kit

windows.c (79207B)

---

 /* Windows host environment. Replaces posix.c and posix_dbg.c on Win32
  * builds; common.c is reused unchanged. Built against the Win32 API with
  * MinGW-w64 in mind.
  *
  * Coverage:
  *   - file_io (CreateFileW/ReadFile/WriteFile + UTF-8 path conversion)
  *   - path helpers (GetFileAttributesExW for exists/mtime, mkdir_p via
  *     CreateDirectoryW, mark_executable is a no-op on NTFS)
  *   - stdin / read_line / edit_temp (GetTempPath + system())
  *   - monotonic time (QueryPerformanceCounter)
  *   - SIGINT shim via SetConsoleCtrlHandler
  *   - dlsym via GetProcAddress over an EnumProcessModules snapshot
  *   - execmem: dual-mapping via CreateFileMappingW + MapViewOfFile; the
  *     write alias is RW, the runtime alias is RX after a protect flip.
  *     Single-mapping fallback uses VirtualAlloc.
  *   - dbg_os: CreateThread for the worker, event objects, vectored
  *     exception handling for SEGV/ILL/BP/etc, VEH-based guarded_copy,
  *     setjmp/longjmp for call_with_catch / thread_abort, SuspendThread +
  *     GetThreadContext for the interrupt path (the interrupt's on_fault
  *     runs on the *caller* thread; natural faults run on the worker
  *     thread inside the VEH, matching POSIX semantics there).
  *
  * The W^X model on Windows mirrors the Linux/FreeBSD memfd path: a single
  * pagefile-backed file-mapping object is mapped twice -- once RW (write
  * alias) and once RX (runtime alias). The dbg code-write path translates
  * a runtime address into the corresponding write alias via the same
  * exec_dual registry the POSIX side uses (re-implemented locally with
  * SRWLock since we don't link the POSIX TUs). Single-mapping reservations
  * (no KIT_PROT_EXEC) just VirtualAlloc a single RW region.
  */
 
 #ifndef WIN32_LEAN_AND_MEAN
 #define WIN32_LEAN_AND_MEAN
 #endif
 #ifndef _WIN32_WINNT
 #define _WIN32_WINNT \
   0x0601 /* Windows 7+: SRWLock, AddVectoredExceptionHandler */
 #endif
 /* rand_s (the OS CSPRNG, used by driver_random_bytes) is declared in
  * <stdlib.h> only when _CRT_RAND_S is defined first. It must be set before any
  * include: several headers below transitively pull in <stdlib.h>, and on some
  * arches (x86_64 mingw) that happens before stdlib.h's own include, so a
  * define placed right above #include <stdlib.h> arrives too late. */
 #ifndef _CRT_RAND_S
 #define _CRT_RAND_S
 #endif
 /* windows.h must precede psapi.h/process.h: the mingw SDK headers use
  * windows.h's WINBOOL/DWORD/LPVOID etc. and do not self-include it. It sits in
  * its OWN include group (blank line below) so a formatter's per-group alphabetic
  * sort cannot reorder it after psapi.h — which would leave EnumProcesses et al.
  * as bare `WINAPI` decls that the mingw cross-build's frontend then rejects. */
 // clang-format off
 #include <windows.h>
 // clang-format on
 
 #include <fcntl.h>
 #include <io.h>
 #include <process.h>
 #include <psapi.h>
 #include <setjmp.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/stat.h>
 #include <time.h>
 #include <wchar.h>
 
 #include "env_internal.h"
 
 /* _environ comes from <stdlib.h> (mingw defines it as a macro over
  * __p__environ()); driver_environ() below uses it directly — no manual extern,
  * which would clash with the header's dllimport declaration under a strict cc. */
 
 /* Win32 dbg interrupt code: a synthetic signo handed up to on_fault. The
  * value just needs to be distinct from real exception codes; we pick a
  * small positive int so it round-trips through the int field of
  * KitDbgOs.interrupt_signo. */
 #define DBG_WIN_INTERRUPT_SIGNO 100
 
 /* ============================================================
  *   UTF-8 <-> UTF-16 path conversion
  * ============================================================ */
 
 /* Convert a UTF-8 path to a freshly-malloc'd wide string. Returns NULL on
  * empty input or allocation failure. Callers free with `free`. */
 static wchar_t* widen(const char* utf8) {
   int need;
   wchar_t* w;
   if (!utf8 || !*utf8) return NULL;
   need = MultiByteToWideChar(CP_UTF8, 0, utf8, -1, NULL, 0);
   if (need <= 0) return NULL;
   w = (wchar_t*)malloc((size_t)need * sizeof(wchar_t));
   if (!w) return NULL;
   if (MultiByteToWideChar(CP_UTF8, 0, utf8, -1, w, need) <= 0) {
     free(w);
     return NULL;
   }
   return w;
 }
 
 static char* narrow(const wchar_t* wide) {
   int need;
   char* out;
   if (!wide) return NULL;
   need = WideCharToMultiByte(CP_UTF8, 0, wide, -1, NULL, 0, NULL, NULL);
   if (need <= 0) return NULL;
   out = (char*)malloc((size_t)need);
   if (!out) return NULL;
   if (WideCharToMultiByte(CP_UTF8, 0, wide, -1, out, need, NULL, NULL) <= 0) {
     free(out);
     return NULL;
   }
   return out;
 }
 
 int driver_path_canonicalize(DriverEnv* env, const char* path, char** out,
                              size_t* out_size) {
   wchar_t* wpath;
   wchar_t* wfull;
   DWORD need;
   char* narrowed;
   char* copy;
   size_t size;
   if (!env || !path || !path[0] || !out || !out_size) return 1;
   wpath = widen(path);
   if (!wpath) return 1;
   need = GetFullPathNameW(wpath, 0, NULL, NULL);
   if (!need) {
     free(wpath);
     return 1;
   }
   wfull = (wchar_t*)malloc((size_t)need * sizeof(*wfull));
   if (!wfull || GetFullPathNameW(wpath, need, wfull, NULL) == 0) {
     free(wfull);
     free(wpath);
     return 1;
   }
   free(wpath);
   narrowed = narrow(wfull);
   free(wfull);
   if (!narrowed || !driver_path_exists(narrowed)) {
     free(narrowed);
     return 1;
   }
   size = driver_strlen(narrowed) + 1u;
   copy = (char*)driver_alloc(env, size);
   if (!copy) {
     free(narrowed);
     return 1;
   }
   driver_memcpy(copy, narrowed, size);
   free(narrowed);
   *out = copy;
   *out_size = size;
   return 0;
 }
 
 /* ============================================================
  *   exec_dual registry (write/runtime alias bookkeeping)
  * ============================================================ */
 
 typedef struct ExecDualNode {
   void* write_base;
   void* runtime_base;
   size_t size;
   struct ExecDualNode* next;
 } ExecDualNode;
 
 static ExecDualNode* g_jit_dual_map;
 static SRWLOCK g_jit_dual_map_lock = SRWLOCK_INIT;
 
 static void exec_dual_register_w(void* write_base, void* runtime_base,
                                  size_t size) {
   ExecDualNode* n;
   if (write_base == runtime_base) return;
   n = (ExecDualNode*)malloc(sizeof(*n));
   if (!n) return;
   n->write_base = write_base;
   n->runtime_base = runtime_base;
   n->size = size;
   AcquireSRWLockExclusive(&g_jit_dual_map_lock);
   n->next = g_jit_dual_map;
   g_jit_dual_map = n;
   ReleaseSRWLockExclusive(&g_jit_dual_map_lock);
 }
 
 static void exec_dual_unregister_w(void* runtime_base) {
   ExecDualNode** pp;
   AcquireSRWLockExclusive(&g_jit_dual_map_lock);
   for (pp = &g_jit_dual_map; *pp; pp = &(*pp)->next) {
     if ((*pp)->runtime_base == runtime_base) {
       ExecDualNode* dead = *pp;
       *pp = dead->next;
       free(dead);
       break;
     }
   }
   ReleaseSRWLockExclusive(&g_jit_dual_map_lock);
 }
 
 static int exec_dual_lookup_w(void* runtime_addr, size_t n, void** write_out) {
   ExecDualNode* cur;
   uintptr_t a = (uintptr_t)runtime_addr;
   AcquireSRWLockShared(&g_jit_dual_map_lock);
   for (cur = g_jit_dual_map; cur; cur = cur->next) {
     uintptr_t base = (uintptr_t)cur->runtime_base;
     if (a >= base && a + n <= base + cur->size) {
       *write_out = (void*)((uintptr_t)cur->write_base + (a - base));
       ReleaseSRWLockShared(&g_jit_dual_map_lock);
       return 0;
     }
   }
   ReleaseSRWLockShared(&g_jit_dual_map_lock);
   return 1;
 }
 
 /* ============================================================
  *   exec memory: dual-map via CreateFileMappingW, single via VirtualAlloc
  * ============================================================ */
 
 typedef struct ExecMemTokenWin {
   HANDLE mapping; /* NULL for single-mapping reservations */
   void* write_addr;
   void* runtime_addr;
   size_t size;
 } ExecMemTokenWin;
 
 static DWORD kit_to_win_prot(int prot) {
   int r = (prot & KIT_PROT_READ) != 0;
   int w = (prot & KIT_PROT_WRITE) != 0;
   int x = (prot & KIT_PROT_EXEC) != 0;
   if (x && w) return PAGE_EXECUTE_READWRITE;
   if (x && r) return PAGE_EXECUTE_READ;
   if (x) return PAGE_EXECUTE;
   if (w) return PAGE_READWRITE;
   if (r) return PAGE_READONLY;
   return PAGE_NOACCESS;
 }
 
 static size_t driver_host_page_size_win(void) {
   SYSTEM_INFO si;
   GetSystemInfo(&si);
   return si.dwPageSize ? (size_t)si.dwPageSize : (size_t)0x1000;
 }
 
 static KitStatus execmem_reserve_single_win(size_t size,
                                             KitExecMemRegion* out) {
   void* p = VirtualAlloc(NULL, size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
   if (!p) return KIT_NOMEM;
   out->write = p;
   out->runtime = p;
   out->size = size;
   out->token = NULL;
   return KIT_OK;
 }
 
 static KitStatus execmem_reserve_dual_win(size_t size, KitExecMemRegion* out) {
   HANDLE map;
   void* w;
   void* r;
   ExecMemTokenWin* tok;
   DWORD lo = (DWORD)(size & 0xFFFFFFFFu);
   DWORD hi = (DWORD)((uint64_t)size >> 32);
 
