kit

dbg.c (120329B)

---

 #include <kit/arch.h>
 #include <kit/compile.h>
 #include <kit/core.h>
 #include <kit/dbg.h>
 #include <kit/disasm.h>
 #include <kit/dwarf.h>
 #include <kit/jit.h>
 #include <kit/link.h>
 #include <kit/object.h>
 #include <stddef.h>
 #include <stdint.h>
 #include <string.h>
 
 #include "backtrace.h"
 #include "cflags.h"
 #include "driver.h"
 #include "inputs.h"
 
 /* `kit dbg` — interactive JIT debugger.
  *
  * Mirrors `kit run` for compile flags and argv shape, but instead of
  * calling the entry directly drops into a REPL that drives a
  * KitJitSession. The session (in libkit) owns the worker thread,
  * signal handlers, breakpoint patcher, and per-arch single-step /
  * displaced-step trampoline. This driver TU only:
  *
  *   - parses argv and turns the source list into a JIT image,
  *   - opens DWARF and a JIT-image view,
  *   - manages a driver-local breakpoint table (id, spec text, enabled
  *     flag) keyed off session-side handles,
  *   - parses LOC strings (file:line, sym[+off], 0xADDR) into addresses
  *     via kit_dwarf_line_to_addr / kit_jit_lookup,
  *   - reads commands from stdin and dispatches,
  *   - renders KitStopInfo into source-level stop messages and the
  *     backtrace via kit_dwarf_unwind_step,
  *   - decodes `p name` via kit_dwarf_var_at + kit_dwarf_loc_read.
  *
  * Forwarding Ctrl-C: while a session call is in flight the driver
  * installs a SIGINT handler that calls kit_jit_session_interrupt; on
  * return it restores SIG_DFL so Ctrl-C at the REPL prompt terminates
  * the program. */
 
 #define DBG_TOOL "dbg"
 #define LINE_CAP 1024
 #define WORD_CAP 256
 #define HEX_CAP 8 /* upper bound on per-arch trap-byte save */
 
 /* ============================================================
  * argv parsing (mirrors run.c)
  * ============================================================ */
 
 typedef enum { DBG_ENTRY_FILE, DBG_ENTRY_CMD } DbgEntryKind;
 typedef struct {
   DbgEntryKind kind;
   const char* value; /* argv pointer — no per-entry allocation */
 } DbgScriptEntry;
 
 typedef struct DbgOpts {
   DriverEnv* env;
   size_t argv_bound;
 
   int opt_level;
   int debug_info;
   const char* entry;
   KitLanguage default_lang;
   int has_default_lang;
 
   DriverCflags cf;
   DriverInputs inputs;
 
   char** prog_argv;
   uint32_t prog_argc;
 
   DbgScriptEntry* script_entries;
   uint32_t nscript_entries;
   uint32_t script_entries_cap;
   int batch_mode;
 } DbgOpts;
 
 void driver_help_dbg(void) {
   driver_printf(
       "%.*s",
       KIT_SLICE_ARG(KIT_SLICE_LIT(
           "kit dbg — interactive JIT debugger\n"
           "\n"
           "USAGE\n"
           "  kit dbg [options] [input.{c,toy,s} ...] [-- prog-arg ...]\n"
           "\n"
           "DESCRIPTION\n"
           "  Mirrors `kit run` for compile flags and argv shape, but "
           "instead\n"
           "  of calling the entry directly drops into a REPL that drives the\n"
           "  JIT session: breakpoints, source-line stepping (into / over),\n"
           "  instruction stepping,\n"
           "  finish, backtrace, registers, locals/args, variable read/write,\n"
           "  and raw memory examine. -g is forced on so source lines and\n"
           "  variable locations are available at runtime.\n"
           "\n"
           "  Anything after `--` is passed to the JITed program as argv.\n"
           "  With no input files, dbg starts an empty JIT session; append "
           "code\n"
           "  with `jit` or evaluate expressions directly from the REPL.\n"
           "\n"
           "COMPILE OPTIONS\n"
           "  -O0 -O1 -O2       Optimization level (default -O0)\n"
           "  -g                Emit DWARF (forced on)\n"
           "  -e SYMBOL         Entry symbol (default `main`)\n"
           "  -x LANG           Default REPL language: c, toy, asm, wasm/wat\n"
           "  --language LANG   Same as -x\n"
           "  -I DIR            Add quoted-include search path\n"
           "  -isystem DIR      Add system-include search path\n"
           "  -D NAME[=BODY]    Define a macro\n"
           "  -U NAME           Undefine a builtin/predefined macro\n"
           "\n"
           "REPL COMMANDS (also shown by `h` at the prompt)\n"
           "  h, help                      show REPL help\n"
           "  q, quit                      exit (Ctrl-D also works)\n"
           "  r, run                       start fresh execution at entry\n"
           "  c, cont                      continue after a stop\n"
           "  s, step                      step to next source line (into "
           "calls)\n"
           "  si, stepi                    single-step one instruction\n"
           "  n, next                      step to next source line (over "
           "calls)\n"
           "  finish                       run until current frame returns\n"
           "  jit [LANG|NAME] { ... }      compile and append a language "
           "snippet\n"
           "  { ... }                      same as jit { ... }\n"
           "  edit [LANG|NAME]             edit and append a language snippet\n"
           "  expr EXPR | expr { ... }     compile and call an expression "
           "thunk\n"
           "  EXPR                         same as expr EXPR\n"
           "                               LANG defaults to the selected "
           "language\n"
           "  jump ADDR                    set PC to ADDR (no resume)\n"
           "  bt, backtrace                print stack trace with arguments\n"
           "  b LOC                        set breakpoint at LOC:\n"
           "                                  0xADDR | sym[+off] | file.c:line\n"
           "  ignore N COUNT               skip the next COUNT hits of bp N\n"
           "  d N, delete N                delete breakpoint N\n"
           "  enable N | disable N         toggle breakpoint N\n"
           "  p NAME                       print variable / global\n"
           "  set NAME VALUE               write VALUE into NAME\n"
           "  x ADDR [count]               examine memory (default 16 bytes)\n"
           "  disasm [ADDR] [count], x/i    disassemble at PC or ADDR\n"
           "  list FILE:LINE | l FILE:LINE source listing around FILE:LINE\n"
           "  info b                       list breakpoints\n"
           "  info reg, info registers     dump registers\n"
           "  info locals | info args      list locals / args at current PC\n"
           "  info functions [PATTERN]     list JIT functions matching PATTERN\n"
           "  info variables [PATTERN]     list JIT globals  matching PATTERN\n"
           "\n"
           "BATCH / SCRIPTING\n"
           "  --script FILE     execute debugger commands from FILE (repeatable)\n"
           "  --command CMD     execute CMD as if typed at the REPL (repeatable)\n"
           "  -c CMD            same as --command\n"
           "  --batch           non-interactive: suppress banner, exit after\n"
           "                    --script / --command sources drain; exit 1 on\n"
           "                    any command error\n"
           "  Note: multi-line jit{} / expr{} blocks in --script files must fit\n"
           "  on a single line (continuation reads go to stdin, not the file).\n"
           "\n"
           "SIGNALS\n"
           "  Ctrl-C is forwarded into the running session as an interrupt; at\n"
           "  the REPL prompt it terminates the program normally.\n"
           "\n"
           "GETTING HELP\n"
           "  -h, --help                   Show this help and exit (this is "
           "the\n"
           "                               command-line help; once the REPL is\n"
           "                               running, type `h` for REPL "
           "commands)\n"
           "\n"
           "EXIT CODES\n"
           "  0   clean exit       1   compile/link/command error       2   "
           "bad "
           "usage\n")));
 }
 
 static int dbg_alloc_arrays(DbgOpts* o, int argc) {
   size_t bound = (size_t)argc;
   o->argv_bound = bound;
   o->prog_argv = driver_alloc_zeroed(o->env, bound * sizeof(*o->prog_argv));
   if (!o->prog_argv) {
     driver_errf(DBG_TOOL, "out of memory");
     return 1;
   }
   if (driver_inputs_init(&o->inputs, o->env, DBG_TOOL, argc) != 0) return 1;
   if (driver_cflags_init(&o->cf, o->env, argc) != 0) {
     driver_errf(DBG_TOOL, "out of memory");
     return 1;
   }
   return 0;
 }
 
 static int dbg_parse_language_name(const char* name, KitLanguage* out) {
   /* Resolve off the compile-time default frontend set (no compiler exists at
    * arg-parse time). Value-equivalent to the former explicit map:
    * c->C, toy->TOY, asm/s->ASM, wasm/wat->WASM. */
   KitLanguage lang;
   if (!name || !*name || !out) return 0;
   lang = kit_language_for_name(NULL, name);
   if (lang == KIT_LANG_UNKNOWN) return 0;
   *out = lang;
   return 1;
 }
 
 static int dbg_set_default_language(DbgOpts* o, const char* name) {
   KitLanguage lang = KIT_LANG_COUNT;
   if (!dbg_parse_language_name(name, &lang)) {
     driver_errf(DBG_TOOL, "unsupported language: %.*s",
                 KIT_SLICE_ARG(kit_slice_cstr(name)));
     return 1;
   }
   o->default_lang = lang;
   o->has_default_lang = 1;
   return 0;
 }
 
 static int dbg_script_entry_push(DbgOpts* o, DbgEntryKind kind,
                                   const char* value) {
   if (o->nscript_entries >= o->script_entries_cap) {
     uint32_t nc = o->script_entries_cap ? o->script_entries_cap * 2 : 4;
     size_t old_sz = (size_t)o->script_entries_cap * sizeof(DbgScriptEntry);
     size_t new_sz = (size_t)nc * sizeof(DbgScriptEntry);
     DbgScriptEntry* nb = o->env->heap->realloc(o->env->heap,
                                                o->script_entries,
                                                old_sz, new_sz,
                                                _Alignof(DbgScriptEntry));
     if (!nb) { driver_errf(DBG_TOOL, "out of memory"); return 1; }
     o->script_entries = nb;
     o->script_entries_cap = nc;
   }
   o->script_entries[o->nscript_entries].kind = kind;
   o->script_entries[o->nscript_entries].value = value;
   o->nscript_entries++;
   return 0;
 }
 
 static int dbg_parse(int argc, char** argv, DbgOpts* o) {
   int i;
   int after_dash_dash = 0;
   if (dbg_alloc_arrays(o, argc) != 0) return 1;
 
   for (i = 1; i < argc; ++i) {
     const char* a = argv[i];
 
     if (after_dash_dash) {
       o->prog_argv[o->prog_argc++] = argv[i];
       continue;
     }
     if (driver_streq(a, "--")) {
       after_dash_dash = 1;
       continue;
     }
 
     {
       int r =
           driver_cflags_try_consume(&o->cf, o->env, DBG_TOOL, argc, argv, &i);
       if (r < 0) return 1;
       if (r > 0) continue;
     }
 
     if (driver_streq(a, "-g")) {
       o->debug_info = 1;
       continue;
     }
     if (driver_streq(a, "-O0")) {
       o->opt_level = 0;
       continue;
     }
     if (driver_streq(a, "-O1")) {
       o->opt_level = 1;
       continue;
     }
     if (driver_streq(a, "-O2")) {
       o->opt_level = 2;
       continue;
     }
 
     if (driver_streq(a, "-e")) {
       if (++i >= argc) {
         driver_errf(DBG_TOOL, "-e requires an argument");
         return 1;
       }
       o->entry = argv[i];
       continue;
     }
 
     if (driver_streq(a, "-x") || driver_streq(a, "--language") ||
         driver_streq(a, "--lang")) {
       if (++i >= argc) {
         driver_errf(DBG_TOOL, "%.*s requires an argument",
                     KIT_SLICE_ARG(kit_slice_cstr(a)));
         return 1;
       }
       if (dbg_set_default_language(o, argv[i]) != 0) return 1;
       continue;
     }
     if (driver_strneq(a, "--language=", 11)) {
       if (dbg_set_default_language(o, a + 11) != 0) return 1;
       continue;
     }
     if (driver_strneq(a, "--lang=", 7)) {
       if (dbg_set_default_language(o, a + 7) != 0) return 1;
       continue;
     }
 
     if (driver_streq(a, "--script")) {
       if (++i >= argc) {
         driver_errf(DBG_TOOL, "--script requires a FILE argument");
         return 1;
       }
       if (dbg_script_entry_push(o, DBG_ENTRY_FILE, argv[i]) != 0) return 1;
       continue;
     }
     if (driver_streq(a, "--command") || driver_streq(a, "-c")) {
       if (++i >= argc) {
         driver_errf(DBG_TOOL, "%.*s requires a CMD argument",
                     KIT_SLICE_ARG(kit_slice_cstr(a)));
         return 1;
       }
       if (dbg_script_entry_push(o, DBG_ENTRY_CMD, argv[i]) != 0) return 1;
       continue;
     }
     if (driver_streq(a, "--batch")) {
       o->batch_mode = 1;
       continue;
     }
 
     if (a[0] == '-' && a[1] != '\0') {
       driver_errf(DBG_TOOL, "unknown flag: %.*s",
                   KIT_SLICE_ARG(kit_slice_cstr(a)));
       return 1;
     }
 
     {
       int r = driver_inputs_classify(&o->inputs, a);
       if (r < 0) return 1;
       if (r == 0) {
         driver_errf(DBG_TOOL, "input does not have a recognized suffix: %.*s",
                     KIT_SLICE_ARG(kit_slice_cstr(a)));
         return 1;
       }
     }
   }
 
   if (!o->entry) o->entry = "main";
   if (!o->debug_info) {
     /* Without -g there are no source lines or variable locations to
      * read at runtime; force it on so `b file:line` and `p name`
      * have something to look at. The user can always re-run without
      * if they want to inspect optimized code at the asm level. */
     o->debug_info = 1;
   }
   return 0;
 }
 
 static void dbg_options_release(DbgOpts* o) {
   size_t bound = o->argv_bound;
   driver_inputs_release(&o->inputs);
   driver_cflags_fini(&o->cf, o->env);
   driver_free(o->env, o->prog_argv, bound * sizeof(*o->prog_argv));
   if (o->script_entries)
     driver_free(o->env, o->script_entries,
                 (size_t)o->script_entries_cap * sizeof(DbgScriptEntry));
 }
 
 /* Compile every C source through a compiler owned by the caller and JIT-link
  * the result. Compiler ownership stays with the caller so DWARF lookups
  * during the REPL session can run against the live compiler. */
 static int dbg_compile_and_jit(DbgOpts* o, KitCompiler* compiler,
                                const KitJitHost* host, KitJit** out_jit) {
   KitCCompileOptions copts;
   const char* link_entry = driver_inputs_count(&o->inputs) ? o->entry : NULL;
   {
     KitCCompileOptions z = {0};
     copts = z;
   }
   KitPreprocessOptions pp;
   copts.code.opt_level = o->opt_level;
   copts.code.debug_info = o->debug_info;
   driver_cflags_fill_pp(&o->cf, &pp);
   return driver_inputs_compile_and_jit(&o->inputs, compiler, host, &copts, &pp,
                                        link_entry, driver_dlsym_resolver, NULL,
                                        out_jit);
 }
 
 static void dbg_fill_compile_options(DbgOpts* o, KitCCompileOptions* copts,
                                      KitPreprocessOptions* pp) {
   {
     KitCCompileOptions z = {0};
     *copts = z;
   }
   copts->code.opt_level = o->opt_level;
   copts->code.debug_info = o->debug_info;
   driver_cflags_fill_pp(&o->cf, pp);
 }
 
 /* ============================================================
  * Breakpoint table (driver-side)
  * ============================================================
  * Each entry pairs a session-side handle (assigned by libkit) with
  * driver-side bookkeeping: a stable integer id we expose to the user, the
  * spec text the user gave us, and a flag that lets us cheaply re-arm
  * temp-disabled breakpoints. */
 
 typedef enum BpKind {
   BP_ADDR,
   BP_SYM,
   BP_LINE,
 } BpKind;
 
 typedef struct Bp {
   int id; /* user-facing handle, 1.. */
   int enabled;
   BpKind kind;
   char* spec; /* heap-owned NUL-terminated copy */
   size_t spec_size;
   uint64_t addr;
   uint64_t skip_count; /* silent skips before the first stop  */
   uint64_t max_hits;   /* 0 = unlimited                       */
   uint32_t session_id; /* libkit handle; 0 when disarmed */
 } Bp;
 
 typedef struct DbgSource {
   char* name;
   size_t name_size;
   uint8_t* data;
   size_t data_size;
   size_t len;
 } DbgSource;
 
 /* ============================================================
  * Session-scoped state
  * ============================================================ */
 
 typedef struct DbgState {
   DriverEnv* env;
   KitCompiler* compiler;
   KitContext ctx;
   KitCCompileOptions copts;
   KitPreprocessOptions pp; /* preprocessor settings for REPL compiles */
   KitJit* jit;
   KitJitSession* session;
   const KitObjFile* view;
   KitDebugInfo* dwarf;
   void* entry_addr;
   const char* entry_name;
   KitLanguage default_jit_lang;
   const char* default_jit_name;
   /* Backing storage for default_jit_name (built from the canonical frontend
    * extension), kept stable for the session's lifetime. */
   char default_jit_name_buf[32];
   KitCompileSession* compile_sessions[KIT_LANG_COUNT];
   DbgSource* sources;
   uint32_t nsources;
   uint32_t sources_cap;
   int prog_argc;
   char** prog_argv;
 
