kit

c_emit.c (147437B)

---

 /* C-source emission core. See doc/CBACKEND.md.
  *
  * Output strategy
  * ---------------
  * Each function buffers two CBufs while CG walks the body:
  *   decls — variable declarations: "  long long v3;\n"
  *   body  — TU-wide running output; we accumulate signature/body/closing-brace
  *           across all functions; func_end splices decls in after the open
  *           brace using the recorded fn_body_start bookmark.
  *
  * c_emit_finalize flushes a tiny prologue + body to the writer.
  *
  * Local declaration is lazy: every operand emit goes through c_ensure_local,
  * which appends one declaration for each semantic local. */
 
 #include "arch/c_target/c_emit.h"
 
 #include <stdio.h>
 #include <string.h>
 
 #include "cg/type.h"
 #include "core/arena.h"
 #include "core/core.h"
 #include "core/heap.h"
 #include "core/pool.h"
 #include "core/slice.h"
 #include "core/vec.h"
 #include "obj/format.h"
 #include "obj/obj.h"
 
 /* Forward decls. */
 static void c_ensure_typedef(CTarget* t, KitCgTypeId tid);
 static const char* c_typedef_name(CTarget* t, KitCgTypeId tid);
 static const char* c_typename(CTarget* t, KitCgTypeId type);
 static KitCgTypeId c_local_type_or_panic(CTarget* t, CGLocal local);
 static Operand c_op_local(CGLocal local, KitCgTypeId type);
 static int c_type_is_aggregate(CTarget* t, KitCgTypeId type);
 static int c_type_is_bool(CTarget* t, KitCgTypeId type);
 static int c_type_is_ptr(CTarget* t, KitCgTypeId type);
 static int c_operand_is_ptr_typed(CTarget* t, Operand op);
 static void c_emit_addr_deref(CTarget* t, Operand addr,
                               KitCgTypeId access_type);
 static void c_emit_copy_addr(CTarget* t, Operand addr);
 CGLocal c_emit_local(CTarget* t, const CGLocalDesc* d);
 /* Private accessor on ObjBuilder (defined in obj/obj.c, not in obj.h).
  * Same forward-decl trick as obj_tls.c uses. */
 ObjSymId obj_tlv_bootstrap_get(const ObjBuilder*);
 
 /* === Growable-array helpers ===
  *
  * The C target's growable tables are heap-backed (allocated from
  * t->c->ctx->heap and freed in c_emit_destroy), so they route through
  * core/vec.h's VEC_GROW rather than hand-rolling the doubling realloc.
  *
  * c_vec_grow_or_panic: ensure capacity >= want, panicking on OOM. Used by
  * append-style tables (scopes, local_static_*) where the live region is
  * tracked by a separate count and the grown tail is never read before being
  * written.
  *
  * c_vec_grow_zeroed: same, but zero-fills the newly grown tail. Used by
  * index-addressed tables (type_state, local_*, sym_forwarded) that are read
  * at arbitrary indices and rely on a zero default. VEC_GROW does not zero,
  * so we capture the pre-grow cap and clear [old_cap, new_cap).
  *
  * Both are macros so VEC_GROW can derive element size/alignment from *ptr. */
 #define c_vec_grow_or_panic(t, ptr, cap, want)                              \
   do {                                                                      \
     if (VEC_GROW((t)->c->ctx->heap, (ptr), (cap), (want))) {                \
       compiler_panic((t)->c, (SrcLoc){0, 0, 0}, "C target: out of memory"); \
     }                                                                       \
   } while (0)
 
 #define c_vec_grow_zeroed(t, ptr, cap, want)                   \
   do {                                                         \
     u32 c_vgz_old_ = (cap);                                    \
     c_vec_grow_or_panic((t), (ptr), (cap), (want));            \
     if ((cap) > c_vgz_old_) {                                  \
       memset((ptr) + c_vgz_old_, 0,                            \
              ((size_t)((cap) - c_vgz_old_)) * sizeof(*(ptr))); \
     }                                                          \
   } while (0)
 
 /* === Target state === */
 
 void c_emit_target_init(CTarget* t, Compiler* c, ObjBuilder* o, KitWriter* w) {
   memset(t, 0, sizeof *t);
   t->c = c;
   t->obj = o;
   t->w = w;
   cbuf_init(&t->forwards, c->ctx->heap);
   cbuf_init(&t->typedefs, c->ctx->heap);
   cbuf_init(&t->data_defs, c->ctx->heap);
   cbuf_init(&t->decls, c->ctx->heap);
   cbuf_init(&t->body, c->ctx->heap);
 }
 
 CTarget* c_emit_target_new(Compiler* c, ObjBuilder* o, KitWriter* w) {
   CTarget* t = arena_new(c->tu, CTarget);
   if (!t) return NULL;
   c_emit_target_init(t, c, o, w);
   return t;
 }
 
 /* === Writer helpers === */
 
 void c_writer_write(CTarget* t, const void* data, size_t n) {
   KitStatus st = kit_writer_write(t->w, data, n);
   if (st != KIT_OK) {
     SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
     compiler_panic(t->c, loc, "C target: writer error %d", (int)st);
   }
 }
 
 void c_writer_puts(CTarget* t, const char* s) {
   size_t n = 0;
   while (s[n]) ++n;
   c_writer_write(t, s, n);
 }
 
 /* === CLocal / type emission === */
 
 static const char* c_int_type_name_for_width(u32 width, int signed_) {
   switch (width) {
     case 1:
     case 8:
       return signed_ ? "int8_t" : "uint8_t";
     case 16:
       return signed_ ? "int16_t" : "uint16_t";
     case 32:
       return signed_ ? "int32_t" : "uint32_t";
     case 64:
       return signed_ ? "int64_t" : "uint64_t";
     case 128:
       return signed_ ? "__int128" : "unsigned __int128";
     default:
       return NULL;
   }
 }
 
 /* Returns the integer width for sign-aware emission. 0 if the type isn't a
  * fixed-width integer (float, ptr, void, aggregate). */
 static u32 c_int_width_for_signedness(CTarget* t, KitCgTypeId type) {
   if (type == KIT_CG_TYPE_NONE) return 0;
   const CgType* ty = cg_type_get(t->c, type);
   if (!ty) return 0;
   if (ty->kind == KIT_CG_TYPE_INT) return ty->integer.width;
   if (ty->kind == KIT_CG_TYPE_BOOL) return 32; /* bool maps to int32_t */
   return 0;
 }
 
 /* === Typedef machinery ===
  *
  * Composite types (records, arrays, function types) are emitted as opaque
  * byte-storage typedefs in a TU-wide typedefs section. The typedef name is
  * `__ty_<id>` keyed on the unaliased type id; this is stable for the
  * compiler instance.
  *
  * For records and arrays the typedef wraps a single `_Alignas(A) uint8_t
  * raw[N];` member, so all field/element access is mediated by the existing
  * `(*(T*)((char*)addr + ofs))` path. This sidesteps any ABI ambiguity (C
  * bitfield rules, array decay, packed/aligned attribute interactions) and
  * keeps types orthogonal to access patterns.
  *
  * For function types we emit a function-pointer typedef `R (*__ty_N)(...)`,
  * used for indirect calls and function-pointer-typed values. */
 
 static void c_grow_type_state(CTarget* t, u32 needed) {
   c_vec_grow_zeroed(t, t->type_state, t->type_state_cap, needed);
 }
 
 static const char* c_typedef_name(CTarget* t, KitCgTypeId tid) {
   char buf[32];
   int n = snprintf(buf, sizeof buf, "__ty_%u", (unsigned)tid);
   Sym s = pool_intern_slice(t->c->global, (Slice){.s = buf, .len = (size_t)n});
   return pool_slice(t->c->global, s).s;
 }
 
 /* Forward decl. */
 static void c_emit_typedef_for_func(CTarget* t, KitCgTypeId tid,
                                     const CgType* ty);
 
 static void c_ensure_typedef(CTarget* t, KitCgTypeId tid) {
   KitCgTypeId u = tid;
   if ((u32)u >= t->type_state_cap) c_grow_type_state(t, (u32)u + 1u);
   if (t->type_state[u] >= 2) return;
   if (t->type_state[u] == 1) return; /* cyclic — emit forward-only */
   t->type_state[u] = 1;
   const CgType* ty = cg_type_get(t->c, u);
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   if (!ty)
     compiler_panic(t->c, loc, "C target: unknown type id %u", (unsigned)u);
   switch (ty->kind) {
     case KIT_CG_TYPE_FUNC:
       c_emit_typedef_for_func(t, u, ty);
       break;
     case KIT_CG_TYPE_RECORD: {
       /* Recurse on field types so any composite-typed field has its
        * typedef emitted first. (Records-by-value are accessed only via
        * pointer arithmetic in kit CG, but emitting deps first keeps the
        * output readable and stable.) */
       for (u32 i = 0; i < ty->record.nfields; ++i) {
         if (!(ty->record.fields[i].flags & KIT_CG_FIELD_BITFIELD)) {
           KitCgTypeId ft = ty->record.fields[i].type;
           KitCgTypeId ftu = ft;
           const CgType* fty = cg_type_get(t->c, ftu);
           if (fty && (fty->kind == KIT_CG_TYPE_RECORD ||
                       fty->kind == KIT_CG_TYPE_ARRAY ||
                       fty->kind == KIT_CG_TYPE_FUNC)) {
             c_ensure_typedef(t, ftu);
           }
         }
       }
       cbuf_puts(&t->typedefs, "typedef struct { _Alignas(");
       cbuf_put_u64(&t->typedefs, (u64)cg_type_align(t->c, u));
       cbuf_puts(&t->typedefs, ") uint8_t raw[");
       cbuf_put_u64(&t->typedefs, cg_type_size(t->c, u));
       cbuf_puts(&t->typedefs, "]; } __ty_");
       cbuf_put_u64(&t->typedefs, (u64)u);
       cbuf_puts(&t->typedefs, ";\n");
       break;
     }
     case KIT_CG_TYPE_ARRAY: {
       KitCgTypeId eu = ty->array.elem;
       const CgType* ety = cg_type_get(t->c, eu);
       if (ety &&
           (ety->kind == KIT_CG_TYPE_RECORD || ety->kind == KIT_CG_TYPE_ARRAY ||
            ety->kind == KIT_CG_TYPE_FUNC)) {
         c_ensure_typedef(t, eu);
       }
       cbuf_puts(&t->typedefs, "typedef struct { _Alignas(");
       cbuf_put_u64(&t->typedefs, (u64)cg_type_align(t->c, u));
       cbuf_puts(&t->typedefs, ") uint8_t raw[");
       cbuf_put_u64(&t->typedefs, cg_type_size(t->c, u));
       cbuf_puts(&t->typedefs, "]; } __ty_");
       cbuf_put_u64(&t->typedefs, (u64)u);
       cbuf_puts(&t->typedefs, ";\n");
       break;
     }
     default:
       compiler_panic(t->c, loc,
                      "C target: c_ensure_typedef on non-composite kind %d",
                      (int)ty->kind);
   }
   t->type_state[u] = 2;
 }
 
 static void c_emit_typedef_for_func(CTarget* t, KitCgTypeId tid,
                                     const CgType* ty) {
   /* Emit recursively for return and param types if they're composites. */
   KitCgTypeId ret = cg_func_ret_type(ty);
   const CgType* rty = cg_type_get(t->c, ret);
   if (rty &&
       (rty->kind == KIT_CG_TYPE_RECORD || rty->kind == KIT_CG_TYPE_ARRAY ||
        rty->kind == KIT_CG_TYPE_FUNC)) {
     c_ensure_typedef(t, ret);
   }
   for (u32 i = 0; i < ty->func.nparams; ++i) {
     KitCgTypeId pt = ty->func.params[i].type;
     const CgType* pty = cg_type_get(t->c, pt);
     if (pty &&
         (pty->kind == KIT_CG_TYPE_RECORD || pty->kind == KIT_CG_TYPE_ARRAY ||
          pty->kind == KIT_CG_TYPE_FUNC)) {
       c_ensure_typedef(t, pt);
     }
   }
   cbuf_puts(&t->typedefs, "typedef ");
   cbuf_puts(&t->typedefs, c_typename(t, cg_func_ret_type(ty)));
   cbuf_puts(&t->typedefs, " (*__ty_");
   cbuf_put_u64(&t->typedefs, (u64)tid);
   cbuf_puts(&t->typedefs, ")(");
   if (ty->func.nparams == 0 && !ty->func.abi_variadic) {
     cbuf_puts(&t->typedefs, "void");
   } else {
     for (u32 i = 0; i < ty->func.nparams; ++i) {
       if (i > 0) cbuf_puts(&t->typedefs, ", ");
       cbuf_puts(&t->typedefs, c_typename(t, ty->func.params[i].type));
     }
     if (ty->func.abi_variadic) {
       if (ty->func.nparams > 0) cbuf_puts(&t->typedefs, ", ");
       cbuf_puts(&t->typedefs, "...");
     }
   }
   cbuf_puts(&t->typedefs, ");\n");
 }
 
 static const char* c_int_type_for_width_panic(CTarget* t, u32 width,
                                               int signed_) {
   const char* s = c_int_type_name_for_width(width, signed_);
   if (!s) {
     SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
     compiler_panic(t->c, loc, "C target: int width %u not yet supported",
                    (unsigned)width);
   }
   return s;
 }
 
 static const char* c_float_type_name(u32 width) {
   switch (width) {
     case 32:
       return "float";
     case 64:
       return "double";
     case 80:
     case 128:
       return "long double";
     default:
       return NULL;
   }
 }
 
 /* Returns the C type name for a CG type id. Scalars map to fixed-width
  * <stdint.h> types or float/double/long double; pointers collapse to void*;
  * composites (records/arrays/funcs) emit an opaque-storage typedef on first
  * sighting and return the typedef name. */
 static const char* c_typename(CTarget* t, KitCgTypeId type) {
   KitCgTypeId resolved = type;
   const CgType* ty = cg_type_get(t->c, resolved);
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   if (!ty) {
     compiler_panic(t->c, loc, "C target: unknown type id %u", (unsigned)type);
   }
   switch (ty->kind) {
     case KIT_CG_TYPE_VOID:
       return "void";
     case KIT_CG_TYPE_BOOL:
       return "int32_t";
     case KIT_CG_TYPE_INT:
       return c_int_type_for_width_panic(t, ty->integer.width, 1);
     case KIT_CG_TYPE_FLOAT: {
       const char* s = c_float_type_name(ty->fp.width);
       if (!s) {
         compiler_panic(t->c, loc, "C target: fp width %u not yet supported",
                        (unsigned)ty->fp.width);
       }
       return s;
     }
     case KIT_CG_TYPE_PTR:
       return "void*";
     case KIT_CG_TYPE_ENUM:
       /* CG enums are width-only; treat as their underlying integer base. */
       return c_typename(t, ty->enum_.base);
     case KIT_CG_TYPE_VARARG_STATE:
       t->need_stdarg = 1;
       return "va_list";
     case KIT_CG_TYPE_RECORD:
     case KIT_CG_TYPE_ARRAY:
     case KIT_CG_TYPE_FUNC:
       c_ensure_typedef(t, resolved);
       return c_typedef_name(t, resolved);
     default:
       compiler_panic(t->c, loc, "C target: type kind %d not yet supported",
                      (int)ty->kind);
   }
 }
 
 void c_emit_type(CTarget* t, CBuf* b, KitCgTypeId type) {
   cbuf_puts(b, c_typename(t, type));
 }
 
 static KitCgTypeId c_local_type_or_panic(CTarget* t, CGLocal local) {
   if ((u32)local < t->local_cap && t->local_declared[local] &&
       t->local_type[local]) {
     return t->local_type[local];
   }
   compiler_panic(t->c, t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0},
                  "C target: unknown local type for v%u", (unsigned)local);
   return KIT_CG_TYPE_NONE;
 }
 
 static Operand c_op_local(CGLocal local, KitCgTypeId type) {
   Operand op;
   memset(&op, 0, sizeof op);
   op.kind = OPK_LOCAL;
   op.type = type;
   op.v.local = local;
   return op;
 }
 
 void c_local_name(CLocal r, char* out, size_t cap) {
   size_t i = 0;
   if (cap == 0) return;
   if (cap > 1) out[i++] = 'v';
   char tmp[16];
   size_t n = 0;
   u32 v = (u32)r;
   if (v == 0) {
     tmp[n++] = '0';
   } else {
     while (v) {
       tmp[n++] = (char)('0' + (v % 10));
       v /= 10;
     }
   }
   while (n && i + 1 < cap) out[i++] = tmp[--n];
   out[i] = '\0';
 }
 
 static void c_grow_local_table(CTarget* t, u32 needed) {
   /* Two parallel arrays kept at a single shared local_cap. Grow each from the
    * same old cap to the same new cap via independent cap trackers, then commit
    * the shared cap once. (They always grow together, so both reach the same
    * VEC_GROW-derived capacity.) */
   u32 declared_cap = t->local_cap;
   u32 type_cap = t->local_cap;
   c_vec_grow_zeroed(t, t->local_declared, declared_cap, needed);
   c_vec_grow_zeroed(t, t->local_type, type_cap, needed);
   t->local_cap = declared_cap;
 }
 
 /* Emit the trailing `__attribute__((unused)) = INIT;` for a local decl of
  * type `ty`. Scalars get `= 0` (readable); aggregates get `= {0}` (the only
  * form that compiles for record/array). va_list also takes `= {0}`: the host's
  * <stdarg.h> va_list is an aggregate (struct/array) on common ABIs (aarch64,
  * x86-64 SysV) where `= 0` is invalid, and `= {0}` is also valid for the
  * pointer form (e.g. Apple), so it is the portable choice. */
 static void c_emit_zero_init(CTarget* t, KitCgTypeId ty) {
   const CgType* cgt = ty ? cg_type_get(t->c, ty) : NULL;
   int braced = cgt && (cgt->kind == KIT_CG_TYPE_RECORD ||
                        cgt->kind == KIT_CG_TYPE_ARRAY ||
                        cgt->kind == KIT_CG_TYPE_VARARG_STATE);
   cbuf_puts(&t->decls, braced ? " __attribute__((unused)) = {0};\n"
                               : " __attribute__((unused)) = 0;\n");
 }
 
 void c_ensure_local(CTarget* t, CLocal r, KitCgTypeId type) {
   if (r == (CLocal)CG_LOCAL_NONE) {
     compiler_panic(t->c, (SrcLoc){0, 0, 0},
                    "C target: CG_LOCAL_NONE reached emission");
   }
   if ((u32)r >= t->local_cap) c_grow_local_table(t, (u32)r + 1u);
   if (t->local_declared[r]) {
     if (type && t->local_type[r] != type) {
       compiler_panic(t->c, t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0},
                      "C target: local v%u used with inconsistent type "
                      "(declared %u, used %u)",
                      (unsigned)r, (unsigned)t->local_type[r], (unsigned)type);
     }
     return;
   }
   t->local_declared[r] = 1;
   t->local_type[r] = type;
   cbuf_puts(&t->decls, "  ");
   c_emit_type(t, &t->decls, type);
   cbuf_puts(&t->decls, " ");
   char buf[24];
   c_local_name(r, buf, sizeof buf);
   cbuf_puts(&t->decls, buf);
   /* Zero-init kills -Wsometimes-uninitialized for control flow clang can't
    * reason through; the host C compiler DSEs the init when a real
    * assignment dominates. Scalars get `= 0`, aggregates `= {0}`. */
   c_emit_zero_init(t, type);
 }
 
 /* Emit a signed-int64 literal. INT64_MIN can't be written directly: clang
  * treats `-9223372036854775808` as `-(9223372036854775808)` with the inner
  * literal too large for any signed type, which trips
  * -Wimplicitly-unsigned-literal. The standard workaround is
  * `(-9223372036854775807LL - 1)`. */
 static void c_emit_imm_literal(CTarget* t, i64 v) {
   if (v == (i64)((u64)1u << 63u)) {
     cbuf_puts(&t->body, "(-9223372036854775807LL - 1)");
     return;
   }
   cbuf_put_i64(&t->body, v);
 }
 
 /* Address-mode tuple decoded from an OPK_INDIRECT operand. Mirrors the
  * `addr_mode` helper in the machine-code backends so all targets share a
  * single in-backend view of `base [+ index << log2_scale] + ofs`. */
 typedef struct CAddrMode {
   CLocal base;
   CLocal index;  /* CG_LOCAL_NONE when no index operand */
   u8 log2_scale; /* meaningful only when index != CG_LOCAL_NONE */
   i32 ofs;
 } CAddrMode;
 
 static CAddrMode c_addr_mode(Operand addr) {
   CAddrMode m;
   m.base = addr.v.ind.base;
   m.index = addr.v.ind.index;
   m.log2_scale = addr.v.ind.log2_scale;
   m.ofs = addr.v.ind.ofs;
   return m;
 }
 
 /* Emit `(char*)base [+ (uintptr_t)index * (1u << log2_scale)] [+ ofs]` into
  * the body, with each optional term suppressed when absent. Used by every
  * OPK_INDIRECT renderer; the caller wraps it with the appropriate
  * `(*(T*)(...))` or `((T)(...))` cast. */
 static void c_emit_indirect_addr_expr(CTarget* t, CAddrMode m) {
   char rbuf[24];
   cbuf_puts(&t->body, "(char*)");
   c_local_name(m.base, rbuf, sizeof rbuf);
   cbuf_puts(&t->body, rbuf);
   if (m.index != CG_LOCAL_NONE) {
     cbuf_puts(&t->body, " + (uintptr_t)");
     c_local_name(m.index, rbuf, sizeof rbuf);
     cbuf_puts(&t->body, rbuf);
     cbuf_puts(&t->body, " * ");
     /* Spell as the explicit 1/2/4/8 literal corresponding to log2_scale.
      * log2_scale is normalized to {0,1,2,3} by cg. */
     cbuf_put_u64(&t->body, (u64)(1u << m.log2_scale));
   }
   if (m.ofs != 0) {
     cbuf_puts(&t->body, " + ");
     cbuf_put_i64(&t->body, (i64)m.ofs);
   }
 }
 