   /* PAGE_EXECUTE_READWRITE on the section object is the max protection any
    * view can request; per-view protections are narrower (RW vs RX). */
   map = CreateFileMappingW(INVALID_HANDLE_VALUE, NULL, PAGE_EXECUTE_READWRITE,
                            hi, lo, NULL);
   if (!map) return KIT_ERR;
 
   w = MapViewOfFile(map, FILE_MAP_READ | FILE_MAP_WRITE, 0, 0, size);
   if (!w) {
     CloseHandle(map);
     return KIT_NOMEM;
   }
   /* Include FILE_MAP_WRITE in the runtime/exec view's mapping access. A view's
    * VirtualProtect ceiling is bounded by its map-access flags, not just the
    * section's max protection: a view mapped READ|EXECUTE can be reprotected to
    * R/RX/RO but NOT to PAGE_READWRITE (err 87). JIT images carry writable
    * runtime segments (an import GOT, .data/.bss) whose final perms are RW, so
    * the exec view must permit write to be VirtualProtect'd RW. Per-segment page
    * protection still enforces W^X (code stays RX, never writable). */
   r = MapViewOfFile(map, FILE_MAP_READ | FILE_MAP_WRITE | FILE_MAP_EXECUTE, 0,
                     0, size);
   if (!r) {
     UnmapViewOfFile(w);
     CloseHandle(map);
     return KIT_NOMEM;
   }
 
   tok = (ExecMemTokenWin*)malloc(sizeof(*tok));
   if (!tok) {
     UnmapViewOfFile(r);
     UnmapViewOfFile(w);
     CloseHandle(map);
     return KIT_NOMEM;
   }
   tok->mapping = map;
   tok->write_addr = w;
   tok->runtime_addr = r;
   tok->size = size;
 
   exec_dual_register_w(w, r, size);
 
   out->write = w;
   out->runtime = r;
   out->size = size;
   out->token = tok;
   return KIT_OK;
 }
 
 static KitStatus execmem_reserve_win(void* user, size_t size, int prot,
                                      KitExecMemRegion* out) {
   (void)user;
   if (!out || !size) return KIT_INVALID;
   if (prot & KIT_PROT_EXEC) return execmem_reserve_dual_win(size, out);
   return execmem_reserve_single_win(size, out);
 }
 
 static KitStatus execmem_protect_win(void* user, void* addr, size_t size,
                                      int prot) {
   DWORD old;
   (void)user;
   return VirtualProtect(addr, size, kit_to_win_prot(prot), &old) ? KIT_OK
                                                                  : KIT_ERR;
 }
 
 static void execmem_release_win(void* user, KitExecMemRegion* region) {
   (void)user;
   if (!region || !region->size) return;
   if (region->token) {
     ExecMemTokenWin* tok = (ExecMemTokenWin*)region->token;
     if (tok->runtime_addr && tok->runtime_addr != tok->write_addr) {
       exec_dual_unregister_w(tok->runtime_addr);
       UnmapViewOfFile(tok->runtime_addr);
     }
     if (tok->write_addr) UnmapViewOfFile(tok->write_addr);
     if (tok->mapping) CloseHandle(tok->mapping);
     free(tok);
   } else if (region->write) {
     VirtualFree(region->write, 0, MEM_RELEASE);
   }
   region->write = NULL;
   region->runtime = NULL;
   region->size = 0;
   region->token = NULL;
 }
 
 static void execmem_flush_icache_win(void* user, void* addr, size_t size) {
   (void)user;
   FlushInstructionCache(GetCurrentProcess(), addr, size);
 }
 
 static KitExecMem g_execmem_win;
 
 /* ============================================================
  *   Writer vtables: HANDLE-backed and stdio-backed
  * ============================================================ */
 
 typedef struct DriverHandleWriter {
   KitWriter base;
   KitHeap* heap;
   HANDLE h;
   KitStatus status;
   uint64_t pos;
   wchar_t* tmp_path;
   wchar_t* final_path;
 } DriverHandleWriter;
 
 static KitStatus hw_write(KitWriter* w, const void* data, size_t n) {
   DriverHandleWriter* fw = (DriverHandleWriter*)w;
   const unsigned char* p = (const unsigned char*)data;
   if (fw->status != KIT_OK) return fw->status;
   while (n > 0) {
     DWORD chunk = n > 0x40000000u ? 0x40000000u : (DWORD)n;
     DWORD wrote = 0;
     if (!WriteFile(fw->h, p, chunk, &wrote, NULL) || wrote == 0) {
       fw->status = KIT_IO;
       return KIT_IO;
     }
     p += wrote;
     n -= wrote;
     fw->pos += wrote;
   }
   return KIT_OK;
 }
 
 static KitStatus hw_seek(KitWriter* w, uint64_t off) {
   DriverHandleWriter* fw = (DriverHandleWriter*)w;
   LARGE_INTEGER li;
   if (fw->status != KIT_OK) return fw->status;
   li.QuadPart = (LONGLONG)off;
   if (!SetFilePointerEx(fw->h, li, NULL, FILE_BEGIN)) {
     fw->status = KIT_IO;
     return KIT_IO;
   }
   fw->pos = off;
   return KIT_OK;
 }
 
 static uint64_t hw_tell(KitWriter* w) { return ((DriverHandleWriter*)w)->pos; }
 static KitStatus hw_status(KitWriter* w) {
   return ((DriverHandleWriter*)w)->status;
 }
 static void hw_close(KitWriter* w) {
   DriverHandleWriter* fw = (DriverHandleWriter*)w;
   KitStatus st = fw->status;
   if (fw->h && fw->h != INVALID_HANDLE_VALUE) {
     if (!CloseHandle(fw->h) && st == KIT_OK) st = KIT_IO;
   }
   if (fw->tmp_path) {
     if (st == KIT_OK &&
         !MoveFileExW(fw->tmp_path, fw->final_path,
                      MOVEFILE_REPLACE_EXISTING | MOVEFILE_WRITE_THROUGH)) {
       st = KIT_IO;
       fw->status = KIT_IO;
     }
     if (st != KIT_OK) DeleteFileW(fw->tmp_path);
     free(fw->tmp_path);
     free(fw->final_path);
   }
   fw->heap->free(fw->heap, fw, sizeof(*fw));
 }
 
 static KitWriter* driver_writer_handle(KitHeap* h, HANDLE fh) {
   DriverHandleWriter* fw = (DriverHandleWriter*)h->alloc(
       h, sizeof(*fw), _Alignof(DriverHandleWriter));
   if (!fw) return NULL;
   fw->base.write = hw_write;
   fw->base.seek = hw_seek;
   fw->base.tell = hw_tell;
   fw->base.status = hw_status;
   fw->base.close = hw_close;
   fw->heap = h;
   fw->h = fh;
   fw->status = KIT_OK;
   fw->pos = 0;
   fw->tmp_path = NULL;
   fw->final_path = NULL;
   return &fw->base;
 }
 
 typedef struct DriverStdioWriter {
   KitWriter base;
   KitHeap* heap;
   FILE* fp;
   KitStatus status;
 } DriverStdioWriter;
 
 static KitStatus stdio_w_write(KitWriter* w, const void* data, size_t n) {
   DriverStdioWriter* sw = (DriverStdioWriter*)w;
   if (n) {
     size_t got = fwrite(data, 1, n, sw->fp);
     if (got != n) {
       sw->status = KIT_IO;
       return KIT_IO;
     }
   }
   return KIT_OK;
 }
 static KitStatus stdio_w_seek(KitWriter* w, uint64_t off) {
   DriverStdioWriter* sw = (DriverStdioWriter*)w;
   return fseek(sw->fp, (long)off, SEEK_SET) == 0 ? KIT_OK : KIT_IO;
 }
 static uint64_t stdio_w_tell(KitWriter* w) {
   long t = ftell(((DriverStdioWriter*)w)->fp);
   return t < 0 ? 0u : (uint64_t)t;
 }
 static KitStatus stdio_w_status(KitWriter* w) {
   DriverStdioWriter* sw = (DriverStdioWriter*)w;
   if (sw->status != KIT_OK) return sw->status;
   return ferror(sw->fp) ? KIT_IO : KIT_OK;
 }
 static void stdio_w_close(KitWriter* w) {
   DriverStdioWriter* sw = (DriverStdioWriter*)w;
   fflush(sw->fp);
   sw->heap->free(sw->heap, sw, sizeof(*sw));
 }
 
 static KitWriter* driver_stdio_writer(DriverEnv* e, FILE* fp) {
   DriverStdioWriter* sw = (DriverStdioWriter*)e->heap->alloc(
       e->heap, sizeof(*sw), _Alignof(DriverStdioWriter));
   if (!sw) return NULL;
   sw->base.write = stdio_w_write;
   sw->base.seek = stdio_w_seek;
   sw->base.tell = stdio_w_tell;
   sw->base.status = stdio_w_status;
   sw->base.close = stdio_w_close;
   sw->heap = e->heap;
   sw->fp = fp;
   sw->status = KIT_OK;
   return &sw->base;
 }
 
 KitWriter* driver_stdout_writer(DriverEnv* e) {
   return driver_stdio_writer(e, stdout);
 }
 
 KitWriter* driver_stderr_writer(DriverEnv* e) {
   return driver_stdio_writer(e, stderr);
 }
 
 void driver_writer_abort(KitWriter* writer) {
   if (!writer) return;
   if (writer->close == hw_close) {
     ((DriverHandleWriter*)writer)->status = KIT_ERR;
   } else if (writer->close == stdio_w_close) {
     ((DriverStdioWriter*)writer)->status = KIT_ERR;
   }
 }
 
 const char* const* driver_environ(void) { return (const char* const*)_environ; }
 
 int driver_touch(const char* path) {
   wchar_t* wpath;
   HANDLE h;
   FILETIME ft;
   if (!path) return 1;
   wpath = widen(path);
   if (!wpath) return 1;
   h = CreateFileW(wpath, FILE_WRITE_ATTRIBUTES,
                   FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_ALWAYS,
                   FILE_ATTRIBUTE_NORMAL, NULL);
   free(wpath);
   if (h == INVALID_HANDLE_VALUE) return 1;
   GetSystemTimeAsFileTime(&ft);
   SetFileTime(h, NULL, &ft, &ft);
   CloseHandle(h);
   return 0;
 }
 
 /* ============================================================
  *   file_io (CreateFileW + ReadFile/WriteFile)
  * ============================================================ */
 
 static KitStatus win_read_all(void* user, const char* path, KitFileData* out) {
   DriverEnv* env = (DriverEnv*)user;
   wchar_t* wpath;
   HANDLE h;
   LARGE_INTEGER sz;
   size_t size;
   size_t got;
   void* buf;
 
   wpath = widen(path);
   if (!wpath) return KIT_NOT_FOUND;
   h = CreateFileW(wpath, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING,
                   FILE_ATTRIBUTE_NORMAL, NULL);
   free(wpath);
   if (h == INVALID_HANDLE_VALUE) return KIT_NOT_FOUND;
   if (!GetFileSizeEx(h, &sz)) {
     CloseHandle(h);
     return KIT_IO;
   }
   size = (size_t)sz.QuadPart;
   buf = size ? env->heap->alloc(env->heap, size, 1) : NULL;
   if (size && !buf) {
     CloseHandle(h);
     return KIT_NOMEM;
   }
   got = 0;
   while (got < size) {
     DWORD chunk =
         (size - got) > 0x40000000u ? 0x40000000u : (DWORD)(size - got);
     DWORD n = 0;
     if (!ReadFile(h, (unsigned char*)buf + got, chunk, &n, NULL) || n == 0) {
       env->heap->free(env->heap, buf, size);
       CloseHandle(h);
       return KIT_IO;
     }
     got += n;
   }
   CloseHandle(h);
   out->data = (const uint8_t*)buf;
   out->size = size;
   out->token = buf;
   return KIT_OK;
 }
 
 static void win_release(void* user, KitFileData* d) {
   DriverEnv* env = (DriverEnv*)user;
   if (d->token) env->heap->free(env->heap, d->token, d->size);
   d->data = NULL;
   d->size = 0;
   d->token = NULL;
 }
 
 static wchar_t* win_wcsdup(const wchar_t* s) {
   size_t n;
   wchar_t* out;
   if (!s) return NULL;
   n = (size_t)lstrlenW(s) + 1u;
   out = (wchar_t*)malloc(n * sizeof(*out));
   if (out) memcpy(out, s, n * sizeof(*out));
   return out;
 }
 
 static int win_ascii_eq_ci(const char* a, const char* b) {
   while (*a && *b) {
     char ca = *a++;
     char cb = *b++;
     if (ca >= 'A' && ca <= 'Z') ca = (char)(ca - 'A' + 'a');
     if (cb >= 'A' && cb <= 'Z') cb = (char)(cb - 'A' + 'a');
     if (ca != cb) return 0;
   }
   return *a == '\0' && *b == '\0';
 }
 
 static int win_special_output_path(const char* path) {
   const char* p;
   if (!path || !*path) return 0;
   for (p = path; *p; ++p) {
     if (*p == '/' || *p == '\\') return 0;
   }
   return win_ascii_eq_ci(path, "nul") || win_ascii_eq_ci(path, "nul:");
 }
 
 static wchar_t* win_output_dir_wide(const char* path) {
   const char* last = NULL;
   const char* p;
   char* dir;
   wchar_t* wdir;
   size_t n;
   for (p = path; *p; ++p) {
     if (*p == '/' || *p == '\\') last = p;
   }
   if (!last) return widen(".");
   n = (size_t)(last - path);
   if (n == 0)
     n = 1u;
   else if (n == 2u && path[1] == ':')
     n = 3u;
   dir = (char*)malloc(n + 1u);
   if (!dir) return NULL;
   memcpy(dir, path, n);
   dir[n] = '\0';
   wdir = widen(dir);
   free(dir);
   return wdir;
 }
 
