kit

link_layout.c (93303B)

---

 /* link_layout.c — section bucketing, vaddr assignment, scripted layout,
  * COMMON BSS allocation, segment-byte copying, and the top-level
  * link_resolve orchestration function.
  *
  * Image-relative discipline: every vaddr / file_offset on the produced
  * image treats the image as based at 0. Consumers (link_emit_elf,
  * kit_jit_from_image) add their own runtime base before patching
  * relocations or writing PT_LOAD headers. Segment byte buffers hold raw
  * input section bytes — no relocations are applied here, in line with
  * the incremental-link discipline (link.h:136). */
 
 #include <kit/core.h>
 #include <kit/jit.h>
 #include <stdarg.h>
 #include <string.h>
 
 #include "core/buf.h"
 #include "core/bytes.h"
 #include "core/diag.h"
 #include "core/heap.h"
 #include "core/metrics.h"
 #include "core/pool.h"
 #include "core/slice.h"
 #include "core/util.h"
 #include "core/vec.h"
 #include "link/link.h"
 #include "link/link_arch.h"
 #include "link/link_internal.h"
 #include "obj/format.h"
 
 LinkImage* link_image_alloc(Compiler*); /* defined in link.c */
 
 #define LINK_ELF_SHF_COMPRESSED 0x800u
 
 /* Page size used for ELF segment alignment. We pull from env->execmem
  * when present (matches the eventual JIT mapping granularity) and fall
  * back to 16 KiB otherwise — large enough for any current Linux/aarch64
  * loader. A future cross-link with mismatched host/target page sizes
  * will need a target-derived value here instead. */
 u64 link_layout_page_size(Linker* l) {
   const KitExecMem* m = (l && l->jit_host) ? l->jit_host->execmem : NULL;
   if (m && m->page_size) return (u64)m->page_size;
   return 0x4000u;
 }
 
 /* Four-bucket segment partitioning: see SegBucket in link_internal.h. */
 
 int link_section_kept(const Section* s) {
   /* This cut keeps allocatable progbits/nobits sections only. Debug,
    * symtab/strtab, group, and note sections are dropped — none of
    * them participate in a static ET_EXEC layout. */
   if (!(s->flags & SF_ALLOC)) return 0;
   if (s->sem == SSEM_PROGBITS || s->sem == SSEM_NOBITS || s->sem == SSEM_NOTE)
     return 1;
   if (s->sem == SSEM_INIT_ARRAY || s->sem == SSEM_FINI_ARRAY ||
       s->sem == SSEM_PREINIT_ARRAY)
     return 1;
   return 0;
 }
 
 int link_section_kept_fileonly(const Section* s) {
   /* Non-allocatable .debug_* sections. They get no PT_LOAD segment but
    * are carried through to the file so addr2line / gdb resolve
    * file:line on the linked image.
    *
    * ELF SHF_COMPRESSED debug sections carry compressed bytes but relocation
    * offsets refer to the uncompressed DWARF stream. Until the object model has
    * a decompression/recompression path, dropping them is the only safe linked
    * executable behavior. */
   return s && !s->removed && s->kind == SEC_DEBUG &&
          !(s->ext_kind == OBJ_EXT_ELF &&
            (s->ext_flags & LINK_ELF_SHF_COMPRESSED));
 }
 
 SegBucket link_bucket_for(u16 flags) {
   if (flags & SF_TLS) return SEG_TLS;
   if (flags & SF_EXEC) return SEG_RX;
   if (flags & SF_WRITE) return SEG_RW;
   return SEG_R;
 }
 
 /* PIE `.data.rel.ro` placement: a read-only data section that carries an
  * absolute (abs32/abs64) reloc cannot stay in a never-writable PT_LOAD.
  * In PIE the linker rewrites those relocs into dynamic records — a
  * RELATIVE for an internal target, a GLOB_DAT for an import — and the
  * loader *writes* the resolved pointer into the slot at load time. A
  * PF_R-only segment faults that store (manifesting as a SIGSEGV in the
  * dynamic loader). Jump tables, @labeladdr arrays, and const pointer
  * initializers all land here. Promote such sections to the writable
  * segment; we forgo the post-relocation RELRO re-protection that a full
  * toolchain would apply via PT_GNU_RELRO. */
 static int link_pie_ro_section_needs_write(const ObjBuilder* ob, ObjSecId sid) {
   u32 i, total = obj_reloc_total(ob);
   for (i = 0; i < total; ++i) {
     const Reloc* r = obj_reloc_at(ob, i);
     if (!r || r->removed || r->section_id != sid) continue;
     if (r->kind == R_ABS64 || r->kind == R_ABS32) return 1;
   }
   return 0;
 }
 
 /* ---- LinkImage growth helpers ----
  *
  * syms / relocs back onto SegVec — pointers stay stable across pushes,
  * so callers may stash LinkSymbol/LinkRelocApply references and
  * re-enter mutation without invalidation. */
 
 static LinkSymbol* append_symbol_slot(LinkImage* img) {
   u32 idx;
   LinkSymbol* s = LinkSyms_push(&img->syms, &idx);
   if (!s) compiler_panic(img->c, SRCLOC_NONE, "link: oom growing symbols");
   s->id = (LinkSymId)(idx + 1u);
   return s;
 }
 
 LinkSymId link_append_symbol(LinkImage* img, const LinkSymbol* tmpl) {
   LinkSymbol* s = append_symbol_slot(img);
   LinkSymId id = s->id;
   *s = *tmpl;
   s->id = id;
   return id;
 }
 
 LinkRelocApply* link_append_reloc_slot(LinkImage* img) {
   LinkRelocApply* r = LinkRelocs_push(&img->relocs, NULL);
   if (!r) compiler_panic(img->c, SRCLOC_NONE, "link: oom growing relocs");
   return r;
 }
 
 /* ---- pass 2: section assignment + segment layout ---- */
 
 typedef struct SecRef {
   u32 input_idx;
   ObjSecId obj_sec_id;
   LinkSectionId link_sec_id;
 } SecRef;
 
 #define PLACE_NONE ((u32)~0u)
 
 /* Within a bucket, input sections sharing a name are placed contiguously
  * — the standard "merge sections by name" rule. Without this the .init
  * prologue from crti.o and the matching epilogue from crtn.o (both in
  * a .init section) get separated by intervening .text, and `_init` is
  * no longer a contiguous function. Placement walk:
  *
  *   1. Build a flat list of (input_idx, obj_sec_id) for kept+live
  *      sections.
  *   2. While collecting, append each section to an O(1)-expected lookup
  *      keyed by (bucket, name). The group array is append-only, so group
  *      order is still first occurrence; each group's linked list preserves
  *      input order.
  *   3. Lay out groups in first-occurrence order.
  */
 typedef struct PlaceEntry {
   u32 input_idx;
   ObjSecId obj_sec_id;
   ObjAtomId obj_atom_id;
   u32 obj_offset;
   u32 size;
   Sym name;
   SegBucket bucket;
   u32 next;
 } PlaceEntry;
 
 typedef struct PlaceGroup {
   u32 head;
   u32 tail;
 } PlaceGroup;
 
 static inline u32 place_group_hash_(u64 key) { return hash_u64(key); }
 HASHMAP_DEFINE(PlaceGroupHash, u64, u32, place_group_hash_);
 
 static u64 place_group_key(Sym name, SegBucket bucket) {
   return (((u64)name + 1u) << 3) | ((u64)bucket + 1u);
 }
 
 static u32 place_group_hash_cap(u32 n) {
   u32 cap = KIT_HASHMAP_INIT_CAP;
   while (cap < 0x80000000u && (cap - cap / 4u) < n) cap <<= 1;
   return cap;
 }
 
 static int live_section_units(const GcLive* g, const InputMap* m, u32 ii,
                               ObjBuilder* ob, ObjSecId sid) {
   u32 n = 0, first, count, i;
   if (link_input_section_has_atoms(m, sid)) {
     link_input_section_atoms(m, sid, &first, &count);
     for (i = 0; i < count; ++i) {
       ObjAtomId aid = m->section_atom_ids[first + i];
       const ObjAtom* a = obj_atom_get(ob, aid);
       if (!a || a->removed) continue;
       if (link_gc_atom_live_get(g, ii, aid)) ++n;
     }
     return n;
   }
   return link_gc_live_get(g, ii, sid) ? 1 : 0;
 }
 
 static void map_placed_unit(InputMap* m, ObjSecId sid, ObjAtomId aid,
                             LinkSectionId lsid) {
   if (aid != OBJ_ATOM_NONE) {
     m->atom[aid] = lsid;
     if (m->section[sid] == LINK_SEC_NONE) m->section[sid] = lsid;
     return;
   }
   m->section[sid] = lsid;
 }
 
 static void link_layout_sections_scripted(Linker* l, LinkImage* img,
                                           const GcLive* g);
 
 void link_layout_sections(Linker* l, LinkImage* img, const GcLive* g) {
   if (l->script) {
     link_layout_sections_scripted(l, img, g);
     return;
   }
   Heap* h = img->heap;
   u32 ii, j;
   u32 total_kept = 0;
 
   /* Pass 0: count kept sections (filtered by GC liveness). */
   for (ii = 0; ii < LinkInputs_count(&l->inputs); ++ii) {
     ObjBuilder* ob = LinkInputs_at(&l->inputs, ii)->obj;
     for (j = 1; j < obj_section_count(ob); ++j) {
       const Section* s = obj_section_get(ob, j);
       InputMap* m = &img->input_maps[ii];
       if (s && link_section_kept(s) && !m->comdat_discarded[j])
         total_kept += live_section_units(g, m, ii, ob, j);
     }
   }
 
   img->sections = total_kept ? (LinkSection*)h->alloc(
                                    h, sizeof(*img->sections) * total_kept,
                                    _Alignof(LinkSection))
                              : NULL;
   if (total_kept && !img->sections)
     compiler_panic(img->c, SRCLOC_NONE, "link: oom on sections");
 
   /* Pass 1: collect kept sections into a flat list. */
   PlaceEntry* entries =
       total_kept ? (PlaceEntry*)h->alloc(h, sizeof(*entries) * total_kept,
                                          _Alignof(PlaceEntry))
                  : NULL;
   PlaceGroup* groups =
       total_kept ? (PlaceGroup*)h->alloc(h, sizeof(*groups) * total_kept,
                                          _Alignof(PlaceGroup))
                  : NULL;
   PlaceGroupHash group_map;
   u32 ngroups = 0;
   if (total_kept && !entries)
     compiler_panic(img->c, SRCLOC_NONE, "link: oom on placement entries");
   if (total_kept && !groups)
     compiler_panic(img->c, SRCLOC_NONE, "link: oom on placement groups");
   if (total_kept) {
     PlaceGroupHash_init_cap(&group_map, h, place_group_hash_cap(total_kept));
     if (!group_map.slots)
       compiler_panic(img->c, SRCLOC_NONE, "link: oom on placement group map");
   }
   {
     u32 e = 0;
     for (ii = 0; ii < LinkInputs_count(&l->inputs); ++ii) {
       ObjBuilder* ob = LinkInputs_at(&l->inputs, ii)->obj;
       InputMap* m = &img->input_maps[ii];
       for (j = 1; j < obj_section_count(ob); ++j) {
         const Section* s = obj_section_get(ob, j);
         u64 key;
         u32* hit;
         u32 group_idx;
         if (!s || !link_section_kept(s) || m->comdat_discarded[j]) continue;
         u32 first = 0, count = 1, ai;
         int has_atoms = link_input_section_has_atoms(m, j);
         if (has_atoms) link_input_section_atoms(m, j, &first, &count);
         for (ai = 0; ai < count; ++ai) {
           ObjAtomId aid =
               has_atoms ? m->section_atom_ids[first + ai] : OBJ_ATOM_NONE;
           const ObjAtom* a = has_atoms ? obj_atom_get(ob, aid) : NULL;
           if (has_atoms) {
             if (!a || a->removed) continue;
             if (!link_gc_atom_live_get(g, ii, aid)) continue;
           } else if (!link_gc_live_get(g, ii, j)) {
             continue;
           }
           entries[e].input_idx = ii;
           entries[e].obj_sec_id = j;
           entries[e].obj_atom_id = has_atoms ? aid : OBJ_ATOM_NONE;
           entries[e].obj_offset = has_atoms ? a->offset : 0u;
           entries[e].size = has_atoms ? a->size : link_section_size_for_link(s);
           entries[e].name = s->name;
           entries[e].bucket = link_bucket_for(s->flags);
           if (l->emit_pie && entries[e].bucket == SEG_R &&
               link_pie_ro_section_needs_write(ob, j))
             entries[e].bucket = SEG_RW;
           entries[e].next = PLACE_NONE;
 
           key = place_group_key(entries[e].name, entries[e].bucket);
           hit = PlaceGroupHash_get(&group_map, key);
           if (hit) {
             group_idx = *hit - 1u;
           } else {
             group_idx = ngroups++;
             groups[group_idx].head = PLACE_NONE;
             groups[group_idx].tail = PLACE_NONE;
             PlaceGroupHash_set(&group_map, key, group_idx + 1u);
           }
           if (groups[group_idx].tail == PLACE_NONE) {
             groups[group_idx].head = e;
           } else {
             entries[groups[group_idx].tail].next = e;
           }
           groups[group_idx].tail = e;
           ++e;
         }
       }
     }
   }
 
