clean up bytecode

CLAUDE.md

@@ -113,6 +113,19 @@ var v = a[]   // pop: v is 3, a is [1, 2]
 - `packages/` — core packages
 - `Makefile` — build system (`make` to rebuild, `make bootstrap` for first build)
 
+## Testing
+
+After any C runtime changes, run all three test suites before considering the work done:
+
+```
+make                        # rebuild
+./cell --dev vm_suite       # VM-level tests (641 tests)
+./cell --dev test suite     # language-level tests (493 tests)
+./cell --dev fuzz           # fuzzer (100 iterations)
+```
+
+All three must pass with 0 failures.
+
 ## Documentation
 
 The `docs/` folder is the single source of truth. The website at `website/` mounts it via Hugo. Key files:

Makefile

@@ -48,12 +48,12 @@ cell_main: source/main.c libcell_runtime.dylib
 
 # Regenerate .mach bytecode when any .cm source changes
 .mach.stamp: $(MACH_SOURCES)
-	./cell --core . regen.cm
+	./cell --dev regen
 	@touch $@
 
 # Force-regenerate all .mach bytecode files
 regen:
-	./cell --core . regen.cm
+	./cell --core . regen
 	@touch .mach.stamp
 
 # Create the cell shop directories

bench.ce

@@ -8,7 +8,7 @@ var os = use('os')
 var testlib = use('internal/testlib')
 var math = use('math/radians')
 
-if (!args) args = []
+var _args = args == null ? [] : args
 
 var target_pkg = null // null = current package
 var target_bench = null // null = all benchmarks, otherwise specific bench file
@@ -55,14 +55,19 @@ function stddev(arr, mean_val) {
 function percentile(arr, p) {
   if (length(arr) == 0) return 0
   var sorted = sort(arr)
-  var idx = floor(arr) * p / 100
+  var idx = floor(length(arr) * p / 100)
   if (idx >= length(arr)) idx = length(arr) - 1
   return sorted[idx]
 }
 
 // Parse arguments similar to test.ce
 function parse_args() {
-  if (length(args) == 0) {
+  var name = null
+  var lock = null
+  var resolved = null
+  var bench_path = null
+
+  if (length(_args) == 0) {
     if (!testlib.is_valid_package('.')) {
       log.console('No cell.toml found in current directory')
       return false
@@ -71,7 +76,7 @@ function parse_args() {
     return true
   }
 
-  if (args[0] == 'all') {
+  if (_args[0] == 'all') {
     if (!testlib.is_valid_package('.')) {
       log.console('No cell.toml found in current directory')
       return false
@@ -80,28 +85,28 @@ function parse_args() {
     return true
   }
 
-  if (args[0] == 'package') {
-    if (length(args) < 2) {
+  if (_args[0] == 'package') {
+    if (length(_args) < 2) {
       log.console('Usage: cell bench package <name> [bench]')
       log.console('       cell bench package all')
       return false
     }
 
-    if (args[1] == 'all') {
+    if (_args[1] == 'all') {
       all_pkgs = true
       log.console('Benchmarking all packages...')
       return true
     }
 
-    var name = args[1]
-    var lock = shop.load_lock()
+    name = _args[1]
+    lock = shop.load_lock()
     if (lock[name]) {
       target_pkg = name
     } else if (starts_with(name, '/') && testlib.is_valid_package(name)) {
       target_pkg = name
     } else {
       if (testlib.is_valid_package('.')) {
-        var resolved = pkg.alias_to_package(null, name)
+        resolved = pkg.alias_to_package(null, name)
         if (resolved) {
           target_pkg = resolved
         } else {
@@ -114,8 +119,8 @@ function parse_args() {
       }
     }
 
-    if (length(args) >= 3) {
-      target_bench = args[2]
+    if (length(_args) >= 3) {
+      target_bench = _args[2]
     }
 
     log.console(`Benchmarking package: ${target_pkg}`)
@@ -123,7 +128,7 @@ function parse_args() {
   }
 
   // cell bench benches/suite or cell bench <path>
-  var bench_path = args[0]
+  bench_path = _args[0]
 
   // Normalize path - add benches/ prefix if not present
   if (!starts_with(bench_path, 'benches/') && !starts_with(bench_path, '/')) {
@@ -160,12 +165,15 @@ function collect_benches(package_name, specific_bench) {
   var files = pkg.list_files(package_name)
   var bench_files = []
   arrfor(files, function(f) {
+    var bench_name = null
+    var match_name = null
+    var match_base = null
     if (starts_with(f, "benches/") && ends_with(f, ".cm")) {
       if (specific_bench) {
-        var bench_name = text(f, 0, -3)
-        var match_name = specific_bench
+        bench_name = text(f, 0, -3)
+        match_name = specific_bench
         if (!starts_with(match_name, 'benches/')) match_name = 'benches/' + match_name
-        var match_base = ends_with(match_name, '.cm') ? text(match_name, 0, -3) : match_name
+        match_base = ends_with(match_name, '.cm') ? text(match_name, 0, -3) : match_name
         if (bench_name != match_base) return
       }
       push(bench_files, f)
@@ -180,24 +188,25 @@ function calibrate_batch_size(bench_fn, is_batch) {
 
   var n = MIN_BATCH_SIZE
   var dt = 0
+  var start = 0
+  var new_n = 0
+  var calc = 0
+  var target_n = 0
 
   // Find a batch size that takes at least MIN_SAMPLE_NS
   while (n < MAX_BATCH_SIZE) {
-    // Ensure n is a valid number before calling
     if (!is_number(n) || n < 1) {
       n = 1
       break
     }
 
-    var start = os.now()
+    start = os.now()
     bench_fn(n)
     dt = os.now() - start
 
     if (dt >= MIN_SAMPLE_NS) break
 
-    // Double the batch size
-    var new_n = n * 2
-    // Check if multiplication produced a valid number
+    new_n = n * 2
     if (!is_number(new_n) || new_n > MAX_BATCH_SIZE) {
       n = MAX_BATCH_SIZE
       break
@@ -207,10 +216,9 @@ function calibrate_batch_size(bench_fn, is_batch) {
 
   // Adjust to target sample duration
   if (dt > 0 && dt < TARGET_SAMPLE_NS && is_number(n) && is_number(dt)) {
-    var calc = n * TARGET_SAMPLE_NS / dt
+    calc = n * TARGET_SAMPLE_NS / dt
     if (is_number(calc) && calc > 0) {
-      var target_n = floor(calc)
-      // Check if floor returned a valid number
+      target_n = floor(calc)
       if (is_number(target_n) && target_n > 0) {
         if (target_n > MAX_BATCH_SIZE) target_n = MAX_BATCH_SIZE
         if (target_n < MIN_BATCH_SIZE) target_n = MIN_BATCH_SIZE
@@ -219,7 +227,6 @@ function calibrate_batch_size(bench_fn, is_batch) {
     }
   }
 
-  // Safety check - ensure we always return a valid batch size
   if (!is_number(n) || n < 1) {
     n = 1
   }
@@ -230,72 +237,70 @@ function calibrate_batch_size(bench_fn, is_batch) {
 // Run a single benchmark function
 function run_single_bench(bench_fn, bench_name) {
   var timings_per_op = []
-
-  // Detect benchmark format:
-  // 1. Object with { setup, run, teardown } - structured format
-  // 2. Function that accepts (n) - batch format
-  // 3. Function that accepts () - legacy format
   var is_structured = is_object(bench_fn) && bench_fn.run
   var is_batch = false
   var batch_size = 1
   var setup_fn = null
   var run_fn = null
   var teardown_fn = null
+  var calibrate_fn = null
+  var _detect = null
+  var i = 0
+  var state = null
+  var start = 0
+  var duration = 0
+  var ns_per_op = 0
 
   if (is_structured) {
     setup_fn = bench_fn.setup || function() { return null }
     run_fn = bench_fn.run
-    teardown_fn = bench_fn.teardown || function(state) {}
+    teardown_fn = bench_fn.teardown || function(s) {}
 
     // Check if run function accepts batch size
-    try {
+    _detect = function() {
       var test_state = setup_fn()
       run_fn(1, test_state)
       is_batch = true
       if (teardown_fn) teardown_fn(test_state)
-    } catch (e) {
+    } disruption {
       is_batch = false
     }
+    _detect()
 
-    // Create wrapper for calibration
-    var calibrate_fn = function(n) {
-      var state = setup_fn()
-      run_fn(n, state)
-      if (teardown_fn) teardown_fn(state)
+    calibrate_fn = function(n) {
+      var s = setup_fn()
+      run_fn(n, s)
+      if (teardown_fn) teardown_fn(s)
     }
     batch_size = calibrate_batch_size(calibrate_fn, is_batch)
 
-    // Safety check for structured benchmarks
     if (!is_number(batch_size) || batch_size < 1) {
       batch_size = 1
     }
   } else {
     // Simple function format
-    try {
+    _detect = function() {
       bench_fn(1)
       is_batch = true
-    } catch (e) {
+    } disruption {
       is_batch = false
     }
+    _detect()
     batch_size = calibrate_batch_size(bench_fn, is_batch)
   }
 
-  // Safety check - ensure batch_size is valid
   if (!batch_size || batch_size < 1) {
     batch_size = 1
   }
 
   // Warmup phase
-  for (var i = 0; i < WARMUP_BATCHES; i++) {
-    // Ensure batch_size is valid before warmup
+  for (i = 0; i < WARMUP_BATCHES; i++) {
     if (!is_number(batch_size) || batch_size < 1) {
-      var type_str = is_null(batch_size) ? 'null' : is_number(batch_size) ? 'number' : is_text(batch_size) ? 'text' : is_object(batch_size) ? 'object' : is_array(batch_size) ? 'array' : is_function(batch_size) ? 'function' : is_logical(batch_size) ? 'logical' : 'unknown'
-      log.console(`WARNING: batch_size became ${type_str} = ${batch_size}, resetting to 1`)
       batch_size = 1
     }
 
     if (is_structured) {
-      var state = setup_fn()
+      state = setup_fn()
       if (is_batch) {
         run_fn(batch_size, state)
       } else {
@@ -312,35 +317,34 @@ function run_single_bench(bench_fn, bench_name) {
   }
 
   // Measurement phase - collect SAMPLES timing samples
-  for (var i = 0; i < SAMPLES; i++) {
-    // Double-check batch_size is valid (should never happen, but defensive)
+  for (i = 0; i < SAMPLES; i++) {
     if (!is_number(batch_size) || batch_size < 1) {
       batch_size = 1
     }
 
     if (is_structured) {
-      var state = setup_fn()
-      var start = os.now()
+      state = setup_fn()
+      start = os.now()
       if (is_batch) {
         run_fn(batch_size, state)
       } else {
         run_fn(state)
       }
-      var duration = os.now() - start
+      duration = os.now() - start
       if (teardown_fn) teardown_fn(state)
 
-      var ns_per_op = is_batch ? duration / batch_size : duration
+      ns_per_op = is_batch ? duration / batch_size : duration
       push(timings_per_op, ns_per_op)
     } else {
-      var start = os.now()
+      start = os.now()
       if (is_batch) {
         bench_fn(batch_size)
       } else {
         bench_fn()
       }
-      var duration = os.now() - start
+      duration = os.now() - start
 
-      var ns_per_op = is_batch ? duration / batch_size : duration
+      ns_per_op = is_batch ? duration / batch_size : duration
       push(timings_per_op, ns_per_op)
     }
   }
@@ -354,7 +358,6 @@ function run_single_bench(bench_fn, bench_name) {
   var p95_ns = percentile(timings_per_op, 95)
   var p99_ns = percentile(timings_per_op, 99)
 
-  // Calculate ops/s from median
   var ops_per_sec = 0
   if (median_ns > 0) {
     ops_per_sec = floor(1000000000 / median_ns)
@@ -408,18 +411,21 @@ function run_benchmarks(package_name, specific_bench) {
 
   arrfor(bench_files, function(f) {
     var mod_path = text(f, 0, -3)
+    var load_error = false
+    var bench_mod = null
+    var use_pkg = null
+    var benches = []
+    var error_result = null
 
     var file_result = {
       name: f,
       benchmarks: []
     }
 
-    try {
-      var bench_mod
-      var use_pkg = package_name ? package_name : fd.realpath('.')
+    var _load_file = function() {
+      use_pkg = package_name ? package_name : fd.realpath('.')
       bench_mod = shop.use(mod_path, use_pkg)
 
-      var benches = []
       if (is_function(bench_mod)) {
         push(benches, {name: 'main', fn: bench_mod})
       } else if (is_object(bench_mod)) {
@@ -432,8 +438,11 @@ function run_benchmarks(package_name, specific_bench) {
       if (length(benches) > 0) {
         log.console(`  ${f}`)
         arrfor(benches, function(b) {
-          try {
-            var result = run_single_bench(b.fn, b.name)
+          var bench_error = false
+          var result = null
+
+          var _run_bench = function() {
+            result = run_single_bench(b.fn, b.name)
             result.package = pkg_result.package
             push(file_result.benchmarks, result)
             pkg_result.total++
@@ -444,25 +453,32 @@ function run_benchmarks(package_name, specific_bench) {
             if (result.batch_size > 1) {
               log.console(`      batch: ${result.batch_size}  samples: ${result.samples}`)
             }
-          } catch (e) {
-            log.console(`    ERROR ${b.name}: ${e}`)
-            log.error(e)
-            var error_result = {
+          } disruption {
+            bench_error = true
+          }
+          _run_bench()
+          if (bench_error) {
+            log.console(`    ERROR ${b.name}`)
+            error_result = {
               package: pkg_result.package,
               name: b.name,
-              error: e.toString()
+              error: "benchmark disrupted"
             }
             push(file_result.benchmarks, error_result)
             pkg_result.total++
           }
         })
       }
-    } catch (e) {
-      log.console(`  Error loading ${f}: ${e}`)
-      var error_result = {
+    } disruption {
+      load_error = true
+    }
+    _load_file()
+    if (load_error) {
+      log.console(`  Error loading ${f}`)
+      error_result = {
         package: pkg_result.package,
         name: "load_module",
-        error: `Error loading module: ${e}`
+        error: "error loading module"
       }
       push(file_result.benchmarks, error_result)
       pkg_result.total++
@@ -478,15 +494,16 @@ function run_benchmarks(package_name, specific_bench) {
 
 // Run all benchmarks
 var all_results = []
+var packages = null
 
 if (all_pkgs) {
   if (testlib.is_valid_package('.')) {
     push(all_results, run_benchmarks(null, null))
   }
 
-  var packages = shop.list_packages()
-  arrfor(packages, function(pkg) {
-    push(all_results, run_benchmarks(pkg, null))
+  packages = shop.list_packages()
+  arrfor(packages, function(p) {
+    push(all_results, run_benchmarks(p, null))
   })
 } else {
   push(all_results, run_benchmarks(target_pkg, target_bench))

benches/actor_patterns.cm

@@ -0,0 +1,232 @@
+// actor_patterns.cm — Actor concurrency benchmarks
+// Message passing, fan-out/fan-in, mailbox throughput.
+// These use structured benchmarks with setup/run/teardown.
+
+// Note: actor benchmarks are measured differently from pure compute.
+// Each iteration sends messages and waits for results, so they're
+// inherently slower but test real concurrency costs.
+
+// Simple ping-pong: two actors sending messages back and forth
+// Since we can't create real actors from a module, we simulate
+// the message-passing patterns with function call overhead that
+// mirrors what the actor dispatch does.
+
+// Simulate message dispatch overhead
+function make_mailbox() {
+  return {
+    queue: [],
+    delivered: 0
+  }
+}
+
+function send(mailbox, msg) {
+  push(mailbox.queue, msg)
+  return null
+}
+
+function receive(mailbox) {
+  if (length(mailbox.queue) == 0) return null
+  mailbox.delivered++
+  return pop(mailbox.queue)
+}
+
+function drain(mailbox) {
+  var count = 0
+  while (length(mailbox.queue) > 0) {
+    pop(mailbox.queue)
+    count++
+  }
+  return count
+}
+
+// Ping-pong: simulate two actors exchanging messages
+function ping_pong(rounds) {
+  var box_a = make_mailbox()
+  var box_b = make_mailbox()
+  var i = 0
+  var msg = null
+
+  send(box_a, {type: "ping", val: 0})
+
+  for (i = 0; i < rounds; i++) {
+    // A receives and sends to B
+    msg = receive(box_a)
+    if (msg) {
+      send(box_b, {type: "pong", val: msg.val + 1})
+    }
+    // B receives and sends to A
+    msg = receive(box_b)
+    if (msg) {
+      send(box_a, {type: "ping", val: msg.val + 1})
+    }
+  }
+
+  return box_a.delivered + box_b.delivered
+}
+
+// Fan-out: one sender, N receivers
+function fan_out(n_receivers, messages_per) {
+  var receivers = []
+  var i = 0
+  var j = 0
+  for (i = 0; i < n_receivers; i++) {
+    push(receivers, make_mailbox())
+  }
+
+  // Send messages to all receivers
+  for (j = 0; j < messages_per; j++) {
+    for (i = 0; i < n_receivers; i++) {
+      send(receivers[i], {seq: j, data: j * 17})
+    }
+  }
+
+  // All receivers drain
+  var total = 0
+  for (i = 0; i < n_receivers; i++) {
+    total += drain(receivers[i])
+  }
+
+  return total
+}
+
+// Fan-in: N senders, one receiver
+function fan_in(n_senders, messages_per) {
+  var inbox = make_mailbox()
+  var i = 0
+  var j = 0
+
+  // Each sender sends messages
+  for (i = 0; i < n_senders; i++) {
+    for (j = 0; j < messages_per; j++) {
+      send(inbox, {sender: i, seq: j, data: i * 100 + j})
+    }
+  }
+
+  // Receiver processes all
+  var total = 0
+  var msg = null
+  msg = receive(inbox)
+  while (msg) {
+    total += msg.data
+    msg = receive(inbox)
+  }
+
+  return total
+}
+
+// Pipeline: chain of processors
+function pipeline(stages, items) {
+  var boxes = []
+  var i = 0
+  var j = 0
+  var msg = null
+
+  for (i = 0; i <= stages; i++) {
+    push(boxes, make_mailbox())
+  }
+
+  // Feed input
+  for (i = 0; i < items; i++) {
+    send(boxes[0], {val: i})
+  }
+
+  // Process each stage
+  for (j = 0; j < stages; j++) {
+    msg = receive(boxes[j])
+    while (msg) {
+      send(boxes[j + 1], {val: msg.val * 2 + 1})
+      msg = receive(boxes[j])
+    }
+  }
+
+  // Drain output
+  var total = 0
+  msg = receive(boxes[stages])
+  while (msg) {
+    total += msg.val
+    msg = receive(boxes[stages])
+  }
+
+  return total
+}
+
+// Request-response pattern (simulate RPC)
+function request_response(n_requests) {
+  var client_box = make_mailbox()
+  var server_box = make_mailbox()
+  var i = 0
+  var req = null
+  var resp = null
+  var total = 0
+
+  for (i = 0; i < n_requests; i++) {
+    // Client sends request
+    send(server_box, {id: i, payload: i * 3, reply_to: client_box})
+
+    // Server processes
+    req = receive(server_box)
+    if (req) {
+      send(req.reply_to, {id: req.id, result: req.payload * 2 + 1})
+    }
+
+    // Client receives response
+    resp = receive(client_box)
+    if (resp) {
+      total += resp.result
+    }
+  }
+
+  return total
+}
+
+return {
+  // Ping-pong: 10K rounds
+  ping_pong_10k: function(n) {
+    var i = 0
+    var x = 0
+    for (i = 0; i < n; i++) {
+      x += ping_pong(10000)
+    }
+    return x
+  },
+
+  // Fan-out: 100 receivers, 100 messages each
+  fan_out_100x100: function(n) {
+    var i = 0
+    var x = 0
+    for (i = 0; i < n; i++) {
+      x += fan_out(100, 100)
+    }
+    return x
+  },
+
+  // Fan-in: 100 senders, 100 messages each
+  fan_in_100x100: function(n) {
+    var i = 0
+    var x = 0
+    for (i = 0; i < n; i++) {
+      x += fan_in(100, 100)
+    }
+    return x
+  },
+
+  // Pipeline: 10 stages, 1000 items
+  pipeline_10x1k: function(n) {
+    var i = 0
+    var x = 0
+    for (i = 0; i < n; i++) {
+      x += pipeline(10, 1000)
+    }
+    return x
+  },
+
+  // Request-response: 5K requests
+  rpc_5k: function(n) {
+    var i = 0
+    var x = 0
+    for (i = 0; i < n; i++) {
+      x += request_response(5000)
+    }
+    return x
+  }
+}

benches/cli_tool.cm

@@ -0,0 +1,141 @@
+// cli_tool.cm — CLI tool simulation (macro benchmark)
+// Parse args + process data + transform + format output.
+// Simulates a realistic small utility program.
+
+var json = use('json')
+
+// Generate fake records
+function generate_records(n) {
+  var records = []
+  var x = 42
+  var i = 0
+  var status_vals = ["active", "inactive", "pending", "archived"]
+  var dept_vals = ["eng", "sales", "ops", "hr", "marketing"]
+  for (i = 0; i < n; i++) {
+    x = ((x * 1103515245 + 12345) & 0x7FFFFFFF) | 0
+    push(records, {
+      id: i + 1,
+      name: `user_${i}`,
+      score: (x % 1000) / 10,
+      status: status_vals[i % 4],
+      department: dept_vals[i % 5]
+    })
+  }
+  return records
+}
+
+// Filter records by field value
+function filter_records(records, field, value) {
+  var result = []
+  var i = 0
+  for (i = 0; i < length(records); i++) {
+    if (records[i][field] == value) {
+      push(result, records[i])
+    }
+  }
+  return result
+}
+
+// Group by a field
+function group_by(records, field) {
+  var groups = {}
+  var i = 0
+  var key = null
+  for (i = 0; i < length(records); i++) {
+    key = records[i][field]
+    if (!key) key = "unknown"
+    if (!groups[key]) groups[key] = []
+    push(groups[key], records[i])
+  }
+  return groups
+}
+
+// Aggregate: compute stats per group
+function aggregate(groups) {
+  var keys = array(groups)
+  var result = []
+  var i = 0
+  var j = 0
+  var grp = null
+  var total = 0
+  var mn = 0
+  var mx = 0
+  for (i = 0; i < length(keys); i++) {
+    grp = groups[keys[i]]
+    total = 0
+    mn = 999999
+    mx = 0
+    for (j = 0; j < length(grp); j++) {
+      total += grp[j].score
+      if (grp[j].score < mn) mn = grp[j].score
+      if (grp[j].score > mx) mx = grp[j].score
+    }
+    push(result, {
+      group: keys[i],
+      count: length(grp),
+      average: total / length(grp),
+      low: mn,
+      high: mx
+    })
+  }
+  return result
+}
+
+// Full pipeline: load → filter → sort → group → aggregate → encode
+function run_pipeline(n_records) {
+  // Generate data
+  var records = generate_records(n_records)
+
+  // Filter to active records
+  var filtered = filter_records(records, "status", "active")
+
+  // Sort by score
+  filtered = sort(filtered, "score")
+
+  // Limit to first 50
+  if (length(filtered) > 50) {
+    filtered = array(filtered, 0, 50)
+  }
+
+  // Group and aggregate
+  var groups = group_by(filtered, "department")
+  var stats = aggregate(groups)
+  stats = sort(stats, "average")
+
+  // Encode as JSON
+  var output = json.encode(stats)
+
+  return length(output)
+}
+
+return {
+  // Small dataset (100 records)
+  cli_pipeline_100: function(n) {
+    var i = 0
+    var x = 0
+    for (i = 0; i < n; i++) {
+      x += run_pipeline(100)
+    }
+    return x
+  },
+
+  // Medium dataset (1000 records)
+  cli_pipeline_1k: function(n) {
+    var i = 0
+    var x = 0
+    for (i = 0; i < n; i++) {
+      x += run_pipeline(1000)
+    }
+    return x
+  },
+
+  // Large dataset (10K records)
+  cli_pipeline_10k: function(n) {
+    var i = 0
+    var x = 0
+    for (i = 0; i < n; i++) {
+      x += run_pipeline(10000)
+    }
+    return x
+  }
+}

benches/deltablue.cm

@@ -0,0 +1,162 @@
+// deltablue.cm — Constraint solver kernel (DeltaBlue-inspired)
+// Dynamic dispatch, pointer chasing, object-heavy workload.
+
+def REQUIRED = 0
+def STRONG = 1
+def NORMAL = 2
+def WEAK = 3
+def WEAKEST = 4
+
+function make_variable(name, value) {
+  return {
+    name: name,
+    value: value,
+    constraints: [],
+    determined_by: null,
+    stay: true,
+    mark: 0
+  }
+}
+
+function make_constraint(strength, variables, satisfy_fn) {
+  return {
+    strength: strength,
+    variables: variables,
+    satisfy: satisfy_fn,
+    output: null
+  }
+}
+
+// Constraint propagation: simple forward solver
+function propagate(vars, constraints) {
+  var changed = true
+  var passes = 0
+  var max_passes = length(constraints) * 3
+  var i = 0
+  var c = null
+  var old_val = 0
+
+  while (changed && passes < max_passes) {
+    changed = false
+    passes++
+    for (i = 0; i < length(constraints); i++) {
+      c = constraints[i]
+      old_val = c.output ? c.output.value : null
+      c.satisfy(c)
+      if (c.output && c.output.value != old_val) {
+        changed = true
+      }
+    }
+  }
+  return passes
+}
+
+// Build a chain of equality constraints: v[i] = v[i-1] + 1
+function build_chain(n) {
+  var vars = []
+  var constraints = []
+  var i = 0
+  for (i = 0; i < n; i++) {
+    push(vars, make_variable(`v${i}`, 0))
+  }
+
+  // Set first variable
+  vars[0].value = 1
+
+  var c = null
+  for (i = 1; i < n; i++) {
+    c = make_constraint(NORMAL, [vars[i - 1], vars[i]], function(self) {
+      self.variables[1].value = self.variables[0].value + 1
+      self.output = self.variables[1]
+    })
+    push(constraints, c)
+    push(vars[i].constraints, c)
+  }
+
+  return {vars: vars, constraints: constraints}
+}
+
+// Build a projection: pairs of variables with scaling constraints
+function build_projection(n) {
+  var src = []
+  var dst = []
+  var constraints = []
+  var i = 0
+  for (i = 0; i < n; i++) {
+    push(src, make_variable(`src${i}`, i * 10))
+    push(dst, make_variable(`dst${i}`, 0))
+  }
+
+  var scale_c = null
+  for (i = 0; i < n; i++) {
+    scale_c = make_constraint(STRONG, [src[i], dst[i]], function(self) {
+      self.variables[1].value = self.variables[0].value * 2 + 1
+      self.output = self.variables[1]
+    })
+    push(constraints, scale_c)
+    push(dst[i].constraints, scale_c)
+  }
+
+  return {src: src, dst: dst, constraints: constraints}
+}
+
+// Edit constraint: change a source, re-propagate
+function run_edits(system, edits) {
+  var i = 0
+  var total_passes = 0
+  for (i = 0; i < edits; i++) {
+    system.vars[0].value = i
+    total_passes += propagate(system.vars, system.constraints)
+  }
+  return total_passes
+}
+
+return {
+  // Chain of 100 variables, propagate
+  chain_100: function(n) {
+    var i = 0
+    var chain = null
+    var x = 0
+    for (i = 0; i < n; i++) {
+      chain = build_chain(100)
+      x += propagate(chain.vars, chain.constraints)
+    }
+    return x
+  },
+
+  // Chain of 500 variables, propagate
+  chain_500: function(n) {
+    var i = 0
+    var chain = null
+    var x = 0
+    for (i = 0; i < n; i++) {
+      chain = build_chain(500)
+      x += propagate(chain.vars, chain.constraints)
+    }
+    return x
+  },
+
+  // Projection of 100 pairs
+  projection_100: function(n) {
+    var i = 0
+    var proj = null
+    var x = 0
+    for (i = 0; i < n; i++) {
+      proj = build_projection(100)
+      x += propagate(proj.src, proj.constraints)
+    }
+    return x
+  },
+
+  // Edit and re-propagate (incremental update)
+  chain_edit_100: function(n) {
+    var chain = build_chain(100)
+    var i = 0
+    var x = 0
+    for (i = 0; i < n; i++) {
+      chain.vars[0].value = i
+      x += propagate(chain.vars, chain.constraints)
+    }
+    return x
+  }
+}

benches/fibonacci.cm

@@ -0,0 +1,126 @@
+// fibonacci.cm — Fibonacci variants kernel
+// Tests recursion overhead, memoization patterns, iteration vs recursion.
+
+// Naive recursive (exponential) — measures call overhead
+function fib_naive(n) {
+  if (n <= 1) return n
+  return fib_naive(n - 1) + fib_naive(n - 2)
+}
+
+// Iterative (linear)
+function fib_iter(n) {
+  var a = 0
+  var b = 1
+  var i = 0
+  var tmp = 0
+  for (i = 0; i < n; i++) {
+    tmp = a + b
+    a = b
+    b = tmp
+  }
+  return a
+}
+
+// Memoized recursive (tests object property lookup + recursion)
+function make_memo_fib() {
+  var cache = {}
+  var fib = function(n) {
+    var key = text(n)
+    if (cache[key]) return cache[key]
+    var result = null
+    if (n <= 1) {
+      result = n
+    } else {
+      result = fib(n - 1) + fib(n - 2)
+    }
+    cache[key] = result
+    return result
+  }
+  return fib
+}
+
+// CPS (continuation passing style) — tests closure creation
+function fib_cps(n, cont) {
+  if (n <= 1) return cont(n)
+  return fib_cps(n - 1, function(a) {
+    return fib_cps(n - 2, function(b) {
+      return cont(a + b)
+    })
+  })
+}
+
+// Matrix exponentiation style (accumulator)
+function fib_matrix(n) {
+  var a = 1
+  var b = 0
+  var c = 0
+  var d = 1
+  var ta = 0
+  var tb = 0
+  var m = n
+  while (m > 0) {
+    if (m % 2 == 1) {
+      ta = a * d + b * c // wrong but stresses numeric ops
+      tb = b * d + a * c
+      a = ta
+      b = tb
+    }
+    ta = c * c + d * d
+    tb = d * (2 * c + d)
+    c = ta
+    d = tb
+    m = floor(m / 2)
+  }
+  return b
+}
+
+return {
+  fib_naive_25: function(n) {
+    var i = 0
+    var x = 0
+    for (i = 0; i < n; i++) x += fib_naive(25)
+    return x
+  },
+
+  fib_naive_30: function(n) {
+    var i = 0
+    var x = 0
+    for (i = 0; i < n; i++) x += fib_naive(30)
+    return x
+  },
+
+  fib_iter_80: function(n) {
+    var i = 0
+    var x = 0
+    for (i = 0; i < n; i++) x += fib_iter(80)
+    return x
+  },
+
+  fib_memo_100: function(n) {
+    var i = 0
+    var x = 0
+    var fib = null
+    for (i = 0; i < n; i++) {
+      fib = make_memo_fib()
+      x += fib(100)
+    }
+    return x
+  },
+
+  fib_cps_20: function(n) {
+    var i = 0
+    var x = 0
+    var identity = function(v) { return v }
+    for (i = 0; i < n; i++) {
+      x += fib_cps(20, identity)
+    }
+    return x
+  },
+
+  fib_matrix_80: function(n) {
+    var i = 0
+    var x = 0
+    for (i = 0; i < n; i++) x += fib_matrix(80)
+    return x
+  }
+}

benches/hash_workload.cm

@@ -0,0 +1,159 @@
+// hash_workload.cm — Hash-heavy / word-count / map-reduce kernel
+// Stresses record (object) creation, property access, and string handling.
+
+function make_words(count) {
+  // Generate a repeating word list to simulate text processing
+  var base_words = [
+    "the", "quick", "brown", "fox", "jumps", "over", "lazy", "dog",
+    "and", "cat", "sat", "on", "mat", "with", "hat", "bat",
+    "alpha", "beta", "gamma", "delta", "epsilon", "zeta", "eta", "theta",
+    "hello", "world", "foo", "bar", "baz", "qux", "quux", "corge"
+  ]
+  var words = []
+  var i = 0
+  for (i = 0; i < count; i++) {
+    push(words, base_words[i % length(base_words)])
+  }
+  return words
+}
+
+// Word frequency count
+function word_count(words) {
+  var freq = {}
+  var i = 0
+  var w = null
+  for (i = 0; i < length(words); i++) {
+    w = words[i]
+    if (freq[w]) {
+      freq[w] = freq[w] + 1
+    } else {
+      freq[w] = 1
+    }
+  }
+  return freq
+}
+
+// Find top-N words by frequency
+function top_n(freq, n) {
+  var keys = array(freq)
+  var pairs = []
+  var i = 0
+  for (i = 0; i < length(keys); i++) {
+    push(pairs, {word: keys[i], count: freq[keys[i]]})
+  }
+  var sorted = sort(pairs, "count")
+  // Return last N (highest counts)
+  var result = []
+  var start = length(sorted) - n
+  if (start < 0) start = 0
+  for (i = start; i < length(sorted); i++) {
+    push(result, sorted[i])
+  }
+  return result
+}
+
+// Histogram: group words by length
+function group_by_length(words) {
+  var groups = {}
+  var i = 0
+  var w = null
+  var k = null
+  for (i = 0; i < length(words); i++) {
+    w = words[i]
+    k = text(length(w))
+    if (!groups[k]) groups[k] = []
+    push(groups[k], w)
+  }
+  return groups
+}
+
+// Simple hash table with chaining (stress property access patterns)
+function hash_table_ops(n) {
+  var table = {}
+  var i = 0
+  var k = null
+  var collisions = 0
+
+  // Insert phase
+  for (i = 0; i < n; i++) {
+    k = `key_${i % 512}`
+    if (table[k]) collisions++
+    table[k] = i
+  }
+
+  // Lookup phase
+  var found = 0
+  for (i = 0; i < n; i++) {
+    k = `key_${i % 512}`
+    if (table[k]) found++
+  }
+
+  // Delete phase
+  var deleted = 0
+  for (i = 0; i < n; i += 3) {
+    k = `key_${i % 512}`
+    if (table[k]) {
+      delete table[k]
+      deleted++
+    }
+  }
+
+  return found - deleted + collisions
+}
+
+var words_1k = make_words(1000)
+var words_10k = make_words(10000)
+
+return {
+  // Word count on 1K words
+  wordcount_1k: function(n) {
+    var i = 0
+    var freq = null
+    for (i = 0; i < n; i++) {
+      freq = word_count(words_1k)
+    }
+    return freq
+  },
+
+  // Word count on 10K words
+  wordcount_10k: function(n) {
+    var i = 0
+    var freq = null
+    for (i = 0; i < n; i++) {
+      freq = word_count(words_10k)
+    }
+    return freq
+  },
+
+  // Word count + top-10 extraction
+  wordcount_top10: function(n) {
+    var i = 0
+    var freq = null
+    var top = null
+    for (i = 0; i < n; i++) {
+      freq = word_count(words_10k)
+      top = top_n(freq, 10)
+    }
+    return top
+  },
+
+  // Group words by length
+  group_by_len: function(n) {
+    var i = 0
+    var groups = null
+    for (i = 0; i < n; i++) {
+      groups = group_by_length(words_10k)
+    }
+    return groups
+  },
+
+  // Hash table insert/lookup/delete
+  hash_table: function(n) {
+    var i = 0
+    var x = 0
+    for (i = 0; i < n; i++) {
+      x += hash_table_ops(2048)
+    }
+    return x
+  }
+}

benches/json_walk.cm

@@ -0,0 +1,167 @@
+// json_walk.cm — JSON parse + walk + serialize kernel
+// Stresses strings, records, arrays, and recursive traversal.
+
+var json = use('json')
+
+function make_nested_object(depth, breadth) {
+  var obj = {}
+  var i = 0
+  var k = null
+  if (depth <= 0) {
+    for (i = 0; i < breadth; i++) {
+      k = `key_${i}`
+      obj[k] = i * 3.14
+    }
+    return obj
+  }
+  for (i = 0; i < breadth; i++) {
+    k = `node_${i}`
+    obj[k] = make_nested_object(depth - 1, breadth)
+  }
+  obj.value = depth
+  obj.name = `level_${depth}`
+  return obj
+}
+
+function make_array_data(size) {
+  var arr = []
+  var i = 0
+  for (i = 0; i < size; i++) {
+    push(arr, {
+      id: i,
+      name: `item_${i}`,
+      active: i % 2 == 0,
+      score: i * 1.5,
+      tags: [`tag_${i % 5}`, `tag_${(i + 1) % 5}`]
+    })
+  }
+  return arr
+}
+
+// Walk an object tree, counting nodes
+function walk_count(obj) {
+  var count = 1
+  var keys = null
+  var i = 0
+  var v = null
+  if (is_object(obj)) {
+    keys = array(obj)
+    for (i = 0; i < length(keys); i++) {
+      v = obj[keys[i]]
+      if (is_object(v) || is_array(v)) {
+        count += walk_count(v)
+      }
+    }
+  } else if (is_array(obj)) {
+    for (i = 0; i < length(obj); i++) {
+      v = obj[i]
+      if (is_object(v) || is_array(v)) {
+        count += walk_count(v)
+      }
+    }
+  }
+  return count
+}
+
+// Walk and extract all numbers
+function walk_sum(obj) {
+  var sum = 0
+  var keys = null
+  var i = 0
+  var v = null
+  if (is_object(obj)) {
+    keys = array(obj)
+    for (i = 0; i < length(keys); i++) {
+      v = obj[keys[i]]
+      if (is_number(v)) {
+        sum += v
+      } else if (is_object(v) || is_array(v)) {
+        sum += walk_sum(v)
+      }
+    }
+  } else if (is_array(obj)) {
+    for (i = 0; i < length(obj); i++) {
+      v = obj[i]
+      if (is_number(v)) {
+        sum += v
+      } else if (is_object(v) || is_array(v)) {
+        sum += walk_sum(v)
+      }
+    }
+  }
+  return sum
+}
+
+// Pre-build test data strings
+var nested_obj = make_nested_object(3, 4)
+var nested_json = json.encode(nested_obj)
+var array_data = make_array_data(200)
+var array_json = json.encode(array_data)
+
+return {
+  // Parse nested JSON
+  json_parse_nested: function(n) {
+    var i = 0
+    var obj = null
+    for (i = 0; i < n; i++) {
+      obj = json.decode(nested_json)
+    }
+    return obj
+  },
+
+  // Parse array-of-records JSON
+  json_parse_array: function(n) {
+    var i = 0
+    var arr = null
+    for (i = 0; i < n; i++) {
+      arr = json.decode(array_json)
+    }
+    return arr
+  },
+
+  // Encode nested object to JSON
+  json_encode_nested: function(n) {
+    var i = 0
+    var s = null
+    for (i = 0; i < n; i++) {
+      s = json.encode(nested_obj)
+    }
+    return s
+  },
+
+  // Encode array to JSON
+  json_encode_array: function(n) {
+    var i = 0
+    var s = null
+    for (i = 0; i < n; i++) {
+      s = json.encode(array_data)
+    }
+    return s
+  },
+
+  // Parse + walk + count
+  json_roundtrip_walk: function(n) {
+    var i = 0
+    var obj = null
+    var count = 0
+    for (i = 0; i < n; i++) {
+      obj = json.decode(nested_json)
+      count += walk_count(obj)
+    }
+    return count
+  },
+
+  // Parse + sum all numbers + re-encode
+  json_roundtrip_full: function(n) {
+    var i = 0
+    var obj = null
+    var sum = 0
+    var out = null
+    for (i = 0; i < n; i++) {
+      obj = json.decode(array_json)
+      sum += walk_sum(obj)
+      out = json.encode(obj)
+    }
+    return sum
+  }
+}

benches/micro_ops.cm

@@ -1,24 +1,24 @@
-// micro_ops.bench.ce (or .cm depending on your convention)
+// micro_ops.cm — microbenchmarks for core operations
 
