kit

windows.c (63784B)

---

 /* Windows host environment. Replaces posix.c and posix_dbg.c on Win32
  * builds; common.c is reused unchanged. Built against the Win32 API with
  * MinGW-w64 in mind.
  *
  * Coverage:
  *   - file_io (CreateFileW/ReadFile/WriteFile + UTF-8 path conversion)
  *   - path helpers (GetFileAttributesExW for exists/mtime, mkdir_p via
  *     CreateDirectoryW, mark_executable is a no-op on NTFS)
  *   - stdin / read_line / edit_temp (GetTempPath + system())
  *   - monotonic time (QueryPerformanceCounter)
  *   - SIGINT shim via SetConsoleCtrlHandler
  *   - dlsym via GetProcAddress over an EnumProcessModules snapshot
  *   - execmem: dual-mapping via CreateFileMappingW + MapViewOfFile; the
  *     write alias is RW, the runtime alias is RX after a protect flip.
  *     Single-mapping fallback uses VirtualAlloc.
  *   - dbg_os: CreateThread for the worker, event objects, vectored
  *     exception handling for SEGV/ILL/BP/etc, __try/__except guarded_copy,
  *     setjmp/longjmp for call_with_catch / thread_abort, SuspendThread +
  *     GetThreadContext for the interrupt path (the interrupt's on_fault
  *     runs on the *caller* thread; natural faults run on the worker
  *     thread inside the VEH, matching POSIX semantics there).
  *
  * The W^X model on Windows mirrors the Linux/FreeBSD memfd path: a single
  * pagefile-backed file-mapping object is mapped twice -- once RW (write
  * alias) and once RX (runtime alias). The dbg code-write path translates
  * a runtime address into the corresponding write alias via the same
  * exec_dual registry the POSIX side uses (re-implemented locally with
  * SRWLock since we don't link the POSIX TUs). Single-mapping reservations
  * (no KIT_PROT_EXEC) just VirtualAlloc a single RW region.
  */
 
 #ifndef WIN32_LEAN_AND_MEAN
 #define WIN32_LEAN_AND_MEAN
 #endif
 #ifndef _WIN32_WINNT
 #define _WIN32_WINNT \
   0x0601 /* Windows 7+: SRWLock, AddVectoredExceptionHandler */
 #endif
 /* windows.h must precede psapi.h/process.h: the mingw SDK headers use
  * windows.h's WINBOOL/DWORD/LPVOID etc. and do not self-include it. Kept in
  * its own include group so a formatter's alphabetic sort can't reorder it
  * after psapi.h (which breaks the mingw cross-build). */
 #include <io.h>
 #include <process.h>
 #include <psapi.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <windows.h>
 #define _CRT_RAND_S /* enable rand_s (OS CSPRNG) */
 #include <setjmp.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/stat.h>
 #include <time.h>
 
 #include "env_internal.h"
 
 extern char** _environ;
 
 /* Win32 dbg interrupt code: a synthetic signo handed up to on_fault. The
  * value just needs to be distinct from real exception codes; we pick a
  * small positive int so it round-trips through the int field of
  * KitDbgOs.interrupt_signo. */
 #define DBG_WIN_INTERRUPT_SIGNO 100
 
 /* ============================================================
  *   UTF-8 <-> UTF-16 path conversion
  * ============================================================ */
 
 /* Convert a UTF-8 path to a freshly-malloc'd wide string. Returns NULL on
  * empty input or allocation failure. Callers free with `free`. */
 static wchar_t* widen(const char* utf8) {
   int need;
   wchar_t* w;
   if (!utf8 || !*utf8) return NULL;
   need = MultiByteToWideChar(CP_UTF8, 0, utf8, -1, NULL, 0);
   if (need <= 0) return NULL;
   w = (wchar_t*)malloc((size_t)need * sizeof(wchar_t));
   if (!w) return NULL;
   if (MultiByteToWideChar(CP_UTF8, 0, utf8, -1, w, need) <= 0) {
     free(w);
     return NULL;
   }
   return w;
 }
 
 static char* narrow(const wchar_t* wide) {
   int need;
   char* out;
   if (!wide) return NULL;
   need = WideCharToMultiByte(CP_UTF8, 0, wide, -1, NULL, 0, NULL, NULL);
   if (need <= 0) return NULL;
   out = (char*)malloc((size_t)need);
   if (!out) return NULL;
   if (WideCharToMultiByte(CP_UTF8, 0, wide, -1, out, need, NULL, NULL) <= 0) {
     free(out);
     return NULL;
   }
   return out;
 }
 
 /* ============================================================
  *   exec_dual registry (write/runtime alias bookkeeping)
  * ============================================================ */
 
 typedef struct ExecDualNode {
   void* write_base;
   void* runtime_base;
   size_t size;
   struct ExecDualNode* next;
 } ExecDualNode;
 
 static ExecDualNode* g_jit_dual_map;
 static SRWLOCK g_jit_dual_map_lock = SRWLOCK_INIT;
 
 static void exec_dual_register_w(void* write_base, void* runtime_base,
                                  size_t size) {
   ExecDualNode* n;
   if (write_base == runtime_base) return;
   n = (ExecDualNode*)malloc(sizeof(*n));
   if (!n) return;
   n->write_base = write_base;
   n->runtime_base = runtime_base;
   n->size = size;
   AcquireSRWLockExclusive(&g_jit_dual_map_lock);
   n->next = g_jit_dual_map;
   g_jit_dual_map = n;
   ReleaseSRWLockExclusive(&g_jit_dual_map_lock);
 }
 
 static void exec_dual_unregister_w(void* runtime_base) {
   ExecDualNode** pp;
   AcquireSRWLockExclusive(&g_jit_dual_map_lock);
   for (pp = &g_jit_dual_map; *pp; pp = &(*pp)->next) {
     if ((*pp)->runtime_base == runtime_base) {
       ExecDualNode* dead = *pp;
       *pp = dead->next;
       free(dead);
       break;
     }
   }
   ReleaseSRWLockExclusive(&g_jit_dual_map_lock);
 }
 
 static int exec_dual_lookup_w(void* runtime_addr, size_t n, void** write_out) {
   ExecDualNode* cur;
   uintptr_t a = (uintptr_t)runtime_addr;
   AcquireSRWLockShared(&g_jit_dual_map_lock);
   for (cur = g_jit_dual_map; cur; cur = cur->next) {
     uintptr_t base = (uintptr_t)cur->runtime_base;
     if (a >= base && a + n <= base + cur->size) {
       *write_out = (void*)((uintptr_t)cur->write_base + (a - base));
       ReleaseSRWLockShared(&g_jit_dual_map_lock);
       return 0;
     }
   }
   ReleaseSRWLockShared(&g_jit_dual_map_lock);
   return 1;
 }
 
 /* ============================================================
  *   exec memory: dual-map via CreateFileMappingW, single via VirtualAlloc
  * ============================================================ */
 
 typedef struct ExecMemTokenWin {
   HANDLE mapping; /* NULL for single-mapping reservations */
   void* write_addr;
   void* runtime_addr;
   size_t size;
 } ExecMemTokenWin;
 
 static DWORD kit_to_win_prot(int prot) {
   int r = (prot & KIT_PROT_READ) != 0;
   int w = (prot & KIT_PROT_WRITE) != 0;
   int x = (prot & KIT_PROT_EXEC) != 0;
   if (x && w) return PAGE_EXECUTE_READWRITE;
   if (x && r) return PAGE_EXECUTE_READ;
   if (x) return PAGE_EXECUTE;
   if (w) return PAGE_READWRITE;
   if (r) return PAGE_READONLY;
   return PAGE_NOACCESS;
 }
 
 static size_t driver_host_page_size_win(void) {
   SYSTEM_INFO si;
   GetSystemInfo(&si);
   return si.dwPageSize ? (size_t)si.dwPageSize : (size_t)0x1000;
 }
 
 static KitStatus execmem_reserve_single_win(size_t size,
                                             KitExecMemRegion* out) {
   void* p = VirtualAlloc(NULL, size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
   if (!p) return KIT_NOMEM;
   out->write = p;
   out->runtime = p;
   out->size = size;
   out->token = NULL;
   return KIT_OK;
 }
 
 static KitStatus execmem_reserve_dual_win(size_t size, KitExecMemRegion* out) {
   HANDLE map;
   void* w;
   void* r;
   ExecMemTokenWin* tok;
   DWORD lo = (DWORD)(size & 0xFFFFFFFFu);
   DWORD hi = (DWORD)((uint64_t)size >> 32);
 