   /* Four segment buckets; tracks per-bucket size during scan and
    * per-section file_offset within the bucket. */
   u64 seg_size[SEG_NBUCKETS] = {0};
   u32 seg_align[SEG_NBUCKETS] = {1, 1, 1, 1};
   u32 seg_count[SEG_NBUCKETS] = {0};
   /* Track trailing NOBITS so segment mem_size > file_size: SEG_RW
    * for .bss / COMMON, SEG_TLS for .tbss. */
   u64 seg_bss_extra[SEG_NBUCKETS] = {0};
 
   /* Pass 2: place sections, grouped by name within each bucket and
    * in first-occurrence order across groups. NOBITS (.bss/.tbss) sections
    * are placed in a second sub-pass so every bucket's file image stays a
    * contiguous prefix: ELF requires bss to trail, and for TLS specifically
    * a .tbss ahead of .tdata makes the loader copy garbage file bytes as the
    * zero-init image (FreeBSD/riscv _init_tls then crashes on a stale TLS
    * pointer). */
   for (int bss_phase = 0; bss_phase < 2; ++bss_phase) {
     for (u32 gi = 0; gi < ngroups; ++gi) {
       for (u32 k = groups[gi].head; k != PLACE_NONE; k = entries[k].next) {
         PlaceEntry* pe = &entries[k];
         SegBucket bucket = pe->bucket;
 
         ObjBuilder* ob = LinkInputs_at(&l->inputs, pe->input_idx)->obj;
         InputMap* m = &img->input_maps[pe->input_idx];
         const Section* s = obj_section_get(ob, pe->obj_sec_id);
         u32 align = s->align ? s->align : 1u;
         u64 ofs;
         LinkSection* ls;
         LinkSectionId lsid;
         int is_bss = (s->sem == SSEM_NOBITS || s->kind == SEC_BSS);
 
         if (is_bss != bss_phase) continue;
         if (is_bss) {
           u64 cursor = seg_size[bucket] + seg_bss_extra[bucket];
           cursor = ALIGN_UP(cursor, (u64)(align));
           seg_bss_extra[bucket] = cursor + (u64)pe->size - seg_size[bucket];
           ofs = cursor;
         } else {
           seg_size[bucket] += seg_bss_extra[bucket];
           seg_bss_extra[bucket] = 0;
           ofs = ALIGN_UP(seg_size[bucket], (u64)(align));
           seg_size[bucket] = ofs + (u64)pe->size;
         }
 
         if (align > seg_align[bucket]) seg_align[bucket] = align;
         seg_count[bucket]++;
 
         lsid = (LinkSectionId)(img->nsections + 1u);
         ls = &img->sections[img->nsections++];
         memset(ls, 0, sizeof(*ls));
         ls->id = lsid;
         ls->input_id = LinkInputs_at(&l->inputs, pe->input_idx)->id;
         ls->obj_section_id = pe->obj_sec_id;
         ls->obj_atom_id = pe->obj_atom_id;
         ls->segment_id = LINK_SEG_NONE;
         ls->obj_offset = pe->obj_offset;
         ls->input_offset = ofs;
         ls->file_offset = ofs;
         ls->vaddr = ofs;
         ls->size = pe->size;
         ls->flags = s->flags;
         ls->align = align;
         ls->name = s->name;
         ls->sem = (s->kind == SEC_BSS) ? SSEM_NOBITS : s->sem;
         ls->segment_id = (LinkSegmentId)(bucket + 1u); /* 1..3 sentinel */
         map_placed_unit(m, pe->obj_sec_id, pe->obj_atom_id, lsid);
       }
     }
   }
 
   if (total_kept) PlaceGroupHash_fini(&group_map);
   if (groups) h->free(h, groups, sizeof(*groups) * total_kept);
   if (entries) h->free(h, entries, sizeof(*entries) * total_kept);
 
   /* Materialize one LinkSegment per non-empty bucket, then assign
    * absolute (image-relative) vaddr/file_offset to each segment and
    * fix up section.{vaddr,file_offset,segment_id}. */
   {
     LinkSegmentId bucket_seg[SEG_NBUCKETS] = {0};
     u64 cursor = 0;
     u32 b;
     u32 nseg = 0;
     for (b = 0; b < SEG_NBUCKETS; ++b)
       if (seg_count[b]) ++nseg;
 
     img->segments =
         nseg ? (LinkSegment*)h->alloc(h, sizeof(*img->segments) * nseg,
                                       _Alignof(LinkSegment))
              : NULL;
     img->segment_bytes =
         nseg ? (u8**)h->alloc(h, sizeof(*img->segment_bytes) * nseg,
                               _Alignof(u8*))
              : NULL;
     img->segment_bytes_cap =
         nseg ? (size_t*)h->alloc(h, sizeof(*img->segment_bytes_cap) * nseg,
                                  _Alignof(size_t))
              : NULL;
     if (nseg &&
         (!img->segments || !img->segment_bytes || !img->segment_bytes_cap))
       compiler_panic(img->c, SRCLOC_NONE, "link: oom on segments");
     if (nseg) {
       memset(img->segment_bytes, 0, sizeof(*img->segment_bytes) * nseg);
       memset(img->segment_bytes_cap, 0, sizeof(*img->segment_bytes_cap) * nseg);
     }
 
     for (b = 0; b < SEG_NBUCKETS; ++b) {
       LinkSegment* seg;
       u64 file_size, mem_size, align;
       u32 nat_align;
       u32 perms;
       if (!seg_count[b]) continue;
       nat_align = seg_align[b] ? seg_align[b] : 1u;
       align = (u64)nat_align;
       if (align < link_layout_page_size(l)) align = link_layout_page_size(l);
       cursor = ALIGN_UP(cursor, (u64)(align));
 
       seg = &img->segments[img->nsegments];
       file_size = seg_size[b];
       mem_size = seg_size[b] + seg_bss_extra[b];
       perms = SF_ALLOC;
       if (b == SEG_RX) perms |= SF_EXEC;
       if (b == SEG_RW) perms |= SF_WRITE;
       if (b == SEG_TLS) perms |= SF_TLS;
 
       memset(seg, 0, sizeof(*seg));
       seg->id = (LinkSegmentId)(img->nsegments + 1u);
       seg->flags = perms;
       seg->file_offset = cursor;
       seg->vaddr = cursor;
       seg->paddr = cursor;
       seg->mem_size = mem_size;
       seg->file_size = file_size;
       seg->align = (u32)align;
       seg->nsections = seg_count[b];
       bucket_seg[b] = seg->id;
       if (b == SEG_TLS) {
         /* Record TLS image span for PT_TLS emission and TLSLE
          * reloc apply.  tls_align preserves the natural section
          * alignment (PT_TLS p_align), distinct from the
          * containing PT_LOAD's page align. */
         img->tls_vaddr = cursor;
         img->tls_filesz = file_size;
         img->tls_memsz = mem_size;
         img->tls_align = nat_align;
       }
       cursor += mem_size;
       img->nsegments++;
     }
 
     /* Allocate segment buffers and fix up section offsets/vaddrs.  The
      * JIT lane maps input section bytes directly into execmem, so ordinary
      * segment payload buffers would be copied only to be copied again. */
     for (b = 0; b < SEG_NBUCKETS; ++b) {
       if (!bucket_seg[b]) continue;
       {
         LinkSegment* seg = &img->segments[bucket_seg[b] - 1];
         if (seg->file_size && !l->jit_mode) {
           img->segment_bytes[bucket_seg[b] - 1] =
               (u8*)h->alloc(h, (size_t)seg->file_size, 16);
           if (!img->segment_bytes[bucket_seg[b] - 1])
             compiler_panic(img->c, SRCLOC_NONE, "link: oom on segment bytes");
           img->segment_bytes_cap[bucket_seg[b] - 1] = (size_t)seg->file_size;
           memset(img->segment_bytes[bucket_seg[b] - 1], 0,
                  (size_t)seg->file_size);
         }
       }
     }
 
     for (j = 0; j < img->nsections; ++j) {
       LinkSection* ls = &img->sections[j];
       u32 b2 = (u32)(ls->segment_id - 1u); /* sentinel-stash */
       LinkSegment* seg = &img->segments[bucket_seg[b2] - 1];
       ls->segment_id = seg->id;
       ls->vaddr += seg->vaddr;
       ls->file_offset += seg->file_offset;
     }
   }
 }
 
 /* ---- scripted layout (linker-script driven) ----
  *
  * Walks the KitLinkScript's output sections in declaration order,
  * placing matched input sections at the dot location counter. One
  * LinkSegment per non-DISCARD output section maps 1:1 to a PT_LOAD on
  * emit. Symbol assignments (top-level and in-section) materialize as
  * defined LinkSymbol globals via link_emit_boundary_sym.
  *
  * Discard handling: `/DISCARD/` matches input sections by glob and
  * leaves their per-input m->section[id] entry as LINK_SEC_NONE — the
  * downstream emit_reloc_records / link_assign_symbol_vaddrs passes
  * already treat that as "section dropped" so they're naturally
  * excluded from segments, gc, and reloc apply. */
 
 /* `*` is the only metachar. Supported forms in the kernel.lds-style
  * subset: trailing star (".text*"), leading star ("*COMMON" — not in
  * kernel.lds but cheap), and exact literal. */
 static int match_glob(const char* pat, const char* name) {
   size_t plen, nlen;
   if (!pat || !name) return 0;
   plen = slice_from_cstr(pat).len;
   nlen = slice_from_cstr(name).len;
   if (plen == 1 && pat[0] == '*') return 1;
   if (plen >= 2 && pat[plen - 1] == '*') {
     if (nlen + 1 < plen) return 0;
     return memcmp(pat, name, plen - 1) == 0;
   }
   if (plen >= 2 && pat[0] == '*') {
     if (nlen + 1 < plen) return 0;
     return memcmp(pat + 1, name + (nlen - (plen - 1)), plen - 1) == 0;
   }
   return plen == nlen && memcmp(pat, name, plen) == 0;
 }
 
 typedef struct ScriptOutInfo {
   KitSlice name;
   u64 vma;
   u64 lma;
   u64 size;
   int defined;
 } ScriptOutInfo;
 
 static const KitLinkRegion* script_find_region(const KitLinkScript* script,
                                                KitSlice name) {
   u32 i;
   if (!script || !name.s) return NULL;
   for (i = 0; i < script->nregions; ++i)
     if (slice_eq(script->regions[i].name, name)) return &script->regions[i];
   return NULL;
 }
 
 static int script_region_index(const KitLinkScript* script, KitSlice name,
                                u32* out) {
   u32 i;
   if (!script || !name.s) return 0;
   for (i = 0; i < script->nregions; ++i) {
     if (slice_eq(script->regions[i].name, name)) {
       if (out) *out = i;
       return 1;
     }
   }
   return 0;
 }
 
 static const ScriptOutInfo* script_find_out(const ScriptOutInfo* outs,
                                             u32 nouts, KitSlice name) {
   u32 i;
   if (!name.s) return NULL;
   for (i = 0; i < nouts; ++i)
     if (outs[i].defined && slice_eq(outs[i].name, name)) return &outs[i];
   return NULL;
 }
 
 static const KitLinkPhdr* script_find_phdr(const KitLinkScript* script,
                                            KitSlice name) {
   u32 i;
   if (!script || !name.s) return NULL;
   for (i = 0; i < script->nphdrs; ++i)
     if (slice_eq(script->phdrs[i].name, name)) return &script->phdrs[i];
   return NULL;
 }
 
 static u64 script_sizeof_headers(Linker* l) {
   const KitLinkScript* s = l ? l->script : NULL;
   u32 nph = 0;
   u32 i;
   u64 eh = (l && l->c && l->c->target.ptr_size == 4) ? 52u : 64u;
   u64 ph = (l && l->c && l->c->target.ptr_size == 4) ? 32u : 56u;
   if (!s) return eh;
   for (i = 0; i < s->nsections; ++i)
     if (!slice_eq_cstr(s->sections[i].name, "/DISCARD/")) ++nph;
   if (s->nphdrs > nph) nph = s->nphdrs;
   return eh + (u64)nph * ph;
 }
 
 static char script_ascii_lower(char c) {
   return (c >= 'A' && c <= 'Z') ? (char)(c + ('a' - 'A')) : c;
 }
 