-// Note: We use a function-local sink in each benchmark to avoid cross-contamination
 function blackhole(sink, x) {
-  // Prevent dead-code elimination
   return (sink + (x | 0)) | 0
 }
 
 function make_obj_xy(x, y) {
-  return { x, y }
+  return {x: x, y: y}
 }
 
 function make_obj_yx(x, y) {
-  // Different insertion order to force a different shape in many engines
-  return { y, x }
+  // Different insertion order to force a different shape
+  return {y: y, x: x}
 }
 
 function make_shapes(n) {
   var out = []
-  for (var i = 0; i < n; i++) {
-    var o = { a: i }
+  var i = 0
+  var o = null
+  for (i = 0; i < n; i++) {
+    o = {a: i}
     o[`p${i}`] = i
     push(out, o)
   }
@@ -27,13 +27,15 @@ function make_shapes(n) {
 
 function make_packed_array(n) {
   var a = []
-  for (var i = 0; i < n; i++) push(a, i)
+  var i = 0
+  for (i = 0; i < n; i++) push(a, i)
   return a
 }
 
 function make_holey_array(n) {
   var a = []
-  for (var i = 0; i < n; i += 2) a[i] = i
+  var i = 0
+  for (i = 0; i < n; i += 2) a[i] = i
   return a
 }
 
@@ -41,7 +43,8 @@ return {
   // 0) Baseline loop cost
   loop_empty: function(n) {
     var sink = 0
-    for (var i = 0; i < n; i++) {}
+    var i = 0
+    for (i = 0; i < n; i++) {}
     return blackhole(sink, n)
   },
 
@@ -49,35 +52,40 @@ return {
   i32_add: function(n) {
     var sink = 0
     var x = 1
-    for (var i = 0; i < n; i++) x = (x + 3) | 0
+    var i = 0
+    for (i = 0; i < n; i++) x = (x + 3) | 0
     return blackhole(sink, x)
   },
 
   f64_add: function(n) {
     var sink = 0
     var x = 1.0
-    for (var i = 0; i < n; i++) x = x + 3.14159
+    var i = 0
+    for (i = 0; i < n; i++) x = x + 3.14159
     return blackhole(sink, x | 0)
   },
 
   mixed_add: function(n) {
     var sink = 0
     var x = 1
-    for (var i = 0; i < n; i++) x = x + 0.25
+    var i = 0
+    for (i = 0; i < n; i++) x = x + 0.25
     return blackhole(sink, x | 0)
   },
 
   bit_ops: function(n) {
     var sink = 0
     var x = 0x12345678
-    for (var i = 0; i < n; i++) x = ((x << 5) ^ (x >>> 3)) | 0
+    var i = 0
+    for (i = 0; i < n; i++) x = ((x << 5) ^ (x >>> 3)) | 0
     return blackhole(sink, x)
   },
 
   overflow_path: function(n) {
     var sink = 0
     var x = 0x70000000
-    for (var i = 0; i < n; i++) x = (x + 0x10000000) | 0
+    var i = 0
+    for (i = 0; i < n; i++) x = (x + 0x10000000) | 0
     return blackhole(sink, x)
   },
 
@@ -85,7 +93,8 @@ return {
   branch_predictable: function(n) {
     var sink = 0
     var x = 0
-    for (var i = 0; i < n; i++) {
+    var i = 0
+    for (i = 0; i < n; i++) {
       if ((i & 7) != 0) x++
       else x += 2
     }
@@ -95,7 +104,8 @@ return {
   branch_alternating: function(n) {
     var sink = 0
     var x = 0
-    for (var i = 0; i < n; i++) {
+    var i = 0
+    for (i = 0; i < n; i++) {
       if ((i & 1) == 0) x++
       else x += 2
     }
@@ -105,29 +115,47 @@ return {
   // 3) Calls
   call_direct: function(n) {
     var sink = 0
-    function f(a) { return (a + 1) | 0 }
+    var f = function(a) { return (a + 1) | 0 }
     var x = 0
-    for (var i = 0; i < n; i++) x = f(x)
+    var i = 0
+    for (i = 0; i < n; i++) x = f(x)
     return blackhole(sink, x)
   },
 
   call_indirect: function(n) {
     var sink = 0
-    function f(a) { return (a + 1) | 0 }
+    var f = function(a) { return (a + 1) | 0 }
     var g = f
     var x = 0
-    for (var i = 0; i < n; i++) x = g(x)
+    var i = 0
+    for (i = 0; i < n; i++) x = g(x)
     return blackhole(sink, x)
   },
 
   call_closure: function(n) {
     var sink = 0
-    function make_adder(k) {
+    var make_adder = function(k) {
       return function(a) { return (a + k) | 0 }
     }
     var add3 = make_adder(3)
     var x = 0
-    for (var i = 0; i < n; i++) x = add3(x)
+    var i = 0
+    for (i = 0; i < n; i++) x = add3(x)
+    return blackhole(sink, x)
+  },
+
+  call_multi_arity: function(n) {
+    var sink = 0
+    var f0 = function() { return 1 }
+    var f1 = function(a) { return a + 1 }
+    var f2 = function(a, b) { return a + b }
+    var f3 = function(a, b, c) { return a + b + c }
+    var f4 = function(a, b, c, d) { return a + b + c + d }
+    var x = 0
+    var i = 0
+    for (i = 0; i < n; i++) {
+      x = (x + f0() + f1(i) + f2(i, 1) + f3(i, 1, 2) + f4(i, 1, 2, 3)) | 0
+    }
     return blackhole(sink, x)
   },
 
@@ -136,7 +164,8 @@ return {
     var sink = 0
     var o = make_obj_xy(1, 2)
     var x = 0
-    for (var i = 0; i < n; i++) x = (x + o.x) | 0
+    var i = 0
+    for (i = 0; i < n; i++) x = (x + o.x) | 0
     return blackhole(sink, x)
   },
 
@@ -145,20 +174,38 @@ return {
     var a = make_obj_xy(1, 2)
     var b = make_obj_yx(1, 2)
     var x = 0
-    for (var i = 0; i < n; i++) {
-      var o = (i & 1) == 0 ? a : b
+    var i = 0
+    var o = null
+    for (i = 0; i < n; i++) {
+      o = (i & 1) == 0 ? a : b
       x = (x + o.x) | 0
     }
     return blackhole(sink, x)
   },
 
+  prop_read_poly_4: function(n) {
+    var sink = 0
+    var shapes = [
+      {x: 1, y: 2},
+      {y: 2, x: 1},
+      {x: 1, z: 3, y: 2},
+      {w: 0, x: 1, y: 2}
+    ]
+    var x = 0
+    var i = 0
+    for (i = 0; i < n; i++) {
+      x = (x + shapes[i & 3].x) | 0
+    }
+    return blackhole(sink, x)
+  },
+
   prop_read_mega: function(n) {
     var sink = 0
     var objs = make_shapes(32)
     var x = 0
-    for (var i = 0; i < n; i++) {
-      var o = objs[i & 31]
-      x = (x + o.a) | 0
+    var i = 0
+    for (i = 0; i < n; i++) {
+      x = (x + objs[i & 31].a) | 0
     }
     return blackhole(sink, x)
   },
@@ -166,7 +213,8 @@ return {
   prop_write_mono: function(n) {
     var sink = 0
     var o = make_obj_xy(1, 2)
-    for (var i = 0; i < n; i++) o.x = (o.x + 1) | 0
+    var i = 0
+    for (i = 0; i < n; i++) o.x = (o.x + 1) | 0
     return blackhole(sink, o.x)
   },
 
@@ -175,14 +223,16 @@ return {
     var sink = 0
     var a = make_packed_array(1024)
     var x = 0
-    for (var i = 0; i < n; i++) x = (x + a[i & 1023]) | 0
+    var i = 0
+    for (i = 0; i < n; i++) x = (x + a[i & 1023]) | 0
     return blackhole(sink, x)
   },
 
   array_write_packed: function(n) {
     var sink = 0
     var a = make_packed_array(1024)
-    for (var i = 0; i < n; i++) a[i & 1023] = i
+    var i = 0
+    for (i = 0; i < n; i++) a[i & 1023] = i
     return blackhole(sink, a[17] | 0)
   },
 
@@ -190,9 +240,10 @@ return {
     var sink = 0
     var a = make_holey_array(2048)
     var x = 0
-    for (var i = 0; i < n; i++) {
-      var v = a[(i & 2047)]
-      // If "missing" is a special value in your language, this stresses that path too
+    var i = 0
+    var v = null
+    for (i = 0; i < n; i++) {
+      v = a[(i & 2047)]
       if (v) x = (x + v) | 0
     }
     return blackhole(sink, x)
@@ -201,21 +252,97 @@ return {
   array_push_steady: function(n) {
     var sink = 0
     var x = 0
-    for (var j = 0; j < n; j++) {
-      var a = []
-      for (var i = 0; i < 256; i++) push(a, i)
+    var j = 0
+    var i = 0
+    var a = null
+    for (j = 0; j < n; j++) {
+      a = []
+      for (i = 0; i < 256; i++) push(a, i)
       x = (x + length(a)) | 0
     }
     return blackhole(sink, x)
   },
 
+  array_push_pop: function(n) {
+    var sink = 0
+    var a = []
+    var x = 0
+    var i = 0
+    var v = 0
+    for (i = 0; i < n; i++) {
+      push(a, i)
+      if (length(a) > 64) {
+        v = pop(a)
+        x = (x + v) | 0
+      }
+    }
+    return blackhole(sink, x)
+  },
+
+  array_indexed_sum: function(n) {
+    var sink = 0
+    var a = make_packed_array(1024)
+    var x = 0
+    var j = 0
+    var i = 0
+    for (j = 0; j < n; j++) {
+      x = 0
+      for (i = 0; i < 1024; i++) {
+        x = (x + a[i]) | 0
+      }
+    }
+    return blackhole(sink, x)
+  },
+
   // 6) Strings
   string_concat_small: function(n) {
     var sink = 0
     var x = 0
-    for (var j = 0; j < n; j++) {
-      var s = ""
-      for (var i = 0; i < 16; i++) s = s + "x"
+    var j = 0
+    var i = 0
+    var s = null
+    for (j = 0; j < n; j++) {
+      s = ""
+      for (i = 0; i < 16; i++) s = s + "x"
+      x = (x + length(s)) | 0
+    }
+    return blackhole(sink, x)
+  },
+
+  string_concat_medium: function(n) {
+    var sink = 0
+    var x = 0
+    var j = 0
+    var i = 0
+    var s = null
+    for (j = 0; j < n; j++) {
+      s = ""
+      for (i = 0; i < 100; i++) s = s + "abcdefghij"
+      x = (x + length(s)) | 0
+    }
+    return blackhole(sink, x)
+  },
+
+  string_interpolation: function(n) {
+    var sink = 0
+    var x = 0
+    var i = 0
+    var s = null
+    for (i = 0; i < n; i++) {
+      s = `item_${i}_value_${i * 2}`
+      x = (x + length(s)) | 0
+    }
+    return blackhole(sink, x)
+  },
+
+  string_slice: function(n) {
+    var sink = 0
+    var base = "the quick brown fox jumps over the lazy dog"
+    var x = 0
+    var i = 0
+    var s = null
+    for (i = 0; i < n; i++) {
+      s = text(base, i % 10, i % 10 + 10)
       x = (x + length(s)) | 0
     }
     return blackhole(sink, x)
@@ -225,8 +352,10 @@ return {
   alloc_tiny_objects: function(n) {
     var sink = 0
     var x = 0
-    for (var i = 0; i < n; i++) {
-      var o = { a: i, b: i + 1, c: i + 2 }
+    var i = 0
+    var o = null
+    for (i = 0; i < n; i++) {
+      o = {a: i, b: i + 1, c: i + 2}
       x = (x + o.b) | 0
     }
     return blackhole(sink, x)
@@ -235,9 +364,12 @@ return {
   alloc_linked_list: function(n) {
     var sink = 0
     var head = null
-    for (var i = 0; i < n; i++) head = { v: i, next: head }
+    var i = 0
     var x = 0
-    var p = head
+    var p = null
+    for (i = 0; i < n; i++) head = {v: i, next: head}
+    x = 0
+    p = head
     while (p) {
       x = (x + p.v) | 0
       p = p.next
@@ -245,18 +377,118 @@ return {
     return blackhole(sink, x)
   },
 
-  // 8) meme-specific (adapt these to your exact semantics)
-  meme_clone_read: function(n) {
-    // If meme(obj) clones like Object.create / prototypal clone, this hits it hard.
-    // Replace with your exact meme call form.
+  alloc_arrays: function(n) {
     var sink = 0
-    var base = { x: 1, y: 2 }
     var x = 0
-    for (var i = 0; i < n; i++) {
-      var o = meme(base)
+    var i = 0
+    var a = null
+    for (i = 0; i < n; i++) {
+      a = [i, i + 1, i + 2, i + 3]
+      x = (x + a[2]) | 0
+    }
+    return blackhole(sink, x)
+  },
+
+  alloc_short_lived: function(n) {
+    var sink = 0
+    var x = 0
+    var i = 0
+    var o = null
+    // Allocate objects that immediately become garbage
+    for (i = 0; i < n; i++) {
+      o = {val: i, data: {inner: i + 1}}
+      x = (x + o.data.inner) | 0
+    }
+    return blackhole(sink, x)
+  },
+
+  alloc_long_lived_pressure: function(n) {
+    var sink = 0
+    var store = []
+    var x = 0
+    var i = 0
+    var o = null
+    // Keep first 1024 objects alive, churn the rest
+    for (i = 0; i < n; i++) {
+      o = {val: i, data: i * 2}
+      if (i < 1024) {
+        push(store, o)
+      }
+      x = (x + o.data) | 0
+    }
+    return blackhole(sink, x)
+  },
+
+  // 8) Meme (prototype clone)
+  meme_clone_read: function(n) {
+    var sink = 0
+    var base = {x: 1, y: 2}
+    var x = 0
+    var i = 0
+    var o = null
+    for (i = 0; i < n; i++) {
+      o = meme(base)
       x = (x + o.x) | 0
     }
     return blackhole(sink, x)
   },
 
+  // 9) Guard / type check paths
+  guard_hot_number: function(n) {
+    // Monomorphic number path — guards should hoist
+    var sink = 0
+    var x = 1
+    var i = 0
+    for (i = 0; i < n; i++) x = x + 1
+    return blackhole(sink, x | 0)
+  },
+
+  guard_mixed_types: function(n) {
+    // Alternating number/text — guards must stay
+    var sink = 0
+    var vals = [1, "a", 2, "b", 3, "c", 4, "d"]
+    var x = 0
+    var i = 0
+    for (i = 0; i < n; i++) {
+      if (is_number(vals[i & 7])) x = (x + vals[i & 7]) | 0
+    }
+    return blackhole(sink, x)
+  },
+
+  // 10) Reduce / higher-order
+  reduce_sum: function(n) {
+    var sink = 0
+    var a = make_packed_array(256)
+    var x = 0
+    var i = 0
+    for (i = 0; i < n; i++) {
+      x = (x + reduce(a, function(acc, v) { return acc + v }, 0)) | 0
+    }
+    return blackhole(sink, x)
+  },
+
+  filter_evens: function(n) {
+    var sink = 0
+    var a = make_packed_array(256)
+    var x = 0
+    var i = 0
+    for (i = 0; i < n; i++) {
+      x = (x + length(filter(a, function(v) { return v % 2 == 0 }))) | 0
+    }
+    return blackhole(sink, x)
+  },
+
+  arrfor_sum: function(n) {
+    var sink = 0
+    var a = make_packed_array(256)
+    var x = 0
+    var i = 0
+    var sum = 0
+    for (i = 0; i < n; i++) {
+      sum = 0
+      arrfor(a, function(v) { sum += v })
+      x = (x + sum) | 0
+    }
+    return blackhole(sink, x)
+  }
 }

benches/module_load.cm

@@ -0,0 +1,249 @@
+// module_load.cm — Module loading simulation (macro benchmark)
+// Simulates parsing many small modules, linking, and running.
+// Tests the "build scenario" pattern.
+
+var json = use('json')
+
+// Simulate a small module: parse token stream + build AST + evaluate
+function tokenize(src) {
+  var tokens = []
+  var i = 0
+  var ch = null
+  var chars = array(src)
+  var buf = ""
+
+  for (i = 0; i < length(chars); i++) {
+    ch = chars[i]
+    if (ch == " " || ch == "\n" || ch == "\t") {
+      if (length(buf) > 0) {
+        push(tokens, buf)
+        buf = ""
+      }
+    } else if (ch == "(" || ch == ")" || ch == "+" || ch == "-"
+            || ch == "*" || ch == "=" || ch == ";" || ch == ",") {
+      if (length(buf) > 0) {
+        push(tokens, buf)
+        buf = ""
+      }
+      push(tokens, ch)
+    } else {
+      buf = buf + ch
+    }
+  }
+  if (length(buf) > 0) push(tokens, buf)
+  return tokens
+}
+
+// Build a simple AST from tokens
+function parse_tokens(tokens) {
+  var ast = []
+  var i = 0
+  var tok = null
+  var node = null
+  for (i = 0; i < length(tokens); i++) {
+    tok = tokens[i]
+    if (tok == "var" || tok == "def") {
+      node = {type: "decl", kind: tok, name: null, value: null}
+      i++
+      if (i < length(tokens)) node.name = tokens[i]
+      i++ // skip =
+      i++
+      if (i < length(tokens)) node.value = tokens[i]
+      push(ast, node)
+    } else if (tok == "return") {
+      node = {type: "return", value: null}
+      i++
+      if (i < length(tokens)) node.value = tokens[i]
+      push(ast, node)
+    } else if (tok == "function") {
+      node = {type: "func", name: null, body: []}
+      i++
+      if (i < length(tokens)) node.name = tokens[i]
+      // Skip to matching )
+      while (i < length(tokens) && tokens[i] != ")") i++
+      push(ast, node)
+    } else {
+      push(ast, {type: "expr", value: tok})
+    }
+  }
+  return ast
+}
+
+// Evaluate: simple symbol table + resolution
+function evaluate(ast, env) {
+  var result = null
+  var i = 0
+  var node = null
+  for (i = 0; i < length(ast); i++) {
+    node = ast[i]
+    if (node.type == "decl") {
+      env[node.name] = node.value
+    } else if (node.type == "return") {
+      result = node.value
+      if (env[result]) result = env[result]
+    } else if (node.type == "func") {
+      env[node.name] = node
+    }
+  }
+  return result
+}
+
+// Generate fake module source code
+function generate_module(id, dep_count) {
+  var src = ""
+  var i = 0
+  src = src + "var _id = " + text(id) + ";\n"
+  for (i = 0; i < dep_count; i++) {
+    src = src + "var dep" + text(i) + " = use(mod_" + text(i) + ");\n"
+  }
+  src = src + "var x = " + text(id * 17) + ";\n"
+  src = src + "var y = " + text(id * 31) + ";\n"
+  src = src + "function compute(a, b) { return a + b; }\n"
+  src = src + "var result = compute(x, y);\n"
+  src = src + "return result;\n"
+  return src
+}
+
+// Simulate loading N modules with dependency chains
+function simulate_build(n_modules, deps_per_module) {
+  var modules = []
+  var loaded = {}
+  var i = 0
+  var j = 0
+  var src = null
+  var tokens = null
+  var ast = null
+  var env = null
+  var result = null
+  var total_tokens = 0
+  var total_nodes = 0
+
+  // Generate all module sources
+  for (i = 0; i < n_modules; i++) {
+    src = generate_module(i, deps_per_module)
+    push(modules, src)
+  }
+
+  // "Load" each module: tokenize → parse → evaluate
+  for (i = 0; i < n_modules; i++) {
+    tokens = tokenize(modules[i])
+    total_tokens += length(tokens)
+
+    ast = parse_tokens(tokens)
+    total_nodes += length(ast)
+
+    env = {}
+    // Resolve dependencies
+    for (j = 0; j < deps_per_module; j++) {
+      if (j < i) {
+        env["dep" + text(j)] = loaded["mod_" + text(j)]
+      }
+    }
+
+    result = evaluate(ast, env)
+    loaded["mod_" + text(i)] = result
+  }
+
+  return {
+    modules: n_modules,
+    total_tokens: total_tokens,
+    total_nodes: total_nodes,
+    last_result: result
+  }
+}
+
+// Dependency graph analysis (topological sort simulation)
+function topo_sort(n_modules, deps_per_module) {
+  // Build adjacency list
+  var adj = {}
+  var in_degree = {}
+  var i = 0
+  var j = 0
+  var name = null
+  var dep = null
+
+  for (i = 0; i < n_modules; i++) {
+    name = "mod_" + text(i)
+    adj[name] = []
+    in_degree[name] = 0
+  }
+
+  for (i = 0; i < n_modules; i++) {
+    name = "mod_" + text(i)
+    for (j = 0; j < deps_per_module; j++) {
+      if (j < i) {
+        dep = "mod_" + text(j)
+        push(adj[dep], name)
+        in_degree[name] = in_degree[name] + 1
+      }
+    }
+  }
+
+  // Kahn's algorithm
+  var queue = []
+  var keys = array(in_degree)
+  for (i = 0; i < length(keys); i++) {
+    if (in_degree[keys[i]] == 0) push(queue, keys[i])
+  }
+
+  var order = []
+  var current = null
+  var neighbors = null
+  var qi = 0
+  while (qi < length(queue)) {
+    current = queue[qi]
+    qi++
+    push(order, current)
+    neighbors = adj[current]
+    if (neighbors) {
+      for (i = 0; i < length(neighbors); i++) {
+        in_degree[neighbors[i]] = in_degree[neighbors[i]] - 1
+        if (in_degree[neighbors[i]] == 0) push(queue, neighbors[i])
+      }
+    }
+  }
+
+  return order
+}
+
+return {
+  // Small build: 50 modules, 3 deps each
+  build_50: function(n) {
+    var i = 0
+    var result = null
+    for (i = 0; i < n; i++) {
+      result = simulate_build(50, 3)
+    }
+    return result
+  },
+
+  // Medium build: 200 modules, 5 deps each
+  build_200: function(n) {
+    var i = 0
+    var result = null
+    for (i = 0; i < n; i++) {
+      result = simulate_build(200, 5)
+    }
+    return result
+  },
+
+  // Large build: 500 modules, 5 deps each
+  build_500: function(n) {
+    var i = 0
+    var result = null
+    for (i = 0; i < n; i++) {
+      result = simulate_build(500, 5)
+    }
+    return result
+  },
+
+  // Topo sort of 500 module dependency graph
+  topo_sort_500: function(n) {
+    var i = 0
+    var order = null
+    for (i = 0; i < n; i++) {
+      order = topo_sort(500, 5)
+    }
+    return order
+  }
+}

benches/nbody.cm

@@ -0,0 +1,160 @@
+// nbody.cm — N-body gravitational simulation kernel
+// Pure numeric + allocation workload. Classic VM benchmark.
+
+var math = use('math/radians')
+
+def PI = 3.141592653589793
+def SOLAR_MASS = 4 * PI * PI
+def DAYS_PER_YEAR = 365.24
+
+function make_system() {
+  // Sun + 4 Jovian planets
+  var sun = {x: 0, y: 0, z: 0, vx: 0, vy: 0, vz: 0, mass: SOLAR_MASS}
+
+  var jupiter = {
+    x: 4.84143144246472090,
+    y: -1.16032004402742839,
+    z: -0.103622044471123109,
+    vx: 0.00166007664274403694 * DAYS_PER_YEAR,
+    vy: 0.00769901118419740425 * DAYS_PER_YEAR,
+    vz: -0.0000690460016972063023 * DAYS_PER_YEAR,
+    mass: 0.000954791938424326609 * SOLAR_MASS
+  }
+
+  var saturn = {
+    x: 8.34336671824457987,
+    y: 4.12479856412430479,
+    z: -0.403523417114321381,
+    vx: -0.00276742510726862411 * DAYS_PER_YEAR,
+    vy: 0.00499852801234917238 * DAYS_PER_YEAR,
+    vz: 0.0000230417297573763929 * DAYS_PER_YEAR,
+    mass: 0.000285885980666130812 * SOLAR_MASS
+  }
+
+  var uranus = {
+    x: 12.8943695621391310,
+    y: -15.1111514016986312,
+    z: -0.223307578892655734,
+    vx: 0.00296460137564761618 * DAYS_PER_YEAR,
+    vy: 0.00237847173959480950 * DAYS_PER_YEAR,
+    vz: -0.0000296589568540237556 * DAYS_PER_YEAR,
+    mass: 0.0000436624404335156298 * SOLAR_MASS
+  }
+
+  var neptune = {
+    x: 15.3796971148509165,
+    y: -25.9193146099879641,
+    z: 0.179258772950371181,
+    vx: 0.00268067772490389322 * DAYS_PER_YEAR,
+    vy: 0.00162824170038242295 * DAYS_PER_YEAR,
+    vz: -0.0000951592254519715870 * DAYS_PER_YEAR,
+    mass: 0.0000515138902046611451 * SOLAR_MASS
+  }
+
+  var bodies = [sun, jupiter, saturn, uranus, neptune]
+
+  // Offset momentum
+  var px = 0
+  var py = 0
+  var pz = 0
+  var i = 0
+  for (i = 0; i < length(bodies); i++) {
+    px += bodies[i].vx * bodies[i].mass
+    py += bodies[i].vy * bodies[i].mass
+    pz += bodies[i].vz * bodies[i].mass
+  }
+  sun.vx = -px / SOLAR_MASS
+  sun.vy = -py / SOLAR_MASS
+  sun.vz = -pz / SOLAR_MASS
+
+  return bodies
+}
+
+function advance(bodies, dt) {
+  var n = length(bodies)
+  var i = 0
+  var j = 0
+  var bi = null
+  var bj = null
+  var dx = 0
+  var dy = 0
+  var dz = 0
+  var dist_sq = 0
+  var dist = 0
+  var mag = 0
+
+  for (i = 0; i < n; i++) {
+    bi = bodies[i]
+    for (j = i + 1; j < n; j++) {
+      bj = bodies[j]
+      dx = bi.x - bj.x
+      dy = bi.y - bj.y
+      dz = bi.z - bj.z
+      dist_sq = dx * dx + dy * dy + dz * dz
+      dist = math.sqrt(dist_sq)
+      mag = dt / (dist_sq * dist)
+
+      bi.vx -= dx * bj.mass * mag
+      bi.vy -= dy * bj.mass * mag
+      bi.vz -= dz * bj.mass * mag
+      bj.vx += dx * bi.mass * mag
+      bj.vy += dy * bi.mass * mag
+      bj.vz += dz * bi.mass * mag
+    }
+  }
+
+  for (i = 0; i < n; i++) {
+    bi = bodies[i]
+    bi.x += dt * bi.vx
+    bi.y += dt * bi.vy
+    bi.z += dt * bi.vz
+  }
+}
+
+function energy(bodies) {
+  var e = 0
+  var n = length(bodies)
+  var i = 0
+  var j = 0
+  var bi = null
+  var bj = null
+  var dx = 0
+  var dy = 0
+  var dz = 0
+  for (i = 0; i < n; i++) {
+    bi = bodies[i]
+    e += 0.5 * bi.mass * (bi.vx * bi.vx + bi.vy * bi.vy + bi.vz * bi.vz)
+    for (j = i + 1; j < n; j++) {
+      bj = bodies[j]
+      dx = bi.x - bj.x
+      dy = bi.y - bj.y
+      dz = bi.z - bj.z
+      e -= (bi.mass * bj.mass) / math.sqrt(dx * dx + dy * dy + dz * dz)
+    }
+  }
+  return e
+}
+
+return {
+  nbody_1k: function(n) {
+    var i = 0
+    var j = 0
+    var bodies = null
+    for (i = 0; i < n; i++) {
+      bodies = make_system()
+      for (j = 0; j < 1000; j++) advance(bodies, 0.01)
+      energy(bodies)
+    }
+  },
+
+  nbody_10k: function(n) {
+    var i = 0
+    var j = 0
+    var bodies = null
+    for (i = 0; i < n; i++) {
+      bodies = make_system()
+      for (j = 0; j < 10000; j++) advance(bodies, 0.01)
+      energy(bodies)
+    }
+  }
+}

benches/ray_tracer.cm

@@ -0,0 +1,154 @@
+// ray_tracer.cm — Simple ray tracer kernel
+// Control flow + numeric + allocation. Classic VM benchmark.
+
+var math = use('math/radians')
+
+function vec(x, y, z) {
+  return {x: x, y: y, z: z}
+}
+
+function vadd(a, b) {
+  return {x: a.x + b.x, y: a.y + b.y, z: a.z + b.z}
+}
+
+function vsub(a, b) {
+  return {x: a.x - b.x, y: a.y - b.y, z: a.z - b.z}
+}
+
+function vmul(v, s) {
+  return {x: v.x * s, y: v.y * s, z: v.z * s}
+}
+
+function vdot(a, b) {
+  return a.x * b.x + a.y * b.y + a.z * b.z
+}
+
+function vnorm(v) {
+  var len = math.sqrt(vdot(v, v))
+  if (len == 0) return vec(0, 0, 0)
+  return vmul(v, 1 / len)
+}
+
+function make_sphere(center, radius, color) {
+  return {
+    center: center,
+    radius: radius,
+    color: color
+  }
+}
+
+function intersect_sphere(origin, dir, sphere) {
+  var oc = vsub(origin, sphere.center)
+  var b = vdot(oc, dir)
+  var c = vdot(oc, oc) - sphere.radius * sphere.radius
+  var disc = b * b - c
+  if (disc < 0) return -1
+  var sq = math.sqrt(disc)
+  var t1 = -b - sq
+  var t2 = -b + sq
+  if (t1 > 0.001) return t1
+  if (t2 > 0.001) return t2
+  return -1
+}
+
+function make_scene() {
+  var spheres = [
+    make_sphere(vec(0, -1, 5), 1, vec(1, 0, 0)),
+    make_sphere(vec(2, 0, 6), 1, vec(0, 1, 0)),
+    make_sphere(vec(-2, 0, 4), 1, vec(0, 0, 1)),
+    make_sphere(vec(0, 1, 4.5), 0.5, vec(1, 1, 0)),
+    make_sphere(vec(1, -0.5, 3), 0.3, vec(1, 0, 1)),
+    make_sphere(vec(0, -101, 5), 100, vec(0.5, 0.5, 0.5))
+  ]
+  var light = vnorm(vec(1, 1, -1))
+  return {spheres: spheres, light: light}
+}
+
+function trace(origin, dir, scene) {
+  var closest_t = 999999
+  var closest_sphere = null
+  var i = 0
+  var t = 0
+  for (i = 0; i < length(scene.spheres); i++) {
+    t = intersect_sphere(origin, dir, scene.spheres[i])
+    if (t > 0 && t < closest_t) {
+      closest_t = t
+      closest_sphere = scene.spheres[i]
+    }
+  }
+
+  if (!closest_sphere) return vec(0.2, 0.3, 0.5) // sky color
+
+  var hit = vadd(origin, vmul(dir, closest_t))
+  var normal = vnorm(vsub(hit, closest_sphere.center))
+  var diffuse = vdot(normal, scene.light)
+  if (diffuse < 0) diffuse = 0
+
+  // Shadow check
+  var shadow_origin = vadd(hit, vmul(normal, 0.001))
+  var in_shadow = false
+  for (i = 0; i < length(scene.spheres); i++) {
+    if (scene.spheres[i] != closest_sphere) {
+      t = intersect_sphere(shadow_origin, scene.light, scene.spheres[i])
+      if (t > 0) {
+        in_shadow = true
+        break
+      }
+    }
+  }
+
+  var ambient = 0.15
+  var intensity = in_shadow ? ambient : ambient + diffuse * 0.85
+  return vmul(closest_sphere.color, intensity)
+}
+
+function render(width, height, scene) {
+  var aspect = width / height
+  var fov = 1.0
+  var total_r = 0
+  var total_g = 0
+  var total_b = 0
+  var y = 0
+  var x = 0
+  var u = 0
+  var v = 0
+  var dir = null
+  var color = null
+  var origin = vec(0, 0, 0)
+
+  for (y = 0; y < height; y++) {
+    for (x = 0; x < width; x++) {
+      u = (2 * (x + 0.5) / width - 1) * aspect * fov
+      v = (1 - 2 * (y + 0.5) / height) * fov
+      dir = vnorm(vec(u, v, 1))
+      color = trace(origin, dir, scene)
+      total_r += color.x
+      total_g += color.y
+      total_b += color.z
+    }
+  }
+
+  return {r: total_r, g: total_g, b: total_b}
+}
+
+var scene = make_scene()
+
+return {
+  raytrace_32x32: function(n) {
+    var i = 0
+    var result = null
+    for (i = 0; i < n; i++) {
+      result = render(32, 32, scene)
+    }
+    return result
+  },
+
+  raytrace_64x64: function(n) {
+    var i = 0
+    var result = null
+    for (i = 0; i < n; i++) {
+      result = render(64, 64, scene)
+    }
+    return result
+  }
+}