   /* PAGE_EXECUTE_READWRITE on the section object is the max protection any
    * view can request; per-view protections are narrower (RW vs RX). */
   map = CreateFileMappingW(INVALID_HANDLE_VALUE, NULL, PAGE_EXECUTE_READWRITE,
                            hi, lo, NULL);
   if (!map) return KIT_ERR;
 
   w = MapViewOfFile(map, FILE_MAP_READ | FILE_MAP_WRITE, 0, 0, size);
   if (!w) {
     CloseHandle(map);
     return KIT_NOMEM;
   }
   /* Include FILE_MAP_WRITE in the runtime/exec view's mapping access. A view's
    * VirtualProtect ceiling is bounded by its map-access flags, not just the
    * section's max protection: a view mapped READ|EXECUTE can be reprotected to
    * R/RX/RO but NOT to PAGE_READWRITE (err 87). JIT images carry writable
    * runtime segments (an import GOT, .data/.bss) whose final perms are RW, so
    * the exec view must permit write to be VirtualProtect'd RW. Per-segment page
    * protection still enforces W^X (code stays RX, never writable). */
   r = MapViewOfFile(map, FILE_MAP_READ | FILE_MAP_WRITE | FILE_MAP_EXECUTE, 0,
                     0, size);
   if (!r) {
     UnmapViewOfFile(w);
     CloseHandle(map);
     return KIT_NOMEM;
   }
 
   tok = (ExecMemTokenWin*)malloc(sizeof(*tok));
   if (!tok) {
     UnmapViewOfFile(r);
     UnmapViewOfFile(w);
     CloseHandle(map);
     return KIT_NOMEM;
   }
   tok->mapping = map;
   tok->write_addr = w;
   tok->runtime_addr = r;
   tok->size = size;
 
   exec_dual_register_w(w, r, size);
 
   out->write = w;
   out->runtime = r;
   out->size = size;
   out->token = tok;
   return KIT_OK;
 }
 
 static KitStatus execmem_reserve_win(void* user, size_t size, int prot,
                                      KitExecMemRegion* out) {
   (void)user;
   if (!out || !size) return KIT_INVALID;
   if (prot & KIT_PROT_EXEC) return execmem_reserve_dual_win(size, out);
   return execmem_reserve_single_win(size, out);
 }
 
 static KitStatus execmem_protect_win(void* user, void* addr, size_t size,
                                      int prot) {
   DWORD old;
   (void)user;
   return VirtualProtect(addr, size, kit_to_win_prot(prot), &old) ? KIT_OK
                                                                  : KIT_ERR;
 }
 
 static void execmem_release_win(void* user, KitExecMemRegion* region) {
   (void)user;
   if (!region || !region->size) return;
   if (region->token) {
     ExecMemTokenWin* tok = (ExecMemTokenWin*)region->token;
     if (tok->runtime_addr && tok->runtime_addr != tok->write_addr) {
       exec_dual_unregister_w(tok->runtime_addr);
       UnmapViewOfFile(tok->runtime_addr);
     }
     if (tok->write_addr) UnmapViewOfFile(tok->write_addr);
     if (tok->mapping) CloseHandle(tok->mapping);
     free(tok);
   } else if (region->write) {
     VirtualFree(region->write, 0, MEM_RELEASE);
   }
   region->write = NULL;
   region->runtime = NULL;
   region->size = 0;
   region->token = NULL;
 }
 
 static void execmem_flush_icache_win(void* user, void* addr, size_t size) {
   (void)user;
   FlushInstructionCache(GetCurrentProcess(), addr, size);
 }
 
 static KitExecMem g_execmem_win;
 
 /* ============================================================
  *   Writer vtables: HANDLE-backed and stdio-backed
  * ============================================================ */
 
 typedef struct DriverHandleWriter {
   KitWriter base;
   KitHeap* heap;
   HANDLE h;
   KitStatus status;
   uint64_t pos;
 } DriverHandleWriter;
 
 static KitStatus hw_write(KitWriter* w, const void* data, size_t n) {
   DriverHandleWriter* fw = (DriverHandleWriter*)w;
   const unsigned char* p = (const unsigned char*)data;
   if (fw->status != KIT_OK) return fw->status;
   while (n > 0) {
     DWORD chunk = n > 0x40000000u ? 0x40000000u : (DWORD)n;
     DWORD wrote = 0;
     if (!WriteFile(fw->h, p, chunk, &wrote, NULL) || wrote == 0) {
       fw->status = KIT_IO;
       return KIT_IO;
     }
     p += wrote;
     n -= wrote;
     fw->pos += wrote;
   }
   return KIT_OK;
 }
 
 static KitStatus hw_seek(KitWriter* w, uint64_t off) {
   DriverHandleWriter* fw = (DriverHandleWriter*)w;
   LARGE_INTEGER li;
   if (fw->status != KIT_OK) return fw->status;
   li.QuadPart = (LONGLONG)off;
   if (!SetFilePointerEx(fw->h, li, NULL, FILE_BEGIN)) {
     fw->status = KIT_IO;
     return KIT_IO;
   }
   fw->pos = off;
   return KIT_OK;
 }
 
 static uint64_t hw_tell(KitWriter* w) { return ((DriverHandleWriter*)w)->pos; }
 static KitStatus hw_status(KitWriter* w) {
   return ((DriverHandleWriter*)w)->status;
 }
 static void hw_close(KitWriter* w) {
   DriverHandleWriter* fw = (DriverHandleWriter*)w;
   if (fw->h && fw->h != INVALID_HANDLE_VALUE) CloseHandle(fw->h);
   fw->heap->free(fw->heap, fw, sizeof(*fw));
 }
 
 static KitWriter* driver_writer_handle(KitHeap* h, HANDLE fh) {
   DriverHandleWriter* fw = (DriverHandleWriter*)h->alloc(
       h, sizeof(*fw), _Alignof(DriverHandleWriter));
   if (!fw) return NULL;
   fw->base.write = hw_write;
   fw->base.seek = hw_seek;
   fw->base.tell = hw_tell;
   fw->base.status = hw_status;
   fw->base.close = hw_close;
   fw->heap = h;
   fw->h = fh;
   fw->status = KIT_OK;
   fw->pos = 0;
   return &fw->base;
 }
 
 typedef struct DriverStdioWriter {
   KitWriter base;
   KitHeap* heap;
   FILE* fp;
   KitStatus status;
 } DriverStdioWriter;
 
 static KitStatus stdio_w_write(KitWriter* w, const void* data, size_t n) {
   DriverStdioWriter* sw = (DriverStdioWriter*)w;
   if (n) {
     size_t got = fwrite(data, 1, n, sw->fp);
     if (got != n) {
       sw->status = KIT_IO;
       return KIT_IO;
     }
   }
   return KIT_OK;
 }
 static KitStatus stdio_w_seek(KitWriter* w, uint64_t off) {
   DriverStdioWriter* sw = (DriverStdioWriter*)w;
   return fseek(sw->fp, (long)off, SEEK_SET) == 0 ? KIT_OK : KIT_IO;
 }
 static uint64_t stdio_w_tell(KitWriter* w) {
   long t = ftell(((DriverStdioWriter*)w)->fp);
   return t < 0 ? 0u : (uint64_t)t;
 }
 static KitStatus stdio_w_status(KitWriter* w) {
   DriverStdioWriter* sw = (DriverStdioWriter*)w;
   if (sw->status != KIT_OK) return sw->status;
   return ferror(sw->fp) ? KIT_IO : KIT_OK;
 }
 static void stdio_w_close(KitWriter* w) {
   DriverStdioWriter* sw = (DriverStdioWriter*)w;
   fflush(sw->fp);
   sw->heap->free(sw->heap, sw, sizeof(*sw));
 }
 
 static KitWriter* driver_stdio_writer(DriverEnv* e, FILE* fp) {
   DriverStdioWriter* sw = (DriverStdioWriter*)e->heap->alloc(
       e->heap, sizeof(*sw), _Alignof(DriverStdioWriter));
   if (!sw) return NULL;
   sw->base.write = stdio_w_write;
   sw->base.seek = stdio_w_seek;
   sw->base.tell = stdio_w_tell;
   sw->base.status = stdio_w_status;
   sw->base.close = stdio_w_close;
   sw->heap = e->heap;
   sw->fp = fp;
   sw->status = KIT_OK;
   return &sw->base;
 }
 
 KitWriter* driver_stdout_writer(DriverEnv* e) {
   return driver_stdio_writer(e, stdout);
 }
 
 KitWriter* driver_stderr_writer(DriverEnv* e) {
   return driver_stdio_writer(e, stderr);
 }
 
 const char* const* driver_environ(void) { return (const char* const*)_environ; }
 
 /* ============================================================
  *   file_io (CreateFileW + ReadFile/WriteFile)
  * ============================================================ */
 
 static KitStatus win_read_all(void* user, const char* path, KitFileData* out) {
   DriverEnv* env = (DriverEnv*)user;
   wchar_t* wpath;
   HANDLE h;
   LARGE_INTEGER sz;
   size_t size;
   size_t got;
   void* buf;
 
   wpath = widen(path);
   if (!wpath) return KIT_NOT_FOUND;
   h = CreateFileW(wpath, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING,
                   FILE_ATTRIBUTE_NORMAL, NULL);
   free(wpath);
   if (h == INVALID_HANDLE_VALUE) return KIT_NOT_FOUND;
   if (!GetFileSizeEx(h, &sz)) {
     CloseHandle(h);
     return KIT_IO;
   }
   size = (size_t)sz.QuadPart;
   buf = size ? env->heap->alloc(env->heap, size, 1) : NULL;
   if (size && !buf) {
     CloseHandle(h);
     return KIT_NOMEM;
   }
   got = 0;
   while (got < size) {
     DWORD chunk =
         (size - got) > 0x40000000u ? 0x40000000u : (DWORD)(size - got);
     DWORD n = 0;
     if (!ReadFile(h, (unsigned char*)buf + got, chunk, &n, NULL) || n == 0) {
       env->heap->free(env->heap, buf, size);
       CloseHandle(h);
       return KIT_IO;
     }
     got += n;
   }
   CloseHandle(h);
   out->data = (const uint8_t*)buf;
   out->size = size;
   out->token = buf;
   return KIT_OK;
 }
 
 static void win_release(void* user, KitFileData* d) {
   DriverEnv* env = (DriverEnv*)user;
   if (d->token) env->heap->free(env->heap, d->token, d->size);
   d->data = NULL;
   d->size = 0;
   d->token = NULL;
 }
 
 static KitStatus win_open_writer(void* user, const char* path,
                                  KitWriter** out) {
   DriverEnv* env = (DriverEnv*)user;
   wchar_t* wpath = widen(path);
   HANDLE h;
   KitWriter* w;
   if (!wpath) return KIT_IO;
   h = CreateFileW(wpath, GENERIC_WRITE, FILE_SHARE_READ, NULL, CREATE_ALWAYS,
                   FILE_ATTRIBUTE_NORMAL, NULL);
   free(wpath);
   if (h == INVALID_HANDLE_VALUE) return KIT_IO;
   w = driver_writer_handle(env->heap, h);
   if (!w) {
     CloseHandle(h);
     return KIT_NOMEM;
   }
   *out = w;
   return KIT_OK;
 }
 