   Bp* bps;
   uint32_t nbps;
   uint32_t bps_cap;
   int next_bp_id;
   uint64_t
       expr_counter; /* user-visible $N; advances only on a successful expr */
   uint64_t expr_attempt; /* unique thunk-symbol id; advances every attempt */
   uint64_t source_counter;
 
   int has_stop;
   KitStopInfo last_stop;
   uint64_t jit_counter;
   DriverLineHistory line_history;
 
   DbgScriptEntry* script_entries; /* transferred from DbgOpts */
   uint32_t nscript_entries;
   int batch_mode;
   int error_count;
 } DbgState;
 
 /* Like driver_errf but increments s->error_count so --batch can propagate
  * command failures to the exit code. */
 #define dbg_errf(s, ...) \
   (driver_errf(DBG_TOOL, __VA_ARGS__), (void)((s)->error_count++))
 
 #define DBG_LIST_CTX 5 /* lines printed before/after the target */
 
 /* SIGINT trampoline. The handler in env.c calls our cb with this state;
  * we forward into the session. kit_jit_session_interrupt is documented
  * async-signal-safe. */
 static void dbg_on_sigint(void* user) {
   DbgState* s = (DbgState*)user;
   if (s && s->session) kit_jit_session_interrupt(s->session);
 }
 
 /* PC-space translation between the JIT runtime address space (where
  * SIGTRAP fires and where the debugger installs breakpoints) and the
  * image-relative vaddr space DWARF was authored in.  Every DWARF call
  * that takes a PC consumes an image vaddr, and every DWARF result
  * that names a code address is image-relative — translate at the
  * boundary.  Fallback is pass-through so out-of-image PCs (e.g.
  * stops inside libc on a future multi-input setup) don't return 0
  * and silently degrade lookups. */
 static uint64_t dbg_pc_rt_to_img(DbgState* s, uint64_t rt) {
   uint64_t v = kit_jit_runtime_to_image(s->jit, rt);
   return v ? v : rt;
 }
 static uint64_t dbg_pc_img_to_rt(DbgState* s, uint64_t img) {
   uint64_t v = kit_jit_image_to_runtime(s->jit, img);
   return v ? v : img;
 }
 
 /* Build a frame view in image-PC space for DWARF queries that key off
  * frame->pc (subprogram_at, param_iter_new, vars_at_new, unwind_step).
  * The register snapshot and CFA stay in their original (runtime) form
  * because dw_eval_expr / loc_read interpret them as live host values. */
 static KitUnwindFrame dbg_frame_for_dwarf(DbgState* s,
                                           const KitUnwindFrame* rt) {
   KitUnwindFrame out = *rt;
   out.pc = dbg_pc_rt_to_img(s, rt->pc);
   return out;
 }
 
 /* Translate any image-vaddr fields stored on a KitDwarfVarLoc back
  * to runtime addresses before the loc is handed to a memory accessor
  * (session_read_mem / session_write_mem operate in runtime space).
  * Only DLOC_GLOBAL carries an absolute address straight from
  * .debug_info; DLOC_REG / DLOC_FRAME_OFS / DLOC_EXPR derive their
  * effective address from live register state or are evaluated against
  * the frame, both of which are already in runtime space. */
 static void dbg_translate_loc(DbgState* s, KitDwarfVarLoc* loc) {
   if (!loc) return;
   if (loc->kind == KIT_DLOC_GLOBAL)
     loc->v.global = dbg_pc_img_to_rt(s, loc->v.global);
 }
 
 /* ============================================================
  * Tiny driver-local string utilities
  * ============================================================
  * The driver TU may use plain libc <string.h>/<ctype.h> per the project
  * rules (no syscalls). We avoid pulling in libc here only because the
  * existing driver shims cover everything we need. */
 
 static int dbg_isspace(int c) {
   return c == ' ' || c == '\t' || c == '\r' || c == '\n';
 }
 static int dbg_isdigit(int c) { return c >= '0' && c <= '9'; }
 static int dbg_isxdigit(int c) {
   return dbg_isdigit(c) || (c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F');
 }
 
 static int dbg_xval(int c) {
   if (dbg_isdigit(c)) return c - '0';
   if (c >= 'a' && c <= 'f') return c - 'a' + 10;
   return c - 'A' + 10;
 }
 
 static char* dbg_dup(DriverEnv* env, const char* s, size_t n,
                      size_t* size_out) {
   char* p = driver_alloc(env, n + 1);
   if (!p) return NULL;
   driver_memcpy(p, s, n);
   p[n] = '\0';
   if (size_out) *size_out = n + 1;
   return p;
 }
 
 /* Parse a 0x-prefixed hex literal or a decimal literal into *out. Returns
  * the number of characters consumed, or 0 on failure. */
 static size_t dbg_parse_uint(const char* s, uint64_t* out) {
   size_t i = 0;
   uint64_t v = 0;
   if (s[0] == '0' && (s[1] == 'x' || s[1] == 'X')) {
     i = 2;
     if (!dbg_isxdigit((unsigned char)s[i])) return 0;
     for (; dbg_isxdigit((unsigned char)s[i]); ++i) {
       v = (v << 4) | (uint64_t)dbg_xval((unsigned char)s[i]);
     }
   } else {
     if (!dbg_isdigit((unsigned char)s[0])) return 0;
     for (; dbg_isdigit((unsigned char)s[i]); ++i) {
       v = v * 10 + (uint64_t)(s[i] - '0');
     }
   }
   *out = v;
   return i;
 }
 
 static size_t dbg_u64_dec(char* dst, size_t cap, uint64_t v);
 
 /* ============================================================
  * Breakpoint table operations
  * ============================================================ */
 
 static Bp* dbg_bp_grow(DbgState* s) {
   uint32_t nc;
   size_t old_size, new_size;
   Bp* nb;
   if (s->nbps < s->bps_cap) return &s->bps[s->nbps];
 
   nc = s->bps_cap ? s->bps_cap * 2 : 8;
   old_size = (size_t)s->bps_cap * sizeof(Bp);
   new_size = (size_t)nc * sizeof(Bp);
   nb = s->env->heap->realloc(s->env->heap, s->bps, old_size, new_size,
                              _Alignof(Bp));
   if (!nb) {
     dbg_errf(s, "out of memory growing breakpoint table");
     return NULL;
   }
   /* Zero the freshly grown tail so future driver_free walks it cleanly. */
   {
     char* z = (char*)nb + old_size;
     size_t n = new_size - old_size;
     size_t j;
     for (j = 0; j < n; ++j) z[j] = 0;
   }
   s->bps = nb;
   s->bps_cap = nc;
   return &s->bps[s->nbps];
 }
 
 static Bp* dbg_bp_find(DbgState* s, int id) {
   uint32_t i;
   for (i = 0; i < s->nbps; ++i) {
     if (s->bps[i].id == id) return &s->bps[i];
   }
   return NULL;
 }
 
 static void dbg_bp_release(DbgState* s, Bp* b) {
   if (b->session_id) {
     kit_jit_session_breakpoint_clear(s->session, b->session_id);
     b->session_id = 0;
   }
   if (b->spec) {
     driver_free(s->env, b->spec, b->spec_size);
     b->spec = NULL;
     b->spec_size = 0;
   }
 }
 
 static int dbg_bp_remove(DbgState* s, int id) {
   uint32_t i;
   for (i = 0; i < s->nbps; ++i) {
     if (s->bps[i].id == id) {
       dbg_bp_release(s, &s->bps[i]);
       /* Shift tail down to keep the array dense; ids stay stable. */
       {
         uint32_t j;
         for (j = i + 1; j < s->nbps; ++j) s->bps[j - 1] = s->bps[j];
       }
       s->nbps--;
       {
         Bp z = {0};
         s->bps[s->nbps] = z;
       }
       return 0;
     }
   }
   return 1;
 }
 
 static void dbg_bps_release_all(DbgState* s) {
   uint32_t i;
   for (i = 0; i < s->nbps; ++i) dbg_bp_release(s, &s->bps[i]);
   if (s->bps) {
     driver_free(s->env, s->bps, (size_t)s->bps_cap * sizeof(Bp));
     s->bps = NULL;
     s->bps_cap = 0;
     s->nbps = 0;
   }
 }
 
 static void dbg_compile_sessions_release(DbgState* s) {
   uint32_t i;
   for (i = 0; i < (uint32_t)KIT_LANG_COUNT; ++i) {
     kit_compile_session_free(s->compile_sessions[i]);
     s->compile_sessions[i] = NULL;
   }
 }
 
 static void dbg_sources_release_all(DbgState* s) {
   uint32_t i;
   for (i = 0; i < s->nsources; ++i) {
     DbgSource* src = &s->sources[i];
     if (src->name) driver_free(s->env, src->name, src->name_size);
     if (src->data) driver_free(s->env, src->data, src->data_size);
   }
   if (s->sources) {
     driver_free(s->env, s->sources,
                 (size_t)s->sources_cap * sizeof(*s->sources));
     s->sources = NULL;
   }
   s->nsources = 0;
   s->sources_cap = 0;
 }
 
 /* ============================================================
  * LOC parser
  * ============================================================
  * Resolves a user-supplied location specification into a single address
  * within the JIT image:
  *
  *   0xADDR              raw address
  *   sym[+0xN | +N]      symbol via kit_jit_lookup, optional offset
  *   file.c:LINE         DWARF lookup
  *
  * Returns 0 on success, 1 on parse / resolution failure (already
  * reported via driver_errf). */
 
 static int dbg_resolve_loc(DbgState* s, const char* spec, BpKind* kind_out,
                            uint64_t* addr_out) {
   /* file:line — uniquely identifiable by a colon NOT preceded by + and
    * followed by digits. We require the suffix after ':' to be all
    * digits so we don't confuse, say, hypothetical `func:42` (which
    * isn't a thing in C). */
   const char* colon = driver_strchr(spec, ':');
   if (colon && dbg_isdigit((unsigned char)colon[1])) {
     size_t file_n = (size_t)(colon - spec);
     char* file;
     uint64_t line64;
     size_t used;
     size_t file_size;
     uint64_t pc;
 
     if (file_n == 0) {
       dbg_errf(s, "empty file in '%.*s'",
                   KIT_SLICE_ARG(kit_slice_cstr(spec)));
       return 1;
     }
     file = dbg_dup(s->env, spec, file_n, &file_size);
     if (!file) {
       dbg_errf(s, "out of memory");
       return 1;
     }
     used = dbg_parse_uint(colon + 1, &line64);
     if (!used || colon[1 + used] != '\0') {
       dbg_errf(s, "expected file.c:LINE, got '%.*s'",
                   KIT_SLICE_ARG(kit_slice_cstr(spec)));
       driver_free(s->env, file, file_size);
       return 1;
     }
     if (!s->dwarf) {
       dbg_errf(s, "no DWARF: cannot resolve %.*s",
                   KIT_SLICE_ARG(kit_slice_cstr(spec)));
       driver_free(s->env, file, file_size);
       return 1;
     }
     {
       KitStatus rc = kit_dwarf_line_to_addr(s->dwarf, kit_slice_cstr(file),
                                             (uint32_t)line64, &pc);
       if (rc == KIT_NOT_FOUND) {
         dbg_errf(s, "no line %u in %.*s", (uint32_t)line64,
                     KIT_SLICE_ARG(kit_slice_cstr(file)));
         driver_free(s->env, file, file_size);
         return 1;
       }
       if (rc == KIT_AMBIGUOUS) {
         KitDwarfLineMatch cands[8];
         uint32_t n = 0;
         uint32_t k;
         kit_dwarf_line_to_addr_all(s->dwarf, kit_slice_cstr(file),
                                    (uint32_t)line64, cands, 8u, &n);
         dbg_errf(s, "ambiguous: %.*s:%u matches %u files",
                     KIT_SLICE_ARG(kit_slice_cstr(file)), (uint32_t)line64,
                     (unsigned)n);
         for (k = 0; k < n && k < 8u; ++k) {
           dbg_errf(s, "  %.*s (0x%llx)", KIT_SLICE_ARG(cands[k].file),
                       (unsigned long long)cands[k].pc);
         }
         if (n > 8u) dbg_errf(s, "  ... and %u more", n - 8u);
         dbg_errf(s, "use a longer path suffix (e.g. b dir/%.*s:%u)",
                     KIT_SLICE_ARG(kit_slice_cstr(file)), (uint32_t)line64);
         driver_free(s->env, file, file_size);
         return 1;
       }
       if (rc != KIT_OK) {
         dbg_errf(s, "no line entry for %.*s",
                     KIT_SLICE_ARG(kit_slice_cstr(spec)));
         driver_free(s->env, file, file_size);
         return 1;
       }
     }
     driver_free(s->env, file, file_size);
     *kind_out = BP_LINE;
     *addr_out = dbg_pc_img_to_rt(s, pc);
     return 0;
   }
 
   /* 0xADDR or decimal address. */
   if ((spec[0] == '0' && (spec[1] == 'x' || spec[1] == 'X')) ||
       dbg_isdigit((unsigned char)spec[0])) {
     uint64_t v;
     size_t used = dbg_parse_uint(spec, &v);
     if (!used || spec[used] != '\0') {
       dbg_errf(s, "trailing junk in address '%.*s'",
                   KIT_SLICE_ARG(kit_slice_cstr(spec)));
       return 1;
     }
     *kind_out = BP_ADDR;
     *addr_out = v;
     return 0;
   }
 
   /* sym[+off] */
   {
     const char* plus = driver_strchr(spec, '+');
     size_t name_n = plus ? (size_t)(plus - spec) : driver_strlen(spec);
     char* name;
     size_t name_size;
     void* resolved;
     uint64_t off = 0;
 
     if (name_n == 0) {
       dbg_errf(s, "empty symbol in '%.*s'",
                   KIT_SLICE_ARG(kit_slice_cstr(spec)));
       return 1;
     }
     name = dbg_dup(s->env, spec, name_n, &name_size);
     if (!name) {
       dbg_errf(s, "out of memory");
       return 1;
     }
     resolved = kit_jit_lookup(s->jit, kit_slice_cstr(name));
     if (!resolved) {
       dbg_errf(s, "symbol not found: %.*s",
                   KIT_SLICE_ARG(kit_slice_cstr(name)));
       driver_free(s->env, name, name_size);
       return 1;
     }
     driver_free(s->env, name, name_size);
 
     if (plus) {
       size_t used = dbg_parse_uint(plus + 1, &off);
       if (!used || plus[1 + used] != '\0') {
         dbg_errf(s, "bad offset in '%.*s'",
                     KIT_SLICE_ARG(kit_slice_cstr(spec)));
         return 1;
       }
     }
 
     *kind_out = BP_SYM;
     /* Object-pointer to integer cast: implementation-defined in
      * standard C, defined as the address on every host where a JIT
      * runs. */
     {
       union {
         void* p;
         uint64_t u;
       } cv;
       cv.p = resolved;
       *addr_out = cv.u + off;
     }
     return 0;
   }
 }
 