 static int script_slice_contains_lit_ci(KitSlice s, const char* lit) {
   size_t lit_len = 0;
   size_t i, j;
   if (!s.s || !lit) return 0;
   while (lit[lit_len]) ++lit_len;
   if (lit_len == 0 || s.len < lit_len) return 0;
   for (i = 0; i <= s.len - lit_len; ++i) {
     for (j = 0; j < lit_len; ++j) {
       if (script_ascii_lower(s.s[i + j]) != script_ascii_lower(lit[j]))
         break;
     }
     if (j == lit_len) return 1;
   }
   return 0;
 }
 
 static int script_format_name(KitSlice name, KitObjFmt* out) {
   if (script_slice_contains_lit_ci(name, "elf")) {
     *out = KIT_OBJ_ELF;
     return 1;
   }
   if (script_slice_contains_lit_ci(name, "mach-o") ||
       script_slice_contains_lit_ci(name, "macho")) {
     *out = KIT_OBJ_MACHO;
     return 1;
   }
   if (script_slice_contains_lit_ci(name, "coff") ||
       script_slice_contains_lit_ci(name, "pei-") ||
       script_slice_contains_lit_ci(name, "pe-")) {
     *out = KIT_OBJ_COFF;
     return 1;
   }
   if (script_slice_contains_lit_ci(name, "wasm")) {
     *out = KIT_OBJ_WASM;
     return 1;
   }
   return 0;
 }
 
 static int script_arch_name(KitSlice name, KitArchKind* out) {
   if (script_slice_contains_lit_ci(name, "aarch64") ||
       script_slice_contains_lit_ci(name, "arm64")) {
     *out = KIT_ARCH_ARM_64;
     return 1;
   }
   if (script_slice_contains_lit_ci(name, "x86_64") ||
       script_slice_contains_lit_ci(name, "x86-64") ||
       script_slice_contains_lit_ci(name, "amd64")) {
     *out = KIT_ARCH_X86_64;
     return 1;
   }
   if (script_slice_contains_lit_ci(name, "riscv64") ||
       script_slice_contains_lit_ci(name, "rv64")) {
     *out = KIT_ARCH_RV64;
     return 1;
   }
   if (script_slice_contains_lit_ci(name, "riscv32") ||
       script_slice_contains_lit_ci(name, "rv32")) {
     *out = KIT_ARCH_RV32;
     return 1;
   }
   if (script_slice_contains_lit_ci(name, "wasm")) {
     *out = KIT_ARCH_WASM;
     return 1;
   }
   if (script_slice_contains_lit_ci(name, "i386") ||
       script_slice_contains_lit_ci(name, "i686") ||
       script_slice_contains_lit_ci(name, "x86")) {
     *out = KIT_ARCH_X86_32;
     return 1;
   }
   if (script_slice_contains_lit_ci(name, "arm")) {
     *out = KIT_ARCH_ARM_32;
     return 1;
   }
   return 0;
 }
 
 static void validate_script_target(Linker* l, const KitLinkScript* script) {
   KitObjFmt fmt;
   KitArchKind arch;
   if (!l || !script) return;
   if (script->output_format.s && script->output_format.len &&
       script_format_name(script->output_format, &fmt) &&
       fmt != l->c->target.obj) {
     compiler_panic(l->c, SRCLOC_NONE,
                    "linker script: OUTPUT_FORMAT '%.*s' does not match target",
                    SLICE_ARG(script->output_format));
   }
   if (script->output_arch.s && script->output_arch.len &&
       script_arch_name(script->output_arch, &arch) &&
       arch != l->c->target.arch) {
     compiler_panic(l->c, SRCLOC_NONE,
                    "linker script: OUTPUT_ARCH '%.*s' does not match target",
                    SLICE_ARG(script->output_arch));
   }
 }
 
 /* Maximum link-script expression evaluation depth — mirrors the parser's
  * LSP_MAX_EXPR_DEPTH so eval fails cleanly (sets *err) instead of overflowing
  * the stack on a pathologically nested expression. */
 #define EVAL_LINK_MAX_DEPTH 256
 
 static u64 eval_link_expr_rec(Linker* l, LinkImage* img, u64 dot,
                               const ScriptOutInfo* outs, u32 nouts,
                               int depth, const KitLinkExpr* e, int* err) {
   if (!e) {
     *err = 1;
     return 0;
   }
   if (depth > EVAL_LINK_MAX_DEPTH) {
     *err = 1;
     return 0;
   }
   switch ((KitLinkExprKind)e->kind) {
     case KIT_LE_INT:
       return (u64)e->v.int_val;
     case KIT_LE_DOT:
       return dot;
     case KIT_LE_SYM: {
       Sym name = pool_intern_slice(l->c->global, e->v.name);
       LinkSymId id = symhash_get(&img->globals, name);
       if (id == LINK_SYM_NONE) {
         compiler_panic(l->c, SRCLOC_NONE,
                        "linker script: undefined symbol '%.*s' in expression",
                        SLICE_ARG(pool_slice(l->c->global, name)));
       }
       return LinkSyms_at(&img->syms, id - 1)->vaddr;
     }
     case KIT_LE_NEG:
       return (u64)(-(i64)eval_link_expr_rec(l, img, dot, outs, nouts,
                                             depth + 1, e->v.align.val, err));
     case KIT_LE_ADD:
       return eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.bin.lhs, err) +
              eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.bin.rhs, err);
     case KIT_LE_SUB:
       return eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.bin.lhs, err) -
              eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.bin.rhs, err);
     case KIT_LE_MUL:
       return eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.bin.lhs, err) *
              eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.bin.rhs, err);
     case KIT_LE_DIV: {
       u64 rhs = eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.bin.rhs, err);
       if (rhs == 0) {
         *err = 1;
         return 0;
       }
       return eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.bin.lhs, err) / rhs;
     }
     case KIT_LE_AND:
       return eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.bin.lhs, err) &
              eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.bin.rhs, err);
     case KIT_LE_OR:
       return eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.bin.lhs, err) |
              eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.bin.rhs, err);
     case KIT_LE_XOR:
       return eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.bin.lhs, err) ^
              eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.bin.rhs, err);
     case KIT_LE_SHL:
       return eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.bin.lhs, err)
              << eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.bin.rhs, err);
     case KIT_LE_SHR:
       return eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.bin.lhs, err) >>
              eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.bin.rhs, err);
     case KIT_LE_MAX: {
       u64 a = eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.bin.lhs, err);
       u64 b = eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.bin.rhs, err);
       return a > b ? a : b;
     }
     case KIT_LE_MIN: {
       u64 a = eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.bin.lhs, err);
       u64 b = eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.bin.rhs, err);
       return a < b ? a : b;
     }
     case KIT_LE_ALIGN: {
       u64 v = eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.align.val, err);
       u64 a =
           eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.align.align, err);
       if (a == 0) return v;
       return ALIGN_UP(v, a);
     }
     case KIT_LE_BLOCK: {
       u64 v = eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.align.val, err);
       u64 a =
           eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.align.align, err);
       if (a == 0) return v;
       return ALIGN_UP(v, a);
     }
     case KIT_LE_REGION_ORIGIN: {
       const KitLinkRegion* r = script_find_region(l->script, e->v.name);
       if (!r) {
         compiler_panic(l->c, SRCLOC_NONE,
                        "linker script: unknown MEMORY region '%.*s'",
                        SLICE_ARG(e->v.name));
       }
       return r->origin;
     }
     case KIT_LE_REGION_LENGTH: {
       const KitLinkRegion* r = script_find_region(l->script, e->v.name);
       if (!r) {
         compiler_panic(l->c, SRCLOC_NONE,
                        "linker script: unknown MEMORY region '%.*s'",
                        SLICE_ARG(e->v.name));
       }
       return r->length;
     }
     case KIT_LE_ADDR: {
       const ScriptOutInfo* info = script_find_out(outs, nouts, e->v.name);
       if (!info)
         compiler_panic(l->c, SRCLOC_NONE,
                        "linker script: ADDR of unknown output section '%.*s'",
                        SLICE_ARG(e->v.name));
       return info->vma;
     }
     case KIT_LE_LOADADDR: {
       const ScriptOutInfo* info = script_find_out(outs, nouts, e->v.name);
       if (!info)
         compiler_panic(
             l->c, SRCLOC_NONE,
             "linker script: LOADADDR of unknown output section '%.*s'",
             SLICE_ARG(e->v.name));
       return info->lma;
     }
     case KIT_LE_SIZEOF: {
       const ScriptOutInfo* info = script_find_out(outs, nouts, e->v.name);
       if (!info)
         compiler_panic(l->c, SRCLOC_NONE,
                        "linker script: SIZEOF of unknown output section '%.*s'",
                        SLICE_ARG(e->v.name));
       return info->size;
     }
     case KIT_LE_SIZEOF_HEADERS:
       return script_sizeof_headers(l);
     case KIT_LE_DEFINED: {
       Sym name = pool_intern_slice(l->c->global, e->v.name);
       LinkSymId id = symhash_get(&img->globals, name);
       const LinkSymbol* s =
           (id != LINK_SYM_NONE) ? LinkSyms_at(&img->syms, id - 1) : NULL;
       return (s && s->defined) ? 1u : 0u;
     }
     case KIT_LE_ABSOLUTE:
       return eval_link_expr_rec(l, img, dot, outs, nouts, depth + 1, e->v.align.val, err);
     default:
       compiler_panic(l->c, SRCLOC_NONE,
                      "linker script: expression kind %u not supported",
                      (unsigned)e->kind);
       return 0;
   }
 }
 
 /* Depth-tracked entry point: callers evaluate from depth 0. */
 static u64 eval_link_expr(Linker* l, LinkImage* img, u64 dot,
                           const ScriptOutInfo* outs, u32 nouts,
                           const KitLinkExpr* e, int* err) {
   return eval_link_expr_rec(l, img, dot, outs, nouts, 0, e, err);
 }
 
 /* Set a segment's phdr attributes (type/filehdr/phdrs/flags) from the named
  * PHDRS entry `name`. Panics if the name is unknown. `dot`/`outs`/`nouts` are
  * forwarded to the FLAGS() expression evaluation. */
 static void script_apply_phdr(Linker* l, LinkImage* img,
                               const KitLinkScript* script, LinkSegment* seg,
                               KitSlice name, u64 dot, const ScriptOutInfo* outs,
                               u32 nouts) {
   const KitLinkPhdr* ph = script_find_phdr(script, name);
   if (!ph)
     compiler_panic(l->c, SRCLOC_NONE, "linker script: unknown PHDR '%.*s'",
                    SLICE_ARG(name));
   seg->phdr_type = ph->type;
   seg->phdr_filehdr = ph->filehdr ? 1u : 0u;
   seg->phdr_phdrs = ph->phdrs ? 1u : 0u;
   if (ph->flags) {
     int err = 0;
     seg->phdr_flags = (u32)eval_link_expr(l, img, dot, outs, nouts, ph->flags,
                                           &err);
     if (err)
       compiler_panic(l->c, SRCLOC_NONE,
                      "linker script: invalid PHDR FLAGS for '%.*s'",
                      SLICE_ARG(ph->name));
     seg->phdr_flags_set = 1u;
   }
 }
 
 /* Format-aware C-symbol mangling for linker-synthesized boundaries. */
 static Sym boundary_name(Linker* l, const char* name) {
   return obj_format_c_mangle(l->c, name);
 }
 
 /* Upsert a global boundary symbol. Satisfies any prior undef ref in place; fans
  * out to per-input duplicate name slots. `section_id` is LINK_SEC_NONE for
  * absolute boundaries, or the owning LinkSectionId for boundaries that must
  * follow a format-specific section relayout. */
 static void link_emit_boundary_sym_ex(Linker* l, LinkImage* img,
                                       const char* name, u64 vaddr,
                                       LinkSectionId section_id, u64 value) {
   Sym sym = boundary_name(l, name);
   LinkSymId id = symhash_get(&img->globals, sym);
   LinkSymId canonical_id = id;
   LinkSymbol rec;
   u8 kind = SK_OBJ;
   int fmt_kind;
   u32 i, n;
   /* Some formats own specific boundary symbols with a fixed SymKind
    * (PE/COFF `__ImageBase` / `_tls_used` are SK_ABS). Ask the format
    * instead of matching names here. */
   if (obj_format_boundary_sym_kind(l->c, slice_from_cstr(name), &fmt_kind))
     kind = (u8)fmt_kind;
   memset(&rec, 0, sizeof(rec));
   rec.name = sym;
   rec.kind = kind;
   rec.defined = 1;
   rec.section_id = section_id;
   rec.value = value;
   rec.vaddr = vaddr;
   rec.bind = SB_GLOBAL;
   if (id != LINK_SYM_NONE) {
     *LinkSyms_at(&img->syms, id - 1) = rec;
     LinkSyms_at(&img->syms, id - 1)->id = id;
   } else {
     LinkSymId fresh = link_append_symbol(img, &rec);
     symhash_insert(&img->globals, sym, fresh, &id);
     canonical_id = fresh;
   }
   n = LinkSyms_count(&img->syms);
   for (i = 0; i < n; ++i) {
     LinkSymbol* s = LinkSyms_at(&img->syms, i);
     if (s->name != sym) continue;
     if (s->id == canonical_id) continue;
     if (s->bind == SB_LOCAL) continue;
     s->section_id = section_id;
     s->value = value;
     s->vaddr = vaddr;
     s->kind = kind;
     s->defined = 1;
     s->imported = 0;
   }
 }
 
 void link_emit_boundary_sym(Linker* l, LinkImage* img, const char* name,
                             u64 vaddr) {
   link_emit_boundary_sym_ex(l, img, name, vaddr, LINK_SEC_NONE, 0);
 }
 
 void link_emit_section_boundary_sym(Linker* l, LinkImage* img, const char* name,
                                     LinkSectionId section_id, u64 value) {
   const LinkSection* sec;
   u64 vaddr;
   if (section_id == LINK_SEC_NONE || section_id > img->nsections)
     compiler_panic(img->c, SRCLOC_NONE,
                    "link: boundary symbol '%.*s' has no containing section",
                    SLICE_ARG(slice_from_cstr(name)));
   sec = &img->sections[section_id - 1];
   vaddr = sec->vaddr + (value - sec->obj_offset);
   link_emit_boundary_sym_ex(l, img, name, vaddr, section_id, value);
 }
 
