kit

link_jit.c (64459B)

---

 /* JIT mapper. Takes a resolved LinkImage, reserves a fresh writable
  * region (via env->execmem), copies segments, applies relocations
  * against the runtime base, flips to final permissions, and returns
  * an owning KitJit handle.
  *
  * Lookup is by interned Sym name (object-local handles never escape).
  * Inspector entries (kit_jit_view, _addr_to_sym, _sym_iter_*) are
  * stubbed for now — the linker can land without dragging the inspector
  * surface up. */
 
 #include <kit/core.h>
 #include <kit/jit.h>
 #include <kit/object.h>
 #include <string.h>
 
 #include "core/buf.h"
 #include "core/bytes.h"
 #include "core/heap.h"
 #include "core/metrics.h"
 #include "core/pool.h"
 #include "core/slice.h"
 #include "core/util.h"
 #include "link/link.h"
 #include "link/link_arch.h"
 #include "link/link_internal.h"
 #include "link/link_reloc_desc.h"
 #include "obj/obj.h"
 
 /* Defined in src/api/objfile.c — exposes the underlying ObjBuilder of a
  * KitObjFile and the internal-only helpers for allocating an empty
  * KitObjFile (used by the JIT debug-view builder). */
 ObjBuilder* kit_objfile_builder(const KitObjFile*);
 KitObjFile* kit_objfile_internal_new(const KitContext* ctx,
                                      KitTargetSpec target, KitObjFmt fmt);
 void kit_objfile_internal_free(KitObjFile*);
 #define jit_view_objfile_free(f) kit_objfile_internal_free(f)
 
 static const KitJitHost* jit_host_from_linker(Linker* l, Compiler* c) {
   const KitJitHost* host = l ? l->jit_host : NULL;
   if (!host)
     compiler_panic(c, SRCLOC_NONE,
                    "kit_jit: link jit host is required for JIT");
   return host;
 }
 
 static const KitExecMem* require_execmem_h(const KitJitHost* host,
                                            Compiler* c) {
   const KitExecMem* m = host ? host->execmem : NULL;
   if (!m || !m->reserve || !m->protect || !m->release) {
     compiler_panic(c, SRCLOC_NONE,
                    "kit_jit: jit host execmem is required for JIT");
   }
   return m;
 }
 
 static u64 jit_page_size_h(const KitJitHost* host, Compiler* c) {
   const KitExecMem* m = require_execmem_h(host, c);
   return m->page_size ? (u64)m->page_size : 0x4000u;
 }
 
 /* Per-segment runtime placement. Each segment gets its own host
  * reservation. Code segments come back as a dual mapping (write alias /
  * runtime alias backing the same physical pages); data and rodata are
  * single-aliased. We populate via the write alias, encode runtime
  * addresses against the runtime alias, then protect the runtime alias to
  * its final perms. No virtual page is ever simultaneously writable and
  * executable. */
 struct KitJit {
   Compiler* c;
   LinkImage* image;
   /* Single contiguous reservation covering every segment.  All segments
    * are sub-ranges of this region — runtime/write aliases are derived
    * by offsetting against (image-vaddr - image_base).  Keeping them
    * inside one mapping guarantees inter-segment displacements stay in
    * range for ADRP (±4 GiB) and CALL26 (±128 MiB), which would
    * otherwise depend on the OS placing independent mmap'd segments
    * close together. */
   KitExecMemRegion master;
   u64 image_base;         /* page-aligned image vaddr that maps to master.* */
   KitExecMemRegion* segs; /* one per image->nsegments; views into master */
   u32 nsegs;
   /* DWARF view, lazily constructed on first kit_jit_view call.  Built
    * over a private Compiler so its string pools and the new ObjBuilder
    * are owned end-to-end by the view; freed in kit_jit_free.  NULL
    * means "not yet built"; view_built distinguishes "tried and gave up"
    * (multi-input v1, etc.) from "untried". */
   KitObjFile* view;
   Linker* linker; /* kept alive for append-time resolver/input context */
   u64 append_cursor[SEG_NBUCKETS];
   u64 append_limit[SEG_NBUCKETS];
   u64 generation;
   /* Borrowed JIT host: execmem vtable.  Mirrors the Linker's
    * jit_host so the JIT's lifetime accessors don't need to walk back to
    * the Linker (which is still live behind jit->linker but may be
    * decoupled in incremental flows). */
   const KitJitHost* jit_host;
   u8 view_built;
   u8 pad[7];
 };
 
 #define JIT_APPEND_RX_SLACK (64ull * 1024ull * 1024ull)
 #define JIT_APPEND_R_SLACK (16ull * 1024ull * 1024ull)
 #define JIT_APPEND_RW_SLACK (16ull * 1024ull * 1024ull)
 #define JIT_APPEND_TLS_SLACK (4ull * 1024ull * 1024ull)
 
 /* RISC-V PCREL_LO12_I/S target a local "anchor" symbol whose vaddr is
  * the address of the paired AUIPC's PCREL_HI20 (or GOT_HI20) site.
  * Defined below vaddr_to_runtime. */
 static i64 jit_rv_pcrel_lo12_disp(LinkImage* img, KitExecMemRegion* segs,
                                   u64 auipc_image_vaddr);
 
 static int perms_for(u32 secflags) {
   int p = KIT_PROT_READ;
   if (secflags & SF_EXEC) p |= KIT_PROT_EXEC;
   if (secflags & SF_WRITE) p |= KIT_PROT_WRITE;
   /* JIT TLS storage is the single live instance (the JIT is single-threaded),
    * accessed and mutated in place, so the TLS segment must be writable — even
    * though the AOT image treats .tdata/.tbss as a read-only init template that
    * each thread copies. */
   if (secflags & SF_TLS) p |= KIT_PROT_WRITE;
   return p;
 }
 
 /* A reference the single-threaded JIT drops because the format's TLS access
  * idiom that materializes its target is relaxed in-image. On Windows/COFF the
  * idiom reads TEB.ThreadLocalStoragePointer, indexes it by the module's
  * `_tls_index`, then `+ SECREL(var)` — there is no loaded PE for the OS to
  * assign a `_tls_index`, so jit_tls_le_relax rewrites that load away and the
  * `_tls_index` ADRP/PC32 relocs must not be applied. The format authority
  * (obj_format_jit_drops_symbol_ref) owns which symbol that is. */
 static int jit_tls_is_index_ref(Compiler* c, const LinkSymbol* tgt) {
   return tgt && obj_format_jit_drops_symbol_ref(c, tgt->name);
 }
 
 /* TLS Local-Exec classifier for the JIT reloc passes, entirely flag-driven:
  * the per-arch tp-relative idiom and the aa64 COFF SECREL12A pair carry
  * RELOC_IS_TLS_LE; x86-64's generic COFF SECREL (RELOC_IS_SECREL) is a TLS
  * access exactly when its target is a TLS symbol. */
 static int jit_reloc_is_tls_le(Compiler* c, RelocKind k, u8 tgt_kind) {
   return reloc_kind_is_tls_le(c, k) ||
          (reloc_kind_is_secrel(c, k) && tgt_kind == SK_TLS);
 }
 
 /* Find the segment that contains image-relative `vaddr` and return its
  * runtime address (the runtime alias, not the write alias). Up to 3
  * segments after layout, so a linear scan is fine.
  *
  * The two-pass shape lets a vaddr that lands exactly on a segment's
  * one-past-end boundary (e.g. `__fini_array_end` when .fini_array is
  * the last section in its segment) still resolve, while preferring an
  * exact start-of-next-segment match when segments happen to abut. */
 static uintptr_t vaddr_to_runtime(const LinkImage* img,
                                   const KitExecMemRegion* segs, u64 vaddr) {
   u32 i;
   for (i = 0; i < img->nsegments; ++i) {
     const LinkSegment* s = &img->segments[i];
     u64 lo = s->vaddr;
     u64 hi = lo + s->mem_size;
     if (vaddr >= lo && vaddr < hi)
       return (uintptr_t)segs[i].runtime + (uintptr_t)(vaddr - lo);
   }
   for (i = 0; i < img->nsegments; ++i) {
     const LinkSegment* s = &img->segments[i];
     u64 hi = s->vaddr + s->mem_size;
     if (vaddr == hi) return (uintptr_t)segs[i].runtime + (uintptr_t)s->mem_size;
   }
   return 0;
 }
 
 /* Same as above but returns the WRITE-alias address — used to determine
  * the byte position at which to apply a relocation. The PC-relative
  * arithmetic in link_reloc_apply uses the runtime address; the bytes
  * themselves get patched at the matching offset of the write alias. */
 static uintptr_t vaddr_to_write(const LinkImage* img,
                                 const KitExecMemRegion* segs, u64 vaddr) {
   u32 i;
   for (i = 0; i < img->nsegments; ++i) {
     const LinkSegment* s = &img->segments[i];
     u64 lo = s->vaddr;
     u64 hi = lo + s->mem_size;
     if (vaddr >= lo && vaddr < hi)
       return (uintptr_t)segs[i].write + (uintptr_t)(vaddr - lo);
   }
   for (i = 0; i < img->nsegments; ++i) {
     const LinkSegment* s = &img->segments[i];
     u64 hi = s->vaddr + s->mem_size;
     if (vaddr == hi) return (uintptr_t)segs[i].write + (uintptr_t)s->mem_size;
   }
   return 0;
 }
 