 /* ============================================================
  * Stop rendering
  * ============================================================ */
 
 static void dbg_print_pc(DbgState* s, uint64_t pc) {
   KitSlice sym = KIT_SLICE_NULL;
   uint64_t off = 0;
   KitSlice file = KIT_SLICE_NULL;
   uint32_t line = 0;
   uint32_t col = 0;
 
   driver_printf("0x%llx", (unsigned long long)pc);
   if (kit_jit_addr_to_sym(s->jit, pc, &sym, &off) == KIT_OK && sym.s) {
     if (off)
       driver_printf(" <%.*s+0x%llx>", KIT_SLICE_ARG(sym),
                     (unsigned long long)off);
     else
       driver_printf(" <%.*s>", KIT_SLICE_ARG(sym));
   }
   if (s->dwarf &&
       kit_dwarf_addr_to_line(s->dwarf, dbg_pc_rt_to_img(s, pc), &file, &line,
                              &col) == KIT_OK &&
       file.s) {
     driver_printf(" at %.*s:%u", KIT_SLICE_ARG(file), line);
     if (col) driver_printf(":%u", col);
   }
 }
 
 static void dbg_print_source_listing(DbgState* s, KitSlice file, uint32_t line,
                                      uint64_t pc, int report_errors);
 
 static KitSlice dbg_step_stop_label(KitStopReason reason) {
   switch (reason) {
     case KIT_STOP_REASON_STEP_INSN:
       return KIT_SLICE_LIT("Single-step complete at ");
     case KIT_STOP_REASON_STEP_LINE:
       return KIT_SLICE_LIT("Step complete at ");
     case KIT_STOP_REASON_NEXT_LINE:
       return KIT_SLICE_LIT("Next complete at ");
     case KIT_STOP_REASON_STEP_OUT:
       return KIT_SLICE_LIT("Finish complete at ");
     case KIT_STOP_REASON_UNKNOWN:
     case KIT_STOP_REASON_USER_BREAKPOINT:
     case KIT_STOP_REASON_SIGNAL:
     case KIT_STOP_REASON_TRAP:
     case KIT_STOP_REASON_INTERRUPT:
     case KIT_STOP_REASON_EXIT:
       break;
   }
   return KIT_SLICE_LIT("Internal breakpoint hit at ");
 }
 
 static void dbg_cmd_bt(DbgState* s);
 static KitStatus dbg_dwarf_read_mem(void* user, uint64_t addr, void* dst,
                                     size_t n);
 
 static void dbg_render_stop(DbgState* s, const KitStopInfo* st) {
   KitSlice file = {0};
   uint32_t line = 0;
   uint32_t col = 0;
   int has_source = 0;
 
   if (st->kind != KIT_STOP_EXIT && s->dwarf &&
       kit_dwarf_addr_to_line(s->dwarf, dbg_pc_rt_to_img(s, st->regs.pc), &file,
                              &line, &col) == KIT_OK &&
       file.s) {
     has_source = 1;
   }
 
   switch (st->kind) {
     case KIT_STOP_BREAKPOINT: {
       Bp* b = NULL;
       uint32_t i;
       for (i = 0; i < s->nbps; ++i) {
         if (s->bps[i].session_id == st->bp_id) {
           b = &s->bps[i];
           break;
         }
       }
       if (b)
         driver_printf("Breakpoint %d (%.*s) hit at ", b->id,
                       KIT_SLICE_ARG(kit_slice_cstr(b->spec)));
       else {
         KitSlice label = dbg_step_stop_label(st->reason);
         driver_printf("%.*s", KIT_SLICE_ARG(label));
       }
       dbg_print_pc(s, st->regs.pc);
       driver_printf("\n");
       break;
     }
     case KIT_STOP_SIGNAL:
       if (st->reason == KIT_STOP_REASON_TRAP)
         driver_printf("Stopped on trap signal %d at ", st->signal);
       else
         driver_printf("Stopped on signal %d at ", st->signal);
       dbg_print_pc(s, st->regs.pc);
       driver_printf("\n");
       /* A fault/trap is a crash, not a planned stop: print the backtrace
        * automatically (the user would type `bt` next anyway). Breakpoints and
        * step completions are separate stop kinds, so this only fires on a real
        * signal or __builtin_trap/assert. */
       if (s->dwarf) dbg_cmd_bt(s);
       break;
     case KIT_STOP_INTERRUPT:
       driver_printf("Interrupted at ");
       dbg_print_pc(s, st->regs.pc);
       driver_printf("\n");
       break;
     case KIT_STOP_EXIT:
       driver_printf("Program exited with code %d\n", st->exit_code);
       break;
   }
   if (has_source)
     dbg_print_source_listing(s, file, line, dbg_pc_rt_to_img(s, st->regs.pc),
                              0);
 }
 
 /* ============================================================
  * Run / continue / step
  * ============================================================
  * Both `r` and `c` flow through the same wrapper: install SIGINT, drive
  * the session (call or resume), restore SIGINT, render the stop. The
  * dbg owns no signal-handling complexity itself — that's the session's
  * job. */
 
 typedef enum DbgRunMode {
   RUN_FRESH,     /* r       — _call from entry         */
   RUN_CONTINUE,  /* c       — _resume(continue)        */
   RUN_STEP_INSN, /* si      — _resume(step_insn)       */
   RUN_STEP_LINE, /* s       — _resume(step_line)       */
   RUN_NEXT_LINE, /* n       — _resume(next_line)       */
   RUN_STEP_OUT,  /* finish  — _resume(step_out)        */
 } DbgRunMode;
 
 static int dbg_drive(DbgState* s, DbgRunMode mode) {
   KitStatus rc;
 
   if (mode == RUN_FRESH && s->has_stop) {
     /* The previous session is dead (entry returned or signal landed).
      * Start a new one. Try to abort it first in case it's parked in a fault. */
     if (s->session) {
       kit_jit_session_resume(s->session, KIT_RESUME_ABORT, NULL);
     }
     s->has_stop = 0;
   } else if (mode != RUN_FRESH && !s->has_stop) {
     dbg_errf(s, "no program is running; use 'r' to start");
     return 1;
   }
 
   if (mode == RUN_FRESH && !s->entry_addr) {
     if (!s->entry_name || !*s->entry_name) {
       dbg_errf(s, "no entry symbol configured");
       return 1;
     }
     s->entry_addr = kit_jit_lookup(s->jit, kit_slice_cstr(s->entry_name));
     if (!s->entry_addr) {
       dbg_errf(s, "entry symbol not found: %.*s",
                   KIT_SLICE_ARG(kit_slice_cstr(s->entry_name)));
       return 1;
     }
   }
 
   if (driver_install_sigint(dbg_on_sigint, s) != 0) {
     dbg_errf(s, "failed to install SIGINT handler");
     return 1;
   }
 
   if (mode == RUN_FRESH) {
     rc = kit_jit_session_call(s->session, s->entry_addr, KIT_ENTRY_INT_ARGV,
                               s->prog_argc, s->prog_argv, &s->last_stop);
   } else {
     KitResumeMode rm = KIT_RESUME_CONTINUE;
     switch (mode) {
       case RUN_STEP_INSN:
         rm = KIT_RESUME_STEP_INSN;
         break;
       case RUN_STEP_LINE:
         rm = KIT_RESUME_STEP_LINE;
         break;
       case RUN_NEXT_LINE:
         rm = KIT_RESUME_NEXT_LINE;
         break;
       case RUN_STEP_OUT:
         rm = KIT_RESUME_STEP_OUT;
         break;
       case RUN_CONTINUE:
         rm = KIT_RESUME_CONTINUE;
         break;
       case RUN_FRESH:
         break; /* unreachable */
     }
     rc = kit_jit_session_resume(s->session, rm, &s->last_stop);
   }
 
   driver_restore_sigint();
 
   if (rc != KIT_OK) {
     driver_errf(
         DBG_TOOL,
         "session %.*s failed (st=%d) — "
         "JIT session implementation pending",
         KIT_SLICE_ARG(kit_slice_cstr(mode == RUN_FRESH ? "call" : "resume")),
         (int)rc);
     return 1;
   }
 
   s->has_stop = 1;
   dbg_render_stop(s, &s->last_stop);
   if (s->last_stop.kind == KIT_STOP_EXIT) s->has_stop = 0;
   return 0;
 }
 
 /* Forward declarations: backtrace renders parameter values via the
  * type-aware printer defined below. */
 static void dbg_print_value(DbgState*, const KitDwarfType*, const uint8_t*,
                             size_t got, int depth);
 static int dbg_read_value(DbgState*, const KitDwarfVarLoc*,
                           const KitUnwindFrame*, uint8_t* stack_buf,
                           size_t stack_cap, uint8_t** buf_out,
                           size_t* alloc_out, size_t* got_out);
 static void dbg_release_value_buf(DbgState*, uint8_t* buf, size_t alloc);
 static char* dbg_take_word(char* line, char** word_out);
 
 /* ============================================================
  * Backtrace
  * ============================================================
  * Renders one line per frame:
  *   #N 0xPC <sym+off> in func (arg1=val1, arg2=val2) at file:line
  * Parameter rendering uses kit_dwarf_param_iter_* against the frame's
  * PC and the unwound register snapshot. Inlined frames are flagged. */
 
 static void dbg_cmd_bt(DbgState* s) {
   KitUnwindFrame frame;
   int level = 0;
 
   if (!s->has_stop) {
     dbg_errf(s, "no program is stopped");
     return;
   }
   if (!s->dwarf) {
     dbg_errf(s, "no DWARF: backtrace unavailable");
     return;
   }
 
   frame = s->last_stop.regs;
   for (;;) {
     KitDwarfSubprogram sp;
     KitUnwindFrame img_frame;
     int have_sp;
 
     driver_printf("#%-2d ", level);
     driver_printf("0x%llx", (unsigned long long)frame.pc);
 
     {
       KitSlice sym = KIT_SLICE_NULL;
       uint64_t off = 0;
       if (kit_jit_addr_to_sym(s->jit, frame.pc, &sym, &off) == KIT_OK &&
           sym.s) {
         if (off)
           driver_printf(" <%.*s+0x%llx>", KIT_SLICE_ARG(sym),
                         (unsigned long long)off);
         else
           driver_printf(" <%.*s>", KIT_SLICE_ARG(sym));
       }
     }
 
     img_frame = dbg_frame_for_dwarf(s, &frame);
     have_sp = (kit_dwarf_subprogram_at(s->dwarf, img_frame.pc, &sp) == KIT_OK);
     if (have_sp && sp.name.s) {
       KitDwarfParamIter* it = NULL;
       KitDwarfVar p;
       int first = 1;
       driver_printf(" in %.*s%.*s (", KIT_SLICE_ARG(sp.name),
                     KIT_SLICE_ARG(sp.inlined ? KIT_SLICE_LIT(" [inlined]")
                                              : KIT_SLICE_NULL));
       if (kit_dwarf_param_iter_new(s->dwarf, img_frame.pc, &it) == KIT_OK) {
         for (;;) {
           KitIterResult r;
           uint8_t stack_buf[64];
           uint8_t* buf;
           size_t alloc;
           size_t got;
           r = kit_dwarf_param_iter_next(it, &p);
           if (r != KIT_ITER_ITEM) break;
           if (!first) driver_printf(", ");
           driver_printf("%.*s=",
                         KIT_SLICE_ARG(p.name.s ? p.name : KIT_SLICE_LIT("?")));
           dbg_translate_loc(s, &p.loc);
           if (dbg_read_value(s, &p.loc, &frame, stack_buf, sizeof(stack_buf),
                              &buf, &alloc, &got) == 0) {
             dbg_print_value(s, p.loc.type, buf, got, 0);
             dbg_release_value_buf(s, buf, alloc);
           } else {
             driver_printf("?");
           }
           first = 0;
         }
         kit_dwarf_param_iter_free(it);
       }
       driver_printf(")");
     }
 
     {
       KitSlice file = KIT_SLICE_NULL;
       uint32_t line = 0;
       uint32_t col = 0;
       KitStatus rc =
           kit_dwarf_addr_to_line(s->dwarf, img_frame.pc, &file, &line, &col);
       if (rc == KIT_OK && file.s) {
         driver_printf(" at %.*s:%u", KIT_SLICE_ARG(file), line);
         if (col) driver_printf(":%u", col);
       } else if (rc == KIT_NOT_FOUND) {
         driver_printf(" [no debug info for this frame]");
       }
     }
     driver_printf("\n");
 
     /* Advance to the caller by following the frame-pointer chain. kit keeps a
      * frame pointer on every backend with a uniform record (fp[0] = caller fp,
      * fp[1] = saved return address), so a memory-reading FP walk is reliable
      * where kit_dwarf_unwind_step is not — the CFI stepper takes no memory
      * provider and so cannot recover a return address spilled to the stack
      * (the common case), terminating after the leaf frame. Reads go through the
      * session; pc/fp/cfa stay runtime addresses, translated per DWARF query. */
     {
       KitArchKind arch = driver_host_target().arch;
       int fpreg = driver_bt_fp_dwarf_reg(arch);
       int ptr = driver_bt_ptr_size(arch);
       uint64_t ra = 0, next_fp = 0;
       if (fpreg < 0) break;
       if (!driver_bt_fp_step(arch, dbg_dwarf_read_mem, s->session,
                              frame.regs[fpreg], &ra, &next_fp))
         break; /* bottom of stack */
       /* Stop at the kit-image boundary: past `main` the chain runs into the
        * session/JIT trampoline and host libc, which carry no symbols and whose
        * depth is host-dependent. */
       if (kit_jit_runtime_to_image(s->jit, ra) == 0) break;
       frame.pc = ra;
       frame.regs[fpreg] = next_fp;
       /* Caller CFA in kit's layout: the address just above the saved pair. */
       frame.cfa = next_fp + 2u * (uint64_t)ptr;
     }
     if (++level > 256) {
       dbg_errf(s, "backtrace truncated at 256 frames");
       break;
     }
   }
 }
 
 /* ============================================================
  * Type-aware value printer
  * ============================================================
  * Walks a KitDwarfType and pretty-prints its byte representation. Used
  * by `p`, `info locals`, `info args`, and the backtrace-arg renderer.
  * Self-recursive for aggregates (struct, union, array). When `type` is
  * NULL (no DWARF type info recovered) the printer falls back to LE-as-u64
  * for small reads and a hex dump for the rest. The function emits the
  * value only — callers print any leading "name = " and the trailing
  * newline. */
 
 static uint64_t dbg_load_le_u(const uint8_t* buf, size_t n) {
   uint64_t v = 0;
   size_t i;
   for (i = 0; i < n && i < 8; ++i) v |= ((uint64_t)buf[i]) << (8 * i);
   return v;
 }
 
 static int64_t dbg_load_le_s(const uint8_t* buf, size_t n) {
   uint64_t v = dbg_load_le_u(buf, n);
   if (n > 0 && n < 8) {
     uint64_t sign = (uint64_t)1 << (8 * n - 1);
     if (v & sign) v |= ~((sign << 1) - 1);
   }
   return (int64_t)v;
 }
 
 static void dbg_indent(int n) {
   int i;
   for (i = 0; i < n; ++i) driver_printf("  ");
 }
 
 static void dbg_print_value(DbgState* s, const KitDwarfType* type,
                             const uint8_t* buf, size_t got, int depth) {
   KitDwarfTypeInfo ti;
 
   if (!type) {
     if (got == 0) {
       driver_printf("<empty>");
       return;
     }
     if (got <= 8) {
       uint64_t v = dbg_load_le_u(buf, got);
       driver_printf("0x%llx (%llu)", (unsigned long long)v,
                     (unsigned long long)v);
       return;
     }
     {
       size_t i;
       driver_printf("{");
       for (i = 0; i < got; ++i) driver_printf(" %02x", buf[i]);
       driver_printf(" }");
       return;
     }
   }
 
   ti = kit_dwarf_type_info(type);
   switch (ti.kind) {
     case KIT_DT_VOID:
       driver_printf("void");
       return;
     case KIT_DT_SINT:
     case KIT_DT_CHAR:
       driver_printf("%lld", (long long)dbg_load_le_s(buf, got));
       return;
     case KIT_DT_UINT:
     case KIT_DT_BOOL:
       driver_printf("%llu", (unsigned long long)dbg_load_le_u(buf, got));
       return;
     case KIT_DT_PTR:
       driver_printf("0x%llx", (unsigned long long)dbg_load_le_u(buf, got));
       return;
     case KIT_DT_FLOAT:
       if (got == 4) {
         union {
           uint32_t u;
           float f;
         } cv;
         cv.u = (uint32_t)dbg_load_le_u(buf, 4);
         driver_printf("%g", (double)cv.f);
       } else if (got == 8) {
         union {
           uint64_t u;
           double d;
         } cv;
         cv.u = dbg_load_le_u(buf, 8);
         driver_printf("%g", cv.d);
       } else {
         size_t i;
         driver_printf("<float-%zu", got);
         for (i = 0; i < got; ++i) driver_printf(" %02x", buf[i]);
         driver_printf(">");
       }
       return;
     case KIT_DT_ENUM: {
       int64_t v = dbg_load_le_s(buf, got);
       KitDwarfEnumIter* it = NULL;
       KitDwarfEnumVal ev;
       KitSlice match = KIT_SLICE_NULL;
       if (kit_dwarf_enum_iter_new(s->dwarf, type, &it) == KIT_OK) {
         for (;;) {
           KitIterResult r = kit_dwarf_enum_iter_next(it, &ev);
           if (r != KIT_ITER_ITEM) break;
           if (ev.value == v) {
             match = ev.name;
             break;
           }
         }
         kit_dwarf_enum_iter_free(it);
       }
       if (match.s)
         driver_printf("%.*s (%lld)", KIT_SLICE_ARG(match), (long long)v);
       else
         driver_printf("%lld", (long long)v);
       return;
     }
     case KIT_DT_TYPEDEF:
       dbg_print_value(s, ti.inner, buf, got, depth);
       return;
     case KIT_DT_ARRAY: {
       uint32_t n = ti.element_count;
       size_t esz = 0;
       uint32_t i;
       if (ti.inner) {
         KitDwarfTypeInfo ein = kit_dwarf_type_info(ti.inner);
         esz = ein.byte_size;
       }
       if (esz == 0 || n == 0 || (size_t)n * esz > got) {
         size_t k;
         driver_printf("{");
         for (k = 0; k < got; ++k) driver_printf(" %02x", buf[k]);
         driver_printf(" }");
         return;
       }
       driver_printf("{\n");
       for (i = 0; i < n; ++i) {
         dbg_indent(depth + 1);
         driver_printf("[%u] = ", i);
         dbg_print_value(s, ti.inner, buf + (size_t)i * esz, esz, depth + 1);
         driver_printf(",\n");
       }
       dbg_indent(depth);
       driver_printf("}");
       return;
     }
     case KIT_DT_STRUCT:
     case KIT_DT_UNION: {
       KitDwarfFieldIter* it = NULL;
       KitDwarfField f;
       driver_printf("{\n");
       if (kit_dwarf_field_iter_new(s->dwarf, type, &it) == KIT_OK) {
         for (;;) {
           KitIterResult r = kit_dwarf_field_iter_next(it, &f);
           if (r != KIT_ITER_ITEM) break;
           size_t fsz = 0;
           dbg_indent(depth + 1);
           driver_printf(
               ".%.*s = ",
               KIT_SLICE_ARG(f.name.len ? f.name : KIT_SLICE_LIT("<anon>")));
           if (f.bit_size) {
             /* Bitfield: read up to 8 bytes spanning the storage
              * unit at byte_offset, shift, mask. */
             size_t off = f.byte_offset;
             size_t take = (off + 8 <= got) ? 8 : (off < got ? got - off : 0);
             uint64_t raw = take ? dbg_load_le_u(buf + off, take) : 0;
             uint64_t mask = (f.bit_size >= 64)
                                 ? (uint64_t)-1
                                 : (((uint64_t)1 << f.bit_size) - 1);
             uint64_t v = (raw >> f.bit_offset) & mask;
             driver_printf("%llu", (unsigned long long)v);
           } else {
             if (f.type) {
               KitDwarfTypeInfo fti = kit_dwarf_type_info(f.type);
               fsz = fti.byte_size;
             }
             if (f.type && fsz > 0 && (size_t)f.byte_offset + fsz <= got) {
               dbg_print_value(s, f.type, buf + f.byte_offset, fsz, depth + 1);
             } else {
               driver_printf("<truncated>");
             }
           }
           driver_printf(",\n");
         }
         kit_dwarf_field_iter_free(it);
       }
       dbg_indent(depth);
       driver_printf("}");
       return;
     }
     case KIT_DT_FUNC:
       driver_printf("<function@0x%llx>",
                     (unsigned long long)dbg_load_le_u(buf, got));
       return;
   }
   driver_printf("<?>");
 }
 
