32,
    /// Whether this control-flow path has terminated.
    terminated: bool,
}

/// A storage root and its statically distinct record fields.
record BorrowPlace: Copy {
    /// Symbol that owns or supplies the storage.
    root: ?*unsafe mut Symbol,
    /// Field indices before the first uncertain projection.
    fields: [u32; MAX_BORROW_FIELDS],
    /// Number of initialized field indices.
    len: u32,
    /// Whether further projections can identify distinct storage.
    precise: bool,
}
/// A reference binding that protects its source for one lexical scope.
record LocalLoan: Copy {
    /// Local symbol that provides access, or nil for a pending call argument.
    binding: ?*unsafe mut Symbol,
    /// Storage retained by the reference.
    place: BorrowPlace,
    /// Whether other reads of the source are excluded.
    exclusive: bool,
    /// Permission identity protected independently of the source place.
    permission: ?*unsafe types::Region,
    /// Named region that owns associated cell storage, when one exists.
    storage: ?*unsafe types::Region,
}

/// Argument metadata retained during call-scoped conflict checks.
record CallArgument: Copy {
    /// Receiver or explicit argument expression.
    node: *ast::Node,
    /// Whether overlapping argument access is excluded.
    exclusive: bool,
}
/// Function-local exact-use checker state.
/// Read loop arrays only at indices below `loopDepth`.
/// `enterLinearLoop` initializes each slot before it increases `loopDepth`.
record LinearChecker: 'arena + 'checking where 'arena: 'checking {
    /// Resolver that owns the symbols and diagnostics.
    resolver: &'checking mut Resolver 'arena,
    /// Regional projections discovered in this function.
    regional: [?RegionalLoan; MAX_REGIONAL_LOANS],
    /// Number of active regional loan entries.
    regionalLen: u32,
    /// Named regions active at the current source location.
    regions: ?*RegionScope,
    /// Regional loans carried to each loop's next iteration.
    loopBackLoans: [u64; MAX_LINEAR_LOOP_DEPTH],
    /// Regional loans carried to each loop's exits.
    loopExitLoans: [u64; MAX_LINEAR_LOOP_DEPTH],
    /// Regions active at each loop's entry and exit.
    loopRegions: [?*RegionScope; MAX_LINEAR_LOOP_DEPTH],
    /// Source places protected by active pattern references.
    loans: [BorrowPlace; MAX_LINEAR_BINDINGS],
    /// Number of active entries in `loans`.
    loanLen: u32,
    /// Reference locals in active lexical scopes.
    locals: [LocalLoan; MAX_LINEAR_BINDINGS],
    /// Number of active local loans.
    localLen: u32,
    /// Permission identities controlled by active lexical authority bindings.
    authorityPermissions: [?*unsafe types::Region; MAX_LINEAR_BINDINGS],
    /// Bindings that provide each lexical permission authority.
    authorityBindings: [?*unsafe mut Symbol; MAX_LINEAR_BINDINGS],
    /// Whether each lexical authority permits exclusive payload access.
    authorityExclusive: [bool; MAX_LINEAR_BINDINGS],
    /// Number of initialized authority entries.
    authorityLen: u32,
    /// Associated payload address currently validated by a region header.
    payloadAddress: ?*ast::Node,
    /// Matching authority reborrow currently being checked.
    witnessPermission: ?*unsafe types::Region,
    /// Binding count at entry to each active loop.
    loopMarks: [u32; MAX_LINEAR_LOOP_DEPTH],
    /// Available bindings at entry to each active loop.
    loopAvailable: [u64; MAX_LINEAR_LOOP_DEPTH],
    /// Available bindings shared by the exits from each active loop.
    loopExitAvailable: [u64; MAX_LINEAR_LOOP_DEPTH],
    /// Whether each active loop can exit without `break`.
    loopHasNaturalExit: [bool; MAX_LINEAR_LOOP_DEPTH],
    /// Whether each active loop contains a reachable `break`.
    loopBreakSeen: [bool; MAX_LINEAR_LOOP_DEPTH],
    /// Number of active loops.
    loopDepth: u32,
}

/// Unwrap a pointer type for pattern matching.
export fn unwrapMatchSubject(ty: Type) -> MatchSubject {
    if let case Type::Pointer { class, target, mutable } = ty {
        let mut bindingClass = types::PointerClass::Ref;
        if let case types::PointerClass::Region(_) = class {
            set bindingClass = class;
        }
        let by = MatchBy::MutRef if mutable else MatchBy::Ref(bindingClass);
        return MatchSubject { effectiveTy: *target, by };
    }
    return MatchSubject { effectiveTy: ty, by: MatchBy::Value };
}

/// Source nodes that define the identities in one region environment.
export union RegionDeclarations: Copy {
    /// Declaration parameters, including any non-region constraints.
    Parameters(*[*ast::Node]),
    /// Single region introduced by a lexical block.
    Block(*ast::Node),
}

/// Region names introduced by a declaration or lexical block.
export record RegionScope: Copy {
    /// Immutable source declarations that supply region identities.
    declarations: RegionDeclarations,
    /// Entries in declaration order.
    entries: *unsafe [*unsafe mut types::Region],
    /// Enclosing lexical region environment.
    parent: ?*RegionScope,
}

/// Region arguments for one source declaration.
record RegionSubstitution: Copy {
    /// Declared parameters in source order.
    parameters: *RegionScope,
    /// Inferred or explicit arguments. Every entry must be set before substitution.
    arguments: *unsafe mut [?*unsafe types::Region],
}

/// One interned application of a nominal declaration to exact region arguments.
export record NominalApplication: Copy {
    /// Canonical source declaration identity.
    base: *unsafe NominalType,
    /// Source parameters in declaration order.
    parameters: *RegionScope,
    /// Region arguments in parameter order.
    arguments: *unsafe [*unsafe types::Region],
    /// Stable descriptor for the substituted field or variant view.
    view: *unsafe mut NominalType,
    /// Resolver-private generation of the most recent compile-time traversal.
    traversalGeneration: u32,
    /// Resolver-private region roles visited during that traversal.
    traversalRoles: u8,
    /// Next application in the resolver cache.
    next: ?*unsafe mut NominalApplication,
    /// Next application in the same lookup bucket.
    bucketNext: ?*unsafe mut NominalApplication,
}

/// Global resolver state.
export record Resolver: 'arena {
    /// Number of symbol identities allocated by this resolver.
    symbolCount: u32,
    /// Active region names for source type checking.
    regionScope: ?*RegionScope,
    /// Interned applications of nominal region parameters.
    applications: ?*unsafe mut NominalApplication,
    /// First entry in the fully resolved suffix of the application list.
    completedApplications: ?*unsafe mut NominalApplication,
    /// Exact application lookup chains, backed by the resolver arena.
    applicationBuckets: *unsafe mut [?*unsafe mut NominalApplication],
    /// Monotonic identity for cycle-safe compile-time type traversals.
    nominalTraversalGeneration: u32,
    /// Cell payload checks that require complete nominal layouts.
    cellChecks: *mut [CellCheck],
    /// Current scope.
    scope: *unsafe mut Scope,
    /// Package scope containing package roots and top-level symbols.
    pkgScope: *unsafe mut Scope,
    /// Stack of loop contexts for nested loops.
    loopStack: [LoopCtx; MAX_LOOP_DEPTH],
    /// Current loop depth, indexes into loop stack.
    loopDepth: u32,
    /// Signature of the function currently being analyzed.
    currentFn: ?FnType,
    /// Declaration that owns the active function body and its local bindings.
    currentFnNode: ?*ast::Node,
    /// Current module being analyzed.
    currentMod: u16,
    /// Whether the current lexical context permits unsafe operations.
    inUnsafeContext: bool,
    /// Configuration for semantic analysis.
    config: Config,
    /// Caller-owned arena, valid for this resolver and all emitted metadata.
    arena: &'arena mut alloc::Arena,
    /// Combined semantic metadata table indexed by node ID.
    nodeData: NodeDataTable,
    /// Lookup chains for interned types.
    types: *unsafe mut [?*TypeNode],
    /// Diagnostics recorded so far.
    errors: DiagnosticBuffer,
    /// Stable module identities indexed by module ID.
    moduleEntries: [?*module::ModuleEntry; module::MAX_MODULES],
    /// Parsed roots captured while module update authority is available.
    moduleRoots: [?*ast::Node; module::MAX_MODULES],
    /// Cache of module scopes indexed by module ID.
    moduleScopes: [?*unsafe mut Scope; module::MAX_MODULES],
    /// Trait instance registry.
    instances: [InstanceEntry; MAX_INSTANCES],
    /// Number of registered instances.
    instancesLen: u32,
    /// Standalone method registry.
    methods: [MethodEntry; MAX_METHODS],
    /// Number of registered standalone methods.
    methodsLen: u32,
}

/// Deferred cell payload validation that requires a complete nominal layout.
record CellCheck: Copy {
    /// Source signature used for diagnostics.
    node: *ast::Node,
    /// Payload whose layout and ownership must be checked.
    payload: Type,
    /// Permission association that makes affine payloads eligible.
    permission: ?*unsafe types::Region,
    /// Region environment at the source signature.
    regions: ?*RegionScope,
    /// Module that owns the source signature.
    moduleId: u16,
}

/// Internal error sentinel thrown when analysis cannot proceed.
export union ResolveError: Copy {
    Failure,
}

/// Node in a type interning lookup chain.
record TypeNode: Copy {
    /// Exact interned type value.
    ty: Type,
    /// Next type in the same lookup bucket.
    next: ?*TypeNode,
}

/// Look up a region name in a lexical environment.
unsafe fn findRegion(scope: ?*RegionScope, name: *[u8]) -> ?*unsafe mut types::Region {
    let mut current = scope;
    while let env = current {
        for region in env.entries {
            if mem::eq(region.name, name) {
                return region;
            }
        }
        set current = env.parent;
    }
    return nil;
}

/// Resolve a source region name without using its spelling as an identity.
unsafe fn resolveRegion 'arena (self: &mut Resolver 'arena, node: *ast::Node) -> *unsafe types::Region
    throws (ResolveError)
{
    let case ast::NodeValue::Region { name, .. } = node.value
        else panic "resolveRegion: invalid region node";
    let region = findRegion(self.regionScope, name)
        else throw emitError(self, node, ErrorKind::UnknownRegion(name));
    return region;
}

/// Bind all region parameters before resolving their parent relations.
unsafe fn bindRegions 'arena (self: &mut Resolver 'arena, owner: *ast::Node, nodes: *[*ast::Node]) -> ?*RegionScope
    throws (ResolveError)
{
    if let case NodeExtra::Regions(scope) = self.nodeData.entries[owner.id].extra {
        return scope;
    }
    let mut count: u32 = 0;
    for node in nodes {
        if let case ast::NodeValue::Region { .. } = node.value {
            set count += 1;
        }
    }
    if count == 0 {
        return nil;
    }
    let entries = try! alloc::allocRawSlice(
        self.arena, @sizeOf(*unsafe mut types::Region), @alignOf(*unsafe mut types::Region), count
    ) as *unsafe mut [*unsafe mut types::Region];
    let mut index: u32 = 0;
    for node in nodes {
        let case ast::NodeValue::Region { name, .. } = node.value else continue;
        for i in 0..index {
            if mem::eq(entries[i].name, name) {
                throw emitError(self, node, ErrorKind::DuplicateBinding(name));
            }
        }
        let region = try! alloc::allocRaw(self.arena, @sizeOf(types::Region), @alignOf(types::Region))
            as *unsafe mut types::Region;
        set *region = types::Region { id: node.id, origin: types::RegionOrigin::Parameter, name, parent: nil };
        set entries[index] = region;
        set index += 1;
    }
    let scope = try! alloc::alloc(&mut *self.arena, @sizeOf(RegionScope), @alignOf(RegionScope)) as *mut RegionScope;
    set *scope = RegionScope {
        declarations: RegionDeclarations::Parameters(nodes),
        entries,
        parent: nil,
    };
    let frozen: *RegionScope = scope;
    set index = 0;
    for node in nodes {
        let case ast::NodeValue::Region { parent, .. } = node.value else continue;
        if let parentNode = parent {
            let case ast::NodeValue::Region { name, .. } = parentNode.value
                else panic "bindRegions: invalid parent node";
            let target = findRegion(frozen, name)
                else throw emitError(self, parentNode, ErrorKind::UnknownRegion(name));
            if types::regionContains(entries[index], target) {
                throw emitError(self, parentNode, ErrorKind::RegionCycle(entries[index].name));
            }
            set entries[index].parent = target;
        }
        set index += 1;
    }
    set self.nodeData.entries[owner.id].extra = NodeExtra::Regions(frozen);
    return frozen;
}

/// Mix aligned metadata addresses into a lookup key.
fn addressHash(address: u64) -> u32 {
    return ((address >> 3) as u32) ^ ((address >> 35) as u32);
}

/// Hash the active fields of a pointer class.
unsafe fn classHash(class: types::PointerClass) -> u32 {
    match class {
        case types::PointerClass::Owned => return 1,
        case types::PointerClass::Ref => return 2,
        case types::PointerClass::Unsafe => return 3,
        case types::PointerClass::Region(region) => return addressHash(region as u64),
    }
}

/// Hash active type fields so equal values select the same lookup chain.
unsafe fn typeHash(ty: Type) -> u32 {
    match ty {
        case Type::Cell { class, permission, payload } => {
            let mut hash = addressHash(payload as u64) ^ (classHash(class) * CACHE_HASH_PRIME);
            if let region = permission {
                set hash = (hash ^ addressHash(region as u64)) * CACHE_HASH_PRIME;
            }
            return hash;
        }
        case Type::Pointer { class, target, mutable } =>
            return addressHash(target as u64) ^ (classHash(class) * CACHE_HASH_PRIME) ^ (1 if mutable else 0),
        case Type::Slice { class, item, mutable } =>
            return addressHash(item as u64) ^ (classHash(class) * CACHE_HASH_PRIME) ^ (1 if mutable else 0),
        case Type::TraitObject { class, traitInfo, mutable } =>
            return addressHash(traitInfo as u64) ^ (classHash(class) * CACHE_HASH_PRIME) ^ (1 if mutable else 0),
        case Type::Session(region) => return addressHash(region as u64),
        case Type::Optional(inner) => return addressHash(inner as u64),
        case Type::Fn(info) => return addressHash(info as u64),
        case Type::Nominal(info) => return addressHash(info as u64),
        case Type::Array(array) => return addressHash(array.item as u64) ^ (array.length * CACHE_HASH_PRIME),
        case Type::Range { start, end } => {
            let mut hash: u32 = 0;
            if let item = start {
                set hash = addressHash(item as u64);
            }
            if let item = end {
                set hash = hash ^ (addressHash(item as u64) * CACHE_HASH_PRIME);
            }
            return hash;
        }
        else => return 0,
    }
}

/// Allocate and intern a type in the arena, returning a pointer for deduplication.
export unsafe fn allocType 'arena (self: &mut Resolver 'arena, ty: Type) -> *Type {
    // Search existing types for a match.
    let bucket = typeHash(ty) & (TYPE_BUCKETS - 1);
    let mut cursor = self.types[bucket];
    while let node = cursor {
        if node.ty == ty {
            return &node.ty;
        }
        set cursor = node.next;
    }
    // Allocate a new type node from the arena.
    let node = try! alloc::alloc(
        &mut *self.arena, @sizeOf(TypeNode), @alignOf(TypeNode)
    ) as *mut TypeNode;

    set *node = TypeNode { ty, next: self.types[bucket] };
    let frozen: *TypeNode = node;
    set self.types[bucket] = frozen;

    return &frozen.ty;
}

/// Allocate a nominal type descriptor and return a pointer to it.
unsafe fn allocNominalType 'arena (self: &mut Resolver 'arena, info: NominalType) -> *unsafe mut NominalType {
    // Nb. We don't attempt to de-duplicate nominal type entries,
    // since they don't carry node information and we create
    // placeholder entries when binding symbols.
    let entry = try! alloc::allocRaw(
        self.arena, @sizeOf(NominalType), @alignOf(NominalType)
    ) as *unsafe mut NominalType;

    set *entry = info;

    return entry;
}

/// Allocate the single runtime layout for a nominal declaration.
unsafe fn allocLayout 'arena (self: &mut Resolver 'arena, value: Layout) -> *Layout {
    let layout = try! alloc::alloc(&mut *self.arena, @sizeOf(Layout), @alignOf(Layout)) as *mut Layout;
    set *layout = value;
    return layout;
}

/// Get the exact arguments of an applied nominal descriptor.
export fn nominalApplication(info: &NominalType) -> ?*unsafe mut NominalApplication {
    match *info {
        case NominalType::Application(applied) => return applied,
        case NominalType::Record(body) => return body.application,
        case NominalType::Union(body) => return body.application,
        else => return nil,
    }
}

/// Return the private visit bit for one compile-time region role.
fn regionTypeRoleBit(role: RegionTypeRole) -> u8 {
    match role {
        case RegionTypeRole::CellPermission => return 1,
        case RegionTypeRole::Reference => return 2,
        case RegionTypeRole::Retention => return 4,
        case RegionTypeRole::StorageValidation => return 8,
        case RegionTypeRole::StoragePresence => return 16,
    }
}

/// Start a cycle-safe nominal traversal without allocating per-call scratch.
unsafe fn nextNominalTraversalGeneration 'arena (self: &mut Resolver 'arena) -> u32 {
    if self.nominalTraversalGeneration == parser::U32_MAX {
        let mut cursor = self.applications;
        while let applied = cursor {
            set applied.traversalGeneration = 0;
            set applied.traversalRoles = 0;
            set cursor = applied.next;
        }
        set self.nominalTraversalGeneration = 0;
    }
    set self.nominalTraversalGeneration += 1;
    return self.nominalTraversalGeneration;
}

/// Mark an applied nominal visited once for a role in one traversal generation.
unsafe fn visitNominalApplication(
    applied: *unsafe mut NominalApplication,
    generation: u32,
    role: RegionTypeRole,
) -> bool {
    if applied.traversalGeneration <> generation {
        set applied.traversalGeneration = generation;
        set applied.traversalRoles = 0;
    }
    let bit = regionTypeRoleBit(role);
    if (applied.traversalRoles & bit) <> 0 {
        return false;
    }
    set applied.traversalRoles |= bit;
    return true;
}

/// Get source region parameters without forcing a recursive type's layout.
unsafe fn nominalParameters 'arena (self: &mut Resolver 'arena, info: *unsafe NominalType) -> ?*RegionScope
    throws (ResolveError)
{
    match *info {
        case NominalType::Placeholder(node) => return try declarationRegions(self, node),
        case NominalType::Resolving(node) => return try declarationRegions(self, node),
        case NominalType::Application(applied) => return applied.parameters,
        case NominalType::Record(body) => return body.regions,
        case NominalType::Union(body) => return body.regions,
    }
}

/// Bind the regions declared by a nominal source node.
unsafe fn declarationRegions 'arena (self: &mut Resolver 'arena, node: *ast::Node) -> ?*RegionScope
    throws (ResolveError)
{
    match node.value {
        case ast::NodeValue::RecordDecl(decl) => return try bindRegions(self, node, decl.regions),
        case ast::NodeValue::UnionDecl(decl) => return try bindRegions(self, node, decl.regions),
        else => panic "declarationRegions: expected nominal declaration",
    }
}

/// Use a hinted application only for the same unapplied nominal declaration.
unsafe fn hintedNominal(info: *unsafe NominalType, hint: Type) -> *unsafe NominalType {
    if nominalApplication(info) <> nil {
        return info;
    }
    let mut target = hint;
    if let case Type::Optional(inner) = target {
        set target = *inner;
    }
    if let case Type::Nominal(other) = target {
        if let applied = nominalApplication(other); applied.base == info {
            return other;
        }
    }
    return info;
}

/// Require explicit arguments for a parameterized nominal type.
unsafe fn requireNominalArguments 'arena (self: &mut Resolver 'arena, info: *unsafe NominalType, site: *ast::Node)
    throws (ResolveError)
{
    if nominalApplication(info) <> nil {
        return;
    }
    if let parameters = try nominalParameters(self, info) {
        throw emitError(self, site, ErrorKind::RegionArgumentCount(CountMismatch {
            expected: parameters.entries.len, actual: 0,
        }));
    }
}

/// Intern an exact nominal application before resolving its recursive members.
unsafe fn internNominalApplication 'arena (
    self: &mut Resolver 'arena, base: *unsafe NominalType, map: &RegionSubstitution
) -> *unsafe mut NominalType {
    let mut hash = addressHash(base as u64);
    for argument in map.arguments {
        let region = argument else panic "internNominalApplication: incomplete map";
        set hash = (hash ^ region.id) * CACHE_HASH_PRIME;
    }
    let bucket = hash & (APPLICATION_BUCKETS - 1);
    let mut cursor = self.applicationBuckets[bucket];
    while let applied = cursor {
        if applied.base == base {
            let mut same = true;
            for argument, i in applied.arguments {
                let other = map.arguments[i] else panic "internNominalApplication: missing argument";
                if argument.id <> other.id {
                    set same = false;
                    break;
                }
            }
            if same {
                return applied.view;
            }
        }
        set cursor = applied.bucketNext;
    }
    let arguments = try! alloc::allocRawSlice(
        self.arena, @sizeOf(*unsafe types::Region), @alignOf(*unsafe types::Region), map.arguments.len
    ) as *unsafe mut [*unsafe types::Region];
    for argument, i in map.arguments {
        let region = argument else panic "internNominalApplication: incomplete map";
        set arguments[i] = region;
    }
    let entry = try! alloc::allocRaw(
        self.arena, @sizeOf(NominalApplication), @alignOf(NominalApplication)
    ) as *unsafe mut NominalApplication;
    let view = allocNominalType(self, NominalType::Application(entry));
    set *entry = NominalApplication {
        base, parameters: map.parameters, arguments, view,
        traversalGeneration: 0, traversalRoles: 0,
        next: self.applications, bucketNext: self.applicationBuckets[bucket],
    };
    set self.applications = entry;
    set self.applicationBuckets[bucket] = entry;
    return view;
}

/// Check explicit region arguments and intern the applied nominal type.
unsafe fn applyNominalRegions 'arena (
    self: &mut Resolver 'arena, base: *unsafe NominalType, regions: *[*ast::Node], site: *ast::Node
) -> *unsafe mut NominalType throws (ResolveError) {
    if nominalApplication(base) <> nil {
        throw emitError(self, site, ErrorKind::RegionArgumentCount(CountMismatch { expected: 0, actual: regions.len }));
    }
    let parameters = try nominalParameters(self, base);
    let mut count: u32 = 0;
    if let scope = parameters {
        set count = scope.entries.len;
    }
    if count <> regions.len {
        throw emitError(self, site, ErrorKind::RegionArgumentCount(CountMismatch { expected: count, actual: regions.len }));
    }
    let scope = parameters else panic "applyNominalRegions: empty application";
    let map = regionSubstitution(self, scope);
    for region, i in regions {
        set map.arguments[i] = try resolveRegion(self, region);
    }
    try validateRegionArguments(self, &map, nil, nil, site);
    return internNominalApplication(self, base, &map);
}

/// Complete nominal views stored inline within an applied type.
/// Pointer, slice, and cell targets have independent storage layouts.
unsafe fn resolveInlineTypeViews 'arena (self: &mut Resolver 'arena, ty: Type, site: *ast::Node)
    throws (ResolveError)
{
    match ty {
        case Type::Nominal(info) => try ensureNominalResolved(self, info, site),
        case Type::Array(array) => try resolveInlineTypeViews(self, *array.item, site),
        case Type::Optional(inner) => try resolveInlineTypeViews(self, *inner, site),
        else => {
        },
    }
}

/// Resolve a substituted member view with the source declaration's shared layout.
unsafe fn resolveNominalApplication 'arena (self: &mut Resolver 'arena, applied: *unsafe mut NominalApplication, site: *ast::Node)
    throws (ResolveError)
{
    try ensureNominalResolved(self, applied.base, site);
    let map = regionSubstitution(self, applied.parameters);
    for argument, i in applied.arguments {
        set map.arguments[i] = argument;
    }
    let allocator = alloc::arenaAllocator(self.arena);
    match *applied.base {
        case NominalType::Record(body) => {
            let mut fields: *mut [RecordField] = &mut [];
            for field in body.fields {
                let fieldType = substituteRegions(self, &map, field.fieldType);
                try resolveInlineTypeViews(self, fieldType, site);
                fields.append(RecordField {
                    name: field.name,
                    fieldType,
                    offset: field.offset,
                }, allocator);
            }
            set *applied.view = NominalType::Record(RecordType {
                privateModule: body.privateModule,
                regions: body.regions,
                application: applied,
                fields: (&fields[..]) as *unsafe [RecordField],
                labeled: body.labeled,
                layout: body.layout,
                declaredLinear: body.declaredLinear,
                declaredCopy: body.declaredCopy,
            });
        }
        case NominalType::Union(body) => {
            let mut variants: *mut [UnionVariant] = &mut [];
            for variant in body.variants {
                let valueType = substituteRegions(self, &map, variant.valueType);
                try resolveInlineTypeViews(self, valueType, site);
                variants.append(UnionVariant {
                    name: variant.name,
                    valueType,
                    symbol: variant.symbol,
                }, allocator);
            }
            set *applied.view = NominalType::Union(UnionType {
                regions: body.regions,
                application: applied,
                variants: (&variants[..]) as *unsafe [UnionVariant],
                layout: body.layout,
                valOffset: body.valOffset,
                isAllVoid: body.isAllVoid,
                declaredLinear: body.declaredLinear,
                declaredCopy: body.declaredCopy,
            });
        }
        else => panic "resolveNominalApplication: unresolved base",
    }
}

/// Complete all applied member views before semantic metadata reaches lowering.
unsafe fn resolveNominalApplications 'arena (self: &mut Resolver 'arena, site: *ast::Node) throws (ResolveError) {
    let mut end = self.completedApplications;
    loop {
        let first = self.applications;
        let mut cursor = first;
        while cursor <> end {
            let applied = cursor else panic "resolveNominalApplications: invalid frontier";
            try ensureNominalResolved(self, applied.view, site);
            set cursor = applied.next;
        }
        if self.applications == first {
            set self.completedApplications = first;
            break;
        }
        set end = first;
    }
    let previousRegions = self.regionScope;
    let previousModule = self.currentMod;
    let mut index: u32 = 0;
    while index < self.cellChecks.len {
        let check = self.cellChecks[index];
        set self.regionScope = check.regions;
        set self.currentMod = check.moduleId;
        try validateCellPayload(self, check.node, check.payload, check.permission) catch error {
            set self.regionScope = previousRegions;
            set self.currentMod = previousModule;
            throw error;
        };
        set index += 1;
    }
    set self.cellChecks.len = 0;
    set self.regionScope = previousRegions;
    set self.currentMod = previousModule;
}


/// Allocate a function type descriptor and return a pointer to it.
unsafe fn allocFnType 'arena (self: &mut Resolver 'arena, info: FnType) -> *FnType {
    let entry = try! alloc::alloc(
        &mut *self.arena, @sizeOf(FnType), @alignOf(FnType)
    ) as *mut FnType;

    set *entry = info;

    return entry;
}

/// Returns an error, if any, associated with the given node.
fn errorForNode 'arena (self: &Resolver 'arena, node: *ast::Node) -> ?Error {
    for i in 0..self.errors.len {
        let err = self.errors.entries[i];
        if err.node == node {
            return err;
        }
    }
    return nil;
}

/// Storage buffers used by the analyzer.
export record ResolverStorage {
    /// Node semantic metadata indexed by node ID.
    nodeData: *mut [NodeData],
    /// Package scope.
    pkgScope: *unsafe mut Scope,
    /// Error storage.
    errors: *mut [Error],
}

/// Input for resolving a single package.
export record Pkg: Copy {
    /// Root module entry.
    rootEntry: *module::ModuleEntry,
    /// Root AST node.
    rootAst: *ast::Node,
}

/// Construct a resolver with module context and backing storage.
/// The arena owner and backing bytes must retain stable addresses during use.
/// Arena reclamation can occur only after all metadata uses end.
export unsafe fn resolver 'arena (
    arena: &'arena mut alloc::Arena,
    storage: ResolverStorage,
    config: Config
) -> Resolver 'arena {
    let case ResolverStorage { nodeData, pkgScope, errors } = storage else panic "expected resolver storage";
    let applicationBuckets = try! alloc::allocRawSlice(
        arena, @sizeOf(?*unsafe mut NominalApplication), @alignOf(?*unsafe mut NominalApplication), APPLICATION_BUCKETS
    ) as *unsafe mut [?*unsafe mut NominalApplication];
    for i in 0..applicationBuckets.len {
        set applicationBuckets[i] = nil;
    }
    let types = try! alloc::allocRawSlice(
        arena, @sizeOf(?*TypeNode), @alignOf(?*TypeNode), TYPE_BUCKETS
    ) as *unsafe mut [?*TypeNode];
    for i in 0..types.len {
        set types[i] = nil;
    }
    let symbols = try! alloc::allocRawSlice(
        arena, @sizeOf(*unsafe mut Symbol), @alignOf(*unsafe mut Symbol), MAX_MODULE_SYMBOLS
    ) as *unsafe mut [*unsafe mut Symbol];

    // Initialize the root scope.
    // TODO: Set this up when declaring `PKG_SCOPE`, not here.
    set *pkgScope = Scope {
        owner: nil,
        parent: nil,
        moduleId: nil,
        symbols,
        symbolsLen: 0,
    };

    // Clear all node semantic metadata to sentinel values.
    // TODO: Use array repeat literal?
    for i in 0..nodeData.len {
        set nodeData[i] = NodeData {
            localCount: 0,
            ty: Type::Unknown,
            coercion: Coercion::Identity,
            binding: nil,
            constValue: nil,
            scope: nil,
            extra: NodeExtra::None,
        };
    }

    let mut moduleScopes: [?*unsafe mut Scope; module::MAX_MODULES] = undefined;
    // TODO: Simplify.
    for i in 0..moduleScopes.len {
        set moduleScopes[i] = nil;
    }
    return Resolver 'arena {
        symbolCount: 0,
        regionScope: nil,
        applications: nil,
        completedApplications: nil,
        applicationBuckets,
        nominalTraversalGeneration: 0,
        cellChecks: &mut [],
        scope: pkgScope,
        pkgScope: pkgScope,
        loopStack: [LoopCtx { hasBreak: false }; MAX_LOOP_DEPTH],
        loopDepth: 0,
        currentFn: nil,
        currentFnNode: nil,
        currentMod: 0,
        inUnsafeContext: false,
        config,
        arena,
        nodeData: NodeDataTable { entries: nodeData },
        types,
        errors: DiagnosticBuffer { entries: errors, len: 0 },
        moduleEntries: [nil; module::MAX_MODULES],
        moduleRoots: [nil; module::MAX_MODULES],
        moduleScopes,
        instances: undefined,
        instancesLen: 0,
        methods: undefined,
        methodsLen: 0,
    };
}

/// Capture the current errors in an immutable arena allocation.
/// The allocation must remain valid while the diagnostics are used.
export unsafe fn diagnostics 'arena (self: &mut Resolver 'arena) -> Diagnostics {
    let count = self.errors.len;
    let entries = try! alloc::allocSlice(
        self.arena, @sizeOf(Error), @alignOf(Error), count
    ) as *mut [Error];
    for i in 0..self.errors.len {
        set entries[i] = self.errors.entries[i];
    }
    return Diagnostics { errors: entries };
}

/// Return `true` if there are no errors in the diagnostics.
export fn success(diag: &Diagnostics) -> bool {
    return diag.errors.len == 0;
}

/// Retrieve an error diagnostic by index, if present.
export fn errorAt(errs: &[Error], index: u32) -> ?Error {
    if index >= errs.len {
        return nil;
    }
    return errs[index];
}

/// Record an error diagnostic and return an error sentinel suitable for throwing.
fn emitError 'arena (self: &mut Resolver 'arena, node: ?*ast::Node, kind: ErrorKind) -> ResolveError {
    // If our error list is full, just return an error without recording it.
    if self.errors.len >= self.errors.entries.len {
        return ResolveError::Failure;
    }
    // Don't record more than one error per node.
    if let n = node; errorForNode(self, n) <> nil {
        return ResolveError::Failure;
    }
    let idx = self.errors.len;
    set self.errors.entries[idx] = Error { kind, node, moduleId: self.currentMod };
    set self.errors.len = idx + 1;

    return ResolveError::Failure;
}

/// Like [`emitError`], but for type mismatches specifically.
fn emitTypeMismatch 'arena (self: &mut Resolver 'arena, node: ?*ast::Node, mismatch: TypeMismatch) -> ResolveError {
    return emitError(self, node, ErrorKind::TypeMismatch(mismatch));
}

/// Allocate a scope object with the given symbol capacity.
unsafe fn allocScope 'arena (self: &mut Resolver 'arena, owner: *ast::Node, capacity: u32) -> *unsafe mut Scope {
    // Check for an existing scope for this node, and don't allocate a new
    // one in that case.
    if let scope = scopeFor(self, owner) {
        return scope;
    }
    assert owner.id < self.nodeData.entries.len, "allocScope: node ID out of bounds";
    let p = try! alloc::allocRaw(self.arena, @sizeOf(Scope), @alignOf(Scope));
    let entry = p as *unsafe mut Scope;

    // Allocate symbols from the arena.
    let symbols = try! alloc::allocRawSlice(
        self.arena, @sizeOf(*unsafe mut Symbol), @alignOf(*unsafe mut Symbol), capacity
    ) as *unsafe mut [*unsafe mut Symbol];

    set *entry = Scope { owner, parent: nil, moduleId: nil, symbols, symbolsLen: 0 };
    set self.nodeData.entries[owner.id].scope = entry;

    return entry;
}

/// Enter a new local scope that is the child of the current scope.
/// This creates a parent/child relationship that means that lookups in the
/// child scope can recurse upwards.
export unsafe fn enterScope 'arena (self: &mut Resolver 'arena, owner: *ast::Node) -> *unsafe Scope {
    let scope = allocScope(self, owner, MAX_LOCAL_SYMBOLS);
    set scope.parent = self.scope;
    set self.scope = scope;
    return scope;
}

/// Enter a module scope. Returns an object that can be used to exit the scope.
export unsafe fn enterModuleScope 'arena (self: &mut Resolver 'arena, owner: *ast::Node, module: *module::ModuleEntry) -> ModuleScope {
    let prevScope = self.scope;
    let prevMod = self.currentMod;
    let scope = allocScope(self, owner, MAX_MODULE_SYMBOLS);

    set self.scope = scope;
    set self.scope.moduleId = module.id;
    set self.currentMod = module.id;
    // TODO: Allow any unsigned integer to index an array.
    set self.moduleScopes[module.id as u32] = scope;

    return ModuleScope { root: owner, entry: module, newScope: scope, prevScope, prevMod };
}

/// Enter a sub-module. Changes the current scope into that of the sub-module.
unsafe fn enterSubModule 'arena (self: &mut Resolver 'arena, name: *[u8], node: *ast::Node) -> ModuleScope throws (ResolveError) {
    let modEntry = findChildModule(self, name, self.currentMod)
        else throw emitError(self, node, ErrorKind::UnresolvedSymbol(name));
    let modRoot = self.moduleRoots[modEntry.id as u32]
        else panic "enterSubModule: analyzing module that wasn't parsed";

    return enterModuleScope(self, modRoot, modEntry);
}

/// Exit a module scope, given the object returned by `enterModuleScope`.
export fn exitModuleScope 'arena (self: &mut Resolver 'arena, entry: ModuleScope) {
    set self.scope = entry.prevScope;
    set self.currentMod = entry.prevMod;
}

/// Exit the most recent scope.
export unsafe fn exitScope 'arena (self: &mut Resolver 'arena) {
    let parent = self.scope.parent else {
        // TODO: This should be a panic, but one of the tests hits this
        // clause, which might be a bug in the generator.
        return;
    };
    set self.scope = parent;
}

/// Initialize a loop context before making it active.
fn enterLoop 'arena (self: &mut Resolver 'arena) {
    assert self.loopDepth < MAX_LOOP_DEPTH, "enterLoop: loop nesting depth exceeded";
    set self.loopStack[self.loopDepth] = LoopCtx { hasBreak: false };
    set self.loopDepth += 1;
}

/// End the active loop context and return its control-flow type.
fn exitLoop 'arena (self: &mut Resolver 'arena) -> Type {
    assert self.loopDepth > 0, "exitLoop: loop depth underflow";
    // Pop and check if break was encountered.
    set self.loopDepth -= 1;
    if self.loopStack[self.loopDepth].hasBreak {
        return Type::Void;
    }
    return Type::Never;
}

/// Visit the body of a loop while tracking nesting depth.
unsafe fn visitLoop 'arena (self: &mut Resolver 'arena, body: *ast::Node) -> Type
    throws (ResolveError)
{
    enterLoop(self);
    try infer(self, body) catch {
        exitLoop(self);
        throw ResolveError::Failure;
    };
    return exitLoop(self);
}

/// Require that loop control statements appear inside a loop.
/// Record breaks and assign the control statement's diverging type.
fn resolveLoopControl 'arena (self: &mut Resolver 'arena, node: *ast::Node) -> Type throws (ResolveError) {
    if self.loopDepth == 0 {
        throw emitError(self, node, ErrorKind::InvalidLoopControl);
    }
    match node.value {
        case ast::NodeValue::Break => {
            // Mark that the current loop has a reachable break.
            set self.loopStack[self.loopDepth - 1].hasBreak = true;
        }
        case ast::NodeValue::Continue => {}
        else => panic "resolveLoopControl: expected loop control statement",
    }
    return setNodeType(self, node, Type::Never);
}

/// Bind a loop pattern to the provided type.
unsafe fn bindForLoopPattern 'arena (self: &mut Resolver 'arena, pattern: *ast::Node, ty: Type, mutable: bool)
    throws (ResolveError)
{
    match pattern.value {
        case ast::NodeValue::Placeholder, ast::NodeValue::Ident(_) => {
            let _ = try bindValueIdent(self, pattern, pattern, ty, mutable, 0, 0);
        }
        else => {
            let actualTy = try checkAssignable(self, pattern, ty);
            setNodeType(self, pattern, actualTy);
        }
    }
}

/// Set the expected return type for a new function body.
unsafe fn enterFn 'arena (self: &mut Resolver 'arena, node: *ast::Node, ty: &FnType) {
    assert self.currentFn == nil, "enterFn: already in a function";
    set self.currentFn = *ty;
    set self.currentFnNode = node;
    enterScope(self, node);
}

/// Clear the expected return type when leaving a function body.
unsafe fn exitFn 'arena (self: &mut Resolver 'arena) {
    if self.currentFn == nil {
        // TODO: This should be a panic, but one of the tests hits this
        // clause, which might be a bug in the generator.
        return;
    }
    set self.currentFn = nil;
    set self.currentFnNode = nil;
    exitScope(self);
}

/// Extract the identifier text from a node.
fn nodeName 'arena (self: &mut Resolver 'arena, node: *ast::Node) -> *[u8]
    throws (ResolveError)
{
    let case ast::NodeValue::Ident(name) = node.value
        else throw emitError(self, node, ErrorKind::ExpectedIdentifier);
    return name;
}

/// Associate a resolved symbol with an AST node.
unsafe fn setNodeSymbol 'arena (self: &mut Resolver 'arena, node: *ast::Node, symbol: *unsafe mut Symbol) {
    if let existingSym = self.nodeData.entries[node.id].binding {
        panic "setNodeSymbol: a symbol is already associated with this node";
    }
    set self.nodeData.entries[node.id].binding = ResolvedSymbol { id: symbol.id, symbol };
}

/// Associate a resolved type with an AST node and return it.
fn setNodeType 'arena (self: &mut Resolver 'arena, node: *ast::Node, ty: Type) -> Type {
    if ty == Type::Unknown {
        // In this case, we simply don't associate a type.
        return ty;
    }
    set self.nodeData.entries[node.id].ty = ty;

    return ty;
}

/// Unify the types of two branches for control flow. Returns `never` only if
/// both branches diverge, otherwise returns `void`. If the else branch is
/// absent, we assume it doesn't diverge.
fn unifyBranches(left: Type, right: ?Type) -> Type {
    if left == Type::Never {
        if let ty = right; ty == Type::Never {
            return Type::Never;
        }
    }
    return Type::Void;
}

/// Associate a coercion plan with an AST node.
fn setNodeCoercion 'arena (self: &mut Resolver 'arena, node: *ast::Node, coercion: Coercion) -> Coercion {
    if coercion == Coercion::Identity {
        return coercion;
    }
    set self.nodeData.entries[node.id].coercion = coercion;

    return coercion;
}

/// Associate a constant value with an AST node.
fn setNodeConstValue 'arena (self: &mut Resolver 'arena, node: *ast::Node, value: ConstValue) {
    set self.nodeData.entries[node.id].constValue = value;
}

/// Associate a record field index with a record literal field node.
fn setRecordFieldIndex 'arena (self: &mut Resolver 'arena, node: *ast::Node, index: u32) {
    set self.nodeData.entries[node.id].extra = NodeExtra::RecordField { index };
}

/// Associate slice range metadata with a subscript expression.
fn setSliceRangeInfo 'arena (self: &mut Resolver 'arena, node: *ast::Node, info: SliceRangeInfo) {
    set self.nodeData.entries[node.id].extra = NodeExtra::SliceRange(info);
}

/// Associate union variant metadata with a pattern or constructor node.
fn setVariantInfo 'arena (self: &mut Resolver 'arena, node: *ast::Node, ordinal: u32, tag: u32) {
    set self.nodeData.entries[node.id].extra = NodeExtra::UnionVariant { ordinal, tag };
}

/// Associate trait method call metadata with a call node.
fn setTraitMethodCall 'arena (self: &mut Resolver 'arena, node: *ast::Node, traitInfo: *unsafe TraitType, methodIndex: u32) {
    set self.nodeData.entries[node.id].extra = NodeExtra::TraitMethodCall { traitInfo, methodIndex };
}

/// Associate for-loop metadata with a for-loop node.
fn setForLoopInfo 'arena (self: &mut Resolver 'arena, node: *ast::Node, info: ForLoopInfo) {
    set self.nodeData.entries[node.id].extra = NodeExtra::ForLoop(info);
}

/// Retrieve the constant value associated with a node, if any.
export fn constValueEntry 'arena (self: &Resolver 'arena, node: *ast::Node) -> ?ConstValue {
    return self.nodeData.entries[node.id].constValue;
}

/// Get the resolved record field index for a record literal field node.
export fn recordFieldIndexFor 'arena (self: &Resolver 'arena, node: *ast::Node) -> ?u32 {
    if let case NodeExtra::RecordField { index } = self.nodeData.entries[node.id].extra {
        return index;
    }
    return nil;
}

/// Get the range metadata for a slice borrow or range assignment.
export fn sliceRangeInfoFor 'arena (self: &Resolver 'arena, node: *ast::Node) -> ?SliceRangeInfo {
    if let case NodeExtra::SliceRange(info) = self.nodeData.entries[node.id].extra {
        return info;
    }
    return nil;
}

/// Get the for-loop metadata for a for-loop node.
export fn forLoopInfoFor 'arena (self: &Resolver 'arena, node: *ast::Node) -> ?ForLoopInfo {
    if let case NodeExtra::ForLoop(info) = self.nodeData.entries[node.id].extra {
        return info;
    }
    return nil;
}

/// Associate match prong metadata with a match prong node.
fn setProngCatchAll 'arena (self: &mut Resolver 'arena, node: *ast::Node, catchAll: bool) {
    set self.nodeData.entries[node.id].extra = NodeExtra::MatchProng { catchAll };
}

/// Check if a prong is catch-all.
export fn isProngCatchAll 'arena (self: &Resolver 'arena, node: *ast::Node) -> bool {
    if let case NodeExtra::MatchProng { catchAll } = self.nodeData.entries[node.id].extra {
        return catchAll;
    }
    return false;
}

/// Set match metadata.
fn setMatchConst 'arena (self: &mut Resolver 'arena, node: *ast::Node, isConst: bool) {
    set self.nodeData.entries[node.id].extra = NodeExtra::Match { isConst };
}

/// Check if a match has all constant patterns.
export fn isMatchConst 'arena (self: &Resolver 'arena, node: *ast::Node) -> bool {
    if let case NodeExtra::Match { isConst } = self.nodeData.entries[node.id].extra {
        return isConst;
    }
    return false;
}

/// Get the resolver metadata for a node.
export fn nodeData 'arena (self: &Resolver 'arena, node: *ast::Node) -> NodeData {
    return self.nodeData.entries[node.id];
}

/// Get the type for a node, or `nil` if unknown.
export fn typeFor 'arena (self: &Resolver 'arena, node: *ast::Node) -> ?Type {
    let ty = self.nodeData.entries[node.id].ty;
    if ty == Type::Unknown {
        return nil;
    }
    return ty;
}

/// Get the scope associated with a node.
export fn scopeFor 'arena (self: &Resolver 'arena, node: *ast::Node) -> ?*unsafe mut Scope {
    return self.nodeData.entries[node.id].scope;
}

/// Get the symbol bound to a node.
export fn symbolFor 'arena (self: &Resolver 'arena, node: *ast::Node) -> ?*unsafe mut Symbol {
    let binding = self.nodeData.entries[node.id].binding else return nil;
    return binding.symbol;
}

/// Get the coercion plan associated with a node, if any.
export fn coercionFor 'arena (self: &Resolver 'arena, node: *ast::Node) -> ?Coercion {
    let c = self.nodeData.entries[node.id].coercion;
    if c == Coercion::Identity {
        return nil;
    }
    return c;
}

/// Get the module ID for a symbol by walking up its scope chain.
export unsafe fn moduleIdForSymbol 'arena (self: &Resolver 'arena, sym: *unsafe Symbol) -> ?u16 {
    // For module-level symbols, return the cached module ID.
    if let id = sym.moduleId {
        return id;
    }
    // For module symbols, return the module ID directly.
    if let case SymbolData::Module { entry, .. } = sym.data {
        return entry.id;
    }
    // If this node has its own scope (functions, types, etc.), walk up from there.
    if let scope = self.nodeData.entries[sym.node.id].scope {
        return findModuleForScope(scope);
    }
    return nil;
}

/// Get the binding node for a variant pattern.
/// Returns the argument node if this is a variant constructor with a non-placeholder binding.
export unsafe fn variantPatternBinding 'arena (self: &Resolver 'arena, pattern: *ast::Node) -> ?*ast::Node {
    let case ast::NodeValue::Call(call) = pattern.value
        else return nil;
    let sym = symbolFor(self, call.callee)
        else return nil;
    let case SymbolData::Variant { .. } = sym.data
        else return nil;

    if call.args.len == 0 {
        return nil;
    }
    let arg = call.args[0];

    if let case ast::NodeValue::Placeholder = arg.value {
        return nil;
    }
    return arg;
}

/// Allocate a new symbol, and return a reference to it.
unsafe fn allocSymbol 'arena (self: &mut Resolver 'arena, data: SymbolData, name: *[u8], node: *ast::Node, attrs: u32) -> *unsafe mut Symbol {
    let sym = try! alloc::allocRaw(self.arena, @sizeOf(Symbol), @alignOf(Symbol)) as *unsafe mut Symbol;
    assert self.symbolCount < parser::U32_MAX, "allocSymbol: symbol identity overflow";
    let id = self.symbolCount;
    set self.symbolCount += 1;
    set *sym = Symbol { id, name, data, attrs, node, moduleId: nil };

    return sym;
}

/// Check that a type is boolean, otherwise throw an error.
unsafe fn checkBoolean 'arena (self: &mut Resolver 'arena, node: *ast::Node) -> Type throws (ResolveError) {
    return try checkEqual(self, node, Type::Bool);
}

/// Check that a type is numeric, otherwise throw an error.
unsafe fn checkNumeric 'arena (self: &mut Resolver 'arena, node: *ast::Node) -> Type throws (ResolveError) {
    let ty = try infer(self, node);
    if not isNumericType(ty) {
        throw emitError(self, node, ErrorKind::ExpectedNumeric);
    }
    return ty;
}

/// Check if a type is a numeric type.
fn isNumericType(ty: Type) -> bool {
    match ty {
        case Type::U8, Type::U16, Type::U32, Type::U64,
             Type::I8, Type::I16, Type::I32, Type::I64,
             Type::Int => return true,
        else => return false,
    }
}

/// Check if a type is an unsigned integer type.
export fn isUnsignedIntegerType(ty: Type) -> bool {
    match ty {
        case Type::U8, Type::U16, Type::U32, Type::U64 => return true,
        else => return false,
    }
}

/// Return the maximum of two u32 values.
fn max(a: u32, b: u32) -> u32 {
    if a > b {
        return a;
    }
    return b;
}

/// Get the layout of a type.
export unsafe fn getTypeLayout(ty: Type) -> Layout {
    return typeLayout(ty);
}

/// Traverse owned type links and compute array, optional, or fixed layouts.
fn typeLayout(ty: Type) -> Layout {
    match ty {
        case Type::Array(arr) => return getArrayLayout(typeLayout(*arr.item), arr.length),
        case Type::Optional(inner) => {
            // Nullable types use null pointer optimization -- no tag byte needed.
            if isNullableType(*inner) {
                return typeLayout(*inner);
            }
            return getOptionalAggregateLayout(typeLayout(*inner));
        }
        case Type::Nominal(info) => {
            unsafe {
                return getNominalLayout(*info);
            }
        },
        else => return fixedTypeLayout(ty),
    }
}

/// Get a layout that does not depend on nested type or nominal metadata.
fn fixedTypeLayout(ty: Type) -> Layout {
    match ty {
        case Type::Pointer { .. } => return Layout {
            size: PTR_SIZE, alignment: PTR_SIZE
        },
        case Type::Slice { .. }, Type::TraitObject { .. }, Type::Session(_) =>
            return Layout { size: PTR_SIZE * 2, alignment: PTR_SIZE },
        case Type::Void, Type::Never => return Layout { size: 0, alignment: 0 },
        case Type::Bool, Type::U8, Type::I8 => return Layout { size: 1, alignment: 1 },
        case Type::U16, Type::I16 => return Layout { size: 2, alignment: 2 },
        case Type::U32, Type::I32 => return Layout { size: 4, alignment: 4 },
        case Type::Int => return Layout { size: 8, alignment: 8 },
        case Type::U64, Type::I64 => return Layout { size: 8, alignment: 8 },
        case Type::Fn(_) => return Layout { size: PTR_SIZE, alignment: PTR_SIZE },
        case Type::Cell { .. } => return Layout {
            size: PTR_SIZE, alignment: PTR_SIZE
        },
        else => {
            panic "fixedTypeLayout: the given type has no fixed layout";
        }
    }
}

/// Get the layout of a type or value.
export unsafe fn getLayout 'arena (self: &Resolver 'arena, node: *ast::Node, ty: Type) -> Layout {
    let mut layout = getTypeLayout(ty);
    // Check for symbol-specific alignment override.
    if let sym = symbolFor(self, node) {
        if let case SymbolData::Value { alignment, .. } = sym.data {
            if alignment > 0 {
                set layout.alignment = alignment;
            }
        }
    }
    return layout;
}

/// Get an array layout from its element layout and length.
export fn getArrayLayout(item: Layout, length: u32) -> Layout {
    return Layout {
        size: item.size * length,
        alignment: item.alignment,
    };
}

/// Get an optional aggregate layout from its payload layout.
export fn getOptionalAggregateLayout(innerLayout: Layout) -> Layout {
    let valOffset = getOptionalValOffset(innerLayout);
    let alignment = max(innerLayout.alignment, 1);

    return Layout {
        size: mem::alignUp(valOffset + innerLayout.size, alignment),
        alignment,
    };
}

/// Get the payload offset within an optional aggregate.
export fn getOptionalValOffset(inner: Layout) -> u32 {
    return mem::alignUp(1, inner.alignment);
}

/// Check if a type is optional.
export fn isOptionalType(ty: Type) -> bool {
    match ty {
        case Type::Optional(_) => return true,
        else => return false,
    }
}

/// Check if a type uses null pointer optimization.
/// This applies to optional pointers `?*T` and optional slices `?*[T]`,
/// where `nil` is represented as a null data pointer with no tag byte.
export fn isOptionalPointer(ty: Type) -> bool {
    if let case Type::Optional(inner) = ty {
        return isNullableType(*inner);
    }
    return false;
}

/// Check if a type uses the optional aggregate representation.
export fn isOptionalAggregate(ty: Type) -> bool {
    if let case Type::Optional(inner) = ty {
        return not isNullableType(*inner);
    }
    return false;
}

/// Check if a type can use null to represent `nil`.
/// Pointers and slices have a data pointer that is never null when valid.
export fn isNullableType(ty: Type) -> bool {
    match ty {
        case Type::Pointer { .. }, Type::Slice { .. } => return true,
        else => return false,
    }
}

/// Get the layout of a nominal type.
export fn getNominalLayout(info: NominalType) -> Layout {
    match info {
        case NominalType::Placeholder(_), NominalType::Resolving(_), NominalType::Application(_) => {
            panic "getNominalLayout: unresolved type";
        }
        case NominalType::Record(recordType) => {
            return *recordType.layout;
        }
        case NominalType::Union(unionType) => {
            return *unionType.layout;
        }
    }
}

/// Get the layout of a result aggregate with a tag and the larger payload.
export unsafe fn getResultLayout(payload: Type, throwList: *[*Type]) -> Layout {
    return resultLayout(payload, throwList);
}

/// Compute tagged result storage while borrowing its error type table.
fn resultLayout(payload: Type, throwList: &[*Type]) -> Layout {
    let payloadLayout = typeLayout(payload);
    let mut maxSize = payloadLayout.size;
    let mut maxAlign = payloadLayout.alignment;

    for errType in throwList {
        let errLayout = typeLayout(*errType);
        set maxSize = max(maxSize, errLayout.size);
        set maxAlign = max(maxAlign, errLayout.alignment);
    }
    return Layout {
        size: PTR_SIZE + maxSize,
        alignment: max(PTR_SIZE, maxAlign),
    };
}

/// Compute the layout for a union given its resolved variants.
fn computeUnionLayout(variants: &[UnionVariant]) -> UnionLayoutInfo {
    let tagSize: u32 = 1;
    let mut maxVarSize: u32 = 0;
    let mut maxVarAlign: u32 = 1;
    let mut isAllVoid: bool = true;

    for variant in variants {
        if variant.valueType <> Type::Void {
            set isAllVoid = false;
            let payloadLayout = typeLayout(variant.valueType);
            set maxVarSize = max(maxVarSize, payloadLayout.size);
            set maxVarAlign = max(maxVarAlign, payloadLayout.alignment);
        }
    }
    let unionAlignment: u32 = max(1, maxVarAlign);
    let unionValOffset: u32 = mem::alignUp(tagSize, maxVarAlign);
    let unionLayout = Layout {
        size: mem::alignUp(unionValOffset + maxVarSize, unionAlignment),
        alignment: unionAlignment,
    };
    return UnionLayoutInfo { layout: unionLayout, valOffset: unionValOffset, isAllVoid };
}

/// Compute the discriminant tag for a variant, advancing the iota counter.
/// If the variant has an explicit `= N` value, uses that; otherwise uses iota.
fn variantTag(variantDecl: ast::UnionDeclVariant, iota: &mut u32) -> u32 {
    let mut tag: u32 = *iota;
    if let valueNode = variantDecl.value {
        let case ast::NodeValue::Number(lit) = valueNode.value
            else panic "variantTag: expected number literal";
        set tag = lit.magnitude as u32;
    }
    set *iota = tag + 1;
    return tag;
}

/// Check if a type is a union without payloads.
export unsafe fn isVoidUnion(ty: Type) -> bool {
    let case Type::Nominal(NominalType::Union(unionType)) = ty
        else return false;
    return unionType.isAllVoid;
}

/// Check if a type should be treated as an address-like value.
fn isAddressType(ty: Type) -> bool {
    if isNullableType(ty) {
        return true;
    }
    match ty {
        case Type::Fn(_) => return true,
        else => return false,
    }
}