 /* link_define_boundary: public alias used by link_dyn.c. */
 void link_define_boundary(Linker* l, LinkImage* img, const char* name,
                           u64 vaddr) {
   link_emit_boundary_sym(l, img, name, vaddr);
 }
 
 /* Upsert a global symbol (mirror of emit_boundary_sym, used by apply_asn). */
 static void upsert_global_sym(Linker* l, LinkImage* img, KitSlice name,
                               u64 vaddr) {
   /* Script sym slices are arena-interned and NUL-terminated; the boundary
    * emitter mangles via obj_format_c_mangle which needs a C string. */
   link_emit_boundary_sym(l, img, name.s, vaddr);
 }
 
 /* Apply one KitLinkAssignment. */
 static int script_symbol_defined(Linker* l, LinkImage* img, KitSlice name) {
   Sym sym;
   LinkSymId id;
   const LinkSymbol* s;
   if (!name.s) return 0;
   sym = pool_intern_slice(l->c->global, name);
   id = symhash_get(&img->globals, sym);
   if (id == LINK_SYM_NONE) return 0;
   s = LinkSyms_at(&img->syms, id - 1);
   return s && s->defined;
 }
 
 static void apply_asn(Linker* l, LinkImage* img, u64* dot,
                       const ScriptOutInfo* outs, u32 nouts,
                       const KitLinkAssignment* asn) {
   int err = 0;
   u64 v = eval_link_expr(l, img, *dot, outs, nouts, asn->expr, &err);
   if (err) return;
   switch ((KitLinkAsnKind)asn->kind) {
     case KIT_LAS_DOT:
       if (v < *dot)
         compiler_panic(l->c, SRCLOC_NONE,
                        "linker script: dot moved backwards (%llu -> %llu)",
                        (unsigned long long)*dot, (unsigned long long)v);
       *dot = v;
       break;
     case KIT_LAS_SYM:
     case KIT_LAS_HIDDEN:
       if (asn->sym.s) upsert_global_sym(l, img, asn->sym, v);
       break;
     case KIT_LAS_PROVIDE:
     case KIT_LAS_PROVIDE_HIDDEN:
       if (asn->sym.s && !script_symbol_defined(l, img, asn->sym))
         upsert_global_sym(l, img, asn->sym, v);
       break;
   }
 }
 
 /* Apply every KIT_LAS_DOT top-level assignment whose textual `seq` is below
  * `seq_limit` and that has not yet been applied (tracked by *cursor), so the
  * location counter advances at the assignment's source position. top_asns is
  * already in textual order, so a single forward cursor suffices. Non-DOT
  * top-level assignments (symbol defs / PROVIDE) are applied in a later pass
  * once all section addresses are known. */
 static void apply_dot_asns_before(Linker* l, LinkImage* img, u64* dot,
                                   const ScriptOutInfo* outs, u32 nouts,
                                   const KitLinkScript* script, u32* cursor,
                                   u32 seq_limit) {
   while (*cursor < script->ntop_asns &&
          script->top_asns[*cursor].seq < seq_limit) {
     const KitLinkAssignment* a = &script->top_asns[*cursor];
     if (a->kind == KIT_LAS_DOT) apply_asn(l, img, dot, outs, nouts, a);
     ++*cursor;
   }
 }
 
 static const char* link_basename(const char* s) {
   const char* base = s;
   if (!s) return NULL;
   for (; *s; ++s)
     if (*s == '/' || *s == '\\') base = s + 1;
   return base;
 }
 
 static int input_match_file(Linker* l, u32 ii, const KitLinkInputMatch* m) {
   const LinkInput* in;
   Slice name = SLICE_NULL;
   const char* full;
   const char* base;
   u32 i;
   if (!m->file_pattern.s && m->nexclude_file_patterns == 0) return 1;
   if (ii >= LinkInputs_count(&l->inputs)) return 0;
   in = LinkInputs_at(&l->inputs, ii);
   if (in->name) name = pool_slice(l->c->global, in->name);
   full = name.s;
   base = link_basename(full);
   if (m->file_pattern.s) {
     if (!full) return 0;
     if (!match_glob(m->file_pattern.s, full) &&
         !match_glob(m->file_pattern.s, base))
       return 0;
   }
   for (i = 0; i < m->nexclude_file_patterns; ++i) {
     const char* pat = m->exclude_file_patterns[i].s;
     if (!pat || !full) continue;
     if (match_glob(pat, full) || match_glob(pat, base)) return 0;
   }
   return 1;
 }
 
 static int input_match_section(Linker* l, u32 ii, const KitLinkInputMatch* m,
                                const char* nm) {
   /* section_pattern is an arena-interned, NUL-terminated span of the
    * script text; match_glob scans it as a C string. */
   return input_match_file(l, ii, m) && match_glob(m->section_pattern.s, nm);
 }
 
 /* Fill `n` bytes of `dst` with the linker-script FILL pattern. GNU ld lays a
  * fill value down as a big-endian byte pattern of `width` bytes (the value's
  * significant byte count; default 4) repeated across the region. The pattern
  * is phase-aligned to the start of the buffer, so gaps anywhere in a section
  * see a consistent repeat. width is clamped to [1,8]. */
 static void script_pattern_fill(u8* dst, size_t n, u64 value, u32 width) {
   size_t i;
   u8 pat[8];
   u32 w = width ? (width > 8u ? 8u : width) : 1u;
   u32 b;
   /* big-endian: most-significant of the `w` low bytes first */
   for (b = 0; b < w; ++b)
     pat[b] = (u8)(value >> (8u * (w - 1u - b)));
   for (i = 0; i < n; ++i) dst[i] = pat[i % w];
 }
 
 static u32 script_output_input_align(Linker* l, LinkImage* img,
                                      const GcLive* g,
                                      const KitLinkOutputSection* os,
                                      u8** claimed) {
   u32 align_max = 1;
   u32 mi, ii, j;
   for (mi = 0; mi < os->ninputs; ++mi) {
     const KitLinkInputMatch* im = &os->inputs[mi];
     for (ii = 0; ii < LinkInputs_count(&l->inputs); ++ii) {
       ObjBuilder* ob = LinkInputs_at(&l->inputs, ii)->obj;
       InputMap* m = &img->input_maps[ii];
       for (j = 1; j < obj_section_count(ob); ++j) {
         const Section* s;
         const char* nm;
         u32 align;
         if (claimed[ii][j]) continue;
         if (m->comdat_discarded[j]) continue;
         s = obj_section_get(ob, j);
         if (!s || !link_section_kept(s)) continue;
         nm = pool_slice(l->c->global, s->name).s;
         if (!nm) continue;
         if (!input_match_section(l, ii, im, nm)) continue;
         if (!live_section_units(g, m, ii, ob, j)) continue;
         align = s->align ? s->align : 1u;
         if (align > align_max) align_max = align;
       }
     }
   }
   return align_max;
 }
 
 static void link_layout_sections_scripted(Linker* l, LinkImage* img,
                                           const GcLive* g) {
   Heap* h = img->heap;
   const KitLinkScript* script = l->script;
   u64 dot = 0;
   u64 file_cursor = 0;
   u32 ii, j, k, si;
   u32 total_kept = 0;
 
   img->scripted = 1;
   validate_script_target(l, script);
 
   for (ii = 0; ii < LinkInputs_count(&l->inputs); ++ii) {
     ObjBuilder* ob = LinkInputs_at(&l->inputs, ii)->obj;
     InputMap* m = &img->input_maps[ii];
     for (j = 1; j < obj_section_count(ob); ++j) {
       const Section* s = obj_section_get(ob, j);
       if (s && link_section_kept(s) && !m->comdat_discarded[j])
         total_kept += live_section_units(g, m, ii, ob, j);
     }
   }
 
   img->sections = total_kept ? (LinkSection*)h->alloc(
                                    h, sizeof(*img->sections) * total_kept,
                                    _Alignof(LinkSection))
                              : NULL;
   if (total_kept && !img->sections)
     compiler_panic(img->c, SRCLOC_NONE, "link: oom on sections");
 
   u8** claimed = NULL;
   ScriptOutInfo* outs = NULL;
   u64* region_cursor = NULL;
   u64* load_region_cursor = NULL;
   if (LinkInputs_count(&l->inputs)) {
     u32 ni = LinkInputs_count(&l->inputs);
     claimed = (u8**)h->alloc(h, sizeof(*claimed) * ni, _Alignof(u8*));
     if (!claimed) compiler_panic(img->c, SRCLOC_NONE, "link: oom on claim map");
     for (ii = 0; ii < ni; ++ii) {
       ObjBuilder* ob = LinkInputs_at(&l->inputs, ii)->obj;
       u32 nsec = obj_section_count(ob);
       claimed[ii] = (u8*)h->alloc(h, nsec, 1);
       if (!claimed[ii])
         compiler_panic(img->c, SRCLOC_NONE, "link: oom on claim row");
       memset(claimed[ii], 0, nsec);
     }
   }
   if (script->nsections) {
     outs = (ScriptOutInfo*)h->alloc(h, sizeof(*outs) * script->nsections,
                                     _Alignof(ScriptOutInfo));
     if (!outs) compiler_panic(img->c, SRCLOC_NONE, "link: oom on script map");
     memset(outs, 0, sizeof(*outs) * script->nsections);
   }
   if (script->nregions) {
     region_cursor =
         (u64*)h->alloc(h, sizeof(*region_cursor) * script->nregions,
                        _Alignof(u64));
     load_region_cursor =
         (u64*)h->alloc(h, sizeof(*load_region_cursor) * script->nregions,
                        _Alignof(u64));
     if (!region_cursor || !load_region_cursor)
       compiler_panic(img->c, SRCLOC_NONE, "link: oom on region cursors");
     for (ii = 0; ii < script->nregions; ++ii) {
       region_cursor[ii] = script->regions[ii].origin;
       load_region_cursor[ii] = script->regions[ii].origin;
     }
   }
 
   /* Inter-section dot assignments (`. = ALIGN(N)` / `. = expr` written
    * between two output sections) must advance the location counter at their
    * textual position. top_asns and sections each carry a shared `seq`; walk
    * the DOT assignments in seq order, applying those that precede the next
    * section right before that section is laid out. dot_cursor tracks the
    * next unapplied top_asn. */
   u32 dot_cursor = 0;
 
   /* Upper bound on segments: each non-discard section contributes at least
    * one, plus one per *additional* :phdr it names (a section listing several
    * phdrs appears under each as its own program header). Coalescing sections
    * that share a phdr only reduces the count, so this stays an upper bound. */
   u32 nseg_max = 0;
   for (si = 0; si < script->nsections; ++si) {
     const KitLinkOutputSection* os_ = &script->sections[si];
     if (slice_eq_cstr(os_->name, "/DISCARD/")) continue;
     nseg_max += os_->nphdrs ? os_->nphdrs : 1u;
   }
   img->segments =
       nseg_max ? (LinkSegment*)h->alloc(h, sizeof(*img->segments) * nseg_max,
                                         _Alignof(LinkSegment))
                : NULL;
   img->segment_bytes =
       nseg_max ? (u8**)h->alloc(h, sizeof(*img->segment_bytes) * nseg_max,
                                 _Alignof(u8*))
                : NULL;
   img->segment_bytes_cap =
       nseg_max
           ? (size_t*)h->alloc(h, sizeof(*img->segment_bytes_cap) * nseg_max,
                               _Alignof(size_t))
           : NULL;
   if (nseg_max &&
       (!img->segments || !img->segment_bytes || !img->segment_bytes_cap))
     compiler_panic(img->c, SRCLOC_NONE, "link: oom on segments");
   if (nseg_max) {
     memset(img->segment_bytes, 0, sizeof(*img->segment_bytes) * nseg_max);
     memset(img->segment_bytes_cap, 0,
            sizeof(*img->segment_bytes_cap) * nseg_max);
   }
 