 /* KitDwarfReadMemFn adapter: forwards a DWARF-driven memory read into
  * the JIT session's address space. The user pointer carries the
  * KitJitSession. */
 static KitStatus dbg_dwarf_read_mem(void* user, uint64_t addr, void* dst,
                                     size_t n) {
   KitJitSession* sess = (KitJitSession*)user;
   if (!sess) return KIT_INVALID;
   return kit_jit_session_read_mem(sess, addr, dst, n);
 }
 
 /* Read a variable's bytes into a heap or stack buffer sized for its DIE
  * type. On success returns 0 and sets *buf_out (which may point at
  * stack_buf or at a heap allocation) plus *got_out. The caller frees
  * *buf_out via dbg_release_value_buf when done. */
 static int dbg_read_value(DbgState* s, const KitDwarfVarLoc* loc,
                           const KitUnwindFrame* frame, uint8_t* stack_buf,
                           size_t stack_cap, uint8_t** buf_out,
                           size_t* alloc_out, size_t* got_out) {
   uint8_t* buf = stack_buf;
   size_t alloc = 0;
   size_t cap = stack_cap;
   size_t got = 0;
 
   if (loc->byte_size > cap) {
     alloc = loc->byte_size;
     buf = driver_alloc(s->env, alloc);
     if (!buf) return 1;
     cap = alloc;
   }
   if (kit_dwarf_loc_read(s->dwarf, loc, frame, dbg_dwarf_read_mem, s->session,
                          buf, cap, &got) != KIT_OK) {
     if (alloc) driver_free(s->env, buf, alloc);
     return 1;
   }
   *buf_out = buf;
   *alloc_out = alloc;
   *got_out = got;
   return 0;
 }
 
 static void dbg_release_value_buf(DbgState* s, uint8_t* buf, size_t alloc) {
   if (alloc) driver_free(s->env, buf, alloc);
 }
 
 /* ============================================================
  * `p name`
  * ============================================================ */
 
 static void dbg_cmd_print(DbgState* s, const char* name) {
   KitDwarfVarLoc loc;
   uint8_t stack_buf[64];
   uint8_t* buf;
   size_t alloc;
   size_t got;
 
   if (!s->has_stop) {
     dbg_errf(s, "no program is stopped");
     return;
   }
 
   {
     KitStatus rc =
         s->dwarf ? kit_dwarf_var_at(s->dwarf,
                                     dbg_pc_rt_to_img(s, s->last_stop.regs.pc),
                                     kit_slice_cstr(name), &loc)
                  : KIT_NOT_FOUND;
     if (rc == KIT_OK) {
       dbg_translate_loc(s, &loc);
       if (dbg_read_value(s, &loc, &s->last_stop.regs, stack_buf,
                          sizeof(stack_buf), &buf, &alloc, &got) != 0) {
         dbg_errf(s, "could not read %.*s",
                     KIT_SLICE_ARG(kit_slice_cstr(name)));
         return;
       }
       driver_printf("%.*s = ", KIT_SLICE_ARG(kit_slice_cstr(name)));
       dbg_print_value(s, loc.type, buf, got, 0);
       driver_printf("\n");
       dbg_release_value_buf(s, buf, alloc);
       return;
     }
 
     /* DWARF didn't know about it — try a global symbol. */
     {
       void* p = kit_jit_lookup(s->jit, kit_slice_cstr(name));
       if (p) {
         union {
           void* p;
           uint64_t u;
         } cv;
         cv.p = p;
         driver_printf("%.*s = 0x%llx (no DWARF type info)\n",
                       KIT_SLICE_ARG(kit_slice_cstr(name)),
                       (unsigned long long)cv.u);
         return;
       }
     }
     dbg_errf(s, "no variable or symbol named '%.*s'",
                 KIT_SLICE_ARG(kit_slice_cstr(name)));
   }
 }
 
 /* ============================================================
  * `set NAME VALUE`
  * ============================================================
  * Writes a 64-bit value into a variable. Routes to write_mem for
  * frame-relative and global locations, set_regs for register-resident
  * variables. v1 supports integer/pointer scalars only — float and
  * aggregate writes are out of scope. */
 
 static void dbg_cmd_set(DbgState* s, const char* name, uint64_t value) {
   KitDwarfVarLoc loc;
   uint8_t buf[8];
   size_t sz;
   size_t i;
 
   if (!s->has_stop) {
     dbg_errf(s, "no program is stopped");
     return;
   }
   {
     KitStatus rc =
         s->dwarf ? kit_dwarf_var_at(s->dwarf,
                                     dbg_pc_rt_to_img(s, s->last_stop.regs.pc),
                                     kit_slice_cstr(name), &loc)
                  : KIT_NOT_FOUND;
     if (rc != KIT_OK) {
       dbg_errf(s, "no variable named '%.*s'",
                   KIT_SLICE_ARG(kit_slice_cstr(name)));
       return;
     }
   }
   dbg_translate_loc(s, &loc);
 
   sz = (loc.byte_size == 0 || loc.byte_size > 8) ? 8 : loc.byte_size;
   for (i = 0; i < sz; ++i) buf[i] = (uint8_t)(value >> (8 * i));
 
   switch (loc.kind) {
     case KIT_DLOC_FRAME_OFS: {
       uint64_t addr =
           s->last_stop.regs.cfa + (uint64_t)(int64_t)loc.v.frame_ofs;
       if (kit_jit_session_write_mem(s->session, addr, buf, sz) != KIT_OK) {
         dbg_errf(s, "memory write failed");
       }
       return;
     }
     case KIT_DLOC_GLOBAL:
       if (kit_jit_session_write_mem(s->session, loc.v.global, buf, sz) !=
           KIT_OK) {
         dbg_errf(s, "memory write failed");
       }
       return;
     case KIT_DLOC_REG: {
       KitUnwindFrame fr = s->last_stop.regs;
       if (loc.v.reg >= 32) {
         dbg_errf(s, "register %u outside the snapshot range",
                     loc.v.reg);
         return;
       }
       fr.regs[loc.v.reg] = value;
       if (kit_jit_session_set_regs(s->session, &fr) != KIT_OK) {
         dbg_errf(s, "register write failed");
         return;
       }
       s->last_stop.regs = fr;
       return;
     }
     case KIT_DLOC_EXPR:
       dbg_errf(s, "cannot set '%.*s': location is a DWARF expression",
                   KIT_SLICE_ARG(kit_slice_cstr(name)));
       return;
   }
 }
 
 /* ============================================================
  * `jump ADDR`
  * ============================================================
  * Move PC without resuming. The session validates that the new PC lies
  * within the JIT image. */
 
 static void dbg_cmd_jump(DbgState* s, uint64_t pc) {
   KitUnwindFrame fr;
   if (!s->has_stop) {
     dbg_errf(s, "no program is stopped");
     return;
   }
   fr = s->last_stop.regs;
   fr.pc = pc;
   if (kit_jit_session_set_regs(s->session, &fr) != 0) {
     dbg_errf(s, "jump failed (pc 0x%llx outside image?)",
                 (unsigned long long)pc);
     return;
   }
   s->last_stop.regs = fr;
   driver_printf("PC set to 0x%llx\n", (unsigned long long)pc);
 }
 
 /* ============================================================
  * `info locals` / `info args` / `info reg`
  * ============================================================ */
 
 static void dbg_cmd_info_vars(DbgState* s, uint32_t mask, const char* label) {
   KitDwarfVarIter* it = NULL;
   KitDwarfVar v;
   int printed = 0;
 
   if (!s->has_stop) {
     dbg_errf(s, "no program is stopped");
     return;
   }
   if (!s->dwarf) {
     dbg_errf(s, "no DWARF: %.*s unavailable",
                 KIT_SLICE_ARG(kit_slice_cstr(label)));
     return;
   }
 
   if (kit_dwarf_vars_at_new(s->dwarf, dbg_pc_rt_to_img(s, s->last_stop.regs.pc),
                             mask, &it) != KIT_OK) {
     driver_printf("No %.*s.\n", KIT_SLICE_ARG(kit_slice_cstr(label)));
     return;
   }
   for (;;) {
     KitIterResult r = kit_dwarf_vars_at_next(it, &v);
     if (r != KIT_ITER_ITEM) break;
     uint8_t stack_buf[64];
     uint8_t* buf;
     size_t alloc;
     size_t got;
     printed = 1;
     dbg_translate_loc(s, &v.loc);
     if (dbg_read_value(s, &v.loc, &s->last_stop.regs, stack_buf,
                        sizeof(stack_buf), &buf, &alloc, &got) != 0) {
       driver_printf("  %.*s = <unreadable>\n", KIT_SLICE_ARG(v.name));
       continue;
     }
     driver_printf("  %.*s = ", KIT_SLICE_ARG(v.name));
     dbg_print_value(s, v.loc.type, buf, got, 1);
     driver_printf("\n");
     dbg_release_value_buf(s, buf, alloc);
   }
   kit_dwarf_vars_at_free(it);
   if (!printed)
     driver_printf("No %.*s.\n", KIT_SLICE_ARG(kit_slice_cstr(label)));
 }
 
 static void dbg_cmd_info_reg(DbgState* s) {
   KitArchKind arch = driver_host_target().arch;
   uint32_t n = kit_arch_register_count(arch);
   uint32_t i;
 
   if (!s->has_stop) {
     dbg_errf(s, "no program is stopped");
     return;
   }
   if (n == 0) {
     dbg_errf(s, "no register table for this arch");
     return;
   }
   driver_printf("pc     0x%016llx\n", (unsigned long long)s->last_stop.regs.pc);
   driver_printf("cfa    0x%016llx\n",
                 (unsigned long long)s->last_stop.regs.cfa);
   for (i = 0; i < n; ++i) {
     KitArchReg r;
     if (kit_arch_register_at(arch, i, &r) != KIT_OK) continue;
     if (r.dwarf_idx >= 32) continue; /* outside KitUnwindFrame.regs */
     driver_printf("%-6.*s 0x%016llx\n", KIT_SLICE_ARG(r.name),
                   (unsigned long long)s->last_stop.regs.regs[r.dwarf_idx]);
   }
 }
 
 /* ============================================================
  * `info functions [PATTERN]` / `info variables [PATTERN]`
  * ============================================================ */
 
 /* Tiny glob matcher: '*' matches any run, '?' matches any single byte.
  * NULL pattern matches every name. */
 static int dbg_glob(const char* pat, const char* s) {
   if (!pat) return 1;
   while (*pat && *s) {
     if (*pat == '*') {
       if (pat[1] == '\0') return 1;
       while (*s) {
         if (dbg_glob(pat + 1, s)) return 1;
         ++s;
       }
       return dbg_glob(pat + 1, s);
     }
     if (*pat != '?' && *pat != *s) return 0;
     ++pat;
     ++s;
   }
   while (*pat == '*') ++pat;
   return *pat == '\0' && *s == '\0';
 }
 
 static void dbg_cmd_info_syms(DbgState* s, KitSymKind want,
                               const char* pattern) {
   KitJitSymIter* it = NULL;
   KitJitSym sym;
   int printed = 0;
 
   if (kit_jit_sym_iter_new(s->jit, &it) != KIT_OK) {
     dbg_errf(s, "symbol enumeration unavailable");
     return;
   }
   for (;;) {
     KitIterResult r = kit_jit_sym_iter_next(it, &sym);
     if (r != KIT_ITER_ITEM) break;
     if (sym.kind != want) continue;
     if (pattern && !dbg_glob(pattern, sym.name.s)) continue;
     driver_printf("0x%016llx  %.*s\n", (unsigned long long)sym.addr,
                   KIT_SLICE_ARG(sym.name));
     printed = 1;
   }
   kit_jit_sym_iter_free(it);
   if (!printed) driver_printf("(none)\n");
 }
 
 static int dbg_refresh_dwarf(DbgState* s) {
   if (s->dwarf) {
     kit_dwarf_free(s->dwarf);
     s->dwarf = NULL;
   }
   s->view = kit_jit_view(s->jit);
   if (s->view) {
     if (kit_dwarf_open(&s->ctx, s->view, &s->dwarf) != KIT_OK) s->dwarf = NULL;
     if (s->dwarf && s->session) {
       kit_jit_session_attach_dwarf(s->session, s->dwarf);
     }
   } else if (s->session) {
     kit_jit_session_attach_dwarf(s->session, NULL);
   }
   return 0;
 }
 
 static int dbg_buf_append(DbgState* s, char** buf, size_t* len, size_t* cap,
                           const char* src, size_t n) {
   if (*len + n + 1u > *cap) {
     size_t nc = *cap ? *cap * 2u : 1024u;
     char* nb;
     while (nc < *len + n + 1u) nc *= 2u;
     nb = (char*)s->env->heap->realloc(s->env->heap, *buf, *cap, nc,
                                       _Alignof(char));
     if (!nb) return 1;
     *buf = nb;
     *cap = nc;
   }
   driver_memcpy(*buf + *len, src, n);
   *len += n;
   (*buf)[*len] = '\0';
   return 0;
 }
 
 static DbgSource* dbg_source_find(DbgState* s, KitSlice name) {
   uint32_t i;
   if (!s || !name.s || !name.len) return NULL;
   for (i = 0; i < s->nsources; ++i) {
     DbgSource* src = &s->sources[i];
     if (src->name && src->name_size == name.len + 1u &&
         memcmp(src->name, name.s, name.len) == 0) {
       return src;
     }
   }
   return NULL;
 }
 
 static DbgSource* dbg_source_grow(DbgState* s) {
   uint32_t nc;
   size_t old_size, new_size;
   DbgSource* ns;
   if (s->nsources < s->sources_cap) return &s->sources[s->nsources];
 
   nc = s->sources_cap ? s->sources_cap * 2 : 8;
   old_size = (size_t)s->sources_cap * sizeof(*s->sources);
   new_size = (size_t)nc * sizeof(*s->sources);
   ns = (DbgSource*)s->env->heap->realloc(s->env->heap, s->sources, old_size,
                                          new_size, _Alignof(DbgSource));
   if (!ns) return NULL;
   {
     char* z = (char*)ns + old_size;
     size_t n = new_size - old_size;
     size_t j;
     for (j = 0; j < n; ++j) z[j] = 0;
   }
   s->sources = ns;
   s->sources_cap = nc;
   return &s->sources[s->nsources];
 }
 
 static int dbg_source_intern_name(DbgState* s, KitSlice name,
                                   const char** out) {
   DbgSource* src;
   size_t name_size;
   char* name_copy;
   if (out) *out = NULL;
   if (!s || !name.s || !name.len) return 1;
 
   src = dbg_source_find(s, name);
   if (src) {
     if (out) *out = src->name;
     return 0;
   }
 
   name_copy = dbg_dup(s->env, name.s, name.len, &name_size);
   if (!name_copy) return 1;
   src = dbg_source_grow(s);
   if (!src) {
     driver_free(s->env, name_copy, name_size);
     return 1;
   }
   src->name = name_copy;
   src->name_size = name_size;
   s->nsources++;
   if (out) *out = src->name;
   return 0;
 }
 
 static int dbg_source_cache_put(DbgState* s, KitSlice name, const char* data,
                                 size_t len) {
   DbgSource* src;
   uint8_t* data_copy;
   size_t data_size = len ? len : 1u;
   if (!s || !name.s || !name.len || !data) return 1;
 
   data_copy = (uint8_t*)driver_alloc(s->env, data_size);
   if (!data_copy) return 1;
   if (len) driver_memcpy(data_copy, data, len);
 
   src = dbg_source_find(s, name);
   if (!src) {
     if (dbg_source_intern_name(s, name, NULL) != 0) {
       driver_free(s->env, data_copy, data_size);
       return 1;
     }
     src = dbg_source_find(s, name);
     if (!src) {
       driver_free(s->env, data_copy, data_size);
       return 1;
     }
   }
   if (src->data) {
     driver_free(s->env, src->data, src->data_size);
   }
 
   src->data = data_copy;
   src->data_size = data_size;
   src->len = len;
   return 0;
 }
 
 static int dbg_brace_delta(const char* p) {
   int d = 0;
   while (*p) {
     if (*p == '{')
       ++d;
     else if (*p == '}')
       --d;
     ++p;
   }
   return d;
 }
 