 /* Assert that `addr`, if OPK_INDIRECT, has no index operand. Used by paths
  * the cg layer guarantees never carry the indexed shape (bitfield, atomics,
  * copy_bytes/set_bytes, inline asm). */
 static void c_assert_no_index(CTarget* t, Operand addr, const char* where) {
   if (addr.kind != OPK_INDIRECT) return;
   if (addr.v.ind.index == CG_LOCAL_NONE) return;
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   compiler_panic(t->c, loc,
                  "C target: %.*s: indexed OPK_INDIRECT not allowed here",
                  SLICE_ARG(slice_from_cstr(where)));
 }
 
 void c_emit_operand(CTarget* t, Operand op) {
   char buf[24];
   switch (op.kind) {
     case OPK_IMM:
       if (op.type == KIT_CG_TYPE_NONE) {
         /* Untyped IMM (e.g. memset byte value): emit the literal raw. */
         cbuf_putc(&t->body, '(');
         c_emit_imm_literal(t, op.v.imm);
         cbuf_putc(&t->body, ')');
       } else {
         cbuf_puts(&t->body, "((");
         c_emit_type(t, &t->body, op.type);
         cbuf_puts(&t->body, ")");
         c_emit_imm_literal(t, op.v.imm);
         cbuf_puts(&t->body, ")");
       }
       return;
     case OPK_LOCAL: {
       c_ensure_local(t, op.v.local, op.type);
       c_local_name(op.v.local, buf, sizeof buf);
       cbuf_puts(&t->body, buf);
       return;
     }
     case OPK_INDIRECT: {
       /* Used by call paths to pass aggregates by-address: the operand's type
        * is the aggregate, the storage is `base + index*scale + ofs`. Emit the
        * deref as a value expression. */
       cbuf_puts(&t->body, "(*(");
       c_emit_type(t, &t->body, op.type);
       cbuf_puts(&t->body, "*)(");
       c_emit_indirect_addr_expr(t, c_addr_mode(op));
       cbuf_puts(&t->body, "))");
       return;
     }
     case OPK_GLOBAL: {
       /* OPK_GLOBAL carries `&sym + addend`. How we spell it depends on
        * op.type:
        *   - pointer/scalar/void: the value IS the address, so cast through
        *     `((T)((char*)sym + addend))`.
        *   - aggregate (RECORD/ARRAY): the symbol's storage is an aggregate
        *     value; emit `(*(T*)((char*)sym + addend))` so the deref reads
        *     the aggregate value (used by call args that pass struct
        *     by-value via a global initialized buffer). */
       obj_sym_mark_referenced(t->obj, op.v.global.sym);
       const char* nm = c_sym_name(t, op.v.global.sym);
       const CgType* gty =
           (op.type != KIT_CG_TYPE_NONE) ? cg_type_get(t->c, op.type) : NULL;
       int is_aggregate = gty && (gty->kind == KIT_CG_TYPE_RECORD ||
                                  gty->kind == KIT_CG_TYPE_ARRAY);
       if (is_aggregate) {
         cbuf_puts(&t->body, "(*(");
         c_emit_type(t, &t->body, op.type);
         cbuf_puts(&t->body, "*)((char*)&");
         cbuf_puts(&t->body, nm);
         if (op.v.global.addend != 0) {
           cbuf_puts(&t->body, " + ");
           cbuf_put_i64(&t->body, op.v.global.addend);
         }
         cbuf_puts(&t->body, "))");
       } else {
         cbuf_puts(&t->body, "((");
         if (op.type != KIT_CG_TYPE_NONE) {
           c_emit_type(t, &t->body, op.type);
         } else {
           cbuf_puts(&t->body, "void*");
         }
         cbuf_puts(&t->body, ")((char*)&");
         cbuf_puts(&t->body, nm);
         if (op.v.global.addend != 0) {
           cbuf_puts(&t->body, " + ");
           cbuf_put_i64(&t->body, op.v.global.addend);
         }
         cbuf_puts(&t->body, "))");
       }
       return;
     }
     default: {
       SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
       compiler_panic(t->c, loc, "C target: operand kind %d not yet supported",
                      (int)op.kind);
     }
   }
 }
 
 static int c_type_is_float(CTarget* t, KitCgTypeId type) {
   if (type == KIT_CG_TYPE_NONE) return 0;
   const CgType* ty = cg_type_get(t->c, type);
   return ty && ty->kind == KIT_CG_TYPE_FLOAT;
 }
 
 /* True iff a and b name the same CG type. */
 static int c_types_equiv(CTarget* t, KitCgTypeId a, KitCgTypeId b) {
   (void)t;
   if (a == 0 || b == 0) return 0;
   return a == b;
 }
 
 /* Emit "  vN = " plus any cast needed for a C assignment expression.
  * Caller must then emit the RHS expression and call c_emit_local_assign_close.
  *
  * `rhs_ty` is the CG type the RHS expression will produce (or 0 if unknown).
  * Pointer/int crossings bridge through uintptr_t to keep host-C diagnostics
  * quiet. The outer `(...)` parens are kept so the closer's `);` stays
  * balanced. */
 static void c_emit_local_assign_open(CTarget* t, CLocal r, KitCgTypeId rhs_ty) {
   if ((u32)r >= t->local_cap || !t->local_declared[r]) {
     compiler_panic(t->c, t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0},
                    "C target: assign to undeclared local v%u", (unsigned)r);
   }
   KitCgTypeId decl = t->local_type[r];
   char buf[24];
   c_local_name(r, buf, sizeof buf);
   cbuf_puts(&t->body, "  ");
   cbuf_puts(&t->body, buf);
   cbuf_puts(&t->body, " = ");
   if (!c_types_equiv(t, rhs_ty, decl)) {
     cbuf_putc(&t->body, '(');
     c_emit_type(t, &t->body, decl);
     cbuf_putc(&t->body, ')');
     if (!c_type_is_float(t, decl) &&
         (!rhs_ty || c_type_is_ptr(t, decl) || c_type_is_ptr(t, rhs_ty))) {
       cbuf_puts(&t->body, "(uintptr_t)");
     }
   }
   cbuf_puts(&t->body, "(");
 }
 
 static void c_emit_local_assign_close(CTarget* t) {
   cbuf_puts(&t->body, ");\n");
 }
 
 void c_emit_operand_signed(CTarget* t, Operand op, int signed_) {
   u32 w = c_int_width_for_signedness(t, op.type);
   if (w == 0) {
     /* Not an integer — emit without sign cast. */
     c_emit_operand(t, op);
     return;
   }
   const char* tn = c_int_type_name_for_width(w, signed_);
   if (!tn) {
     c_emit_operand(t, op);
     return;
   }
   int via_uptr = c_operand_is_ptr_typed(t, op);
   /* CG ints are width-only; the C target declares every int local/IMM
    * as the signed `int{W}_t` of its width. So when `signed_` is true and
    * the operand's emit-width matches `w`, the explicit cast is redundant
    * with what c_emit_operand already produces. Skipping it cuts the
    * ubiquitous `((int32_t)((int32_t)23))` double-cast down to one. */
   if (!via_uptr && signed_) {
     KitCgTypeId et = op.type;
     if (c_int_width_for_signedness(t, et) == w) {
       c_emit_operand(t, op);
       return;
     }
   }
   cbuf_puts(&t->body, "((");
   cbuf_puts(&t->body, tn);
   cbuf_puts(&t->body, ")");
   if (via_uptr) {
     cbuf_puts(&t->body, "(uintptr_t)");
   }
   c_emit_operand(t, op);
   cbuf_puts(&t->body, ")");
 }
 
 /* Returns 1 if `type` is a pointer (or void*). */
 static int c_type_is_ptr(CTarget* t, KitCgTypeId type) {
   if (type == KIT_CG_TYPE_NONE) return 0;
   const CgType* ty = cg_type_get(t->c, type);
   return ty && ty->kind == KIT_CG_TYPE_PTR;
 }
 
 static int c_type_is_bool(CTarget* t, KitCgTypeId type) {
   if (type == KIT_CG_TYPE_NONE) return 0;
   const CgType* ty = cg_type_get(t->c, type);
   return ty && ty->kind == KIT_CG_TYPE_BOOL;
 }
 
 static int c_type_is_aggregate(CTarget* t, KitCgTypeId type) {
   if (type == KIT_CG_TYPE_NONE) return 0;
   const CgType* ty = cg_type_get(t->c, type);
   return ty &&
          (ty->kind == KIT_CG_TYPE_RECORD || ty->kind == KIT_CG_TYPE_ARRAY);
 }
 
 static int c_operand_is_ptr_typed(CTarget* t, Operand op) {
   if (c_type_is_ptr(t, op.type)) return 1;
   return 0;
 }
 
 /* Emit `(target_ty)(uintptr_t)(op)` (or `(target_ty)(op)` for float
  * target_ty). Used when the caller needs a specific C expression type.
  * Pointer/int crossings bridge through uintptr_t. */
 static void c_emit_operand_as(CTarget* t, Operand op, KitCgTypeId target_ty) {
   if (c_types_equiv(t, op.type, target_ty)) {
     c_emit_operand(t, op);
     return;
   }
   cbuf_puts(&t->body, "(");
   c_emit_type(t, &t->body, target_ty);
   cbuf_puts(&t->body, ")");
   if (!c_type_is_float(t, target_ty) &&
       (!op.type || c_type_is_ptr(t, op.type) || c_type_is_ptr(t, target_ty))) {
     cbuf_puts(&t->body, "(uintptr_t)");
   }
   cbuf_puts(&t->body, "(");
   c_emit_operand(t, op);
   cbuf_puts(&t->body, ")");
 }
 
 /* Emit an operand for use in a C binary arithmetic expression. Pointer-typed
  * operands are cast to uintptr_t so C arithmetic semantics apply uniformly
  * (kit IR carries byte offsets, not C-pointer-arith scaled indices). */
 static void c_emit_operand_arith(CTarget* t, Operand op) {
   if (c_operand_is_ptr_typed(t, op)) {
     cbuf_puts(&t->body, "((uintptr_t)");
     if (op.kind == OPK_IMM) {
       c_emit_imm_literal(t, op.v.imm);
     } else {
       c_emit_operand(t, op);
     }
     cbuf_puts(&t->body, ")");
     return;
   }
   c_emit_operand(t, op);
 }
 
 /* Same, but applies the requested signedness when the operand is an integer
  * (used for SDIV/UDIV/SREM/UREM/SHR_S/SHR_U). Pointer operands always go
  * through the uintptr_t cast regardless of the requested signedness. */
 static void c_emit_operand_arith_signed(CTarget* t, Operand op, int signed_) {
   if (c_operand_is_ptr_typed(t, op)) {
     cbuf_puts(&t->body, "((uintptr_t)");
     if (op.kind == OPK_IMM) {
       c_emit_imm_literal(t, op.v.imm);
     } else {
       c_emit_operand(t, op);
     }
     cbuf_puts(&t->body, ")");
     return;
   }
   c_emit_operand_signed(t, op, signed_);
 }
 
 /* Emit a C lvalue expression for an addr operand (OPK_LOCAL / OPK_GLOBAL /
  * OPK_INDIRECT) using `access_type` as the access type. The result is the
  * full `*(T*)(...)` dereference, or the C variable directly when the access
  * type matches the underlying local/global object. */
 static void c_emit_addr_deref(CTarget* t, Operand addr,
                               KitCgTypeId access_type) {
   char buf[24];
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   switch (addr.kind) {
     case OPK_LOCAL: {
       c_ensure_local(t, addr.v.local, addr.type);
       c_local_name(addr.v.local, buf, sizeof buf);
       if (access_type == 0 || addr.type == 0 || access_type == addr.type) {
         cbuf_puts(&t->body, buf);
       } else {
         cbuf_puts(&t->body, "(*(");
         c_emit_type(t, &t->body, access_type);
         cbuf_puts(&t->body, "*)&");
         cbuf_puts(&t->body, buf);
         cbuf_puts(&t->body, ")");
       }
       return;
     }
     case OPK_GLOBAL: {
       obj_sym_mark_referenced(t->obj, addr.v.global.sym);
       const char* nm = c_sym_name(t, addr.v.global.sym);
       cbuf_puts(&t->body, "(*(");
       c_emit_type(t, &t->body, access_type);
       cbuf_puts(&t->body, "*)((char*)&");
       cbuf_puts(&t->body, nm);
       if (addr.v.global.addend != 0) {
         cbuf_puts(&t->body, " + ");
         cbuf_put_i64(&t->body, addr.v.global.addend);
       }
       cbuf_puts(&t->body, "))");
       return;
     }
     case OPK_INDIRECT: {
       CAddrMode m = c_addr_mode(addr);
       if ((u32)m.base >= t->local_cap || !t->local_declared[m.base]) {
         compiler_panic(t->c, loc,
                        "C target: indirect on undeclared base local v%u",
                        (unsigned)m.base);
       }
       if (m.index != CG_LOCAL_NONE &&
           ((u32)m.index >= t->local_cap || !t->local_declared[m.index])) {
         compiler_panic(t->c, loc,
                        "C target: indirect on undeclared index local v%u",
                        (unsigned)m.index);
       }
       cbuf_puts(&t->body, "(*(");
       c_emit_type(t, &t->body, access_type);
       cbuf_puts(&t->body, "*)(");
       c_emit_indirect_addr_expr(t, m);
       cbuf_puts(&t->body, "))");
       return;
     }
     default:
       compiler_panic(t->c, loc,
                      "C target: addr-deref on operand kind %d not supported",
                      (int)addr.kind);
   }
 }
 
 /* Emit a C address-of expression for a lvalue operand. Output is a pointer
  * value (cast to dst_type). */
 static void c_emit_lvalue_addr(CTarget* t, Operand lv, KitCgTypeId dst_type) {
   char buf[24];
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   switch (lv.kind) {
     case OPK_LOCAL:
       cbuf_puts(&t->body, "((");
       c_emit_type(t, &t->body, dst_type);
       cbuf_puts(&t->body, ")");
       cbuf_puts(&t->body, "&");
       c_ensure_local(t, lv.v.local, lv.type);
       c_local_name(lv.v.local, buf, sizeof buf);
       cbuf_puts(&t->body, buf);
       cbuf_puts(&t->body, ")");
       return;
     case OPK_GLOBAL: {
       obj_sym_mark_referenced(t->obj, lv.v.global.sym);
       const char* nm = c_sym_name(t, lv.v.global.sym);
       cbuf_puts(&t->body, "((");
       c_emit_type(t, &t->body, dst_type);
       cbuf_puts(&t->body, ")((char*)&");
       cbuf_puts(&t->body, nm);
       if (lv.v.global.addend != 0) {
         cbuf_puts(&t->body, " + ");
         cbuf_put_i64(&t->body, lv.v.global.addend);
       }
       cbuf_puts(&t->body, ")");
       cbuf_puts(&t->body, ")");
       return;
     }
     case OPK_INDIRECT: {
       cbuf_puts(&t->body, "((");
       c_emit_type(t, &t->body, dst_type);
       cbuf_puts(&t->body, ")(");
       c_emit_indirect_addr_expr(t, c_addr_mode(lv));
       cbuf_puts(&t->body, "))");
       return;
     }
     default:
       compiler_panic(t->c, loc,
                      "C target: addr-of on operand kind %d not supported",
                      (int)lv.kind);
   }
 }
 
 /* === Symbol name lookup === */
 
 const char* c_sym_name(CTarget* t, ObjSymId sym) {
   const ObjSym* os = obj_symbol_get(t->obj, sym);
   if (!os) {
     compiler_panic(t->c, (SrcLoc){0, 0, 0}, "C target: unknown ObjSymId %u",
                    (unsigned)sym);
   }
   Slice nm = pool_slice(t->c->global, os->name);
   const char* s = nm.s;
   size_t n = nm.len;
   /* Linker symbols carry the active object format's C-mangle prefix (a leading
    * underscore on Mach-O); the host C compiler will re-add it on its own, so
    * strip when re-emitting source. */
   obj_format_demangle_c(t->c, &s, &n);
   /* Sanitize for C identifier rules: assemblers accept '.', '$', etc. in
    * symbol names; C does not. Replace each illegal byte with '_' and prepend
    * '_' if the first char isn't alpha/underscore. Local syms (SB_LOCAL) also
    * get an ObjSymId prefix: one C emit session may contain several original
    * source units, each of which may legally define the same internal-linkage
    * name. Globals are assumed to come in with C-safe names; if they don't, we
    * still rewrite — the resulting symbol won't link against other TUs that use
    * the asm spelling, but kit-produced code uses it consistently. */
   int is_local = os->bind == SB_LOCAL;
   int needs_rewrite = is_local;
   if (n == 0 && !is_local) {
     return s;
   }
   if (n != 0 && !is_local) {
     if (!((s[0] >= 'a' && s[0] <= 'z') || (s[0] >= 'A' && s[0] <= 'Z') ||
           s[0] == '_')) {
       needs_rewrite = 1;
     }
     for (size_t i = 0; i < n; ++i) {
       char ch = s[i];
       if (!((ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z') ||
             (ch >= '0' && ch <= '9') || ch == '_')) {
         needs_rewrite = 1;
         break;
       }
     }
   }
   if (!needs_rewrite) return s;
   char buf[256];
   size_t cap = sizeof(buf) - 1u;
   size_t out = 0;
   if (is_local) {
     static const char prefix[] = "__kit_local_";
     char digits[16];
     size_t ndigits = 0;
     u32 value = (u32)sym;
     for (size_t i = 0; i + 1u < sizeof prefix && out < cap; ++i)
       buf[out++] = prefix[i];
     do {
       digits[ndigits++] = (char)('0' + value % 10u);
       value /= 10u;
     } while (value != 0 && ndigits < sizeof digits);
     while (ndigits != 0 && out < cap) buf[out++] = digits[--ndigits];
     if (out < cap) buf[out++] = '_';
   } else {
     int first_alpha = (s[0] >= 'a' && s[0] <= 'z') ||
                       (s[0] >= 'A' && s[0] <= 'Z') || s[0] == '_';
     if (!first_alpha && out < cap) buf[out++] = '_';
   }
   for (size_t i = 0; i < n && out < cap; ++i) {
     char ch = s[i];
     int ok = (ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z') ||
              (ch >= '0' && ch <= '9') || ch == '_';
     buf[out++] = ok ? ch : '_';
   }
   buf[out] = '\0';
   Sym interned = pool_intern_slice(t->c->global, (Slice){.s = buf, .len = out});
   return pool_slice(t->c->global, interned).s;
 }
 
 /* === Prologue / finalize === */
 
 void c_emit_prologue(CTarget* t) {
   if (t->prologue_emitted) return;
   t->prologue_emitted = 1;
   c_writer_puts(t,
                 "/* generated by kit --emit=c */\n"
                 "#include <stdint.h>\n"
                 "#include <stdalign.h>\n");
   /* Other headers are decided at finalize so include lines remain
    * deterministic regardless of when the type was first referenced.
    * Writer flushes are not stream-buffered, so we keep prologue compact and
    * tack the rest on at c_emit_finalize. */
   c_writer_puts(t, "\n");
 }
 
 /* === func_begin / func_end === */
 
 /* Write `RetT name(P0, P1, ...)` (without trailing `;` or `{`) to `b`. */
 static void c_emit_func_signature(CTarget* t, CBuf* b, const char* name,
                                   KitCgTypeId fn_type) {
   KitCgTypeId ret_type = cg_type_func_ret_id(t->c, fn_type);
   const CgType* fty = cg_type_get(t->c, fn_type);
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   if (!fty || fty->kind != KIT_CG_TYPE_FUNC) {
     compiler_panic(t->c, loc, "C target: fn_type is not a function type");
   }
   if (cg_type_is_void(t->c, ret_type)) {
     cbuf_puts(b, "void");
   } else {
     c_emit_type(t, b, ret_type);
   }
   cbuf_puts(b, " ");
   cbuf_puts(b, name);
   cbuf_puts(b, "(");
   if (fty->func.nparams == 0 && !fty->func.abi_variadic) {
     cbuf_puts(b, "void");
   } else {
     for (u32 i = 0; i < fty->func.nparams; ++i) {
       if (i > 0) cbuf_puts(b, ", ");
       c_emit_type(t, b, fty->func.params[i].type);
       cbuf_puts(b, " p");
       cbuf_put_u64(b, (u64)i);
     }
     if (fty->func.abi_variadic) {
       if (fty->func.nparams > 0) cbuf_puts(b, ", ");
       cbuf_puts(b, "...");
     }
   }
   cbuf_puts(b, ")");
 }
 
 void c_emit_func_begin(CTarget* t, const CGFuncDesc* fd) {
   c_emit_prologue(t);
 
   t->cur_fn = fd;
   cbuf_reset(&t->decls);
   for (u32 i = 0; i < t->local_cap; ++i) {
     t->local_declared[i] = 0;
     t->local_type[i] = 0;
   }
   t->next_label = 0;
   t->next_local = 0;
   t->next_tmp = 0;
   t->nscopes = 0;
   t->last_was_terminator = 0;
   t->have_emitted_loc = 0;
   t->emitted_loc = (SrcLoc){0, 0, 0};
 
   const char* name = c_sym_name(t, fd->sym);
 
   /* Forward-declare so out-of-order callers and same-TU references find the
    * prototype regardless of definition order. */
   c_ensure_forward_decl(t, fd->sym, fd->fn_type);
 
   {
     const ObjSym* os = obj_symbol_get(t->obj, fd->sym);
     if (os && os->bind == SB_LOCAL) cbuf_puts(&t->body, "static ");
   }
   c_emit_func_signature(t, &t->body, name, fd->fn_type);
   cbuf_puts(&t->body, " {\n");
   t->fn_body_start = t->body.len;
 }
 