 /* See forward decl above.  Find the paired AUIPC PCREL_HI20/GOT_HI20
  * reloc whose write_vaddr matches the anchor target, recompute the
  * displacement using runtime addresses, and return it so the
  * link_reloc_apply LO12_I/S encoder produces matching low-12 bits.
  *
  * Linear scan; reloc counts are small even for full JIT images. */
 static i64 jit_rv_pcrel_lo12_disp(LinkImage* img, KitExecMemRegion* segs,
                                   u64 auipc_image_vaddr) {
   u32 n = LinkRelocs_count(&img->relocs);
   u32 i;
   for (i = 0; i < n; ++i) {
     const LinkRelocApply* hi = LinkRelocs_at(&img->relocs, i);
     const LinkSymbol* hi_tgt;
     u64 hi_S, hi_P;
     if (!reloc_kind_is_pcrel_anchor(img->c, hi->kind)) continue;
     if (hi->write_vaddr != auipc_image_vaddr) continue;
     hi_tgt = LinkSyms_at(&img->syms, hi->target - 1);
     if (!hi_tgt) continue;
     if (hi_tgt->kind == SK_ABS)
       hi_S = hi_tgt->vaddr;
     else
       hi_S = (u64)vaddr_to_runtime(img, segs, hi_tgt->vaddr);
     hi_P = (u64)vaddr_to_runtime(img, segs, hi->write_vaddr);
     return (i64)hi_S + hi->addend - (i64)hi_P;
   }
   compiler_panic(img->c, SRCLOC_NONE,
                  "kit_jit: RV PCREL_LO12 at 0x%llx has no paired PCREL_HI20",
                  (unsigned long long)auipc_image_vaddr);
   return 0;
 }
 
 static void jit_copy_input_section_bytes(LinkImage* img,
                                          const KitExecMemRegion* segs) {
   Compiler* c = img->c;
   Linker* l = img->linker;
   u32 i;
   for (i = 0; i < img->nsections; ++i) {
     const LinkSection* ls = &img->sections[i];
     const LinkSegment* seg;
     ObjBuilder* ob;
     const Section* s;
     u32 input_idx;
     u8* dst;
     if (ls->input_id == LINK_INPUT_NONE) continue;
     input_idx = ls->input_id - 1u;
     if (ls->segment_id == LINK_SEG_NONE || ls->segment_id > img->nsegments)
       compiler_panic(c, SRCLOC_NONE,
                      "kit_jit_from_image: section has invalid segment");
     seg = &img->segments[ls->segment_id - 1u];
     ob = (input_idx < img->dbg_objs_n) ? img->dbg_objs[input_idx] : NULL;
     if (!ob && l && input_idx < LinkInputs_count(&l->inputs))
       ob = LinkInputs_at(&l->inputs, input_idx)->obj;
     if (!ob)
       compiler_panic(c, SRCLOC_NONE,
                      "kit_jit_from_image: input section bytes unavailable");
     s = obj_section_get(ob, ls->obj_section_id);
     if (!s || s->sem == SSEM_NOBITS || s->kind == SEC_BSS) continue;
     if (ls->size == 0) continue;
     dst = (u8*)segs[seg->id - 1u].write + (size_t)(ls->vaddr - seg->vaddr);
     metrics_count(c, "jit.input_section_bytes", ls->size);
     buf_read(&s->bytes, (u32)ls->obj_offset, dst, (size_t)ls->size);
   }
 }
 
 /* Opaque user data for the JitRelaxCtx.resolve_pair callback: the arch hook
  * (RISC-V PCREL_LO12) gets the paired AUIPC's runtime displacement without
  * reaching into LinkImage itself. */
 typedef struct {
   LinkImage* img;
   KitExecMemRegion* segs;
 } JitPairResolve;
 
 static i64 jit_resolve_pcrel_pair(void* user, u64 anchor_vaddr) {
   JitPairResolve* p = (JitPairResolve*)user;
   return jit_rv_pcrel_lo12_disp(p->img, p->segs, anchor_vaddr);
 }
 
 /* Apply one relocation against the JIT runtime base.  Shared by the bulk
  * from-image pass and the incremental-append pass so their reloc handling can
  * never drift.  Patch-site bytes go through the write alias; PC-relative
  * arithmetic uses the runtime alias.
  *
  * Order mirrors the resolution chain: drop Windows `_tls_index` refs, relax
  * Local-Exec TLS via the arch idiom hook, then resolve S and offer the reloc
  * to the arch's JIT-relaxation hook (TLV / GOT / weak-undef / RISC-V pcrel
  * pairing) before the ordinary apply.  `got_relaxed` is 1 on the append path
  * (no real GOT was built) and 0 for the full link (where .got slots exist). */
 static void jit_apply_reloc(Compiler* c, LinkImage* img, KitExecMemRegion* segs,
                             const LinkRelocApply* r, int got_relaxed) {
   const LinkSymbol* tgt = LinkSyms_at(&img->syms, r->target - 1);
   const LinkArchDesc* d;
   JitPairResolve pair;
   JitRelaxCtx ctx;
   u64 S, P;
   u8* P_bytes;
 
   /* Windows TLS idiom `_tls_index` references are dropped: the access is
    * relaxed to in-image addressing, so the index load is rewritten away. */
   if (jit_tls_is_index_ref(c, tgt)) return;
 
   /* Local-Exec TLS -> in-image addressing (single-threaded JIT).  The per-arch
    * idiom rewrite lives behind LinkArchDesc.jit_tls_le_relax; this stays
    * arch-neutral, classifying ELF via RELOC_IS_TLS_LE and the COFF Windows
    * idiom via its terminal SECREL reloc(s). */
   if (jit_reloc_is_tls_le(c, r->kind, tgt->kind)) {
     u64 storage =
         (tgt->kind == SK_ABS)
             ? tgt->vaddr + (u64)r->addend
             : (u64)vaddr_to_runtime(img, segs, tgt->vaddr) + (u64)r->addend;
     u8* bytes = (u8*)vaddr_to_write(img, segs, r->write_vaddr);
     u64 site_pc = (u64)vaddr_to_runtime(img, segs, r->write_vaddr);
     d = link_arch_desc_for(c);
     if (!d || !d->jit_tls_le_relax || !bytes)
       compiler_panic(c, SRCLOC_NONE,
                      "kit_jit: target has no TLS Local-Exec relaxation");
     d->jit_tls_le_relax(c, r->kind, bytes, storage, site_pc);
     return;
   }
 
   /* extern resolver result OR true absolute symbol — vaddr already holds the
    * runtime address; otherwise map the image vaddr to its runtime alias. */
   S = (tgt->kind == SK_ABS) ? tgt->vaddr
                             : (u64)vaddr_to_runtime(img, segs, tgt->vaddr);
   P = (u64)vaddr_to_runtime(img, segs, r->write_vaddr);
   P_bytes = (u8*)vaddr_to_write(img, segs, r->write_vaddr);
   if (!P_bytes)
     compiler_panic(c, SRCLOC_NONE, "kit_jit: relocation site is unmapped");
 
   /* Arch JIT relaxation: collapse the runtime indirection (Mach-O TLV
    * descriptor call, GOT load on the append path, weak-undef zeroing, RISC-V
    * PCREL_LO12 anchor recompute) to direct in-image addressing.  Returns 1 if
    * it owned the kind; otherwise fall through to the ordinary apply. */
   pair.img = img;
   pair.segs = segs;
   ctx.site = P_bytes;
   ctx.S = S;
   ctx.addend = r->addend;
   ctx.site_pc = P;
   ctx.weak_undef_zero =
       (tgt->bind == SB_WEAK && tgt->kind == SK_ABS && tgt->vaddr == 0);
   ctx.got_relaxed = got_relaxed;
   ctx.resolve_pair = jit_resolve_pcrel_pair;
   ctx.resolve_user = &pair;
   ctx.anchor_vaddr = tgt->vaddr;
   d = link_arch_desc_for(c);
   if (d && d->jit_reloc_relax && d->jit_reloc_relax(c, r->kind, &ctx)) return;
 
   link_reloc_apply(c, r->kind, P_bytes, S, r->addend, P);
 }
 
 KitJit* kit_jit_from_image(LinkImage* img) {
   Compiler* c;
   Heap* heap;
   const KitExecMem* mem;
   const KitJitHost* host;
   KitJit* jit;
   KitExecMemRegion* segs;
   KitExecMemRegion master;
   u64 page;
   u64 image_base = (u64)-1;
   u64 image_end = 0;
   u64 append_start;
   u64 append_total;
   u64 master_size;
   int needs_exec = 0;
   int needs_input_materialize = 0;
   u32 i;
 
   if (!img) return NULL;
   c = img->c;
   heap = img->heap;
   host = jit_host_from_linker(img->linker, c);
   mem = require_execmem_h(host, c);
   page = jit_page_size_h(host, c);
 
   /* Compute the span all segments must fit inside.  Layout guarantees
    * each segment's vaddr is page-aligned (layout_segments / layout_got
    * align via ALIGN_UP at the page size), so the offset within the
    * master mapping is (vaddr - image_base).  An empty JIT image has no
    * initial segments, but still owns append slack so the debugger can
    * start from an empty translation unit and append code later. */
   if (img->nsegments == 0) {
     image_base = page;
     image_end = page;
     needs_exec = 1;
   } else {
     for (i = 0; i < img->nsegments; ++i) {
       const LinkSegment* seg = &img->segments[i];
       u64 hi = ALIGN_UP(seg->vaddr + seg->mem_size, page);
       if (seg->vaddr < image_base) image_base = seg->vaddr;
       if (hi > image_end) image_end = hi;
       if (seg->flags & SF_EXEC) needs_exec = 1;
     }
   }
   if (image_base & (page - 1u))
     compiler_panic(c, SRCLOC_NONE,
                    "kit_jit_from_image: segment vaddr not page-aligned");
   append_start = image_end;
   append_total = JIT_APPEND_RX_SLACK + JIT_APPEND_R_SLACK +
                  JIT_APPEND_RW_SLACK + JIT_APPEND_TLS_SLACK;
   master_size = (image_end - image_base) + append_total;
   metrics_count(c, "jit.master_size", master_size);
   metrics_count(c, "jit.nsegments", img->nsegments);
 