/// Return the representable range for an integer type.
fn integerRange(ty: Type) -> ?IntegerRange {
    match ty {
        case Type::I8 => return IntegerRange::Signed {
            bits: 8,
            min: I8_MIN as i64,
            max: I8_MAX as i64,
            lim: (I8_MAX as u64) + 1,
        },
        case Type::I16 => return IntegerRange::Signed {
            bits: 16,
            min: I16_MIN as i64,
            max: I16_MAX as i64,
            lim: (I16_MAX as u64) + 1,
        },
        case Type::I32 => return IntegerRange::Signed {
            bits: 32,
            min: I32_MIN as i64,
            max: I32_MAX as i64,
            lim: (I32_MAX as u64) + 1,
        },
        case Type::I64, Type::Int => return IntegerRange::Signed {
            bits: 64,
            min: I64_MIN,
            max: I64_MAX,
            lim: (I64_MAX as u64) + 1,
        },
        case Type::U8 => return IntegerRange::Unsigned { bits: 8, max: U8_MAX as u64 },
        case Type::U16 => return IntegerRange::Unsigned { bits: 16, max: U16_MAX as u64 },
        case Type::U32 => return IntegerRange::Unsigned { bits: 32, max: parser::U32_MAX as u64 },
        case Type::U64 => return IntegerRange::Unsigned { bits: 64, max: parser::U64_MAX },
        else => return nil,
    }
}

/// Validate that an integer constant fits within the target type's range.
fn validateConstIntRange(value: ConstValue, target: Type) -> bool {
    let range = integerRange(target)
        else panic "validateConstIntRange: expected integer type";
    let case ConstValue::Int(int) = value
        else panic "validateConstIntRange: expected integer constant";

    match range {
        case IntegerRange::Signed { lim, .. } => {
            if int.negative {
                if int.magnitude > lim {
                    return false;
                }
                return true;
            }
            if int.magnitude > lim - 1 {
                return false;
            }
            return true;
        }
        case IntegerRange::Unsigned { max, .. } => {
            if int.negative or int.magnitude > max {
                return false;
            }
            return true;
        }
    }
}

/// Ensure all nested nominal types in a type are resolved.
unsafe fn ensureTypeResolved 'arena (self: &mut Resolver 'arena, ty: Type, site: *ast::Node) throws (ResolveError) {
    match ty {
        case Type::Nominal(info) => try ensureNominalResolved(self, info, site),
        // Pointer, slice, and cell layouts do not depend on their element layout.
        case Type::Pointer { .. }, Type::Slice { .. }, Type::Cell { .. } => {
        },
        case Type::Array(arr) => try ensureTypeResolved(self, *arr.item, site),
        case Type::Optional(inner) => try ensureTypeResolved(self, *inner, site),
        else => {},
    }
}

/// Ensure a nominal type has its body resolved.
unsafe fn ensureNominalResolved 'arena (self: &mut Resolver 'arena, tyInfo: *unsafe NominalType, site: *ast::Node)
    throws (ResolveError)
{
    if let case NominalType::Application(applied) = *tyInfo {
        try resolveNominalApplication(self, applied, site);
        return;
    }
    if let case NominalType::Resolving(_) = *tyInfo {
        throw emitError(self, site, ErrorKind::RecursiveType);
    }
    if let case NominalType::Placeholder(declNode) = *tyInfo {
        // When resolving on-demand (e.g. from a child module), switch to the
        // declaring module's scope so field type lookups find the right symbols.
        let prevScope = self.scope;
        let prevMod = self.currentMod;

        if let sym = symbolFor(self, declNode) {
            if let mid = sym.moduleId {
                if (mid as u32) < self.moduleScopes.len {
                    if let ms = self.moduleScopes[mid as u32] {
                        set self.scope = ms;
                        set self.currentMod = mid;
                    }
                }
            }
        }

        match declNode.value {
            case ast::NodeValue::RecordDecl(decl) => {
                try resolveRecordBody(self, declNode, decl) catch error {
                    set self.scope = prevScope;
                    set self.currentMod = prevMod;
                    throw error;
                };
            }
            case ast::NodeValue::UnionDecl(decl) => {
                try resolveUnionBody(self, declNode, decl) catch error {
                    set self.scope = prevScope;
                    set self.currentMod = prevMod;
                    throw error;
                };
            }
            else => {},
        }
        set self.scope = prevScope;
        set self.currentMod = prevMod;
    }
}

/// Check if all elements in a node list are assignable to the target type.
unsafe fn isListAssignable 'arena (self: &mut Resolver 'arena, targetType: Type, items: *[*ast::Node]) -> bool {
    for itemNode in items {
        let elemTy = typeFor(self, itemNode)
            else return false;
        if let _ = isAssignable(self, targetType, elemTy, itemNode) {
            // Do nothing.
        } else {
            return false;
        }
    }
    return true;
}

/// Return whether pointer classes are compatible in the current safety context.
fn pointerClassesAssignable(
    to: types::PointerClass,
    from: types::PointerClass,
    inUnsafeContext: bool,
) -> bool {
    return to == from or (
        to == types::PointerClass::Ref
        and (types::isReference(from) or from == types::PointerClass::Owned
            or (from == types::PointerClass::Unsafe and inUnsafeContext))
    );
}

/// Limit an exclusive value's implicit borrow to its owner's borrow.
unsafe fn assignableValueType 'arena (self: &mut Resolver 'arena, node: *ast::Node, source: Type) -> Type {
    match source {
        case Type::Pointer { class, target, mutable: true } => {
            let usable = pointerAddressClass(self, node, class, true);
            return Type::Pointer { class: usable, target, mutable: true };
        }
        case Type::Slice { class, item, mutable: true } => {
            let usable = pointerAddressClass(self, node, class, true);
            return Type::Slice { class: usable, item, mutable: true };
        }
        case Type::TraitObject { class, traitInfo, mutable: true } => {
            let usable = pointerAddressClass(self, node, class, true);
            return Type::TraitObject { class: usable, traitInfo, mutable: true };
        }
        case Type::Optional(inner) => {
            let value = assignableValueType(self, node, *inner);
            if typesEqual(value, *inner) {
                return source;
            }
            return Type::Optional(allocType(self, value));
        }
        else => return source,
    }
}

/// Check if the `from` type is assignable to the `to` type, and return a
/// coercion plan if so.
/// Referenced storage requires equal element types. Function values may gain
/// an unsafe call requirement.
unsafe fn isAssignable 'arena (self: &mut Resolver 'arena, to: Type, source: Type, rval: *ast::Node) -> ?Coercion {
    let from = assignableValueType(self, rval, source);
    if to == Type::Unknown or from == Type::Unknown {
        return nil;
    }
    if from == Type::Undefined {
        if containsRegion(to) {
            return nil;
        }
        if to == Type::Never {
            return nil;
        }
        // TODO: Don't let `undefined` be used in place of functions and other
        // non-data types.
        return Coercion::Identity;
    }
    // The "never" type can always be assigned, since the code path is never
    // executed.
    if from == Type::Never {
        return Coercion::Identity;
    }
    if to == from {
        return Coercion::Identity;
    }
    if let case Type::Cell { class, permission, payload } = to {
        let case Type::Cell {
            class: sourceClass, permission: sourcePermission, payload: sourcePayload,
        } = from else return nil;
        let mut storageAssignable = pointerClassesAssignable(
            class, sourceClass, self.inUnsafeContext
        );
        if let case types::PointerClass::Region(targetRegion) = class {
            if let case types::PointerClass::Region(sourceRegion) = sourceClass {
                set storageAssignable = types::regionContains(sourceRegion, targetRegion);
            }
        }
        if permission == sourcePermission and storageAssignable
            and typesEqual(*payload, *sourcePayload)
        {
            return Coercion::Identity;
        }
        return nil;
    }
    if let case Type::Pointer { class: lhsClass, target: lhsTarget, mutable: lhsMutable } = to {
        let case Type::Pointer { class: rhsClass, target: rhsTarget, mutable: rhsMutable } = from
            else return nil;
        if not pointerClassesAssignable(lhsClass, rhsClass, self.inUnsafeContext) {
            return nil;
        }
        // Allow coercion from `*T` to `*opaque`, and mutable counterparts.
        if *lhsTarget == Type::Opaque {
            if lhsMutable and not rhsMutable {
                return nil;
            }
            return Coercion::Identity;
        }
        if lhsMutable and not rhsMutable {
            return nil;
        }
        if typesEqual(*lhsTarget, *rhsTarget) {
            return Coercion::Identity;
        }
        return nil;
    }
    if let case Type::TraitObject { class: lhsClass, traitInfo: lhsTraitInfo, mutable: lhsMutable } = to {
        if let case Type::Pointer { class: rhsClass, target: rhsTarget, mutable: rhsMutable } = from {
            if not pointerClassesAssignable(lhsClass, rhsClass, self.inUnsafeContext)
                or (lhsMutable and not rhsMutable)
            {
                return nil;
            }
            if let inst = findInstance(self, lhsTraitInfo, *rhsTarget) {
                return Coercion::TraitObject { traitInfo: lhsTraitInfo, inst };
            }
        }
        if let case Type::TraitObject { class: rhsClass, traitInfo: rhsTraitInfo, mutable: rhsMutable } = from {
            if not pointerClassesAssignable(lhsClass, rhsClass, self.inUnsafeContext)
                or lhsTraitInfo <> rhsTraitInfo
            {
                return nil;
            }
            if lhsMutable and not rhsMutable {
                return nil;
            }
            return Coercion::Identity;
        }
        return nil;
    }
    if let case Type::Slice { class: lhsClass, item: lhsItem, mutable: lhsMutable } = to {
        let case Type::Slice { class: rhsClass, item: rhsItem, mutable: rhsMutable } = from
            else return nil;
        if not pointerClassesAssignable(lhsClass, rhsClass, self.inUnsafeContext)
            or (lhsMutable and not rhsMutable)
        {
            return nil;
        }
        // Allow coercion from `*[T]` to `*[opaque]`, and mutable counterparts.
        if *lhsItem == Type::Opaque {
            return Coercion::Identity;
        }
        if typesEqual(*lhsItem, *rhsItem) {
            return Coercion::Identity;
        }
        return nil;
    }
    match to {
        case Type::Array(lhs) => {
            let case Type::Array(rhs) = from
                else return nil;

            if lhs.length <> rhs.length {
                return nil;
            }
            // For array literals, check each element individually for
            // assignability.
            match rval.value {
                case ast::NodeValue::ArrayLit(items) => {
                    if rhs.length == 0 and lhs.length == 0 {
                        return Coercion::Identity;
                    }
                    // TODO: This won't work, because we should be setting coercions
                    // for every list item, but we don't. It's best to not have an
                    // `isAssignable` function and just have one that records coercions.
                    if isListAssignable(self, *lhs.item, items) {
                        return Coercion::Identity;
                    }
                    return nil;
                }
                case ast::NodeValue::ArrayRepeatLit(repeat) => {
                    return isAssignable(self, *lhs.item, *rhs.item, repeat.item);
                }
                else => {
                    if typesEqual(*lhs.item, *rhs.item) {
                        return Coercion::Identity;
                    }
                    return nil;
                }
            }
        }

        case Type::Optional(inner) => {
            if from == Type::Nil {
                return Coercion::OptionalLift(to);
            }
            if let _ = isAssignable(self, *inner, from, rval) {
                return Coercion::OptionalLift(to);
            }
            if let case Type::Optional(fromInner) = from {
                return isAssignable(self, *inner, *fromInner, rval);
            }
            return nil;
        }

        case Type::Fn(toInfo) => {
            // Allow function type structural matching.
            if let case Type::Fn(fromInfo) = from {
                if fnTypeEqual(toInfo, fromInfo) or (
                    toInfo.isUnsafe and not fromInfo.isUnsafe
                    and fnSignatureEqual(toInfo, fromInfo)
                ) {
                    return Coercion::Identity;
                }
            }
            return nil;
        }
        else => {
            if isNumericType(to) and isNumericType(from) {
                // Perform range validation at compile time if possible.
                // For unsuffixed integer expressions (`Type::Int`), only
                // validate literals directly written by the programmer.
                // Folded results (e.g. `0 - 65`) may not fit the target
                // type but are valid wrapping arithmetic at runtime.
                if let value = constValueEntry(self, rval) {
                    if from <> Type::Int or isIntegerLiteralExpr(rval) {
                        if validateConstIntRange(value, to) {
                            return Coercion::Identity;
                        }
                        return nil;
                    }
                    // Folded constant expression (e.g. `1 + 2`): if the
                    // result fits the target, use identity. Otherwise allow
                    // wrapping via numeric cast.
                    if validateConstIntRange(value, to) {
                        return Coercion::Identity;
                    }
                }
                // Allow unsuffixed integer expressions to be inferred from context.
                if from == Type::Int {
                    return Coercion::NumericCast { from, to };
                }
                // Non-constant numeric values require an explicit cast.
                return nil;
            }
        }
    }
    return nil;
}

/// Check if two function type descriptors are structurally equivalent.
fn fnTypeEqual(a: &FnType, b: &FnType) -> bool {
    if a.isUnsafe <> b.isUnsafe {
        return false;
    }
    return fnSignatureEqual(a, b);
}

/// Compare parameter, return, and error types of functions.
fn fnSignatureEqual(a: &FnType, b: &FnType) -> bool {
    if a.regions <> b.regions {
        return false;
    }
    if a.paramTypes.len <> b.paramTypes.len {
        return false;
    }
    if a.throwList.len <> b.throwList.len {
        return false;
    }
    if not typesEqual(*a.returnType, *b.returnType) {
        return false;
    }
    for i in 0..a.paramTypes.len {
        if not typesEqual(*a.paramTypes[i], *b.paramTypes[i]) {
            return false;
        }
    }
    for i in 0..a.throwList.len {
        if not typesEqual(*a.throwList[i], *b.throwList[i]) {
            return false;
        }
    }
    return true;
}

/// Check if two types are structurally equal.
export fn typesEqual(a: Type, b: Type) -> bool {
    // Nominal and trait types compare by descriptor identity.
    if a == b {
        return true;
    }
    if let case Type::Pointer { class: aClass, target: aTarget, mutable: aMutable } = a {
        let case Type::Pointer { class: bClass, target: bTarget, mutable: bMutable } = b
            else return false;
        return aClass == bClass and aMutable == bMutable
            and typesEqual(*aTarget, *bTarget);
    }
    if let case Type::Slice { class: aClass, item: aItem, mutable: aMutable } = a {
        let case Type::Slice { class: bClass, item: bItem, mutable: bMutable } = b
            else return false;
        return aClass == bClass and aMutable == bMutable
            and typesEqual(*aItem, *bItem);
    }
    match a {
        case Type::Cell { class, permission, payload } => {
            let case Type::Cell {
                class: otherClass, permission: otherPermission, payload: other,
            } = b else return false;
            return class == otherClass and permission == otherPermission
                and typesEqual(*payload, *other);
        }
        case Type::Array(aa) => {
            let case Type::Array(ab) = b else return false;
            return aa.length == ab.length and typesEqual(*aa.item, *ab.item);
        }
        case Type::Optional(oa) => {
            let case Type::Optional(ob) = b else return false;
            return typesEqual(*oa, *ob);
        }
        case Type::Fn(fa) => {
            let case Type::Fn(fb) = b else return false;
            return fnTypeEqual(fa, fb);
        }
        else => return false,
    }
}

/// Compare types after lexical region arguments are erased.
/// Nominal types retain their source declaration identity.
export unsafe fn erasedTypesEqual(a: Type, b: Type) -> bool {
    if typesEqual(a, b) {
        return true;
    }
    match a {
        case Type::Cell { class, permission, payload } => {
            let case Type::Cell {
                class: otherClass, permission: otherPermission, payload: other,
            } = b else return false;
            if (permission == nil) <> (otherPermission == nil) {
                return false;
            }
            return erasedClassesEqual(class, otherClass) and erasedTypesEqual(*payload, *other);
        }
        case Type::Session(_) => {
            let case Type::Session(_) = b else return false;
            return true;
        }
        case Type::Nominal(left) => {
            let case Type::Nominal(right) = b else return false;
            let mut leftBase = left;
            let mut rightBase = right;
            if let app = nominalApplication(left) {
                set leftBase = app.base;
            }
            if let app = nominalApplication(right) {
                set rightBase = app.base;
            }
            return leftBase == rightBase;
        }
        case Type::Pointer { class, target, mutable } => {
            let case Type::Pointer { class: otherClass, target: other, mutable: otherMutable } = b
                else return false;
            return erasedClassesEqual(class, otherClass) and mutable == otherMutable
                and erasedTypesEqual(*target, *other);
        }
        case Type::Slice { class, item, mutable } => {
            let case Type::Slice { class: otherClass, item: other, mutable: otherMutable } = b
                else return false;
            return erasedClassesEqual(class, otherClass) and mutable == otherMutable
                and erasedTypesEqual(*item, *other);
        }
        case Type::TraitObject { class, traitInfo, mutable } => {
            let case Type::TraitObject { class: otherClass, traitInfo: other, mutable: otherMutable } = b
                else return false;
            return erasedClassesEqual(class, otherClass) and mutable == otherMutable and traitInfo == other;
        }
        case Type::Array(left) => {
            let case Type::Array(right) = b else return false;
            return left.length == right.length and erasedTypesEqual(*left.item, *right.item);
        }
        case Type::Optional(left) => {
            let case Type::Optional(right) = b else return false;
            return erasedTypesEqual(*left, *right);
        }
        case Type::Fn(left) => {
            let case Type::Fn(right) = b else return false;
            if left.isUnsafe <> right.isUnsafe or left.paramTypes.len <> right.paramTypes.len
                or left.throwList.len <> right.throwList.len {
                return false;
            }
            for ty, i in left.paramTypes {
                if not erasedTypesEqual(*ty, *right.paramTypes[i]) {
                    return false;
                }
            }
            for ty, i in left.throwList {
                if not erasedTypesEqual(*ty, *right.throwList[i]) {
                    return false;
                }
            }
            return erasedTypesEqual(*left.returnType, *right.returnType);
        }
        else => return false,
    }
}

/// Compare pointer classes without lexical region identities.
fn erasedClassesEqual(a: types::PointerClass, b: types::PointerClass) -> bool {
    return a == b or (types::isReference(a) and types::isReference(b));
}

/// Require distinct runtime tags for errors with different source types.
unsafe fn validateErrorTag 'arena (self: &mut Resolver 'arena, node: *ast::Node, ty: Type, errors: *[*Type]) throws (ResolveError) {
    for other in errors {
        if not typesEqual(ty, *other) and erasedTypesEqual(ty, *other) {
            throw emitError(self, node, ErrorKind::AmbiguousRegionalError);
        }
    }
}

/// Return whether `ty` is a direct reference.
export fn isRefType(ty: Type) -> bool {
    match ty {
        case Type::Cell { class, .. } => return types::isReference(class),
        case Type::Pointer { class, .. } => return types::isReference(class),
        case Type::Slice { class, .. } => return types::isReference(class),
        case Type::TraitObject { class, .. } => return types::isReference(class),
        else => return false,
    }
}

/// Get the region of a direct named reference.
fn referenceRegion(ty: Type) -> ?*unsafe types::Region {
    let mut class = types::PointerClass::Ref;
    match ty {
        case Type::Cell { class: cellClass, .. } => set class = cellClass,
        case Type::Pointer { class: pointerClass, .. } => set class = pointerClass,
        case Type::Slice { class: sliceClass, .. } => set class = sliceClass,
        case Type::TraitObject { class: objectClass, .. } => set class = objectClass,
        else => return nil,
    }
    if let case types::PointerClass::Region(region) = class {
        return region;
    }
    return nil;
}

/// Require every free region in a value type to remain in lexical scope.
unsafe fn validateRegionDependencies 'arena (self: &mut Resolver 'arena, node: *ast::Node, ty: Type)
    throws (ResolveError)
{
    try validateRegionStorage(self, node, ty, nil);
}

/// Check a dependency against storage lifetime or current lexical visibility.
unsafe fn regionCoversStorage(
    scope: ?*RegionScope, dependency: *unsafe types::Region, destination: ?*unsafe types::Region
) -> bool {
    if let region = destination {
        return types::regionContains(dependency, region);
    }
    return regionInScope(scope, dependency.id);
}

/// Require stored references to cover the lifetime of checked destination storage.
unsafe fn validateRegionalStore 'arena (self: &mut Resolver 'arena, place: *ast::Node, value: *ast::Node, ty: Type)
    throws (ResolveError)
{
    if let case types::PointerClass::Region(region) = addressStorageClass(self, place) {
        try validateRegionStorage(self, value, ty, region);
    }
}

/// Require all type dependencies to cover the destination or active lexical scope.
/// Permission identities are visibility dependencies rather than storage lifetimes.
unsafe fn validateRegionStorage 'arena (
    self: &mut Resolver 'arena, node: *ast::Node, ty: Type, destination: ?*unsafe types::Region
)
    throws (ResolveError)
{
    let generation = nextNominalTraversalGeneration(self);
    try validateRegionStorageType(self, node, ty, destination, generation);
}

/// Walk one value type once per applied nominal descriptor.
unsafe fn validateRegionStorageType 'arena (
    self: &mut Resolver 'arena,
    node: *ast::Node,
    ty: Type,
    destination: ?*unsafe types::Region,
    generation: u32,
)
    throws (ResolveError)
{
    if let case Type::Session(region) = ty {
        if not regionCoversStorage(self.regionScope, region, destination) {
            throw emitError(self, node, ErrorKind::RegionEscape(region.name));
        }
    }
    if let region = referenceRegion(ty) {
        if not regionCoversStorage(self.regionScope, region, destination) {
            throw emitError(self, node, ErrorKind::RegionEscape(region.name));
        }
    }
    match ty {
        case Type::Pointer { target, .. } =>
            try validateRegionStorageType(
                self, node, *target, destination, generation,
            ),
        case Type::Slice { item, .. } =>
            try validateRegionStorageType(
                self, node, *item, destination, generation,
            ),
        case Type::Cell { permission, payload, .. } => {
            if let region = permission; not regionInScope(self.regionScope, region.id) {
                throw emitError(self, node, ErrorKind::RegionEscape(region.name));
            }
            try validateRegionStorageType(
                self, node, *payload, destination, generation,
            );
        }
        case Type::Array(array) =>
            try validateRegionStorageType(
                self, node, *array.item, destination, generation,
            ),
        case Type::Optional(inner) =>
            try validateRegionStorageType(
                self, node, *inner, destination, generation,
            ),
        case Type::Nominal(info) => {
            let applied = nominalApplication(info) else return;
            for region in applied.arguments {
                if not regionInScope(self.regionScope, region.id) {
                    throw emitError(self, node, ErrorKind::RegionEscape(region.name));
                }
            }
            if not visitNominalApplication(
                applied, generation, RegionTypeRole::StorageValidation,
            ) {
                return;
            }
            match *info {
                case NominalType::Record(recordType) => {
                    for field in recordType.fields {
                        try validateRegionStorageType(
                            self, node, field.fieldType, destination, generation,
                        );
                    }
                }
                case NominalType::Union(unionType) => {
                    for variant in unionType.variants {
                        try validateRegionStorageType(
                            self, node, variant.valueType, destination, generation,
                        );
                    }
                }
                // Unresolved applications have no member view to inspect yet.
                case NominalType::Placeholder(_), NominalType::Resolving(_),
                     NominalType::Application(_) => return,
            }
        }
        case Type::Fn(info) => {
            if info.regions <> nil {
                return;
            }
            for parameter in info.paramTypes {
                try validateRegionStorageType(
                    self, node, *parameter, destination, generation,
                );
            }
            for error in info.throwList {
                try validateRegionStorageType(
                    self, node, *error, destination, generation,
                );
            }
            try validateRegionStorageType(
                self, node, *info.returnType, destination, generation,
            );
        }
        else => {}
    }
}

/// Return whether a value type carries a named storage lifetime.
/// Cell permission identities authorize access and do not constrain storage.
unsafe fn containsStorageRegion 'arena (
    self: &mut Resolver 'arena, node: *ast::Node, root: Type
) -> bool throws (ResolveError) {
    let generation = nextNominalTraversalGeneration(self);
    return try typeContainsStorageRegion(self, node, root, generation);
}

/// Search one value type once per applied nominal descriptor.
unsafe fn typeContainsStorageRegion 'arena (
    self: &mut Resolver 'arena, node: *ast::Node, ty: Type, generation: u32
) -> bool throws (ResolveError) {
    match ty {
        case Type::Cell { class, payload, .. } => {
            if let case types::PointerClass::Region(_) = class {
                return true;
            }
            return try typeContainsStorageRegion(self, node, *payload, generation);
        }
        case Type::Session(_) => return true,
        case Type::Pointer { class, target, .. } => {
            if let case types::PointerClass::Region(_) = class {
                return true;
            }
            return try typeContainsStorageRegion(self, node, *target, generation);
        }
        case Type::Slice { class, item, .. } => {
            if let case types::PointerClass::Region(_) = class {
                return true;
            }
            return try typeContainsStorageRegion(self, node, *item, generation);
        }
        case Type::TraitObject { class, .. } => {
            if let case types::PointerClass::Region(_) = class {
                return true;
            }
            return false;
        }
        case Type::Array(array) =>
            return try typeContainsStorageRegion(self, node, *array.item, generation),
        case Type::Optional(inner) =>
            return try typeContainsStorageRegion(self, node, *inner, generation),
        case Type::Range { start, end } => {
            if let startType = start;
                try typeContainsStorageRegion(self, node, *startType, generation)
            {
                return true;
            }
            if let endType = end {
                return try typeContainsStorageRegion(self, node, *endType, generation);
            }
            return false;
        }
        case Type::Nominal(info) => {
            try ensureNominalResolved(self, info, node);
            let applied = nominalApplication(info) else return false;
            if not visitNominalApplication(
                applied, generation, RegionTypeRole::StoragePresence,
            ) {
                return false;
            }
            match *info {
                case NominalType::Record(recordType) => {
                    for field in recordType.fields {
                        if try typeContainsStorageRegion(
                            self, node, field.fieldType, generation,
                        ) {
                            return true;
                        }
                    }
                }
                case NominalType::Union(unionType) => {
                    for variant in unionType.variants {
                        if try typeContainsStorageRegion(
                            self, node, variant.valueType, generation,
                        ) {
                            return true;
                        }
                    }
                }
                case NominalType::Placeholder(_), NominalType::Resolving(_),
                     NominalType::Application(_) =>
                    panic "typeContainsStorageRegion: unresolved nominal type",
            }
            return false;
        }
        case Type::Fn(info) => {
            if info.regions <> nil {
                return false;
            }
            for parameter in info.paramTypes {
                if try typeContainsStorageRegion(
                    self, node, *parameter, generation,
                ) {
                    return true;
                }
            }
            for error in info.throwList {
                if try typeContainsStorageRegion(self, node, *error, generation) {
                    return true;
                }
            }
            return try typeContainsStorageRegion(
                self, node, *info.returnType, generation,
            );
        }
        else => return false,
    }
}

/// Return whether a type has an explicit region dependency.
unsafe fn containsRegion(ty: Type) -> bool {
    match ty {
        case Type::Cell { class, permission, payload } => {
            if permission <> nil {
                return true;
            }
            if let case types::PointerClass::Region(_) = class {
                return true;
            }
            return containsRegion(*payload);
        }
        case Type::Session(_) => return true,
        case Type::Pointer { class, target, .. } => {
            if let case types::PointerClass::Region(_) = class {
                return true;
            }
            return containsRegion(*target);
        }
        case Type::Slice { class, item, .. } => {
            if let case types::PointerClass::Region(_) = class {
                return true;
            }
            return containsRegion(*item);
        }
        case Type::TraitObject { class, .. } => {
            if let case types::PointerClass::Region(_) = class {
                return true;
            }
            return false;
        }
        case Type::Array(array) => return containsRegion(*array.item),
        case Type::Optional(inner) => return containsRegion(*inner),
        case Type::Fn(info) => {
            if info.regions <> nil or containsRegion(*info.returnType) {
                return true;
            }
            for param in info.paramTypes {
                if containsRegion(*param) {
                    return true;
                }
            }
            for error in info.throwList {
                if containsRegion(*error) {
                    return true;
                }
            }
            return false;
        }
        case Type::Nominal(info) => return nominalApplication(info) <> nil,
        else => return false,
    }
}

/// Return whether a stored type contains a reference without a named region.
fn containsUnscopedRef(ty: Type) -> bool {
    if isRefType(ty) and referenceRegion(ty) == nil {
        return true;
    }
    if let case Type::Pointer { target, .. } = ty {
        return containsUnscopedRef(*target);
    }
    if let case Type::Slice { item, .. } = ty {
        return containsUnscopedRef(*item);
    }
    match ty {
        case Type::Cell { payload, .. } => return containsUnscopedRef(*payload),
        case Type::Array(array) => return containsUnscopedRef(*array.item),
        case Type::Optional(inner) => return containsUnscopedRef(*inner),
        case Type::Fn(info) => return info.regions <> nil,
        // Nominal declarations validate their own fields and variants.
        // Treating them as leaves also terminates recursive pointer types.
        case Type::Nominal(_) => return false,
        else => return false,
    }
}

/// Return whether `ty` may be duplicated implicitly.
export unsafe fn isCopy(ty: Type) -> bool {
    match ty {
        case Type::Session(_) => return false,
        case Type::Pointer { class, mutable, .. } =>
            return class == types::PointerClass::Unsafe or not mutable,
        case Type::Slice { class, mutable, .. } =>
            return class == types::PointerClass::Unsafe or not mutable,
        case Type::TraitObject { class, mutable, .. } =>
            return class == types::PointerClass::Unsafe or not mutable,
        case Type::Array(array) => return isCopy(*array.item),
        case Type::Optional(inner) => return isCopy(*inner),
        case Type::Nominal(NominalType::Record(recInfo)) => return recInfo.declaredCopy,
        case Type::Nominal(NominalType::Union(unionType)) => return unionType.declaredCopy,
        case Type::Nominal(NominalType::Application(applied)) => return isCopy(Type::Nominal(applied.base)),
        case Type::Nominal(NominalType::Placeholder(_)), Type::Nominal(NominalType::Resolving(_)) => return false,
        else => return true,
    }
}

/// Return whether a type must be consumed exactly once.
export unsafe fn isLinear(ty: Type) -> bool {
    match ty {
        case Type::Nominal(NominalType::Application(applied)) => return isLinear(Type::Nominal(applied.base)),
        case Type::Array(array) => return isLinear(*array.item),
        case Type::Optional(inner) => return isLinear(*inner),
        case Type::Nominal(NominalType::Record(recInfo)) => {
            if recInfo.declaredLinear {
                return true;
            }
            for field in recInfo.fields {
                if isLinear(field.fieldType) {
                    return true;
                }
            }
            return false;
        }
        case Type::Nominal(NominalType::Union(unionType)) => {
            if unionType.declaredLinear {
                return true;
            }
            for variant in unionType.variants {
                if isLinear(variant.valueType) {
                    return true;
                }
            }
            return false;
        }
        else => return false,
    }
}

/// Return whether a by-value use moves `ty`.
unsafe fn isMoveOnly(ty: Type) -> bool {
    return not isCopy(ty);
}

/// Return whether `ty` is a direct unsafe pointer-like value.
fn isUnsafePointerType(ty: Type) -> bool {
    match ty {
        case Type::Cell { class: types::PointerClass::Unsafe, .. },
             Type::Pointer { class: types::PointerClass::Unsafe, .. },
             Type::Slice { class: types::PointerClass::Unsafe, .. },
             Type::TraitObject { class: types::PointerClass::Unsafe, .. } => return true,
        else => return false,
    }
}

/// Get the record info from a record type.
export unsafe fn getRecord(ty: Type) -> ?RecordType {
    let case Type::Nominal(NominalType::Record(recInfo)) = ty else return nil;
    return recInfo;
}

/// Auto-dereference a type: if it's a pointer, return the target type.
export fn autoDeref(ty: Type) -> Type {
    if let case Type::Pointer { target, .. } = ty {
        return *target;
    }
    return ty;
}

/// Get field info for a record-like type (records, slices) by field index.
export unsafe fn getRecordField(ty: Type, index: u32) -> ?RecordField {
    if let case Type::Slice { class, item, mutable } = ty {
        match index {
            case 0 => return RecordField {
                name: PTR_FIELD,
                fieldType: Type::Pointer { class, target: item, mutable },
                offset: 0,
            },
            case 1 => return RecordField {
                name: LEN_FIELD,
                fieldType: Type::U32,
                offset: PTR_SIZE as i32,
            },
            case 2 => return RecordField {
                name: CAP_FIELD,
                fieldType: Type::U32,
                offset: PTR_SIZE as i32 + 4,
            },
            else => return nil,
        }
    }
    if let case Type::Nominal(NominalType::Record(recInfo)) = ty;
        index < recInfo.fields.len
    {
        return recInfo.fields[index];
    }
    return nil;
}

/// Check if the two types can be compared for equality.
unsafe fn isComparable(left: Type, right: Type) -> bool {
    if left == Type::Unknown or right == Type::Unknown {
        return false;
    }
    if left == right {
        return true;
    }
    // Comparisons with optionals.
    if let case Type::Optional(l) = left {
        if let case Type::Optional(r) = right {
            return isComparable(*l, *r);
        } else if right == Type::Nil {
            return true;
        }
        return isComparable(*l, right);
    } else if let case Type::Optional(_) = right {
        return isComparable(right, left); // Flip order.
    }
    // Pointer comparisons ignore mutability.
    if let case Type::Pointer { target: lTarget, .. } = left {
        if let case Type::Pointer { target: rTarget, .. } = right {
            return typesEqual(*lTarget, *rTarget);
        }
    }
    // Numeric types.
    if isNumericType(left) and isNumericType(right) {
        return true;
    }
    return false;
}

/// Check if the `from` type is assignable to the `to` type, and return a
/// coercion plan if so, or throw an error if not.
unsafe fn expectAssignable 'arena (self: &mut Resolver 'arena, to: Type, source: Type, site: *ast::Node) -> Coercion throws (ResolveError) {
    let from = assignableValueType(self, site, source);
    if isRefType(to) and isUnsafePointerType(from) {
        try requireUnsafe(self, site);
    }
    // Ensure any nested nominal types are resolved before checking assignability.
    try ensureTypeResolved(self, to, site);
    if let coercion = isAssignable(self, to, from, site) {
        return setNodeCoercion(self, site, coercion);
    }
    throw emitTypeMismatch(self, site, TypeMismatch {
        expected: to,
        actual: from,
    });
}

/// Check that a type is optional, otherwise throw an error.
unsafe fn checkOptional 'arena (self: &mut Resolver 'arena, node: *ast::Node) -> *Type
    throws (ResolveError)
{
    if let case Type::Optional(inner) = try infer(self, node) {
        return inner;
    }
    throw emitError(self, node, ErrorKind::ExpectedOptional);
}

/// Check that a node's type is equal to the expected type.
unsafe fn checkEqual 'arena (self: &mut Resolver 'arena, node: *ast::Node, expected: Type) -> Type
    throws (ResolveError)
{
    let actualTy = try visit(self, node, expected);
    if actualTy <> expected {
        throw emitTypeMismatch(self, node, TypeMismatch { expected, actual: actualTy });
    }
    return actualTy;
}

/// Bind an identifier in the given scope.
unsafe fn bindIdent 'arena (
    self: &mut Resolver 'arena,
    name: *[u8],
    owner: *ast::Node,
    data: SymbolData,
    attrs: u32,
    scope: *unsafe mut Scope
) -> *unsafe mut Symbol throws (ResolveError) {
    let sym = allocSymbol(self, data, name, owner, attrs);
    try addSymbolToScope(self, sym, scope, owner);
    setNodeSymbol(self, owner, sym);

    return sym;
}

/// Add a symbol to the given scope.
unsafe fn addSymbolToScope 'arena (self: &mut Resolver 'arena, sym: *unsafe mut Symbol, scope: *unsafe mut Scope, site: *ast::Node) throws (ResolveError) {
    for i in 0..scope.symbolsLen {
        if scope.symbols[i].name == sym.name {
            throw emitError(self, site, ErrorKind::DuplicateBinding(sym.name));
        }
    }
    if scope.symbolsLen >= scope.symbols.len {
        throw emitError(self, site, ErrorKind::SymbolOverflow);
    }
    // Preserve the defining module when importing an existing symbol into
    // another module's scope.
    if sym.moduleId == nil {
        if let modId = scope.moduleId {
            set sym.moduleId = modId;
        }
    }
    set scope.symbols[scope.symbolsLen] = sym;
    set scope.symbolsLen += 1;
}

/// Bind a value identifier in the current scope.
/// Returns `nil` if the identifier is a placeholder (`_`).
unsafe fn bindValueIdent 'arena (
    self: &mut Resolver 'arena,
    ident: *ast::Node,
    owner: *ast::Node,
    type: Type,
    mutable: bool,
    alignment: u32,
    attrs: u32
) -> ?*unsafe mut Symbol throws (ResolveError) {
    if let case ast::NodeValue::Placeholder = ident.value {
        setNodeType(self, owner, type);
        return nil;
    }
    let name = try nodeName(self, ident);
    let data = SymbolData::Value { mutable, alignment, type, addressTaken: false };
    let scope = self.scope;
    let sym = try bindIdent(self, name, owner, data, attrs, scope);
    if ident <> owner {
        setNodeSymbol(self, ident, sym);
    }
    setNodeType(self, owner, type);
    setNodeType(self, ident, type);

    // Track number of local bindings for lowering stage.
    if let owner = self.currentFnNode {
        set self.nodeData.entries[owner.id].localCount += 1;
    }
    return sym;
}

/// Bind a constant identifier in the current scope.
unsafe fn bindConstIdent 'arena (
    self: &mut Resolver 'arena,
    ident: *ast::Node,
    owner: *ast::Node,
    type: Type,
    val: ?ConstValue,
    attrs: u32
) -> *unsafe mut Symbol throws (ResolveError) {
    let name = try nodeName(self, ident);
    let data = SymbolData::Constant { type, value: val };
    let scope = self.scope;
    let sym = try bindIdent(self, name, owner, data, attrs, scope);
    setNodeType(self, owner, type);
    setNodeType(self, ident, type);

    return sym;
}

/// Bind a module identifier in the given scope.
/// This is used when declaring modules with `mod` or
/// importing modules with `use`.
unsafe fn bindModuleIdent 'arena (
    self: &mut Resolver 'arena,
    entry: *module::ModuleEntry,
    scope: *unsafe mut Scope,
    owner: *ast::Node,
    attrs: u32,
    bindingScope: *unsafe mut Scope
) -> *unsafe mut Symbol throws (ResolveError) {
    let data = SymbolData::Module { entry, scope };
    let name = entry.name;

    return try bindIdent(self, name, owner, data, attrs, bindingScope);
}

/// Bind a type identifier in the current scope.
unsafe fn bindTypeIdent 'arena (
    self: &mut Resolver 'arena,
    ident: *ast::Node,
    owner: *ast::Node,
    type: *unsafe mut NominalType,
    attrs: u32
) -> *unsafe mut Symbol throws (ResolveError) {
    let name = try nodeName(self, ident);
    let data = SymbolData::Type(type);
    let scope = self.scope;
    return try bindIdent(self, name, owner, data, attrs, scope);
}

/// Predicate that matches any symbol.
fn isAnySymbol(_sym: &Symbol) -> bool {
    return true;
}

/// Predicate that matches value or constant symbols.
fn isValueSymbol(sym: &Symbol) -> bool {
    if let case SymbolData::Value { .. } = sym.data {
        return true;
    }
    if let case SymbolData::Constant { .. } = sym.data {
        return true;
    }
    return false;
}

/// Predicate that matches type symbols.
fn isTypeSymbol(sym: &Symbol) -> bool {
    if let case SymbolData::Type(_) = sym.data {
        return true;
    }
    return false;
}

/// Find a symbol by name in a specific scope, filtered by a predicate.
unsafe fn findInScope(scope: *unsafe Scope, name: *[u8], predicate: fn(&Symbol) -> bool) -> ?*unsafe mut Symbol {
    for i in 0..scope.symbolsLen {
        let sym = scope.symbols[i];
        if sym.name == name and predicate(sym) {
            return sym;
        }
    }
    return nil;
}

/// Find a symbol by name, traversing scopes upwards, filtered by a predicate.
unsafe fn findInScopeRecursive(scope: *unsafe Scope, name: *[u8], predicate: fn(&Symbol) -> bool) -> ?*unsafe mut Symbol {
    let mut curr = scope;
    loop {
        if let sym = findInScope(curr, name, predicate) {
            return sym;
        }
        if let parent = curr.parent {
            set curr = parent;
        } else {
            break;
        }
    }
    return nil;
}

/// Find a symbol by name in a specific scope (matches any symbol kind).
export unsafe fn findSymbolInScope(scope: *unsafe Scope, name: *[u8]) -> ?*unsafe mut Symbol {
    return findInScope(scope, name, isAnySymbol);
}

/// Look up a value symbol by name, searching from the given scope outward.
unsafe fn findValueSymbol(scope: *unsafe Scope, name: *[u8]) -> ?*unsafe mut Symbol {
    return findInScopeRecursive(scope, name, isValueSymbol);
}

/// Look up a type symbol by name, searching from the given scope outward.
unsafe fn findTypeSymbol(scope: *unsafe Scope, name: *[u8]) -> ?*unsafe mut Symbol {
    return findInScopeRecursive(scope, name, isTypeSymbol);
}

/// Like `findValueSymbol`, but finds symbols of any kinds.
unsafe fn findAnySymbol(scope: *unsafe Scope, name: *[u8]) -> ?*unsafe mut Symbol {
    return findInScopeRecursive(scope, name, isAnySymbol);
}

/// Flatten an identifier or scope access chain into an array of name segments.
/// Examples: `fnord` -> `&["fnord"]`, `a::b::c` -> `&["a", "b", "c"]`.
/// Return the number of segments written to the buffer.
fn flattenPath 'arena (
    self: &mut Resolver 'arena,
    node: *ast::Node,
    buf: &mut [*[u8]]
) -> u32 throws (ResolveError) {
    let mut out: u32 = 0;

    match node.value {
        case ast::NodeValue::Ident(name) if name.len > 0 => {
            assert buf.len >= 1, "flattenPath: invalid output buffer size";
            set buf[0] = name;
            set out = 1;
        }
        case ast::NodeValue::ScopeAccess(access) => {
            // Recursively flatten parent path.
            let parent = try flattenPath(self, access.parent, buf);
            assert parent < buf.len, "flattenPath: invalid output buffer size";
            let child = try nodeName(self, access.child);
            set buf[parent] = child;
            set out = parent + 1;
        }
        case ast::NodeValue::Super => {
            // `super` is handled by scope adjustment in `checkSuperAccess`.
            // Return empty prefix so the path continues from the next segment.
            set out = 0;
            return out;
        }
        else => {
            // Fallthrough to error.
        }
    }
    if out < 1 {
        throw emitError(self, node, ErrorKind::InvalidIdentifier(node));
    }
    return out;
}

/// Find the module ID for a given scope by walking up the scope chain until
/// we hit the module's scope.
unsafe fn findModuleForScope(scope: *unsafe Scope) -> ?u16 {
    let mut s = scope;
    loop {
        if let id = s.moduleId {
            return id;
        }
        if let parent = s.parent {
            set s = parent;
        } else {
            return nil;
        }
    }
}

/// Return a retained module identity, if its ID is registered.
export fn moduleFor 'arena (self: &Resolver 'arena, id: u16) -> ?*module::ModuleEntry {
    if id as u32 >= self.moduleEntries.len {
        return nil;
    }
    return self.moduleEntries[id as u32];
}

/// Find a retained child identity by its parent and name.
fn findChildModule 'arena (self: &Resolver 'arena, name: *[u8], parentId: u16) -> ?*module::ModuleEntry {
    for child in self.moduleEntries {
        if let entry = child {
            if entry.parent == parentId and mem::eq(entry.name, name) {
                return entry;
            }
        }
    }
    return nil;
}

/// Get the parent module scope for the current module.
/// Returns the scope of the parent module, or `nil` if this is a root module.
fn getParentModuleScope 'arena (self: &mut Resolver 'arena, node: *ast::Node) -> ?*unsafe mut Scope throws (ResolveError) {
    let currentMod = moduleFor(self, self.currentMod)
        else throw emitError(self, node, ErrorKind::Internal);
    let parentId = currentMod.parent
        else return nil; // No parent module.

    return self.moduleScopes[parentId as u32];
}

/// Check if a node has `super` at its root (e.g. `super::x` or `super::Union::Variant`).
/// Returns the parent scope and the original node so `flattenPath` can strip `super`.
fn checkSuperAccess 'arena (
    self: &mut Resolver 'arena,
    node: *ast::Node
) -> ?SuperAccessResult throws (ResolveError) {
    // TODO: Maybe we should deal with `super` after the path is flattened.
    if let case ast::NodeValue::ScopeAccess(access) = node.value {
        // Direct super access: `super::x`.
        if let case ast::NodeValue::Super = access.parent.value {
            let parentScope = try getParentModuleScope(self, node)
                else throw emitError(self, node, ErrorKind::InvalidModulePath);
            return SuperAccessResult { scope: parentScope, child: node };
        }
        // Nested super access: `super::x::y`, check if parent path contains `super`.
        if let _ = try checkSuperAccess(self, access.parent) {
            let parentScope = try getParentModuleScope(self, node)
                else throw emitError(self, node, ErrorKind::InvalidModulePath);
            return SuperAccessResult { scope: parentScope, child: node };
        }
    }
    return nil;
}

/// Check symbol visibility from declaration attributes and module identities.
/// A symbol is accessible if:
/// * It has the `export` attribute, OR
/// * It's being accessed from within the module where it was defined.
fn isSymbolVisible(attrs: u32, symModuleId: ?u16, currentModuleId: ?u16) -> bool {
    // Public symbols are visible from anywhere.
    if ast::hasAttribute(attrs, ast::Attribute::Export) {
        return true;
    }
    // In test mode, @test symbols are visible from anywhere
    // so the test runner can reference them.
    if ast::hasAttribute(attrs, ast::Attribute::Test) {
        return true;
    }
    // Private symbols are only visible from the same module.
    return symModuleId == currentModuleId;
}

/// Resolve an access node (eg. `lang::resolver::MAX_ERRORS`) to a symbol,
/// starting from the given scope.
unsafe fn resolveAccess 'arena (
    self: &mut Resolver 'arena,
    node: *ast::Node,
    access: ast::Access,
    scope: *unsafe Scope
) -> *unsafe mut Symbol throws (ResolveError) {
    if let case ast::NodeValue::RegionApply { .. } = access.parent.value {
        let ty = try infer(self, access.parent);
        let case Type::Nominal(info) = ty else throw emitError(self, node, ErrorKind::InvalidScopeAccess);
        try ensureNominalResolved(self, info, access.parent);
        let case NominalType::Union(body) = *info else throw emitError(self, node, ErrorKind::InvalidScopeAccess);
        let name = try nodeName(self, access.child);
        let symbol = try resolveUnionVariantAccess(self, node, access, body, name);
        setNodeType(self, node, ty);
        return symbol;
    }
    // Handle `super` access by adjusting scope and node.
    let mut startScope = scope;
    let mut pathNode = node;
    if let superAccess = try checkSuperAccess(self, node) {
        set startScope = superAccess.scope;
        set pathNode = superAccess.child;
    }
    // TODO: It doesn't make sense that `flattenPath` handles identifiers and scope access,
    // while this function requires a scope access.
    let mut buffer: [*[u8]; 32] = undefined;
    let pathLen = try flattenPath(self, pathNode, &mut buffer[..]);

    return try resolvePath(self, node, access, &buffer[..pathLen], startScope);
}

/// Resolve a path (eg. ["lang", "resolver", "MAX_ERRORS"]) to a symbol,
/// starting from the given scope.
unsafe fn resolvePath 'arena (
    self: &mut Resolver 'arena,
    node: *ast::Node,
    access: ast::Access,
    path: &[*[u8]],
    scope: *unsafe Scope
) -> *unsafe mut Symbol throws (ResolveError) {
    assert path.len <> 0, "resolvePath: empty path";
    // Start by finding the root of the path.
    let root = path[0];
    let sym = findInScopeRecursive(scope, root, isAnySymbol)
        else throw emitError(self, node, ErrorKind::UnresolvedSymbol(root));

    // Check visibility for symbol.
    if not isSymbolVisible(sym.attrs, findModuleForScope(scope), findModuleForScope(self.scope)) {
        throw emitError(self, node, ErrorKind::UnresolvedSymbol(root));
    }
    // End condition.
    if path.len == 1 {
        return sym;
    }
    // Otherwise, we need to enter the next scope with the path suffix.
    match sym.data {
        case SymbolData::Module { scope, .. } => {
            return try resolvePath(self, node, access, &path[1..], scope);
        }
        case SymbolData::Type(ty) => {
            // Lazily resolve union body if not yet done.
            try ensureNominalResolved(self, ty, node);

            if let case NominalType::Union(unionType) = *ty {
                // TODO: Recurse with variant so we consolidate everything.
                if path.len > 2 {
                    throw emitError(self, node, ErrorKind::InvalidScopeAccess);
                }
                let variantName = path[1];
                let variantSym = try resolveUnionVariantAccess(
                    self, node, access, unionType, variantName
                );
                // TODO: This shouldn't be here.
                setNodeType(self, node, Type::Nominal(ty));
                return variantSym;
            }
        }
        else => {} // Fallthrough.
    }
    throw emitError(self, node, ErrorKind::InvalidScopeAccess);
}

/// Resolve a module path (e.g., `foo::bar::baz`) to a module entry and scope.
/// This traverses the module hierarchy, checking visibility at each step.
unsafe fn resolveModulePath 'arena (
    self: &mut Resolver 'arena,
    module: *ast::Node
) -> ResolvedModule throws (ResolveError) {
    let mut startScope = self.scope;
    let mut pathNode = module;

    // Handle `super` access.
    if let superAccess = try checkSuperAccess(self, module) {
        set startScope = superAccess.scope;
        set pathNode = superAccess.child;
    }
    let mut pathBuf: [*[u8]; 16] = undefined;
    let pathLen = try flattenPath(self, pathNode, &mut pathBuf[..]);
    if pathLen == 0 {
        throw emitError(self, module, ErrorKind::UnresolvedSymbol(""));
    }
    let parentName = pathBuf[0];

    // First, check if this is a sub-module of the start scope.
    if let sym = findSymbolInScope(startScope, parentName) {
        return try resolveModulePathRecursive(self, module, &pathBuf[1..pathLen], sym);
    }
    // Not a sub-module, so look in the global scope for a package root.
    let sym = findSymbolInScope(self.pkgScope, parentName)
        else throw emitError(self, module, ErrorKind::UnresolvedSymbol(parentName));

    return try resolveModulePathRecursive(self, module, &pathBuf[1..pathLen], sym);
}

/// Recursively resolve the remaining path segments by traversing child modules.
unsafe fn resolveModulePathRecursive 'arena (
    self: &mut Resolver 'arena,
    node: *ast::Node,
    path: &[*[u8]],
    sym: *unsafe Symbol
) -> ResolvedModule throws (ResolveError) {
    let case SymbolData::Module { entry, scope } = sym.data
        else throw emitError(self, node, ErrorKind::Internal);

    if path.len == 0 {
        return ResolvedModule { entry, scope };
    }
    let childName = path[0];
    let childSym = findSymbolInScope(scope, childName)
        else throw emitError(self, node, ErrorKind::UnresolvedSymbol(childName));

    if not isSymbolVisible(childSym.attrs, findModuleForScope(scope), findModuleForScope(self.scope)) {
        throw emitError(self, node, ErrorKind::UnresolvedSymbol(childName));
    }
    return try resolveModulePathRecursive(
        self,
        node,
        &path[1..],
        childSym
    );
}

/// Resolve a type name, which could be an identifier or scoped path.
unsafe fn resolveTypeName 'arena (self: &mut Resolver 'arena, node: *ast::Node) -> *unsafe NominalType throws (ResolveError) {
    match node.value {
        case ast::NodeValue::Ident(name) => {
            let sym = findTypeSymbol(self.scope, name)
                else throw emitError(self, node, ErrorKind::UnresolvedSymbol(name));
            let case SymbolData::Type(ty) = sym.data
                else throw emitError(self, node, ErrorKind::Internal);

            setNodeSymbol(self, node, sym);

            return ty;
        }
        case ast::NodeValue::ScopeAccess(access) => {
            let scope = self.scope;
            let sym = try resolveAccess(self, node, access, scope);
            let case SymbolData::Type(ty) = sym.data
                else throw emitError(self, node, ErrorKind::Internal);

            setNodeSymbol(self, node, sym);

            return ty;
        }
        else => panic "resolveTypeName: unsupported node value",
    }
}

/// Visit a top-level declaration in the declaration phase.
/// This binds all names and analyzes signatures, types, and initializers.
/// Function bodies are deferred to the definition phase.
///
/// Nb. User-defined types are already handled by this point.
unsafe fn visitDecl 'arena (self: &mut Resolver 'arena, node: *ast::Node) throws (ResolveError) {
    match node.value {
        case ast::NodeValue::FnDecl(_),
             ast::NodeValue::ConstDecl(_),
             ast::NodeValue::Mod(_),
             ast::NodeValue::Use(_) => {
            // Handled in previous passes.
        }
        case ast::NodeValue::StaticDecl(_) => {
            try infer(self, node);
        }
        case ast::NodeValue::InstanceDecl { traitName, targetType, regions, methods } => {
            try resolveInstanceDecl(self, node, traitName, targetType, regions, methods);
        }
        case ast::NodeValue::MethodDecl {
            ..
        } => {
            try resolveMethodDecl(self, node);
        }
        else => {
            // Ignore non-declaration nodes.
        }
    }
}

/// Require an unsafe function or block.
fn requireUnsafe 'arena (self: &mut Resolver 'arena, node: *ast::Node) throws (ResolveError) {
    if not self.inUnsafeContext {
        throw emitError(self, node, ErrorKind::UnsafeOperation);
    }
}

/// Require an unsafe context for any access to an unsafe static.
fn checkStaticAccess 'arena (self: &mut Resolver 'arena, node: *ast::Node, sym: &Symbol)
    throws (ResolveError)
{
    if let case ast::NodeValue::StaticDecl(_) = sym.node.value {
        if ast::hasAttribute(sym.attrs, ast::Attribute::Unsafe) {
            try requireUnsafe(self, node);
        }
    }
}

/// Reject calls from safe code through unsafe function types.
fn checkUnsafeCall 'arena (self: &mut Resolver 'arena, node: *ast::Node, info: *FnType)
    throws (ResolveError)
{
    if info.isUnsafe and not self.inUnsafeContext {
        throw emitError(self, node, ErrorKind::UnsafeCall);
    }
}

/// Visit a top-level definition, recursing into sub-modules.
unsafe fn visitDef 'arena (self: &mut Resolver 'arena, node: *ast::Node) throws (ResolveError) {
    match node.value {
        case ast::NodeValue::FnDecl(decl) => {
            try resolveFnDeclBody(self, node, decl) catch {
                return;
            };
        }
        case ast::NodeValue::Mod(decl) => {
            let modName = try nodeName(self, decl.name);
            if not shouldAnalyzeModule(self, decl.attrs, modName) {
                return;
            }
            let submod = try enterSubModule(self, modName, node);
            let case ast::NodeValue::Block(block) = submod.root.value
                else panic "visitDef: expected block for module root";
            try resolveModuleDefs(self, &block) catch e {
                exitModuleScope(self, submod);
                throw e;
            };
            exitModuleScope(self, submod);
        }
        case ast::NodeValue::RecordDecl(_),
             ast::NodeValue::UnionDecl(_),
             ast::NodeValue::Use(_),
             ast::NodeValue::TraitDecl { .. } => {
            // Skip: already analyzed in declaration phase.
        }
        case ast::NodeValue::InstanceDecl { methods, .. } => {
            try resolveInstanceMethodBodies(self, methods);
        }
        case ast::NodeValue::MethodDecl {
            ..
        } => {
            try resolveMethodBody(self, node);
        }
        else => {
            // FIXME: This allows module-level statements that should
            // normally only be valid inside function bodies. We currently
            // need this because of how tests are written, but it should
            // be eventually removed.
            try infer(self, node) catch {
                return;
            };
        }
    }
}