 /* ============================================================
  *   Path helpers
  * ============================================================ */
 
 int driver_path_exists(const char* path) {
   WIN32_FILE_ATTRIBUTE_DATA fad;
   wchar_t* wpath;
   BOOL ok;
   if (!path) return 0;
   wpath = widen(path);
   if (!wpath) return 0;
   ok = GetFileAttributesExW(wpath, GetFileExInfoStandard, &fad);
   free(wpath);
   return ok ? 1 : 0;
 }
 
 /* Convert a FILETIME (100-ns ticks since 1601-01-01 UTC) to ns since the
  * Unix epoch (1970-01-01 UTC). 11644473600 sec is the gap. */
 static int64_t filetime_to_unix_ns(FILETIME ft) {
   uint64_t t = ((uint64_t)ft.dwHighDateTime << 32) | (uint64_t)ft.dwLowDateTime;
   /* Subtract Win-to-Unix epoch offset in 100-ns ticks. */
   static const uint64_t EPOCH_DIFF_100NS = 116444736000000000ull;
   if (t < EPOCH_DIFF_100NS) t = EPOCH_DIFF_100NS;
   return (int64_t)((t - EPOCH_DIFF_100NS) * 100ull);
 }
 
 int driver_path_mtime_ns(const char* path, int64_t* out) {
   WIN32_FILE_ATTRIBUTE_DATA fad;
   wchar_t* wpath;
   BOOL ok;
   if (!path || !out) return 1;
   wpath = widen(path);
   if (!wpath) return 1;
   ok = GetFileAttributesExW(wpath, GetFileExInfoStandard, &fad);
   free(wpath);
   if (!ok) return 1;
   *out = filetime_to_unix_ns(fad.ftLastWriteTime);
   return 0;
 }
 
 int driver_path_stat(const char* path, uint64_t* out_size,
                      uint64_t* out_mtime_ns, uint8_t* out_filetype) {
   WIN32_FILE_ATTRIBUTE_DATA fad;
   wchar_t* wpath;
   BOOL ok;
   DWORD err;
   if (!path) return 2;
   wpath = widen(path);
   if (!wpath) return 2;
   ok = GetFileAttributesExW(wpath, GetFileExInfoStandard, &fad);
   err = ok ? 0 : GetLastError();
   free(wpath);
   if (!ok) {
     return (err == ERROR_FILE_NOT_FOUND || err == ERROR_PATH_NOT_FOUND) ? 1 : 2;
   }
   *out_mtime_ns = (uint64_t)filetime_to_unix_ns(fad.ftLastWriteTime);
   if (fad.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) {
     *out_size = 0u;
     *out_filetype = 3; /* DIRECTORY */
   } else if (fad.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) {
     *out_size = ((uint64_t)fad.nFileSizeHigh << 32) | fad.nFileSizeLow;
     *out_filetype = 7; /* SYMBOLIC_LINK */
   } else {
     *out_size = ((uint64_t)fad.nFileSizeHigh << 32) | fad.nFileSizeLow;
     *out_filetype = 4; /* REGULAR_FILE */
   }
   return 0;
 }
 
 typedef struct DriverDirEntryRec {
   char* name;
   size_t name_alloc;
   uint32_t name_len;
   uint64_t ino;
   uint64_t size;
   uint64_t mtime_ns;
   uint8_t filetype;
 } DriverDirEntryRec;
 
 struct DriverDirHandle {
   DriverEnv* env;
   DriverDirEntryRec* entries;
   size_t entries_alloc;
   uint64_t count;
 };
 
 static char* driver_join_path(DriverEnv* env, const char* a, const char* b);
 
 DriverDirHandle* driver_open_dir(DriverEnv* env, const char* path) {
   char* pattern;
   wchar_t* wpattern;
   WIN32_FIND_DATAW fd;
   HANDLE h;
   DWORD last;
   DriverDirHandle* dh;
   uint64_t cap = 0;
   uint64_t count = 0;
 
   if (!env || !path) return NULL;
   pattern = driver_join_path(env, path, "*");
   if (!pattern) return NULL;
   wpattern = widen(pattern);
   driver_free(env, pattern, kit_slice_cstr(pattern).len + 1u);
   if (!wpattern) return NULL;
 
   h = FindFirstFileW(wpattern, &fd);
   free(wpattern);
   if (h == INVALID_HANDLE_VALUE) return NULL;
 
   dh = (DriverDirHandle*)env->heap->alloc(env->heap, sizeof(*dh),
                                           _Alignof(DriverDirHandle));
   if (!dh) {
     FindClose(h);
     return NULL;
   }
   memset(dh, 0, sizeof(*dh));
   dh->env = env;
 
   for (;;) {
     char* name;
     size_t name_len;
     DriverDirEntryRec* e;
 
     name = narrow(fd.cFileName);
     if (!name) goto fail;
     if (driver_streq(name, ".") || driver_streq(name, "..")) {
       free(name);
       goto loop_next;
     }
 
     name_len = kit_slice_cstr(name).len;
 
     /* grow entry array */
     if (count >= cap) {
       uint64_t new_cap = cap ? cap * 2u : 8u;
       size_t new_alloc = (size_t)new_cap * sizeof(DriverDirEntryRec);
       DriverDirEntryRec* nv = (DriverDirEntryRec*)env->heap->alloc(
           env->heap, new_alloc, _Alignof(DriverDirEntryRec));
       if (!nv) {
         free(name);
         goto fail;
       }
       if (dh->entries) {
         memcpy(nv, dh->entries, (size_t)count * sizeof(DriverDirEntryRec));
         env->heap->free(env->heap, dh->entries, dh->entries_alloc);
       }
       dh->entries = nv;
       dh->entries_alloc = new_alloc;
       cap = new_cap;
     }
 
     e = &dh->entries[count];
     memset(e, 0, sizeof(*e));
     e->name_alloc = name_len + 1u;
     e->name = (char*)env->heap->alloc(env->heap, e->name_alloc, 1u);
     if (!e->name) {
       free(name);
       goto fail;
     }
     memcpy(e->name, name, name_len + 1u);
     e->name_len = (uint32_t)name_len;
     free(name);
 
     e->size = ((uint64_t)fd.nFileSizeHigh << 32) | fd.nFileSizeLow;
     e->mtime_ns = (uint64_t)filetime_to_unix_ns(fd.ftLastWriteTime);
     if (fd.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY)
       e->filetype = 3;
     else if (fd.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)
       e->filetype = 7;
     else
       e->filetype = 4;
     ++count;
 
   loop_next:
     if (!FindNextFileW(h, &fd)) {
       last = GetLastError();
       if (last == ERROR_NO_MORE_FILES) break;
       goto fail;
     }
   }
 
   FindClose(h);
   dh->count = count;
   return dh;
 
 fail:
   FindClose(h);
   driver_close_dir(env, dh);
   return NULL;
 }
 
 int driver_read_dir_entry(DriverDirHandle* h, uint64_t index,
                           const char** out_name, uint32_t* out_name_len,
                           uint64_t* out_ino, uint64_t* out_size,
                           uint64_t* out_mtime_ns, uint8_t* out_filetype) {
   DriverDirEntryRec* e;
   if (!h || index >= h->count) return 1;
   e = &h->entries[index];
   *out_name = e->name;
   *out_name_len = e->name_len;
   *out_ino = e->ino;
   *out_size = e->size;
   *out_mtime_ns = e->mtime_ns;
   *out_filetype = e->filetype;
   return 0;
 }
 
 void driver_close_dir(DriverEnv* env, DriverDirHandle* h) {
   uint64_t i;
   if (!h) return;
   if (!env) env = h->env;
   for (i = 0; i < h->count; ++i) {
     DriverDirEntryRec* e = &h->entries[i];
     if (e->name) env->heap->free(env->heap, e->name, e->name_alloc);
   }
   if (h->entries) env->heap->free(env->heap, h->entries, h->entries_alloc);
   env->heap->free(env->heap, h, sizeof(*h));
 }
 
 int driver_mkdir_p(DriverEnv* env, const char* path) {
   size_t len;
   char* buf;
   size_t i;
   if (!path || !path[0]) return 1;
   len = kit_slice_cstr(path).len;
   buf = (char*)driver_alloc(env, len + 1);
   if (!buf) return 1;
   memcpy(buf, path, len + 1);
 
   /* Walk separators, accepting both '/' and '\\'. Skip the drive prefix
    * ("C:") and the leading separator(s) of a UNC path so we don't try to
    * CreateDirectory("\\\\server"). */
   for (i = 0; i <= len; ++i) {
     int at_end = (i == len);
     char ch = buf[i];
     int is_sep = (ch == '/' || ch == '\\');
     int do_create = at_end || is_sep;
     if (!do_create) continue;
     if (!at_end) buf[i] = '\0';
     /* Skip pure roots: "", ".", drive-letter-only ("C:"), and UNC roots
      * ("\\\\server" or "\\\\server\\share"). */
     if (buf[0] == '\0') {
       /* nothing yet */
     } else if (driver_streq(buf, ".")) {
       /* skip */
     } else if (i >= 2 && buf[1] == ':' && buf[2] == '\0') {
       /* "C:" — drive prefix only */
     } else {
       wchar_t* wpath = widen(buf);
       if (!wpath) {
         driver_free(env, buf, len + 1);
         return 1;
       }
       if (!CreateDirectoryW(wpath, NULL)) {
         DWORD err = GetLastError();
         if (err != ERROR_ALREADY_EXISTS) {
           free(wpath);
           driver_free(env, buf, len + 1);
           return 1;
         }
       }
       {
         WIN32_FILE_ATTRIBUTE_DATA fad;
         BOOL ok = GetFileAttributesExW(wpath, GetFileExInfoStandard, &fad);
         free(wpath);
         if (!ok || !(fad.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY)) {
           driver_free(env, buf, len + 1);
           return 1;
         }
       }
     }
     if (!at_end) buf[i] = ch;
   }
 
   driver_free(env, buf, len + 1);
   return 0;
 }
 
 int driver_mark_executable_output(const char* path) {
   /* Windows has no Unix +x bit; file extension governs executability and
    * NTFS ACLs are inherited from the parent directory. No-op success. */
   (void)path;
   return 0;
 }
 