   /* One reservation for the whole image.  Requesting EXEC if any segment
    * is exec triggers the dual-mapping path on Apple silicon; non-exec
    * regions just leave the alternate alias unused.  Per-segment final
    * perms are applied via mem->protect on sub-ranges below. */
   {
     int master_prot = KIT_PROT_READ | KIT_PROT_WRITE;
     if (needs_exec) master_prot |= KIT_PROT_EXEC;
     metrics_scope_begin(c, "jit.reserve");
     if (mem->reserve(mem->user, (size_t)master_size, master_prot, &master) !=
         0) {
       compiler_panic(c, SRCLOC_NONE,
                      "kit_jit_from_image: execmem.reserve failed");
     }
     metrics_scope_end(c, "jit.reserve");
   }
 
   segs = NULL;
   if (img->nsegments) {
     segs = (KitExecMemRegion*)heap->alloc(heap, sizeof(*segs) * img->nsegments,
                                           _Alignof(KitExecMemRegion));
     if (!segs) {
       mem->release(mem->user, &master);
       compiler_panic(c, SRCLOC_NONE,
                      "kit_jit_from_image: oom on segment table");
     }
     memset(segs, 0, sizeof(*segs) * img->nsegments);
   }
 
   /* Subdivide the master mapping.  segs[i].token stays NULL — the
    * master reservation owns the underlying mapping and is released in
    * kit_jit_free. */
   for (i = 0; i < img->nsegments; ++i) {
     const LinkSegment* seg = &img->segments[i];
     u64 off = seg->vaddr - image_base;
     size_t mlen = (size_t)ALIGN_UP(seg->mem_size, page);
     segs[i].write = (u8*)master.write + off;
     segs[i].runtime = (u8*)master.runtime + off;
     segs[i].size = mlen;
     segs[i].token = NULL;
   }
   /* Master reservation is zeroed; BSS is naturally zero. */
 
   /* Copy synthetic segment buffers to their write aliases.  In JIT mode,
    * ordinary input-section segments intentionally have NULL payload buffers
    * and are materialized directly from input Buf chunks below. */
   metrics_scope_begin(c, "jit.copy_segments");
   for (i = 0; i < img->nsegments; ++i) {
     const LinkSegment* seg = &img->segments[i];
     if (seg->file_size == 0) continue;
     if (!img->segment_bytes[i]) {
       needs_input_materialize = 1;
       continue;
     }
     metrics_count(c, "jit.segment_bytes", seg->file_size);
     memcpy(segs[i].write, img->segment_bytes[i], (size_t)seg->file_size);
   }
   if (needs_input_materialize) {
     if (!img->linker || !img->linker->jit_mode)
       compiler_panic(c, SRCLOC_NONE,
                      "kit_jit_from_image: segment bytes are not materialized");
     jit_copy_input_section_bytes(img, segs);
   }
   metrics_scope_end(c, "jit.copy_segments");
 
   /* Apply relocations. The patch site bytes go through the write
    * alias; PC-relative arithmetic uses the runtime alias address. */
   metrics_scope_begin(c, "jit.apply_relocs");
   for (i = 0; i < LinkRelocs_count(&img->relocs); ++i) {
     /* got_relaxed=0: the full from-image link ran GOT layout, so .got slots
      * exist and GOT loads apply normally (S points at the slot). */
     jit_apply_reloc(c, img, segs, LinkRelocs_at(&img->relocs, i), 0);
   }
   metrics_scope_end(c, "jit.apply_relocs");
 
   /* Flip the runtime alias of each segment to its final perms. The
    * write alias is unaffected (still RW for any segment we'd want to
    * write to from JITed code; for EXEC segments the write alias is
    * orphaned after this point — JITed code is not expected to write
    * to its own code).  Each segs[i] is a sub-range of master; protect
    * accepts arbitrary [addr,size) inside the reservation. */
   metrics_scope_begin(c, "jit.protect");
   for (i = 0; i < img->nsegments; ++i) {
     const LinkSegment* seg = &img->segments[i];
     if (mem->protect(mem->user, segs[i].runtime, segs[i].size,
                      perms_for(seg->flags)) != 0) {
       mem->release(mem->user, &master);
       if (segs) heap->free(heap, segs, sizeof(*segs) * img->nsegments);
       compiler_panic(c, SRCLOC_NONE,
                      "kit_jit_from_image: execmem.protect failed");
     }
   }
   if (append_total) {
     void* slack_rt =
         (u8*)master.runtime + (uintptr_t)(append_start - image_base);
     (void)mem->protect(mem->user, slack_rt, (size_t)append_total,
                        KIT_PROT_NONE);
   }
   metrics_scope_end(c, "jit.protect");
 
   /* Flush only the segments that will be executed, against the
    * runtime alias (the address from which the CPU will fetch). */
   if (mem->flush_icache) {
     metrics_scope_begin(c, "jit.flush_icache");
     for (i = 0; i < img->nsegments; ++i) {
       const LinkSegment* seg = &img->segments[i];
       if (seg->flags & SF_EXEC)
         mem->flush_icache(mem->user, segs[i].runtime, segs[i].size);
     }
     metrics_scope_end(c, "jit.flush_icache");
   }
 
   /* IFUNC pre-resolution: now that code is executable and slots are
    * writable, walk every (resolver_vaddr, slot_vaddr) pair, call the
    * resolver in-process, and store its return value into the slot's
    * runtime address.  The iplt stub then loads the slot and tail-
    * calls the chosen implementation on every invocation. */
   if (img->niplt) {
     typedef void* (*ResolverFn)(void);
     for (i = 0; i < img->niplt; ++i) {
       u64 resolver_vaddr = img->iplt_pairs[2u * i + 0];
       u64 slot_vaddr = img->iplt_pairs[2u * i + 1];
       uintptr_t resolver_rt = vaddr_to_runtime(img, segs, resolver_vaddr);
       uintptr_t slot_rt = vaddr_to_runtime(img, segs, slot_vaddr);
       void* impl;
       if (!resolver_rt || !slot_rt)
         compiler_panic(c, SRCLOC_NONE,
                        "kit_jit: iplt vaddr does not map to runtime");
       impl = ((ResolverFn)resolver_rt)();
       *(void**)(uintptr_t)slot_rt = impl;
     }
   }
 
   jit = (KitJit*)heap->alloc(heap, sizeof(*jit), _Alignof(KitJit));
   if (!jit) {
     mem->release(mem->user, &master);
     if (segs) heap->free(heap, segs, sizeof(*segs) * img->nsegments);
     compiler_panic(c, SRCLOC_NONE, "kit_jit_from_image: oom on jit handle");
   }
   jit->c = c;
   jit->image = img;
   jit->master = master;
   jit->image_base = image_base;
   jit->segs = segs;
   jit->nsegs = img->nsegments;
   jit->view = NULL;
   jit->linker = img->linker;
   jit->append_cursor[SEG_RX] = append_start;
   jit->append_limit[SEG_RX] = jit->append_cursor[SEG_RX] + JIT_APPEND_RX_SLACK;
   jit->append_cursor[SEG_R] = jit->append_limit[SEG_RX];
   jit->append_limit[SEG_R] = jit->append_cursor[SEG_R] + JIT_APPEND_R_SLACK;
   jit->append_cursor[SEG_RW] = jit->append_limit[SEG_R];
   jit->append_limit[SEG_RW] = jit->append_cursor[SEG_RW] + JIT_APPEND_RW_SLACK;
   jit->append_cursor[SEG_TLS] = jit->append_limit[SEG_RW];
   jit->append_limit[SEG_TLS] =
       jit->append_cursor[SEG_TLS] + JIT_APPEND_TLS_SLACK;
   jit->generation = 0;
   jit->view_built = 0u;
   jit->jit_host = host;
 
   /* Take ownership of the image: undefer it from the compiler so a
    * future panic doesn't reap something we still hold. */
   if (img->deferred) {
     compiler_undefer(c, img->deferred);
     img->deferred = NULL;
   }
   if (jit->linker && jit->linker->deferred) {
     compiler_undefer(c, jit->linker->deferred);
     jit->linker->deferred = NULL;
   }
 