benches/richards.cm

@@ -0,0 +1,251 @@
+// richards.cm — Richards benchmark (scheduler simulation)
+// Object-ish workload: dynamic dispatch, state machines, queuing.
+
+def IDLE = 0
+def WORKER = 1
+def HANDLER_A = 2
+def HANDLER_B = 3
+def DEVICE_A = 4
+def DEVICE_B = 5
+def NUM_TASKS = 6
+
+def TASK_RUNNING = 0
+def TASK_WAITING = 1
+def TASK_HELD = 2
+def TASK_SUSPENDED = 3
+
+function make_packet(link, id, kind) {
+  return {link: link, id: id, kind: kind, datum: 0, data: array(4, 0)}
+}
+
+function scheduler() {
+  var tasks = array(NUM_TASKS, null)
+  var current = null
+  var queue_count = 0
+  var hold_count = 0
+  var v1 = 0
+  var v2 = 0
+  var w_id = HANDLER_A
+  var w_datum = 0
+  var h_a_queue = null
+  var h_a_count = 0
+  var h_b_queue = null
+  var h_b_count = 0
+  var dev_a_pkt = null
+  var dev_b_pkt = null
+
+  var find_next = function() {
+    var best = null
+    var i = 0
+    for (i = 0; i < NUM_TASKS; i++) {
+      if (tasks[i] && tasks[i].state == TASK_RUNNING) {
+        if (!best || tasks[i].priority > best.priority) {
+          best = tasks[i]
+        }
+      }
+    }
+    return best
+  }
+
+  var hold_self = function() {
+    hold_count++
+    if (current) current.state = TASK_HELD
+    return find_next()
+  }
+
+  var release = function(id) {
+    var t = tasks[id]
+    if (!t) return find_next()
+    if (t.state == TASK_HELD) t.state = TASK_RUNNING
+    if (t.priority > (current ? current.priority : -1)) return t
+    return current
+  }
+
+  var queue_packet = function(pkt) {
+    var t = tasks[pkt.id]
+    var p = null
+    if (!t) return find_next()
+    queue_count++
+    pkt.link = null
+    pkt.id = current ? current.id : 0
+    if (!t.queue) {
+      t.queue = pkt
+      t.state = TASK_RUNNING
+      if (t.priority > (current ? current.priority : -1)) return t
+    } else {
+      p = t.queue
+      while (p.link) p = p.link
+      p.link = pkt
+    }
+    return current
+  }
+
+  // Idle task
+  tasks[IDLE] = {id: IDLE, priority: 0, queue: null, state: TASK_RUNNING,
+    hold_count: 0, queue_count: 0,
+    fn: function(pkt) {
+      v1--
+      if (v1 == 0) return hold_self()
+      if ((v2 & 1) == 0) {
+        v2 = v2 >> 1
+        return release(DEVICE_A)
+      }
+      v2 = (v2 >> 1) ^ 0xD008
+      return release(DEVICE_B)
+    }
+  }
+
+  // Worker task
+  tasks[WORKER] = {id: WORKER, priority: 1000, queue: null, state: TASK_SUSPENDED,
+    hold_count: 0, queue_count: 0,
+    fn: function(pkt) {
+      var i = 0
+      if (!pkt) return hold_self()
+      w_id = (w_id == HANDLER_A) ? HANDLER_B : HANDLER_A
+      pkt.id = w_id
+      pkt.datum = 0
+      for (i = 0; i < 4; i++) {
+        w_datum++
+        if (w_datum > 26) w_datum = 1
+        pkt.data[i] = 65 + w_datum
+      }
+      return queue_packet(pkt)
+    }
+  }
+
+  // Handler A
+  tasks[HANDLER_A] = {id: HANDLER_A, priority: 2000, queue: null, state: TASK_SUSPENDED,
+    hold_count: 0, queue_count: 0,
+    fn: function(pkt) {
+      var p = null
+      if (pkt) { h_a_queue = pkt; h_a_count++ }
+      if (h_a_queue) {
+        p = h_a_queue
+        h_a_queue = p.link
+        if (h_a_count < 3) return queue_packet(p)
+        return release(DEVICE_A)
+      }
+      return hold_self()
+    }
+  }
+
+  // Handler B
+  tasks[HANDLER_B] = {id: HANDLER_B, priority: 3000, queue: null, state: TASK_SUSPENDED,
+    hold_count: 0, queue_count: 0,
+    fn: function(pkt) {
+      var p = null
+      if (pkt) { h_b_queue = pkt; h_b_count++ }
+      if (h_b_queue) {
+        p = h_b_queue
+        h_b_queue = p.link
+        if (h_b_count < 3) return queue_packet(p)
+        return release(DEVICE_B)
+      }
+      return hold_self()
+    }
+  }
+
+  // Device A
+  tasks[DEVICE_A] = {id: DEVICE_A, priority: 4000, queue: null, state: TASK_SUSPENDED,
+    hold_count: 0, queue_count: 0,
+    fn: function(pkt) {
+      var p = null
+      if (pkt) { dev_a_pkt = pkt; return hold_self() }
+      if (dev_a_pkt) {
+        p = dev_a_pkt
+        dev_a_pkt = null
+        return queue_packet(p)
+      }
+      return hold_self()
+    }
+  }
+
+  // Device B
+  tasks[DEVICE_B] = {id: DEVICE_B, priority: 5000, queue: null, state: TASK_SUSPENDED,
+    hold_count: 0, queue_count: 0,
+    fn: function(pkt) {
+      var p = null
+      if (pkt) { dev_b_pkt = pkt; return hold_self() }
+      if (dev_b_pkt) {
+        p = dev_b_pkt
+        dev_b_pkt = null
+        return queue_packet(p)
+      }
+      return hold_self()
+    }
+  }
+
+  var run = function(iterations) {
+    var i = 0
+    var pkt1 = null
+    var pkt2 = null
+    var steps = 0
+    var pkt = null
+    var next = null
+
+    v1 = iterations
+    v2 = 0xBEEF
+    queue_count = 0
+    hold_count = 0
+    w_id = HANDLER_A
+    w_datum = 0
+    h_a_queue = null
+    h_a_count = 0
+    h_b_queue = null
+    h_b_count = 0
+    dev_a_pkt = null
+    dev_b_pkt = null
+
+    for (i = 0; i < NUM_TASKS; i++) {
+      if (tasks[i]) {
+        tasks[i].state = (i == IDLE) ? TASK_RUNNING : TASK_SUSPENDED
+        tasks[i].queue = null
+      }
+    }
+
+    pkt1 = make_packet(null, WORKER, 1)
+    pkt2 = make_packet(pkt1, WORKER, 1)
+    tasks[WORKER].queue = pkt2
+    tasks[WORKER].state = TASK_RUNNING
+
+    current = find_next()
+    while (current && steps < iterations * 10) {
+      pkt = current.queue
+      if (pkt) {
+        current.queue = pkt.link
+        current.queue_count++
+      }
+      next = current.fn(pkt)
+      if (next) current = next
+      else current = find_next()
+      steps++
+    }
+    return {queue_count: queue_count, hold_count: hold_count, steps: steps}
+  }
+
+  return {run: run}
+}
+
+return {
+  richards_100: function(n) {
+    var i = 0
+    var s = null
+    var result = null
+    for (i = 0; i < n; i++) {
+      s = scheduler()
+      result = s.run(100)
+    }
+    return result
+  },
+
+  richards_1k: function(n) {
+    var i = 0
+    var s = null
+    var result = null
+    for (i = 0; i < n; i++) {
+      s = scheduler()
+      result = s.run(1000)
+    }
+    return result
+  }
+}

benches/sorting.cm

@@ -0,0 +1,180 @@
+// sorting.cm — Sorting and searching kernel
+// Array manipulation, comparison-heavy, allocation patterns.
+
+function make_random_array(n, seed) {
+  var a = []
+  var x = seed
+  var i = 0
+  for (i = 0; i < n; i++) {
+    x = ((x * 1103515245 + 12345) & 0x7FFFFFFF) | 0
+    push(a, x % 10000)
+  }
+  return a
+}
+
+function make_descending(n) {
+  var a = []
+  var i = 0
+  for (i = n - 1; i >= 0; i--) push(a, i)
+  return a
+}
+
+// Manual quicksort (tests recursion + array mutation)
+function qsort(arr, lo, hi) {
+  var i = lo
+  var j = hi
+  var pivot = arr[floor((lo + hi) / 2)]
+  var tmp = 0
+  if (lo >= hi) return null
+  while (i <= j) {
+    while (arr[i] < pivot) i++
+    while (arr[j] > pivot) j--
+    if (i <= j) {
+      tmp = arr[i]
+      arr[i] = arr[j]
+      arr[j] = tmp
+      i++
+      j--
+    }
+  }
+  if (lo < j) qsort(arr, lo, j)
+  if (i < hi) qsort(arr, i, hi)
+  return null
+}
+
+// Merge sort (tests allocation + array creation)
+function msort(arr) {
+  var n = length(arr)
+  if (n <= 1) return arr
+  var mid = floor(n / 2)
+  var left = msort(array(arr, 0, mid))
+  var right = msort(array(arr, mid, n))
+  return merge(left, right)
+}
+
+function merge(a, b) {
+  var result = []
+  var i = 0
+  var j = 0
+  while (i < length(a) && j < length(b)) {
+    if (a[i] <= b[j]) {
+      push(result, a[i])
+      i++
+    } else {
+      push(result, b[j])
+      j++
+    }
+  }
+  while (i < length(a)) {
+    push(result, a[i])
+    i++
+  }
+  while (j < length(b)) {
+    push(result, b[j])
+    j++
+  }
+  return result
+}
+
+// Binary search
+function bsearch(arr, target) {
+  var lo = 0
+  var hi = length(arr) - 1
+  var mid = 0
+  while (lo <= hi) {
+    mid = floor((lo + hi) / 2)
+    if (arr[mid] == target) return mid
+    if (arr[mid] < target) lo = mid + 1
+    else hi = mid - 1
+  }
+  return -1
+}
+
+// Sort objects by field
+function sort_records(n) {
+  var records = []
+  var x = 42
+  var i = 0
+  for (i = 0; i < n; i++) {
+    x = ((x * 1103515245 + 12345) & 0x7FFFFFFF) | 0
+    push(records, {id: i, score: x % 10000, name: `item_${i}`})
+  }
+  return sort(records, "score")
+}
+
+return {
+  // Quicksort 1K random integers
+  qsort_1k: function(n) {
+    var i = 0
+    var a = null
+    for (i = 0; i < n; i++) {
+      a = make_random_array(1000, i)
+      qsort(a, 0, length(a) - 1)
+    }
+    return a
+  },
+
+  // Quicksort 10K random integers
+  qsort_10k: function(n) {
+    var i = 0
+    var a = null
+    for (i = 0; i < n; i++) {
+      a = make_random_array(10000, i)
+      qsort(a, 0, length(a) - 1)
+    }
+    return a
+  },
+
+  // Merge sort 1K (allocation heavy)
+  msort_1k: function(n) {
+    var i = 0
+    var result = null
+    for (i = 0; i < n; i++) {
+      result = msort(make_random_array(1000, i))
+    }
+    return result
+  },
+
+  // Built-in sort 1K
+  builtin_sort_1k: function(n) {
+    var i = 0
+    var result = null
+    for (i = 0; i < n; i++) {
+      result = sort(make_random_array(1000, i))
+    }
+    return result
+  },
+
+  // Sort worst case (descending → ascending)
+  sort_worst_case: function(n) {
+    var i = 0
+    var a = null
+    for (i = 0; i < n; i++) {
+      a = make_descending(1000)
+      qsort(a, 0, length(a) - 1)
+    }
+    return a
+  },
+
+  // Binary search in sorted array
+  bsearch_1k: function(n) {
+    var sorted = make_random_array(1000, 42)
+    sorted = sort(sorted)
+    var found = 0
+    var i = 0
+    for (i = 0; i < n; i++) {
+      if (bsearch(sorted, sorted[i % 1000]) >= 0) found++
+    }
+    return found
+  },
+
+  // Sort records by field
+  sort_records_500: function(n) {
+    var i = 0
+    var result = null
+    for (i = 0; i < n; i++) {
+      result = sort_records(500)
+    }
+    return result
+  }
+}

benches/spectral_norm.cm

@@ -0,0 +1,82 @@
+// spectral_norm.cm — Spectral norm kernel
+// Pure numeric, dense array access, mathematical computation.
+
+var math = use('math/radians')
+
+function eval_a(i, j) {
+  return 1.0 / ((i + j) * (i + j + 1) / 2 + i + 1)
+}
+
+function eval_a_times_u(n, u, au) {
+  var i = 0
+  var j = 0
+  var sum = 0
+  for (i = 0; i < n; i++) {
+    sum = 0
+    for (j = 0; j < n; j++) {
+      sum += eval_a(i, j) * u[j]
+    }
+    au[i] = sum
+  }
+}
+
+function eval_at_times_u(n, u, atu) {
+  var i = 0
+  var j = 0
+  var sum = 0
+  for (i = 0; i < n; i++) {
+    sum = 0
+    for (j = 0; j < n; j++) {
+      sum += eval_a(j, i) * u[j]
+    }
+    atu[i] = sum
+  }
+}
+
+function eval_ata_times_u(n, u, atau) {
+  var v = array(n, 0)
+  eval_a_times_u(n, u, v)
+  eval_at_times_u(n, v, atau)
+}
+
+function spectral_norm(n) {
+  var u = array(n, 1)
+  var v = array(n, 0)
+  var i = 0
+  var vbv = 0
+  var vv = 0
+
+  for (i = 0; i < 10; i++) {
+    eval_ata_times_u(n, u, v)
+    eval_ata_times_u(n, v, u)
+  }
+
+  vbv = 0
+  vv = 0
+  for (i = 0; i < n; i++) {
+    vbv += u[i] * v[i]
+    vv += v[i] * v[i]
+  }
+
+  return math.sqrt(vbv / vv)
+}
+
+return {
+  spectral_100: function(n) {
+    var i = 0
+    var result = 0
+    for (i = 0; i < n; i++) {
+      result = spectral_norm(100)
+    }
+    return result
+  },
+
+  spectral_200: function(n) {
+    var i = 0
+    var result = 0
+    for (i = 0; i < n; i++) {
+      result = spectral_norm(200)
+    }
+    return result
+  }
+}

benches/string_processing.cm

@@ -0,0 +1,188 @@
+// string_processing.cm — String-heavy kernel
+// Concat, split, search, replace, interning path stress.
+
+function make_lorem(paragraphs) {
+  var base = "Lorem ipsum dolor sit amet consectetur adipiscing elit sed do eiusmod tempor incididunt ut labore et dolore magna aliqua Ut enim ad minim veniam quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat"
+  var result = ""
+  var i = 0
+  for (i = 0; i < paragraphs; i++) {
+    if (i > 0) result = result + " "
+    result = result + base
+  }
+  return result
+}
+
+// Build a lookup table from text
+function build_index(txt) {
+  var words = array(txt, " ")
+  var index = {}
+  var i = 0
+  var w = null
+  for (i = 0; i < length(words); i++) {
+    w = words[i]
+    if (!index[w]) {
+      index[w] = []
+    }
+    push(index[w], i)
+  }
+  return index
+}
+
+// Levenshtein-like distance (simplified)
+function edit_distance(a, b) {
+  var la = length(a)
+  var lb = length(b)
+  if (la == 0) return lb
+  if (lb == 0) return la
+
+  // Use flat array for 2 rows of DP matrix
+  var prev = array(lb + 1, 0)
+  var curr = array(lb + 1, 0)
+  var i = 0
+  var j = 0
+  var cost = 0
+  var del = 0
+  var ins = 0
+  var sub = 0
+  var tmp = null
+  var ca = array(a)
+  var cb = array(b)
+
+  for (j = 0; j <= lb; j++) prev[j] = j
+  for (i = 1; i <= la; i++) {
+    curr[0] = i
+    for (j = 1; j <= lb; j++) {
+      cost = ca[i - 1] == cb[j - 1] ? 0 : 1
+      del = prev[j] + 1
+      ins = curr[j - 1] + 1
+      sub = prev[j - 1] + cost
+      curr[j] = del
+      if (ins < curr[j]) curr[j] = ins
+      if (sub < curr[j]) curr[j] = sub
+    }
+    tmp = prev
+    prev = curr
+    curr = tmp
+  }
+  return prev[lb]
+}
+
+var lorem_5 = make_lorem(5)
+var lorem_20 = make_lorem(20)
+
+return {
+  // Split text into words and count
+  string_split_count: function(n) {
+    var i = 0
+    var words = null
+    var count = 0
+    for (i = 0; i < n; i++) {
+      words = array(lorem_5, " ")
+      count += length(words)
+    }
+    return count
+  },
+
+  // Build word index (split + hash + array ops)
+  string_index_build: function(n) {
+    var i = 0
+    var idx = null
+    for (i = 0; i < n; i++) {
+      idx = build_index(lorem_5)
+    }
+    return idx
+  },
+
+  // Search for substrings
+  string_search: function(n) {
+    var targets = ["dolor", "minim", "quis", "magna", "ipsum"]
+    var i = 0
+    var j = 0
+    var count = 0
+    for (i = 0; i < n; i++) {
+      for (j = 0; j < length(targets); j++) {
+        if (search(lorem_20, targets[j])) count++
+      }
+    }
+    return count
+  },
+
+  // Replace operations
+  string_replace: function(n) {
+    var i = 0
+    var result = null
+    for (i = 0; i < n; i++) {
+      result = replace(lorem_5, "dolor", "DOLOR")
+      result = replace(result, "ipsum", "IPSUM")
+      result = replace(result, "amet", "AMET")
+    }
+    return result
+  },
+
+  // String concatenation builder
+  string_builder: function(n) {
+    var i = 0
+    var j = 0
+    var s = null
+    var total = 0
+    for (i = 0; i < n; i++) {
+      s = ""
+      for (j = 0; j < 50; j++) {
+        s = s + "key=" + text(j) + "&value=" + text(j * 17) + "&"
+      }
+      total += length(s)
+    }
+    return total
+  },
+
+  // Edit distance (DP + array + string ops)
+  edit_distance: function(n) {
+    var words = ["kitten", "sitting", "saturday", "sunday", "intention", "execution"]
+    var i = 0
+    var j = 0
+    var total = 0
+    for (i = 0; i < n; i++) {
+      for (j = 0; j < length(words) - 1; j++) {
+        total += edit_distance(words[j], words[j + 1])
+      }
+    }
+    return total
+  },
+
+  // Upper/lower/trim chain
+  string_transforms: function(n) {
+    var src = "  Hello World  "
+    var i = 0
+    var x = 0
+    var result = null
+    for (i = 0; i < n; i++) {
+      result = trim(src)
+      result = upper(result)
+      result = lower(result)
+      x += length(result)
+    }
+    return x
+  },
+
+  // Starts_with / ends_with (interning path)
+  string_prefix_suffix: function(n) {
+    var strs = [
+      "application/json",
+      "text/html",
+      "image/png",
+      "application/xml",
+      "text/plain"
+    ]
+    var i = 0
+    var j = 0
+    var count = 0
+    for (i = 0; i < n; i++) {
+      for (j = 0; j < length(strs); j++) {
+        if (starts_with(strs[j], "application/")) count++
+        if (ends_with(strs[j], "/json")) count++
+        if (starts_with(strs[j], "text/")) count++
+      }
+    }
+    return count
+  }
+}

benches/tree_ops.cm

@@ -0,0 +1,137 @@
+// tree_ops.cm — Tree data structure operations kernel
+// Pointer chasing, recursion, allocation patterns.
+
+// Binary tree: create, walk, transform, check
+function make_tree(depth) {
+  if (depth <= 0) return {val: 1, left: null, right: null}
+  return {
+    val: depth,
+    left: make_tree(depth - 1),
+    right: make_tree(depth - 1)
+  }
+}
+
+function tree_check(node) {
+  if (!node) return 0
+  if (!node.left) return node.val
+  return node.val + tree_check(node.left) - tree_check(node.right)
+}
+
+function tree_sum(node) {
+  if (!node) return 0
+  return node.val + tree_sum(node.left) + tree_sum(node.right)
+}
+
+function tree_depth(node) {
+  if (!node) return 0
+  var l = tree_depth(node.left)
+  var r = tree_depth(node.right)
+  return 1 + (l > r ? l : r)
+}
+
+function tree_count(node) {
+  if (!node) return 0
+  return 1 + tree_count(node.left) + tree_count(node.right)
+}
+
+// Transform tree: map values
+function tree_map(node, fn) {
+  if (!node) return null
+  return {
+    val: fn(node.val),
+    left: tree_map(node.left, fn),
+    right: tree_map(node.right, fn)
+  }
+}
+
+// Flatten tree to array (in-order)
+function tree_flatten(node, result) {
+  if (!node) return null
+  tree_flatten(node.left, result)
+  push(result, node.val)
+  tree_flatten(node.right, result)
+  return null
+}
+
+// Build sorted tree from array (balanced)
+function build_balanced(arr, lo, hi) {
+  if (lo > hi) return null
+  var mid = floor((lo + hi) / 2)
+  return {
+    val: arr[mid],
+    left: build_balanced(arr, lo, mid - 1),
+    right: build_balanced(arr, mid + 1, hi)
+  }
+}
+
+// Find a value in BST
+function bst_find(node, val) {
+  if (!node) return false
+  if (val == node.val) return true
+  if (val < node.val) return bst_find(node.left, val)
+  return bst_find(node.right, val)
+}
+
+return {
+  // Binary tree create + check (allocation heavy)
+  tree_create_check: function(n) {
+    var i = 0
+    var t = null
+    var x = 0
+    for (i = 0; i < n; i++) {
+      t = make_tree(10)
+      x += tree_check(t)
+    }
+    return x
+  },
+
+  // Deep tree traversals
+  tree_traversal: function(n) {
+    var t = make_tree(12)
+    var x = 0
+    var i = 0
+    for (i = 0; i < n; i++) {
+      x += tree_sum(t) + tree_depth(t) + tree_count(t)
+    }
+    return x
+  },
+
+  // Tree map (create new tree from old)
+  tree_transform: function(n) {
+    var t = make_tree(10)
+    var i = 0
+    var mapped = null
+    for (i = 0; i < n; i++) {
+      mapped = tree_map(t, function(v) { return v * 2 + 1 })
+    }
+    return mapped
+  },
+
+  // Flatten + rebuild (array <-> tree conversion)
+  tree_flatten_rebuild: function(n) {
+    var t = make_tree(10)
+    var i = 0
+    var flat = null
+    var rebuilt = null
+    for (i = 0; i < n; i++) {
+      flat = []
+      tree_flatten(t, flat)
+      rebuilt = build_balanced(flat, 0, length(flat) - 1)
+    }
+    return rebuilt
+  },
+
+  // BST search (pointer chasing)
+  bst_search: function(n) {
+    // Build a balanced BST of 1024 elements
+    var data = []
+    var i = 0
+    for (i = 0; i < 1024; i++) push(data, i)
+    var bst = build_balanced(data, 0, 1023)
+    var found = 0
+    for (i = 0; i < n; i++) {
+      if (bst_find(bst, i % 1024)) found++
+    }
+    return found
+  }
+}

debug/debug.c

@@ -1,27 +1,15 @@
 #include "cell.h"
 
-// Return the current stack depth.
-JSC_CCALL(debug_stack_depth, return number2js(js,js_debugger_stack_depth(js)))
+// TODO: Reimplement stack depth for register VM
+JSC_CCALL(debug_stack_depth, return number2js(js, 0))
 
-// Return a backtrace of the current call stack.
-JSC_CCALL(debug_build_backtrace, return js_debugger_build_backtrace(js))
-
-// Return the closure variables for a given function.
-JSC_CCALL(debug_closure_vars, return js_debugger_closure_variables(js,argv[0]))
-
-JSC_CCALL(debug_set_closure_var,
-  js_debugger_set_closure_variable(js,argv[0],argv[1],argv[2]);
-  return JS_NULL;
-)
-
-// Return the local variables for a specific stack frame.
-JSC_CCALL(debug_local_vars, return js_debugger_local_variables(js, js2number(js,argv[0])))
-
-// Return metadata about a given function.
-JSC_CCALL(debug_fn_info, return js_debugger_fn_info(js, argv[0]))
-
-// Return an array of functions in the current backtrace.
-JSC_CCALL(debug_backtrace_fns, return js_debugger_backtrace_fns(js))
+// TODO: Reimplement debug introspection for register VM
+JSC_CCALL(debug_build_backtrace, return JS_NewArray(js))
+JSC_CCALL(debug_closure_vars, return JS_NewObject(js))
+JSC_CCALL(debug_set_closure_var, return JS_NULL;)
+JSC_CCALL(debug_local_vars, return JS_NewObject(js))
+JSC_CCALL(debug_fn_info, return JS_NewObject(js))
+JSC_CCALL(debug_backtrace_fns, return JS_NewArray(js))
 
 static const JSCFunctionListEntry js_debug_funcs[] = {
   MIST_FUNC_DEF(debug, stack_depth, 0),
@@ -37,4 +25,4 @@ JSValue js_debug_use(JSContext *js) {
   JSValue mod = JS_NewObject(js);
   JS_SetPropertyFunctionList(js,mod,js_debug_funcs,countof(js_debug_funcs));
   return mod;
-}
+}

debug/js.c

@@ -1,48 +1,16 @@
 #include "cell.h"
 
 JSC_CCALL(os_mem_limit, JS_SetMemoryLimit(JS_GetRuntime(js), js2number(js,argv[0])))
-JSC_CCALL(os_max_stacksize, JS_SetMaxStackSize(JS_GetRuntime(js), js2number(js,argv[0])))
+JSC_CCALL(os_max_stacksize, JS_SetMaxStackSize(js, js2number(js,argv[0])))
 
-// Compute the approximate size of a single JS value in memory.
+// TODO: Reimplement memory usage reporting for new allocator
 JSC_CCALL(os_calc_mem,
-  JSMemoryUsage mu;
-  JS_ComputeMemoryUsage(JS_GetRuntime(js),&mu);
   ret = JS_NewObject(js);
-  JS_SetPropertyStr(js,ret,"malloc_size",number2js(js,mu.malloc_size));
-  JS_SetPropertyStr(js,ret,"malloc_limit",number2js(js,mu.malloc_limit));
-  JS_SetPropertyStr(js,ret,"memory_used_size",number2js(js,mu.memory_used_size));
-  JS_SetPropertyStr(js,ret,"malloc_count",number2js(js,mu.malloc_count));
-  JS_SetPropertyStr(js,ret,"memory_used_count",number2js(js,mu.memory_used_count));
-  JS_SetPropertyStr(js,ret,"str_count",number2js(js,mu.str_count));
-  JS_SetPropertyStr(js,ret,"str_size",number2js(js,mu.str_size));
-  JS_SetPropertyStr(js,ret,"obj_count",number2js(js,mu.obj_count));
-  JS_SetPropertyStr(js,ret,"obj_size",number2js(js,mu.obj_size));
-  JS_SetPropertyStr(js,ret,"prop_count",number2js(js,mu.prop_count));
-  JS_SetPropertyStr(js,ret,"prop_size",number2js(js,mu.prop_size));
-  JS_SetPropertyStr(js,ret,"shape_count",number2js(js,mu.shape_count));
-  JS_SetPropertyStr(js,ret,"shape_size",number2js(js,mu.shape_size));
-  JS_SetPropertyStr(js,ret,"js_func_count",number2js(js,mu.js_func_count));
-  JS_SetPropertyStr(js,ret,"js_func_size",number2js(js,mu.js_func_size));
-  JS_SetPropertyStr(js,ret,"js_func_code_size",number2js(js,mu.js_func_code_size));
-  JS_SetPropertyStr(js,ret,"js_func_pc2line_count",number2js(js,mu.js_func_pc2line_count));
-  JS_SetPropertyStr(js,ret,"js_func_pc2line_size",number2js(js,mu.js_func_pc2line_size));
-  JS_SetPropertyStr(js,ret,"c_func_count",number2js(js,mu.c_func_count));
-  JS_SetPropertyStr(js,ret,"array_count",number2js(js,mu.array_count));
-  JS_SetPropertyStr(js,ret,"fast_array_count",number2js(js,mu.fast_array_count));
-  JS_SetPropertyStr(js,ret,"fast_array_elements",number2js(js,mu.fast_array_elements));
-  JS_SetPropertyStr(js,ret,"binary_object_count",number2js(js,mu.binary_object_count));
-  JS_SetPropertyStr(js,ret,"binary_object_size",number2js(js,mu.binary_object_size));
 )
 
-// Disassemble a function object into a string.
-JSC_CCALL(js_disassemble,
-  return js_debugger_fn_bytecode(js, argv[0]);
-)
-
-// Return metadata about a given function.
-JSC_CCALL(js_fn_info,
-  return js_debugger_fn_info(js, argv[0]);
-)
+// TODO: Reimplement for register VM
+JSC_CCALL(js_disassemble, return JS_NewArray(js);)
+JSC_CCALL(js_fn_info, return JS_NewObject(js);)
 
 static const JSCFunctionListEntry js_js_funcs[] = {
   MIST_FUNC_DEF(os, calc_mem, 0),

diff.ce

@@ -0,0 +1,264 @@
+// diff.ce — differential testing: run tests optimized vs unoptimized, compare results
+//
+// Usage:
+//   cell diff                - diff all test files in current package
+//   cell diff suite          - diff a specific test file (tests/suite.cm)
+//   cell diff tests/foo      - diff a specific test file by path
+var shop = use('internal/shop')
+var pkg = use('package')
+var fd = use('fd')
+var time = use('time')
+
+var _args = args == null ? [] : args
+
+var analyze = use('os').analyze
+var run_ast_fn = use('os').run_ast_fn
+var run_ast_noopt_fn = use('os').run_ast_noopt_fn
+
+if (!run_ast_noopt_fn) {
+  log.console("error: run_ast_noopt_fn not available (rebuild bootstrap)")
+  $stop()
+  return
+}
+
+// Parse arguments: diff [test_path]
+var target_test = null
+if (length(_args) > 0) {
+  target_test = _args[0]
+}
+
+function is_valid_package(dir) {
+  var _dir = dir == null ? '.' : dir
+  return fd.is_file(_dir + '/cell.toml')
+}
+
+if (!is_valid_package('.')) {
+  log.console('No cell.toml found in current directory')
+  $stop()
+  return
+}
+
+// Collect test files
+function collect_tests(specific_test) {
+  var files = pkg.list_files(null)
+  var test_files = []
+  var i = 0
+  var f = null
+  var test_name = null
+  var match_name = null
+  var match_base = null
+  for (i = 0; i < length(files); i++) {
+    f = files[i]
+    if (starts_with(f, "tests/") && ends_with(f, ".cm")) {
+      if (specific_test) {
+        test_name = text(f, 0, -3)
+        match_name = specific_test
+        if (!starts_with(match_name, 'tests/')) match_name = 'tests/' + match_name
+        match_base = ends_with(match_name, '.cm') ? text(match_name, 0, -3) : match_name
+        if (test_name != match_base) continue
+      }
+      push(test_files, f)
+    }
+  }
+  return test_files
+}
+
+// Deep comparison of two values
+function values_equal(a, b) {
+  var i = 0
+  var ka = null
+  var kb = null
+  if (a == b) return true
+  if (is_null(a) && is_null(b)) return true
+  if (is_null(a) || is_null(b)) return false
+  if (is_array(a) && is_array(b)) {
+    if (length(a) != length(b)) return false
+    i = 0
+    while (i < length(a)) {
+      if (!values_equal(a[i], b[i])) return false
+      i = i + 1
+    }
+    return true
+  }
+  if (is_object(a) && is_object(b)) {
+    ka = array(a)
+    kb = array(b)
+    if (length(ka) != length(kb)) return false
+    i = 0
+    while (i < length(ka)) {
+      if (!values_equal(a[ka[i]], b[ka[i]])) return false
+      i = i + 1
+    }
+    return true
+  }
+  return false
+}
+
+function describe(val) {
+  if (is_null(val)) return "null"
+  if (is_text(val)) return `"${val}"`
+  if (is_number(val)) return text(val)
+  if (is_logical(val)) return text(val)
+  if (is_function(val)) return "<function>"
+  if (is_array(val)) return `[array length=${text(length(val))}]`
+  if (is_object(val)) return `{record keys=${text(length(array(val)))}}`
+  return "<unknown>"
+}
+
+// Run a single test file through both paths
+function diff_test_file(file_path) {
+  var mod_path = text(file_path, 0, -3)
+  var src_path = fd.realpath('.') + '/' + file_path
+  var src = null
+  var ast = null
+  var mod_opt = null
+  var mod_noopt = null
+  var results = {file: file_path, tests: [], passed: 0, failed: 0, errors: []}
+  var use_pkg = fd.realpath('.')
+  var opt_error = null
+  var noopt_error = null
+  var keys = null
+  var i = 0
+  var k = null
+  var opt_result = null
+  var noopt_result = null
+  var opt_err = null
+  var noopt_err = null
+  var _run_one_opt = null
+  var _run_one_noopt = null
+
+  // Build env for module loading
+  var make_env = function() {
+    return {
+      use: function(path) {
+        return shop.use(path, use_pkg)
+      }
+    }
+  }
+
+  // Read and parse
+  var _read = function() {
+    src = text(fd.slurp(src_path))
+    ast = analyze(src, src_path)
+  } disruption {
+    push(results.errors, `failed to parse ${file_path}`)
+    return results
+  }
+  _read()
+  if (length(results.errors) > 0) return results
+
+  // Run optimized
+  var _run_opt = function() {
+    mod_opt = run_ast_fn(mod_path, ast, make_env())
+  } disruption {
+    opt_error = "disrupted"
+  }
+  _run_opt()
+
+  // Run unoptimized
+  var _run_noopt = function() {
+    mod_noopt = run_ast_noopt_fn(mod_path, ast, make_env())
+  } disruption {
+    noopt_error = "disrupted"
+  }
+  _run_noopt()
+
+  // Compare module-level behavior
+  if (opt_error != noopt_error) {
+    push(results.errors, `module load mismatch: opt=${opt_error != null ? opt_error : "ok"} noopt=${noopt_error != null ? noopt_error : "ok"}`)
+    results.failed = results.failed + 1
+    return results
+  }
+  if (opt_error != null) {
+    // Both disrupted during load — that's consistent
+    results.passed = results.passed + 1
+    push(results.tests, {name: "<module>", status: "passed"})
+    return results
+  }
+
+  // If module returns a record of functions, test each one
+  if (is_object(mod_opt) && is_object(mod_noopt)) {
+    keys = array(mod_opt)
+    while (i < length(keys)) {
+      k = keys[i]
+      if (is_function(mod_opt[k]) && is_function(mod_noopt[k])) {
+        opt_result = null
+        noopt_result = null
+        opt_err = null
+        noopt_err = null
+
+        _run_one_opt = function() {
+          opt_result = mod_opt[k]()
+        } disruption {
+          opt_err = "disrupted"
+        }
+        _run_one_opt()
+
+        _run_one_noopt = function() {
+          noopt_result = mod_noopt[k]()
+        } disruption {
+          noopt_err = "disrupted"
+        }
+        _run_one_noopt()
+
+        if (opt_err != noopt_err) {
+          push(results.tests, {name: k, status: "failed"})
+          push(results.errors, `${k}: disruption mismatch opt=${opt_err != null ? opt_err : "ok"} noopt=${noopt_err != null ? noopt_err : "ok"}`)
+          results.failed = results.failed + 1
+        } else if (!values_equal(opt_result, noopt_result)) {
+          push(results.tests, {name: k, status: "failed"})
+          push(results.errors, `${k}: result mismatch opt=${describe(opt_result)} noopt=${describe(noopt_result)}`)
+          results.failed = results.failed + 1
+        } else {
+          push(results.tests, {name: k, status: "passed"})
+          results.passed = results.passed + 1
+        }
+      }
+      i = i + 1
+    }
+  } else {
+    // Compare direct return values
+    if (!values_equal(mod_opt, mod_noopt)) {
+      push(results.tests, {name: "<return>", status: "failed"})
+      push(results.errors, `return value mismatch: opt=${describe(mod_opt)} noopt=${describe(mod_noopt)}`)
+      results.failed = results.failed + 1
+    } else {
+      push(results.tests, {name: "<return>", status: "passed"})
+      results.passed = results.passed + 1
+    }
+  }
+
+  return results
+}
+
+// Main
+var test_files = collect_tests(target_test)
+log.console(`Differential testing: ${text(length(test_files))} file(s)`)
+
+var total_passed = 0
+var total_failed = 0
+var i = 0
+var result = null
+var j = 0
+
+while (i < length(test_files)) {
+  result = diff_test_file(test_files[i])
+  log.console(`  ${result.file}: ${text(result.passed)} passed, ${text(result.failed)} failed`)
+  j = 0
+  while (j < length(result.errors)) {
+    log.console(`    MISMATCH: ${result.errors[j]}`)
+    j = j + 1
+  }
+  total_passed = total_passed + result.passed
+  total_failed = total_failed + result.failed
+  i = i + 1
+}
+
+log.console(`----------------------------------------`)
+log.console(`Diff: ${text(total_passed)} passed, ${text(total_failed)} failed, ${text(total_passed + total_failed)} total`)
+
+if (total_failed > 0) {
+  log.console(`DIFFERENTIAL FAILURES DETECTED`)
+}
+
+$stop()

docs/_index.md

@@ -56,6 +56,7 @@ Modules loaded with `use()`:
 ## Tools
 
 - [**Command Line**](/docs/cli/) — the `pit` tool
+- [**Testing**](/docs/testing/) — writing and running tests
 - [**Writing C Modules**](/docs/c-modules/) — native extensions
 
 ## Architecture

docs/cli.md

@@ -78,12 +78,13 @@ pit build
 
 ### pit test
 
-Run tests.
+Run tests. See [Testing](/docs/testing/) for the full guide.
 
 ```bash
 pit test            # run tests in current package
 pit test all        # run all tests
 pit test <package>  # run tests in specific package
+pit test suite --verify --diff  # with IR verification and differential testing
 ```
 