 static KitStatus win_open_writer(void* user, const char* path,
                                  KitWriter** out) {
   DriverEnv* env = (DriverEnv*)user;
   wchar_t* wpath = widen(path);
   wchar_t* wdir = NULL;
   wchar_t* wtmp_dup = NULL;
   wchar_t tmp_path[MAX_PATH];
   HANDLE h;
   KitWriter* w;
   int special = win_special_output_path(path);
   if (!wpath) return KIT_IO;
   if (special) {
     h = CreateFileW(wpath, GENERIC_WRITE, FILE_SHARE_READ, NULL, CREATE_ALWAYS,
                     FILE_ATTRIBUTE_NORMAL, NULL);
   } else {
     wdir = win_output_dir_wide(path);
     if (!wdir || !GetTempFileNameW(wdir, L"kit", 0, tmp_path)) {
       free(wdir);
       free(wpath);
       return KIT_IO;
     }
     free(wdir);
     h = CreateFileW(tmp_path, GENERIC_WRITE, FILE_SHARE_READ, NULL,
                     CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
     if (h == INVALID_HANDLE_VALUE) {
       DeleteFileW(tmp_path);
       free(wpath);
       return KIT_IO;
     }
   }
   if (h == INVALID_HANDLE_VALUE) {
     free(wpath);
     return KIT_IO;
   }
   w = driver_writer_handle(env->heap, h);
   if (!w) {
     CloseHandle(h);
     if (!special) DeleteFileW(tmp_path);
     free(wpath);
     return KIT_NOMEM;
   }
   if (!special) {
     DriverHandleWriter* hw = (DriverHandleWriter*)w;
     wtmp_dup = win_wcsdup(tmp_path);
     if (!wtmp_dup) {
       kit_writer_close(w);
       DeleteFileW(tmp_path);
       free(wpath);
       return KIT_NOMEM;
     }
     hw->tmp_path = wtmp_dup;
     hw->final_path = wpath;
   } else {
     free(wpath);
   }
   *out = w;
   return KIT_OK;
 }
 
 /* ============================================================
  *   Path helpers
  * ============================================================ */
 
 int driver_path_exists(const char* path) {
   WIN32_FILE_ATTRIBUTE_DATA fad;
   wchar_t* wpath;
   BOOL ok;
   if (!path) return 0;
   wpath = widen(path);
   if (!wpath) return 0;
   ok = GetFileAttributesExW(wpath, GetFileExInfoStandard, &fad);
   free(wpath);
   return ok ? 1 : 0;
 }
 
 /* Convert a FILETIME (100-ns ticks since 1601-01-01 UTC) to ns since the
  * Unix epoch (1970-01-01 UTC). 11644473600 sec is the gap. */
 static int64_t filetime_to_unix_ns(FILETIME ft) {
   uint64_t t = ((uint64_t)ft.dwHighDateTime << 32) | (uint64_t)ft.dwLowDateTime;
   /* Subtract Win-to-Unix epoch offset in 100-ns ticks. */
   static const uint64_t EPOCH_DIFF_100NS = 116444736000000000ull;
   if (t < EPOCH_DIFF_100NS) t = EPOCH_DIFF_100NS;
   return (int64_t)((t - EPOCH_DIFF_100NS) * 100ull);
 }
 
 int driver_path_mtime_ns(const char* path, int64_t* out) {
   WIN32_FILE_ATTRIBUTE_DATA fad;
   wchar_t* wpath;
   BOOL ok;
   if (!path || !out) return 1;
   wpath = widen(path);
   if (!wpath) return 1;
   ok = GetFileAttributesExW(wpath, GetFileExInfoStandard, &fad);
   free(wpath);
   if (!ok) return 1;
   *out = filetime_to_unix_ns(fad.ftLastWriteTime);
   return 0;
 }
 
 int driver_path_stat(const char* path, uint64_t* out_size,
                      uint64_t* out_mtime_ns, uint8_t* out_filetype) {
   WIN32_FILE_ATTRIBUTE_DATA fad;
   wchar_t* wpath;
   BOOL ok;
   DWORD err;
   if (!path) return 2;
   wpath = widen(path);
   if (!wpath) return 2;
   ok = GetFileAttributesExW(wpath, GetFileExInfoStandard, &fad);
   err = ok ? 0 : GetLastError();
   free(wpath);
   if (!ok) {
     return (err == ERROR_FILE_NOT_FOUND || err == ERROR_PATH_NOT_FOUND) ? 1 : 2;
   }
   *out_mtime_ns = (uint64_t)filetime_to_unix_ns(fad.ftLastWriteTime);
   if (fad.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) {
     *out_size = 0u;
     *out_filetype = 3; /* DIRECTORY */
   } else if (fad.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) {
     *out_size = ((uint64_t)fad.nFileSizeHigh << 32) | fad.nFileSizeLow;
     *out_filetype = 7; /* SYMBOLIC_LINK */
   } else {
     *out_size = ((uint64_t)fad.nFileSizeHigh << 32) | fad.nFileSizeLow;
     *out_filetype = 4; /* REGULAR_FILE */
   }
   return 0;
 }
 
 int driver_path_lstat(const char* path, uint64_t* out_size,
                       uint8_t* out_filetype, int* out_executable) {
   uint64_t mtime = 0;
   /* GetFileAttributesExW reports a reparse point without following it, so
    * driver_path_stat is already effectively no-follow on Windows; there is no
    * POSIX-style execute bit. */
   if (out_executable) *out_executable = 0;
   return driver_path_stat(path, out_size, &mtime, out_filetype);
 }
 
 typedef struct DriverDirEntryRec {
   char* name;
   size_t name_alloc;
   uint32_t name_len;
   uint64_t ino;
   uint64_t size;
   uint64_t mtime_ns;
   uint8_t filetype;
 } DriverDirEntryRec;
 
 struct DriverDirHandle {
   DriverEnv* env;
   DriverDirEntryRec* entries;
   size_t entries_alloc;
   uint64_t count;
 };
 
 DriverDirHandle* driver_open_dir(DriverEnv* env, const char* path) {
   char* pattern;
   wchar_t* wpattern;
   WIN32_FIND_DATAW fd;
   HANDLE h;
   DWORD last;
   DriverDirHandle* dh;
   uint64_t cap = 0;
   uint64_t count = 0;
 
   if (!env || !path) return NULL;
   pattern = driver_path_join(env, path, "*", NULL);
   if (!pattern) return NULL;
   wpattern = widen(pattern);
   driver_free(env, pattern, kit_slice_cstr(pattern).len + 1u);
   if (!wpattern) return NULL;
 
   h = FindFirstFileW(wpattern, &fd);
   free(wpattern);
   if (h == INVALID_HANDLE_VALUE) return NULL;
 
   dh = (DriverDirHandle*)env->heap->alloc(env->heap, sizeof(*dh),
                                           _Alignof(DriverDirHandle));
   if (!dh) {
     FindClose(h);
     return NULL;
   }
   memset(dh, 0, sizeof(*dh));
   dh->env = env;
 
   for (;;) {
     char* name;
     size_t name_len;
     DriverDirEntryRec* e;
 
     name = narrow(fd.cFileName);
     if (!name) goto fail;
     if (driver_streq(name, ".") || driver_streq(name, "..")) {
       free(name);
       goto loop_next;
     }
 
     name_len = kit_slice_cstr(name).len;
 
     /* grow entry array */
     if (count >= cap) {
       uint64_t new_cap = cap ? cap * 2u : 8u;
       size_t new_alloc = (size_t)new_cap * sizeof(DriverDirEntryRec);
       DriverDirEntryRec* nv = (DriverDirEntryRec*)env->heap->alloc(
           env->heap, new_alloc, _Alignof(DriverDirEntryRec));
       if (!nv) {
         free(name);
         goto fail;
       }
       if (dh->entries) {
         memcpy(nv, dh->entries, (size_t)count * sizeof(DriverDirEntryRec));
         env->heap->free(env->heap, dh->entries, dh->entries_alloc);
       }
       dh->entries = nv;
       dh->entries_alloc = new_alloc;
       cap = new_cap;
     }
 
     e = &dh->entries[count];
     memset(e, 0, sizeof(*e));
     e->name_alloc = name_len + 1u;
     e->name = (char*)env->heap->alloc(env->heap, e->name_alloc, 1u);
     if (!e->name) {
       free(name);
       goto fail;
     }
     memcpy(e->name, name, name_len + 1u);
     e->name_len = (uint32_t)name_len;
     free(name);
 
     e->size = ((uint64_t)fd.nFileSizeHigh << 32) | fd.nFileSizeLow;
     e->mtime_ns = (uint64_t)filetime_to_unix_ns(fd.ftLastWriteTime);
     if (fd.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY)
       e->filetype = 3;
     else if (fd.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)
       e->filetype = 7;
     else
       e->filetype = 4;
     ++count;
 
   loop_next:
     if (!FindNextFileW(h, &fd)) {
       last = GetLastError();
       if (last == ERROR_NO_MORE_FILES) break;
       goto fail;
     }
   }
 
   FindClose(h);
   dh->count = count;
   return dh;
 
 fail:
   FindClose(h);
   driver_close_dir(env, dh);
   return NULL;
 }
 
 int driver_read_dir_entry(DriverDirHandle* h, uint64_t index,
                           const char** out_name, uint32_t* out_name_len,
                           uint64_t* out_ino, uint64_t* out_size,
                           uint64_t* out_mtime_ns, uint8_t* out_filetype) {
   DriverDirEntryRec* e;
   if (!h || index >= h->count) return 1;
   e = &h->entries[index];
   *out_name = e->name;
   *out_name_len = e->name_len;
   *out_ino = e->ino;
   *out_size = e->size;
   *out_mtime_ns = e->mtime_ns;
   *out_filetype = e->filetype;
   return 0;
 }
 
 void driver_close_dir(DriverEnv* env, DriverDirHandle* h) {
   uint64_t i;
   if (!h) return;
   if (!env) env = h->env;
   for (i = 0; i < h->count; ++i) {
     DriverDirEntryRec* e = &h->entries[i];
     if (e->name) env->heap->free(env->heap, e->name, e->name_alloc);
   }
   if (h->entries) env->heap->free(env->heap, h->entries, h->entries_alloc);
   env->heap->free(env->heap, h, sizeof(*h));
 }
 
 int driver_mkdir_p(DriverEnv* env, const char* path) {
   size_t len;
   char* buf;
   size_t i;
   if (!path || !path[0]) return 1;
   len = kit_slice_cstr(path).len;
   buf = (char*)driver_alloc(env, len + 1);
   if (!buf) return 1;
   memcpy(buf, path, len + 1);
 
   /* Walk separators, accepting both '/' and '\\'. Skip the drive prefix
    * ("C:") and the leading separator(s) of a UNC path so we don't try to
    * CreateDirectory("\\\\server"). */
   for (i = 0; i <= len; ++i) {
     int at_end = (i == len);
     char ch = buf[i];
     int is_sep = (ch == '/' || ch == '\\');
     int do_create = at_end || is_sep;
     if (!do_create) continue;
     if (!at_end) buf[i] = '\0';
     /* Skip pure roots: "", ".", drive-letter-only ("C:"), and UNC roots
      * ("\\\\server" or "\\\\server\\share"). */
     if (buf[0] == '\0') {
       /* nothing yet */
     } else if (driver_streq(buf, ".")) {
       /* skip */
     } else if (i >= 2 && buf[1] == ':' && buf[2] == '\0') {
       /* "C:" — drive prefix only */
     } else {
       wchar_t* wpath = widen(buf);
       if (!wpath) {
         driver_free(env, buf, len + 1);
         return 1;
       }
       if (!CreateDirectoryW(wpath, NULL)) {
         DWORD err = GetLastError();
         if (err != ERROR_ALREADY_EXISTS) {
           free(wpath);
           driver_free(env, buf, len + 1);
           return 1;
         }
       }
       {
         WIN32_FILE_ATTRIBUTE_DATA fad;
         BOOL ok = GetFileAttributesExW(wpath, GetFileExInfoStandard, &fad);
         free(wpath);
         if (!ok || !(fad.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY)) {
           driver_free(env, buf, len + 1);
           return 1;
         }
       }
     }
     if (!at_end) buf[i] = ch;
   }
 
   driver_free(env, buf, len + 1);
   return 0;
 }
 
 int driver_mark_executable_output(const char* path) {
   /* Windows has no Unix +x bit; file extension governs executability and
    * NTFS ACLs are inherited from the parent directory. No-op success. */
   (void)path;
   return 0;
 }
 
 int driver_path_mode_get(const char* path, uint32_t* mode_out) {
   if (!path || !mode_out || !driver_path_exists(path)) return 1;
   *mode_out = 0;
   return 0;
 }
 
 int driver_path_mode_set(const char* path, uint32_t mode) {
   (void)mode;
   return path && driver_path_exists(path) ? 0 : 1;
 }
 