/// Try to infer a node's type.
unsafe fn infer 'arena (self: &mut Resolver 'arena, node: *ast::Node) -> Type throws (ResolveError) {
    return try visit(self, node, Type::Unknown);
}

/// Permit named reference dependencies and direct call-scoped or local references.
unsafe fn validateValueTypeReferences 'arena (self: &mut Resolver 'arena, node: *ast::Node, ty: Type)
    throws (ResolveError)
{
    try validateRegionDependencies(self, node, ty);
    if let case Type::Fn(info) = ty; info.regions == nil {
        return;
    }
    if isRefType(ty) {
        if let case Type::Pointer { target, .. } = ty {
            if containsUnscopedRef(*target) {
                throw emitError(self, node, ErrorKind::InvalidRefPosition);
            }
        } else if let case Type::Slice { item, .. } = ty {
            if containsUnscopedRef(*item) {
                throw emitError(self, node, ErrorKind::InvalidRefPosition);
            }
        }
    } else if containsUnscopedRef(ty) {
        throw emitError(self, node, ErrorKind::InvalidRefPosition);
    }
}

/// Require a type that may be stored or escape a call.
unsafe fn ensureStorableType 'arena (self: &mut Resolver 'arena, node: *ast::Node, ty: Type)
    throws (ResolveError)
{
    try validateRegionDependencies(self, node, ty);
    if containsUnscopedRef(ty) {
        throw emitError(self, node, ErrorKind::InvalidRefPosition);
    }
}

/// Resolve a type signature node.
unsafe fn resolveValueType 'arena (self: &mut Resolver 'arena, node: *ast::Node) -> Type throws (ResolveError) {
    let ty = try visit(self, node, Type::Unknown);
    if let case Type::Nominal(info) = ty {
        try requireNominalArguments(self, info, node);
    }
    // Opaque value types are not allowed.
    if ty == Type::Opaque {
        throw emitError(self, node, ErrorKind::OpaqueTypeNotAllowed);
    }
    try validateValueTypeReferences(self, node, ty);
    return ty;
}

/// Analyze a node's type and check that it can be assigned to the expected type.
unsafe fn checkAssignable 'arena (self: &mut Resolver 'arena, node: *ast::Node, expected: Type) -> Type throws (ResolveError) {
    let actual = try visit(self, node, expected);
    let _ = try expectAssignable(self, expected, actual, node);
    if isRefType(expected) and isMutablePointerLike(expected) and isMutablePointerLike(actual) {
        if not try canMutateThrough(self, node) {
            throw emitError(self, node, ErrorKind::ImmutableBinding);
        }
    }
    return actual;
}

/// Analyze a node and propagate the resolved type.
/// The `hint` parameter provides type context for inference and validation.
/// When `nil`, the type must be inferred from the expression itself.
unsafe fn visit 'arena (self: &mut Resolver 'arena, node: *ast::Node, hint: Type) -> Type
    throws (ResolveError)
{
    if let ty = typeFor(self, node) {
        // An optional context completes a nil expression's storage type.
        if ty <> Type::Nil or not isOptionalType(hint) {
            return ty;
        }
    }
    match node.value {
        case ast::NodeValue::Ident(name) => {
            let sym = findAnySymbol(self.scope, name)
                else throw emitError(self, node, ErrorKind::UnresolvedSymbol(name));
            try checkStaticAccess(self, node, sym);
            setNodeSymbol(self, node, sym);
            match sym.data {
                case SymbolData::Value { type, .. } =>
                    return setNodeType(self, node, type),
                case SymbolData::Constant { type, value } => {
                    if let val = value {
                        setNodeConstValue(self, node, val);
                    }
                    return setNodeType(self, node, type);
                },
                case SymbolData::Type(t) =>
                    return setNodeType(self, node, Type::Nominal(hintedNominal(t, hint))),
                case SymbolData::Variant { .. } =>
                    return Type::Void,
                case SymbolData::Module { .. } =>
                    throw emitError(self, node, ErrorKind::UnexpectedModuleName),
                case SymbolData::Trait(_) =>
                    throw emitError(self, node, ErrorKind::UnexpectedTraitName),
            }
        },
        case ast::NodeValue::Call(call) => return try resolveCall(self, node, call, CallCtx::Normal, hint),
        case ast::NodeValue::FieldAccess(access) => return try resolveFieldAccess(self, node, access),
        case ast::NodeValue::BinOp(binop) => return try resolveBinOp(self, node, binop),
        case ast::NodeValue::RegionBlock { region, bindings, body, isSession } => {
            if isSession {
                return try resolveSessionBlock(self, node, region, bindings, body);
            }
            return try resolveBorrowBlock(self, node, region, bindings, body);
        }
        case ast::NodeValue::Block(block) => return try resolveBlock(self, node, block),
        case ast::NodeValue::Let(decl) => return try resolveLet(self, node, decl),
        case ast::NodeValue::ConstDecl(decl) => return try resolveConstOrStatic(
            self, node, decl.ident, decl.type, decl.value, decl.attrs, true
        ),
        case ast::NodeValue::StaticDecl(decl) => return try resolveConstOrStatic(
            self, node, decl.ident, decl.type, decl.value, decl.attrs, false
        ),
        case ast::NodeValue::FnParam(param) => return try resolveFnParam(self, node, param),
        case ast::NodeValue::If(cond) => return try resolveIf(self, node, cond),
        case ast::NodeValue::CondExpr(cond) => return try resolveCondExpr(self, node, cond, hint),
        case ast::NodeValue::IfLet(cond) => return try resolveIfLet(self, node, cond),
        case ast::NodeValue::While(loopNode) => return try resolveWhile(self, node, loopNode),
        case ast::NodeValue::WhileLet(loopNode) => return try resolveWhileLet(self, node, loopNode),
        case ast::NodeValue::For(loopNode) => return try resolveFor(self, node, loopNode),
        case ast::NodeValue::Loop { body } => {
            let loopType = try visitLoop(self, body);
            return setNodeType(self, node, loopType);
        },
        case ast::NodeValue::Break, ast::NodeValue::Continue => return try resolveLoopControl(self, node),
        case ast::NodeValue::Match(sw) => return try resolveMatch(self, node, sw),
        case ast::NodeValue::MatchProng(_) => panic "visit: `MatchProng` not handled here",
        case ast::NodeValue::LetElse(letElse) => return try resolveLetElse(self, node, letElse),
        case ast::NodeValue::BuiltinCall { kind, args } => return try resolveBuiltinCall(self, node, kind, args),
        case ast::NodeValue::Assign(assign) => return try resolveAssign(self, node, assign),
        case ast::NodeValue::RecordLit(lit) => return try resolveRecordLit(self, node, lit, hint),
        case ast::NodeValue::ArrayLit(items) => return try resolveArrayLit(self, node, items, hint),
        case ast::NodeValue::ArrayRepeatLit(lit) => return try resolveArrayRepeat(self, node, lit, hint),
        case ast::NodeValue::Subscript { container, index } => return try resolveSubscript(self, node, container, index),
        case ast::NodeValue::ScopeAccess(access) => return try resolveScopeAccess(self, node, access, hint),
        case ast::NodeValue::AddressOf(addr) => return try resolveAddressOf(self, node, addr, hint),
        case ast::NodeValue::Deref(target) => return try resolveDeref(self, node, target, hint),
        case ast::NodeValue::As(expr) => return try resolveAs(self, node, expr),
        case ast::NodeValue::Range(range) => return try resolveRange(self, node, range),
        case ast::NodeValue::Try(expr) => return try resolveTry(self, node, expr, hint),
        case ast::NodeValue::Return { value } => return try resolveReturn(self, node, value),
        case ast::NodeValue::Throw { expr } => return try resolveThrow(self, node, expr),
        case ast::NodeValue::Panic { message } => {
            try visitOptional(self, message, Type::Slice { // TODO: Have easy access to string type.
                class: types::PointerClass::Owned,
                item: allocType(self, Type::U8),
                mutable: false,
            });
            return setNodeType(self, node, Type::Never);
        },
        case ast::NodeValue::Assert { condition, message } => {
            try visit(self, condition, Type::Bool);
            try visitOptional(self, message, Type::Slice { // TODO: Have easy access to string type.
                class: types::PointerClass::Owned,
                item: allocType(self, Type::U8),
                mutable: false,
            });
            return setNodeType(self, node, Type::Void);
        },
        case ast::NodeValue::UnOp(unop) => return try resolveUnOp(self, node, unop),
        case ast::NodeValue::ExprStmt(expr) => {
            // Pass `Void` as expected type to indicate value is discarded.
            let exprTy = try visit(self, expr, Type::Void);
            return setNodeType(self, node, Type::Never if exprTy == Type::Never else Type::Void);
        },
        case ast::NodeValue::RegionApply { value, regions } =>
            return try resolveRegionApply(self, node, value, regions),
        case ast::NodeValue::TypeSig(sig) => return try inferTypeSig(self, node, sig),
        case ast::NodeValue::Super => {
            // `super` by itself is invalid, must be used in scope access.
            throw emitError(self, node, ErrorKind::InvalidModulePath);
        },
        case ast::NodeValue::Nil => {
            // Use the hint type if it's an optional, otherwise fall back to `Nil`.
            if let case Type::Optional(_) = hint {
                return setNodeType(self, node, hint);
            }
            return setNodeType(self, node, Type::Nil);
        },
        case ast::NodeValue::Undef => {
            try requireUnsafe(self, node);
            return setNodeType(self, node, Type::Undefined);
        },
        case ast::NodeValue::Bool(value) => {
            setNodeConstValue(self, node, ConstValue::Bool(value));
            return setNodeType(self, node, Type::Bool);
        }
        case ast::NodeValue::Char(value) => {
            setNodeConstValue(self, node, ConstValue::Char(value));
            return setNodeType(self, node, Type::U8);
        }
        case ast::NodeValue::String(text) => {
            setNodeConstValue(self, node, ConstValue::String(text));
            let byteTy = allocType(self, Type::U8);
            let sliceTy = allocType(self, Type::Slice {
                class: types::PointerClass::Owned,
                item: byteTy,
                mutable: false,
            });
            return setNodeType(self, node, *sliceTy);
        },
        case ast::NodeValue::Number(lit) => {
            setNodeConstValue(self, node, ConstValue::Int(ConstInt {
                magnitude: lit.magnitude,
                bits: 64,
                signed: false,
                negative: false,
            }));
            return setNodeType(self, node, Type::Int);
        },
        case ast::NodeValue::Placeholder => {
            throw emitError(self, node, ErrorKind::PlaceholderExpression);
        },
        else => {
            throw emitError(self, node, ErrorKind::UnexpectedNode(node));
        }
    }
}

/// Visit an optional node when present.
unsafe fn visitOptional 'arena (self: &mut Resolver 'arena, node: ?*ast::Node, hint: Type) -> ?Type
    throws (ResolveError)
{
    if let n = node {
        return try visit(self, n, hint);
    }
    return nil;
}

/// Visit every node contained in a list, returning the last resolved type.
unsafe fn visitList 'arena (self: &mut Resolver 'arena, list: *[*ast::Node]) -> Type
    throws (ResolveError)
{
    let mut diverges = false;
    for item in list {
        if try infer(self, item) == Type::Never {
            set diverges = true;
        }
    }
    if diverges {
        return Type::Never;
    }
    return Type::Void;
}

/// Collect attribute flags applied to a declaration.
fn resolveAttributes(attrs: ?ast::Attributes) -> u32 {
    let list = attrs else return 0;
    let mut mask: u32 = 0;

    for node in list.list {
        let case ast::NodeValue::Attribute(attr) = node.value
            else panic "resolveAttributes: invalid attribute node";
        set mask |= (attr as u32);
    }
    return mask;
}

/// Ensure the `default` attribute is only applied to functions.
fn ensureDefaultAttrNotAllowed 'arena (self: &mut Resolver 'arena, node: *ast::Node, attrs: u32)
    throws (ResolveError)
{
    let defaultBit = ast::Attribute::Default as u32;
    if (attrs & defaultBit) <> 0 {
        throw emitError(self, node, ErrorKind::DefaultAttrOnlyOnFn);
    }
}

/// Analyze a block node, allocating a nested lexical scope.
unsafe fn resolveBlock 'arena (self: &mut Resolver 'arena, node: *ast::Node, block: ast::Block) -> Type
    throws (ResolveError)
{
    enterScope(self, node);
    let wasUnsafe = self.inUnsafeContext;
    set self.inUnsafeContext = wasUnsafe or block.isUnsafe;
    let blockTy = try visitList(self, block.statements) catch {
        // One of the statements in the block failed analysis. We simply proceed
        // without checking the rest of the block statements. Return `Never` to
        // avoid spurious `FnMissingReturn` errors.
        exitScope(self);
        set self.inUnsafeContext = wasUnsafe;
        return setNodeType(self, node, Type::Never);
    };
    exitScope(self);
    set self.inUnsafeContext = wasUnsafe;

    return setNodeType(self, node, blockTy);
}

/// Introduce a concrete region under an explicit parent or enclosing region block.
unsafe fn borrowRegion 'arena (self: &mut Resolver 'arena, node: *ast::Node) -> *RegionScope throws (ResolveError) {
    let case ast::NodeValue::Region { name, parent } = node.value
        else panic "borrowRegion: invalid region node";
    if findRegion(self.regionScope, name) <> nil {
        throw emitError(self, node, ErrorKind::DuplicateBinding(name));
    }
    let mut enclosing: ?*unsafe types::Region = nil;
    let mut current = self.regionScope;
    while let scope = current {
        for region in scope.entries {
            if region.origin == types::RegionOrigin::Block {
                set enclosing = region;
                break;
            }
        }
        if enclosing <> nil {
            break;
        }
        set current = scope.parent;
    }
    if let parentNode = parent {
        set enclosing = try resolveRegion(self, parentNode);
    }
    let region = try! alloc::allocRaw(self.arena, @sizeOf(types::Region), @alignOf(types::Region))
        as *unsafe mut types::Region;
    set *region = types::Region { id: node.id, origin: types::RegionOrigin::Block, name, parent: enclosing };
    let entries = try! alloc::allocRawSlice(
        self.arena, @sizeOf(*unsafe mut types::Region), @alignOf(*unsafe mut types::Region), 1
    ) as *unsafe mut [*unsafe mut types::Region];
    set entries[0] = region;
    let scope = try! alloc::alloc(&mut *self.arena, @sizeOf(RegionScope), @alignOf(RegionScope)) as *mut RegionScope;
    set *scope = RegionScope {
        declarations: RegionDeclarations::Block(node),
        entries,
        parent: self.regionScope,
    };
    return scope;
}

/// Qualify an existing-place borrow with its block's region.
///
/// A permission cell loan deliberately joins independent storage and
/// permission regions. Its paired authority witness proves the lexical
/// shortening that the single-parent region graph cannot represent.
unsafe fn qualifyBlockBorrow 'arena (
    self: &mut Resolver 'arena, node: *ast::Node, ty: Type,
    region: *unsafe types::Region, hasPermissionWitness: bool
) -> Type throws (ResolveError) {
    let mut class = types::PointerClass::Ref;
    match ty {
        case Type::Cell { class: cellClass, .. } => set class = cellClass,
        case Type::Pointer { class: pointerClass, .. } => set class = pointerClass,
        case Type::Slice { class: sliceClass, .. } => set class = sliceClass,
        else => throw emitError(self, node, ErrorKind::RefBinding),
    }
    if let case types::PointerClass::Region(source) = class {
        if not hasPermissionWitness and not types::regionContains(source, region) {
            throw emitError(self, node, ErrorKind::RegionParent(region.name));
        }
    }
    match ty {
        case Type::Cell { permission, payload, .. } =>
            return Type::Cell {
                class: types::PointerClass::Region(region), permission, payload,
            },
        case Type::Pointer { target, mutable, .. } =>
            return Type::Pointer { class: types::PointerClass::Region(region), target, mutable },
        case Type::Slice { item, mutable, .. } =>
            return Type::Slice { class: types::PointerClass::Region(region), item, mutable },
        else => throw emitError(self, node, ErrorKind::RefBinding),
    }
}

/// Check source places before publishing the region's bindings to its body.
unsafe fn resolveBorrowBlock 'arena (
    self: &mut Resolver 'arena, node: *ast::Node, regionNode: *ast::Node,
    bindings: *[*ast::Node], body: *ast::Node
) -> Type throws (ResolveError) {
    if self.currentFn == nil {
        throw emitError(self, node, ErrorKind::InvalidRefPosition);
    }
    let scope = try borrowRegion(self, regionNode);
    let region = scope.entries[0];
    let mut authorityPermissions: [?*unsafe types::Region; MAX_REGIONAL_LOANS] =
        [nil; MAX_REGIONAL_LOANS];
    let mut authorityExclusive: [bool; MAX_REGIONAL_LOANS] =
        [false; MAX_REGIONAL_LOANS];
    let mut authorityLen: u32 = 0;
    let mut payloadPermissions: [?*unsafe types::Region; MAX_REGIONAL_LOANS] =
        [nil; MAX_REGIONAL_LOANS];
    let mut payloadExclusive: [bool; MAX_REGIONAL_LOANS] =
        [false; MAX_REGIONAL_LOANS];
    let mut payloadLen: u32 = 0;
    for bindingNode in bindings {
        let case ast::NodeValue::RegionBinding(binding) = bindingNode.value
            else panic "resolveBorrowBlock: invalid binding node";
        let case ast::NodeValue::AddressOf(address) = binding.value.value
            else panic "resolveBorrowBlock: invalid source node";
        try infer(self, binding.value);
        if not ast::isPlaceExpr(address.target) or borrowPlace(self, address.target).root == nil {
            throw emitError(self, binding.value, ErrorKind::RefBinding);
        }
        if address.kind == ast::AddressKind::Cell {
            continue;
        }
        if let cellTy = try inferCellPayload(self, address.target) {
            if let case Type::Cell { permission: controlled, .. } = cellTy {
                if let permission = controlled {
                    if payloadLen >= MAX_REGIONAL_LOANS {
                        throw emitError(self, binding.value, ErrorKind::RegionalLoanOverflow);
                    }
                    set payloadPermissions[payloadLen] = permission;
                    set payloadExclusive[payloadLen] =
                        address.kind == ast::AddressKind::Mutable;
                    set payloadLen += 1;
                    continue;
                }
            }
        }
        if let case ast::NodeValue::Deref(source) = address.target.value {
            let sourceTy = try infer(self, source);
            if let case Type::Pointer {
                class: types::PointerClass::Region(permission),
                mutable: true,
                ..
            } = sourceTy {
                if authorityLen >= MAX_REGIONAL_LOANS {
                    throw emitError(self, binding.value, ErrorKind::RegionalLoanOverflow);
                }
                set authorityPermissions[authorityLen] = permission;
                set authorityExclusive[authorityLen] =
                    address.kind == ast::AddressKind::Mutable;
                set authorityLen += 1;
            }
        }
    }
    for bindingNode in bindings {
        let case ast::NodeValue::RegionBinding(binding) = bindingNode.value
            else panic "resolveBorrowBlock: invalid binding node";
        let case ast::NodeValue::AddressOf(address) = binding.value.value
            else panic "resolveBorrowBlock: invalid source node";
        let mut permission: ?*unsafe types::Region = nil;
        let mut isPayload = false;
        if address.kind <> ast::AddressKind::Cell {
            if let cellTy = try inferCellPayload(self, address.target) {
                if let case Type::Cell { permission: controlled, .. } = cellTy {
                    set permission = controlled;
                    set isPayload = controlled <> nil;
                }
            }
            if permission == nil {
                if let case ast::NodeValue::Deref(source) = address.target.value {
                    let sourceTy = try infer(self, source);
                    if let case Type::Pointer {
                        class: types::PointerClass::Region(controlled),
                        mutable: true,
                        ..
                    } = sourceTy {
                        set permission = controlled;
                    }
                }
            }
        }
        let mut hasPermissionWitness = false;
        if let controlled = permission {
            let exclusive = address.kind == ast::AddressKind::Mutable;
            if isPayload {
                for i in 0..authorityLen {
                    let candidate = authorityPermissions[i]
                        else panic "resolveBorrowBlock: missing authority permission";
                    if candidate.id == controlled.id and authorityExclusive[i] == exclusive {
                        set hasPermissionWitness = true;
                        break;
                    }
                }
            } else {
                for i in 0..payloadLen {
                    let candidate = payloadPermissions[i]
                        else panic "resolveBorrowBlock: missing payload permission";
                    if candidate.id == controlled.id and payloadExclusive[i] == exclusive {
                        set hasPermissionWitness = true;
                        break;
                    }
                }
            }
        }
        let ty = try infer(self, binding.value);
        let qualified = try qualifyBlockBorrow(
            self, binding.value, ty, region, hasPermissionWitness,
        );
        setNodeType(self, binding.value, qualified);
    }
    let previous = self.regionScope;
    set self.regionScope = scope;
    set self.nodeData.entries[node.id].extra = NodeExtra::Regions(scope);
    enterScope(self, node);
    let result = try resolveBorrowBody(self, bindings, body) catch error {
        exitScope(self);
        set self.regionScope = previous;
        throw error;
    };
    exitScope(self);
    set self.regionScope = previous;
    return setNodeType(self, node, result);
}

/// Bind a checked region's source references and resolve its statement body.
unsafe fn resolveBorrowBody 'arena (self: &mut Resolver 'arena, bindings: *[*ast::Node], body: *ast::Node) -> Type
    throws (ResolveError)
{
    for bindingNode in bindings {
        let case ast::NodeValue::RegionBinding(binding) = bindingNode.value
            else panic "resolveBorrowBody: invalid binding node";
        try resolveLet(self, bindingNode, ast::borrowBinding(binding));
    }
    return try infer(self, body);
}

/// Find a declaration by spelling when the name is not interned.
unsafe fn findSpelledSymbol(scope: *unsafe Scope, name: *[u8]) -> ?*unsafe mut Symbol {
    for i in 0..scope.symbolsLen {
        let symbol = scope.symbols[i];
        if mem::eq(symbol.name, name) {
            return symbol;
        }
    }
    return nil;
}

/// Look up a compiler-known declaration in the standard allocation module.
unsafe fn allocationSymbol 'arena (self: &Resolver 'arena, name: *[u8]) -> ?*unsafe mut Symbol {
    let mut scope = self.pkgScope;
    for segment in ["std", "lang", "alloc"] {
        let symbol = findSpelledSymbol(scope, segment) else return nil;
        let case SymbolData::Module { scope: child, .. } = symbol.data else return nil;
        set scope = child;
    }
    return findSpelledSymbol(scope, name);
}

/// Bind an allocation interface while retaining the source arena until region exit.
unsafe fn resolveSessionBlock 'arena (
    self: &mut Resolver 'arena, node: *ast::Node, regionNode: *ast::Node,
    bindings: *[*ast::Node], body: *ast::Node
) -> Type throws (ResolveError) {
    if self.currentFn == nil or bindings.len <> 1 {
        throw emitError(self, node, ErrorKind::InvalidSessionSource);
    }
    let bindingNode = bindings[0];
    let case ast::NodeValue::RegionBinding(binding) = bindingNode.value
        else panic "resolveSessionBlock: invalid binding";
    let case ast::NodeValue::AddressOf(address) = binding.value.value
        else throw emitError(self, binding.value, ErrorKind::InvalidSessionSource);
    let ty = try infer(self, binding.value);
    let case Type::Pointer { target, .. } = ty
        else throw emitError(self, binding.value, ErrorKind::InvalidSessionSource);
    let allocTrait = allocationSymbol(self, "Alloc")
        else throw emitError(self, node, ErrorKind::InvalidSessionSource);
    let case SymbolData::Trait(allocInfo) = allocTrait.data
        else throw emitError(self, node, ErrorKind::InvalidSessionSource);
    let allocModule = moduleIdForSymbol(self, allocTrait)
        else throw emitError(self, node, ErrorKind::InvalidSessionSource);
    let mut allocInstance: ?*unsafe InstanceEntry = nil;
    for i in 0..self.instancesLen {
        let candidate: *unsafe InstanceEntry = &self.instances[i];
        if candidate.traitType.moduleId == allocModule and mem::eq(candidate.traitType.name, allocInfo.name)
            and erasedTypesEqual(candidate.concreteType, *target)
        {
            set allocInstance = candidate;
            break;
        }
    }
    let selected = allocInstance
        else throw emitError(self, node, ErrorKind::InvalidSessionSource);
    if address.kind <> ast::AddressKind::Mutable or not ast::isPlaceExpr(address.target)
        or borrowPlace(self, address.target).root == nil
    {
        throw emitError(self, binding.value, ErrorKind::InvalidSessionSource);
    }
    let _ = setNodeCoercion(self, binding.value, Coercion::TraitObject {
        traitInfo: allocInfo, inst: selected,
    });
    let scope = try borrowRegion(self, regionNode);
    let region = scope.entries[0];
    if let sourceRegion = referenceRegion(ty) {
        set region.parent = sourceRegion;
    }
    setNodeType(self, binding.value, try qualifyBlockBorrow(self, binding.value, ty, region, false));
    let previous = self.regionScope;
    set self.regionScope = scope;
    set self.nodeData.entries[node.id].extra = NodeExtra::Regions(scope);
    enterScope(self, node);
    let result = try resolveSessionBody(self, bindingNode, binding, region, body) catch error {
        exitScope(self);
        set self.regionScope = previous;
        throw error;
    };
    exitScope(self);
    set self.regionScope = previous;
    return setNodeType(self, node, result);
}

/// Introduce the opaque session value and check its body.
unsafe fn resolveSessionBody 'arena (
    self: &mut Resolver 'arena, node: *ast::Node, binding: ast::Arg,
    region: *unsafe types::Region, body: *ast::Node
) -> Type throws (ResolveError) {
    let ident = binding.label else panic "resolveSessionBody: missing binding name";
    let _ = try bindValueIdent(self, ident, node, Type::Session(region), false, 0, 0);
    return try infer(self, body);
}

/// Analyze a `let` declaration and bind its identifier.
unsafe fn resolveLet 'arena (self: &mut Resolver 'arena, node: *ast::Node, decl: ast::Let) -> Type
    throws (ResolveError)
{
    let mut alignment: u32 = 0; // Zero is default.
    let mut bindingTy = Type::Unknown;
    let mut valueTy = Type::Unknown;

    // Check type.
    if let declTy = try visitOptional(self, decl.type, Type::Unknown) {
        set valueTy = try checkAssignable(self, decl.value, declTy);
        set bindingTy = declTy;
    } else {
        set bindingTy = try infer(self, decl.value);
        set valueTy = bindingTy;

        if not isTypeInferrable(bindingTy) {
            throw emitError(self, decl.value, ErrorKind::CannotInferType);
        }
    }
    try validateValueTypeReferences(self, node, bindingTy);
    if isRefType(bindingTy) {
        if self.currentFn == nil {
            throw emitError(self, node, ErrorKind::InvalidRefPosition);
        }
        if decl.mutable and (referenceRegion(bindingTy) == nil or not isCopy(bindingTy)) {
            throw emitError(self, node, ErrorKind::RefBinding);
        }
    }
    // Variables cannot have void type.
    if bindingTy == Type::Void {
        throw emitError(self, decl.value, ErrorKind::CannotAssignVoid);
    }
    // Variables cannot have opaque type directly.
    if bindingTy == Type::Opaque {
        throw emitError(self, node, ErrorKind::OpaqueTypeNotAllowed);
    }
    // Check alignment.
    if let a = decl.alignment {
        let case ast::NodeValue::Align { value } = a.value
            else panic "resolveLet: expected Align node";
        set alignment = try checkSizeInt(self, value);
    }
    assert bindingTy <> Type::Unknown;

    // Alignment must be zero or a power of two.
    if alignment <> 0 and (alignment & (alignment - 1)) <> 0 {
        throw emitError(self, decl.value, ErrorKind::InvalidAlignmentValue(alignment));
    }
    let _ = try bindValueIdent(self, decl.ident, node, bindingTy, decl.mutable, alignment, 0);

    // Untyped initializers use the declared storage type.
    if not isTypeInferrable(valueTy) {
        setNodeType(self, decl.value, bindingTy);
    }

    return Type::Never if valueTy == Type::Never else Type::Void;
}

/// Check whether a node is an integer literal, optionally under unary negation.
fn isIntegerLiteralExpr(node: *ast::Node) -> bool {
    match node.value {
        case ast::NodeValue::Number(_) => return true,
        case ast::NodeValue::UnOp(unop) => {
            if unop.op == ast::UnaryOp::Neg {
                return isIntegerLiteralExpr(unop.value);
            }
            return false;
        },
        else => return false,
    }
}

/// Determine whether a node represents a compile-time constant expression.
export unsafe fn isConstExpr 'arena (self: &Resolver 'arena, node: *ast::Node) -> bool {
    match node.value {
        case ast::NodeValue::Bool(_),
             ast::NodeValue::Char(_),
             ast::NodeValue::Number(_),
             ast::NodeValue::String(_),
             ast::NodeValue::Undef,
             ast::NodeValue::Nil => {
            return true;
        },
        case ast::NodeValue::ArrayLit(items) => {
            for item in items {
                if not isConstExpr(self, item) {
                    return false;
                }
            }
            return true;
        },
        case ast::NodeValue::ArrayRepeatLit(repeat) => {
            return isConstExpr(self, repeat.item);
        },
        case ast::NodeValue::AddressOf(addr) => {
            let ty = typeFor(self, node) else {
                return false;
            };
            if let case Type::Slice { .. } = ty {
                return isConstExpr(self, addr.target);
            }
            return false;
        },
        case ast::NodeValue::RecordLit(lit) => {
            // Record literals are constant if all field values are constant.
            for field in lit.fields {
                if let case ast::NodeValue::RecordLitField(fieldLit) = field.value {
                    if not isConstExpr(self, fieldLit.value) {
                        return false;
                    }
                }
            }
            return true;
        },
        case ast::NodeValue::Ident(_),
             ast::NodeValue::ScopeAccess(_) => {
            // Identifiers and scope accesses referencing constants, union
            // variants, or function values are constant expressions.
            if let sym = symbolFor(self, node) {
                match sym.data {
                    case SymbolData::Variant { .. },
                         SymbolData::Constant { .. } => return true,
                    case SymbolData::Value { type, .. } => {
                        if let case Type::Fn(_) = type {
                            return true;
                        }
                    }
                    else => {}
                }
            }
            return false;
        },
        case ast::NodeValue::Call(call) => {
            // Constructor calls (union variants, unlabeled records) are constant
            // if all payload args are themselves constant.
            if let sym = symbolFor(self, call.callee) {
                match sym.data {
                    case SymbolData::Variant { .. } => {}
                    case SymbolData::Type(NominalType::Record(recInfo)) => {
                        if recInfo.labeled {
                            return false;
                        }
                    },
                    else => return false,
                }
                for arg in call.args {
                    if not isConstExpr(self, arg) {
                        return false;
                    }
                }
                return true;
            }
            return false;
        },
        case ast::NodeValue::BinOp(binop) => {
            // Binary expressions are constant if both operands are constant.
            return isConstExpr(self, binop.left) and isConstExpr(self, binop.right);
        },
        case ast::NodeValue::UnOp(unop) => {
            // Unary expressions are constant if the operand is constant.
            return isConstExpr(self, unop.value);
        },
        case ast::NodeValue::As(expr) => {
            // Cast expressions are constant if the source value is constant.
            return isConstExpr(self, expr.value);
        },
        else => {
            return false;
        }
    }
}

/// Construct an integer constant descriptor.
fn constInt(magnitude: u64, bits: u8, signed: bool, negative: bool) -> ConstValue {
    return ConstValue::Int(ConstInt { magnitude, bits, signed, negative });
}

/// Apply an integer cast to a constant value, including target-width
/// truncation and signed interpretation.
fn castConstInt(value: ConstInt, target: Type) -> ConstValue {
    let raw = constIntToBits(value);
    let range = integerRange(target)
        else panic "castConstInt: expected integer type";

    match range {
        case IntegerRange::Unsigned { bits, .. } =>
            return ConstValue::Int(constIntFromBits(raw, bits, false)),
        case IntegerRange::Signed { bits, .. } =>
            return ConstValue::Int(constIntFromBits(raw, bits, true)),
    }
}

/// Return the constant `u32` value for a slice bound when known.
fn constSliceIndex 'arena (self: &mut Resolver 'arena, node: *ast::Node) -> ?u32 {
    let value = constValueEntry(self, node)
        else return nil;
    let case ConstValue::Int(int) = value
        else return nil;
    if int.negative {
        return nil;
    }
    return int.magnitude as u32;
}

/// Validates and extracts a non-negative integer constant from a compile-time expression.
///
/// This function ensures that a node represents a valid, non-negative integer constant
/// that fits within a machine word. It is used for contexts requiring compile-time
/// non-negative integers, such as array sizes and alignment specifications.
///
/// Returns the unsigned magnitude of the constant as `u32`.
unsafe fn checkSizeInt 'arena (self: &mut Resolver 'arena, node: *ast::Node) -> u32
    throws (ResolveError)
{
    // First traverse the node expect a numeric type.
    let _ = try checkNumeric(self, node);

    // Look up the compile-time constant value associated with this node.
    let value = constValueEntry(self, node)
        else throw emitError(self, node, ErrorKind::ConstExprRequired);

    let case ConstValue::Int(int) = value
        else panic "checkSizeInt: expected integer constant";

    // Validate it fits within u32 range.
    if not validateConstIntRange(value, Type::U32) {
        throw emitError(self, node, ErrorKind::NumericLiteralOverflow);
    }
    assert not int.negative;
    setNodeType(self, node, Type::U32);

    return int.magnitude as u32;
}

/// Check that constructor arguments match record fields.
///
/// Verifies argument count matches field count, and that each argument is
/// assignable to its corresponding field type.
unsafe fn checkRecordConstructorArgs 'arena (self: &mut Resolver 'arena, node: *ast::Node, args: *[*ast::Node], recInfo: RecordType)
    throws (ResolveError)
{
    try checkRecordArity(self, CountMismatch { expected: recInfo.fields.len, actual: args.len }, node);
    for arg, i in args {
        let fieldType = recInfo.fields[i].fieldType;
        try checkAssignable(self, arg, fieldType);
    }
}

/// Check that the argument count of a constructor pattern or call matches the record field count.
fn checkRecordArity 'arena (self: &mut Resolver 'arena, counts: CountMismatch, pattern: *ast::Node) throws (ResolveError) {
    if counts.actual <> counts.expected {
        throw emitError(self, pattern, ErrorKind::RecordFieldCountMismatch(counts));
    }
}

/// Helper for analyzing `constant` and `static` declarations.
unsafe fn resolveConstOrStatic 'arena (
    self: &mut Resolver 'arena,
    node: *ast::Node,
    ident: *ast::Node,
    typeNode: *ast::Node,
    valueNode: *ast::Node,
    attrList: ?ast::Attributes,
    isConst: bool
) -> Type throws (ResolveError) {
    let attrs = resolveAttributes(attrList);
    let bindingTy = try infer(self, typeNode);
    if containsRegion(bindingTy) {
        throw emitError(self, typeNode, ErrorKind::InvalidRefPosition);
    }
    try ensureStorableType(self, typeNode, bindingTy);
    let wasUnsafe = self.inUnsafeContext;
    set self.inUnsafeContext = wasUnsafe or (
        not isConst and ast::hasAttribute(attrs, ast::Attribute::Unsafe)
    );
    let valueTy = try checkAssignable(self, valueNode, bindingTy) catch e {
        set self.inUnsafeContext = wasUnsafe;
        throw e;
    };
    set self.inUnsafeContext = wasUnsafe;

    if isConst {
        let mut constVal = constValueEntry(self, valueNode);
        if constVal == nil and not isConstExpr(self, valueNode) {
            throw emitError(self, valueNode, ErrorKind::ConstExprRequired);
        }
        if let val = constVal {
            if let case ConstValue::Int(int) = val; isNumericType(bindingTy) {
                set constVal = castConstInt(int, bindingTy);
            }
        }
        try bindConstIdent(self, ident, node, bindingTy, constVal, attrs);
    } else {
        if not isConstExpr(self, valueNode) {
            throw emitError(self, valueNode, ErrorKind::ConstExprRequired);
        }
        try bindValueIdent(self, ident, node, bindingTy, true, 0, attrs);
    }
    setNodeType(self, valueNode, bindingTy);

    return Type::Void;
}

/// Analyze a function declaration signature and bind the function name.
unsafe fn resolveFnDecl 'arena (self: &mut Resolver 'arena, node: *ast::Node, decl: ast::FnDecl) -> Type
    throws (ResolveError)
{
    let previous = self.regionScope;
    set self.regionScope = try bindRegions(self, node, decl.regions);
    let result = try resolveFnSignature(self, node, decl) catch error {
        set self.regionScope = previous;
        throw error;
    };
    set self.regionScope = previous;
    return result;
}

/// Resolve a function signature in its declared region environment.
unsafe fn resolveFnSignature 'arena (self: &mut Resolver 'arena, node: *ast::Node, decl: ast::FnDecl) -> Type
    throws (ResolveError)
{
    let attrMask = resolveAttributes(decl.attrs);
    let mut retTy = Type::Void;
    if let retNode = decl.sig.returnType {
        set retTy = try infer(self, retNode);
        try ensureStorableType(self, retNode, retTy);
    }
    let a = alloc::arenaAllocator(self.arena);
    let mut paramTypes: *mut [*Type] = &mut [];
    let mut throwList: *mut [*Type] = &mut [];
    let mut fnType = FnType {
        regions: self.regionScope,
        paramTypes: &[],
        returnType: allocType(self, retTy),
        throwList: &[],
        isUnsafe: ast::hasAttribute(attrMask, ast::Attribute::Unsafe),
    };
    // Enter the function scope to process parameters.
    enterFn(self, node, &fnType);

    if decl.sig.params.len > MAX_FN_PARAMS {
        exitFn(self);
        throw emitError(self, node, ErrorKind::FnParamOverflow(CountMismatch {
            expected: MAX_FN_PARAMS,
            actual: decl.sig.params.len,
        }));
    }
    for paramNode in decl.sig.params {
        let paramTy = try infer(self, paramNode) catch e {
            exitFn(self);
            throw e;
        };
        paramTypes.append(allocType(self, paramTy), a);
    }

    if decl.sig.throwList.len > MAX_FN_THROWS {
        exitFn(self);
        throw emitError(self, node, ErrorKind::FnThrowOverflow(CountMismatch {
            expected: MAX_FN_THROWS,
            actual: decl.sig.throwList.len,
        }));
    }
    for throwNode in decl.sig.throwList {
        let throwTy = try infer(self, throwNode) catch e {
            exitFn(self);
            throw e;
        };
        try validateErrorTag(self, throwNode, throwTy, &throwList[..]);
        throwList.append(allocType(self, throwTy), a);
        try ensureStorableType(self, throwNode, throwTy);
    }
    exitFn(self);
    set fnType.paramTypes = &paramTypes[..];
    set fnType.throwList = &throwList[..];

    // Bind the function name.
    let ty = Type::Fn(allocFnType(self, fnType));
    let sym = try bindValueIdent(self, decl.name, node, ty, false, 0, attrMask)
        else throw emitError(self, node, ErrorKind::ExpectedIdentifier);

    return ty;
}

/// Analyze a function body.
unsafe fn resolveFnDeclBody 'arena (self: &mut Resolver 'arena, node: *ast::Node, decl: ast::FnDecl) throws (ResolveError) {
    let sym = symbolFor(self, node) else {
        // The function declaration failed to type check, therefore
        // no symbol was associated with it.
        return;
    };
    let case SymbolData::Value { type: Type::Fn(fnType), .. } = sym.data else {
        panic "resolveFnDeclBody: unexpected symbol data for function";
    };
    let isExtern = ast::hasAttribute(sym.attrs, ast::Attribute::Extern);
    let isIntrinsic = ast::hasAttribute(sym.attrs, ast::Attribute::Intrinsic);

    if let body = decl.body {
        if isIntrinsic {
            throw emitError(self, node, ErrorKind::IntrinsicUnexpectedBody);
        }
        if isExtern {
            throw emitError(self, node, ErrorKind::FnUnexpectedBody);
        }
        let previous = self.regionScope;
        set self.regionScope = try bindRegions(self, node, decl.regions);
        try resolveExecutableBody(self, node, fnType, nil, decl.sig.params, body) catch error {
            set self.regionScope = previous;
            throw error;
        };
        set self.regionScope = previous;
    } else if not isExtern {
        throw emitError(self, node, ErrorKind::FnMissingBody);
    }
}

/// Resolve a function or method body and restore the enclosing context.
unsafe fn resolveExecutableBody 'arena (
    self: &mut Resolver 'arena,
    node: *ast::Node,
    fnType: *FnType,
    receiverName: ?*ast::Node,
    params: *[*ast::Node],
    body: *ast::Node,
) throws (ResolveError) {
    let wasUnsafe = self.inUnsafeContext;
    set self.inUnsafeContext = fnType.isUnsafe;
    // Enter function scope.
    enterFn(self, node, fnType); // Enter function scope for body analysis.

    let missingReturn = try checkExecutableBody(self, fnType, receiverName, params, body) catch e {
        exitFn(self);
        set self.inUnsafeContext = wasUnsafe;
        throw e;
    };
    exitFn(self);
    set self.inUnsafeContext = wasUnsafe;
    if missingReturn {
        throw emitError(self, body, ErrorKind::FnMissingReturn);
    }
}

/// Check parameters, body types, and ownership.
/// Return whether a required return is missing.
unsafe fn checkExecutableBody 'arena (
    self: &mut Resolver 'arena,
    fnType: *FnType,
    receiverName: ?*ast::Node,
    params: *[*ast::Node],
    body: *ast::Node,
) -> bool throws (ResolveError) {
    if let receiver = receiverName {
        // Bind the receiver parameter.
        let receiverTy = *fnType.paramTypes[0];
        try bindValueIdent(self, receiver, receiver, receiverTy, false, 0, 0);
        // Bind the remaining parameters from the signature.
        for paramNode in params {
            let paramTy = try infer(self, paramNode);
        }
    }
    // Resolve the body.
    let retTy = *fnType.returnType;
    let bodyTy = try checkAssignable(self, body, Type::Void);
    if retTy <> Type::Void and bodyTy <> Type::Never {
        return true;
    }
    // Ownership checks require complete type and call metadata.
    if self.errors.len == 0 {
        try checkLinearFn(self, receiverName, params, body);
    }
    return false;
}

/// Analyze a function parameter and bind its identifier.
unsafe fn resolveFnParam 'arena (self: &mut Resolver 'arena, node: *ast::Node, param: ast::FnParam) -> Type
    throws (ResolveError)
{
    let ty = try resolveValueType(self, param.type);
    let _ = try bindValueIdent(self, param.name, node, ty, false, 0, 0);

    return ty;
}

/// Compiler-known ownership markers carried by a composite declaration.
record OwnershipMarkers: Copy {
    /// The declaration requires exact consumption.
    linear: bool,
    /// The declaration permits implicit copies.
    copy: bool,
}

/// Resolve compiler-known ownership markers from a derive list.
unsafe fn resolveOwnershipMarkers 'arena (self: &mut Resolver 'arena, derives: *[*ast::Node]) -> OwnershipMarkers
    throws (ResolveError)
{
    let mut result = OwnershipMarkers { linear: false, copy: false };
    for derive in derives {
        if let case ast::NodeValue::Region { .. } = derive.value {
            continue;
        }
        let name = try nodeName(self, derive);
        if mem::eq(name, "Once") {
            if result.linear {
                throw emitError(self, derive, ErrorKind::DuplicateBinding(name));
            }
            if result.copy {
                throw emitError(self, derive, ErrorKind::ConflictingOwnershipMarkers);
            }
            set result.linear = true;
        } else if mem::eq(name, "Copy") {
            if result.copy {
                throw emitError(self, derive, ErrorKind::DuplicateBinding(name));
            }
            if result.linear {
                throw emitError(self, derive, ErrorKind::ConflictingOwnershipMarkers);
            }
            set result.copy = true;
        } else {
            // Resolve an ordinary trait derive.
            try infer(self, derive);
        }
    }
    return result;
}

/// Resolve record fields from a node list.
unsafe fn resolveRecordFields 'arena (self: &mut Resolver 'arena, node: *ast::Node, fields: *[*ast::Node], labeled: bool) -> RecordType
    throws (ResolveError)
{
    let a = alloc::arenaAllocator(self.arena);
    let mut result: *mut [RecordField] = &mut [];
    let mut layout = Layout { size: 0, alignment: 1 };

    if fields.len > parser::MAX_RECORD_FIELDS {
        throw emitError(self, node, ErrorKind::Internal);
    }
    for field in fields {
        let case ast::NodeValue::RecordField {
            field: fieldNode,
            type: typeNode,
            value: valueNode
        } = field.value else panic "resolveRecordFields: invalid record field";
        let fieldTy = try resolveValueType(self, typeNode);
        try ensureStorableType(self, typeNode, fieldTy);

        if let v = valueNode {
            let _valTy = try checkAssignable(self, v, fieldTy);
        }
        // Get field name for labeled records.
        let mut fieldName: ?*[u8] = nil;
        if labeled {
            let n = fieldNode
                else panic "resolveRecordFields: labeled record field missing name";
            set fieldName = try nodeName(self, n);
        }
        let fieldType = typeFor(self, typeNode)
            else throw emitError(self, typeNode, ErrorKind::CannotInferType);

        // Ensure field type is fully resolved before computing layout.
        try ensureTypeResolved(self, fieldType, typeNode);

        appendRecordField(&mut result, &mut layout, fieldName, fieldType, a);
    }
    // Compute cached layout.
    let recordLayout = Layout {
        size: mem::alignUp(layout.size, layout.alignment),
        alignment: layout.alignment
    };
    return RecordType {
        privateModule: nil,
        regions: nil,
        application: nil,
        fields: (&result[..]) as *unsafe [RecordField],
        labeled,
        layout: allocLayout(self, recordLayout),
        declaredLinear: false,
        declaredCopy: false,
    };
}

/// Append an owned record field and update the layout before tail padding.
fn appendRecordField(fields: &mut *mut [RecordField], layout: &mut Layout, name: ?*[u8], fieldType: Type, allocator: alloc::Allocator) {
    // Compute field offset by aligning to field's alignment.
    let fieldLayout = typeLayout(fieldType);
    let offset = mem::alignUp(layout.size, fieldLayout.alignment);
    fields.append(RecordField { name, fieldType, offset: offset as i32 }, allocator);

    // Advance offset past this field.
    set layout.size = offset + fieldLayout.size;

    // Track max alignment for record layout.
    set layout.alignment = max(layout.alignment, fieldLayout.alignment);
}

/// Resolve record field types for a named record declaration.
unsafe fn resolveRecordBody 'arena (self: &mut Resolver 'arena, node: *ast::Node, decl: ast::RecordDecl)
    throws (ResolveError)
{
    let previous = self.regionScope;
    set self.regionScope = try bindRegions(self, node, decl.regions);
    try resolveRecordContents(self, node, decl) catch error {
        set self.regionScope = previous;
        throw error;
    };
    set self.regionScope = previous;
}

/// Resolve record contents in the declaration's region environment.
unsafe fn resolveRecordContents 'arena (self: &mut Resolver 'arena, node: *ast::Node, decl: ast::RecordDecl)
    throws (ResolveError)
{
    // Get the type symbol that was bound to this declaration node.
    // If there's no symbol, it's because an earlier phase failed.
    let sym = symbolFor(self, node)
        else return;
    let case SymbolData::Type(nominalTy) = sym.data
        else panic "resolveRecordBody: unexpected type symbol data";

    // Skip if already resolved.
    if let case NominalType::Record(_) = *nominalTy {
        return;
    }
    let markers = try resolveOwnershipMarkers(self, decl.derives);
    set *nominalTy = NominalType::Resolving(node);
    let mut recordType = try resolveRecordFields(self, node, decl.fields, decl.labeled) catch error {
        set *nominalTy = NominalType::Placeholder(node);
        throw error;
    };
    set recordType.regions = self.regionScope;
    if ast::hasAttribute(sym.attrs, ast::Attribute::Opaque) {
        set recordType.privateModule = self.currentMod;
    }
    if markers.copy {
        for field in recordType.fields {
            if not isCopy(field.fieldType) {
                throw emitError(self, node, ErrorKind::CopyContainsNonCopy);
            }
        }
    }
    set recordType.declaredLinear = markers.linear;
    set recordType.declaredCopy = markers.copy;

    set *nominalTy = NominalType::Record(recordType);
}

/// Bind a type name.
unsafe fn bindTypeName 'arena (self: &mut Resolver 'arena, node: *ast::Node, name: *ast::Node, attrs: ?ast::Attributes) -> *unsafe mut Symbol
    throws (ResolveError)
{
    let attrMask = resolveAttributes(attrs);
    try ensureDefaultAttrNotAllowed(self, node, attrMask);

    // Create a placeholder nominal type that will be replaced in
    // the next phase.
    let nominalTy = allocNominalType(self, NominalType::Placeholder(node));

    return try bindTypeIdent(self, name, node, nominalTy, attrMask);
}

/// Allocate a trait type descriptor and return a pointer to it.
unsafe fn allocTraitType 'arena (self: &mut Resolver 'arena, name: *[u8]) -> *unsafe mut TraitType {
    let p = try! alloc::allocRaw(self.arena, @sizeOf(TraitType), @alignOf(TraitType));
    let entry = p as *unsafe mut TraitType;
    set *entry = TraitType { name, moduleId: self.currentMod, methods: &mut [], supertraits: &mut [] };

    return entry;
}

/// Bind a trait name in the current scope.
unsafe fn bindTraitName 'arena (self: &mut Resolver 'arena, node: *ast::Node, name: *ast::Node, attrs: ?ast::Attributes) -> *unsafe mut Symbol
    throws (ResolveError)
{
    let attrMask = resolveAttributes(attrs);
    try ensureDefaultAttrNotAllowed(self, node, attrMask);

    let traitName = try nodeName(self, name);
    let traitType = allocTraitType(self, traitName);
    let data = SymbolData::Trait(traitType);
    let scope = self.scope;
    let sym = try bindIdent(self, traitName, node, data, attrMask, scope);

    setNodeType(self, node, Type::Void);
    setNodeType(self, name, Type::Void);

    return sym;
}

/// Find a trait method by name and return its resolved metadata.
export fn findTraitMethod(methods: &[TraitMethod], name: *[u8]) -> ?TraitMethod {
    for method in methods {
        if mem::eq(method.name, name) {
            return method;
        }
    }
    return nil;
}

/// Resolve a trait declaration body: supertrait methods, then own methods.
unsafe fn resolveTraitBody 'arena (self: &mut Resolver 'arena, node: *ast::Node, supertraits: *[*ast::Node], methods: *[*ast::Node])
    throws (ResolveError)
{
    let sym = symbolFor(self, node)
        else return;
    let case SymbolData::Trait(traitType) = sym.data
        else return;
    if traitType.methods.len > 0 {
        return;
    }

    // Resolve supertrait bounds and copy their methods into this trait.
    for superNode in supertraits {
        let superSym = try resolveNamePath(self, superNode);
        let case SymbolData::Trait(superTrait) = superSym.data
            else throw emitError(self, superNode, ErrorKind::Internal);
        // Trait bodies are otherwise resolved in source order. Recursively
        // resolve a supertrait only when it is declared later.
        if superSym.node.id > node.id {
            let case ast::NodeValue::TraitDecl {
                supertraits: inheritedTraits, methods: inheritedMethods, ..
            } = superSym.node.value else throw emitError(self, superNode, ErrorKind::Internal);
            try resolveTraitBody(self, superSym.node, inheritedTraits, inheritedMethods);
        }

        setNodeSymbol(self, superNode, superSym);

        let a = alloc::arenaAllocator(self.arena);
        if traitType.methods.len + superTrait.methods.len > ast::MAX_TRAIT_METHODS {
            throw emitError(self, node, ErrorKind::TraitMethodOverflow(CountMismatch {
                expected: ast::MAX_TRAIT_METHODS,
                actual: traitType.methods.len as u32 + superTrait.methods.len as u32,
            }));
        }
        // Copy inherited methods into this trait's method table.
        for inherited in superTrait.methods {
            if let _ = findTraitMethod(&traitType.methods[..], inherited.name) {
                throw emitError(self, superNode, ErrorKind::DuplicateBinding(inherited.name));
            }
            traitType.methods.append(TraitMethod {
                name: inherited.name,
                fnType: inherited.fnType,
                mutable: inherited.mutable,
                receiverClass: inherited.receiverClass,
                index: traitType.methods.len as u32,
            }, a);
        }
        traitType.supertraits.append(superTrait, a);
    }

    if traitType.methods.len + methods.len > ast::MAX_TRAIT_METHODS {
        throw emitError(self, node, ErrorKind::TraitMethodOverflow(CountMismatch {
            expected: ast::MAX_TRAIT_METHODS,
            actual: traitType.methods.len as u32 + methods.len as u32,
        }));
    }

    for methodNode in methods {
        let case ast::NodeValue::TraitMethodSig { name, modifiers, receiver, sig } = methodNode.value
            else continue;
        let attrs = modifiers.attrs;
        let methodName = try nodeName(self, name);
        let attrMask = resolveAttributes(attrs);
        let previousRegions = self.regionScope;
        set self.regionScope = try bindRegions(self, methodNode, modifiers.regions);

        // Reject duplicate method names.
        if let _ = findTraitMethod(&traitType.methods[..], methodName) {
            throw emitError(self, name, ErrorKind::DuplicateBinding(methodName));
        }
        // Determine the receiver class and mutability, and validate that it
        // points to the declaring trait.
        let case ast::NodeValue::TypeSig(typeSig) = receiver.value
            else throw emitError(self, receiver, ErrorKind::TraitReceiverMismatch);
        let case ast::TypeSig::Pointer {
            class: receiverSyntax, valueType: receiverValueType, mutable,
        } = typeSig
            else throw emitError(self, receiver, ErrorKind::TraitReceiverMismatch);
        let receiverClass = resolvePointerClass(receiverSyntax);
        let case ast::NodeValue::TypeSig(innerSig) = receiverValueType.value
            else throw emitError(self, receiver, ErrorKind::TraitReceiverMismatch);
        let case ast::TypeSig::Nominal(nameNode) = innerSig
            else throw emitError(self, receiver, ErrorKind::TraitReceiverMismatch);
        let receiverTargetName = try nodeName(self, nameNode);

        if receiverTargetName <> traitType.name {
            throw emitError(self, receiver, ErrorKind::TraitReceiverMismatch);
        }
        // Resolve parameter types and return type.
        let a = alloc::arenaAllocator(self.arena);
        let mut paramTypes: *mut [*Type] = &mut [];
        let mut throwList: *mut [*Type] = &mut [];
        let mut retType = allocType(self, Type::Void);

        if sig.params.len > MAX_FN_PARAMS {
            throw emitError(self, methodNode, ErrorKind::FnParamOverflow(CountMismatch {
                expected: MAX_FN_PARAMS,
                actual: sig.params.len,
            }));
        }
        for paramNode in sig.params {
            let case ast::NodeValue::FnParam(param) = paramNode.value
                else throw emitError(self, paramNode, ErrorKind::ExpectedIdentifier);
            let paramTy = try resolveValueType(self, param.type);
            paramTypes.append(allocType(self, paramTy), a);
        }
        if let ret = sig.returnType {
            set retType = allocType(self, try infer(self, ret));
        }
        // Resolve throws list.
        if sig.throwList.len > MAX_FN_THROWS {
            throw emitError(self, methodNode, ErrorKind::FnThrowOverflow(CountMismatch {
                expected: MAX_FN_THROWS,
                actual: sig.throwList.len,
            }));
        }
        for throwNode in sig.throwList {
            let throwTy = try infer(self, throwNode);
            try validateErrorTag(self, throwNode, throwTy, &throwList[..]);
            throwList.append(allocType(self, throwTy), a);
        }
        let fnType = FnType {
            regions: self.regionScope,
            paramTypes: &paramTypes[..],
            returnType: retType,
            throwList: &throwList[..],
            isUnsafe: ast::hasAttribute(attrMask, ast::Attribute::Unsafe),
        };
        traitType.methods.append(TraitMethod {
            name: methodName,
            fnType: allocFnType(self, fnType),
            mutable,
            receiverClass,
            index: traitType.methods.len as u32,
        }, a);

        setNodeType(self, methodNode, Type::Void);
        set self.regionScope = previousRegions;
    }
}