 /* ---------------- self executable path ---------------- */
 /* GetModuleFileNameW(NULL) reports the path of the running image. A return
  * equal to the buffer size means truncation (older Windows doesn't fail), so
  * grow until the result fits, then narrow to UTF-8. */
 int driver_self_exe_path(DriverEnv* env, char** out, size_t* out_size) {
   DWORD cap = 256;
   wchar_t* wbuf = NULL;
   char* narrowed;
   size_t size;
   if (!env || !out || !out_size) return 1;
   for (;;) {
     wchar_t* nb = (wchar_t*)realloc(wbuf, (size_t)cap * sizeof(wchar_t));
     DWORD n;
     if (!nb) {
       free(wbuf);
       return 1;
     }
     wbuf = nb;
     n = GetModuleFileNameW(NULL, wbuf, cap);
     if (n == 0) {
       free(wbuf);
       return 1;
     }
     if (n < cap) break; /* fit: n excludes the terminator on success */
     if (cap >= (1u << 20)) {
       free(wbuf);
       return 1;
     }
     cap *= 2;
   }
   narrowed = narrow(wbuf); /* malloc'd UTF-8 */
   free(wbuf);
   if (!narrowed) return 1;
   size = driver_strlen(narrowed) + 1u;
   *out = (char*)driver_alloc(env, size);
   if (!*out) {
     free(narrowed);
     return 1;
   }
   driver_memcpy(*out, narrowed, size);
   *out_size = size;
   free(narrowed);
   return 0;
 }
 
 /* ---------------- link helpers (install) ---------------- */
 
 #ifndef SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE
 #define SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE 0x2
 #endif
 
 int driver_create_symlink(const char* target, const char* link_path) {
   wchar_t* wtarget;
   wchar_t* wlink;
   BOOLEAN ok;
   if (!target || !link_path) return 1;
   wtarget = widen(target);
   wlink = widen(link_path);
   if (!wtarget || !wlink) {
     free(wtarget);
     free(wlink);
     return 1;
   }
   /* Prefer the unprivileged (Developer Mode) flag; fall back without it for
    * older hosts that reject the unknown flag. */
   ok = CreateSymbolicLinkW(wlink, wtarget,
                            SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE);
   if (!ok) ok = CreateSymbolicLinkW(wlink, wtarget, 0);
   free(wtarget);
   free(wlink);
   return ok ? 0 : 1;
 }
 
 int driver_create_hardlink(const char* target, const char* link_path) {
   wchar_t* wtarget;
   wchar_t* wlink;
   BOOL ok;
   if (!target || !link_path) return 1;
   wtarget = widen(target);
   wlink = widen(link_path);
   if (!wtarget || !wlink) {
     free(wtarget);
     free(wlink);
     return 1;
   }
   ok = CreateHardLinkW(wlink, wtarget, NULL);
   free(wtarget);
   free(wlink);
   return ok ? 0 : 1;
 }
 
 int driver_remove_file(const char* path) {
   wchar_t* wpath;
   BOOL ok;
   if (!path) return 1;
   wpath = widen(path);
   if (!wpath) return 1;
   ok = DeleteFileW(wpath);
   if (!ok) {
     DWORD err = GetLastError();
     if (err == ERROR_FILE_NOT_FOUND || err == ERROR_PATH_NOT_FOUND) ok = TRUE;
   }
   free(wpath);
   return ok ? 0 : 1;
 }
 
 int driver_path_lexists(const char* path) {
   wchar_t* wpath;
   DWORD attr;
   if (!path) return 0;
   wpath = widen(path);
   if (!wpath) return 0;
   /* GetFileAttributesW does not traverse reparse points, so a dangling
    * symlink reports its own attributes rather than failing. */
   attr = GetFileAttributesW(wpath);
   free(wpath);
   return attr != INVALID_FILE_ATTRIBUTES;
 }
 
 static char* driver_join_path(DriverEnv* env, const char* a, const char* b) {
   size_t al = kit_slice_cstr(a).len;
   size_t bl = kit_slice_cstr(b).len;
   int slash = al > 0 && a[al - 1u] != '/' && a[al - 1u] != '\\';
   char* out = (char*)driver_alloc(env, al + (slash ? 1u : 0u) + bl + 1u);
   if (!out) return NULL;
   memcpy(out, a, al);
   if (slash) out[al++] = '/';
   memcpy(out + al, b, bl);
   out[al + bl] = '\0';
   return out;
 }
 
 static int driver_walk_regular_files_at(DriverEnv* env, const char* dir,
                                         const char* rel, DriverWalkFileFn cb,
                                         void* user) {
   char* pattern;
   wchar_t* wpattern;
   WIN32_FIND_DATAW fd;
   HANDLE h;
   DWORD last;
   int rc = 1;
 
   pattern = driver_join_path(env, dir, "*");
   if (!pattern) return 1;
   wpattern = widen(pattern);
   driver_free(env, pattern, kit_slice_cstr(pattern).len + 1u);
   if (!wpattern) return 1;
 
   h = FindFirstFileW(wpattern, &fd);
   free(wpattern);
   if (h == INVALID_HANDLE_VALUE) {
     last = GetLastError();
     return last == ERROR_FILE_NOT_FOUND ? 0 : 1;
   }
 
   for (;;) {
     char* name = narrow(fd.cFileName);
     char* child = NULL;
     char* child_rel = NULL;
     int child_rc = 0;
     if (!name) goto loop_fail;
     if (driver_streq(name, ".") || driver_streq(name, "..")) {
       free(name);
       goto loop_next;
     }
     child = driver_join_path(env, dir, name);
     child_rel = rel && rel[0] ? driver_join_path(env, rel, name)
                               : driver_join_path(env, "", name);
     if (!child || !child_rel) goto loop_fail;
     if ((fd.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0) {
       if ((fd.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0) {
         child_rc = 1;
       } else {
         child_rc =
             driver_walk_regular_files_at(env, child, child_rel, cb, user);
       }
     } else {
       child_rc = cb(user, child, child_rel, 0);
     }
     if (child_rel)
       driver_free(env, child_rel, kit_slice_cstr(child_rel).len + 1u);
     if (child) driver_free(env, child, kit_slice_cstr(child).len + 1u);
     free(name);
     if (child_rc) goto out;
 
   loop_next:
     if (!FindNextFileW(h, &fd)) break;
     continue;
 
   loop_fail:
     if (child_rel)
       driver_free(env, child_rel, kit_slice_cstr(child_rel).len + 1u);
     if (child) driver_free(env, child, kit_slice_cstr(child).len + 1u);
     if (name) free(name);
     goto out;
   }
 
   last = GetLastError();
   rc = last == ERROR_NO_MORE_FILES ? 0 : 1;
 
 out:
   FindClose(h);
   return rc;
 }
 
 int driver_walk_regular_files(DriverEnv* env, const char* root,
                               DriverWalkFileFn cb, void* user) {
   if (!env || !root || !root[0] || !cb) return 1;
   return driver_walk_regular_files_at(env, root, "", cb, user);
 }
 
 /* ============================================================
  *   Time
  * ============================================================ */
 
 uint64_t driver_now_ns(void) {
   /* QueryPerformanceCounter is monotonic across cores on every supported
    * Windows version since Vista. */
   LARGE_INTEGER freq;
   LARGE_INTEGER ctr;
   if (!QueryPerformanceFrequency(&freq) || freq.QuadPart <= 0) return 0;
   if (!QueryPerformanceCounter(&ctr)) return 0;
   /* Avoid 128-bit multiply: split ticks into integer-seconds and remainder. */
   {
     int64_t sec = ctr.QuadPart / freq.QuadPart;
     int64_t rem = ctr.QuadPart % freq.QuadPart;
     return (uint64_t)sec * 1000000000ull +
            (uint64_t)((rem * 1000000000) / freq.QuadPart);
   }
 }
 
 int driver_random_bytes(uint8_t* out, size_t n) {
   /* rand_s draws from the OS CSPRNG (RtlGenRandom) without linking bcrypt. */
   size_t off = 0;
   if (!out) return 1;
   while (off < n) {
     unsigned int v;
     size_t chunk;
     if (rand_s(&v) != 0) return 1;
     chunk = n - off < sizeof v ? n - off : sizeof v;
     memcpy(out + off, &v, chunk);
     off += chunk;
   }
   return 0;
 }
 
 /* ============================================================
  *   load helpers
  * ============================================================ */
 
 int driver_load_bytes(const KitFileIO* io, const char* tool, const char* path,
                       DriverLoad* out, KitSlice* in) {
   out->loaded = 0;
   out->fd.data = NULL;
   out->fd.size = 0;
   out->fd.token = NULL;
   if (!io || !io->read_all) {
     driver_errf(tool, "host file I/O unavailable");
     return 1;
   }
   if (io->read_all(io->user, path, &out->fd) != KIT_OK) {
     driver_errf(tool, "failed to read: %.*s",
                 KIT_SLICE_ARG(kit_slice_cstr(path)));
     return 1;
   }
   out->loaded = 1;
   in->data = out->fd.data;
   in->len = out->fd.size;
   return 0;
 }
 
 void driver_release_bytes(const KitFileIO* io, DriverLoad* lf) {
   if (!lf || !lf->loaded) return;
   if (io && io->release) io->release(io->user, &lf->fd);
   lf->loaded = 0;
 }
 