 /* Test-and-set on the sym_forwarded bitmap, growing it as needed. Returns 1 if
  * `sym` was already marked (caller should skip re-emitting its forward decl),
  * 0 after marking it for the first time. Shared by c_ensure_forward_decl and
  * c_emit_alias, which both emit a decl that doubles as a forward prototype. */
 static int c_sym_forwarded_test_and_set(CTarget* t, ObjSymId sym) {
   c_vec_grow_zeroed(t, t->sym_forwarded, t->sym_forwarded_cap, (u32)sym + 1u);
   if (t->sym_forwarded[sym]) return 1;
   t->sym_forwarded[sym] = 1;
   return 0;
 }
 
 void c_ensure_forward_decl(CTarget* t, ObjSymId sym, KitCgTypeId fn_type) {
   if (c_sym_forwarded_test_and_set(t, sym)) return;
   const char* name = c_sym_name(t, sym);
   const ObjSym* os = obj_symbol_get(t->obj, sym);
   if ((os && (os->kind == SK_FUNC || os->kind == SK_IFUNC)) || fn_type != 0) {
     if (os && os->bind == SB_LOCAL) cbuf_puts(&t->forwards, "static ");
     c_emit_func_signature(t, &t->forwards, name, fn_type);
     cbuf_puts(&t->forwards, ";\n");
   } else {
     if (os && os->bind == SB_LOCAL)
       cbuf_puts(&t->forwards, "static ");
     else
       cbuf_puts(&t->forwards, "extern ");
     if (os && os->section_id != OBJ_SEC_NONE) {
       const Section* sec = obj_section_get(t->obj, os->section_id);
       if (sec->kind == SEC_RODATA) cbuf_puts(&t->forwards, "const ");
     }
     cbuf_puts(&t->forwards, "struct __kit_data_");
     cbuf_puts(&t->forwards, name);
     cbuf_puts(&t->forwards, " ");
     cbuf_puts(&t->forwards, name);
     cbuf_puts(&t->forwards, ";\n");
   }
 }
 
 void c_emit_func_end(CTarget* t) {
   size_t splice_at = t->fn_body_start;
   size_t body_after = t->body.len;
   size_t fn_body_len = body_after - splice_at;
   Heap* h = t->c->ctx->heap;
 
   u8* tmp = NULL;
   if (fn_body_len) {
     tmp = (u8*)h->alloc(h, fn_body_len, 1);
     if (!tmp) {
       compiler_panic(t->c, t->cur_fn->loc, "C target: out of memory");
     }
     for (size_t i = 0; i < fn_body_len; ++i) {
       tmp[i] = t->body.data[splice_at + i];
     }
   }
 
   t->body.len = splice_at;
   if (t->decls.len)
     cbuf_putn(&t->body, (const char*)t->decls.data, t->decls.len);
   if (tmp) {
     cbuf_putn(&t->body, (const char*)tmp, fn_body_len);
     h->free(h, tmp, fn_body_len);
   }
   cbuf_puts(&t->body, "}\n\n");
 
   t->cur_fn = NULL;
 }
 
 /* === locals, params === */
 
 void c_emit_param_bind(CTarget* t, CGLocal local, KitCgTypeId type, u32 index) {
   char buf[24];
   c_ensure_local(t, local, type);
   c_local_name(local, buf, sizeof buf);
   cbuf_puts(&t->body, "  ");
   cbuf_puts(&t->body, buf);
   cbuf_puts(&t->body, " = p");
   cbuf_put_u64(&t->body, (u64)index);
   cbuf_puts(&t->body, ";\n");
 }
 
 CGLocal c_emit_param(CTarget* t, const CGParamDesc* pd) {
   CGLocalDesc d;
   memset(&d, 0, sizeof d);
   d.type = pd->type;
   d.name = pd->name;
   d.loc = pd->loc;
   d.size = pd->size;
   d.align = pd->align;
   d.flags = pd->flags;
   CGLocal local = c_emit_local(t, &d);
   c_emit_param_bind(t, local, pd->type, pd->index);
   return local;
 }
 
 /* === load_imm, copy, binop === */
 
 void c_emit_load_imm(CTarget* t, Operand dst, i64 imm) {
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   if (dst.kind != OPK_LOCAL) {
     compiler_panic(t->c, loc, "C target: load_imm dst must be LOCAL");
   }
   c_ensure_local(t, dst.v.local, dst.type);
   /* The literal is emitted bare; its C type is `long long`. We can drop
    * the bridge cast iff the bare assignment compiles cleanly:
    *   - integer dst: imm must fit in dst's signed range (else
    *     -Wconstant-conversion). 64-bit dst always fits.
    *   - pointer dst: only `0` (null pointer constant) is safe; any other
    *     literal trips -Wint-conversion.
    * Otherwise keep the bridge. */
   u32 w = c_int_width_for_signedness(t, dst.type);
   int can_drop_bridge;
   if (w > 0) {
     can_drop_bridge = (w >= 64) || (imm >= -((i64)1 << (w - 1)) &&
                                     imm <= (((i64)1 << (w - 1)) - 1));
   } else if (c_type_is_ptr(t, dst.type)) {
     can_drop_bridge = (imm == 0);
   } else {
     can_drop_bridge = 0;
   }
   c_emit_local_assign_open(t, dst.v.local,
                            can_drop_bridge ? dst.type : (KitCgTypeId)0);
   c_emit_imm_literal(t, imm);
   c_emit_local_assign_close(t);
 }
 
 void c_emit_copy(CTarget* t, Operand dst, Operand src) {
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   if (dst.kind != OPK_LOCAL) {
     compiler_panic(t->c, loc, "C target: copy dst must be LOCAL");
   }
   c_ensure_local(t, dst.v.local, dst.type);
   c_emit_local_assign_open(t, dst.v.local, src.type);
   c_emit_operand(t, src);
   c_emit_local_assign_close(t);
 }
 
 static const char* binop_to_c(BinOp op) {
   switch (op) {
     case BO_IADD:
     case BO_FADD:
       return "+";
     case BO_ISUB:
     case BO_FSUB:
       return "-";
     case BO_IMUL:
     case BO_FMUL:
       return "*";
     case BO_SDIV:
     case BO_UDIV:
     case BO_FDIV:
       return "/";
     case BO_SREM:
     case BO_UREM:
       return "%";
     case BO_AND:
       return "&";
     case BO_OR:
       return "|";
     case BO_XOR:
       return "^";
     case BO_SHL:
       return "<<";
     case BO_SHR_S:
     case BO_SHR_U:
       return ">>";
   }
   return NULL;
 }
 
 /* For BinOp `op`, decide how to sign-cast the operands. Returns 0 for "no
  * cast", 1 for "cast both to signed", 2 for "cast both to unsigned", 3 for
  * "cast lhs only (signedness `lhs_signed`)" (used for shifts). */
 typedef enum { BSC_NONE, BSC_SIGNED, BSC_UNSIGNED, BSC_SHIFT_LHS } BinSignCast;
 
 static BinSignCast binop_sign_kind(BinOp op, int* lhs_signed_out) {
   *lhs_signed_out = 1;
   switch (op) {
     case BO_SDIV:
     case BO_SREM:
       return BSC_SIGNED;
     case BO_UDIV:
     case BO_UREM:
       return BSC_UNSIGNED;
     case BO_SHR_S:
       *lhs_signed_out = 1;
       return BSC_SHIFT_LHS;
     case BO_SHR_U:
       *lhs_signed_out = 0;
       return BSC_SHIFT_LHS;
     default:
       return BSC_NONE;
   }
 }
 
 void c_emit_binop(CTarget* t, BinOp op, Operand dst, Operand a, Operand b) {
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   const char* sym = binop_to_c(op);
   if (!sym) {
     compiler_panic(t->c, loc, "C target: unknown binop %d", (int)op);
   }
   if (dst.kind != OPK_LOCAL) {
     compiler_panic(t->c, loc, "C target: binop dst must be LOCAL");
   }
   c_ensure_local(t, dst.v.local, dst.type);
   /* Pointer operands get cast to uintptr_t inside c_emit_operand_arith,
    * so the binop's C result type is `uintptr_t`, not the original pointer
    * type. Keep the bridge when dst or either operand is pointer-typed so
    * the assignment back to a pointer dst doesn't trip -Wint-conversion. */
   int has_ptr = c_operand_is_ptr_typed(t, dst) ||
                 c_operand_is_ptr_typed(t, a) || c_operand_is_ptr_typed(t, b);
   c_emit_local_assign_open(t, dst.v.local, has_ptr ? (KitCgTypeId)0 : dst.type);
   int lhs_signed = 1;
   BinSignCast bsc = binop_sign_kind(op, &lhs_signed);
   switch (bsc) {
     case BSC_NONE:
       c_emit_operand_arith(t, a);
       cbuf_puts(&t->body, " ");
       cbuf_puts(&t->body, sym);
       cbuf_puts(&t->body, " ");
       c_emit_operand_arith(t, b);
       break;
     case BSC_SIGNED:
       c_emit_operand_arith_signed(t, a, 1);
       cbuf_puts(&t->body, " ");
       cbuf_puts(&t->body, sym);
       cbuf_puts(&t->body, " ");
       c_emit_operand_arith_signed(t, b, 1);
       break;
     case BSC_UNSIGNED:
       c_emit_operand_arith_signed(t, a, 0);
       cbuf_puts(&t->body, " ");
       cbuf_puts(&t->body, sym);
       cbuf_puts(&t->body, " ");
       c_emit_operand_arith_signed(t, b, 0);
       break;
     case BSC_SHIFT_LHS:
       c_emit_operand_arith_signed(t, a, lhs_signed);
       cbuf_puts(&t->body, " ");
       cbuf_puts(&t->body, sym);
       cbuf_puts(&t->body, " ");
       c_emit_operand(t, b);
       break;
   }
   c_emit_local_assign_close(t);
 }
 
 /* ===== unop ===== */
 
 void c_emit_unop(CTarget* t, UnOp op, Operand dst, Operand a) {
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   if (dst.kind != OPK_LOCAL) {
     compiler_panic(t->c, loc, "C target: unop dst must be LOCAL");
   }
   c_ensure_local(t, dst.v.local, dst.type);
   const char* sym = NULL;
   switch (op) {
     case UO_NEG:
     case UO_FNEG:
       sym = "-";
       break;
     case UO_NOT:
       sym = "!";
       break;
     case UO_BNOT:
       sym = "~";
       break;
     default:
       compiler_panic(t->c, loc, "C target: unknown unop %d", (int)op);
   }
   c_emit_local_assign_open(t, dst.v.local, dst.type);
   cbuf_puts(&t->body, sym);
   c_emit_operand(t, a);
   c_emit_local_assign_close(t);
 }
 
 /* ===== compare ops ===== */
 
 /* The single C operator for ops that lower to one relational/equality
  * expression: all integer ops, plus the FP predicates whose plain C operator
  * already has the right NaN behavior (<,<=,>,>= and == are ordered: false on
  * NaN; != is unordered: true on NaN). The remaining FP predicates need a
  * compound expression and are handled in c_emit_cmp_operands; they return NULL
  * here. No `default:` so -Wswitch flags any unhandled enumerator. */
 static const char* cmp_to_c(CmpOp op) {
   switch (op) {
     case CMP_EQ:
     case CMP_OEQ_F:
       return "==";
     case CMP_NE:
     case CMP_UNE_F:
       return "!=";
     case CMP_LT_S:
     case CMP_LT_U:
     case CMP_OLT_F:
       return "<";
     case CMP_LE_S:
     case CMP_LE_U:
     case CMP_OLE_F:
       return "<=";
     case CMP_GT_S:
     case CMP_GT_U:
     case CMP_OGT_F:
       return ">";
     case CMP_GE_S:
     case CMP_GE_U:
     case CMP_OGE_F:
       return ">=";
     /* Compound FP predicates — no single C operator (see c_emit_cmp_operands).
      */
     case CMP_ONE_F:
     case CMP_UEQ_F:
     case CMP_ULT_F:
     case CMP_ULE_F:
     case CMP_UGT_F:
     case CMP_UGE_F:
       return NULL;
   }
   return NULL;
 }
 
 /* The 6 FP predicates with no single C operator: built from compound ordered
  * comparisons (no isnan(); host must not be built with -ffast-math). */
 static int cmp_is_fp_compound(CmpOp op) {
   return op == CMP_ONE_F || op == CMP_UEQ_F || op == CMP_ULT_F ||
          op == CMP_ULE_F || op == CMP_UGT_F || op == CMP_UGE_F;
 }
 
 /* Returns 1 if cmp op needs unsigned operand cast. -1 if signed. 0 if no cast
  * (EQ/NE — sign doesn't matter for integer equality at the same width — and
  * float compares). */
 static int cmp_signedness(CmpOp op) {
   switch (op) {
     case CMP_LT_S:
     case CMP_LE_S:
     case CMP_GT_S:
     case CMP_GE_S:
       return -1;
     case CMP_LT_U:
     case CMP_LE_U:
     case CMP_GT_U:
     case CMP_GE_U:
       return 1;
     default:
       return 0;
   }
 }
 
 /* Emit one ordered comparison `<a> opstr <b>` (no signedness cast — FP). */
 static void c_emit_fp_rel(CTarget* t, Operand a, const char* opstr, Operand b) {
   c_emit_operand_arith(t, a);
   cbuf_puts(&t->body, " ");
   cbuf_puts(&t->body, opstr);
   cbuf_puts(&t->body, " ");
   c_emit_operand_arith(t, b);
 }
 
 static void c_emit_cmp_operands(CTarget* t, CmpOp op, Operand a, Operand b) {
   /* The 6 FP predicates without a single C operator. Composed from ordered
    * comparisons via unordered-R == !(ordered-not-R); ONE/UEQ from a<b / a>b.
    * Each `!(...)` / `(...)` wraps the full cast-bearing comparison. */
   switch (op) {
     case CMP_UGE_F: /* !(OLT) */
       cbuf_puts(&t->body, "!(");
       c_emit_fp_rel(t, a, "<", b);
       cbuf_puts(&t->body, ")");
       return;
     case CMP_UGT_F: /* !(OLE) */
       cbuf_puts(&t->body, "!(");
       c_emit_fp_rel(t, a, "<=", b);
       cbuf_puts(&t->body, ")");
       return;
     case CMP_ULE_F: /* !(OGT) */
       cbuf_puts(&t->body, "!(");
       c_emit_fp_rel(t, a, ">", b);
       cbuf_puts(&t->body, ")");
       return;
     case CMP_ULT_F: /* !(OGE) */
       cbuf_puts(&t->body, "!(");
       c_emit_fp_rel(t, a, ">=", b);
       cbuf_puts(&t->body, ")");
       return;
     case CMP_ONE_F: /* ordered & !=: a<b || a>b */
       cbuf_puts(&t->body, "(");
       c_emit_fp_rel(t, a, "<", b);
       cbuf_puts(&t->body, " || ");
       c_emit_fp_rel(t, a, ">", b);
       cbuf_puts(&t->body, ")");
       return;
     case CMP_UEQ_F: /* unordered | ==: !(a<b) && !(a>b) */
       cbuf_puts(&t->body, "(!(");
       c_emit_fp_rel(t, a, "<", b);
       cbuf_puts(&t->body, ") && !(");
       c_emit_fp_rel(t, a, ">", b);
       cbuf_puts(&t->body, "))");
       return;
     default:
       break; /* integer ops + single-operator FP fall through */
   }
   int sg = cmp_signedness(op);
   if (sg == 0) {
     c_emit_operand_arith(t, a);
     cbuf_puts(&t->body, " ");
     cbuf_puts(&t->body, cmp_to_c(op));
     cbuf_puts(&t->body, " ");
     c_emit_operand_arith(t, b);
   } else {
     int signed_ = (sg < 0);
     c_emit_operand_arith_signed(t, a, signed_);
     cbuf_puts(&t->body, " ");
     cbuf_puts(&t->body, cmp_to_c(op));
     cbuf_puts(&t->body, " ");
     c_emit_operand_arith_signed(t, b, signed_);
   }
 }
 
 void c_emit_cmp(CTarget* t, CmpOp op, Operand dst, Operand a, Operand b) {
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   if (dst.kind != OPK_LOCAL) {
     compiler_panic(t->c, loc, "C target: cmp dst must be LOCAL");
   }
   if (!cmp_to_c(op) && !cmp_is_fp_compound(op)) {
     compiler_panic(t->c, loc, "C target: unknown cmp %d", (int)op);
   }
   c_ensure_local(t, dst.v.local, dst.type);
   /* Compare result is C `int` (0/1); assigning to integer dst.type narrows
    * implicitly without -Wall complaint. The result of a `!(...)` / `||` / `&&`
    * compound FP predicate is already an int 0/1. */
   c_emit_local_assign_open(t, dst.v.local, dst.type);
   c_emit_cmp_operands(t, op, a, b);
   c_emit_local_assign_close(t);
 }
 
 /* ===== labels, jump, cmp_branch ===== */
 
 static void c_label_name(Label l, char* out, size_t cap) {
   size_t i = 0;
   if (cap == 0) return;
   const char* p = "L";
   while (*p && i + 1 < cap) out[i++] = *p++;
   char tmp[16];
   size_t n = 0;
   u32 v = (u32)l;
   if (v == 0) {
     tmp[n++] = '0';
   } else {
     while (v) {
       tmp[n++] = (char)('0' + (v % 10));
       v /= 10;
     }
   }
   while (n && i + 1 < cap) out[i++] = tmp[--n];
   out[i] = '\0';
 }
 
 Label c_emit_label_new(CTarget* t) {
   t->next_label += 1;
   return (Label)t->next_label;
 }
 
 void c_emit_label_place(CTarget* t, Label l) {
   char buf[24];
   c_label_name(l, buf, sizeof buf);
   /* `Lk: __attribute__((unused));` — empty stmt keeps it valid at end-of-block,
    * and the attribute silences -Wunused-label when the goto got folded away. */
   cbuf_puts(&t->body, " ");
   cbuf_puts(&t->body, buf);
   cbuf_puts(&t->body, ": __attribute__((unused));\n");
   t->last_was_terminator = 0;
 }
 
 /* If `l` is the innermost structured scope's break/continue label, return
  * the C keyword that exits/iterates that scope (a literal `break` or
  * `continue`). NULL means "fall back to goto." Matches only the innermost
  * scope because C `break`/`continue` only escape the nearest enclosing
  * loop/switch — outer-scope targets must stay as goto. */
 static const char* c_scope_kw_for_label(CTarget* t, Label l) {
   if (t->nscopes == 0) return NULL;
   const CScopeInfo* s = &t->scopes[t->nscopes - 1u];
   if (!s->structured) return NULL;
   if (l == s->break_label) return "break";
   if (l == s->continue_label) return "continue";
   return NULL;
 }
 
 void c_emit_jump(CTarget* t, Label l) {
   if (t->last_was_terminator) return;
   const char* kw = c_scope_kw_for_label(t, l);
   if (kw) {
     cbuf_puts(&t->body, "  ");
     cbuf_puts(&t->body, kw);
     cbuf_puts(&t->body, ";\n");
   } else {
     char buf[24];
     c_label_name(l, buf, sizeof buf);
     cbuf_puts(&t->body, "  goto ");
     cbuf_puts(&t->body, buf);
     cbuf_puts(&t->body, ";\n");
   }
   t->last_was_terminator = 1;
 }
 
 void c_emit_cmp_branch(CTarget* t, CmpOp op, Operand a, Operand b, Label l) {
   if (t->last_was_terminator) return;
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   if (!cmp_to_c(op) && !cmp_is_fp_compound(op)) {
     compiler_panic(t->c, loc, "C target: unknown cmp %d", (int)op);
   }
   const char* kw = c_scope_kw_for_label(t, l);
   cbuf_puts(&t->body, "  if (");
   c_emit_cmp_operands(t, op, a, b);
   if (kw) {
     cbuf_puts(&t->body, ") ");
     cbuf_puts(&t->body, kw);
     cbuf_puts(&t->body, ";\n");
   } else {
     char buf[24];
     c_label_name(l, buf, sizeof buf);
     cbuf_puts(&t->body, ") goto ");
     cbuf_puts(&t->body, buf);
     cbuf_puts(&t->body, ";\n");
   }
 }
 
 /* ===== scopes =====
  *
  * SCOPE_LOOP maps to C's `for (;;) { ... }`. CG places the continue label
  * just before `scope_begin` and the break label just before `scope_end`
  * (see src/cg/control.c:208,253). The C target leaves those label
  * placements in the body — they sit just before `for (;;) {` and just
  * after `}` respectively, so any outer-scope `goto continue_lbl` or
  * `goto break_lbl` (e.g. a nested loop's `continue` targeting this
  * outer loop) still resolves. Inside the `for` body, `c_jump` and
  * `c_cmp_branch` translate jumps whose target is the *innermost* scope's
  * break/continue label into `break;` / `continue;`; outer-scope targets
  * fall back to `goto`. The redundant `Lk: ;` adjacent to the `for` is
  * cosmetic; gcc/clang fold it. */
 
 static void c_grow_scopes(CTarget* t, u32 needed) {
   c_vec_grow_or_panic(t, t->scopes, t->scopes_cap, needed);
 }
 
