kit

pp_directive.c (60678B)

---

 /* pp_directive.c — if-stack, PP expression evaluator, #include search/open,
  * #line, #pragma, #error, #embed, and directive dispatch. */
 
 #include "pp/pp_priv.h"
 
 static void destringize(Pp* pp, const Tok* str_tok, char* out, size_t cap,
                         size_t* out_len);
 static void pp_warn(Pp* pp, SrcLoc loc, const char* fmt, ...);
 
 /* ============================================================
  * If-stack
  * ============================================================ */
 
 static void if_push(Pp* pp, IfFrame f) {
   if (pp->ifstk_n == pp->ifstk_cap) {
     u32 nc = pp->ifstk_cap ? pp->ifstk_cap * 2 : 4;
     pp->ifstk = pp_xrealloc(pp, pp->ifstk, sizeof(IfFrame) * pp->ifstk_cap,
                             sizeof(IfFrame) * nc, _Alignof(IfFrame));
     pp->ifstk_cap = nc;
   }
   pp->ifstk[pp->ifstk_n++] = f;
 }
 
 static IfFrame* if_top(Pp* pp) {
   return pp->ifstk_n ? &pp->ifstk[pp->ifstk_n - 1] : NULL;
 }
 
 static void if_pop(Pp* pp) {
   if (pp->ifstk_n) --pp->ifstk_n;
 }
 
 /* ============================================================
  * Directive line reader
  * ============================================================ */
 
 /* Read tokens up through (and including) the next TOK_NEWLINE / TOK_EOF.
  * Drops the newline; collected tokens are arena-allocated and returned via
  * *out_toks/out_n. */
 void read_directive_line(Pp* pp, Tok** out_toks, u32* out_n) {
   Tok* buf = NULL;
   u32 cap = 0, n = 0;
   Tok t;
   u8 saved_rd = pp->reading_directive;
   pp->reading_directive = 1;
   for (;;) {
     t = src_next_raw(pp, NULL);
     if (t.kind == TOK_NEWLINE || t.kind == TOK_EOF) break;
     if (n == cap) {
       u32 nc = cap ? cap * 2 : 8;
       Tok* nb = (Tok*)arena_alloc(pp->arena, sizeof(Tok) * nc, _Alignof(Tok));
       if (cap) memcpy(nb, buf, sizeof(Tok) * cap);
       buf = nb;
       cap = nc;
     }
     buf[n++] = t;
   }
   pp->reading_directive = saved_rd;
   *out_toks = buf;
   *out_n = n;
 }
 
 /* ============================================================
  * PP expression evaluator (§6.10.1)
  * ============================================================ */
 
 /* Parse a C integer constant from a pp-number's spelling. Suffixes (u, l,
  * etc.) are ignored. Recognizes decimal, hex (0x...), and octal (0...). */
 static i64 parse_pp_int(const char* s, size_t n) {
   int base = 10;
   size_t i = 0;
   u64 val =
       0; /* unsigned: #if arithmetic wraps on overflow, signed would be UB */
   if (n >= 2 && s[0] == '0' && (s[1] == 'x' || s[1] == 'X')) {
     base = 16;
     i = 2;
   } else if (n >= 1 && s[0] == '0') {
     base = 8;
     i = 1;
   }
   for (; i < n; ++i) {
     char c = s[i];
     int d;
     if (c >= '0' && c <= '9')
       d = c - '0';
     else if (base == 16 && c >= 'a' && c <= 'f')
       d = c - 'a' + 10;
     else if (base == 16 && c >= 'A' && c <= 'F')
       d = c - 'A' + 10;
     else
       break;
     if (d >= base) break;
     val = val * (u64)base + (u64)d;
   }
   return (i64)val;
 }
 
 /* Pre-pass: replace `defined X` / `defined ( X )` with a 0/1 pp-number,
  * preserving the rest of the token sequence. The operand of `defined` is
  * NOT macro-expanded. Output is a fresh TokVec. */
 static void prepass_defined(Pp* pp, const Tok* in, u32 nin, TokVec* out) {
   u32 i;
   for (i = 0; i < nin; ++i) {
     if (in[i].kind == TOK_IDENT && tok_ident(&in[i]) == pp->sym_defined) {
       int has_paren = 0;
       Sym ident = 0;
       u32 j = i + 1;
       if (j < nin && in[j].kind == TOK_PUNCT && tok_punct(&in[j]) == '(') {
         has_paren = 1;
         ++j;
       }
       if (j >= nin || in[j].kind != TOK_IDENT) {
         compiler_panic(pp->c, pp_materialize_loc(pp, in[i].loc),
                        "operand of 'defined' must be an identifier");
       }
       ident = tok_ident(&in[j]);
       ++j;
       if (has_paren) {
         if (j >= nin || in[j].kind != TOK_PUNCT || tok_punct(&in[j]) != ')') {
           compiler_panic(pp->c, pp_materialize_loc(pp, in[i].loc),
                          "expected ')' after 'defined' operand");
         }
         ++j;
       }
       {
         Tok t;
         /* `__has_include` / `__has_include_next` are not macros (their operand
          * isn't a normal token sequence) but, like clang/GCC, they answer
          * `defined()` with 1 so the guarded idiom
          *   #if defined(__has_include) && __has_include(<x>)
          * — common in system headers — takes its intended branch. */
         int is_defined = mt_get(pp, ident) != NULL ||
                          ident == pp->sym_has_include ||
                          ident == pp->sym_has_include_next;
         memset(&t, 0, sizeof(t));
         t.kind = TOK_NUM;
         t.flags = in[i].flags & (TF_AT_BOL | TF_HAS_SPACE);
         t.loc = in[i].loc;
         t.aux = 0;
         t.text = text_intern_ref(
             pp, is_defined ? kit_slice_cstr("1") : kit_slice_cstr("0"));
         tv_push(pp, out, t);
       }
       i = j - 1;
     } else {
       tv_push(pp, out, in[i]);
     }
   }
 }
 
 /* Macro-expand a sequence of pre-#if tokens to completion.
  *
  * Sets pp->in_if_expansion for the duration so pp_next_raw can keep
  * `defined`-operator operands raw even when they ride out of a macro
  * body via the ## operator. Without this flag a macro body like
  *   #define G(x) (!defined(__G_DEFINED_ ## x))
  * would have the pasted operand expanded if it happens to name an
  * already-defined macro, leaving the second prepass to choke on
  * `defined()`. */
 static void expand_for_if(Pp* pp, const Tok* in, u32 nin, TokVec* out) {
   Tok* slice;
   u8 saved;
   if (nin == 0) return;
   slice = arena_array(pp->arena, Tok, nin);
   memcpy(slice, in, sizeof(Tok) * nin);
   saved = pp->in_if_expansion;
   pp->in_if_expansion = 1;
   pp->defined_skip = 0;
   expand_arg_to_eof(pp, slice, nin, out);
   pp->in_if_expansion = saved;
   pp->defined_skip = 0;
 }
 
 /* Replace remaining identifiers with `0` per §6.10.1 ¶4, after `defined`
  * has been handled. */
 static void replace_remaining_if_identifiers(Pp* pp, TokVec* toks) {
   u32 i;
   TextRef zero = text_intern_ref(pp, kit_slice_cstr("0"));
   for (i = 0; i < toks->n; ++i) {
     if (toks->data[i].kind == TOK_IDENT) {
       toks->data[i].kind = TOK_NUM;
       toks->data[i].aux = 0;
       toks->data[i].text = zero;
     }
   }
 }
 
 /* Recursive-descent expression evaluator over an expanded token list. */
 typedef struct EE {
   Pp* pp;
   const Tok* toks;
   u32 n;
   u32 pos;
   SrcLoc loc;
   SrcLoc op_loc; /* loc of the binary operator being applied (for panics) */
 } EE;
 
 static i64 ee_ternary(EE* e);
 
 static const Tok* ee_peek(EE* e) {
   return e->pos < e->n ? &e->toks[e->pos] : NULL;
 }
 
 static int ee_match_punct(EE* e, u32 p) {
   const Tok* t = ee_peek(e);
   if (t && t->kind == TOK_PUNCT && tok_punct(t) == p) {
     ++e->pos;
     return 1;
   }
   return 0;
 }
 
 static i64 ee_primary(EE* e) {
   const Tok* t = ee_peek(e);
   if (!t) compiler_panic(e->pp->c, e->loc, "#if: missing operand");
   if (t->kind == TOK_NUM) {
     KitSlice s = pp_text_slice(e->pp, t);
     ++e->pos;
     return parse_pp_int(s.s, s.len);
   }
   if (t->kind == TOK_CHR) {
     /* Treat as the codepoint of the first character (post-decoding
      * not implemented; cover the common case of a single ASCII
      * char). */
     KitSlice s = pp_text_slice(e->pp, t);
     ++e->pos;
     if (s.len >= 3 && s.s[0] == '\'') return (unsigned char)s.s[1];
     return 0;
   }
   if (t->kind == TOK_PUNCT && tok_punct(t) == '(') {
     i64 v;
     ++e->pos;
     v = ee_ternary(e);
     if (!ee_match_punct(e, ')')) {
       compiler_panic(e->pp->c, pp_materialize_loc(e->pp, t->loc),
                      "#if: expected ')'");
     }
     return v;
   }
   compiler_panic(e->pp->c, pp_materialize_loc(e->pp, t->loc),
                  "#if: unexpected token in expression");
   return 0;
 }
 
 static i64 ee_unary(EE* e) {
   const Tok* t = ee_peek(e);
   if (t && t->kind == TOK_PUNCT) {
     u32 p = tok_punct(t);
     if (p == '!' || p == '-' || p == '+' || p == '~') {
       i64 v;
       ++e->pos;
       v = ee_unary(e);
       switch (p) {
         case '!':
           return v ? 0 : 1;
         case '-':
           return -v;
         case '+':
           return v;
         case '~':
           return ~v;
       }
     }
   }
   return ee_primary(e);
 }
 