 ### pit link

docs/compiler-tools.md

@@ -0,0 +1,264 @@
+---
+title: "Compiler Inspection Tools"
+description: "Tools for inspecting and debugging the compiler pipeline"
+weight: 50
+type: "docs"
+---
+
+ƿit includes a set of tools for inspecting the compiler pipeline at every stage. These are useful for debugging, testing optimizations, and understanding what the compiler does with your code.
+
+## Pipeline Overview
+
+The compiler runs in stages:
+
+```
+source → tokenize → parse → fold → mcode → streamline → output
+```
+
+Each stage has a corresponding dump tool that lets you see its output.
+
+| Stage       | Tool              | What it shows                          |
+|-------------|-------------------|----------------------------------------|
+| fold        | `dump_ast.cm`     | Folded AST as JSON                     |
+| mcode       | `dump_mcode.cm`   | Raw mcode IR before optimization       |
+| streamline  | `dump_stream.cm`  | Before/after instruction counts + IR   |
+| streamline  | `dump_types.cm`   | Optimized IR with type annotations     |
+| streamline  | `streamline.ce`   | Full optimized IR as JSON              |
+| all         | `ir_report.ce`    | Structured optimizer flight recorder   |
+
+All tools take a source file as input and run the pipeline up to the relevant stage.
+
+## Quick Start
+
+```bash
+# see raw mcode IR
+./cell --core . dump_mcode.cm myfile.ce
+
+# see what the optimizer changed
+./cell --core . dump_stream.cm myfile.ce
+
+# full optimizer report with events
+./cell --core . ir_report.ce --full myfile.ce
+```
+
+## dump_ast.cm
+
+Prints the folded AST as JSON. This is the output of the parser and constant folder, before mcode generation.
+
+```bash
+./cell --core . dump_ast.cm <file.ce|file.cm>
+```
+
+## dump_mcode.cm
+
+Prints the raw mcode IR before any optimization. Shows the instruction array as formatted text with opcode, operands, and program counter.
+
+```bash
+./cell --core . dump_mcode.cm <file.ce|file.cm>
+```
+
+## dump_stream.cm
+
+Shows a before/after comparison of the optimizer. For each function, prints:
+- Instruction count before and after
+- Number of eliminated instructions
+- The streamlined IR (nops hidden by default)
+
+```bash
+./cell --core . dump_stream.cm <file.ce|file.cm>
+```
+
+## dump_types.cm
+
+Shows the optimized IR with type annotations. Each instruction is followed by the known types of its slot operands, inferred by walking the instruction stream.
+
+```bash
+./cell --core . dump_types.cm <file.ce|file.cm>
+```
+
+## streamline.ce
+
+Runs the full pipeline (tokenize, parse, fold, mcode, streamline) and outputs the optimized IR as JSON. Useful for piping to `jq` or saving for comparison.
+
+```bash
+./cell --core . streamline.ce <file.ce|file.cm>
+```
+
+## ir_report.ce
+
+The optimizer flight recorder. Runs the full pipeline with structured logging and outputs machine-readable, diff-friendly JSON. This is the most detailed tool for understanding what the optimizer did and why.
+
+```bash
+./cell --core . ir_report.ce [options] <file.ce|file.cm>
+```
+
+### Options
+
+| Flag | Description |
+|------|-------------|
+| `--summary` | Per-pass JSON summaries with instruction counts and timing (default) |
+| `--events` | Include rewrite events showing each optimization applied |
+| `--types` | Include type delta records showing inferred slot types |
+| `--ir-before=PASS` | Print canonical IR before a specific pass |
+| `--ir-after=PASS` | Print canonical IR after a specific pass |
+| `--ir-all` | Print canonical IR before and after all passes |
+| `--full` | Everything: summary + events + types + ir-all |
+
+With no flags, `--summary` is the default.
+
+### Output Format
+
+Output is line-delimited JSON. Each line is a self-contained JSON object with a `type` field:
+
+**`type: "pass"`** — Per-pass summary with categorized instruction counts before and after:
+
+```json
+{
+  "type": "pass",
+  "pass": "eliminate_type_checks",
+  "fn": "fib",
+  "ms": 0.12,
+  "changed": true,
+  "before": {"instr": 77, "nop": 0, "guard": 16, "branch": 28, ...},
+  "after":  {"instr": 77, "nop": 1, "guard": 15, "branch": 28, ...},
+  "changes": {"guards_removed": 1, "nops_added": 1}
+}
+```
+
+**`type: "event"`** — Individual rewrite event with before/after instructions and reasoning:
+
+```json
+{
+  "type": "event",
+  "pass": "eliminate_type_checks",
+  "rule": "incompatible_type_forces_jump",
+  "at": 3,
+  "before": [["is_int", 5, 2, 4, 9], ["jump_false", 5, "rel_ni_2", 4, 9]],
+  "after": ["_nop_tc_1", ["jump", "rel_ni_2", 4, 9]],
+  "why": {"slot": 2, "known_type": "float", "checked_type": "int"}
+}
+```
+
+**`type: "types"`** — Inferred type information for a function:
+
+```json
+{
+  "type": "types",
+  "fn": "fib",
+  "param_types": {},
+  "slot_types": {"25": "null"}
+}
+```
+
+**`type: "ir"`** — Canonical IR text for a function at a specific point:
+
+```json
+{
+  "type": "ir",
+  "when": "before",
+  "pass": "all",
+  "fn": "fib",
+  "text": "fn fib (args=1, slots=26)\n  @0    access          s2, 2\n  ..."
+}
+```
+
+### Rewrite Rules
+
+Each pass records events with named rules:
+
+**eliminate_type_checks:**
+- `known_type_eliminates_guard` — type already known, guard removed
+- `incompatible_type_forces_jump` — type conflicts, conditional jump becomes unconditional
+- `num_subsumes_int_float` — num check satisfied by int or float
+- `dynamic_to_field` — load_dynamic/store_dynamic narrowed to field access
+- `dynamic_to_index` — load_dynamic/store_dynamic narrowed to index access
+
+**simplify_algebra:**
+- `add_zero`, `sub_zero`, `mul_one`, `div_one` — identity operations become moves
+- `mul_zero` — multiplication by zero becomes constant
+- `self_eq`, `self_ne` — same-slot comparisons become constants
+
+**simplify_booleans:**
+- `not_jump_false_fusion` — not + jump_false fused into jump_true
+- `not_jump_true_fusion` — not + jump_true fused into jump_false
+- `double_not` — not + not collapsed to move
+
+**eliminate_moves:**
+- `self_move` — move to same slot becomes nop
+
+**eliminate_dead_jumps:**
+- `jump_to_next` — jump to immediately following label becomes nop
+
+### Canonical IR Format
+
+The `--ir-all`, `--ir-before`, and `--ir-after` flags produce a deterministic text representation of the IR:
+
+```
+fn fib (args=1, slots=26)
+  @0    access          s2, 2
+  @1    is_int          s4, s1                          ; [guard]
+  @2    jump_false      s4, "rel_ni_2"                  ; [branch]
+  @3    --- nop (tc) ---
+  @4    jump            "rel_ni_2"                      ; [branch]
+  @5    lt_int          s3, s1, s2
+  @6    jump            "rel_done_4"                    ; [branch]
+      rel_ni_2:
+  @8    is_num          s4, s1                          ; [guard]
+```
+
+Properties:
+- `@N` is the raw array index, stable across passes (passes replace, never insert or delete)
+- `sN` prefix distinguishes slot operands from literal values
+- String operands are quoted
+- Labels appear as indented headers with a colon
+- Category tags in brackets: `[guard]`, `[branch]`, `[load]`, `[store]`, `[call]`, `[arith]`, `[move]`, `[const]`
+- Nops shown as `--- nop (reason) ---` with reason codes: `tc` (type check), `bl` (boolean), `mv` (move), `dj` (dead jump), `ur` (unreachable)
+
+### Examples
+
+```bash
+# what passes changed something?
+./cell --core . ir_report.ce --summary myfile.ce | jq 'select(.changed)'
+
+# list all rewrite rules that fired
+./cell --core . ir_report.ce --events myfile.ce | jq 'select(.type == "event") | .rule'
+
+# diff IR before and after optimization
+./cell --core . ir_report.ce --ir-all myfile.ce | jq -r 'select(.type == "ir") | .text'
+
+# full report for analysis
+./cell --core . ir_report.ce --full myfile.ce > report.json
+```
+
+## ir_stats.cm
+
+A utility module used by `ir_report.ce` and available for custom tooling. Not a standalone tool.
+
+```javascript
+var ir_stats = use("ir_stats")
+
+ir_stats.detailed_stats(func)                    // categorized instruction counts
+ir_stats.ir_fingerprint(func)                    // djb2 hash of instruction array
+ir_stats.canonical_ir(func, name, opts)          // deterministic text representation
+ir_stats.type_snapshot(slot_types)               // frozen copy of type map
+ir_stats.type_delta(before_types, after_types)   // compute type changes
+ir_stats.category_tag(op)                        // classify an opcode
+```
+
+### Instruction Categories
+
+`detailed_stats` classifies each instruction into one of these categories:
+
+| Category | Opcodes |
+|----------|---------|
+| load     | `load_field`, `load_index`, `load_dynamic`, `get`, `access` (non-constant) |
+| store    | `store_field`, `store_index`, `store_dynamic`, `set_var`, `put`, `push` |
+| branch   | `jump`, `jump_true`, `jump_false`, `jump_not_null` |
+| call     | `invoke`, `goinvoke` |
+| guard    | `is_int`, `is_text`, `is_num`, `is_bool`, `is_null`, `is_array`, `is_func`, `is_record`, `is_stone` |
+| arith    | `add_int`, `sub_int`, ..., `add_float`, ..., `concat`, `neg_int`, `neg_float`, bitwise ops |
+| move     | `move` |
+| const    | `int`, `true`, `false`, `null`, `access` (with constant value) |
+| label    | string entries that are not nops |
+| nop      | strings starting with `_nop_` |
+| other    | everything else (`frame`, `setarg`, `array`, `record`, `function`, `return`, etc.) |

docs/spec/.pages

@@ -0,0 +1,3 @@
+nav:
+  - pipeline.md
+  - mcode.md

docs/spec/mach.md

@@ -1,11 +1,13 @@
 ---
 title: "Register VM"
-description: "Register-based virtual machine (Mach)"
+description: "Binary encoding of the Mach bytecode interpreter"
 ---
 
 ## Overview
 
-The Mach VM is a register-based virtual machine using 32-bit instructions. It is modeled after Lua's register VM — operands are register indices rather than stack positions, reducing instruction count and improving performance.
+The Mach VM is a register-based virtual machine that directly interprets the [Mcode IR](mcode.md) instruction set as compact 32-bit binary bytecode. It is modeled after Lua's register VM — operands are register indices rather than stack positions, reducing instruction count and improving performance.
+
+The Mach serializer (`mach.c`) converts streamlined mcode JSON into binary instructions. Since the Mach bytecode is a direct encoding of the mcode, the [Mcode IR](mcode.md) reference is the authoritative instruction set documentation.
 
 ## Instruction Formats
 
@@ -45,95 +47,12 @@ Used for unconditional jumps with a 24-bit signed offset.
 
 ## Registers
 
-Each function frame has a fixed number of register slots, determined at compile time. Registers hold:
+Each function frame has a fixed number of register slots, determined at compile time:
 
 - **R(0)** — `this` binding
 - **R(1)..R(arity)** — function arguments
 - **R(arity+1)..** — local variables and temporaries
 
-## Instruction Set
-
-### Loading
-
-| Opcode | Format | Description |
-|--------|--------|-------------|
-| `LOADK` | iABx | `R(A) = K(Bx)` — load from constant pool |
-| `LOADI` | iAsBx | `R(A) = sBx` — load small integer |
-| `LOADNULL` | iA | `R(A) = null` |
-| `LOADTRUE` | iA | `R(A) = true` |
-| `LOADFALSE` | iA | `R(A) = false` |
-| `MOVE` | iABC | `R(A) = R(B)` — register copy |
-
-### Arithmetic
-
-| Opcode | Format | Description |
-|--------|--------|-------------|
-| `ADD` | iABC | `R(A) = R(B) + R(C)` |
-| `SUB` | iABC | `R(A) = R(B) - R(C)` |
-| `MUL` | iABC | `R(A) = R(B) * R(C)` |
-| `DIV` | iABC | `R(A) = R(B) / R(C)` |
-| `MOD` | iABC | `R(A) = R(B) % R(C)` |
-| `POW` | iABC | `R(A) = R(B) ^ R(C)` |
-| `NEG` | iABC | `R(A) = -R(B)` |
-| `INC` | iABC | `R(A) = R(B) + 1` |
-| `DEC` | iABC | `R(A) = R(B) - 1` |
-
-### Comparison
-
-| Opcode | Format | Description |
-|--------|--------|-------------|
-| `EQ` | iABC | `R(A) = R(B) == R(C)` |
-| `NEQ` | iABC | `R(A) = R(B) != R(C)` |
-| `LT` | iABC | `R(A) = R(B) < R(C)` |
-| `LE` | iABC | `R(A) = R(B) <= R(C)` |
-| `GT` | iABC | `R(A) = R(B) > R(C)` |
-| `GE` | iABC | `R(A) = R(B) >= R(C)` |
-
-### Property Access
-
-| Opcode | Format | Description |
-|--------|--------|-------------|
-| `GETFIELD` | iABC | `R(A) = R(B)[K(C)]` — named property |
-| `SETFIELD` | iABC | `R(A)[K(B)] = R(C)` — set named property |
-| `GETINDEX` | iABC | `R(A) = R(B)[R(C)]` — computed property |
-| `SETINDEX` | iABC | `R(A)[R(B)] = R(C)` — set computed property |
-
-### Variable Resolution
-
-| Opcode | Format | Description |
-|--------|--------|-------------|
-| `GETNAME` | iABx | Unresolved variable (compiler placeholder) |
-| `GETINTRINSIC` | iABx | Global intrinsic / built-in |
-| `GETENV` | iABx | Module environment variable |
-| `GETUP` | iABC | `R(A) = UpFrame(B).slots[C]` — closure upvalue |
-| `SETUP` | iABC | `UpFrame(A).slots[B] = R(C)` — set closure upvalue |
-
-### Control Flow
-
-| Opcode | Format | Description |
-|--------|--------|-------------|
-| `JMP` | isJ | Unconditional jump |
-| `JMPTRUE` | iAsBx | Jump if `R(A)` is true |
-| `JMPFALSE` | iAsBx | Jump if `R(A)` is false |
-| `JMPNULL` | iAsBx | Jump if `R(A)` is null |
-
-### Function Calls
-
-| Opcode | Format | Description |
-|--------|--------|-------------|
-| `CALL` | iABC | Call `R(A)` with `B` args starting at `R(A+1)`, `C`=keep result |
-| `RETURN` | iA | Return `R(A)` |
-| `RETNIL` | — | Return null |
-| `CLOSURE` | iABx | Create closure from function pool entry `Bx` |
-
-### Object / Array
-
-| Opcode | Format | Description |
-|--------|--------|-------------|
-| `NEWOBJECT` | iA | `R(A) = {}` |
-| `NEWARRAY` | iABC | `R(A) = array(B)` |
-| `PUSH` | iABC | Push `R(B)` to array `R(A)` |
-
 ## JSCodeRegister
 
 The compiled output for a function:
@@ -149,7 +68,7 @@ struct JSCodeRegister {
   uint32_t func_count;      // nested function count
   JSCodeRegister **functions; // nested function table
   JSValue name;             // function name
-  uint16_t disruption_pc;   // exception handler offset
+  uint16_t disruption_pc;   // disruption handler offset
 };
 ```
 

docs/spec/mcode.md

@@ -1,23 +1,259 @@
 ---
 title: "Mcode IR"
-description: "JSON-based intermediate representation"
+description: "Instruction set reference for the JSON-based intermediate representation"
 ---
 
 ## Overview
 
-Mcode is a JSON-based intermediate representation that can be interpreted directly. It represents the same operations as the Mach register VM but uses string-based instruction dispatch rather than binary opcodes. Mcode is intended as an intermediate step toward native code compilation.
-
-## Pipeline
+Mcode is the intermediate representation at the center of the ƿit compilation pipeline. All source code is lowered to mcode before execution or native compilation. The mcode instruction set is the **authoritative reference** for the operations supported by the ƿit runtime — the Mach VM bytecode is a direct binary encoding of these same instructions.
 
 ```
-Source → Tokenize → Parse (AST) → Fold → Mcode (JSON) → Streamline → Mach VM (default)
-                                                                    → Mcode Interpreter
-                                                                    → QBE → Native
+Source → Tokenize → Parse → Fold → Mcode → Streamline → Machine
 ```
 
-Mcode is produced by `mcode.cm`, which lowers the folded AST to JSON instruction arrays. The streamline optimizer (`streamline.cm`) then eliminates redundant operations. The result is serialized to binary bytecode by the Mach compiler (`mach.c`), interpreted directly by `mcode.c`, or lowered to QBE IL by `qbe_emit.cm` for native compilation. See [Compilation Pipeline](pipeline.md) for the full overview.
+Mcode is produced by `mcode.cm`, optimized by `streamline.cm`, then either serialized to 32-bit bytecode for the Mach VM (`mach.c`), or lowered to QBE/LLVM IL for native compilation (`qbe_emit.cm`). See [Compilation Pipeline](pipeline.md) for the full overview.
 
-### Function Proxy Decomposition
+## Instruction Format
+
+Each instruction is a JSON array. The first element is the instruction name (string), followed by operands. The last two elements are line and column numbers for source mapping:
+
+```json
+["add_int", dest, a, b, line, col]
+["load_field", dest, obj, "key", line, col]
+["jump", "label_name"]
+```
+
+Operands are register slot numbers (integers), constant values (strings, numbers), or label names (strings).
+
+## Instruction Reference
+
+### Loading and Constants
+
+| Instruction | Operands | Description |
+|-------------|----------|-------------|
+| `access` | `dest, name` | Load variable by name (intrinsic or environment) |
+| `int` | `dest, value` | Load integer constant |
+| `true` | `dest` | Load boolean `true` |
+| `false` | `dest` | Load boolean `false` |
+| `null` | `dest` | Load `null` |
+| `move` | `dest, src` | Copy register value |
+| `function` | `dest, id` | Load nested function by index |
+| `regexp` | `dest, pattern` | Create regexp object |
+
+### Arithmetic — Integer
+
+| Instruction | Operands | Description |
+|-------------|----------|-------------|
+| `add_int` | `dest, a, b` | `dest = a + b` (integer) |
+| `sub_int` | `dest, a, b` | `dest = a - b` (integer) |
+| `mul_int` | `dest, a, b` | `dest = a * b` (integer) |
+| `div_int` | `dest, a, b` | `dest = a / b` (integer) |
+| `mod_int` | `dest, a, b` | `dest = a % b` (integer) |
+| `neg_int` | `dest, src` | `dest = -src` (integer) |
+
+### Arithmetic — Float
+
+| Instruction | Operands | Description |
+|-------------|----------|-------------|
+| `add_float` | `dest, a, b` | `dest = a + b` (float) |
+| `sub_float` | `dest, a, b` | `dest = a - b` (float) |
+| `mul_float` | `dest, a, b` | `dest = a * b` (float) |
+| `div_float` | `dest, a, b` | `dest = a / b` (float) |
+| `mod_float` | `dest, a, b` | `dest = a % b` (float) |
+| `neg_float` | `dest, src` | `dest = -src` (float) |
+
+### Arithmetic — Generic
+
+| Instruction | Operands | Description |
+|-------------|----------|-------------|
+| `pow` | `dest, a, b` | `dest = a ^ b` (exponentiation) |
+
+### Text
+
+| Instruction | Operands | Description |
+|-------------|----------|-------------|
+| `concat` | `dest, a, b` | `dest = a ~ b` (text concatenation) |
+
+### Comparison — Integer
+
+| Instruction | Operands | Description |
+|-------------|----------|-------------|
+| `eq_int` | `dest, a, b` | `dest = a == b` (integer) |
+| `ne_int` | `dest, a, b` | `dest = a != b` (integer) |
+| `lt_int` | `dest, a, b` | `dest = a < b` (integer) |
+| `le_int` | `dest, a, b` | `dest = a <= b` (integer) |
+| `gt_int` | `dest, a, b` | `dest = a > b` (integer) |
+| `ge_int` | `dest, a, b` | `dest = a >= b` (integer) |
+
+### Comparison — Float
+
+| Instruction | Operands | Description |
+|-------------|----------|-------------|
+| `eq_float` | `dest, a, b` | `dest = a == b` (float) |
+| `ne_float` | `dest, a, b` | `dest = a != b` (float) |
+| `lt_float` | `dest, a, b` | `dest = a < b` (float) |
+| `le_float` | `dest, a, b` | `dest = a <= b` (float) |
+| `gt_float` | `dest, a, b` | `dest = a > b` (float) |
+| `ge_float` | `dest, a, b` | `dest = a >= b` (float) |
+
+### Comparison — Text
+
+| Instruction | Operands | Description |
+|-------------|----------|-------------|
+| `eq_text` | `dest, a, b` | `dest = a == b` (text) |
+| `ne_text` | `dest, a, b` | `dest = a != b` (text) |
+| `lt_text` | `dest, a, b` | `dest = a < b` (lexicographic) |
+| `le_text` | `dest, a, b` | `dest = a <= b` (lexicographic) |
+| `gt_text` | `dest, a, b` | `dest = a > b` (lexicographic) |
+| `ge_text` | `dest, a, b` | `dest = a >= b` (lexicographic) |
+
+### Comparison — Boolean
+
+| Instruction | Operands | Description |
+|-------------|----------|-------------|
+| `eq_bool` | `dest, a, b` | `dest = a == b` (boolean) |
+| `ne_bool` | `dest, a, b` | `dest = a != b` (boolean) |
+
+### Comparison — Special
+
+| Instruction | Operands | Description |
+|-------------|----------|-------------|
+| `is_identical` | `dest, a, b` | Object identity check (same reference) |
+| `eq_tol` | `dest, a, b` | Equality with tolerance |
+| `ne_tol` | `dest, a, b` | Inequality with tolerance |
+
+### Type Checks
+
+Inlined from intrinsic function calls. Each sets `dest` to `true` or `false`.
+
+| Instruction | Operands | Description |
+|-------------|----------|-------------|
+| `is_int` | `dest, src` | Check if integer |
+| `is_num` | `dest, src` | Check if number (integer or float) |
+| `is_text` | `dest, src` | Check if text |
+| `is_bool` | `dest, src` | Check if logical |
+| `is_null` | `dest, src` | Check if null |
+| `is_array` | `dest, src` | Check if array |
+| `is_func` | `dest, src` | Check if function |
+| `is_record` | `dest, src` | Check if record (object) |
+| `is_stone` | `dest, src` | Check if stone (immutable) |
+| `is_proxy` | `dest, src` | Check if function proxy (arity 2) |
+
+### Logical
+
+| Instruction | Operands | Description |
+|-------------|----------|-------------|
+| `not` | `dest, src` | Logical NOT |
+| `and` | `dest, a, b` | Logical AND |
+| `or` | `dest, a, b` | Logical OR |
+
+### Bitwise
+
+| Instruction | Operands | Description |
+|-------------|----------|-------------|
+| `bitand` | `dest, a, b` | Bitwise AND |
+| `bitor` | `dest, a, b` | Bitwise OR |
+| `bitxor` | `dest, a, b` | Bitwise XOR |
+| `bitnot` | `dest, src` | Bitwise NOT |
+| `shl` | `dest, a, b` | Shift left |
+| `shr` | `dest, a, b` | Arithmetic shift right |
+| `ushr` | `dest, a, b` | Unsigned shift right |
+
+### Property Access
+
+Memory operations come in typed variants. The compiler selects the appropriate variant based on `type_tag` and `access_kind` annotations from parse and fold.
+
+| Instruction | Operands | Description |
+|-------------|----------|-------------|
+| `load_field` | `dest, obj, key` | Load record property by string key |
+| `store_field` | `obj, val, key` | Store record property by string key |
+| `load_index` | `dest, obj, idx` | Load array element by integer index |
+| `store_index` | `obj, val, idx` | Store array element by integer index |
+| `load_dynamic` | `dest, obj, key` | Load property (dispatches at runtime) |
+| `store_dynamic` | `obj, val, key` | Store property (dispatches at runtime) |
+| `delete` | `obj, key` | Delete property |
+| `in` | `dest, obj, key` | Check if property exists |
+| `length` | `dest, src` | Get length of array or text |
+
+### Object and Array Construction
+
+| Instruction | Operands | Description |
+|-------------|----------|-------------|
+| `record` | `dest` | Create empty record `{}` |
+| `array` | `dest, n` | Create empty array (elements added via `push`) |
+| `push` | `arr, val` | Push value to array |
+| `pop` | `dest, arr` | Pop value from array |
+
+### Function Calls
+
+Function calls are decomposed into three instructions:
+
+| Instruction | Operands | Description |
+|-------------|----------|-------------|
+| `frame` | `dest, fn, argc` | Allocate call frame for `fn` with `argc` arguments |
+| `setarg` | `frame, idx, val` | Set argument `idx` in call frame |
+| `invoke` | `frame, result` | Execute the call, store result |
+| `goframe` | `dest, fn, argc` | Allocate frame for async/concurrent call |
+| `goinvoke` | `frame, result` | Invoke async/concurrent call |
+
+### Variable Resolution
+
+| Instruction | Operands | Description |
+|-------------|----------|-------------|
+| `access` | `dest, name` | Load variable (intrinsic or module environment) |
+| `set_var` | `name, src` | Set top-level variable by name |
+| `get` | `dest, level, slot` | Get closure variable from parent scope |
+| `put` | `level, slot, src` | Set closure variable in parent scope |
+
+### Control Flow
+
+| Instruction | Operands | Description |
+|-------------|----------|-------------|
+| `LABEL` | `name` | Define a named label (not executed) |
+| `jump` | `label` | Unconditional jump |
+| `jump_true` | `cond, label` | Jump if `cond` is true |
+| `jump_false` | `cond, label` | Jump if `cond` is false |
+| `jump_not_null` | `val, label` | Jump if `val` is not null |
+| `return` | `src` | Return value from function |
+| `disrupt` | — | Trigger disruption (error) |
+
+## Typed Instruction Design
+
+A key design principle of mcode is that **every type check is an explicit instruction**. Arithmetic and comparison operations come in type-specialized variants (`add_int`, `add_float`, `eq_text`, etc.) rather than a single polymorphic instruction.
+
+When type information is available from the fold stage, the compiler emits the typed variant directly. When the type is unknown, the compiler emits a type-check/dispatch pattern:
+
+```json
+["is_int", check, a]
+["jump_false", check, "float_path"]
+["add_int", dest, a, b]
+["jump", "done"]
+["LABEL", "float_path"]
+["add_float", dest, a, b]
+["LABEL", "done"]
+```
+
+The [Streamline Optimizer](streamline.md) eliminates dead branches when types are statically known, collapsing the dispatch to a single typed instruction.
+
+## Intrinsic Inlining
+
+The mcode compiler recognizes calls to built-in intrinsic functions and emits direct opcodes instead of the generic frame/setarg/invoke call sequence:
+
+| Source call | Emitted instruction |
+|-------------|-------------------|
+| `is_array(x)` | `is_array dest, src` |
+| `is_function(x)` | `is_func dest, src` |
+| `is_object(x)` | `is_record dest, src` |
+| `is_stone(x)` | `is_stone dest, src` |
+| `is_integer(x)` | `is_int dest, src` |
+| `is_text(x)` | `is_text dest, src` |
+| `is_number(x)` | `is_num dest, src` |
+| `is_logical(x)` | `is_bool dest, src` |
+| `is_null(x)` | `is_null dest, src` |
+| `length(x)` | `length dest, src` |
+| `push(arr, val)` | `push arr, val` |
+
+## Function Proxy Decomposition
 
 When the compiler encounters a method call `obj.method(args)`, it emits a branching pattern to handle ƿit's function proxy protocol. An arity-2 function used as a proxy target receives the method name and argument array instead of a normal method call:
 
@@ -25,9 +261,8 @@ When the compiler encounters a method call `obj.method(args)`, it emits a branch
 ["is_proxy", check, obj]
 ["jump_false", check, "record_path"]
 
-// Proxy path: call obj(name, [args...]) with this=null
 ["access", name_slot, "method"]
-["array", args_arr, N, arg0, arg1, ...]
+["array", args_arr, N, arg0, arg1]
 ["null", null_slot]
 ["frame", f, obj, 2]
 ["setarg", f, 0, null_slot]
@@ -41,21 +276,38 @@ When the compiler encounters a method call `obj.method(args)`, it emits a branch
 ["frame", f2, method, N]
 ["setarg", f2, 0, obj]
 ["setarg", f2, 1, arg0]
-...
 ["invoke", f2, dest]
 
 ["LABEL", "done"]
 ```
 
-The streamline optimizer can eliminate the dead branch when the type of `obj` is statically known.
+## Labels and Control Flow
 
-## JSMCode Structure
+Control flow uses named labels instead of numeric offsets:
+
+```json
+["LABEL", "loop_start"]
+["add_int", 1, 1, 2]
+["jump_false", 3, "loop_end"]
+["jump", "loop_start"]
+["LABEL", "loop_end"]
+```
+
+Labels are collected into a name-to-index map during loading, enabling O(1) jump resolution. The Mach serializer converts label names to numeric offsets in the binary bytecode.
+
+## Nop Convention
+
+The streamline optimizer replaces eliminated instructions with nop strings (e.g., `_nop_tc_1`, `_nop_bl_2`). Nop strings are skipped during interpretation and native code emission but preserved in the instruction array to maintain positional stability for jump targets.
+
+## Internal Structures
+
+### JSMCode (Mcode Interpreter)
 
 ```c
 struct JSMCode {
   uint16_t nr_args;        // argument count
   uint16_t nr_slots;       // register count
-  cJSON **instrs;          // pre-flattened instruction array
+  cJSON **instrs;          // instruction array
   uint32_t instr_count;    // number of instructions
 
   struct {
@@ -70,74 +322,25 @@ struct JSMCode {
   cJSON *json_root;        // keeps JSON alive
   const char *name;        // function name
   const char *filename;    // source file
-  uint16_t disruption_pc;  // exception handler offset
+  uint16_t disruption_pc;  // disruption handler offset
 };
 ```
 
-## Instruction Format
+### JSCodeRegister (Mach VM Bytecode)
 
-Each instruction is a JSON array. The first element is the instruction name (string), followed by operands (typically `[op, dest, ...args, line, col]`):
-
-```json
-["access", 3, 5, 1, 9]
-["load_index", 10, 4, 9, 5, 11]
-["store_dynamic", 4, 11, 12, 6, 3]
-["frame", 15, 14, 1, 7, 7]
-["setarg", 15, 0, 16, 7, 7]
-["invoke", 15, 13, 7, 7]
+```c
+struct JSCodeRegister {
+  uint16_t arity;           // argument count
+  uint16_t nr_slots;        // total register count
+  uint32_t cpool_count;     // constant pool size
+  JSValue *cpool;           // constant pool
+  uint32_t instr_count;     // instruction count
+  MachInstr32 *instructions; // 32-bit instruction array
+  uint32_t func_count;      // nested function count
+  JSCodeRegister **functions; // nested function table
+  JSValue name;             // function name
+  uint16_t disruption_pc;   // disruption handler offset
+};
 ```
 
-### Typed Load/Store
-
-Memory operations come in typed variants for optimization:
-
-- `load_index dest, obj, idx` — array element by integer index
-- `load_field dest, obj, key` — record property by string key
-- `load_dynamic dest, obj, key` — unknown; dispatches at runtime
-- `store_index obj, val, idx` — array element store
-- `store_field obj, val, key` — record property store
-- `store_dynamic obj, val, key` — unknown; dispatches at runtime
-
-The compiler selects the appropriate variant based on `type_tag` and `access_kind` annotations from parse and fold.
-
-### Decomposed Calls
-
-Function calls are split into separate instructions:
-
-- `frame dest, fn, argc` — allocate call frame
-- `setarg frame, idx, val` — set argument
-- `invoke frame, result` — execute the call
-
-## Labels
-
-Control flow uses named labels instead of numeric offsets:
-
-```json
-["LABEL", "loop_start"]
-["ADD", 1, 1, 2]
-["JMPFALSE", 3, "loop_end"]
-["JMP", "loop_start"]
-["LABEL", "loop_end"]
-```
-
-Labels are collected into a name-to-index map during loading, enabling O(1) jump resolution.
-
-## Differences from Mach
-
-| Property | Mcode | Mach |
-|----------|-------|------|
-| Instructions | cJSON arrays | 32-bit binary |
-| Dispatch | String comparison | Switch on opcode byte |
-| Constants | Inline in JSON | Separate constant pool |
-| Jump targets | Named labels | Numeric offsets |
-| Memory | Heap (cJSON nodes) | Off-heap (malloc) |
-
-## Purpose
-
-Mcode serves as an inspectable, debuggable intermediate format:
-
-- **Human-readable** — the JSON representation can be printed and examined
-- **Language-independent** — any tool that produces the correct JSON can target the ƿit runtime
-- **Compilation target** — the Mach compiler can consume mcode as input, and future native code generators can work from the same representation
-
-The cost of string-based dispatch makes mcode slower than the binary Mach VM, so it is primarily useful during development and as a compilation intermediate rather than for production execution.
+The Mach serializer (`mach.c`) converts the JSON mcode into compact 32-bit instructions with a constant pool. See [Register VM](mach.md) for the binary encoding formats.

docs/spec/pipeline.md

@@ -5,14 +5,17 @@ description: "Overview of the compilation stages and optimizations"
 
 ## Overview
 
-The compilation pipeline transforms source code through several stages, each adding information or lowering the representation toward execution. All backends share the same path through mcode and streamline. There are three execution backends: the Mach register VM (default), the Mcode interpreter (debug), and native code via QBE (experimental).
+The compilation pipeline transforms source code through several stages, each adding information or lowering the representation toward execution. All backends share the same path through mcode and streamline.
 
 ```
-Source → Tokenize → Parse → Fold → Mcode → Streamline → Mach VM (default)
-                                                        → Mcode Interpreter
-                                                        → QBE → Native
+Source → Tokenize → Parse → Fold → Mcode → Streamline → Machine
 ```
 
+The final **machine** stage has two targets:
+
+- **Mach VM** — a register-based bytecode interpreter that directly executes the mcode instruction set as compact 32-bit binary
+- **Native code** — lowers mcode to QBE or LLVM intermediate language, then compiles to machine code for the target CPU architecture
+
 ## Stages
 
 ### Tokenize (`tokenize.cm`)
@@ -24,7 +27,8 @@ Splits source text into tokens. Handles string interpolation by re-tokenizing te
 Converts tokens into an AST. Also performs semantic analysis:
 
 - **Scope records**: For each scope (global, function), builds a record mapping variable names to their metadata: `make` (var/def/function/input), `function_nr`, `nr_uses`, `closure` flag, and `level`.
-- **Type tags**: When the right-hand side of a `def` is a syntactically obvious type, stamps `type_tag` on the scope record entry. Derivable types: `"integer"`, `"number"`, `"text"`, `"array"`, `"record"`, `"function"`, `"logical"`, `"null"`.
+- **Type tags**: When the right-hand side of a `def` is a syntactically obvious type, stamps `type_tag` on the scope record entry. Derivable types: `"integer"`, `"number"`, `"text"`, `"array"`, `"record"`, `"function"`, `"logical"`. For `def` variables, type tags are also inferred from usage patterns: push (`x[] = v`) implies array, property access (`x.foo = v`) implies record, integer key implies array, text key implies record.
+- **Type error detection**: For `def` variables with known type tags, provably wrong operations are reported as compile errors: property access on arrays, push on non-arrays, text keys on arrays, integer keys on records. Only `def` variables are checked because `var` can be reassigned.
 - **Intrinsic resolution**: Names used but not locally bound are recorded in `ast.intrinsics`. Name nodes referencing intrinsics get `intrinsic: true`.
 - **Access kind**: Subscript (`[`) nodes get `access_kind`: `"index"` for numeric subscripts, `"field"` for string subscripts, omitted otherwise.
 - **Tail position**: Return statements where the expression is a call get `tail: true`.
@@ -37,8 +41,8 @@ Operates on the AST. Performs constant folding and type analysis:
 - **Constant propagation**: Tracks `def` bindings whose values are known constants.
 - **Type propagation**: Extends `type_tag` through operations. When both operands of an arithmetic op have known types, the result type is known. Propagates type tags to reference sites.
 - **Intrinsic specialization**: When an intrinsic call's argument types are known, stamps a `hint` on the call node. For example, `length(x)` where x is a known array gets `hint: "array_length"`. Type checks like `is_array(known_array)` are folded to `true`.
-- **Purity marking**: Stamps `pure: true` on expressions with no side effects (literals, name references, arithmetic on pure operands).
-- **Dead code elimination**: Removes unreachable branches when conditions are known constants.
+- **Purity analysis**: Expressions with no side effects are marked pure (literals, name references, arithmetic on pure operands, calls to pure intrinsics). The pure intrinsic set contains only `is_*` sensory functions — they are the only intrinsics guaranteed to never disrupt regardless of argument types. Other intrinsics like `text`, `number`, and `length` can disrupt on wrong argument types and are excluded.
+- **Dead code elimination**: Removes unreachable branches when conditions are known constants. Removes unused `var`/`def` declarations with pure initializers. Removes standalone calls to pure intrinsics where the result is discarded.
 
 ### Mcode (`mcode.cm`)
 
@@ -47,57 +51,46 @@ Lowers the AST to a JSON-based intermediate representation with explicit operati
 - **Typed load/store**: Emits `load_index` (array by integer), `load_field` (record by string), or `load_dynamic` (unknown) based on type information from fold.
 - **Decomposed calls**: Function calls are split into `frame` (create call frame) + `setarg` (set arguments) + `invoke` (execute call).
 - **Intrinsic access**: Intrinsic functions are loaded via `access` with an intrinsic marker rather than global lookup.
+- **Intrinsic inlining**: Type-check intrinsics (`is_array`, `is_text`, `is_number`, `is_integer`, `is_logical`, `is_null`, `is_function`, `is_object`, `is_stone`), `length`, and `push` are emitted as direct opcodes instead of frame/setarg/invoke call sequences.
+- **Disruption handler labels**: When a function has a disruption handler, a label is emitted before the handler code. This allows the streamline optimizer's unreachable code elimination to safely nop dead code after `return` without accidentally eliminating the handler.
+- **Tail call marking**: When a return statement's expression is a call and the function has no disruption handler, the final `invoke` is renamed to `tail_invoke`. This marks the call site for future tail call optimization. Functions with disruption handlers cannot use TCO because the handler frame must remain on the stack.
 
-See [Mcode IR](mcode.md) for instruction format details.
+See [Mcode IR](mcode.md) for the instruction format and complete instruction reference.
 
 ### Streamline (`streamline.cm`)
 
-Optimizes the Mcode IR. Operates per-function:
+Optimizes the Mcode IR through a series of independent passes. Operates per-function:
 
-- **Redundant instruction elimination**: Removes no-op patterns and redundant moves.
-- **Dead code removal**: Eliminates instructions whose results are never used.
-- **Type-based narrowing**: When type information is available, narrows `load_dynamic`/`store_dynamic` to typed variants.
+1. **Backward type inference**: Infers parameter types from how they are used in typed operators (`add_int`, `store_index`, `load_field`, `push`, `pop`, etc.). Immutable `def` parameters keep their inferred type across label join points.
+2. **Type-check elimination**: When a slot's type is known, eliminates `is_<type>` + conditional jump pairs. Narrows `load_dynamic`/`store_dynamic` to typed variants.
+3. **Algebraic simplification**: Rewrites identity operations (add 0, multiply 1, divide 1) and folds same-slot comparisons.
+4. **Boolean simplification**: Fuses `not` + conditional jump into a single jump with inverted condition.
+5. **Move elimination**: Removes self-moves (`move a, a`).
+6. **Unreachable elimination**: Nops dead code after `return` until the next label.
+7. **Dead jump elimination**: Removes jumps to the immediately following label.
 
-### QBE Emit (`qbe_emit.cm`)
+See [Streamline Optimizer](streamline.md) for detailed pass descriptions.
 
-Lowers optimized Mcode IR to QBE intermediate language for native code compilation. Each Mcode function becomes a QBE function that calls into the cell runtime (`cell_rt_*` functions) for operations that require the runtime (allocation, intrinsic dispatch, etc.).
+### Machine
 
-String constants are interned in a data section. Integer constants are NaN-boxed inline.
+The streamlined mcode is lowered to a machine target for execution.
 
-### QBE Macros (`qbe.cm`)
+#### Mach VM (default)
 
-Provides operation implementations as QBE IL templates. Each arithmetic, comparison, and type operation is defined as a function that emits the corresponding QBE instructions, handling type dispatch (integer, float, text paths) with proper guard checks.
-
-## Execution Backends
-
-### Mach VM (default)
-
-Binary 32-bit register VM. The Mach serializer (`mach.c`) converts streamlined mcode JSON into compact 32-bit bytecode with a constant pool. Used for production execution and bootstrapping.
+The Mach VM is a register-based virtual machine that directly interprets the mcode instruction set as 32-bit binary bytecode. The Mach serializer (`mach.c`) converts streamlined mcode JSON into compact 32-bit instructions with a constant pool. Since the mach bytecode is a direct encoding of the mcode, the [Mcode IR](mcode.md) reference serves as the authoritative instruction set documentation.
 