 CGScope c_emit_scope_begin(CTarget* t, const CGScopeDesc* d) {
   if (t->nscopes + 1u >= t->scopes_cap) c_grow_scopes(t, t->nscopes + 2u);
   u32 idx = t->nscopes;
   t->scopes[idx].kind = d->kind;
   t->scopes[idx].break_label = d->break_label;
   t->scopes[idx].continue_label = d->continue_label;
   t->scopes[idx].structured = 0;
   t->nscopes += 1u;
   if (d->kind == SCOPE_LOOP) {
     cbuf_puts(&t->body, "  for (;;) {\n");
     t->scopes[idx].structured = 1;
     t->last_was_terminator = 0;
     return (CGScope)(idx + 1u);
   }
   return (CGScope)(idx + 1u);
 }
 
 void c_emit_scope_end(CTarget* t, CGScope s) {
   if (s == 0 || (u32)s > t->nscopes) {
     compiler_panic(t->c, t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0},
                    "C target: scope_end on invalid handle");
   }
   u32 idx = (u32)s - 1u;
   if (t->scopes[idx].structured) {
     /* CG places break_label just before scope_end, so the label sits
      * inside the for-body. Anything that lands on it (including a
      * `goto break_lbl` from a nested scope's labeled break) needs to
      * exit the for — without an explicit `break;`, fall-through would
      * iterate again. Always emit; if the body already terminated the
      * defensive break is dead but harmless. */
     cbuf_puts(&t->body, "  break;\n");
     cbuf_puts(&t->body, "  }\n");
     /* The closing brace is not a terminator; control can fall through it
      * (e.g., off the end of a void function). */
     t->last_was_terminator = 0;
   }
   t->nscopes -= 1u;
 }
 
 void c_emit_break_to(CTarget* t, CGScope s) {
   if (s == 0 || (u32)s > t->nscopes) {
     compiler_panic(t->c, t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0},
                    "C target: break_to on invalid handle");
   }
   c_emit_jump(t, t->scopes[s - 1u].break_label);
 }
 
 void c_emit_continue_to(CTarget* t, CGScope s) {
   if (s == 0 || (u32)s > t->nscopes) {
     compiler_panic(t->c, t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0},
                    "C target: continue_to on invalid handle");
   }
   c_emit_jump(t, t->scopes[s - 1u].continue_label);
 }
 
 /* ===== switch dispatch ===== */
 
 /* Emit `case <value>:`. For an int32_t selector the bare literal is
  * already the right type, so we skip the cast; for wider/narrower
  * integers we wrap in `(T)` so the case constant matches the switch
  * value's promoted type (avoids -Wswitch warnings on narrower
  * selectors). */
 static void c_emit_case_value(CTarget* t, KitCgTypeId sel_ty, u64 v) {
   u32 w = c_int_width_for_signedness(t, sel_ty);
   cbuf_puts(&t->body, "    case ");
   if (w != 0 && w != 32) {
     cbuf_putc(&t->body, '(');
     c_emit_type(t, &t->body, sel_ty);
     cbuf_puts(&t->body, ")");
   }
   c_emit_imm_literal(t, (i64)v);
   cbuf_puts(&t->body, ":");
 }
 
 void c_emit_switch_(
     CTarget* t, const CGSwitchDesc* d) { /* gcc/clang ignore strategy hints and
                                             pick their own dispatch shape. */
   (void)d->hint;
   if (t->last_was_terminator) return;
   cbuf_puts(&t->body, "  switch (");
   c_emit_operand(t, d->selector);
   cbuf_puts(&t->body, ") {\n");
   for (u32 i = 0; i < d->ncases; ++i) {
     char buf[24];
     c_label_name(d->cases[i].label, buf, sizeof buf);
     c_emit_case_value(t, d->selector.type, d->cases[i].value);
     cbuf_puts(&t->body, " goto ");
     cbuf_puts(&t->body, buf);
     cbuf_puts(&t->body, ";\n");
   }
   cbuf_puts(&t->body, "    default: ");
   if (d->default_label != (Label)LABEL_NONE) {
     char buf[24];
     c_label_name(d->default_label, buf, sizeof buf);
     cbuf_puts(&t->body, "goto ");
     cbuf_puts(&t->body, buf);
     cbuf_puts(&t->body, ";\n");
   } else {
     /* No default supplied — the kit IR's contract for that case is
      * "if no case matches, fall through." `break;` does exactly that
      * inside the for-wrapper around structured scopes. */
     cbuf_puts(&t->body, "break;\n");
   }
   cbuf_puts(&t->body, "  }\n");
   /* The switch always transfers control (every arm jumps or breaks).
    * Mark as terminator so any frontend-emitted defensive jump after
    * dispatch is dropped. */
   t->last_was_terminator = 1;
 }
 
 /* ===== load_label_addr / indirect_branch =====
  * GCC computed-goto extension: `&&L` is the address of label L within
  * the current function, and `goto *p;` jumps to such an address. This
  * is the lowering every cc1-like backend uses (and what the toy
  * frontend ultimately compiles to via the C target). */
 void c_emit_load_label_addr(CTarget* t, Operand dst, Label l) {
   char buf[24];
   if (dst.kind != OPK_LOCAL) {
     compiler_panic(t->c, t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0},
                    "C target: load_label_addr dst must be LOCAL");
   }
   c_ensure_local(t, dst.v.local, dst.type);
   c_emit_local_assign_open(t, dst.v.local, (KitCgTypeId)0);
   cbuf_puts(&t->body, "(void*)&&");
   c_label_name(l, buf, sizeof buf);
   cbuf_puts(&t->body, buf);
   c_emit_local_assign_close(t);
 }
 
 void c_emit_indirect_branch(CTarget* t, Operand addr,
                             const Label* valid_targets, u32 ntargets) {
   (void)valid_targets;
   (void)ntargets;
   if (t->last_was_terminator) return;
   cbuf_puts(&t->body, "  goto *");
   c_emit_operand(t, addr);
   cbuf_puts(&t->body, ";\n");
   t->last_was_terminator = 1;
 }
 
 /* ===== function-local static label-address data ===== */
 
 static int c_is_local_static_sym(CTarget* t, ObjSymId sym) {
   for (u32 i = 0; i < t->local_static_nsyms; ++i) {
     if (t->local_static_syms[i] == sym) return 1;
   }
   return 0;
 }
 
 static void c_mark_local_static_sym(CTarget* t, ObjSymId sym) {
   if (sym == OBJ_SYM_NONE || c_is_local_static_sym(t, sym)) return;
   /* Append-style: VEC_GROW for the doubling realloc, but keep the
    * cur_fn-relative panic location this path uses on OOM. */
   if (VEC_GROW(t->c->ctx->heap, t->local_static_syms, t->local_static_syms_cap,
                t->local_static_nsyms + 1u)) {
     compiler_panic(t->c, t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0},
                    "C target: out of memory");
   }
   t->local_static_syms[t->local_static_nsyms++] = sym;
 }
 
 static void c_grow_local_static_entries(CTarget* t, u32 want) {
   /* Append-style (the caller initializes the [0, count) entries after this
    * grows): VEC_GROW for the doubling realloc, with the cur_fn-relative panic
    * location this path uses on OOM. */
   if (VEC_GROW(t->c->ctx->heap, t->local_static_entries,
                t->local_static_entries_cap, want)) {
     compiler_panic(t->c, t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0},
                    "C target: out of memory");
   }
 }
 
 int c_emit_can_local_static_data(CTarget* t,
                                  const CGLocalStaticDataDesc* desc) {
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   const CgType* ty = cg_type_get(t->c, desc->type);
   if (!ty) {
     compiler_panic(t->c, loc, "C target: unknown local static type %u",
                    (unsigned)desc->type);
   }
   if (ty->kind == KIT_CG_TYPE_ARRAY) {
     ty = cg_type_get(t->c, ty->array.elem);
   }
   return ty && ty->kind == KIT_CG_TYPE_PTR;
 }
 
 int c_emit_local_static_data_begin(CTarget* t,
                                    const CGLocalStaticDataDesc* desc) {
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   if (!t->cur_fn) {
     compiler_panic(t->c, loc,
                    "C target: function-local static data outside function");
   }
   if (t->local_static_active) {
     compiler_panic(t->c, loc,
                    "C target: nested function-local static data definition");
   }
   const CgType* ty = cg_type_get(t->c, desc->type);
   if (!ty) {
     compiler_panic(t->c, loc, "C target: unknown local static type %u",
                    (unsigned)desc->type);
   }
 
   u64 count = 1;
   int is_array = 0;
   KitCgTypeId elem = desc->type;
   if (ty->kind == KIT_CG_TYPE_ARRAY) {
     is_array = 1;
     count = ty->array.count;
     elem = ty->array.elem;
     ty = cg_type_get(t->c, elem);
   }
   if (!c_emit_can_local_static_data(t, desc)) {
     return 0;
   }
   if (count > UINT32_MAX) {
     compiler_panic(t->c, loc, "C target: local static pointer table too large");
   }
 
   c_grow_local_static_entries(t, (u32)count);
   for (u32 i = 0; i < (u32)count; ++i) {
     t->local_static_entries[i].label = LABEL_NONE;
     t->local_static_entries[i].addend = 0;
     t->local_static_entries[i].has_label = 0;
   }
   t->local_static_nentries = (u32)count;
   t->local_static_sym = desc->sym;
   t->local_static_type = desc->type;
   t->local_static_count = count;
   t->local_static_offset = 0;
   t->local_static_ptr_width = (u32)cg_type_size(t->c, elem);
   t->local_static_align =
       desc->align ? desc->align : cg_type_align(t->c, desc->type);
   t->local_static_active = 1;
   t->local_static_is_array = (u8)is_array;
   t->local_static_readonly =
       (desc->attrs.flags & KIT_CG_DATADEF_READONLY) ? 1u : 0u;
   c_mark_local_static_sym(t, desc->sym);
   return 1;
 }
 
 void c_emit_local_static_data_write(CTarget* t, const u8* data, u64 len) {
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   if (!t->local_static_active || !len) return;
   if (data) {
     for (u64 i = 0; i < len; ++i) {
       if (data[i] != 0) {
         compiler_panic(t->c, loc,
                        "C target: function-local static label table supports "
                        "only zero bytes and label addresses");
       }
     }
   }
   t->local_static_offset += len;
 }
 
 void c_emit_local_static_data_label_addr(CTarget* t, Label target, i64 addend,
                                          u32 width, u32 address_space) {
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   (void)address_space;
   if (!t->local_static_active) {
     compiler_panic(t->c, loc,
                    "C target: label address outside local static data");
   }
   if (width != t->local_static_ptr_width) {
     compiler_panic(t->c, loc,
                    "C target: label address width %u does not match pointer "
                    "width %u",
                    (unsigned)width, (unsigned)t->local_static_ptr_width);
   }
   if ((t->local_static_offset % t->local_static_ptr_width) != 0) {
     compiler_panic(t->c, loc,
                    "C target: unaligned label address in local static data");
   }
   u64 idx = t->local_static_offset / t->local_static_ptr_width;
   if (idx >= t->local_static_count) {
     compiler_panic(t->c, loc,
                    "C target: too many local static label table entries");
   }
   CLocalStaticLabelEntry* e = &t->local_static_entries[(u32)idx];
   if (e->has_label) {
     compiler_panic(t->c, loc,
                    "C target: duplicate local static label table entry");
   }
   e->label = target;
   e->addend = addend;
   e->has_label = 1;
   t->local_static_offset += width;
 }
 
 static void c_emit_local_static_label_expr(CTarget* t,
                                            const CLocalStaticLabelEntry* e) {
   char lbuf[24];
   if (!e->has_label) {
     cbuf_puts(&t->decls, "(void*)0");
     return;
   }
   if (e->addend == 0) {
     cbuf_puts(&t->decls, "&&");
     c_label_name(e->label, lbuf, sizeof lbuf);
     cbuf_puts(&t->decls, lbuf);
     return;
   }
   cbuf_puts(&t->decls, "(void*)((char*)&&");
   c_label_name(e->label, lbuf, sizeof lbuf);
   cbuf_puts(&t->decls, lbuf);
   cbuf_puts(&t->decls, " + ");
   cbuf_put_i64(&t->decls, e->addend);
   cbuf_puts(&t->decls, ")");
 }
 
 void c_emit_local_static_data_end(CTarget* t) {
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   if (!t->local_static_active) return;
   u64 total_size = t->local_static_count * t->local_static_ptr_width;
   if (t->local_static_offset > total_size) {
     compiler_panic(t->c, loc,
                    "C target: local static initializer exceeds object size");
   }
   const char* nm = c_sym_name(t, t->local_static_sym);
   cbuf_puts(&t->decls, "  static __attribute__((unused)) ");
   cbuf_puts(&t->decls, "_Alignas(");
   cbuf_put_u64(&t->decls, t->local_static_align ? t->local_static_align : 1);
   cbuf_puts(&t->decls, ") void* ");
   if (t->local_static_readonly) cbuf_puts(&t->decls, "const ");
   cbuf_puts(&t->decls, nm);
   if (t->local_static_is_array) {
     cbuf_puts(&t->decls, "[");
     cbuf_put_u64(&t->decls, t->local_static_count);
     cbuf_puts(&t->decls, "]");
   }
   cbuf_puts(&t->decls, " = {");
   for (u32 i = 0; i < t->local_static_nentries; ++i) {
     if (i > 0) cbuf_putc(&t->decls, ',');
     if ((i & 3u) == 0) cbuf_puts(&t->decls, "\n    ");
     c_emit_local_static_label_expr(t, &t->local_static_entries[i]);
   }
   cbuf_puts(&t->decls, "\n  };\n");
 
   t->local_static_active = 0;
   t->local_static_sym = OBJ_SYM_NONE;
   t->local_static_type = KIT_CG_TYPE_NONE;
   t->local_static_count = 0;
   t->local_static_offset = 0;
   t->local_static_ptr_width = 0;
   t->local_static_align = 0;
   t->local_static_nentries = 0;
   t->local_static_is_array = 0;
   t->local_static_readonly = 0;
 }
 
 /* ===== local, local_addr ===== */
 
 CGLocal c_emit_local(CTarget* t, const CGLocalDesc* d) {
   t->next_local += 1u;
   if (t->next_local == CG_LOCAL_NONE) {
     compiler_panic(t->c, t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0},
                    "C target: semantic local id exhausted");
     return CG_LOCAL_NONE;
   }
   c_ensure_local(t, (CGLocal)t->next_local, d->type);
   return (CGLocal)t->next_local;
 }
 
 void c_emit_local_addr(CTarget* t, Operand dst, const CGLocalDesc* d,
                        CGLocal s) {
   (void)d;
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   if (dst.kind != OPK_LOCAL) {
     compiler_panic(t->c, loc, "C target: local_addr dst must be LOCAL");
   }
   c_ensure_local(t, dst.v.local, dst.type);
   c_ensure_local(t, s, d->type);
   char buf[24];
   c_emit_local_assign_open(t, dst.v.local, (KitCgTypeId)0);
   cbuf_puts(&t->body, "&");
   c_local_name(s, buf, sizeof buf);
   cbuf_puts(&t->body, buf);
   c_emit_local_assign_close(t);
 }
 
 /* ===== convert ===== */
 
 void c_emit_convert(CTarget* t, ConvKind k, Operand dst, Operand src) {
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   if (dst.kind != OPK_LOCAL) {
     compiler_panic(t->c, loc, "C target: convert dst must be LOCAL");
   }
   c_ensure_local(t, dst.v.local, dst.type);
   char buf[24];
   c_local_name(dst.v.local, buf, sizeof buf);
 
   if (k == CV_BITCAST) {
     /* Same-size reinterpretation. Use __builtin_memcpy through a temp so
      * neither aliasing nor representation assumptions creep in. The temp
      * lives in its own `{ ... }` block, so no name collision tracking. */
     u32 id = ++t->next_tmp;
     cbuf_puts(&t->body, "  { ");
     c_emit_type(t, &t->body, src.type);
     cbuf_puts(&t->body, " __bc");
     cbuf_put_u64(&t->body, (u64)id);
     cbuf_puts(&t->body, " = ");
     c_emit_operand(t, src);
     cbuf_puts(&t->body, "; __builtin_memcpy(&");
     cbuf_puts(&t->body, buf);
     cbuf_puts(&t->body, ", &__bc");
     cbuf_put_u64(&t->body, (u64)id);
     cbuf_puts(&t->body, ", sizeof __bc");
     cbuf_put_u64(&t->body, (u64)id);
     cbuf_puts(&t->body, "); }\n");
     return;
   }
 
   if (c_type_is_bool(t, dst.type)) {
     c_emit_local_assign_open(t, dst.v.local, dst.type);
     cbuf_puts(&t->body, "(");
     c_emit_type(t, &t->body, dst.type);
     cbuf_puts(&t->body, ")(");
     c_emit_operand(t, src);
     cbuf_puts(&t->body, " != 0)");
     c_emit_local_assign_close(t);
     return;
   }
 
   /* Integer and float conversions: a C cast does the right thing once the
    * source is first cast to the appropriate signedness (for SEXT/ZEXT and
    * ITOF_S/U / FTOI_S/U). */
   int src_signed = 1;
   switch (k) {
     case CV_ZEXT:
     case CV_ITOF_U:
     case CV_FTOI_U:
       src_signed = 0;
       break;
     default:
       src_signed = 1;
       break;
   }
 
   /* The cast `(dst.type)(src)` produces a value of dst.type. */
   c_emit_local_assign_open(t, dst.v.local, dst.type);
   cbuf_puts(&t->body, "(");
   c_emit_type(t, &t->body, dst.type);
   cbuf_puts(&t->body, ")");
   if (k == CV_SEXT || k == CV_ZEXT) {
     c_emit_operand_signed(t, src, src_signed);
   } else if (k == CV_TRUNC && c_operand_is_ptr_typed(t, src)) {
     /* Casting a pointer directly to a narrower integer trips
      * -Wvoid-pointer-to-int-cast (and -Wpointer-to-int-cast). Bridge
      * through uintptr_t. */
     cbuf_puts(&t->body, "((uintptr_t)");
     c_emit_operand(t, src);
     cbuf_puts(&t->body, ")");
   } else {
     /* TRUNC / FTOI / ITOF / FEXT / FTRUNC: rely on C cast semantics. */
     c_emit_operand(t, src);
   }
   c_emit_local_assign_close(t);
 }
 
 /* === call === */
 
 static KitCgTypeId c_call_arg_type(CTarget* t, const CgType* fty,
                                    const CGCallDesc* d, u32 i) {
   if (i < fty->func.nparams) return fty->func.params[i].type;
   return c_local_type_or_panic(t, d->args[i]);
 }
 
 static void c_emit_call_arg(CTarget* t, const CgType* fty, const CGCallDesc* d,
                             u32 i) {
   KitCgTypeId ty = c_call_arg_type(t, fty, d, i);
   c_ensure_local(t, d->args[i], ty);
   c_emit_operand(t, c_op_local(d->args[i], ty));
 }
 
 /* Render call operand `i`, optionally cast to unsigned __int128 first (used by
  * the unsigned i128 helpers below). */
 static void c_emit_ti_operand(CTarget* t, const CgType* fty,
                               const CGCallDesc* d, u32 i, int as_unsigned) {
   if (as_unsigned) cbuf_puts(&t->body, "(unsigned __int128)(");
   c_emit_call_arg(t, fty, d, i);
   if (as_unsigned) cbuf_puts(&t->body, ")");
 }
 
 /* The CG arithmetic layer (src/cg/arith.c) lowers 128-bit integer operations
  * into calls to runtime helpers: compiler-rt-standard names for mul/div/mod/
  * shift/neg, and __kit_*-prefixed ones for add/sub/bitwise/not/extend/compare
  * — operations that real toolchains inline (so have no compiler-rt symbol), or
  * that use kit's own -1/0/1 compare convention. A C compiler has native
  * __int128, so the portable C backend re-expresses every such call as a native
  * operator: the emitted source then needs neither kit's runtime nor the host's
  * compiler-rt builtins. Returns 1 if it emitted the intrinsic, 0 to fall
  * through to a normal call. */
 static int c_try_emit_ti_intrinsic(CTarget* t, const CgType* fty,
                                    const CGCallDesc* d) {
   if (d->callee.kind != OPK_GLOBAL) return 0;
   const char* n = c_sym_name(t, d->callee.v.global.sym);
   if (!n) return 0;
 
   /* Symmetric binary ops over two i128 operands: (a) OP (b). `u` casts both
    * operands to unsigned __int128 first (unsigned divide/remainder). */
   static const struct {
     const char* name;
     const char* op;
     int u;
   } kBin[] = {
       {"__kit_addti3", "+", 0}, {"__kit_subti3", "-", 0},
       {"__multi3", "*", 0},     {"__kit_andti3", "&", 0},
       {"__kit_orti3", "|", 0},  {"__kit_xorti3", "^", 0},
       {"__divti3", "/", 0},     {"__modti3", "%", 0},
       {"__udivti3", "/", 1},    {"__umodti3", "%", 1},
   };
   if (d->nargs == 2) {
     for (size_t i = 0; i < sizeof kBin / sizeof kBin[0]; ++i) {
       if (strcmp(n, kBin[i].name) != 0) continue;
       cbuf_puts(&t->body, "(");
       c_emit_ti_operand(t, fty, d, 0, kBin[i].u);
       cbuf_puts(&t->body, " ");
       cbuf_puts(&t->body, kBin[i].op);
       cbuf_puts(&t->body, " ");
       c_emit_ti_operand(t, fty, d, 1, kBin[i].u);
       cbuf_puts(&t->body, ")");
       return 1;
     }
   }
 
   /* Shifts: (value) OP (count). The count is a plain int operand, never cast;
    * logical right shift takes an unsigned value. */
   if (d->nargs == 2) {
     const char* sop = NULL;
     int uval = 0;
     if (strcmp(n, "__ashlti3") == 0) {
       sop = "<<";
     } else if (strcmp(n, "__ashrti3") == 0) {
       sop = ">>";
     } else if (strcmp(n, "__lshrti3") == 0) {
       sop = ">>";
       uval = 1;
     }
     if (sop) {
       cbuf_puts(&t->body, "(");
       c_emit_ti_operand(t, fty, d, 0, uval);
       cbuf_puts(&t->body, " ");
       cbuf_puts(&t->body, sop);
       cbuf_puts(&t->body, " ");
       c_emit_call_arg(t, fty, d, 1);
       cbuf_puts(&t->body, ")");
       return 1;
     }
   }
 