 /* One row per binary operator, highest `prec` binds tightest. All listed
  * operators are left-associative; ternary (right-assoc) stays special-cased
  * in ee_ternary. `apply` folds (lhs OP rhs) and owns the div/mod-by-zero
  * panic (it needs the operator loc, threaded via EE::op_loc). */
 typedef i64 (*EeApply)(EE* e, i64 a, i64 b);
 
 static i64 eb_mul(EE* e, i64 a, i64 b) {
   (void)e;
   return a * b;
 }
 static i64 eb_div(EE* e, i64 a, i64 b) {
   if (b == 0) compiler_panic(e->pp->c, e->op_loc, "#if: division by zero");
   return a / b;
 }
 static i64 eb_mod(EE* e, i64 a, i64 b) {
   if (b == 0) compiler_panic(e->pp->c, e->op_loc, "#if: modulo by zero");
   return a % b;
 }
 static i64 eb_add(EE* e, i64 a, i64 b) {
   (void)e;
   return a + b;
 }
 static i64 eb_sub(EE* e, i64 a, i64 b) {
   (void)e;
   return a - b;
 }
 static i64 eb_shl(EE* e, i64 a, i64 b) {
   (void)e;
   return a << b;
 }
 static i64 eb_shr(EE* e, i64 a, i64 b) {
   (void)e;
   return a >> b;
 }
 static i64 eb_lt(EE* e, i64 a, i64 b) {
   (void)e;
   return a < b;
 }
 static i64 eb_gt(EE* e, i64 a, i64 b) {
   (void)e;
   return a > b;
 }
 static i64 eb_le(EE* e, i64 a, i64 b) {
   (void)e;
   return a <= b;
 }
 static i64 eb_ge(EE* e, i64 a, i64 b) {
   (void)e;
   return a >= b;
 }
 static i64 eb_eq(EE* e, i64 a, i64 b) {
   (void)e;
   return a == b;
 }
 static i64 eb_ne(EE* e, i64 a, i64 b) {
   (void)e;
   return a != b;
 }
 static i64 eb_band(EE* e, i64 a, i64 b) {
   (void)e;
   return a & b;
 }
 static i64 eb_bxor(EE* e, i64 a, i64 b) {
   (void)e;
   return a ^ b;
 }
 static i64 eb_bor(EE* e, i64 a, i64 b) {
   (void)e;
   return a | b;
 }
 static i64 eb_logand(EE* e, i64 a, i64 b) {
   (void)e;
   return a && b;
 }
 static i64 eb_logor(EE* e, i64 a, i64 b) {
   (void)e;
   return a || b;
 }
 
 typedef struct EeOp {
   u32 punct; /* P_* / ASCII codepoint of the operator token */
   u8 prec;   /* higher binds tighter */
   EeApply apply;
 } EeOp;
 
 static const EeOp ee_ops[] = {
     {'*', 10, eb_mul},  {'/', 10, eb_div},     {'%', 10, eb_mod},
     {'+', 9, eb_add},   {'-', 9, eb_sub},      {P_SHL, 8, eb_shl},
     {P_SHR, 8, eb_shr}, {'<', 7, eb_lt},       {'>', 7, eb_gt},
     {P_LE, 7, eb_le},   {P_GE, 7, eb_ge},      {P_EQ, 6, eb_eq},
     {P_NE, 6, eb_ne},   {'&', 5, eb_band},     {'^', 4, eb_bxor},
     {'|', 3, eb_bor},   {P_AND, 2, eb_logand}, {P_OR, 1, eb_logor},
 };
 
 static const EeOp* ee_lookup_op(const Tok* t) {
   size_t i;
   if (!t || t->kind != TOK_PUNCT) return NULL;
   for (i = 0; i < sizeof(ee_ops) / sizeof(ee_ops[0]); ++i) {
     if (ee_ops[i].punct == tok_punct(t)) return &ee_ops[i];
   }
   return NULL;
 }
 
 /* Precedence-climbing fold of all left-associative binary operators. */
 static i64 ee_binary(EE* e, int min_prec) {
   i64 v = ee_unary(e);
   for (;;) {
     const Tok* t = ee_peek(e);
     const EeOp* op = ee_lookup_op(t);
     SrcLoc op_loc;
     i64 rhs;
     if (!op || op->prec < min_prec) break;
     op_loc = pp_materialize_loc(e->pp, t->loc);
     ++e->pos;
     /* Left-associative: parse the RHS with strictly higher precedence so
      * same-prec operators fold left-to-right. */
     rhs = ee_binary(e, op->prec + 1);
     e->op_loc = op_loc;
     v = op->apply(e, v, rhs);
   }
   return v;
 }
 
 static i64 ee_ternary(EE* e) {
   i64 c = ee_binary(e, 1);
   if (ee_match_punct(e, '?')) {
     i64 a = ee_ternary(e);
     i64 b;
     if (!ee_match_punct(e, ':')) {
       compiler_panic(e->pp->c, e->loc, "#if: ':' expected in ternary");
     }
     b = ee_ternary(e);
     return c ? a : b;
   }
   return c;
 }
 
 /* Header-resolution helpers used by the __has_include pre-pass below; the
  * definitions live further down with the #include machinery. */
 static void parse_include_path(Pp* pp, const Tok* line, u32 n, LocRef loc,
                                char* path_out, size_t cap, int* system_out);
 static int find_and_open_include(Pp* pp, const char* path, int system,
                                  LocRef loc, const u8** data, size_t* size,
                                  char* resolved, size_t resolved_cap,
                                  int* resolved_system_out, u32* next_start_out);
 static int find_and_open_include_next(Pp* pp, const char* path, u32 start,
                                       const u8** data, size_t* size,
                                       char* resolved, size_t resolved_cap,
                                       int* resolved_system_out,
                                       u32* next_start_out);
 
 /* Pre-pass: replace `__has_include(<h>)` / `__has_include("h")` (and the
  * `__has_include_next` variant) with the pp-number 1 or 0 per whether the
  * header resolves against the include search path — the same search a real
  * #include would perform. Runs BEFORE macro expansion so the `<...>` form's
  * `<` and `>` are never mistaken for comparison operators, and so the header
  * tokens are not subject to the surrounding #if's identifier→0 rewrite. The
  * operand itself is still macro-expanded (via parse_include_path), matching
  * the `__has_include(HEADER_MACRO)` idiom. Output is a fresh TokVec. */
 static void prepass_has_include(Pp* pp, const Tok* in, u32 nin, TokVec* out) {
   u32 i;
   for (i = 0; i < nin; ++i) {
     int is_has = 0, is_next = 0;
     u32 j, op_n, depth, s;
     const Tok* op_first;
     char path[4096];
     char resolved[4096];
     int system_form = 0, resolved_system = 0, present = 0;
     u32 next_start = 0, next_search = 0;
     const u8* data;
     size_t size;
     Tok t;
     const char* what;
 
     if (in[i].kind == TOK_IDENT) {
       if (tok_ident(&in[i]) == pp->sym_has_include)
         is_has = 1;
       else if (tok_ident(&in[i]) == pp->sym_has_include_next)
         is_has = is_next = 1;
     }
     if (!is_has) {
       tv_push(pp, out, in[i]);
       continue;
     }
     what = is_next ? "__has_include_next" : "__has_include";
 