 ```
-./cell script.ce
+pit script.ce
 ```
 
-Debug the mach bytecode output:
+#### Native Code (QBE / LLVM)
+
+Lowers the streamlined mcode to QBE or LLVM intermediate language for compilation to native machine code. Each mcode function becomes a native function that calls into the ƿit runtime (`cell_rt_*` functions) for operations that require the runtime (allocation, intrinsic dispatch, etc.).
+
+String constants are interned in a data section. Integer constants are encoded inline.
 
 ```
-./cell --core . --dump-mach script.ce
-```
-
-### Mcode Interpreter
-
-JSON-based interpreter. Used for debugging the compilation pipeline.
-
-```
-./cell --mcode script.ce
-```
-
-### QBE Native (experimental)
-
-Generates QBE IL that can be compiled to native code.
-
-```
-./cell --emit-qbe script.ce > output.ssa
+pit --emit-qbe script.ce > output.ssa
 ```
 
 ## Files
@@ -113,6 +106,14 @@ Generates QBE IL that can be compiled to native code.
 | `qbe.cm` | QBE IL operation templates |
 | `internal/bootstrap.cm` | Pipeline orchestrator |
 
+## Debug Tools
+
+| File | Purpose |
+|------|---------|
+| `dump_mcode.cm` | Print raw Mcode IR before streamlining |
+| `dump_stream.cm` | Print IR after streamlining with before/after stats |
+| `dump_types.cm` | Print streamlined IR with type annotations |
+
 ## Test Files
 
 | File | Tests |
@@ -122,3 +123,5 @@ Generates QBE IL that can be compiled to native code.
 | `mcode_test.ce` | Typed load/store, decomposed calls |
 | `streamline_test.ce` | Optimization counts, IR before/after |
 | `qbe_test.ce` | End-to-end QBE IL generation |
+| `test_intrinsics.cm` | Inlined intrinsic opcodes (is_array, length, push, etc.) |
+| `test_backward.cm` | Backward type propagation for parameters |

docs/spec/streamline.md

@@ -0,0 +1,361 @@
+---
+title: "Streamline Optimizer"
+description: "Mcode IR optimization passes"
+---
+
+## Overview
+
+The streamline optimizer (`streamline.cm`) runs a series of independent passes over the Mcode IR to eliminate redundant operations. Each pass is a standalone function that can be enabled, disabled, or reordered. Passes communicate only through the instruction array they mutate in place, replacing eliminated instructions with nop strings (e.g., `_nop_tc_1`).
+
+The optimizer runs after `mcode.cm` generates the IR and before the result is lowered to the Mach VM or emitted as QBE IL.
+
+```
+Fold (AST) → Mcode (JSON IR) → Streamline → Mach VM / QBE
+```
+
+## Type Lattice
+
+The optimizer tracks a type for each slot in the register file:
+
+| Type | Meaning |
+|------|---------|
+| `unknown` | No type information |
+| `int` | Integer |
+| `float` | Floating-point |
+| `num` | Number (subsumes int and float) |
+| `text` | String |
+| `bool` | Logical (true/false) |
+| `null` | Null value |
+| `array` | Array |
+| `record` | Record (object) |
+| `function` | Function |
+| `blob` | Binary blob |
+
+Subsumption: `int` and `float` both satisfy a `num` check.
+
+## Passes
+
+### 1. infer_param_types (backward type inference)
+
+Scans typed operators and generic arithmetic to determine what types their operands must be. For example, `subtract dest, a, b` implies both `a` and `b` are numbers.
+
+When a parameter slot (1..nr_args) is consistently inferred as a single type, that type is recorded. Since parameters are immutable (`def`), the inferred type holds for the entire function and persists across label join points (loop headers, branch targets).
+
+Backward inference rules:
+
+| Operator class | Operand type inferred |
+|---|---|
+| `subtract`, `multiply`, `divide`, `modulo`, `pow`, `negate` | T_NUM |
+| `eq_int`, `ne_int`, `lt_int`, `gt_int`, `le_int`, `ge_int`, bitwise ops | T_INT |
+| `eq_float`, `ne_float`, `lt_float`, `gt_float`, `le_float`, `ge_float` | T_FLOAT |
+| `concat`, text comparisons | T_TEXT |
+| `eq_bool`, `ne_bool`, `not`, `and`, `or` | T_BOOL |
+| `store_index` (object operand) | T_ARRAY |
+| `store_index` (index operand) | T_INT |
+| `store_field` (object operand) | T_RECORD |
+| `push` (array operand) | T_ARRAY |
+| `load_index` (object operand) | T_ARRAY |
+| `load_index` (index operand) | T_INT |
+| `load_field` (object operand) | T_RECORD |
+| `pop` (array operand) | T_ARRAY |
+
+Note: `add` is excluded from backward inference because it is polymorphic — it handles both numeric addition and text concatenation. Only operators that are unambiguously numeric can infer T_NUM.
+
+When a slot appears with conflicting type inferences, the result is `unknown`. INT + FLOAT conflicts produce `num`.
+
+**Nop prefix:** none (analysis only, does not modify instructions)
+
+### 2. infer_slot_write_types (slot write-type invariance)
+
+Scans all instructions to determine which non-parameter slots have a consistent write type. If every instruction that writes to a given slot produces the same type, that type is globally invariant and can safely persist across label join points.
+
+This analysis is sound because:
+- `alloc_slot()` in mcode.cm is monotonically increasing — temp slots are never reused
+- All local variable declarations must be at function body level and initialized — slots are written before any backward jumps to loop headers
+- `move` is conservatively treated as T_UNKNOWN, avoiding unsound transitive assumptions
+
+Write type mapping:
+
+| Instruction class | Write type |
+|---|---|
+| `int` | T_INT |
+| `true`, `false` | T_BOOL |
+| `null` | T_NULL |
+| `access` | type of literal value |
+| `array` | T_ARRAY |
+| `record` | T_RECORD |
+| `function` | T_FUNCTION |
+| `length` | T_INT |
+| bitwise ops | T_INT |
+| `concat` | T_TEXT |
+| bool ops, comparisons, `in` | T_BOOL |
+| generic arithmetic (`add`, `subtract`, `negate`, etc.) | T_UNKNOWN |
+| `move`, `load_field`, `load_index`, `load_dynamic`, `pop`, `get` | T_UNKNOWN |
+| `invoke`, `tail_invoke` | T_UNKNOWN |
+
+The result is a map of slot→type for slots where all writes agree on a single known type. Parameter slots (1..nr_args) and slot 0 are excluded.
+
+Common patterns this enables:
+
+- **Length variables** (`var len = length(arr)`): written by `length` (T_INT) only → invariant T_INT
+- **Boolean flags** (`var found = false; ... found = true`): written by `false` and `true` → invariant T_BOOL
+- **Locally-created containers** (`var arr = []`): written by `array` only → invariant T_ARRAY
+
+Note: Loop counters (`var i = 0; i = i + 1`) are NOT invariant because `add` produces T_UNKNOWN. However, if `i` is a function parameter used in arithmetic, backward inference from `subtract`/`multiply`/etc. will infer T_NUM for it, which persists across labels.
+
+**Nop prefix:** none (analysis only, does not modify instructions)
+
+### 3. eliminate_type_checks (type-check + jump elimination)
+
+Forward pass that tracks the known type of each slot. When a type check (`is_int`, `is_text`, `is_num`, etc.) is followed by a conditional jump, and the slot's type is already known, the check and jump can be eliminated or converted to an unconditional jump.
+
+Three cases:
+
+- **Known match** (e.g., `is_int` on a slot known to be `int`): both the check and the conditional jump are eliminated (nop'd).
+- **Known mismatch** (e.g., `is_text` on a slot known to be `int`): the check is nop'd and the conditional jump is rewritten to an unconditional `jump`.
+- **Unknown**: the check remains, but on fallthrough, the slot's type is narrowed to the checked type (enabling downstream eliminations).
+
+This pass also reduces `load_dynamic`/`store_dynamic` to `load_field`/`store_field` or `load_index`/`store_index` when the key slot's type is known.
+
+At label join points, all type information is reset except for parameter types from backward inference and write-invariant types from slot write-type analysis.
+
+**Nop prefix:** `_nop_tc_`
+
+### 4. simplify_algebra (same-slot comparison folding)
+
+Tracks known constant values. Folds same-slot comparisons:
+
+| Pattern | Rewrite |
+|---------|---------|
+| `eq_* dest, x, x` | `true dest` |
+| `le_* dest, x, x` | `true dest` |
+| `ge_* dest, x, x` | `true dest` |
+| `is_identical dest, x, x` | `true dest` |
+| `ne_* dest, x, x` | `false dest` |
+| `lt_* dest, x, x` | `false dest` |
+| `gt_* dest, x, x` | `false dest` |
+
+**Nop prefix:** none (rewrites in place, does not create nops)
+
+### 5. simplify_booleans (not + jump fusion)
+
+Peephole pass that eliminates unnecessary `not` instructions:
+
+| Pattern | Rewrite |
+|---------|---------|
+| `not d, x; jump_false d, L` | nop; `jump_true x, L` |
+| `not d, x; jump_true d, L` | nop; `jump_false x, L` |
+| `not d1, x; not d2, d1` | nop; `move d2, x` |
+
+This is particularly effective on `if (!cond)` patterns, which the compiler generates as `not; jump_false`. After this pass, they become a single `jump_true`.
+
+**Nop prefix:** `_nop_bl_`
+
+### 6. eliminate_moves (self-move elimination)
+
+Removes `move a, a` instructions where the source and destination are the same slot. These can arise from earlier passes rewriting binary operations into moves.
+
+**Nop prefix:** `_nop_mv_`
+
+### 7. eliminate_unreachable (dead code after return)
+
+Nops instructions after `return` until the next real label. Only `return` is treated as a terminal instruction; `disrupt` is not, because the disruption handler code immediately follows `disrupt` and must remain reachable.
+
+The mcode compiler emits a label at disruption handler entry points (see `emit_label(gen_label("disruption"))` in mcode.cm), which provides the label boundary that stops this pass from eliminating handler code.
+
+**Nop prefix:** `_nop_ur_`
+
+### 8. eliminate_dead_jumps (jump-to-next-label elimination)
+
+Removes `jump L` instructions where `L` is the immediately following label (skipping over any intervening nop strings). These are common after other passes eliminate conditional branches, leaving behind jumps that fall through naturally.
+
+**Nop prefix:** `_nop_dj_`
+
+## Pass Composition
+
+All passes run in sequence in `optimize_function`:
+
+```
+infer_param_types        → returns param_types map
+infer_slot_write_types   → returns write_types map
+eliminate_type_checks    → uses param_types + write_types
+simplify_algebra
+simplify_booleans
+eliminate_moves
+eliminate_unreachable
+eliminate_dead_jumps
+```
+
+Each pass is independent and can be commented out for testing or benchmarking.
+
+## Intrinsic Inlining
+
+Before streamlining, `mcode.cm` recognizes calls to built-in intrinsic functions and emits direct opcodes instead of the generic frame/setarg/invoke call sequence. This reduces a 6-instruction call pattern to a single instruction:
+
+| Call | Emitted opcode |
+|------|---------------|
+| `is_array(x)` | `is_array dest, src` |
+| `is_function(x)` | `is_func dest, src` |
+| `is_object(x)` | `is_record dest, src` |
+| `is_stone(x)` | `is_stone dest, src` |
+| `is_integer(x)` | `is_int dest, src` |
+| `is_text(x)` | `is_text dest, src` |
+| `is_number(x)` | `is_num dest, src` |
+| `is_logical(x)` | `is_bool dest, src` |
+| `is_null(x)` | `is_null dest, src` |
+| `length(x)` | `length dest, src` |
+| `push(arr, val)` | `push arr, val` |
+
+These inlined opcodes have corresponding Mach VM implementations in `mach.c`.
+
+## Unified Arithmetic
+
+Arithmetic operations use generic opcodes: `add`, `subtract`, `multiply`, `divide`, `modulo`, `pow`, `negate`. There are no type-dispatched variants (e.g., no `add_int`/`add_float`).
+
+The Mach VM dispatches at runtime with an int-first fast path via `reg_vm_binop()`: it checks `JS_VALUE_IS_BOTH_INT` first for fast integer arithmetic, then falls back to float conversion, text concatenation (for `add` only), or type error.
+
+Bitwise operations (`shl`, `shr`, `ushr`, `bitand`, `bitor`, `bitxor`, `bitnot`) remain integer-only and disrupt if operands are not integers.
+
+The QBE/native backend maps generic arithmetic to helper calls (`qbe.add`, `qbe.sub`, etc.). The vision for the native path is that with sufficient type inference, the backend can unbox proven-numeric values to raw registers, operate directly, and only rebox at boundaries (returns, calls, stores).
+
+## Debugging Tools
+
+Three dump tools inspect the IR at different stages:
+
+- **`dump_mcode.cm`** — prints the raw Mcode IR after `mcode.cm`, before streamlining
+- **`dump_stream.cm`** — prints the IR after streamlining, with before/after instruction counts
+- **`dump_types.cm`** — prints the streamlined IR with type annotations on each instruction
+
+Usage:
+```
+./cell --core . dump_mcode.cm <file.ce|file.cm>
+./cell --core . dump_stream.cm <file.ce|file.cm>
+./cell --core . dump_types.cm <file.ce|file.cm>
+```
+
+## Tail Call Marking
+
+When a function's return expression is a call (`stmt.tail == true` from the parser) and the function has no disruption handler, mcode.cm renames the final `invoke` instruction to `tail_invoke`. This is semantically identical to `invoke` in the current Mach VM, but marks the call site for future tail call optimization.
+
+The disruption handler restriction exists because TCO would discard the current frame, but the handler must remain on the stack to catch disruptions from the callee.
+
+`tail_invoke` is handled by the same passes as `invoke` in streamline (type tracking, algebraic simplification) and executes identically in the VM.
+
+## Type Propagation Architecture
+
+Type information flows through three compilation stages, each building on the previous:
+
+### Stage 1: Parse-time type tags (parse.cm)
+
+The parser assigns `type_tag` strings to scope variable entries when the type is syntactically obvious:
+
+- **From initializers**: `def a = []` → `type_tag: "array"`, `def n = 42` → `type_tag: "integer"`, `def r = {}` → `type_tag: "record"`
+- **From usage patterns** (def only): `def x = null; x[] = v` infers `type_tag: "array"` from the push. `def x = null; x.foo = v` infers `type_tag: "record"` from property access.
+- **Type error detection** (def only): When a `def` variable has a known type_tag, provably wrong operations are compile errors:
+  - Property access (`.`) on array
+  - Push (`[]`) on non-array
+  - Text key on array
+  - Integer key on record
+
+Only `def` (constant) variables participate in type inference and error detection. `var` variables can be reassigned, making their initializer type unreliable.
+
+### Stage 2: Fold-time type propagation (fold.cm)
+
+The fold pass extends type information through the AST:
+
+- **Intrinsic folding**: `is_array(known_array)` folds to `true`. `length(known_array)` gets `hint: "array_length"`.
+- **Purity analysis**: Expressions involving only `is_*` intrinsic calls with pure arguments are considered pure. This enables dead code elimination for unused `var`/`def` bindings with pure initializers, and elimination of standalone pure call statements.
+- **Dead code**: Unused pure `var`/`def` declarations are removed. Standalone calls to pure intrinsics (where the result is discarded) are removed. Unreachable branches with constant conditions are removed.
+
+The `pure_intrinsics` set currently contains only `is_*` sensory functions (`is_array`, `is_text`, `is_number`, `is_integer`, `is_function`, `is_logical`, `is_null`, `is_object`, `is_stone`). Other intrinsics like `text`, `number`, and `length` can disrupt on wrong argument types, so they are excluded — removing a call that would disrupt changes observable behavior.
+
+### Stage 3: Streamline-time type tracking (streamline.cm)
+
+The streamline optimizer uses a numeric type lattice (`T_INT`, `T_FLOAT`, `T_TEXT`, etc.) for fine-grained per-instruction tracking:
+
+- **Backward inference** (pass 1): Scans typed operators to infer parameter types. Since parameters are `def` (immutable), inferred types persist across label boundaries.
+- **Write-type invariance** (pass 2): Scans all instructions to find local slots where every write produces the same type. These invariant types persist across label boundaries alongside parameter types.
+- **Forward tracking** (pass 3): `track_types` follows instruction execution order, tracking the type of each slot. Known-type operations set their destination type (e.g., `concat` → T_TEXT, `length` → T_INT). Generic arithmetic produces T_UNKNOWN. Type checks on unknown slots narrow the type on fallthrough.
+- **Type check elimination** (pass 3): When a slot's type is already known, `is_<type>` + conditional jump pairs are eliminated or converted to unconditional jumps.
+- **Dynamic access narrowing** (pass 3): `load_dynamic`/`store_dynamic` are narrowed to `load_field`/`store_field` or `load_index`/`store_index` when the key type is known.
+
+Type information resets at label join points (since control flow merges could bring different types), except for parameter types from backward inference and write-invariant types from slot write-type analysis.
+
+## Future Work
+
+### Copy Propagation
+
+A basic-block-local copy propagation pass would replace uses of a copied variable with its source, enabling further move elimination. An implementation was attempted but encountered an unsolved bug where 2-position instruction operand replacement produces incorrect code during self-hosting (the replacement logic for 3-position instructions works correctly). The root cause is not yet understood. See the project memory files for detailed notes.
+
+### Expanded Purity Analysis
+
+The current purity set is conservative (only `is_*`). It could be expanded by:
+
+- **Argument-type-aware purity**: If all arguments to an intrinsic are known to be the correct types (via type_tag or slot_types), the call cannot disrupt and is safe to eliminate. For example, `length(known_array)` is pure but `length(unknown)` is not.
+- **User function purity**: Analyze user-defined function bodies during pre_scan. A function is pure if its body contains only pure expressions and calls to known-pure functions. This requires fixpoint iteration for mutual recursion.
+- **Callback-aware purity**: Intrinsics like `filter`, `find`, `reduce`, `some`, `every` are pure if their callback argument is pure.
+
+### Forward Type Narrowing from Typed Operations
+
+With unified arithmetic (generic `add`/`subtract`/`multiply`/`divide`/`modulo`/`negate` instead of typed variants), this approach is no longer applicable. Typed comparisons (`eq_int`, `lt_float`, etc.) still exist and their operands have known types, but these are already handled by backward inference.
+
+### Guard Hoisting for Parameters
+
+When a type check on a parameter passes (falls through), the parameter's type could be promoted to `param_types` so it persists across label boundaries. This would allow the first type check on a parameter to prove its type for the entire function. However, this is unsound for polymorphic parameters — if a function is called with different argument types, the first check would wrongly eliminate checks for subsequent types.
+
+A safe version would require proving that a parameter is monomorphic (called with only one type across all call sites), which requires interprocedural analysis.
+
+**Note:** For local variables (non-parameters), the write-type invariance analysis (pass 2) achieves a similar effect safely — if every write to a slot produces the same type, that type persists across labels without needing to hoist any guard.
+
+### Tail Call Optimization
+
+`tail_invoke` instructions are currently marked but execute identically to `invoke`. Actual TCO would reuse the current call frame instead of creating a new one. This requires:
+
+- Ensuring argument count matches (or the frame can be resized)
+- No live locals needed after the call (guaranteed by tail position)
+- No disruption handler on the current function (already enforced by the marking)
+- VM support in mach.c to rewrite the frame in place
+
+### Interprocedural Type Inference
+
+Currently all type inference is intraprocedural (within a single function). Cross-function analysis could:
+
+- Infer return types from function bodies
+- Propagate argument types from call sites to callees
+- Specialize functions for known argument types (cloning)
+
+### Strength Reduction
+
+Common patterns that could be lowered to cheaper operations when operand types are known:
+
+- `multiply x, 2` with proven-int operands → shift left
+- `divide x, 2` with proven-int → arithmetic shift right
+- `modulo x, power_of_2` with proven-int → bitwise and
+
+### Numeric Unboxing (QBE/native path)
+
+With unified arithmetic and backward type inference, the native backend can identify regions where numeric values remain in registers without boxing/unboxing:
+
+1. **Guard once**: When backward inference proves a parameter is T_NUM, emit a single type guard at function entry.
+2. **Unbox**: Convert the tagged JSValue to a raw double register.
+3. **Operate**: Use native FP/int instructions directly (no function calls, no tag checks).
+4. **Rebox**: Convert back to tagged JSValue only at rebox points (function returns, calls, stores to arrays/records).
+
+This requires inserting `unbox`/`rebox` IR annotations (no-ops in the Mach VM, meaningful only to QBE).
+
+### Loop-Invariant Code Motion
+
+Type checks that are invariant across loop iterations (checking a variable that doesn't change in the loop body) could be hoisted above the loop. This would require identifying loop boundaries and proving invariance.
+
+### Algebraic Identity Optimization
+
+With unified arithmetic, algebraic identities (x+0→x, x*1→x, x*0→0, x/1→x) require knowing operand values at compile time. Since generic `add`/`multiply` operate on any numeric type, the constant-tracking logic in `simplify_algebra` could be extended to handle these for known-constant slots.
+
+## Nop Convention
+
+Eliminated instructions are replaced with strings matching `_nop_<prefix>_<counter>`. The prefix identifies which pass created the nop. Nop strings are:
+
+- Skipped during interpretation (the VM ignores them)
+- Skipped during QBE emission
+- Not counted in instruction statistics
+- Preserved in the instruction array to maintain positional stability for jump targets

docs/testing.md

@@ -0,0 +1,170 @@
+---
+title: "Testing"
+description: "Writing and running tests in ƿit"
+weight: 45
+type: "docs"
+---
+
+ƿit has built-in support for writing and running tests. Tests live in the `tests/` directory of a package and are `.cm` modules that return a record of test functions.
+
+## Writing Tests
+
+A test file returns a record where each key starting with `test_` is a test function. A test passes if it returns `null` (or nothing). It fails if it returns a text string describing the failure.
+
+```javascript
+// tests/math.cm
+return {
+    test_addition: function() {
+        if (1 + 2 != 3) return "expected 3"
+    },
+
+    test_division: function() {
+        if (10 / 3 != 3.333333333333333333) return "unexpected result"
+    }
+}
+```
+
+Test functions take no arguments. Use early returns with a failure message to report errors:
+
+```javascript
+test_array_push: function() {
+    var a = [1, 2]
+    a[] = 3
+    if (length(a) != 3) return "expected length 3, got " + text(length(a))
+    if (a[2] != 3) return "expected a[2] to be 3"
+}
+```
+
+## Running Tests
+
+```bash
+pit test                          # run all tests in current package
+pit test suite                    # run a specific test file (tests/suite.cm)
+pit test tests/math               # same, with explicit path
+pit test all                      # run all tests in current package
+pit test package <name>           # run all tests in a named package
+pit test package <name> <test>    # run a specific test in a named package
+pit test package all              # run tests from all installed packages
+```
+
+### Flags
+
+```bash
+pit test suite -g          # run GC after each test (useful for detecting leaks)
+pit test suite --verify    # enable IR verification during compilation
+pit test suite --diff      # run each test optimized and unoptimized, compare results
+```
+
+`--verify` and `--diff` can be combined:
+
+```bash
+pit test suite --verify --diff
+```
+
+## IR Verification
+
+The `--verify` flag enables structural validation of the compiler's intermediate representation after each optimizer pass. This catches bugs like invalid slot references, broken jump targets, and malformed instructions.
+
+When verification fails, errors are printed with the pass name that introduced them:
+
+```
+[verify_ir] slot_bounds: slot 12 out of range 0..9 in instruction add_int
+[verify_ir] 1 errors after dead_code_elimination
+```
+
+IR verification adds overhead and is intended for development, not production use.
+
+## Differential Testing
+
+Differential testing runs each test through two paths — with the optimizer enabled and with it disabled — and compares results. Any mismatch between the two indicates an optimizer bug.
+
+### Inline Mode
+
+The `--diff` flag on `pit test` runs each test module through both paths during a normal test run:
+
+```bash
+pit test suite --diff
+```
+
+Output includes a mismatch count at the end:
+
+```
+Tests: 493 passed, 0 failed, 493 total
+Diff mismatches: 0
+```
+
+### Standalone Mode
+
+`pit diff` is a dedicated differential testing tool with detailed mismatch reporting:
+
+```bash
+pit diff                   # diff all test files in current package
+pit diff suite             # diff a specific test file
+pit diff tests/math        # same, with explicit path
+```
+
+For each test function, it reports whether the optimized and unoptimized results match:
+
+```
+  tests/suite.cm: 493 passed, 0 failed
+----------------------------------------
+Diff: 493 passed, 0 failed, 493 total
+```
+
+When a mismatch is found:
+
+```
+  tests/suite.cm: 492 passed, 1 failed
+    MISMATCH: test_foo: result mismatch opt=42 noopt=43
+```
+
+## Fuzz Testing
+
+The fuzzer generates random self-checking programs, compiles them, and runs them through both optimized and unoptimized paths. Each generated program contains test functions that validate their own expected results, so failures catch both correctness bugs and optimizer mismatches.
+
+```bash
+pit fuzz                   # 100 iterations, random seed
+pit fuzz 500               # 500 iterations, random seed
+pit fuzz --seed 42         # 100 iterations, deterministic seed
+pit fuzz 1000 --seed 42   # 1000 iterations, deterministic seed
+```
+
+The fuzzer generates programs that exercise:
+
+- Integer and float arithmetic with known expected results
+- Control flow (if/else, while loops)
+- Closures and captured variable mutation
+- Records and property access
+- Arrays and iteration
+- Higher-order functions
+- Disruption handling
+- Text concatenation
+
+On failure, the generated source is saved to `tests/fuzz_failures/` for reproduction:
+
+```
+Fuzzing: 1000 iterations, starting seed=42
+  FAIL seed=57: diff fuzz_3: opt=10 noopt=11
+    saved to tests/fuzz_failures/seed_57.cm
+----------------------------------------
+Fuzz: 999 passed, 1 failed, 1000 total
+Failures saved to tests/fuzz_failures/
+```
+
+Saved failure files are valid `.cm` modules that can be run directly or added to the test suite.
+
+## Test File Organization
+
+Tests live in the `tests/` directory of a package:
+
+```
+mypackage/
+├── pit.toml
+├── math.cm
+└── tests/
+    ├── suite.cm        # main test suite
+    ├── math.cm         # math-specific tests
+    └── disrupt.cm      # disruption tests
+```
+
+All `.cm` files under `tests/` are discovered automatically by `pit test`.

dump_ast.cm

@@ -0,0 +1,16 @@
+// dump_ast.cm — pretty-print the folded AST as JSON
+//
+// Usage: ./cell --core . dump_ast.cm <file.ce|file.cm>
+
+var fd = use("fd")
+var json = use("json")
+var tokenize = use("tokenize")
+var parse = use("parse")
+var fold = use("fold")
+
+var filename = args[0]
+var src = text(fd.slurp(filename))
+var tok = tokenize(src, filename)
+var ast = parse(tok.tokens, src, filename, tokenize)
+var folded = fold(ast)
+print(json.encode(folded))

dump_mcode.cm

@@ -1,20 +1,117 @@
+// dump_mcode.cm — pretty-print mcode IR (before streamlining)
+//
+// Usage: ./cell --core . dump_mcode.cm <file.ce|file.cm>
+
 var fd = use("fd")
 var json = use("json")
 var tokenize = use("tokenize")
 var parse = use("parse")
 var fold = use("fold")
 var mcode = use("mcode")
-var streamline = use("streamline")
 
-var name = args[0]
-var src = text(fd.slurp(name))
-var tok = tokenize(src, name)
-var ast = parse(tok.tokens, src, name, tokenize)
+if (length(args) < 1) {
+  print("usage: cell --core . dump_mcode.cm <file>")
+  return
+}
+
+var filename = args[0]
+var src = text(fd.slurp(filename))
+var tok = tokenize(src, filename)
+var ast = parse(tok.tokens, src, filename, tokenize)
 var folded = fold(ast)
 var compiled = mcode(folded)
-var optimized = streamline(compiled)
-var out = json.encode(optimized)
-var f = fd.open("/tmp/mcode_dump.json", "w")
-fd.write(f, out)
-fd.close(f)
-print("wrote /tmp/mcode_dump.json")
+
+var pad_right = function(s, w) {
+  var r = s
+  while (length(r) < w) {
+    r = r + " "
+  }
+  return r
+}
+
+var fmt_val = function(v) {
+  if (is_null(v)) {
+    return "null"
+  }
+  if (is_number(v)) {
+    return text(v)
+  }
+  if (is_text(v)) {
+    return `"${v}"`
+  }
+  if (is_object(v)) {
+    return json.encode(v)
+  }
+  if (is_logical(v)) {
+    return v ? "true" : "false"
+  }
+  return text(v)
+}
+
+var dump_function = function(func, name) {
+  var nr_args = func.nr_args != null ? func.nr_args : 0
+  var nr_slots = func.nr_slots != null ? func.nr_slots : 0
+  var nr_close = func.nr_close_slots != null ? func.nr_close_slots : 0
+  var instrs = func.instructions
+  var i = 0
+  var pc = 0
+  var instr = null
+  var op = null
+  var n = 0
+  var parts = null
+  var j = 0
+  var operands = null
+  var pc_str = null
+  var op_str = null
+  print(`\n=== ${name} (args=${text(nr_args)}, slots=${text(nr_slots)}, closures=${text(nr_close)}) ===`)
+  if (instrs == null || length(instrs) == 0) {
+    print("  (empty)")
+    return null
+  }
+  while (i < length(instrs)) {
+    instr = instrs[i]
+    if (is_text(instr)) {
+      if (!starts_with(instr, "_nop_")) {
+        print(`${instr}:`)
+      }
+    } else if (is_array(instr)) {
+      op = instr[0]
+      n = length(instr)
+      parts = []
+      j = 1
+      while (j < n - 2) {
+        push(parts, fmt_val(instr[j]))
+        j = j + 1
+      }
+      operands = text(parts, ", ")
+      pc_str = pad_right(text(pc), 5)
+      op_str = pad_right(op, 14)
+      print(`  ${pc_str} ${op_str} ${operands}`)
+      pc = pc + 1
+    }
+    i = i + 1
+  }
+  return null
+}
+
+var main_name = null
+var fi = 0
+var func = null
+var fname = null
+
+// Dump main
+if (compiled.main != null) {
+  main_name = compiled.name != null ? compiled.name : "<main>"
+  dump_function(compiled.main, main_name)
+}
+
+// Dump sub-functions
+if (compiled.functions != null) {
+  fi = 0
+  while (fi < length(compiled.functions)) {
+    func = compiled.functions[fi]
+    fname = func.name != null ? func.name : `<func_${text(fi)}>`
+    dump_function(func, `[${text(fi)}] ${fname}`)
+    fi = fi + 1
+  }
+}

dump_stream.cm

@@ -0,0 +1,166 @@
+// dump_stream.cm — show mcode IR before and after streamlining
+//
+// Usage: ./cell --core . dump_stream.cm <file.ce|file.cm>
+
+var fd = use("fd")
+var json = use("json")
+var tokenize = use("tokenize")
+var parse = use("parse")
+var fold = use("fold")
+var mcode = use("mcode")
+var streamline = use("streamline")
+
+if (length(args) < 1) {
+  print("usage: cell --core . dump_stream.cm <file>")
+  return
+}
+
+var filename = args[0]
+var src = text(fd.slurp(filename))
+var tok = tokenize(src, filename)
+var ast = parse(tok.tokens, src, filename, tokenize)
+var folded = fold(ast)
+var compiled = mcode(folded)
+
+// Deep copy IR for before snapshot
+var before = json.decode(json.encode(compiled))
+
+var optimized = streamline(compiled)
+
+var pad_right = function(s, w) {
+  var r = s
+  while (length(r) < w) {
+    r = r + " "
+  }
+  return r
+}
+
+var fmt_val = function(v) {
+  if (is_null(v)) {
+    return "null"
+  }
+  if (is_number(v)) {
+    return text(v)
+  }
+  if (is_text(v)) {
+    return `"${v}"`
+  }
+  if (is_object(v)) {
+    return json.encode(v)
+  }
+  if (is_logical(v)) {
+    return v ? "true" : "false"
+  }
+  return text(v)
+}
+
+var count_stats = function(func) {
+  var instrs = func.instructions
+  var total = 0
+  var nops = 0
+  var calls = 0
+  var i = 0
+  var instr = null
+  if (instrs == null) {
+    return {total: 0, nops: 0, real: 0, calls: 0}
+  }
+  while (i < length(instrs)) {
+    instr = instrs[i]
+    if (is_text(instr)) {
+      if (starts_with(instr, "_nop_")) {
+        nops = nops + 1
+      }
+    } else if (is_array(instr)) {
+      total = total + 1
+      if (instr[0] == "invoke") {
+        calls = calls + 1
+      }
+    }
+    i = i + 1
+  }
+  return {total: total, nops: nops, real: total - nops, calls: calls}
+}
+
+var dump_function = function(func, show_nops) {
+  var instrs = func.instructions
+  var i = 0
+  var pc = 0
+  var instr = null
+  var op = null
+  var n = 0
+  var parts = null
+  var j = 0
+  var operands = null
+  var pc_str = null
+  var op_str = null
+  if (instrs == null || length(instrs) == 0) {
+    return null
+  }
+  while (i < length(instrs)) {
+    instr = instrs[i]
+    if (is_text(instr)) {
+      if (starts_with(instr, "_nop_")) {
+        if (show_nops) {
+          print(`  ${pad_right(text(pc), 5)} --- nop ---`)