 /* ============================================================
  *   stdin / edit_temp / read_line
  * ============================================================ */
 
 int driver_read_stdin(DriverEnv* e, uint8_t** out_data, size_t* out_size) {
   size_t cap = 4096;
   size_t len = 0;
   uint8_t* buf = e->heap->alloc(e->heap, cap, 1);
   HANDLE h = GetStdHandle(STD_INPUT_HANDLE);
   if (!buf) return 0;
   for (;;) {
     DWORD n;
     if (len == cap) {
       size_t newcap = cap * 2;
       uint8_t* nb = e->heap->realloc(e->heap, buf, cap, newcap, 1);
       if (!nb) {
         e->heap->free(e->heap, buf, cap);
         return 0;
       }
       buf = nb;
       cap = newcap;
     }
     if (!ReadFile(h, buf + len, (DWORD)(cap - len), &n, NULL)) {
       if (GetLastError() == ERROR_BROKEN_PIPE) break; /* EOF on pipe */
       e->heap->free(e->heap, buf, cap);
       return 0;
     }
     if (n == 0) break;
     len += n;
   }
   if (len < cap) {
     uint8_t* shrunk = len ? e->heap->realloc(e->heap, buf, cap, len, 1) : NULL;
     if (len && !shrunk) {
       *out_data = buf;
       *out_size = cap;
       return 1;
     }
     if (!len) {
       e->heap->free(e->heap, buf, cap);
       buf = NULL;
     } else {
       buf = shrunk;
     }
   }
   *out_data = buf;
   *out_size = len;
   return 1;
 }
 
 static int driver_write_handle_all(HANDLE h, const uint8_t* data, size_t n) {
   size_t off = 0;
   while (off < n) {
     DWORD chunk = (n - off) > 0x40000000u ? 0x40000000u : (DWORD)(n - off);
     DWORD wr = 0;
     if (!WriteFile(h, data + off, chunk, &wr, NULL) || wr == 0) return 0;
     off += wr;
   }
   return 1;
 }
 
 int driver_edit_temp(DriverEnv* e, const char* suffix, const uint8_t* initial,
                      size_t initial_size, uint8_t** out_data,
                      size_t* out_size) {
   /* Windows temp-file dance:
    *   - GetTempPathW gives us %TMP%/%TEMP%/%USERPROFILE% with trailing '\\'.
    *   - GetTempFileNameW makes a unique "<dir>\\cfXXXX.tmp" path. We ignore
    *     the ".tmp" and append our requested suffix below by renaming.
    *   - We rename to "<base><suffix>" so the editor sees the right extension.
    *   - Editor is launched via system() so shell quoting / PATH lookup is
    *     handled by cmd.exe.
    */
   wchar_t tmp_dir[MAX_PATH + 1];
   wchar_t tmp_path[MAX_PATH + 1];
   DWORD got;
   HANDLE h = INVALID_HANDLE_VALUE;
   wchar_t* wsuffix = NULL;
   wchar_t final_path[MAX_PATH + 64];
   size_t final_len;
   int ok = 0;
   KitFileData fd_data;
   const char* editor;
   char* cmd = NULL;
   int rc;
   size_t cmd_cap;
   char utf8_path[MAX_PATH * 4 + 1];
   int utf8_len;
 
   if (!out_data || !out_size) return 0;
   *out_data = NULL;
   *out_size = 0;
 
   got = GetTempPathW(MAX_PATH + 1, tmp_dir);
   if (got == 0 || got > MAX_PATH) return 0;
   if (GetTempFileNameW(tmp_dir, L"cf", 0, tmp_path) == 0) return 0;
 
   /* Build the final path = tmp_path with ".tmp" stripped + requested suffix.
    * GetTempFileNameW already created the file at tmp_path; we MoveFileEx to
    * rename it to final_path. */
   {
     size_t tplen = wcslen(tmp_path);
     /* Strip the ".tmp" extension GetTempFileNameW appends. */
     if (tplen >= 4 && tmp_path[tplen - 4] == L'.') tplen -= 4;
     if (tplen >= sizeof(final_path) / sizeof(wchar_t) - 16) {
       DeleteFileW(tmp_path);
       return 0;
     }
     memcpy(final_path, tmp_path, tplen * sizeof(wchar_t));
     final_path[tplen] = L'\0';
     final_len = tplen;
     if (suffix && *suffix) {
       wsuffix = widen(suffix);
       if (!wsuffix) {
         DeleteFileW(tmp_path);
         return 0;
       }
       {
         size_t sl = wcslen(wsuffix);
         if (final_len + sl + 1 >= sizeof(final_path) / sizeof(wchar_t)) {
           free(wsuffix);
           DeleteFileW(tmp_path);
           return 0;
         }
         memcpy(final_path + final_len, wsuffix, sl * sizeof(wchar_t));
         final_len += sl;
         final_path[final_len] = L'\0';
       }
       free(wsuffix);
     }
     if (!MoveFileExW(tmp_path, final_path, MOVEFILE_REPLACE_EXISTING)) {
       DeleteFileW(tmp_path);
       return 0;
     }
   }
 
   /* Open the renamed file and write initial contents. */
   h = CreateFileW(final_path, GENERIC_WRITE, FILE_SHARE_READ, NULL,
                   TRUNCATE_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
   if (h == INVALID_HANDLE_VALUE) goto out;
   if (initial_size &&
       !driver_write_handle_all(h, initial ? initial : (const uint8_t*)"",
                                initial_size))
     goto out;
   CloseHandle(h);
   h = INVALID_HANDLE_VALUE;
 
   /* Convert final_path back to UTF-8 for the editor command. */
   utf8_len = WideCharToMultiByte(CP_UTF8, 0, final_path, -1, utf8_path,
                                  (int)sizeof(utf8_path), NULL, NULL);
   if (utf8_len <= 0) goto out;
 
   editor = getenv("VISUAL");
   if (!editor || !*editor) editor = getenv("EDITOR");
   if (!editor || !*editor) editor = "notepad";
   cmd_cap = strlen(editor) + (size_t)utf8_len + 16;
   cmd = (char*)malloc(cmd_cap);
   if (!cmd) goto out;
   /* Wrap the entire command in extra quotes so cmd.exe /S doesn't strip
    * matching outer quotes when the editor path itself has spaces. */
   rc = snprintf(cmd, cmd_cap, "\"\"%s\" \"%s\"\"", editor, utf8_path);
   if (rc < 0 || (size_t)rc >= cmd_cap) goto out;
   if (system(cmd) != 0) goto out;
 
   fd_data.data = NULL;
   fd_data.size = 0;
   fd_data.token = NULL;
   if (win_read_all(e, utf8_path, &fd_data) != KIT_OK) goto out;
   *out_data = (uint8_t*)fd_data.data;
   *out_size = fd_data.size;
   ok = 1;
 
 out:
   if (h != INVALID_HANDLE_VALUE) CloseHandle(h);
   if (cmd) free(cmd);
   DeleteFileW(final_path);
   return ok;
 }
 
 int driver_read_line(char* buf, size_t cap) {
   size_t len = 0;
   if (!buf || cap < 2) return -1;
   for (;;) {
     int c = fgetc(stdin);
     if (c == EOF) {
       buf[len] = '\0';
       if (ferror(stdin)) return -1;
       if (len == 0) return 0;
       return (int)len;
     }
     if (c == '\n') {
       /* Strip a trailing CR if present (CRLF line ending). */
       if (len > 0 && buf[len - 1] == '\r') --len;
       buf[len] = '\0';
       return (int)len;
     }
     if (len + 1 < cap) buf[len++] = (char)c;
   }
 }
 
 static int win_line_history_add(DriverEnv* env, DriverLineHistory* h,
                                 const char* line, size_t len) {
   char** ni;
   size_t* ns;
   char* copy;
   uint32_t nc;
   if (!env || !h || !line || len == 0) return 0;
   if (h->count == h->cap) {
     size_t old_items = (size_t)h->cap * sizeof(*h->items);
     size_t new_items;
     size_t old_sizes = (size_t)h->cap * sizeof(*h->sizes);
     size_t new_sizes;
     nc = h->cap ? h->cap * 2u : 32u;
     new_items = (size_t)nc * sizeof(*h->items);
     new_sizes = (size_t)nc * sizeof(*h->sizes);
     ni = (char**)env->heap->realloc(env->heap, h->items, old_items, new_items,
                                     _Alignof(char*));
     if (!ni) return 1;
     h->items = ni;
     ns = (size_t*)env->heap->realloc(env->heap, h->sizes, old_sizes, new_sizes,
                                      _Alignof(size_t));
     if (!ns) return 1;
     h->sizes = ns;
     h->cap = nc;
   }
   copy = (char*)driver_alloc(env, len + 1u);
   if (!copy) return 1;
   memcpy(copy, line, len);
   copy[len] = '\0';
   h->items[h->count] = copy;
   h->sizes[h->count] = len + 1u;
   h->count++;
   return 0;
 }
 
 int driver_read_line_edit(DriverEnv* env, const char* prompt, char* buf,
                           size_t cap, DriverLineHistory* hist,
                           DriverLineCompleteFn complete, void* complete_user) {
   int n;
   (void)complete;
   (void)complete_user;
   if (prompt && *prompt) {
     fputs(prompt, stdout);
     fflush(stdout);
   }
   n = driver_read_line(buf, cap);
   if (n > 0 && hist) (void)win_line_history_add(env, hist, buf, (size_t)n);
   return n;
 }
 
 /* ============================================================
  *   dlsym via GetProcAddress over loaded modules
  * ============================================================ */
 