   /* Unary ops and i64 -> i128 widening. */
   if (d->nargs == 1) {
     const char* uop = NULL;
     if (strcmp(n, "__negti2") == 0)
       uop = "-";
     else if (strcmp(n, "__kit_notti3") == 0)
       uop = "~";
     if (uop) {
       cbuf_puts(&t->body, "(");
       cbuf_puts(&t->body, uop);
       cbuf_puts(&t->body, "(");
       c_emit_call_arg(t, fty, d, 0);
       cbuf_puts(&t->body, "))");
       return 1;
     }
     if (strcmp(n, "__kit_sext64ti") == 0) {
       cbuf_puts(&t->body, "((__int128)(int64_t)(");
       c_emit_call_arg(t, fty, d, 0);
       cbuf_puts(&t->body, "))");
       return 1;
     }
     if (strcmp(n, "__kit_zext64ti") == 0) {
       cbuf_puts(&t->body, "((unsigned __int128)(uint64_t)(");
       c_emit_call_arg(t, fty, d, 0);
       cbuf_puts(&t->body, "))");
       return 1;
     }
   }
 
   /* Compare: kit's helpers return -1/0/1 (the CG layer compares the result
    * against zero), so reproduce that sign convention with native operators. */
   if (d->nargs == 2) {
     int usign = -1;
     if (strcmp(n, "__kit_cmpti2") == 0)
       usign = 0;
     else if (strcmp(n, "__kit_ucmpti2") == 0)
       usign = 1;
     if (usign >= 0) {
       cbuf_puts(&t->body, "(");
       c_emit_ti_operand(t, fty, d, 0, usign);
       cbuf_puts(&t->body, " < ");
       c_emit_ti_operand(t, fty, d, 1, usign);
       cbuf_puts(&t->body, " ? -1 : (");
       c_emit_ti_operand(t, fty, d, 0, usign);
       cbuf_puts(&t->body, " > ");
       c_emit_ti_operand(t, fty, d, 1, usign);
       cbuf_puts(&t->body, " ? 1 : 0))");
       return 1;
     }
   }
   return 0;
 }
 
 static void c_emit_call_expr(CTarget* t, const CgType* fty,
                              const CGCallDesc* d) {
   if (c_try_emit_ti_intrinsic(t, fty, d)) return;
   if (d->callee.kind == OPK_GLOBAL) {
     c_ensure_forward_decl(t, d->callee.v.global.sym, d->fn_type);
     cbuf_puts(&t->body, c_sym_name(t, d->callee.v.global.sym));
   } else if (d->callee.kind == OPK_LOCAL) {
     const char* fp = c_typedef_name(t, d->fn_type);
     cbuf_puts(&t->body, "((");
     c_ensure_typedef(t, d->fn_type);
     cbuf_puts(&t->body, fp);
     cbuf_puts(&t->body, ")");
     c_emit_operand(t, d->callee);
     cbuf_puts(&t->body, ")");
   } else {
     compiler_panic(t->c, t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0},
                    "C target: callee kind %d not supported",
                    (int)d->callee.kind);
   }
 
   cbuf_puts(&t->body, "(");
   for (u32 i = 0; i < d->nargs; ++i) {
     if (i > 0) cbuf_puts(&t->body, ", ");
     c_emit_call_arg(t, fty, d, i);
   }
   cbuf_puts(&t->body, ")");
 }
 
 const char* c_emit_tail_call_unrealizable_reason(CTarget* t,
                                                  const CGCallDesc* d) {
   return c_emit_tail_call_unrealizable_reason_for(t, t->cur_fn, d);
 }
 
 const char* c_emit_tail_call_unrealizable_reason_for(
     CTarget* t, const CGFuncDesc* caller_fd, const CGCallDesc* d) {
   SrcLoc loc = caller_fd ? caller_fd->loc : (SrcLoc){0, 0, 0};
   const CgType* fty = cg_type_get(t->c, d->fn_type);
   if (!fty || fty->kind != KIT_CG_TYPE_FUNC) {
     compiler_panic(t->c, loc, "C target: tail call: bad fn_type");
   }
   const CgType* caller =
       caller_fd ? cg_type_get(t->c, caller_fd->fn_type) : NULL;
   if (!caller || caller->kind != KIT_CG_TYPE_FUNC) {
     compiler_panic(t->c, loc, "C target: tail call outside function");
   }
   if (caller->func.abi_variadic) {
     return "C target: caller variadic tail call not yet supported by clang "
            "musttail";
   }
   if (fty->func.abi_variadic) {
     return "C target: variadic tail call not yet supported by clang musttail";
   }
   if (caller->func.nparams != fty->func.nparams) {
     return "C target: tail call with differing parameter counts not yet "
            "supported by clang musttail";
   }
   return NULL;
 }
 
 void c_emit_call(CTarget* t, const CGCallDesc* d) {
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
 
   const CgType* fty = cg_type_get(t->c, d->fn_type);
   if (!fty || fty->kind != KIT_CG_TYPE_FUNC) {
     compiler_panic(t->c, loc, "C target: call: bad fn_type");
   }
   KitCgTypeId ret_type = cg_func_ret_type(fty);
   int is_tail = (d->flags & CG_CALL_TAIL) != 0;
 
   if (is_tail) {
     cbuf_puts(&t->body, "  __attribute__((musttail)) return ");
     c_emit_call_expr(t, fty, d);
     cbuf_puts(&t->body, ";\n");
     t->last_was_terminator = 1;
   } else if (d->result == CG_LOCAL_NONE) {
     cbuf_puts(&t->body, "  ");
     c_emit_call_expr(t, fty, d);
     cbuf_puts(&t->body, ";\n");
   } else {
     c_ensure_local(t, d->result, ret_type);
     c_emit_local_assign_open(t, d->result, ret_type);
     c_emit_call_expr(t, fty, d);
     c_emit_local_assign_close(t);
   }
 }
 
 /* === load / store === */
 
 void c_emit_load(CTarget* t, Operand dst, Operand addr, MemAccess m) {
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   if (dst.kind != OPK_LOCAL) {
     compiler_panic(t->c, loc, "C target: load dst must be LOCAL");
   }
   c_ensure_local(t, dst.v.local, dst.type);
   KitCgTypeId access_ty = m.type ? m.type : dst.type;
   if (c_type_is_aggregate(t, access_ty) && !c_type_is_aggregate(t, dst.type))
     access_ty = dst.type;
   /* The deref `*(access_ty*)addr` produces a value of access_ty. */
   c_emit_local_assign_open(t, dst.v.local, access_ty);
   c_emit_addr_deref(t, addr, access_ty);
   c_emit_local_assign_close(t);
 }
 
 void c_emit_store(CTarget* t, Operand addr, Operand src, MemAccess m) {
   KitCgTypeId access_ty = m.type ? m.type : src.type;
   if (c_type_is_aggregate(t, access_ty) && !c_type_is_aggregate(t, src.type))
     access_ty = src.type;
   cbuf_puts(&t->body, "  ");
   c_emit_addr_deref(t, addr, access_ty);
   /* c_emit_operand_as bridges int/ptr crossings through uintptr_t so
    * roundtrips don't trip `-Wint-conversion`. */
   cbuf_puts(&t->body, " = ");
   c_emit_operand_as(t, src, access_ty);
   cbuf_puts(&t->body, ";\n");
 }
 
 void c_emit_addr_of(CTarget* t, Operand dst, Operand lv) {
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   if (dst.kind != OPK_LOCAL) {
     compiler_panic(t->c, loc, "C target: addr_of dst must be LOCAL");
   }
   c_ensure_local(t, dst.v.local, dst.type);
   /* `c_emit_lvalue_addr` casts its output to dst.type already. */
   c_emit_local_assign_open(t, dst.v.local, dst.type);
   c_emit_lvalue_addr(t, lv, dst.type);
   c_emit_local_assign_close(t);
 }
 
 void c_emit_ret(CTarget* t, CGLocal value) {
   /* Already-terminated block: this ret is unreachable (the frontend's
    * defensive `return 0;` epilogue lands here right after a user return). */
   if (t->last_was_terminator) return;
   /* CG emits a defensive void-return epilogue at the end of every function. For
    * a non-void function that's unreachable; emitting a bare `return;` would
    * trip -Wreturn-type. Spell it as `__builtin_unreachable()` so the host C
    * compiler sees the path is dead without us inventing a fake value. A genuine
    * void return (the function's result is the void builtin) must still emit
    * `return;` -- testing against KIT_CG_TYPE_NONE here would misfire, since the
    * cutover represents void as the void builtin, not NONE. */
   if (value == CG_LOCAL_NONE && t->cur_fn) {
     if (!cg_type_is_void(t->c, t->cur_fn->result_type)) {
       cbuf_puts(&t->body, "  __builtin_unreachable();\n");
       t->last_was_terminator = 1;
       return;
     }
   }
   cbuf_puts(&t->body, "  return");
   if (value != CG_LOCAL_NONE) {
     cbuf_puts(&t->body, " ");
     KitCgTypeId ret_type = t->cur_fn ? t->cur_fn->result_type : (KitCgTypeId)0;
     const CgType* rty = ret_type ? cg_type_get(t->c, ret_type) : NULL;
     int is_aggregate = rty && (rty->kind == KIT_CG_TYPE_RECORD ||
                                rty->kind == KIT_CG_TYPE_ARRAY);
     if (ret_type && !is_aggregate) {
       KitCgTypeId value_ty = c_local_type_or_panic(t, value);
       c_emit_operand_as(t, c_op_local(value, value_ty), ret_type);
     } else {
       c_emit_operand(t, c_op_local(value, ret_type));
     }
   }
   cbuf_puts(&t->body, ";\n");
   t->last_was_terminator = 1;
 }
 
 /* === unreachable ===
  * Control terminator for statically-unreachable code (the C
  * __builtin_unreachable point). Ends the basic block; emit the host
  * compiler's `__builtin_unreachable()` so it sees the path is dead. */
 void c_emit_unreachable(CTarget* t) {
   if (t->last_was_terminator) return;
   cbuf_puts(&t->body, "  __builtin_unreachable();\n");
   t->last_was_terminator = 1;
 }
 
 /* === alias ===
  * `kit_cg_alias` makes alias_sym refer to target_sym's body. In obj-file
  * land that's two ObjSyms sharing a (section_id, value); in C source we
  * have to spell it out:
  *
  *   ELF/PE   → `Ret alias(args) __attribute__((alias("target")));`
  *              Single definition, true aliasing, &alias == &target.
  *   Mach-O   → emit a thunk `Ret alias(args) { return target(args); }`.
  *              Clang on Darwin rejects __attribute__((alias)) outright,
  *              so we fall back to a wrapper. Loses the `&alias==&target`
  *              identity but preserves call-through semantics, which is
  *              all the kit-emitted code path needs.
  *
  * The emitted decl serves as the alias definition AND a forward prototype
  * for callers, so we mark sym_forwarded to dedup against a later c_call. */
 void c_emit_alias(CTarget* t, ObjSymId alias_sym, ObjSymId target_sym,
                   KitCgTypeId type) {
   if (c_sym_forwarded_test_and_set(t, alias_sym)) return;
   const char* alias_name = c_sym_name(t, alias_sym);
   const char* target_name = c_sym_name(t, target_sym);
   const CgType* fty = cg_type_get(t->c, type);
   int is_func = fty && fty->kind == KIT_CG_TYPE_FUNC;
 
   const ObjFormatImpl* fmt = obj_format_lookup(t->c->target.obj);
   if (!fmt || !fmt->alias_via_thunk) {
     /* Attribute form. Works for both function and object aliases on ELF
      * and PE/COFF. */
     c_emit_func_signature(t, &t->forwards, alias_name, type);
     cbuf_puts(&t->forwards, " __attribute__((alias(\"");
     cbuf_puts(&t->forwards, target_name);
     cbuf_puts(&t->forwards, "\")));\n");
     return;
   }
 
   /* Mach-O thunk fallback. Functions only for v1 — object aliases on
    * Darwin would need a more elaborate scheme (see doc/CBACKEND.md). */
   if (!is_func) {
     compiler_panic(t->c, (SrcLoc){0, 0, 0},
                    "C target: object alias on Mach-O not yet supported");
   }
   /* Forward prototype for the target (its full definition lands separately
    * via c_func_begin). Also dedup that. */
   c_ensure_forward_decl(t, target_sym, type);
   /* `static`? No — alias must be externally visible. */
   c_emit_func_signature(t, &t->forwards, alias_name, type);
   cbuf_puts(&t->forwards, " { ");
   KitCgTypeId ret_type = cg_type_func_ret_id(t->c, type);
   if (!cg_type_is_void(t->c, ret_type)) cbuf_puts(&t->forwards, "return ");
   cbuf_puts(&t->forwards, target_name);
   cbuf_puts(&t->forwards, "(");
   for (u32 i = 0; i < fty->func.nparams; ++i) {
     if (i > 0) cbuf_puts(&t->forwards, ", ");
     cbuf_puts(&t->forwards, "p");
     cbuf_put_u64(&t->forwards, (u64)i);
   }
   cbuf_puts(&t->forwards, "); }\n");
 }
 
 /* === intrinsic ===
  *
  * All kit IntrinKinds map onto gcc/clang `__builtin_*` builtins, which
  * the host C compiler then turns into the appropriate sequence (inline op,
  * libcall, runtime CAS, etc.). This is exactly the seam the doc described:
  * kit records intent, the downstream toolchain picks the mechanism.
  *
  * Operand shapes follow arch.h §IntrinKind. */
 
 static const char* c_bitop_builtin(IntrinKind k, u32 width) {
   switch (k) {
     case INTRIN_POPCOUNT:
       if (width == 32) return "__builtin_popcount";
       if (width == 64) return "__builtin_popcountll";
       if (width == 16 || width == 8) return "__builtin_popcount";
       return NULL;
     case INTRIN_CTZ:
       if (width == 32) return "__builtin_ctz";
       if (width == 64) return "__builtin_ctzll";
       if (width == 16 || width == 8) return "__builtin_ctz";
       return NULL;
     case INTRIN_CLZ:
       if (width == 32) return "__builtin_clz";
       if (width == 64) return "__builtin_clzll";
       if (width == 16 || width == 8) return "__builtin_clz";
       return NULL;
     case INTRIN_BSWAP:
       if (width == 16) return "__builtin_bswap16";
       if (width == 32) return "__builtin_bswap32";
       if (width == 64) return "__builtin_bswap64";
       return NULL;
     default:
       return NULL;
   }
 }
 
 static const char* c_overflow_builtin(IntrinKind k) {
   switch (k) {
     case INTRIN_SADD_OVERFLOW:
     case INTRIN_UADD_OVERFLOW:
       return "__builtin_add_overflow";
     case INTRIN_SSUB_OVERFLOW:
     case INTRIN_USUB_OVERFLOW:
       return "__builtin_sub_overflow";
     case INTRIN_SMUL_OVERFLOW:
     case INTRIN_UMUL_OVERFLOW:
       return "__builtin_mul_overflow";
     default:
       return NULL;
   }
 }
 
 void c_emit_intrinsic(CTarget* t, IntrinKind k, Operand* dsts, u32 ndst,
                       const Operand* args, u32 narg) {
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   switch (k) {
     case INTRIN_TRAP:
       cbuf_puts(&t->body, "  __builtin_trap();\n");
       return;
     case INTRIN_PREFETCH: {
       cbuf_puts(&t->body, "  __builtin_prefetch(");
       for (u32 i = 0; i < narg; ++i) {
         if (i > 0) cbuf_puts(&t->body, ", ");
         c_emit_operand(t, args[i]);
       }
       cbuf_puts(&t->body, ");\n");
       return;
     }
     case INTRIN_ASSUME_ALIGNED: {
       /* dsts[0] is the result local (pointer); args = (ptr, align [, ofs]) */
       if (ndst != 1) {
         compiler_panic(t->c, loc,
                        "C target: assume_aligned: expected 1 dst, got %u",
                        (unsigned)ndst);
       }
       c_ensure_local(t, dsts[0].v.local, dsts[0].type);
       /* Returns void*; bridge to dst pointer type. */
       c_emit_local_assign_open(t, dsts[0].v.local, (KitCgTypeId)0);
       cbuf_puts(&t->body, "__builtin_assume_aligned(");
       for (u32 i = 0; i < narg; ++i) {
         if (i > 0) cbuf_puts(&t->body, ", ");
         c_emit_operand(t, args[i]);
       }
       cbuf_puts(&t->body, ")");
       c_emit_local_assign_close(t);
       return;
     }
     case INTRIN_EXPECT: {
       /* dsts[0] = __builtin_expect(args[0], args[1]) but typed via long. */
       if (ndst != 1 || narg != 2) {
         compiler_panic(t->c, loc,
                        "C target: expect: bad shape (ndst=%u narg=%u)",
                        (unsigned)ndst, (unsigned)narg);
       }
       c_ensure_local(t, dsts[0].v.local, dsts[0].type);
       /* Returns `long`; dst.type may be a narrower int — keep the bridge. */
       c_emit_local_assign_open(t, dsts[0].v.local, (KitCgTypeId)0);
       cbuf_puts(&t->body, "__builtin_expect((long)");
       c_emit_operand(t, args[0]);
       cbuf_puts(&t->body, ", (long)");
       c_emit_operand(t, args[1]);
       cbuf_puts(&t->body, ")");
       c_emit_local_assign_close(t);
       return;
     }
     case INTRIN_POPCOUNT:
     case INTRIN_CTZ:
     case INTRIN_CLZ:
     case INTRIN_BSWAP: {
       if (ndst != 1 || narg != 1) {
         compiler_panic(t->c, loc,
                        "C target: bit-intrin: bad shape (ndst=%u narg=%u)",
                        (unsigned)ndst, (unsigned)narg);
       }
       /* bswap width is determined by the result type (in bytes -> bit-width
        * bucket, matching the old per-width intrinsic split). The other bit
        * ops keep deriving width from the operand. */
       u32 w;
       if (k == INTRIN_BSWAP) {
         u32 bytes = (u32)cg_type_size(t->c, dsts[0].type);
         w = bytes <= 2 ? 16u : (bytes <= 4 ? 32u : 64u);
       } else {
         w = c_int_width_for_signedness(t, args[0].type);
       }
       const char* fn = c_bitop_builtin(k, w);
       if (!fn) {
         compiler_panic(t->c, loc, "C target: bit-intrin width %u unsupported",
                        (unsigned)w);
       }
       c_ensure_local(t, dsts[0].v.local, dsts[0].type);
       /* __builtin_popcount/ctz/clz return `int`; bswap returns its input
        * type. Narrow to dst.type via the bridge. */
       c_emit_local_assign_open(t, dsts[0].v.local, (KitCgTypeId)0);
       cbuf_puts(&t->body, fn);
       cbuf_puts(&t->body, "(");
       c_emit_operand(t, args[0]);
       cbuf_puts(&t->body, ")");
       c_emit_local_assign_close(t);
       return;
     }
     case INTRIN_SMUL_HIGH:
     case INTRIN_UMUL_HIGH: {
       u32 width;
       int is_signed = k == INTRIN_SMUL_HIGH;
       if (ndst != 1 || narg != 2) {
         compiler_panic(t->c, loc,
                        "C target: mul-high: bad shape (ndst=%u narg=%u)",
                        (unsigned)ndst, (unsigned)narg);
       }
       width = (u32)cg_type_size(t->c, dsts[0].type) * 8u;
       c_ensure_local(t, dsts[0].v.local, dsts[0].type);
       c_emit_local_assign_open(t, dsts[0].v.local, (KitCgTypeId)0);
       if (width == 64u) {
         cbuf_puts(&t->body, is_signed ? "((int64_t)(((__int128)(int64_t)("
                                         : "((uint64_t)(((unsigned __int128)(uint64_t)(");
         c_emit_operand(t, args[0]);
         cbuf_puts(&t->body, is_signed ? ") * (__int128)(int64_t)("
                                       : ") * (unsigned __int128)(uint64_t)(");
         c_emit_operand(t, args[1]);
         cbuf_puts(&t->body, ")) >> 64))");
       } else {
         cbuf_puts(&t->body, is_signed ? "((int32_t)(((int64_t)(int32_t)("
                                         : "((uint32_t)(((uint64_t)(uint32_t)(");
         c_emit_operand(t, args[0]);
         cbuf_puts(&t->body, is_signed ? ") * (int64_t)(int32_t)("
                                       : ") * (uint64_t)(uint32_t)(");
         c_emit_operand(t, args[1]);
         cbuf_puts(&t->body, is_signed ? ")) >> 32))" : ")) >> 32))");
       }
       c_emit_local_assign_close(t);
       return;
     }
     case INTRIN_CPU_YIELD:
       /* A portable relax hint may be discarded by the downstream C compiler. */
       cbuf_puts(&t->body, "  (void)0;\n");
       return;
     case INTRIN_MEMMOVE: {
       cbuf_puts(&t->body, "  __builtin_memmove(");
       for (u32 i = 0; i < narg; ++i) {
         if (i > 0) cbuf_puts(&t->body, ", ");
         /* The pointer operands (dst and src) may be typed as a plain integer
          * local when they come from address arithmetic, which the C target
          * declares as int64_t. __builtin_memmove takes void*, so cast
          * explicitly to avoid -Wint-conversion. */
         int is_ptr_arg = (i == 0) || (i == 1);
         if (is_ptr_arg) cbuf_puts(&t->body, "(void*)");
         c_emit_operand(t, args[i]);
       }
       cbuf_puts(&t->body, ");\n");
       return;
     }
     case INTRIN_SADD_OVERFLOW:
     case INTRIN_UADD_OVERFLOW:
     case INTRIN_SSUB_OVERFLOW:
     case INTRIN_USUB_OVERFLOW:
     case INTRIN_SMUL_OVERFLOW:
     case INTRIN_UMUL_OVERFLOW: {
       /* dsts[0] = value local, dsts[1] = i1 overflow flag.
        *
        * Signedness comes from the intrinsic kind, but kit's CG int type
        * is width-only and the C target declares every result as a signed
        * fixed-width (int{8,16,32,64}_t). __builtin_*_overflow keys its
        * overflow check on the result type, so passing the signed local
        * directly makes a UADD test as if it were signed and miss true
        * unsigned overflow. Wrap the call in a block with a scratch result
        * of the right signedness and copy it back through the int/uint
        * bridge. */
       if (ndst != 2 || narg != 2) {
         compiler_panic(t->c, loc, "C target: overflow-intrin: bad shape");
       }
       int is_unsigned =
           (k == INTRIN_UADD_OVERFLOW || k == INTRIN_USUB_OVERFLOW ||
            k == INTRIN_UMUL_OVERFLOW);
       const char* fn = c_overflow_builtin(k);
       c_ensure_local(t, dsts[0].v.local, dsts[0].type);
       c_ensure_local(t, dsts[1].v.local, dsts[1].type);
       char vbuf[24], obuf[24];
       c_local_name(dsts[0].v.local, vbuf, sizeof vbuf);
       c_local_name(dsts[1].v.local, obuf, sizeof obuf);
       u32 w = c_int_width_for_signedness(t, dsts[0].type);
       const char* sty = c_int_type_name_for_width(w, !is_unsigned);
       if (!sty) {
         compiler_panic(t->c, loc,
                        "C target: overflow-intrin: unsupported width %u",
                        (unsigned)w);
       }
       cbuf_puts(&t->body, "  { ");
       cbuf_puts(&t->body, sty);
       cbuf_puts(&t->body, " __ovsc; ");
       cbuf_puts(&t->body, obuf);
       cbuf_puts(&t->body, " = (");
       c_emit_type(t, &t->body, dsts[1].type);
       cbuf_puts(&t->body, ")");
       cbuf_puts(&t->body, fn);
       cbuf_puts(&t->body, "((");
       cbuf_puts(&t->body, sty);
       cbuf_puts(&t->body, ")");
       c_emit_operand(t, args[0]);
       cbuf_puts(&t->body, ", (");
       cbuf_puts(&t->body, sty);
       cbuf_puts(&t->body, ")");
       c_emit_operand(t, args[1]);
       cbuf_puts(&t->body, ", &__ovsc); ");
       cbuf_puts(&t->body, vbuf);
       cbuf_puts(&t->body, " = (");
       c_emit_type(t, &t->body, dsts[0].type);
       cbuf_puts(&t->body, ")__ovsc; }\n");
       return;
     }
     case INTRIN_SETJMP: {
       t->need_setjmp = 1;
       if (ndst != 1 || narg != 1) {
         compiler_panic(t->c, loc, "C target: setjmp: bad shape");
       }
       c_ensure_local(t, dsts[0].v.local, dsts[0].type);
       /* setjmp returns `int`; bridge to dst.type. */
       c_emit_local_assign_open(t, dsts[0].v.local, (KitCgTypeId)0);
       cbuf_puts(&t->body, "setjmp(*(jmp_buf*)(");
       c_emit_operand(t, args[0]);
       cbuf_puts(&t->body, "))");
       c_emit_local_assign_close(t);
       return;
     }
     case INTRIN_LONGJMP: {
       t->need_setjmp = 1;
       cbuf_puts(&t->body, "  longjmp(*(jmp_buf*)(");
       c_emit_operand(t, args[0]);
       cbuf_puts(&t->body, "), (int)");
       c_emit_operand(t, args[1]);
       cbuf_puts(&t->body, ");\n");
       return;
     }
     case INTRIN_FRAME_ADDRESS:
     case INTRIN_RETURN_ADDRESS: {
       /* Forward straight to the host compiler's builtin. dsts[0] is the void*
        * result; args[0] is the constant level. The builtin requires a bare
        * integer constant, so emit the level as a plain decimal (not via
        * c_emit_operand, which wraps IMMs in a cast). */
       char nbuf[24];
       unsigned level =
           (narg >= 1 && args[0].kind == OPK_IMM) ? (unsigned)args[0].v.imm : 0u;
       if (ndst != 1) {
         compiler_panic(t->c, loc,
                        "C target: frame/return address: expected 1 dst, got %u",
                        (unsigned)ndst);
       }
       snprintf(nbuf, sizeof nbuf, "%u", level);
       c_ensure_local(t, dsts[0].v.local, dsts[0].type);
       c_emit_local_assign_open(t, dsts[0].v.local, (KitCgTypeId)0);
       cbuf_puts(&t->body, k == INTRIN_FRAME_ADDRESS
                               ? "__builtin_frame_address("
                               : "__builtin_return_address(");
       cbuf_puts(&t->body, nbuf);
       cbuf_puts(&t->body, ")");
       c_emit_local_assign_close(t);
       return;
     }
     case INTRIN_READCYCLECOUNTER: {
       /* Forward to the host compiler's builtin. dsts[0] is the u64 result. */
       if (ndst != 1) {
         compiler_panic(t->c, loc,
                        "C target: readcyclecounter: expected 1 dst, got %u",
                        (unsigned)ndst);
       }
       c_ensure_local(t, dsts[0].v.local, dsts[0].type);
       c_emit_local_assign_open(t, dsts[0].v.local, (KitCgTypeId)0);
       cbuf_puts(&t->body, "__builtin_readcyclecounter()");
       c_emit_local_assign_close(t);
       return;
     }
     case INTRIN_SYSCALL:
       compiler_panic(t->c, loc, "C target: syscall intrinsic not supported");
       return;
     case INTRIN_NONE:
     default:
       compiler_panic(t->c, loc, "C target: intrinsic kind %d not handled",
                      (int)k);
   }
 }
 