+          pc = pc + 1
+        }
+      } else {
+        print(`${instr}:`)
+      }
+    } else if (is_array(instr)) {
+      op = instr[0]
+      n = length(instr)
+      parts = []
+      j = 1
+      while (j < n - 2) {
+        push(parts, fmt_val(instr[j]))
+        j = j + 1
+      }
+      operands = text(parts, ", ")
+      pc_str = pad_right(text(pc), 5)
+      op_str = pad_right(op, 14)
+      print(`  ${pc_str} ${op_str} ${operands}`)
+      pc = pc + 1
+    }
+    i = i + 1
+  }
+  return null
+}
+
+var dump_pair = function(before_func, after_func, name) {
+  var nr_args = after_func.nr_args != null ? after_func.nr_args : 0
+  var nr_slots = after_func.nr_slots != null ? after_func.nr_slots : 0
+  var b_stats = count_stats(before_func)
+  var a_stats = count_stats(after_func)
+  var eliminated = a_stats.nops
+  print(`\n=== ${name} (args=${text(nr_args)}, slots=${text(nr_slots)}) ===`)
+  print(`  before: ${text(b_stats.total)} instructions, ${text(b_stats.calls)} invokes`)
+  print(`  after:  ${text(a_stats.real)} instructions (${text(eliminated)} eliminated), ${text(a_stats.calls)} invokes`)
+  print("\n  -- streamlined --")
+  dump_function(after_func, false)
+  return null
+}
+
+var main_name = null
+var fi = 0
+var func = null
+var bfunc = null
+var fname = null
+
+// Dump main
+if (optimized.main != null && before.main != null) {
+  main_name = optimized.name != null ? optimized.name : "<main>"
+  dump_pair(before.main, optimized.main, main_name)
+}
+
+// Dump sub-functions
+if (optimized.functions != null && before.functions != null) {
+  fi = 0
+  while (fi < length(optimized.functions)) {
+    func = optimized.functions[fi]
+    bfunc = before.functions[fi]
+    fname = func.name != null ? func.name : `<func_${text(fi)}>`
+    dump_pair(bfunc, func, `[${text(fi)}] ${fname}`)
+    fi = fi + 1
+  }
+}

dump_types.cm

@@ -0,0 +1,237 @@
+// dump_types.cm — show streamlined IR with type annotations
+//
+// Usage: ./cell --core . dump_types.cm <file.ce|file.cm>
+
+var fd = use("fd")
+var json = use("json")
+var tokenize = use("tokenize")
+var parse = use("parse")
+var fold = use("fold")
+var mcode = use("mcode")
+var streamline = use("streamline")
+
+if (length(args) < 1) {
+  print("usage: cell --core . dump_types.cm <file>")
+  return
+}
+
+var filename = args[0]
+var src = text(fd.slurp(filename))
+var tok = tokenize(src, filename)
+var ast = parse(tok.tokens, src, filename, tokenize)
+var folded = fold(ast)
+var compiled = mcode(folded)
+var optimized = streamline(compiled)
+
+// Type constants
+def T_UNKNOWN = "unknown"
+def T_INT = "int"
+def T_FLOAT = "float"
+def T_NUM = "num"
+def T_TEXT = "text"
+def T_BOOL = "bool"
+def T_NULL = "null"
+def T_ARRAY = "array"
+def T_RECORD = "record"
+def T_FUNCTION = "function"
+
+def int_result_ops = {
+  bitnot: true, bitand: true, bitor: true,
+  bitxor: true, shl: true, shr: true, ushr: true
+}
+def bool_result_ops = {
+  eq_int: true, ne_int: true, lt_int: true, gt_int: true,
+  le_int: true, ge_int: true,
+  eq_float: true, ne_float: true, lt_float: true, gt_float: true,
+  le_float: true, ge_float: true,
+  eq_text: true, ne_text: true, lt_text: true, gt_text: true,
+  le_text: true, ge_text: true,
+  eq_bool: true, ne_bool: true,
+  not: true, and: true, or: true,
+  is_int: true, is_text: true, is_num: true,
+  is_bool: true, is_null: true, is_identical: true,
+  is_array: true, is_func: true, is_record: true, is_stone: true
+}
+
+var access_value_type = function(val) {
+  if (is_number(val)) {
+    return is_integer(val) ? T_INT : T_FLOAT
+  }
+  if (is_text(val)) {
+    return T_TEXT
+  }
+  return T_UNKNOWN
+}
+
+var track_types = function(slot_types, instr) {
+  var op = instr[0]
+  var src_type = null
+  if (op == "access") {
+    slot_types[text(instr[1])] = access_value_type(instr[2])
+  } else if (op == "int") {
+    slot_types[text(instr[1])] = T_INT
+  } else if (op == "true" || op == "false") {
+    slot_types[text(instr[1])] = T_BOOL
+  } else if (op == "null") {
+    slot_types[text(instr[1])] = T_NULL
+  } else if (op == "move") {
+    src_type = slot_types[text(instr[2])]
+    slot_types[text(instr[1])] = src_type != null ? src_type : T_UNKNOWN
+  } else if (int_result_ops[op] == true) {
+    slot_types[text(instr[1])] = T_INT
+  } else if (op == "concat") {
+    slot_types[text(instr[1])] = T_TEXT
+  } else if (bool_result_ops[op] == true) {
+    slot_types[text(instr[1])] = T_BOOL
+  } else if (op == "typeof") {
+    slot_types[text(instr[1])] = T_TEXT
+  } else if (op == "array") {
+    slot_types[text(instr[1])] = T_ARRAY
+  } else if (op == "record") {
+    slot_types[text(instr[1])] = T_RECORD
+  } else if (op == "function") {
+    slot_types[text(instr[1])] = T_FUNCTION
+  } else if (op == "invoke" || op == "tail_invoke") {
+    slot_types[text(instr[2])] = T_UNKNOWN
+  } else if (op == "load_field" || op == "load_index" || op == "load_dynamic") {
+    slot_types[text(instr[1])] = T_UNKNOWN
+  } else if (op == "pop" || op == "get") {
+    slot_types[text(instr[1])] = T_UNKNOWN
+  } else if (op == "length") {
+    slot_types[text(instr[1])] = T_INT
+  } else if (op == "add" || op == "subtract" || op == "multiply" ||
+             op == "divide" || op == "modulo" || op == "pow" || op == "negate") {
+    slot_types[text(instr[1])] = T_UNKNOWN
+  }
+  return null
+}
+
+var pad_right = function(s, w) {
+  var r = s
+  while (length(r) < w) {
+    r = r + " "
+  }
+  return r
+}
+
+var fmt_val = function(v) {
+  if (is_null(v)) {
+    return "null"
+  }
+  if (is_number(v)) {
+    return text(v)
+  }
+  if (is_text(v)) {
+    return `"${v}"`
+  }
+  if (is_object(v)) {
+    return json.encode(v)
+  }
+  if (is_logical(v)) {
+    return v ? "true" : "false"
+  }
+  return text(v)
+}
+
+// Build type annotation string for an instruction
+var type_annotation = function(slot_types, instr) {
+  var n = length(instr)
+  var parts = []
+  var j = 1
+  var v = null
+  var t = null
+  while (j < n - 2) {
+    v = instr[j]
+    if (is_number(v)) {
+      t = slot_types[text(v)]
+      if (t != null && t != T_UNKNOWN) {
+        push(parts, `s${text(v)}:${t}`)
+      }
+    }
+    j = j + 1
+  }
+  if (length(parts) == 0) {
+    return ""
+  }
+  return text(parts, " ")
+}
+
+var dump_function_typed = function(func, name) {
+  var nr_args = func.nr_args != null ? func.nr_args : 0
+  var nr_slots = func.nr_slots != null ? func.nr_slots : 0
+  var instrs = func.instructions
+  var slot_types = {}
+  var i = 0
+  var pc = 0
+  var instr = null
+  var op = null
+  var n = 0
+  var annotation = null
+  var operand_parts = null
+  var j = 0
+  var operands = null
+  var pc_str = null
+  var op_str = null
+  var line = null
+  print(`\n=== ${name} (args=${text(nr_args)}, slots=${text(nr_slots)}) ===`)
+  if (instrs == null || length(instrs) == 0) {
+    print("  (empty)")
+    return null
+  }
+  while (i < length(instrs)) {
+    instr = instrs[i]
+    if (is_text(instr)) {
+      if (starts_with(instr, "_nop_")) {
+        i = i + 1
+        continue
+      }
+      slot_types = {}
+      print(`${instr}:`)
+    } else if (is_array(instr)) {
+      op = instr[0]
+      n = length(instr)
+      annotation = type_annotation(slot_types, instr)
+      operand_parts = []
+      j = 1
+      while (j < n - 2) {
+        push(operand_parts, fmt_val(instr[j]))
+        j = j + 1
+      }
+      operands = text(operand_parts, ", ")
+      pc_str = pad_right(text(pc), 5)
+      op_str = pad_right(op, 14)
+      line = pad_right(`  ${pc_str} ${op_str} ${operands}`, 50)
+      if (length(annotation) > 0) {
+        print(`${line} ; ${annotation}`)
+      } else {
+        print(line)
+      }
+      track_types(slot_types, instr)
+      pc = pc + 1
+    }
+    i = i + 1
+  }
+  return null
+}
+
+var main_name = null
+var fi = 0
+var func = null
+var fname = null
+
+// Dump main
+if (optimized.main != null) {
+  main_name = optimized.name != null ? optimized.name : "<main>"
+  dump_function_typed(optimized.main, main_name)
+}
+
+// Dump sub-functions
+if (optimized.functions != null) {
+  fi = 0
+  while (fi < length(optimized.functions)) {
+    func = optimized.functions[fi]
+    fname = func.name != null ? func.name : `<func_${text(fi)}>`
+    dump_function_typed(func, `[${text(fi)}] ${fname}`)
+    fi = fi + 1
+  }
+}

fold.cm

@@ -15,10 +15,18 @@ var fold = function(ast) {
     return k == "number" || k == "text" || k == "true" || k == "false" || k == "null"
   }
 
+  // Only intrinsics that can NEVER disrupt regardless of argument types
+  var pure_intrinsics = {
+    is_array: true, is_text: true, is_number: true, is_integer: true,
+    is_function: true, is_logical: true, is_null: true, is_object: true,
+    is_stone: true
+  }
+
   var is_pure = function(expr) {
     if (expr == null) return true
     var k = expr.kind
     var i = 0
+    var target = null
     if (k == "number" || k == "text" || k == "true" || k == "false" ||
         k == "null" || k == "name" || k == "this") return true
     if (k == "function") return true
@@ -47,6 +55,17 @@ var fold = function(ast) {
     if (k == "==" || k == "!=" || k == "&&" || k == "||") {
       return is_pure(expr.left) && is_pure(expr.right)
     }
+    if (k == "(") {
+      target = expr.expression
+      if (target != null && target.intrinsic == true && pure_intrinsics[target.name] == true) {
+        i = 0
+        while (i < length(expr.list)) {
+          if (!is_pure(expr.list[i])) return false
+          i = i + 1
+        }
+        return true
+      }
+    }
     return false
   }
 
@@ -676,6 +695,10 @@ var fold = function(ast) {
           }
         }
       }
+      // Dead pure call elimination: standalone pure calls with no result
+      if (stmt.kind == "call" && is_pure(stmt.expression)) {
+        stmt.dead = true
+      }
       // Dead function elimination
       if (stmt.kind == "function" && stmt.name != null) {
         sv = scope_var(fn_nr, stmt.name)

fuzz.ce

@@ -0,0 +1,278 @@
+// fuzz.ce — fuzzer driver: generates random programs, runs differential, saves failures
+//
+// Usage:
+//   cell fuzz                - run 100 iterations with a random seed
+//   cell fuzz 500            - run 500 iterations with a random seed
+//   cell fuzz --seed 42      - run 100 iterations starting at seed 42
+//   cell fuzz 500 --seed 42  - run 500 iterations starting at seed 42
+//
+// Each iteration generates a random self-checking program, compiles it,
+// runs it through both optimized and unoptimized paths, and compares results.
+// Failures are saved to tests/fuzz_failures/ for reproduction.
+var fd = use('fd')
+var time = use('time')
+var json = use('json')
+
+var os_ref = use('os')
+var analyze = os_ref.analyze
+var run_ast_fn = os_ref.run_ast_fn
+var run_ast_noopt_fn = os_ref.run_ast_noopt_fn
+
+var fuzzgen = use('fuzzgen')
+
+var _args = args == null ? [] : args
+
+// Parse arguments: fuzz [iterations] [--seed N]
+var iterations = 100
+var start_seed = null
+var i = 0
+var n = null
+var run_err = null
+var _run_one = null
+
+while (i < length(_args)) {
+  if (_args[i] == '--seed' && i + 1 < length(_args)) {
+    start_seed = number(_args[i + 1])
+    i = i + 2
+  } else {
+    n = number(_args[i])
+    if (n != null && n > 0) iterations = n
+    i = i + 1
+  }
+}
+
+if (start_seed == null) {
+  start_seed = floor(time.number() * 1000) % 1000000
+}
+
+if (!run_ast_noopt_fn) {
+  log.console("error: run_ast_noopt_fn not available (rebuild bootstrap)")
+  $stop()
+  return
+}
+
+// Ensure failures directory exists
+var failures_dir = "tests/fuzz_failures"
+
+function ensure_dir(path) {
+  if (fd.is_dir(path)) return
+  var parts = array(path, '/')
+  var current = ''
+  var j = 0
+  while (j < length(parts)) {
+    if (parts[j] != '') {
+      current = current + parts[j] + '/'
+      if (!fd.is_dir(current)) {
+        fd.mkdir(current)
+      }
+    }
+    j = j + 1
+  }
+}
+
+// Deep comparison
+function values_equal(a, b) {
+  var j = 0
+  if (a == b) return true
+  if (is_null(a) && is_null(b)) return true
+  if (is_null(a) || is_null(b)) return false
+  if (is_array(a) && is_array(b)) {
+    if (length(a) != length(b)) return false
+    j = 0
+    while (j < length(a)) {
+      if (!values_equal(a[j], b[j])) return false
+      j = j + 1
+    }
+    return true
+  }
+  return false
+}
+
+function describe(val) {
+  if (is_null(val)) return "null"
+  if (is_text(val)) return `"${val}"`
+  if (is_number(val)) return text(val)
+  if (is_logical(val)) return text(val)
+  if (is_function(val)) return "<function>"
+  return "<other>"
+}
+
+// Run a single fuzz iteration
+function run_fuzz(seed_val) {
+  var src = fuzzgen.generate(seed_val)
+  var name = "fuzz_" + text(seed_val)
+  var ast = null
+  var mod_opt = null
+  var mod_noopt = null
+  var opt_err = null
+  var noopt_err = null
+  var errors = []
+  var keys = null
+  var k = 0
+  var key = null
+  var ret = null
+  var _run = null
+  var run_err = null
+  var keys2 = null
+  var k2 = 0
+  var key2 = null
+  var opt_result = null
+  var noopt_result = null
+  var opt_fn_err = null
+  var noopt_fn_err = null
+  var _run_opt = null
+  var _run_noopt = null
+
+  // Parse
+  var _parse = function() {
+    ast = analyze(src, name + ".cm")
+  } disruption {
+    push(errors, "parse error")
+  }
+  _parse()
+  if (length(errors) > 0) return {seed: seed_val, errors: errors, src: src}
+
+  // Run optimized
+  var _opt = function() {
+    mod_opt = run_ast_fn(name, ast, {use: function(p) { return use(p) }})
+  } disruption {
+    opt_err = "disrupted"
+  }
+  _opt()
+
+  // Run unoptimized
+  var _noopt = function() {
+    mod_noopt = run_ast_noopt_fn(name + "_noopt", ast, {use: function(p) { return use(p) }})
+  } disruption {
+    noopt_err = "disrupted"
+  }
+  _noopt()
+
+  // Check module-level behavior
+  if (opt_err != noopt_err) {
+    push(errors, `module load: opt=${opt_err != null ? opt_err : "ok"} noopt=${noopt_err != null ? noopt_err : "ok"}`)
+    return {seed: seed_val, errors: errors, src: src}
+  }
+  if (opt_err != null) {
+    // Both failed to load — consistent
+    return {seed: seed_val, errors: errors, src: src}
+  }
+
+  // Run self-checks (optimized module)
+  if (is_object(mod_opt)) {
+    keys = array(mod_opt)
+    k = 0
+    while (k < length(keys)) {
+      key = keys[k]
+      if (is_function(mod_opt[key])) {
+        ret = null
+        run_err = null
+        _run = function() {
+          ret = mod_opt[key]()
+        } disruption {
+          run_err = "disrupted"
+        }
+        _run()
+
+        if (is_text(ret)) {
+          push(errors, `self-check ${key}: ${ret}`)
+        }
+        if (run_err != null) {
+          push(errors, `self-check ${key}: unexpected disruption`)
+        }
+      }
+      k = k + 1
+    }
+  }
+
+  // Differential check on each function
+  if (is_object(mod_opt) && is_object(mod_noopt)) {
+    keys2 = array(mod_opt)
+    k2 = 0
+    while (k2 < length(keys2)) {
+      key2 = keys2[k2]
+      if (is_function(mod_opt[key2]) && is_function(mod_noopt[key2])) {
+        opt_result = null
+        noopt_result = null
+        opt_fn_err = null
+        noopt_fn_err = null
+
+        _run_opt = function() {
+          opt_result = mod_opt[key2]()
+        } disruption {
+          opt_fn_err = "disrupted"
+        }
+        _run_opt()
+
+        _run_noopt = function() {
+          noopt_result = mod_noopt[key2]()
+        } disruption {
+          noopt_fn_err = "disrupted"
+        }
+        _run_noopt()
+
+        if (opt_fn_err != noopt_fn_err) {
+          push(errors, `diff ${key2}: opt=${opt_fn_err != null ? opt_fn_err : "ok"} noopt=${noopt_fn_err != null ? noopt_fn_err : "ok"}`)
+        } else if (!values_equal(opt_result, noopt_result)) {
+          push(errors, `diff ${key2}: opt=${describe(opt_result)} noopt=${describe(noopt_result)}`)
+        }
+      }
+      k2 = k2 + 1
+    }
+  }
+
+  return {seed: seed_val, errors: errors, src: src}
+}
+
+// Main loop
+log.console(`Fuzzing: ${text(iterations)} iterations, starting seed=${text(start_seed)}`)
+var total_pass = 0
+var total_fail = 0
+var result = null
+var j = 0
+var current_seed = 0
+var fail_path = null
+
+i = 0
+while (i < iterations) {
+  current_seed = start_seed + i
+  run_err = null
+  _run_one = function() {
+    result = run_fuzz(current_seed)
+  } disruption {
+    run_err = "generator crashed"
+  }
+  _run_one()
+
+  if (run_err != null) {
+    result = {seed: current_seed, errors: [run_err], src: "// generator crashed"}
+  }
+
+  if (length(result.errors) > 0) {
+    total_fail = total_fail + 1
+    log.console(`  FAIL seed=${text(current_seed)}: ${result.errors[0]}`)
+
+    // Save failure source for reproduction
+    ensure_dir(failures_dir)
+    fail_path = failures_dir + "/seed_" + text(current_seed) + ".cm"
+    fd.slurpwrite(fail_path, stone(blob(result.src)))
+    log.console(`    saved to ${fail_path}`)
+  } else {
+    total_pass = total_pass + 1
+  }
+
+  // Progress report every 100 iterations
+  if ((i + 1) % 100 == 0) {
+    log.console(`  progress: ${text(i + 1)}/${text(iterations)} (${text(total_pass)} passed, ${text(total_fail)} failed)`)
+  }
+
+  i = i + 1
+}
+
+log.console(`----------------------------------------`)
+log.console(`Fuzz: ${text(total_pass)} passed, ${text(total_fail)} failed, ${text(iterations)} total`)
+if (total_fail > 0) {
+  log.console(`Failures saved to ${failures_dir}/`)
+}
+
+$stop()

fuzzgen.cm

@@ -0,0 +1,348 @@
+// fuzzgen.cm — generates self-checking .cm programs for fuzz testing
+// Each generated program returns a record of test functions that
+// validate their own expected results.
+
+// Newline constant — backtick strings don't interpret \n as escape
+var NL = "\n"
+
+// Simple seeded PRNG (xorshift32)
+var _seed = 1
+function seed(s) {
+  _seed = s != 0 ? s : 1
+}
+
+function rand() {
+  _seed = _seed ^ (_seed << 13)
+  _seed = _seed ^ (_seed >> 17)
+  _seed = _seed ^ (_seed << 5)
+  if (_seed < 0) _seed = -_seed
+  return _seed
+}
+
+function rand_int(lo, hi) {
+  return lo + (rand() % (hi - lo + 1))
+}
+
+function rand_float() {
+  return rand_int(-10000, 10000) / 100
+}
+
+function rand_bool() {
+  return rand() % 2 == 0
+}
+
+function pick(arr) {
+  return arr[rand() % length(arr)]
+}
+
+// Expression generators — each returns {src: "code", val: expected_value}
+// depth is decremented to prevent infinite recursion
+
+function gen_int_literal() {
+  var v = rand_int(-10000, 10000)
+  return {src: text(v), val: v}
+}
+
+function gen_float_literal() {
+  var v = rand_float()
+  return {src: text(v), val: v}
+}
+
+function gen_bool_literal() {
+  var v = rand_bool()
+  var s = "false"
+  if (v) s = "true"
+  return {src: s, val: v}
+}
+
+function gen_text_literal() {
+  var words = ["alpha", "beta", "gamma", "delta", "epsilon"]
+  var w = pick(words)
+  return {src: `"${w}"`, val: w}
+}
+
+function gen_null_literal() {
+  return {src: "null", val: null}
+}
+
+function gen_int_expr(depth) {
+  var a = null
+  var b = null
+  var op = null
+  var result = null
+
+  if (depth <= 0) return gen_int_literal()
+
+  a = gen_int_expr(depth - 1)
+  b = gen_int_expr(depth - 1)
+
+  // Avoid division by zero
+  if (b.val == 0) b = {src: "1", val: 1}
+
+  op = pick(["+", "-", "*"])
+  if (op == "+") {
+    result = a.val + b.val
+  } else if (op == "-") {
+    result = a.val - b.val
+  } else {
+    result = a.val * b.val
+  }
+
+  // Guard against overflow beyond safe integer range
+  if (result > 9007199254740991 || result < -9007199254740991) {
+    return gen_int_literal()
+  }
+
+  return {src: `(${a.src} ${op} ${b.src})`, val: result}
+}
+
+function gen_float_expr(depth) {
+  var a = null
+  var b = null
+  var op = null
+  var result = null
+
+  if (depth <= 0) return gen_float_literal()
+
+  a = gen_float_expr(depth - 1)
+  b = gen_float_expr(depth - 1)
+
+  if (b.val == 0) b = {src: "1.0", val: 1.0}
+
+  op = pick(["+", "-", "*"])
+  if (op == "+") {
+    result = a.val + b.val
+  } else if (op == "-") {
+    result = a.val - b.val
+  } else {
+    result = a.val * b.val
+  }
+
+  return {src: `(${a.src} ${op} ${b.src})`, val: result}
+}
+
+function gen_text_expr(depth) {
+  var a = null
+  var b = null
+
+  if (depth <= 0) return gen_text_literal()
+
+  a = gen_text_literal()
+  b = gen_text_literal()
+
+  return {src: `(${a.src} + ${b.src})`, val: a.val + b.val}
+}
+
+function gen_comparison_expr(depth) {
+  var a = null
+  var b = null
+  var op = null
+  var result = null
+
+  a = gen_int_expr(depth > 0 ? depth - 1 : 0)
+  b = gen_int_expr(depth > 0 ? depth - 1 : 0)
+
+  op = pick(["==", "!=", "<", ">", "<=", ">="])
+  if (op == "==") {
+    result = a.val == b.val
+  } else if (op == "!=") {
+    result = a.val != b.val
+  } else if (op == "<") {
+    result = a.val < b.val
+  } else if (op == ">") {
+    result = a.val > b.val
+  } else if (op == "<=") {
+    result = a.val <= b.val
+  } else {
+    result = a.val >= b.val
+  }
+
+  return {src: `(${a.src} ${op} ${b.src})`, val: result}
+}
+
+// Generate an if-else expression test
+function gen_if_else_test() {
+  var cond = gen_comparison_expr(1)
+  var then_val = gen_int_literal()
+  var else_val = gen_int_literal()
+  var expected = cond.val ? then_val.val : else_val.val
+
+  var body = "var result = null" + NL
+  body = body + "    if (" + cond.src + ") {" + NL
+  body = body + "      result = " + then_val.src + NL
+  body = body + "    } else {" + NL
+  body = body + "      result = " + else_val.src + NL
+  body = body + "    }" + NL
+  body = body + "    if (result != " + text(expected) + ") return \"if_else: expected " + text(expected) + " got \" + text(result)"
+
+  return body
+}
+
+// Generate a loop accumulator test
+function gen_loop_test() {
+  var count = rand_int(1, 50)
+  var step = rand_int(1, 10)
+  var expected = 0
+  var i = 0
+  while (i < count) {
+    expected = expected + step
+    i = i + 1
+  }
+
+  var body = "var acc = 0" + NL
+  body = body + "    var i = 0" + NL
+  body = body + "    while (i < " + text(count) + ") {" + NL
+  body = body + "      acc = acc + " + text(step) + NL
+  body = body + "      i = i + 1" + NL
+  body = body + "    }" + NL
+  body = body + "    if (acc != " + text(expected) + ") return \"loop: expected " + text(expected) + " got \" + text(acc)"
+
+  return body
+}
+
+// Generate a closure test
+function gen_closure_test() {
+  var init_val = rand_int(1, 100)
+  var inc = rand_int(1, 10)
+  var calls = rand_int(1, 10)
+  var expected = init_val + (inc * calls)
+
+  var body = "var counter = " + text(init_val) + NL
+  body = body + "    var inc = function() { counter = counter + " + text(inc) + " }" + NL
+  body = body + "    var i = 0" + NL
+  body = body + "    while (i < " + text(calls) + ") {" + NL
+  body = body + "      inc()" + NL
+  body = body + "      i = i + 1" + NL
+  body = body + "    }" + NL
+  body = body + "    if (counter != " + text(expected) + ") return \"closure: expected " + text(expected) + " got \" + text(counter)"
+
+  return body
+}
+
+// Generate a record property test
+function gen_record_test() {
+  var a = gen_int_literal()
+  var b = gen_int_literal()
+  var sum = a.val + b.val
+
+  var body = "var r = {a: " + a.src + ", b: " + b.src + "}" + NL
+  body = body + "    var result = r.a + r.b" + NL
+  body = body + "    if (result != " + text(sum) + ") return \"record: expected " + text(sum) + " got \" + text(result)"
+
+  return body
+}
+
+// Generate an array test
+function gen_array_test() {
+  var n = rand_int(2, 10)
+  var vals = []
+  var i = 0
+  var sum = 0
+  var v = 0
+  while (i < n) {
+    v = rand_int(-100, 100)
+    push(vals, v)
+    sum = sum + v
+    i = i + 1
+  }
+
+  var val_strs = []
+  i = 0
+  while (i < n) {
+    push(val_strs, text(vals[i]))
+    i = i + 1
+  }
+
+  var body = "var a = [" + text(val_strs, ", ") + "]" + NL
+  body = body + "    var _sum = 0" + NL
+  body = body + "    var i = 0" + NL
+  body = body + "    while (i < length(a)) {" + NL
+  body = body + "      _sum = _sum + a[i]" + NL
+  body = body + "      i = i + 1" + NL
+  body = body + "    }" + NL
+  body = body + "    if (_sum != " + text(sum) + ") return \"array_sum: expected " + text(sum) + " got \" + text(_sum)"
+
+  return body
+}
+
+// Generate a nested function / higher-order test
+function gen_higher_order_test() {
+  var mul = rand_int(2, 10)
+  var input = rand_int(1, 100)
+  var expected = input * mul
+
+  var body = "var make_mul = function(m) {" + NL
+  body = body + "      return function(x) { return x * m }" + NL
+  body = body + "    }" + NL
+  body = body + "    var fn = make_mul(" + text(mul) + ")" + NL
+  body = body + "    var result = fn(" + text(input) + ")" + NL
+  body = body + "    if (result != " + text(expected) + ") return \"higher_order: expected " + text(expected) + " got \" + text(result)"
+
+  return body
+}
+
+// Generate a disruption handling test
+function gen_disrupt_test() {
+  var body = "var caught = false" + NL
+  body = body + "    var _fn = function() { disrupt } disruption { caught = true }" + NL
+  body = body + "    _fn()" + NL
+  body = body + "    if (!caught) return \"disrupt: expected to catch disruption\""
+
+  return body
+}
+
+// Generate a text operation test
+function gen_text_op_test() {
+  var words = ["hello", "world", "foo", "bar", "baz"]
+  var w1 = pick(words)
+  var w2 = pick(words)
+  var expected = w1 + w2
+
+  var body = "var a = \"" + w1 + "\"" + NL
+  body = body + "    var b = \"" + w2 + "\"" + NL
+  body = body + "    var c = a + b" + NL
+  body = body + "    if (c != \"" + expected + "\") return \"text_op: expected " + expected + " got \" + c"
+
+  return body
+}
+
+// All generators
+var generators = [
+  gen_if_else_test,
+  gen_loop_test,
+  gen_closure_test,
+  gen_record_test,
+  gen_array_test,
+  gen_higher_order_test,
+  gen_disrupt_test,
+  gen_text_op_test
+]
+
+// Generate a complete self-checking .cm program
+function generate(s) {
+  seed(s)
+
+  var num_tests = rand_int(5, 15)
+  var src = "// Auto-generated fuzz test (seed=" + text(s) + ")\nreturn {\n"
+  var i = 0
+  var gen = null
+  var body = null
+
+  while (i < num_tests) {
+    gen = pick(generators)
+    body = gen()
+    if (i > 0) src = src + ",\n"
+    src = src + "  fuzz_" + text(i) + ": function() {\n"
+    src = src + "    " + body + "\n"
+    src = src + "  }"
+    i = i + 1
+  }
+
+  src = src + "\n}\n"
+  return src
+}
+
+return {
+  generate: generate,
+  seed: seed
+}

internal/bootstrap.cm

@@ -1,5 +1,5 @@
 // Hidden vars come from env:
-//   CLI mode (cell_init):       os, args, core_path, shop_path, emit_qbe, dump_mach
+//   CLI mode (cell_init):       os, args, core_path, shop_path
 //   Actor spawn (script_startup): os, json, nota, wota, actorsym, init, core_path, shop_path
 // args[0] = script name, args[1..] = user args
 var load_internal = os.load_internal
@@ -24,15 +24,21 @@ function use_basic(path) {
   return result
 }
 
-// Load a module from .mach bytecode (bootstrap modules have no source fallback)
+// Load a module from .mach/.mcode bytecode (bootstrap modules have no source fallback)
 function boot_load(name, env) {
-  var mach_path = core_path + '/' + name + ".mach"
+  var mach_path = core_path + '/' + name + ".cm.mach"
+  var mcode_path = core_path + '/' + name + ".cm.mcode"
   var data = null
+  var mcode_json = null
   if (fd.is_file(mach_path)) {
     data = fd.slurp(mach_path)
     return mach_load(data, env)
   }
-  print("error: missing bootstrap bytecode: " + mach_path + "\n")
+  if (fd.is_file(mcode_path)) {
+    mcode_json = text(fd.slurp(mcode_path))
+    return mach_eval_mcode(name, mcode_json, env)
+  }
+  print("error: missing bootstrap bytecode: " + name + "\n")
   disrupt
 }
 
@@ -48,42 +54,53 @@ use_cache['fold'] = fold_mod
 var mcode_mod = boot_load("mcode", boot_env)
 use_cache['mcode'] = mcode_mod
 var streamline_mod = null
-var qbe_emit_mod = null
 
-// Warn if any .cm source is newer than its .mach bytecode
+// Warn if any .cm source is newer than its compiled bytecode
 function check_mach_stale() {
-  var pairs = [
-    ["tokenize.cm", "tokenize.mach"],
-    ["parse.cm", "parse.mach"],
-    ["fold.cm", "fold.mach"],
-    ["mcode.cm", "mcode.mach"],
-    ["streamline.cm", "streamline.mach"],
-    ["qbe.cm", "qbe.mach"],
-    ["qbe_emit.cm", "qbe_emit.mach"],
-    ["internal/bootstrap.cm", "internal/bootstrap.mach"],
-    ["internal/engine.cm", "internal/engine.mach"]
+  var sources = [
+    "tokenize.cm",
+    "parse.cm",
+    "fold.cm",
+    "mcode.cm",
+    "streamline.cm",
+    "qbe.cm",
+    "qbe_emit.cm",
+    "internal/bootstrap.cm",
+    "internal/engine.cm"
   ]
   var stale = []
   var _i = 0
   var cm_path = null
   var mach_path = null
+  var mcode_path = null
   var cm_stat = null
-  var mach_stat = null
-  while (_i < length(pairs)) {
-    cm_path = core_path + '/' + pairs[_i][0]
-    mach_path = core_path + '/' + pairs[_i][1]
-    if (fd.is_file(cm_path) && fd.is_file(mach_path)) {
+  var compiled_stat = null
+  var best_mtime = null
+  while (_i < length(sources)) {
+    cm_path = core_path + '/' + sources[_i]
+    mach_path = cm_path + '.mach'
+    mcode_path = cm_path + '.mcode'
+    best_mtime = null
+    if (fd.is_file(mach_path)) {
+      best_mtime = fd.stat(mach_path).mtime
+    }
+    if (fd.is_file(mcode_path)) {
+      compiled_stat = fd.stat(mcode_path)
+      if (best_mtime == null || compiled_stat.mtime > best_mtime) {
+        best_mtime = compiled_stat.mtime
+      }
+    }
+    if (best_mtime != null && fd.is_file(cm_path)) {
       cm_stat = fd.stat(cm_path)
-      mach_stat = fd.stat(mach_path)
-      if (cm_stat.mtime > mach_stat.mtime) {
-        push(stale, pairs[_i][0])
+      if (cm_stat.mtime > best_mtime) {
+        push(stale, sources[_i])
       }
     }
     _i = _i + 1
   }
   if (length(stale) > 0) {
     print("warning: bytecode is stale for: " + text(stale, ", ") + "\n")
-    print("run 'make regen' or './cell --core . regen.cm' to update\n")
+    print("run 'make regen' to update\n")
   }
 }
 check_mach_stale()
@@ -123,10 +140,12 @@ function analyze(src, filename) {
   return ast
 }
 
-// Load a module from .mach bytecode, falling back to source compilation
+// Load a module from .mach/.mcode bytecode, falling back to source compilation
 function load_module(name, env) {
-  var mach_path = core_path + '/' + name + ".mach"
+  var mach_path = core_path + '/' + name + ".cm.mach"
+  var mcode_path = core_path + '/' + name + ".cm.mcode"
   var data = null
+  var mcode_json = null
   var src_path = null
   var src = null
   var ast = null
@@ -136,6 +155,10 @@ function load_module(name, env) {
     data = fd.slurp(mach_path)
     return mach_load(data, env)
   }
+  if (fd.is_file(mcode_path)) {
+    mcode_json = text(fd.slurp(mcode_path))
+    return mach_eval_mcode(name, mcode_json, env)
+  }
   src_path = core_path + '/' + name + ".cm"
   src = text(fd.slurp(src_path))
   ast = analyze(src, src_path)
@@ -145,37 +168,43 @@ function load_module(name, env) {
 }
 
 // Load optimization pipeline modules (needs analyze to be defined)
-var qbe_macros = null
 streamline_mod = load_module("streamline", boot_env)
 use_cache['streamline'] = streamline_mod
-if (emit_qbe) {
-  qbe_macros = load_module("qbe", boot_env)
-  qbe_emit_mod = load_module("qbe_emit", boot_env)
-  use_cache['qbe'] = qbe_macros
-  use_cache['qbe_emit'] = qbe_emit_mod
-}
+
+// Lazy-loaded verify_ir module (loaded on first use via use_fn)
+var _verify_ir_mod = null
 
 // Run AST through mcode pipeline → register VM
 function run_ast(name, ast, env) {
   var compiled = mcode_mod(ast)
-  var optimized = streamline_mod(compiled)
-  var qbe_il = null
-  if (emit_qbe) {
-    qbe_il = qbe_emit_mod(optimized, qbe_macros)
-    print(qbe_il)
-    return null
+  if (os._verify_ir) {
+    if (_verify_ir_mod == null) {
+      _verify_ir_mod = use_fn('verify_ir')
+    }
+    compiled._verify = true
+    compiled._verify_mod = _verify_ir_mod
   }
-  if (dump_mach) {
-    mach_dump_mcode(name, json.encode(optimized), env)
-    return null
+  var optimized = streamline_mod(compiled)
+  // Clean up verify properties before JSON encoding
+  if (optimized._verify) {
+    delete optimized._verify
+    delete optimized._verify_mod
   }
   return mach_eval_mcode(name, json.encode(optimized), env)
 }
 
+// Run AST through mcode pipeline WITHOUT optimization → register VM
+function run_ast_noopt(name, ast, env) {
+  var compiled = mcode_mod(ast)
+  return mach_eval_mcode(name, json.encode(compiled), env)
+}
+
 // use() with ƿit pipeline for .cm modules
 function use_fn(path) {
   var file_path = null
   var mach_path = null
+  var mcode_path = null
+  var mcode_json = null
   var data = null
   var script = null
   var ast = null
@@ -183,10 +212,10 @@ function use_fn(path) {
   if (use_cache[path])
     return use_cache[path]
 
-  // Try .mach bytecode first (CWD then core_path)
-  mach_path = path + '.mach'
+  // Try .cm.mach bytecode first (CWD then core_path)
+  mach_path = path + '.cm.mach'
   if (!fd.is_file(mach_path))
-    mach_path = core_path + '/' + path + '.mach'
+    mach_path = core_path + '/' + path + '.cm.mach'
   if (fd.is_file(mach_path)) {
     data = fd.slurp(mach_path)
     result = mach_load(data, {use: use_fn})
@@ -194,6 +223,17 @@ function use_fn(path) {
     return result
   }
 
+  // Try .cm.mcode JSON IR (CWD then core_path)
