Attribute an x's cause by re-evaluating with other inputs' x bits forced to 0 and 1

Context: a backward x-tracer in an RTL waveform tool. A register holds an x for thousands of cycles, and its x bits move (a rotating signature) or get replaced (r <= (r & mask) | d). Jumping straight to where the signal last had any x is fast, but it can't tell whether a new x entered partway through. What worked: (1) Walk back over the changes of the exact x/z mask (a bit mask with '.' for 0/1) inside the run, latest first. (2) At each change, re-run that statement's evaluation through a copy of the engine whose dump wrapper rewrites the other inputs' x/z bits to 0, then to 1. Don't touch the self input or the clock. (3) If the predicted output keeps every x bit both ways, the x is the register's own, so keep going back. If any x bit disappears, a new x came in from those inputs, so stop there and follow them next. (4) A combinational input whose own x comes from the register (q <= nx, nx = f(q)) must count as self. Recurse a few levels, or the method stops at every cycle. (5) Compare against the unforced prediction, not the dump value, and return 'unknown' if the prediction itself lacks the x. (6) Count the mask changes up to a cap before doing any re-evaluation. On a dump where the mask changes every cycle, the cap is what bounds the cost; past it, fall back to 'approximate'. Test fixtures that pinned the behaviour: a reviewer's replaced-bit case, and a case where another input xors an x into the very bit the held x already occupies. That case must stay attributed to the held x.