/// Resolve a name path node to a symbol.
/// Used for trait and type references in instance declarations and trait objects.
unsafe fn resolveNamePath 'arena (self: &mut Resolver 'arena, node: *ast::Node) -> *unsafe mut Symbol
    throws (ResolveError)
{
    match node.value {
        case ast::NodeValue::Ident(name) => {
            let sym = findAnySymbol(self.scope, name)
                else throw emitError(self, node, ErrorKind::UnresolvedSymbol(name));
            return sym;
        }
        case ast::NodeValue::ScopeAccess(access) => {
            let scope = self.scope;
            return try resolveAccess(self, node, access, scope);
        }
        else => {
            throw emitError(self, node, ErrorKind::ExpectedIdentifier);
        }
    }
}

/// Join instance and method region parameters into one function binder.
unsafe fn instanceMethodRegions 'arena (
    self: &mut Resolver 'arena, instanceRegions: *[*ast::Node], methodRegions: *[*ast::Node]
) -> *[*ast::Node] {
    let count = instanceRegions.len + methodRegions.len;
    if count == 0 {
        return &[];
    }
    let allocator = alloc::arenaAllocator(self.arena);
    let mut nodes: *mut [*ast::Node] = &mut [];
    for region in instanceRegions {
        nodes.append(region, allocator);
    }
    for region in methodRegions {
        nodes.append(region, allocator);
    }
    return &nodes[..];
}

/// Map one region binder to a contiguous part of another binder.
unsafe fn mapRegionScopes 'arena (
    self: &mut Resolver 'arena, source: ?*RegionScope, target: ?*RegionScope,
    offset: u32, site: *ast::Node
) -> ?RegionSubstitution throws (ResolveError) {
    let sourceScope = source else return nil;
    let targetScope = target else throw emitError(self, site, ErrorKind::Internal);
    if offset + sourceScope.entries.len > targetScope.entries.len {
        throw emitError(self, site, ErrorKind::RegionArgumentCount(CountMismatch {
            expected: sourceScope.entries.len,
            actual: targetScope.entries.len - offset,
        }));
    }
    let map = regionSubstitution(self, sourceScope);
    for _, i in sourceScope.entries {
        set map.arguments[i] = targetScope.entries[offset + i];
    }
    try validateRegionArguments(self, &map, nil, nil, site);
    return map;
}

/// Resolved implementation of one trait method.
record ResolvedInstanceMethod: Copy {
    /// Canonical trait method.
    method: TraitMethod,
    /// Concrete function symbol.
    symbol: *unsafe mut Symbol,
}

/// Shared declaration state for instance method resolution.
record InstanceMethodContext: Copy {
    /// Implemented trait.
    traitInfo: *unsafe TraitType,
    /// Instance target with declaration regions applied.
    concreteType: Type,
    /// Instance region nodes in declaration order.
    regions: *[*ast::Node],
    /// Bound instance region scope.
    scope: ?*RegionScope,
}

/// Resolve one instance method in its combined region environment.
unsafe fn resolveInstanceMethod 'arena (
    self: &mut Resolver 'arena, methodNode: *ast::Node,
    context: &InstanceMethodContext
) -> ResolvedInstanceMethod throws (ResolveError) {
    let case ast::NodeValue::MethodDecl {
        name, modifiers, receiverType, sig, ..
    } = methodNode.value else panic "resolveInstanceMethod: invalid method";
    let combinedRegions = instanceMethodRegions(self, context.regions, modifiers.regions);
    let methodScope = try bindRegions(self, methodNode, combinedRegions);
    set self.regionScope = methodScope;

    let methodName = try nodeName(self, name);
    let attrMask = resolveAttributes(modifiers.attrs);
    let tm = findTraitMethod(&context.traitInfo.methods[..], methodName)
        else throw emitError(self, name, ErrorKind::UnresolvedSymbol(methodName));
    if ast::hasAttribute(attrMask, ast::Attribute::Unsafe) <> tm.fnType.isUnsafe {
        throw emitError(self, methodNode, ErrorKind::TraitMethodSafetyMismatch);
    }

    let case ast::NodeValue::TypeSig(ast::TypeSig::Pointer {
        class: receiverSyntax, valueType, mutable: receiverMut,
    }) = receiverType.value else throw emitError(self, receiverType, ErrorKind::TraitReceiverMismatch);
    let receiverClass = resolvePointerClass(receiverSyntax);
    if receiverClass <> tm.receiverClass {
        throw emitError(self, receiverType, ErrorKind::TraitReceiverMismatch);
    }
    let annotatedTy = try infer(self, valueType);
    let mut expectedConcrete = context.concreteType;
    if let map = try mapRegionScopes(self, context.scope, methodScope, 0, methodNode) {
        set expectedConcrete = substituteRegions(self, &map, context.concreteType);
    }
    if not typesEqual(annotatedTy, expectedConcrete) {
        throw emitTypeMismatch(self, receiverType, TypeMismatch { expected: expectedConcrete, actual: annotatedTy });
    }
    if tm.mutable and not receiverMut {
        throw emitError(self, receiverType, ErrorKind::ImmutableBinding);
    }
    if receiverMut and not tm.mutable {
        throw emitError(self, receiverType, ErrorKind::ReceiverMutabilityMismatch);
    }

    let mut traitFn = tm.fnType;
    let mut traitRegionCount: u32 = 0;
    if let traitScope = tm.fnType.regions {
        set traitRegionCount = traitScope.entries.len;
    }
    if traitRegionCount <> modifiers.regions.len {
        throw emitError(self, methodNode, ErrorKind::RegionArgumentCount(CountMismatch {
            expected: traitRegionCount, actual: modifiers.regions.len,
        }));
    }
    if let map = try mapRegionScopes(self, tm.fnType.regions, methodScope, context.regions.len, methodNode) {
        set traitFn = substituteFnRegions(self, &map, tm.fnType, nil);
    }
    if sig.params.len <> traitFn.paramTypes.len {
        throw emitError(self, methodNode, ErrorKind::FnArgCountMismatch(CountMismatch {
            expected: traitFn.paramTypes.len, actual: sig.params.len,
        }));
    }

    let allocator = alloc::arenaAllocator(self.arena);
    let mut paramTypes: *mut [*Type] = &mut [];
    let receiverPtrType = Type::Pointer {
        class: receiverClass, target: allocType(self, annotatedTy), mutable: receiverMut,
    };
    paramTypes.append(allocType(self, receiverPtrType), allocator);
    for paramNode, i in sig.params {
        let case ast::NodeValue::FnParam(param) = paramNode.value
            else throw emitError(self, paramNode, ErrorKind::ExpectedIdentifier);
        let instanceParamTy = try resolveValueType(self, param.type);
        if not typesEqual(instanceParamTy, *traitFn.paramTypes[i]) {
            throw emitTypeMismatch(self, paramNode, TypeMismatch {
                expected: *traitFn.paramTypes[i], actual: instanceParamTy,
            });
        }
        paramTypes.append(allocType(self, instanceParamTy), allocator);
    }
    let mut returnType = Type::Void;
    if let returnNode = sig.returnType {
        set returnType = try resolveValueType(self, returnNode);
    }
    if not typesEqual(returnType, *traitFn.returnType) {
        throw emitTypeMismatch(self, methodNode, TypeMismatch {
            expected: *traitFn.returnType, actual: returnType,
        });
    }
    if sig.throwList.len <> traitFn.throwList.len {
        throw emitError(self, methodNode, ErrorKind::FnThrowCountMismatch(CountMismatch {
            expected: traitFn.throwList.len, actual: sig.throwList.len,
        }));
    }
    let mut throwList: *mut [*Type] = &mut [];
    for throwNode, i in sig.throwList {
        let throwType = try resolveValueType(self, throwNode);
        if not typesEqual(throwType, *traitFn.throwList[i]) {
            throw emitTypeMismatch(self, throwNode, TypeMismatch {
                expected: *traitFn.throwList[i], actual: throwType,
            });
        }
        throwList.append(allocType(self, throwType), allocator);
    }

    let fnType = FnType {
        regions: methodScope, paramTypes: &paramTypes[..],
        returnType: allocType(self, returnType), throwList: &throwList[..],
        isUnsafe: tm.fnType.isUnsafe,
    };
    let fnTy = Type::Fn(allocFnType(self, fnType));
    let sym = allocSymbol(self, SymbolData::Value {
        mutable: false, alignment: 0, type: fnTy, addressTaken: false,
    }, methodName, methodNode, attrMask);
    setNodeSymbol(self, methodNode, sym);
    setNodeType(self, methodNode, fnTy);
    setNodeType(self, name, fnTy);
    set self.regionScope = context.scope;
    return ResolvedInstanceMethod { method: tm, symbol: sym };
}

/// Resolve an instance declaration.
/// Validates that the trait exists, the target type exists, and all methods
/// match the trait's signatures.
unsafe fn resolveInstanceDecl 'arena (
    self: &mut Resolver 'arena,
    node: *ast::Node,
    traitName: *ast::Node,
    targetType: *ast::Node,
    regions: *[*ast::Node],
    methods: *[*ast::Node]
) throws (ResolveError) {
    let previous = self.regionScope;
    set self.regionScope = try bindRegions(self, node, regions);
    try resolveInstanceContents(self, node, traitName, targetType, regions, methods) catch error {
        set self.regionScope = previous;
        throw error;
    };
    set self.regionScope = previous;
}

/// Resolve an instance in its declaration region environment.
unsafe fn resolveInstanceContents 'arena (
    self: &mut Resolver 'arena,
    node: *ast::Node,
    traitName: *ast::Node,
    targetType: *ast::Node,
    regions: *[*ast::Node],
    methods: *[*ast::Node]
) throws (ResolveError) {
    let instanceScope = self.regionScope;
    // Look up the trait.
    let traitSym = try resolveNamePath(self, traitName);
    let case SymbolData::Trait(traitInfo) = traitSym.data
        else throw emitError(self, traitName, ErrorKind::Internal);

    setNodeSymbol(self, traitName, traitSym);

    // Look up the target type.
    let typeSym = try resolveNamePath(self, targetType);
    let case SymbolData::Type(nominalTy) = typeSym.data
        else throw emitError(self, targetType, ErrorKind::Internal);
    setNodeSymbol(self, targetType, typeSym);
    // Ensure the concrete type body is resolved.
    try ensureNominalResolved(self, nominalTy, targetType);

    // Reject duplicate instance for the same (trait, type) pair.
    let mut concreteInfo = nominalTy;
    if regions.len > 0 {
        set concreteInfo = try applyNominalRegions(self, nominalTy, regions, targetType);
    } else {
        try requireNominalArguments(self, nominalTy, targetType);
    }
    let concreteType = Type::Nominal(concreteInfo);
    if let _ = findInstance(self, traitInfo, concreteType) {
        throw emitError(self, node, ErrorKind::DuplicateInstance);
    }

    // Build the instance entry.
    if self.instancesLen >= MAX_INSTANCES {
        throw emitError(self, node, ErrorKind::Internal);
    }
    let methodSlice = try! alloc::allocRawSlice(
        self.arena, @sizeOf(*unsafe mut Symbol), @alignOf(*unsafe mut Symbol), traitInfo.methods.len as u32
    ) as *unsafe mut [*unsafe mut Symbol];
    let mut entry = InstanceEntry {
        traitType: traitInfo,
        concreteType,
        concreteTypeName: typeSym.name,
        moduleId: self.currentMod,
        methods: methodSlice,
    };
    // Track which trait methods are covered by the instance.
    let mut covered: [bool; ast::MAX_TRAIT_METHODS] = [false; ast::MAX_TRAIT_METHODS];
    let methodContext = InstanceMethodContext {
        traitInfo, concreteType, regions, scope: instanceScope,
    };

    // Match each instance method to a trait method.
    for methodNode in methods {
        let resolved = try resolveInstanceMethod(
            self, methodNode, &methodContext
        );
        set entry.methods[resolved.method.index] = resolved.symbol;
        set covered[resolved.method.index] = true;
    }

    // Fill inherited method slots from supertrait instances.
    for superTrait in traitInfo.supertraits {
        let superInst = findInstance(self, superTrait, concreteType)
            else throw emitError(self, node, ErrorKind::MissingSupertraitInstance(superTrait.name));
        for superMethod, mi in superTrait.methods {
            let merged = findTraitMethod(&traitInfo.methods[..], superMethod.name)
                else panic "resolveInstanceDecl: inherited method not found";
            if not covered[merged.index] {
                set entry.methods[merged.index] = superInst.methods[mi];
                set covered[merged.index] = true;
            }
        }
    }

    // Check that all trait methods are implemented.
    for method, i in traitInfo.methods {
        if not covered[i] {
            throw emitError(self, node, ErrorKind::MissingTraitMethod(method.name));
        }
    }
    set self.instances[self.instancesLen] = entry;
    set self.instancesLen += 1;

    setNodeType(self, node, Type::Void);
}

/// Resolve instance method bodies.
unsafe fn resolveInstanceMethodBodies 'arena (self: &mut Resolver 'arena, methods: *[*ast::Node])
    throws (ResolveError)
{
    for methodNode in methods {
        let case ast::NodeValue::MethodDecl { .. } = methodNode.value else continue;

        // Symbol may be absent if [`resolveInstanceDecl`] reported an error
        // for this method (eg. unknown method name). Skip gracefully.
        if symbolFor(self, methodNode) == nil {
            continue;
        }

        try resolveMethodBody(self, methodNode);
    }
}

/// Resolve a method body shared by instance methods and standalone methods.
/// Binds the receiver and parameters, then type-checks the body.
unsafe fn resolveMethodBody 'arena (
    self: &mut Resolver 'arena,
    node: *ast::Node,
) throws (ResolveError) {
    let case ast::NodeValue::MethodDecl { receiverName, sig, body, .. } = node.value
        else panic "resolveMethodBody: invalid method";
    let sym = symbolFor(self, node)
        else throw emitError(self, node, ErrorKind::Internal);
    let case SymbolData::Value { type: Type::Fn(fnType), .. } = sym.data
        else panic "resolveMethodBody: expected value symbol";
    let previous = self.regionScope;
    set self.regionScope = fnType.regions;
    try resolveExecutableBody(self, node, fnType, receiverName, sig.params, body) catch error {
        set self.regionScope = previous;
        throw error;
    };
    set self.regionScope = previous;
}

/// Resolve a standalone method declaration (signature only).
/// Validates the receiver type and registers the method in the method table.

/// Extract the type name from a resolved receiver type node.
unsafe fn receiverTypeName 'arena (
    self: &mut Resolver 'arena,
    receiverType: *ast::Node,
) -> *[u8] throws (ResolveError) {
    let case ast::NodeValue::TypeSig(ast::TypeSig::Pointer { valueType, .. }) =
        receiverType.value
        else throw emitError(self, receiverType, ErrorKind::TraitReceiverMismatch);
    let mut nameNode: *ast::Node = valueType;
    match valueType.value {
        case ast::NodeValue::TypeSig(ast::TypeSig::Nominal(name)) => set nameNode = name,
        case ast::NodeValue::TypeSig(ast::TypeSig::Applied { name, .. }) => set nameNode = name,
        else => throw emitError(self, receiverType, ErrorKind::Internal),
    }
    let sym = symbolFor(self, nameNode)
        else throw emitError(self, receiverType, ErrorKind::Internal);

    return sym.name;
}

/// Resolve and register a standalone method declaration.
unsafe fn resolveMethodDecl 'arena (
    self: &mut Resolver 'arena,
    node: *ast::Node,
) throws (ResolveError) {
    let case ast::NodeValue::MethodDecl { modifiers, .. } = node.value
        else panic "resolveMethodDecl: invalid method";
    let previous = self.regionScope;
    set self.regionScope = try bindRegions(self, node, modifiers.regions);
    try resolveMethodSignature(self, node) catch error {
        set self.regionScope = previous;
        throw error;
    };
    set self.regionScope = previous;
}

/// Resolve a standalone method signature in its region environment.
unsafe fn resolveMethodSignature 'arena (
    self: &mut Resolver 'arena,
    node: *ast::Node,
) throws (ResolveError) {
    let case ast::NodeValue::MethodDecl {
        name, modifiers, receiverType, sig, ..
    } = node.value else panic "resolveMethodSignature: invalid method";
    // Resolve the receiver type: must be `*Type` or `*mut Type` pointing to a
    // nominal type.
    let fullReceiverTy = try infer(self, receiverType);
    let case Type::Pointer {
        class: receiverClass, target: receiverTarget, mutable: receiverMut,
    } = fullReceiverTy
        else throw emitError(self, receiverType, ErrorKind::TraitReceiverMismatch);
    let concreteType = *receiverTarget;
    let case Type::Nominal(nominalTy) = concreteType
        else throw emitError(self, receiverType, ErrorKind::ExpectedRecord);
    try ensureNominalResolved(self, nominalTy, receiverType);

    // Get the type name from the inner type node's symbol.
    let typeName = try receiverTypeName(self, receiverType);
    let methodName = try nodeName(self, name);
    let attrMask = resolveAttributes(modifiers.attrs);

    // Reject duplicate method for the same (type, name).
    if let _ = findMethod(self, concreteType, methodName) {
        throw emitError(self, name, ErrorKind::DuplicateBinding(methodName));
    }

    // Resolve parameter types.
    let a = alloc::arenaAllocator(self.arena);
    let mut paramTypes: *mut [*Type] = &mut [];

    // Receiver is the first parameter.
    let receiverPtrType = Type::Pointer {
        class: receiverClass,
        target: allocType(self, concreteType),
        mutable: receiverMut,
    };
    paramTypes.append(allocType(self, receiverPtrType), a);

    for paramNode in sig.params {
        let case ast::NodeValue::FnParam(param) = paramNode.value
            else throw emitError(self, paramNode, ErrorKind::ExpectedIdentifier);
        let paramTy = try resolveValueType(self, param.type);
        paramTypes.append(allocType(self, paramTy), a);
    }

    // Resolve return type.
    let mut returnType = Type::Void;
    if let retNode = sig.returnType {
        set returnType = try resolveValueType(self, retNode);
    }

    // Resolve throw list.
    let mut throwTypes: *mut [*Type] = &mut [];
    for throwNode in sig.throwList {
        let throwTy = try resolveValueType(self, throwNode);
        try validateErrorTag(self, throwNode, throwTy, &throwTypes[..]);
        throwTypes.append(allocType(self, throwTy), a);
    }

    let retTypePtr = allocType(self, returnType);
    let throwList = &throwTypes[..];

    let isUnsafe = ast::hasAttribute(attrMask, ast::Attribute::Unsafe);
    // Full function type (receiver + params) for lowering.
    let fullFnType = FnType {
        regions: self.regionScope,
        paramTypes: &paramTypes[..],
        returnType: retTypePtr,
        throwList,
        isUnsafe,
    };
    let fullFnInfo = allocFnType(self, fullFnType);
    let fnTy = Type::Fn(fullFnInfo);

    // Function type excluding receiver, for call arg checking.
    let checkFnType = FnType {
        regions: self.regionScope,
        paramTypes: &paramTypes[1..],
        returnType: retTypePtr,
        throwList,
        isUnsafe,
    };

    // Create a symbol for the method without binding it into the module scope.
    let sym = allocSymbol(self, SymbolData::Value {
        mutable: false, alignment: 0, type: fnTy, addressTaken: false,
    }, methodName, node, attrMask);

    setNodeSymbol(self, node, sym);
    setNodeType(self, node, fnTy);
    setNodeType(self, name, fnTy);

    // Register in the method table.
    if self.methodsLen >= MAX_METHODS {
        throw emitError(self, node, ErrorKind::Internal);
    }
    set self.methods[self.methodsLen] = MethodEntry {
        moduleId: self.currentMod,
        concreteType,
        concreteTypeName: typeName,
        name: methodName,
        fnType: allocFnType(self, checkFnType),
        mutable: receiverMut,
        receiverClass,
        symbolId: sym.id,
        fullFnType: fullFnInfo,
    };
    set self.methodsLen += 1;
}

/// Look up an instance entry by trait and concrete type.
unsafe fn findInstance 'arena (self: &Resolver 'arena, traitInfo: *unsafe TraitType, concreteType: Type) -> ?*unsafe InstanceEntry {
    for i in 0..self.instancesLen {
        let entry: *unsafe InstanceEntry = &self.instances[i];
        if entry.traitType == traitInfo and erasedTypesEqual(entry.concreteType, concreteType) {
            return entry;
        }
    }
    return nil;
}

/// Look up a standalone method by concrete type and name.
export unsafe fn findMethod 'arena (self: &Resolver 'arena, concreteType: Type, name: *[u8]) -> ?*unsafe MethodEntry {
    for i in 0..self.methodsLen {
        let entry: *unsafe MethodEntry = &self.methods[i];
        if erasedTypesEqual(entry.concreteType, concreteType) and entry.name == name {
            return entry;
        }
    }
    return nil;
}

/// Look up standalone method metadata by its resolver-local symbol identity.
export fn findMethodBySymbol 'arena (self: &Resolver 'arena, symbolId: u32) -> ?MethodEntry {
    for i in 0..self.methodsLen {
        let entry = self.methods[i];
        if entry.symbolId == symbolId {
            return entry;
        }
    }
    return nil;
}

/// Resolve union variant types after all type names are bound (Phase 2 of type resolution).
unsafe fn resolveUnionBody 'arena (self: &mut Resolver 'arena, node: *ast::Node, decl: ast::UnionDecl)
    throws (ResolveError)
{
    let previous = self.regionScope;
    set self.regionScope = try bindRegions(self, node, decl.regions);
    try resolveUnionContents(self, node, decl) catch error {
        set self.regionScope = previous;
        throw error;
    };
    set self.regionScope = previous;
}

/// Resolve union contents in the declaration's region environment.
unsafe fn resolveUnionContents 'arena (self: &mut Resolver 'arena, node: *ast::Node, decl: ast::UnionDecl)
    throws (ResolveError)
{
    // Get the type symbol that was bound to this declaration node.
    // If there's no symbol, it's because an earlier phase failed.
    let sym = symbolFor(self, node)
        else return;
    let case SymbolData::Type(nominalTy) = sym.data
        else panic "resolveUnionBody: unexpected symbol data";

    // Check if already resolved, in which case there's no need to
    // do it again.
    if let case NominalType::Union(_) = *nominalTy {
        return;
    }
    let a = alloc::arenaAllocator(self.arena);
    let mut variants: *mut [UnionVariant] = &mut [];

    let markers = try resolveOwnershipMarkers(self, decl.derives);
    set *nominalTy = NominalType::Resolving(node);

    assert decl.variants.len <= MAX_UNION_VARIANTS, "resolveUnionBody: maximum union variants exceeded";
    let mut iota: u32 = 0;
    for variantNode, i in decl.variants {
        let case ast::NodeValue::UnionDeclVariant(variantDecl) = variantNode.value
            else panic "resolveUnionBody: invalid union variant";
        let variantName = try nodeName(self, variantDecl.name);
        // Resolve the variant's payload type if present.
        let mut variantType = Type::Void;
        if let typeNode = variantDecl.type {
            set variantType = try infer(self, typeNode);
            try ensureStorableType(self, typeNode, variantType);
            try ensureTypeResolved(self, variantType, typeNode);
        }
        // Process the variant's explicit discriminant value if present.
        try visitOptional(self, variantDecl.value, variantType);
        let tag = variantTag(variantDecl, &mut iota);
        // Create a symbol for this variant.
        let data = SymbolData::Variant { type: variantType, decl: node, ordinal: i, index: tag };
        let variantSym = allocSymbol(self, data, variantName, variantNode, 0);

        variants.append(UnionVariant {
            name: variantName,
            valueType: variantType,
            symbol: variantSym,
        }, a);
    }
    if markers.copy {
        for variant in &variants[..] {
            if not isCopy(variant.valueType) {
                throw emitError(self, node, ErrorKind::CopyContainsNonCopy);
            }
        }
    }
    let info = computeUnionLayout(&variants[..]);

    // Update the nominal type with the resolved variants.
    set *nominalTy = NominalType::Union(UnionType {
        regions: self.regionScope,
        application: nil,
        variants: (&variants[..]) as *unsafe [UnionVariant],
        layout: allocLayout(self, info.layout),
        valOffset: info.valOffset,
        isAllVoid: info.isAllVoid,
        declaredLinear: markers.linear,
        declaredCopy: markers.copy,
    });
}

/// Check whether an attributed module or import is active in this build.
/// A test module is active only when its source module was registered.
fn shouldAnalyzeModule 'arena (self: &Resolver 'arena, attrs: ?ast::Attributes, name: ?*[u8]) -> bool {
    if let attributes = attrs {
        if ast::attributesContains(&attributes, ast::Attribute::Test) {
            if not self.config.buildTest {
                return false;
            }
            if let moduleName = name {
                return findChildModule(self, moduleName, self.currentMod) <> nil;
            }
        }
    }
    return true;
}

/// Analyze a module during the graph analysis phase.
unsafe fn resolveModGraph 'arena (self: &mut Resolver 'arena, node: *ast::Node, decl: ast::Mod)
    throws (ResolveError)
{
    let modName = try nodeName(self, decl.name);
    if not shouldAnalyzeModule(self, decl.attrs, modName) {
        return;
    }
    let attrMask = resolveAttributes(decl.attrs);
    try ensureDefaultAttrNotAllowed(self, node, attrMask);
    let submod = try enterSubModule(self, modName, node);

    // Bind the module symbol in the outer scope, ie. where the `mod` statement is.
    try bindModuleIdent(self, submod.entry, submod.newScope, submod.root, attrMask, submod.prevScope);
    let case ast::NodeValue::Block(block) = submod.root.value
        else panic "resolveModGraph: expected block for module root";
    try resolveModuleGraph(self, &block);

    exitModuleScope(self, submod);
}

/// Analyze a module in the declaration phase.
unsafe fn resolveModDecl 'arena (self: &mut Resolver 'arena, node: *ast::Node, decl: ast::Mod)
    throws (ResolveError)
{
    // Find module under the current module.
    let modName = try nodeName(self, decl.name);
    if not shouldAnalyzeModule(self, decl.attrs, modName) {
        return;
    }
    let submod = try enterSubModule(self, modName, node);
    let case ast::NodeValue::Block(block) = submod.root.value
        else panic "resolveModDecl: expected block for module root";
    try resolveModuleDecls(self, &block);

    exitModuleScope(self, submod);
}

/// Analyze a `use` statement and create a symbol for the imported module.
unsafe fn resolveUse 'arena (self: &mut Resolver 'arena, node: *ast::Node, decl: ast::Use) -> Type
    throws (ResolveError)
{
    if not shouldAnalyzeModule(self, decl.attrs, nil) {
        return Type::Void;
    }
    let resolved = try resolveModulePath(self, decl.path);
    let attrMask = resolveAttributes(decl.attrs);

    if decl.wildcard {
        // Import all public symbols from the target module.
        for i in 0..resolved.scope.symbolsLen {
            let sym = resolved.scope.symbols[i];
            if ast::hasAttribute(sym.attrs, ast::Attribute::Export) {
                if let existing = findSymbolInScope(self.scope, sym.name) {
                    if existing == sym {
                        continue;
                    }
                }
                let scope = self.scope;
                try addSymbolToScope(self, sym, scope, node);
            }
        }
    } else {
        // Regular module import.
        let scope = self.scope;
        try bindModuleIdent(self, resolved.entry, resolved.scope, node, attrMask, scope);
    }
    return Type::Void;
}

/// Analyze a standard `if` statement.
unsafe fn resolveIf 'arena (self: &mut Resolver 'arena, node: *ast::Node, cond: ast::If) -> Type
    throws (ResolveError)
{
    try checkBoolean(self, cond.condition);
    let thenTy = try visit(self, cond.thenBranch, Type::Void);
    let elseTy = try visitOptional(self, cond.elseBranch, Type::Void);

    return setNodeType(self, node, unifyBranches(thenTy, elseTy));
}

/// Analyze a conditional expression.
unsafe fn resolveCondExpr 'arena (self: &mut Resolver 'arena, node: *ast::Node, cond: ast::CondExpr, hint: Type) -> Type
    throws (ResolveError)
{
    try checkBoolean(self, cond.condition);
    let thenValue = try visit(self, cond.thenExpr, hint);
    let thenTy = assignableValueType(self, cond.thenExpr, thenValue);
    let elseValue = try visit(self, cond.elseExpr, hint);
    let elseTy = assignableValueType(self, cond.elseExpr, elseValue);

    // Either branch may supply the concrete type for an otherwise context-
    // dependent expression, such as an unsuffixed integer or `nil`.
    if let coercion = isAssignable(self, thenTy, elseTy, cond.elseExpr) {
        setNodeCoercion(self, cond.elseExpr, coercion);
        return setNodeType(self, node, thenTy);
    }
    if let coercion = isAssignable(self, elseTy, thenTy, cond.thenExpr) {
        setNodeCoercion(self, cond.thenExpr, coercion);
        return setNodeType(self, node, elseTy);
    }
    try expectAssignable(self, thenTy, elseTy, cond.elseExpr);

    return setNodeType(self, node, thenTy);
}

/// Analyze a pattern match structure (used by if-let, while-let).
unsafe fn resolvePatternMatch 'arena (self: &mut Resolver 'arena, node: *ast::Node, pat: &ast::PatternMatch)
    throws (ResolveError)
{
    match pat.kind {
        case ast::PatternKind::Case => {
            // Analyze pattern against scrutinee type.
            let scrutineeTy = try infer(self, pat.scrutinee);
            if isUnsafePointerType(scrutineeTy) {
                try requireUnsafe(self, pat.scrutinee);
            }
            let subject = unwrapMatchSubject(scrutineeTy);
            try resolveCasePattern(self, pat.pattern, subject.effectiveTy, IdentMode::Compare, subject.by);
        }
        case ast::PatternKind::Binding => {
            // Scrutinee must be optional, bind the payload.
            let scrutineeTy = try checkOptional(self, pat.scrutinee);
            let payloadTy = *scrutineeTy;

            try bindValueIdent(self, pat.pattern, node, payloadTy, pat.mutable, 0, 0);
            setNodeType(self, pat.pattern, payloadTy);
        }
    }
    if let guard = pat.guard {
        try checkBoolean(self, guard);
    }
}

/// Analyze an `if let` or `if let case` pattern binding.
unsafe fn resolveIfLet 'arena (self: &mut Resolver 'arena, node: *ast::Node, cond: ast::IfLet) -> Type
    throws (ResolveError)
{
    enterScope(self, node);
    try resolvePatternMatch(self, node, &cond.pattern);

    let thenTy = try visit(self, cond.thenBranch, Type::Void);
    exitScope(self);

    let elseTy = try visitOptional(self, cond.elseBranch, Type::Void);

    return setNodeType(self, node, unifyBranches(thenTy, elseTy));
}

/// Controls how bare identifiers are handled in case patterns.
union IdentMode: Copy {
    /// Identifier is a value to compare against.
    Compare,
    /// Identifier introduces a new binding.
    Bind,
}

/// Check whether a pattern node is a destructuring pattern that looks
/// through structure (union variant, record literal, scope access).
/// Identifiers, placeholders, and plain literals are not destructuring.
export fn isDestructuringPattern(pattern: *ast::Node) -> bool {
    match pattern.value {
        case ast::NodeValue::Call(_),
             ast::NodeValue::RecordLit(_),
             ast::NodeValue::ScopeAccess(_) => return true,
        else => return false,
    }
}

/// Analyze a case pattern for match, if-case, let-case, or while-case.
///
/// At the top level, bare identifiers are compared against existing values.
/// Inside destructuring patterns (arrays, records), identifiers become bindings.
unsafe fn resolveCasePattern 'arena (
    self: &mut Resolver 'arena,
    pattern: *ast::Node,
    scrutineeTy: Type,
    mode: IdentMode,
    matchBy: MatchBy
) throws (ResolveError) {
    if let case Type::Pointer { target, .. } = scrutineeTy; isDestructuringPattern(pattern) {
        if isUnsafePointerType(scrutineeTy) {
            try requireUnsafe(self, pattern);
        }
        try resolveCasePattern(self, pattern, *target, mode, matchBy);
        return;
    }
    // TODO: Collapse these nested matches.
    match scrutineeTy {
        case Type::Nominal(info) => {
            try ensureNominalResolved(self, info, pattern);

            match *info {
                case NominalType::Union(unionType) => {
                    try resolveUnionPattern(self, pattern, scrutineeTy, unionType, matchBy);
                    return;
                }
                case NominalType::Record(recInfo) => {
                    match pattern.value {
                        case ast::NodeValue::Call(_), ast::NodeValue::RecordLit(_) => {
                            try resolveRecordPattern(self, pattern, scrutineeTy, recInfo, matchBy);
                            return;
                        } else => {}
                    }
                } else => {}
            }
        }
        case Type::Array(arrayInfo) => {
            if let case ast::NodeValue::ArrayLit(items) = pattern.value {
                if items.len as u32 <> arrayInfo.length {
                    throw emitError(self, pattern, ErrorKind::RecordFieldCountMismatch(
                        CountMismatch { expected: arrayInfo.length, actual: items.len as u32 }
                    ));
                }
                let elemTy = *arrayInfo.item;
                for item in items {
                    try resolveCasePattern(self, item, elemTy, IdentMode::Bind, matchBy);
                }
                setNodeType(self, pattern, scrutineeTy);
                return;
            }
        } else => {}
    }
    // Handle non-binding patterns (literals, placeholders) and bindings.
    match pattern.value {
        case ast::NodeValue::Placeholder => {
            // Placeholder matches without introducing bindings.
        }
        case ast::NodeValue::Ident(_) => {
            match mode {
                case IdentMode::Bind => try bindPatternVar(self, pattern, scrutineeTy, matchBy),
                case IdentMode::Compare => try checkAssignable(self, pattern, scrutineeTy),
            }
        }
        else => {
            // Literals and other expressions: check type compatibility.
            try checkAssignable(self, pattern, scrutineeTy);
        }
    }
}

/// Analyze a traditional `while` loop.
unsafe fn resolveWhile 'arena (self: &mut Resolver 'arena, node: *ast::Node, loopNode: ast::While) -> Type
    throws (ResolveError)
{
    try checkBoolean(self, loopNode.condition);
    let loopTy = try visitLoop(self, loopNode.body);
    try visitOptional(self, loopNode.elseBranch, Type::Void);

    if loopNode.condition.value == ast::NodeValue::Bool(true) {
        return setNodeType(self, node, loopTy);
    }
    return setNodeType(self, node, Type::Void);
}

/// Analyze a `while let` loop with pattern binding.
unsafe fn resolveWhileLet 'arena (self: &mut Resolver 'arena, node: *ast::Node, loopNode: ast::WhileLet) -> Type
    throws (ResolveError)
{
    enterScope(self, node);
    try resolvePatternMatch(self, node, &loopNode.pattern);

    try visitLoop(self, loopNode.body);
    exitScope(self);

    try visitOptional(self, loopNode.elseBranch, Type::Void);

    return setNodeType(self, node, Type::Void);
}

/// Store complete iteration metadata and return the loop binding type.
fn resolveForInfo 'arena (
    self: &mut Resolver 'arena, node: *ast::Node, forStmt: ast::For, iterableTy: Type
) -> Type throws (ResolveError) {
    // Extract binding names for the lowerer.
    let mut bindingName: ?*[u8] = nil;
    if let case ast::NodeValue::Ident(name) = forStmt.binding.value {
        set bindingName = name;
    }
    let mut indexName: ?*[u8] = nil;
    if let idx = forStmt.index {
        if let case ast::NodeValue::Ident(name) = idx.value {
            set indexName = name;
        }
    }
    // Extract item type and store pre-computed loop metadata for the lowerer.
    match iterableTy {
        case Type::Slice { item, class, .. } => {
            if class == types::PointerClass::Unsafe {
                try requireUnsafe(self, forStmt.iterable);
            }
            setForLoopInfo(self, node, ForLoopInfo::Collection {
                elemType: item, length: nil, bindingName, indexName
            });
            return *item;
        }
        case Type::Range { start, .. } => {
            // Iterable ranges must have a start, and since we enforce type
            // equality for start and end, that is always the item type.
            let valType = start else {
                throw emitError(self, forStmt.iterable, ErrorKind::ExpectedIterable);
            };
            let case ast::NodeValue::Range(range) = forStmt.iterable.value else {
                throw emitError(self, forStmt.iterable, ErrorKind::ExpectedIterable);
            };
            setForLoopInfo(self, node, ForLoopInfo::Range {
                valType, range, bindingName, indexName
            });
            return *valType;
        }
        case Type::Array(arrayInfo) => {
            setForLoopInfo(self, node, ForLoopInfo::Collection {
                elemType: arrayInfo.item,
                length: arrayInfo.length,
                bindingName,
                indexName,
            });
            return *arrayInfo.item;
        }
        else => throw emitError(self, forStmt.iterable, ErrorKind::ExpectedIterable),
    }
}

/// Analyze a `for` loop, binding iteration variables.
unsafe fn resolveFor 'arena (self: &mut Resolver 'arena, node: *ast::Node, forStmt: ast::For) -> Type
    throws (ResolveError)
{
    let iterableTy = try infer(self, forStmt.iterable);
    let itemTy = try resolveForInfo(self, node, forStmt, iterableTy);
    enterScope(self, node);
    try bindForLoopPattern(self, forStmt.binding, itemTy, false);

    if let pat = forStmt.index {
        try bindForLoopPattern(self, pat, Type::U32, false);
    }
    // The lowerer always creates at least one internal variable for iteration,
    // even when the binding is a placeholder or no explicit index is given.
    if let owner = self.currentFnNode {
        set self.nodeData.entries[owner.id].localCount += 1;
    }
    try visitLoop(self, forStmt.body);
    exitScope(self);

    try visitOptional(self, forStmt.elseBranch, Type::Void);

    return setNodeType(self, node, Type::Void);
}

/// Get the node within a pattern that carries the `UnionVariant` extra.
/// For `ScopeAccess` it is the pattern itself, for `RecordLit` it is the
/// type name, and for `Call` it is the callee.
export fn patternVariantKeyNode(pattern: *ast::Node) -> ?*ast::Node {
    match pattern.value {
        case ast::NodeValue::ScopeAccess(_) => return pattern,
        case ast::NodeValue::RecordLit(lit) => return lit.typeName,
        case ast::NodeValue::Call(call) => return call.callee,
        else => return nil,
    }
}

/// Get the i-th sub-pattern element from a compound pattern.
/// For `RecordLit` this is the i-th field's value; for `Call` it is the
/// i-th argument.
fn patternSubElement(pattern: *ast::Node, idx: u32) -> ?*ast::Node {
    match pattern.value {
        case ast::NodeValue::RecordLit(lit) => {
            if idx < lit.fields.len as u32 {
                if let case ast::NodeValue::RecordLitField(field) = lit.fields[idx].value {
                    return field.value;
                }
            }
        }
        case ast::NodeValue::Call(call) => {
            if idx < call.args.len as u32 {
                return call.args[idx];
            }
        }
        else => {}
    }
    return nil;
}

/// Get the number of sub-pattern elements in a compound pattern.
fn patternSubCount(pattern: *ast::Node) -> u32 {
    match pattern.value {
        case ast::NodeValue::RecordLit(lit) => return lit.fields.len as u32,
        case ast::NodeValue::Call(call) => return call.args.len as u32,
        else => return 0,
    }
}

/// Check whether a pattern contains nested sub-patterns that further
/// refine the match beyond the outer variant (e.g. nested union variant
/// tests or literal comparisons). Used to allow the same outer variant
/// to appear in multiple match arms.
fn hasNestedRefiningPattern 'arena (self: &Resolver 'arena, pattern: *ast::Node) -> bool {
    for i in 0..patternSubCount(pattern) {
        if let sub = patternSubElement(pattern, i) {
            if isRefiningPattern(self, sub) {
                return true;
            }
        }
    }
    return false;
}

/// Check whether a single pattern node is a refining pattern that tests
/// a value rather than just binding it. Union variants, literals, and
/// scope accesses are refining; identifiers, placeholders, and plain
/// record destructurings are not.
fn isRefiningPattern 'arena (self: &Resolver 'arena, pattern: *ast::Node) -> bool {
    match pattern.value {
        case ast::NodeValue::Ident(_), ast::NodeValue::Placeholder =>
            return false,
        case ast::NodeValue::RecordLit(_), ast::NodeValue::Call(_) => {
            if let keyNode = patternVariantKeyNode(pattern) {
                if let case NodeExtra::UnionVariant { .. } = self.nodeData.entries[keyNode.id].extra {
                    return true;
                }
            }
            // Plain record destructuring / non-variant call is not directly
            // refining; recurse to check sub-patterns.
            return hasNestedRefiningPattern(self, pattern);
        }
        case ast::NodeValue::ArrayLit(items) => {
            for item in items {
                if isRefiningPattern(self, item) {
                    return true;
                }
            }
            return false;
        }
        case ast::NodeValue::ScopeAccess(_) =>
            return true,
        else =>
            return true,
    }
}

/// Check whether any pattern in a case prong matches unconditionally.
/// A plain `_` or an all-binding array pattern (e.g. `[x, y]`) qualifies.
/// Note: top-level identifiers in `case` are comparisons, not bindings,
/// so they do not count as wildcards.
fn hasWildcardPattern(patterns: *[*ast::Node]) -> bool {
    for pattern in patterns {
        match pattern.value {
            case ast::NodeValue::Placeholder => return true,
            case ast::NodeValue::ArrayLit(items) => {
                if isIrrefutableArrayPattern(items) {
                    return true;
                }
            }
            else => {}
        }
    }
    return false;
}

/// Check whether all elements of an array pattern are irrefutable.
/// Inside array patterns, identifiers are bindings, not comparisons.
fn isIrrefutableArrayPattern(items: *[*ast::Node]) -> bool {
    for item in items {
        match item.value {
            case ast::NodeValue::Ident(_), ast::NodeValue::Placeholder => {}
            case ast::NodeValue::ArrayLit(inner) => {
                if not isIrrefutableArrayPattern(inner) {
                    return false;
                }
            }
            else => return false,
        }
    }
    return true;
}

/// Classify a match prong and reject unreachable prongs after a catch-all.
/// Record whether lowering can omit the prong's pattern test.
fn checkMatchProng 'arena (
    self: &mut Resolver 'arena,
    prongNode: *ast::Node,
    prong: ast::MatchProng,
    subjectTy: Type,
    state: &mut MatchState
) throws (ResolveError) {
    // Whether this prong is catch-all.
    let mut isCatchAll = false;

    if prong.guard <> nil {
        set state.isConst = false;
    } else {
        match prong.arm {
            case ast::ProngArm::Binding(_) => {
                // For optionals, a binding matches only a present value.
                set isCatchAll = not isOptionalType(subjectTy);
            },
            case ast::ProngArm::Else => set isCatchAll = true,
            case ast::ProngArm::Case(patterns) => set isCatchAll = hasWildcardPattern(patterns),
        }
    }
    if state.catchAll {
        if isCatchAll {
            throw emitError(self, prongNode, ErrorKind::DuplicateCatchAll);
        }
        throw emitError(self, prongNode, ErrorKind::CatchAllMustBeLast);
    }
    if isCatchAll {
        set state.catchAll = true;
    }
    setProngCatchAll(self, prongNode, isCatchAll);

}

/// Analyze a `match` expression. Dispatches to specialized functions based on
/// the subject type.
unsafe fn resolveMatch 'arena (self: &mut Resolver 'arena, node: *ast::Node, sw: ast::Match) -> Type
    throws (ResolveError)
{
    let subjectTy = try infer(self, sw.subject);
    if isUnsafePointerType(subjectTy) {
        try requireUnsafe(self, sw.subject);
    }
    let subject = unwrapMatchSubject(subjectTy);

    if let case Type::Optional(inner) = subject.effectiveTy {
        try resolveMatchOptional(self, node, sw, inner, subject.by);
    } else if let case Type::Nominal(NominalType::Union(u)) = subject.effectiveTy {
        try resolveMatchUnion(self, node, sw, subject.effectiveTy, u, subject.by);
    } else {
        try resolveMatchGeneric(self, node, sw, subject.effectiveTy, subject.by);
    }

    // Mark last non-guarded prong as exhaustive.
    let lastProng = sw.prongs[sw.prongs.len - 1];
    let case ast::NodeValue::MatchProng(p) = lastProng.value
        else panic "resolveMatch: expected match prong";
    if p.guard == nil {
        setProngCatchAll(self, lastProng, true);
    }
    let ty = typeFor(self, node) else {
        return Type::Void;
    };
    return ty;
}

/// Analyze a `match` expression on an optional subject.
unsafe fn resolveMatchOptional 'arena (
    self: &mut Resolver 'arena,
    node: *ast::Node,
    sw: ast::Match,
    innerTy: *Type,
    matchBy: MatchBy
) -> Type throws (ResolveError)
{
    let subjectTy = Type::Optional(innerTy);
    let prongs = sw.prongs;
    let mut hasValue = false;
    let mut hasNil = false;
    let mut state = MatchState { catchAll: false, isConst: false };
    let mut matchType = Type::Never;

    for prongNode in prongs {
        let case ast::NodeValue::MatchProng(prong) = prongNode.value
            else panic "resolveMatchOptional: expected match prong";

        try checkMatchProng(self, prongNode, prong, subjectTy, &mut state);
        set matchType = try visitMatchProng(self, prongNode, prong, subjectTy, matchType, matchBy);

        // Track coverage. Guarded prongs don't count as covering a case.
        if prong.guard == nil {
            if let case ast::ProngArm::Binding(_) = prong.arm {
                if hasValue {
                    throw emitError(self, prongNode, ErrorKind::DuplicateMatchPattern);
                }
                set hasValue = true;
            } else if let case ast::ProngArm::Case(patterns) = prong.arm {
                for pat in patterns {
                    if let case ast::NodeValue::Nil = pat.value {
                        if hasNil {
                            throw emitError(self, pat, ErrorKind::DuplicateMatchPattern);
                        }
                        set hasNil = true;
                    }
                }
            }
        }
    }

    // Check exhaustiveness.
    if not state.catchAll {
        if not hasValue {
            throw emitError(self, node, ErrorKind::OptionalMatchMissingValue);
        }
        if not hasNil {
            throw emitError(self, node, ErrorKind::OptionalMatchMissingNil);
        }
    } else if hasValue and hasNil {
        throw emitError(self, node, ErrorKind::UnreachableElse);
    }
    return setNodeType(self, node, matchType);
}

/// Analyze a `match` expression on a union subject.
unsafe fn resolveMatchUnion 'arena (
    self: &mut Resolver 'arena,
    node: *ast::Node,
    sw: ast::Match,
    subjectTy: Type,
    info: UnionType,
    matchBy: MatchBy
) -> Type throws (ResolveError) {
    let prongs = sw.prongs;
    let mut covered: [bool; MAX_UNION_VARIANTS] = [false; MAX_UNION_VARIANTS];
    let mut coveredCount: u32 = 0;
    let mut state = MatchState { catchAll: false, isConst: false };
    let mut matchType = Type::Never;

    for prongNode in prongs {
        let case ast::NodeValue::MatchProng(prong) = prongNode.value
            else panic "resolveMatchUnion: expected match prong";

        try checkMatchProng(self, prongNode, prong, subjectTy, &mut state);
        set matchType = try visitMatchProng(self, prongNode, prong, subjectTy, matchType, matchBy);

        // Guarded prongs don't count as covering. Patterns with nested
        // refining sub-patterns (e.g. matching different inner union variants)
        // don't count as duplicates or as fully covering.
        if prong.guard == nil {
            if let case ast::ProngArm::Case(patterns) = prong.arm {
                for pattern in patterns {
                    if let case NodeExtra::UnionVariant { ordinal: ix, .. } = self.nodeData.entries[pattern.id].extra {
                        if not hasNestedRefiningPattern(self, pattern) {
                            if covered[ix] {
                                throw emitError(self, pattern, ErrorKind::DuplicateMatchPattern);
                            }
                            set covered[ix] = true;
                            set coveredCount += 1;
                        }
                    }
                }
            }
        }
    }
    // Check that all variants are covered.
    if not state.catchAll {
        for variant, i in info.variants {
            if not covered[i] {
                throw emitError(
                    self, node, ErrorKind::UnionMatchNonExhaustive(variant.name)
                );
            }
        }
    } else if coveredCount == info.variants.len as u32 {
        throw emitError(self, node, ErrorKind::UnreachableElse);
    }
    return setNodeType(self, node, matchType);
}

/// Analyze a `match` expression on a generic subject type. Requires exhaustiveness:
/// booleans must cover both `true` and `false`, other types require a catch-all.
unsafe fn resolveMatchGeneric 'arena (self: &mut Resolver 'arena, node: *ast::Node, sw: ast::Match, subjectTy: Type, matchBy: MatchBy) -> Type
    throws (ResolveError)
{
    let prongs = sw.prongs;
    let mut state = MatchState { catchAll: false, isConst: true };
    let mut matchType = Type::Never;
    let mut hasTrue = false;
    let mut hasFalse = false;
    let mut hasConstCase = false;

    for prongNode in prongs {
        let case ast::NodeValue::MatchProng(prong) = prongNode.value
            else panic "resolveMatchGeneric: expected match prong";

        try checkMatchProng(self, prongNode, prong, subjectTy, &mut state);
        set matchType = try visitMatchProng(self, prongNode, prong, subjectTy, matchType, matchBy);
        // Track boolean coverage. Guarded prongs don't count as covering.
        if let case ast::ProngArm::Case(patterns) = prong.arm {
            for p in patterns {
                if prong.guard == nil {
                    if let case ast::NodeValue::Bool(val) = p.value {
                        if (val and hasTrue) or (not val and hasFalse) {
                            throw emitError(self, p, ErrorKind::DuplicateMatchPattern);
                        }
                        if val {
                            set hasTrue = true;
                        } else {
                            set hasFalse = true;
                        }
                    }
                }
                // Scalar constant patterns allow the match to be lowered
                // to a switch instruction.
                if let c = constValueEntry(self, p) {
                    match c {
                        case ConstValue::Bool(_), ConstValue::Char(_), ConstValue::Int(_) =>
                            set hasConstCase = true,
                        else =>
                            set state.isConst = false,
                    }
                }
            }
        }
    }

    // Check exhaustiveness.
    if not state.catchAll {
        if let case Type::Bool = subjectTy {
            if not hasTrue {
                throw emitError(self, node, ErrorKind::BoolMatchMissing(true));
            }
            if not hasFalse {
                throw emitError(self, node, ErrorKind::BoolMatchMissing(false));
            }
        } else {
            throw emitError(self, node, ErrorKind::MatchNonExhaustive);
        }
    } else if let case Type::Bool = subjectTy {
        if hasTrue and hasFalse {
            throw emitError(self, node, ErrorKind::UnreachableElse);
        }
    }
    setMatchConst(self, node, state.isConst and hasConstCase);

    return setNodeType(self, node, matchType);
}

/// Analyze a single `match` prong branch. Returns the unified match type.
unsafe fn visitMatchProng 'arena (
    self: &mut Resolver 'arena,
    node: *ast::Node,
    prongNode: ast::MatchProng,
    subjectTy: Type,
    matchType: Type,
    matchBy: MatchBy
) -> Type throws (ResolveError) {
    enterScope(self, node);
    let prongTy = try resolveMatchProngBody(self, prongNode, subjectTy, matchBy) catch e {
        exitScope(self);
        throw e;
    };
    exitScope(self);
    setNodeType(self, node, prongTy);

    return unifyBranches(matchType, prongTy);
}

/// Analyze the contents of a `match` prong while inside the prong scope.
unsafe fn resolveMatchProngBody 'arena (
    self: &mut Resolver 'arena,
    prong: ast::MatchProng,
    subjectTy: Type,
    matchBy: MatchBy
) -> Type throws (ResolveError) {
    match prong.arm {
        case ast::ProngArm::Binding(pat) => {
            // For optionals, bind the unwrapped inner type.
            let mut bindTy = subjectTy;
            if let case Type::Optional(inner) = subjectTy {
                set bindTy = *inner;
            }
            try bindPatternVar(self, pat, bindTy, matchBy);
        }
        case ast::ProngArm::Case(patterns) => {
            for pattern in patterns {
                try resolveCasePattern(self, pattern, subjectTy, IdentMode::Compare, matchBy);
            }
        }
        case ast::ProngArm::Else => {}
    }
    if let g = prong.guard {
        try checkBoolean(self, g);
    }
    return try visit(self, prong.body, Type::Void);
}

/// Ensure a scope access pattern references a compatible union variant.
unsafe fn resolveUnionScopePattern 'arena (
    self: &mut Resolver 'arena,
    pattern: *ast::Node,
    access: ast::Access,
    subjectTy: Type,
    unionType: UnionType
) throws (ResolveError) {
    let patternTy = try visit(self, pattern, subjectTy);
    if not isComparable(patternTy, subjectTy) {
        throw emitTypeMismatch(self, pattern, TypeMismatch {
            expected: subjectTy,
            actual: patternTy,
        });
    }
    let case NodeExtra::UnionVariant { ordinal: index, .. } = self.nodeData.entries[pattern.id].extra else {
        throw emitError(self, pattern, ErrorKind::Internal);
    };
    let variant = &unionType.variants[index];
    // If this variant has a payload, throw an error, since the user hasn't
    // provided one.
    if variant.valueType <> Type::Void {
        throw emitError(self, pattern, ErrorKind::UnionVariantPayloadMissing(variant.name));
    }
}

/// Validate and bind a union constructor call used as a `match` pattern.
unsafe fn resolveUnionCallPattern 'arena (
    self: &mut Resolver 'arena,
    pattern: *ast::Node,
    call: ast::Call,
    subjectTy: Type,
    unionType: UnionType,
    matchBy: MatchBy
) throws (ResolveError) {
    let calleeTy = try checkEqual(self, call.callee, subjectTy);
    let case NodeExtra::UnionVariant { ordinal: index, tag } = self.nodeData.entries[call.callee.id].extra else {
        throw emitError(self, call.callee, ErrorKind::Internal);
    };
    let variant = &unionType.variants[index];
    // Copy variant index to the pattern node for the lowerer.
    setVariantInfo(self, pattern, index, tag);

    if variant.valueType <> Type::Void {
        try bindUnionPatternPayload(self, pattern, call, variant.name, variant.valueType, matchBy);
    } else {
        throw emitError(self, pattern, ErrorKind::UnionVariantPayloadUnexpected(variant.name));
    }
}

/// Bind the payload introduced by a union constructor pattern.
unsafe fn bindUnionPatternPayload 'arena (
    self: &mut Resolver 'arena,
    pattern: *ast::Node,
    call: ast::Call,
    variantName: *[u8],
    payloadTy: Type,
    matchBy: MatchBy
) throws (ResolveError) {
    if call.args.len == 0 {
        throw emitError(
            self, pattern, ErrorKind::UnionVariantPayloadMissing(variantName)
        );
    }
    // All variant payloads are records.
    try ensureTypeResolved(self, payloadTy, pattern);
    let recInfo = getRecord(payloadTy)
        else panic "bindUnionPatternPayload: payload is not a record";

    try bindRecordPatternFields(self, pattern, recInfo, matchBy);
}

/// Bind a pattern variable. For ref matches, wraps the type in a pointer.
unsafe fn bindPatternVar 'arena (self: &mut Resolver 'arena, binding: *ast::Node, ty: Type, matchBy: MatchBy)
    throws (ResolveError)
{
    let mut bindTy = ty;
    match matchBy {
        case MatchBy::Value => {}
        case MatchBy::Ref(class) => set bindTy = Type::Pointer {
            class,
            target: allocType(self, ty),
            mutable: false,
        },
        case MatchBy::MutRef => set bindTy = Type::Pointer {
            class: types::PointerClass::Ref,
            target: allocType(self, ty),
            mutable: true,
        },
    }
    match binding.value {
        case ast::NodeValue::Placeholder => {
            // Nothing to do.
        }
        case ast::NodeValue::Ident(_) => {
            try bindValueIdent(self, binding, binding, bindTy, false, 0, 0);
        }
        else => {
            // Nested pattern: recursively resolve (record destructuring,
            // union variant, scope access, call, literals, etc).
            try resolveCasePattern(self, binding, ty, IdentMode::Bind, matchBy);
        }
    }
}