 /* ---------------- self executable path ---------------- */
 static int wide_dir_exists(const wchar_t* path) {
   DWORD attrs = GetFileAttributesW(path);
   return attrs != INVALID_FILE_ATTRIBUTES &&
          (attrs & FILE_ATTRIBUTE_DIRECTORY) != 0;
 }
 
 /* An installed Windows multicall name is a hard link, so
  * GetModuleFileNameW reports the prefix alias rather than the distribution's
  * bin/kit.exe name.  Enumerate the file's other NTFS names and select the one
  * that owns a Kit support tree.  This is the hard-link analogue of POSIX
  * realpath resolving an installed symlink to its distribution executable. */
 static int wide_exe_has_support(const wchar_t* exe) {
   size_t n, slash, suffix_len;
   wchar_t* probe;
   static const wchar_t dev_suffix[] = L"support\\rt\\include";
   static const wchar_t pkg_suffix[] = L"..\\support\\rt\\include";
   const wchar_t* suffix;
   int packaged;
   if (!exe || !*exe) return 0;
   n = wcslen(exe);
   slash = n;
   while (slash > 0 && exe[slash - 1] != L'\\' && exe[slash - 1] != L'/')
     --slash;
   if (slash == 0) return 0;
   for (packaged = 0; packaged < 2; ++packaged) {
     suffix = packaged ? pkg_suffix : dev_suffix;
     suffix_len = wcslen(suffix);
     probe = (wchar_t*)malloc((slash + suffix_len + 1u) * sizeof(*probe));
     if (!probe) return 0;
     memcpy(probe, exe, slash * sizeof(*probe));
     memcpy(probe + slash, suffix, (suffix_len + 1u) * sizeof(*probe));
     if (wide_dir_exists(probe)) {
       free(probe);
       return 1;
     }
     free(probe);
   }
   return 0;
 }
 
 static wchar_t* wide_find_distribution_hardlink(const wchar_t* invoked) {
   wchar_t volume[MAX_PATH];
   wchar_t* link_name = NULL;
   wchar_t* selected = NULL;
   DWORD cap = 256;
   HANDLE find = INVALID_HANDLE_VALUE;
   if (!invoked || !GetVolumePathNameW(invoked, volume, MAX_PATH)) return NULL;
   for (;;) {
     DWORD size = cap;
     wchar_t* next = (wchar_t*)realloc(link_name, (size_t)cap * sizeof(*next));
     if (!next) goto done;
     link_name = next;
     find = FindFirstFileNameW(invoked, 0, &size, link_name);
     if (find != INVALID_HANDLE_VALUE) break;
     if (GetLastError() != ERROR_MORE_DATA || size <= cap) goto done;
     cap = size;
   }
   for (;;) {
     size_t volume_len = wcslen(volume);
     size_t name_off =
         link_name[0] == L'\\' || link_name[0] == L'/' ? 1u : 0u;
     size_t name_len = wcslen(link_name + name_off);
     int need_sep = volume_len > 0 && volume[volume_len - 1] != L'\\' &&
                    volume[volume_len - 1] != L'/';
     size_t total = volume_len + (size_t)need_sep + name_len + 1u;
     wchar_t* candidate = (wchar_t*)malloc(total * sizeof(*candidate));
     if (!candidate) goto done;
     memcpy(candidate, volume, volume_len * sizeof(*candidate));
     if (need_sep) candidate[volume_len++] = L'\\';
     memcpy(candidate + volume_len, link_name + name_off,
            (name_len + 1u) * sizeof(*candidate));
     if (wide_exe_has_support(candidate)) {
       selected = candidate;
       break;
     }
     free(candidate);
     {
       DWORD size = cap;
       if (FindNextFileNameW(find, &size, link_name)) continue;
       if (GetLastError() != ERROR_MORE_DATA || size <= cap) break;
       {
         wchar_t* next =
             (wchar_t*)realloc(link_name, (size_t)size * sizeof(*next));
         if (!next) goto done;
         link_name = next;
         cap = size;
       }
       size = cap;
       if (!FindNextFileNameW(find, &size, link_name)) break;
     }
   }
 done:
   if (find != INVALID_HANDLE_VALUE) FindClose(find);
   free(link_name);
   return selected;
 }
 
 /* GetModuleFileNameW(NULL) reports the path of the running image. A return
  * equal to the buffer size means truncation (older Windows doesn't fail), so
  * grow until the result fits, then narrow to UTF-8. */
 int driver_self_exe_path(DriverEnv* env, char** out, size_t* out_size) {
   DWORD cap = 256;
   wchar_t* wbuf = NULL;
   char* narrowed;
   size_t size;
   if (!env || !out || !out_size) return 1;
   for (;;) {
     wchar_t* nb = (wchar_t*)realloc(wbuf, (size_t)cap * sizeof(wchar_t));
     DWORD n;
     if (!nb) {
       free(wbuf);
       return 1;
     }
     wbuf = nb;
     n = GetModuleFileNameW(NULL, wbuf, cap);
     if (n == 0) {
       free(wbuf);
       return 1;
     }
     if (n < cap) break; /* fit: n excludes the terminator on success */
     if (cap >= (1u << 20)) {
       free(wbuf);
       return 1;
     }
     cap *= 2;
   }
   {
     wchar_t* dist = wide_find_distribution_hardlink(wbuf);
     if (dist) {
       free(wbuf);
       wbuf = dist;
     }
   }
   narrowed = narrow(wbuf); /* malloc'd UTF-8 */
   free(wbuf);
   if (!narrowed) return 1;
   size = driver_strlen(narrowed) + 1u;
   *out = (char*)driver_alloc(env, size);
   if (!*out) {
     free(narrowed);
     return 1;
   }
   driver_memcpy(*out, narrowed, size);
   *out_size = size;
   free(narrowed);
   return 0;
 }
 
 /* ---------------- link helpers (install) ---------------- */
 
 #ifndef SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE
 #define SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE 0x2
 #endif
 
 int driver_create_symlink(const char* target, const char* link_path) {
   wchar_t* wtarget;
   wchar_t* wlink;
   BOOLEAN ok;
   if (!target || !link_path) return 1;
   wtarget = widen(target);
   wlink = widen(link_path);
   if (!wtarget || !wlink) {
     free(wtarget);
     free(wlink);
     return 1;
   }
   /* Prefer the unprivileged (Developer Mode) flag; fall back without it for
    * older hosts that reject the unknown flag. */
   ok = CreateSymbolicLinkW(wlink, wtarget,
                            SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE);
   if (!ok) ok = CreateSymbolicLinkW(wlink, wtarget, 0);
   free(wtarget);
   free(wlink);
   return ok ? 0 : 1;
 }
 
 int driver_readlink(const char* path, char* buf, size_t cap) {
   /* Reading a reparse point is materially more involved than POSIX
    * readlink(2), and initramfs symlinks are a Linux artifact. The Windows
    * build is best-effort and reports failure; the caller emits a clear
    * diagnostic and skips the entry rather than archiving a bogus link. */
   (void)path;
   (void)buf;
   (void)cap;
   return 1;
 }
 
 int driver_create_hardlink(const char* target, const char* link_path) {
   wchar_t* wtarget;
   wchar_t* wlink;
   BOOL ok;
   if (!target || !link_path) return 1;
   wtarget = widen(target);
   wlink = widen(link_path);
   if (!wtarget || !wlink) {
     free(wtarget);
     free(wlink);
     return 1;
   }
   ok = CreateHardLinkW(wlink, wtarget, NULL);
   free(wtarget);
   free(wlink);
   return ok ? 0 : 1;
 }
 
 int driver_remove_file(const char* path) {
   wchar_t* wpath;
   BOOL ok;
   if (!path) return 1;
   wpath = widen(path);
   if (!wpath) return 1;
   ok = DeleteFileW(wpath);
   if (!ok) {
     DWORD err = GetLastError();
     if (err == ERROR_FILE_NOT_FOUND || err == ERROR_PATH_NOT_FOUND) ok = TRUE;
   }
   free(wpath);
   return ok ? 0 : 1;
 }
 
 int driver_path_lexists(const char* path) {
   wchar_t* wpath;
   DWORD attr;
   if (!path) return 0;
   wpath = widen(path);
   if (!wpath) return 0;
   /* GetFileAttributesW does not traverse reparse points, so a dangling
    * symlink reports its own attributes rather than failing. */
   attr = GetFileAttributesW(wpath);
   free(wpath);
   return attr != INVALID_FILE_ATTRIBUTES;
 }
 
 int driver_rename(const char* from, const char* to) {
   wchar_t *wfrom, *wto;
   BOOL ok;
   if (!from || !to) return 1;
   wfrom = widen(from);
   wto = widen(to);
   if (!wfrom || !wto) {
     free(wfrom);
     free(wto);
     return 1;
   }
   ok = MoveFileExW(wfrom, wto, MOVEFILE_REPLACE_EXISTING);
   free(wfrom);
   free(wto);
   return ok ? 0 : 1;
 }
 
 static int win_remove_tree(const char* path) {
   wchar_t* wpath = widen(path);
   DWORD attr;
   int rc = 0;
   if (!wpath) return 1;
   attr = GetFileAttributesW(wpath);
   if (attr == INVALID_FILE_ATTRIBUTES) {
     DWORD e = GetLastError();
     free(wpath);
     return (e == ERROR_FILE_NOT_FOUND || e == ERROR_PATH_NOT_FOUND) ? 0 : 1;
   }
   if ((attr & FILE_ATTRIBUTE_DIRECTORY) &&
       !(attr & FILE_ATTRIBUTE_REPARSE_POINT)) {
     char pattern[4096];
     WIN32_FIND_DATAW fd;
     HANDLE h;
     wchar_t* wpattern;
     snprintf(pattern, sizeof pattern, "%s\\*", path);
     wpattern = widen(pattern);
     if (!wpattern) {
       free(wpath);
       return 1;
     }
     h = FindFirstFileW(wpattern, &fd);
     free(wpattern);
     if (h != INVALID_HANDLE_VALUE) {
       do {
         char child[4096], nameu8[1024];
         if (WideCharToMultiByte(CP_UTF8, 0, fd.cFileName, -1, nameu8,
                                 (int)sizeof nameu8, NULL, NULL) <= 0) {
           rc = 1;
           continue;
         }
         if (nameu8[0] == '.' && (nameu8[1] == '\0' ||
                                  (nameu8[1] == '.' && nameu8[2] == '\0')))
           continue;
         if ((size_t)snprintf(child, sizeof child, "%s\\%s", path, nameu8) >=
             sizeof child) {
           rc = 1;
           continue;
         }
         if (win_remove_tree(child) != 0) rc = 1;
       } while (FindNextFileW(h, &fd));
       FindClose(h);
     }
     if (!RemoveDirectoryW(wpath)) rc = 1;
   } else if (attr & FILE_ATTRIBUTE_DIRECTORY) {
     if (!RemoveDirectoryW(wpath)) rc = 1; /* reparse point: remove link only */
   } else {
     if (!DeleteFileW(wpath)) rc = 1;
   }
   free(wpath);
   return rc;
 }
 
 int driver_remove_tree(const char* path) {
   if (!path) return 1;
   return win_remove_tree(path);
 }
 
 int driver_kit_home(char* buf, size_t cap) {
   const char* v;
   int n = -1;
   size_t len;
   if (!buf || cap == 0) return 1;
   if ((v = getenv("KIT_HOME")) && *v)
     n = snprintf(buf, cap, "%s", v);
   else if ((v = getenv("XDG_DATA_HOME")) && *v)
     n = snprintf(buf, cap, "%s/kit", v);
   else if ((v = getenv("LOCALAPPDATA")) && *v)
     n = snprintf(buf, cap, "%s\\kit", v);
   if (n < 0 || (size_t)n >= cap) return 1;
   len = strlen(buf);
   while (len > 1 && (buf[len - 1] == '/' || buf[len - 1] == '\\'))
     buf[--len] = '\0';
   return 0;
 }
 