 /* Snapshot the loaded modules at first call and remember them. We don't
  * track DLL load/unload events; that's a reasonable trade-off for a JIT
  * (the relevant DLLs -- ucrt, kernel32, the kit binary -- are loaded
  * before the JIT extern resolver runs). */
 static HMODULE g_dlsym_modules[256];
 static DWORD g_dlsym_count;
 static SRWLOCK g_dlsym_lock = SRWLOCK_INIT;
 static int g_dlsym_inited;
 
 static void dlsym_init_once(void) {
   HANDLE proc;
   DWORD need = 0;
   AcquireSRWLockExclusive(&g_dlsym_lock);
   if (g_dlsym_inited) {
     ReleaseSRWLockExclusive(&g_dlsym_lock);
     return;
   }
   proc = GetCurrentProcess();
   if (EnumProcessModules(proc, g_dlsym_modules, sizeof(g_dlsym_modules),
                          &need)) {
     DWORD have = need / (DWORD)sizeof(HMODULE);
     g_dlsym_count = have > (DWORD)(sizeof(g_dlsym_modules) / sizeof(HMODULE))
                         ? (DWORD)(sizeof(g_dlsym_modules) / sizeof(HMODULE))
                         : have;
   } else {
     /* Fall back to the executable module and the CRT/kernel essentials. */
     g_dlsym_modules[0] = GetModuleHandleW(NULL);
     g_dlsym_modules[1] = GetModuleHandleW(L"kernel32.dll");
     g_dlsym_modules[2] = GetModuleHandleW(L"msvcrt.dll");
     g_dlsym_modules[3] = GetModuleHandleW(L"ucrtbase.dll");
     g_dlsym_count = 4;
   }
   g_dlsym_inited = 1;
   ReleaseSRWLockExclusive(&g_dlsym_lock);
 }
 
 static void* win_dlsym(const char* name) {
   DWORD i;
   if (!name) return NULL;
   dlsym_init_once();
   /* Try the source-level name; if that misses and there's a leading '_'
    * (Mach-O-mangled), try without it. */
   AcquireSRWLockShared(&g_dlsym_lock);
   for (i = 0; i < g_dlsym_count; ++i) {
     void* p;
     if (!g_dlsym_modules[i]) continue;
     p = (void*)GetProcAddress(g_dlsym_modules[i], name);
     if (p) {
       ReleaseSRWLockShared(&g_dlsym_lock);
       return p;
     }
   }
   if (name[0] == '_' && name[1] != '\0') {
     for (i = 0; i < g_dlsym_count; ++i) {
       void* p;
       if (!g_dlsym_modules[i]) continue;
       p = (void*)GetProcAddress(g_dlsym_modules[i], name + 1);
       if (p) {
         ReleaseSRWLockShared(&g_dlsym_lock);
         return p;
       }
     }
   }
   ReleaseSRWLockShared(&g_dlsym_lock);
   return NULL;
 }
 
 static int win_name_eq(KitSlice s, const char* lit, size_t litlen) {
   return s.len == litlen && memcmp(s.s, lit, litlen) == 0;
 }
 
 /* libucrt-static stdio entry points handed to JIT'd code.
  *
  * With kit's UCRT profile (__USE_MINGW_ANSI_STDIO=0), mingw's <stdio.h>
  * resolves the printf/scanf family to out-of-line wrappers that live ONLY in
  * libucrt.a — ucrtbase.dll exports just the __stdio_common_v* cores (and
  * __local_stdio_* helpers the wrappers call). An AOT `kit cc` link pulls the
  * wrappers from libucrt.a; the in-process JIT (`kit run`) resolves externs via
  * dlsym over loaded DLLs (win_dlsym), which can't see them, so a printf-using
  * JIT program fails with an undefined `printf`. kit.exe statically links
  * libucrt.a, so taking each wrapper's address here pulls its definition into
  * our own image and lets us hand the JIT our copy. Functions that ARE
  * ucrtbase.dll exports (puts, fputs, fflush, putchar, __stdio_common_v*,
  * __acrt_iob_func, …) resolve through win_dlsym above and never reach this
  * table. The __local_stdio_*_options helpers' storage only ever holds the
  * default (0) flags, so sharing one instance between the host and the JIT'd
  * program is benign. */
 void* driver_dlsym_resolver(void* user, KitSlice name_s) {
   void* p;
   (void)user;
   if (!name_s.s || name_s.len == 0) return NULL;
   p = win_dlsym(name_s.s);
   if (p) return p;
   /* Match by source name; #fn stringizes it and sizeof-1 is its length. */
 #define KIT_STATIC_STDIO(fn) \
   if (win_name_eq(name_s, #fn, sizeof(#fn) - 1u)) return (void*)(uintptr_t)&fn
   KIT_STATIC_STDIO(__local_stdio_printf_options);
   KIT_STATIC_STDIO(__local_stdio_scanf_options);
   KIT_STATIC_STDIO(printf);
   KIT_STATIC_STDIO(fprintf);
   KIT_STATIC_STDIO(sprintf);
   KIT_STATIC_STDIO(snprintf);
   KIT_STATIC_STDIO(_snprintf);
   KIT_STATIC_STDIO(vprintf);
   KIT_STATIC_STDIO(vfprintf);
   KIT_STATIC_STDIO(vsprintf);
   KIT_STATIC_STDIO(vsnprintf);
   KIT_STATIC_STDIO(_vsnprintf);
   KIT_STATIC_STDIO(scanf);
   KIT_STATIC_STDIO(fscanf);
   KIT_STATIC_STDIO(sscanf);
   KIT_STATIC_STDIO(_snscanf);
   KIT_STATIC_STDIO(vscanf);
   KIT_STATIC_STDIO(vfscanf);
   KIT_STATIC_STDIO(vsscanf);
   KIT_STATIC_STDIO(_scprintf);
   KIT_STATIC_STDIO(_vscprintf);
 #undef KIT_STATIC_STDIO
   return NULL;
 }
 
 /* ============================================================
  *   SIGINT shim via SetConsoleCtrlHandler
  * ============================================================ */
 
 static void (*g_ctrlc_cb)(void*);
 static void* g_ctrlc_cb_user;
 
 static BOOL WINAPI ctrlc_trampoline(DWORD type) {
   if (type == CTRL_C_EVENT || type == CTRL_BREAK_EVENT) {
     if (g_ctrlc_cb) g_ctrlc_cb(g_ctrlc_cb_user);
     return TRUE; /* handled */
   }
   return FALSE;
 }
 
 int driver_install_sigint(void (*cb)(void*), void* user) {
   g_ctrlc_cb = cb;
   g_ctrlc_cb_user = user;
   return SetConsoleCtrlHandler(ctrlc_trampoline, TRUE) ? 0 : 1;
 }
 
 void driver_restore_sigint(void) {
   SetConsoleCtrlHandler(ctrlc_trampoline, FALSE);
   g_ctrlc_cb = NULL;
   g_ctrlc_cb_user = NULL;
 }
 
 /* No fault-guard on Windows yet (the POSIX path uses sigaction + sigsetjmp; a
  * vectored-exception-handler port is a follow-up). Run the entry directly so
  * `kit run` still executes the program; on_crash never fires. */
 int driver_run_with_crash_guard(DriverEnv* env, KitArchKind arch,
                                 DriverRunEntryFn entry, int argc, char** argv,
                                 int* ret_out, DriverRunCrashFn on_crash,
                                 void* user) {
   (void)env;
   (void)arch;
   (void)on_crash;
   (void)user;
   *ret_out = entry(argc, argv);
   return 0;
 }
 
 /* ============================================================
  *   Win32 CONTEXT <-> KitUnwindFrame marshalling
  * ============================================================ */
 
 /* Inline per-arch marshalling: the Win32 dbg path is short enough that a
  * separate uctx_*_windows.c isn't worth the extra TU. Only the host arch
  * matters; cross-arch debug isn't a Win32 concern (the worker runs in our
  * own process). */
 
 #if defined(_M_X64) || defined(__x86_64__)
 static void ctx_to_frame(const CONTEXT* c, KitUnwindFrame* f) {
   memset(f, 0, sizeof(*f));
   f->pc = (uint64_t)c->Rip;
   f->cfa = (uint64_t)c->Rsp;
   /* SysV DWARF mapping: rax=0, rdx=1, rcx=2, rbx=3, rsi=4, rdi=5, rbp=6,
    * rsp=7, r8..r15=8..15. We use the same mapping so kit's DWARF reader
    * can interpret these directly. */
   f->regs[0] = c->Rax;
   f->regs[1] = c->Rdx;
   f->regs[2] = c->Rcx;
   f->regs[3] = c->Rbx;
   f->regs[4] = c->Rsi;
   f->regs[5] = c->Rdi;
   f->regs[6] = c->Rbp;
   f->regs[7] = c->Rsp;
   f->regs[8] = c->R8;
   f->regs[9] = c->R9;
   f->regs[10] = c->R10;
   f->regs[11] = c->R11;
   f->regs[12] = c->R12;
   f->regs[13] = c->R13;
   f->regs[14] = c->R14;
   f->regs[15] = c->R15;
 }
 
 static void frame_to_ctx(const KitUnwindFrame* f, CONTEXT* c) {
   c->Rip = f->pc;
   c->Rax = f->regs[0];
   c->Rdx = f->regs[1];
   c->Rcx = f->regs[2];
   c->Rbx = f->regs[3];
   c->Rsi = f->regs[4];
   c->Rdi = f->regs[5];
   c->Rbp = f->regs[6];
   c->Rsp = f->regs[7];
   c->R8 = f->regs[8];
   c->R9 = f->regs[9];
   c->R10 = f->regs[10];
   c->R11 = f->regs[11];
   c->R12 = f->regs[12];
   c->R13 = f->regs[13];
   c->R14 = f->regs[14];
   c->R15 = f->regs[15];
 }
 #elif defined(_M_ARM64) || defined(__aarch64__)
 static void ctx_to_frame(const CONTEXT* c, KitUnwindFrame* f) {
   unsigned i;
   memset(f, 0, sizeof(*f));
   f->pc = (uint64_t)c->Pc;
   f->cfa = (uint64_t)c->Sp;
   for (i = 0; i < 31; ++i) f->regs[i] = c->X[i];
   f->regs[31] = c->Sp;
 }
 
 static void frame_to_ctx(const KitUnwindFrame* f, CONTEXT* c) {
   unsigned i;
   c->Pc = f->pc;
   for (i = 0; i < 31; ++i) c->X[i] = f->regs[i];
   c->Sp = f->regs[31];
 }
 #else
 static void ctx_to_frame(const CONTEXT* c, KitUnwindFrame* f) {
   (void)c;
   memset(f, 0, sizeof(*f));
 }
 static void frame_to_ctx(const KitUnwindFrame* f, CONTEXT* c) {
   (void)f;
   (void)c;
 }
 #endif
 