/// Check a record pattern's exact nominal type before binding its fields.
unsafe fn resolveRecordPattern 'arena (
    self: &mut Resolver 'arena, pattern: *ast::Node, subjectTy: Type, body: RecordType, matchBy: MatchBy
) throws (ResolveError) {
    let mut name: ?*ast::Node = nil;
    match pattern.value {
        case ast::NodeValue::Call(call) => set name = call.callee,
        case ast::NodeValue::RecordLit(lit) => set name = lit.typeName,
        else => panic "resolveRecordPattern: expected record pattern",
    }
    if let typeName = name {
        let actual = try visit(self, typeName, subjectTy);
        let symbol = symbolFor(self, typeName) else throw emitError(self, typeName, ErrorKind::ExpectedRecord);
        let case SymbolData::Type(_) = symbol.data else throw emitError(self, typeName, ErrorKind::ExpectedRecord);
        if not typesEqual(actual, subjectTy) {
            throw emitTypeMismatch(self, typeName, TypeMismatch { expected: subjectTy, actual });
        }
    }
    setNodeType(self, pattern, subjectTy);
    try bindRecordPatternFields(self, pattern, body, matchBy);
}

/// Require access to a record's module-owned representation.
fn requireRecordAccess 'arena (self: &mut Resolver 'arena, node: *ast::Node, recordType: RecordType)
    throws (ResolveError)
{
    if let owner = recordType.privateModule; owner <> self.currentMod {
        throw emitError(self, node, ErrorKind::OpaqueRecordAccess);
    }
}

/// Bind record pattern fields to variables in the current scope.
unsafe fn bindRecordPatternFields 'arena (
    self: &mut Resolver 'arena,
    pattern: *ast::Node,
    recInfo: RecordType,
    matchBy: MatchBy
) throws (ResolveError) {
    try requireRecordAccess(self, pattern, recInfo);
    match pattern.value {
        case ast::NodeValue::Call(call) => {
            // Unlabeled patterns: `S(x, y)`.
            try checkRecordArity(self, CountMismatch { expected: recInfo.fields.len, actual: call.args.len }, pattern);

            for binding, i in call.args {
                let fieldType = recInfo.fields[i].fieldType;
                try bindPatternVar(self, binding, fieldType, matchBy);
            }
        }
        case ast::NodeValue::RecordLit(lit) => {
            // Labeled patterns: `T { x, y }` or `T { x: binding }`.
            if not lit.ignoreRest {
                try checkRecordArity(self, CountMismatch { expected: recInfo.fields.len, actual: lit.fields.len }, pattern);
            }
            for fieldNode in lit.fields {
                let case ast::NodeValue::RecordLitField(field) = fieldNode.value
                    else panic "expected RecordLitField";

                // Brace patterns require labeled fields.
                let label = field.label else panic "expected labeled field";
                let fieldName = try nodeName(self, label);
                let fieldIndex = findRecordField(&recInfo.fields[..], fieldName)
                    else throw emitError(self, fieldNode, ErrorKind::RecordFieldUnknown(fieldName));
                let fieldType = recInfo.fields[fieldIndex].fieldType;
                // Store field index for the lowerer.
                setRecordFieldIndex(self, fieldNode, fieldIndex);
                try bindPatternVar(self, field.value, fieldType, matchBy);
            }
        }
        else => throw emitError(self, pattern, ErrorKind::Internal)
    }
}

/// Validate and bind a record literal pattern for matching labeled union variants.
unsafe fn resolveUnionRecordPattern 'arena (
    self: &mut Resolver 'arena,
    pattern: *ast::Node,
    lit: ast::RecordLit,
    subjectTy: Type,
    unionType: UnionType,
    matchBy: MatchBy
) throws (ResolveError) {
    let typeName = lit.typeName else {
        throw emitError(self, pattern, ErrorKind::Internal);
    };
    // Verify the type matches the subject.
    let patternTy = try visit(self, typeName, subjectTy);
    if not isComparable(patternTy, subjectTy) {
        throw emitTypeMismatch(self, pattern, TypeMismatch {
            expected: subjectTy,
            actual: patternTy,
        });
    }
    let case NodeExtra::UnionVariant { ordinal: index, tag } = self.nodeData.entries[typeName.id].extra else {
        throw emitError(self, typeName, ErrorKind::Internal);
    };
    let variant = &unionType.variants[index];

    // Copy variant index to the pattern node for the lowerer.
    setVariantInfo(self, pattern, index, tag);

    if variant.valueType == Type::Void {
        throw emitError(self, pattern, ErrorKind::UnionVariantPayloadUnexpected(variant.name));
    }
    try ensureTypeResolved(self, variant.valueType, pattern);
    let recInfo = getRecord(variant.valueType)
        else panic "resolveUnionRecordPattern: payload is not a record";

    try bindRecordPatternFields(self, pattern, recInfo, matchBy);
}

/// Analyze a pattern appearing in a union case.
unsafe fn resolveUnionPattern 'arena (
    self: &mut Resolver 'arena,
    pattern: *ast::Node,
    subjectTy: Type,
    unionType: UnionType,
    matchBy: MatchBy
) throws (ResolveError) {
    match pattern.value {
        case ast::NodeValue::ScopeAccess(access) =>
            try resolveUnionScopePattern(self, pattern, access, subjectTy, unionType),
        case ast::NodeValue::Call(call) =>
            try resolveUnionCallPattern(self, pattern, call, subjectTy, unionType, matchBy),
        case ast::NodeValue::RecordLit(lit) =>
            try resolveUnionRecordPattern(self, pattern, lit, subjectTy, unionType, matchBy),
        else => {
            let patternTy = try visit(self, pattern, subjectTy);
            throw emitTypeMismatch(self, pattern, TypeMismatch {
                expected: subjectTy,
                actual: patternTy,
            });
        }
    }
}

/// Return whether a case pattern introduces value bindings.
fn casePatternIntroducesBindings(pattern: *ast::Node, nested: bool) -> bool {
    match pattern.value {
        case ast::NodeValue::Ident(_) => return nested,
        case ast::NodeValue::Call(call) => {
            for arg in call.args {
                if casePatternIntroducesBindings(arg, true) {
                    return true;
                }
            }
        }
        case ast::NodeValue::RecordLit(lit) => {
            for fieldNode in lit.fields {
                let case ast::NodeValue::RecordLitField(field) = fieldNode.value
                    else continue;
                if casePatternIntroducesBindings(field.value, true) {
                    return true;
                }
            }
        }
        case ast::NodeValue::ArrayLit(items) => {
            for item in items {
                if casePatternIntroducesBindings(item, true) {
                    return true;
                }
            }
        }
        else => {}
    }
    return false;
}

/// Analyze a `let-else` guard.
unsafe fn resolveLetElse 'arena (self: &mut Resolver 'arena, node: *ast::Node, letElse: ast::LetElse) -> Type
    throws (ResolveError)
{
    let pat = letElse.pattern;
    let exprTy = try infer(self, pat.scrutinee);

    match pat.kind {
        case ast::PatternKind::Binding => {
            // Simple binding requires an optional expression.
            let case Type::Optional(inner) = exprTy else {
                throw emitError(self, pat.scrutinee, ErrorKind::ExpectedOptional);
            };
            let payloadTy = *inner;
            // The `else` branch supplies the binding when the optional is nil.
            try checkAssignable(self, letElse.elseBranch, payloadTy);
            let _ = try bindValueIdent(self, pat.pattern, node, payloadTy, pat.mutable, 0, 0);

            return setNodeType(self, node, Type::Void);
        }
        case ast::PatternKind::Case => {
            // Resolve the failure path before introducing success-only bindings.
            let elseTy = try checkAssignable(self, letElse.elseBranch, exprTy);
            try resolveCasePattern(
                self,
                pat.pattern,
                exprTy,
                IdentMode::Compare,
                MatchBy::Value,
            );
            if let guardExpr = pat.guard {
                try checkBoolean(self, guardExpr);
            }
            if elseTy <> Type::Never and
               casePatternIntroducesBindings(pat.pattern, false)
            {
                throw emitError(
                    self,
                    letElse.elseBranch,
                    ErrorKind::LinearLetElseMustTerminate,
                );
            }
        }
    }
    return setNodeType(self, node, Type::Void);
}

/// Analyze builtin function calls like `@sizeOf(T)` and `@alignOf(T)`.
unsafe fn resolveBuiltinCall 'arena (
    self: &mut Resolver 'arena,
    node: *ast::Node,
    kind: ast::Builtin,
    args: *[*ast::Node]
) -> Type throws (ResolveError) {
    // Handle `@sliceOf(ptr, len)` and `@sliceOf(ptr, len, cap)`.
    if kind == ast::Builtin::SliceOf {
        if args.len <> 2 and args.len <> 3 {
            throw emitError(self, node, ErrorKind::BuiltinArgCountMismatch(CountMismatch {
                expected: 2,
                actual: args.len as u32,
            }));
        }
        let ptrType = try visit(self, args[0], Type::Unknown);
        let case Type::Pointer { class, target, mutable } = ptrType else {
            throw emitError(self, node, ErrorKind::ExpectedPointer);
        };
        let _ = try checkAssignable(self, args[1], Type::U32);
        if args.len == 3 {
            let _ = try checkAssignable(self, args[2], Type::U32);
        }
        try requireUnsafe(self, node);
        return setNodeType(self, node, Type::Slice { class, item: target, mutable });
    }
    if args.len <> 1 {
        throw emitError(self, node, ErrorKind::BuiltinArgCountMismatch(CountMismatch {
            expected: 1,
            actual: args.len as u32,
        }));
    }

    let ty = try resolveValueType(self, args[0]);
    // Ensure the type body is resolved before computing layout.
    // TODO: Somehow, ensuring the type is resolved should just happen all
    // the time, lazily.
    try ensureTypeResolved(self, ty, args[0]);
    // TODO: This should be stored in `symbol` instead of having to recompute it.
    // That way there's a canonical place to look for code gen.
    let layout = getTypeLayout(ty);

    // Evaluate the built-in.
    let mut value: u32 = undefined;
    match kind {
        case ast::Builtin::SizeOf => {
            set value = layout.size;
        },
        case ast::Builtin::AlignOf => {
            set value = layout.alignment;
        },
        case ast::Builtin::SliceOf => {
            panic "unreachable: @sliceOf handled above";
        }
    }
    // Record as constant value for constant folding.
    setNodeConstValue(self, node, ConstValue::Int(ConstInt {
        magnitude: value as u64,
        bits: 32,
        signed: false,
        negative: false,
    }));
    return setNodeType(self, node, Type::U32);
}

/// Allocate an initially empty argument map for a region-parameterized signature.
unsafe fn regionSubstitution 'arena (self: &mut Resolver 'arena, parameters: *RegionScope) -> RegionSubstitution {
    let count = parameters.entries.len;
    let arguments = try! alloc::allocRawSlice(
        self.arena, @sizeOf(?*unsafe types::Region), @alignOf(?*unsafe types::Region), count
    ) as *unsafe mut [?*unsafe types::Region];
    for i in 0..count {
        set arguments[i] = nil;
    }
    return RegionSubstitution { parameters, arguments };
}

/// Find a region's position among the region declarations in one scope.
fn regionIndex(scope: &RegionScope, regionId: u32) -> ?u32 {
    match scope.declarations {
        case RegionDeclarations::Parameters(nodes) => {
            let mut index: u32 = 0;
            for node in nodes {
                let case ast::NodeValue::Region { .. } = node.value else continue;
                if node.id == regionId {
                    return index;
                }
                set index += 1;
            }
        }
        case RegionDeclarations::Block(node) => {
            if node.id == regionId {
                return 0;
            }
        }
    }
    return nil;
}

/// Infer one region argument from a pair of reference classes.
unsafe fn inferRegionClass 'arena (
    self: &mut Resolver 'arena, map: &RegionSubstitution,
    expected: types::PointerClass, actual: types::PointerClass, site: *ast::Node
) throws (ResolveError) {
    let case types::PointerClass::Region(parameter) = expected else return;
    let index = regionIndex(map.parameters, parameter.id) else return;
    let case types::PointerClass::Region(argument) = actual
        else throw emitError(self, site, ErrorKind::RegionInference(parameter.name));
    if let previous = map.arguments[index]; previous.id <> argument.id {
        throw emitError(self, site, ErrorKind::RegionInference(parameter.name));
    }
    set map.arguments[index] = argument;
}

/// Infer regions through matching type structure without adding lifetime subtyping.
unsafe fn inferRegionArguments 'arena (
    self: &mut Resolver 'arena, map: &RegionSubstitution, expected: Type, actual: Type, site: *ast::Node
) throws (ResolveError) {
    match expected {
        case Type::Cell { class, permission, payload } => {
            let case Type::Cell {
                class: otherClass, permission: otherPermission, payload: other,
            } = actual else return;
            try inferRegionClass(self, map, class, otherClass, site);
            if let expectedPermission = permission {
                let actualPermission = otherPermission else return;
                try inferRegionClass(
                    self, map,
                    types::PointerClass::Region(expectedPermission),
                    types::PointerClass::Region(actualPermission),
                    site
                );
            }
            try inferRegionArguments(self, map, *payload, *other, site);
        }
        case Type::Session(region) => {
            let case Type::Session(other) = actual else return;
            try inferRegionClass(self, map, types::PointerClass::Region(region),
                types::PointerClass::Region(other), site);
        }
        case Type::Pointer { class, target, .. } => {
            let case Type::Pointer { class: otherClass, target: otherTarget, .. } = actual else return;
            try inferRegionClass(self, map, class, otherClass, site);
            try inferRegionArguments(self, map, *target, *otherTarget, site);
        }
        case Type::Slice { class, item, .. } => {
            let case Type::Slice { class: otherClass, item: otherItem, .. } = actual else return;
            try inferRegionClass(self, map, class, otherClass, site);
            try inferRegionArguments(self, map, *item, *otherItem, site);
        }
        case Type::TraitObject { class, .. } => {
            if let case Type::TraitObject { class: otherClass, .. } = actual {
                try inferRegionClass(self, map, class, otherClass, site);
            }
        }
        case Type::Array(array) => {
            if let case Type::Array(other) = actual {
                try inferRegionArguments(self, map, *array.item, *other.item, site);
            }
        }
        case Type::Optional(inner) => {
            if let case Type::Optional(other) = actual {
                try inferRegionArguments(self, map, *inner, *other, site);
            } else {
                try inferRegionArguments(self, map, *inner, actual, site);
            }
        }
        case Type::Fn(info) => {
            let case Type::Fn(other) = actual else return;
            if info.paramTypes.len <> other.paramTypes.len or info.throwList.len <> other.throwList.len {
                return;
            }
            for parameter, i in info.paramTypes {
                try inferRegionArguments(self, map, *parameter, *other.paramTypes[i], site);
            }
            for error, i in info.throwList {
                try inferRegionArguments(self, map, *error, *other.throwList[i], site);
            }
            try inferRegionArguments(self, map, *info.returnType, *other.returnType, site);
        }
        case Type::Nominal(info) => {
            let applied = nominalApplication(info) else return;
            let case Type::Nominal(otherInfo) = actual else return;
            let other = nominalApplication(otherInfo) else return;
            if applied.base <> other.base {
                return;
            }
            for region, i in applied.arguments {
                try inferRegionClass(self, map, types::PointerClass::Region(region),
                    types::PointerClass::Region(other.arguments[i]), site);
            }
        }
        else => {
        }
    }
}

/// Return whether a type uses one formal region as a cell permission.
/// Unapplied nominals cannot capture a free formal region, so only exact
/// applications need cycle marking and member traversal.
unsafe fn typeHasFormalCellPermission 'arena (
    self: &mut Resolver 'arena,
    ty: Type,
    permission: *unsafe types::Region,
    generation: u32,
    site: *ast::Node,
) -> bool throws (ResolveError) {
    match ty {
        case Type::Cell { permission: identity, payload, .. } => {
            if let cellPermission = identity; cellPermission == permission {
                return true;
            }
            return try typeHasFormalCellPermission(
                self, *payload, permission, generation, site,
            );
        }
        case Type::Pointer { target, .. } =>
            return try typeHasFormalCellPermission(
                self, *target, permission, generation, site,
            ),
        case Type::Slice { item, .. } =>
            return try typeHasFormalCellPermission(
                self, *item, permission, generation, site,
            ),
        case Type::Array(array) =>
            return try typeHasFormalCellPermission(
                self, *array.item, permission, generation, site,
            ),
        case Type::Optional(inner) =>
            return try typeHasFormalCellPermission(
                self, *inner, permission, generation, site,
            ),
        case Type::Range { start, end } => {
            if let startType = start;
                try typeHasFormalCellPermission(
                    self, *startType, permission, generation, site,
                )
            {
                return true;
            }
            if let endType = end {
                return try typeHasFormalCellPermission(
                    self, *endType, permission, generation, site,
                );
            }
            return false;
        }
        case Type::Nominal(nominal) => {
            let applied = nominalApplication(nominal) else return false;
            try ensureNominalResolved(self, nominal, site);
            if not visitNominalApplication(
                applied, generation, RegionTypeRole::CellPermission,
            ) {
                return false;
            }
            match *nominal {
                case NominalType::Record(recordType) => {
                    for field in recordType.fields {
                        if try typeHasFormalCellPermission(
                            self, field.fieldType, permission, generation, site,
                        ) {
                            return true;
                        }
                    }
                }
                case NominalType::Union(unionType) => {
                    for variant in unionType.variants {
                        if try typeHasFormalCellPermission(
                            self, variant.valueType, permission, generation, site,
                        ) {
                            return true;
                        }
                    }
                }
                case NominalType::Placeholder(_), NominalType::Resolving(_),
                     NominalType::Application(_) =>
                    panic "typeHasFormalCellPermission: unresolved application",
            }
            return false;
        }
        case Type::Fn(info) => {
            for parameter in info.paramTypes {
                if try typeHasFormalCellPermission(
                    self, *parameter, permission, generation, site,
                ) {
                    return true;
                }
            }
            for error in info.throwList {
                if try typeHasFormalCellPermission(
                    self, *error, permission, generation, site,
                ) {
                    return true;
                }
            }
            return try typeHasFormalCellPermission(
                self, *info.returnType, permission, generation, site,
            );
        }
        else => return false,
    }
}

/// Return whether a function contract uses one formal cell permission.
unsafe fn contractHasFormalCellPermission 'arena (
    self: &mut Resolver 'arena,
    info: *FnType,
    receiver: ?Type,
    permission: *unsafe types::Region,
    generation: u32,
    site: *ast::Node,
) -> bool throws (ResolveError) {
    if let receiverType = receiver;
        try typeHasFormalCellPermission(
            self, receiverType, permission, generation, site,
        )
    {
        return true;
    }
    for parameter in info.paramTypes {
        if try typeHasFormalCellPermission(
            self, *parameter, permission, generation, site,
        ) {
            return true;
        }
    }
    if try typeHasFormalCellPermission(
        self, *info.returnType, permission, generation, site,
    ) {
        return true;
    }
    for error in info.throwList {
        if try typeHasFormalCellPermission(
            self, *error, permission, generation, site,
        ) {
            return true;
        }
    }
    return false;
}

/// Validate region parents and keep distinct formal cell permissions injective.
unsafe fn validateRegionArguments 'arena (
    self: &mut Resolver 'arena,
    map: &RegionSubstitution,
    contract: ?*FnType,
    receiver: ?Type,
    site: *ast::Node,
) throws (ResolveError) {
    for parameter, i in map.parameters.entries {
        if map.arguments[i] == nil {
            throw emitError(self, site, ErrorKind::RegionInference(parameter.name));
        }
    }
    for parameter, i in map.parameters.entries {
        let parent = parameter.parent else continue;
        let index = regionIndex(map.parameters, parent.id)
            else panic "validateRegionArguments: unknown parent";
        let parentArgument = map.arguments[index]
            else panic "validateRegionArguments: missing parent argument";
        let argument = map.arguments[i]
            else panic "validateRegionArguments: missing argument";
        if not types::regionContains(parentArgument, argument) {
            throw emitError(self, site, ErrorKind::RegionParent(parameter.name));
        }
    }
    let info = contract else return;

    // Only colliding arguments need contract scans. Formal parameters bound the
    // candidates, while generation marks keep recursive applications finite.
    for parameter, i in map.parameters.entries {
        let argument = map.arguments[i]
            else panic "validateRegionArguments: missing argument";
        let mut checked = false;
        for j in 0..i {
            let previousArgument = map.arguments[j]
                else panic "validateRegionArguments: missing previous argument";
            if previousArgument <> argument {
                continue;
            }
            if not checked {
                let generation = nextNominalTraversalGeneration(self);
                set checked = true;
                if not try contractHasFormalCellPermission(
                    self, info, receiver, parameter, generation, site,
                ) {
                    break;
                }
            }
            let previous = map.parameters.entries[j];
            let generation = nextNominalTraversalGeneration(self);
            if try contractHasFormalCellPermission(
                self, info, receiver, previous, generation, site,
            ) {
                throw emitError(
                    self, site, ErrorKind::RegionInference(parameter.name),
                );
            }
        }
    }
}

/// Substitute a reference's region while preserving its ownership class.
unsafe fn substituteRegionClass(map: &RegionSubstitution, class: types::PointerClass) -> types::PointerClass {
    let case types::PointerClass::Region(region) = class else return class;
    let index = regionIndex(map.parameters, region.id) else return class;
    let argument = map.arguments[index] else panic "substituteRegionClass: missing argument";
    return types::PointerClass::Region(argument);
}

/// Substitute free region arguments in a type without changing its runtime layout.
unsafe fn substituteRegions 'arena (self: &mut Resolver 'arena, map: &RegionSubstitution, ty: Type) -> Type {
    match ty {
        case Type::Cell { class, permission, payload } => {
            let mut substitutedPermission = permission;
            if let region = permission {
                let case types::PointerClass::Region(argument) = substituteRegionClass(
                    map, types::PointerClass::Region(region)
                ) else panic "substituteRegions: invalid permission class";
                set substitutedPermission = argument;
            }
            return Type::Cell {
                class: substituteRegionClass(map, class),
                permission: substitutedPermission,
                payload: allocType(self, substituteRegions(self, map, *payload)),
            };
        }
        case Type::Session(region) => {
            let index = regionIndex(map.parameters, region.id) else return ty;
            let argument = map.arguments[index] else panic "substituteRegions: missing session region";
            return Type::Session(argument);
        }
        case Type::Pointer { class, target, mutable } => {
            let targetType = substituteRegions(self, map, *target);
            return Type::Pointer { class: substituteRegionClass(map, class), target: allocType(self, targetType), mutable };
        }
        case Type::Slice { class, item, mutable } => {
            let itemType = substituteRegions(self, map, *item);
            return Type::Slice { class: substituteRegionClass(map, class), item: allocType(self, itemType), mutable };
        }
        case Type::TraitObject { class, traitInfo, mutable } =>
            return Type::TraitObject { class: substituteRegionClass(map, class), traitInfo, mutable },
        case Type::Array(array) => {
            let itemType = substituteRegions(self, map, *array.item);
            return Type::Array(ArrayType { item: allocType(self, itemType), length: array.length });
        }
        case Type::Optional(inner) => {
            let innerType = substituteRegions(self, map, *inner);
            return Type::Optional(allocType(self, innerType));
        }
        case Type::Fn(info) => return Type::Fn(substituteFnRegions(self, map, info, info.regions)),
        case Type::Nominal(info) => {
            let applied = nominalApplication(info) else return ty;
            let arguments = regionSubstitution(self, applied.parameters);
            for region, i in applied.arguments {
                let class = substituteRegionClass(map, types::PointerClass::Region(region));
                let case types::PointerClass::Region(argument) = class else panic;
                set arguments.arguments[i] = argument;
            }
            return Type::Nominal(internNominalApplication(self, applied.base, &arguments));
        }
        else => return ty,
    }
}

/// Create a substituted signature with the specified remaining region binder.
unsafe fn substituteFnRegions 'arena (
    self: &mut Resolver 'arena, map: &RegionSubstitution, info: *FnType, regions: ?*RegionScope
) -> *FnType {
    let a = alloc::arenaAllocator(self.arena);
    let mut paramTypes: *mut [*Type] = &mut [];
    let mut throwList: *mut [*Type] = &mut [];
    for parameter in info.paramTypes {
        let ty = substituteRegions(self, map, *parameter);
        paramTypes.append(allocType(self, ty), a);
    }
    for error in info.throwList {
        let ty = substituteRegions(self, map, *error);
        throwList.append(allocType(self, ty), a);
    }
    let returnType = substituteRegions(self, map, *info.returnType);
    return allocFnType(self, FnType {
        regions,
        paramTypes: &paramTypes[..],
        returnType: allocType(self, returnType),
        throwList: &throwList[..],
        isUnsafe: info.isUnsafe,
    });
}

/// Preserve a call-scoped pointer class while inferring its region-bearing contents.
/// Named reference regions are inferred from the source storage.
unsafe fn regionInputHint 'arena (self: &mut Resolver 'arena, expected: Type) -> Type {
    if let case Type::Optional(inner) = expected {
        return regionInputHint(self, *inner);
    }
    match expected {
        case Type::Pointer { class, mutable, .. } => {
            if let case types::PointerClass::Region(_) = class {
                return Type::Unknown;
            }
            return Type::Pointer { class, target: allocType(self, Type::Unknown), mutable };
        }
        case Type::Slice { class, mutable, .. } => {
            if let case types::PointerClass::Region(_) = class {
                return Type::Unknown;
            }
            return Type::Slice { class, item: allocType(self, Type::Unknown), mutable };
        }
        else => return Type::Unknown,
    }
}

/// Infer a source function's region arguments from its call inputs.
unsafe fn instantiateCall 'arena (self: &mut Resolver 'arena, node: *ast::Node, call: ast::Call, info: *FnType) -> *FnType
    throws (ResolveError)
{
    let parameters = info.regions else return info;
    if call.args.len <> info.paramTypes.len {
        throw emitError(self, node, ErrorKind::FnArgCountMismatch(CountMismatch {
            expected: info.paramTypes.len, actual: call.args.len,
        }));
    }
    let map = regionSubstitution(self, parameters);
    for argument, i in call.args {
        let expected = *info.paramTypes[i];
        if containsRegion(expected) {
            let actual = try visit(self, argument, regionInputHint(self, expected));
            try inferRegionArguments(self, &map, expected, actual, argument);
        }
    }
    try validateRegionArguments(self, &map, info, nil, node);
    return substituteFnRegions(self, &map, info, nil);
}

/// Infer a method's region arguments from its receiver and call arguments.
unsafe fn instantiateMethodCall 'arena (
    self: &mut Resolver 'arena, node: *ast::Node, call: ast::Call,
    receiver: *ast::Node, receiverType: Type, method: *unsafe MethodEntry
) -> *FnType throws (ResolveError) {
    let parameters = method.fnType.regions else return method.fnType;
    if call.args.len <> method.fnType.paramTypes.len {
        throw emitError(self, node, ErrorKind::FnArgCountMismatch(CountMismatch {
            expected: method.fnType.paramTypes.len, actual: call.args.len,
        }));
    }
    let map = regionSubstitution(self, parameters);
    try inferRegionArguments(self, &map, method.concreteType, receiverType, receiver);
    for argument, i in call.args {
        let expected = *method.fnType.paramTypes[i];
        if containsRegion(expected) {
            let actual = try visit(self, argument, regionInputHint(self, expected));
            try inferRegionArguments(self, &map, expected, actual, argument);
        }
    }
    try validateRegionArguments(
        self, &map, method.fnType, method.concreteType, node,
    );
    return substituteFnRegions(self, &map, method.fnType, nil);
}

/// Apply explicit current-scope regions to a function or nominal type.
unsafe fn resolveRegionApply 'arena (
    self: &mut Resolver 'arena, node: *ast::Node, value: *ast::Node, regions: *[*ast::Node]
) -> Type throws (ResolveError) {
    let ty = try infer(self, value);
    if let case Type::Nominal(base) = ty {
        let symbol = symbolFor(self, value) else throw emitError(self, node, ErrorKind::CannotInferType);
        let case SymbolData::Type(_) = symbol.data else throw emitError(self, node, ErrorKind::CannotInferType);
        let applied = try applyNominalRegions(self, base, regions, node);
        try ensureNominalResolved(self, applied, node);
        setNodeSymbol(self, node, symbol);
        return setNodeType(self, node, Type::Nominal(applied));
    }
    let case Type::Fn(info) = ty else throw emitError(self, node, ErrorKind::CannotInferType);
    let mut count: u32 = 0;
    if let scope = info.regions {
        set count = scope.entries.len;
    }
    if count <> regions.len {
        throw emitError(self, node, ErrorKind::RegionArgumentCount(CountMismatch { expected: count, actual: regions.len }));
    }
    let scope = info.regions else panic "resolveRegionApply: empty region application";
    let map = regionSubstitution(self, scope);
    for region, i in regions {
        set map.arguments[i] = try resolveRegion(self, region);
    }
    try validateRegionArguments(self, &map, info, nil, node);
    let applied = substituteFnRegions(self, &map, info, nil);
    if let symbol = symbolFor(self, value) {
        setNodeSymbol(self, node, symbol);
    }
    return setNodeType(self, node, Type::Fn(applied));
}

/// Validate call arguments against a function type: check argument count,
/// type-check each argument, and verify that throwing functions use `try`.
unsafe fn checkCallArgs 'arena (self: &mut Resolver 'arena, node: *ast::Node, call: ast::Call, info: *FnType, ctx: CallCtx)
    throws (ResolveError)
{
    if ctx == CallCtx::Normal and info.throwList.len > 0 {
        throw emitError(self, node, ErrorKind::MissingTry);
    }
    if call.args.len <> info.paramTypes.len as u32 {
        throw emitError(self, node, ErrorKind::FnArgCountMismatch(CountMismatch {
            expected: info.paramTypes.len as u32,
            actual: call.args.len,
        }));
    }
    for argNode, i in call.args {
        let expectedTy = *info.paramTypes[i];

        try checkAssignable(self, argNode, expectedTy);
    }
}

/// Return whether a value can be discarded by bulk arena reclamation.
/// Pointer lifetimes are checked when their values are constructed.
unsafe fn isBulkDiscardable(ty: Type) -> bool {
    match ty {
        case Type::Void, Type::Bool, Type::U8, Type::U16, Type::U32, Type::U64,
             Type::I8, Type::I16, Type::I32, Type::I64, Type::Fn(_) => return true,
        case Type::Pointer { .. }, Type::Slice { .. }, Type::TraitObject { .. } => return true,
        case Type::Cell { .. } => return true,
        case Type::Array(array) => return isBulkDiscardable(*array.item),
        case Type::Optional(inner) => return isBulkDiscardable(*inner),
        case Type::Nominal(NominalType::Record(recordType)) => {
            if recordType.declaredLinear {
                return false;
            }
            for field in recordType.fields {
                if not isBulkDiscardable(field.fieldType) {
                    return false;
                }
            }
            return true;
        }
        case Type::Nominal(NominalType::Union(unionType)) => {
            if unionType.declaredLinear {
                return false;
            }
            for variant in unionType.variants {
                if not isBulkDiscardable(variant.valueType) {
                    return false;
                }
            }
            return true;
        }
        else => return false,
    }
}

/// Compute the end of an aligned layout within the allocator's byte-count range.
fn allocationLayoutEnd(offset: u64, layout: Layout) -> ?u64 {
    let mut aligned = offset;
    if layout.alignment > 0 {
        let mask = (layout.alignment - 1) as u64;
        set aligned = (offset + mask) & ~mask;
    }
    let end = aligned + layout.size as u64;
    if end > 4294967295 {
        return nil;
    }
    return end;
}

/// Check allocation layout arithmetic independently of the stored narrow offsets.
unsafe fn hasAllocationLayout(ty: Type) -> bool {
    let layout = getTypeLayout(ty);
    match ty {
        case Type::Cell { .. } => return true,
        case Type::Array(array) => {
            if not hasAllocationLayout(*array.item) {
                return false;
            }
            let item = getTypeLayout(*array.item);
            return item.size as u64 * array.length as u64 == layout.size as u64;
        }
        case Type::Optional(inner) => {
            if not hasAllocationLayout(*inner) {
                return false;
            }
            if isNullableType(*inner) {
                return true;
            }
            let end = allocationLayoutEnd(1, getTypeLayout(*inner)) else return false;
            let total = allocationLayoutEnd(end, Layout { size: 0, alignment: layout.alignment }) else return false;
            return total == layout.size as u64;
        }
        case Type::Nominal(NominalType::Record(recordType)) => {
            let mut offset: u64 = 0;
            for field in recordType.fields {
                if not hasAllocationLayout(field.fieldType) {
                    return false;
                }
                let fieldLayout = getTypeLayout(field.fieldType);
                let end = allocationLayoutEnd(offset, fieldLayout) else return false;
                let start = end - fieldLayout.size as u64;
                if start > 2147483647 or field.offset < 0 or start <> field.offset as u64 {
                    return false;
                }
                set offset = end;
            }
            let total = allocationLayoutEnd(offset, Layout { size: 0, alignment: layout.alignment }) else return false;
            return total == layout.size as u64;
        }
        case Type::Nominal(NominalType::Union(unionType)) => {
            let mut payloadSize: u32 = 0;
            let mut alignment: u32 = 1;
            for variant in unionType.variants {
                if not hasAllocationLayout(variant.valueType) {
                    return false;
                }
                let item = getTypeLayout(variant.valueType);
                set payloadSize = max(payloadSize, item.size);
                set alignment = max(alignment, item.alignment);
            }
            let end = allocationLayoutEnd(1, Layout { size: payloadSize, alignment }) else return false;
            let total = allocationLayoutEnd(end, Layout { size: 0, alignment }) else return false;
            return total == layout.size as u64 and end - payloadSize as u64 == unionType.valOffset as u64;
        }
        else => return true,
    }
}

/// Validate the reservation ABI used by typed session allocation.
unsafe fn sessionRuntime 'arena (
    self: &mut Resolver 'arena, node: *ast::Node, slice: bool
) -> TraitMethod
    throws (ResolveError)
{
    let allocTrait = allocationSymbol(self, "Alloc")
        else throw emitError(self, node, ErrorKind::InvalidAllocationRuntime);
    let case SymbolData::Trait(allocInfo) = allocTrait.data
        else throw emitError(self, node, ErrorKind::InvalidAllocationRuntime);
    let name = "reserveSlice" if slice else "reserve";
    let method = findTraitMethod(&allocInfo.methods[..], name)
        else throw emitError(self, node, ErrorKind::InvalidAllocationRuntime);
    let error = allocationSymbol(self, "AllocError")
        else throw emitError(self, node, ErrorKind::InvalidAllocationRuntime);
    let case SymbolData::Type(errorType) = error.data
        else throw emitError(self, node, ErrorKind::InvalidAllocationRuntime);
    let count: u32 = 3 if slice else 2;
    let info = method.fnType;
    if info.regions <> nil or not info.isUnsafe or info.paramTypes.len <> count or info.throwList.len <> 1 {
        throw emitError(self, node, ErrorKind::InvalidAllocationRuntime);
    }
    if not typesEqual(*info.throwList[0], Type::Nominal(errorType)) {
        throw emitError(self, node, ErrorKind::InvalidAllocationRuntime);
    }
    for i in 0..count {
        if *info.paramTypes[i] <> Type::U32 {
            throw emitError(self, node, ErrorKind::InvalidAllocationRuntime);
        }
    }
    let expected = Type::Slice { class: types::PointerClass::Unsafe, item: allocType(self, Type::Opaque), mutable: true }
        if slice else Type::Pointer {
            class: types::PointerClass::Unsafe, target: allocType(self, Type::Opaque), mutable: true
        };
    if not typesEqual(*info.returnType, expected) {
        throw emitError(self, node, ErrorKind::InvalidAllocationRuntime);
    }
    return method;
}

/// Check initialized session allocation and retain its source region in the result.
unsafe fn resolveSessionAllocation 'arena (
    self: &mut Resolver 'arena, node: *ast::Node, call: ast::Call, access: ast::Access,
    region: *unsafe types::Region, ctx: CallCtx, hint: Type
) -> Type throws (ResolveError) {
    let name = try nodeName(self, access.child);
    let mut kind = SessionAllocationKind::New;
    if mem::eq(name, "copy") {
        set kind = SessionAllocationKind::Copy;
    }
    else if mem::eq(name, "fill") {
        set kind = SessionAllocationKind::Fill;
    }
    else if not mem::eq(name, "new") {
        throw emitError(self, access.child, ErrorKind::UnresolvedSymbol(name));
    }
    let count: u32 = 2 if kind == SessionAllocationKind::Fill else 1;
    if call.args.len <> count {
        throw emitError(self, node, ErrorKind::FnArgCountMismatch(CountMismatch { expected: count, actual: call.args.len }));
    }
    let slice = kind <> SessionAllocationKind::New;
    let mut itemHint = Type::Unknown;
    if kind == SessionAllocationKind::New {
        if let case Type::Pointer { target, .. } = hint {
            set itemHint = *target;
        }
    } else if kind == SessionAllocationKind::Fill {
        if let case Type::Slice { item, .. } = hint {
            set itemHint = *item;
        }
    } else {
        set itemHint = Type::Slice {
            class: types::PointerClass::Ref, item: allocType(self, Type::Unknown), mutable: false,
        };
    }
    let valueType = try visit(self, call.args[0], itemHint);
    let mut itemType = valueType;
    let mut parameter = valueType;
    if kind == SessionAllocationKind::Copy {
        let case Type::Slice { item, .. } = valueType
            else throw emitError(self, call.args[0], ErrorKind::ExpectedIndexable);
        set itemType = *item;
        set parameter = Type::Slice { class: types::PointerClass::Ref, item, mutable: false };
    }
    if not isTypeInferrable(itemType) or itemType == Type::Void or itemType == Type::Opaque {
        throw emitError(self, call.args[0], ErrorKind::CannotInferType);
    }
    try ensureStorableType(self, call.args[0], itemType);
    try ensureTypeResolved(self, itemType, call.args[0]);
    try validateRegionStorage(self, call.args[0], itemType, region);
    if not isBulkDiscardable(itemType) or (slice and not isCopy(itemType)) {
        throw emitError(self, call.args[0], ErrorKind::InvalidAllocationValue);
    }
    if not hasAllocationLayout(itemType) {
        throw emitError(self, call.args[0], ErrorKind::InvalidAllocationLayout);
    }
    let runtime = try sessionRuntime(self, node, slice);
    let runtimeType = runtime.fnType;
    let item = allocType(self, itemType);
    let result = Type::Slice { class: types::PointerClass::Region(region), item, mutable: true }
        if slice else Type::Pointer {
            class: types::PointerClass::Region(region), target: item, mutable: true
        };
    let a = alloc::arenaAllocator(self.arena);
    let mut parameters: *mut [*Type] = &mut [];
    parameters.append(allocType(self, parameter), a);
    if kind == SessionAllocationKind::Fill {
        parameters.append(allocType(self, Type::U32), a);
    }
    let info = allocFnType(self, FnType {
        regions: nil, paramTypes: &parameters[..], returnType: allocType(self, result),
        throwList: runtimeType.throwList, isUnsafe: false,
    });
    try checkCallArgs(self, node, call, info, ctx);
    setNodeType(self, call.callee, Type::Fn(info));
    let allocTrait = allocationSymbol(self, "Alloc") else panic;
    let case SymbolData::Trait(traitInfo) = allocTrait.data else panic;
    set self.nodeData.entries[node.id].extra = NodeExtra::SessionAllocation(SessionAllocation {
        kind, item, traitInfo, methodIndex: runtime.index,
    });
    return setNodeType(self, node, result);
}

/// Require a complete, bulk-discardable cell payload, and Copy when unassociated.
unsafe fn validateCellPayload 'arena (
    self: &mut Resolver 'arena,
    node: *ast::Node,
    payload: Type,
    permission: ?*unsafe types::Region,
) throws (ResolveError) {
    try ensureStorableType(self, node, payload);
    try ensureTypeResolved(self, payload, node);
    if not isTypeInferrable(payload) or payload == Type::Void or payload == Type::Opaque
        or (permission == nil and not isCopy(payload)) or not isBulkDiscardable(payload)
    {
        throw emitError(self, node, ErrorKind::InvalidCellPayload);
    }
    if not hasAllocationLayout(payload) {
        throw emitError(self, node, ErrorKind::InvalidAllocationLayout);
    }
}

/// Analyze a function call expression.
unsafe fn resolveCall 'arena (self: &mut Resolver 'arena, node: *ast::Node, call: ast::Call, ctx: CallCtx, hint: Type) -> Type
    throws (ResolveError)
{
    // Intercept method calls on slices before inferring the callee.
    if let case ast::NodeValue::FieldAccess(access) = call.callee.value {
        let parentTy = try infer(self, access.parent);
        if isUnsafePointerType(parentTy) {
            try requireUnsafe(self, access.parent);
        }
        let subjectTy = autoDeref(parentTy);
        if let case Type::Session(region) = subjectTy {
            return try resolveSessionAllocation(self, node, call, access, region, ctx, hint);
        }

        if let case Type::Slice { item, mutable, .. } = subjectTy {
            let methodName = try nodeName(self, access.child);
            if methodName == "append" {
                return try resolveSliceAppend(
                    self, node, access.parent, parentTy, call.args, item, mutable
                );
            }
            if methodName == "delete" {
                return try resolveSliceDelete(
                    self, node, access.parent, call.args, item, mutable
                );
            }
        }
    }
    let calleeTy = try visit(self, call.callee, hint);
    if let case Type::Fn(info) = calleeTy {
        try checkUnsafeCall(self, call.callee, info);
    }

    // Check if callee is a union variant and dispatch to constructor handler.
    // TODO: Move this out. We should decide on this earlier, based on the callee.
    if let calleeSym = symbolFor(self, call.callee) {
        if let case SymbolData::Variant { decl, .. } = calleeSym.data {
            // TODO: Don't pass the callee type, pass the union type by getting it from
            // the symbol.
            let case Type::Nominal(ty) = calleeTy else panic "resolveCall: invalid variant type";
            return try resolveUnionConstructorCall(self, node, call, ty);
        }
        // Check if callee is an unlabeled record type for constructor call syntax.
        if let case SymbolData::Type(_) = calleeSym.data {
            let case Type::Nominal(ty) = calleeTy else panic "resolveCall: invalid type callee";
            try requireNominalArguments(self, ty, call.callee);
            // Ensure the record body is resolved before checking if labeled.
            try ensureNominalResolved(self, ty, call.callee);
            if let case NominalType::Record(recInfo) = *ty {
                if not recInfo.labeled {
                    return try resolveRecordConstructorCall(self, node, call, ty);
                }
            }
        }
    }

    // Check if we have a trait method call, ie. callee is a trait object.
    if let case ast::NodeValue::FieldAccess(access) = call.callee.value {
        let mut parentTy = Type::Unknown;
        if let t = typeFor(self, access.parent) {
            set parentTy = t;
        }
        let subjectTy = autoDeref(parentTy);

        if let case Type::TraitObject { traitInfo, mutable: objMutable, .. } = subjectTy {
            let methodName = try nodeName(self, access.child);
            let method = findTraitMethod(&traitInfo.methods[..], methodName)
                else throw emitError(self, access.child, ErrorKind::RecordFieldUnknown(methodName));

            // Reject mutable-receiver methods called on immutable trait objects.
            if method.mutable {
                if not objMutable or not try canMutateThrough(self, access.parent) {
                    throw emitError(self, access.parent, ErrorKind::ImmutableBinding);
                }
            }
            let applied = try instantiateCall(self, node, call, method.fnType);
            try resolveInlineTypeViews(self, *applied.returnType, node);
            try checkCallArgs(self, node, call, applied, ctx);
            setNodeType(self, call.callee, Type::Fn(applied));
            setTraitMethodCall(self, node, traitInfo, method.index);

            return setNodeType(self, node, *applied.returnType);
        }

        // Check for a standalone method call on a concrete type.
        if let case Type::Nominal(_) = subjectTy {
            let methodName = try nodeName(self, access.child);
            if let method = findMethod(self, subjectTy, methodName) {
                // Reject mutable-receiver methods on immutable bindings.
                // If the parent is already a mutable pointer, the receiver is fine.
                // Otherwise, check that the parent can yield a mutable borrow.
                if method.mutable {
                    if not try canMutateThrough(self, access.parent) {
                        throw emitError(self, access.parent, ErrorKind::ImmutableBinding);
                    }
                }
                // Check arguments (excluding receiver).
                let applied = try instantiateMethodCall(
                    self, node, call, access.parent, subjectTy, method
                );
                try resolveInlineTypeViews(self, *applied.returnType, node);
                try checkCallArgs(self, node, call, applied, ctx);
                setNodeType(self, call.callee, Type::Fn(applied));
                set self.nodeData.entries[node.id].extra = NodeExtra::MethodCall { method };

                return setNodeType(self, node, *applied.returnType);
            }
        }
    }
    let case Type::Fn(info) = calleeTy else {
        throw emitError(self, call.callee, ErrorKind::TypeMismatch(TypeMismatch {
            expected: Type::Unknown,
            actual: calleeTy,
        }));
    };
    let applied = try instantiateCall(self, node, call, info);
    try resolveInlineTypeViews(self, *applied.returnType, node);
    try checkCallArgs(self, node, call, applied, ctx);
    // Associate function type to callee.
    setNodeType(self, call.callee, Type::Fn(applied));

    // Associate return type to call.
    return setNodeType(self, node, *applied.returnType);
}

/// Check labeled record fields against the slice allocator layout and callback ABI.
fn isSliceAllocator(fields: &[RecordField]) -> bool {
    if fields.len <> 2 {
        return false;
    }
    let func = fields[0];
    let ctx = fields[1];
    let funcName = func.name else return false;
    let ctxName = ctx.name else return false;
    if not mem::eq(funcName, "func") or not mem::eq(ctxName, "ctx") or
       func.offset <> 0 or ctx.offset <> 8
    {
        return false;
    }
    let case Type::Fn(callback) = func.fieldType else return false;
    let case Type::Pointer { target, .. } = ctx.fieldType else return false;
    if *target <> Type::Opaque or callback.paramTypes.len <> 3 or callback.throwList.len <> 0 {
        return false;
    }
    if not typesEqual(*callback.paramTypes[0], ctx.fieldType) or
       *callback.paramTypes[1] <> Type::U32 or *callback.paramTypes[2] <> Type::U32
    {
        return false;
    }
    let case Type::Pointer { class, target: result, mutable } = *callback.returnType
        else return false;
    return class == types::PointerClass::Owned and mutable and *result == Type::Opaque;
}

/// Resolve `slice.append(val, allocator)`.
unsafe fn resolveSliceAppend 'arena (
    self: &mut Resolver 'arena,
    node: *ast::Node,
    parent: *ast::Node,
    parentType: Type,
    args: *[*ast::Node],
    elemType: *Type,
    mutable: bool
) -> Type throws (ResolveError) {
    if not mutable {
        throw emitError(self, parent, ErrorKind::ImmutableBinding);
    }
    if args.len <> 2 {
        throw emitError(self, node, ErrorKind::FnArgCountMismatch(CountMismatch {
            expected: 2,
            actual: args.len as u32,
        }));
    }
    // First argument must be assignable to the element type.
    try checkAssignable(self, args[0], *elemType);
    // The allocator stores its callback and context at fixed offsets.
    let allocatorTy = try infer(self, args[1]);
    if let case Type::Nominal(info) = allocatorTy {
        try ensureNominalResolved(self, info, args[1]);
    }
    let mut validAllocator = false;
    if let case Type::Nominal(NominalType::Record(rec)) = allocatorTy; rec.labeled {
        set validAllocator = isSliceAllocator(&rec.fields[..]);
    }
    if not validAllocator {
        throw emitError(self, args[1], ErrorKind::InvalidSliceAllocator);
    }
    set self.nodeData.entries[node.id].extra = NodeExtra::SliceAppend { elemType };

    // Return the parent's type so the caller can rebind:
    return setNodeType(self, node, parentType);
}

/// Resolve `slice.delete(index)`.
unsafe fn resolveSliceDelete 'arena (
    self: &mut Resolver 'arena,
    node: *ast::Node,
    parent: *ast::Node,
    args: *[*ast::Node],
    elemType: *Type,
    mutable: bool
) -> Type throws (ResolveError) {
    if not mutable {
        throw emitError(self, parent, ErrorKind::ImmutableBinding);
    }
    if args.len <> 1 {
        throw emitError(self, node, ErrorKind::FnArgCountMismatch(CountMismatch {
            expected: 1,
            actual: args.len as u32,
        }));
    }
    try checkAssignable(self, args[0], Type::U32);
    set self.nodeData.entries[node.id].extra = NodeExtra::SliceDelete { elemType };

    return setNodeType(self, node, Type::Void);
}

/// Analyze an assignment expression.
unsafe fn resolveAssign 'arena (self: &mut Resolver 'arena, node: *ast::Node, assign: ast::Assign) -> Type
    throws (ResolveError)
{
    // Slice assignment: `slice[range] = value`.
    if let case ast::NodeValue::Subscript { container, index } = assign.left.value {
        if let case ast::NodeValue::Range(range) = index.value {
            try infer(self, index);
            let containerTy = try infer(self, container);
            let cellTy = try inferCellPayload(self, container);
            if cellTy == nil and not try canMutateThrough(self, container) {
                throw emitError(self, container, ErrorKind::ImmutableBinding);
            }
            let subjectTy = autoDeref(containerTy);
            try checkSliceRangeIndices(self, range);

            let info = sliceRangeInfo(subjectTy)
                else throw emitError(self, container, ErrorKind::ExpectedIndexable);
            if not info.mutable {
                throw emitError(self, container, ErrorKind::ImmutableBinding);
            }
            if let capacity = info.capacity {
                try validateArraySliceBounds(self, range, capacity, node);
            }
            let item = info.itemType;
            // RHS is either a fill value or a source slice.
            let rhsTy = try infer(self, assign.right);
            if let case Type::Slice { item: sourceItem, .. } = rhsTy {
                if *sourceItem <> *item {
                    throw emitTypeMismatch(
                        self,
                        assign.right,
                        TypeMismatch { expected: *item, actual: *sourceItem },
                    );
                }
            } else {
                try checkAssignable(self, assign.right, *item);
            }
            if let controlled = cellTy {
                let case Type::Cell { class, .. } = controlled
                    else panic "resolveAssign: invalid cell range payload";
                if let case types::PointerClass::Region(region) = class {
                    try validateRegionStorage(self, assign.right, *item, region);
                } else if class == types::PointerClass::Owned
                    and try containsStorageRegion(self, assign.right, *item)
                {
                    throw emitError(self, assign.right, ErrorKind::InvalidCellPayload);
                }
            } else {
                try validateRegionalStore(self, assign.left, assign.right, *item);
            }
            setSliceRangeInfo(self, node, info);
            setNodeType(self, assign.left, *item);

            return setNodeType(self, node, Type::Void);
        }
    }
    let leftTy = try infer(self, assign.left);

    if let cellTy = try inferCellPayload(self, assign.left) {
        let case Type::Cell { class, .. } = cellTy
            else panic "resolveAssign: invalid cell payload";
        try checkAssignable(self, assign.right, leftTy);
        if let case types::PointerClass::Region(region) = class {
            try validateRegionStorage(self, assign.right, leftTy, region);
        } else if class == types::PointerClass::Owned
            and try containsStorageRegion(self, assign.right, leftTy)
        {
            throw emitError(self, assign.right, ErrorKind::InvalidCellPayload);
        }
        return setNodeType(self, node, leftTy);
    }

    // Check if the left-hand side can be assigned to by checking if it's a mutable location.
    if not try canBorrowMutFrom(self, assign.left) {
        throw emitError(self, assign.left, ErrorKind::ImmutableBinding);
    }
    try checkAssignable(self, assign.right, leftTy);
    try validateRegionalStore(self, assign.left, assign.right, leftTy);

    return setNodeType(self, node, leftTy);
}

/// Construct complete range metadata for an array or slice type.
/// Callers check array place access and select the resulting borrow access.
fn sliceRangeInfo(ty: Type) -> ?SliceRangeInfo {
    match ty {
        case Type::Slice { item, mutable, .. } =>
            return SliceRangeInfo { itemType: item, mutable, capacity: nil },
        case Type::Array(array) =>
            return SliceRangeInfo { itemType: array.item, mutable: true, capacity: array.length },
        else => return nil,
    }
}

/// Ensure slice range bounds are valid `u32` values.
unsafe fn checkSliceRangeIndices 'arena (self: &mut Resolver 'arena, range: ast::Range) throws (ResolveError) {
    if let start = range.start {
        try checkIndex(self, start);
    }
    if let end = range.end {
        try checkIndex(self, end);
    }
}

/// Emit an error when constant slice bounds exceed the array length or are reversed.
fn validateArraySliceBounds 'arena (self: &mut Resolver 'arena, range: ast::Range, length: u32, site: *ast::Node) throws (ResolveError) {
    let mut startVal: ?u32 = nil;
    let mut endVal: ?u32 = length;

    if let startNode = range.start {
        if let val = constSliceIndex(self, startNode) {
            set startVal = val;
        }
    }
    if let endNode = range.end {
        if let val = constSliceIndex(self, endNode) {
            set endVal = val;
        }
    }
    if let val = startVal; val > length {
        throw emitError(self, site, ErrorKind::SliceRangeOutOfBounds);
    }
    if let val = endVal; val > length {
        throw emitError(self, site, ErrorKind::SliceRangeOutOfBounds);
    }
    if let start = startVal {
        if let end = endVal; start > end {
            throw emitError(self, site, ErrorKind::SliceRangeOutOfBounds);
        }
    }
}

/// Check that an index expression has an unsigned integer type.
/// Accepts `u8`, `u16`, `u32` and unsuffixed integer literals.
/// Smaller types are widened to `u32` via a numeric cast coercion.
unsafe fn checkIndex 'arena (self: &mut Resolver 'arena, indexNode: *ast::Node) throws (ResolveError) {
    let indexTy = try visit(self, indexNode, Type::U32);
    if indexTy == Type::Int or indexTy == Type::U32 {
        let _ = try expectAssignable(self, Type::U32, indexTy, indexNode);
        return;
    }
    match indexTy {
        case Type::U8, Type::U16 => {
            setNodeCoercion(self, indexNode, Coercion::NumericCast {
                from: indexTy, to: Type::U32,
            });
        }
        else => {
            throw emitTypeMismatch(self, indexNode, TypeMismatch {
                expected: Type::U32,
                actual: indexTy,
            });
        }
    }
}

/// Analyze an array or slice subscript expression.
unsafe fn resolveSubscript 'arena (self: &mut Resolver 'arena, node: *ast::Node, container: *ast::Node, indexNode: *ast::Node) -> Type
    throws (ResolveError)
{
    // Range subscripts always require `&` to form a slice.
    if let case ast::NodeValue::Range(range) = indexNode.value {
        let _ = try infer(self, indexNode);
        let _ = try infer(self, container);
        try checkSliceRangeIndices(self, range);
        throw emitError(self, node, ErrorKind::SliceRequiresAddress);
    }
    let containerTy = try infer(self, container);
    if isUnsafePointerType(containerTy) {
        try requireUnsafe(self, container);
    }
    try checkIndex(self, indexNode);
    let subjectTy = autoDeref(containerTy);
    if let case Type::Slice { item, .. } = subjectTy {
        return setNodeType(self, node, *item);
    }

    match subjectTy {
        case Type::Array(arrayInfo) => {
            return setNodeType(self, node, *arrayInfo.item);
        }
        else => {
            throw emitError(self, container, ErrorKind::ExpectedIndexable);
        }
    }
}