     j = i + 1;
     if (j >= nin || in[j].kind != TOK_PUNCT || tok_punct(&in[j]) != '(') {
       compiler_panic(pp->c, pp_materialize_loc(pp, in[i].loc),
                      "expected '(' after %s", what);
     }
     ++j; /* past '(' */
     op_first = &in[j];
     depth = 1;
     op_n = 0;
     for (; j < nin; ++j, ++op_n) {
       if (in[j].kind == TOK_PUNCT && tok_punct(&in[j]) == '(') {
         ++depth;
       } else if (in[j].kind == TOK_PUNCT && tok_punct(&in[j]) == ')') {
         if (--depth == 0) break;
       }
     }
     if (j >= nin)
       compiler_panic(pp->c, pp_materialize_loc(pp, in[i].loc),
                      "unterminated %s", what);
     /* in[j] is the matching ')'. */
 
     parse_include_path(pp, op_first, op_n, in[i].loc, path, sizeof(path),
                        &system_form);
     if (is_next) {
       for (s = pp->nsources; s > 0; --s) {
         TokSrc* tp = &pp->sources[s - 1];
         if (tp->kind == SRC_LEX && tp->lex) {
           next_search = tp->inc_next_start;
           break;
         }
       }
       present = find_and_open_include_next(pp, path, next_search, &data, &size,
                                            resolved, sizeof(resolved),
                                            &resolved_system, &next_start);
     } else {
       present = find_and_open_include(pp, path, system_form, in[i].loc, &data,
                                       &size, resolved, sizeof(resolved),
                                       &resolved_system, &next_start);
     }
 
     memset(&t, 0, sizeof(t));
     t.kind = TOK_NUM;
     t.flags = in[i].flags & (TF_AT_BOL | TF_HAS_SPACE);
     t.loc = in[i].loc;
     t.aux = 0;
     t.text = text_intern_ref(
         pp, present ? kit_slice_cstr("1") : kit_slice_cstr("0"));
     tv_push(pp, out, t);
     i = j; /* resume past the matching ')' */
   }
 }
 
 i64 eval_if_expr(Pp* pp, const Tok* line, u32 n, LocRef loc) {
   TokVec defs = {0};
   TokVec hasinc = {0};
   TokVec exp = {0};
   TokVec defs2 = {0};
   EE e;
   i64 v;
 
   prepass_defined(pp, line, n, &defs);
   prepass_has_include(pp, defs.data, defs.n, &hasinc);
   expand_for_if(pp, hasinc.data, hasinc.n, &exp);
   prepass_defined(pp, exp.data, exp.n, &defs2);
   replace_remaining_if_identifiers(pp, &defs2);
 
   e.pp = pp;
   e.toks = defs2.data;
   e.n = defs2.n;
   e.pos = 0;
   e.loc = pp_materialize_loc(pp, loc);
   v = ee_ternary(&e);
   if (e.pos != e.n) {
     compiler_panic(pp->c, e.loc,
                    "#if: unexpected trailing tokens in expression");
   }
   return v;
 }
 
 /* ============================================================
  * Conditional inclusion helpers
  * ============================================================ */
 
 static void consume_to_newline(Pp* pp) {
   Tok t;
   do {
     t = src_next_raw(pp, NULL);
   } while (t.kind != TOK_NEWLINE && t.kind != TOK_EOF);
 }
 
 /* Drive the source forward consuming tokens until we either:
  *   - reach a balancing #endif (pops the frame, returns), or
  *   - reach a #elif / #else that flips the top frame to IF_INCLUDE
  *     (returns with that frame active).
  * Nested #if directives inside the skipped group are tracked via
  * `local_depth`. Unrecognised directives in skipped groups are tolerated
  * (§6.10 ¶4, covered by `8c_skipped_relaxed_syntax`). */
 static void skip_until_active(Pp* pp) {
   int local_depth = 0;
   while (pp->ifstk_n > 0) {
     IfFrame* top = if_top(pp);
     Tok t;
     if (top->state == IF_INCLUDE && local_depth == 0) return;
     t = src_next_raw(pp, NULL);
     if (t.kind == TOK_EOF) {
       compiler_panic(pp->c, pp_materialize_loc(pp, top->loc),
                      "unterminated #if / #ifdef");
     }
     if (t.kind != TOK_PP_HASH || (t.flags & TF_AT_BOL) == 0) continue;
 
     /* Read directive name (or null directive). */
     {
       Tok nt = src_next_raw(pp, NULL);
       Sym name;
       if (nt.kind == TOK_NEWLINE || nt.kind == TOK_EOF) continue;
       if (nt.kind != TOK_IDENT) {
         consume_to_newline(pp);
         continue;
       }
       name = tok_ident(&nt);
       if (name == pp->sym_if || name == pp->sym_ifdef ||
           name == pp->sym_ifndef) {
         ++local_depth;
         consume_to_newline(pp);
         continue;
       }
       if (name == pp->sym_endif) {
         consume_to_newline(pp);
         if (local_depth > 0) {
           --local_depth;
           continue;
         }
         if_pop(pp);
         return;
       }
       if (name == pp->sym_else) {
         consume_to_newline(pp);
         if (local_depth > 0) continue;
         if (top->has_else) {
           compiler_panic(pp->c, pp_materialize_loc(pp, t.loc),
                          "duplicate #else");
         }
         top->has_else = 1;
         if (top->state == IF_SEEK_TRUE) {
           top->state = IF_INCLUDE;
           return;
         }
         top->state = IF_DONE;
         continue;
       }
       if (name == pp->sym_elif) {
         if (local_depth > 0 || top->has_else || top->state == IF_DONE) {
           consume_to_newline(pp);
           continue;
         }
         if (top->state == IF_SEEK_TRUE) {
           Tok* line;
           u32 ln;
           i64 v;
           read_directive_line(pp, &line, &ln);
           v = eval_if_expr(pp, line, ln, t.loc);
           if (v != 0) {
             top->state = IF_INCLUDE;
             return;
           }
           continue;
         }
         /* Was IF_INCLUDE; #elif means we're done. (Should already
          * have been transitioned to DONE before entering this
          * skip — defensive.) */
         top->state = IF_DONE;
         consume_to_newline(pp);
         continue;
       }
       /* Other directive — relaxed: skip silently. */
       consume_to_newline(pp);
       continue;
     }
   }
 }
 
 /* ============================================================
  * Predefined macro name guard
  * ============================================================ */
 
 static int is_predefined_macro_name(Pp* pp, Sym name) {
   return name == pp->sym_va_args || name == pp->sym_line__ ||
          name == pp->sym_file__ || name == pp->sym_date__ ||
          name == pp->sym_time__;
   /* __STDC__/__STDC_HOSTED__/__STDC_VERSION__ are registered as real
    * macros, so the macro-table lookup catches them. */
 }
 
 /* ============================================================
  * #ifdef / #if / #elif / #else / #endif
  * ============================================================ */
 
 static void do_ifdef(Pp* pp, const Tok* line, u32 n, int negate, LocRef loc) {
   int defined;
   IfFrame f;
   if (n < 1 || line[0].kind != TOK_IDENT) {
     compiler_panic(pp->c, pp_materialize_loc(pp, loc),
                    negate ? "#ifndef: expected identifier"
                           : "#ifdef: expected identifier");
   }
   defined = (mt_get(pp, tok_ident(&line[0])) != NULL) ||
             is_predefined_macro_name(pp, tok_ident(&line[0]));
   if (negate) defined = !defined;
   memset(&f, 0, sizeof(f));
   f.state = defined ? IF_INCLUDE : IF_SEEK_TRUE;
   f.loc = loc;
   if_push(pp, f);
   if (!defined) skip_until_active(pp);
 }
 
 static void do_if_directive(Pp* pp, const Tok* line, u32 n, LocRef loc) {
   i64 v = eval_if_expr(pp, line, n, loc);
   IfFrame f;
   memset(&f, 0, sizeof(f));
   f.state = v ? IF_INCLUDE : IF_SEEK_TRUE;
   f.loc = loc;
   if_push(pp, f);
   if (!v) skip_until_active(pp);
 }
 
 static void do_elif(Pp* pp, LocRef loc) {
   /* We only reach do_elif from the active branch — meaning the
    * preceding group emitted code. So we must skip the rest. */
   IfFrame* top = if_top(pp);
   if (!top) compiler_panic(pp->c, pp_materialize_loc(pp, loc), "stray #elif");
   if (top->has_else)
     compiler_panic(pp->c, pp_materialize_loc(pp, loc), "#elif after #else");
   top->state = IF_DONE;
   skip_until_active(pp);
 }
 
 static void do_else(Pp* pp, LocRef loc) {
   IfFrame* top = if_top(pp);
   if (!top) compiler_panic(pp->c, pp_materialize_loc(pp, loc), "stray #else");
   if (top->has_else)
     compiler_panic(pp->c, pp_materialize_loc(pp, loc), "duplicate #else");
   top->has_else = 1;
   top->state = IF_DONE;
   skip_until_active(pp);
 }
 
 static void do_endif(Pp* pp, LocRef loc) {
   if (!if_top(pp))
     compiler_panic(pp->c, pp_materialize_loc(pp, loc), "stray #endif");
   if_pop(pp);
 }
 