 /* Map a Win32 exception code to the POSIX-style signo the dbg session
  * expects. Anything we don't recognize falls through as a generic SEGV. */
 static int exception_code_to_signo(DWORD code) {
   switch (code) {
     case EXCEPTION_BREAKPOINT:
     case EXCEPTION_SINGLE_STEP:
       return 5; /* SIGTRAP */
     case EXCEPTION_ILLEGAL_INSTRUCTION:
     case EXCEPTION_PRIV_INSTRUCTION:
       return 4; /* SIGILL */
     case EXCEPTION_INT_DIVIDE_BY_ZERO:
     case EXCEPTION_INT_OVERFLOW:
     case EXCEPTION_FLT_DIVIDE_BY_ZERO:
     case EXCEPTION_FLT_OVERFLOW:
     case EXCEPTION_FLT_UNDERFLOW:
     case EXCEPTION_FLT_INVALID_OPERATION:
     case EXCEPTION_FLT_DENORMAL_OPERAND:
     case EXCEPTION_FLT_INEXACT_RESULT:
     case EXCEPTION_FLT_STACK_CHECK:
       return 8; /* SIGFPE */
     case EXCEPTION_DATATYPE_MISALIGNMENT:
       return 7; /* SIGBUS */
     case EXCEPTION_ACCESS_VIOLATION:
     case EXCEPTION_IN_PAGE_ERROR:
     case EXCEPTION_ARRAY_BOUNDS_EXCEEDED:
     case EXCEPTION_STACK_OVERFLOW:
     default:
       return 11; /* SIGSEGV */
   }
 }
 
 /* ============================================================
  *   dbg_os: threads, events, exceptions, guarded_copy
  * ============================================================ */
 
 static KitDbgSignalOps g_dbg_ops;
 static int g_dbg_ops_set;
 static void* g_dbg_session;
 static DWORD g_dbg_worker_tid;
 static int g_dbg_worker_tid_valid;
 static PVOID g_veh_cookie;
 
 /* Guarded-copy landing for the VEH path. Both __try/__except and a VEH
  * fallback set g_guard_armed; if the VEH fires while it's set the
  * exception is "translated" into a longjmp via the VEH's ability to
  * rewrite the resume context. We use __try/__except for the primary
  * path and treat the VEH armed-check as a backstop. */
 static __declspec(thread) int g_guard_armed;
 static __declspec(thread) jmp_buf g_guard_buf;
 
 static int win_dbg_caller_is_worker(void) {
   return g_dbg_worker_tid_valid && GetCurrentThreadId() == g_dbg_worker_tid;
 }
 
 /* --- thread shim --- */
 
 typedef struct DbgWinThread {
   HANDLE handle;
   DWORD tid;
   void (*fn)(void*);
   void* arg;
 } DbgWinThread;
 
 static unsigned __stdcall dbg_thread_trampoline(void* p) {
   DbgWinThread* t = (DbgWinThread*)p;
   t->fn(t->arg);
   return 0;
 }
 
 static KitStatus dbg_thread_start_win(void* user, void (*fn)(void*), void* arg,
                                       void** thread_out) {
   DbgWinThread* t;
   uintptr_t h;
   (void)user;
   t = (DbgWinThread*)malloc(sizeof(*t));
   if (!t) return KIT_NOMEM;
   t->fn = fn;
   t->arg = arg;
   /* _beginthreadex sets up the CRT TLS for the new thread; pure CreateThread
    * leaves the CRT in an undefined state for code that calls printf/malloc. */
   h = _beginthreadex(NULL, 0, dbg_thread_trampoline, t, 0, (unsigned*)&t->tid);
   if (h == 0) {
     free(t);
     return KIT_ERR;
   }
   t->handle = (HANDLE)h;
   g_dbg_worker_tid = t->tid;
   g_dbg_worker_tid_valid = 1;
   *thread_out = t;
   return KIT_OK;
 }
 
 static void dbg_thread_join_win(void* user, void* thread) {
   DbgWinThread* t = (DbgWinThread*)thread;
   (void)user;
   if (!t) return;
   WaitForSingleObject(t->handle, INFINITE);
   CloseHandle(t->handle);
   g_dbg_worker_tid_valid = 0;
   free(t);
 }
 
 /* Interrupt the worker by suspending it, snapshotting its CONTEXT,
  * calling on_fault on the caller thread (the REPL), and writing back any
  * register edits. This differs from POSIX (where the signal handler runs
  * the on_fault on the worker), but the observable contract -- "the worker
  * is stopped while on_fault runs and resumes with the edited frame" --
  * matches. Locking quirks of SuspendThread aren't a concern here: the
  * worker is, by construction, running JIT'd user code that holds no host
  * locks. */
 static KitStatus dbg_thread_interrupt_win(void* user, void* thread) {
   DbgWinThread* t = (DbgWinThread*)thread;
   CONTEXT ctx;
   KitUnwindFrame frame;
   KitStatus rc;
   (void)user;
   if (!t || !g_dbg_ops_set || !g_dbg_ops.on_fault) return KIT_INVALID;
   if (SuspendThread(t->handle) == (DWORD)-1) return KIT_ERR;
   memset(&ctx, 0, sizeof(ctx));
   ctx.ContextFlags = CONTEXT_FULL;
   if (!GetThreadContext(t->handle, &ctx)) {
     ResumeThread(t->handle);
     return KIT_ERR;
   }
   ctx_to_frame(&ctx, &frame);
   rc = g_dbg_ops.on_fault(g_dbg_session, DBG_WIN_INTERRUPT_SIGNO, &frame);
   if (rc == KIT_OK) {
     frame_to_ctx(&frame, &ctx);
     SetThreadContext(t->handle, &ctx);
   }
   ResumeThread(t->handle);
   return rc;
 }
 
 /* --- event shim --- */
 
 static KitStatus dbg_event_new_win(void* user, void** event_out) {
   HANDLE h;
   (void)user;
   /* Manual-reset so a signaler that races ahead of the waiter doesn't lose
    * the wake-up; the dbg core explicitly resets via event_reset. */
   h = CreateEventW(NULL, TRUE, FALSE, NULL);
   if (!h) return KIT_ERR;
   *event_out = (void*)h;
   return KIT_OK;
 }
 
 static void dbg_event_free_win(void* user, void* ev) {
   (void)user;
   if (ev) CloseHandle((HANDLE)ev);
 }
 
 static KitStatus dbg_event_wait_win(void* user, void* ev) {
   (void)user;
   if (WaitForSingleObject((HANDLE)ev, INFINITE) != WAIT_OBJECT_0)
     return KIT_ERR;
   /* Auto-reset semantics expected by dbg_event_wait on POSIX (it clears
    * the flag after consuming). Mirror that here so the contract holds. */
   ResetEvent((HANDLE)ev);
   return KIT_OK;
 }
 
 static KitStatus dbg_event_signal_win(void* user, void* ev) {
   (void)user;
   return SetEvent((HANDLE)ev) ? KIT_OK : KIT_ERR;
 }
 
 static KitStatus dbg_event_reset_win(void* user, void* ev) {
   (void)user;
   return ResetEvent((HANDLE)ev) ? KIT_OK : KIT_ERR;
 }
 
 /* --- vectored exception handler --- */
 
 /* Recovery thunk: when guarded_copy's __try/__except is unavailable (or
  * for natural faults raised inside a guarded region) we hand control back
  * to the longjmp target by rewriting the resume context. */
 static LONG WINAPI dbg_veh(EXCEPTION_POINTERS* ep) {
   DWORD code = ep->ExceptionRecord->ExceptionCode;
   KitUnwindFrame frame;
   KitStatus rc;
   int signo;
 
   /* Filter out C++-style exceptions / debug strings we don't care about. */
   if (code == 0x406D1388u /* MS_VC_EXCEPTION (SetThreadName) */ ||
       code == 0xE06D7363u /* CXX EH */ || code == DBG_PRINTEXCEPTION_C ||
       code == DBG_PRINTEXCEPTION_WIDE_C)
     return EXCEPTION_CONTINUE_SEARCH;
 
   /* SEGV/BUS during a guarded_copy: bail out without involving the
    * session. The VEH backstop only fires if SEH/__try wasn't compiled in
    * for the function that armed the guard. */
   if (g_guard_armed &&
       (code == EXCEPTION_ACCESS_VIOLATION || code == EXCEPTION_IN_PAGE_ERROR ||
        code == EXCEPTION_DATATYPE_MISALIGNMENT)) {
     g_guard_armed = 0;
     longjmp(g_guard_buf, 1);
     /* not reached */
     return EXCEPTION_CONTINUE_EXECUTION;
   }
 
   if (!win_dbg_caller_is_worker() || !g_dbg_ops_set || !g_dbg_ops.on_fault)
     return EXCEPTION_CONTINUE_SEARCH;
 
   signo = exception_code_to_signo(code);
   ctx_to_frame(ep->ContextRecord, &frame);
   rc = g_dbg_ops.on_fault(g_dbg_session, signo, &frame);
   if (rc != KIT_OK) return EXCEPTION_CONTINUE_SEARCH;
   frame_to_ctx(&frame, ep->ContextRecord);
   return EXCEPTION_CONTINUE_EXECUTION;
 }
 
 static KitStatus dbg_signals_install_win(void* user, const KitDbgSignalOps* ops,
                                          void* session) {
   (void)user;
   if (g_veh_cookie) return KIT_ERR;
   g_dbg_ops = *ops;
   g_dbg_ops_set = 1;
   g_dbg_session = session;
   /* First==1 ensures we run before any other VEH and before the system's
    * default last-chance handler. */
   g_veh_cookie = AddVectoredExceptionHandler(1, dbg_veh);
   if (!g_veh_cookie) {
     memset(&g_dbg_ops, 0, sizeof(g_dbg_ops));
     g_dbg_ops_set = 0;
     g_dbg_session = NULL;
     return KIT_ERR;
   }
   return KIT_OK;
 }
 
 static void dbg_signals_uninstall_win(void* user) {
   (void)user;
   if (g_veh_cookie) {
     RemoveVectoredExceptionHandler(g_veh_cookie);
     g_veh_cookie = NULL;
   }
   memset(&g_dbg_ops, 0, sizeof(g_dbg_ops));
   g_dbg_ops_set = 0;
   g_dbg_session = NULL;
 }
 