/// Find a record field by name.
fn findRecordField(fields: &[RecordField], fieldName: *[u8]) -> ?u32 {
    for field, i in fields {
        if let name = field.name {
            if name == fieldName {
                return i;
            }
        }
    }
    return nil;
}

/// Analyze a union constructor call with payload.
unsafe fn resolveUnionConstructorCall 'arena (self: &mut Resolver 'arena, node: *ast::Node, call: ast::Call, unionNominal: *unsafe NominalType) -> Type
    throws (ResolveError)
{
    // Get the union nominal type.
    let case NominalType::Union(unionType) = *unionNominal
        else panic "resolveUnionConstructorCall: not a union type";

    // Callee was already visited; get the variant index it set.
    let case NodeExtra::UnionVariant { ordinal: index, tag } = self.nodeData.entries[call.callee.id].extra else {
        throw emitError(self, call.callee, ErrorKind::Internal);
    };
    let variant = &unionType.variants[index];

    // Associate variant index with `call` node for the lowerer.
    setVariantInfo(self, node, index, tag);

    // Check if this variant expects a payload.
    let payloadType = variant.valueType;
    if payloadType <> Type::Void {
        try ensureTypeResolved(self, payloadType, node);
        let recInfo = getRecord(payloadType)
            else panic "resolveUnionVariantConstructor: payload is not a record";
        try checkRecordConstructorArgs(self, node, call.args, recInfo);
    } else {
        if call.args.len > 0 {
            throw emitError(self, node, ErrorKind::UnionVariantPayloadUnexpected(variant.name));
        }
    }
    return setNodeType(self, node, Type::Nominal(unionNominal));
}

/// Analyze an unlabeled record constructor call.
///
/// Handles the syntax `R(a, b)` for unlabeled records, checking that the
/// number of arguments matches the record's field count and that each argument
/// is assignable to its corresponding field type.
unsafe fn resolveRecordConstructorCall 'arena (self: &mut Resolver 'arena, node: *ast::Node, call: ast::Call, recordType: *unsafe NominalType) -> Type
    throws (ResolveError)
{
    let case NominalType::Record(recInfo) = *recordType
        else panic "resolveRecordConstructorCall: not a record type";

    try requireRecordAccess(self, node, recInfo);
    try checkRecordConstructorArgs(self, node, call.args, recInfo);
    return setNodeType(self, node, Type::Nominal(recordType));
}

/// Resolve the type name of a record literal, handling both record types and
/// union variant payloads like `Union::Variant { ... }`.
unsafe fn resolveRecordLitType 'arena (
    self: &mut Resolver 'arena, node: *ast::Node, typeIdent: *ast::Node, hint: Type
) -> ResolvedRecordLitType
    throws (ResolveError)
{
    if let case ast::NodeValue::RegionApply { .. } = typeIdent.value {
        let ty = try infer(self, typeIdent);
        let case Type::Nominal(info) = ty else throw emitError(self, node, ErrorKind::ExpectedRecord);
        return ResolvedRecordLitType { recordType: info, resultType: ty };
    }
    // Check if this is a scope access that might be a union variant.
    if let case ast::NodeValue::ScopeAccess(access) = typeIdent.value {
        let scope = self.scope;
        let sym = try resolveAccess(self, typeIdent, access, scope);

        // Check if resolved symbol is a union variant.
        if let case SymbolData::Variant { type, decl, ordinal, index } = sym.data {
            let sourceTy = typeFor(self, typeIdent) else panic "resolveRecordLitType: missing union type";
            let case Type::Nominal(source) = sourceTy else panic "resolveRecordLitType: invalid union type";
            let unionNominalType = hintedNominal(source, hint);
            try requireNominalArguments(self, unionNominalType, typeIdent);
            try ensureNominalResolved(self, unionNominalType, typeIdent);
            let case NominalType::Union(body) = *unionNominalType else panic;
            let case Type::Nominal(payloadInfo) = body.variants[ordinal].valueType
                else throw emitError(self, node, ErrorKind::ExpectedRecord);

            // Store the variant index for the lowerer.
            setVariantInfo(self, node, ordinal, index);

            return ResolvedRecordLitType {
                recordType: payloadInfo,
                resultType: Type::Nominal(unionNominalType),
            };
        }
        // Not a variant, must be a type.
        let case SymbolData::Type(ty) = sym.data
            else throw emitError(self, node, ErrorKind::ExpectedRecord);
        return ResolvedRecordLitType {
            recordType: ty,
            resultType: Type::Nominal(ty),
        };
    }
    // Simple identifier, resolve as type name.
    let tyInfo = try resolveTypeName(self, typeIdent);
    return ResolvedRecordLitType {
        recordType: tyInfo,
        resultType: Type::Nominal(tyInfo),
    };
}

/// Analyze a record literal expression.
unsafe fn resolveRecordLit 'arena (self: &mut Resolver 'arena, node: *ast::Node, lit: ast::RecordLit, hint: Type) -> Type
    throws (ResolveError)
{
    // If no type name, infer an anonymous tuple type.
    let typeIdent = lit.typeName else {
        return try resolveAnonRecordLit(self, node, lit, hint);
    };
    // Resolve the type name, handling both record types and union variants.
    let resolved = try resolveRecordLitType(self, node, typeIdent, hint);
    let mut tyInfo = resolved.recordType;
    let mut resultType = resolved.resultType;
    let mut target = hint;
    if let case Type::Optional(inner) = target {
        set target = *inner;
    }
    if nominalApplication(tyInfo) == nil {
        if let case Type::Nominal(info) = target {
            if let applied = nominalApplication(info); applied.base == tyInfo {
                set tyInfo = info;
                set resultType = target;
            }
        }
    }
    try requireNominalArguments(self, tyInfo, typeIdent);

    // Lazily resolve record body if not yet done.
    try ensureNominalResolved(self, tyInfo, typeIdent);
    let case NominalType::Record(recordType) = *tyInfo
        else throw emitError(self, node, ErrorKind::ExpectedRecord);

    try requireRecordAccess(self, node, recordType);
    // Unlabeled records must use constructor call syntax `R(...)`, not brace syntax.
    if not recordType.labeled {
        throw emitError(self, node, ErrorKind::RecordFieldStyleMismatch);
    }
    // Check field count. With `{ .. }` syntax, fewer fields are allowed.
    if lit.fields.len > recordType.fields.len {
        throw emitError(self, node, ErrorKind::RecordFieldCountMismatch(CountMismatch {
            expected: recordType.fields.len as u32,
            actual: lit.fields.len,
        }));
    }
    if not lit.ignoreRest and lit.fields.len < recordType.fields.len {
        let missingName = recordType.fields[lit.fields.len].name else panic;
        throw emitError(self, node, ErrorKind::RecordFieldMissing(missingName));
    }

    // Fields must be in declaration order.
    for fieldNode, idx in lit.fields {
        let case ast::NodeValue::RecordLitField(fieldArg) = fieldNode.value
            else panic "resolveRecordLit: expected field node value";
        let label = fieldArg.label
            else panic "resolveRecordLit: expected labeled field";
        let fieldName = try nodeName(self, label);
        let expected = recordType.fields[idx];
        let expectedName = expected.name else panic;

        if fieldName <> expectedName {
            throw emitError(self, fieldNode, ErrorKind::RecordFieldOutOfOrder {
                field: fieldName,
                prev: expectedName,
            });
        }
        setRecordFieldIndex(self, fieldNode, idx);
        try checkAssignable(self, fieldArg.value, expected.fieldType);
        setNodeType(self, fieldNode, expected.fieldType);
    }
    return setNodeType(self, node, resultType);
}

/// Analyze an anonymous record literal, checking fields against the hint type.
unsafe fn resolveAnonRecordLit 'arena (self: &mut Resolver 'arena, node: *ast::Node, lit: ast::RecordLit, hint: Type) -> Type
    throws (ResolveError)
{
    // Unwrap optional hint to get the inner record type.
    let mut innerHint = hint;
    if let case Type::Optional(inner) = hint {
        set innerHint = *inner;
    }
    let mut hintInfo: ?RecordType = nil;
    if let case Type::Nominal(info) = innerHint {
        try ensureNominalResolved(self, info, node);
        if let case NominalType::Record(s) = *info {
            set hintInfo = s;
        }
    }
    let targetInfo = hintInfo else {
        throw emitError(self, node, ErrorKind::CannotInferType);
    };

    try requireRecordAccess(self, node, targetInfo);
    // Check field count.
    if lit.fields.len <> targetInfo.fields.len {
        if lit.fields.len < targetInfo.fields.len {
            let missingName = targetInfo.fields[lit.fields.len].name else panic;
            throw emitError(self, node, ErrorKind::RecordFieldMissing(missingName));
        } else {
            throw emitError(self, node, ErrorKind::RecordFieldCountMismatch(CountMismatch {
                expected: targetInfo.fields.len as u32,
                actual: lit.fields.len,
            }));
        }
    }

    // Fields must be in declaration order.
    for fieldNode, idx in lit.fields {
        let case ast::NodeValue::RecordLitField(fieldArg) = fieldNode.value
            else panic "resolveAnonRecordLit: expected field node value";
        let label = fieldArg.label
            else panic "resolveAnonRecordLit: expected labeled field";
        let fieldName = try nodeName(self, label);
        let expected = targetInfo.fields[idx];
        let expectedName = expected.name else panic;

        if fieldName <> expectedName {
            throw emitError(self, fieldNode, ErrorKind::RecordFieldOutOfOrder {
                field: fieldName,
                prev: expectedName,
            });
        }
        setRecordFieldIndex(self, fieldNode, idx);
        let fieldType = try visit(self, fieldArg.value, expected.fieldType);

        try expectAssignable(self, expected.fieldType, fieldType, fieldArg.value);
        setNodeType(self, fieldNode, fieldType);
    }
    return setNodeType(self, node, innerHint);
}

/// Analyze an array literal expression.
unsafe fn resolveArrayLit 'arena (self: &mut Resolver 'arena, node: *ast::Node, items: *[*ast::Node], hint: Type) -> Type
    throws (ResolveError)
{
    let length = items.len;
    let mut expectedTy: Type = Type::Unknown;

    if let case Type::Array(ary) = hint {
        set expectedTy = *ary.item;
    } else if let case Type::Optional(inner) = hint {
        if let case Type::Array(ary) = *inner {
            set expectedTy = *ary.item;
        }
    };
    for itemNode in items {
        let itemTy = try visit(self, itemNode, expectedTy);
        assert itemTy <> Type::Unknown;

        // Set the expected type to the first type we encounter.
        if expectedTy == Type::Unknown {
            set expectedTy = itemTy;
        } else {
            try expectAssignable(self, expectedTy, itemTy, itemNode);
        }
    }
    if expectedTy == Type::Unknown {
        throw emitError(self, node, ErrorKind::CannotInferType);
    };
    let arrayTy = Type::Array(ArrayType { item: allocType(self, expectedTy), length });
    return setNodeType(self, node, arrayTy);
}

/// Analyze an array repeat literal expression.
unsafe fn resolveArrayRepeat 'arena (self: &mut Resolver 'arena, node: *ast::Node, lit: ast::ArrayRepeatLit, hint: Type) -> Type
    throws (ResolveError)
{
    let mut itemHint = hint;
    if let case Type::Array(ary) = hint {
        set itemHint = *ary.item;
    } else if let case Type::Optional(inner) = hint {
        if let case Type::Array(ary) = *inner {
            set itemHint = *ary.item;
        }
    }
    let valueTy = try visit(self, lit.item, itemHint);
    let count = try checkSizeInt(self, lit.count);
    let arrayTy = Type::Array(ArrayType {
        item: allocType(self, valueTy),
        length: count,
    });
    return setNodeType(self, node, arrayTy);
}

/// Resolve union variant access.
unsafe fn resolveUnionVariantAccess 'arena (
    self: &mut Resolver 'arena,
    node: *ast::Node,
    access: ast::Access,
    unionType: UnionType,
    variantName: *[u8]
) -> *unsafe mut Symbol throws (ResolveError) {
    // Look up the variant in the union's nominal type.
    for i in 0..unionType.variants.len {
        let variant = &unionType.variants[i];
        if variant.name == variantName {
            let case SymbolData::Variant { ordinal, index, .. } = variant.symbol.data
                else panic "resolveUnionVariantAccess: expected variant symbol";

            // Associate the variant symbol with the child node.
            setNodeSymbol(self, access.child, variant.symbol);
            setNodeSymbol(self, node, variant.symbol);

            // Store the variant index for the lowerer.
            setVariantInfo(self, node, ordinal, index);

            return variant.symbol;
        }
    }
    throw emitError(self, access.child, ErrorKind::UnresolvedSymbol(variantName));
}

/// Analyze a scope access expression.
unsafe fn resolveScopeAccess 'arena (self: &mut Resolver 'arena, node: *ast::Node, access: ast::Access, hint: Type) -> Type
    throws (ResolveError)
{
    let scope = self.scope;
    let sym = try resolveAccess(self, node, access, scope);
    try checkStaticAccess(self, node, sym);
    let mut ty: Type = undefined;

    match sym.data {
        case SymbolData::Value { type, .. } => {
            setNodeSymbol(self, node, sym);
            set ty = type;
        }
        case SymbolData::Constant { type, value } => {
            // Propagate the constant value.
            if let val = value {
                setNodeConstValue(self, node, val);
            }
            setNodeSymbol(self, node, sym);
            set ty = type;
        }
        case SymbolData::Type(t) => {
            setNodeSymbol(self, node, sym);
            set ty = Type::Nominal(hintedNominal(t, hint));
        }
        case SymbolData::Variant { index, .. } => {
            let ty = typeFor(self, node)
                else throw emitError(self, node, ErrorKind::Internal);
            let case Type::Nominal(info) = ty else panic "resolveScopeAccess: invalid variant type";
            let applied = hintedNominal(info, hint);
            try requireNominalArguments(self, applied, node);
            try ensureNominalResolved(self, applied, node);
            let variantTy = Type::Nominal(applied);
            // For unions without payload, store the variant index as a constant.
            if isVoidUnion(variantTy) {
                setNodeConstValue(self, node, ConstValue::Int(ConstInt {
                    magnitude: index as u64,
                    bits: 32,
                    signed: false,
                    negative: false,
                }));
            }
            return setNodeType(self, node, variantTy);
        }
        case SymbolData::Module { .. } => {
            throw emitError(self, node, ErrorKind::UnexpectedModuleName);
        }
        case SymbolData::Trait(_) => { // Trait names are not values.
            throw emitError(self, node, ErrorKind::UnexpectedTraitName);
        }
    }
    return setNodeType(self, node, ty);
}

/// Analyze a field access expression.
unsafe fn resolveFieldAccess 'arena (self: &mut Resolver 'arena, node: *ast::Node, access: ast::Access) -> Type
    throws (ResolveError)
{
    let parentTy = try infer(self, access.parent);
    if isUnsafePointerType(parentTy) {
        try requireUnsafe(self, access.parent);
    }
    let subjectTy = autoDeref(parentTy);
    try ensureTypeResolved(self, subjectTy, access.parent);

    if let case Type::Slice { class, item, mutable } = subjectTy {
        let fieldNode = access.child;
        let fieldName = try nodeName(self, fieldNode);
        if mem::eq(fieldName, PTR_FIELD) {
            try requireUnsafe(self, node);
            setRecordFieldIndex(self, fieldNode, 0);
            return setNodeType(
                self,
                node,
                Type::Pointer { class, target: item, mutable },
            );
        }
        if mem::eq(fieldName, LEN_FIELD) {
            setRecordFieldIndex(self, fieldNode, 1);
            return setNodeType(self, node, Type::U32);
        }
        if mem::eq(fieldName, CAP_FIELD) {
            setRecordFieldIndex(self, fieldNode, 2);
            return setNodeType(self, node, Type::U32);
        }
        throw emitError(self, node, ErrorKind::SliceFieldUnknown(fieldName));
    }
    if let case Type::TraitObject { traitInfo, .. } = subjectTy {
        let fieldName = try nodeName(self, access.child);
        let method = findTraitMethod(&traitInfo.methods[..], fieldName)
            else throw emitError(self, node, ErrorKind::RecordFieldUnknown(fieldName));
        return setNodeType(self, node, Type::Fn(method.fnType));
    }

    match subjectTy {
        case Type::Nominal(NominalType::Record(recordType)) => {
            let fieldNode = access.child;
            let fieldName = try nodeName(self, fieldNode);
            if let fieldIndex = findRecordField(&recordType.fields[..], fieldName) {
                try requireRecordAccess(self, node, recordType);
                let fieldTy = recordType.fields[fieldIndex].fieldType;
                setRecordFieldIndex(self, fieldNode, fieldIndex);
                return setNodeType(self, node, fieldTy);
            }
            // Not a field: check for a standalone method.
            if let method = findMethod(self, subjectTy, fieldName) {
                return setNodeType(self, node, Type::Fn(method.fnType));
            }
            throw emitError(self, node, ErrorKind::RecordFieldUnknown(fieldName));
        }
        case Type::Array(arrayInfo) => {
            let fieldNode = access.child;
            let fieldName = try nodeName(self, fieldNode);

            if mem::eq(fieldName, LEN_FIELD) {
                let lengthConst = constInt(arrayInfo.length as u64, 32, false, false);
                setNodeConstValue(self, node, lengthConst);

                return setNodeType(self, node, Type::U32);
            }
            throw emitError(self, node, ErrorKind::ArrayFieldUnknown(fieldName));
        }

        else => {
            // Check for standalone methods on any nominal type (e.g. unions).
            if let case Type::Nominal(_) = subjectTy {
                let fieldName = try nodeName(self, access.child);
                if let method = findMethod(self, subjectTy, fieldName) {
                    return setNodeType(self, node, Type::Fn(method.fnType));
                }
            }
            throw emitError(self, access.parent, ErrorKind::ExpectedRecord);
        }
    }
}

/// Return whether a pointer-like value grants mutable access.
fn isMutablePointerLike(ty: Type) -> bool {
    match ty {
        case Type::Pointer { mutable, .. } => return mutable,
        case Type::Slice { mutable, .. } => return mutable,
        case Type::TraitObject { mutable, .. } => return mutable,
        else => return false,
    }
}

/// Check exclusive access to an element or field of a container.
unsafe fn canAccessExclusiveProjection 'arena (self: &mut Resolver 'arena, container: *ast::Node) -> bool
    throws (ResolveError)
{
    let ty = try infer(self, container);
    if let case Type::Slice { mutable: false, .. } = autoDeref(ty) {
        return false;
    }
    match ty {
        case Type::Pointer { class, mutable, .. } => {
            if not mutable {
                return false;
            }
            if class == types::PointerClass::Unsafe {
                return true;
            }
        }
        case Type::Slice { class, mutable, .. } => {
            if not mutable {
                return false;
            }
            if class == types::PointerClass::Unsafe {
                return true;
            }
        }
        else => {
        },
    }
    return try canAccessExclusiveHandle(self, container);
}

/// Check that a stored exclusive handle is not reached through shared access.
unsafe fn canAccessExclusiveHandle 'arena (self: &mut Resolver 'arena, node: *ast::Node) -> bool
    throws (ResolveError)
{
    match node.value {
        case ast::NodeValue::FieldAccess(access) =>
            return try canAccessExclusiveProjection(self, access.parent),
        case ast::NodeValue::Subscript { container, .. } =>
            return try canAccessExclusiveProjection(self, container),
        case ast::NodeValue::Deref(inner) =>
            return try canAccessExclusiveProjection(self, inner),
        case ast::NodeValue::As(expr) =>
            return try canAccessExclusiveHandle(self, expr.value),
        case ast::NodeValue::CondExpr(cond) => {
            if not try canAccessExclusiveHandle(self, cond.thenExpr) {
                return false;
            }
            return try canAccessExclusiveHandle(self, cond.elseExpr);
        }
        else => return true,
    }
}

/// Check target mutability for implicit pointer access.
unsafe fn canMutateThrough 'arena (self: &mut Resolver 'arena, node: *ast::Node) -> bool
    throws (ResolveError)
{
    let ty = try infer(self, node);
    match ty {
        case Type::Pointer { class, mutable, .. } => {
            if not mutable {
                return false;
            }
            if class == types::PointerClass::Unsafe {
                return true;
            }
            return try canAccessExclusiveHandle(self, node);
        }
        case Type::Slice { class, mutable, .. } => {
            if not mutable {
                return false;
            }
            if class == types::PointerClass::Unsafe {
                return true;
            }
            return try canAccessExclusiveHandle(self, node);
        }
        case Type::TraitObject { class, mutable, .. } => {
            if not mutable {
                return false;
            }
            if class == types::PointerClass::Unsafe {
                return true;
            }
            return try canAccessExclusiveHandle(self, node);
        }
        else => return try canBorrowMutFrom(self, node),
    }
}

/// Determine whether an expression can yield a mutable location for borrowing.
unsafe fn canBorrowMutFrom 'arena (self: &mut Resolver 'arena, node: *ast::Node) -> bool
    throws (ResolveError)
{
    match node.value {
        case ast::NodeValue::Ident(name) => {
            let sym = findValueSymbol(self.scope, name)
                else return false;
            let case SymbolData::Value { mutable, .. } = sym.data
                else return false;
            return mutable;
        }
        case ast::NodeValue::FieldAccess(access) => {
            let parentTy = try infer(self, access.parent);
            if let case Type::Slice { .. } = autoDeref(parentTy) {
                try requireUnsafe(self, node);
            }
            return try canMutateThrough(self, access.parent);
        }
        case ast::NodeValue::ScopeAccess(_) => {
            // Module-qualified access to a top-level symbol. A `static`
            // binds as a mutable value; a `constant` does not.
            let _ = try infer(self, node);
            let sym = symbolFor(self, node)
                else return false;

            if let case SymbolData::Value { mutable, .. } = sym.data {
                return mutable;
            }
            return false;
        }
        case ast::NodeValue::Subscript { container, .. } => {
            let containerTy = try infer(self, container);
            // Subscript auto-derefs pointers, so check the actual indexed type.
            let subjectTy = autoDeref(containerTy);

            if let case Type::Slice { mutable, .. } = subjectTy {
                if not mutable {
                    return false;
                }
                return try canMutateThrough(self, container);
            }
            if let case Type::Array(_) = subjectTy {
                return try canMutateThrough(self, container);
            }
            return false;
        }
        case ast::NodeValue::ArrayLit(_),
             ast::NodeValue::ArrayRepeatLit(_) =>
        {
            return true;
        }
        case ast::NodeValue::Call(_) => {
            // A call returning `*mut T` (or `&mut [T]`) yields a
            // mutable place. Non-pointer returns cannot be mutably borrowed.
            let ty = try infer(self, node);
            if let case Type::Pointer { mutable, .. } = ty {
                return mutable;
            }
            if let case Type::Slice { mutable, .. } = ty {
                return mutable;
            }
            return false;
        }
        case ast::NodeValue::Deref(inner) => {
            let innerTy = try infer(self, inner);

            if let case Type::Pointer { .. } = innerTy {
                return try canMutateThrough(self, inner);
            }
            if let case Type::Slice { .. } = innerTy {
                return try canMutateThrough(self, inner);
            }
            // Record deref: mutability depends on the inner binding.
            if let case Type::Nominal(NominalType::Record(recInfo)) = innerTy {
                if not recInfo.labeled and recInfo.fields.len == 1 {
                    return try canBorrowMutFrom(self, inner);
                }
            }
            return false;
        }
        else => {
            return false;
        }
    }
}

/// Restrict a pointee lifetime to the borrow of its exclusive owner.
unsafe fn constrainAddressClass(storage: types::PointerClass, owner: types::PointerClass) -> types::PointerClass {
    if owner == types::PointerClass::Owned or owner == types::PointerClass::Unsafe {
        return storage;
    }
    if owner == types::PointerClass::Ref {
        return owner;
    }
    let case types::PointerClass::Region(ownerRegion) = owner else panic;
    if let case types::PointerClass::Region(storageRegion) = storage {
        if types::regionContains(storageRegion, ownerRegion) {
            return owner;
        }
        if types::regionContains(ownerRegion, storageRegion) {
            return storage;
        }
        return types::PointerClass::Ref;
    }
    if storage == types::PointerClass::Owned {
        return owner;
    }
    return storage;
}

/// Get the usable pointee lifetime of a pointer or slice value.
unsafe fn pointerAddressClass 'arena (
    self: &Resolver 'arena, node: *ast::Node, class: types::PointerClass, mutable: bool
) -> types::PointerClass {
    if not mutable or class == types::PointerClass::Unsafe {
        return class;
    }
    return constrainAddressClass(class, exclusiveOwnerClass(self, node));
}

/// Get the lifetime of storage selected by a pointer or slice subscript.
unsafe fn indexedPointerClass 'arena (self: &Resolver 'arena, container: *ast::Node) -> ?types::PointerClass {
    let ty = typeFor(self, container) else return nil;
    if let case Type::Pointer { class, target, mutable } = ty {
        let parentClass = pointerAddressClass(self, container, class, mutable);
        if let case Type::Slice { class: sliceClass, mutable: sliceMutable, .. } = *target {
            if not sliceMutable or sliceClass == types::PointerClass::Unsafe {
                return sliceClass;
            }
            return constrainAddressClass(sliceClass, parentClass);
        }
        return parentClass;
    }
    if let case Type::Slice { class, mutable, .. } = ty {
        return pointerAddressClass(self, container, class, mutable);
    }
    return nil;
}

/// Get the borrow that controls access to a stored exclusive handle.
/// Directly owned values have no additional borrow restriction.
unsafe fn exclusiveOwnerClass 'arena (self: &Resolver 'arena, node: *ast::Node) -> types::PointerClass {
    match node.value {
        case ast::NodeValue::FieldAccess(access) => {
            if let ty = typeFor(self, access.parent) {
                match ty {
                    case Type::Pointer { class, mutable, .. } =>
                        return pointerAddressClass(self, access.parent, class, mutable),
                    case Type::Slice { class, mutable, .. } =>
                        return pointerAddressClass(self, access.parent, class, mutable),
                    else => {
                    },
                }
            }
            return exclusiveOwnerClass(self, access.parent);
        }
        case ast::NodeValue::Subscript { container, .. } => {
            if let class = indexedPointerClass(self, container) {
                return class;
            }
            return exclusiveOwnerClass(self, container);
        }
        case ast::NodeValue::Deref(target) => {
            if let ty = typeFor(self, target) {
                if let case Type::Pointer { class, mutable, .. } = ty {
                    return pointerAddressClass(self, target, class, mutable);
                }
            }
            return exclusiveOwnerClass(self, target);
        }
        case ast::NodeValue::As(expr) => return exclusiveOwnerClass(self, expr.value),
        case ast::NodeValue::CondExpr(cond) =>
            return constrainAddressClass(exclusiveOwnerClass(self, cond.thenExpr), exclusiveOwnerClass(self, cond.elseExpr)),
        else => return types::PointerClass::Owned,
    }
}

/// Return the storage class of an addressed location.
unsafe fn addressStorageClass 'arena (self: &Resolver 'arena, node: *ast::Node) -> types::PointerClass {
    match node.value {
        case ast::NodeValue::Ident(_), ast::NodeValue::ScopeAccess(_) => {
            if let sym = symbolFor(self, node) {
                match sym.node.value {
                    case ast::NodeValue::StaticDecl(_), ast::NodeValue::ConstDecl(_) =>
                        return types::PointerClass::Owned,
                    else => {}
                }
            }
        }
        case ast::NodeValue::FieldAccess(access) => {
            if let ty = typeFor(self, access.parent) {
                if let case Type::Pointer { class, mutable, .. } = ty {
                    return pointerAddressClass(self, access.parent, class, mutable);
                }
            }
            return addressStorageClass(self, access.parent);
        }
        case ast::NodeValue::Subscript { container, .. } => {
            if let class = indexedPointerClass(self, container) {
                return class;
            }
            return addressStorageClass(self, container);
        }
        case ast::NodeValue::Deref(target) => {
            if let ty = typeFor(self, target) {
                if let case Type::Pointer { class, mutable, .. } = ty {
                    return pointerAddressClass(self, target, class, mutable);
                }
            }
            return addressStorageClass(self, target);
        }
        else => {}
    }
    return types::PointerClass::Ref;
}

/// Select an address type without extending the target storage lifetime.
unsafe fn addressClass 'arena (self: &mut Resolver 'arena, target: *ast::Node, hint: Type) -> types::PointerClass
    throws (ResolveError)
{
    if isUnsafePointerType(hint) {
        try requireUnsafe(self, target);
        return types::PointerClass::Unsafe;
    }
    if isRefType(hint) {
        if referenceRegion(hint) <> nil {
            return addressStorageClass(self, target);
        }
        return types::PointerClass::Ref;
    }
    match target.value {
        case ast::NodeValue::ArrayLit(_), ast::NodeValue::ArrayRepeatLit(_) => {
            if isConstExpr(self, target) {
                return types::PointerClass::Owned;
            }
        }
        else => {}
    }
    return addressStorageClass(self, target);
}

/// Return the cell type whose payload contains a place during type analysis.
unsafe fn inferCellPayload 'arena (self: &mut Resolver 'arena, node: *ast::Node) -> ?Type
    throws (ResolveError)
{
    match node.value {
        case ast::NodeValue::Deref(target) => {
            let ty = try infer(self, target);
            if let case Type::Cell { .. } = ty {
                return ty;
            }
        }
        case ast::NodeValue::FieldAccess(access) =>
            return try inferCellPayload(self, access.parent),
        case ast::NodeValue::Subscript { container, .. } =>
            return try inferCellPayload(self, container),
        else => {}
    }
    return nil;
}

/// Return whether a typed expression accesses a whole cell payload.
export fn isCellDeref 'arena (self: &Resolver 'arena, node: *ast::Node) -> bool {
    if let case ast::NodeValue::Deref(target) = node.value {
        if let ty = typeFor(self, target) {
            if let case Type::Cell { .. } = ty {
                return true;
            }
        }
    }
    return false;
}

/// Return whether an expression creates shared mutable access to a source place.
fn createsCellBorrow(node: *ast::Node) -> bool {
    match node.value {
        case ast::NodeValue::AddressOf(address) => return address.kind == ast::AddressKind::Cell,
        case ast::NodeValue::As(expr) => return createsCellBorrow(expr.value),
        case ast::NodeValue::RegionApply { value, .. } => return createsCellBorrow(value),
        case ast::NodeValue::CondExpr(cond) =>
            return createsCellBorrow(cond.thenExpr) or createsCellBorrow(cond.elseExpr),
        else => return false,
    }
}

/// Find the exclusive handle that owns an addressed place.
fn addressOwner 'arena (self: &Resolver 'arena, node: *ast::Node) -> ?*ast::Node {
    let mut parent: ?*ast::Node = nil;
    match node.value {
        case ast::NodeValue::Deref(target) => set parent = target,
        case ast::NodeValue::FieldAccess(access) => set parent = access.parent,
        case ast::NodeValue::Subscript { container, .. } => set parent = container,
        else => {}
    }
    let parentNode = parent else return nil;
    if let ty = typeFor(self, parentNode) {
        match ty {
            case Type::Pointer { mutable: true, .. }, Type::Slice { mutable: true, .. } => return parentNode,
            else => {}
        }
    }
    return addressOwner(self, parentNode);
}

/// Analyze an address-of expression.
unsafe fn resolveAddressOf 'arena (self: &mut Resolver 'arena, node: *ast::Node, addr: ast::AddressOf, hint: Type) -> Type
    throws (ResolveError)
{
    let payloadCell = try inferCellPayload(self, addr.target);
    if let cellTy = payloadCell {
        let case Type::Cell { permission, .. } = cellTy
            else panic "resolveAddressOf: invalid cell payload";
        if permission == nil or addr.kind == ast::AddressKind::Cell {
            throw emitError(self, addr.target, ErrorKind::ImmutableBinding);
        }
    }
    if addr.kind == ast::AddressKind::Cell and not ast::isPlaceExpr(addr.target) {
        throw emitError(self, addr.target, ErrorKind::RefBinding);
    }
    if payloadCell == nil and ast::isExclusiveAddress(addr) {
        if not try canBorrowMutFrom(self, addr.target) {
            throw emitError(self, addr.target, ErrorKind::ImmutableBinding);
        }
    }
    if let case ast::NodeValue::Subscript { container, index } = addr.target.value {
        if let case ast::NodeValue::Range(range) = index.value {
            if addr.kind == ast::AddressKind::Cell {
                throw emitError(self, addr.target, ErrorKind::InvalidCellPayload);
            }
            let containerTy = try infer(self, container);
            let subjectTy = autoDeref(containerTy);

            try checkSliceRangeIndices(self, range);

            let mut info = sliceRangeInfo(subjectTy)
                else throw emitError(self, container, ErrorKind::ExpectedIndexable);
            if ast::isExclusiveAddress(addr) and not info.mutable {
                throw emitError(self, addr.target, ErrorKind::ImmutableBinding);
            }
            if let capacity = info.capacity {
                try validateArraySliceBounds(self, range, capacity, node);
            }
            set info.mutable = addr.kind == ast::AddressKind::Mutable;
            let class = try addressClass(self, addr.target, hint);
            let sliceTy = Type::Slice { class, item: info.itemType, mutable: info.mutable };
            let alloc = allocType(self, sliceTy);
            setSliceRangeInfo(self, node, info);
            setNodeType(self, addr.target, *alloc);
            return setNodeType(self, node, *alloc);
        }
    }
    // Derive a hint for the target type from the slice hint.
    let mut targetHint: Type = Type::Unknown;
    if let case Type::Slice { item, .. } = hint {
        set targetHint = Type::Array(ArrayType { item, length: 0 });
    }
    let targetTy = try visit(self, addr.target, targetHint);
    let class = try addressClass(self, addr.target, hint);

    // Mark local variable symbols as address-taken so the lowerer
    // allocates a stack slot eagerly.
    if let case ast::NodeValue::Ident(name) = addr.target.value {
        if let sym = findValueSymbol(self.scope, name) {
            match &mut sym.data {
                case SymbolData::Value { addressTaken, .. } => {
                    set *addressTaken = true;
                }
                else => {}
            }
        }
    }

    if addr.kind == ast::AddressKind::Cell {
        let mut permission: ?*unsafe types::Region = nil;
        if let permissionNode = addr.permission {
            set permission = try resolveRegion(self, permissionNode);
        }
        try validateCellPayload(self, node, targetTy, permission);
        if let case types::PointerClass::Region(region) = class {
            try validateRegionStorage(self, addr.target, targetTy, region);
        } else if class == types::PointerClass::Owned
            and try containsStorageRegion(self, addr.target, targetTy)
        {
            throw emitError(self, addr.target, ErrorKind::InvalidCellPayload);
        }
        return setNodeType(self, node, Type::Cell {
            class, permission, payload: allocType(self, targetTy),
        });
    }
    if let case Type::Array(arrayInfo) = targetTy {
        match addr.target.value {
            case ast::NodeValue::ArrayLit(_),
                 ast::NodeValue::ArrayRepeatLit(_) =>
            {
                let sliceTy = Type::Slice { class, item: arrayInfo.item, mutable: addr.kind == ast::AddressKind::Mutable };
                return setNodeType(self, node, *allocType(self, sliceTy));
            }
            else => {}
        }
    }
    let pointerTy = Type::Pointer {
        class, target: allocType(self, targetTy), mutable: addr.kind == ast::AddressKind::Mutable,
    };
    return setNodeType(self, node, pointerTy);
}

/// Analyze a dereference expression.
unsafe fn resolveDeref 'arena (self: &mut Resolver 'arena, node: *ast::Node, targetNode: *ast::Node, hint: Type) -> Type
    throws (ResolveError)
{
    let operandTy = try visit(self, targetNode, hint);
    if let case Type::Cell { class, permission, payload } = operandTy {
        if class == types::PointerClass::Unsafe {
            try requireUnsafe(self, targetNode);
        }
        try validateCellPayload(self, node, *payload, permission);
        return setNodeType(self, node, *payload);
    }
    if let case Type::Pointer { class, target, .. } = operandTy {
        if class == types::PointerClass::Unsafe {
            try requireUnsafe(self, targetNode);
        }
        // Disallow dereferencing opaque pointers.
        if *target == Type::Opaque {
            throw emitError(self, targetNode, ErrorKind::OpaqueTypeDeref);
        }
        return setNodeType(self, node, *target);
    }
    // Auto-deref for single-field unlabeled records.
    if let case Type::Nominal(NominalType::Record(recInfo)) = operandTy {
        if not recInfo.labeled and recInfo.fields.len == 1 {
            try requireRecordAccess(self, node, recInfo);
            let fieldTy = recInfo.fields[0].fieldType;
            setRecordFieldIndex(self, node, 0);
            return setNodeType(self, node, fieldTy);
        }
    }
    throw emitError(self, targetNode, ErrorKind::ExpectedPointer);
}

/// Check if a type is a pointer to opaque.
fn isOpaquePointer(ty: Type) -> bool {
    if let case Type::Pointer { target, .. } = ty {
        return *target == Type::Opaque;
    }
    return false;
}

/// Check if a type is an opaque slice.
fn isOpaqueSlice(ty: Type) -> bool {
    if let case Type::Slice { item, .. } = ty {
        return *item == Type::Opaque;
    }
    return false;
}

/// Check if an `as` cast between two types is valid.
unsafe fn isValidCast(source: Type, target: Type) -> bool {
    // Allow identity casts.
    if source == target {
        return true;
    }
    // Allow numeric to numeric.
    if isNumericType(source) and isNumericType(target) {
        return true;
    }
    // Allow `void` union to numeric.
    // TODO: Check that variant index fits in target type.
    if isVoidUnion(source) and isNumericType(target) {
        return true;
    }
    // Allow address to numeric.
    if let case Type::Slice { .. } = source {
        // Disallow slice to numeric; slices are fat pointers.
    } else if isAddressType(source) and isNumericType(target) {
        return true;
    }
    // Allow pointer casts if one side is `*opaque` or target types are castable.
    if let case Type::Pointer {
        class: sourceClass, target: sourceTarget, mutable: sourceMutable,
    } = source {
        if let case Type::Pointer {
            class: targetClass, target: targetTarget, mutable: targetMutable,
        } = target {
            if sourceClass <> targetClass {
                return false;
            }
            if targetMutable and not sourceMutable {
                return false;
            }
            if isOpaquePointer(source) or isOpaquePointer(target) {
                return true;
            }
            return isValidCast(*sourceTarget, *targetTarget);
        }
    }
    // Allow slice casts if one side is `*[opaque]`, target is `*[u8]`,
    // or element types are castable.
    if let case Type::Slice {
        class: sourceClass, item: sourceItem, mutable: sourceMutable,
    } = source {
        if let case Type::Slice {
            class: targetClass, item: targetItem, mutable: targetMutable,
        } = target {
            if sourceClass <> targetClass {
                return false;
            }
            if targetMutable and not sourceMutable {
                return false;
            }
            if isOpaqueSlice(source) or isOpaqueSlice(target) {
                return true;
            }
            if *targetItem == Type::U8 {
                return true;
            }
            return isValidCast(*sourceItem, *targetItem);
        }
    }
    return false;
}

/// Require casts into region-dependent storage to preserve its typed contents.
fn regionalCastPreservesType(source: Type, target: Type) -> bool {
    if typesEqual(source, target) {
        return true;
    }
    if let case Type::Pointer { target: sourceItem, .. } = source {
        let case Type::Pointer { target: targetItem, .. } = target else return false;
        return typesEqual(*sourceItem, *targetItem);
    }
    if let case Type::Slice { item: sourceItem, .. } = source {
        let case Type::Slice { item: targetItem, .. } = target else return false;
        return typesEqual(*sourceItem, *targetItem);
    }
    return false;
}

/// Analyze an `as` cast expression.
unsafe fn resolveAs 'arena (self: &mut Resolver 'arena, node: *ast::Node, expr: ast::As) -> Type
    throws (ResolveError)
{
    let targetTy = try infer(self, expr.type);
    let sourceTy = try visit(self, expr.value, targetTy);
    if isUnsafePointerType(sourceTy) or isUnsafePointerType(targetTy) {
        try requireUnsafe(self, node);
    }

    assert sourceTy <> Type::Unknown;
    assert targetTy <> Type::Unknown;

    if let case Type::Cell { class, permission, payload } = targetTy {
        if let case Type::Pointer { class: sourceClass, target, mutable: true } = sourceTy;
            permission == nil and sourceClass == class
            and class <> types::PointerClass::Unsafe and typesEqual(*target, *payload)
        {
            return setNodeType(self, node, targetTy);
        }
        if typesEqual(sourceTy, targetTy) {
            return setNodeType(self, node, targetTy);
        }
        throw emitError(self, node, ErrorKind::InvalidAsCast(InvalidAsCast { from: sourceTy, to: targetTy }));
    }
    if containsRegion(targetTy) and not regionalCastPreservesType(sourceTy, targetTy) {
        throw emitError(self, node, ErrorKind::InvalidAsCast(InvalidAsCast {
            from: sourceTy, to: targetTy,
        }));
    }
    let mut valid = isValidCast(sourceTy, targetTy);
    if let case Type::Pointer {
        class: sourceClass, target: sourceTarget, mutable: sourceMutable,
    } = sourceTy {
        if let case Type::Pointer {
            class: targetClass, target: targetTarget, mutable: targetMutable,
        } = targetTy {
            if types::isReference(sourceClass) and
               targetClass == types::PointerClass::Unsafe and
               (not targetMutable or sourceMutable) and
               isValidCast(*sourceTarget, *targetTarget)
            {
                set valid = true;
            }
        }
    }
    if let case Type::Slice {
        class: sourceClass, item: sourceItem, mutable: sourceMutable,
    } = sourceTy {
        if let case Type::Slice {
            class: targetClass, item: targetItem, mutable: targetMutable,
        } = targetTy {
            if types::isReference(sourceClass) and
               targetClass == types::PointerClass::Unsafe and
               (not targetMutable or sourceMutable) and
               isValidCast(*sourceItem, *targetItem)
            {
                set valid = true;
            }
        }
    }
    if valid {
        if let case Type::Pointer { target: sourceTarget, .. } = sourceTy {
            if let case Type::Pointer { target: targetTarget, .. } = targetTy {
                if *targetTarget <> Type::Opaque and not typesEqual(*sourceTarget, *targetTarget) {
                    try requireUnsafe(self, node);
                }
            }
        }
        if let case Type::Slice { item: sourceItem, .. } = sourceTy {
            if let case Type::Slice { item: targetItem, .. } = targetTy {
                if *targetItem <> Type::Opaque and not typesEqual(*sourceItem, *targetItem) {
                    try requireUnsafe(self, node);
                }
            }
        }
        // Propagate the constant value after applying the cast's target-width
        // truncation and signed interpretation.
        if let value = constValueEntry(self, expr.value) {
            if let case ConstValue::Int(i) = value {
                setNodeConstValue(self, node, castConstInt(i, targetTy));
            }
        }
        return setNodeType(self, node, targetTy);
    }
    throw emitError(self, node, ErrorKind::InvalidAsCast(InvalidAsCast {
        from: sourceTy,
        to: targetTy,
    }));
}

/// Analyze a range expression.
unsafe fn resolveRange 'arena (self: &mut Resolver 'arena, node: *ast::Node, range: ast::Range) -> Type
    throws (ResolveError)
{
    let mut start: ?*Type = nil;
    let mut end: ?*Type = nil;

    if let s = range.start {
        let startTy = try checkNumeric(self, s);

        if let e = range.end {
            let endTy = try checkNumeric(self, e);
            let mut resolvedTy = startTy;

            // Infer unsuffixed integer literals from the opposite bound.
            if startTy == Type::Int and endTy <> Type::Int {
                let _ = try checkAssignable(self, s, endTy);
                set resolvedTy = endTy;
            } else if endTy == Type::Int and startTy <> Type::Int {
                let _ = try checkAssignable(self, e, startTy);
                set resolvedTy = startTy;
            } else {
                let _ = try checkAssignable(self, e, startTy);
            }
            set start = allocType(self, resolvedTy);
            set end = allocType(self, resolvedTy);
        } else {
            set start = allocType(self, startTy);
        }
    } else if let e = range.end {
        set end = allocType(self, try checkNumeric(self, e));
    }
    return setNodeType(self, node, Type::Range { start, end });
}

/// Analyze a `try` expression and its handlers.
/// The `expected` type is used to determine if the value is discarded (`Void`)
/// or if the catch expression needs type checking.
unsafe fn resolveTry 'arena (self: &mut Resolver 'arena, node: *ast::Node, tryExpr: ast::Try, hint: Type) -> Type
    throws (ResolveError)
{
    let call = tryExpr.expr;
    let case ast::NodeValue::Call(callExpr) = call.value
        else throw emitError(self, call, ErrorKind::TryNonThrowing);
    let resultTy = try resolveCall(self, call, callExpr, CallCtx::Try, Type::Unknown);

    // TODO: It's annoying that we need to re-fetch the function type after
    // analyzing the call.
    let calleeTy = typeFor(self, callExpr.callee)
        else return setNodeType(self, node, resultTy);
    let case Type::Fn(calleeInfo) = calleeTy
        else throw emitError(self, callExpr.callee, ErrorKind::TryNonThrowing);

    if calleeInfo.throwList.len == 0 {
        throw emitError(self, callExpr.callee, ErrorKind::TryNonThrowing);
    }
    // If we're not catching the error, nor panicking on error, nor returning
    // optional, then the current function must be able to propagate it.
    let mut tryResultTy = resultTy;
    if tryExpr.returnsOptional {
        // `try?` converts errors to `nil` and wraps the result in an optional.
        if let case Type::Optional(_) = resultTy {
            // Already optional, no wrapping needed.
        } else {
            set tryResultTy = Type::Optional(allocType(self, resultTy));
        }
    } else if tryExpr.catches.len > 0 {
        // `try ... catch` -- one or more catch clauses.
        set tryResultTy = try resolveTryCatches(self, node, tryExpr.catches, calleeInfo, resultTy, hint);
    } else if not tryExpr.shouldPanic {
        let fnInfo = self.currentFn
            else throw emitError(self, node, ErrorKind::TryRequiresThrows);
        if fnInfo.throwList.len == 0 {
            throw emitError(self, node, ErrorKind::TryRequiresThrows);
        }
        // Check that *all* thrown errors of the callee can be propagated by
        // the caller.
        for throwTy in calleeInfo.throwList {
            let mut found = false;

            for callerThrowTy in fnInfo.throwList {
                if callerThrowTy == throwTy {
                    set found = true;
                    break;
                }
            }
            if not found {
                throw emitError(self, node, ErrorKind::TryIncompatibleError);
            }
        }
    }
    return setNodeType(self, node, tryResultTy);
}

/// Check that a `catch` body is assignable to the expected result type, but only
/// in expression context (`hint` is neither `Unknown` nor `Void`).
unsafe fn checkCatchBody 'arena (self: &mut Resolver 'arena, body: *ast::Node, resultTy: Type, hint: Type)
    throws (ResolveError)
{
    if hint <> Type::Unknown and hint <> Type::Void {
        try checkAssignable(self, body, resultTy);
    }
}

/// Resolve catch clauses for a `try ... catch` expression.
///
/// For a single untyped catch (with or without binding), resolves the catch
/// body and returns the result type. Multi-error callees with inferred bindings
/// are rejected; you must use typed catches.
unsafe fn resolveTryCatches 'arena (
    self: &mut Resolver 'arena,
    node: *ast::Node,
    catches: *[*ast::Node],
    calleeInfo: *FnType,
    resultTy: Type,
    hint: Type
) -> Type throws (ResolveError) {
    let firstNode = catches[0];
    let case ast::NodeValue::CatchClause(first) = firstNode.value else
        throw emitError(self, node, ErrorKind::UnexpectedNode(firstNode));

    // Typed catches: dispatch to dedicated handler.
    if first.typeNode <> nil {
        return try resolveTypedCatches(self, node, catches, calleeInfo, resultTy, hint);
    }
    // Single untyped catch clause.
    if let binding = first.binding {
        if calleeInfo.throwList.len > 1 {
            throw emitError(self, binding, ErrorKind::TryCatchMultiError);
        }
        enterScope(self, node);

        let errTy = *calleeInfo.throwList[0];
        try bindValueIdent(self, binding, binding, errTy, false, 0, 0);
    }
    let bodyTy = try visit(self, first.body, resultTy);

    if let _ = first.binding {
        exitScope(self);
    }
    try checkCatchBody(self, first.body, resultTy, hint);

    return bodyTy if resultTy == Type::Never else resultTy;
}

/// Resolve typed catch clauses (`catch e as T {..} catch e as S {..}`).
///
/// Validates that each type annotation is in the callee's throw list, that
/// there are no duplicate catch types, and that the clauses are exhaustive.
unsafe fn resolveTypedCatches 'arena (
    self: &mut Resolver 'arena,
    node: *ast::Node,
    catches: *[*ast::Node],
    calleeInfo: *FnType,
    resultTy: Type,
    hint: Type
) -> Type throws (ResolveError) {
    // Track which of the callee's throw types have been covered.
    let mut covered: [bool; MAX_FN_THROWS] = [false; MAX_FN_THROWS];
    let mut hasCatchAll = false;
    let mut catchTy = Type::Never;

    for clauseNode in catches {
        let case ast::NodeValue::CatchClause(clause) = clauseNode.value else
            throw emitError(self, node, ErrorKind::UnexpectedNode(clauseNode));

        if let typeNode = clause.typeNode {
            // Typed catch clause: validate against callee's throw list.
            let errTy = try infer(self, typeNode);
            let mut foundIdx: ?u32 = nil;

            for throwType, j in calleeInfo.throwList {
                if errTy == *throwType {
                    set foundIdx = j;
                    break;
                }
            }
            let idx = foundIdx else {
                throw emitError(self, typeNode, ErrorKind::TryIncompatibleError);
            };
            if covered[idx] {
                throw emitError(self, typeNode, ErrorKind::TryCatchDuplicateType);
            }
            set covered[idx] = true;

            // Bind the error variable if present.
            if let binding = clause.binding {
                enterScope(self, clauseNode);
                try bindValueIdent(self, binding, binding, errTy, false, 0, 0);
            }
        } else {
            // Catch-all clause with no type annotation or binding.
            set hasCatchAll = true;
        }
        // Resolve the catch body and check assignability.
        let bodyTy = try visit(self, clause.body, resultTy);
        if bodyTy <> Type::Never { set catchTy = Type::Void; }
        // Only typed clauses can have bindings.
        if let _ = clause.binding {
            exitScope(self);
        }
        try checkCatchBody(self, clause.body, resultTy, hint);
    }

    // Check exhaustiveness: all callee error types must be covered.
    if not hasCatchAll {
        for i in 0..calleeInfo.throwList.len {
            if not covered[i] {
                throw emitError(self, node, ErrorKind::TryCatchNonExhaustive);
            }
        }
    }
    return catchTy if resultTy == Type::Never else resultTy;
}

/// Analyze a `throw` statement.
unsafe fn resolveThrow 'arena (self: &mut Resolver 'arena, node: *ast::Node, expr: *ast::Node) -> Type
    throws (ResolveError)
{
    let fnInfo = self.currentFn
        else throw emitError(self, node, ErrorKind::ThrowRequiresThrows);
    if fnInfo.throwList.len == 0 {
        throw emitError(self, node, ErrorKind::ThrowRequiresThrows);
    }
    let throwTy = try infer(self, expr);
    for errTy in fnInfo.throwList {
        if let coerce = isAssignable(self, *errTy, throwTy, expr) {
            setNodeCoercion(self, expr, coerce);
            return setNodeType(self, node, Type::Never);
        }
    }
    throw emitError(self, expr, ErrorKind::ThrowIncompatibleError);
}

/// Analyze a `return` statement.
unsafe fn resolveReturn 'arena (self: &mut Resolver 'arena, node: *ast::Node, retVal: ?*ast::Node) -> Type
    throws (ResolveError)
{
    let f = self.currentFn
        else throw emitError(self, node, ErrorKind::UnexpectedReturn);
    let expected = *f.returnType;

    if let val = retVal {
        let actualTy = try visit(self, val, expected);
        if let source = referenceRegion(actualTy) {
            if let destination = referenceRegion(expected);
                not types::regionContains(source, destination)
            {
                let mut current = self.regionScope;
                while let scope = current {
                    let mut ownsSource = false;
                    for region in scope.entries {
                        if region.id == source.id {
                            set ownsSource = true;
                            break;
                        }
                    }
                    if ownsSource {
                        let mut lexical: ?*unsafe mut Scope = self.scope;
                        while let localScope = lexical {
                            if let owner = localScope.owner {
                                if let case ast::NodeValue::RegionBlock { bindings, .. } =
                                    owner.value
                                {
                                    if let case NodeExtra::Regions(blockRegions) =
                                        self.nodeData.entries[owner.id].extra
                                    {
                                        if blockRegions.entries[0].id == source.id {
                                            for bindingNode in bindings {
                                                let case ast::NodeValue::RegionBinding(binding) =
                                                    bindingNode.value
                                                    else panic "resolveReturn: invalid region binding";
                                                let case ast::NodeValue::AddressOf(address) =
                                                    binding.value.value else continue;
                                                if let cellTy =
                                                    try inferCellPayload(self, address.target)
                                                {
                                                    if let case Type::Cell {
                                                        permission: controlled,
                                                        ..
                                                    } = cellTy; controlled <> nil {
                                                        throw emitError(
                                                            self,
                                                            val,
                                                            ErrorKind::RegionEscape(source.name),
                                                        );
                                                    }
                                                }
                                            }
                                            break;
                                        }
                                    }
                                }
                            }
                            set lexical = localScope.parent;
                        }
                        break;
                    }
                    set current = scope.parent;
                }
            }
        }
        let _ = try expectAssignable(self, expected, actualTy, val);
        if isRefType(expected) and isMutablePointerLike(expected) and
            isMutablePointerLike(actualTy)
        {
            if not try canMutateThrough(self, val) {
                throw emitError(self, val, ErrorKind::ImmutableBinding);
            }
        }
    } else if expected <> Type::Void {
        throw emitTypeMismatch(self, node, TypeMismatch { expected, actual: Type::Void });
    }
    // In throwing functions, return values are wrapped in the success variant.
    if f.throwList.len > 0 {
        setNodeCoercion(self, node, Coercion::ResultWrap);
    }
    return setNodeType(self, node, Type::Never);
}

/// Convert a [`ConstInt`] to its two's-complement bit pattern.
fn constIntToBits(c: ConstInt) -> u64 {
    return (0 - c.magnitude) if c.negative else c.magnitude;
}

/// Convert a [`ConstInt`] to its signed two's-complement representation.
fn constIntToSigned(c: ConstInt) -> i64 {
    return constIntToBits(c) as i64;
}

/// Build a [`ConstInt`] from a signed result, preserving bit width and signedness.
fn constIntFromSigned(value: i64, bits: u8, signed: bool) -> ConstInt {
    if value < 0 {
        // Compute magnitude without signed overflow.
        let uval = value as u64;
        return ConstInt {
            magnitude: 0 - uval,
            bits,
            signed,
            negative: true,
        };
    }
    return ConstInt {
        magnitude: value as u64,
        bits,
        signed,
        negative: false,
    };
}

/// Build a [`ConstInt`] from a two's-complement bit pattern.
fn constIntFromBits(raw: u64, bits: u8, signed: bool) -> ConstInt {
    let mask = parser::U64_MAX if bits == 64 else parser::U64_MAX >> (64 - bits) as u64;
    let truncated = raw & mask;

    if signed {
        let signBit = (mask >> 1) + 1;
        if (truncated & signBit) <> 0 {
            return ConstInt {
                magnitude: (0 - truncated) & mask,
                bits,
                signed,
                negative: true,
            };
        }
    }
    return ConstInt { magnitude: truncated, bits, signed, negative: false };
}