 static int fetch_hex_val(char c, unsigned* out) {
   if (c >= '0' && c <= '9') {
     *out = (unsigned)(c - '0');
     return 0;
   }
   if (c >= 'a' && c <= 'f') {
     *out = (unsigned)(c - 'a') + 10u;
     return 0;
   }
   if (c >= 'A' && c <= 'F') {
     *out = (unsigned)(c - 'A') + 10u;
     return 0;
   }
   return 1;
 }
 
 static char* fetch_decode_url_path(const char* s) {
   char* out;
   char* w;
   size_t n;
   if (!s) return NULL;
   n = strlen(s);
   out = (char*)malloc(n + 1u);
   if (!out) return NULL;
   w = out;
   while (*s) {
     if (*s == '%') {
       unsigned hi, lo;
       if (!s[1] || !s[2] || fetch_hex_val(s[1], &hi) ||
           fetch_hex_val(s[2], &lo)) {
         free(out);
         return NULL;
       }
       if (((hi << 4) | lo) == 0u) {
         free(out);
         return NULL;
       }
       *w++ = (char)((hi << 4) | lo);
       s += 3;
     } else {
       *w++ = *s++;
     }
   }
   *w = '\0';
   return out;
 }
 
 static char* fetch_file_url_path(const char* url) {
   const char* p;
   char* decoded;
   if (!url || strncmp(url, "file://", 7) != 0) return NULL;
   p = url + 7;
   if (strncmp(p, "localhost/", 10) == 0) {
     p += 10;
   } else if (p[0] == '/') {
     ++p;
   } else {
     const char* slash = strchr(p, '/');
     char* unc;
     size_t host_len, rest_len;
     if (!slash || slash == p) return NULL;
     host_len = (size_t)(slash - p);
     rest_len = strlen(slash + 1u);
     unc = (char*)malloc(2u + host_len + 1u + rest_len + 1u);
     if (!unc) return NULL;
     unc[0] = '\\';
     unc[1] = '\\';
     memcpy(unc + 2u, p, host_len);
     unc[2u + host_len] = '\\';
     memcpy(unc + 2u + host_len + 1u, slash + 1u, rest_len + 1u);
     decoded = fetch_decode_url_path(unc);
     free(unc);
     return decoded;
   }
   decoded = fetch_decode_url_path(p);
   return decoded;
 }
 
 static int fetch_copy_file(const char* src, const char* dest) {
   uint8_t buf[32768];
   wchar_t *wsrc, *wdest;
   HANDLE in_h, out_h;
   int rc = 1;
   wsrc = widen(src);
   wdest = widen(dest);
   if (!wsrc || !wdest) {
     free(wsrc);
     free(wdest);
     return 1;
   }
   in_h = CreateFileW(wsrc, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING,
                      FILE_ATTRIBUTE_NORMAL, NULL);
   free(wsrc);
   if (in_h == INVALID_HANDLE_VALUE) {
     free(wdest);
     return 1;
   }
   out_h = CreateFileW(wdest, GENERIC_WRITE, FILE_SHARE_READ, NULL,
                       CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
   free(wdest);
   if (out_h == INVALID_HANDLE_VALUE) {
     CloseHandle(in_h);
     return 1;
   }
   for (;;) {
     DWORD got = 0;
     if (!ReadFile(in_h, buf, sizeof buf, &got, NULL)) break;
     if (got == 0u) {
       rc = 0;
       break;
     }
     {
       DWORD off = 0;
       while (off < got) {
         DWORD wrote = 0;
         if (!WriteFile(out_h, buf + off, got - off, &wrote, NULL) ||
             wrote == 0u)
           goto out;
         off += wrote;
       }
     }
   }
 out:
   if (!CloseHandle(out_h)) rc = 1;
   CloseHandle(in_h);
   return rc;
 }
 
 int driver_fetch_url(const char* url, const char* dest) {
   wchar_t *wurl, *wdest;
   intptr_t rc;
   char* file_path;
   if (!url || !dest) return 1;
   if (strncmp(url, "file://", 7) == 0) {
     int copy_rc;
     file_path = fetch_file_url_path(url);
     if (!file_path) return 1;
     copy_rc = fetch_copy_file(file_path, dest);
     free(file_path);
     return copy_rc;
   }
   wurl = widen(url);
   wdest = widen(dest);
   if (!wurl || !wdest) {
     free(wurl);
     free(wdest);
     return 1;
   }
   /* curl.exe ships with Windows 10+; the URL is a distinct argv element (no
    * shell), so a hostile mirror URL cannot inject a command. */
   rc = _wspawnlp(_P_WAIT, L"curl", L"curl", L"-fsSL", L"-o", wdest, L"--", wurl,
                  (wchar_t*)NULL);
   free(wurl);
   free(wdest);
   return rc == 0 ? 0 : 1;
 }
 
 static int driver_walk_regular_files_at(DriverEnv* env, const char* dir,
                                         const char* rel, DriverWalkFileFn cb,
                                         void* user) {
   char* pattern;
   wchar_t* wpattern;
   WIN32_FIND_DATAW fd;
   HANDLE h;
   DWORD last;
   int rc = 1;
 
   pattern = driver_path_join(env, dir, "*", NULL);
   if (!pattern) return 1;
   wpattern = widen(pattern);
   driver_free(env, pattern, kit_slice_cstr(pattern).len + 1u);
   if (!wpattern) return 1;
 
   h = FindFirstFileW(wpattern, &fd);
   free(wpattern);
   if (h == INVALID_HANDLE_VALUE) {
     last = GetLastError();
     return last == ERROR_FILE_NOT_FOUND ? 0 : 1;
   }
 
   for (;;) {
     char* name = narrow(fd.cFileName);
     char* child = NULL;
     char* child_rel = NULL;
     int child_rc = 0;
     if (!name) goto loop_fail;
     if (driver_streq(name, ".") || driver_streq(name, "..")) {
       free(name);
       goto loop_next;
     }
     child = driver_path_join(env, dir, name, NULL);
     child_rel = rel && rel[0] ? driver_path_join(env, rel, name, NULL)
                               : driver_path_join(env, "", name, NULL);
     if (!child || !child_rel) goto loop_fail;
     if ((fd.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0) {
       if ((fd.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0) {
         child_rc = 1;
       } else {
         child_rc =
             driver_walk_regular_files_at(env, child, child_rel, cb, user);
       }
     } else {
       child_rc = cb(user, child, child_rel, 0);
     }
     if (child_rel)
       driver_free(env, child_rel, kit_slice_cstr(child_rel).len + 1u);
     if (child) driver_free(env, child, kit_slice_cstr(child).len + 1u);
     free(name);
     if (child_rc) goto out;
 
   loop_next:
     if (!FindNextFileW(h, &fd)) break;
     continue;
 
   loop_fail:
     if (child_rel)
       driver_free(env, child_rel, kit_slice_cstr(child_rel).len + 1u);
     if (child) driver_free(env, child, kit_slice_cstr(child).len + 1u);
     if (name) free(name);
     goto out;
   }
 
   last = GetLastError();
   rc = last == ERROR_NO_MORE_FILES ? 0 : 1;
 
 out:
   FindClose(h);
   return rc;
 }
 
 int driver_walk_regular_files(DriverEnv* env, const char* root,
                               DriverWalkFileFn cb, void* user) {
   if (!env || !root || !root[0] || !cb) return 1;
   return driver_walk_regular_files_at(env, root, "", cb, user);
 }
 
 /* ============================================================
  *   Time
  * ============================================================ */
 
 uint64_t driver_now_ns(void) {
   /* QueryPerformanceCounter is monotonic across cores on every supported
    * Windows version since Vista. */
   LARGE_INTEGER freq;
   LARGE_INTEGER ctr;
   if (!QueryPerformanceFrequency(&freq) || freq.QuadPart <= 0) return 0;
   if (!QueryPerformanceCounter(&ctr)) return 0;
   /* Avoid 128-bit multiply: split ticks into integer-seconds and remainder. */
   {
     int64_t sec = ctr.QuadPart / freq.QuadPart;
     int64_t rem = ctr.QuadPart % freq.QuadPart;
     return (uint64_t)sec * 1000000000ull +
            (uint64_t)((rem * 1000000000) / freq.QuadPart);
   }
 }
 
 int driver_random_bytes(uint8_t* out, size_t n) {
   /* rand_s draws from the OS CSPRNG (RtlGenRandom) without linking bcrypt. */
   size_t off = 0;
   if (!out) return 1;
   while (off < n) {
     unsigned int v;
     size_t chunk;
     if (rand_s(&v) != 0) return 1;
     chunk = n - off < sizeof v ? n - off : sizeof v;
     memcpy(out + off, &v, chunk);
     off += chunk;
   }
   return 0;
 }
 
 /* ============================================================
  *   load helpers
  * ============================================================ */
 
 /* driver_load_bytes / driver_release_bytes are OS-neutral; see env/common.c. */
 
 /* ============================================================
  *   stdin / edit_temp / read_line
  * ============================================================ */
 
 int driver_read_stdin(DriverEnv* e, uint8_t** out_data, size_t* out_size) {
   size_t cap = 4096;
   size_t len = 0;
   uint8_t* buf = e->heap->alloc(e->heap, cap, 1);
   HANDLE h = GetStdHandle(STD_INPUT_HANDLE);
   if (!buf) return 0;
   for (;;) {
     DWORD n;
     if (len == cap) {
       size_t newcap = cap * 2;
       uint8_t* nb = e->heap->realloc(e->heap, buf, cap, newcap, 1);
       if (!nb) {
         e->heap->free(e->heap, buf, cap);
         return 0;
       }
       buf = nb;
       cap = newcap;
     }
     if (!ReadFile(h, buf + len, (DWORD)(cap - len), &n, NULL)) {
       if (GetLastError() == ERROR_BROKEN_PIPE) break; /* EOF on pipe */
       e->heap->free(e->heap, buf, cap);
       return 0;
     }
     if (n == 0) break;
     len += n;
   }
   if (len < cap) {
     uint8_t* shrunk = len ? e->heap->realloc(e->heap, buf, cap, len, 1) : NULL;
     if (len && !shrunk) {
       *out_data = buf;
       *out_size = cap;
       return 1;
     }
     if (!len) {
       e->heap->free(e->heap, buf, cap);
       buf = NULL;
     } else {
       buf = shrunk;
     }
   }
   *out_data = buf;
   *out_size = len;
   return 1;
 }
 
 static int driver_write_handle_all(HANDLE h, const uint8_t* data, size_t n) {
   size_t off = 0;
   while (off < n) {
     DWORD chunk = (n - off) > 0x40000000u ? 0x40000000u : (DWORD)(n - off);
     DWORD wr = 0;
     if (!WriteFile(h, data + off, chunk, &wr, NULL) || wr == 0) return 0;
     off += wr;
   }
   return 1;
 }
 
 int driver_edit_temp(DriverEnv* e, const char* suffix, const uint8_t* initial,
                      size_t initial_size, uint8_t** out_data,
                      size_t* out_size) {
   /* Windows temp-file dance:
    *   - GetTempPathW gives us %TMP%/%TEMP%/%USERPROFILE% with trailing '\\'.
    *   - GetTempFileNameW makes a unique "<dir>\\cfXXXX.tmp" path. We ignore
    *     the ".tmp" and append our requested suffix below by renaming.
    *   - We rename to "<base><suffix>" so the editor sees the right extension.
    *   - Editor is launched via system() so shell quoting / PATH lookup is
    *     handled by cmd.exe.
    */
   wchar_t tmp_dir[MAX_PATH + 1];
   wchar_t tmp_path[MAX_PATH + 1];
   DWORD got;
   HANDLE h = INVALID_HANDLE_VALUE;
   wchar_t* wsuffix = NULL;
   wchar_t final_path[MAX_PATH + 64];
   size_t final_len;
   int ok = 0;
   KitFileData fd_data;
   const char* editor;
   char* cmd = NULL;
   int rc;
   size_t cmd_cap;
   char utf8_path[MAX_PATH * 4 + 1];
   int utf8_len;
 
   if (!out_data || !out_size) return 0;
   *out_data = NULL;
   *out_size = 0;
 
   got = GetTempPathW(MAX_PATH + 1, tmp_dir);
   if (got == 0 || got > MAX_PATH) return 0;
   if (GetTempFileNameW(tmp_dir, L"cf", 0, tmp_path) == 0) return 0;
 