   /* Per-segment primary :phdr name (parallel to img->segments while we build
    * it); a new section naming the same phdr as the currently-open segment and
    * vaddr-contiguous with it coalesces into that one PT_LOAD. Kept local — no
    * LinkSegment field needed. open_seg is the index of the coalescable open
    * segment, or (u32)-1 when none can be extended. */
   KitSlice* seg_phdr_name = NULL;
   u32 open_seg = (u32)-1;
   if (nseg_max) {
     seg_phdr_name =
         (KitSlice*)h->alloc(h, sizeof(*seg_phdr_name) * nseg_max,
                             _Alignof(KitSlice));
     if (!seg_phdr_name)
       compiler_panic(img->c, SRCLOC_NONE, "link: oom on segment phdr names");
     memset(seg_phdr_name, 0, sizeof(*seg_phdr_name) * nseg_max);
   }
 
   for (si = 0; si < script->nsections; ++si) {
     const KitLinkOutputSection* os = &script->sections[si];
     int is_discard = slice_eq_cstr(os->name, "/DISCARD/");
     /* Apply any inter-section dot assignments that textually precede this
      * output section before placing it. */
     apply_dot_asns_before(l, img, &dot, outs, script->nsections, script,
                           &dot_cursor, os->seq);
     if (outs) outs[si].name = os->name;
 
     if (is_discard) {
       u32 mi;
       for (mi = 0; mi < os->ninputs; ++mi) {
         const KitLinkInputMatch* im = &os->inputs[mi];
         for (ii = 0; ii < LinkInputs_count(&l->inputs); ++ii) {
           ObjBuilder* ob = LinkInputs_at(&l->inputs, ii)->obj;
           for (j = 1; j < obj_section_count(ob); ++j) {
             const Section* s;
             const char* nm;
             if (claimed[ii][j]) continue;
             s = obj_section_get(ob, j);
             if (!s) continue;
             {
               nm = pool_slice(l->c->global, s->name).s;
             }
             if (!nm) continue;
             if (input_match_section(l, ii, im, nm)) claimed[ii][j] = 1;
           }
         }
       }
       continue;
     }
 
     u64 sec_start_dot;
     u64 lma_start;
     u64 subalign_val = 0;
     /* GNU ld fill: a big-endian byte pattern repeated across gaps; a plain
      * integer FILL value is 4 bytes wide. fill_value carries the full value;
      * fill_width its significant byte count (default 4). */
     u64 fill_value = 0;
     u32 fill_width = 4;
     u32 perms = 0;
     LinkSegmentId seg_id = (LinkSegmentId)(img->nsegments + 1u);
     LinkSegment* seg;
     u64 file_size_accum = 0;
     u64 mem_size_accum = 0;
     u32 align_max = 1;
     u32 nsec_in_seg = 0;
     u32 first_section_idx = img->nsections;
     u32 region_idx = 0;
     u32 load_region_idx = 0;
     int has_region = 0;
     int has_load_region = 0;
 
     if (os->region.s) {
       has_region = script_region_index(script, os->region, &region_idx);
       if (!has_region)
         compiler_panic(l->c, SRCLOC_NONE,
                        "linker script: unknown MEMORY region '%.*s'",
                        SLICE_ARG(os->region));
     }
     if (os->load_region.s) {
       has_load_region =
           script_region_index(script, os->load_region, &load_region_idx);
       if (!has_load_region)
         compiler_panic(l->c, SRCLOC_NONE,
                        "linker script: unknown load MEMORY region '%.*s'",
                        SLICE_ARG(os->load_region));
     }
 
     align_max = script_output_input_align(l, img, g, os, claimed);
     if (os->vma) {
       int err = 0;
       dot = eval_link_expr(l, img, dot, outs, script->nsections, os->vma, &err);
       if (err)
         compiler_panic(l->c, SRCLOC_NONE,
                        "linker script: invalid VMA expression for '%.*s'",
                        SLICE_ARG(os->name));
     } else if (has_region) {
       dot = region_cursor[region_idx];
     }
     dot = ALIGN_UP(dot, (u64)align_max);
     if (os->subalign) {
       int err = 0;
       subalign_val =
           eval_link_expr(l, img, dot, outs, script->nsections, os->subalign,
                          &err);
       if (err)
         compiler_panic(l->c, SRCLOC_NONE,
                        "linker script: invalid SUBALIGN for '%.*s'",
                        SLICE_ARG(os->name));
     }
     if (os->fill) {
       int err = 0;
       u64 fv =
           eval_link_expr(l, img, dot, outs, script->nsections, os->fill, &err);
       if (err)
         compiler_panic(l->c, SRCLOC_NONE,
                        "linker script: invalid fill expression for '%.*s'",
                        SLICE_ARG(os->name));
       fill_value = fv;
     }
     /* Body command 0: the injected `: ALIGN(N)` header (if any) sets the
      * section base before any content is placed. Apply only body_seq-0
      * assignments here, then capture sec_start_dot. The remaining body
      * commands (input-section globs and interior `sym = .` / `. = expr`
      * assignments) execute below in true source order. */
     for (k = 0; k < os->nasns; ++k) {
       if (os->asns[k].body_seq == 0)
         apply_asn(l, img, &dot, outs, script->nsections, &os->asns[k]);
     }
     sec_start_dot = dot;
 
     /* Interleave input-section placement and interior assignments by their
      * source-order body_seq. GNU ld executes section-body commands in order,
      * so a `sym = .` after a `*(.data*)` glob captures `.` AFTER the glob's
      * content, and a `. = ALIGN(N)` after the last glob extends the section.
      * Both os->asns (body_seq >= 1) and os->inputs are stamped in ascending
      * source order, so a single forward cursor over each suffices. */
     {
       u32 ak = 0;
       u32 mi = 0;
       /* Skip past the body_seq-0 header assignments already applied above. */
       while (ak < os->nasns && os->asns[ak].body_seq == 0) ++ak;
       for (;;) {
         int have_asn = ak < os->nasns;
         int have_in = mi < os->ninputs;
         if (!have_asn && !have_in) break;
         /* Apply the assignment whose body_seq is strictly before the next
          * pending input command (or all trailing assignments when no inputs
          * remain). */
         if (have_asn &&
             (!have_in || os->asns[ak].body_seq < os->inputs[mi].body_seq)) {
           apply_asn(l, img, &dot, outs, script->nsections, &os->asns[ak]);
           /* A `. = expr` that advances dot past the placed content extends the
            * section span (GNU ld grows the output section to the new dot). The
            * gap also becomes interior file padding when it follows emitted
            * PROGBITS bytes in a loadable section (file_size_accum already
            * nonzero); a gap before any file content stays bss-like. */
           if (dot - sec_start_dot > mem_size_accum)
             mem_size_accum = dot - sec_start_dot;
           if (!os->noload && file_size_accum &&
               dot - sec_start_dot > file_size_accum)
             file_size_accum = dot - sec_start_dot;
           ++ak;
           continue;
         }
         {
           const KitLinkInputMatch* im = &os->inputs[mi];
           for (ii = 0; ii < LinkInputs_count(&l->inputs); ++ii) {
             ObjBuilder* ob = LinkInputs_at(&l->inputs, ii)->obj;
             InputMap* m = &img->input_maps[ii];
             for (j = 1; j < obj_section_count(ob); ++j) {
               const Section* s;
               const char* nm;
               u32 align;
               u32 first = 0, count = 1, ai;
               int has_atoms;
               if (claimed[ii][j]) continue;
               if (m->comdat_discarded[j]) continue;
               s = obj_section_get(ob, j);
               if (!s || !link_section_kept(s)) continue;
               {
                 nm = pool_slice(l->c->global, s->name).s;
               }
               if (!nm) continue;
               if (!input_match_section(l, ii, im, nm)) continue;
 
               align =
                   subalign_val ? (u32)subalign_val : (s->align ? s->align : 1u);
               has_atoms = link_input_section_has_atoms(m, j);
               if (has_atoms) link_input_section_atoms(m, j, &first, &count);
               for (ai = 0; ai < count; ++ai) {
                 ObjAtomId aid =
                     has_atoms ? m->section_atom_ids[first + ai] : OBJ_ATOM_NONE;
                 const ObjAtom* atom = has_atoms ? obj_atom_get(ob, aid) : NULL;
                 u64 ofs;
                 LinkSection* ls;
                 LinkSectionId lsid;
                 u64 obj_offset;
                 u64 size;
                 if (has_atoms) {
                   if (!atom || atom->removed) continue;
                   if (!link_gc_atom_live_get(g, ii, aid)) continue;
                   obj_offset = atom->offset;
                   size = atom->size;
                 } else if (!link_gc_live_get(g, ii, j)) {
                   continue;
                 } else {
                   obj_offset = 0u;
                   size = link_section_size_for_link(s);
                 }
                 if (align > align_max) align_max = align;
                 dot = ALIGN_UP(dot, (u64)align);
                 ofs = dot;
 
                 lsid = (LinkSectionId)(img->nsections + 1u);
                 ls = &img->sections[img->nsections++];
                 memset(ls, 0, sizeof(*ls));
                 ls->id = lsid;
                 ls->input_id = LinkInputs_at(&l->inputs, ii)->id;
                 ls->obj_section_id = j;
                 ls->obj_atom_id = aid;
                 ls->segment_id = seg_id;
                 ls->obj_offset = obj_offset;
                 ls->vaddr = ofs;
                 ls->size = size;
                 ls->flags = s->flags;
                 ls->align = align;
                 ls->name = s->name;
                 /* A (NOLOAD) output section produces no file bytes regardless
                  * of the input section's PROGBITS/NOBITS semantics: mark every
                  * placed unit NOBITS so the byte-copy
                  * (link_emit_segment_bytes) and the segment shape below both
                  * treat it as bss. */
                 ls->sem = (os->noload || s->kind == SEC_BSS) ? SSEM_NOBITS
                                                              : s->sem;
                 ls->file_offset = ofs - sec_start_dot;
                 ls->input_offset = ls->file_offset;
                 map_placed_unit(m, j, aid, lsid);
 
                 dot += ls->size;
                 mem_size_accum = dot - sec_start_dot;
                 if (!os->noload && ls->sem != SSEM_NOBITS)
                   file_size_accum = dot - sec_start_dot;
                 perms |= (s->flags & (SF_EXEC | SF_WRITE | SF_TLS));
                 ++nsec_in_seg;
               }
               claimed[ii][j] = 1;
             }
           }
           ++mi;
         }
       }
     }
 
     if (os->lma) {
       int err = 0;
       lma_start =
           eval_link_expr(l, img, dot, outs, script->nsections, os->lma, &err);
       if (err)
         compiler_panic(l->c, SRCLOC_NONE,
                        "linker script: invalid AT() expression for '%.*s'",
                        SLICE_ARG(os->name));
     } else if (has_load_region) {
       lma_start = ALIGN_UP(load_region_cursor[load_region_idx],
                            (u64)(align_max ? align_max : 1u));
       load_region_cursor[load_region_idx] = lma_start + file_size_accum;
     } else {
       lma_start = sec_start_dot;
       if (has_region && load_region_cursor) {
         u64 lend = lma_start + file_size_accum;
         if (lend > load_region_cursor[region_idx])
           load_region_cursor[region_idx] = lend;
       }
     }
 
     if (has_region) {
       const KitLinkRegion* r = &script->regions[region_idx];
       u64 end = dot;
       /* Bug 3: a section spanning [sec_start_dot, end) fits region r iff
        * sec_start_dot >= origin and (end - origin) <= length. Compute the
        * end-fits test by subtraction, never `origin + length`, which wraps to
        * 0 for a canonical high-half region (e.g. ORIGIN=0xFFFFFFFF80000000,
        * LENGTH=0x80000000) and would falsely flag a legal placement. */
       if (sec_start_dot < r->origin || end < r->origin ||
           end - r->origin > r->length)
         compiler_panic(
             l->c, SRCLOC_NONE,
             "linker script: section '%.*s' overflows MEMORY region '%.*s'",
             SLICE_ARG(os->name), SLICE_ARG(r->name));
       region_cursor[region_idx] = end;
     }
     if (has_load_region && file_size_accum) {
       const KitLinkRegion* r = &script->regions[load_region_idx];
       u64 lend = lma_start + file_size_accum;
       /* Bug 3: same wrap-safe form for the load image [lma_start, lend). */
       if (lma_start < r->origin || lend < r->origin ||
           lend - r->origin > r->length)
         compiler_panic(
             l->c, SRCLOC_NONE,
             "linker script: load image for '%.*s' overflows MEMORY region "
             "'%.*s'",
             SLICE_ARG(os->name), SLICE_ARG(r->name));
     }
     if (outs) {
       outs[si].vma = sec_start_dot;
       outs[si].lma = lma_start;
       outs[si].size = mem_size_accum;
       outs[si].defined = 1;
     }
 
     if (nsec_in_seg == 0) {
       continue;
     }
 
     /* (a) Coalesce: if this section's PRIMARY :phdr matches the currently-open
      * segment and the section is vaddr-contiguous with it, extend that segment
      * into one PT_LOAD instead of opening a new one. A section listing several
      * phdrs may still coalesce its primary here; its additional phdrs become
      * alias program headers below covering just this section's range. FLAGS()
      * / AT() seal a segment (they override the geometry) and never coalesce. */
     KitSlice primary_phdr = os->nphdrs ? os->phdrs[0] : KIT_SLICE_NULL;
     int can_coalesce =
         open_seg != (u32)-1 && primary_phdr.s && seg_phdr_name[open_seg].s &&
         slice_eq(seg_phdr_name[open_seg], primary_phdr) &&
         sec_start_dot == img->segments[open_seg].vaddr +
                              img->segments[open_seg].mem_size &&
         /* Bug 1: never coalesce onto an open segment that ends in an internal
          * NOBITS (bss) tail. Coalescing packs the follower's file bytes
          * file-contiguously (after oseg->file_size) while it keeps its
          * mem-contiguous vaddr; with file_size < mem_size that skews the
          * follower's loaded bytes down by the tail size. Falling through to
          * the else branch opens a correct, separate page-aligned PT_LOAD. */
         img->segments[open_seg].file_size ==
             img->segments[open_seg].mem_size &&
         !os->lma && !os->flags;
 