/// Try to fold a binary operation on two integer constants.
/// Returns the resulting constant value if successful.
fn foldIntBinOp(op: ast::BinaryOp, left: ConstInt, right: ConstInt) -> ?ConstValue {
    // Use the wider bit width and propagate signedness.
    let mut bits = left.bits;
    if right.bits > bits {
        set bits = right.bits;
    }
    let signed = left.signed or right.signed;
    let l = constIntToSigned(left);
    let r = constIntToSigned(right);

    match op {
        // Shift counts are masked to the left operand's width, matching
        // the runtime word instructions.
        case ast::BinaryOp::Shl => {
            let raw = constIntToBits(left);
            let shamt = constIntToBits(right) % left.bits as u64;
            return ConstValue::Int(constIntFromBits(raw << shamt, left.bits, left.signed));
        },
        case ast::BinaryOp::Shr => {
            let shamt = constIntToBits(right) % left.bits as u64;
            if left.signed {
                let shifted = constIntToSigned(left) >> shamt as i64;
                return ConstValue::Int(
                    constIntFromBits(shifted as u64, left.bits, true)
                );
            }
            return ConstValue::Int(
                constIntFromBits(left.magnitude >> shamt, left.bits, false)
            );
        },
        case ast::BinaryOp::Eq  => return ConstValue::Bool(l == r),
        case ast::BinaryOp::Ne  => return ConstValue::Bool(l <> r),
        case ast::BinaryOp::Lt =>
            return ConstValue::Bool(l < r if signed else left.magnitude < right.magnitude),
        case ast::BinaryOp::Gt =>
            return ConstValue::Bool(l > r if signed else left.magnitude > right.magnitude),
        case ast::BinaryOp::Lte =>
            return ConstValue::Bool(l <= r if signed else left.magnitude <= right.magnitude),
        case ast::BinaryOp::Gte =>
            return ConstValue::Bool(l >= r if signed else left.magnitude >= right.magnitude),
        case ast::BinaryOp::Add => return ConstValue::Int(constIntFromSigned(l + r, bits, signed)),
        case ast::BinaryOp::Sub => return ConstValue::Int(constIntFromSigned(l - r, bits, signed)),
        case ast::BinaryOp::Mul => return ConstValue::Int(constIntFromSigned(l * r, bits, signed)),
        case ast::BinaryOp::Div => {
            if signed {
                if r == 0 {
                    return nil;
                }
                return ConstValue::Int(constIntFromSigned(l / r, bits, true));
            }
            if right.magnitude == 0 {
                return nil;
            }
            return constInt(left.magnitude / right.magnitude, bits, false, false);
        },
        case ast::BinaryOp::Mod => {
            if signed {
                if r == 0 {
                    return nil;
                }
                return ConstValue::Int(constIntFromSigned(l % r, bits, true));
            }
            if right.magnitude == 0 {
                return nil;
            }
            return constInt(left.magnitude % right.magnitude, bits, false, false);
        },
        case ast::BinaryOp::BitAnd => return ConstValue::Int(constIntFromSigned(l & r, bits, signed)),
        case ast::BinaryOp::BitOr  => return ConstValue::Int(constIntFromSigned(l | r, bits, signed)),
        case ast::BinaryOp::BitXor => return ConstValue::Int(constIntFromSigned(l ^ r, bits, signed)),
        else => return nil,
    }
}

/// Try to constant-fold a binary operation on two resolved operands.
/// Only folds when the result type is concrete.
fn tryFoldBinOp 'arena (self: &mut Resolver 'arena, node: *ast::Node, binop: ast::BinOp, resultTy: Type) {
    let leftVal = constValueEntry(self, binop.left)
        else return;
    let rightVal = constValueEntry(self, binop.right)
        else return;

    // Fold integer binary ops.
    if let case ConstValue::Int(leftInt) = leftVal {
        if let case ConstValue::Int(rightInt) = rightVal {
            if let result = foldIntBinOp(binop.op, leftInt, rightInt) {
                setNodeConstValue(self, node, result);
            }
            return;
        }
    }

    // Fold boolean binary ops.
    if let case ConstValue::Bool(l) = leftVal {
        if let case ConstValue::Bool(r) = rightVal {
            match binop.op {
                case ast::BinaryOp::And => setNodeConstValue(self, node, ConstValue::Bool(l and r)),
                case ast::BinaryOp::Or => setNodeConstValue(self, node, ConstValue::Bool(l or r)),
                case ast::BinaryOp::Eq => setNodeConstValue(self, node, ConstValue::Bool(l == r)),
                case ast::BinaryOp::Ne,
                     ast::BinaryOp::Xor => setNodeConstValue(self, node, ConstValue::Bool(l <> r)),
                else => {}
            }
        }
    }
}

/// Analyze a binary expression.
unsafe fn resolveBinOp 'arena (self: &mut Resolver 'arena, node: *ast::Node, binop: ast::BinOp) -> Type
    throws (ResolveError)
{
    let mut resultTy = Type::Unknown;

    match binop.op {
        case ast::BinaryOp::And,
             ast::BinaryOp::Or,
             ast::BinaryOp::Xor =>
        {
            try checkBoolean(self, binop.left);
            try checkBoolean(self, binop.right);

            set resultTy = Type::Bool;
        },
        case ast::BinaryOp::Eq,
             ast::BinaryOp::Ne =>
        {
            let leftTy = try infer(self, binop.left);
            let rightTy = try visit(self, binop.right, leftTy);
            if isUnsafePointerType(leftTy) or isUnsafePointerType(rightTy) {
                try requireUnsafe(self, node);
            }

            if not isComparable(leftTy, rightTy) {
                throw emitTypeMismatch(self, binop.right, TypeMismatch {
                    expected: leftTy,
                    actual: rightTy,
                });
            }
            // When comparing `T == ?T`, record a coercion on the
            // non-optional side so the lowerer lifts it before comparing.
            // We use the already-optional type from the other side rather than
            // constructing a new optional, so that e.g. `?u8 == 42` coerces
            // `42` to `?u8` (not `?i32`). We also record OptionalLift directly
            // rather than using expectAssignable, because comparisons should
            // allow e.g. `?*mut T == *T` where mutability differs.
            if let case Type::Optional(_) = leftTy {
                if not isOptionalType(rightTy) {
                    setNodeCoercion(self, binop.right, Coercion::OptionalLift(leftTy));
                }
            } else if let case Type::Optional(_) = rightTy {
                setNodeCoercion(self, binop.left, Coercion::OptionalLift(rightTy));
            }
            set resultTy = Type::Bool;
        },
        else => {
            // Check for pointer arithmetic before numeric check.
            if binop.op == ast::BinaryOp::Add or binop.op == ast::BinaryOp::Sub {
                let leftTy = try infer(self, binop.left);
                let rightTy = try visit(self, binop.right, leftTy);

                // Allow arithmetic on owning pointers and unsafe pointers, but
                // never on references.
                if let case Type::Pointer { class: leftClass, target: leftTarget, .. } = leftTy {
                    if *leftTarget == Type::Opaque {
                        throw emitError(self, node, ErrorKind::OpaquePointerArithmetic);
                    }
                    if not types::isReference(leftClass)
                        and isNumericType(rightTy)
                    {
                        try requireUnsafe(self, node);
                        return setNodeType(self, node, leftTy);
                    }
                }
                if let case Type::Pointer { class: rightClass, target: rightTarget, .. } = rightTy {
                    if *rightTarget == Type::Opaque {
                        throw emitError(self, node, ErrorKind::OpaquePointerArithmetic);
                    }
                    if binop.op == ast::BinaryOp::Add
                        and not types::isReference(rightClass)
                        and isNumericType(leftTy)
                    {
                        try requireUnsafe(self, node);
                        return setNodeType(self, node, rightTy);
                    }
                }
            }
            let leftTy = try checkNumeric(self, binop.left);
            let rightTy = try checkNumeric(self, binop.right);

            let mut operandTy = leftTy;
            if leftTy <> rightTy {
                if leftTy == Type::Int {
                    set operandTy = rightTy;
                } else if rightTy <> Type::Int {
                    throw emitTypeMismatch(self, binop.right, TypeMismatch {
                        expected: leftTy,
                        actual: rightTy,
                    });
                }
            }

            // Ordering comparisons return `bool`, not the operand type.
            match binop.op {
                case ast::BinaryOp::Lt, ast::BinaryOp::Gt,
                     ast::BinaryOp::Lte, ast::BinaryOp::Gte =>
                    set resultTy = Type::Bool,
                else =>
                    set resultTy = operandTy,
            }

        }
    };
    // Try constant folding after both operands are resolved.
    tryFoldBinOp(self, node, binop, resultTy);

    return setNodeType(self, node, resultTy);
}

/// Analyze a unary expression.
unsafe fn resolveUnOp 'arena (self: &mut Resolver 'arena, node: *ast::Node, unop: ast::UnOp) -> Type
    throws (ResolveError)
{
    let mut resultTy = Type::Unknown;

    match unop.op {
        case ast::UnaryOp::Not => {
            set resultTy = try checkBoolean(self, unop.value);
            if let value = constValueEntry(self, unop.value) {
                if let case ConstValue::Bool(val) = value {
                    setNodeConstValue(self, node, ConstValue::Bool(not val));
                }
            }
        },
        case ast::UnaryOp::Neg => {
            // TODO: Check that we're allowed to use `-` here? Should negation
            // only be valid for signed integers?
            set resultTy = try checkNumeric(self, unop.value);
            if let value = constValueEntry(self, unop.value) {
                // Get the constant expression for the value, flip the sign,
                // and store that new expression on the unary op node.
                if let case ConstValue::Int(intVal) = value {
                    setNodeConstValue(
                        self,
                        node,
                        constInt(intVal.magnitude, intVal.bits, true, not intVal.negative)
                    );
                }
            }
        },
        case ast::UnaryOp::BitNot => {
            set resultTy = try checkNumeric(self, unop.value);
            if let value = constValueEntry(self, unop.value) {
                if let case ConstValue::Int(intVal) = value {
                    let signed = constIntToSigned(intVal);
                    let inverted = constIntFromSigned(-(signed + 1), intVal.bits, intVal.signed);
                    setNodeConstValue(self, node, ConstValue::Int(inverted));
                }
            }
        },
    };
    return setNodeType(self, node, resultTy);
}

/// Resolve a type signature node and set its type.
unsafe fn inferTypeSig 'arena (self: &mut Resolver 'arena, node: *ast::Node, sig: ast::TypeSig) -> Type
    throws (ResolveError)
{
    let resolved = try resolveTypeSig(self, node, sig);

    return setNodeType(self, node, resolved);
}

/// Convert a parsed pointer qualifier to its semantic class.
fn resolvePointerClass(class: ast::PointerClass) -> types::PointerClass {
    match class {
        case ast::PointerClass::Owned => return types::PointerClass::Owned,
        case ast::PointerClass::Ref => return types::PointerClass::Ref,
        case ast::PointerClass::Unsafe => return types::PointerClass::Unsafe,
    }
}

/// Convert a type signature node into a type value.
unsafe fn resolveTypeSig 'arena (self: &mut Resolver 'arena, node: *ast::Node, sig: ast::TypeSig) -> Type
    throws (ResolveError)
{
    match sig {
        case ast::TypeSig::Cell { class, permission, payload } => {
            let inner = try infer(self, payload);
            try ensureStorableType(self, node, inner);
            let mut permissionRegion: ?*unsafe types::Region = nil;
            if let permissionNode = permission {
                set permissionRegion = try resolveRegion(self, permissionNode);
            }
            let allocator = alloc::arenaAllocator(self.arena);
            self.cellChecks.append(CellCheck {
                node,
                payload: inner,
                permission: permissionRegion,
                regions: self.regionScope,
                moduleId: self.currentMod,
            }, allocator);
            return Type::Cell {
                class: resolvePointerClass(class),
                permission: permissionRegion,
                payload: allocType(self, inner),
            };
        }
        case ast::TypeSig::RegionRef { region, type } => {
            let identity = try resolveRegion(self, region);
            let base = try infer(self, type);
            match base {
                case Type::Cell { permission, payload, .. } =>
                    return Type::Cell {
                        class: types::PointerClass::Region(identity), permission, payload,
                    },
                case Type::Pointer { target, mutable, .. } =>
                    return Type::Pointer { class: types::PointerClass::Region(identity), target, mutable },
                case Type::Slice { item, mutable, .. } =>
                    return Type::Slice { class: types::PointerClass::Region(identity), item, mutable },
                case Type::TraitObject { traitInfo, mutable, .. } =>
                    return Type::TraitObject { class: types::PointerClass::Region(identity), traitInfo, mutable },
                else => throw emitError(self, node, ErrorKind::InvalidRefPosition),
            }
        }
        case ast::TypeSig::Applied { name, regions } => {
            if let case ast::NodeValue::Ident(spelling) = name.value;
                mem::eq(spelling, "Session") and findTypeSymbol(self.scope, spelling) == nil
            {
                if regions.len <> 1 {
                    throw emitError(self, node, ErrorKind::RegionArgumentCount(CountMismatch {
                        expected: 1, actual: regions.len,
                    }));
                }
                return Type::Session(try resolveRegion(self, regions[0]));
            }
            let base = try resolveTypeName(self, name);
            return Type::Nominal(try applyNominalRegions(self, base, regions, node));
        }
        case ast::TypeSig::Void => {
            return Type::Void;
        }
        case ast::TypeSig::Never => {
            return Type::Never;
        }
        case ast::TypeSig::Opaque => {
            return Type::Opaque;
        }
        case ast::TypeSig::Bool => {
            return Type::Bool;
        }
        case ast::TypeSig::Integer { width, sign } => {
            let u = sign == ast::Signedness::Unsigned;
            match width {
                case 1 => return Type::U8 if u else Type::I8,
                case 2 => return Type::U16 if u else Type::I16,
                case 4 => return Type::U32 if u else Type::I32,
                case 8 => return Type::U64 if u else Type::I64,
                else => {
                    panic "resolveTypeSig: invalid integer width";
                }
            }
        }
        case ast::TypeSig::Array { itemType, length } => {
            let item = try infer(self, itemType);
            let length = try checkSizeInt(self, length);

            return Type::Array(ArrayType { item: allocType(self, item), length });
        }
        case ast::TypeSig::Slice { class, itemType, mutable } => {
            let item = try infer(self, itemType);
            return Type::Slice {
                class: resolvePointerClass(class),
                item: allocType(self, item),
                mutable,
            };
        }
        case ast::TypeSig::Pointer { class, valueType, mutable } => {
            let target = try infer(self, valueType);
            return Type::Pointer {
                class: resolvePointerClass(class),
                target: allocType(self, target),
                mutable,
            };
        }
        case ast::TypeSig::Optional { valueType } => {
            let payload = try infer(self, valueType);
            return Type::Optional(allocType(self, payload));
        }
        case ast::TypeSig::Nominal(name) => {
            let ty = try resolveTypeName(self, name);
            try requireNominalArguments(self, ty, node);
            return Type::Nominal(ty);
        }
        case ast::TypeSig::Record { fields, labeled } => {
            let mut recordType = try resolveRecordFields(self, node, fields, labeled);
            set recordType.declaredCopy = true;
            for field in recordType.fields {
                if not isCopy(field.fieldType) {
                    set recordType.declaredCopy = false;
                }
            }
            set recordType.regions = self.regionScope;
            let nominalTy = allocNominalType(self, NominalType::Record(recordType));
            if let scope = self.regionScope {
                let map = regionSubstitution(self, scope);
                for parameter, i in scope.entries {
                    set map.arguments[i] = parameter;
                }
                return Type::Nominal(internNominalApplication(self, nominalTy, &map));
            }
            return Type::Nominal(nominalTy);
        }
        case ast::TypeSig::Fn { sig: t, isUnsafe } => {
            let a = alloc::arenaAllocator(self.arena);
            let mut paramTypes: *mut [*Type] = &mut [];
            let mut throwList: *mut [*Type] = &mut [];

            if t.params.len > MAX_FN_PARAMS {
                throw emitError(self, node, ErrorKind::FnParamOverflow(CountMismatch {
                    expected: MAX_FN_PARAMS,
                    actual: t.params.len,
                }));
            }
            if t.throwList.len > MAX_FN_THROWS {
                throw emitError(self, node, ErrorKind::FnThrowOverflow(CountMismatch {
                    expected: MAX_FN_THROWS,
                    actual: t.throwList.len,
                }));
            }

            for paramNode in t.params {
                let paramTy = try resolveValueType(self, paramNode);
                paramTypes.append(allocType(self, paramTy), a);
            }
            for tyNode in t.throwList {
                let throwTy = try resolveValueType(self, tyNode);
                try ensureStorableType(self, tyNode, throwTy);
                try validateErrorTag(self, tyNode, throwTy, &throwList[..]);
                throwList.append(allocType(self, throwTy), a);
            }
            let mut retType = allocType(self, Type::Void);
            if let ret = t.returnType {
                let resolvedRet = try resolveValueType(self, ret);
                try ensureStorableType(self, ret, resolvedRet);
                set retType = allocType(self, resolvedRet);
            }
            let fnType = FnType {
                regions: nil,
                paramTypes: &paramTypes[..],
                returnType: retType,
                throwList: &throwList[..],
                isUnsafe,
            };
            return Type::Fn(allocFnType(self, fnType));
        }
        // Resolve an opaque trait object signature.
        case ast::TypeSig::TraitObject { class, traitName, mutable } => {
            let sym = try resolveNamePath(self, traitName);
            let case SymbolData::Trait(traitInfo) = sym.data
                else throw emitError(self, traitName, ErrorKind::Internal);
            setNodeSymbol(self, traitName, sym);

            return Type::TraitObject { class: resolvePointerClass(class), traitInfo, mutable };
        }
    }
}

/// Check if a type can be used for inferrence.
fn isTypeInferrable(type: Type) -> bool {
    if let case Type::Pointer { target, .. } = type {
        return isTypeInferrable(*target);
    }
    match type {
        case Type::Unknown, Type::Nil, Type::Undefined, Type::Int => return false,
        case Type::Array(ary) => return isTypeInferrable(*ary.item),
        case Type::Optional(opt) => return isTypeInferrable(*opt),
        else => return true,
    }
}

/// Analyze a standalone expression by wrapping it in a synthetic function.
export unsafe fn resolveExpr 'arena (
    self: &mut Resolver 'arena, expr: *ast::Node, arena: &mut ast::NodeArena
) -> Diagnostics throws (ResolveError) {
    let a = alloc::arenaAllocator(&mut arena.arena);
    let exprStmt = ast::synthNode(arena, ast::NodeValue::ExprStmt(expr));
    let bodyStmts = ast::nodeSlice(arena, 1).append(exprStmt, a);
    let module = ast::synthFnModule(arena, ANALYZE_EXPR_FN_NAME, bodyStmts);

    let case ast::NodeValue::Block(block) = module.modBody.value
        else panic "resolveExpr: expected block for module body";
    enterScope(self, module.modBody);
    try resolveModuleDecls(self, &block) catch {
        return diagnostics(self);
    };
    try resolveModuleDefs(self, &block) catch {
        return diagnostics(self);
    };
    exitScope(self);

    return diagnostics(self);
}

/// Analyze a parsed module root, ie. a block of top-level statements.
export unsafe fn resolveModuleRoot 'arena (self: &mut Resolver 'arena, root: *ast::Node) -> Diagnostics throws (ResolveError) {
    let case ast::NodeValue::Block(block) = root.value
        else panic "resolveModuleRoot: expected block for module root";

    enterScope(self, root);
    try resolveModuleDecls(self, &block) catch {
        return diagnostics(self);
    };
    try resolveModuleDefs(self, &block) catch {
        return diagnostics(self);
    };
    exitScope(self);
    setNodeType(self, root, Type::Void);

    return diagnostics(self);
}

/// Analyze the module graph. This pass processes `mod` statements, creating symbols
/// and scopes for them, and also binds type names in each module so that cross-module
/// type references work regardless of declaration order.
unsafe fn resolveModuleGraph 'arena (self: &mut Resolver 'arena, block: &ast::Block) throws (ResolveError) {
    try bindTypeNames(self, block);

    for node in block.statements {
        if let case ast::NodeValue::Mod(decl) = node.value {
            try resolveModGraph(self, node, decl);
        }
    }
}

/// Bind all type names in a module.
/// Skips declarations that have already been bound.
unsafe fn bindTypeNames 'arena (self: &mut Resolver 'arena, block: &ast::Block) throws (ResolveError) {
    for node in block.statements {
        match node.value {
            case ast::NodeValue::RecordDecl(decl) => {
                if symbolFor(self, node) == nil {
                    try bindTypeName(self, node, decl.name, decl.attrs) catch {};
                }
            }
            case ast::NodeValue::UnionDecl(decl) => {
                if symbolFor(self, node) == nil {
                    try bindTypeName(self, node, decl.name, decl.attrs) catch {};
                }
            }
            case ast::NodeValue::TraitDecl { name, attrs, .. } => {
                if symbolFor(self, node) == nil {
                    try bindTraitName(self, node, name, attrs) catch {};
                }
            }
            else => {}
        }
    }
}

/// Resolve all type bodies in a module.
unsafe fn resolveTypeBodies 'arena (self: &mut Resolver 'arena, block: &ast::Block) throws (ResolveError) {
    for node in block.statements {
        match node.value {
            case ast::NodeValue::RecordDecl(decl) => {
                try resolveRecordBody(self, node, decl) catch {
                    // Continue resolving other types even if one fails.
                };
            }
            case ast::NodeValue::UnionDecl(decl) => {
                try resolveUnionBody(self, node, decl) catch {
                    // Continue resolving other types even if one fails.
                };
            }
            case ast::NodeValue::TraitDecl { supertraits, methods, .. } => {
                try resolveTraitBody(self, node, supertraits, methods) catch {
                    // Continue resolving other types even if one fails.
                };
            }
            else => {
                // Ignore other declarations.
            }
        }
    }
}

/// Analyze module declarations. This pass processes all top-level statements. When it hits
/// a `mod` statement, it recurses inside the module, analyzing its statements. Module import
/// statements (`use`) are processed here, and make use of the module graph established in the
/// previous pass.
///
/// This function uses a two-phase approach:
/// Phase 1: Bind all type names to allow forward references and mutual recursion.
/// Phase 2: Resolve type bodies, ie. field types, variant types, etc.
unsafe fn resolveModuleDecls 'arena (res: &mut Resolver 'arena, block: &ast::Block) throws (ResolveError) {
    // Phase 1: Bind all type names as placeholders.
    try bindTypeNames(res, block);
    // Phase 2: Process imports so names available from the module graph can
    // be used in function signatures.
    for node in block.statements {
        if let case ast::NodeValue::Use(decl) = node.value {
            try resolveUse(res, node, decl);
        }
    }
    // Phase 3: Bind function signatures so that function references are
    // available in constant and static initializers.
    for node in block.statements {
        if let case ast::NodeValue::FnDecl(decl) = node.value {
            try resolveFnDecl(res, node, decl);
        }
    }
    // Phase 4: Process constants before submodules, so that child modules
    // can reference parent constants via `super::`.
    for node in block.statements {
        if let case ast::NodeValue::ConstDecl(_) = node.value {
            try infer(res, node);
        }
    }
    // Phase 5: Process submodule declarations -- recurses into child modules.
    // Child modules may trigger on-demand type resolution via
    // [`ensureNominalResolved`] which switches to the declaring module's
    // scope.
    for node in block.statements {
        if let case ast::NodeValue::Mod(decl) = node.value {
            try resolveModDecl(res, node, decl);
        }
    }
    // Phase 5b: Process wildcard imports after submodules are resolved,
    // so that transitive re-exports (export use foo::*) are visible.
    for node in block.statements {
        if let case ast::NodeValue::Use(decl) = node.value {
            if decl.wildcard {
                try resolveUse(res, node, decl);
            }
        }
    }
    // Phase 6: Resolve type bodies (record fields, union variants).
    try resolveTypeBodies(res, block);
    // Phase 7: Process all other declarations (statics, etc.).
    for stmt in block.statements {
        try visitDecl(res, stmt);
    }
}

/// Create a place with no storage root or field projections.
fn emptyBorrowPlace() -> BorrowPlace {
    return BorrowPlace { root: nil, fields: [0; MAX_BORROW_FIELDS], len: 0, precise: true };
}

/// Create initialized loan and loop scratch state for one function.
fn linearChecker 'arena 'checking (
    resolver: &'checking mut Resolver 'arena, regions: ?*RegionScope
) -> LinearChecker 'arena 'checking where 'arena: 'checking {
    let place = emptyBorrowPlace();
    return LinearChecker 'arena 'checking {
        resolver,
        regional: [nil; MAX_REGIONAL_LOANS],
        regionalLen: 0,
        regions,
        loopBackLoans: [0; MAX_LINEAR_LOOP_DEPTH],
        loopExitLoans: [0; MAX_LINEAR_LOOP_DEPTH],
        loopRegions: [nil; MAX_LINEAR_LOOP_DEPTH],
        loans: [place; MAX_LINEAR_BINDINGS],
        loanLen: 0,
        locals: [LocalLoan {
            binding: nil, place, exclusive: false, permission: nil, storage: nil,
        }; MAX_LINEAR_BINDINGS],
        localLen: 0,
        authorityPermissions: [nil; MAX_LINEAR_BINDINGS],
        authorityBindings: [nil; MAX_LINEAR_BINDINGS],
        authorityExclusive: [false; MAX_LINEAR_BINDINGS],
        authorityLen: 0,
        payloadAddress: nil,
        witnessPermission: nil,
        loopMarks: [0; MAX_LINEAR_LOOP_DEPTH],
        loopAvailable: [0; MAX_LINEAR_LOOP_DEPTH],
        loopExitAvailable: [0; MAX_LINEAR_LOOP_DEPTH],
        loopHasNaturalExit: [false; MAX_LINEAR_LOOP_DEPTH],
        loopBreakSeen: [false; MAX_LINEAR_LOOP_DEPTH],
        loopDepth: 0,
    };
}

/// Create an empty ownership environment with initialized binding slots.
fn linearEnv() -> LinearEnv {
    return LinearEnv {
        regionalLoans: 0,
        symbols: [nil; MAX_LINEAR_BINDINGS],
        available: 0,
        len: 0,
        terminated: false,
    };
}

/// Read initialized binding metadata from the active prefix.
fn linearSymbol(env: &LinearEnv, index: u32) -> TrackedSymbol {
    assert index < env.len, "linearSymbol: binding index outside active prefix";
    let symbol = env.symbols[index] else panic "linearSymbol: missing active binding";
    return symbol;
}

/// Find a tracked binding by symbol identity.
fn findLinearBinding(env: &LinearEnv, symbolId: u32) -> ?u32 {
    for i in 0..env.len {
        if linearSymbol(env, i).id == symbolId {
            return i;
        }
    }
    return nil;
}

/// Return whether a tracked binding is still available.
fn linearBindingAvailable(env: &LinearEnv, index: u32) -> bool {
    return (env.available & ((1 as u64) << (index as u64))) <> 0;
}

/// Find the newest live authority for a cell permission.
unsafe fn findCellAuthority 'arena 'checking (
    checker: &LinearChecker 'arena 'checking,
    env: &LinearEnv,
    permission: *unsafe types::Region,
) -> ?u32 where 'arena: 'checking {
    let mut i = checker.authorityLen;
    while i > 0 {
        set i -= 1;
        let candidate = checker.authorityPermissions[i] else continue;
        if candidate.id <> permission.id {
            continue;
        }
        let binding = checker.authorityBindings[i]
            else panic "findCellAuthority: missing authority binding";
        if let bindingIndex = findLinearBinding(env, binding.id);
            not linearBindingAvailable(env, bindingIndex)
        {
            continue;
        }
        return i;
    }
    return nil;
}

/// Add a local binding when its resolved type moves by value.
unsafe fn addLinearBinding 'arena 'checking (checker: &mut LinearChecker 'arena 'checking, env: &mut LinearEnv, node: *ast::Node)
    throws (ResolveError) where 'arena: 'checking
{
    let sym = symbolFor(checker.resolver, node) else return;
    let case SymbolData::Value { type: ty, .. } = sym.data else return;
    if not isMoveOnly(ty) {
        return;
    }
    if env.len >= MAX_LINEAR_BINDINGS {
        throw emitError(checker.resolver, node, ErrorKind::Internal);
    }
    let usage = BindingUse::Linear if isLinear(ty) else BindingUse::Affine;
    set env.symbols[env.len] = TrackedSymbol { id: sym.id, name: sym.name, node: sym.node, usage };
    set env.available |= (1 as u64) << (env.len as u64);
    set env.len += 1;
}

/// Mark a tracked binding as uninitialized.
fn markLinearBindingUnavailable 'arena (self: &mut Resolver 'arena, env: &mut LinearEnv, node: *ast::Node) {
    let binding = self.nodeData.entries[node.id].binding else return;
    let index = findLinearBinding(env, binding.id) else return;
    set env.available &= ~((1 as u64) << (index as u64));
}

/// Require exact-use bindings introduced after `start` to be consumed.
fn finishLinearScope 'arena 'checking (
    checker: &mut LinearChecker 'arena 'checking,
    env: &mut LinearEnv,
    start: u32,
) throws (ResolveError) where 'arena: 'checking {
    if not env.terminated {
        for i in start..env.len {
            if linearBindingAvailable(env, i) {
                let sym = linearSymbol(env, i);
                if sym.usage == BindingUse::Linear {
                    throw emitError(
                        checker.resolver,
                        sym.node,
                        ErrorKind::LinearNotConsumed(sym.name),
                    );
                }
            }
        }
    }
    set env.len = start;
}

/// Require a tracked identifier to remain available for any access.
fn checkLinearIdent 'arena 'checking (
    checker: &mut LinearChecker 'arena 'checking,
    env: &mut LinearEnv,
    node: *ast::Node,
) throws (ResolveError) where 'arena: 'checking {
    let binding = checker.resolver.nodeData.entries[node.id].binding else return;
    let index = findLinearBinding(env, binding.id) else return;
    if not linearBindingAvailable(env, index) {
        let sym = linearSymbol(env, index);
        let kind = ErrorKind::LinearUseAfterConsume(sym.name) if sym.usage == BindingUse::Linear
            else ErrorKind::AffineUseAfterMove(sym.name);
        throw emitError(checker.resolver, node, kind);
    }
}

/// Move or consume a tracked identifier once.
fn consumeLinearIdent 'arena 'checking (
    checker: &mut LinearChecker 'arena 'checking,
    env: &mut LinearEnv,
    node: *ast::Node,
) throws (ResolveError) where 'arena: 'checking {
    try checkLinearIdent(checker, env, node);
    let binding = checker.resolver.nodeData.entries[node.id].binding else return;
    let index = findLinearBinding(env, binding.id) else return;
    set env.available &= ~((1 as u64) << (index as u64));
}

/// Merge ownership availability across two live branches.
/// Validate both inputs before writing to an output that can alias either input.
fn joinLinearBranches 'arena 'checking (
    checker: &mut LinearChecker 'arena 'checking,
    env: &mut LinearEnv,
    left: &LinearEnv,
    right: &LinearEnv,
    node: *ast::Node,
) throws (ResolveError) where 'arena: 'checking {
    if left.terminated and right.terminated {
        set *env = *left;
        set env.terminated = true;
        return;
    }
    if left.terminated {
        set *env = *right;
        return;
    }
    if right.terminated {
        set *env = *left;
        return;
    }
    assert left.len == right.len, "joinLinearBranches: scope mismatch";
    let mut available = left.available;
    for i in 0..left.len {
        if linearBindingAvailable(left, i) <> linearBindingAvailable(right, i) {
            let sym = linearSymbol(left, i);
            if sym.usage == BindingUse::Linear {
                throw emitError(
                    checker.resolver,
                    node,
                    ErrorKind::LinearBranchMismatch(sym.name),
                );
            }
            set available &= ~((1 as u64) << (i as u64));
        }
    }
    let regionalLoans = left.regionalLoans | right.regionalLoans;
    set *env = *left;
    set env.available = available;
    set env.regionalLoans = regionalLoans;
}

/// Require all available exact-use bindings to be consumed at a function exit.
fn finishLinearExit 'arena 'checking (
    checker: &mut LinearChecker 'arena 'checking,
    env: &mut LinearEnv,
) throws (ResolveError) where 'arena: 'checking {
    if env.terminated {
        return;
    }
    for i in 0..env.len {
        if linearBindingAvailable(env, i) {
            let sym = linearSymbol(env, i);
            if sym.usage == BindingUse::Linear {
                throw emitError(
                    checker.resolver,
                    sym.node,
                    ErrorKind::LinearNotConsumed(sym.name),
                );
            }
        }
    }
    set env.terminated = true;
}

/// Find the local root borrowed or consumed by an argument expression.
fn linearRootSymbol 'arena (self: &mut Resolver 'arena, node: *ast::Node) -> ?*unsafe mut Symbol {
    match node.value {
        case ast::NodeValue::Ident(_), ast::NodeValue::ScopeAccess(_) =>
            return symbolFor(self, node),
        case ast::NodeValue::As(expr) => return linearRootSymbol(self, expr.value),
        case ast::NodeValue::AddressOf(addr) => return linearRootSymbol(self, addr.target),
        case ast::NodeValue::FieldAccess(access) =>
            return linearRootSymbol(self, access.parent),
        case ast::NodeValue::Subscript { container, .. } =>
            return linearRootSymbol(self, container),
        case ast::NodeValue::Deref(target) => return linearRootSymbol(self, target),
        else => return nil,
    }
}

/// A projection loan that remains active until its named region ends.
record RegionalLoan: Copy {
    /// Address expression that supplies access to the loan.
    source: *ast::Node,
    /// Source identity of the projection's declared lifetime.
    regionId: u32,
    /// Storage protected by the projection.
    place: BorrowPlace,
    /// Whether accesses through other references are excluded.
    exclusive: bool,
}

/// Read an initialized regional loan from the active prefix.
fn regionalLoan 'arena 'checking (
    checker: &LinearChecker 'arena 'checking, index: u32
) -> RegionalLoan where 'arena: 'checking {
    assert index < checker.regionalLen, "regionalLoan: index outside active prefix";
    let loan = checker.regional[index] else panic "regionalLoan: missing active loan";
    return loan;
}

/// Return whether a region identity is visible in a lexical environment.
fn regionInScope(scope: ?*RegionScope, regionId: u32) -> bool {
    let mut cursor = scope;
    while let current = cursor {
        if regionIndex(current, regionId) <> nil {
            return true;
        }
        set cursor = current.parent;
    }
    return false;
}

/// Retain only loans whose regions remain active at a control-flow destination.
fn regionalLoansInScope 'arena 'checking (checker: &LinearChecker 'arena 'checking, mask: u64, scope: ?*RegionScope) -> u64 where 'arena: 'checking {
    let mut result: u64 = 0;
    for i in 0..checker.regionalLen {
        let bit = (1 as u64) << (i as u64);
        if (mask & bit) <> 0 and regionInScope(scope, regionalLoan(checker, i).regionId) {
            set result |= bit;
        }
    }
    return result;
}

/// Remap one loan mask after the regional loan table is compacted.
fn remapRegionalLoans(mask: u64, mapping: &[u64]) -> u64 {
    let mut result: u64 = 0;
    for replacement, i in mapping {
        if (mask & ((1 as u64) << (i as u64))) <> 0 {
            set result |= replacement;
        }
    }
    return result;
}

/// Reclaim ended-region entries and preserve loans for enclosing regions.
fn compactRegionalLoans 'arena 'checking (
    checker: &mut LinearChecker 'arena 'checking, env: &mut LinearEnv,
    scope: ?*RegionScope
) where 'arena: 'checking {
    let oldLen = checker.regionalLen;
    let mut mapping: [u64; MAX_REGIONAL_LOANS] = [0; MAX_REGIONAL_LOANS];
    let mut next: u32 = 0;
    for i in 0..oldLen {
        let loan = regionalLoan(checker, i);
        if regionInScope(scope, loan.regionId) {
            set checker.regional[next] = loan;
            set mapping[i] = (1 as u64) << (next as u64);
            set next += 1;
        }
    }
    set env.regionalLoans = remapRegionalLoans(env.regionalLoans, &mapping[..oldLen]);
    for i in 0..checker.loopDepth {
        set checker.loopBackLoans[i] = remapRegionalLoans(checker.loopBackLoans[i], &mapping[..oldLen]);
        set checker.loopExitLoans[i] = remapRegionalLoans(checker.loopExitLoans[i], &mapping[..oldLen]);
    }
    set checker.regionalLen = next;
}

/// Check whether an access comes from the reference created by a projection.
unsafe fn usesRegionalLoan 'arena (self: &mut Resolver 'arena, node: *ast::Node, source: *ast::Node) -> bool {
    if node.id == source.id {
        return true;
    }
    let root = linearRootSymbol(self, node) else return false;
    let origin = localReferenceSource(root) else return false;
    return usesRegionalLoan(self, origin, source);
}

/// Retain a full-region projection independently of its local binding scope.
unsafe fn addRegionalLoan 'arena 'checking (
    checker: &mut LinearChecker 'arena 'checking, env: &mut LinearEnv, node: *ast::Node, address: ast::AddressOf
) throws (ResolveError) where 'arena: 'checking {
    let ty = typeFor(checker.resolver, node) else return;
    let mut class = types::PointerClass::Ref;
    match ty {
        case Type::Cell { class: cellClass, .. } => set class = cellClass,
        case Type::Pointer { class: pointerClass, .. } => set class = pointerClass,
        case Type::Slice { class: sliceClass, .. } => set class = sliceClass,
        else => return,
    }
    let case types::PointerClass::Region(region) = class else return;
    let storage = addressStorageClass(checker.resolver, address.target);
    let case types::PointerClass::Region(parent) = storage else return;
    if parent.id <> region.id {
        return;
    }
    let place = borrowPlace(checker.resolver, address.target);
    if place.root == nil {
        return;
    }
    for i in 0..checker.regionalLen {
        let loan = regionalLoan(checker, i);
        if loan.source.id == node.id {
            set env.regionalLoans |= (1 as u64) << (i as u64);
            return;
        }
    }
    if checker.regionalLen >= MAX_REGIONAL_LOANS {
        throw emitError(checker.resolver, node, ErrorKind::RegionalLoanOverflow);
    }
    let index = checker.regionalLen;
    set checker.regional[index] = RegionalLoan { source: node, regionId: region.id, place, exclusive: ast::isExclusiveAddress(address) };
    set checker.regionalLen += 1;
    set env.regionalLoans |= (1 as u64) << (index as u64);
}

/// Return whether an initializer copies a shared reference with a named region.
/// Address expressions and casts retain a loan on their source storage.
fn copiesRegionalReference(ty: Type, value: *ast::Node) -> bool {
    if referenceRegion(ty) == nil or isMutablePointerLike(ty) {
        return false;
    }
    match value.value {
        case ast::NodeValue::AddressOf(_), ast::NodeValue::As(_) => return false,
        else => return true,
    }
}

/// Return the initializer that supplies a local reference's storage.
fn localReferenceSource(sym: &Symbol) -> ?*ast::Node {
    let case SymbolData::Value { type: ty, .. } = sym.data else return nil;
    if let case Type::Session(_) = ty {
        if let case ast::NodeValue::RegionBinding(binding) = sym.node.value {
            return binding.value;
        }
    }
    if isRefType(ty) {
        if let case ast::NodeValue::Let(binding) = sym.node.value {
            if copiesRegionalReference(ty, binding.value) {
                return nil;
            }
            return binding.value;
        }
        if let case ast::NodeValue::RegionBinding(binding) = sym.node.value {
            return binding.value;
        }
    }
    return nil;
}

/// Resolve a place through reference locals without extending its storage lifetime.
unsafe fn borrowPlace 'arena (self: &mut Resolver 'arena, node: *ast::Node) -> BorrowPlace {
    let mut place = emptyBorrowPlace();
    match node.value {
        case ast::NodeValue::Ident(_), ast::NodeValue::ScopeAccess(_) => {
            let sym = symbolFor(self, node) else return place;
            if let source = localReferenceSource(sym) {
                let origin = borrowPlace(self, source);
                if origin.root <> nil {
                    return origin;
                }
            }
            set place.root = sym;
        }
        case ast::NodeValue::AddressOf(addr) => return borrowPlace(self, addr.target),
        case ast::NodeValue::As(expr) => return borrowPlace(self, expr.value),
        case ast::NodeValue::FieldAccess(access) => {
            set place = borrowPlace(self, access.parent);
            if let ty = typeFor(self, access.parent) {
                if let case Type::Pointer { .. } = ty; not isRefType(ty) and place.len > 0 {
                    set place.len = 0;
                    set place.precise = false;
                }
                if let case Type::Nominal(NominalType::Record(_)) = autoDeref(ty);
                    place.precise and place.len < MAX_BORROW_FIELDS
                {
                    if let index = recordFieldIndexFor(self, access.child) {
                        set place.fields[place.len] = index;
                        set place.len += 1;
                        return place;
                    }
                }
            }
            set place.precise = false;
        }
        case ast::NodeValue::Subscript { container, .. } => {
            set place = borrowPlace(self, container);
            if let ty = typeFor(self, container) {
                if let case Type::Slice { class, .. } = autoDeref(ty); not types::isReference(class) {
                    set place.len = 0;
                }
            }
            set place.precise = false;
        }
        case ast::NodeValue::Deref(target) => {
            set place = borrowPlace(self, target);
            if let ty = typeFor(self, target); not isRefType(ty) and place.len > 0 {
                set place.len = 0;
                set place.precise = false;
            }
        }
        else => {}
    }
    return place;
}

/// Two places overlap unless distinct inline fields prove separation.
fn placesOverlap(left: &BorrowPlace, right: &BorrowPlace) -> bool {
    if left.root == nil or left.root <> right.root {
        return false;
    }
    let count = left.len if left.len < right.len else right.len;
    for i in 0..count {
        if left.fields[i] <> right.fields[i] {
            return false;
        }
    }
    return true;
}

/// Check whether access uses a reference or one of its lexical reborrows.
unsafe fn usesLocalLoan 'arena (self: &mut Resolver 'arena, node: *ast::Node, binding: *unsafe mut Symbol) -> bool {
    let root = linearRootSymbol(self, node) else return false;
    if root == binding {
        return true;
    }
    let source = localReferenceSource(root) else return false;
    return usesLocalLoan(self, source, binding);
}
/// Reject accesses that conflict with a reference in an active lexical scope.
unsafe fn checkLocalLoans 'arena 'checking (checker: &mut LinearChecker 'arena 'checking, env: &LinearEnv, node: *ast::Node, exclusive: bool)
    throws (ResolveError) where 'arena: 'checking
{
    let place = borrowPlace(checker.resolver, node);
    let root = place.root;
    if let placeRoot = root {
        for i in 0..checker.regionalLen {
            if (env.regionalLoans & ((1 as u64) << (i as u64))) == 0 {
                continue;
            }
            let loan = regionalLoan(checker, i);
            if (exclusive or loan.exclusive) and placesOverlap(&place, &loan.place)
                and not usesRegionalLoan(checker.resolver, node, loan.source)
            {
                throw emitError(
                    checker.resolver, node, ErrorKind::BorrowConflict(placeRoot.name),
                );
            }
        }
    }
    let mut accessRegion: ?*unsafe types::Region = nil;
    if let ty = typeFor(checker.resolver, node) {
        set accessRegion = referenceRegion(ty);
    }
    if let cellTy = try explicitCellPayload(checker.resolver, node) {
        let case Type::Cell { permission, .. } = cellTy
            else panic "checkLocalLoans: invalid cell payload";
        set accessRegion = permission;
    } else if let cellTy = try inferCellPayload(checker.resolver, node) {
        let case Type::Cell { permission, .. } = cellTy
            else panic "checkLocalLoans: invalid cell payload";
        set accessRegion = permission;
    }
    for i in 0..checker.localLen {
        let loan = checker.locals[i];
        let mut throughBinding = false;
        if let binding = loan.binding {
            set throughBinding = usesLocalLoan(checker.resolver, node, binding);
        }
        if let placeRoot = root;
            (exclusive or loan.exclusive) and placesOverlap(&place, &loan.place)
            and not throughBinding
        {
            throw emitError(
                checker.resolver, node, ErrorKind::BorrowConflict(placeRoot.name),
            );
        }
        let permission = loan.permission else continue;
        let region = accessRegion else continue;
        let mut identityMatches = permission.id == region.id;
        if let storage = loan.storage; storage.id == region.id {
            set identityMatches = true;
        }
        if not identityMatches or not (exclusive or loan.exclusive) or throughBinding {
            continue;
        }
        let mut name = permission.name;
        if let placeRoot = root {
            set name = placeRoot.name;
        }
        throw emitError(checker.resolver, node, ErrorKind::BorrowConflict(name));
    }
}

/// Return cell metadata for an explicit payload borrow through transparent wrappers.
unsafe fn explicitCellPayload 'arena (
    self: &mut Resolver 'arena, node: *ast::Node
) -> ?Type throws (ResolveError) {
    match node.value {
        case ast::NodeValue::AddressOf(address) =>
            return try inferCellPayload(self, address.target),
        case ast::NodeValue::As(cast) =>
            return try explicitCellPayload(self, cast.value),
        case ast::NodeValue::RegionApply { value, .. } =>
            return try explicitCellPayload(self, value),
        else => return nil,
    }
}

/// Retain source storage for local borrows and region headers.
unsafe fn addLocalLoan 'arena 'checking (checker: &mut LinearChecker 'arena 'checking, env: &LinearEnv, node: *ast::Node, binding: ast::Let)
    throws (ResolveError) where 'arena: 'checking
{
    let ty = typeFor(checker.resolver, binding.ident) else return;
    if not isRefType(ty) {
        let case Type::Session(_) = ty else return;
        let case ast::NodeValue::RegionBinding(_) = node.value else return;
    }
    if let case ast::NodeValue::Let(_) = node.value;
        copiesRegionalReference(ty, binding.value)
    {
        return;
    }
    let place = borrowPlace(checker.resolver, binding.value);
    if place.root == nil {
        if referenceRegion(ty) <> nil {
            return;
        }
        throw emitError(checker.resolver, node, ErrorKind::RefBinding);
    }
    if checker.localLen >= MAX_LINEAR_BINDINGS {
        throw emitError(checker.resolver, node, ErrorKind::Internal);
    }
    let sym = symbolFor(checker.resolver, node) else panic "reference without binding";
    let mut exclusive = isExclusiveArgument(ty) or createsCellBorrow(binding.value);
    if let case Type::Cell { .. } = ty {
        if let case ast::NodeValue::As(expr) = binding.value.value {
            if let source = typeFor(checker.resolver, expr.value) {
                if let case Type::Pointer { mutable: true, .. } = source {
                    set exclusive = true;
                }
            }
        }
    }
    try checkLocalLoans(checker, env, binding.value, exclusive);
    let mut permission: ?*unsafe types::Region = nil;
    let mut storage: ?*unsafe types::Region = nil;
    if let cellTy = try explicitCellPayload(checker.resolver, binding.value) {
        let case Type::Cell {
            class, permission: cellPermission, ..
        } = cellTy else panic "addLocalLoan: invalid cell payload";
        set permission = cellPermission;
        if let case types::PointerClass::Region(region) = class {
            set storage = region;
        }
    }
    set checker.locals[checker.localLen] = LocalLoan {
        binding: sym, place, exclusive, permission, storage,
    };
    set checker.localLen += 1;
}

/// Protect storage borrowed by a pointer pattern until its bindings leave scope.
unsafe fn addPatternLoan 'arena 'checking (checker: &mut LinearChecker 'arena 'checking, subject: *ast::Node)
    throws (ResolveError) where 'arena: 'checking
{
    let ty = typeFor(checker.resolver, subject) else return;
    if unwrapMatchSubject(ty).by == MatchBy::Value {
        return;
    }
    let place = borrowPlace(checker.resolver, subject);
    if place.root == nil {
        return;
    }
    if checker.loanLen >= MAX_LINEAR_BINDINGS {
        throw emitError(checker.resolver, subject, ErrorKind::Internal);
    }
    set checker.loans[checker.loanLen] = place;
    set checker.loanLen += 1;
}

/// Reject a write, mutable loan, or ownership transfer of a pattern source.
unsafe fn checkPatternLoan 'arena 'checking (checker: &mut LinearChecker 'arena 'checking, node: *ast::Node)
    throws (ResolveError) where 'arena: 'checking
{
    let place = borrowPlace(checker.resolver, node);
    let root = place.root else return;
    for i in 0..checker.loanLen {
        if placesOverlap(&checker.loans[i], &place) {
            throw emitError(checker.resolver, node, ErrorKind::BorrowConflict(root.name));
        }
    }
}

/// Return whether a parameter borrows its argument only for the call.
fn isBorrowedReferenceParameter(ty: Type) -> bool {
    if not isRefType(ty) {
        return false;
    }
    match ty {
        case Type::Cell { class, .. } => return class == types::PointerClass::Ref,
        case Type::Pointer { class, .. } => return class == types::PointerClass::Ref,
        case Type::Slice { class, .. } => return class == types::PointerClass::Ref,
        case Type::TraitObject { class, .. } => return class == types::PointerClass::Ref,
        else => return false,
    }
}

/// Return whether a type carries one region in the requested compile-time role.
/// Applied nominal visits are generation- and role-marked; unapplied nominals
/// cannot carry the queried free region and require no member traversal.
unsafe fn typeHasRegionRole 'arena (
    self: &mut Resolver 'arena,
    ty: Type,
    region: *unsafe types::Region,
    role: RegionTypeRole,
    generation: u32,
) -> bool {
    if role == RegionTypeRole::Reference {
        if let dependency = referenceRegion(ty); dependency == region {
            return true;
        }
    }
    match ty {
        case Type::Cell { permission, payload, .. } => {
            if role == RegionTypeRole::Retention {
                return typeHasRegionRole(
                    self, *payload, region, RegionTypeRole::Reference, generation,
                ) or typeHasRegionRole(
                    self, *payload, region, RegionTypeRole::Retention, generation,
                );
            }
            if role == RegionTypeRole::CellPermission {
                if let identity = permission; identity == region {
                    return true;
                }
            }
            return typeHasRegionRole(
                self, *payload, region, role, generation,
            );
        }
        case Type::Session(identity) =>
            return role == RegionTypeRole::Retention
                and types::regionContains(region, identity),
        case Type::Pointer { target, .. } =>
            return typeHasRegionRole(
                self, *target, region, role, generation,
            ),
        case Type::Slice { item, .. } =>
            return typeHasRegionRole(
                self, *item, region, role, generation,
            ),
        case Type::Array(array) =>
            return typeHasRegionRole(
                self, *array.item, region, role, generation,
            ),
        case Type::Optional(inner) =>
            return typeHasRegionRole(
                self, *inner, region, role, generation,
            ),
        case Type::Range { start, end } => {
            if let startType = start;
                typeHasRegionRole(
                    self, *startType, region, role, generation,
                )
            {
                return true;
            }
            if let endType = end {
                return typeHasRegionRole(
                    self, *endType, region, role, generation,
                );
            }
            return false;
        }
        case Type::Nominal(info) => {
            let applied = nominalApplication(info) else return false;
            if not visitNominalApplication(applied, generation, role) {
                // This application and role have no unvisited members.
                return false;
            }
            match *info {
                case NominalType::Record(recordType) => {
                    for field in recordType.fields {
                        if typeHasRegionRole(
                            self, field.fieldType, region, role, generation,
                        ) {
                            return true;
                        }
                    }
                }
                case NominalType::Union(unionType) => {
                    for variant in unionType.variants {
                        if typeHasRegionRole(
                            self, variant.valueType, region, role, generation,
                        ) {
                            return true;
                        }
                    }
                }
                // Linear checking normally sees completed applications. Deny
                // reuse without treating an unknown view as permission proof.
                case NominalType::Placeholder(_), NominalType::Resolving(_),
                     NominalType::Application(_) =>
                    return role <> RegionTypeRole::CellPermission,
            }
            return false;
        }
        case Type::Fn(info) => {
            for parameter in info.paramTypes {
                if typeHasRegionRole(
                    self, *parameter, region, role, generation,
                ) {
                    return true;
                }
            }
            for error in info.throwList {
                if typeHasRegionRole(
                    self, *error, region, role, generation,
                ) {
                    return true;
                }
            }
            return typeHasRegionRole(
                self, *info.returnType, region, role, generation,
            );
        }
        else => return false,
    }
}

/// Classify one call argument from the instantiated function contract.
/// Regional mutable authority is call-borrowed only when the contract uses its
/// region as cell permission and no result, error, other input, or mutable
/// receiver can retain a reference carrying that region.
unsafe fn callParameterUse 'arena (
    self: &mut Resolver 'arena,
    info: *FnType,
    parameterIndex: u32,
    receiver: ?Type,
    receiverMutable: bool,
) -> LinearUse {
    let parameter = *info.paramTypes[parameterIndex];
    if isBorrowedReferenceParameter(parameter) {
        return LinearUse::Borrow;
    }
    let case Type::Pointer {
        class: types::PointerClass::Region(region), mutable: true, ..
    } = parameter else return LinearUse::Consume;

    let permissionGeneration = nextNominalTraversalGeneration(self);
    let mut hasPermission = false;
    if let receiverType = receiver {
        set hasPermission = typeHasRegionRole(
            self, receiverType, region, RegionTypeRole::CellPermission,
            permissionGeneration,
        );
    }
    if not hasPermission {
        for candidate in info.paramTypes {
            if typeHasRegionRole(
                self, *candidate, region, RegionTypeRole::CellPermission,
                permissionGeneration,
            ) {
                set hasPermission = true;
                break;
            }
        }
    }
    if not hasPermission {
        for error in info.throwList {
            if typeHasRegionRole(
                self, *error, region, RegionTypeRole::CellPermission,
                permissionGeneration,
            ) {
                set hasPermission = true;
                break;
            }
        }
    }
    if not hasPermission {
        set hasPermission = typeHasRegionRole(
            self, *info.returnType, region, RegionTypeRole::CellPermission,
            permissionGeneration,
        );
    }
    if not hasPermission {
        return LinearUse::Consume;
    }

    // Results and thrown values outlive the call directly.
    let resultGeneration = nextNominalTraversalGeneration(self);
    if typeHasRegionRole(
        self, *info.returnType, region, RegionTypeRole::Reference,
        resultGeneration,
    ) {
        return LinearUse::Consume;
    }
    for error in info.throwList {
        if typeHasRegionRole(
            self, *error, region, RegionTypeRole::Reference, resultGeneration,
        ) {
            return LinearUse::Consume;
        }
    }

    // A mutable input can store the authority reference, while cells and
    // sessions provide interior retention even through an otherwise shared
    // contract position. Exclude the authority parameter itself.
    for candidate, i in info.paramTypes {
        if i == parameterIndex {
            continue;
        }
        let retentionGeneration = nextNominalTraversalGeneration(self);
        if typeHasRegionRole(
            self, *candidate, region, RegionTypeRole::Retention,
            retentionGeneration,
        ) {
            return LinearUse::Consume;
        }
        let referenceGeneration = nextNominalTraversalGeneration(self);
        if typeHasRegionRole(
            self, *candidate, region, RegionTypeRole::Reference,
            referenceGeneration,
        ) and isExclusiveArgument(*candidate) {
            return LinearUse::Consume;
        }
    }

    if let receiverType = receiver {
        let retentionGeneration = nextNominalTraversalGeneration(self);
        if typeHasRegionRole(
            self, receiverType, region, RegionTypeRole::Retention,
            retentionGeneration,
        ) {
            return LinearUse::Consume;
        }
        if receiverMutable {
            let referenceGeneration = nextNominalTraversalGeneration(self);
            if typeHasRegionRole(
                self, receiverType, region, RegionTypeRole::Reference,
                referenceGeneration,
            ) {
                return LinearUse::Consume;
            }
        }
    }
    return LinearUse::Borrow;
}

/// Return whether a parameter can mutate or consume its argument's storage.
unsafe fn isExclusiveArgument(ty: Type) -> bool {
    match ty {
        case Type::Pointer { mutable, .. } => return mutable,
        case Type::Slice { mutable, .. } => return mutable,
        case Type::TraitObject { mutable, .. } => return mutable,
        else => return isMoveOnly(ty),
    }
}