 /* ============================================================
  * #include (§6.10.2)
  * ============================================================ */
 
 /* Arena-heap adapter backing the IncCache slot table: alloc/realloc bump
  * from pp->arena (immortal until pp_free), free is a no-op. A resize
  * orphans the small old slot table in the arena — bounded by the final
  * table size and negligible. Mirrors the parser's c_arena_heap. */
 static void* inc_cache_alloc(KitHeap* h, size_t n, size_t align) {
   return kit_arena_alloc((KitArena*)h->user, n, align);
 }
 static void* inc_cache_realloc(KitHeap* h, void* old, size_t old_n,
                                size_t new_n, size_t align) {
   void* q = kit_arena_alloc((KitArena*)h->user, new_n, align);
   if (q && old && old_n) memcpy(q, old, old_n < new_n ? old_n : new_n);
   return q;
 }
 static void inc_cache_free(KitHeap* h, void* p, size_t n) {
   (void)h;
   (void)p;
   (void)n;
 }
 
 /* Lazily set up the header-content cache, resolution memo, and their
  * shared arena-backed heap. */
 static void inc_cache_ensure(Pp* pp) {
   if (pp->inc_cache_ready) return;
   pp->inc_cache_heap.alloc = inc_cache_alloc;
   pp->inc_cache_heap.realloc = inc_cache_realloc;
   pp->inc_cache_heap.free = inc_cache_free;
   pp->inc_cache_heap.user = pp->arena;
   IncCache_init(&pp->inc_cache, &pp->inc_cache_heap);
   IncResolveMap_init(&pp->inc_resolve, &pp->inc_cache_heap);
   pp->inc_cache_ready = 1;
 }
 
 /* Intern a candidate/resolved path string into a Sym usable as a cache
  * key. Returns 0 (an invalid key) only for the empty string, which never
  * names a real header. */
 static Sym inc_cache_key(Pp* pp, const char* path) {
   return kit_sym_intern(pp->pool->c, kit_slice_cstr(path));
 }
 
 /* Read `path` via the host's file_io and copy its bytes into the pp
  * arena so they outlive io->release. Returns 1 on success. */
 static int try_open_include(Pp* pp, const char* path, const u8** data_out,
                             size_t* size_out) {
   KitFileData fd;
   const KitFileIO* io;
   u8* buf;
 
   memset(&fd, 0, sizeof(fd));
   io = kit_compiler_context(pp->c)->file_io;
   if (!io || !io->read_all) {
     compiler_panic(pp->c, (SrcLoc){0, 0, 0},
                    "#include: env.file_io is not configured");
   }
   if (io->read_all(io->user, path, &fd) != KIT_OK) return 0;
   {
     size_t sz = fd.size;
     buf = (u8*)arena_alloc(pp->arena, sz ? sz : 1, 1);
     if (sz && fd.data) memcpy(buf, fd.data, sz);
     if (io->release) io->release(io->user, &fd); /* zeros fd */
     *data_out = buf;
     *size_out = sz;
   }
   return 1;
 }
 
 /* Open `path` for #include, serving from the header-content cache when the
  * same resolved path was already read this TU. A hit returns the cached
  * arena bytes with NO syscalls; a miss reads via try_open_include and
  * caches the result keyed on the path string. The returned (data,size) is
  * byte-identical to a fresh read, so this never affects which file wins a
  * search nor the bytes that feed the lexer. */
 static int open_include_cached(Pp* pp, const char* path, const u8** data_out,
                                size_t* size_out) {
   Sym key;
   IncEntry* hit;
   inc_cache_ensure(pp);
   key = inc_cache_key(pp, path);
   if (key) {
     hit = IncCache_get(&pp->inc_cache, key);
     if (hit) {
       *data_out = hit->data;
       *size_out = hit->size;
       return 1;
     }
   }
   if (!try_open_include(pp, path, data_out, size_out)) return 0;
   if (key) {
     IncEntry e = {0};
     e.data = *data_out;
     e.size = *size_out;
     IncCache_set(&pp->inc_cache, key, e);
   }
   return 1;
 }
 
 /* Return the includer's directory for resolving a quoted include, or "."
  * for in-memory/builtin sources (where CWD is the natural fallback, like
  * gcc treats stdin). `dir_out` must point to a buffer of size >= cap. */
 static int includer_dir(Pp* pp, LocRef loc, char* dir_out, size_t cap) {
   KitSourceFile sf;
   const char* p = NULL;
   size_t plen = 0;
   const char* slash;
   size_t dlen;
   memset(&sf, 0, sizeof(sf));
   if (kit_source_file(pp->c, loc.file_id, &sf) == 0 && sf.name) {
     KitSlice s = kit_sym_str(pp->pool->c, sf.name);
     p = s.s;
     plen = s.len;
   }
   if (!p || plen == 0 || p[0] == '<') {
     if (cap < 2) return 0;
     dir_out[0] = '.';
     dir_out[1] = 0;
     return 1;
   }
   slash = NULL;
   {
     size_t i;
     for (i = plen; i > 0; --i) {
       if (p[i - 1] == '/') {
         slash = p + i - 1;
         break;
       }
     }
   }
   if (!slash) {
     if (cap < 2) return 0;
     dir_out[0] = '.';
     dir_out[1] = 0;
     return 1;
   }
   dlen = (size_t)(slash - p);
   if (dlen == 0) dlen = 1; /* path was "/x" — dir is "/" */
   if (dlen + 1 > cap) return 0;
   memcpy(dir_out, p, dlen);
   dir_out[dlen] = 0;
   return 1;
 }
 
 /* Build the resolution-memo key for a (spelling, system, includer-dir)
  * request and intern it. The key folds the search-affecting inputs into
  * one string: a leading '<' (system) or '"' (quoted) tag, and — for the
  * quoted form, whose includer-relative step is includer-specific — the
  * includer directory followed by a '\n' separator (which can appear in
  * neither a path nor a header spelling) before the spelling. System form
  * skips the includer step, so its key omits the dir. Returns 0 only if
  * the key would overflow the scratch buffer (memo simply not used). */
 static Sym inc_resolve_key(Pp* pp, const char* path, size_t plen, int system,
                            LocRef loc) {
   char key[4096 + 4096 + 8];
   size_t pos = 0;
   key[pos++] = system ? '<' : '"';
   if (!system) {
     char dir[4096];
     if (!includer_dir(pp, loc, dir, sizeof(dir))) return 0;
     {
       size_t dlen = kit_slice_cstr(dir).len;
       if (pos + dlen + 1 + plen >= sizeof(key)) return 0;
       memcpy(key + pos, dir, dlen);
       pos += dlen;
       key[pos++] = '\n';
     }
   } else if (pos + plen >= sizeof(key)) {
     return 0;
   }
   memcpy(key + pos, path, plen);
   pos += plen;
   return kit_sym_intern(pp->pool->c, (KitSlice){.s = key, .len = pos});
 }
 
 /* Record a successful dir-search resolution under its spelling key, so the
  * next request for the same spelling skips the search. No-op when the key
  * was unavailable (rkey == 0). `resolved` is a NUL-terminated path.
  * `next_start` is the inc_dirs index a #include_next from the resolved file
  * resumes at (0 for the includer-relative / absolute wins). */
 static void inc_resolve_record(Pp* pp, Sym rkey, const char* resolved,
                                int resolved_system, u32 next_start) {
   IncResolved e;
   if (!rkey) return;
   e.path = kit_sym_intern(pp->pool->c, kit_slice_cstr(resolved));
   e.system = (u8)(resolved_system ? 1 : 0);
   e.next_start = next_start;
   IncResolveMap_set(&pp->inc_resolve, rkey, e);
 }
 