 /* === alloca === */
 
 void c_emit_alloca(CTarget* t, Operand dst, Operand size, u32 align) {
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   if (dst.kind != OPK_LOCAL) {
     compiler_panic(t->c, loc, "C target: alloca dst must be LOCAL");
   }
   c_ensure_local(t, dst.v.local, dst.type);
   /* __builtin_alloca returns `void*`; dst.type is typically void* too. */
   c_emit_local_assign_open(t, dst.v.local, dst.type);
   if (align > 1) {
     /* gcc has __builtin_alloca_with_align taking bits, not bytes. */
     cbuf_puts(&t->body, "__builtin_alloca_with_align(");
     c_emit_operand(t, size);
     cbuf_puts(&t->body, ", ");
     cbuf_put_u64(&t->body, (u64)align * 8u);
     cbuf_puts(&t->body, ")");
   } else {
     cbuf_puts(&t->body, "__builtin_alloca(");
     c_emit_operand(t, size);
     cbuf_puts(&t->body, ")");
   }
   c_emit_local_assign_close(t);
 }
 
 /* === varargs ===
  *
  * The C-target va_list is the host toolchain's `va_list` from <stdarg.h>.
  * The first arg of all va_* is `ap_addr` - the address of the va_list local.
  * We deref to get the va_list lvalue C's macros expect. */
 
 void c_emit_va_start(CTarget* t, Operand ap_addr) {
   t->need_stdarg = 1;
   /* va_start needs the "last named parameter". CG doesn't pass that to the
    * backend; gcc/clang accept any non-modified ident here for variadic
    * compatibility — feed the synthesized parameter name `p<nparams-1>` from
    * the enclosing function. */
   const CGFuncDesc* fd = t->cur_fn;
   SrcLoc loc = fd ? fd->loc : (SrcLoc){0, 0, 0};
   if (!fd) compiler_panic(t->c, loc, "C target: va_start outside function");
   const CgType* fty = cg_type_get(t->c, fd->fn_type);
   if (!fty || fty->kind != KIT_CG_TYPE_FUNC || fty->func.nparams == 0) {
     compiler_panic(t->c, loc,
                    "C target: va_start in non-variadic function shape");
   }
   cbuf_puts(&t->body, "  __builtin_va_start(*(va_list*)(");
   c_emit_operand(t, ap_addr);
   cbuf_puts(&t->body, "), p");
   cbuf_put_u64(&t->body, (u64)(fty->func.nparams - 1u));
   cbuf_puts(&t->body, ");\n");
 }
 
 void c_emit_va_end(CTarget* t, Operand ap_addr) {
   cbuf_puts(&t->body, "  __builtin_va_end(*(va_list*)(");
   c_emit_operand(t, ap_addr);
   cbuf_puts(&t->body, "));\n");
 }
 
 void c_emit_va_copy(CTarget* t, Operand dst_addr, Operand src_addr) {
   cbuf_puts(&t->body, "  __builtin_va_copy(*(va_list*)(");
   c_emit_operand(t, dst_addr);
   cbuf_puts(&t->body, "), *(va_list*)(");
   c_emit_operand(t, src_addr);
   cbuf_puts(&t->body, "));\n");
 }
 
 void c_emit_va_arg(CTarget* t, Operand dst, Operand ap_addr, KitCgTypeId ty) {
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   if (dst.kind != OPK_LOCAL) {
     compiler_panic(t->c, loc, "C target: va_arg dst must be LOCAL");
   }
   c_ensure_local(t, dst.v.local, dst.type);
   /* __builtin_va_arg yields a value of `ty`. */
   c_emit_local_assign_open(t, dst.v.local, ty);
   cbuf_puts(&t->body, "__builtin_va_arg(*(va_list*)(");
   c_emit_operand(t, ap_addr);
   cbuf_puts(&t->body, "), ");
   c_emit_type(t, &t->body, ty);
   cbuf_puts(&t->body, ")");
   c_emit_local_assign_close(t);
 }
 
 /* === copy_bytes / set_bytes === */
 
 void c_emit_copy_bytes(CTarget* t, Operand dst_addr, Operand src_addr,
                        AggregateAccess m) {
   c_assert_no_index(t, dst_addr, "copy_bytes dst");
   c_assert_no_index(t, src_addr, "copy_bytes src");
   /* dst/src may be plain integer regs from address arithmetic (declared
    * int64_t); __builtin_memcpy takes void*, so cast to avoid
    * -Wint-conversion. */
   cbuf_puts(&t->body, "  __builtin_memcpy((void*)");
   c_emit_copy_addr(t, dst_addr);
   cbuf_puts(&t->body, ", (void*)");
   c_emit_copy_addr(t, src_addr);
   cbuf_puts(&t->body, ", ");
   cbuf_put_u64(&t->body, (u64)m.size);
   cbuf_puts(&t->body, ");\n");
 }
 
 static void c_emit_copy_addr(CTarget* t, Operand addr) {
   char buf[24];
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   switch (addr.kind) {
     case OPK_LOCAL:
       c_ensure_local(t, addr.v.local, addr.type);
       if (c_operand_is_ptr_typed(t, addr)) {
         c_emit_operand(t, addr);
       } else {
         cbuf_putc(&t->body, '&');
         c_local_name(addr.v.local, buf, sizeof buf);
         cbuf_puts(&t->body, buf);
       }
       return;
     case OPK_GLOBAL: {
       obj_sym_mark_referenced(t->obj, addr.v.global.sym);
       cbuf_puts(&t->body, "((char*)&");
       cbuf_puts(&t->body, c_sym_name(t, addr.v.global.sym));
       if (addr.v.global.addend != 0) {
         cbuf_puts(&t->body, " + ");
         cbuf_put_i64(&t->body, addr.v.global.addend);
       }
       cbuf_putc(&t->body, ')');
       return;
     }
     case OPK_INDIRECT:
       c_emit_indirect_addr_expr(t, c_addr_mode(addr));
       return;
     default:
       compiler_panic(t->c, loc,
                      "C target: copy_bytes address operand kind %d not "
                      "supported",
                      (int)addr.kind);
   }
 }
 
 void c_emit_set_bytes(CTarget* t, Operand dst_addr, Operand byte_value,
                       AggregateAccess m) {
   c_assert_no_index(t, dst_addr, "set_bytes dst");
   /* dst may be a plain integer local from address arithmetic (declared
    * int64_t); __builtin_memset takes void*, so cast to avoid
    * -Wint-conversion. */
   cbuf_puts(&t->body, "  __builtin_memset((void*)");
   c_emit_copy_addr(t, dst_addr);
   cbuf_puts(&t->body, ", (int)");
   c_emit_operand(t, byte_value);
   cbuf_puts(&t->body, ", ");
   cbuf_put_u64(&t->body, (u64)m.size);
   cbuf_puts(&t->body, ");\n");
 }
 
 /* === TLS ===
  *
  * Thread-local data is emitted as `_Thread_local _Alignas(A) uint8_t name[N];`
  * during c_emit_data, and tls_addr_of spells `((char*)&name + addend)` with
  * the requested pointer type. The host C compiler picks the TLS model. */
 
 void c_emit_tls_addr_of(CTarget* t, Operand dst, ObjSymId sym, i64 addend);
 
 void c_emit_tls_addr_of(CTarget* t, Operand dst, ObjSymId sym, i64 addend) {
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   if (dst.kind != OPK_LOCAL) {
     compiler_panic(t->c, loc, "C target: tls_addr_of dst must be LOCAL");
   }
   c_ensure_local(t, dst.v.local, dst.type);
   const char* nm = c_sym_name(t, sym);
   /* RHS spells `(char*)&sym + addend` — pointer type that may not match
    * dst.type; keep the bridge to cast through cleanly. */
   c_emit_local_assign_open(t, dst.v.local, (KitCgTypeId)0);
   cbuf_puts(&t->body, "((char*)&");
   cbuf_puts(&t->body, nm);
   if (addend != 0) {
     cbuf_puts(&t->body, " + ");
     cbuf_put_i64(&t->body, addend);
   }
   cbuf_puts(&t->body, ")");
   c_emit_local_assign_close(t);
 }
 
 /* === bitfields ===
  *
  * kit CG flattens bitfields to (storage_type, byte_offset, bit_offset,
  * bit_width) at the access boundary, so the C target never sees a C-level
  * bitfield declaration. We extract/insert via explicit mask+shift on the
  * underlying storage unit (a fixed-width unsigned int loaded through the
  * usual address-deref path), which sidesteps the C bitfield ABI ambiguity
  * entirely. */
 
 void c_emit_bitfield_load(CTarget* t, Operand dst, Operand addr,
                           BitFieldAccess bf);
 void c_emit_bitfield_store(CTarget* t, Operand addr, Operand src,
                            BitFieldAccess bf);
 
 /* Returns the unsigned C integer type matching the storage-unit byte size. */
 static const char* c_bf_storage_type(u32 size) {
   switch (size) {
     case 1:
       return "uint8_t";
     case 2:
       return "uint16_t";
     case 4:
       return "uint32_t";
     case 8:
       return "uint64_t";
     default:
       return NULL;
   }
 }
 
 /* Spell an address expression for a backend-addressable lvalue operand.
  * Unlike c_emit_operand, this never reads the object value; it materializes
  * the address of the local/global/indirect storage itself. */
 static void c_emit_lvalue_addr_expr_raw(CTarget* t, Operand addr) {
   char buf[24];
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   switch (addr.kind) {
     case OPK_LOCAL:
       cbuf_putc(&t->body, '&');
       c_ensure_local(t, addr.v.local, addr.type);
       c_local_name(addr.v.local, buf, sizeof buf);
       cbuf_puts(&t->body, buf);
       return;
     case OPK_GLOBAL: {
       obj_sym_mark_referenced(t->obj, addr.v.global.sym);
       const char* nm = c_sym_name(t, addr.v.global.sym);
       cbuf_puts(&t->body, "((char*)&");
       cbuf_puts(&t->body, nm);
       if (addr.v.global.addend != 0) {
         cbuf_puts(&t->body, " + ");
         cbuf_put_i64(&t->body, addr.v.global.addend);
       }
       cbuf_putc(&t->body, ')');
       return;
     }
     case OPK_INDIRECT: {
       CAddrMode m = c_addr_mode(addr);
       if ((u32)m.base >= t->local_cap || !t->local_declared[m.base]) {
         compiler_panic(t->c, loc,
                        "C target: bitfield on undeclared base local v%u",
                        (unsigned)m.base);
       }
       cbuf_putc(&t->body, '(');
       c_emit_indirect_addr_expr(t, m);
       cbuf_putc(&t->body, ')');
       return;
     }
     default:
       compiler_panic(t->c, loc,
                      "C target: bitfield address on operand kind %d not "
                      "supported",
                      (int)addr.kind);
   }
 }
 
 /* Spell `*(uintN_t*)((char*)addr + bf.storage_offset)` into the body. */
 static void c_bf_storage_lvalue(CTarget* t, Operand addr, BitFieldAccess bf,
                                 const char* storage_ty) {
   cbuf_puts(&t->body, "(*(");
   cbuf_puts(&t->body, storage_ty);
   cbuf_puts(&t->body, "*)((char*)");
   c_emit_lvalue_addr_expr_raw(t, addr);
   if (bf.storage_offset != 0) {
     cbuf_puts(&t->body, " + ");
     cbuf_put_u64(&t->body, (u64)bf.storage_offset);
   }
   cbuf_puts(&t->body, "))");
 }
 
 void c_emit_bitfield_load(CTarget* t, Operand dst, Operand addr,
                           BitFieldAccess bf) {
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   if (dst.kind != OPK_LOCAL) {
     compiler_panic(t->c, loc, "C target: bitfield_load dst must be LOCAL");
   }
   c_assert_no_index(t, addr, "bitfield_load");
   if (bf.bit_width == 0) {
     /* Zero-width — layout barrier only; nothing to load. Emit a no-op
      * assignment so the dst local still gets a defined value. */
     c_ensure_local(t, dst.v.local, dst.type);
     /* RHS is the literal 0 (int); narrowing to dst.type is fine. */
     c_emit_local_assign_open(t, dst.v.local, dst.type);
     cbuf_puts(&t->body, "0");
     c_emit_local_assign_close(t);
     return;
   }
   const char* sty = c_bf_storage_type(bf.storage.size);
   if (!sty) {
     compiler_panic(t->c, loc, "C target: bitfield storage size %u unsupported",
                    (unsigned)bf.storage.size);
   }
   c_ensure_local(t, dst.v.local, dst.type);
   /* RHS is the storage-width int from the mask/shift expression; bridge
    * to dst.type so any signedness/width adjustment is explicit. */
   c_emit_local_assign_open(t, dst.v.local, (KitCgTypeId)0);
   /* For signed bitfields, sign-extend via the standard shift-up / arith-shift-
    * down trick on a signed integer of the storage width. For unsigned, mask
    * the extracted bits.
    *
    * Storage is little-endian-bit-indexed on every kit-supported target
    * (LSB-first within a storage unit on x86_64/aarch64/rv64). */
   u32 sw = bf.storage.size * 8u;
   if (bf.signed_) {
     /* (int_storage_t)((storage << shl) >> shr) where:
      *   shl = sw - bit_width - bit_offset
      *   shr = sw - bit_width
      * Then cast to dst type. */
     u32 shl = sw - (u32)bf.bit_width - (u32)bf.bit_offset;
     u32 shr = sw - (u32)bf.bit_width;
     cbuf_puts(&t->body, "(((int");
     cbuf_put_u64(&t->body, (u64)sw);
     cbuf_puts(&t->body, "_t)(");
     c_bf_storage_lvalue(t, addr, bf, sty);
     cbuf_puts(&t->body, " << ");
     cbuf_put_u64(&t->body, (u64)shl);
     cbuf_puts(&t->body, ")) >> ");
     cbuf_put_u64(&t->body, (u64)shr);
     cbuf_puts(&t->body, ")");
   } else {
     /* ((storage >> bit_offset) & ((1u << bit_width) - 1)) */
     u64 mask = (bf.bit_width >= 64) ? ~(u64)0 : (((u64)1 << bf.bit_width) - 1u);
     cbuf_puts(&t->body, "((");
     c_bf_storage_lvalue(t, addr, bf, sty);
     cbuf_puts(&t->body, " >> ");
     cbuf_put_u64(&t->body, (u64)bf.bit_offset);
     cbuf_puts(&t->body, ") & (");
     cbuf_puts(&t->body, sty);
     cbuf_puts(&t->body, ")0x");
     static const char hex[] = "0123456789abcdef";
     int started = 0;
     for (int sh = 60; sh >= 0; sh -= 4) {
       u32 nib = (u32)((mask >> sh) & 0xfu);
       if (nib || started || sh == 0) {
         cbuf_putc(&t->body, hex[nib]);
         started = 1;
       }
     }
     cbuf_puts(&t->body, ")");
   }
   c_emit_local_assign_close(t);
 }
 
 void c_emit_bitfield_store(CTarget* t, Operand addr, Operand src,
                            BitFieldAccess bf) {
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   c_assert_no_index(t, addr, "bitfield_store");
   if (bf.bit_width == 0) return; /* zero-width: no-op */
   const char* sty = c_bf_storage_type(bf.storage.size);
   if (!sty) {
     compiler_panic(t->c, loc, "C target: bitfield storage size %u unsupported",
                    (unsigned)bf.storage.size);
   }
   u64 mask = (bf.bit_width >= 64) ? ~(u64)0 : (((u64)1 << bf.bit_width) - 1u);
   /* *(uintN_t*)p = (*(uintN_t*)p & ~(mask << bit_offset)) |
    *               (((uintN_t)src & mask) << bit_offset); */
   cbuf_puts(&t->body, "  ");
   c_bf_storage_lvalue(t, addr, bf, sty);
   cbuf_puts(&t->body, " = (");
   c_bf_storage_lvalue(t, addr, bf, sty);
   cbuf_puts(&t->body, " & ~((");
   cbuf_puts(&t->body, sty);
   cbuf_puts(&t->body, ")0x");
   static const char hex[] = "0123456789abcdef";
   int started = 0;
   for (int sh = 60; sh >= 0; sh -= 4) {
     u32 nib = (u32)((mask >> sh) & 0xfu);
     if (nib || started || sh == 0) {
       cbuf_putc(&t->body, hex[nib]);
       started = 1;
     }
   }
   cbuf_puts(&t->body, " << ");
   cbuf_put_u64(&t->body, (u64)bf.bit_offset);
   cbuf_puts(&t->body, ")) | ((((");
   cbuf_puts(&t->body, sty);
   cbuf_puts(&t->body, ")");
   c_emit_operand(t, src);
   cbuf_puts(&t->body, ") & (");
   cbuf_puts(&t->body, sty);
   cbuf_puts(&t->body, ")0x");
   started = 0;
   for (int sh = 60; sh >= 0; sh -= 4) {
     u32 nib = (u32)((mask >> sh) & 0xfu);
     if (nib || started || sh == 0) {
       cbuf_putc(&t->body, hex[nib]);
       started = 1;
     }
   }
   cbuf_puts(&t->body, ") << ");
   cbuf_put_u64(&t->body, (u64)bf.bit_offset);
   cbuf_puts(&t->body, ");\n");
 }
 