   /* Run .init_array constructors in forward order. */
   {
     typedef void (*VoidFn)(void);
     void* p_start = kit_jit_lookup(jit, KIT_SLICE_LIT("__init_array_start"));
     void* p_end = kit_jit_lookup(jit, KIT_SLICE_LIT("__init_array_end"));
     if (p_start && p_end) {
       VoidFn* fn = (VoidFn*)p_start;
       VoidFn* end = (VoidFn*)p_end;
       metrics_scope_begin(c, "jit.ctors");
       for (; fn != end; ++fn)
         if (*fn) (*fn)();
       metrics_scope_end(c, "jit.ctors");
     }
   }
 
   return jit;
 }
 
 const KitExecMem* kit_jit_image_execmem(KitJit* jit) {
   if (!jit || !jit->jit_host) return NULL;
   return jit->jit_host->execmem;
 }
 
 void kit_jit_free(KitJit* jit) {
   Heap* heap;
   const KitExecMem* mem;
   if (!jit) return;
   heap = (Heap*)jit->c->ctx->heap;
   mem = jit->jit_host ? jit->jit_host->execmem : NULL;
   /* The debug view (if built) is closed first — it owns a private
    * Compiler whose pools must be released before the image's
    * referenced builders are freed in link_image_free. */
   if (jit->view) {
     jit_view_objfile_free(jit->view);
     jit->view = NULL;
   }
   /* segs[] are views into master — release master only. */
   if (mem && mem->release && jit->master.size) {
     mem->release(mem->user, &jit->master);
   }
   if (jit->segs) {
     heap->free(heap, jit->segs, sizeof(*jit->segs) * jit->nsegs);
   }
   if (jit->image) {
     /* link_image_free unfederes (no-op now) and releases storage. */
     link_image_free(jit->image);
   }
   if (jit->linker) {
     link_free(jit->linker);
     jit->linker = NULL;
   }
   heap->free(heap, jit, sizeof(*jit));
 }
 
 void* kit_jit_lookup(KitJit* jit, KitSlice name) {
   Sym sym;
   LinkSymId id;
   const LinkSymbol* s;
   if (!jit || !name.s) return NULL;
   /* C-symbol mangling lives in obj_format_c_mangle so JIT lookups by
    * source-level name find the symbol regardless of target format.
    * name.s is NUL-terminated (KIT_SLICE_LIT / kit_slice_cstr / interned).
    */
   sym = obj_format_c_mangle(jit->c, name.s);
   id = symhash_get(&jit->image->globals, sym);
   if (id == LINK_SYM_NONE) return NULL;
   s = LinkSyms_at(&jit->image->syms, id - 1);
   if (!s) return NULL;
   if (!s->defined) return NULL;
   if (s->kind == SK_ABS) return (void*)(uintptr_t)s->vaddr;
   return (void*)vaddr_to_runtime(jit->image, jit->segs, s->vaddr);
 }
 
 void* kit_jit_tls_addr(KitJit* jit, void* sym_addr) {
   /* Resolve a thread-local's in-image storage from the address its SYMBOL
    * resolves to (single-threaded JIT: the in-image .tdata/.tbss is the single
    * instance — see the TLVP relaxation in kit_jit_from_image).
    *
    *  - Mach-O: the symbol resolves to a 24-byte TLV descriptor; its +16 slot
    *    holds the variable's in-image storage address (the normal R_ABS64
    *    against the storage symbol, applied during the reloc pass).
    *  - ELF/COFF: the symbol already resolves to the in-image storage.
    *
    * Returns NULL for anything outside this image's reservation — e.g. a
    * foreign/extern thread-local resolved through the host (dlsym) — which we
    * must not dereference. The interpreter relies on this NULL to diagnose
    * cleanly rather than treat a foreign pointer as our storage. */
   u8* p = (u8*)sym_addr;
   u8* lo = (u8*)jit->master.runtime;
   u8* hi = lo + jit->master.size;
   if (!jit || !p) return NULL;
   if (!jit->master.runtime || p < lo || p >= hi) return NULL;
   if (obj_format_tls_via_descriptor(jit->c)) {
     void* storage;
     if (p + 24u > hi) return NULL;
     memcpy(&storage, p + 16u, sizeof storage);
     return storage;
   }
   return p;
 }
 
 uint64_t kit_jit_generation(KitJit* jit) { return jit ? jit->generation : 0; }
 
 typedef struct JitAppendSec {
   ObjSecId obj_sec;
   ObjAtomId obj_atom;
   LinkSectionId link_sec;
   LinkSegmentId link_seg;
   SegBucket bucket;
   u64 obj_offset;
   u64 vaddr;
   u64 size;
   u64 file_size;
   u32 align;
   u16 flags;
   u16 sem;
   Sym name;
 } JitAppendSec;
 
 SEGVEC_DEFINE(JitAppendSecs, JitAppendSec, 4);
 
 static InputMap jit_input_map_alloc(KitJit* jit, ObjBuilder* ob) {
   InputMap m;
   ObjSymIter* it;
   ObjSymEntry e;
   u32 nsyms = 0;
   it = obj_symiter_new(ob);
   while (obj_symiter_next(it, &e)) ++nsyms;
   obj_symiter_free(it);
   link_input_map_alloc(jit->image, &m, ob, nsyms + 1u);
   return m;
 }
 
 static void jit_invalidate_view(KitJit* jit) {
   if (jit->view) {
     jit_view_objfile_free(jit->view);
     jit->view = NULL;
   }
   jit->view_built = 0u;
 }
 
 /* Incremental-append reloc apply.  Delegates to the shared jit_apply_reloc
  * with got_relaxed=1: the append path does not re-run GOT layout, so GOT loads
  * in the appended object are relaxed to direct in-image addressing. */
 static void jit_apply_one_reloc(KitJit* jit, const LinkRelocApply* r) {
   jit_apply_reloc(jit->c, jit->image, jit->segs, r, 1);
 }
 
 static void jit_append_obj_inner(KitJit* jit, ObjBuilder* ob) {
   LinkImage* img = jit->image;
   Heap* h = img->heap;
   const KitExecMem* mem = require_execmem_h(jit->jit_host, jit->c);
   u64 page = jit_page_size_h(jit->jit_host, jit->c);
   u32 old_nsections = img->nsections;
   u32 old_nsegments = img->nsegments;
   u32 old_nsegs = jit->nsegs;
   u32 old_nmaps = img->ninput_maps;
   u32 old_dbg_n = img->dbg_objs_n;
   u32 old_nrelocs = LinkRelocs_count(&img->relocs);
   u64 old_cursor[SEG_NBUCKETS];
   InputMap m;
   JitAppendSecs secs;
   u32 nsecs = 0;
   u32 obj_sec_count;
   u64 cursor[SEG_NBUCKETS];
   LinkInputId new_input_id;
   u32 new_input_idx;
   ObjSymIter* it;
   ObjSymEntry e;
   u32 i;
 
   JitAppendSecs_init(&secs, h);
   for (i = 0; i < SEG_NBUCKETS; ++i) old_cursor[i] = jit->append_cursor[i];
 
   if (!jit || !ob || !jit->linker || obj_compiler(ob) != jit->c)
     compiler_panic(jit ? jit->c : NULL, SRCLOC_NONE,
                    "kit_jit_append_obj: object is not appendable");
 
   /* Preflight duplicate strong definitions and unresolved references before
    * mutating image-visible state. */
   it = obj_symiter_new(ob);
   while (obj_symiter_next(it, &e)) {
     const ObjSym* s = e.sym;
     if (link_sym_is_spurious_undef(s)) continue;
     if (link_sym_is_def(s) && s->name != 0 &&
         (s->bind == SB_GLOBAL || s->bind == SB_WEAK)) {
       LinkSymId existing = symhash_get(&img->globals, s->name);
       if (existing != LINK_SYM_NONE) {
         LinkSymbol* prev = LinkSyms_at(&img->syms, existing - 1);
         if (prev && prev->defined &&
             link_bind_strength((u8)s->bind) == link_bind_strength(SB_GLOBAL) &&
             link_bind_strength(prev->bind) == link_bind_strength(SB_GLOBAL)) {
           Slice nm_s = pool_slice(jit->c->global, s->name);
           const char* nm = nm_s.s;
           size_t namelen = nm_s.len;
           obj_format_demangle_c(jit->c, &nm, &namelen);
           obj_symiter_free(it);
           compiler_panic(jit->c, SRCLOC_NONE,
                          "kit_jit_append_obj: duplicate global '%.*s'",
                          (int)namelen, nm);
         }
       }
     } else if (!link_sym_is_def(s) && s->name != 0) {
       LinkSymId hit = symhash_get(&img->globals, s->name);
       int ok = 0;
       if (hit != LINK_SYM_NONE) {
         LinkSymbol* def = LinkSyms_at(&img->syms, hit - 1);
         if (def && def->defined) ok = 1;
       }
       if (!ok) {
         ObjSymIter* it2 = obj_symiter_new(ob);
         ObjSymEntry e2;
         while (obj_symiter_next(it2, &e2)) {
           const ObjSym* d = e2.sym;
           if (d && d->name == s->name && link_sym_is_def(d) &&
               (d->bind == SB_GLOBAL || d->bind == SB_WEAK)) {
             ok = 1;
             break;
           }
         }
         obj_symiter_free(it2);
       }
       if (!ok && jit->linker->resolver) {
         Slice nm_s = pool_slice(jit->c->global, s->name);
         if (jit->linker->resolver(jit->linker->resolver_user, nm_s)) ok = 1;
       }
       if (!ok && s->bind == SB_WEAK) ok = 1;
       /* Format pseudo-symbols the JIT image satisfies internally (Mach-O
        * __tlv_bootstrap, COFF _tls_index): the obj layer is the single
        * arbiter so src/link names no pseudo-symbol. */
       if (!ok && obj_format_jit_undef_internal(jit->c, s->name)) ok = 1;
       if (!ok) {
         Slice nm_s = pool_slice(jit->c->global, s->name);
         const char* nm = nm_s.s;
         size_t nlen = nm_s.len;
         obj_format_demangle_c(jit->c, &nm, &nlen);
         obj_symiter_free(it);
         compiler_panic(jit->c, SRCLOC_NONE,
                        "kit_jit_append_obj: undefined reference to '%.*s'",
                        (int)nlen, nm);
       }
     }
   }
   obj_symiter_free(it);
 
   m = jit_input_map_alloc(jit, ob);
   obj_sec_count = obj_section_count(ob);
   for (i = 0; i < SEG_NBUCKETS; ++i) cursor[i] = jit->append_cursor[i];
 