 /* Search for a header. Absolute paths are opened verbatim. Quoted form
  * ("...") additionally searches the directory of the file containing the
  * #include first (per C §6.10.2); bracket form (<...>) skips that step.
  * Both forms then walk the configured -I / -isystem dirs in order.
  *
  * A resolution memo short-circuits the repeat case: when the same spelling
  * (with the same system flag and, for quoted form, the same includer dir)
  * was resolved before, we go straight to the winning path — skipping the
  * dir-by-dir ENOENT storm — and the content cache serves its bytes. */
 /* Walk pp->inc_dirs[start ..] looking for `path`, opening the first hit.
  * On success fills data/size, writes the resolved path and its -isystem
  * flag, and sets *next_start to one past the winning dir (the resume point
  * for a subsequent #include_next from the resolved file). Returns 0 if no
  * configured dir holds the header. */
 static int search_inc_dirs(Pp* pp, const char* path, u32 start, const u8** data,
                            size_t* size, char* resolved, size_t resolved_cap,
                            int* resolved_system_out, u32* next_start) {
   char buf[4096];
   size_t plen = kit_slice_cstr(path).len;
   u32 i;
   for (i = start; i < pp->ninc_dirs; ++i) {
     const char* d = pp->inc_dirs[i].path;
     size_t dlen = kit_slice_cstr(d).len;
     if (dlen + 1 + plen + 1 > sizeof(buf)) continue;
     memcpy(buf, d, dlen);
     buf[dlen] = '/';
     memcpy(buf + dlen + 1, path, plen);
     buf[dlen + 1 + plen] = 0;
     if (open_include_cached(pp, buf, data, size)) {
       if (dlen + 1 + plen + 1 > resolved_cap) return 0;
       memcpy(resolved, buf, dlen + 1 + plen + 1);
       *resolved_system_out = pp->inc_dirs[i].system ? 1 : 0;
       *next_start = i + 1;
       return 1;
     }
   }
   return 0;
 }
 
 static int find_and_open_include(Pp* pp, const char* path, int system,
                                  LocRef loc, const u8** data, size_t* size,
                                  char* resolved, size_t resolved_cap,
                                  int* resolved_system_out,
                                  u32* next_start_out) {
   char buf[4096];
   size_t plen = kit_slice_cstr(path).len;
   Sym rkey = 0;
 
   /* Absolute paths and the includer-relative ("...") step are not system
    * search dirs; only a configured -isystem dir flips this to 1 below. A
    * #include_next from such a file resumes at the head of the search path. */
   *resolved_system_out = 0;
   *next_start_out = 0;
 
   if (plen > 0 && path[0] == '/') {
     if (open_include_cached(pp, path, data, size)) {
       if (plen + 1 > resolved_cap) return 0;
       memcpy(resolved, path, plen + 1);
       return 1;
     }
     return 0;
   }
 
   /* Probe the resolution memo (covers only the dir-search winners below;
    * absolute paths return above). On a hit, reopen the recorded resolved
    * path — which the content cache already holds, so this is syscall-free
    * — and reproduce the byte-identical resolved string + system flag. */
   inc_cache_ensure(pp);
   rkey = inc_resolve_key(pp, path, plen, system, loc);
   if (rkey) {
     IncResolved* hit = IncResolveMap_get(&pp->inc_resolve, rkey);
     if (hit) {
       KitSlice rp = kit_sym_str(pp->pool->c, hit->path);
       if (rp.len + 1 > resolved_cap) return 0;
       if (!open_include_cached(pp, rp.s, data, size)) return 0;
       memcpy(resolved, rp.s, rp.len + 1);
       *resolved_system_out = hit->system ? 1 : 0;
       *next_start_out = hit->next_start;
       return 1;
     }
   }
 
   if (!system) {
     char dir[4096];
     if (includer_dir(pp, loc, dir, sizeof(dir))) {
       size_t dlen = kit_slice_cstr(dir).len;
       if (dlen + 1 + plen + 1 <= sizeof(buf)) {
         memcpy(buf, dir, dlen);
         buf[dlen] = '/';
         memcpy(buf + dlen + 1, path, plen);
         buf[dlen + 1 + plen] = 0;
         if (open_include_cached(pp, buf, data, size)) {
           if (dlen + 1 + plen + 1 > resolved_cap) return 0;
           memcpy(resolved, buf, dlen + 1 + plen + 1);
           inc_resolve_record(pp, rkey, resolved, 0, 0);
           return 1;
         }
       }
     }
   }
   if (search_inc_dirs(pp, path, 0, data, size, resolved, resolved_cap,
                       resolved_system_out, next_start_out)) {
     inc_resolve_record(pp, rkey, resolved, *resolved_system_out,
                        *next_start_out);
     return 1;
   }
   return 0;
 }
 
 /* #include_next: like #include, but the search resumes at `start` (one past
  * the dir the including file was found in) and skips both the absolute-path
  * fast path and the includer-relative step. Bypasses the resolution memo —
  * the memo key does not encode the resume point, and #include_next is rare. */
 static int find_and_open_include_next(Pp* pp, const char* path, u32 start,
                                       const u8** data, size_t* size,
                                       char* resolved, size_t resolved_cap,
                                       int* resolved_system_out,
                                       u32* next_start_out) {
   *resolved_system_out = 0;
   *next_start_out = 0;
   inc_cache_ensure(pp);
   return search_inc_dirs(pp, path, start, data, size, resolved, resolved_cap,
                          resolved_system_out, next_start_out);
 }
 
 /* Decode a directly-lexed TOK_HEADER name into a NUL-terminated path.
  * Classifies <...> (system) vs "..." (local), enforces the destination
  * capacity, and writes the unwrapped contents to out. `what` is the
  * directive name used in panic messages (e.g. "#include", "#embed"). */
 static void header_name_to_path(Pp* pp, KitSlice slc, char* out, size_t cap,
                                 int* system_out, LocRef loc, const char* what) {
   const char* s = slc.s;
   size_t slen = slc.len;
   if (slen < 2)
     compiler_panic(pp->c, pp_materialize_loc(pp, loc),
                    "%s: malformed header name", what);
   if (s[0] == '<' && s[slen - 1] == '>')
     *system_out = 1;
   else if (s[0] == '"' && s[slen - 1] == '"')
     *system_out = 0;
   else
     compiler_panic(pp->c, pp_materialize_loc(pp, loc),
                    "%s: malformed header name", what);
   if (slen - 2 + 1 > cap)
     compiler_panic(pp->c, pp_materialize_loc(pp, loc), "%s: path too long",
                    what);
   memcpy(out, s + 1, slen - 2);
   out[slen - 2] = 0;
 }
 
 /* Parse the directive arguments into (path, system_flag). Handles:
  *   - directly-lexed TOK_HEADER: < ... > or " ... "
  *   - macro-replaced form: line is macro-expanded, then expected to
  *     produce either a TOK_STR ("...") or a < ... > sequence. */
 static void parse_include_path(Pp* pp, const Tok* line, u32 n, LocRef loc,
                                char* path_out, size_t cap, int* system_out) {
   if (n == 0)
     compiler_panic(pp->c, pp_materialize_loc(pp, loc),
                    "#include: missing path");
 
   if (line[0].kind == TOK_HEADER) {
     KitSlice sl = pp_text_slice(pp, &line[0]);
     header_name_to_path(pp, sl, path_out, cap, system_out, loc, "#include");
     return;
   }
 
   /* Macro-replaced form. */
   {
     TokVec exp = {0};
     Tok* slice = arena_array(pp->arena, Tok, n);
     memcpy(slice, line, sizeof(Tok) * n);
     expand_arg_to_eof(pp, slice, n, &exp);
 
     if (exp.n == 0) {
       compiler_panic(pp->c, pp_materialize_loc(pp, loc),
                      "#include: empty after macro replacement");
     }
     if (exp.data[0].kind == TOK_STR) {
       KitSlice sl = pp_text_slice(pp, &exp.data[0]);
       const char* s = sl.s;
       size_t slen = sl.len;
       if (slen < 2 || s[0] != '"' || s[slen - 1] != '"') {
         compiler_panic(pp->c, pp_materialize_loc(pp, loc),
                        "#include: malformed string");
       }
       if (slen - 2 + 1 > cap) {
         compiler_panic(pp->c, pp_materialize_loc(pp, loc),
                        "#include: path too long");
       }
       memcpy(path_out, s + 1, slen - 2);
       path_out[slen - 2] = 0;
       *system_out = 0;
       return;
     }
     if (exp.data[0].kind == TOK_PUNCT && tok_punct(&exp.data[0]) == '<') {
       size_t pos = 0;
       u32 i;
       for (i = 1; i < exp.n; ++i) {
         size_t slen = 0;
         const char* s = NULL;
         if (exp.data[i].kind == TOK_PUNCT && tok_punct(&exp.data[i]) == '>') {
           break;
         }
         {
           KitSlice sl = pp_text_slice(pp, &exp.data[i]);
           if (sl.len) {
             s = sl.s;
             slen = sl.len;
           }
         }
         if (s && pos + slen + 1 <= cap) {
           memcpy(path_out + pos, s, slen);
           pos += slen;
         }
       }
       path_out[pos] = 0;
       *system_out = 1;
       return;
     }
     compiler_panic(pp->c, pp_materialize_loc(pp, loc),
                    "#include: expected \"...\" or <...> after expansion");
   }
 }
 
 /* Shared core for #include and #include_next (is_next == 1). */
 static void do_include(Pp* pp, const Tok* line, u32 n, LocRef loc,
                        int is_next) {
   char path[4096];
   char resolved[4096];
   int system_form = 0;
   int resolved_system = 0;
   u32 next_start = 0;
   const u8* data;
   size_t size;
   Lexer* lex;
   u32 includer_id = 0;
   u32 next_search = 0;
   u32 included_id;
   u32 i;
   int found;
   TokSrc s;
   Sym pkey;
 
   parse_include_path(pp, line, n, loc, path, sizeof(path), &system_form);
 