 /* === inline asm ===
  *
  * Re-serialize kit's asm-block IR (template + constraint-bound operands +
  * clobbers) as GCC extended asm. The kit CG already speaks GCC-style
  * constraint strings ("r", "=r", "+m", "[name]constraint", matching "0"...),
  * so we pass the template through and emit the constraint+operand pairs in
  * order. */
 
 void c_emit_asm_block(CTarget* t, const char* tmpl, const AsmConstraint* outs,
                       u32 no, Operand* oo, const AsmConstraint* ins, u32 ni,
                       const Operand* io, const Sym* clobs, u32 nc);
 
 static void c_emit_c_string_literal(CBuf* b, const char* s) {
   cbuf_putc(b, '"');
   for (; *s; ++s) {
     char ch = *s;
     if (ch == '"' || ch == '\\') {
       cbuf_putc(b, '\\');
       cbuf_putc(b, ch);
     } else if (ch == '\n') {
       cbuf_puts(b, "\\n");
     } else if (ch == '\r') {
       cbuf_puts(b, "\\r");
     } else if (ch == '\t') {
       cbuf_puts(b, "\\t");
     } else if ((unsigned char)ch < 0x20 || (unsigned char)ch >= 0x7f) {
       static const char hex[] = "0123456789abcdef";
       cbuf_puts(b, "\\x");
       cbuf_putc(b, hex[((unsigned char)ch >> 4) & 0xfu]);
       cbuf_putc(b, hex[(unsigned char)ch & 0xfu]);
     } else {
       cbuf_putc(b, ch);
     }
   }
   cbuf_putc(b, '"');
 }
 
 /* "__kit_ao<i>" / "__kit_ai<i>": a unique name for the register temporary that
  * carries a hard-register-pinned output/input operand. */
 static void c_asm_reg_temp_name(char* out, size_t cap, int is_out, u32 idx) {
   const char* pfx = is_out ? "__kit_ao" : "__kit_ai";
   size_t i = 0;
   char tmp[16];
   size_t n = 0;
   u32 v = idx;
   while (*pfx && i + 1 < cap) out[i++] = *pfx++;
   if (!v) tmp[n++] = '0';
   while (v) {
     tmp[n++] = (char)('0' + v % 10);
     v /= 10;
   }
   while (n && i + 1 < cap) out[i++] = tmp[--n];
   out[i] = '\0';
 }
 
 /* Emit an asm output operand's lvalue expression (a plain local, or a
  * dereferenced address for OPK_INDIRECT). Usable as both lvalue and rvalue. */
 static void c_emit_asm_out_lvalue(CTarget* t, Operand op) {
   if (op.kind == OPK_LOCAL) {
     char rb[24];
     c_ensure_local(t, op.v.local, op.type);
     c_local_name(op.v.local, rb, sizeof rb);
     cbuf_puts(&t->body, rb);
   } else {
     c_emit_addr_deref(t, op, op.type);
   }
 }
 
 void c_emit_asm_block(CTarget* t, const char* tmpl, const AsmConstraint* outs,
                       u32 no, Operand* oo, const AsmConstraint* ins, u32 ni,
                       const Operand* io, const Sym* clobs, u32 nc) {
   char nm[24];
   for (u32 i = 0; i < no; ++i) c_assert_no_index(t, oo[i], "asm_block out");
   for (u32 i = 0; i < ni; ++i) c_assert_no_index(t, io[i], "asm_block in");
 
   /* GNU local register variables (AsmConstraint.reg): a target backend resolves
    * the pin to a physical register, but the portable C backend has no register
    * names to bind — so re-emit each pinned operand as a faithful
    * `register T v __asm__("reg")` temporary (scoped in a block) and let the
    * host compiler honor the binding. Dormant unless a frontend marks an
    * operand; only the C frontend does, for register variables. */
   int any_pin = 0;
   for (u32 i = 0; i < no; ++i)
     if (outs[i].reg) any_pin = 1;
   for (u32 i = 0; i < ni; ++i)
     if (ins[i].reg) any_pin = 1;
 
   if (any_pin) {
     cbuf_puts(&t->body, "  {\n");
     for (u32 i = 0; i < ni; ++i) {
       if (!ins[i].reg) continue;
       c_asm_reg_temp_name(nm, sizeof nm, 0, i);
       cbuf_puts(&t->body, "    register ");
       c_emit_type(t, &t->body, io[i].type);
       cbuf_puts(&t->body, " ");
       cbuf_puts(&t->body, nm);
       cbuf_puts(&t->body, " __asm__(");
       c_emit_c_string_literal(&t->body, pool_slice(t->c->global, ins[i].reg).s);
       cbuf_puts(&t->body, ") = ");
       c_emit_operand(t, io[i]);
       cbuf_puts(&t->body, ";\n");
     }
     for (u32 i = 0; i < no; ++i) {
       if (!outs[i].reg) continue;
       c_asm_reg_temp_name(nm, sizeof nm, 1, i);
       cbuf_puts(&t->body, "    register ");
       c_emit_type(t, &t->body, oo[i].type);
       cbuf_puts(&t->body, " ");
       cbuf_puts(&t->body, nm);
       cbuf_puts(&t->body, " __asm__(");
       c_emit_c_string_literal(&t->body,
                               pool_slice(t->c->global, outs[i].reg).s);
       cbuf_puts(&t->body, ")");
       if (outs[i].dir == KIT_CG_ASM_INOUT) {
         cbuf_puts(&t->body, " = ");
         c_emit_asm_out_lvalue(t, oo[i]);
       }
       cbuf_puts(&t->body, ";\n");
     }
   }
 
   cbuf_puts(&t->body, any_pin ? "    __asm__ __volatile__ ("
                               : "  __asm__ __volatile__ (");
   c_emit_c_string_literal(&t->body, tmpl ? tmpl : "");
   /* Outputs. */
   cbuf_puts(&t->body, " : ");
   for (u32 i = 0; i < no; ++i) {
     if (i > 0) cbuf_puts(&t->body, ", ");
     if (outs[i].name) {
       cbuf_puts(&t->body, "[");
       cbuf_puts(&t->body, pool_slice(t->c->global, outs[i].name).s);
       cbuf_puts(&t->body, "] ");
     }
     c_emit_c_string_literal(&t->body, outs[i].str ? outs[i].str : "");
     cbuf_puts(&t->body, "(");
     /* Outputs must be an lvalue. OPK_LOCAL is a plain C local; this
      * works directly. OPK_LOCAL / OPK_INDIRECT also produce lvalues. A pinned
      * output names its register temporary instead. */
     if (outs[i].reg) {
       c_asm_reg_temp_name(nm, sizeof nm, 1, i);
       cbuf_puts(&t->body, nm);
     } else {
       c_emit_asm_out_lvalue(t, oo[i]);
     }
     cbuf_puts(&t->body, ")");
   }
   /* Inputs. kit synthesizes a matching `"N"` input for every ASM_INOUT
    * output (so its IR sees a fresh read), but gcc treats `+r` outputs as
    * already serving the read role and rejects a redundant matching input.
    * Drop those synthesized matches when the referenced output is `+`-tied. */
   cbuf_puts(&t->body, " : ");
   int emitted_any = 0;
   for (u32 i = 0; i < ni; ++i) {
     const char* cs = ins[i].str ? ins[i].str : "";
     if (cs[0] >= '0' && cs[0] <= '9') {
       u32 idx = (u32)(cs[0] - '0');
       if (idx < no && outs[idx].str && outs[idx].str[0] == '+') continue;
     }
     if (emitted_any) cbuf_puts(&t->body, ", ");
     emitted_any = 1;
     if (ins[i].name) {
       cbuf_puts(&t->body, "[");
       cbuf_puts(&t->body, pool_slice(t->c->global, ins[i].name).s);
       cbuf_puts(&t->body, "] ");
     }
     c_emit_c_string_literal(&t->body, cs);
     cbuf_puts(&t->body, "(");
     if (ins[i].reg) {
       c_asm_reg_temp_name(nm, sizeof nm, 0, i);
       cbuf_puts(&t->body, nm);
     } else {
       c_emit_operand(t, io[i]);
     }
     cbuf_puts(&t->body, ")");
   }
   /* Clobbers. */
   cbuf_puts(&t->body, " : ");
   for (u32 i = 0; i < nc; ++i) {
     if (i > 0) cbuf_puts(&t->body, ", ");
     c_emit_c_string_literal(&t->body, pool_slice(t->c->global, clobs[i]).s);
   }
   cbuf_puts(&t->body, ");\n");
 
   if (any_pin) {
     for (u32 i = 0; i < no; ++i) {
       if (!outs[i].reg) continue;
       c_asm_reg_temp_name(nm, sizeof nm, 1, i);
       cbuf_puts(&t->body, "    ");
       c_emit_asm_out_lvalue(t, oo[i]);
       cbuf_puts(&t->body, " = ");
       cbuf_puts(&t->body, nm);
       cbuf_puts(&t->body, ";\n");
     }
     cbuf_puts(&t->body, "  }\n");
   }
 }
 
 /* === load_const ===
  *
  * Used by CG for non-integer literal pushes (mainly floats —
  * `kit_cg_push_float`). Bytes are the target's ABI encoding of the value; we
  * copy them into the dst local via a static const byte array and
  * __builtin_memcpy so any host C compiler sees the same bit pattern. */
 
 void c_emit_load_const(CTarget* t, Operand dst, ConstBytes cb);
 
 void c_emit_load_const(CTarget* t, Operand dst, ConstBytes cb) {
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   if (dst.kind != OPK_LOCAL) {
     compiler_panic(t->c, loc, "C target: load_const dst must be LOCAL");
   }
   c_ensure_local(t, dst.v.local, dst.type);
   char buf[24];
   c_local_name(dst.v.local, buf, sizeof buf);
   u32 id = ++t->next_tmp;
   cbuf_puts(&t->body, "  { static const uint8_t __k");
   cbuf_put_u64(&t->body, (u64)id);
   cbuf_puts(&t->body, "[");
   cbuf_put_u64(&t->body, (u64)cb.size);
   cbuf_puts(&t->body, "] = {");
   static const char hex[] = "0123456789abcdef";
   for (u32 i = 0; i < cb.size; ++i) {
     if (i > 0) cbuf_putc(&t->body, ',');
     cbuf_puts(&t->body, "0x");
     cbuf_putc(&t->body, hex[(cb.bytes[i] >> 4) & 0xfu]);
     cbuf_putc(&t->body, hex[cb.bytes[i] & 0xfu]);
   }
   cbuf_puts(&t->body, "}; __builtin_memcpy(&");
   cbuf_puts(&t->body, buf);
   cbuf_puts(&t->body, ", __k");
   cbuf_put_u64(&t->body, (u64)id);
   cbuf_puts(&t->body, ", ");
   cbuf_put_u64(&t->body, (u64)cb.size);
   cbuf_puts(&t->body, "); }\n");
 }
 
 /* === atomics ===
  *
  * Lowered to gcc/clang's `__atomic_*` generic builtins. The host compiler
  * picks the inline sequence vs. libcall and applies the requested memory
  * order. kit's KitCgMemOrder enum aligns 1-1 with the `__ATOMIC_*` constants.
  */
 
 static const char* c_memorder_token(KitCgMemOrder o) {
   switch (o) {
     case KIT_CG_MO_RELAXED:
       return "__ATOMIC_RELAXED";
     case KIT_CG_MO_CONSUME:
       return "__ATOMIC_CONSUME";
     case KIT_CG_MO_ACQUIRE:
       return "__ATOMIC_ACQUIRE";
     case KIT_CG_MO_RELEASE:
       return "__ATOMIC_RELEASE";
     case KIT_CG_MO_ACQ_REL:
       return "__ATOMIC_ACQ_REL";
     case KIT_CG_MO_SEQ_CST:
       return "__ATOMIC_SEQ_CST";
   }
   return "__ATOMIC_SEQ_CST";
 }
 
 void c_emit_atomic_load(CTarget* t, Operand dst, Operand addr, MemAccess m,
                         KitCgMemOrder o);
 void c_emit_atomic_store(CTarget* t, Operand addr, Operand src, MemAccess m,
                          KitCgMemOrder o);
 void c_emit_atomic_rmw(CTarget* t, KitCgAtomicOp op, Operand dst, Operand addr,
                        Operand val, MemAccess m, KitCgMemOrder o);
 void c_emit_atomic_cas(CTarget* t, Operand prior, Operand ok, Operand addr,
                        Operand expected, Operand desired, MemAccess m,
                        KitCgMemOrder so, KitCgMemOrder fo);
 void c_emit_fence(CTarget* t, KitCgMemOrder o);
 
 void c_emit_atomic_load(CTarget* t, Operand dst, Operand addr, MemAccess m,
                         KitCgMemOrder o) {
   (void)m;
   c_assert_no_index(t, addr, "atomic_load");
   c_ensure_local(t, dst.v.local, dst.type);
   /* __atomic_load_n returns a value of the pointed-to type (dst.type). */
   c_emit_local_assign_open(t, dst.v.local, dst.type);
   cbuf_puts(&t->body, "__atomic_load_n((");
   c_emit_type(t, &t->body, dst.type);
   cbuf_puts(&t->body, "*)");
   c_emit_operand(t, addr);
   cbuf_puts(&t->body, ", ");
   cbuf_puts(&t->body, c_memorder_token(o));
   cbuf_puts(&t->body, ")");
   c_emit_local_assign_close(t);
 }
 
 void c_emit_atomic_store(CTarget* t, Operand addr, Operand src, MemAccess m,
                          KitCgMemOrder o) {
   (void)m;
   c_assert_no_index(t, addr, "atomic_store");
   cbuf_puts(&t->body, "  __atomic_store_n((");
   c_emit_type(t, &t->body, src.type);
   cbuf_puts(&t->body, "*)");
   c_emit_operand(t, addr);
   cbuf_puts(&t->body, ", ");
   c_emit_operand_as(t, src, src.type);
   cbuf_puts(&t->body, ", ");
   cbuf_puts(&t->body, c_memorder_token(o));
   cbuf_puts(&t->body, ");\n");
 }
 
 static const char* c_atomic_op_builtin(KitCgAtomicOp op) {
   switch (op) {
     case KIT_CG_ATOMIC_XCHG:
       return "__atomic_exchange_n";
     case KIT_CG_ATOMIC_ADD:
       return "__atomic_fetch_add";
     case KIT_CG_ATOMIC_SUB:
       return "__atomic_fetch_sub";
     case KIT_CG_ATOMIC_AND:
       return "__atomic_fetch_and";
     case KIT_CG_ATOMIC_OR:
       return "__atomic_fetch_or";
     case KIT_CG_ATOMIC_XOR:
       return "__atomic_fetch_xor";
     case KIT_CG_ATOMIC_NAND:
       return "__atomic_fetch_nand";
   }
   return NULL;
 }
 
 void c_emit_atomic_rmw(CTarget* t, KitCgAtomicOp op, Operand dst, Operand addr,
                        Operand val, MemAccess m, KitCgMemOrder o) {
   (void)m;
   SrcLoc loc = t->cur_fn ? t->cur_fn->loc : (SrcLoc){0, 0, 0};
   c_assert_no_index(t, addr, "atomic_rmw");
   const char* fn = c_atomic_op_builtin(op);
   if (!fn) {
     compiler_panic(t->c, loc, "C target: unknown atomic op %d", (int)op);
   }
   c_ensure_local(t, dst.v.local, dst.type);
   /* __atomic_fetch_* returns the prior value of the pointed-to type. */
   c_emit_local_assign_open(t, dst.v.local, val.type);
   cbuf_puts(&t->body, fn);
   cbuf_puts(&t->body, "((");
   c_emit_type(t, &t->body, val.type);
   cbuf_puts(&t->body, "*)");
   c_emit_operand(t, addr);
   cbuf_puts(&t->body, ", ");
   c_emit_operand_as(t, val, val.type);
   cbuf_puts(&t->body, ", ");
   cbuf_puts(&t->body, c_memorder_token(o));
   cbuf_puts(&t->body, ")");
   c_emit_local_assign_close(t);
 }
 
 void c_emit_atomic_cas(CTarget* t, Operand prior, Operand ok, Operand addr,
                        Operand expected, Operand desired, MemAccess m,
                        KitCgMemOrder so, KitCgMemOrder fo) {
   (void)m;
   c_assert_no_index(t, addr, "atomic_cas");
   /* gcc's __atomic_compare_exchange_n needs a real lvalue holding the
    * expected value because it is updated on failure. Materialize a scratch
    * local with the compare type, then copy it out to the prior result. */
   c_ensure_local(t, prior.v.local, prior.type);
   c_ensure_local(t, ok.v.local, ok.type);
   u32 id = ++t->next_tmp;
   cbuf_puts(&t->body, "  { ");
   c_emit_type(t, &t->body, prior.type);
   cbuf_puts(&t->body, " __cas");
   cbuf_put_u64(&t->body, (u64)id);
   cbuf_puts(&t->body, " = ");
   c_emit_operand_as(t, expected, prior.type);
   cbuf_puts(&t->body, "; ");
   char ok_name[24], prior_name[24];
   c_local_name(ok.v.local, ok_name, sizeof ok_name);
   c_local_name(prior.v.local, prior_name, sizeof prior_name);
   cbuf_puts(&t->body, ok_name);
   cbuf_puts(&t->body, " = (");
   c_emit_type(t, &t->body, ok.type);
   cbuf_puts(&t->body, ")__atomic_compare_exchange_n((");
   c_emit_type(t, &t->body, prior.type);
   cbuf_puts(&t->body, "*)");
   c_emit_operand(t, addr);
   cbuf_puts(&t->body, ", &__cas");
   cbuf_put_u64(&t->body, (u64)id);
   cbuf_puts(&t->body, ", ");
   c_emit_operand_as(t, desired, prior.type);
   cbuf_puts(&t->body, ", 0, ");
   cbuf_puts(&t->body, c_memorder_token(so));
   cbuf_puts(&t->body, ", ");
   cbuf_puts(&t->body, c_memorder_token(fo));
   cbuf_puts(&t->body, "); ");
   /* prior local = __cas; */
   cbuf_puts(&t->body, prior_name);
   cbuf_puts(&t->body, " = __cas");
   cbuf_put_u64(&t->body, (u64)id);
   cbuf_puts(&t->body, "; }\n");
 }
 
 void c_emit_fence(CTarget* t, KitCgMemOrder o) {
   cbuf_puts(&t->body, "  __atomic_thread_fence(");
   cbuf_puts(&t->body, c_memorder_token(o));
   cbuf_puts(&t->body, ");\n");
 }
 
 /* === set_loc === */
 
 static void cbuf_put_line_filename(CBuf* b, KitSlice s) {
   size_t i;
   cbuf_putc(b, '"');
   for (i = 0; i < s.len; ++i) {
     {
       unsigned char ch = (unsigned char)s.s[i];
       switch (ch) {
         case '\\':
         case '"':
           cbuf_putc(b, '\\');
           cbuf_putc(b, (char)ch);
           break;
         case '\n':
           cbuf_puts(b, "\\n");
           break;
         case '\r':
           cbuf_puts(b, "\\r");
           break;
         case '\t':
           cbuf_puts(b, "\\t");
           break;
         default:
           cbuf_putc(b, (char)ch);
           break;
       }
     }
   }
   cbuf_putc(b, '"');
 }
 
 void c_emit_set_loc(CTarget* t, SrcLoc l) {
   KitSlice file;
 
   if (!t->cur_fn || l.file_id == 0 || l.line == 0) return;
   if (t->have_emitted_loc && t->emitted_loc.file_id == l.file_id &&
       t->emitted_loc.line == l.line) {
     return;
   }
 
   file = kit_compiler_file_name(t->c, l.file_id);
   if (!file.len) return;
 
   cbuf_puts(&t->body, "#line ");
   cbuf_put_u64(&t->body, (u64)l.line);
   cbuf_putc(&t->body, ' ');
   cbuf_put_line_filename(&t->body, file);
   cbuf_putc(&t->body, '\n');
 
   t->emitted_loc = l;
   t->have_emitted_loc = 1;
 }
 
 /* === data emission ===
  *
  * Walks the ObjBuilder's symbol table at finalize and emits a C declaration
  * for every data object — defined or extern. Bytes are emitted verbatim as a
  * `uint8_t name[N] = { 0x.., ... }` initializer. Relocations targeting bytes
  * inside a defined symbol are spelled as runtime fixups in a constructor; this
  * covers both same-TU and cross-TU references uniformly and avoids the C
  * static-initializer restrictions on non-constant addresses.
  *
  * The host C compiler re-applies the Mach-O leading-underscore on link, so the
  * C source uses the kit linker name minus the `_` prefix (matching
  * c_sym_name elsewhere in this file). */
 
 static int c_is_data_section(const Section* sec) {
   if (!sec) return 0;
   switch (sec->kind) {
     case SEC_DATA:
     case SEC_RODATA:
     case SEC_BSS:
       return 1;
     case SEC_OTHER:
       /* User-named sections holding allocated data (e.g. `.text.hot` would
        * be EXEC, but a custom data section is just SF_ALLOC). */
       return (sec->flags & SF_ALLOC) && !(sec->flags & SF_EXEC);
     default:
       return 0;
   }
 }
 
 static void c_emit_link_attrs(CBuf* b, const ObjSym* os) {
   if (os->bind == SB_WEAK) cbuf_puts(b, "__attribute__((weak)) ");
   if (os->vis == SV_HIDDEN) {
     cbuf_puts(b, "__attribute__((visibility(\"hidden\"))) ");
   } else if (os->vis == SV_PROTECTED) {
     cbuf_puts(b, "__attribute__((visibility(\"protected\"))) ");
   }
 }
 