   for (i = 1; i < obj_sec_count; ++i) {
     const Section* s = obj_section_get(ob, (ObjSecId)i);
     u32 first = 0, count = 1, ai;
     int has_atoms;
     if (!s || !link_section_kept(s)) continue;
     has_atoms = link_input_section_has_atoms(&m, (ObjSecId)i);
     if (has_atoms) link_input_section_atoms(&m, (ObjSecId)i, &first, &count);
     for (ai = 0; ai < count; ++ai) {
       ObjAtomId aid =
           has_atoms ? m.section_atom_ids[first + ai] : OBJ_ATOM_NONE;
       const ObjAtom* atom = has_atoms ? obj_atom_get(ob, aid) : NULL;
       SegBucket b;
       u64 obj_offset;
       u64 size;
       u64 vaddr;
       JitAppendSec* ps;
       u32 sec_idx;
       if (has_atoms) {
         if (!atom || atom->removed) continue;
         obj_offset = atom->offset;
         size = atom->size;
       } else {
         obj_offset = 0u;
         size = link_section_size_for_link(s);
       }
       if (size == 0) continue;
       b = link_bucket_for(s->flags);
       vaddr = ALIGN_UP(cursor[b], (u64)(s->align ? s->align : 1u));
       if (vaddr + size > jit->append_limit[b])
         compiler_panic(jit->c, SRCLOC_NONE,
                        "kit_jit_append_obj: append slack exhausted");
       ps = JitAppendSecs_push(&secs, &sec_idx);
       if (!ps)
         compiler_panic(jit->c, SRCLOC_NONE,
                        "kit_jit_append_obj: oom on section plan");
       ps->obj_sec = (ObjSecId)i;
       ps->obj_atom = has_atoms ? aid : OBJ_ATOM_NONE;
       ps->link_sec = (LinkSectionId)(old_nsections + sec_idx + 1u);
       ps->link_seg = (LinkSegmentId)(old_nsegments + sec_idx + 1u);
       ps->bucket = b;
       ps->obj_offset = obj_offset;
       ps->vaddr = vaddr;
       ps->size = size;
       ps->file_size = (s->sem == SSEM_NOBITS || s->kind == SEC_BSS) ? 0 : size;
       ps->align = s->align ? s->align : 1u;
       ps->flags = s->flags;
       ps->sem = (s->kind == SEC_BSS) ? SSEM_NOBITS : s->sem;
       ps->name = s->name;
       if (has_atoms) {
         m.atom[aid] = ps->link_sec;
         if (m.section[i] == LINK_SEC_NONE) m.section[i] = ps->link_sec;
       } else {
         m.section[i] = ps->link_sec;
       }
       cursor[b] = vaddr + size;
     }
   }
   nsecs = JitAppendSecs_count(&secs);
   for (i = 0; i < SEG_NBUCKETS; ++i) jit->append_cursor[i] = cursor[i];
 
   it = obj_symiter_new(ob);
   while (obj_symiter_next(it, &e)) {
     const ObjSym* s = e.sym;
     int is_def;
     if (e.id >= m.nsym || link_sym_is_spurious_undef(s)) continue;
     is_def = link_sym_is_def(s);
     if (is_def && (s->bind == SB_GLOBAL || s->bind == SB_WEAK) &&
         s->name != 0) {
       LinkSymId existing = symhash_get(&img->globals, s->name);
       if (existing != LINK_SYM_NONE) {
         LinkSymbol* prev = LinkSyms_at(&img->syms, existing - 1);
         if (prev && prev->defined &&
             link_bind_strength((u8)s->bind) == link_bind_strength(SB_GLOBAL) &&
             link_bind_strength(prev->bind) == link_bind_strength(SB_GLOBAL)) {
           Slice nm_s = pool_slice(jit->c->global, s->name);
           const char* nm = nm_s.s;
           size_t namelen = nm_s.len;
           obj_format_demangle_c(jit->c, &nm, &namelen);
           obj_symiter_free(it);
           compiler_panic(jit->c, SRCLOC_NONE,
                          "kit_jit_append_obj: duplicate global '%.*s'",
                          (int)namelen, nm);
         }
         if (prev && prev->defined) {
           m.sym[e.id] = existing;
           continue;
         }
       }
     }
     m.sym[e.id] = (LinkSymId)(LinkSyms_count(&img->syms) + 1u);
     {
       LinkSymbol rec;
       memset(&rec, 0, sizeof(rec));
       rec.name = s->name;
       rec.input_id = (LinkInputId)(LinkInputs_count(&jit->linker->inputs) + 1u);
       rec.obj_sym = e.id;
       rec.section_id = LINK_SEC_NONE;
       rec.atom_id = is_def ? link_input_sym_atom(&m, e.id) : OBJ_ATOM_NONE;
       rec.value = s->value;
       rec.size = s->size;
       rec.common_align = (s->kind == SK_COMMON) ? (u32)s->common_align : 0u;
       rec.bind = (u8)s->bind;
       rec.kind = (u8)s->kind;
       rec.defined = (u8)is_def;
       if (is_def && s->section_id != OBJ_SEC_NONE &&
           s->section_id < m.nsection) {
         rec.section_id = link_input_symbol_section(&m, s, e.id);
         if (rec.section_id != LINK_SEC_NONE) {
           u32 sj;
           for (sj = 0; sj < nsecs; ++sj) {
             JitAppendSec* ps = JitAppendSecs_at(&secs, sj);
             if (ps && ps->link_sec == rec.section_id) {
               rec.vaddr = ps->vaddr + (s->value - ps->obj_offset);
               break;
             }
           }
         }
       } else if (s->kind == SK_ABS) {
         rec.vaddr = s->value;
       }
       m.sym[e.id] = link_append_symbol(img, &rec);
       if (is_def && (s->bind == SB_GLOBAL || s->bind == SB_WEAK) &&
           s->name != 0) {
         LinkSymId existing;
         if (symhash_insert(&img->globals, s->name, m.sym[e.id], &existing)) {
         } else {
           m.sym[e.id] = existing;
         }
       }
     }
   }
   obj_symiter_free(it);
 
   /* Resolve newly appended undefs before any bytes become executable. */
   for (i = 0; i < LinkSyms_count(&img->syms); ++i) {
     LinkSymbol* s = LinkSyms_at(&img->syms, i);
     if (s->input_id !=
         (LinkInputId)(LinkInputs_count(&jit->linker->inputs) + 1u))
       continue;
     if (s->defined) continue;
     if (s->name != 0) {
       LinkSymId hit = symhash_get(&img->globals, s->name);
       if (hit != LINK_SYM_NONE && hit != s->id) {
         LinkSymbol* def = LinkSyms_at(&img->syms, hit - 1);
         if (def->defined) {
           s->section_id = def->section_id;
           s->atom_id = def->atom_id;
           s->value = def->value;
           s->vaddr = def->vaddr;
           s->kind = def->kind;
           s->bind = def->bind;
           s->defined = 1;
           continue;
         }
       }
     }
     if (jit->linker->resolver && s->name != 0) {
       Slice nm_s = pool_slice(jit->c->global, s->name);
       void* p = jit->linker->resolver(jit->linker->resolver_user, nm_s);
       if (p) {
         s->kind = SK_ABS;
         s->vaddr = (u64)(uintptr_t)p;
         s->defined = 1;
         continue;
       }
     }
     if (s->bind == SB_WEAK) {
       s->kind = SK_ABS;
       s->vaddr = 0;
       s->defined = 1;
       continue;
     }
     /* Format pseudo-symbols the JIT image satisfies internally (Mach-O
      * __tlv_bootstrap, COFF _tls_index): define as 0 so resolution does not
      * reject them. Same obj-layer arbiter as the preflight pass above, so the
      * two no longer disagree (a non-weak undef _tls_index in an appended COFF
      * object used to pass preflight then panic here). */
     if (obj_format_jit_undef_internal(jit->c, s->name)) {
       s->kind = SK_ABS;
       s->vaddr = 0;
       s->defined = 1;
       continue;
     }
     if (s->name != 0) {
       Slice nm_s = pool_slice(jit->c->global, s->name);
       const char* nm = nm_s.s;
       size_t nlen = nm_s.len;
       obj_format_demangle_c(jit->c, &nm, &nlen);
       compiler_panic(jit->c, SRCLOC_NONE,
                      "kit_jit_append_obj: undefined reference to '%.*s'",
                      (int)nlen, nm);
     }
     compiler_panic(jit->c, SRCLOC_NONE,
                    "kit_jit_append_obj: undefined anonymous symbol");
   }
 
   new_input_id = link_add_obj(jit->linker, ob);
   new_input_idx = new_input_id - 1u;
 
   {
     InputMap* maps = (InputMap*)h->realloc(
         h, img->input_maps, sizeof(*img->input_maps) * img->ninput_maps,
         sizeof(*img->input_maps) * (new_input_idx + 1u), _Alignof(InputMap));
     if (!maps)
       compiler_panic(jit->c, SRCLOC_NONE,
                      "kit_jit_append_obj: oom growing input maps");
     img->input_maps = maps;
     while (img->ninput_maps < new_input_idx) {
       memset(&img->input_maps[img->ninput_maps], 0, sizeof(InputMap));
       img->ninput_maps++;
     }
     img->input_maps[new_input_idx] = m;
     img->ninput_maps = new_input_idx + 1u;
   }
 
   if (nsecs) {
     LinkSection* nsections = (LinkSection*)h->realloc(
         h, img->sections, sizeof(*img->sections) * old_nsections,
         sizeof(*img->sections) * (old_nsections + nsecs),
         _Alignof(LinkSection));
     LinkSegment* nsegments = (LinkSegment*)h->realloc(
         h, img->segments, sizeof(*img->segments) * old_nsegments,
         sizeof(*img->segments) * (old_nsegments + nsecs),
         _Alignof(LinkSegment));
     u8** nsegbytes = (u8**)h->realloc(
         h, img->segment_bytes, sizeof(*img->segment_bytes) * old_nsegments,
         sizeof(*img->segment_bytes) * (old_nsegments + nsecs), _Alignof(u8*));
     size_t* nsegcaps = (size_t*)h->realloc(
         h, img->segment_bytes_cap,
         sizeof(*img->segment_bytes_cap) * old_nsegments,
         sizeof(*img->segment_bytes_cap) * (old_nsegments + nsecs),
         _Alignof(size_t));
     KitExecMemRegion* njsegs = (KitExecMemRegion*)h->realloc(
         h, jit->segs, sizeof(*jit->segs) * old_nsegs,
         sizeof(*jit->segs) * (old_nsegs + nsecs), _Alignof(KitExecMemRegion));
     if (!nsections || !nsegments || !nsegbytes || !nsegcaps || !njsegs)
       compiler_panic(jit->c, SRCLOC_NONE,
                      "kit_jit_append_obj: oom growing image tables");
     img->sections = nsections;
     img->segments = nsegments;
     img->segment_bytes = nsegbytes;
     img->segment_bytes_cap = nsegcaps;
     jit->segs = njsegs;
   }
 