   /* Build the final path = tmp_path with ".tmp" stripped + requested suffix.
    * GetTempFileNameW already created the file at tmp_path; we MoveFileEx to
    * rename it to final_path. */
   {
     size_t tplen = wcslen(tmp_path);
     /* Strip the ".tmp" extension GetTempFileNameW appends. */
     if (tplen >= 4 && tmp_path[tplen - 4] == L'.') tplen -= 4;
     if (tplen >= sizeof(final_path) / sizeof(wchar_t) - 16) {
       DeleteFileW(tmp_path);
       return 0;
     }
     memcpy(final_path, tmp_path, tplen * sizeof(wchar_t));
     final_path[tplen] = L'\0';
     final_len = tplen;
     if (suffix && *suffix) {
       wsuffix = widen(suffix);
       if (!wsuffix) {
         DeleteFileW(tmp_path);
         return 0;
       }
       {
         size_t sl = wcslen(wsuffix);
         if (final_len + sl + 1 >= sizeof(final_path) / sizeof(wchar_t)) {
           free(wsuffix);
           DeleteFileW(tmp_path);
           return 0;
         }
         memcpy(final_path + final_len, wsuffix, sl * sizeof(wchar_t));
         final_len += sl;
         final_path[final_len] = L'\0';
       }
       free(wsuffix);
     }
     if (!MoveFileExW(tmp_path, final_path, MOVEFILE_REPLACE_EXISTING)) {
       DeleteFileW(tmp_path);
       return 0;
     }
   }
 
   /* Open the renamed file and write initial contents. */
   h = CreateFileW(final_path, GENERIC_WRITE, FILE_SHARE_READ, NULL,
                   TRUNCATE_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
   if (h == INVALID_HANDLE_VALUE) goto out;
   if (initial_size &&
       !driver_write_handle_all(h, initial ? initial : (const uint8_t*)"",
                                initial_size))
     goto out;
   CloseHandle(h);
   h = INVALID_HANDLE_VALUE;
 
   /* Convert final_path back to UTF-8 for the editor command. */
   utf8_len = WideCharToMultiByte(CP_UTF8, 0, final_path, -1, utf8_path,
                                  (int)sizeof(utf8_path), NULL, NULL);
   if (utf8_len <= 0) goto out;
 
   editor = getenv("VISUAL");
   if (!editor || !*editor) editor = getenv("EDITOR");
   if (!editor || !*editor) editor = "notepad";
   cmd_cap = strlen(editor) + (size_t)utf8_len + 16;
   cmd = (char*)malloc(cmd_cap);
   if (!cmd) goto out;
   /* Wrap the entire command in extra quotes so cmd.exe /S doesn't strip
    * matching outer quotes when the editor path itself has spaces. */
   rc = snprintf(cmd, cmd_cap, "\"\"%s\" \"%s\"\"", editor, utf8_path);
   if (rc < 0 || (size_t)rc >= cmd_cap) goto out;
   if (system(cmd) != 0) goto out;
 
   fd_data.data = NULL;
   fd_data.size = 0;
   fd_data.token = NULL;
   if (win_read_all(e, utf8_path, &fd_data) != KIT_OK) goto out;
   *out_data = (uint8_t*)fd_data.data;
   *out_size = fd_data.size;
   ok = 1;
 
 out:
   if (h != INVALID_HANDLE_VALUE) CloseHandle(h);
   if (cmd) free(cmd);
   DeleteFileW(final_path);
   return ok;
 }
 
 int driver_read_line(char* buf, size_t cap) {
   size_t len = 0;
   if (!buf || cap < 2) return -1;
   for (;;) {
     int c = fgetc(stdin);
     if (c == EOF) {
       buf[len] = '\0';
       if (ferror(stdin)) return -1;
       if (len == 0) return 0;
       return (int)len;
     }
     if (c == '\n') {
       /* Strip a trailing CR if present (CRLF line ending). */
       if (len > 0 && buf[len - 1] == '\r') --len;
       buf[len] = '\0';
       return (int)len;
     }
     if (len + 1 < cap) buf[len++] = (char)c;
   }
 }
 
 static int win_line_history_add(DriverEnv* env, DriverLineHistory* h,
                                 const char* line, size_t len) {
   char** ni;
   size_t* ns;
   char* copy;
   uint32_t nc;
   if (!env || !h || !line || len == 0) return 0;
   if (h->count == h->cap) {
     size_t old_items = (size_t)h->cap * sizeof(*h->items);
     size_t new_items;
     size_t old_sizes = (size_t)h->cap * sizeof(*h->sizes);
     size_t new_sizes;
     nc = h->cap ? h->cap * 2u : 32u;
     new_items = (size_t)nc * sizeof(*h->items);
     new_sizes = (size_t)nc * sizeof(*h->sizes);
     ni = (char**)env->heap->realloc(env->heap, h->items, old_items, new_items,
                                     _Alignof(char*));
     if (!ni) return 1;
     h->items = ni;
     ns = (size_t*)env->heap->realloc(env->heap, h->sizes, old_sizes, new_sizes,
                                      _Alignof(size_t));
     if (!ns) return 1;
     h->sizes = ns;
     h->cap = nc;
   }
   copy = (char*)driver_alloc(env, len + 1u);
   if (!copy) return 1;
   memcpy(copy, line, len);
   copy[len] = '\0';
   h->items[h->count] = copy;
   h->sizes[h->count] = len + 1u;
   h->count++;
   return 0;
 }
 
 int driver_read_line_edit(DriverEnv* env, const char* prompt, char* buf,
                           size_t cap, DriverLineHistory* hist,
                           DriverLineCompleteFn complete, void* complete_user,
                           const char* edit_suffix) {
   int n;
   (void)complete;
   (void)complete_user;
   /* This host reads in cooked mode, so there is no keystroke interception
    * for a Ctrl-G inline-edit binding; the `edit` REPL command remains the
    * editor entry point here. */
   (void)edit_suffix;
   if (prompt && *prompt) {
     fputs(prompt, stdout);
     fflush(stdout);
   }
   n = driver_read_line(buf, cap);
   if (n > 0 && hist) (void)win_line_history_add(env, hist, buf, (size_t)n);
   return n;
 }
 
 /* ============================================================
  *   dlsym via GetProcAddress over loaded modules
  * ============================================================ */
 
 /* Snapshot the loaded modules at first call and remember them. We don't
  * track DLL load/unload events; that's a reasonable trade-off for a JIT
  * (the relevant DLLs -- ucrt, kernel32, the kit binary -- are loaded
  * before the JIT extern resolver runs). */
 static HMODULE g_dlsym_modules[256];
 static DWORD g_dlsym_count;
 static SRWLOCK g_dlsym_lock = SRWLOCK_INIT;
 static int g_dlsym_inited;
 
 static void dlsym_init_once(void) {
   HANDLE proc;
   DWORD need = 0;
   AcquireSRWLockExclusive(&g_dlsym_lock);
   if (g_dlsym_inited) {
     ReleaseSRWLockExclusive(&g_dlsym_lock);
     return;
   }
   proc = GetCurrentProcess();
   if (EnumProcessModules(proc, g_dlsym_modules, sizeof(g_dlsym_modules),
                          &need)) {
     DWORD have = need / (DWORD)sizeof(HMODULE);
     g_dlsym_count = have > (DWORD)(sizeof(g_dlsym_modules) / sizeof(HMODULE))
                         ? (DWORD)(sizeof(g_dlsym_modules) / sizeof(HMODULE))
                         : have;
   } else {
     /* Fall back to the executable module and the CRT/kernel essentials. */
     g_dlsym_modules[0] = GetModuleHandleW(NULL);
     g_dlsym_modules[1] = GetModuleHandleW(L"kernel32.dll");
     g_dlsym_modules[2] = GetModuleHandleW(L"msvcrt.dll");
     g_dlsym_modules[3] = GetModuleHandleW(L"ucrtbase.dll");
     g_dlsym_count = 4;
   }
   g_dlsym_inited = 1;
   ReleaseSRWLockExclusive(&g_dlsym_lock);
 }
 
 static void* win_dlsym(const char* name) {
   DWORD i;
   if (!name) return NULL;
   dlsym_init_once();
   /* Try the source-level name; if that misses and there's a leading '_'
    * (Mach-O-mangled), try without it. */
   AcquireSRWLockShared(&g_dlsym_lock);
   for (i = 0; i < g_dlsym_count; ++i) {
     void* p;
     if (!g_dlsym_modules[i]) continue;
     p = (void*)GetProcAddress(g_dlsym_modules[i], name);
     if (p) {
       ReleaseSRWLockShared(&g_dlsym_lock);
       return p;
     }
   }
   if (name[0] == '_' && name[1] != '\0') {
     for (i = 0; i < g_dlsym_count; ++i) {
       void* p;
       if (!g_dlsym_modules[i]) continue;
       p = (void*)GetProcAddress(g_dlsym_modules[i], name + 1);
       if (p) {
         ReleaseSRWLockShared(&g_dlsym_lock);
         return p;
       }
     }
   }
   ReleaseSRWLockShared(&g_dlsym_lock);
   return NULL;
 }
 
 static int win_name_eq(KitSlice s, const char* lit, size_t litlen) {
   return s.len == litlen && memcmp(s.s, lit, litlen) == 0;
 }
 
 /* libucrt-static stdio entry points handed to JIT'd code.
  *
  * With kit's UCRT profile (__USE_MINGW_ANSI_STDIO=0), mingw's <stdio.h>
  * resolves the printf/scanf family to out-of-line wrappers that live ONLY in
  * libucrt.a — ucrtbase.dll exports just the __stdio_common_v* cores (and
  * __local_stdio_* helpers the wrappers call). An AOT `kit cc` link pulls the
  * wrappers from libucrt.a; the in-process JIT (`kit run`) resolves externs via
  * dlsym over loaded DLLs (win_dlsym), which can't see them, so a printf-using
  * JIT program fails with an undefined `printf`. kit.exe statically links
  * libucrt.a, so taking each wrapper's address here pulls its definition into
  * our own image and lets us hand the JIT our copy. Functions that ARE
  * ucrtbase.dll exports (puts, fputs, fflush, putchar, __stdio_common_v*,
  * __acrt_iob_func, …) resolve through win_dlsym above and never reach this
  * table. The __local_stdio_*_options helpers' storage only ever holds the
  * default (0) flags, so sharing one instance between the host and the JIT'd
  * program is benign. */
 void* driver_dlsym_resolver(void* user, KitSlice name_s) {
   void* p;
   (void)user;
   if (!name_s.s || name_s.len == 0) return NULL;
   p = win_dlsym(name_s.s);
   if (p) return p;
   /* Match by source name; #fn stringizes it and sizeof-1 is its length. */
 #define KIT_STATIC_STDIO(fn) \
   if (win_name_eq(name_s, #fn, sizeof(#fn) - 1u)) return (void*)(uintptr_t)&fn
   KIT_STATIC_STDIO(__local_stdio_printf_options);
   KIT_STATIC_STDIO(__local_stdio_scanf_options);
   KIT_STATIC_STDIO(printf);
   KIT_STATIC_STDIO(fprintf);
   KIT_STATIC_STDIO(sprintf);
   KIT_STATIC_STDIO(snprintf);
   KIT_STATIC_STDIO(_snprintf);
   KIT_STATIC_STDIO(vprintf);
   KIT_STATIC_STDIO(vfprintf);
   KIT_STATIC_STDIO(vsprintf);
   KIT_STATIC_STDIO(vsnprintf);
   KIT_STATIC_STDIO(_vsnprintf);
   KIT_STATIC_STDIO(scanf);
   KIT_STATIC_STDIO(fscanf);
   KIT_STATIC_STDIO(sscanf);
   KIT_STATIC_STDIO(_snscanf);
   KIT_STATIC_STDIO(vscanf);
   KIT_STATIC_STDIO(vfscanf);
   KIT_STATIC_STDIO(vsscanf);
   KIT_STATIC_STDIO(_scprintf);
   KIT_STATIC_STDIO(_vscprintf);
 #undef KIT_STATIC_STDIO
   return NULL;
 }
 