 /* Caller buffer sizes for the REPL filename builders below. ".<ext>" and
  * "<dbg-jit.<ext>>" with the canonical frontend extension comfortably fit. */
 #define DBG_JIT_SUFFIX_CAP 16
 #define DBG_JIT_NAME_CAP 32
 /* DbgState.default_jit_name_buf must match DBG_JIT_NAME_CAP (it is sized with a
  * literal because it precedes this macro in the file). */
 _Static_assert(sizeof(((DbgState*)0)->default_jit_name_buf) == DBG_JIT_NAME_CAP,
                "default_jit_name_buf must equal DBG_JIT_NAME_CAP");
 
 /* Canonical language name for the JIT REPL (kit_language_name with a "c"
  * fallback so C and any unnamed/out-of-range language render as "c", matching
  * the former hardcoded default). The result is borrowed static storage. */
 static const char* dbg_jit_language_name(KitCompiler* c, KitLanguage lang) {
   const char* name = kit_language_name(c, lang);
   return name ? name : "c";
 }
 
 /* Append NUL-terminated `s` into `buf[cap]` starting at `*pos`, advancing
  * `*pos`. Truncates rather than overflowing; the result is always
  * NUL-terminated when cap > 0. (dbg.c builds strings with driver_* helpers
  * rather than stdio.) */
 static void dbg_str_append(char* buf, size_t cap, size_t* pos, const char* s) {
   size_t n = driver_strlen(s);
   size_t room;
   if (*pos >= cap) return;
   room = cap - 1u - *pos; /* leave space for NUL */
   if (n > room) n = room;
   driver_memcpy(buf + *pos, s, n);
   *pos += n;
   buf[*pos] = '\0';
 }
 
 /* Build the dotted file suffix (e.g. ".toy") for `lang` into `buf`, defaulting
  * to ".c" for C and any unnamed/out-of-range language. The canonical bare
  * extension is the single source of truth (kit_language_default_extension);
  * the leading "." is tool presentation. Returns `buf`. */
 static const char* dbg_jit_language_suffix(KitCompiler* c, KitLanguage lang,
                                            char* buf, size_t cap) {
   const char* ext = kit_language_default_extension(c, lang);
   size_t pos = 0;
   if (lang == KIT_LANG_C || !ext) ext = "c";
   if (cap > 0) buf[0] = '\0';
   dbg_str_append(buf, cap, &pos, ".");
   dbg_str_append(buf, cap, &pos, ext);
   return buf;
 }
 
 /* Build the default synthesized REPL source name (e.g. "<dbg-jit.toy>") for
  * `lang` into `buf`, derived from the canonical suffix. Returns `buf`. */
 static const char* dbg_jit_default_name(KitCompiler* c, KitLanguage lang,
                                         char* buf, size_t cap) {
   char suffix[DBG_JIT_SUFFIX_CAP];
   size_t pos = 0;
   dbg_jit_language_suffix(c, lang, suffix, sizeof suffix);
   if (cap > 0) buf[0] = '\0';
   dbg_str_append(buf, cap, &pos, "<dbg-jit");
   dbg_str_append(buf, cap, &pos, suffix);
   dbg_str_append(buf, cap, &pos, ">");
   return buf;
 }
 
 static int dbg_jit_uses_default_name(KitCompiler* c, KitLanguage lang,
                                      const char* input_name) {
   char def[DBG_JIT_NAME_CAP];
   return !input_name ||
          driver_streq(input_name,
                       dbg_jit_default_name(c, lang, def, sizeof def));
 }
 
 static int dbg_make_repl_source_name(KitCompiler* c, KitLanguage lang,
                                      uint64_t id, char* out, size_t cap) {
   const char* prefix = "<dbg-jit-";
   char suffix_buf[DBG_JIT_SUFFIX_CAP];
   const char* suffix =
       dbg_jit_language_suffix(c, lang, suffix_buf, sizeof suffix_buf);
   char num[32];
   size_t prefix_len = driver_strlen(prefix);
   size_t suffix_len = driver_strlen(suffix);
   size_t num_len = dbg_u64_dec(num, sizeof(num), id);
   size_t need;
   if (!num_len) return 1;
   need = prefix_len + num_len + suffix_len + 2u;
   if (need > cap) return 1;
   driver_memcpy(out, prefix, prefix_len);
   driver_memcpy(out + prefix_len, num, num_len);
   driver_memcpy(out + prefix_len + num_len, suffix, suffix_len);
   out[prefix_len + num_len + suffix_len] = '>';
   out[prefix_len + num_len + suffix_len + 1u] = '\0';
   return 0;
 }
 
 static KitLanguage dbg_jit_language_for_tag(DbgState* s, const char* tag,
                                             const char** name_out) {
   if (!tag || !*tag) {
     if (name_out) *name_out = s->default_jit_name;
     return s->default_jit_lang;
   }
   if (driver_streq(tag, "c")) {
     if (name_out) *name_out = "<dbg-jit.c>";
     return KIT_LANG_C;
   }
   if (driver_streq(tag, "toy")) {
     if (name_out) *name_out = "<dbg-jit.toy>";
     return KIT_LANG_TOY;
   }
   if (driver_streq(tag, "asm") || driver_streq(tag, "s")) {
     if (name_out) *name_out = "<dbg-jit.s>";
     return KIT_LANG_ASM;
   }
   if (driver_streq(tag, "wasm") || driver_streq(tag, "wat")) {
     if (name_out) *name_out = "<dbg-jit.wat>";
     return KIT_LANG_WASM;
   }
   if (name_out) *name_out = tag;
   return kit_language_for_path(s->compiler, tag);
 }
 
 static KitStatus dbg_compile_session_for(DbgState* s, KitLanguage lang,
                                          KitCompileSession** out) {
   KitCompileSessionOptions sopts;
   KitStatus st;
 
   if (!s || !out || (unsigned)lang >= KIT_LANG_COUNT) return KIT_INVALID;
   *out = NULL;
   if (s->compile_sessions[lang]) {
     *out = s->compile_sessions[lang];
     return KIT_OK;
   }
   {
     KitCompileSessionOptions z = {0};
     sopts = z;
   }
   sopts.lang = lang;
   sopts.compile.code = s->copts.code;
   sopts.compile.diagnostics = s->copts.diagnostics;
   sopts.compile.preprocess = s->pp;
   st = kit_compile_session_new(s->compiler, &sopts, &s->compile_sessions[lang]);
   if (st != KIT_OK) return st;
   *out = s->compile_sessions[lang];
   return KIT_OK;
 }
 
 static int dbg_jit_compile_append_ex(DbgState* s, KitLanguage lang,
                                      const char* input_name, const char* src,
                                      size_t len,
                                      KitFrontendInputKind input_kind,
                                      const char* repl_entry_name) {
   KitSourceInput sin;
   KitCompileSession* session = NULL;
   KitObjBuilder* ob = NULL;
   KitStatus st;
   char generated_name[96];
   char default_name[DBG_JIT_NAME_CAP];
   const char* effective_name =
       input_name ? input_name
                  : dbg_jit_default_name(s->compiler, lang, default_name,
                                         sizeof default_name);
   uint64_t source_id = s->source_counter + 1u;
   int generated_source_name = 0;
 
   s->jit_counter++;
   if (input_kind == KIT_FRONTEND_INPUT_REPL_TOPLEVEL &&
       dbg_jit_uses_default_name(s->compiler, lang, input_name)) {
     if (dbg_make_repl_source_name(s->compiler, lang, source_id, generated_name,
                                   sizeof(generated_name)) != 0) {
       dbg_errf(s, "repl source name overflow");
       return 1;
     }
     if (dbg_source_intern_name(s, kit_slice_cstr(generated_name),
                                &effective_name) != 0) {
       dbg_errf(s, "out of memory naming repl source");
       return 1;
     }
     generated_source_name = 1;
   }
   memset(&sin, 0, sizeof(sin));
   sin.name = kit_slice_cstr(effective_name);
   sin.bytes.data = (const uint8_t*)src;
   sin.bytes.len = len;
   sin.lang = lang;
   sin.input_kind = input_kind;
   sin.repl_entry_name = kit_slice_cstr(repl_entry_name);
   st = dbg_compile_session_for(s, lang, &session);
   /* Stage the compile: on success the frontend's durable declarations are left
    * pending so we only commit them once the object has actually been published
    * into the JIT image. A failed compile is already rolled back internally. */
   if (st == KIT_OK) st = kit_compile_session_stage(session, &sin, &ob);
   if (st != KIT_OK || !ob) {
     if (ob) kit_obj_builder_free(ob);
     dbg_errf(s, "jit compile failed");
     return 1;
   }
   {
     KitLinkSessionOptions lopts = {0};
     KitLinkSession* link = NULL;
     KitJitPublishOptions popts = {0};
     KitJitPublishResult pres;
     lopts.output_kind = KIT_LINK_OUTPUT_RELOCATABLE;
     st = kit_link_session_new(s->compiler, &lopts, &link);
     if (st == KIT_OK) st = kit_link_session_add_obj(link, ob);
     popts.kind = KIT_JIT_PUBLISH_APPEND_OBJECTS;
     popts.link = link;
     if (st == KIT_OK) st = kit_jit_publish(s->jit, &popts, &pres);
     kit_link_session_free(link);
   }
   if (st != KIT_OK) {
     /* Publish rejected the object (e.g. a duplicate global). Roll back the
      * staged declarations so the frontend never advertises a symbol the JIT
      * image does not have. */
     kit_compile_session_abort(session);
     dbg_errf(s, "jit append failed");
     return 1;
   }
   /* Published: make the staged declarations durable. */
   kit_compile_session_commit(session);
   if (generated_source_name) s->source_counter = source_id;
   {
     /* Cache the verbatim toplevel text only for frontends that re-read
      * earlier toplevel source on later compiles (toy today), per the
      * frontend's static capability rather than a hard-coded language. */
     KitFrontendCaps caps = {0};
     int cache_source =
         kit_frontend_caps(s->compiler, lang, &caps) == KIT_OK &&
         caps.cache_repl_toplevel_source;
     if (cache_source && input_kind == KIT_FRONTEND_INPUT_REPL_TOPLEVEL &&
         dbg_source_cache_put(s, sin.name, src, len) != 0) {
       dbg_errf(s, "out of memory caching source for list");
     }
   }
   dbg_refresh_dwarf(s);
   return 0;
 }
 
 static int dbg_jit_compile_append(DbgState* s, KitLanguage lang,
                                   const char* input_name, const char* src,
                                   size_t len) {
   return dbg_jit_compile_append_ex(s, lang, input_name, src, len,
                                    KIT_FRONTEND_INPUT_REPL_TOPLEVEL, NULL);
 }
 
 static int dbg_parse_jit_lang_arg(DbgState* s, const char* rest,
                                   KitLanguage* lang_out,
                                   const char** input_name_out,
                                   const char** after_out) {
   const char* p = rest;
   const char* input_name = NULL;
   KitLanguage lang;
 
   while (*p && dbg_isspace((unsigned char)*p)) ++p;
   if (*p && *p != '{') {
     const char* tag = p;
     size_t tag_n;
     char tag_buf[64];
     while (*p && !dbg_isspace((unsigned char)*p) && *p != '{') ++p;
     tag_n = (size_t)(p - tag);
     if (tag_n == 0 || tag_n >= sizeof(tag_buf)) {
       dbg_errf(s, "language/name is too long");
       return 1;
     }
     driver_memcpy(tag_buf, tag, tag_n);
     tag_buf[tag_n] = '\0';
     lang = dbg_jit_language_for_tag(s, tag_buf, &input_name);
     if (input_name == tag_buf &&
         dbg_source_intern_name(s, kit_slice_cstr(input_name), &input_name) !=
             0) {
       dbg_errf(s, "out of memory naming repl source");
       return 1;
     }
     while (*p && dbg_isspace((unsigned char)*p)) ++p;
   } else {
     lang = dbg_jit_language_for_tag(s, NULL, &input_name);
   }
 
   *lang_out = lang;
   *input_name_out = input_name;
   *after_out = p;
   return 0;
 }
 
 static void dbg_cmd_jit(DbgState* s, const char* rest) {
   char* src = NULL;
   size_t len = 0, cap = 0;
   const char* p;
   const char* input_name;
   KitLanguage lang;
   int depth;
 
   if (dbg_parse_jit_lang_arg(s, rest, &lang, &input_name, &p) != 0) return;
   if (*p != '{') {
     dbg_errf(s, "usage: jit [c|toy|asm|name.ext] { ... }");
     return;
   }
   ++p;
   depth = 1 + dbg_brace_delta(p);
   {
     const char* end = p + driver_strlen(p);
     if (depth <= 0) {
       while (end > p && end[-1] != '}') --end;
       if (end > p) --end;
     }
     if (dbg_buf_append(s, &src, &len, &cap, p, (size_t)(end - p)) != 0)
       goto oom;
     if (dbg_buf_append(s, &src, &len, &cap, "\n", 1) != 0) goto oom;
   }
   while (depth > 0) {
     char line[LINE_CAP];
     int n;
     driver_printf("     > ");
     driver_flush_stdout();
     n = driver_read_line(line, sizeof(line));
     if (n <= 0) {
       dbg_errf(s, "unterminated jit block");
       goto out;
     }
     depth += dbg_brace_delta(line);
     if (depth <= 0) {
       char* close = line;
       while (*close && *close != '}') ++close;
       if (dbg_buf_append(s, &src, &len, &cap, line, (size_t)(close - line)) !=
           0)
         goto oom;
       if (dbg_buf_append(s, &src, &len, &cap, "\n", 1) != 0) goto oom;
       break;
     }
     if (dbg_buf_append(s, &src, &len, &cap, line, driver_strlen(line)) != 0)
       goto oom;
     if (dbg_buf_append(s, &src, &len, &cap, "\n", 1) != 0) goto oom;
   }
 
   (void)dbg_jit_compile_append(s, lang, input_name, src, len);
   goto out;
 
 oom:
   dbg_errf(s, "out of memory");
 out:
   if (src) driver_free(s->env, src, cap);
 }
 
 static void dbg_cmd_edit(DbgState* s, const char* rest) {
   KitLanguage lang;
   const char* input_name;
   const char* p;
   uint8_t* src = NULL;
   size_t len = 0;
   char suffix[DBG_JIT_SUFFIX_CAP];
 
   if (dbg_parse_jit_lang_arg(s, rest, &lang, &input_name, &p) != 0) return;
   if (*p) {
     dbg_errf(s, "usage: edit [c|toy|asm|name.ext]");
     return;
   }
   if (!driver_edit_temp(s->env,
                         dbg_jit_language_suffix(s->compiler, lang, suffix,
                                                 sizeof suffix),
                         NULL, 0, &src, &len)) {
     dbg_errf(s, "editor failed");
     return;
   }
   if (len == 0) {
     dbg_errf(s, "empty editor buffer; nothing appended");
     goto out;
   }
   (void)dbg_jit_compile_append(s, lang, input_name, (const char*)src, len);
 
 out:
   driver_free(s->env, src, len);
 }
 
 static void dbg_cmd_language(DbgState* s, const char* rest) {
   char tmp[WORD_CAP];
   const char* p = rest;
   size_t n = 0;
   KitLanguage lang;
   const char* name;
 
   while (*p && dbg_isspace((unsigned char)*p)) ++p;
   while (p[n] && !dbg_isspace((unsigned char)p[n])) ++n;
   if (n == 0) {
     const KitPreprocessOptions* pp = &s->pp;
     driver_printf("Language: %.*s\n",
                   KIT_SLICE_ARG(kit_slice_cstr(dbg_jit_language_name(
                       s->compiler, s->default_jit_lang))));
     driver_printf(
         "Language options: input=%.*s opt=-O%d debug=%.*s includes=%u "
         "system-includes=%u defines=%u undefines=%u session=%.*s\n",
         KIT_SLICE_ARG(kit_slice_cstr(s->default_jit_name)),
         s->copts.code.opt_level,
         KIT_SLICE_ARG(kit_slice_cstr(s->copts.code.debug_info ? "on" : "off")),
         (unsigned)pp->ninclude_dirs, (unsigned)pp->nsystem_include_dirs,
         (unsigned)pp->ndefines, (unsigned)pp->nundefines,
         KIT_SLICE_ARG(kit_slice_cstr(s->compile_sessions[s->default_jit_lang]
                                          ? "cached"
                                          : "not-created")));
     return;
   }
   if (n >= sizeof(tmp)) {
     dbg_errf(s, "usage: :language c|toy|asm|wat|wasm");
     return;
   }
   driver_memcpy(tmp, p, n);
   tmp[n] = '\0';
   lang = dbg_jit_language_for_tag(s, tmp, &name);
   (void)name;
   if (lang == KIT_LANG_COUNT) {
     dbg_errf(s, "unsupported language: %.*s",
                 KIT_SLICE_ARG(kit_slice_cstr(tmp)));
     return;
   }
   s->default_jit_lang = lang;
   s->default_jit_name = dbg_jit_default_name(
       s->compiler, lang, s->default_jit_name_buf, sizeof s->default_jit_name_buf);
   driver_printf(
       "Language: %.*s\n",
       KIT_SLICE_ARG(kit_slice_cstr(dbg_jit_language_name(s->compiler, lang))));
 }
 