   for (i = 0; i < nsecs; ++i) {
     JitAppendSec* ps = JitAppendSecs_at(&secs, i);
     LinkSection* ls = &img->sections[old_nsections + i];
     LinkSegment* seg = &img->segments[old_nsegments + i];
     KitExecMemRegion* js = &jit->segs[old_nsegs + i];
     const Section* os = obj_section_get(ob, ps->obj_sec);
     memset(ls, 0, sizeof(*ls));
     ls->id = ps->link_sec;
     ls->input_id = new_input_id;
     ls->obj_section_id = ps->obj_sec;
     ls->obj_atom_id = ps->obj_atom;
     ls->segment_id = ps->link_seg;
     ls->obj_offset = ps->obj_offset;
     ls->input_offset = 0;
     ls->file_offset = ps->vaddr;
     ls->vaddr = ps->vaddr;
     ls->size = ps->size;
     ls->flags = ps->flags;
     ls->align = ps->align;
     ls->name = ps->name;
     ls->sem = ps->sem;
 
     memset(seg, 0, sizeof(*seg));
     seg->id = ps->link_seg;
     seg->flags = SF_ALLOC;
     if (ps->bucket == SEG_RX) seg->flags |= SF_EXEC;
     if (ps->bucket == SEG_RW) seg->flags |= SF_WRITE;
     if (ps->bucket == SEG_TLS) seg->flags |= SF_TLS;
     seg->file_offset = ps->vaddr;
     seg->vaddr = ps->vaddr;
     seg->paddr = ps->vaddr;
     seg->mem_size = ps->size;
     seg->file_size = ps->file_size;
     seg->align = (u32)page;
     seg->nsections = 1;
     img->segment_bytes[old_nsegments + i] = NULL;
     img->segment_bytes_cap[old_nsegments + i] = 0;
 
     memset(js, 0, sizeof(*js));
     js->write =
         (u8*)jit->master.write + (uintptr_t)(ps->vaddr - jit->image_base);
     js->runtime =
         (u8*)jit->master.runtime + (uintptr_t)(ps->vaddr - jit->image_base);
     js->size = (size_t)ps->size;
     js->token = NULL;
 
     if (os && os->sem != SSEM_NOBITS && os->kind != SEC_BSS &&
         os->bytes.total && ps->size)
       buf_read(&os->bytes, (u32)ps->obj_offset, (u8*)js->write,
                (size_t)ps->size);
     img->nsections++;
     img->nsegments++;
     jit->nsegs++;
   }
 
   {
     u32 total = obj_reloc_total(ob);
     for (i = 0; i < total; ++i) {
       const Reloc* r = obj_reloc_at(ob, i);
       LinkRelocApply rec;
       LinkSectionId ls_id;
       const LinkSection* ls;
       if (!r || r->section_id == OBJ_SEC_NONE || r->section_id >= m.nsection)
         continue;
       ls_id = link_input_reloc_section(&m, r, i);
       if (ls_id == LINK_SEC_NONE) continue;
       if (r->sym == OBJ_SYM_NONE || r->sym >= m.nsym ||
           m.sym[r->sym] == LINK_SYM_NONE)
         continue;
       ls = &img->sections[ls_id - 1];
       memset(&rec, 0, sizeof(rec));
       rec.input_id = new_input_id;
       rec.section_id = r->section_id;
       rec.link_section_id = ls_id;
       rec.offset = r->offset - (u32)ls->obj_offset;
       rec.width = reloc_kind_width(jit->c, (RelocKind)r->kind);
       rec.write_vaddr = ls->vaddr + rec.offset;
       rec.write_file_offset = rec.write_vaddr;
       rec.kind = (RelocKind)r->kind;
       rec.target = m.sym[r->sym];
       rec.addend = r->addend;
       *link_append_reloc_slot(img) = rec;
     }
   }
 
   for (i = old_nrelocs; i < LinkRelocs_count(&img->relocs); ++i) {
     const LinkRelocApply* r = LinkRelocs_at(&img->relocs, i);
     jit_apply_one_reloc(jit, r);
   }
 
   for (i = old_nsegs; i < jit->nsegs; ++i) {
     const LinkSegment* seg = &img->segments[i];
     u64 page_lo = seg->vaddr & ~(page - 1u);
     u64 page_hi = ALIGN_UP(seg->vaddr + seg->mem_size, page);
     void* rt =
         (u8*)jit->master.runtime + (uintptr_t)(page_lo - jit->image_base);
     if (mem->protect(mem->user, rt, (size_t)(page_hi - page_lo),
                      perms_for(seg->flags)) != 0) {
       compiler_panic(jit->c, SRCLOC_NONE,
                      "kit_jit_append_obj: execmem.protect failed");
     }
   }
   if (mem->flush_icache) {
     for (i = old_nsegs; i < jit->nsegs; ++i) {
       const LinkSegment* seg = &img->segments[i];
       if (seg->flags & SF_EXEC)
         mem->flush_icache(mem->user, jit->segs[i].runtime, jit->segs[i].size);
     }
   }
 
   {
     ObjBuilder** nd = (ObjBuilder**)h->realloc(
         h, img->dbg_objs, sizeof(*img->dbg_objs) * old_dbg_n,
         sizeof(*img->dbg_objs) * (new_input_idx + 1u), _Alignof(ObjBuilder*));
     u8* no = (u8*)h->realloc(
         h, img->dbg_objs_owned, sizeof(*img->dbg_objs_owned) * old_dbg_n,
         sizeof(*img->dbg_objs_owned) * (new_input_idx + 1u), 1u);
     if (!nd || !no)
       compiler_panic(jit->c, SRCLOC_NONE,
                      "kit_jit_append_obj: oom growing debug inputs");
     img->dbg_objs = nd;
     img->dbg_objs_owned = no;
     while (img->dbg_objs_n < new_input_idx) {
       img->dbg_objs[img->dbg_objs_n] = NULL;
       img->dbg_objs_owned[img->dbg_objs_n] = 0u;
       img->dbg_objs_n++;
     }
     img->dbg_objs[new_input_idx] = ob;
     img->dbg_objs_owned[new_input_idx] = 0u;
     img->dbg_objs_n = new_input_idx + 1u;
   }
 
   jit_invalidate_view(jit);
   jit->generation++;
   JitAppendSecs_fini(&secs);
   (void)old_cursor;
   (void)old_nmaps;
 }
 
 KitStatus kit_jit_publish(KitJit* jit, const KitJitPublishOptions* opts,
                           KitJitPublishResult* result) {
   PanicFrame panic;
   Compiler* c;
   KitLinkSession* link;
   u32 i;
 
   if (result) memset(result, 0, sizeof(*result));
   if (!jit || !opts || !opts->link) return KIT_INVALID;
   if ((KitJitPublishKind)opts->kind != KIT_JIT_PUBLISH_APPEND_OBJECTS)
     return KIT_UNSUPPORTED;
   link = opts->link;
   if (link->non_obj_inputs) return KIT_UNSUPPORTED;
   c = jit->c;
   compiler_panic_push(c, &panic);
   if (setjmp(panic.env)) {
     /* A failed append (e.g. duplicate global) panics from
      * jit_append_obj_inner. compiler_run_cleanups fires the borrowed link
      * session's deferred linker_cleanup, which frees its Linker; null the
      * session's references so the caller's kit_link_session_free does not
      * double-free. Mirrors link_session_guard's recovery. */
     compiler_run_cleanups(c);
     link->linker = NULL;
     link->image = NULL;
     compiler_panic_pop(c, &panic);
     return KIT_ERR;
   }
   for (i = 0; i < link->npublish_objs; ++i)
     jit_append_obj_inner(jit, link->publish_objs[i]);
   compiler_panic_pop(c, &panic);
   if (result) result->generation = jit->generation;
   return KIT_OK;
 }
 
 /* ---- inspector entries ---- */
 
 /* True if `name` (NUL-terminated) is a debug section the DWARF consumer
  * (src/debug/dwarf_open.c) might read.  Everything else is skipped. */
 static int jit_view_is_debug_name(const char* name) {
   if (!name) return 0;
   if (name[0] == '.' && name[1] == 'd' && name[2] == 'e' && name[3] == 'b' &&
       name[4] == 'u' && name[5] == 'g' && name[6] == '_')
     return 1; /* .debug_* */
   /* .eh_frame is consulted by kit_dwarf for CFI unwinding when
    * available; kit itself doesn't currently emit it, but inputs read
    * from external .o files may carry it. */
   if (name[0] == '.' && name[1] == 'e' && name[2] == 'h' && name[3] == '_' &&
       name[4] == 'f' && name[5] == 'r' && name[6] == 'a' && name[7] == 'm' &&
       name[8] == 'e' && name[9] == '\0')
     return 1;
   return 0;
 }
 