   /* Locate the current includer (topmost SRC_LEX source): its file_id seeds
    * the include graph, and — for #include_next — its inc_next_start is the
    * point in the search path from which we resume. */
   for (i = pp->nsources; i > 0; --i) {
     TokSrc* tp = &pp->sources[i - 1];
     if (tp->kind == SRC_LEX && tp->lex) {
       includer_id = lex_file_id(tp->lex);
       next_search = tp->inc_next_start;
       break;
     }
   }
 
   if (is_next)
     found = find_and_open_include_next(pp, path, next_search, &data, &size,
                                        resolved, sizeof(resolved),
                                        &resolved_system, &next_start);
   else
     found = find_and_open_include(pp, path, system_form, loc, &data, &size,
                                   resolved, sizeof(resolved), &resolved_system,
                                   &next_start);
   if (!found) {
     compiler_panic(pp->c, pp_materialize_loc(pp, loc),
                    "%s: file not found: %.*s",
                    is_next ? "#include_next" : "#include",
                    KIT_SLICE_ARG(kit_slice_cstr(path)));
   }
 
   /* Multiple-include optimization: if this resolved file was already lexed and
    * is either #pragma once or still wrapped by a defined #ifndef guard, skip
    * re-lexing it entirely — it would emit no tokens anyway. This is the classic
    * controlling-macro optimization (tcc/gcc/clang have it); kit's IncCache
    * already serves the bytes syscall-free, but re-lexing them through
    * skip_until_active still costs the full lex+intern of every token. */
   pkey = inc_cache_key(pp, resolved);
   if (pkey) {
     for (i = pp->nsources; i > 0; --i) {
       TokSrc* tp = &pp->sources[i - 1];
       if (tp->kind == SRC_LEX && tp->once && tp->path_key == pkey) return;
     }
   }
   if (pkey && pp->inc_cache_ready) {
     IncEntry* e = IncCache_get(&pp->inc_cache, pkey);
     if (e && (e->once || (e->guard && mt_get(pp, e->guard) != NULL))) return;
   }
 
   /* Inherit the parser-feed newline policy from the primary source: in cc mode
    * an #include'd file's non-directive newlines are dropped at the lexer too
    * (the parser never sees them); -E / cpp leaves them on. */
   {
     SourceSpec spec;
     memset(&spec, 0, sizeof spec);
     spec.name = kit_slice_cstr(resolved);
     spec.bytes = (const char*)data;
     spec.len = (u32)size;
     spec.flags = (pp->parser_feed ? SRC_PARSER_FEED : 0u) |
                  (resolved_system ? SRC_SYSTEM : 0u);
     lex = lex_open(pp->c, &spec);
   }
   included_id = lex_file_id(lex);
   /* Adopt the source buffer + splice table for lazy loc/text materialization
    * (must happen before the source is pushed). */
   pp_register_srcinfo(pp, lex);
 
   memset(&s, 0, sizeof(s));
   s.kind = SRC_LEX;
   s.lex = lex;
   s.inc_next_start = next_start;
   s.path_key = pkey;
   s.guard_if_base = pp->ifstk_n;
   src_push(pp, s);
 
   kit_source_add_include(pp->c, includer_id, included_id,
                          pp_materialize_loc(pp, loc), system_form,
                          resolved_system);
 }
 
 /* ============================================================
  * #line (§6.10.4)
  * ============================================================ */
 
 /* Find the topmost SRC_LEX source on the stack — that's the "current
  * file" whose line/file should track #line directives. */
 TokSrc* current_lex_src(Pp* pp) {
   u32 i;
   for (i = pp->nsources; i > 0; --i) {
     TokSrc* s = &pp->sources[i - 1];
     if (s->kind == SRC_LEX) return s;
   }
   return NULL;
 }
 
 static void do_line(Pp* pp, const Tok* line, u32 n, LocRef loc) {
   /* Macro-replace arguments first (a2). */
   TokVec exp = {0};
   Tok* slice;
   TokSrc* lex_src;
   i64 target_line;
   Sym target_file = 0;
 
   if (n == 0)
     compiler_panic(pp->c, pp_materialize_loc(pp, loc),
                    "#line: missing arguments");
   slice = arena_array(pp->arena, Tok, n);
   memcpy(slice, line, sizeof(Tok) * n);
   expand_arg_to_eof(pp, slice, n, &exp);
 
   if (exp.n == 0 || exp.data[0].kind != TOK_NUM) {
     compiler_panic(pp->c, pp_materialize_loc(pp, loc),
                    "#line: expected line number");
   }
   {
     KitSlice s = pp_text_slice(pp, &exp.data[0]);
     target_line = parse_pp_int(s.s, s.len);
   }
   if (exp.n >= 2) {
     if (exp.data[1].kind != TOK_STR) {
       compiler_panic(pp->c, pp_materialize_loc(pp, loc),
                      "#line: file argument must be a string");
     }
     {
       KitSlice s = pp_text_slice(pp, &exp.data[1]);
       if (s.len >= 2 && s.s[0] == '"' && s.s[s.len - 1] == '"') {
         /* Destringize to logical bytes (undo \" and \\): the overlay file is
          * stored unescaped, like a real source path, and __FILE__ re-escapes
          * it uniformly when expanded. */
         char* fbuf = (char*)arena_alloc(pp->arena, s.len, 1);
         size_t flen = 0;
         destringize(pp, &exp.data[1], fbuf, s.len, &flen);
         target_file =
             kit_sym_intern(pp->pool->c, (KitSlice){.s = fbuf, .len = flen});
       }
     }
   }
 
   lex_src = current_lex_src(pp);
   if (!lex_src)
     compiler_panic(pp->c, pp_materialize_loc(pp, loc),
                    "#line outside any file");
   {
     /* Record a positional #line overlay segment: from the cursor offset where
      * the directive takes effect onward, the reported line is the physical line
      * plus `delta`, and __FILE__ reports `target_file` (0 = none given). */
     LocRef effect = lex_here(lex_src->lex);
     u32 phys = pp_phys_line(pp, effect);
     i32 delta = (i32)target_line - (i32)phys;
     pp_add_line_seg(pp, lex_file_id(lex_src->lex), effect.off, delta,
                     target_file);
   }
 }
 
 /* ============================================================
  * #pragma + _Pragma (§6.10.6, §6.10.9)
  * ============================================================ */
 
 /* Push the unmodified directive line back onto the source stack as a
  * buffer, so pp_emit_text writes it as-is. SRC_BUF gates directive
  * recognition off, so this won't recurse. */
 void emit_pragma_line(Pp* pp, const Tok* line, u32 n, LocRef loc) {
   TokVec out = {0};
   u32 i;
   Tok hash, ident, nl;
 
   memset(&hash, 0, sizeof(hash));
   hash.kind = TOK_PP_HASH;
   hash.flags = TF_AT_BOL;
   hash.loc = loc;
   hash.aux = '#';
   hash.text = text_none_ref();
   tv_push(pp, &out, hash);
 
   memset(&ident, 0, sizeof(ident));
   ident.kind = TOK_IDENT;
   ident.flags = 0;
   ident.loc = loc;
   ident.aux = pp->sym_pragma_kw;
   ident.text = text_sym_ref(pp->sym_pragma_kw);
   tv_push(pp, &out, ident);
 
   for (i = 0; i < n; ++i) {
     Tok t = line[i];
     /* Force a leading space between tokens. */
     t.flags |= TF_HAS_SPACE;
     if (i == 0) {
       /* Space between "pragma" and the first arg. */
     }
     tv_push(pp, &out, t);
   }
 
   memset(&nl, 0, sizeof(nl));
   nl.kind = TOK_NEWLINE;
   nl.loc = loc;
   tv_push(pp, &out, nl);
 
   push_buf(pp, out.data, out.n);
 }
 
 static int pragma_num_u32(Pp* pp, const Tok* t, u32* out) {
   const char* s;
   size_t len;
   u32 v = 0;
   KitSlice sl;
   if (!t || t->kind != TOK_NUM || !out) return 0;
   sl = pp_text_slice(pp, t);
   s = sl.s;
   len = sl.len;
   if (!s || len == 0) return 0;
   for (size_t i = 0; i < len; ++i) {
     if (s[i] < '0' || s[i] > '9') break;
     v = v * 10u + (u32)(s[i] - '0');
   }
   *out = v;
   return 1;
 }
 