 static size_t dbg_u64_dec(char* dst, size_t cap, uint64_t v) {
   char tmp[32];
   size_t n = 0;
   size_t i;
   if (!dst || cap == 0) return 0;
   if (v == 0) {
     if (cap < 2u) return 0;
     dst[0] = '0';
     dst[1] = '\0';
     return 1;
   }
   while (v && n < sizeof(tmp)) {
     tmp[n++] = (char)('0' + (v % 10u));
     v /= 10u;
   }
   if (n + 1u > cap) return 0;
   for (i = 0; i < n; ++i) dst[i] = tmp[n - 1u - i];
   dst[n] = '\0';
   return n;
 }
 
 static int dbg_call_u64_entry(DbgState* s, void* entry, const uint64_t* args,
                               uint32_t nargs, uint64_t* ret_out) {
   uint64_t ret = 0;
   KitStopInfo stop;
 
   if (driver_install_sigint(dbg_on_sigint, s) != 0) {
     dbg_errf(s, "failed to install SIGINT handler");
     return 1;
   }
   if (kit_jit_session_call_u64(s->session, entry, args, nargs, &ret, &stop) !=
       KIT_OK) {
     driver_restore_sigint();
     dbg_errf(s, "call failed (debuggee must be idle or exited)");
     return 1;
   }
   driver_restore_sigint();
   s->last_stop = stop;
   s->has_stop = (stop.kind != KIT_STOP_EXIT);
   if (ret_out) *ret_out = ret;
   if (stop.kind != KIT_STOP_EXIT) {
     s->has_stop = 1;
     dbg_render_stop(s, &stop);
     return 2;
   }
   return 0;
 }
 
 static void dbg_cmd_expr(DbgState* s, const char* expr) {
   char* body = NULL;
   size_t body_len = 0, body_cap = 0;
   char num[32];
   char name[64];
   size_t num_len;
   size_t prefix_len;
   void* entry;
   uint64_t ret = 0;
   uint64_t attempt;
   uint64_t id;
   int is_block = 0;
 
   while (*expr && dbg_isspace((unsigned char)*expr)) ++expr;
   if (!*expr) {
     dbg_errf(s, "usage: expr EXPR | expr { STATEMENTS }");
     return;
   }
 
   if (*expr == '{') {
     const char* p = expr + 1;
     int depth = 1 + dbg_brace_delta(p);
     const char* end = p + driver_strlen(p);
     is_block = 1;
     if (depth <= 0) {
       while (end > p && end[-1] != '}') --end;
       if (end > p) --end;
     }
     if (dbg_buf_append(s, &body, &body_len, &body_cap, p, (size_t)(end - p)) !=
         0)
       goto oom;
     if (dbg_buf_append(s, &body, &body_len, &body_cap, "\n", 1) != 0) goto oom;
     while (depth > 0) {
       char line[LINE_CAP];
       int n;
       driver_printf("expr > ");
       driver_flush_stdout();
       n = driver_read_line(line, sizeof(line));
       if (n <= 0) {
         dbg_errf(s, "unterminated expr block");
         goto out;
       }
       depth += dbg_brace_delta(line);
       if (depth <= 0) {
         char* close = line;
         while (*close && *close != '}') ++close;
         if (dbg_buf_append(s, &body, &body_len, &body_cap, line,
                            (size_t)(close - line)) != 0)
           goto oom;
         if (dbg_buf_append(s, &body, &body_len, &body_cap, "\n", 1) != 0)
           goto oom;
         break;
       }
       if (dbg_buf_append(s, &body, &body_len, &body_cap, line,
                          driver_strlen(line)) != 0)
         goto oom;
       if (dbg_buf_append(s, &body, &body_len, &body_cap, "\n", 1) != 0)
         goto oom;
     }
   }
 
   /* The thunk symbol name uses a monotonic per-attempt counter so each
    * compiled thunk gets a unique linkage name even across failed attempts.
    * The user-visible result number ($N) is a separate counter advanced only
    * after a full success (compile + publish + call), so a failed snippet does
    * not consume a result number. */
   attempt = ++s->expr_attempt;
   num_len = dbg_u64_dec(num, sizeof(num), attempt);
   if (!num_len) {
     dbg_errf(s, "expression counter overflow");
     goto out;
   }
   prefix_len = driver_strlen("__kit_dbg_expr_");
   if (prefix_len + num_len + 1u > sizeof(name)) {
     dbg_errf(s, "expression symbol too long");
     goto out;
   }
   driver_memcpy(name, "__kit_dbg_expr_", prefix_len);
   driver_memcpy(name + prefix_len, num, num_len + 1u);
 
   {
     const char* src = is_block ? body : expr;
     size_t len = is_block ? body_len : driver_strlen(expr);
     KitFrontendInputKind kind =
         is_block ? KIT_FRONTEND_INPUT_REPL_BLOCK : KIT_FRONTEND_INPUT_REPL_EXPR;
     /* s->default_jit_name mirrors dbg_jit_default_name(s->default_jit_lang),
      * kept in sync wherever default_jit_lang is set. */
     if (dbg_jit_compile_append_ex(s, s->default_jit_lang, s->default_jit_name,
                                   src, len, kind, name) != 0) {
       goto out;
     }
   }
 
   entry = kit_jit_lookup(s->jit, kit_slice_cstr(name));
   if (!entry) {
     dbg_errf(s, "expression thunk not found: %.*s",
                 KIT_SLICE_ARG(kit_slice_cstr(name)));
     goto out;
   }
   if (dbg_call_u64_entry(s, entry, NULL, 0, &ret) == 0) {
     id = ++s->expr_counter;
     driver_printf("$%llu = %llu (0x%llx)\n", (unsigned long long)id,
                   (unsigned long long)ret, (unsigned long long)ret);
   }
   goto out;
 
 oom:
   dbg_errf(s, "out of memory");
 out:
   if (body) driver_free(s->env, body, body_cap);
 }
 
 /* ============================================================
  * `x ADDR [count]`
  * ============================================================
  * Examine memory: reads `count` bytes (default 16) at `addr` from the
  * worker's address space and prints them as 16-byte rows. */
 
 static void dbg_cmd_examine(DbgState* s, uint64_t addr, size_t count) {
   uint8_t buf[256];
   size_t remaining = count;
 
   if (!s->has_stop) {
     dbg_errf(s, "no program is stopped");
     return;
   }
 
   while (remaining) {
     size_t chunk = remaining > sizeof(buf) ? sizeof(buf) : remaining;
     size_t i;
     if (kit_jit_session_read_mem(s->session, addr, buf, chunk) != KIT_OK) {
       dbg_errf(s, "read failed at 0x%llx", (unsigned long long)addr);
       return;
     }
     for (i = 0; i < chunk; i += 16) {
       size_t j;
       size_t row = chunk - i < 16 ? chunk - i : 16;
       driver_printf("0x%llx:", (unsigned long long)(addr + i));
       for (j = 0; j < row; ++j) driver_printf(" %02x", buf[i + j]);
       driver_printf("\n");
     }
     addr += chunk;
     remaining -= chunk;
   }
 }
 
 /* ============================================================
  * `disasm [ADDR] [count]`, `x/i [ADDR] [count]`
  * ============================================================
  * Decode a small instruction window from the stopped program. Without an
  * address, starts at the stopped PC; count is in instructions. */
 
 static void dbg_cmd_disasm(DbgState* s, uint64_t addr, size_t count) {
   uint8_t buf[512];
   KitDisasmContext dctx;
   KitDisasmIter* it = NULL;
   size_t byte_count;
   size_t shown = 0;
 
   if (!s->has_stop) {
     dbg_errf(s, "no program is stopped");
     return;
   }
   if (count == 0) count = 8;
   if (count > 32) {
     dbg_errf(s, "disasm count too large");
     return;
   }
   byte_count = count * 16u;
   if (byte_count > sizeof(buf)) byte_count = sizeof(buf);
   if (kit_jit_session_read_mem(s->session, addr, buf, byte_count) != KIT_OK) {
     dbg_errf(s, "read failed at 0x%llx", (unsigned long long)addr);
     return;
   }
 
   memset(&dctx, 0, sizeof(dctx));
   dctx.target = kit_compiler_target(s->compiler);
   dctx.context = s->ctx;
   if (kit_disasm_iter_new(&dctx, buf, byte_count, addr, s->view, &it) !=
       KIT_OK) {
     dbg_errf(s, "disassembler unavailable");
     return;
   }
   while (shown < count) {
     KitInsn insn;
     KitIterResult r = kit_disasm_iter_next(it, &insn);
     if (r == KIT_ITER_END) break;
     if (r != KIT_ITER_ITEM) {
       dbg_errf(s, "disassembly failed");
       break;
     }
     driver_printf("0x%llx: %-8.*s", (unsigned long long)insn.vaddr,
                   KIT_SLICE_ARG(insn.mnemonic));
     if (insn.operands.len) driver_printf(" %.*s", KIT_SLICE_ARG(insn.operands));
     if (insn.annotation.len)
       driver_printf(" %.*s", KIT_SLICE_ARG(insn.annotation));
     driver_printf("\n");
     shown++;
   }
   kit_disasm_iter_free(it);
 }
 
 /* ============================================================
  * Source listing
  * ============================================================
  * Print a context window of source lines centered on `file:line`.
  *
  * Reads REPL snippets from the debugger's in-memory source cache and normal
  * files from disk via env.file_io.  When neither is available (e.g. the DWARF
  * came from a `.o` / `.a` whose source isn't available here), command-mode
  * reports the DWARF line number alone and source stops silently keep the
  * already-rendered location line. */
 
 static void dbg_print_source_bytes(const uint8_t* data, size_t size,
                                    uint32_t line, int report_errors) {
   static const uint8_t empty[1] = {0};
   uint32_t target = line;
   uint32_t lo = target > DBG_LIST_CTX ? target - DBG_LIST_CTX : 1;
   uint32_t hi = target + DBG_LIST_CTX;
   uint32_t cur = 1;
   const uint8_t* p;
   const uint8_t* end;
   const uint8_t* line_start;
 
   if (!data && size != 0) return;
   if (!data) data = empty;
   p = data;
   end = data + size;
   line_start = p;
 
   while (p <= end) {
     int eol = (p == end) || (*p == '\n');
     if (eol) {
       if (p == end && p == line_start && end > data && end[-1] == '\n') break;
       if (cur >= lo && cur <= hi) {
         size_t len = (size_t)(p - line_start);
         driver_printf(
             "%6u%.*s %.*s\n", cur,
             KIT_SLICE_ARG(kit_slice_cstr(cur == target ? " >" : "  ")),
             (int)len, (const char*)line_start);
       }
       ++cur;
       if (p == end) break;
       line_start = p + 1;
     }
     ++p;
   }
   if (report_errors && cur <= target)
     driver_errf(DBG_TOOL, "file has only %u lines; %u requested", cur - 1u,
                 target);
 }
 
 static void dbg_print_source_listing(DbgState* s, KitSlice file, uint32_t line,
                                      uint64_t pc, int report_errors) {
   char path[1024];
   KitFileData fd;
   const KitFileIO* io;
   DbgSource* cached;
 
   if (!file.s || file.len == 0) {
     if (report_errors) {
       dbg_errf(s, "bad file in '%.*s'", KIT_SLICE_ARG(file));
     }
     return;
   }
 
   cached = dbg_source_find(s, file);
   if (cached && cached->data) {
     dbg_print_source_bytes(cached->data, cached->len, line, report_errors);
     return;
   }
 
   if (file.len >= sizeof(path)) {
     if (report_errors) {
       dbg_errf(s, "bad file in '%.*s'", KIT_SLICE_ARG(file));
     }
     return;
   }
   driver_memcpy(path, file.s, file.len);
   path[file.len] = '\0';
 
   /* Try to read the file via file_io.  On miss, fall back to the
    * DWARF-only summary line per doc/DBG.md §10. */
   io = s->env && s->env->file_io.read_all ? &s->env->file_io : NULL;
   if (!io || io->read_all(io->user, path, &fd) != KIT_OK) {
     if (report_errors) {
       driver_printf("%.*s:%u  [source not available; pc=0x%llx]\n",
                     KIT_SLICE_ARG(kit_slice_cstr(path)), line,
                     (unsigned long long)pc);
     }
     return;
   }
 
   dbg_print_source_bytes(fd.data, fd.size, line, report_errors);
 
   if (io->release) io->release(io->user, &fd);
 }
 
 static void dbg_cmd_list(DbgState* s, const char* spec) {
   const char* colon;
   size_t flen;
   char path[1024];
   uint64_t line_u;
   size_t used;
   uint64_t pc;
   KitSlice file;
 
   if (!s->dwarf) {
     dbg_errf(s, "no DWARF: cannot resolve %.*s",
                 KIT_SLICE_ARG(kit_slice_cstr(spec)));
     return;
   }
 
   colon = driver_strchr(spec, ':');
   if (!colon || !dbg_isdigit((unsigned char)colon[1])) {
     dbg_errf(s, "usage: list file:line");
     return;
   }
   flen = (size_t)(colon - spec);
   if (flen == 0 || flen >= sizeof(path)) {
     dbg_errf(s, "bad file in '%.*s'",
                 KIT_SLICE_ARG(kit_slice_cstr(spec)));
     return;
   }
   driver_memcpy(path, spec, flen);
   path[flen] = '\0';
   used = dbg_parse_uint(colon + 1, &line_u);
   if (!used || colon[1 + used] != '\0') {
     dbg_errf(s, "usage: list file:line");
     return;
   }
 
   /* Validate via DWARF first. */
   {
     KitStatus st = kit_dwarf_line_to_addr(s->dwarf, kit_slice_cstr(path),
                                           (uint32_t)line_u, &pc);
     if (st == KIT_NOT_FOUND) {
       dbg_errf(s, "no line %u in %.*s", (uint32_t)line_u,
                   KIT_SLICE_ARG(kit_slice_cstr(path)));
       return;
     }
     if (st == KIT_AMBIGUOUS) {
       dbg_errf(s,
                   "ambiguous: %.*s:%u matches multiple files; "
                   "use a longer path suffix",
                   KIT_SLICE_ARG(kit_slice_cstr(path)), (uint32_t)line_u);
       return;
     }
     if (st != KIT_OK) {
       dbg_errf(s, "no line entry for %.*s",
                   KIT_SLICE_ARG(kit_slice_cstr(spec)));
       return;
     }
   }
 
   file = kit_slice_cstr(path);
   dbg_print_source_listing(s, file, (uint32_t)line_u, pc, 1);
 }
 
 /* ============================================================
  * `info b`, `b LOC`, `d N`, `enable N` / `disable N`, `ignore N COUNT`
  * ============================================================ */
 
 /* Arm a Bp through the appropriate session entry. The plain breakpoint_set
  * is used when no skip/cap is in effect; otherwise the spec form. The
  * driver does not yet wire conditions, but the spec callback slot is left
  * NULL so this remains forward-compatible. */
 static int dbg_bp_arm(DbgState* s, Bp* b) {
   KitStatus st;
   if (b->skip_count == 0 && b->max_hits == 0) {
     st = kit_jit_session_breakpoint_set(s->session, b->addr, &b->session_id);
   } else {
     KitBreakpointSpec spec;
     KitBreakpointSpec z = {0};
     spec = z;
     spec.addr = b->addr;
     spec.skip_count = b->skip_count;
     spec.max_hits = b->max_hits;
     st = kit_jit_session_breakpoint_set_spec(s->session, &spec, &b->session_id);
   }
   return st == KIT_OK ? 0 : 1;
 }
 
 static void dbg_cmd_break(DbgState* s, const char* spec) {
   BpKind kind;
   uint64_t addr;
   Bp* b;
 
   if (!*spec) {
     dbg_errf(s, "usage: b <0xADDR | sym[+off] | file.c:line>");
     return;
   }
   if (dbg_resolve_loc(s, spec, &kind, &addr) != 0) return;
 
   b = dbg_bp_grow(s);
   if (!b) return;
 