 /* True if input `ii` carries any debug section that's worth surfacing.
  * Cheap walk over the input's section table.  Sym values are pool-local,
  * so name strings must be dereferenced through the input's *own*
  * compiler pool — not the jit's pool. */
 static int jit_view_input_has_debug(KitJit* jit, u32 ii) {
   ObjBuilder* ob;
   Pool* in_pool;
   u32 nsec, k;
   if (ii >= jit->image->dbg_objs_n) return 0;
   ob = jit->image->dbg_objs[ii];
   if (!ob) return 0;
   in_pool = obj_compiler(ob)->global;
   nsec = obj_section_count(ob);
   for (k = 0; k < nsec; ++k) {
     const Section* s = obj_section_get(ob, (ObjSecId)(k + 1));
     const char* nm;
     if (!s || !s->name) continue;
     nm = pool_slice(in_pool, s->name).s;
     if (jit_view_is_debug_name(nm)) return 1;
   }
   return 0;
 }
 
 /* Resolve an input-local ObjSymId to the final image vaddr of the
  * defining LinkSymbol, going through the per-input InputMap and the
  * image's LinkSyms table.  Returns 0 if the symbol is undefined or the
  * mapping is missing — debug relocations against unresolved symbols
  * collapse to zero, which is the DWARF "absent" convention. */
 static u64 jit_view_sym_vaddr(KitJit* jit, u32 ii, ObjSymId obj_sym) {
   const InputMap* m;
   LinkSymId lid;
   const LinkSymbol* s;
   if (obj_sym == OBJ_SYM_NONE) return 0;
   if (ii >= jit->image->ninput_maps) return 0;
   m = &jit->image->input_maps[ii];
   if (!m->sym || obj_sym >= m->nsym) return 0;
   lid = m->sym[obj_sym];
   if (lid == LINK_SYM_NONE || lid > LinkSyms_count(&jit->image->syms)) return 0;
   s = LinkSyms_at(&jit->image->syms, lid - 1);
   if (!s || !s->defined) return 0;
   return s->vaddr; /* image-relative — what DWARF was emitted in */
 }
 
 /* Per-output-section state used while concatenating multi-input debug
  * bytes.  Keyed by interned name in the view compiler's pool. */
 typedef struct ViewSec {
   Sym view_name; /* interned in view_ob's compiler pool */
   ObjSecId view_id;
   u32 cur_size; /* bytes currently in the view section */
   /* Snapshot of cur_size taken at the start of processing the current
    * input.  Reloc apply for SK_SECTION targets must use this value so
    * that intra-input references resolve to *this* input's contribution,
    * not bytes appended later from the same input. */
   u32 snap;
 } ViewSec;
 
 /* Find-or-create a ViewSec entry by debug-section name. */
 static ViewSec* view_sec_for(KitJit* jit, ViewSec* tab, u32* ntab,
                              u32* cap_inout, const char* name, u16 flags,
                              u32 align, u32 entsize, ObjBuilder* view_ob,
                              ViewSec** tab_out) {
   Heap* h = (Heap*)jit->c->ctx->heap;
   Pool* view_pool = obj_compiler(view_ob)->global;
   Sym vn = pool_intern_cstr(view_pool, name);
   u32 i;
   for (i = 0; i < *ntab; ++i) {
     if (tab[i].view_name == vn) {
       if (tab_out) *tab_out = tab;
       return &tab[i];
     }
   }
   if (*ntab == *cap_inout) {
     u32 ncap = *cap_inout ? *cap_inout * 2u : 4u;
     ViewSec* na = (ViewSec*)h->realloc(h, tab, *cap_inout * sizeof(*tab),
                                        ncap * sizeof(*tab), _Alignof(ViewSec));
     if (!na) return NULL;
     tab = na;
     *cap_inout = ncap;
     if (tab_out) *tab_out = tab;
   } else if (tab_out) {
     *tab_out = tab;
   }
   {
     ViewSec* slot = &tab[(*ntab)++];
     slot->view_name = vn;
     slot->view_id = obj_section_ex(view_ob, vn, SEC_DEBUG, SSEM_PROGBITS, flags,
                                    align ? align : 1u, entsize, 0, 0);
     slot->cur_size = 0;
     slot->snap = 0;
     return slot;
   }
 }
 
 /* Find a ViewSec by view-pool name (no creation).  Returns NULL on miss. */
 static ViewSec* view_sec_find(ViewSec* tab, u32 ntab, Sym view_name) {
   u32 i;
   for (i = 0; i < ntab; ++i)
     if (tab[i].view_name == view_name) return &tab[i];
   return NULL;
 }
 
 /* Copy one debug section from input `ii` into the view, applying its
  * relocations against either the view-relative section prefix (for
  * SK_SECTION targets pointing at a debug section) or the final image
  * vaddr (for code/data symbol targets like DW_AT_low_pc).
  *
  * `tab` is the find-or-create table of view sections, keyed by name;
  * snapshots taken at the start of this input are read from it via
  * view_sec_find. */
 static void jit_view_copy_debug_section(KitJit* jit, u32 ii, ObjSecId in_sec_id,
                                         ObjBuilder* view_ob, ViewSec* tab,
                                         u32 ntab, ViewSec* out_vs) {
   ObjBuilder* in_ob = jit->image->dbg_objs[ii];
   const Section* in_sec = obj_section_get(in_ob, in_sec_id);
   Pool* in_pool;
   Pool* view_pool = obj_compiler(view_ob)->global;
   Heap* h;
   u32 nbytes, k, total_relocs;
   u8* bytes;
   if (!in_sec) return;
   nbytes = in_sec->bytes.total;
   if (nbytes == 0) return;
   in_pool = obj_compiler(in_ob)->global;
   h = (Heap*)jit->c->ctx->heap;
   (void)in_pool;
 
   bytes = (u8*)h->alloc(h, nbytes, 1);
   if (!bytes) return;
   buf_flatten(&in_sec->bytes, bytes);
 
   /* Apply this section's relocations in place.  obj_reloc_at returns
    * all relocations across the input; filter by section_id. */
   total_relocs = obj_reloc_total(in_ob);
   for (k = 0; k < total_relocs; ++k) {
     const Reloc* r = obj_reloc_at(in_ob, k);
     u64 S = 0;
     int handled = 0;
     if (!r || r->section_id != in_sec_id) continue;
     if (r->offset >= nbytes) continue; /* malformed; skip */
     /* SK_SECTION target → resolve against the per-input snapshot of the
      * matching view section's prefix size.  This is what makes the
      * concatenated multi-input view's cross-section offsets land in
      * the right slot. */
     if (r->sym != OBJ_SYM_NONE) {
       const ObjSym* ts = obj_symbol_get(in_ob, r->sym);
       if (ts && ts->kind == SK_SECTION && ts->section_id != OBJ_SEC_NONE) {
         const Section* tsec = obj_section_get(in_ob, ts->section_id);
         if (tsec && tsec->kind == SEC_DEBUG && tsec->name) {
           Slice tnm_s = pool_slice(obj_compiler(in_ob)->global, tsec->name);
           const char* tnm = tnm_s.s;
           size_t tnlen = tnm_s.len;
           if (tnm) {
             Sym v_tn =
                 pool_intern_slice(view_pool, (Slice){.s = tnm, .len = tnlen});
             ViewSec* tgt = view_sec_find(tab, ntab, v_tn);
             if (tgt) {
               S = (u64)tgt->snap;
               handled = 1;
             }
           }
         }
       }
     }
     if (!handled) S = jit_view_sym_vaddr(jit, ii, r->sym);
     /* P is unused by ABS kinds; PC-relative debug-section relocs are
      * not produced by kit's debug emitter, but if some external .o
      * carried one against a debug section, P=0 would give a
      * non-meaningful offset — acceptable for a viewer that only reads
      * absolute address fields. */
     link_reloc_apply(jit->c, (RelocKind)r->kind, bytes + r->offset, S,
                      r->addend, 0);
   }
 
   obj_write(view_ob, out_vs->view_id, bytes, nbytes);
   out_vs->cur_size += nbytes;
   h->free(h, bytes, nbytes);
 }
 
 /* Build the view on first call.  Walks every input that carries a debug
  * section and concatenates per-section bytes into the view's matching
  * sections.  SK_SECTION relocations are resolved against the view-side
  * prefix length snapshotted at the start of each input, so the merged
  * CU2/CU3/... cross-section offsets land in the right slot. */
 static KitObjFile* jit_view_build(KitJit* jit) {
   KitObjFile* view;
   ObjBuilder* view_ob;
   ViewSec* tab = NULL;
   u32 ntab = 0, cap = 0;
   Heap* h;
   u32 ii, k;
   int any = 0;
 
   if (!jit->image || jit->image->dbg_objs_n == 0) return NULL;
   for (ii = 0; ii < jit->image->dbg_objs_n; ++ii) {
     if (jit_view_input_has_debug(jit, ii)) {
       any = 1;
       break;
     }
   }
   if (!any) return NULL;
 
   view =
       kit_objfile_internal_new(jit->c->ctx, jit->c->target, jit->c->target.obj);
   if (!view) return NULL;
   view_ob = kit_objfile_builder(view);
   if (!view_ob) {
     kit_objfile_internal_free(view);
     return NULL;
   }
   h = (Heap*)jit->c->ctx->heap;
 
   for (ii = 0; ii < jit->image->dbg_objs_n; ++ii) {
     ObjBuilder* in_ob;
     u32 nsec;
     if (!jit_view_input_has_debug(jit, ii)) continue;
     in_ob = jit->image->dbg_objs[ii];
 
