Module from_program 

★ Phase 1 — the CompiledProgram → C Op-walker (bytecode-IR-as-source-of-truth re-base) ★

The SYSTEMS-tier C backend that hangs off the bytecode VM, mirroring codegen_riscv’s Emitter: walk the CompiledProgram’s flat Op stream and lower each op to C over a register file, with Jump/JumpIfFalse/ JumpIfTrue reconstructed as goto on the same CFG (a relooper recovering while/if for gcc’s vectorizer is a later perf pass; correctness first). User functions are separate regions (delimited by entry_pc), each emitted as a C function under the VM’s register-windowing call convention. Because it lowers the bytecode, it inherits the whole optimizer lattice — the perf win the plan predicts.

Uniform register file. Every register is one int64_t slot. Scalars of every kind ride it: an Int holds its value, a Bool holds 0/1, a Float holds its IEEE-754 bit pattern (recovered with as_f64), a Text holds a char* reinterpreted as an integer, and a Seq holds a heap-boxed Seq_i64*/Seq_f64*/ Seq_str*/Seq_bool* (the proven codegen_c value-typed runtime, boxed so its handle fits a slot). A per-register Kind, inferred by a forward pass mirroring codegen_riscv::infer_kinds, drives how an op combines its operands (int vs float), how a collection op picks its typed runtime call, and how Show renders — exactly the proven fabric/wpe model where “float rides in the i64 regs as bit patterns.”

Grown op-by-op behind c_bytecode_lock (program_outcome(P) == c_bytecode_run(P)); a not-yet-lowered op (or a kind this pass does not model) is a LOUD Err (a typed refusal, never wrong code), exactly like codegen_riscv’s Unsupported. The AST-based codegen_c stays the shipping path until this Op-walker covers the corpus, then compile_to_c swaps to it and the AST entanglement is deleted.

Structs

Offload

A function whose calls a device may answer: its index in the program, the device region that answers it, and how each parameter and the result cross the boundary.

OffloadedC

The walker’s C for a program with an offload table, and each offloaded function it keeps on the host with the reason.

Functions

compile_program_to_c

Lower a whole CompiledProgram to a self-contained C translation unit. Returns a typed refusal (Err) for any op/const/kind not yet lowered — the caller falls back to the AST emitter.

compile_program_to_c_offloaded

The Op-walker with an offload table. Each function the table names asks its device first, at its entry, so every caller’s call is offered: logos_dev_call(region, args, &out) with the parameters in their ports, whose DONE answer is the call’s result and whose DECLINED answer runs the body the walker emits for it anyway. A function a port cannot serve — a parameter or result whose settled kind the port does not carry — stays on the host, reported in kept. The driver’s definition is the caller’s to append.

compile_program_to_c_with_offloads

The Op-walker with an offload table (compile_program_to_c_offloaded); an empty table is compile_program_to_c_with_policy.

compile_program_to_c_with_policy

The Op-walker with an optional policy context — the (interner, PolicyRegistry) a CheckPolicy op needs to resolve its predicate/capability name into a condition (the bytecode carries only the name, exactly as the VM consults its policy_ctx). A program with no Check statement passes None and emits byte-identical C to before. This is the seam compile_to_c_via_bytecode uses so runtime authorization lowers natively.