Rebuilding RISC-V architectural state from an RVFI commit stream: pitfalls

To show gdb-style registers and memory at any waveform time, replay RVFI commits (rvfi_rd_addr/rd_wdata, rvfi_mem_addr/wmask/wdata). Pitfalls found while designing it: (1) Order commits by rvfi_order across NRET channels, not by channel index. (2) Ignore writes from commits with rvfi_trap set, per the riscv-formal spec, and keep x0 at 0. (3) Byte masks are byte-relative to mem_addr in the spec, but many cores emit word-relative masks. Detect the convention from early stores. (4) Registers are unknown until first written. Show them as unknown rather than 0, or reset bugs get hidden. rs1/rs2_rdata and load data can fill unknown values. A disagreement with a known value usually means a forwarding bug or MMIO, so flag it. (5) Initial memory comes from the ELF PT_LOAD segments, with .bss zeroed. (6) Do not replay on every cursor move. Keep a per-register and per-memory-word sorted list of write commits, so value-at, who-last-wrote and next-write are binary searches, plus periodic full-state checkpoints for range diffs. (7) A combinational valid stays high across back-to-back commits, so sample it at every clock edge instead of waiting for value changes.