+  mcode_path = path + '.cm.mcode'
+  if (!fd.is_file(mcode_path))
+    mcode_path = core_path + '/' + path + '.cm.mcode'
+  if (fd.is_file(mcode_path)) {
+    mcode_json = text(fd.slurp(mcode_path))
+    result = mach_eval_mcode(path, mcode_json, {use: use_fn})
+    use_cache[path] = result
+    return result
+  }
+
   // Try .cm source (CWD then core_path)
   file_path = path + '.cm'
   if (!fd.is_file(file_path))
@@ -215,14 +255,20 @@ function use_fn(path) {
 
 // Helper to load engine.cm and run it with given env
 function load_engine(env) {
-  var engine_path = core_path + '/internal/engine.mach'
+  var engine_path = core_path + '/internal/engine.cm.mach'
+  var mcode_path = core_path + '/internal/engine.cm.mcode'
   var data = null
+  var mcode_json = null
   var engine_src = null
   var engine_ast = null
   if (fd.is_file(engine_path)) {
     data = fd.slurp(engine_path)
     return mach_load(data, env)
   }
+  if (fd.is_file(mcode_path)) {
+    mcode_json = text(fd.slurp(mcode_path))
+    return mach_eval_mcode('engine', mcode_json, env)
+  }
   engine_path = core_path + '/internal/engine.cm'
   engine_src = text(fd.slurp(engine_path))
   engine_ast = analyze(engine_src, engine_path)
@@ -234,50 +280,31 @@ function load_engine(env) {
 var program = null
 var user_args = []
 var _j = 0
-var script_file = null
-var script = null
-var ast = null
 
 if (args != null) {
-  // CLI mode — parse args
+  // CLI mode — always run as actor program (.ce)
   program = args[0]
+  if (!program) {
+    print("error: no program specified\n")
+    disrupt
+  }
   _j = 1
   while (_j < length(args)) {
     push(user_args, args[_j])
     _j = _j + 1
   }
 
-  // Resolve script file: try .cm then .ce in CWD then core_path
-  script_file = program
-  if (!ends_with(script_file, '.ce') && !ends_with(script_file, '.cm'))
-    script_file = program + '.cm'
-
-  if (!fd.is_file(script_file))
-    script_file = core_path + '/' + program + '.cm'
-  if (!fd.is_file(script_file))
-    script_file = program + '.ce'
-  if (!fd.is_file(script_file))
-    script_file = core_path + '/' + program + '.ce'
-
-  if (ends_with(script_file, '.ce')) {
-    // Actor script — delegate to engine
-    load_engine({
-      os: os, actorsym: actorsym,
-      init: {program: program, arg: user_args},
-      core_path: core_path, shop_path: shop_path, json: json,
-      analyze: analyze, run_ast_fn: run_ast
-    })
-  } else {
-    // Module script — run directly
-    script = text(fd.slurp(script_file))
-    ast = analyze(script, script_file)
-    run_ast(program, ast, {use: use_fn, args: user_args, json: json})
-  }
+  load_engine({
+    os: os, actorsym: actorsym,
+    init: {program: program, arg: user_args},
+    core_path: core_path, shop_path: shop_path, json: json,
+    analyze: analyze, run_ast_fn: run_ast, run_ast_noopt_fn: run_ast_noopt
+  })
 } else {
   // Actor spawn mode — load engine.cm with full actor env
   load_engine({
     os: os, actorsym: actorsym, init: init,
     core_path: core_path, shop_path: shop_path, json: json, nota: nota, wota: wota,
-    analyze: analyze, run_ast_fn: run_ast
+    analyze: analyze, run_ast_fn: run_ast, run_ast_noopt_fn: run_ast_noopt
   })
 }

internal/engine.cm

@@ -1,4 +1,4 @@
-// Hidden vars (os, actorsym, init, core_path, shop_path, analyze, run_ast_fn, json) come from env
+// Hidden vars (os, actorsym, init, core_path, shop_path, analyze, run_ast_fn, run_ast_noopt_fn, json) come from env
 // In actor spawn mode, also: nota, wota
 var ACTORDATA = actorsym
 var SYSYM = '__SYSTEM__'
@@ -76,14 +76,22 @@ function use_core(path) {
   arrfor(array(core_extras), function(k) { env[k] = core_extras[k] })
   if (sym) env.native = sym
 
-  // Check for pre-compiled .mach file first
-  var mach_path = core_path + '/' + path + '.mach'
+  // Check for pre-compiled .cm.mach file first
+  var mach_path = core_path + '/' + path + '.cm.mach'
   if (fd.is_file(mach_path)) {
     result = mach_load(fd.slurp(mach_path), env)
     use_cache[cache_key] = result
     return result
   }
 
+  // Check for .cm.mcode JSON IR
+  var mcode_path = core_path + '/' + path + '.cm.mcode'
+  if (fd.is_file(mcode_path)) {
+    result = mach_eval_mcode('core:' + path, text(fd.slurp(mcode_path)), env)
+    use_cache[cache_key] = result
+    return result
+  }
+
   // Fall back to source .cm file — compile at runtime
   var file_path = core_path + '/' + path + MOD_EXT
   if (fd.is_file(file_path)) {
@@ -206,6 +214,7 @@ os.global_shop_path = shop_path
 os.$_ = $_
 os.analyze = analyze
 os.run_ast_fn = run_ast_fn
+os.run_ast_noopt_fn = run_ast_noopt_fn
 os.json = json
 use_cache['core/json'] = json
 
@@ -728,7 +737,7 @@ function report_to_overling(msg)
 var program = _cell.args.program
 
 if (!program) {
-  log.error('No program specified. Usage: cell <program.ce> [args...]')
+  log.error('No program specified. Usage: cell <program> [args...]')
   os.exit(1)
 }
 
@@ -818,6 +827,10 @@ function enet_check()
 actor_mod.setname(_cell.args.program)
 
 var prog = _cell.args.program
+if (ends_with(prog, '.cm')) {
+  os.print(`error: ${prog} is a module (.cm), not a program (.ce)\n`)
+  os.exit(1)
+}
 if (ends_with(prog, '.ce')) prog = text(prog, 0, -3)
 
 var package = use_core('package')
@@ -864,6 +877,8 @@ $_.clock(_ => {
   env.use = function(path) {
     var ck = 'core/' + path
     if (use_cache[ck]) return use_cache[ck]
+    var core_mod = use_core(path)
+    if (core_mod) return core_mod
     return shop.use(path, pkg)
   }
   env.args = _cell.args.arg

internal/shop.cm

@@ -438,6 +438,7 @@ function resolve_mod_fn(path, pkg) {
   var compiled = null
   var mach_path = null
   var mach_blob = null
+  var mcode_path = null
   var ir = null
   var optimized = null
 
@@ -446,7 +447,7 @@ function resolve_mod_fn(path, pkg) {
     return cached
   }
 
-  // Check for pre-compiled .mach file alongside .cm source
+  // Check for pre-compiled .mach or .mcode file alongside .cm source
   if (ends_with(path, '.cm')) {
     mach_path = text(path, 0, length(path) - 3) + '.mach'
     if (fd.is_file(mach_path)) {
@@ -454,6 +455,12 @@ function resolve_mod_fn(path, pkg) {
       put_into_cache(stone(blob(content)), mach_blob)
       return mach_blob
     }
+    mcode_path = path + '.mcode'
+    if (fd.is_file(mcode_path)) {
+      compiled = mach_compile_mcode_bin(path, text(fd.slurp(mcode_path)))
+      put_into_cache(stone(blob(content)), compiled)
+      return compiled
+    }
   }
 
   // Compile via full pipeline: analyze → mcode → streamline → serialize

ir_report.ce

@@ -0,0 +1,200 @@
+// ir_report.ce — optimizer flight recorder CLI
+//
+// Usage: ./cell --core . ir_report.ce [options] <file.cm|file.ce>
+//
+// Options:
+//   --summary       Per-pass JSON summaries (default)
+//   --events        Include rewrite events
+//   --types         Include type deltas
+//   --ir-before=PASS  Print canonical IR before PASS
+//   --ir-after=PASS   Print canonical IR after PASS
+//   --ir-all        Print canonical IR before/after every pass
+//   --full          Everything (summary + events + types + ir-all)
+
+var fd = use("fd")
+var json = use("json")
+var tokenize = use("tokenize")
+var parse = use("parse")
+var fold = use("fold")
+var mcode = use("mcode")
+var streamline = use("streamline")
+var ir_stats = use("ir_stats")
+
+// --- Parse arguments ---
+
+var filename = null
+var opt_events = false
+var opt_types = false
+var opt_ir_before = null
+var opt_ir_after = null
+var opt_ir_all = false
+var i = 0
+var arg = null
+var p = null
+var e = null
+var td = null
+
+while (i < length(args)) {
+  arg = args[i]
+  if (arg == "--events") {
+    opt_events = true
+  } else if (arg == "--types") {
+    opt_types = true
+  } else if (arg == "--ir-all") {
+    opt_ir_all = true
+  } else if (arg == "--full") {
+    opt_events = true
+    opt_types = true
+    opt_ir_all = true
+  } else if (arg == "--summary") {
+    // default, no-op
+  } else if (starts_with(arg, "--ir-before=")) {
+    opt_ir_before = text(arg, 12)
+  } else if (starts_with(arg, "--ir-after=")) {
+    opt_ir_after = text(arg, 11)
+  } else if (!starts_with(arg, "--")) {
+    filename = arg
+  } else {
+    print(`unknown option: ${arg}\n`)
+    print("usage: cell --core . ir_report.ce [options] <file>\n")
+    $stop()
+  }
+  i = i + 1
+}
+
+if (filename == null) {
+  print("usage: cell --core . ir_report.ce [options] <file.cm|file.ce>\n")
+  print("  --summary        per-pass JSON summaries (default)\n")
+  print("  --events         include rewrite events\n")
+  print("  --types          include type deltas\n")
+  print("  --ir-before=PASS print canonical IR before PASS\n")
+  print("  --ir-after=PASS  print canonical IR after PASS\n")
+  print("  --ir-all         print canonical IR before/after every pass\n")
+  print("  --full           everything\n")
+  $stop()
+}
+
+// --- Compile ---
+
+var src = text(fd.slurp(filename))
+var tok = tokenize(src, filename)
+var ast = parse(tok.tokens, src, filename, tokenize)
+var folded = fold(ast)
+var compiled = mcode(folded)
+
+// --- Determine which passes need IR snapshots ---
+
+var need_snapshots = opt_ir_all || opt_ir_before != null || opt_ir_after != null
+
+// Deep copy for before snapshot if we need IR printing
+var before_ir = null
+if (need_snapshots) {
+  before_ir = json.decode(json.encode(compiled))
+}
+
+// --- Set up log ---
+
+var log = {
+  passes: [],
+  events: null,
+  type_deltas: null
+}
+
+if (opt_events) {
+  log.events = []
+}
+if (opt_types) {
+  log.type_deltas = []
+}
+
+// --- Run optimizer ---
+
+var optimized = streamline(compiled, log)
+
+// --- Output ---
+
+var emit = function(obj) {
+  print(json.encode(obj))
+  print("\n")
+}
+
+// Pass summaries (always)
+i = 0
+while (i < length(log.passes)) {
+  p = log.passes[i]
+  p.type = "pass"
+  emit(p)
+  i = i + 1
+}
+
+// Rewrite events
+if (opt_events && log.events != null) {
+  i = 0
+  while (i < length(log.events)) {
+    e = log.events[i]
+    e.type = "event"
+    emit(e)
+    i = i + 1
+  }
+}
+
+// Type deltas
+if (opt_types && log.type_deltas != null) {
+  i = 0
+  while (i < length(log.type_deltas)) {
+    td = log.type_deltas[i]
+    td.type = "types"
+    emit(td)
+    i = i + 1
+  }
+}
+
+// --- Canonical IR printing ---
+
+var print_ir = function(ir_obj, when_label, pass_name) {
+  var fname = null
+  var fi = 0
+  var func = null
+  if (ir_obj.main != null) {
+    fname = ir_obj.name != null ? ir_obj.name : "<main>"
+    emit({
+      type: "ir",
+      when: when_label,
+      pass: pass_name,
+      fn: fname,
+      text: ir_stats.canonical_ir(ir_obj.main, fname, {show_nops: true})
+    })
+  }
+  if (ir_obj.functions != null) {
+    fi = 0
+    while (fi < length(ir_obj.functions)) {
+      func = ir_obj.functions[fi]
+      fname = func.name != null ? func.name : `<func_${text(fi)}>`
+      emit({
+        type: "ir",
+        when: when_label,
+        pass: pass_name,
+        fn: fname,
+        text: ir_stats.canonical_ir(func, fname, {show_nops: true})
+      })
+      fi = fi + 1
+    }
+  }
+  return null
+}
+
+if (need_snapshots) {
+  if (opt_ir_all) {
+    print_ir(before_ir, "before", "all")
+    print_ir(optimized, "after", "all")
+  } else {
+    if (opt_ir_before != null) {
+      print_ir(before_ir, "before", opt_ir_before)
+    }
+    if (opt_ir_after != null) {
+      print_ir(optimized, "after", opt_ir_after)
+    }
+  }
+}
+
+$stop()

ir_stats.cm

@@ -0,0 +1,357 @@
+// ir_stats.cm — IR statistics, fingerprinting, and canonical printing
+//
+// Usage: var ir_stats = use("ir_stats")
+//   ir_stats.detailed_stats(func)
+//   ir_stats.ir_fingerprint(func)
+//   ir_stats.canonical_ir(func, name, opts)
+//   ir_stats.type_snapshot(slot_types)
+//   ir_stats.type_delta(before_types, after_types)
+
+var json = use("json")
+
+// --- Category maps ---
+
+var load_ops = {
+  load_field: true, load_index: true, load_dynamic: true,
+  get: true
+}
+var store_ops = {
+  store_field: true, store_index: true, store_dynamic: true,
+  set_var: true, put: true, push: true
+}
+var branch_ops = {
+  jump: true, jump_true: true, jump_false: true, jump_not_null: true
+}
+var call_ops = {
+  invoke: true, goinvoke: true
+}
+var guard_ops = {
+  is_int: true, is_text: true, is_num: true, is_bool: true,
+  is_null: true, is_array: true, is_func: true, is_record: true,
+  is_stone: true
+}
+var arith_ops = {
+  add_int: true, sub_int: true, mul_int: true, div_int: true, mod_int: true,
+  add_float: true, sub_float: true, mul_float: true, div_float: true, mod_float: true,
+  concat: true, neg_int: true, neg_float: true,
+  bitnot: true, bitand: true, bitor: true, bitxor: true,
+  shl: true, shr: true, ushr: true
+}
+var move_ops = {
+  move: true
+}
+var const_ops = {
+  int: true, true: true, false: true, null: true
+}
+
+var nop_reasons = {
+  tc: "tc",
+  bl: "bl",
+  mv: "mv",
+  dj: "dj",
+  ur: "ur"
+}
+
+var category_tag = function(op) {
+  if (guard_ops[op] == true) { return "guard" }
+  if (branch_ops[op] == true) { return "branch" }
+  if (load_ops[op] == true) { return "load" }
+  if (store_ops[op] == true) { return "store" }
+  if (call_ops[op] == true) { return "call" }
+  if (arith_ops[op] == true) { return "arith" }
+  if (move_ops[op] == true) { return "move" }
+  if (const_ops[op] == true) { return "const" }
+  return null
+}
+
+// --- detailed_stats ---
+
+var detailed_stats = function(func) {
+  var instructions = func.instructions
+  var stats = {
+    instr: 0, nop: 0,
+    load: 0, store: 0, branch: 0, call: 0,
+    guard: 0, arith: 0, move: 0, const: 0,
+    label: 0, other: 0
+  }
+  var i = 0
+  var instr = null
+  var op = null
+  var num = 0
+
+  if (instructions == null) {
+    return stats
+  }
+
+  num = length(instructions)
+  while (i < num) {
+    instr = instructions[i]
+    if (is_text(instr)) {
+      if (starts_with(instr, "_nop_")) {
+        stats.nop = stats.nop + 1
+        stats.instr = stats.instr + 1
+      } else {
+        stats.label = stats.label + 1
+      }
+    } else if (is_array(instr)) {
+      stats.instr = stats.instr + 1
+      op = instr[0]
+      if (op == "access" && !is_number(instr[2]) && !is_logical(instr[2])) {
+        stats.load = stats.load + 1
+      } else if (op == "access") {
+        stats.const = stats.const + 1
+      } else if (load_ops[op] == true) {
+        stats.load = stats.load + 1
+      } else if (store_ops[op] == true) {
+        stats.store = stats.store + 1
+      } else if (branch_ops[op] == true) {
+        stats.branch = stats.branch + 1
+      } else if (call_ops[op] == true) {
+        stats.call = stats.call + 1
+      } else if (guard_ops[op] == true) {
+        stats.guard = stats.guard + 1
+      } else if (arith_ops[op] == true) {
+        stats.arith = stats.arith + 1
+      } else if (move_ops[op] == true) {
+        stats.move = stats.move + 1
+      } else if (const_ops[op] == true) {
+        stats.const = stats.const + 1
+      } else {
+        stats.other = stats.other + 1
+      }
+    }
+    i = i + 1
+  }
+  return stats
+}
+
+// --- ir_fingerprint ---
+// djb2 hash computed over the JSON-encoded instructions
+
+var djb2 = function(s) {
+  var chars = array(s)
+  var hash = 5381
+  var i = 0
+  var num = length(chars)
+  while (i < num) {
+    hash = ((hash * 33) + number(chars[i])) % 4294967296
+    i = i + 1
+  }
+  return text(hash, 16)
+}
+
+var ir_fingerprint = function(func) {
+  return djb2(json.encode(func.instructions))
+}
+
+// --- canonical_ir ---
+
+var pad_right = function(s, w) {
+  var r = s
+  while (length(r) < w) {
+    r = r + " "
+  }
+  return r
+}
+
+var nop_reason = function(s) {
+  // extract reason from _nop_XX_NNN
+  var parts = array(s, "_")
+  // parts: ["", "nop", "XX", "NNN"]
+  if (length(parts) >= 3) {
+    return parts[2]
+  }
+  return "?"
+}
+
+var fmt_operand = function(v) {
+  if (is_null(v)) {
+    return "null"
+  }
+  if (is_number(v)) {
+    return text(v)
+  }
+  if (is_text(v)) {
+    return `"${v}"`
+  }
+  if (is_logical(v)) {
+    if (v) { return "true" }
+    return "false"
+  }
+  return text(v)
+}
+
+var canonical_ir = function(func, name, opts) {
+  var instructions = func.instructions
+  var nr_args = func.nr_args != null ? func.nr_args : 0
+  var nr_slots = func.nr_slots != null ? func.nr_slots : 0
+  var show_nops = false
+  var show_types = false
+  var slot_types = null
+  var lines = []
+  var i = 0
+  var instr = null
+  var op = null
+  var n = 0
+  var parts = null
+  var j = 0
+  var idx_str = null
+  var op_str = null
+  var operands = null
+  var suffix = null
+  var tag = null
+  var typ = null
+  var reason = null
+  var num = 0
+
+  if (opts != null) {
+    if (opts.show_nops == true) { show_nops = true }
+    if (opts.show_types == true) { show_types = true }
+    if (opts.slot_types != null) { slot_types = opts.slot_types }
+  }
+
+  lines[] = `fn ${name != null ? name : "<anon>"} (args=${text(nr_args)}, slots=${text(nr_slots)})`
+
+  if (instructions == null) {
+    return text(lines, "\n")
+  }
+
+  num = length(instructions)
+  while (i < num) {
+    instr = instructions[i]
+
+    if (is_text(instr)) {
+      if (starts_with(instr, "_nop_")) {
+        if (show_nops) {
+          reason = nop_reason(instr)
+          idx_str = pad_right(`@${text(i)}`, 6)
+          lines[] = `  ${idx_str}--- nop (${reason}) ---`
+        }
+      } else {
+        lines[] = `      ${instr}:`
+      }
+      i = i + 1
+      continue
+    }
+
+    if (!is_array(instr)) {
+      i = i + 1
+      continue
+    }
+
+    op = instr[0]
+    n = length(instr)
+    parts = []
+    j = 1
+    while (j < n - 2) {
+      if (is_number(instr[j]) && op != "int" && !(op == "access" && j == 2)) {
+        parts[] = `s${text(instr[j])}`
+      } else {
+        parts[] = fmt_operand(instr[j])
+      }
+      j = j + 1
+    }
+    operands = text(parts, ", ")
+
+    idx_str = pad_right(`@${text(i)}`, 6)
+    op_str = pad_right(op, 16)
+    suffix = ""
+
+    tag = category_tag(op)
+
+    if (show_types && slot_types != null) {
+      // show type for dest slot if known
+      if (is_number(instr[1])) {
+        typ = slot_types[text(instr[1])]
+        if (typ != null) {
+          suffix = `; -> ${typ}`
+        }
+      }
+      if (tag != null) {
+        suffix = suffix + `  [${tag}]`
+      }
+    } else if (tag != null) {
+      suffix = suffix + `; [${tag}]`
+    }
+
+    if (length(suffix) > 0) {
+      lines[] = `  ${idx_str}${op_str}${operands} ${suffix}`
+    } else {
+      lines[] = `  ${idx_str}${op_str}${operands}`
+    }
+
+    i = i + 1
+  }
+
+  return text(lines, "\n")
+}
+
+// --- type_snapshot ---
+
+var type_snapshot = function(slot_types) {
+  if (slot_types == null) {
+    return {}
+  }
+  return stone(record(slot_types))
+}
+
+// --- type_delta ---
+
+var type_delta = function(before_types, after_types) {
+  var result = {
+    added: {},
+    removed: {},
+    strengthened: {},
+    weakened: {}
+  }
+  var bt = before_types != null ? before_types : {}
+  var at = after_types != null ? after_types : {}
+  var keys = null
+  var i = 0
+  var k = null
+  var bv = null
+  var av = null
+
+  // check after for added/changed
+  keys = array(at)
+  i = 0
+  while (i < length(keys)) {
+    k = keys[i]
+    av = at[k]
+    bv = bt[k]
+    if (bv == null) {
+      result.added[k] = av
+    } else if (bv != av) {
+      if (bv == "unknown" || (bv == "num" && (av == "int" || av == "float"))) {
+        result.strengthened[k] = {from: bv, to: av}
+      } else if (av == "unknown" || (av == "num" && (bv == "int" || bv == "float"))) {
+        result.weakened[k] = {from: bv, to: av}
+      } else {
+        result.strengthened[k] = {from: bv, to: av}
+      }
+    }
+    i = i + 1
+  }
+
+  // check before for removed
+  keys = array(bt)
+  i = 0
+  while (i < length(keys)) {
+    k = keys[i]
+    if (at[k] == null) {
+      result.removed[k] = bt[k]
+    }
+    i = i + 1
+  }
+
+  return result
+}
+
+return {
+  detailed_stats: detailed_stats,
+  ir_fingerprint: ir_fingerprint,
+  canonical_ir: canonical_ir,
+  type_snapshot: type_snapshot,
+  type_delta: type_delta,
+  category_tag: category_tag
+}

mcode.cm

@@ -52,6 +52,7 @@ var mcode = function(ast) {
   var s_cur_line = 0
   var s_cur_col = 0
   var s_filename = null
+  var s_has_disruption = false
 
   // Shared closure vars for binop helpers (avoids >4 param functions)
   var _bp_dest = 0
@@ -78,7 +79,8 @@ var mcode = function(ast) {
       function_nr: s_function_nr,
       intrinsic_cache: s_intrinsic_cache,
       cur_line: s_cur_line,
-      cur_col: s_cur_col
+      cur_col: s_cur_col,
+      has_disruption: s_has_disruption
     }
   }
 
@@ -99,6 +101,7 @@ var mcode = function(ast) {
     s_intrinsic_cache = saved.intrinsic_cache
     s_cur_line = saved.cur_line
     s_cur_col = saved.cur_col
+    s_has_disruption = saved.has_disruption
   }
 
   // Slot allocation
@@ -270,157 +273,19 @@ var mcode = function(ast) {
     return node.kind == "null"
   }
 
-  // emit_add_decomposed: int path -> text path -> float path -> disrupt
+  // emit_add_decomposed: emit generic add (VM dispatches int/float/text)
   // reads _bp_dest, _bp_left, _bp_right, _bp_ln, _bp_rn from closure
   var emit_add_decomposed = function() {
-    var dest = _bp_dest
-    var left = _bp_left
-    var right = _bp_right
-    var t0 = 0
-    var t1 = 0
-    var left_is_int = is_known_int(_bp_ln)
-    var left_is_text = is_known_text(_bp_ln)
-    var left_is_num = is_known_number(_bp_ln)
-    var right_is_int = is_known_int(_bp_rn)
-    var right_is_text = is_known_text(_bp_rn)
-    var right_is_num = is_known_number(_bp_rn)
-    var not_int = null
-    var not_text = null
-    var done = null
-    var err = null
-
-    // Both sides known int
-    if (left_is_int && right_is_int) {
-      emit_3("add_int", dest, left, right)
+    // Known text+text → concat directly (skip numeric check in VM)
+    if (is_known_text(_bp_ln) && is_known_text(_bp_rn)) {
+      emit_3("concat", _bp_dest, _bp_left, _bp_right)
       return null
     }
-    // Both sides known text
-    if (left_is_text && right_is_text) {
-      emit_3("concat", dest, left, right)
-      return null
-    }
-    // Both sides known number (but not both int)
-    if (left_is_num && right_is_num) {
-      if (left_is_int && right_is_int) {
-        emit_3("add_int", dest, left, right)
-      } else {
-        emit_3("add_float", dest, left, right)
-      }
-      return null
-    }
-
-    not_int = gen_label("add_ni")
-    not_text = gen_label("add_nt")
-    done = gen_label("add_done")
-    err = gen_label("add_err")
-
-    // Int path
-    t0 = alloc_slot()
-    if (!left_is_int) {
-      emit_2("is_int", t0, left)
-      emit_jump_cond("jump_false", t0, not_int)
-    }
-    t1 = alloc_slot()
-    if (!right_is_int) {
-      emit_2("is_int", t1, right)
-      emit_jump_cond("jump_false", t1, not_int)
-    }
-    emit_3("add_int", dest, left, right)
-    emit_jump(done)
-
-    // Text path
-    emit_label(not_int)
-    if (!left_is_text) {
-      emit_2("is_text", t0, left)
-      emit_jump_cond("jump_false", t0, not_text)
-    }
-    if (!right_is_text) {
-      emit_2("is_text", t1, right)
-      emit_jump_cond("jump_false", t1, not_text)
-    }
-    emit_3("concat", dest, left, right)
-    emit_jump(done)
-
-    // Float path
-    emit_label(not_text)
-    if (!left_is_num) {
-      emit_2("is_num", t0, left)
-      emit_jump_cond("jump_false", t0, err)
-    }
-    if (!right_is_num) {
-      emit_2("is_num", t1, right)
-      emit_jump_cond("jump_false", t1, err)
-    }
-    emit_3("add_float", dest, left, right)
-    emit_jump(done)
-
-    emit_label(err)
-    emit_0("disrupt")
-    emit_label(done)
+    emit_3("add", _bp_dest, _bp_left, _bp_right)
     return null
   }
 
-  // emit_numeric_binop: int path -> float path -> disrupt
-  // reads _bp_dest, _bp_left, _bp_right, _bp_ln, _bp_rn from closure
-  var emit_numeric_binop = function(int_op, float_op) {
-    var dest = _bp_dest
-    var left = _bp_left
-    var right = _bp_right
-    var t0 = 0
-    var t1 = 0
-    var left_is_int = is_known_int(_bp_ln)
-    var left_is_num = is_known_number(_bp_ln)
-    var right_is_int = is_known_int(_bp_rn)
-    var right_is_num = is_known_number(_bp_rn)
-    var not_int = null
-    var done = null
-    var err = null
-
-    // Both sides known int
-    if (left_is_int && right_is_int) {
-      emit_3(int_op, dest, left, right)
-      return null
-    }
-    // Both sides known number (but not both int)
-    if (left_is_num && right_is_num) {
-      emit_3(float_op, dest, left, right)
-      return null
-    }
-
-    not_int = gen_label("num_ni")
-    done = gen_label("num_done")
-    err = gen_label("num_err")
-
-    t0 = alloc_slot()
-    if (!left_is_int) {
-      emit_2("is_int", t0, left)
-      emit_jump_cond("jump_false", t0, not_int)
-    }
-    t1 = alloc_slot()
-    if (!right_is_int) {
-      emit_2("is_int", t1, right)
-      emit_jump_cond("jump_false", t1, not_int)
-    }
-    emit_3(int_op, dest, left, right)
-    emit_jump(done)
-
-    emit_label(not_int)
-    if (!left_is_num) {
-      emit_2("is_num", t0, left)
-      emit_jump_cond("jump_false", t0, err)
-    }
-    if (!right_is_num) {
-      emit_2("is_num", t1, right)
-      emit_jump_cond("jump_false", t1, err)
-    }
-    emit_3(float_op, dest, left, right)
-    emit_jump(done)
-
-    emit_label(err)
-    emit_0("disrupt")
-    emit_label(done)
-    return null
-  }
+  // emit_numeric_binop removed — generic ops emitted directly via passthrough
 
   // emit_eq_decomposed: identical -> int -> float -> text -> null -> bool -> mismatch(false)
   // reads _bp_dest, _bp_left, _bp_right from closure
@@ -646,41 +511,9 @@ var mcode = function(ast) {
     return null
   }
 
-  // emit_neg_decomposed: int path -> float path -> disrupt
+  // emit_neg_decomposed: emit generic negate (VM dispatches int/float)
   var emit_neg_decomposed = function(dest, src, src_node) {
-    var t0 = 0
-    var not_int = null
-    var done = null
-    var err = null
-
-    if (is_known_int(src_node)) {
-      emit_2("neg_int", dest, src)
-      return null
-    }
-    if (is_known_number(src_node)) {
-      emit_2("neg_float", dest, src)
-      return null
-    }
-
-    not_int = gen_label("neg_ni")
-    done = gen_label("neg_done")
-    err = gen_label("neg_err")
-
-    t0 = alloc_slot()
-    emit_2("is_int", t0, src)
-    emit_jump_cond("jump_false", t0, not_int)
-    emit_2("neg_int", dest, src)
-    emit_jump(done)
-
-    emit_label(not_int)
-    emit_2("is_num", t0, src)
-    emit_jump_cond("jump_false", t0, err)
-    emit_2("neg_float", dest, src)
-    emit_jump(done)
-
-    emit_label(err)
-    emit_0("disrupt")
-    emit_label(done)
+    emit_2("negate", dest, src)
     return null
   }
 
@@ -692,14 +525,6 @@ var mcode = function(ast) {
     _bp_right = right
     if (op_str == "add") {
       emit_add_decomposed()
-    } else if (op_str == "subtract") {
-      emit_numeric_binop("sub_int", "sub_float")
-    } else if (op_str == "multiply") {
-      emit_numeric_binop("mul_int", "mul_float")
-    } else if (op_str == "divide") {
-      emit_numeric_binop("div_int", "div_float")
-    } else if (op_str == "modulo") {
-      emit_numeric_binop("mod_int", "mod_float")
     } else if (op_str == "eq") {
       emit_eq_decomposed()
     } else if (op_str == "ne") {
@@ -713,7 +538,8 @@ var mcode = function(ast) {
     } else if (op_str == "ge") {
       emit_relational("ge_int", "ge_float", "ge_text")
     } else {
-      // Passthrough for bitwise, pow, in, etc.
+      // Passthrough for subtract, multiply, divide, modulo,
+      // bitwise, pow, in, etc.
       emit_3(op_str, dest, left, right)
     }
     return null
@@ -782,13 +608,12 @@ var mcode = function(ast) {
     var name_str = alloc_slot()
     emit_const_str(name_str, prop)
     var args_arr = alloc_slot()
-    var arr_instr = ["array", args_arr, argc]
+    add_instr(["array", args_arr, 0])
     _i = 0
     while (_i < argc) {
-      push(arr_instr, args[_i])
+      emit_2("push", args_arr, args[_i])
       _i = _i + 1
     }
-    add_instr(arr_instr)
     var pf = alloc_slot()
     emit_3("frame", pf, obj, 2)
     emit_3("setarg", pf, 0, null_slot)
@@ -836,13 +661,12 @@ var mcode = function(ast) {
     var null_slot = alloc_slot()
     emit_const_null(null_slot)
     var args_arr = alloc_slot()
-    var arr_instr = ["array", args_arr, argc]
+    add_instr(["array", args_arr, 0])
     _i = 0
     while (_i < argc) {
-      push(arr_instr, args[_i])
+      emit_2("push", args_arr, args[_i])
       _i = _i + 1
     }
-    add_instr(arr_instr)
     var pf = alloc_slot()
     emit_3("frame", pf, obj, 2)
     emit_3("setarg", pf, 0, null_slot)
@@ -986,6 +810,323 @@ var mcode = function(ast) {
     return -1
   }
 
+  // --- Inline expansion toggle flags ---
+  var inline_arrfor = true
+  var inline_filter = true
+  var inline_every = true
+  var inline_some = true
+  var inline_reduce = true
+
+  // --- Helper: emit a reduce loop body ---
+  // r = {acc, i, arr, fn, len}; emits loop updating acc in-place.
+  // Caller must emit the done_label after calling this.
+  var emit_reduce_loop = function(r, forward, done_label) {
+    var acc = r.acc
+    var i = r.i
+    var arr_slot = r.arr
+    var fn_slot = r.fn
+    var len = r.len
+    var check = alloc_slot()
+    var item = alloc_slot()
+    var null_s = alloc_slot()
+    var one = alloc_slot()
+    var zero = alloc_slot()
+    var f = alloc_slot()
+    var loop_label = gen_label("reduce_loop")
+    emit_2("int", one, 1)
+    emit_1("null", null_s)
+    emit_label(loop_label)
+    if (forward) {
+      emit_3("lt_int", check, i, len)
+    } else {
+      emit_2("int", zero, 0)
+      emit_3("ge_int", check, i, zero)
+    }
+    emit_jump_cond("jump_false", check, done_label)
+    emit_3("load_index", item, arr_slot, i)
+    emit_3("frame", f, fn_slot, 2)
+    emit_3("setarg", f, 0, null_s)
+    emit_3("setarg", f, 1, acc)
+    emit_3("setarg", f, 2, item)
+    emit_2("invoke", f, acc)
+    if (forward) {
+      emit_3("add", i, i, one)
+    } else {
+      emit_3("subtract", i, i, one)
+    }
+    emit_jump(loop_label)
+  }
+
+  // --- Inline expansion: arrfor(arr, fn) ---
+  var expand_inline_arrfor = function(dest, arr_slot, fn_slot) {
+    var len = alloc_slot()
+    var i = alloc_slot()
+    var check = alloc_slot()
+    var item = alloc_slot()
+    var null_s = alloc_slot()
+    var one = alloc_slot()
+    var f = alloc_slot()
+    var discard = alloc_slot()
+    var loop_label = gen_label("arrfor_loop")
+    var done_label = gen_label("arrfor_done")
+    emit_2("length", len, arr_slot)
+    emit_2("int", i, 0)
+    emit_2("int", one, 1)
+    emit_1("null", null_s)
+    emit_label(loop_label)
+    emit_3("lt_int", check, i, len)
+    emit_jump_cond("jump_false", check, done_label)
+    emit_3("load_index", item, arr_slot, i)
+    emit_3("frame", f, fn_slot, 2)
+    emit_3("setarg", f, 0, null_s)
+    emit_3("setarg", f, 1, item)
+    emit_3("setarg", f, 2, i)
+    emit_2("invoke", f, discard)
+    emit_3("add", i, i, one)
+    emit_jump(loop_label)
+    emit_label(done_label)
+    emit_1("null", dest)
+    return dest
+  }
+
+  // --- Inline expansion: every(arr, fn) ---
+  var expand_inline_every = function(dest, arr_slot, fn_slot) {
+    var len = alloc_slot()
+    var i = alloc_slot()
+    var check = alloc_slot()
+    var item = alloc_slot()
+    var null_s = alloc_slot()
+    var one = alloc_slot()
+    var f = alloc_slot()
+    var val = alloc_slot()
+    var loop_label = gen_label("every_loop")
+    var ret_true = gen_label("every_true")
+    var ret_false = gen_label("every_false")
+    var done_label = gen_label("every_done")
+    emit_2("length", len, arr_slot)
+    emit_2("int", i, 0)
+    emit_2("int", one, 1)
+    emit_1("null", null_s)
+    emit_label(loop_label)
+    emit_3("lt_int", check, i, len)
+    emit_jump_cond("jump_false", check, ret_true)
+    emit_3("load_index", item, arr_slot, i)
+    emit_3("frame", f, fn_slot, 1)
+    emit_3("setarg", f, 0, null_s)
+    emit_3("setarg", f, 1, item)
+    emit_2("invoke", f, val)
+    emit_jump_cond("jump_false", val, ret_false)
+    emit_3("add", i, i, one)
+    emit_jump(loop_label)
+    emit_label(ret_true)
+    emit_1("true", dest)
+    emit_jump(done_label)
+    emit_label(ret_false)
+    emit_1("false", dest)
+    emit_label(done_label)
+    return dest
+  }
+
+  // --- Inline expansion: some(arr, fn) ---
+  var expand_inline_some = function(dest, arr_slot, fn_slot) {
+    var len = alloc_slot()
+    var i = alloc_slot()
+    var check = alloc_slot()
+    var item = alloc_slot()
+    var null_s = alloc_slot()
+    var one = alloc_slot()
+    var f = alloc_slot()
+    var val = alloc_slot()
+    var loop_label = gen_label("some_loop")
+    var ret_true = gen_label("some_true")
+    var ret_false = gen_label("some_false")
+    var done_label = gen_label("some_done")
+    emit_2("length", len, arr_slot)
+    emit_2("int", i, 0)
+    emit_2("int", one, 1)
+    emit_1("null", null_s)
+    emit_label(loop_label)
+    emit_3("lt_int", check, i, len)
+    emit_jump_cond("jump_false", check, ret_false)
+    emit_3("load_index", item, arr_slot, i)
+    emit_3("frame", f, fn_slot, 1)
+    emit_3("setarg", f, 0, null_s)
+    emit_3("setarg", f, 1, item)
+    emit_2("invoke", f, val)
+    emit_jump_cond("jump_true", val, ret_true)