 /* Reads `len` bytes starting at `ofs` from the section's byte buffer. The
  * Section uses a chunked Buf; buf_read does the splice for us. */
 static void c_read_section_bytes(const Section* sec, u32 ofs, u8* out,
                                  size_t len) {
   buf_read(&sec->bytes, ofs, out, len);
 }
 
 static void c_emit_data_bytes(CBuf* b, const u8* bytes, size_t n) {
   cbuf_puts(b, " = {");
   for (size_t i = 0; i < n; ++i) {
     if (i > 0) cbuf_putc(b, ',');
     if ((i & 15u) == 0) cbuf_puts(b, "\n    ");
     cbuf_puts(b, "0x");
     static const char hex[] = "0123456789abcdef";
     cbuf_putc(b, hex[(bytes[i] >> 4) & 0xfu]);
     cbuf_putc(b, hex[bytes[i] & 0xfu]);
   }
   cbuf_puts(b, "\n  }");
 }
 
 /* Mach-O TLS support: the user-visible SK_TLS symbol is a 24-byte TLV
  * descriptor in __DATA,__thread_vars, and the actual initial bytes live in
  * a synthesized `<name>$tlv$init` sym in __thread_data (or __thread_bss).
  * The descriptor carries an R_ABS64 reloc at offset +16 pointing at that
  * init sym. For C-source emission we don't care about the descriptor at all
  * — we just emit `_Thread_local` with the init sym's bytes and let the host
  * C compiler synthesize whatever TLV plumbing it needs. */
 
 /* Find the data init sym referenced by a Mach-O TLS descriptor at
  * `desc_base` in section `desc_sec`. Looks for an R_ABS64 reloc at
  * `desc_base + 16`. Returns OBJ_SYM_NONE if not found. */
 static ObjSymId c_macho_tls_find_init(CTarget* t, ObjSecId desc_sec,
                                       u32 desc_base) {
   u32 total = obj_reloc_total(t->obj);
   for (u32 i = 0; i < total; ++i) {
     const Reloc* r = obj_reloc_at(t->obj, i);
     if (r->section_id != desc_sec) continue;
     if (r->offset != desc_base + 16u) continue;
     return r->sym;
   }
   return OBJ_SYM_NONE;
 }
 
 /* Returns 1 if the section is __DATA,__thread_vars (the descriptor section
  * on Mach-O). Compared by interned Sym id. */
 static int c_sec_name_is_macho_tvars(CTarget* t, const Section* sec) {
   if (!sec) return 0;
   Sym tvars =
       pool_intern_slice(t->c->global, SLICE_LIT("__DATA,__thread_vars"));
   return sec->name == tvars;
 }
 
 /* Returns 1 if any relocation falls into the half-open range [base, base+size)
  * of section `sec_id` (i.e. patches the bytes of this symbol). */
 static int c_sym_has_relocs(CTarget* t, ObjSecId sec_id, u32 base, u32 size) {
   u32 total = obj_reloc_total(t->obj);
   for (u32 i = 0; i < total; ++i) {
     const Reloc* r = obj_reloc_at(t->obj, i);
     if (r->section_id != sec_id) continue;
     if (r->offset >= base && r->offset < base + size) return 1;
   }
   return 0;
 }
 
 /* Emit one data symbol: extern declaration if undef, otherwise the full
  * definition with bytes. Function symbols are skipped — those go through the
  * forwards path. */
 static void c_emit_data_symbol(CTarget* t, ObjSymId id, const ObjSym* os) {
   if (c_is_local_static_sym(t, id)) return;
   if (os->kind == SK_FUNC || os->kind == SK_IFUNC) return;
   if (os->kind == SK_SECTION || os->kind == SK_FILE) return;
   /* On descriptor-model TLS targets (Mach-O), obj_tls.c synthesizes
    * `__tlv_bootstrap` as an SK_UNDEF extern for the TLV descriptor's first
    * field. The C target delegates all TLS lowering to the host compiler via
    * `_Thread_local`, so this descriptor-time-only symbol has no place in the
    * emitted source. */
   if (os->kind == SK_UNDEF && obj_format_tls_via_descriptor(t->c)) {
     const ObjBuilder* ob = t->obj;
     if (id == obj_tlv_bootstrap_get(ob)) return;
   }
   const char* nm = c_sym_name(t, id);
   CBuf* b = &t->data_defs;
   /* SK_TLS user-visible syms need a _Thread_local prefix. On ELF the sym
    * lives in .tdata/.tbss with the right bytes/size and our normal data
    * path handles them once we set the qualifier. On Mach-O the user-visible
    * sym is the 24-byte TLV descriptor — its bytes are not the user's data,
    * so we can't faithfully reproduce it in C; bail to a SKIP. */
   int is_tls = (os->kind == SK_TLS);
 
   /* Extern (undefined) data — only declare if referenced. We can't readily
    * distinguish "referenced as data" from "referenced as func address" here,
    * so declare it as `extern uint8_t name[];` only if it was actually
    * referenced from somewhere; otherwise it'd produce unused warnings. The
    * obj symbol's `referenced` bit is exactly the right signal. */
   /* SK_TLS with no defining section = extern TLS — falls through to the
    * undef branch below with the `_Thread_local` qualifier. */
   /* Extern: SK_UNDEF, or any other defined-kind sym that the producer
    * marked as having no defining section (the C frontend uses SK_OBJ +
    * section=NONE for `extern T x __attribute__((weak));`). */
   int is_extern = (os->kind == SK_UNDEF) ||
                   (os->kind != SK_COMMON && os->section_id == OBJ_SEC_NONE);
   if (is_extern) {
     /* Always declare extern data syms in C source: the host cc tolerates
      * unused externs, and the ObjSym::referenced bit isn't reliably set on
      * syms the C target only addresses by writing the name into the source
      * (no relocation gets emitted against them).
      *
      * Weak externs need different attributes per object format: on Mach-O
      * the `weak` attribute requires a definition; the right spelling for an
      * undefined weak ref is `__attribute__((weak_import))`. On ELF/PE the
      * existing `weak` attribute works as expected. */
     if (os->bind == SB_WEAK) {
       const ObjFormatImpl* fmt = obj_format_lookup(t->c->target.obj);
       const char* weak_attr =
           (fmt && fmt->weak_undef_attr) ? fmt->weak_undef_attr : "weak";
       cbuf_puts(b, "__attribute__((");
       cbuf_puts(b, weak_attr);
       cbuf_puts(b, ")) ");
     }
     if (os->vis == SV_HIDDEN) {
       cbuf_puts(b, "__attribute__((visibility(\"hidden\"))) ");
     } else if (os->vis == SV_PROTECTED) {
       cbuf_puts(b, "__attribute__((visibility(\"protected\"))) ");
     }
     cbuf_puts(b, "extern ");
     if (is_tls) cbuf_puts(b, "_Thread_local ");
     cbuf_puts(b, "uint8_t ");
     cbuf_puts(b, nm);
     cbuf_puts(b, "[];\n");
     return;
   }
   if (is_tls && obj_format_tls_via_descriptor(t->c)) {
     /* Mach-O splits TLS across two object-file symbols (see obj_tls.c): the
      * user-visible sym is a 24-byte TLV descriptor in
      * __DATA,__thread_vars; the actual initial bytes live in a synthesized
      * `<name>$tlv$init` sym in __DATA,__thread_data (or __thread_bss). For
      * C source emission we don't need either of those — `_Thread_local`
      * delegates to the host C compiler, which builds its own descriptor.
      *
      * We use the descriptor sym as the carrier (its name is what user code
      * references) and pull the initial bytes/size/alignment from the init
      * sym, found via the R_ABS64 reloc at descriptor offset +16. The init
      * sym is skipped in its own iteration. */
     const Section* desc_sec = obj_section_get(t->obj, os->section_id);
     if (c_sec_name_is_macho_tvars(t, desc_sec)) {
       ObjSymId init_id =
           c_macho_tls_find_init(t, os->section_id, (u32)os->value);
       if (init_id == OBJ_SYM_NONE) {
         compiler_panic(t->c, (SrcLoc){0, 0, 0},
                        "C target: Mach-O TLS descriptor missing init reloc");
       }
       const ObjSym* init_os = obj_symbol_get(t->obj, init_id);
       if (!init_os || init_os->section_id == OBJ_SEC_NONE) {
         compiler_panic(t->c, (SrcLoc){0, 0, 0},
                        "C target: Mach-O TLS init sym not defined");
       }
       const Section* init_sec = obj_section_get(t->obj, init_os->section_id);
       u32 init_base = (u32)init_os->value;
       u32 init_size = (u32)init_os->size;
       /* TLS data with relocations would need the constructor-fixup path
        * (and we'd have to rewrite the reloc target's section/offset to
        * the descriptor's name in the emitted C). No test currently
        * exercises this; surface it as a clear panic-as-skip if we hit it. */
       if (c_sym_has_relocs(t, init_os->section_id, init_base, init_size)) {
         compiler_panic(t->c, (SrcLoc){0, 0, 0},
                        "C target: Mach-O TLS with pointer init not yet "
                        "supported");
       }
       if (os->bind == SB_LOCAL) cbuf_puts(b, "static ");
       cbuf_puts(b, "_Thread_local ");
       c_emit_link_attrs(b, os);
       cbuf_puts(b, "__attribute__((unused)) ");
       cbuf_puts(b, "_Alignas(");
       cbuf_put_u64(b, init_sec->align ? init_sec->align : 1);
       cbuf_puts(b, ") uint8_t ");
       cbuf_puts(b, nm);
       cbuf_puts(b, "[");
       cbuf_put_u64(b, init_size ? init_size : 1);
       cbuf_puts(b, "]");
       if (init_sec->kind == SEC_BSS || init_sec->sem == SSEM_NOBITS ||
           init_size == 0) {
         cbuf_puts(b, ";\n");
       } else {
         Heap* h = t->c->ctx->heap;
         u8* bytes = (u8*)h->alloc(h, init_size, 1);
         if (!bytes) {
           compiler_panic(t->c, (SrcLoc){0, 0, 0},
                          "C target: oom on TLS init bytes");
         }
         c_read_section_bytes(init_sec, init_base, bytes, init_size);
         c_emit_data_bytes(b, bytes, init_size);
         h->free(h, bytes, init_size);
         cbuf_puts(b, ";\n");
       }
       return;
     }
     /* Not the descriptor: this is the synthesized `<name>$tlv$init` data
      * sym (or a __thread_ptrs entry). The descriptor case above already
      * emitted the user-facing _Thread_local; nothing more to do. */
     return;
   }
   if (os->kind == SK_COMMON) {
     /* Common — uninitialized, with explicit alignment. Emit as
      * tentative-definition (`uint8_t name[size];` at file scope), which C
      * treats as a common-style definition under -fcommon. */
     cbuf_puts(b, "__attribute__((unused)) _Alignas(");
     cbuf_put_u64(b, os->common_align ? os->common_align : 1);
     cbuf_puts(b, ") uint8_t ");
     cbuf_puts(b, nm);
     cbuf_puts(b, "[");
     cbuf_put_u64(b, os->size);
     cbuf_puts(b, "];\n");
     return;
   }
   if (os->section_id == OBJ_SEC_NONE) return;
   const Section* sec = obj_section_get(t->obj, os->section_id);
   if (!c_is_data_section(sec)) return;
   u32 base = (u32)os->value;
   u32 size = (u32)os->size;
   u32 nrelocs = 0;
   u32 total_relocs = obj_reloc_total(t->obj);
   for (u32 i = 0; i < total_relocs; ++i) {
     const Reloc* r = obj_reloc_at(t->obj, i);
     if (r->section_id == os->section_id && r->offset >= base &&
         r->offset < base + size) {
       nrelocs++;
     }
   }
 
   Heap* h = t->c->ctx->heap;
   const Reloc** rs = NULL;
   if (nrelocs) {
     rs = (const Reloc**)h->alloc(h, nrelocs * sizeof(const Reloc*), 1);
     u32 j = 0;
     for (u32 i = 0; i < total_relocs; ++i) {
       const Reloc* r = obj_reloc_at(t->obj, i);
       if (r->section_id == os->section_id && r->offset >= base &&
           r->offset < base + size) {
         rs[j++] = r;
       }
     }
     for (u32 i = 1; i < nrelocs; ++i) {
       const Reloc* tmp = rs[i];
       u32 k = i;
       while (k > 0 && rs[k - 1]->offset > tmp->offset) {
         rs[k] = rs[k - 1];
         k--;
       }
       rs[k] = tmp;
     }
     /* The C backend can only render an absolute address (&sym as a pointer
      * value) into a data slot. A PC-relative or section-difference reloc is
      * not a C constant expression, and a sub-pointer-width address cannot be
      * truncated into its slot in portable C — reject those rather than
      * silently mis-size the slot (the width logic below assumes ABS32/ABS64).
      */
     for (u32 i = 0; i < nrelocs; ++i) {
       if (rs[i]->kind != R_ABS32 && rs[i]->kind != R_ABS64)
         compiler_panic(t->c, (SrcLoc){0, 0, 0},
                        "C target: unsupported non-absolute data relocation "
                        "(kind %u) targeting '%s'; the C backend emits only "
                        "absolute (R_ABS32/R_ABS64) data relocations",
                        (unsigned)rs[i]->kind, c_sym_name(t, rs[i]->sym));
     }
   }
 
   cbuf_puts(b, "struct ");
   if (nrelocs > 0) cbuf_puts(b, "__attribute__((packed)) ");
   cbuf_puts(b, "__kit_data_");
   cbuf_puts(b, nm);
   cbuf_puts(b, " {\n");
 
   if (nrelocs == 0) {
     cbuf_puts(b, "  uint8_t raw[");
     cbuf_put_u64(b, size ? size : 1);
     cbuf_puts(b, "];\n");
   } else {
     u32 cur = base;
     for (u32 i = 0; i < nrelocs; ++i) {
       const Reloc* r = rs[i];
       if (r->offset > cur) {
         cbuf_puts(b, "  uint8_t chunk_");
         cbuf_put_u64(b, i);
         cbuf_puts(b, "[");
         cbuf_put_u64(b, r->offset - cur);
         cbuf_puts(b, "];\n");
       }
       u32 width = (r->kind == R_ABS32) ? 4 : 8;
       const char* ty = (width == 4) ? "uint32_t" : "void*";
       cbuf_puts(b, "  ");
       cbuf_puts(b, ty);
       cbuf_puts(b, " ptr_");
       cbuf_put_u64(b, i);
       cbuf_puts(b, ";\n");
       cur = r->offset + width;
     }
     if (cur < base + size) {
       cbuf_puts(b, "  uint8_t chunk_");
       cbuf_put_u64(b, nrelocs);
       cbuf_puts(b, "[");
       cbuf_put_u64(b, base + size - cur);
       cbuf_puts(b, "];\n");
     }
   }
   cbuf_puts(b, "};\n");
 
   if (os->bind == SB_LOCAL) cbuf_puts(b, "static ");
   if (is_tls) cbuf_puts(b, "_Thread_local ");
   c_emit_link_attrs(b, os);
   cbuf_puts(b, "__attribute__((unused)) ");
 
   int is_ro = (sec->kind == SEC_RODATA);
   if (is_ro) cbuf_puts(b, "const ");
 
   cbuf_puts(b, "_Alignas(");
   cbuf_put_u64(b, sec->align ? sec->align : 1);
   cbuf_puts(b, ") struct __kit_data_");
   cbuf_puts(b, nm);
   cbuf_puts(b, " ");
   cbuf_puts(b, nm);
 
   if (sec->kind == SEC_BSS || sec->sem == SSEM_NOBITS) {
     cbuf_puts(b, ";\n");
   } else if (size == 0) {
     cbuf_puts(b, " = {{0}};\n");
   } else {
     cbuf_puts(b, " = {\n");
     u8* bytes = (u8*)h->alloc(h, size, 1);
     c_read_section_bytes(sec, base, bytes, size);
 
     if (nrelocs == 0) {
       cbuf_puts(b, "  .raw = {");
       for (u32 i = 0; i < size; ++i) {
         if (i > 0) cbuf_puts(b, ", ");
         cbuf_put_u64(b, bytes[i]);
       }
       cbuf_puts(b, "}\n");
     } else {
       u32 cur = base;
       for (u32 i = 0; i < nrelocs; ++i) {
         const Reloc* r = rs[i];
         if (r->offset > cur) {
           cbuf_puts(b, "  .chunk_");
           cbuf_put_u64(b, i);
           cbuf_puts(b, " = {");
           for (u32 k = 0; k < r->offset - cur; ++k) {
             if (k > 0) cbuf_puts(b, ", ");
             cbuf_put_u64(b, bytes[cur - base + k]);
           }
           cbuf_puts(b, "},\n");
         }
 
         u32 width = (r->kind == R_ABS32) ? 4 : 8;
         c_ensure_forward_decl(t, r->sym, 0);
         const char* tgt = c_sym_name(t, r->sym);
         const char* cast = (width == 4) ? "(uint32_t)(uintptr_t)" : "(void*)";
 
         cbuf_puts(b, "  .ptr_");
         cbuf_put_u64(b, i);
         cbuf_puts(b, " = ");
         cbuf_puts(b, cast);
         cbuf_puts(b, "((char*)&");
         cbuf_puts(b, tgt);
         if (r->addend != 0) {
           cbuf_puts(b, " + ");
           cbuf_put_i64(b, r->addend);
         }
         cbuf_puts(b, "),\n");
         cur = r->offset + width;
       }
       if (cur < base + size) {
         cbuf_puts(b, "  .chunk_");
         cbuf_put_u64(b, nrelocs);
         cbuf_puts(b, " = {");
         for (u32 k = 0; k < base + size - cur; ++k) {
           if (k > 0) cbuf_puts(b, ", ");
           cbuf_put_u64(b, bytes[cur - base + k]);
         }
         cbuf_puts(b, "}\n");
       }
     }
     h->free(h, bytes, size);
     cbuf_puts(b, "};\n");
   }
 
   if (nrelocs) h->free(h, (void*)rs, nrelocs * sizeof(const Reloc*));
 }
 
 /* Re-emit a file-scope `__asm__("...")` block at TU scope. The CG layer hands
  * us the de-escaped assembly text (real newlines); re-quote it as a single C
  * string literal so the host C compiler assembles it. Lands in data_defs, which
  * finalize flushes at file scope before any function body. */
 void c_emit_file_scope_asm(CTarget* t, const char* src, size_t len) {
   CBuf* b = &t->data_defs;
   cbuf_puts(b, "__asm__(\"");
   for (size_t i = 0; i < len; ++i) {
     char ch = src[i];
     switch (ch) {
       case '\\':
         cbuf_puts(b, "\\\\");
         break;
       case '"':
         cbuf_puts(b, "\\\"");
         break;
       case '\n':
         cbuf_puts(b, "\\n");
         break;
       case '\t':
         cbuf_puts(b, "\\t");
         break;
       case '\r':
         cbuf_puts(b, "\\r");
         break;
       default:
         cbuf_putc(b, ch);
         break;
     }
   }
   cbuf_puts(b, "\");\n");
 }
 
 static void c_emit_data(CTarget* t) {
   ObjSymIter* it = obj_symiter_new(t->obj);
   if (!it) return;
   ObjSymEntry e;
   while (obj_symiter_next(it, &e)) {
     if (!e.sym) continue;
     c_emit_data_symbol(t, e.id, e.sym);
   }
   obj_symiter_free(it);
 }
 
 /* === finalize / destroy === */
 
 void c_emit_finalize(CTarget* t) {
   if (t->finalized) return;
   t->finalized = 1;
   c_emit_prologue(t);
   if (t->need_stdarg) c_writer_puts(t, "#include <stdarg.h>\n");
   if (t->need_setjmp) c_writer_puts(t, "#include <setjmp.h>\n");
   if (t->need_stdarg || t->need_setjmp) c_writer_puts(t, "\n");
   if (t->typedefs.len) {
     c_writer_write(t, t->typedefs.data, t->typedefs.len);
     c_writer_puts(t, "\n");
   }
   c_emit_data(t);
   if (t->forwards.len) {
     c_writer_write(t, t->forwards.data, t->forwards.len);
     c_writer_puts(t, "\n");
   }
   if (t->data_defs.len) {
     c_writer_write(t, t->data_defs.data, t->data_defs.len);
     c_writer_puts(t, "\n");
   }
   if (t->body.len) c_writer_write(t, t->body.data, t->body.len);
 }
 
 void c_emit_destroy(CTarget* t) {
   Heap* h = t->c->ctx->heap;
   cbuf_fini(&t->forwards);
   cbuf_fini(&t->typedefs);
   cbuf_fini(&t->data_defs);
   cbuf_fini(&t->decls);
   cbuf_fini(&t->body);
   if (t->sym_forwarded) h->free(h, t->sym_forwarded, t->sym_forwarded_cap);
   t->sym_forwarded = NULL;
   t->sym_forwarded_cap = 0;
   if (t->local_static_syms) {
     h->free(h, t->local_static_syms,
             t->local_static_syms_cap * sizeof(*t->local_static_syms));
   }
   if (t->local_static_entries) {
     h->free(h, t->local_static_entries,
             t->local_static_entries_cap * sizeof(*t->local_static_entries));
   }
   if (t->local_declared) h->free(h, t->local_declared, t->local_cap);
   if (t->local_type)
     h->free(h, t->local_type, t->local_cap * sizeof(KitCgTypeId));
   if (t->scopes) h->free(h, t->scopes, t->scopes_cap * sizeof(CScopeInfo));
   t->local_declared = NULL;
   t->local_type = NULL;
   t->scopes = NULL;
   t->local_static_syms = NULL;
   t->local_static_entries = NULL;
   t->local_cap = 0;
   t->scopes_cap = 0;
   t->local_static_syms_cap = 0;
   t->local_static_entries_cap = 0;
   t->local_static_nsyms = 0;
   t->local_static_nentries = 0;
 }