     /* Per-section file geometry (used by both the primary placement and the
      * alias program headers, which describe only this section's range). */
     u64 this_file_off;
     u64 this_vaddr = sec_start_dot;
     u64 this_paddr = lma_start;
 
     if (can_coalesce) {
       LinkSegment* oseg = &img->segments[open_seg];
       u64 prev_file = oseg->file_size;
       u64 new_file = prev_file + file_size_accum;
       seg = oseg;
       this_file_off = seg->file_offset + prev_file;
       seg->mem_size += mem_size_accum;
       /* This section's bytes follow the open segment's directly (no page
        * break); rebase its LinkSections into the open segment. */
       {
         u32 fi;
         for (fi = first_section_idx; fi < img->nsections; ++fi) {
           LinkSection* ls = &img->sections[fi];
           ls->segment_id = seg->id;
           ls->file_offset = this_file_off + ls->file_offset;
         }
       }
       file_cursor += file_size_accum;
       if (file_size_accum && !l->jit_mode) {
         u8* grown = (u8*)h->realloc(h, img->segment_bytes[open_seg],
                                     img->segment_bytes_cap[open_seg],
                                     (size_t)new_file, 16);
         if (!grown)
           compiler_panic(img->c, SRCLOC_NONE,
                          "link: oom growing coalesced segment bytes");
         img->segment_bytes[open_seg] = grown;
         img->segment_bytes_cap[open_seg] = (size_t)new_file;
         script_pattern_fill(grown + prev_file, (size_t)file_size_accum,
                             fill_value, fill_width);
       }
       seg->file_size = new_file;
       seg->nsections += nsec_in_seg;
       /* Bug 2: a FLAGS-less PHDRS PT_LOAD maps p_flags from seg->flags
        * (perms_to_pflags); a coalesced PT_LOAD must carry the UNION of all its
        * mapped sections' perms (GNU-ld behavior), not just the first section's
        * (set once at segment creation). Union only the p_flags-relevant bits
        * (R/W/X) — a PT_LOAD's flags must never include SF_TLS, which the
        * emitter treats specially (p_memsz collapses to file_size for SF_TLS
        * segments); TLS sizing is owned by the dedicated PT_TLS segment.
        * (Defensive: the scripted layout does not currently route SF_TLS into a
        * coalesced section's perms, so this only narrows intent.) */
       seg->flags |= SF_ALLOC | (perms & (SF_EXEC | SF_WRITE));
     } else {
       seg = &img->segments[img->nsegments];
       memset(seg, 0, sizeof(*seg));
       seg->id = seg_id;
       seg->flags = SF_ALLOC | perms;
       seg->vaddr = sec_start_dot;
       seg->paddr = lma_start;
       file_cursor = ALIGN_UP(file_cursor, (u64)PAGE_SIZE);
       seg->file_offset = file_cursor;
       this_file_off = seg->file_offset;
       seg->mem_size = mem_size_accum;
       seg->file_size = file_size_accum;
       seg->align = align_max;
       seg->nsections = nsec_in_seg;
       /* Primary phdr names the segment's program-header attributes; the name
        * is recorded so a following same-phdr contiguous section coalesces. */
       if (os->nphdrs) {
         script_apply_phdr(l, img, script, seg, os->phdrs[0], dot, outs,
                           script->nsections);
         seg_phdr_name[img->nsegments] = os->phdrs[0];
       } else {
         seg_phdr_name[img->nsegments] = KIT_SLICE_NULL;
       }
       if (os->flags) {
         int err = 0;
         seg->phdr_flags =
             (u32)eval_link_expr(l, img, dot, outs, script->nsections,
                                 os->flags, &err);
         if (err)
           compiler_panic(l->c, SRCLOC_NONE,
                          "linker script: invalid FLAGS for section '%.*s'",
                          SLICE_ARG(os->name));
         seg->phdr_flags_set = 1u;
       }
       file_cursor += file_size_accum;
       if (file_size_accum && !l->jit_mode) {
         img->segment_bytes[img->nsegments] =
             (u8*)h->alloc(h, (size_t)file_size_accum, 16);
         if (!img->segment_bytes[img->nsegments])
           compiler_panic(img->c, SRCLOC_NONE,
                          "link: oom on scripted segment bytes");
         img->segment_bytes_cap[img->nsegments] = (size_t)file_size_accum;
         script_pattern_fill(img->segment_bytes[img->nsegments],
                             (size_t)file_size_accum, fill_value, fill_width);
       }
       {
         u32 fi;
         for (fi = first_section_idx; fi < img->nsections; ++fi) {
           LinkSection* ls = &img->sections[fi];
           ls->file_offset = seg->file_offset + (ls->file_offset);
         }
       }
       /* A primary segment (phdr-named, no FLAGS/AT) is coalescable by a
        * following same-phdr contiguous section. No-phdr / FLAGS / AT segments
        * are sealed (NULL name never matches a phdr-named follower, matching
        * the pre-coalesce per-section behavior). */
       open_seg = (os->nphdrs && !os->flags && !os->lma) ? img->nsegments
                                                         : (u32)-1;
       img->nsegments++;
     }
 
     /* (b) Each ADDITIONAL :phdr the section names yields an alias program
      * header covering only THIS section's vaddr/file range, with no byte
      * buffer of its own (the bytes are on disk via the primary; the ELF byte
      * writer skips NULL-buffer segments). */
     {
       u32 pi;
       for (pi = 1; pi < os->nphdrs; ++pi) {
         LinkSegment* aseg = &img->segments[img->nsegments];
         memset(aseg, 0, sizeof(*aseg));
         aseg->id = (LinkSegmentId)(img->nsegments + 1u);
         aseg->flags = SF_ALLOC | perms;
         aseg->vaddr = this_vaddr;
         aseg->paddr = this_paddr;
         aseg->file_offset = this_file_off;
         aseg->mem_size = mem_size_accum;
         aseg->file_size = file_size_accum;
         aseg->align = align_max;
         aseg->nsections = 0; /* aliases own no sections */
         script_apply_phdr(l, img, script, aseg, os->phdrs[pi], dot, outs,
                           script->nsections);
         seg_phdr_name[img->nsegments] = os->phdrs[pi];
         img->segment_bytes[img->nsegments] = NULL;
         img->segment_bytes_cap[img->nsegments] = 0;
         img->nsegments++;
       }
     }
   }
 
   /* Apply any trailing dot assignments after the last output section. */
   apply_dot_asns_before(l, img, &dot, outs, script->nsections, script,
                         &dot_cursor, UINT32_MAX);
 
   for (k = 0; k < script->ntop_asns; ++k) {
     const KitLinkAssignment* a = &script->top_asns[k];
     if (a->kind != KIT_LAS_DOT)
       apply_asn(l, img, &dot, outs, script->nsections, a);
   }
 
   for (k = 0; k < script->nasserts; ++k) {
     int err = 0;
     u64 ok = eval_link_expr(l, img, dot, outs, script->nsections,
                             script->asserts[k].expr, &err);
     if (err || !ok) {
       KitSlice msg = script->asserts[k].message;
       compiler_panic(l->c, SRCLOC_NONE, "linker script ASSERT failed: %.*s",
                      SLICE_ARG(msg));
     }
   }
 
   if (claimed) {
     u32 ni = LinkInputs_count(&l->inputs);
     for (ii = 0; ii < ni; ++ii) {
       ObjBuilder* ob = LinkInputs_at(&l->inputs, ii)->obj;
       h->free(h, claimed[ii], obj_section_count(ob));
     }
     h->free(h, claimed, sizeof(*claimed) * ni);
   }
   if (outs) h->free(h, outs, sizeof(*outs) * script->nsections);
   if (seg_phdr_name)
     h->free(h, seg_phdr_name, sizeof(*seg_phdr_name) * nseg_max);
   if (region_cursor)
     h->free(h, region_cursor, sizeof(*region_cursor) * script->nregions);
   if (load_region_cursor)
     h->free(h, load_region_cursor,
             sizeof(*load_region_cursor) * script->nregions);
 }
 
 /* ---- pass 2b: COMMON symbol BSS allocation ---- */
 
 void link_layout_commons(Linker* l, LinkImage* img) {
   u32 i;
   (void)l;
   LinkSegment* rw_seg = NULL;
 
   for (i = 0; i < img->nsegments; ++i) {
     if (img->segments[i].flags & SF_WRITE) {
       rw_seg = &img->segments[i];
       break;
     }
   }
 
   {
     int has_common = 0;
     for (i = 0; i < LinkSyms_count(&img->syms); ++i)
       if (LinkSyms_at(&img->syms, i)->kind == SK_COMMON &&
           LinkSyms_at(&img->syms, i)->defined) {
         has_common = 1;
         break;
       }
     if (!has_common) return;
   }
 
   if (!rw_seg) {
     /* No writable PT_LOAD yet — synthesize a zero-size BSS segment for the
      * COMMON section. This is a NOBITS region (no byte buffer, file/mem
      * size grow with the section below), so it adopts only the array-
      * growth helper, not the fixed-size region builder. */
     u32 seg_idx = link_iplt_alloc_segments(img, 1u);
     u64 vaddr = 0;
     for (i = 0; i < img->nsegments; ++i) {
       u64 end = img->segments[i].vaddr + img->segments[i].mem_size;
       if (end > vaddr) vaddr = end;
     }
     vaddr = ALIGN_UP(vaddr, (u64)(link_layout_page_size(l)));
     rw_seg = &img->segments[seg_idx];
     memset(rw_seg, 0, sizeof(*rw_seg));
     rw_seg->id = (LinkSegmentId)(seg_idx + 1u);
     rw_seg->flags = SF_ALLOC | SF_WRITE;
     rw_seg->vaddr = vaddr;
     rw_seg->paddr = vaddr;
     rw_seg->file_offset = vaddr;
     rw_seg->file_size = 0;
     rw_seg->mem_size = 0;
     rw_seg->align = (u32)link_layout_page_size(l);
     img->segment_bytes[seg_idx] = NULL;
     img->segment_bytes_cap[seg_idx] = 0;
     img->nsegments++;
   }
 
   {
     Heap* h = img->heap;
     u64 bss_start = rw_seg->vaddr + rw_seg->mem_size;
     u64 bss_cursor = bss_start;
     u32 max_align = 1u;
     LinkSection* commsec;
     LinkSectionId comm_lsid;
 
     for (i = 0; i < LinkSyms_count(&img->syms); ++i) {
       LinkSymbol* s = LinkSyms_at(&img->syms, i);
       u32 align;
       if (s->kind != SK_COMMON || !s->defined) continue;
       align = s->common_align ? s->common_align : 1u;
       if (align > max_align) max_align = align;
       bss_cursor = ALIGN_UP(bss_cursor, (u64)(align));
       s->value = bss_cursor - bss_start;
       bss_cursor += s->size ? s->size : 1u;
     }
 