 static void handle_pragma_pack(Pp* pp, const Tok* line, u32 n, LocRef loc) {
   u32 i = 0;
   if (n < 3 || line[0].kind != TOK_IDENT) return;
   if (!pp_text_eq_cstr(pp, &line[0], "pack")) return;
   if (line[1].kind != TOK_PUNCT || tok_punct(&line[1]) != '(') return;
   i = 2;
   if (i < n && line[i].kind == TOK_PUNCT && tok_punct(&line[i]) == ')') {
     pp->pack_align = 0;
     return;
   }
   if (i < n && line[i].kind == TOK_IDENT) {
     if (pp_text_eq_cstr(pp, &line[i], "push")) {
       if (pp->pack_stack_n <
           (u32)(sizeof pp->pack_stack / sizeof pp->pack_stack[0])) {
         pp->pack_stack[pp->pack_stack_n++] = pp->pack_align;
       } else {
         pp_warn(
             pp, pp_materialize_loc(pp, loc),
             "#pragma pack(push): pack stack overflow (max %u); push dropped",
             (u32)(sizeof pp->pack_stack / sizeof pp->pack_stack[0]));
       }
       ++i;
       if (i < n && line[i].kind == TOK_PUNCT && tok_punct(&line[i]) == ',') {
         u32 v = 0;
         ++i;
         if (i < n && pragma_num_u32(pp, &line[i], &v)) pp->pack_align = v;
       }
       return;
     }
     if (pp_text_eq_cstr(pp, &line[i], "pop")) {
       if (pp->pack_stack_n) pp->pack_align = pp->pack_stack[--pp->pack_stack_n];
       return;
     }
   }
   {
     u32 v = 0;
     if (pragma_num_u32(pp, &line[i], &v)) pp->pack_align = v;
   }
 }
 
 static void do_pragma(Pp* pp, const Tok* line, u32 n, LocRef loc) {
   /* #pragma once: mark the current file include-once for the multiple-include
    * optimization (see do_include). Still forwarded to output like any pragma.
    */
   if (n >= 1 && line[0].kind == TOK_IDENT &&
       tok_ident(&line[0]) == pp->sym_once) {
     TokSrc* gls = current_lex_src(pp);
     if (gls) gls->once = 1;
   }
   /* Forward unrecognised pragmas to the output. STDC pragmas pass
    * through too; we don't act on them yet. */
   handle_pragma_pack(pp, line, n, loc);
   emit_pragma_line(pp, line, n, loc);
 }
 
 /* Destringize a string literal token's content: strip surrounding quotes
  * and undo the `\"` and `\\` escapes. Other escape sequences pass
  * through verbatim — the result is fed back through the lexer, which
  * does its own escape handling for any string literals nested inside. */
 static void destringize(Pp* pp, const Tok* str_tok, char* out, size_t cap,
                         size_t* out_len) {
   KitSlice sl = pp_text_slice(pp, str_tok);
   const char* s = sl.s;
   size_t slen = sl.len;
   size_t i, w = 0;
   if (slen < 2 || s[0] != '"' || s[slen - 1] != '"') {
     compiler_panic(pp->c, pp_materialize_loc(pp, str_tok->loc),
                    "_Pragma: argument must be a string literal");
   }
   for (i = 1; i + 1 < slen; ++i) {
     char c = s[i];
     if (c == '\\' && i + 2 < slen && (s[i + 1] == '\\' || s[i + 1] == '"')) {
       ++i;
       c = s[i];
     }
     if (w + 1 >= cap)
       compiler_panic(pp->c, pp_materialize_loc(pp, str_tok->loc),
                      "_Pragma: payload too long");
     out[w++] = c;
   }
   out[w] = 0;
   *out_len = w;
 }
 
 /* Handle a `_Pragma("...")` invocation. Caller has consumed the
  * `_Pragma` identifier. Reads `(` STR `)`, destringizes, re-lexes the
  * payload, and emits a #pragma directive line. */
 int try_expand_pragma_op(Pp* pp, const Tok* invoke) {
   Tok lp, str, rp;
   char buf[1024];
   size_t buf_n = 0;
   Lexer* lex;
   TokVec args = {0};
 
   /* Peek '(' (skipping NL). Use peek_for_invoke_paren for consistency,
    * but we need the saved-back behavior for a non-match. */
   {
     int saw_ws;
     if (!peek_for_invoke_paren(pp, &saw_ws)) {
       return 0; /* not an invocation; emit _Pragma as ident */
     }
     (void)saw_ws;
   }
   /* Read the string literal arg. */
   str = src_next_raw(pp, NULL);
   if (str.kind != TOK_STR) {
     compiler_panic(pp->c, pp_materialize_loc(pp, invoke->loc),
                    "_Pragma: expected string literal");
   }
   rp = src_next_raw(pp, NULL);
   if (rp.kind != TOK_PUNCT || tok_punct(&rp) != ')') {
     compiler_panic(pp->c, pp_materialize_loc(pp, invoke->loc),
                    "_Pragma: expected ')'");
   }
   (void)lp;
 
   destringize(pp, &str, buf, sizeof(buf) - 2, &buf_n);
   /* Append a NL so the lexer terminates cleanly. */
   buf[buf_n++] = '\n';
   buf[buf_n] = 0;
 
   /* Re-lex into args. Bytes need to live until lex_close; copy into
    * arena. */
   {
     SourceSpec spec;
     char* arena_buf = (char*)arena_alloc(pp->arena, buf_n + 1, 1);
     memcpy(arena_buf, buf, buf_n + 1);
     memset(&spec, 0, sizeof spec);
     spec.name = kit_slice_cstr("<_Pragma>");
     spec.bytes = arena_buf;
     spec.len = (u32)buf_n;
     lex = lex_open(pp->c, &spec);
   }
   for (;;) {
     Tok t;
     lex_next(lex, &t);
     if (t.kind == TOK_EOF || t.kind == TOK_NEWLINE) break;
     /* These tokens outlive `lex`; a TEXT_SRC spelling points into the lexer's
      * own buffer, so intern it now while the lexer is still open. */
     if (t.text.kind == TEXT_SRC)
       t.text = text_intern_ref(pp, lex_text_slice(lex, t.text));
     tv_push(pp, &args, t);
   }
   lex_close(lex);
 
   emit_pragma_line(pp, args.data, args.n, invoke->loc);
   return 1;
 }
 
 /* ============================================================
  * #error / #warning
  * ============================================================ */
 
 static void directive_message(Pp* pp, const Tok* line, u32 n, CharBuf* cb) {
   u32 i;
   for (i = 0; i < n; ++i) {
     KitSlice slc = pp_text_slice(pp, &line[i]);
     const char* s = slc.s;
     size_t sl = slc.len;
     if (i > 0) cb_putc(pp, cb, ' ');
     if (s && sl) cb_append(pp, cb, s, (u32)sl);
   }
   cb_putc(pp, cb, 0);
 }
 
 static void pp_warn(Pp* pp, SrcLoc loc, const char* fmt, ...) {
   KitDiagSink* sink = kit_compiler_context(pp->c)->diag;
   va_list ap;
   if (sink && sink->emit) {
     va_start(ap, fmt);
     sink->emit(sink, KIT_DIAG_WARN, loc, fmt, ap);
     va_end(ap);
   }
   if (sink) sink->warnings++;
 }
 
 static void do_error(Pp* pp, const Tok* line, u32 n, LocRef loc) {
   CharBuf cb = {0};
   directive_message(pp, line, n, &cb);
   compiler_panic(pp->c, pp_materialize_loc(pp, loc), "#error: %.*s",
                  KIT_SLICE_ARG(kit_slice_cstr(cb.data ? cb.data : "")));
 }
 
 static void do_warning(Pp* pp, const Tok* line, u32 n, LocRef loc) {
   CharBuf cb = {0};
   directive_message(pp, line, n, &cb);
   pp_warn(pp, pp_materialize_loc(pp, loc), "#warning: %.*s",
           KIT_SLICE_ARG(kit_slice_cstr(cb.data ? cb.data : "")));
 }
 
 /* ============================================================
  * #embed (C23, §6.10.* per N3033)
  * ============================================================ */
 
 static void do_embed(Pp* pp, const Tok* line, u32 n, LocRef loc) {
   char path[4096];
   char resolved[4096];
   int system_form = 0;
   const u8* data;
   size_t size;
   u32 j;
   /* Optional embed parameters parsed below. */
   i64 limit_n = -1;
   Tok* if_empty_toks = NULL;
   u32 if_empty_n = 0;
   /* Header-name path: first token. */
   u32 arg_start = 0;
 
   if (n == 0)
     compiler_panic(pp->c, pp_materialize_loc(pp, loc), "#embed: missing path");
 
   if (line[0].kind == TOK_HEADER) {
     KitSlice slc = pp_text_slice(pp, &line[0]);
     header_name_to_path(pp, slc, path, sizeof(path), &system_form, loc,
                         "#embed");
     arg_start = 1;
   } else {
     compiler_panic(pp->c, pp_materialize_loc(pp, loc),
                    "#embed: header-name argument required");
   }
 