 /* --- W^X transitions --- */
 
 static size_t page_floor(size_t v, size_t pg) { return v & ~(pg - 1); }
 static size_t page_ceil(size_t v, size_t pg) {
   return (v + pg - 1) & ~(pg - 1);
 }
 
 static KitStatus dbg_code_write_begin_win(void* user, void* runtime_addr,
                                           size_t n, void** write_out) {
   size_t pg;
   uintptr_t a;
   uintptr_t base;
   size_t span;
   DWORD old;
   (void)user;
   if (!runtime_addr || !n || !write_out) return KIT_INVALID;
   /* Dual-mapped reservation: write through the alias, no protect flip. */
   if (exec_dual_lookup_w(runtime_addr, n, write_out) == 0) return KIT_OK;
   /* Single-mapping fallback: transient PAGE_EXECUTE_READWRITE. */
   pg = driver_host_page_size_win();
   a = (uintptr_t)runtime_addr;
   base = page_floor(a, pg);
   span = page_ceil((a - base) + n, pg);
   if (!VirtualProtect((void*)base, span, PAGE_EXECUTE_READWRITE, &old))
     return KIT_ERR;
   *write_out = runtime_addr;
   return KIT_OK;
 }
 
 static void dbg_code_write_end_win(void* user, void* runtime_addr, size_t n) {
   void* w;
   size_t pg;
   uintptr_t a;
   uintptr_t base;
   size_t span;
   DWORD old;
   (void)user;
   if (exec_dual_lookup_w(runtime_addr, n, &w) == 0)
     return; /* nothing to flip */
   pg = driver_host_page_size_win();
   a = (uintptr_t)runtime_addr;
   base = page_floor(a, pg);
   span = page_ceil((a - base) + n, pg);
   VirtualProtect((void*)base, span, PAGE_EXECUTE_READ, &old);
 }
 
 static void dbg_flush_icache_win(void* user, void* runtime_addr, size_t n) {
   (void)user;
   FlushInstructionCache(GetCurrentProcess(), runtime_addr, n);
 }
 
 /* --- guarded copy via SEH __try/__except --- */
 
 static KitStatus dbg_guarded_copy_win(void* user, void* dst, const void* src,
                                       size_t n) {
   (void)user;
   /* MinGW-w64 supports __try/__except natively for the SEH model on x86_64
    * and arm64 (GCC: -fseh-exceptions; clang: built-in). The VEH backstop
    * above catches it if the toolchain ever falls back to setjmp-based EH. */
   if (setjmp(g_guard_buf) != 0) {
     g_guard_armed = 0;
     return KIT_ERR;
   }
   g_guard_armed = 1;
 #if defined(__kit__)
   /* kit's C frontend implements no SEH (__try/__except). Rely on the VEH
    * backstop (dbg_veh) installed by dbg_signals_install_win: it sees the
    * thread-local g_guard_armed and longjmps back through g_guard_buf on an
    * access fault, which is the exact fallback the comment above anticipates. */
   memcpy(dst, src, n);
   g_guard_armed = 0;
   return KIT_OK;
 #else
   __try {
     memcpy(dst, src, n);
     g_guard_armed = 0;
     return KIT_OK;
   } __except (EXCEPTION_EXECUTE_HANDLER) {
     g_guard_armed = 0;
     return KIT_ERR;
   }
 #endif
 }
 
 /* --- call_with_catch / thread_abort (longjmp-based) --- */
 
 static __declspec(thread) jmp_buf g_dbg_abort_buf;
 
 static int dbg_call_with_catch_win(void* user, void (*fn)(void*), void* arg) {
   (void)user;
   if (setjmp(g_dbg_abort_buf) == 0) {
     fn(arg);
     return 0;
   }
   return 1;
 }
 
 static void dbg_thread_abort_win(void* user) {
   (void)user;
   longjmp(g_dbg_abort_buf, 1);
 }
 
 static KitDbgOs g_dbg_os_win = {
     .thread_start = dbg_thread_start_win,
     .thread_join = dbg_thread_join_win,
     .thread_interrupt = dbg_thread_interrupt_win,
     .event_new = dbg_event_new_win,
     .event_free = dbg_event_free_win,
     .event_wait = dbg_event_wait_win,
     .event_signal = dbg_event_signal_win,
     .event_reset = dbg_event_reset_win,
     .signals_install = dbg_signals_install_win,
     .signals_uninstall = dbg_signals_uninstall_win,
     .interrupt_signo = DBG_WIN_INTERRUPT_SIGNO,
     .trap_signo = 5,
     .code_write_begin = dbg_code_write_begin_win,
     .code_write_end = dbg_code_write_end_win,
     .flush_icache = dbg_flush_icache_win,
     .guarded_copy = dbg_guarded_copy_win,
     .call_with_catch = dbg_call_with_catch_win,
     .thread_abort = dbg_thread_abort_win,
     .user = NULL,
 };
 
 /* JIT thread-local access resolves to in-image storage (single-threaded JIT:
  * the in-image TLS data is the single instance — see src/link/link_jit.c), so
  * no host-provided per-thread TLS vtable is needed. */
 
 /* ============================================================
  *   host target
  * ============================================================ */
 
 static KitArchKind host_arch_self_win(void) {
 #if defined(_M_X64) || defined(__x86_64__)
   return KIT_ARCH_X86_64;
 #elif defined(_M_ARM64) || defined(__aarch64__)
   return KIT_ARCH_ARM_64;
 #elif defined(_M_IX86) || defined(__i386__)
   return KIT_ARCH_X86_32;
 #elif defined(_M_ARM) || defined(__arm__)
   return KIT_ARCH_ARM_32;
 #else
   return KIT_ARCH_X86_64;
 #endif
 }
 
 KitTargetSpec driver_host_target(void) {
   KitTargetSpec t;
   t.arch = host_arch_self_win();
   t.os = KIT_OS_WINDOWS;
   t.obj = KIT_OBJ_COFF;
   t.ptr_size = (uint8_t)sizeof(void*);
   t.ptr_align = (uint8_t)sizeof(void*);
   t.big_endian = 0;
   t.pic = driver_default_pic(t.obj, t.os);
   t.code_model = KIT_CM_DEFAULT;
   return t;
 }
 
 /* No host probe on Windows: the MinGW sysroot is supplied via --sysroot or the
  * KIT_SYSROOT env var (handled in the cc driver), not auto-discovered from a
  * fixed install path. */
 int driver_default_hosted_dirs(DriverEnv* env, KitTargetSpec target,
                                DriverHostedDirs* out) {
   (void)env;
   (void)target;
   (void)out;
   return 1;
 }
 
 /* ============================================================
  *   env wiring
  * ============================================================ */
 
 static char g_cache_dir_win[4096];
 
 void driver_env_init(DriverEnv* e) {
   e->heap = &g_heap_libc;
   e->diag = &g_diag_stderr;
   e->file_io.read_all = win_read_all;
   e->file_io.release = win_release;
   e->file_io.open_writer = win_open_writer;
   e->file_io.user = e;
 
   g_execmem_win.page_size = driver_host_page_size_win();
   g_execmem_win.reserve = execmem_reserve_win;
   g_execmem_win.protect = execmem_protect_win;
   g_execmem_win.release = execmem_release_win;
   g_execmem_win.flush_icache = execmem_flush_icache_win;
   g_execmem_win.user = NULL;
   e->execmem = &g_execmem_win;
 
   e->dbg_os = &g_dbg_os_win;
   e->metrics = NULL;
 
   {
     /* XDG_CACHE_HOME wins if set (cross-platform tooling convention),
      * otherwise fall back to %LOCALAPPDATA%\\kit, otherwise a
      * build-tree-local path. */
     const char* xdg = getenv("XDG_CACHE_HOME");
     const char* lap = getenv("LOCALAPPDATA");
     if (xdg && *xdg) {
       snprintf(g_cache_dir_win, sizeof(g_cache_dir_win), "%s/kit", xdg);
     } else if (lap && *lap) {
       snprintf(g_cache_dir_win, sizeof(g_cache_dir_win), "%s\\kit", lap);
     } else {
       snprintf(g_cache_dir_win, sizeof(g_cache_dir_win), "build\\kit-cache");
     }
     g_cache_dir_win[sizeof(g_cache_dir_win) - 1] = '\0';
     e->cache_dir = g_cache_dir_win;
   }
 
   {
     const char* sde = getenv("SOURCE_DATE_EPOCH");
     if (sde && *sde) {
       char* endp = NULL;
       long long v = strtoll(sde, &endp, 10);
       e->now = (endp != sde && v >= 0) ? (int64_t)v : (int64_t)-1;
     } else {
       time_t t = time(NULL);
       e->now = (t == (time_t)-1) ? (int64_t)-1 : (int64_t)t;
     }
   }
 }
 
 void driver_env_fini(DriverEnv* e) { (void)e; }
 
 KitContext driver_env_to_context(const DriverEnv* e) {
   KitContext c;
   c.heap = e->heap;
   c.file_io = &e->file_io;
   c.diag = e->diag;
   c.metrics = e->metrics;
   c.now = e->now;
   return c;
 }
 
 KitJitHost driver_env_to_jit_host(const DriverEnv* e) {
   KitJitHost h;
   h.execmem = e->execmem;
   return h;
 }
 
 KitDbgHost driver_env_to_dbg_host(const DriverEnv* e) {
   KitDbgHost h;
   h.os = e->dbg_os;
   return h;
 }