     /* Phase A: find-or-create every debug section this input contributes
      * to, and snapshot cur_size as the per-input prefix. */
     nsec = obj_section_count(in_ob);
     for (k = 0; k < nsec; ++k) {
       const Section* s = obj_section_get(in_ob, (ObjSecId)(k + 1));
       const char* nm;
       ViewSec* vs;
       if (!s || !s->name) continue;
       nm = pool_slice(obj_compiler(in_ob)->global, s->name).s;
       if (!nm || !jit_view_is_debug_name(nm)) continue;
       vs = view_sec_for(jit, tab, &ntab, &cap, nm, s->flags,
                         s->align ? s->align : 1u, s->entsize, view_ob, &tab);
       if (!vs) continue;
     }
     for (k = 0; k < ntab; ++k) tab[k].snap = tab[k].cur_size;
 
     /* Phase B: copy each debug section + apply relocs.  cur_size grows
      * as bytes get appended; SK_SECTION resolution always reads `snap`
      * (the start-of-input snapshot), so intra-input references inside
      * any debug section still land in this input's slice. */
     for (k = 0; k < nsec; ++k) {
       const Section* s = obj_section_get(in_ob, (ObjSecId)(k + 1));
       const char* nm;
       size_t nlen = 0;
       Sym v_nm;
       ViewSec* vs;
       if (!s || !s->name) continue;
       {
         Slice nm_s = pool_slice(obj_compiler(in_ob)->global, s->name);
         nm = nm_s.s;
         nlen = nm_s.len;
       }
       if (!nm || !jit_view_is_debug_name(nm)) continue;
       v_nm = pool_intern_slice(obj_compiler(view_ob)->global,
                                (Slice){.s = nm, .len = nlen});
       vs = view_sec_find(tab, ntab, v_nm);
       if (!vs) continue;
       jit_view_copy_debug_section(jit, ii, (ObjSecId)(k + 1), view_ob, tab,
                                   ntab, vs);
     }
   }
 
   if (tab) h->free(h, tab, sizeof(*tab) * cap);
   obj_finalize(view_ob);
   return view;
 }
 
 const KitObjFile* kit_jit_view(KitJit* jit) {
   if (!jit) return NULL;
   if (jit->view_built) return jit->view;
   jit->view = jit_view_build(jit);
   jit->view_built = 1u;
   return jit->view;
 }
 
 /* True for symbol kinds the user-facing JIT inspector surfaces. Mapping
  * symbols (SK_NOTYPE — aarch64 $x/$d), section/file/undef symbols are
  * skipped. */
 static int jit_sym_kind_visible(u8 k) {
   return k == SK_FUNC || k == SK_OBJ || k == SK_COMMON || k == SK_TLS ||
          k == SK_IFUNC || k == SK_ABS;
 }
 
 /* Resolve a LinkSymbol's interned name to a stable C string, stripping
  * the target format's C-mangling prefix (Mach-O's leading `_`) so the
  * user sees the source-level name. */
 static Slice jit_sym_name_slice(KitJit* jit, const LinkSymbol* s) {
   Slice nm_s = pool_slice(jit->c->global, s->name);
   const char* nm = nm_s.s;
   size_t len = nm_s.len;
   if (!nm) return KIT_SLICE_NULL;
   obj_format_demangle_c(jit->c, &nm, &len);
   nm_s.s = nm;
   nm_s.len = len;
   return nm_s;
 }
 
 static uint64_t jit_sym_runtime_addr(KitJit* jit, const LinkSymbol* s) {
   if (s->kind == SK_ABS) return s->vaddr;
   return (uint64_t)vaddr_to_runtime(jit->image, jit->segs, s->vaddr);
 }
 
 KitStatus kit_jit_addr_to_sym(KitJit* jit, uint64_t addr, KitSlice* name_out,
                               uint64_t* off_out) {
   u32 n;
   u32 i;
   const LinkSymbol* best = NULL;
   uint64_t best_base = 0;
   uint64_t best_off = (uint64_t)-1;
   if (name_out) *name_out = KIT_SLICE_NULL;
   if (off_out) *off_out = 0;
   if (!jit) return KIT_INVALID;
   n = LinkSyms_count(&jit->image->syms);
   for (i = 0; i < n; ++i) {
     LinkSymbol* s = LinkSyms_at(&jit->image->syms, i);
     uint64_t base;
     if (!s || !s->defined) continue;
     if (!jit_sym_kind_visible(s->kind)) continue;
     base = jit_sym_runtime_addr(jit, s);
     if (!base) continue;
     if (addr >= base && (s->size == 0 || addr < base + s->size)) {
       uint64_t off = addr - base;
       if (off < best_off ||
           (off == best_off && best && best->size == 0 && s->size != 0)) {
         best = s;
         best_base = base;
         best_off = off;
       }
     }
   }
   if (best) {
     if (name_out) *name_out = jit_sym_name_slice(jit, best);
     if (off_out) *off_out = addr - best_base;
     return KIT_OK;
   }
   return KIT_NOT_FOUND;
 }
 
 struct KitJitSymIter {
   KitJit* jit;
   u32 next;
 };
 
 KitStatus kit_jit_sym_iter_new(KitJit* jit, KitJitSymIter** out) {
   Heap* h;
   KitJitSymIter* it;
   if (!out) return KIT_INVALID;
   *out = NULL;
   if (!jit) return KIT_INVALID;
   h = (Heap*)jit->c->ctx->heap;
   it = (KitJitSymIter*)h->alloc(h, sizeof(*it), _Alignof(KitJitSymIter));
   if (!it) return KIT_NOMEM;
   it->jit = jit;
   it->next = 0;
   *out = it;
   return KIT_OK;
 }
 
 KitIterResult kit_jit_sym_iter_next(KitJitSymIter* it, KitJitSym* out) {
   u32 n;
   if (!it || !out) return KIT_ITER_ERROR;
   n = LinkSyms_count(&it->jit->image->syms);
   while (it->next < n) {
     LinkSymbol* s = LinkSyms_at(&it->jit->image->syms, it->next++);
     if (!s || !s->defined) continue;
     if (!jit_sym_kind_visible(s->kind)) continue;
     out->name = jit_sym_name_slice(it->jit, s);
     out->addr = jit_sym_runtime_addr(it->jit, s);
     out->size = s->size;
     out->kind = (KitSymKind)s->kind;
     return KIT_ITER_ITEM;
   }
   return KIT_ITER_END;
 }
 
 void kit_jit_sym_iter_free(KitJitSymIter* it) {
   Heap* h;
   if (!it) return;
   h = (Heap*)it->jit->c->ctx->heap;
   h->free(h, it, sizeof(*it));
 }
 
 /* ---- accessors for src/dbg/ ----
  *
  * The KitJit struct is private to this TU. The debugger session needs a
  * way to validate that an address lies inside the JIT image (so it can
  * reject breakpoint and read/write requests pointing outside the code
  * region) and a way to read the image's target arch. These accessors give
  * it just that, without exporting the segment table or the LinkImage. */
 int kit_jit_image_contains(KitJit* jit, uint64_t runtime_addr) {
   u32 i;
   uintptr_t a;
   if (!jit || !jit->segs) return 0;
   a = (uintptr_t)runtime_addr;
   for (i = 0; i < jit->nsegs; ++i) {
     uintptr_t lo = (uintptr_t)jit->segs[i].runtime;
     uintptr_t hi = lo + (uintptr_t)jit->segs[i].size;
     if (a >= lo && a < hi) return 1;
   }
   return 0;
 }
 
 /* runtime <-> image vaddr translation.  The pair is symmetric with
  * vaddr_to_runtime above; exposed here so dwarf consumers and the
  * driver can cross the boundary at every DWARF call.  Walks the
  * segment table (at most a handful of entries) so callers can do this
  * per stop without measurable cost. */
 uint64_t kit_jit_runtime_to_image(KitJit* jit, uint64_t runtime_pc) {
   u32 i;
   uintptr_t a;
   if (!jit || !jit->segs) return 0;
   a = (uintptr_t)runtime_pc;
   for (i = 0; i < jit->nsegs; ++i) {
     uintptr_t lo = (uintptr_t)jit->segs[i].runtime;
     uintptr_t hi = lo + (uintptr_t)jit->segs[i].size;
     if (a >= lo && a < hi) {
       const LinkSegment* s = &jit->image->segments[i];
       return s->vaddr + (uint64_t)(a - lo);
     }
   }
   /* One-past-end: lets a return-address that sits exactly at a
    * segment's end-boundary still round-trip. */
   for (i = 0; i < jit->nsegs; ++i) {
     uintptr_t hi =
         (uintptr_t)jit->segs[i].runtime + (uintptr_t)jit->segs[i].size;
     if (a == hi) {
       const LinkSegment* s = &jit->image->segments[i];
       return s->vaddr + s->mem_size;
     }
   }
   return 0;
 }
 
 uint64_t kit_jit_image_to_runtime(KitJit* jit, uint64_t image_vaddr) {
   uintptr_t rt;
   if (!jit || !jit->segs) return 0;
   rt = vaddr_to_runtime(jit->image, jit->segs, image_vaddr);
   return (uint64_t)rt;
 }
 
 KitArchKind kit_jit_image_arch(KitJit* jit) { return jit->c->target.arch; }
 
 Compiler* kit_jit_compiler(KitJit* jit) { return jit->c; }
 
 void kit_jit_run_dtors(KitJit* jit) {
   typedef void (*VoidFn)(void);
   void* p_start;
   void* p_end;
   if (!jit) return;
   p_start = kit_jit_lookup(jit, KIT_SLICE_LIT("__fini_array_start"));
   p_end = kit_jit_lookup(jit, KIT_SLICE_LIT("__fini_array_end"));
   if (p_start && p_end) {
     VoidFn* begin = (VoidFn*)p_start;
     VoidFn* fn = (VoidFn*)p_end;
     while (fn != begin) {
       --fn;
       if (*fn) (*fn)();
     }
   }
 }