   {
     Bp z = {0};
     *b = z;
   }
   b->id = ++s->next_bp_id;
   b->enabled = 1;
   b->kind = kind;
   b->addr = addr;
   b->spec = dbg_dup(s->env, spec, driver_strlen(spec), &b->spec_size);
   if (!b->spec) {
     dbg_errf(s, "out of memory");
     return;
   }
 
   if (dbg_bp_arm(s, b) != 0) {
     dbg_errf(s, "failed to arm breakpoint at 0x%llx",
                 (unsigned long long)addr);
     b->session_id = 0;
     b->enabled = 0;
   }
 
   s->nbps++;
   driver_printf(
       "Breakpoint %d at 0x%llx (%.*s)%.*s\n", b->id, (unsigned long long)addr,
       KIT_SLICE_ARG(kit_slice_cstr(spec)),
       KIT_SLICE_ARG(kit_slice_cstr(b->session_id ? "" : " [disarmed]")));
 }
 
 static void dbg_cmd_info_b(DbgState* s) {
   uint32_t i;
   if (s->nbps == 0) {
     driver_printf("No breakpoints.\n");
     return;
   }
   driver_printf("Num  Enb  Address              Skip   Max    Spec\n");
   for (i = 0; i < s->nbps; ++i) {
     Bp* b = &s->bps[i];
     driver_printf(
         "%-4d %-4s 0x%-18llx %-6llu %-6llu %.*s%.*s\n", b->id,
         b->enabled ? "y" : "n", (unsigned long long)b->addr,
         (unsigned long long)b->skip_count, (unsigned long long)b->max_hits,
         KIT_SLICE_ARG(kit_slice_cstr(b->spec)),
         KIT_SLICE_ARG(kit_slice_cstr(b->session_id ? "" : " [disarmed]")));
   }
 }
 
 static void dbg_cmd_ignore(DbgState* s, int id, uint64_t count) {
   Bp* b = dbg_bp_find(s, id);
   if (!b) {
     dbg_errf(s, "no breakpoint %d", id);
     return;
   }
   if (b->session_id) {
     kit_jit_session_breakpoint_clear(s->session, b->session_id);
     b->session_id = 0;
   }
   b->skip_count = count;
   if (b->enabled) {
     if (dbg_bp_arm(s, b) != 0) {
       dbg_errf(s, "failed to re-arm breakpoint %d", id);
       return;
     }
   }
   driver_printf("Breakpoint %d will skip the next %llu hits\n", id,
                 (unsigned long long)count);
 }
 
 static void dbg_cmd_delete(DbgState* s, int id) {
   if (dbg_bp_remove(s, id) != 0) {
     dbg_errf(s, "no breakpoint %d", id);
   }
 }
 
 static void dbg_cmd_set_enabled(DbgState* s, int id, int enable) {
   Bp* b = dbg_bp_find(s, id);
   if (!b) {
     dbg_errf(s, "no breakpoint %d", id);
     return;
   }
   if (enable && !b->enabled) {
     if (dbg_bp_arm(s, b) != 0) {
       dbg_errf(s, "failed to re-arm breakpoint %d", id);
       return;
     }
     b->enabled = 1;
   } else if (!enable && b->enabled) {
     if (b->session_id) {
       kit_jit_session_breakpoint_clear(s->session, b->session_id);
       b->session_id = 0;
     }
     b->enabled = 0;
   }
 }
 
 /* ============================================================
  * Help
  * ============================================================ */
 
 static void dbg_cmd_help(void) {
   driver_printf(
       "%.*s",
       KIT_SLICE_ARG(KIT_SLICE_LIT(
           "Commands (abbrev. shown):\n"
           "  h, help                     show this help\n"
           "  q, quit                     exit (Ctrl-D also works)\n"
           "  :language c|toy|asm|wasm/wat\n"
           "                              select language for jit/expr input\n"
           "  r, run                      start fresh execution at entry\n"
           "  c, cont                     continue after a stop\n"
           "  s, step                     step to next source line (into "
           "calls)\n"
           "  si, stepi                   single-step one instruction\n"
           "  n, next                     step to next source line (over "
           "calls)\n"
           "  finish                      run until current frame returns\n"
           "  jit [LANG|NAME] { ... }     compile and append a language "
           "snippet\n"
           "  { ... }                     same as jit { ... }\n"
           "  edit [LANG|NAME], e [...]   edit and append a language snippet\n"
           "  expr EXPR | expr { ... }    compile and call an expression thunk\n"
           "  EXPR                        same as expr EXPR\n"
           "                              LANG defaults to the selected "
           "language\n"
           "  jump ADDR                   set PC to ADDR (no resume)\n"
           "  bt, backtrace               print stack trace with arguments\n"
           "  b LOC                       set breakpoint at LOC:\n"
           "                                 0xADDR | sym[+off] | file.c:line\n"
           "  ignore N COUNT              skip the next COUNT hits of bp N\n"
           "  d N, delete N               delete breakpoint N\n"
           "  enable N | disable N        toggle breakpoint N\n"
           "  p NAME                      print variable / global\n"
           "  set NAME VALUE              write VALUE into NAME\n"
           "  x ADDR [count]              examine memory (count bytes, default "
           "16)\n"
           "  disasm [ADDR] [count], x/i  disassemble at PC or ADDR\n"
           "  list FILE:LINE, l FILE:LINE source listing around FILE:LINE\n"
           "  info b                      list breakpoints\n"
           "  info reg, info registers    dump registers\n"
           "  info locals                 list locals at current PC\n"
           "  info args                   list args at current PC\n"
           "  info functions [PATTERN]    list JIT functions matching PATTERN\n"
           "  info variables [PATTERN]    list JIT globals  matching "
           "PATTERN\n")));
 }
 
 static KitLanguage dbg_default_language_from_inputs(KitCompiler* c,
                                                     const DbgOpts* o) {
   if (o->has_default_lang) return o->default_lang;
   if (o->inputs.nsources) return kit_language_for_path(c, o->inputs.sources[0]);
   if (o->inputs.nsource_memory) return o->inputs.source_memory[0].lang;
   return KIT_LANG_C;
 }
 
 /* ============================================================
  * Tokenizer / dispatch
  * ============================================================ */
 
 /* Trim leading whitespace and split off one whitespace-delimited word.
  * Returns the start of the next region (i.e. the rest of the line, with
  * its own leading whitespace skipped). The input buffer is mutated:
  * the byte after the first word is replaced with a NUL. */
 static char* dbg_take_word(char* line, char** word_out) {
   char* p = line;
   char* w;
   while (*p && dbg_isspace((unsigned char)*p)) ++p;
   if (!*p) {
     *word_out = p;
     return p;
   }
   w = p;
   while (*p && !dbg_isspace((unsigned char)*p)) ++p;
   if (*p) {
     *p = '\0';
     ++p;
   }
   while (*p && dbg_isspace((unsigned char)*p)) ++p;
   *word_out = w;
   return p;
 }
 
 static int dbg_dispatch(DbgState* s, char* line) {
   char raw[LINE_CAP];
   size_t raw_len = driver_strlen(line);
   char* cmd;
   char* rest;
 
   if (raw_len >= sizeof(raw)) raw_len = sizeof(raw) - 1u;
   driver_memcpy(raw, line, raw_len);
   raw[raw_len] = '\0';
 
   rest = dbg_take_word(line, &cmd);
 
   if (!*cmd) return 0; /* blank line */
 
   if (driver_streq(cmd, "h") || driver_streq(cmd, "help")) {
     dbg_cmd_help();
     return 0;
   }
   if (driver_streq(cmd, ":language") || driver_streq(cmd, ":lang") ||
       driver_streq(cmd, "language")) {
     dbg_cmd_language(s, rest);
     return 0;
   }
   if (driver_streq(cmd, "q") || driver_streq(cmd, "quit") ||
       driver_streq(cmd, "exit")) {
     return 1; /* signal "exit REPL" */
   }
   if (driver_streq(cmd, "r") || driver_streq(cmd, "run")) {
     dbg_drive(s, RUN_FRESH);
     return 0;
   }
   if (driver_streq(cmd, "abort")) {
     if (s->has_stop && s->session) {
       kit_jit_session_resume(s->session, KIT_RESUME_ABORT, NULL);
       s->has_stop = 0;
       dbg_errf(s, "execution aborted");
     } else {
       dbg_errf(s, "nothing to abort");
     }
     return 0;
   }
   if (driver_streq(cmd, "c") || driver_streq(cmd, "cont") ||
       driver_streq(cmd, "continue")) {
     dbg_drive(s, RUN_CONTINUE);
     return 0;
   }
   if (driver_streq(cmd, "s") || driver_streq(cmd, "step")) {
     dbg_drive(s, RUN_STEP_LINE);
     return 0;
   }
   if (driver_streq(cmd, "si") || driver_streq(cmd, "stepi")) {
     dbg_drive(s, RUN_STEP_INSN);
     return 0;
   }
   if (driver_streq(cmd, "n") || driver_streq(cmd, "next")) {
     dbg_drive(s, RUN_NEXT_LINE);
     return 0;
   }
   if (driver_streq(cmd, "finish")) {
     dbg_drive(s, RUN_STEP_OUT);
     return 0;
   }
   if (driver_streq(cmd, "jit")) {
     dbg_cmd_jit(s, rest);
     return 0;
   }
   if (driver_streq(cmd, "edit") || driver_streq(cmd, "e")) {
     dbg_cmd_edit(s, rest);
     return 0;
   }
   if (driver_streq(cmd, "expr")) {
     if (!s->session) {
       dbg_errf(s, "no JIT session");
       return 0;
     }
     dbg_cmd_expr(s, rest);
     return 0;
   }
   if (driver_streq(cmd, "bt") || driver_streq(cmd, "backtrace") ||
       driver_streq(cmd, "where")) {
     dbg_cmd_bt(s);
     return 0;
   }
   if (driver_streq(cmd, "b") || driver_streq(cmd, "break")) {
     char* loc;
     dbg_take_word(rest, &loc);
     dbg_cmd_break(s, loc);
     return 0;
   }
   if (driver_streq(cmd, "info")) {
     char* what;
     rest = dbg_take_word(rest, &what);
     if (driver_streq(what, "b") || driver_streq(what, "break") ||
         driver_streq(what, "breakpoints")) {
       dbg_cmd_info_b(s);
     } else if (driver_streq(what, "reg") || driver_streq(what, "registers")) {
       dbg_cmd_info_reg(s);
     } else if (driver_streq(what, "locals")) {
       dbg_cmd_info_vars(s, 1u << KIT_DVR_LOCAL, "locals");
     } else if (driver_streq(what, "args")) {
       dbg_cmd_info_vars(s, 1u << KIT_DVR_ARG, "args");
     } else if (driver_streq(what, "functions") || driver_streq(what, "func")) {
       char* pat;
       dbg_take_word(rest, &pat);
       dbg_cmd_info_syms(s, KIT_SK_FUNC, *pat ? pat : NULL);
     } else if (driver_streq(what, "variables") || driver_streq(what, "var")) {
       char* pat;
       dbg_take_word(rest, &pat);
       dbg_cmd_info_syms(s, KIT_SK_OBJ, *pat ? pat : NULL);
     } else {
       dbg_errf(s, "unknown 'info' subcommand: %.*s",
                   KIT_SLICE_ARG(kit_slice_cstr(what)));
     }
     return 0;
   }
   if (driver_streq(cmd, "set")) {
     char* name;
     char* val_s;
     uint64_t v;
     size_t used;
     rest = dbg_take_word(rest, &name);
     if (!*name) {
       dbg_errf(s, "usage: set NAME VALUE");
       return 0;
     }
     /* Accept an optional `=` between name and value: `set x = 5`. */
     if (driver_streq(name, "=")) {
       dbg_errf(s, "usage: set NAME VALUE");
       return 0;
     }
     rest = dbg_take_word(rest, &val_s);
     if (driver_streq(val_s, "=")) {
       rest = dbg_take_word(rest, &val_s);
     }
     if (!*val_s) {
       dbg_errf(s, "usage: set NAME VALUE");
       return 0;
     }
     used = dbg_parse_uint(val_s, &v);
     if (!used || val_s[used] != '\0') {
       dbg_errf(s, "expected integer value, got '%.*s'",
                   KIT_SLICE_ARG(kit_slice_cstr(val_s)));
       return 0;
     }
     dbg_cmd_set(s, name, v);
     return 0;
   }
   if (driver_streq(cmd, "jump") || driver_streq(cmd, "j")) {
     char* addr_s;
     uint64_t addr;
     size_t used;
     dbg_take_word(rest, &addr_s);
     if (!*addr_s) {
       dbg_errf(s, "usage: jump ADDR");
       return 0;
     }
     used = dbg_parse_uint(addr_s, &addr);
     if (!used || addr_s[used] != '\0') {
       dbg_errf(s, "bad address '%.*s'",
                   KIT_SLICE_ARG(kit_slice_cstr(addr_s)));
       return 0;
     }
     dbg_cmd_jump(s, addr);
     return 0;
   }
   if (driver_streq(cmd, "ignore")) {
     char* id_s;
     char* cnt_s;
     uint64_t id;
     uint64_t cnt;
     size_t used;
     rest = dbg_take_word(rest, &id_s);
     dbg_take_word(rest, &cnt_s);
     if (!*id_s || !*cnt_s) {
       dbg_errf(s, "usage: ignore N COUNT");
       return 0;
     }
     used = dbg_parse_uint(id_s, &id);
     if (!used || id_s[used] != '\0') {
       dbg_errf(s, "expected breakpoint id");
       return 0;
     }
     used = dbg_parse_uint(cnt_s, &cnt);
     if (!used || cnt_s[used] != '\0') {
       dbg_errf(s, "expected hit count");
       return 0;
     }
     dbg_cmd_ignore(s, (int)id, cnt);
     return 0;
   }
   if (driver_streq(cmd, "d") || driver_streq(cmd, "delete")) {
     char* arg;
     uint64_t id;
     size_t used;
     dbg_take_word(rest, &arg);
     if (!*arg) {
       dbg_errf(s, "usage: d <id>");
       return 0;
     }
     used = dbg_parse_uint(arg, &id);
     if (!used || arg[used] != '\0') {
       dbg_errf(s, "expected breakpoint id");
       return 0;
     }
     dbg_cmd_delete(s, (int)id);
     return 0;
   }
   if (driver_streq(cmd, "enable") || driver_streq(cmd, "disable")) {
     char* arg;
     uint64_t id;
     size_t used;
     dbg_take_word(rest, &arg);
     used = dbg_parse_uint(arg, &id);
     if (!used || arg[used] != '\0') {
       dbg_errf(s, "expected breakpoint id");
       return 0;
     }
     dbg_cmd_set_enabled(s, (int)id, driver_streq(cmd, "enable"));
     return 0;
   }
   if (driver_streq(cmd, "p") || driver_streq(cmd, "print")) {
     char* name;
     dbg_take_word(rest, &name);
     if (!*name) {
       dbg_errf(s, "usage: p <name>");
       return 0;
     }
     dbg_cmd_print(s, name);
     return 0;
   }
   if (driver_streq(cmd, "list") || driver_streq(cmd, "l")) {
     char* loc;
     dbg_take_word(rest, &loc);
     if (!*loc) {
       dbg_errf(s, "usage: list file:line");
       return 0;
     }
     dbg_cmd_list(s, loc);
     return 0;
   }
   if (driver_streq(cmd, "disasm") || driver_streq(cmd, "x/i")) {
     char* addr_s;
     char* count_s;
     uint64_t addr = s->has_stop ? s->last_stop.regs.pc : 0;
     uint64_t count = 8;
     size_t used;
     rest = dbg_take_word(rest, &addr_s);
     if (*addr_s) {
       used = dbg_parse_uint(addr_s, &addr);
       if (!used || addr_s[used] != '\0') {
         dbg_errf(s, "bad address '%.*s'",
                     KIT_SLICE_ARG(kit_slice_cstr(addr_s)));
         return 0;
       }
       dbg_take_word(rest, &count_s);
       if (*count_s) {
         used = dbg_parse_uint(count_s, &count);
         if (!used || count_s[used] != '\0') {
           dbg_errf(s, "bad count '%.*s'",
                       KIT_SLICE_ARG(kit_slice_cstr(count_s)));
           return 0;
         }
       }
     }
     dbg_cmd_disasm(s, addr, (size_t)count);
     return 0;
   }
   if (driver_streq(cmd, "x") || driver_streq(cmd, "examine")) {
     char* addr_s;
     char* count_s;
     uint64_t addr;
     uint64_t count = 16;
     size_t used;
     rest = dbg_take_word(rest, &addr_s);
     if (!*addr_s) {
       dbg_errf(s, "usage: x <addr> [count]");
       return 0;
     }
     used = dbg_parse_uint(addr_s, &addr);
     if (!used || addr_s[used] != '\0') {
       dbg_errf(s, "bad address '%.*s'",
                   KIT_SLICE_ARG(kit_slice_cstr(addr_s)));
       return 0;
     }
     dbg_take_word(rest, &count_s);
     if (*count_s) {
       used = dbg_parse_uint(count_s, &count);
       if (!used || count_s[used] != '\0') {
         dbg_errf(s, "bad count '%.*s'",
                     KIT_SLICE_ARG(kit_slice_cstr(count_s)));
         return 0;
       }
     }
     dbg_cmd_examine(s, addr, (size_t)count);
     return 0;
   }
 
   if (cmd[0] == '{') {
     dbg_cmd_jit(s, raw);
     return 0;
   }
 
   if (s->session) {
     dbg_cmd_expr(s, raw);
   } else {
     dbg_errf(s, "unknown command: %.*s (try 'h')",
                 KIT_SLICE_ARG(kit_slice_cstr(cmd)));
   }
   return 0;
 }
 