     {
       u32 new_nsec = img->nsections + 1u;
       LinkSection* nsec = (LinkSection*)h->realloc(
           h, img->sections, sizeof(*img->sections) * img->nsections,
           sizeof(*img->sections) * new_nsec, _Alignof(LinkSection));
       if (!nsec)
         compiler_panic(img->c, SRCLOC_NONE, "link: oom on common section");
       img->sections = nsec;
     }
     commsec = &img->sections[img->nsections];
     memset(commsec, 0, sizeof(*commsec));
     comm_lsid = (LinkSectionId)(img->nsections + 1u);
     commsec->id = comm_lsid;
     commsec->input_id = LINK_INPUT_NONE;
     commsec->obj_section_id = OBJ_SEC_NONE;
     commsec->segment_id = rw_seg->id;
     commsec->input_offset = 0;
     commsec->file_offset = bss_start;
     commsec->vaddr = bss_start;
     commsec->size = bss_cursor - bss_start;
     commsec->flags = SF_ALLOC | SF_WRITE;
     commsec->align = max_align;
     commsec->name = pool_intern_slice(img->c->global, SLICE_LIT(".bss.common"));
     commsec->sem = SSEM_NOBITS;
     img->nsections++;
 
     for (i = 0; i < LinkSyms_count(&img->syms); ++i) {
       LinkSymbol* s = LinkSyms_at(&img->syms, i);
       if (s->kind != SK_COMMON || !s->defined) continue;
       s->section_id = comm_lsid;
       s->vaddr = bss_start + s->value;
       s->kind = SK_OBJ;
     }
 
     rw_seg->mem_size = bss_cursor - rw_seg->vaddr;
     rw_seg->nsections++;
   }
 }
 
 /* Copy each input section's bytes into its segment buffer. */
 void link_emit_segment_bytes(Linker* l, LinkImage* img) {
   u32 j;
   (void)l;
   for (j = 0; j < img->nsections; ++j) {
     LinkSection* ls = &img->sections[j];
     ObjBuilder* ob;
     if (ls->input_id == LINK_INPUT_NONE) continue;
     ob = LinkInputs_at(&l->inputs, ls->input_id - 1)->obj;
     const Section* s = obj_section_get(ob, ls->obj_section_id);
     LinkSegment* seg = &img->segments[ls->segment_id - 1];
     u8* dst;
     /* ls->sem carries the OUTPUT-section decision (e.g. (NOLOAD) forces
      * NOBITS even for PROGBITS input), so check it too — the segment it
      * lives in has no file bytes to copy into. */
     if (!s || s->sem == SSEM_NOBITS || s->kind == SEC_BSS ||
         ls->sem == SSEM_NOBITS)
       continue;
     if (ls->size == 0) continue;
     dst = img->segment_bytes[seg->id - 1] +
           (size_t)(ls->file_offset - seg->file_offset);
     buf_read(&s->bytes, (u32)ls->obj_offset, dst, (size_t)ls->size);
   }
 }
 
 /* ---- pass 2c: file-only debug sections ----
  *
  * Carry every surviving .debug_* section through to the linked image as
  * a non-segment, file-resident LinkSection so addr2line / gdb resolve
  * file:line on the output.  Contributions of the same name are assigned
  * a per-name cumulative `vaddr` (the DWARF-section-relative base: 0 for
  * the first input, size0 for the second, …); the ELF emitter merges
  * same-name contributions into one output .debug_X section, and the
  * per-input base makes SK_SECTION cross-section R_ABS32 offsets land in
  * the merged section.  Each contribution keeps its own byte buffer in
  * the debug registry, with relocations applied in place at reloc-offset.
  *
  * Runs after link_emit_segment_bytes (so the segment-byte copy never
  * sees these segment-less sections) and before link_assign_symbol_vaddrs
  * (so the SK_SECTION debug symbols pick up their section_id + base). */
 
 /* Per-output-name cumulative base tracker. Debug section names are few
  * (.debug_info/.debug_line/.debug_abbrev/.debug_str/...), so a linear
  * scan is fine. */
 typedef struct DbgNameAcc {
   Sym name;
   u64 cum; /* running total size for this name */
 } DbgNameAcc;
 
 void link_layout_debug(Linker* l, LinkImage* img) {
   Heap* h = img->heap;
   u32 ii, j;
   u32 ndbg = 0;
 
   /* Pass 0: count surviving debug contributions. */
   for (ii = 0; ii < LinkInputs_count(&l->inputs); ++ii) {
     ObjBuilder* ob = LinkInputs_at(&l->inputs, ii)->obj;
     InputMap* m = &img->input_maps[ii];
     for (j = 1; j < obj_section_count(ob); ++j) {
       const Section* s = obj_section_get(ob, j);
       if (link_section_kept_fileonly(s) && !m->comdat_discarded[j] &&
           link_section_size_for_link(s) > 0)
         ++ndbg;
     }
   }
   if (ndbg == 0) return;
 
   /* Grow img->sections to hold the new file-only sections appended after
    * the existing allocatable + common sections. */
   {
     u32 new_nsec = img->nsections + ndbg;
     LinkSection* ns = (LinkSection*)h->realloc(
         h, img->sections, sizeof(*img->sections) * img->nsections,
         sizeof(*img->sections) * new_nsec, _Alignof(LinkSection));
     if (!ns) compiler_panic(img->c, SRCLOC_NONE, "link: oom on debug sections");
     img->sections = ns;
   }
 
   img->dbg_bytes =
       (u8**)h->alloc(h, sizeof(*img->dbg_bytes) * ndbg, _Alignof(u8*));
   img->dbg_size =
       (u64*)h->alloc(h, sizeof(*img->dbg_size) * ndbg, _Alignof(u64));
   DbgNameAcc* acc =
       (DbgNameAcc*)h->alloc(h, sizeof(*acc) * ndbg, _Alignof(DbgNameAcc));
   if (!img->dbg_bytes || !img->dbg_size || !acc)
     compiler_panic(img->c, SRCLOC_NONE, "link: oom on debug registry");
   memset(img->dbg_bytes, 0, sizeof(*img->dbg_bytes) * ndbg);
   memset(img->dbg_size, 0, sizeof(*img->dbg_size) * ndbg);
 
   img->dbg_first_lsid = (LinkSectionId)(img->nsections + 1u);
   img->dbg_count = 0;
   u32 nacc = 0;
 
   /* Pass 1: append one file-only LinkSection per contribution, assign
    * per-name cumulative base, and copy bytes into the registry. */
   for (ii = 0; ii < LinkInputs_count(&l->inputs); ++ii) {
     ObjBuilder* ob = LinkInputs_at(&l->inputs, ii)->obj;
     InputMap* m = &img->input_maps[ii];
     for (j = 1; j < obj_section_count(ob); ++j) {
       const Section* s = obj_section_get(ob, j);
       u32 size;
       u64 base;
       u32 ai, slot;
       LinkSection* ls;
       LinkSectionId lsid;
       u8* buf;
       if (!link_section_kept_fileonly(s) || m->comdat_discarded[j]) continue;
       size = link_section_size_for_link(s);
       if (size == 0) continue;
 
       /* Per-name cumulative base. */
       for (ai = 0; ai < nacc; ++ai)
         if (acc[ai].name == s->name) break;
       if (ai == nacc) {
         acc[nacc].name = s->name;
         acc[nacc].cum = 0;
         ai = nacc++;
       }
       base = acc[ai].cum;
       acc[ai].cum += size;
 
       slot = img->dbg_count;
       lsid = (LinkSectionId)(img->nsections + 1u);
       ls = &img->sections[img->nsections++];
       memset(ls, 0, sizeof(*ls));
       ls->id = lsid;
       ls->input_id = LinkInputs_at(&l->inputs, ii)->id;
       ls->obj_section_id = j;
       ls->obj_atom_id = OBJ_ATOM_NONE;
       ls->segment_id = LINK_SEG_NONE;
       ls->obj_offset = 0;
       ls->input_offset = 0;
       ls->file_offset = 0; /* assigned by the ELF emitter */
       ls->vaddr = base;    /* DWARF-section-relative base */
       ls->size = size;
       ls->flags = s->flags;
       ls->align = s->align ? s->align : 1u;
       ls->name = s->name;
       ls->sem = SSEM_PROGBITS;
       ls->file_only = 1u;
 
       /* Copy this contribution's bytes into its own registry buffer. */
       buf = (u8*)h->alloc(h, size, 1);
       if (!buf) compiler_panic(img->c, SRCLOC_NONE, "link: oom on debug bytes");
       buf_read(&s->bytes, 0u, buf, (size_t)size);
       img->dbg_bytes[slot] = buf;
       img->dbg_size[slot] = size;
       img->dbg_count++;
 
       /* Map the input's section id to this LinkSection so the SK_SECTION
        * debug symbol resolves (assign_symbol_vaddrs) and its relocations
        * route here (emit_relocations). */
       map_placed_unit(m, j, OBJ_ATOM_NONE, lsid);
     }
   }
 
   h->free(h, acc, sizeof(*acc) * ndbg);
 }
 
 u8* link_fileonly_bytes(LinkImage* img, LinkSectionId id) {
   if (!img || id == LINK_SEC_NONE || id < img->dbg_first_lsid) return NULL;
   {
     u32 idx = (u32)(id - img->dbg_first_lsid);
     if (idx >= img->dbg_count) return NULL;
     return img->dbg_bytes[idx];
   }
 }
 
 /* ---- linker flags, policy, and strict validation (kernel-C work) ----
  *
  * These run inside link_resolve after layout (so alias targets / section
  * vaddrs are known) and after symbol resolution (so dynamic-artifact and
  * cross-input checks see every input). They are deliberately self-contained
  * and only consult the borrowed option arrays plumbed onto the Linker. */
 
 /* Emit a non-fatal linker warning. With --fatal-warnings the warning is
  * promoted to a hard error (compiler_panic, which unwinds the link). */
 static void link_warn(Linker* l, const char* fmt, ...) {
   va_list ap;
   if (l->fatal_warnings) {
     va_start(ap, fmt);
     compiler_panicv(l->c, SRCLOC_NONE, fmt, ap);
     va_end(ap); /* unreachable; compiler_panicv is _Noreturn */
   }
   if (l->c && l->c->ctx && l->c->ctx->diag) {
     va_start(ap, fmt);
     diag_emitv(l->c->ctx->diag, DIAG_WARN, SRCLOC_NONE, fmt, ap);
     va_end(ap);
   }
 }
 
 /* --defsym: define each requested symbol. Two forms:
  *   NAME=0x1234    — an absolute symbol carrying the literal value verbatim.
  *   NAME=othersym  — an alias that resolves to othersym's address (+optional
  *                    bias). The alias copies the target's kind/section/value so
  *                    it rebases identically at emit (matching GNU ld, where the
  *                    alias takes the target's final address). Run after layout
  *                    and undef resolution so the target has a settled vaddr. */
 static void link_apply_defsyms(Linker* l, LinkImage* img) {
   u32 i;
   for (i = 0; i < l->ndefsyms; ++i) {
     const KitLinkDefsym* d = &l->defsyms[i];
     char namebuf[256];
     size_t nlen;
     Sym sym;
     LinkSymId existing;
     LinkSymbol rec;
     if (!d->name.s || d->name.len == 0) continue;
     nlen =
         d->name.len < sizeof(namebuf) - 1u ? d->name.len : sizeof(namebuf) - 1u;
     memcpy(namebuf, d->name.s, nlen);
     namebuf[nlen] = '\0';
     memset(&rec, 0, sizeof(rec));
     sym = pool_intern_slice(l->c->global, (Slice){.s = namebuf, .len = (u32)nlen});
     rec.name = sym;
     rec.bind = SB_GLOBAL;
     rec.defined = 1;
     if (d->alias.s && d->alias.len) {
       Sym tgt = pool_intern_slice(l->c->global,
                                   (Slice){.s = d->alias.s, .len = d->alias.len});
       LinkSymId tid = symhash_get(&img->globals, tgt);
       const LinkSymbol* t;
       if (tid == LINK_SYM_NONE) {
         compiler_panic(l->c, SRCLOC_NONE,
                        "link: --defsym '%s': undefined alias target '%.*s'",
                        namebuf, (int)d->alias.len, d->alias.s);
       }
       t = LinkSyms_at(&img->syms, tid - 1);
       /* Inherit the target's placement so the alias rebases identically. */
       rec.kind = t->kind;
       rec.section_id = t->section_id;
       rec.value = t->value;
       rec.vaddr = t->vaddr + d->value;
       rec.imported = t->imported;
       rec.dso_input_id = t->dso_input_id;
     } else {
       rec.kind = SK_ABS;
       rec.vaddr = d->value;
       rec.value = d->value;
     }
     existing = symhash_get(&img->globals, sym);
     if (existing != LINK_SYM_NONE) {
       rec.id = existing;
       *LinkSyms_at(&img->syms, existing - 1) = rec;
     } else {
       LinkSymId fresh = link_append_symbol(img, &rec);
       symhash_insert(&img->globals, sym, fresh, &existing);
     }
   }
 }
 