 /* ============================================================
  *   SIGINT shim via SetConsoleCtrlHandler
  * ============================================================ */
 
 static void (*g_ctrlc_cb)(void*);
 static void* g_ctrlc_cb_user;
 
 static BOOL WINAPI ctrlc_trampoline(DWORD type) {
   if (type == CTRL_C_EVENT || type == CTRL_BREAK_EVENT) {
     if (g_ctrlc_cb) g_ctrlc_cb(g_ctrlc_cb_user);
     return TRUE; /* handled */
   }
   return FALSE;
 }
 
 int driver_install_sigint(void (*cb)(void*), void* user) {
   g_ctrlc_cb = cb;
   g_ctrlc_cb_user = user;
   return SetConsoleCtrlHandler(ctrlc_trampoline, TRUE) ? 0 : 1;
 }
 
 void driver_restore_sigint(void) {
   SetConsoleCtrlHandler(ctrlc_trampoline, FALSE);
   g_ctrlc_cb = NULL;
   g_ctrlc_cb_user = NULL;
 }
 
 /* No fault-guard on Windows yet (the POSIX path uses sigaction + sigsetjmp; a
  * vectored-exception-handler port is a follow-up). Run the entry directly so
  * `kit run` still executes the program; on_crash never fires. */
 int driver_run_with_crash_guard(DriverEnv* env, KitArchKind arch,
                                 DriverRunEntryFn entry, int argc, char** argv,
                                 int* ret_out, DriverRunCrashFn on_crash,
                                 void* user) {
   (void)env;
   (void)arch;
   (void)on_crash;
   (void)user;
   *ret_out = entry(argc, argv);
   return 0;
 }
 
 /* ============================================================
  *   Win32 CONTEXT <-> KitUnwindFrame marshalling
  * ============================================================ */
 
 /* Inline per-arch marshalling: the Win32 dbg path is short enough that a
  * separate uctx_*_windows.c isn't worth the extra TU. Only the host arch
  * matters; cross-arch debug isn't a Win32 concern (the worker runs in our
  * own process). */
 
 #if defined(_M_X64) || defined(__x86_64__)
 static void ctx_to_frame(const CONTEXT* c, KitUnwindFrame* f) {
   memset(f, 0, sizeof(*f));
   f->pc = (uint64_t)c->Rip;
   f->cfa = (uint64_t)c->Rsp;
   /* SysV DWARF mapping: rax=0, rdx=1, rcx=2, rbx=3, rsi=4, rdi=5, rbp=6,
    * rsp=7, r8..r15=8..15. We use the same mapping so kit's DWARF reader
    * can interpret these directly. */
   f->regs[0] = c->Rax;
   f->regs[1] = c->Rdx;
   f->regs[2] = c->Rcx;
   f->regs[3] = c->Rbx;
   f->regs[4] = c->Rsi;
   f->regs[5] = c->Rdi;
   f->regs[6] = c->Rbp;
   f->regs[7] = c->Rsp;
   f->regs[8] = c->R8;
   f->regs[9] = c->R9;
   f->regs[10] = c->R10;
   f->regs[11] = c->R11;
   f->regs[12] = c->R12;
   f->regs[13] = c->R13;
   f->regs[14] = c->R14;
   f->regs[15] = c->R15;
 }
 
 static void frame_to_ctx(const KitUnwindFrame* f, CONTEXT* c) {
   c->Rip = f->pc;
   c->Rax = f->regs[0];
   c->Rdx = f->regs[1];
   c->Rcx = f->regs[2];
   c->Rbx = f->regs[3];
   c->Rsi = f->regs[4];
   c->Rdi = f->regs[5];
   c->Rbp = f->regs[6];
   c->Rsp = f->regs[7];
   c->R8 = f->regs[8];
   c->R9 = f->regs[9];
   c->R10 = f->regs[10];
   c->R11 = f->regs[11];
   c->R12 = f->regs[12];
   c->R13 = f->regs[13];
   c->R14 = f->regs[14];
   c->R15 = f->regs[15];
 }
 #elif defined(_M_ARM64) || defined(__aarch64__)
 static void ctx_to_frame(const CONTEXT* c, KitUnwindFrame* f) {
   unsigned i;
   memset(f, 0, sizeof(*f));
   f->pc = (uint64_t)c->Pc;
   f->cfa = (uint64_t)c->Sp;
   for (i = 0; i < 31; ++i) f->regs[i] = c->X[i];
   f->regs[31] = c->Sp;
 }
 
 static void frame_to_ctx(const KitUnwindFrame* f, CONTEXT* c) {
   unsigned i;
   c->Pc = f->pc;
   for (i = 0; i < 31; ++i) c->X[i] = f->regs[i];
   c->Sp = f->regs[31];
 }
 #else
 static void ctx_to_frame(const CONTEXT* c, KitUnwindFrame* f) {
   (void)c;
   memset(f, 0, sizeof(*f));
 }
 static void frame_to_ctx(const KitUnwindFrame* f, CONTEXT* c) {
   (void)f;
   (void)c;
 }
 #endif
 
 /* Map a Win32 exception code to the POSIX-style signo the dbg session
  * expects. Anything we don't recognize falls through as a generic SEGV. */
 static int exception_code_to_signo(DWORD code) {
   switch (code) {
     case EXCEPTION_BREAKPOINT:
     case EXCEPTION_SINGLE_STEP:
       return 5; /* SIGTRAP */
     case EXCEPTION_ILLEGAL_INSTRUCTION:
     case EXCEPTION_PRIV_INSTRUCTION:
       return 4; /* SIGILL */
     case EXCEPTION_INT_DIVIDE_BY_ZERO:
     case EXCEPTION_INT_OVERFLOW:
     case EXCEPTION_FLT_DIVIDE_BY_ZERO:
     case EXCEPTION_FLT_OVERFLOW:
     case EXCEPTION_FLT_UNDERFLOW:
     case EXCEPTION_FLT_INVALID_OPERATION:
     case EXCEPTION_FLT_DENORMAL_OPERAND:
     case EXCEPTION_FLT_INEXACT_RESULT:
     case EXCEPTION_FLT_STACK_CHECK:
       return 8; /* SIGFPE */
     case EXCEPTION_DATATYPE_MISALIGNMENT:
       return 7; /* SIGBUS */
     case EXCEPTION_ACCESS_VIOLATION:
     case EXCEPTION_IN_PAGE_ERROR:
     case EXCEPTION_ARRAY_BOUNDS_EXCEEDED:
     case EXCEPTION_STACK_OVERFLOW:
     default:
       return 11; /* SIGSEGV */
   }
 }
 
 /* ============================================================
  *   dbg_os: threads, events, exceptions, guarded_copy
  * ============================================================ */
 
 static KitDbgSignalOps g_dbg_ops;
 static int g_dbg_ops_set;
 static void* g_dbg_session;
 static DWORD g_dbg_worker_tid;
 static int g_dbg_worker_tid_valid;
 static PVOID g_veh_cookie;
 
 /* Guarded-copy landing for the VEH path. dbg_guarded_copy_win sets
  * g_guard_armed around the copy; if the VEH fires while it's set the exception
  * is "translated" into a longjmp via the VEH's ability to rewrite the resume
  * context. This is the single mechanism for every compiler (no SEH __try). */
 static __thread int g_guard_armed;
 static __thread jmp_buf g_guard_buf;
 
 static int win_dbg_caller_is_worker(void) {
   return g_dbg_worker_tid_valid && GetCurrentThreadId() == g_dbg_worker_tid;
 }
 
 /* --- thread shim --- */
 
 typedef struct DbgWinThread {
   HANDLE handle;
   DWORD tid;
   void (*fn)(void*);
   void* arg;
 } DbgWinThread;
 
 static unsigned __stdcall dbg_thread_trampoline(void* p) {
   DbgWinThread* t = (DbgWinThread*)p;
   t->fn(t->arg);
   return 0;
 }
 
 static KitStatus dbg_thread_start_win(void* user, void (*fn)(void*), void* arg,
                                       void** thread_out) {
   DbgWinThread* t;
   uintptr_t h;
   (void)user;
   t = (DbgWinThread*)malloc(sizeof(*t));
   if (!t) return KIT_NOMEM;
   t->fn = fn;
   t->arg = arg;
   /* _beginthreadex sets up the CRT TLS for the new thread; pure CreateThread
    * leaves the CRT in an undefined state for code that calls printf/malloc. */
   h = _beginthreadex(NULL, 0, dbg_thread_trampoline, t, 0, (unsigned*)&t->tid);
   if (h == 0) {
     free(t);
     return KIT_ERR;
   }
   t->handle = (HANDLE)h;
   g_dbg_worker_tid = t->tid;
   g_dbg_worker_tid_valid = 1;
   *thread_out = t;
   return KIT_OK;
 }
 
 static void dbg_thread_join_win(void* user, void* thread) {
   DbgWinThread* t = (DbgWinThread*)thread;
   (void)user;
   if (!t) return;
   WaitForSingleObject(t->handle, INFINITE);
   CloseHandle(t->handle);
   g_dbg_worker_tid_valid = 0;
   free(t);
 }
 
 /* Interrupt the worker by suspending it, snapshotting its CONTEXT,
  * calling on_fault on the caller thread (the REPL), and writing back any
  * register edits. This differs from POSIX (where the signal handler runs
  * the on_fault on the worker), but the observable contract -- "the worker
  * is stopped while on_fault runs and resumes with the edited frame" --
  * matches. Locking quirks of SuspendThread aren't a concern here: the
  * worker is, by construction, running JIT'd user code that holds no host
  * locks. */
 static KitStatus dbg_thread_interrupt_win(void* user, void* thread) {
   DbgWinThread* t = (DbgWinThread*)thread;
   CONTEXT ctx;
   KitUnwindFrame frame;
   KitStatus rc;
   (void)user;
   if (!t || !g_dbg_ops_set || !g_dbg_ops.on_fault) return KIT_INVALID;
   if (SuspendThread(t->handle) == (DWORD)-1) return KIT_ERR;
   memset(&ctx, 0, sizeof(ctx));
   ctx.ContextFlags = CONTEXT_FULL;
   if (!GetThreadContext(t->handle, &ctx)) {
     ResumeThread(t->handle);
     return KIT_ERR;
   }
   ctx_to_frame(&ctx, &frame);
   rc = g_dbg_ops.on_fault(g_dbg_session, DBG_WIN_INTERRUPT_SIGNO, &frame);
   if (rc == KIT_OK) {
     frame_to_ctx(&frame, &ctx);
     SetThreadContext(t->handle, &ctx);
   }
   ResumeThread(t->handle);
   return rc;
 }
 
 /* --- event shim --- */
 
 static KitStatus dbg_event_new_win(void* user, void** event_out) {
   HANDLE h;
   (void)user;
   /* Manual-reset so a signaler that races ahead of the waiter doesn't lose
    * the wake-up; the dbg core explicitly resets via event_reset. */
   h = CreateEventW(NULL, TRUE, FALSE, NULL);
   if (!h) return KIT_ERR;
   *event_out = (void*)h;
   return KIT_OK;
 }
 
 static void dbg_event_free_win(void* user, void* ev) {
   (void)user;
   if (ev) CloseHandle((HANDLE)ev);
 }
 
 static KitStatus dbg_event_wait_win(void* user, void* ev) {
   (void)user;
   if (WaitForSingleObject((HANDLE)ev, INFINITE) != WAIT_OBJECT_0)
     return KIT_ERR;
   /* Auto-reset semantics expected by dbg_event_wait on POSIX (it clears
    * the flag after consuming). Mirror that here so the contract holds. */
   ResetEvent((HANDLE)ev);
   return KIT_OK;
 }
 
 static KitStatus dbg_event_signal_win(void* user, void* ev) {
   (void)user;
   return SetEvent((HANDLE)ev) ? KIT_OK : KIT_ERR;
 }
 
 static KitStatus dbg_event_reset_win(void* user, void* ev) {
   (void)user;
   return ResetEvent((HANDLE)ev) ? KIT_OK : KIT_ERR;
 }
 