 /* ============================================================
  * Completion
  * ============================================================ */
 
 static int dbg_slice_has_prefix(KitSlice s, const char* prefix,
                                 size_t prefix_len) {
   return s.len >= prefix_len && memcmp(s.s, prefix, prefix_len) == 0;
 }
 
 static int dbg_cstr_has_prefix(const char* s, const char* prefix,
                                size_t prefix_len) {
   return driver_strlen(s) >= prefix_len && memcmp(s, prefix, prefix_len) == 0;
 }
 
 static int dbg_completion_seen(DriverLineCompletionList* out, const char* text,
                                size_t len) {
   uint32_t i;
   for (i = 0; i < out->count; ++i) {
     if (driver_strlen(out->items[i].text) == len &&
         memcmp(out->items[i].text, text, len) == 0)
       return 1;
   }
   return 0;
 }
 
 static void dbg_completion_add_cstr(DriverLineCompletionList* out,
                                     const char* prefix, size_t prefix_len,
                                     const char* text) {
   size_t len = driver_strlen(text);
   if (!dbg_cstr_has_prefix(text, prefix, prefix_len)) return;
   if (dbg_completion_seen(out, text, len)) return;
   (void)driver_line_completion_add(out, text, len);
 }
 
 static void dbg_completion_add_slice(DriverLineCompletionList* out,
                                      const char* prefix, size_t prefix_len,
                                      KitSlice text) {
   if (!text.s || !dbg_slice_has_prefix(text, prefix, prefix_len)) return;
   if (dbg_completion_seen(out, text.s, text.len)) return;
   (void)driver_line_completion_add(out, text.s, text.len);
 }
 
 static void dbg_completion_add_u64(DriverLineCompletionList* out,
                                    const char* prefix, size_t prefix_len,
                                    uint64_t v) {
   char buf[32];
   size_t n = 0;
   char rev[32];
   size_t r = 0;
   if (v == 0) {
     rev[r++] = '0';
   } else {
     while (v && r < sizeof(rev)) {
       rev[r++] = (char)('0' + (v % 10u));
       v /= 10u;
     }
   }
   while (r > 0 && n + 1u < sizeof(buf)) buf[n++] = rev[--r];
   buf[n] = '\0';
   dbg_completion_add_cstr(out, prefix, prefix_len, buf);
 }
 
 static void dbg_word_bounds(const char* line, size_t cursor, size_t* start,
                             size_t* end) {
   size_t len = driver_strlen(line);
   size_t s = cursor < len ? cursor : len;
   size_t e = s;
   while (s > 0 && !dbg_isspace((unsigned char)line[s - 1])) --s;
   while (e < len && !dbg_isspace((unsigned char)line[e])) ++e;
   *start = s;
   *end = e;
 }
 
 static size_t dbg_read_word_at(const char* line, size_t start, char* out,
                                size_t cap) {
   size_t i = start;
   size_t n = 0;
   while (line[i] && dbg_isspace((unsigned char)line[i])) ++i;
   while (line[i] && !dbg_isspace((unsigned char)line[i])) {
     if (n + 1u < cap) out[n++] = line[i];
     ++i;
   }
   if (cap) out[n] = '\0';
   return n;
 }
 
 static void dbg_complete_commands(DriverLineCompletionList* out,
                                   const char* prefix, size_t prefix_len) {
   static const char* const cmds[] = {
       "help",   "quit",     "exit",      "run",     "cont",  "continue",
       "step",   "stepi",    "next",      "finish",  "jit",   "edit",
       "expr",   "bt",       "backtrace", "where",   "break", "info",
       "ignore", "delete",   "enable",    "disable", "print", "set",
       "jump",   "list",     "disasm",    "x",       "x/i",   ":language",
       ":lang",  "language", "abort",     "h",       "q",     "r",
       "c",      "s",        "si",        "n",       "b",     "d",
       "p",      "l",        "e",
   };
   size_t i;
   for (i = 0; i < sizeof(cmds) / sizeof(cmds[0]); ++i)
     dbg_completion_add_cstr(out, prefix, prefix_len, cmds[i]);
 }
 
 static void dbg_complete_info(DriverLineCompletionList* out, const char* prefix,
                               size_t prefix_len) {
   static const char* const words[] = {
       "b",    "break",     "breakpoints", "reg",       "registers", "locals",
       "args", "functions", "func",        "variables", "var",
   };
   size_t i;
   for (i = 0; i < sizeof(words) / sizeof(words[0]); ++i)
     dbg_completion_add_cstr(out, prefix, prefix_len, words[i]);
 }
 
 static void dbg_complete_languages(DriverLineCompletionList* out,
                                    const char* prefix, size_t prefix_len) {
   static const char* const langs[] = {"c", "toy", "asm", "wasm", "wat"};
   size_t i;
   for (i = 0; i < sizeof(langs) / sizeof(langs[0]); ++i)
     dbg_completion_add_cstr(out, prefix, prefix_len, langs[i]);
 }
 
 static void dbg_complete_symbols(DbgState* s, DriverLineCompletionList* out,
                                  const char* prefix, size_t prefix_len,
                                  int funcs, int objects) {
   KitJitSymIter* it = NULL;
   KitJitSym sym;
   if (!s->jit || kit_jit_sym_iter_new(s->jit, &it) != KIT_OK) return;
   for (;;) {
     KitIterResult r = kit_jit_sym_iter_next(it, &sym);
     if (r != KIT_ITER_ITEM) break;
     if ((sym.kind == KIT_SK_FUNC && funcs) ||
         (sym.kind == KIT_SK_OBJ && objects))
       dbg_completion_add_slice(out, prefix, prefix_len, sym.name);
   }
   kit_jit_sym_iter_free(it);
 }
 
 static void dbg_complete_locals(DbgState* s, DriverLineCompletionList* out,
                                 const char* prefix, size_t prefix_len) {
   KitDwarfVarIter* it = NULL;
   KitDwarfVar v;
   if (!s->has_stop || !s->dwarf) return;
   if (kit_dwarf_vars_at_new(s->dwarf, dbg_pc_rt_to_img(s, s->last_stop.regs.pc),
                             KIT_DVRM_LOCAL | KIT_DVRM_ARG, &it) != KIT_OK)
     return;
   for (;;) {
     KitIterResult r = kit_dwarf_vars_at_next(it, &v);
     if (r != KIT_ITER_ITEM) break;
     dbg_completion_add_slice(out, prefix, prefix_len, v.name);
   }
   kit_dwarf_vars_at_free(it);
 }
 
 static void dbg_complete_files(DbgState* s, DriverLineCompletionList* out,
                                const char* prefix, size_t prefix_len) {
   KitDwarfCuIter* cui = NULL;
   KitDwarfCu cu;
   if (!s->dwarf) return;
   if (kit_dwarf_cu_iter_new(s->dwarf, &cui) != KIT_OK) return;
   for (;;) {
     KitDwarfLineIter* li = NULL;
     KitDwarfLineRow row;
     KitIterResult cr = kit_dwarf_cu_iter_next(cui, &cu);
     if (cr != KIT_ITER_ITEM) break;
     if (kit_dwarf_line_iter_new(s->dwarf, cu.offset, &li) != KIT_OK) continue;
     for (;;) {
       KitSlice file = KIT_SLICE_NULL;
       KitIterResult lr = kit_dwarf_line_iter_next(li, &row);
       if (lr != KIT_ITER_ITEM) break;
       if (kit_dwarf_line_file(s->dwarf, cu.offset, row.file_index, &file) ==
           KIT_OK)
         dbg_completion_add_slice(out, prefix, prefix_len, file);
     }
     kit_dwarf_line_iter_free(li);
   }
   kit_dwarf_cu_iter_free(cui);
 }
 
 static void dbg_complete_breakpoint_ids(DbgState* s,
                                         DriverLineCompletionList* out,
                                         const char* prefix, size_t prefix_len) {
   uint32_t i;
   for (i = 0; i < s->nbps; ++i)
     dbg_completion_add_u64(out, prefix, prefix_len, (uint64_t)s->bps[i].id);
 }
 
 static void dbg_complete(void* user, const char* line, size_t cursor,
                          DriverLineCompletionList* out) {
   DbgState* s = (DbgState*)user;
   char cmd[WORD_CAP];
   char arg1[WORD_CAP];
   size_t start, end;
   size_t prefix_len;
   const char* prefix;
 
   dbg_word_bounds(line, cursor, &start, &end);
   out->replace_start = start;
   out->replace_end = end;
   prefix = line + start;
   prefix_len = cursor > start ? cursor - start : 0;
 
   dbg_read_word_at(line, 0, cmd, sizeof(cmd));
   if (start == 0 || cmd[0] == '\0') {
     dbg_complete_commands(out, prefix, prefix_len);
     return;
   }
 
   if (driver_streq(cmd, "info")) {
     dbg_read_word_at(line, start == 0 ? 0 : driver_strlen(cmd), arg1,
                      sizeof(arg1));
     if (arg1[0] == '\0' || start <= driver_strlen(cmd) + 1u) {
       dbg_complete_info(out, prefix, prefix_len);
       return;
     }
   }
 
   if (driver_streq(cmd, ":language") || driver_streq(cmd, ":lang") ||
       driver_streq(cmd, "language")) {
     dbg_complete_languages(out, prefix, prefix_len);
     return;
   }
   if (driver_streq(cmd, "jit") || driver_streq(cmd, "edit") ||
       driver_streq(cmd, "e")) {
     dbg_complete_languages(out, prefix, prefix_len);
     dbg_complete_symbols(s, out, prefix, prefix_len, 1, 0);
     return;
   }
   if (driver_streq(cmd, "b") || driver_streq(cmd, "break")) {
     dbg_complete_symbols(s, out, prefix, prefix_len, 1, 0);
     dbg_complete_files(s, out, prefix, prefix_len);
     return;
   }
   if (driver_streq(cmd, "list") || driver_streq(cmd, "l")) {
     dbg_complete_files(s, out, prefix, prefix_len);
     return;
   }
   if (driver_streq(cmd, "p") || driver_streq(cmd, "print") ||
       driver_streq(cmd, "set")) {
     dbg_complete_locals(s, out, prefix, prefix_len);
     dbg_complete_symbols(s, out, prefix, prefix_len, 0, 1);
     return;
   }
   if (driver_streq(cmd, "d") || driver_streq(cmd, "delete") ||
       driver_streq(cmd, "enable") || driver_streq(cmd, "disable") ||
       driver_streq(cmd, "ignore")) {
     dbg_complete_breakpoint_ids(s, out, prefix, prefix_len);
     return;
   }
 
   dbg_complete_locals(s, out, prefix, prefix_len);
   dbg_complete_symbols(s, out, prefix, prefix_len, 1, 1);
 }
 
 /* ============================================================
  * Script source helpers
  * ============================================================ */
 
 /* Execute a single command string as if typed at the REPL.
  * Returns 1 if the REPL should exit (quit command), 0 otherwise. */
 static int dbg_run_script_cmd(DbgState* s, const char* cmd) {
   char line[LINE_CAP];
   size_t n = driver_strlen(cmd);
   if (n >= LINE_CAP) n = LINE_CAP - 1;
   driver_memcpy(line, cmd, n);
   line[n] = '\0';
   return dbg_dispatch(s, line);
 }
 
 /* Execute debugger commands from a file, one per line.
  * Returns 1 if the REPL should exit (quit command), 0 otherwise. */
 static int dbg_run_script_file(DbgState* s, const char* path) {
   DriverLoad load = {0};
   KitSlice bytes;
   const char* p;
   const char* end;
   char line[LINE_CAP];
   if (driver_load_bytes(&s->env->file_io, DBG_TOOL, path, &load, &bytes) != 0)
     return 0; /* driver_load_bytes already emitted an error */
   p = (const char*)bytes.data;
   end = p + bytes.len;
   while (p < end) {
     const char* nl = p;
     size_t len;
     while (nl < end && *nl != '\n') nl++;
     len = (size_t)(nl - p);
     /* Strip trailing carriage return. */
     if (len > 0 && p[len - 1] == '\r') len--;
     if (len >= LINE_CAP) len = LINE_CAP - 1;
     driver_memcpy(line, p, len);
     line[len] = '\0';
     p = (nl < end) ? nl + 1 : end;
     if (dbg_dispatch(s, line)) {
       driver_release_bytes(&s->env->file_io, &load);
       return 1;
     }
   }
   driver_release_bytes(&s->env->file_io, &load);
   return 0;
 }
 
 /* ============================================================
  * REPL
  * ============================================================ */
 
 static void dbg_repl(DbgState* s) {
   char line[LINE_CAP];
   uint32_t i;
 
   if (!s->batch_mode) driver_printf("kit dbg — 'h' for help, 'q' to quit\n");
 
   /* Phase 1: drain --script / --command sources in order. */
   for (i = 0; i < s->nscript_entries; i++) {
     DbgScriptEntry* e = &s->script_entries[i];
     int quit = (e->kind == DBG_ENTRY_FILE)
                    ? dbg_run_script_file(s, e->value)
                    : dbg_run_script_cmd(s, e->value);
     if (quit) return;
   }
 
   /* Phase 2: in --batch mode, exit without falling through to stdin. */
   if (s->batch_mode) return;
 
   /* Phase 3: interactive loop. */
   for (;;) {
     int n;
     n = driver_read_line_edit(s->env, "(kit) ", line, sizeof(line),
                               &s->line_history, dbg_complete, s);
     if (n == 0) { /* EOF — Ctrl-D */
       driver_printf("\n");
       return;
     }
     if (n == -1) {
       dbg_errf(s, "stdin read error");
       return;
     }
     if (n == -2) { /* SIGINT during prompt */
       driver_printf("\n");
       continue;
     }
     if (dbg_dispatch(s, line)) return;
   }
 }
 
 /* ============================================================
  * Top-level entry
  * ============================================================ */
 
 int driver_dbg(int argc, char** argv) {
   DriverEnv env;
   DbgOpts o = {0};
   KitCompiler* compiler = NULL;
   KitTarget* target = NULL;
   KitJit* jit = NULL;
   DbgState st = {0};
   KitContext ctx;
   KitJitHost jhost;
   KitDbgHost dhost;
   int rc;
 
   if (driver_argv_wants_help(argc, argv, 1)) {
     driver_help_dbg();
     return 0;
   }
 
   driver_env_init(&env);
   o.env = &env;
 
   if (dbg_parse(argc, argv, &o) != 0) {
     dbg_options_release(&o);
     driver_env_fini(&env);
     return 2;
   }
 
   ctx = driver_env_to_context(&env);
   jhost = driver_env_to_jit_host(&env);
   dhost = driver_env_to_dbg_host(&env);
   {
     KitTargetOptions topts;
     memset(&topts, 0, sizeof topts);
     topts.spec = driver_host_target();
     if (kit_target_new(&ctx, &topts, &target) != KIT_OK ||
         driver_compiler_new(target, &ctx, &compiler) != KIT_OK) {
       driver_errf(DBG_TOOL, "failed to initialize compiler");
       kit_target_free(target);
       dbg_options_release(&o);
       driver_env_fini(&env);
       return 1;
     }
   }
 
   rc = dbg_compile_and_jit(&o, compiler, &jhost, &jit);
   if (rc != 0) {
     driver_compiler_free(compiler);
     kit_target_free(target);
     dbg_options_release(&o);
     driver_env_fini(&env);
     return rc;
   }
 
   st.env = &env;
   st.compiler = compiler;
   st.ctx = ctx;
   dbg_fill_compile_options(&o, &st.copts, &st.pp);
   st.jit = jit;
   st.default_jit_lang = dbg_default_language_from_inputs(compiler, &o);
   st.default_jit_name = dbg_jit_default_name(
       st.compiler, st.default_jit_lang, st.default_jit_name_buf,
       sizeof st.default_jit_name_buf);
   st.prog_argc = (int)o.prog_argc;
   st.prog_argv = o.prog_argv;
   st.entry_name = o.entry;
   st.script_entries = o.script_entries;
   st.nscript_entries = o.nscript_entries;
   st.batch_mode = o.batch_mode;
 
   if (driver_inputs_count(&o.inputs) != 0) {
     st.entry_addr = kit_jit_lookup(jit, kit_slice_cstr(o.entry));
     if (!st.entry_addr) {
       driver_errf(DBG_TOOL, "entry symbol not found: %.*s",
                   KIT_SLICE_ARG(kit_slice_cstr(o.entry)));
       kit_jit_free(jit);
       driver_compiler_free(compiler);
       kit_target_free(target);
       dbg_options_release(&o);
       driver_env_fini(&env);
       return 1;
     }
   }
 
   if (kit_jit_session_new(jit, &dhost, &st.session) != KIT_OK) {
     driver_errf(DBG_TOOL,
                 "JIT session not yet implemented in libkit — "
                 "REPL will start in degraded mode (commands will surface "
                 "'session implementation pending' until the lib lands)");
     st.session = NULL;
     /* Keep going so the surrounding driver path is exercised. */
   }
 
   st.view = kit_jit_view(jit);
   if (st.view) {
     if (kit_dwarf_open(&ctx, st.view, &st.dwarf) != KIT_OK) st.dwarf = NULL;
     if (st.dwarf && st.session) {
       kit_jit_session_attach_dwarf(st.session, st.dwarf);
     }
   }
 
   dbg_repl(&st);
 
   driver_line_history_fini(&env, &st.line_history);
   dbg_bps_release_all(&st);
   dbg_compile_sessions_release(&st);
   dbg_sources_release_all(&st);
   if (st.dwarf) kit_dwarf_free(st.dwarf);
   if (st.session) kit_jit_session_free(st.session);
   kit_jit_free(jit);
   driver_compiler_free(compiler);
   kit_target_free(target);
   dbg_options_release(&o);
   driver_env_fini(&env);
   return (st.batch_mode && st.error_count > 0) ? 1 : 0;
 }