 /* --section-start / -Tdata / -Tbss: force a named output section's *final*
  * runtime address to exactly the requested value (GNU-ld semantics). The actual
  * placement is deferred to the format emitter (ELF: link_apply_section_starts
  * in src/obj/elf/link.c, applied AFTER shift_image_addresses so the headers
  * load-page and the runtime image base both fall out of the delta) — at layout
  * time we only validate, since the image-relative vaddr here is not yet in the
  * final coordinate system. Ignored under a script (which pins addresses
  * itself). This pass emits the diagnostics (it has Linker / link_warn); the
  * matched section's segment is shifted by the emitter to land it exactly. */
 static void link_apply_section_starts(Linker* l, LinkImage* img) {
   u32 i, j;
   if (l->script) {
     if (l->nsection_starts)
       link_warn(l,
                 "link: --section-start/-Tdata/-Tbss ignored under a linker "
                 "script");
     return;
   }
   for (i = 0; i < l->nsection_starts; ++i) {
     const KitLinkSectionStart* ss = &l->section_starts[i];
     int matched = 0;
     if (!ss->name.s || ss->name.len == 0) continue;
     for (j = 0; j < img->nsections; ++j) {
       LinkSection* sec = &img->sections[j];
       Slice nm = sec->name ? pool_slice(l->c->global, sec->name) : SLICE_NULL;
       if (!nm.s || nm.len != ss->name.len ||
           memcmp(nm.s, ss->name.s, nm.len) != 0)
         continue;
       matched = 1;
     }
     if (!matched)
       link_warn(l, "link: --section-start: no output section named '%.*s'",
                 (int)ss->name.len, ss->name.s);
   }
 }
 
 /* Strict freestanding validation: reject dynamic-link artifacts on a
  * freestanding/static-non-PIE link. Runs after symbol resolution so every
  * input (and any DT_NEEDED-style import) is visible. The DSO-input and
  * dynamic-section checks generalize the existing relocatable-only DSO guard
  * to the freestanding executable case. --allow-undefined remains the escape
  * hatch for undefined references, but it does not relax these structural
  * rejections (a freestanding image has no dynamic loader to honor them). */
 static int link_section_name_is_dynamic(Slice nm) {
   /* The dynamic-link sections a freestanding static image must not carry. */
   static const char* const dyn[] = {".dynamic", ".dynsym", ".dynstr",
                                      ".rela.plt", ".rel.plt", ".plt",
                                      ".got.plt", ".rela.dyn", ".rel.dyn",
                                      ".interp"};
   u32 i;
   if (!nm.s || nm.len == 0) return 0;
   for (i = 0; i < (u32)(sizeof(dyn) / sizeof(dyn[0])); ++i) {
     size_t dl = strlen(dyn[i]);
     if (nm.len == dl && memcmp(nm.s, dyn[i], dl) == 0) return 1;
   }
   return 0;
 }
 
 static void link_validate_freestanding(Linker* l) {
   u32 ii;
   if (!l->freestanding_strict) return;
 
   for (ii = 0; ii < LinkInputs_count(&l->inputs); ++ii) {
     LinkInput* in = LinkInputs_at(&l->inputs, ii);
     ObjBuilder* ob = in->obj;
     Slice inname = in->name ? pool_slice(l->c->global, in->name) : SLICE_NULL;
     const char* label = inname.s ? inname.s : "<input>";
     u32 j;
 
     /* (c) DSO inputs: a shared object has no place in a freestanding image. */
     if (in->kind == LINK_INPUT_DSO_BYTES) {
       compiler_panic(l->c, SRCLOC_NONE,
                      "link: freestanding link rejects shared-object input "
                      "'%s' (no dynamic loader)",
                      label);
     }
     if (!ob) continue;
 
     /* (a)+(b) dynamic-interpreter / dynamic-section / PLT-GOT-import inputs.
      * A freestanding static image must not pull in .interp (PT_INTERP) or any
      * .dynamic/.dynsym/.plt/.got.plt artifact. */
     for (j = 1; j < obj_section_count(ob); ++j) {
       const Section* s = obj_section_get(ob, j);
       Slice nm;
       if (!s || s->removed) continue;
       nm = s->name ? pool_slice(l->c->global, s->name) : SLICE_NULL;
       if (link_section_name_is_dynamic(nm)) {
         compiler_panic(l->c, SRCLOC_NONE,
                        "link: freestanding link rejects dynamic section '%.*s' "
                        "from input '%s'",
                        (int)nm.len, nm.s, label);
       }
     }
   }
 }
 
 /* ---- public orchestration ---- */
 
 LinkImage* link_resolve(Linker* l) {
   LinkImage* img;
   Heap* h;
 
   metrics_scope_begin(l->c, "link.resolve.total");
   /* Inject any format-owned synthetic input before symbol resolution.
    * Only the COFF format registers a hook (link_synth_coff_ctor_dtor_list);
    * the dispatcher is a no-op for every other format. */
   obj_format_synth_inputs(l->c, l);
   metrics_scope_begin(l->c, "link.ingest_archives");
   link_ingest_archives(l);
   metrics_scope_end(l->c, "link.ingest_archives");
 
   img = link_image_alloc(l->c);
   h = img->heap;
   img->linker = l;
   img->text_base_set = l->text_base_set;
   img->text_base = l->text_base;
   img->shared = l->emit_shared;
   img->elf_e_flags = l->elf_e_flags;
   img->have_elf_e_flags = l->have_elf_e_flags;
 
   img->ninput_maps = LinkInputs_count(&l->inputs);
   metrics_count(l->c, "link.inputs", img->ninput_maps);
   img->input_maps =
       LinkInputs_count(&l->inputs)
           ? (InputMap*)h->alloc(
                 h, sizeof(*img->input_maps) * LinkInputs_count(&l->inputs),
                 _Alignof(InputMap))
           : NULL;
   if (LinkInputs_count(&l->inputs) && !img->input_maps)
     compiler_panic(l->c, SRCLOC_NONE, "link: oom on input maps");
   if (LinkInputs_count(&l->inputs))
     memset(img->input_maps, 0,
            sizeof(*img->input_maps) * LinkInputs_count(&l->inputs));
 
   metrics_scope_begin(l->c, "link.resolve_symbols");
   link_resolve_symbols(l, img);
   metrics_scope_end(l->c, "link.resolve_symbols");
   /* Strict freestanding policy: reject dynamic-link artifacts and cross-input
    * mismatches before laying anything out. DSO inputs / dynamic sections have
    * no home in a freestanding static image (no dynamic loader). */
   link_validate_freestanding(l);
   {
     GcLive g = {0};
     metrics_scope_begin(l->c, "link.gc");
     link_gc_live_alloc(&g, l, h);
     link_gc_compute(l, img, &g);
     metrics_scope_end(l->c, "link.gc");
     metrics_scope_begin(l->c, "link.layout_sections");
     link_layout_sections(l, img, &g);
     link_layout_commons(l, img);
     metrics_count(l->c, "link.sections", img->nsections);
     metrics_count(l->c, "link.segments", img->nsegments);
     metrics_scope_end(l->c, "link.layout_sections");
     metrics_scope_begin(l->c, "link.emit_segment_bytes");
     if (!l->jit_mode) link_emit_segment_bytes(l, img);
     metrics_scope_end(l->c, "link.emit_segment_bytes");
     /* Carry .debug_* through as file-only sections. ELF places them in
      * non-alloc sections; Mach-O in a __DWARF segment. The JIT path
      * serves debug via kit_jit_view instead, and COFF emit doesn't yet
      * handle file-only sections. */
     metrics_scope_begin(l->c, "link.layout_debug");
     if (!l->strip_debug && !l->jit_mode &&
         obj_format_carries_file_only_debug(l->c))
       link_layout_debug(l, img);
     metrics_scope_end(l->c, "link.layout_debug");
     /* --section-start / -Tdata / -Tbss: pin chosen output sections to fixed
      * addresses before symbol vaddrs are derived from them. */
     link_apply_section_starts(l, img);
     metrics_scope_begin(l->c, "link.assign_vaddrs");
     link_assign_symbol_vaddrs(l, img);
     metrics_scope_end(l->c, "link.assign_vaddrs");
     metrics_scope_begin(l->c, "link.emit_boundaries");
     link_emit_array_boundaries(l, img);
     link_emit_tls_boundaries(l, img);
     link_emit_encoding_section_boundaries(l, img);
     link_emit_boundary_sym(l, img, "__dso_handle", 0);
     /* `_DYNAMIC` marks the dynamic section; in a static image it must be
      * absolute 0 so libc's static-vs-dynamic probe (FreeBSD's __libc_start1
      * gates _init_tls() on `&_DYNAMIC != NULL`) takes the static path. Only
      * define it for dynamic output, where layout_dyn places it at the real
      * .dynamic vaddr; for static, the weak undef from crt/libc already
      * resolved to SK_ABS 0, and defining it here as a rebased SK_OBJ symbol
      * would wrongly make `&_DYNAMIC` non-zero. */
     if (l->emit_pie || l->emit_shared)
       link_emit_boundary_sym(l, img, "_DYNAMIC", 0);
     link_emit_boundary_sym(l, img, "_GLOBAL_OFFSET_TABLE_", 0);
     /* PE/COFF: mingw CRT references `__ImageBase` for ASLR-relative
      * addressing and base-relocation bookkeeping.  The PE emitter
      * writes LINK_PE_IMAGE_BASE into the optional header; expose the
      * same value as a linker-defined symbol so input objects resolve.
      * Driven by the format claiming `__ImageBase` (the same hook that
      * fixes its SymKind) rather than a target.obj switch. */
     {
       int fmt_kind;
       if (obj_format_boundary_sym_kind(l->c, SLICE_LIT("__ImageBase"),
                                        &fmt_kind)) {
         link_emit_boundary_sym(l, img, "__ImageBase", LINK_PE_IMAGE_BASE);
         if (img->tls_memsz) link_emit_boundary_sym(l, img, "_tls_used", 0);
       }
     }
     {
       const LinkArchDesc* arch = link_arch_desc_for(l->c);
       u32 si;
       u64 gp_vaddr = 0;
       if (arch && arch->global_pointer_symbol) {
         for (si = 0; si < img->nsegments; ++si) {
           if (img->segments[si].flags & SF_WRITE) {
             gp_vaddr = img->segments[si].vaddr + arch->global_pointer_rw_offset;
             break;
           }
         }
         link_emit_boundary_sym(l, img, arch->global_pointer_symbol, gp_vaddr);
       }
     }
     metrics_scope_end(l->c, "link.emit_boundaries");
     metrics_scope_begin(l->c, "link.resolve_undefs");
     link_resolve_undefs(l, img);
     metrics_scope_end(l->c, "link.resolve_undefs");
     /* --defsym: define absolute / alias linker symbols now that layout and
      * undef resolution are done (an alias target's vaddr is known). Runs
      * before relocations so a defsym can satisfy a reference, and before
      * entry resolution so a defsym can name the entry point. */
     link_apply_defsyms(l, img);
     metrics_scope_begin(l->c, "link.gc_drop_dead");
     link_gc_drop_dead_globals(l, img, &g);
     metrics_scope_end(l->c, "link.gc_drop_dead");
     metrics_scope_begin(l->c, "link.layout_iplt");
     link_layout_iplt(l, img);
     if (img->niplt) link_emit_array_boundaries(l, img);
     metrics_scope_end(l->c, "link.layout_iplt");
     {
       LinkSymId* got_map = NULL;
       LinkSymId* stub_map = NULL;
       u32 map_size = LinkSyms_count(&img->syms) + 1u;
       metrics_scope_begin(l->c, "link.layout_jit_stubs");
       link_layout_jit_stubs(l, img, map_size, &stub_map);
       metrics_scope_end(l->c, "link.layout_jit_stubs");
       metrics_scope_begin(l->c, "link.layout_got");
       /* Skip the link-time static GOT only for formats that build their own
        * static GOT / non-lazy pointer table (Mach-O) in a static image. */
       if (!obj_format_builds_own_static_got(l->c) || !l->emit_static_exe)
         link_layout_got(l, img, map_size, &got_map);
       metrics_scope_end(l->c, "link.layout_got");
       metrics_scope_begin(l->c, "link.emit_relocations");
       link_emit_relocations(l, img, got_map, stub_map);
       metrics_count(l->c, "link.syms", LinkSyms_count(&img->syms));
       metrics_count(l->c, "link.relocs", LinkRelocs_count(&img->relocs));
       metrics_scope_end(l->c, "link.emit_relocations");
       if (got_map) h->free(h, got_map, sizeof(*got_map) * map_size);
       if (stub_map) h->free(h, stub_map, sizeof(*stub_map) * map_size);
     }
     {
       const ObjFormatImpl* fmt = obj_format_lookup(l->c->target.obj);
       metrics_scope_begin(l->c, "link.layout_dyn");
       if (fmt && fmt->layout_dyn) fmt->layout_dyn(l, img);
       metrics_scope_end(l->c, "link.layout_dyn");
     }
     metrics_scope_begin(l->c, "link.resolve_entry");
     link_resolve_entry(l, img);
     metrics_scope_end(l->c, "link.resolve_entry");
     link_gc_live_free(&g, h);
   }
 
   metrics_scope_begin(l->c, "link.capture_debug");
   link_capture_debug_inputs(l, img);
   metrics_scope_end(l->c, "link.capture_debug");
 
   metrics_scope_end(l->c, "link.resolve.total");
   return img;
 }