 /* --- vectored exception handler --- */
 
 /* Recovery thunk: for a fault inside a guarded_copy (g_guard_armed) or any
  * other natural fault raised in a guarded region, hand control back to the
  * longjmp target by rewriting the resume context. */
 static LONG WINAPI dbg_veh(EXCEPTION_POINTERS* ep) {
   DWORD code = ep->ExceptionRecord->ExceptionCode;
   KitUnwindFrame frame;
   KitStatus rc;
   int signo;
 
   /* Filter out C++-style exceptions / debug strings we don't care about. */
   if (code == 0x406D1388u /* MS_VC_EXCEPTION (SetThreadName) */ ||
       code == 0xE06D7363u /* CXX EH */ || code == DBG_PRINTEXCEPTION_C ||
       code == DBG_PRINTEXCEPTION_WIDE_C)
     return EXCEPTION_CONTINUE_SEARCH;
 
   /* SEGV/BUS during a guarded_copy: bail out without involving the
    * session. The VEH backstop only fires if SEH/__try wasn't compiled in
    * for the function that armed the guard. */
   if (g_guard_armed &&
       (code == EXCEPTION_ACCESS_VIOLATION || code == EXCEPTION_IN_PAGE_ERROR ||
        code == EXCEPTION_DATATYPE_MISALIGNMENT)) {
     g_guard_armed = 0;
     longjmp(g_guard_buf, 1);
     /* not reached */
     return EXCEPTION_CONTINUE_EXECUTION;
   }
 
   if (!win_dbg_caller_is_worker() || !g_dbg_ops_set || !g_dbg_ops.on_fault)
     return EXCEPTION_CONTINUE_SEARCH;
 
   signo = exception_code_to_signo(code);
   ctx_to_frame(ep->ContextRecord, &frame);
   rc = g_dbg_ops.on_fault(g_dbg_session, signo, &frame);
   if (rc != KIT_OK) return EXCEPTION_CONTINUE_SEARCH;
   frame_to_ctx(&frame, ep->ContextRecord);
   return EXCEPTION_CONTINUE_EXECUTION;
 }
 
 static KitStatus dbg_signals_install_win(void* user, const KitDbgSignalOps* ops,
                                          void* session) {
   (void)user;
   if (g_veh_cookie) return KIT_ERR;
   g_dbg_ops = *ops;
   g_dbg_ops_set = 1;
   g_dbg_session = session;
   /* First==1 ensures we run before any other VEH and before the system's
    * default last-chance handler. */
   g_veh_cookie = AddVectoredExceptionHandler(1, dbg_veh);
   if (!g_veh_cookie) {
     memset(&g_dbg_ops, 0, sizeof(g_dbg_ops));
     g_dbg_ops_set = 0;
     g_dbg_session = NULL;
     return KIT_ERR;
   }
   return KIT_OK;
 }
 
 static void dbg_signals_uninstall_win(void* user) {
   (void)user;
   if (g_veh_cookie) {
     RemoveVectoredExceptionHandler(g_veh_cookie);
     g_veh_cookie = NULL;
   }
   memset(&g_dbg_ops, 0, sizeof(g_dbg_ops));
   g_dbg_ops_set = 0;
   g_dbg_session = NULL;
 }
 
 /* --- W^X transitions --- */
 
 static size_t page_floor(size_t v, size_t pg) { return v & ~(pg - 1); }
 static size_t page_ceil(size_t v, size_t pg) {
   return (v + pg - 1) & ~(pg - 1);
 }
 
 static KitStatus dbg_code_write_begin_win(void* user, void* runtime_addr,
                                           size_t n, void** write_out) {
   size_t pg;
   uintptr_t a;
   uintptr_t base;
   size_t span;
   DWORD old;
   (void)user;
   if (!runtime_addr || !n || !write_out) return KIT_INVALID;
   /* Dual-mapped reservation: write through the alias, no protect flip. */
   if (exec_dual_lookup_w(runtime_addr, n, write_out) == 0) return KIT_OK;
   /* Single-mapping fallback: transient PAGE_EXECUTE_READWRITE. */
   pg = driver_host_page_size_win();
   a = (uintptr_t)runtime_addr;
   base = page_floor(a, pg);
   span = page_ceil((a - base) + n, pg);
   if (!VirtualProtect((void*)base, span, PAGE_EXECUTE_READWRITE, &old))
     return KIT_ERR;
   *write_out = runtime_addr;
   return KIT_OK;
 }
 
 static void dbg_code_write_end_win(void* user, void* runtime_addr, size_t n) {
   void* w;
   size_t pg;
   uintptr_t a;
   uintptr_t base;
   size_t span;
   DWORD old;
   (void)user;
   if (exec_dual_lookup_w(runtime_addr, n, &w) == 0)
     return; /* nothing to flip */
   pg = driver_host_page_size_win();
   a = (uintptr_t)runtime_addr;
   base = page_floor(a, pg);
   span = page_ceil((a - base) + n, pg);
   VirtualProtect((void*)base, span, PAGE_EXECUTE_READ, &old);
 }
 
 static void dbg_flush_icache_win(void* user, void* runtime_addr, size_t n) {
   (void)user;
   FlushInstructionCache(GetCurrentProcess(), runtime_addr, n);
 }
 
 /* --- guarded copy via the vectored exception handler --- */
 
 static KitStatus dbg_guarded_copy_win(void* user, void* dst, const void* src,
                                       size_t n) {
   (void)user;
   /* Catch an access fault during the copy without SEH __try/__except: the
    * vectored handler dbg_veh (installed by dbg_signals_install_win) sees the
    * thread-local g_guard_armed and longjmps back through g_guard_buf on a
    * fault. This is one path for every compiler — kit's own frontend, gcc, and
    * clang alike — so it needs no -fseh-exceptions / -fms-extensions and no
    * __try language extension. */
   if (setjmp(g_guard_buf) != 0) {
     g_guard_armed = 0;
     return KIT_ERR;
   }
   g_guard_armed = 1;
   memcpy(dst, src, n);
   g_guard_armed = 0;
   return KIT_OK;
 }
 
 /* --- call_with_catch / thread_abort (longjmp-based) --- */
 
 static __thread jmp_buf g_dbg_abort_buf;
 
 static int dbg_call_with_catch_win(void* user, void (*fn)(void*), void* arg) {
   (void)user;
   if (setjmp(g_dbg_abort_buf) == 0) {
     fn(arg);
     return 0;
   }
   return 1;
 }
 
 static void dbg_thread_abort_win(void* user) {
   (void)user;
   longjmp(g_dbg_abort_buf, 1);
 }
 
 static KitDbgOs g_dbg_os_win = {
     .thread_start = dbg_thread_start_win,
     .thread_join = dbg_thread_join_win,
     .thread_interrupt = dbg_thread_interrupt_win,
     .event_new = dbg_event_new_win,
     .event_free = dbg_event_free_win,
     .event_wait = dbg_event_wait_win,
     .event_signal = dbg_event_signal_win,
     .event_reset = dbg_event_reset_win,
     .signals_install = dbg_signals_install_win,
     .signals_uninstall = dbg_signals_uninstall_win,
     .interrupt_signo = DBG_WIN_INTERRUPT_SIGNO,
     .trap_signo = 5,
     .code_write_begin = dbg_code_write_begin_win,
     .code_write_end = dbg_code_write_end_win,
     .flush_icache = dbg_flush_icache_win,
     .guarded_copy = dbg_guarded_copy_win,
     .call_with_catch = dbg_call_with_catch_win,
     .thread_abort = dbg_thread_abort_win,
     .user = NULL,
 };
 
 /* JIT thread-local access resolves to in-image storage (single-threaded JIT:
  * the in-image TLS data is the single instance — see src/link/link_jit.c), so
  * no host-provided per-thread TLS vtable is needed. */
 
 /* ============================================================
  *   host target
  * ============================================================ */
 
 static KitArchKind host_arch_self_win(void) {
 #if defined(_M_X64) || defined(__x86_64__)
   return KIT_ARCH_X86_64;
 #elif defined(_M_ARM64) || defined(__aarch64__)
   return KIT_ARCH_ARM_64;
 #elif defined(_M_IX86) || defined(__i386__)
   return KIT_ARCH_X86_32;
 #elif defined(_M_ARM) || defined(__arm__)
   return KIT_ARCH_ARM_32;
 #else
   return KIT_ARCH_X86_64;
 #endif
 }
 
 KitTargetSpec driver_host_target(void) {
   KitTargetSpec t = {0};
   t.arch = host_arch_self_win();
   t.os = KIT_OS_WINDOWS;
   t.obj = KIT_OBJ_COFF;
   t.ptr_size = (uint8_t)sizeof(void*);
   t.ptr_align = (uint8_t)sizeof(void*);
   t.big_endian = 0;
   t.pic = driver_default_pic(t.obj, t.os);
   t.code_model = KIT_CM_DEFAULT;
   return t;
 }
 
 /* No host probe on Windows: the MinGW sysroot is supplied via --sysroot or the
  * KIT_SYSROOT env var (handled in the cc driver), not auto-discovered from a
  * fixed install path. */
 int driver_default_hosted_dirs(DriverEnv* env, KitTargetSpec target,
                                DriverHostedDirs* out) {
   (void)env;
   (void)target;
   (void)out;
   return 1;
 }
 
 /* ============================================================
  *   env wiring
  * ============================================================ */
 
 static char g_cache_dir_win[4096];
 
 void driver_env_init(DriverEnv* e) {
   e->heap = &g_heap_libc;
   e->diag = &g_diag_stderr;
   e->file_io.read_all = win_read_all;
   e->file_io.release = win_release;
   e->file_io.open_writer = win_open_writer;
   e->file_io.user = e;
 
   g_execmem_win.page_size = driver_host_page_size_win();
   g_execmem_win.reserve = execmem_reserve_win;
   g_execmem_win.protect = execmem_protect_win;
   g_execmem_win.release = execmem_release_win;
   g_execmem_win.flush_icache = execmem_flush_icache_win;
   g_execmem_win.user = NULL;
   e->execmem = &g_execmem_win;
 
   e->dbg_os = &g_dbg_os_win;
   /* Opt-in compile metrics (KIT_METRICS): one process-wide profiler backs both
    * the heap counters and libkit's scope timers. NULL when unset -- the metrics
    * hot path is then a single pointer check. */
   e->profiler = driver_metrics_profiler();
 
   {
     /* XDG_CACHE_HOME wins if set (cross-platform tooling convention),
      * otherwise fall back to %LOCALAPPDATA%\\kit, otherwise a
      * build-tree-local path. */
     const char* xdg = getenv("XDG_CACHE_HOME");
     const char* lap = getenv("LOCALAPPDATA");
     if (xdg && *xdg) {
       snprintf(g_cache_dir_win, sizeof(g_cache_dir_win), "%s/kit", xdg);
     } else if (lap && *lap) {
       snprintf(g_cache_dir_win, sizeof(g_cache_dir_win), "%s\\kit", lap);
     } else {
       snprintf(g_cache_dir_win, sizeof(g_cache_dir_win), "build\\kit-cache");
     }
     g_cache_dir_win[sizeof(g_cache_dir_win) - 1] = '\0';
     e->cache_dir = g_cache_dir_win;
   }
 
   {
     const char* sde = getenv("SOURCE_DATE_EPOCH");
     if (sde && *sde) {
       char* endp = NULL;
       long long v = strtoll(sde, &endp, 10);
       e->now = (endp != sde && v >= 0) ? (int64_t)v : (int64_t)-1;
     } else {
       time_t t = time(NULL);
       e->now = (t == (time_t)-1) ? (int64_t)-1 : (int64_t)t;
     }
   }
 }
 
 void driver_env_fini(DriverEnv* e) { (void)e; }
 
 KitContext driver_env_to_context(const DriverEnv* e) {
   KitContext c;
   c.heap = e->heap;
   c.file_io = &e->file_io;
   c.diag = e->diag;
   c.profiler = e->profiler;
   c.now = e->now;
   return c;
 }
 
 KitJitHost driver_env_to_jit_host(const DriverEnv* e) {
   KitJitHost h;
   h.execmem = e->execmem;
   return h;
 }
 
 KitDbgHost driver_env_to_dbg_host(const DriverEnv* e) {
   KitDbgHost h;
   h.os = e->dbg_os;
   return h;
 }