/// Add the value identifiers introduced by a pattern.
/// Return whether the pattern introduces references to its source storage.
unsafe fn addLinearPatternBindings 'arena 'checking (
    checker: &mut LinearChecker 'arena 'checking,
    env: &mut LinearEnv,
    pattern: *ast::Node,
) -> bool throws (ResolveError) where 'arena: 'checking {
    let mut hasReferences = false;
    match pattern.value {
        case ast::NodeValue::Ident(_) => {
            try addLinearBinding(checker, env, pattern);
            if let ty = typeFor(checker.resolver, pattern) {
                return isRefType(ty);
            }
        }
        case ast::NodeValue::Call(call) => {
            for arg in call.args {
                if try addLinearPatternBindings(checker, env, arg) {
                    set hasReferences = true;
                }
            }
        }
        case ast::NodeValue::RecordLit(lit) => {
            for fieldNode in lit.fields {
                let case ast::NodeValue::RecordLitField(field) = fieldNode.value
                    else panic "addLinearPatternBindings: expected field";
                if try addLinearPatternBindings(checker, env, field.value) {
                    set hasReferences = true;
                }
            }
        }
        case ast::NodeValue::ArrayLit(items) => {
            for item in items {
                if try addLinearPatternBindings(checker, env, item) {
                    set hasReferences = true;
                }
            }
        }
        else => {}
    }
    return hasReferences;
}

/// Check a lexical block and exact-use of locals introduced in it.
unsafe fn checkLinearBlock 'arena 'checking (
    checker: &mut LinearChecker 'arena 'checking,
    env: &mut LinearEnv,
    node: *ast::Node,
) throws (ResolveError) where 'arena: 'checking {
    let start = env.len;
    let localStart = checker.localLen;
    let authorityStart = checker.authorityLen;
    let case ast::NodeValue::Block(block) = node.value
        else panic "checkLinearBlock: expected block";
    for stmt in block.statements {
        if env.terminated {
            break;
        }
        try checkLinearNode(checker, env, stmt, LinearUse::Discard);
    }
    try finishLinearScope(checker, env, start);
    set checker.localLen = localStart;
    set checker.authorityLen = authorityStart;
}

/// Push a repeated-control-flow boundary.
/// Initialize all loop state at this depth before increasing `loopDepth`.
fn enterLinearLoop 'arena 'checking (checker: &mut LinearChecker 'arena 'checking, env: &LinearEnv) where 'arena: 'checking {
    assert checker.loopDepth < MAX_LINEAR_LOOP_DEPTH, "linear loop nesting overflow";
    let depth = checker.loopDepth;
    set checker.loopBackLoans[depth] = 0;
    set checker.loopExitLoans[depth] = 0;
    set checker.loopRegions[depth] = checker.regions;
    set checker.loopMarks[depth] = env.len;
    set checker.loopAvailable[depth] = env.available;
    set checker.loopExitAvailable[depth] = env.available;
    set checker.loopHasNaturalExit[depth] = false;
    set checker.loopBreakSeen[depth] = false;
    set checker.loopDepth += 1;
}

/// Require a repeated body's outer bindings to match its entry state.
fn checkLinearLoopBackEdge 'arena 'checking (
    checker: &mut LinearChecker 'arena 'checking,
    env: &LinearEnv,
    node: *ast::Node,
) throws (ResolveError) where 'arena: 'checking {
    if env.terminated {
        return;
    }
    assert checker.loopDepth > 0, "linear loop back edge outside loop";
    let depth = checker.loopDepth - 1;
    set checker.loopBackLoans[depth] |= regionalLoansInScope(checker, env.regionalLoans, checker.loopRegions[depth]);
    let mark = checker.loopMarks[depth];
    let entryAvailable = checker.loopAvailable[depth];
    for i in 0..mark {
        let bit = (1 as u64) << (i as u64);
        if (env.available & bit) <> (entryAvailable & bit) {
            let sym = linearSymbol(env, i);
            throw emitError(
                checker.resolver,
                node,
                ErrorKind::LinearBranchMismatch(sym.name),
            );
        }
    }
}

/// Record the ownership state of a loop's condition-false exit.
fn setLinearLoopNaturalExit 'arena 'checking (checker: &mut LinearChecker 'arena 'checking, env: &LinearEnv) where 'arena: 'checking {
    assert checker.loopDepth > 0, "linear loop exit outside loop";
    let depth = checker.loopDepth - 1;
    set checker.loopExitLoans[depth] |= regionalLoansInScope(checker, env.regionalLoans, checker.loopRegions[depth]);
    set checker.loopExitAvailable[depth] = env.available;
    set checker.loopHasNaturalExit[depth] = true;
}

/// Require a break exit to agree with every other exit from this loop.
fn checkLinearLoopBreak 'arena 'checking (
    checker: &mut LinearChecker 'arena 'checking,
    env: &LinearEnv,
    node: *ast::Node,
) throws (ResolveError) where 'arena: 'checking {
    assert checker.loopDepth > 0, "linear loop break outside loop";
    let depth = checker.loopDepth - 1;
    set checker.loopExitLoans[depth] |= regionalLoansInScope(checker, env.regionalLoans, checker.loopRegions[depth]);
    let mark = checker.loopMarks[depth];
    if checker.loopHasNaturalExit[depth] or checker.loopBreakSeen[depth] {
        let expected = checker.loopExitAvailable[depth];
        for i in 0..mark {
            let bit = (1 as u64) << (i as u64);
            if (env.available & bit) <> (expected & bit) {
                let sym = linearSymbol(env, i);
                throw emitError(
                    checker.resolver,
                    node,
                    ErrorKind::LinearBranchMismatch(sym.name),
                );
            }
        }
    } else {
        set checker.loopExitAvailable[depth] = env.available;
    }
    set checker.loopBreakSeen[depth] = true;
}

/// Pop a repeated-control-flow boundary.
fn exitLinearLoop 'arena 'checking (checker: &mut LinearChecker 'arena 'checking) where 'arena: 'checking {
    assert checker.loopDepth > 0, "exitLinearLoop: not in loop";
    set checker.loopDepth -= 1;
}

/// Check a conditional and merge its ownership states.
unsafe fn checkLinearIf 'arena 'checking (
    checker: &mut LinearChecker 'arena 'checking,
    env: &mut LinearEnv,
    node: *ast::Node,
    conditional: ast::If,
) throws (ResolveError) where 'arena: 'checking {
    try checkLinearNode(checker, env, conditional.condition, LinearUse::Consume);
    let base = *env;
    let mut thenEnv = base;
    try checkLinearNode(checker, &mut thenEnv, conditional.thenBranch, LinearUse::Discard);
    let mut elseEnv = base;
    if let branch = conditional.elseBranch {
        try checkLinearNode(checker, &mut elseEnv, branch, LinearUse::Discard);
    }
    try joinLinearBranches(checker, env, &thenEnv, &elseEnv, node);
}

/// Check an expression conditional and merge its ownership states.
unsafe fn checkLinearCondExpr 'arena 'checking (
    checker: &mut LinearChecker 'arena 'checking,
    env: &mut LinearEnv,
    node: *ast::Node,
    conditional: ast::CondExpr,
    usage: LinearUse,
) throws (ResolveError) where 'arena: 'checking {
    try checkLinearNode(checker, env, conditional.condition, LinearUse::Consume);
    let base = *env;
    let mut thenEnv = base;
    try checkLinearNode(checker, &mut thenEnv, conditional.thenExpr, usage);
    let mut elseEnv = base;
    try checkLinearNode(checker, &mut elseEnv, conditional.elseExpr, usage);
    try joinLinearBranches(checker, env, &thenEnv, &elseEnv, node);
}

/// Pointer patterns borrow their subject; value patterns consume it.
fn patternSubjectUse 'arena (self: &Resolver 'arena, subject: *ast::Node) -> LinearUse {
    if let ty = typeFor(self, subject) {
        if let case Type::Pointer { .. } = ty {
            return LinearUse::Borrow;
        }
    }
    return LinearUse::Consume;
}

/// Check a match expression, including ownership transferred into patterns.
unsafe fn checkLinearMatch 'arena 'checking (
    checker: &mut LinearChecker 'arena 'checking,
    env: &mut LinearEnv,
    node: *ast::Node,
    matchExpr: ast::Match,
) throws (ResolveError) where 'arena: 'checking {
    try checkLinearNode(checker, env, matchExpr.subject, patternSubjectUse(checker.resolver, matchExpr.subject));
    let base = *env;
    let mut haveResult = false;
    let mut result = base;
    for prongNode in matchExpr.prongs {
        let case ast::NodeValue::MatchProng(prong) = prongNode.value
            else panic "checkLinearMatch: expected prong";
        let mut branch = base;
        let bindingsStart = branch.len;
        let loanStart = checker.loanLen;
        match prong.arm {
            case ast::ProngArm::Case(patterns) => {
                for pattern in patterns {
                    if try addLinearPatternBindings(checker, &mut branch, pattern) {
                        try addPatternLoan(checker, matchExpr.subject);
                    }
                }
            }
            case ast::ProngArm::Binding(binding) => {
                if try addLinearPatternBindings(checker, &mut branch, binding) {
                    try addPatternLoan(checker, matchExpr.subject);
                }
            }
            case ast::ProngArm::Else => {}
        }
        if prong.guard <> nil {
            for i in bindingsStart..branch.len {
                let sym = linearSymbol(&branch, i);
                if sym.usage == BindingUse::Linear {
                    throw emitError(checker.resolver, prongNode, ErrorKind::LinearDiscard);
                }
            }
        }
        if let guard = prong.guard {
            try checkLinearNode(checker, &mut branch, guard, LinearUse::Consume);
        }
        try checkLinearNode(checker, &mut branch, prong.body, LinearUse::Discard);
        try finishLinearScope(checker, &mut branch, bindingsStart);
        set checker.loanLen = loanStart;
        if haveResult {
            let previous = result;
        try joinLinearBranches(checker, &mut result, &previous, &branch, node);
        } else {
            set result = branch;
            set haveResult = true;
        }
    }
    if haveResult {
        set *env = result;
    }
}

/// Check call-scoped loans and argument ownership transfers.
unsafe fn checkLinearCall 'arena 'checking (
    checker: &mut LinearChecker 'arena 'checking,
    env: &mut LinearEnv,
    node: *ast::Node,
    call: ast::Call,
) throws (ResolveError) where 'arena: 'checking {
    let localStart = checker.localLen;
    match checker.resolver.nodeData.entries[node.id].extra {
        case NodeExtra::SliceAppend { .. }, NodeExtra::SliceDelete { .. } => {
            let case ast::NodeValue::FieldAccess(access) = call.callee.value
                else panic "slice mutation without receiver";
            try checkPatternLoan(checker, access.parent);
            try checkLocalLoans(checker, env, access.parent, true);
        }
        else => {}
    }
    try checkLinearNode(checker, env, call.callee, LinearUse::Observe);
    let mut fnInfo: ?*FnType = nil;
    if let calleeTy = typeFor(checker.resolver, call.callee) {
        if let case Type::Fn(info) = calleeTy {
            set fnInfo = info;
        }
    }
    if fnInfo == nil {
        match checker.resolver.nodeData.entries[node.id].extra {
            case NodeExtra::TraitMethodCall { traitInfo, methodIndex } =>
                set fnInfo = traitInfo.methods[methodIndex].fnType,
            case NodeExtra::MethodCall { method } => set fnInfo = method.fnType,
            else => {}
        }
    }
    let info = fnInfo else {
        for arg in call.args {
            try checkLinearNode(checker, env, arg, LinearUse::Consume);
        }
        return;
    };
    let mut arguments: [?CallArgument; MAX_FN_PARAMS + 1] = [nil; MAX_FN_PARAMS + 1];
    let mut argumentsLen: u32 = 0;
    let mut contractReceiver: ?Type = nil;
    let mut contractReceiverMutable = false;

    // Method function types exclude their implicit receiver. Account for it
    // explicitly so owning receivers are consumed and reference receivers
    // participate in call-scoped loan conflict checks.
    if let case ast::NodeValue::FieldAccess(access) = call.callee.value {
        let mut receiverClass = types::PointerClass::Unsafe;
        let mut receiverMutable = false;
        let mut haveReceiver = false;
        match checker.resolver.nodeData.entries[node.id].extra {
            case NodeExtra::TraitMethodCall { traitInfo, methodIndex } => {
                let method = &traitInfo.methods[methodIndex];
                set receiverClass = method.receiverClass;
                set receiverMutable = method.mutable;
                set haveReceiver = true;
            }
            case NodeExtra::MethodCall { method } => {
                set receiverClass = method.receiverClass;
                set receiverMutable = method.mutable;
                set haveReceiver = true;
            }
            else => {}
        }
        if haveReceiver {
            if let receiverType = typeFor(checker.resolver, access.parent) {
                set contractReceiver = autoDeref(receiverType);
            }
            set contractReceiverMutable = receiverMutable;
            try checkLocalLoans(checker, env, access.parent,
                receiverMutable or receiverClass == types::PointerClass::Owned);
            if receiverMutable or receiverClass == types::PointerClass::Owned {
                try checkPatternLoan(checker, access.parent);
            }
            if receiverClass <> types::PointerClass::Unsafe {
                set arguments[argumentsLen] = CallArgument {
                    node: access.parent,
                    exclusive: receiverClass == types::PointerClass::Owned or receiverMutable,
                };
                set argumentsLen += 1;
            }
            if types::isReference(receiverClass) {
                try checkLinearNode(checker, env, access.parent, LinearUse::Borrow);
                if createsExplicitBorrow(access.parent) {
                    try retainCallLoan(checker, access.parent, receiverMutable);
                }
            } else if receiverClass == types::PointerClass::Owned {
                try checkLinearNode(checker, env, access.parent, LinearUse::Consume);
            }
        }
    }

    for arg, i in call.args {
        let expected = *info.paramTypes[i];
        let argExclusive = isExclusiveArgument(expected) or createsCellBorrow(arg);
        if argExclusive {
            try checkPatternLoan(checker, arg);
        }
        if not isUnsafePointerType(expected) {
            for j in 0..argumentsLen {
                let previous = arguments[j] else panic "checkLinearCall: missing active argument";
                if previous.exclusive or argExclusive {
                    if let name = callArgumentConflict(checker.resolver, previous.node, arg) {
                        throw emitError(checker.resolver, arg, ErrorKind::BorrowConflict(name));
                    }
                }
            }
            set arguments[argumentsLen] = CallArgument { node: arg, exclusive: argExclusive };
            set argumentsLen += 1;
        }
        try checkLocalLoans(checker, env, arg, argExclusive);
        let argumentUse = callParameterUse(
            checker.resolver, info, i, contractReceiver, contractReceiverMutable,
        );
        try checkLinearNode(checker, env, arg, argumentUse);
        if isRefType(expected) and createsExplicitBorrow(arg) {
            try retainCallLoan(checker, arg, argExclusive);
        }
    }
    set checker.localLen = localStart;
    if *info.returnType == Type::Never and info.throwList.len == 0 {
        set env.terminated = true;
    }
}

/// Return the storage name when two call arguments can address the same place.
unsafe fn callArgumentConflict 'arena (
    self: &mut Resolver 'arena, left: *ast::Node, right: *ast::Node
) -> ?*[u8] {
    match left.value {
        case ast::NodeValue::CondExpr(cond) => {
            if let name = callArgumentConflict(self, cond.thenExpr, right) {
                return name;
            }
            return callArgumentConflict(self, cond.elseExpr, right);
        }
        case ast::NodeValue::As(cast) => return callArgumentConflict(self, cast.value, right),
        case ast::NodeValue::RegionApply { value, .. } => return callArgumentConflict(self, value, right),
        else => {}
    }
    match right.value {
        case ast::NodeValue::CondExpr(cond) => {
            if let name = callArgumentConflict(self, left, cond.thenExpr) {
                return name;
            }
            return callArgumentConflict(self, left, cond.elseExpr);
        }
        case ast::NodeValue::As(cast) => return callArgumentConflict(self, left, cast.value),
        case ast::NodeValue::RegionApply { value, .. } => return callArgumentConflict(self, left, value),
        else => {}
    }
    let leftPlace = borrowPlace(self, left);
    let rightPlace = borrowPlace(self, right);
    if placesOverlap(&leftPlace, &rightPlace) {
        let root = rightPlace.root else panic "callArgumentConflict: overlap without root";
        return root.name;
    }
    return nil;
}

/// Return whether evaluating an argument creates an explicit address borrow.
fn createsExplicitBorrow(node: *ast::Node) -> bool {
    match node.value {
        case ast::NodeValue::AddressOf(_) => return true,
        case ast::NodeValue::As(cast) => return createsExplicitBorrow(cast.value),
        case ast::NodeValue::RegionApply { value, .. } => return createsExplicitBorrow(value),
        case ast::NodeValue::CondExpr(cond) =>
            return createsExplicitBorrow(cond.thenExpr) or createsExplicitBorrow(cond.elseExpr),
        else => return false,
    }
}

/// Protect explicit address arguments until their call begins.
unsafe fn retainCallLoan 'arena 'checking (
    checker: &mut LinearChecker 'arena 'checking, node: *ast::Node, exclusive: bool
) throws (ResolveError) where 'arena: 'checking {
    match node.value {
        case ast::NodeValue::CondExpr(cond) => {
            try retainCallLoan(checker, cond.thenExpr, exclusive);
            try retainCallLoan(checker, cond.elseExpr, exclusive);
            return;
        }
        case ast::NodeValue::As(cast) => {
            try retainCallLoan(checker, cast.value, exclusive);
            return;
        }
        case ast::NodeValue::RegionApply { value, .. } => {
            try retainCallLoan(checker, value, exclusive);
            return;
        }
        else => {}
    }
    let place = borrowPlace(checker.resolver, node);
    if place.root == nil {
        return;
    }
    if checker.localLen >= MAX_LINEAR_BINDINGS {
        throw emitError(checker.resolver, node, ErrorKind::Internal);
    }
    let mut permission: ?*unsafe types::Region = nil;
    let mut storage: ?*unsafe types::Region = nil;
    if let cellTy = try explicitCellPayload(checker.resolver, node) {
        let case Type::Cell {
            class, permission: cellPermission, ..
        } = cellTy else panic "retainCallLoan: invalid cell payload";
        set permission = cellPermission;
        if let case types::PointerClass::Region(region) = class {
            set storage = region;
        }
    }
    set checker.locals[checker.localLen] = LocalLoan {
        binding: nil, place, exclusive, permission, storage,
    };
    set checker.localLen += 1;
}

/// Check a pattern conditional. Linear scrutinees require an exhaustive match.
unsafe fn checkLinearIfLet 'arena 'checking (
    checker: &mut LinearChecker 'arena 'checking,
    env: &mut LinearEnv,
    node: *ast::Node,
    conditional: ast::IfLet,
) throws (ResolveError) where 'arena: 'checking {
    if let subjectTy = typeFor(checker.resolver, conditional.pattern.scrutinee);
        isLinear(subjectTy)
    {
        throw emitError(
            checker.resolver,
            conditional.pattern.scrutinee,
            ErrorKind::LinearPartialMove,
        );
    }
    try checkLinearNode(
        checker,
        env,
        conditional.pattern.scrutinee,
        patternSubjectUse(checker.resolver, conditional.pattern.scrutinee),
    );
    let base = *env;
    let mut thenEnv = base;
    let bindingsStart = thenEnv.len;
    let loanStart = checker.loanLen;
    if try addLinearPatternBindings(checker, &mut thenEnv, conditional.pattern.pattern) {
        try addPatternLoan(checker, conditional.pattern.scrutinee);
    }
    expireAllocationLoans(checker, &mut thenEnv, conditional.pattern.pattern, conditional.pattern.scrutinee);
    if let guard = conditional.pattern.guard {
        try checkLinearNode(checker, &mut thenEnv, guard, LinearUse::Consume);
    }
    try checkLinearNode(checker, &mut thenEnv, conditional.thenBranch, LinearUse::Discard);
    try finishLinearScope(checker, &mut thenEnv, bindingsStart);
    set checker.loanLen = loanStart;
    let mut elseEnv = base;
    if let branch = conditional.elseBranch {
        try checkLinearNode(checker, &mut elseEnv, branch, LinearUse::Discard);
    }
    try joinLinearBranches(checker, env, &thenEnv, &elseEnv, node);
}

/// Check a repeated region-loan flow until its loop-entry mask is stable.
/// Each additional pass must add a bit from the bounded regional loan table.
unsafe fn checkLinearLoop 'arena 'checking (checker: &mut LinearChecker 'arena 'checking, env: &mut LinearEnv, node: *ast::Node)
    throws (ResolveError) where 'arena: 'checking
{
    if let case ast::NodeValue::For(forStmt) = node.value {
        try checkLinearNode(checker, env, forStmt.iterable, LinearUse::Consume);
    }
    let base = *env;
    let depth = checker.loopDepth;
    let mut entryLoans = base.regionalLoans;
    loop {
        let mut pass = base;
        set pass.regionalLoans = entryLoans;
        try checkLinearLoopPass(checker, &mut pass, node);
        let next = entryLoans | checker.loopBackLoans[depth];
        if next == entryLoans {
            set *env = pass;
            return;
        }
        set entryLoans = next;
    }
}

/// Check one pass through a loop with the current loop-entry loan state.
unsafe fn checkLinearLoopPass 'arena 'checking (checker: &mut LinearChecker 'arena 'checking, env: &mut LinearEnv, node: *ast::Node)
    throws (ResolveError) where 'arena: 'checking
{
    match node.value {
        case ast::NodeValue::While(whileStmt) => {
            enterLinearLoop(checker, env);
            try checkLinearNode(checker, env, whileStmt.condition, LinearUse::Consume);
            let conditionExit = *env;
            setLinearLoopNaturalExit(checker, &conditionExit);
            let mut bodyEnv = conditionExit;
            try checkLinearNode(checker, &mut bodyEnv, whileStmt.body, LinearUse::Discard);
            try checkLinearLoopBackEdge(checker, &bodyEnv, whileStmt.body);
            exitLinearLoop(checker);
            set *env = conditionExit;
            set env.regionalLoans = checker.loopExitLoans[checker.loopDepth];
            if let elseBranch = whileStmt.elseBranch {
                let mut elseEnv = conditionExit;
                try checkLinearNode(
                    checker,
                    &mut elseEnv,
                    elseBranch,
                    LinearUse::Discard,
                );
                let exits = *env;
                try joinLinearBranches(checker, env, &exits, &elseEnv, node);
            }
        }
        case ast::NodeValue::WhileLet(whileStmt) => {
            if let subjectTy = typeFor(checker.resolver, whileStmt.pattern.scrutinee);
                isLinear(subjectTy)
            {
                throw emitError(
                    checker.resolver,
                    whileStmt.pattern.scrutinee,
                    ErrorKind::LinearPartialMove,
                );
            }
            let base = *env;
            enterLinearLoop(checker, env);
            let mut bodyEnv = base;
            try checkLinearNode(
                checker,
                &mut bodyEnv,
                whileStmt.pattern.scrutinee,
                patternSubjectUse(checker.resolver, whileStmt.pattern.scrutinee),
            );
            let mut conditionExit = bodyEnv;
            let start = bodyEnv.len;
            let loanStart = checker.loanLen;
            if try addLinearPatternBindings(checker, &mut bodyEnv, whileStmt.pattern.pattern) {
                try addPatternLoan(checker, whileStmt.pattern.scrutinee);
            }
            expireAllocationLoans(checker, &mut bodyEnv, whileStmt.pattern.pattern, whileStmt.pattern.scrutinee);
            if let guard = whileStmt.pattern.guard {
                try checkLinearNode(checker, &mut bodyEnv, guard, LinearUse::Consume);
                let mut guardExit = bodyEnv;
                try finishLinearScope(checker, &mut guardExit, start);
                let previous = conditionExit;
                try joinLinearBranches(
                    checker,
                    &mut conditionExit,
                    &previous,
                    &guardExit,
                    guard,
                );
            }
            setLinearLoopNaturalExit(checker, &conditionExit);
            try checkLinearNode(checker, &mut bodyEnv, whileStmt.body, LinearUse::Discard);
            try finishLinearScope(checker, &mut bodyEnv, start);
            set checker.loanLen = loanStart;
            try checkLinearLoopBackEdge(checker, &bodyEnv, whileStmt.body);
            exitLinearLoop(checker);
            set *env = conditionExit;
            set env.regionalLoans = checker.loopExitLoans[checker.loopDepth];
            if let elseBranch = whileStmt.elseBranch {
                let mut elseEnv = conditionExit;
                try checkLinearNode(
                    checker,
                    &mut elseEnv,
                    elseBranch,
                    LinearUse::Discard,
                );
                let exits = *env;
                try joinLinearBranches(checker, env, &exits, &elseEnv, node);
            }
        }
        case ast::NodeValue::For(forStmt) => {
            if let iterableTy = typeFor(checker.resolver, forStmt.iterable) {
                if isLinear(iterableTy) {
                    throw emitError(
                        checker.resolver,
                        forStmt.iterable,
                        ErrorKind::LinearPartialMove,
                    );
                }
            }
            let base = *env;
            enterLinearLoop(checker, env);
            setLinearLoopNaturalExit(checker, &base);
            let mut bodyEnv = base;
            let start = bodyEnv.len;
            try addLinearBinding(checker, &mut bodyEnv, forStmt.binding);
            if let index = forStmt.index {
                try addLinearBinding(checker, &mut bodyEnv, index);
            }
            try checkLinearNode(checker, &mut bodyEnv, forStmt.body, LinearUse::Discard);
            try finishLinearScope(checker, &mut bodyEnv, start);
            try checkLinearLoopBackEdge(checker, &bodyEnv, forStmt.body);
            exitLinearLoop(checker);
            set *env = base;
            set env.regionalLoans = checker.loopExitLoans[checker.loopDepth];
            if let elseBranch = forStmt.elseBranch {
                let mut elseEnv = base;
                try checkLinearNode(
                    checker,
                    &mut elseEnv,
                    elseBranch,
                    LinearUse::Discard,
                );
                let exits = *env;
                try joinLinearBranches(checker, env, &exits, &elseEnv, node);
            }
        }
        case ast::NodeValue::Loop { body } => {
            let base = *env;
            enterLinearLoop(checker, env);
            let mut bodyEnv = base;
            try checkLinearNode(checker, &mut bodyEnv, body, LinearUse::Discard);
            try checkLinearLoopBackEdge(checker, &bodyEnv, body);
            let depth = checker.loopDepth - 1;
            let breakSeen = checker.loopBreakSeen[depth];
            let exitAvailable = checker.loopExitAvailable[depth];
            exitLinearLoop(checker);
            set *env = base;
            set env.regionalLoans = checker.loopExitLoans[checker.loopDepth];
            if breakSeen {
                set env.available = exitAvailable;
            } else {
                set env.terminated = true;
            }
        }
        else => panic "checkLinearLoopPass: expected loop",
    }
}

/// Transfer a cell's owning handle and check each address operand once.
unsafe fn checkCellAddressOwner 'arena 'checking (
    checker: &mut LinearChecker 'arena 'checking, env: &mut LinearEnv,
    node: *ast::Node, owner: *ast::Node
) throws (ResolveError) where 'arena: 'checking {
    if node == owner {
        try checkLinearNode(checker, env, node, LinearUse::Consume);
        return;
    }
    match node.value {
        case ast::NodeValue::Deref(target) => try checkCellAddressOwner(checker, env, target, owner),
        case ast::NodeValue::FieldAccess(access) => try checkCellAddressOwner(checker, env, access.parent, owner),
        case ast::NodeValue::Subscript { container, index } => {
            try checkCellAddressOwner(checker, env, container, owner);
            try checkLinearNode(checker, env, index, LinearUse::Consume);
        }
        else => panic "cell address owner must belong to its place",
    }
}

/// Fresh allocation storage has no loans from earlier loop iterations.
unsafe fn expireAllocationLoans 'arena 'checking (
    checker: &mut LinearChecker 'arena 'checking, env: &mut LinearEnv,
    node: *ast::Node, value: *ast::Node
) where 'arena: 'checking {
    let case ast::NodeValue::Try(allocation) = value.value else return;
    if allocation.catches.len <> 0 {
        return;
    }
    let case NodeExtra::SessionAllocation(_) = checker.resolver.nodeData.entries[allocation.expr.id].extra
        else return;
    let symbol = checker.resolver.nodeData.entries[node.id].binding else return;
    for i in 0..checker.regionalLen {
        if regionalLoan(checker, i).place.root == symbol.symbol {
            set env.regionalLoans &= ~((1 as u64) << (i as u64));
        }
    }
}

/// Check one expression or statement under an ownership-use context.
unsafe fn checkLinearNode 'arena 'checking (
    checker: &mut LinearChecker 'arena 'checking,
    env: &mut LinearEnv,
    node: *ast::Node,
    usage: LinearUse,
) throws (ResolveError) where 'arena: 'checking {
    if env.terminated {
        return;
    }
    if usage <> LinearUse::Locate {
        match node.value {
            case ast::NodeValue::Ident(_), ast::NodeValue::ScopeAccess(_),
                 ast::NodeValue::FieldAccess(_), ast::NodeValue::Subscript { .. },
                 ast::NodeValue::Deref(_) => {
                let mut exclusive = usage == LinearUse::Place
                    and not isCellDeref(checker.resolver, node);
                if usage == LinearUse::Consume {
                    if let ty = typeFor(checker.resolver, node) {
                        set exclusive = isExclusiveArgument(ty);
                    }
                }
                if let cellTy = try inferCellPayload(checker.resolver, node) {
                    let case Type::Cell { permission: controlled, .. } = cellTy
                        else panic "checkLinearNode: invalid cell payload";
                    if let permission = controlled {
                        let permissionExclusive = usage == LinearUse::Place;
                        for i in 0..checker.localLen {
                            let loan = checker.locals[i];
                            if let loanPermission = loan.permission;
                                loanPermission.id == permission.id
                                and (permissionExclusive or loan.exclusive)
                            {
                                throw emitError(
                                    checker.resolver, node,
                                    ErrorKind::BorrowConflict(permission.name),
                                );
                            }
                        }
                        let index = findCellAuthority(checker, env, permission)
                            else throw emitError(
                                checker.resolver, node,
                                ErrorKind::CellPermissionRequired(permission.name),
                            );
                        if permissionExclusive and not checker.authorityExclusive[index] {
                            throw emitError(
                                checker.resolver, node,
                                ErrorKind::CellPermissionRequired(permission.name),
                            );
                        }
                    }
                }
                try checkLocalLoans(checker, env, node, exclusive);
            }
            else => {}
        }
    }
    match node.value {
        case ast::NodeValue::Ident(_) => {
            if usage <> LinearUse::Place {
                try checkLinearIdent(checker, env, node);
            }
            if usage == LinearUse::Consume {
                if let ty = typeFor(checker.resolver, node); isExclusiveArgument(ty) {
                    try checkPatternLoan(checker, node);
                }
                try consumeLinearIdent(checker, env, node);
            }
        }
        case ast::NodeValue::ExprStmt(expr) => {
            if let exprTy = typeFor(checker.resolver, expr) {
                if isLinear(exprTy) {
                    throw emitError(checker.resolver, expr, ErrorKind::LinearDiscard);
                }
            }
            try checkLinearNode(checker, env, expr, LinearUse::Consume);
        }
        case ast::NodeValue::RegionBlock { bindings, body, .. } => {
            let previousRegions = checker.regions;
            let case NodeExtra::Regions(scope) = checker.resolver.nodeData.entries[node.id].extra else {
                if checker.resolver.errors.len > 0 {
                    return;
                }
                panic "checkLinearNode: missing region scope";
            };
            let start = env.len;
            let localStart = checker.localLen;
            let authorityStart = checker.authorityLen;
            let mut reborrowSources: [?*ast::Node; MAX_LINEAR_BINDINGS] =
                [nil; MAX_LINEAR_BINDINGS];
            let mut reborrowPermissions: [?*unsafe types::Region; MAX_LINEAR_BINDINGS] =
                [nil; MAX_LINEAR_BINDINGS];
            let mut reborrowExclusive: [bool; MAX_LINEAR_BINDINGS] =
                [false; MAX_LINEAR_BINDINGS];
            let mut reborrowLen: u32 = 0;
            for bindingNode in bindings {
                let case ast::NodeValue::RegionBinding(binding) = bindingNode.value
                    else panic "checkLinearNode: invalid borrow binding";
                let case ast::NodeValue::AddressOf(address) = binding.value.value
                    else continue;
                if address.kind == ast::AddressKind::Cell {
                    continue;
                }
                let case ast::NodeValue::Deref(source) = address.target.value
                    else continue;
                let sourceTy = typeFor(checker.resolver, source) else continue;
                let case Type::Pointer {
                    class: types::PointerClass::Region(permission),
                    mutable: true,
                    ..
                } = sourceTy else continue;
                let authorityIndex = findCellAuthority(checker, env, permission)
                    else continue;
                if not checker.authorityExclusive[authorityIndex] {
                    continue;
                }
                assert reborrowLen < MAX_LINEAR_BINDINGS,
                    "checkLinearNode: permission reborrow overflow";
                set reborrowSources[reborrowLen] = binding.value;
                set reborrowPermissions[reborrowLen] = permission;
                set reborrowExclusive[reborrowLen] =
                    address.kind == ast::AddressKind::Mutable;
                set reborrowLen += 1;
            }
            set checker.regions = scope;
            for bindingNode in bindings {
                let case ast::NodeValue::RegionBinding(binding) = bindingNode.value
                    else panic "checkLinearNode: invalid borrow binding";
                let case ast::NodeValue::AddressOf(address) = binding.value.value
                    else panic "checkLinearNode: invalid borrow source";
                if let cellTy = try inferCellPayload(checker.resolver, address.target) {
                    let case Type::Cell { permission: controlled, .. } = cellTy
                        else panic "checkLinearNode: invalid cell payload";
                    if let permission = controlled {
                        let exclusive = address.kind == ast::AddressKind::Mutable;
                        let mut matched = false;
                        for i in 0..reborrowLen {
                            let candidate = reborrowPermissions[i]
                                else panic "checkLinearNode: missing reborrow permission";
                            if candidate.id == permission.id
                                and reborrowExclusive[i] == exclusive
                            {
                                set matched = true;
                                break;
                            }
                        }
                        if not matched {
                            throw emitError(
                                checker.resolver, binding.value,
                                ErrorKind::CellPermissionRequired(permission.name),
                            );
                        }
                        set checker.payloadAddress = binding.value;
                    }
                }
                for i in 0..reborrowLen {
                    let source = reborrowSources[i]
                        else panic "checkLinearNode: missing authority reborrow";
                    if source == binding.value {
                        set checker.witnessPermission = reborrowPermissions[i];
                        break;
                    }
                }
                try checkLinearNode(checker, env, binding.value, LinearUse::Consume);
                if env.terminated {
                    break;
                }
                try addLinearBinding(checker, env, bindingNode);
                let lexical = ast::borrowBinding(binding);
                try addLocalLoan(checker, env, bindingNode, lexical);
                let symbol = symbolFor(checker.resolver, bindingNode)
                    else panic "checkLinearNode: missing region binding";
                let mut permission = checker.witnessPermission;
                let mut exclusive = address.kind == ast::AddressKind::Mutable;
                if permission == nil {
                    if let case SymbolData::Value {
                        type: Type::Pointer {
                            class: types::PointerClass::Region(region),
                            mutable: true,
                            ..
                        },
                        ..
                    } = symbol.data {
                        set permission = region;
                        set exclusive = true;
                    }
                }
                if let controlled = permission {
                    if checker.authorityLen >= MAX_LINEAR_BINDINGS {
                        throw emitError(checker.resolver, bindingNode, ErrorKind::Internal);
                    }
                    let index = checker.authorityLen;
                    set checker.authorityPermissions[index] = controlled;
                    set checker.authorityBindings[index] = symbol;
                    set checker.authorityExclusive[index] = exclusive;
                    set checker.authorityLen += 1;
                }
                set checker.payloadAddress = nil;
                set checker.witnessPermission = nil;
            }
            try checkLinearBlock(checker, env, body);
            try finishLinearScope(checker, env, start);
            set checker.localLen = localStart;
            set checker.authorityLen = authorityStart;
            set checker.regions = previousRegions;
            compactRegionalLoans(checker, env, previousRegions);
        }
        case ast::NodeValue::Block(_) => try checkLinearBlock(checker, env, node),
        case ast::NodeValue::Let(binding) => {
            let mut isUndefined = false;
            if let case ast::NodeValue::Undef = binding.value.value {
                set isUndefined = true;
            }
            if isUndefined {
                if let bindingTy = typeFor(checker.resolver, binding.ident);
                    isLinear(bindingTy)
                {
                    throw emitError(
                        checker.resolver,
                        binding.value,
                        ErrorKind::LinearUndefined,
                    );
                }
            }
            try checkLinearNode(checker, env, binding.value, LinearUse::Consume);
            if env.terminated {
                return;
            }
            try addLinearBinding(checker, env, node);
            try addLocalLoan(checker, env, node, binding);
            if let symbol = symbolFor(checker.resolver, node) {
                if let case SymbolData::Value {
                    type: Type::Pointer {
                        class: types::PointerClass::Region(permission),
                        mutable: true,
                        ..
                    },
                    ..
                } = symbol.data {
                    if checker.authorityLen >= MAX_LINEAR_BINDINGS {
                        throw emitError(checker.resolver, node, ErrorKind::Internal);
                    }
                    let index = checker.authorityLen;
                    set checker.authorityPermissions[index] = permission;
                    set checker.authorityBindings[index] = symbol;
                    set checker.authorityExclusive[index] = true;
                    set checker.authorityLen += 1;
                }
            }
            expireAllocationLoans(checker, env, node, binding.value);
            if isUndefined {
                markLinearBindingUnavailable(checker.resolver, env, node);
            }
        }
        case ast::NodeValue::Assign(assign) => {
            if not isCellDeref(checker.resolver, assign.left) {
                try checkPatternLoan(checker, assign.left);
            }
            let mut target: ?u32 = nil;
            let mut targetLinear = false;
            if let leftTy = typeFor(checker.resolver, assign.left) {
                if isMoveOnly(leftTy) {
                    set targetLinear = isLinear(leftTy);
                    if let case ast::NodeValue::Ident(_) = assign.left.value {
                        if let sym = symbolFor(checker.resolver, assign.left) {
                            set target = findLinearBinding(env, sym.id);
                        }
                    }
                    if targetLinear and target == nil {
                        throw emitError(
                            checker.resolver,
                            assign.left,
                            ErrorKind::LinearOverwrite,
                        );
                    }
                }
            }
            try checkLinearNode(checker, env, assign.left, LinearUse::Place);
            try checkLinearNode(checker, env, assign.right, LinearUse::Consume);
            if let index = target {
                if targetLinear and linearBindingAvailable(env, index) {
                    throw emitError(
                        checker.resolver,
                        assign.left,
                        ErrorKind::LinearOverwrite,
                    );
                }
                set env.available |= (1 as u64) << (index as u64);
            }
        }
        case ast::NodeValue::RegionApply { value, .. } =>
            try checkLinearNode(checker, env, value, usage),
        case ast::NodeValue::Call(call) => try checkLinearCall(checker, env, node, call),
        case ast::NodeValue::AddressOf(addr) => {
            if addr.kind == ast::AddressKind::Cell {
                if let resultTy = typeFor(checker.resolver, node) {
                    if let case Type::Cell { permission: controlled, .. } = resultTy {
                        if let permission = controlled {
                            let index = findCellAuthority(checker, env, permission)
                                else throw emitError(
                                    checker.resolver, node,
                                    ErrorKind::CellPermissionRequired(permission.name),
                                );
                            if not checker.authorityExclusive[index] {
                                throw emitError(
                                    checker.resolver, node,
                                    ErrorKind::CellPermissionRequired(permission.name),
                                );
                            }
                        }
                    }
                }
            }
            if let cellTy = try inferCellPayload(checker.resolver, addr.target) {
                let case Type::Cell { permission: controlled, .. } = cellTy
                    else panic "checkLinearNode: invalid cell payload address";
                if let permission = controlled {
                    let mut headerValidated = false;
                    if let allowed = checker.payloadAddress; allowed == node {
                        set headerValidated = true;
                    }
                    if not headerValidated {
                        let index = findCellAuthority(checker, env, permission)
                            else throw emitError(
                                checker.resolver, node,
                                ErrorKind::CellPermissionRequired(permission.name),
                            );
                        if addr.kind == ast::AddressKind::Mutable
                            and not checker.authorityExclusive[index]
                        {
                            throw emitError(
                                checker.resolver, node,
                                ErrorKind::CellPermissionRequired(permission.name),
                            );
                        }
                    }
                    let permissionExclusive = addr.kind == ast::AddressKind::Mutable;
                    for i in 0..checker.localLen {
                        let loan = checker.locals[i];
                        if let loanPermission = loan.permission;
                            loanPermission.id == permission.id
                            and (permissionExclusive or loan.exclusive)
                        {
                            throw emitError(
                                checker.resolver, node,
                                ErrorKind::BorrowConflict(permission.name),
                            );
                        }
                    }
                }
            }
            try checkLocalLoans(checker, env, addr.target, ast::isExclusiveAddress(addr));
            if ast::isExclusiveAddress(addr) {
                try checkPatternLoan(checker, addr.target);
            }
            let mut owner: ?*ast::Node = nil;
            if addr.kind == ast::AddressKind::Cell {
                if let ty = typeFor(checker.resolver, node) {
                    if let case Type::Cell { class: types::PointerClass::Owned, .. } = ty {
                        set owner = addressOwner(checker.resolver, addr.target);
                    }
                }
            }
            if let source = owner {
                try checkCellAddressOwner(checker, env, addr.target, source);
            } else {
                try checkLinearNode(checker, env, addr.target, LinearUse::Locate);
            }
            try addRegionalLoan(checker, env, node, addr);
        }
        case ast::NodeValue::Deref(target) => {
            if let resultTy = typeFor(checker.resolver, node) {
                let cellObservation = usage == LinearUse::Observe
                    and (try inferCellPayload(checker.resolver, node)) <> nil;
                if isMoveOnly(resultTy) and (usage == LinearUse::Consume or cellObservation) {
                    throw emitError(checker.resolver, node, ErrorKind::LinearPartialMove);
                }
            }
            try checkLinearNode(checker, env, target, LinearUse::Locate);
        }
        case ast::NodeValue::FieldAccess(access) => {
            if let resultTy = typeFor(checker.resolver, node) {
                let cellObservation = usage == LinearUse::Observe
                    and (try inferCellPayload(checker.resolver, node)) <> nil;
                if isMoveOnly(resultTy) and (usage == LinearUse::Consume or cellObservation) {
                    throw emitError(checker.resolver, node, ErrorKind::LinearPartialMove);
                }
            }
            try checkLinearNode(checker, env, access.parent, LinearUse::Locate);
        }
        case ast::NodeValue::ScopeAccess(_) => {}
        case ast::NodeValue::Subscript { container, index } => {
            if let resultTy = typeFor(checker.resolver, node) {
                let cellObservation = usage == LinearUse::Observe
                    and (try inferCellPayload(checker.resolver, node)) <> nil;
                if isMoveOnly(resultTy) and (usage == LinearUse::Consume or cellObservation) {
                    throw emitError(checker.resolver, node, ErrorKind::LinearPartialMove);
                }
            }
            try checkLinearNode(checker, env, container, LinearUse::Locate);
            try checkLinearNode(checker, env, index, LinearUse::Consume);
        }
        case ast::NodeValue::RecordLit(lit) => {
            for fieldNode in lit.fields {
                let case ast::NodeValue::RecordLitField(field) = fieldNode.value
                    else panic "checkLinearNode: expected field";
                try checkLinearNode(checker, env, field.value, LinearUse::Consume);
            }
        }
        case ast::NodeValue::ArrayLit(items) => {
            for item in items {
                try checkLinearNode(checker, env, item, LinearUse::Consume);
            }
        }
        case ast::NodeValue::ArrayRepeatLit(repeat) => {
            if let itemTy = typeFor(checker.resolver, repeat.item) {
                if not isCopy(itemTy) {
                    throw emitError(
                        checker.resolver,
                        repeat.item,
                        ErrorKind::LinearDiscard,
                    );
                }
            }
            try checkLinearNode(checker, env, repeat.item, LinearUse::Consume);
            try checkLinearNode(checker, env, repeat.count, LinearUse::Consume);
        }
        case ast::NodeValue::BinOp(op) => {
            if op.op == ast::BinaryOp::And or op.op == ast::BinaryOp::Or {
                try checkLinearNode(checker, env, op.left, LinearUse::Consume);
                let skipped = *env;
                let mut evaluated = skipped;
                try checkLinearNode(checker, &mut evaluated, op.right, LinearUse::Consume);
                try joinLinearBranches(checker, env, &skipped, &evaluated, node);
                return;
            }
            let mut operandUse = LinearUse::Consume;
            match op.op {
                case ast::BinaryOp::Eq, ast::BinaryOp::Ne,
                     ast::BinaryOp::Lt, ast::BinaryOp::Gt,
                     ast::BinaryOp::Lte, ast::BinaryOp::Gte =>
                    set operandUse = LinearUse::Observe,
                else => {}
            }
            try checkLinearNode(checker, env, op.left, operandUse);
            try checkLinearNode(checker, env, op.right, operandUse);
        }
        case ast::NodeValue::UnOp(op) => {
            try checkLinearNode(checker, env, op.value, LinearUse::Consume);
        }
        case ast::NodeValue::As(expr) => {
            let mut castUse = usage;
            if let targetTy = typeFor(checker.resolver, node) {
                if let case Type::Cell { .. } = targetTy {
                    set castUse = LinearUse::Consume;
                }
            }
            if let targetTy = typeFor(checker.resolver, node); isNumericType(targetTy) {
                set castUse = LinearUse::Observe;
            }
            try checkLinearNode(checker, env, expr.value, castUse);
        }
        case ast::NodeValue::Range(range) => {
            if let start = range.start {
                try checkLinearNode(checker, env, start, LinearUse::Consume);
            }
            if let end = range.end {
                try checkLinearNode(checker, env, end, LinearUse::Consume);
            }
        }
        case ast::NodeValue::BuiltinCall { args, .. } => {
            for arg in args {
                try checkLinearNode(checker, env, arg, LinearUse::Consume);
            }
        }
        case ast::NodeValue::If(conditional) => {
            try checkLinearIf(checker, env, node, conditional);
        }
        case ast::NodeValue::CondExpr(conditional) => {
            try checkLinearCondExpr(checker, env, node, conditional, usage);
        }
        case ast::NodeValue::IfLet(conditional) => {
            try checkLinearIfLet(checker, env, node, conditional);
        }
        case ast::NodeValue::LetElse(binding) => {
            if let subjectTy = typeFor(checker.resolver, binding.pattern.scrutinee);
                isLinear(subjectTy)
            {
                throw emitError(
                    checker.resolver,
                    binding.pattern.scrutinee,
                    ErrorKind::LinearPartialMove,
                );
            }
            try checkLinearNode(
                checker,
                env,
                binding.pattern.scrutinee,
                patternSubjectUse(checker.resolver, binding.pattern.scrutinee),
            );
            let base = *env;
            let mut guardedEnv = base;
            try addLinearPatternBindings(checker, &mut guardedEnv, binding.pattern.pattern);
            expireAllocationLoans(checker, &mut guardedEnv, binding.pattern.pattern, binding.pattern.scrutinee);
            if let guard = binding.pattern.guard {
                try checkLinearNode(checker, &mut guardedEnv, guard, LinearUse::Consume);
            }
            let mut successEnv = guardedEnv;
            let mut fallbackEnv = base;
            try checkLinearNode(
                checker,
                &mut fallbackEnv,
                binding.elseBranch,
                LinearUse::Consume,
            );
            if binding.pattern.guard <> nil {
                let mut guardFallbackEnv = guardedEnv;
                try checkLinearNode(
                    checker,
                    &mut guardFallbackEnv,
                    binding.elseBranch,
                    LinearUse::Consume,
                );
                try finishLinearScope(checker, &mut guardFallbackEnv, base.len);
                let previous = fallbackEnv;
                try joinLinearBranches(
                    checker,
                    &mut fallbackEnv,
                    &previous,
                    &guardFallbackEnv,
                    binding.elseBranch,
                );
            }
            if let case ast::PatternKind::Binding = binding.pattern.kind {
                try addLinearPatternBindings(
                    checker,
                    &mut fallbackEnv,
                    binding.pattern.pattern,
                );
            }
            try joinLinearBranches(checker, env, &successEnv, &fallbackEnv, node);
        }
        case ast::NodeValue::Match(matchExpr) => {
            try checkLinearMatch(checker, env, node, matchExpr);
        }
        case ast::NodeValue::Try(tryExpr) => {
            try checkLinearNode(checker, env, tryExpr.expr, usage);
            let success = *env;
            if let resultTy = typeFor(checker.resolver, tryExpr.expr); resultTy == Type::Never {
                if not tryExpr.returnsOptional and (tryExpr.catches.len > 0 or tryExpr.shouldPanic) {
                    set env.terminated = true;
                }
            }
            for catchNode in tryExpr.catches {
                let case ast::NodeValue::CatchClause(catchClause) = catchNode.value
                    else panic "checkLinearNode: expected catch";
                let mut branch = success;
                let start = branch.len;
                if let binding = catchClause.binding {
                    try addLinearBinding(checker, &mut branch, binding);
                }
                try checkLinearNode(checker, &mut branch, catchClause.body, usage);
                try finishLinearScope(checker, &mut branch, start);
                let previous = *env;
                try joinLinearBranches(checker, env, &previous, &branch, node);
            }
        }
        case ast::NodeValue::While(_), ast::NodeValue::WhileLet(_),
             ast::NodeValue::For(_), ast::NodeValue::Loop { .. } =>
            try checkLinearLoop(checker, env, node),
        case ast::NodeValue::Break => {
            assert checker.loopDepth > 0, "linear loop control outside loop";
            let start = checker.loopMarks[checker.loopDepth - 1];
            try finishLinearScope(checker, env, start);
            try checkLinearLoopBreak(checker, env, node);
            set env.terminated = true;
        }
        case ast::NodeValue::Continue => {
            assert checker.loopDepth > 0, "linear loop control outside loop";
            let start = checker.loopMarks[checker.loopDepth - 1];
            try finishLinearScope(checker, env, start);
            try checkLinearLoopBackEdge(checker, env, node);
            set env.terminated = true;
        }
        case ast::NodeValue::Return { value } => {
            if let expr = value {
                try checkLinearNode(checker, env, expr, LinearUse::Consume);
            }
            try finishLinearExit(checker, env);
        }
        case ast::NodeValue::Throw { expr } => {
            try checkLinearNode(checker, env, expr, LinearUse::Consume);
            try finishLinearExit(checker, env);
        }
        case ast::NodeValue::Panic { message } => {
            if let expr = message {
                try checkLinearNode(checker, env, expr, LinearUse::Consume);
            }
            set env.terminated = true;
        }
        case ast::NodeValue::Assert { condition, message } => {
            try checkLinearNode(checker, env, condition, LinearUse::Consume);
            if let expr = message {
                try checkLinearNode(checker, env, expr, LinearUse::Consume);
            }
        }
        else => {}
    }
}

/// Check exact-use ownership for one resolved function.
unsafe fn checkLinearFn 'arena (
    self: &mut Resolver 'arena,
    receiver: ?*ast::Node,
    params: *[*ast::Node],
    body: *ast::Node,
) throws (ResolveError) {
    try resolveNominalApplications(self, body);
    let regions = self.regionScope;
    let resolved: 'checking = &mut *self where 'arena: 'checking in {
        let mut checker = linearChecker(resolved, regions);
        let mut env = linearEnv();
        if let receiverNode = receiver {
            try addLinearBinding(&mut checker, &mut env, receiverNode);
            if let symbol = symbolFor(checker.resolver, receiverNode) {
                if let case SymbolData::Value {
                    type: Type::Pointer {
                        class: types::PointerClass::Region(permission),
                        mutable: true,
                        ..
                    },
                    ..
                } = symbol.data {
                    let index = checker.authorityLen;
                    set checker.authorityPermissions[index] = permission;
                    set checker.authorityBindings[index] = symbol;
                    set checker.authorityExclusive[index] = true;
                    set checker.authorityLen += 1;
                }
            }
        }
        for paramNode in params {
            let case ast::NodeValue::FnParam(_) = paramNode.value
                else panic "checkLinearFn: expected parameter";
            try addLinearBinding(&mut checker, &mut env, paramNode);
            if let symbol = symbolFor(checker.resolver, paramNode) {
                if let case SymbolData::Value {
                    type: Type::Pointer {
                        class: types::PointerClass::Region(permission),
                        mutable: true,
                        ..
                    },
                    ..
                } = symbol.data {
                    if checker.authorityLen >= MAX_LINEAR_BINDINGS {
                        throw emitError(checker.resolver, paramNode, ErrorKind::Internal);
                    }
                    let index = checker.authorityLen;
                    set checker.authorityPermissions[index] = permission;
                    set checker.authorityBindings[index] = symbol;
                    set checker.authorityExclusive[index] = true;
                    set checker.authorityLen += 1;
                }
            }
        }
        try checkLinearNode(&mut checker, &mut env, body, LinearUse::Discard);
        try finishLinearScope(&mut checker, &mut env, 0);
    }
}

/// Analyze module definitions. This pass analyzes function bodies, recursing into sub-modules.
unsafe fn resolveModuleDefs 'arena (self: &mut Resolver 'arena, block: &ast::Block) throws (ResolveError) {
    for stmt in block.statements {
        try resolveNominalApplications(self, stmt);
        try visitDef(self, stmt);
        try resolveNominalApplications(self, stmt);
    }
}

/// Resolve all packages.
/// Module entries retain their identity throughout resolution and diagnostics.
export unsafe fn resolve 'arena 'permission (self: &mut Resolver 'arena, graph: &module::ModuleGraph 'permission, packages: &[Pkg]) -> Diagnostics throws (ResolveError) {
    assert module::entryCount(graph) <= self.moduleEntries.len, "resolve: module registry capacity exceeded";
    for i in 0..self.moduleEntries.len {
        let entry = module::get(graph, i as u16);
        set self.moduleEntries[i] = entry;
        if let present = entry {
            set self.moduleRoots[i] = module::astFor(graph, present);
        } else {
            set self.moduleRoots[i] = nil;
        }
    }

    // 1. Bind all package roots to enable cross-package references.
    for i in 0..packages.len {
        let pkg = packages[i];
        // Enter a new scope for the module.
        let enter = enterModuleScope(self, pkg.rootAst, pkg.rootEntry);
        // Bind the package root module name in the global package scope.
        let scope = self.pkgScope;
        try bindModuleIdent(self, pkg.rootEntry, enter.newScope, pkg.rootAst, 0, scope);

        exitModuleScope(self, enter);
    }
    // 2. Resolve each package's contents.
    for i in 0..packages.len {
        let pkg = packages[i];
        let diags = try resolvePackage(self, pkg.rootEntry, pkg.rootAst);
        if not success(&diags) {
            return diags;
        }
    }
    return diagnostics(self);
}

/// Resolve a package.
unsafe fn resolvePackage 'arena (self: &mut Resolver 'arena, rootEntry: *module::ModuleEntry, node: *ast::Node) -> Diagnostics throws (ResolveError) {
    let rootId = rootEntry.id;
    let scope = self.moduleScopes[rootId as u32]
        else panic "resolvePackage: module scope not found";

    // Set up the module scope for this package.
    set self.scope = scope;
    set self.currentMod = rootId;

    let case ast::NodeValue::Block(block) = node.value
        else panic "resolvePackage: expected block for module root";

    // Module graph analysis phase: bind all module name symbols and scopes.
    try resolveModuleGraph(self, &block) catch {
        assert self.errors.len > 0, "resolvePackage: failure should have diagnostics";
        return diagnostics(self);
    };

    // Declaration phase: bind all names and analyze top-level declarations.
    try resolveModuleDecls(self, &block) catch {
        assert self.errors.len > 0, "resolvePackage: failure should have diagnostics";
    };
    if self.errors.len > 0 {
        return diagnostics(self);
    }

    // Definition phase: analyze function bodies and sub-module definitions.
    try resolveModuleDefs(self, &block) catch {
        assert self.errors.len > 0, "resolvePackage: failure should have diagnostics";
    };
    setNodeType(self, node, Type::Void);

    return diagnostics(self);
}