   /* Parse trailing parameters: limit(N), if_empty(...). */
   j = arg_start;
   while (j < n) {
     if (line[j].kind == TOK_IDENT) {
       KitSlice slc = pp_text_slice(pp, &line[j]);
       const char* s = slc.s;
       size_t sl = slc.len;
       if (sl == 5 && memcmp(s, "limit", 5) == 0) {
         if (j + 1 >= n || line[j + 1].kind != TOK_PUNCT ||
             tok_punct(&line[j + 1]) != '(') {
           compiler_panic(pp->c, pp_materialize_loc(pp, loc),
                          "#embed: expected '(' after limit");
         }
         j += 2;
         if (j >= n || line[j].kind != TOK_NUM) {
           compiler_panic(pp->c, pp_materialize_loc(pp, loc),
                          "#embed: limit() expects an integer");
         }
         {
           KitSlice s2 = pp_text_slice(pp, &line[j]);
           limit_n = parse_pp_int(s2.s, s2.len);
         }
         ++j;
         if (j >= n || line[j].kind != TOK_PUNCT || tok_punct(&line[j]) != ')') {
           compiler_panic(pp->c, pp_materialize_loc(pp, loc),
                          "#embed: expected ')' to close limit");
         }
         ++j;
         continue;
       }
       if (sl == 8 && memcmp(s, "if_empty", 8) == 0) {
         u32 depth = 0;
         u32 start;
         if (j + 1 >= n || line[j + 1].kind != TOK_PUNCT ||
             tok_punct(&line[j + 1]) != '(') {
           compiler_panic(pp->c, pp_materialize_loc(pp, loc),
                          "#embed: expected '(' after if_empty");
         }
         j += 2;
         start = j;
         while (j < n) {
           if (line[j].kind == TOK_PUNCT) {
             if (tok_punct(&line[j]) == '(')
               ++depth;
             else if (tok_punct(&line[j]) == ')') {
               if (depth == 0) break;
               --depth;
             }
           }
           ++j;
         }
         if (j >= n) {
           compiler_panic(pp->c, pp_materialize_loc(pp, loc),
                          "#embed: unterminated if_empty");
         }
         if_empty_toks = arena_array(pp->arena, Tok, j - start ? j - start : 1);
         if_empty_n = j - start;
         memcpy(if_empty_toks, line + start, sizeof(Tok) * if_empty_n);
         ++j; /* skip ')' */
         continue;
       }
     }
     compiler_panic(pp->c, pp_materialize_loc(pp, loc),
                    "#embed: unexpected token in parameter list");
   }
 
   {
     /* #embed does not record a dependency edge, so the resolved-dir system
      * flag and #include_next resume point are not consumed here. */
     int embed_resolved_system = 0;
     u32 embed_next_start = 0;
     if (!find_and_open_include(pp, path, system_form, loc, &data, &size,
                                resolved, sizeof(resolved),
                                &embed_resolved_system, &embed_next_start)) {
       compiler_panic(pp->c, pp_materialize_loc(pp, loc),
                      "#embed: file not found: %.*s",
                      KIT_SLICE_ARG(kit_slice_cstr(path)));
     }
   }
 
   /* Apply limit(). */
   {
     size_t emit_n = size;
     if (limit_n >= 0 && (u64)limit_n < emit_n) emit_n = (size_t)limit_n;
     if (emit_n == 0) {
       /* Empty: emit if_empty payload (or nothing). */
       if (if_empty_toks && if_empty_n) {
         push_buf(pp, if_empty_toks, if_empty_n);
       }
       return;
     }
     /* Build a buffer of pp-numbers separated by ',' punctuators. */
     {
       TokVec out = {0};
       size_t i;
       for (i = 0; i < emit_n; ++i) {
         char numbuf[8];
         int nl = 0;
         u8 v = data[i];
         /* "u8 -> decimal" without sprintf. */
         if (v == 0) {
           numbuf[nl++] = '0';
         } else {
           char tmp[4];
           int k = 0;
           while (v) {
             tmp[k++] = (char)('0' + (v % 10));
             v /= 10;
           }
           while (k > 0) numbuf[nl++] = tmp[--k];
         }
         {
           Tok t;
           memset(&t, 0, sizeof(t));
           t.kind = TOK_NUM;
           t.loc = loc;
           t.aux = 0;
           t.text =
               text_intern_ref(pp, (KitSlice){.s = numbuf, .len = (size_t)nl});
           if (i == 0) t.flags = TF_AT_BOL;
           /* Bytes after a comma get a leading space to match
            * clang's `, ` separator format. */
           else
             t.flags = TF_HAS_SPACE;
           tv_push(pp, &out, t);
         }
         if (i + 1 < emit_n) {
           Tok comma;
           memset(&comma, 0, sizeof(comma));
           comma.kind = TOK_PUNCT;
           comma.aux = ',';
           comma.loc = loc;
           comma.text = text_none_ref();
           tv_push(pp, &out, comma);
         }
       }
       push_buf(pp, out.data, out.n);
     }
   }
 }
 
 /* ============================================================
  * Directive dispatch
  * ============================================================ */
 
 void process_directive(Pp* pp, LocRef hash_loc) {
   Tok* line;
   u32 n;
   Sym name;
 
   read_directive_line(pp, &line, &n);
   if (n == 0) {
     /* Null directive: '#' newline. Nothing to do. */
     return;
   }
   if (line[0].kind != TOK_IDENT) {
     compiler_panic(pp->c, pp_materialize_loc(pp, line[0].loc),
                    "expected directive name after '#'");
   }
   name = tok_ident(&line[0]);
 
   /* Multiple-include-guard state machine, run on the current file source
    * before dispatch. The only directive that may open a whole-file guard is
    * `#ifndef MACRO` as the very first directive (nothing but whitespace before
    * it, at the file's base if-depth); any other directive seen at START, or any
    * directive at all after the controlling #endif (AFTER), disqualifies it.
    * #pragma is exempt — #pragma once is its own (orthogonal) mechanism. */
   {
     TokSrc* gls = current_lex_src(pp);
     if (gls && name != pp->sym_pragma) {
       if (gls->guard_state == GUARD_START) {
         if (name == pp->sym_ifndef && n >= 2 && line[1].kind == TOK_IDENT &&
             pp->ifstk_n == gls->guard_if_base) {
           gls->guard_macro = tok_ident(&line[1]);
           gls->guard_state = GUARD_IN;
         } else {
           gls->guard_state = GUARD_FAILED;
         }
       } else if (gls->guard_state == GUARD_AFTER) {
         gls->guard_state = GUARD_FAILED;
       }
     }
   }
 
   if (name == pp->sym_define)
     do_define(pp, line + 1, n - 1);
   else if (name == pp->sym_undef)
     do_undef(pp, line + 1, n - 1);
   else if (name == pp->sym_if)
     do_if_directive(pp, line + 1, n - 1, hash_loc);
   else if (name == pp->sym_ifdef)
     do_ifdef(pp, line + 1, n - 1, 0, hash_loc);
   else if (name == pp->sym_ifndef)
     do_ifdef(pp, line + 1, n - 1, 1, hash_loc);
   else if (name == pp->sym_elif)
     do_elif(pp, hash_loc);
   else if (name == pp->sym_else)
     do_else(pp, hash_loc);
   else if (name == pp->sym_endif)
     do_endif(pp, hash_loc);
   else if (name == pp->sym_include)
     do_include(pp, line + 1, n - 1, hash_loc, 0);
   else if (name == pp->sym_include_next)
     do_include(pp, line + 1, n - 1, hash_loc, 1);
   else if (name == pp->sym_line)
     do_line(pp, line + 1, n - 1, hash_loc);
   else if (name == pp->sym_pragma)
     do_pragma(pp, line + 1, n - 1, hash_loc);
   else if (name == pp->sym_error)
     do_error(pp, line + 1, n - 1, hash_loc);
   else if (name == pp->sym_warning)
     do_warning(pp, line + 1, n - 1, hash_loc);
   else if (name == pp->sym_embed)
     do_embed(pp, line + 1, n - 1, hash_loc);
   else {
     compiler_panic(pp->c, pp_materialize_loc(pp, line[0].loc),
                    "unsupported directive");
   }
 
   /* The controlling #endif (the one returning the if-stack to the file's base
    * depth) closes a candidate guard. After this only whitespace/newlines may
    * follow for the guard to hold; any further token/directive flips it to
    * FAILED (see the START/AFTER handling above and the content check in
    * src_next_raw_into). do_include/do_undef etc. do not change current_lex_src
    * out from under us here because this only fires for #endif. */
   if (name == pp->sym_endif) {
     TokSrc* gls = current_lex_src(pp);
     if (gls && gls->guard_state == GUARD_IN &&
         pp->ifstk_n == gls->guard_if_base) {
       gls->guard_state = GUARD_AFTER;
     }
   }
 }