+    emit_3("add", i, i, one)
+    emit_jump(loop_label)
+    emit_label(ret_true)
+    emit_1("true", dest)
+    emit_jump(done_label)
+    emit_label(ret_false)
+    emit_1("false", dest)
+    emit_label(done_label)
+    return dest
+  }
+
+  // --- Inline expansion: filter(arr, fn) ---
+  var expand_inline_filter = function(dest, arr_slot, fn_slot) {
+    var result = alloc_slot()
+    var len = alloc_slot()
+    var i = alloc_slot()
+    var check = alloc_slot()
+    var item = alloc_slot()
+    var null_s = alloc_slot()
+    var one = alloc_slot()
+    var f = alloc_slot()
+    var val = alloc_slot()
+    var loop_label = gen_label("filter_loop")
+    var skip_label = gen_label("filter_skip")
+    var done_label = gen_label("filter_done")
+    add_instr(["array", result, 0])
+    emit_2("length", len, arr_slot)
+    emit_2("int", i, 0)
+    emit_2("int", one, 1)
+    emit_1("null", null_s)
+    emit_label(loop_label)
+    emit_3("lt_int", check, i, len)
+    emit_jump_cond("jump_false", check, done_label)
+    emit_3("load_index", item, arr_slot, i)
+    emit_3("frame", f, fn_slot, 2)
+    emit_3("setarg", f, 0, null_s)
+    emit_3("setarg", f, 1, item)
+    emit_3("setarg", f, 2, i)
+    emit_2("invoke", f, val)
+    emit_jump_cond("jump_false", val, skip_label)
+    emit_2("push", result, item)
+    emit_label(skip_label)
+    emit_3("add", i, i, one)
+    emit_jump(loop_label)
+    emit_label(done_label)
+    emit_2("move", dest, result)
+    return dest
+  }
+
+  // --- Inline expansion: reduce(arr, fn[, initial[, reverse]]) ---
+  var expand_inline_reduce = function(dest, args, nargs) {
+    var arr_slot = args.arr
+    var fn_slot = args.fn
+    var init_slot = args.init
+    var rev_slot = args.rev
+    var len = alloc_slot()
+    var acc = alloc_slot()
+    var i = alloc_slot()
+    var check = alloc_slot()
+    var zero = alloc_slot()
+    var one = alloc_slot()
+    var final_label = gen_label("reduce_final")
+    var has_init = null
+    var no_init_rev = null
+    var init_rev = null
+    var null_label = null
+    var d1 = null
+    var d2 = null
+    var d3 = null
+    var d4 = null
+    var r = null
+    emit_2("length", len, arr_slot)
+    emit_2("int", zero, 0)
+    emit_2("int", one, 1)
+    r = {acc: acc, i: i, arr: arr_slot, fn: fn_slot, len: len}
+    if (nargs == 2) {
+      null_label = gen_label("reduce_null")
+      d1 = gen_label("reduce_d1")
+      emit_3("lt_int", check, zero, len)
+      emit_jump_cond("jump_false", check, null_label)
+      emit_3("load_index", acc, arr_slot, zero)
+      emit_2("move", i, one)
+      emit_reduce_loop(r, true, d1)
+      emit_label(d1)
+      emit_2("move", dest, acc)
+      emit_jump(final_label)
+      emit_label(null_label)
+      emit_1("null", dest)
+      emit_label(final_label)
+    } else if (nargs == 3) {
+      has_init = gen_label("reduce_has_init")
+      null_label = gen_label("reduce_null")
+      d1 = gen_label("reduce_d1")
+      d2 = gen_label("reduce_d2")
+      emit_2("is_null", check, init_slot)
+      emit_jump_cond("jump_false", check, has_init)
+      // No initial, forward
+      emit_3("lt_int", check, zero, len)
+      emit_jump_cond("jump_false", check, null_label)
+      emit_3("load_index", acc, arr_slot, zero)
+      emit_2("move", i, one)
+      emit_reduce_loop(r, true, d1)
+      emit_label(d1)
+      emit_2("move", dest, acc)
+      emit_jump(final_label)
+      emit_label(null_label)
+      emit_1("null", dest)
+      emit_jump(final_label)
+      // Has initial, forward
+      emit_label(has_init)
+      emit_2("move", acc, init_slot)
+      emit_2("int", i, 0)
+      emit_reduce_loop(r, true, d2)
+      emit_label(d2)
+      emit_2("move", dest, acc)
+      emit_label(final_label)
+    } else {
+      // nargs == 4: full branching
+      has_init = gen_label("reduce_has_init")
+      no_init_rev = gen_label("reduce_no_init_rev")
+      init_rev = gen_label("reduce_init_rev")
+      null_label = gen_label("reduce_null")
+      d1 = gen_label("reduce_d1")
+      d2 = gen_label("reduce_d2")
+      d3 = gen_label("reduce_d3")
+      d4 = gen_label("reduce_d4")
+      emit_2("is_null", check, init_slot)
+      emit_jump_cond("jump_false", check, has_init)
+      // No initial
+      emit_3("lt_int", check, zero, len)
+      emit_jump_cond("jump_false", check, null_label)
+      emit_jump_cond("jump_true", rev_slot, no_init_rev)
+      // No initial, forward
+      emit_3("load_index", acc, arr_slot, zero)
+      emit_2("move", i, one)
+      emit_reduce_loop(r, true, d1)
+      emit_label(d1)
+      emit_2("move", dest, acc)
+      emit_jump(final_label)
+      // No initial, reverse
+      emit_label(no_init_rev)
+      emit_3("subtract", i, len, one)
+      emit_3("load_index", acc, arr_slot, i)
+      emit_3("subtract", i, i, one)
+      emit_reduce_loop(r, false, d2)
+      emit_label(d2)
+      emit_2("move", dest, acc)
+      emit_jump(final_label)
+      emit_label(null_label)
+      emit_1("null", dest)
+      emit_jump(final_label)
+      // Has initial
+      emit_label(has_init)
+      emit_jump_cond("jump_true", rev_slot, init_rev)
+      // Has initial, forward
+      emit_2("move", acc, init_slot)
+      emit_2("int", i, 0)
+      emit_reduce_loop(r, true, d3)
+      emit_label(d3)
+      emit_2("move", dest, acc)
+      emit_jump(final_label)
+      // Has initial, reverse
+      emit_label(init_rev)
+      emit_2("move", acc, init_slot)
+      emit_3("subtract", i, len, one)
+      emit_reduce_loop(r, false, d4)
+      emit_label(d4)
+      emit_2("move", dest, acc)
+      emit_label(final_label)
+    }
+    return dest
+  }
+
   // Forward declarations via var
   var gen_expr = null
   var gen_statement = null
@@ -1181,17 +1322,29 @@ var mcode = function(ast) {
     var obj_slot = 0
     var idx_expr = null
     var idx_slot = 0
+    var guard_t = 0
+    var guard_err = null
+    var guard_done = null
 
     if (cop != null) {
       return gen_compound_assign(node, cop)
     }
 
-    // Push syntax: arr[] = val
+    // Push syntax: arr[] = val (guarded)
     if (node.push == true) {
       arr_expr = left.left
       arr_slot = gen_expr(arr_expr, -1)
       val_slot = gen_expr(right, -1)
+      guard_t = alloc_slot()
+      guard_err = gen_label("push_err")
+      guard_done = gen_label("push_done")
+      emit_2("is_array", guard_t, arr_slot)
+      emit_jump_cond("jump_false", guard_t, guard_err)
       emit_2("push", arr_slot, val_slot)
+      emit_jump(guard_done)
+      emit_label(guard_err)
+      emit_0("disrupt")
+      emit_label(guard_done)
       return val_slot
     }
 
@@ -1270,6 +1423,7 @@ var mcode = function(ast) {
     var a0 = 0
     var a1 = 0
     var a2 = 0
+    var a3 = 0
     var d = 0
     var top = null
     var arg_slots = null
@@ -1306,6 +1460,9 @@ var mcode = function(ast) {
     var kname = null
     var func = null
     var func_id = 0
+    var guard_t = 0
+    var guard_err = null
+    var guard_done = null
 
     if (expr == null) {
       return -1
@@ -1343,13 +1500,12 @@ var mcode = function(ast) {
       }
       // Create array from expression results
       arr_slot = alloc_slot()
-      arr_instr = ["array", arr_slot, nexpr]
+      add_instr(["array", arr_slot, 0])
       _i = 0
       while (_i < nexpr) {
-        push(arr_instr, expr_slots[_i])
+        emit_2("push", arr_slot, expr_slots[_i])
         _i = _i + 1
       }
-      add_instr(arr_instr)
       // Load format intrinsic
       fmt_func_slot = find_intrinsic("format")
       if (fmt_func_slot < 0) {
@@ -1509,6 +1665,94 @@ var mcode = function(ast) {
         return d
       }
 
+      // Tier 1 intrinsic inlining: emit direct opcodes instead of frame/invoke
+      if (callee_kind == "name" && callee.intrinsic == true) {
+        fname = callee.name
+        nargs = args_list != null ? length(args_list) : 0
+        // 1-arg type check intrinsics → direct opcode
+        if (nargs == 1) {
+          if (fname == "is_array" || fname == "is_function" ||
+              fname == "is_object" || fname == "is_stone" ||
+              fname == "is_integer" || fname == "is_text" ||
+              fname == "is_number" || fname == "is_logical" ||
+              fname == "is_null" || fname == "length") {
+            a0 = gen_expr(args_list[0], -1)
+            d = alloc_slot()
+            if (fname == "is_array") {
+              emit_2("is_array", d, a0)
+            } else if (fname == "is_function") {
+              emit_2("is_func", d, a0)
+            } else if (fname == "is_object") {
+              emit_2("is_record", d, a0)
+            } else if (fname == "is_stone") {
+              emit_2("is_stone", d, a0)
+            } else if (fname == "is_integer") {
+              emit_2("is_int", d, a0)
+            } else if (fname == "is_text") {
+              emit_2("is_text", d, a0)
+            } else if (fname == "is_number") {
+              emit_2("is_num", d, a0)
+            } else if (fname == "is_logical") {
+              emit_2("is_bool", d, a0)
+            } else if (fname == "is_null") {
+              emit_2("is_null", d, a0)
+            } else if (fname == "length") {
+              emit_2("length", d, a0)
+            }
+            return d
+          }
+        }
+        // 2-arg push: push(arr, val) → guarded direct opcode
+        if (nargs == 2 && fname == "push") {
+          a0 = gen_expr(args_list[0], -1)
+          a1 = gen_expr(args_list[1], -1)
+          guard_t = alloc_slot()
+          guard_err = gen_label("push_err")
+          guard_done = gen_label("push_done")
+          emit_2("is_array", guard_t, a0)
+          emit_jump_cond("jump_false", guard_t, guard_err)
+          emit_2("push", a0, a1)
+          emit_jump(guard_done)
+          emit_label(guard_err)
+          emit_0("disrupt")
+          emit_label(guard_done)
+          return a1
+        }
+        // Callback intrinsics → inline mcode loops
+        if (nargs == 2 && fname == "arrfor" && inline_arrfor) {
+          a0 = gen_expr(args_list[0], -1)
+          a1 = gen_expr(args_list[1], -1)
+          d = alloc_slot()
+          return expand_inline_arrfor(d, a0, a1)
+        }
+        if (nargs == 2 && fname == "every" && inline_every) {
+          a0 = gen_expr(args_list[0], -1)
+          a1 = gen_expr(args_list[1], -1)
+          d = alloc_slot()
+          return expand_inline_every(d, a0, a1)
+        }
+        if (nargs == 2 && fname == "some" && inline_some) {
+          a0 = gen_expr(args_list[0], -1)
+          a1 = gen_expr(args_list[1], -1)
+          d = alloc_slot()
+          return expand_inline_some(d, a0, a1)
+        }
+        if (nargs == 2 && fname == "filter" && inline_filter) {
+          a0 = gen_expr(args_list[0], -1)
+          a1 = gen_expr(args_list[1], -1)
+          d = alloc_slot()
+          return expand_inline_filter(d, a0, a1)
+        }
+        if (fname == "reduce" && nargs >= 2 && nargs <= 4 && inline_reduce) {
+          a0 = gen_expr(args_list[0], -1)
+          a1 = gen_expr(args_list[1], -1)
+          a2 = nargs >= 3 ? gen_expr(args_list[2], -1) : -1
+          a3 = nargs >= 4 ? gen_expr(args_list[3], -1) : -1
+          d = alloc_slot()
+          return expand_inline_reduce(d, {arr: a0, fn: a1, init: a2, rev: a3}, nargs)
+        }
+      }
+
       // Collect arg slots
       arg_slots = []
       _i = 0
@@ -1686,13 +1930,12 @@ var mcode = function(ast) {
         _i = _i + 1
       }
       dest = alloc_slot()
-      instr = ["array", dest, count]
+      add_instr(["array", dest, 0])
       _i = 0
       while (_i < count) {
-        push(instr, elem_slots[_i])
+        emit_2("push", dest, elem_slots[_i])
         _i = _i + 1
       }
-      push(s_instructions, instr)
       return dest
     }
 
@@ -1810,6 +2053,10 @@ var mcode = function(ast) {
     var func = null
     var func_id = 0
     var dest = 0
+    var guard_t = 0
+    var guard_err = null
+    var guard_done = null
+    var last_instr = null
 
     if (stmt == null) {
       return null
@@ -1825,12 +2072,21 @@ var mcode = function(ast) {
       right = stmt.right
       name = left.name
       local_slot = find_var(name)
-      // Pop: var val = arr[]
+      // Pop: var val = arr[] (guarded)
       if (stmt.pop == true && right != null) {
         arr_expr = right.left
         arr_slot = gen_expr(arr_expr, -1)
         if (local_slot >= 0) {
+          guard_t = alloc_slot()
+          guard_err = gen_label("pop_err")
+          guard_done = gen_label("pop_done")
+          emit_2("is_array", guard_t, arr_slot)
+          emit_jump_cond("jump_false", guard_t, guard_err)
           emit_2("pop", local_slot, arr_slot)
+          emit_jump(guard_done)
+          emit_label(guard_err)
+          emit_0("disrupt")
+          emit_label(guard_done)
         }
         return null
       }
@@ -2007,6 +2263,13 @@ var mcode = function(ast) {
       expr = stmt.expression
       if (expr != null) {
         slot = gen_expr(expr, -1)
+        // Mark tail calls: rename last invoke to tail_invoke
+        if (stmt.tail == true && !s_has_disruption) {
+          last_instr = s_instructions[length(s_instructions) - 1]
+          if (is_array(last_instr) && last_instr[0] == "invoke") {
+            last_instr[0] = "tail_invoke"
+          }
+        }
         emit_1("return", slot)
       } else {
         null_slot = alloc_slot()
@@ -2189,6 +2452,7 @@ var mcode = function(ast) {
     s_label_map = {}
 
     s_is_arrow = is_arrow
+    s_has_disruption = disrupt_clause != null && is_array(disrupt_clause)
 
     s_function_nr = fn_nr_node != null ? fn_nr_node : 0
 
@@ -2297,6 +2561,7 @@ var mcode = function(ast) {
 
     // Compile disruption clause
     if (disrupt_clause != null && is_array(disrupt_clause)) {
+      emit_label(gen_label("disruption"))
       disruption_start = length(s_instructions)
       _i = 0
       while (_i < length(disrupt_clause)) {

parse.cm

@@ -692,10 +692,10 @@ var parse = function(tokens, src, filename, tokenizer) {
     if (tok.kind == "?") {
       start = tok
       advance()
-      then_expr = parse_expr()
+      then_expr = parse_assign_expr()
       if (tok.kind == ":") advance()
       else parse_error(tok, "expected ':' in ternary expression")
-      else_expr = parse_expr()
+      else_expr = parse_assign_expr()
       node = ast_node("then", start)
       node.expression = cond
       node.then = then_expr
@@ -1425,7 +1425,9 @@ var parse = function(tokens, src, filename, tokenizer) {
       vars: [],
       in_loop: opts.in_loop == true,
       function_nr: fn_nr,
-      is_function_scope: opts.is_func == true
+      is_function_scope: opts.is_func == true,
+      func_node: null,
+      has_inner_func: false
     }
   }
 
@@ -1478,6 +1480,15 @@ var parse = function(tokens, src, filename, tokenizer) {
     return false
   }
 
+  var sem_find_func_scope = function(scope) {
+    var s = scope
+    while (s != null) {
+      if (s.is_function_scope) return s
+      s = s.parent
+    }
+    return null
+  }
+
   var sem_add_intrinsic = function(name) {
     if (find(intrinsics, name) == null) push(intrinsics, name)
   }
@@ -1616,6 +1627,46 @@ var parse = function(tokens, src, filename, tokenizer) {
       if (kind == "[" && left_node.right != null) {
         sem_check_expr(scope, left_node.right)
       }
+      // Type error detection for known-type constant objects
+      if (obj_expr != null && obj_expr.kind == "name" && obj_expr.name != null) {
+        v = sem_find_var(scope, obj_expr.name)
+        if (v != null && v.is_const && v.type_tag != null) {
+          if (kind == ".") {
+            if (v.type_tag == "array") {
+              sem_error(left_node, "cannot set property on array '" + obj_expr.name + "'")
+            }
+          } else if (kind == "[") {
+            if (left_node.right == null) {
+              // Push: a[] = val
+              if (v.type_tag != "array") {
+                sem_error(left_node, "push only works on arrays, not " + v.type_tag + " '" + obj_expr.name + "'")
+              }
+            } else if (v.type_tag == "array") {
+              if (left_node.right.kind == "text") {
+                sem_error(left_node, "cannot use text key on array '" + obj_expr.name + "'")
+              }
+            } else if (v.type_tag == "record") {
+              if (left_node.right.kind == "number" && is_integer(left_node.right.number)) {
+                sem_error(left_node, "cannot use integer key on record '" + obj_expr.name + "'; use text key")
+              }
+            }
+          }
+        } else if (v != null && v.is_const && v.type_tag == null) {
+          // Infer type_tag from usage pattern (def only)
+          if (kind == ".") {
+            v.type_tag = "record"
+          } else if (kind == "[") {
+            if (left_node.right == null) {
+              // Push: a[] = val → array
+              v.type_tag = "array"
+            } else if (left_node.right.kind == "number" && is_integer(left_node.right.number)) {
+              v.type_tag = "array"
+            } else if (left_node.right.kind == "text") {
+              v.type_tag = "record"
+            }
+          }
+        }
+      }
     }
   }
 
@@ -1635,6 +1686,7 @@ var parse = function(tokens, src, filename, tokenizer) {
     var pname = null
     var def_val = null
     var sr = null
+    var enclosing = null
 
     if (_assign_kinds[kind] == true) {
       sem_check_assign_target(scope, expr.left)
@@ -1736,9 +1788,12 @@ var parse = function(tokens, src, filename, tokenizer) {
     }
 
     if (kind == "function") {
+      enclosing = sem_find_func_scope(scope)
+      if (enclosing != null) enclosing.has_inner_func = true
       fn_nr_val = expr.function_nr
       if (fn_nr_val == null) fn_nr_val = scope.function_nr
       fn_scope = make_scope(scope, fn_nr_val, {is_func: true})
+      fn_scope.func_node = expr
       expr.outer = scope.function_nr
       i = 0
       while (i < length(expr.list)) {
@@ -1819,6 +1874,8 @@ var parse = function(tokens, src, filename, tokenizer) {
     var pname = null
     var def_val = null
     var sr = null
+    var enclosing = null
+    var func_scope = null
     var tt = null
 
     if (kind == "var_list") {
@@ -1861,7 +1918,7 @@ var parse = function(tokens, src, filename, tokenizer) {
       sem_check_expr(scope, stmt.right)
       if (name != null) {
         tt = derive_type_tag(stmt.right)
-        if (tt != null) {
+        if (tt != null && tt != "null") {
           existing = sem_find_var(scope, name)
           if (existing != null) existing.type_tag = tt
         }
@@ -1941,7 +1998,26 @@ var parse = function(tokens, src, filename, tokenizer) {
       return null
     }
 
-    if (kind == "return" || kind == "go") {
+    if (kind == "go") {
+      sem_check_expr(scope, stmt.expression)
+      if (stmt.expression == null || stmt.expression.kind != "(") {
+        sem_error(stmt, "'go' must be followed by a function call")
+      } else {
+        func_scope = sem_find_func_scope(scope)
+        if (func_scope != null && func_scope.func_node != null) {
+          if (func_scope.func_node.disruption != null) {
+            sem_error(stmt, "cannot use 'go' in a function with a disruption clause")
+          }
+          if (func_scope.has_inner_func) {
+            sem_error(stmt, "cannot use 'go' in a function that defines inner functions")
+          }
+        }
+        stmt.tail = true
+      }
+      return null
+    }
+
+    if (kind == "return") {
       sem_check_expr(scope, stmt.expression)
       if (stmt.expression != null && stmt.expression.kind == "(") {
         stmt.tail = true
@@ -1982,11 +2058,14 @@ var parse = function(tokens, src, filename, tokenizer) {
     }
 
     if (kind == "function") {
+      enclosing = sem_find_func_scope(scope)
+      if (enclosing != null) enclosing.has_inner_func = true
       name = stmt.name
       if (name != null) sem_add_var(scope, name, {make: "function", fn_nr: scope.function_nr})
       fn_nr_val = stmt.function_nr
       if (fn_nr_val == null) fn_nr_val = scope.function_nr
       fn_scope = make_scope(scope, fn_nr_val, {is_func: true})
+      fn_scope.func_node = stmt
       stmt.outer = scope.function_nr
       i = 0
       while (i < length(stmt.list)) {

qbe.cm

@@ -732,167 +732,6 @@ var ushr = function(p, ctx, a, b) {
 // These map directly to the new IR ops emitted by mcode.cm.
 // ============================================================
 
-// --- Arithmetic (int path) ---
-// add_int: assume both operands are tagged ints. Overflow -> float.
-var add_int = function(p, ctx, a, b) {
-  return `  %${p}.ia =l sar ${a}, 1
-  %${p}.ib =l sar ${b}, 1
-  %${p}.sum =l add %${p}.ia, %${p}.ib
-  %${p}.lo =w csltl %${p}.sum, ${int32_min}
-  %${p}.hi =w csgtl %${p}.sum, ${int32_max}
-  %${p}.ov =w or %${p}.lo, %${p}.hi
-  jnz %${p}.ov, @${p}.ov, @${p}.ok
-@${p}.ok
-  %${p}.rw =w copy %${p}.sum
-  %${p}.rext =l extuw %${p}.rw
-  %${p} =l shl %${p}.rext, 1
-  jmp @${p}.done
-@${p}.ov
-  %${p}.fd =d sltof %${p}.sum
-  %${p} =l call $__JS_NewFloat64(l ${ctx}, d %${p}.fd)
-@${p}.done
-`
-}
-
-var sub_int = function(p, ctx, a, b) {
-  return `  %${p}.ia =l sar ${a}, 1
-  %${p}.ib =l sar ${b}, 1
-  %${p}.diff =l sub %${p}.ia, %${p}.ib
-  %${p}.lo =w csltl %${p}.diff, ${int32_min}
-  %${p}.hi =w csgtl %${p}.diff, ${int32_max}
-  %${p}.ov =w or %${p}.lo, %${p}.hi
-  jnz %${p}.ov, @${p}.ov, @${p}.ok
-@${p}.ok
-  %${p}.rw =w copy %${p}.diff
-  %${p}.rext =l extuw %${p}.rw
-  %${p} =l shl %${p}.rext, 1
-  jmp @${p}.done
-@${p}.ov
-  %${p}.fd =d sltof %${p}.diff
-  %${p} =l call $__JS_NewFloat64(l ${ctx}, d %${p}.fd)
-@${p}.done
-`
-}
-
-var mul_int = function(p, ctx, a, b) {
-  return `  %${p}.ia =l sar ${a}, 1
-  %${p}.ib =l sar ${b}, 1
-  %${p}.prod =l mul %${p}.ia, %${p}.ib
-  %${p}.lo =w csltl %${p}.prod, ${int32_min}
-  %${p}.hi =w csgtl %${p}.prod, ${int32_max}
-  %${p}.ov =w or %${p}.lo, %${p}.hi
-  jnz %${p}.ov, @${p}.ov, @${p}.ok
-@${p}.ok
-  %${p}.rw =w copy %${p}.prod
-  %${p}.rext =l extuw %${p}.rw
-  %${p} =l shl %${p}.rext, 1
-  jmp @${p}.done
-@${p}.ov
-  %${p}.fd =d sltof %${p}.prod
-  %${p} =l call $__JS_NewFloat64(l ${ctx}, d %${p}.fd)
-@${p}.done
-`
-}
-
-var div_int = function(p, ctx, a, b) {
-  return `  %${p}.ia =w copy 0
-  %${p}.tmp =l sar ${a}, 1
-  %${p}.ia =w copy %${p}.tmp
-  %${p}.ib =w copy 0
-  %${p}.tmp2 =l sar ${b}, 1
-  %${p}.ib =w copy %${p}.tmp2
-  %${p}.div0 =w ceqw %${p}.ib, 0
-  jnz %${p}.div0, @${p}.null, @${p}.chk
-@${p}.null
-  %${p} =l copy ${js_null}
-  jmp @${p}.done
-@${p}.chk
-  %${p}.rem =w rem %${p}.ia, %${p}.ib
-  %${p}.exact =w ceqw %${p}.rem, 0
-  jnz %${p}.exact, @${p}.idiv, @${p}.fdiv
-@${p}.idiv
-  %${p}.q =w div %${p}.ia, %${p}.ib
-  %${p}.qext =l extuw %${p}.q
-  %${p} =l shl %${p}.qext, 1
-  jmp @${p}.done
-@${p}.fdiv
-  %${p}.da =d swtof %${p}.ia
-  %${p}.db =d swtof %${p}.ib
-  %${p}.dr =d div %${p}.da, %${p}.db
-  %${p} =l call $__JS_NewFloat64(l ${ctx}, d %${p}.dr)
-@${p}.done
-`
-}
-
-var mod_int = function(p, ctx, a, b) {
-  return `  %${p}.ia =w copy 0
-  %${p}.tmp =l sar ${a}, 1
-  %${p}.ia =w copy %${p}.tmp
-  %${p}.ib =w copy 0
-  %${p}.tmp2 =l sar ${b}, 1
-  %${p}.ib =w copy %${p}.tmp2
-  %${p}.div0 =w ceqw %${p}.ib, 0
-  jnz %${p}.div0, @${p}.null, @${p}.do_mod
-@${p}.null
-  %${p} =l copy ${js_null}
-  jmp @${p}.done
-@${p}.do_mod
-  %${p}.r =w rem %${p}.ia, %${p}.ib
-  %${p}.rext =l extuw %${p}.r
-  %${p} =l shl %${p}.rext, 1
-@${p}.done
-`
-}
-
-var neg_int = function(p, ctx, v) {
-  return `  %${p}.sl =l sar ${v}, 1
-  %${p}.iw =w copy %${p}.sl
-  %${p}.is_min =w ceqw %${p}.iw, ${int32_min}
-  jnz %${p}.is_min, @${p}.ov, @${p}.ok
-@${p}.ov
-  %${p}.fd =d swtof %${p}.iw
-  %${p}.fdn =d neg %${p}.fd
-  %${p} =l call $__JS_NewFloat64(l ${ctx}, d %${p}.fdn)
-  jmp @${p}.done
-@${p}.ok
-  %${p}.ni =w sub 0, %${p}.iw
-  %${p}.niext =l extuw %${p}.ni
-  %${p} =l shl %${p}.niext, 1
-@${p}.done
-`
-}
-
-// --- Arithmetic (float path) ---
-var add_float = function(p, ctx, a, b) {
-  return `  %${p} =l call $qbe_float_add(l ${ctx}, l ${a}, l ${b})
-`
-}
-
-var sub_float = function(p, ctx, a, b) {
-  return `  %${p} =l call $qbe_float_sub(l ${ctx}, l ${a}, l ${b})
-`
-}
-
-var mul_float = function(p, ctx, a, b) {
-  return `  %${p} =l call $qbe_float_mul(l ${ctx}, l ${a}, l ${b})
-`
-}
-
-var div_float = function(p, ctx, a, b) {
-  return `  %${p} =l call $qbe_float_div(l ${ctx}, l ${a}, l ${b})
-`
-}
-
-var mod_float = function(p, ctx, a, b) {
-  return `  %${p} =l call $qbe_float_mod(l ${ctx}, l ${a}, l ${b})
-`
-}
-
-var neg_float = function(p, ctx, v) {
-  return `  %${p} =l call $qbe_float_neg(l ${ctx}, l ${v})
-`
-}
-
 // --- Text concat ---
 var concat = function(p, ctx, a, b) {
   return `  %${p} =l call $JS_ConcatString(l ${ctx}, l ${a}, l ${b})
@@ -1039,20 +878,6 @@ return {
   shl: shl,
   shr: shr,
   ushr: ushr,
-  // decomposed arithmetic (int path)
-  add_int: add_int,
-  sub_int: sub_int,
-  mul_int: mul_int,
-  div_int: div_int,
-  mod_int: mod_int,
-  neg_int: neg_int,
-  // decomposed arithmetic (float path)
-  add_float: add_float,
-  sub_float: sub_float,
-  mul_float: mul_float,
-  div_float: div_float,
-  mod_float: mod_float,
-  neg_float: neg_float,
   // text concat
   concat: concat,
   // decomposed comparisons (int)

qbe_emit.cm

@@ -201,77 +201,46 @@ var qbe_emit = function(ir, qbe) {
         continue
       }
 
-      // --- Arithmetic (int path) — use qbe.cm macros ---
+      // --- Generic arithmetic (VM dispatches int/float) ---
 
-      if (op == "add_int") {
+      if (op == "add") {
         p = fresh()
-        emit(qbe.add_int(p, "%ctx", s(a2), s(a3)))
+        emit(qbe.add(p, "%ctx", s(a2), s(a3)))
         emit(`  ${s(a1)} =l copy %${p}`)
         wb(a1)
         continue
       }
-      if (op == "sub_int") {
+      if (op == "subtract") {
         p = fresh()
-        emit(qbe.sub_int(p, "%ctx", s(a2), s(a3)))
+        emit(qbe.sub(p, "%ctx", s(a2), s(a3)))
         emit(`  ${s(a1)} =l copy %${p}`)
         wb(a1)
         continue
       }
-      if (op == "mul_int") {
+      if (op == "multiply") {
         p = fresh()
-        emit(qbe.mul_int(p, "%ctx", s(a2), s(a3)))
+        emit(qbe.mul(p, "%ctx", s(a2), s(a3)))
         emit(`  ${s(a1)} =l copy %${p}`)
         wb(a1)
         continue
       }
-      if (op == "div_int") {
+      if (op == "divide") {
         p = fresh()
-        emit(qbe.div_int(p, "%ctx", s(a2), s(a3)))
+        emit(qbe.div(p, "%ctx", s(a2), s(a3)))
         emit(`  ${s(a1)} =l copy %${p}`)
         wb(a1)
         continue
       }
-      if (op == "mod_int") {
+      if (op == "modulo") {
         p = fresh()
-        emit(qbe.mod_int(p, "%ctx", s(a2), s(a3)))
+        emit(qbe.mod(p, "%ctx", s(a2), s(a3)))
         emit(`  ${s(a1)} =l copy %${p}`)
         wb(a1)
         continue
       }
-
-      // --- Arithmetic (float path) ---
-
-      if (op == "add_float") {
+      if (op == "negate") {
         p = fresh()
-        emit(qbe.add_float(p, "%ctx", s(a2), s(a3)))
-        emit(`  ${s(a1)} =l copy %${p}`)
-        wb(a1)
-        continue
-      }
-      if (op == "sub_float") {
-        p = fresh()
-        emit(qbe.sub_float(p, "%ctx", s(a2), s(a3)))
-        emit(`  ${s(a1)} =l copy %${p}`)
-        wb(a1)
-        continue
-      }
-      if (op == "mul_float") {
-        p = fresh()
-        emit(qbe.mul_float(p, "%ctx", s(a2), s(a3)))
-        emit(`  ${s(a1)} =l copy %${p}`)
-        wb(a1)
-        continue
-      }
-      if (op == "div_float") {
-        p = fresh()
-        emit(qbe.div_float(p, "%ctx", s(a2), s(a3)))
-        emit(`  ${s(a1)} =l copy %${p}`)
-        wb(a1)
-        continue
-      }
-      if (op == "mod_float") {
-        p = fresh()
-        emit(qbe.mod_float(p, "%ctx", s(a2), s(a3)))
+        emit(qbe.neg(p, "%ctx", s(a2)))
         emit(`  ${s(a1)} =l copy %${p}`)
         wb(a1)
         continue
@@ -650,7 +619,8 @@ var qbe_emit = function(ir, qbe) {
         continue
       }
       if (op == "goinvoke") {
-        emit(`  call $cell_rt_goinvoke(l %ctx, l ${s(a1)})`)
+        emit(`  %_goret =l call $cell_rt_goinvoke(l %ctx, l ${s(a1)})`)
+        emit(`  ret %_goret`)
         continue
       }
 

regen.ce

@@ -0,0 +1,155 @@
+// regen.ce — regenerate .mach bytecode files
+// Run with: ./cell --core . regen
+
+var fd = use("fd")
+var json = use("json")
+var tokenize = use("tokenize")
+var parse = use("parse")
+var fold = use("fold")
+var mcode = use("mcode")
+var streamline = use("streamline")
+
+var files = [
+  {src: "tokenize.cm", name: "tokenize", out: "tokenize.cm.mcode"},
+  {src: "parse.cm", name: "parse", out: "parse.cm.mcode"},
+  {src: "fold.cm", name: "fold", out: "fold.cm.mcode"},
+  {src: "mcode.cm", name: "mcode", out: "mcode.cm.mcode"},
+  {src: "streamline.cm", name: "streamline", out: "streamline.cm.mcode"},
+  {src: "qbe.cm", name: "qbe", out: "qbe.cm.mcode"},
+  {src: "qbe_emit.cm", name: "qbe_emit", out: "qbe_emit.cm.mcode"},
+  {src: "internal/bootstrap.cm", name: "bootstrap", out: "internal/bootstrap.cm.mcode"},
+  {src: "internal/engine.cm", name: "engine", out: "internal/engine.cm.mcode"}
+]
+
+var i = 0
+var entry = null
+var src = null
+var tok_result = null
+var ast = null
+var folded = null
+var compiled = null
+var optimized = null
+var mcode_text = null
+var f = null
+var errs = null
+var ei = 0
+var e = null
+var had_errors = false
+
+// Collapse leaf arrays (instruction arrays) onto single lines
+var compact_arrays = function(json_text) {
+  var lines = array(json_text, "\n")
+  var result = []
+  var i = 0
+  var line = null
+  var trimmed = null
+  var collecting = false
+  var collected = null
+  var indent = null
+  var is_leaf = null
+  var j = 0
+  var inner = null
+  var parts = null
+  var trailing = null
+  var chars = null
+  var k = 0
+
+  while (i < length(lines)) {
+    line = lines[i]
+    trimmed = trim(line)
+    if (collecting == false && trimmed == "[") {
+      collecting = true
+      chars = array(line)
+      k = 0
+      while (k < length(chars) && chars[k] == " ") {
+        k = k + 1
+      }
+      indent = text(line, 0, k)
+      collected = []
+      i = i + 1
+      continue
+    }
+    if (collecting) {
+      if (trimmed == "]" || trimmed == "],") {
+        is_leaf = true
+        j = 0
+        while (j < length(collected)) {
+          inner = trim(collected[j])
+          if (starts_with(inner, "[") || starts_with(inner, "{")) {
+            is_leaf = false
+          }
+          j = j + 1
+        }
+        if (is_leaf && length(collected) > 0) {
+          parts = []
+          j = 0
+          while (j < length(collected)) {
+            inner = trim(collected[j])
+            if (ends_with(inner, ",")) {
+              inner = text(inner, 0, length(inner) - 1)
+            }
+            parts[] = inner
+            j = j + 1
+          }
+          trailing = ""
+          if (ends_with(trimmed, ",")) {
+            trailing = ","
+          }
+          result[] = `${indent}[${text(parts, ", ")}]${trailing}`
+        } else {
+          result[] = `${indent}[`
+          j = 0
+          while (j < length(collected)) {
+            result[] = collected[j]
+            j = j + 1
+          }
+          result[] = line
+        }
+        collecting = false
+      } else {
+        collected[] = line
+      }
+      i = i + 1
+      continue
+    }
+    result[] = line
+    i = i + 1
+  }
+  return text(result, "\n")
+}
+
+while (i < length(files)) {
+  entry = files[i]
+  src = text(fd.slurp(entry.src))
+  tok_result = tokenize(src, entry.src)
+  ast = parse(tok_result.tokens, src, entry.src, tokenize)
+  // Check for parse/semantic errors
+  errs = ast.errors
+  if (errs != null && length(errs) > 0) {
+    ei = 0
+    while (ei < length(errs)) {
+      e = errs[ei]
+      if (e.line != null) {
+        print(`${entry.src}:${text(e.line)}:${text(e.column)}: error: ${e.message}`)
+      } else {
+        print(`${entry.src}: error: ${e.message}`)
+      }
+      ei = ei + 1
+    }
+    had_errors = true
+    i = i + 1
+    continue
+  }
+  folded = fold(ast)
+  compiled = mcode(folded)
+  optimized = streamline(compiled)
+  mcode_text = compact_arrays(json.encode(optimized, null, 2))
+  f = fd.open(entry.out, "w")
+  fd.write(f, mcode_text)
+  fd.close(f)
+  print(`wrote ${entry.out}`)
+  i = i + 1
+}
+if (had_errors) {
+  print("regen aborted: fix errors above")
+}

regen.cm

@@ -1,75 +0,0 @@
-// regen.cm — regenerate .mach bytecode files
-// Run with: ./cell --core . regen.cm
-
-var fd = use("fd")
-var json = use("json")
-var tokenize = use("tokenize")
-var parse = use("parse")
-var fold = use("fold")
-var mcode = use("mcode")
-var streamline = use("streamline")
-
-var files = [
-  {src: "tokenize.cm", name: "tokenize", out: "tokenize.mach"},
-  {src: "parse.cm", name: "parse", out: "parse.mach"},
-  {src: "fold.cm", name: "fold", out: "fold.mach"},
-  {src: "mcode.cm", name: "mcode", out: "mcode.mach"},
-  {src: "streamline.cm", name: "streamline", out: "streamline.mach"},
-  {src: "qbe.cm", name: "qbe", out: "qbe.mach"},
-  {src: "qbe_emit.cm", name: "qbe_emit", out: "qbe_emit.mach"},
-  {src: "internal/bootstrap.cm", name: "bootstrap", out: "internal/bootstrap.mach"},
-  {src: "internal/engine.cm", name: "engine", out: "internal/engine.mach"}
-]
-
-var i = 0
-var entry = null
-var src = null
-var tok_result = null
-var ast = null
-var folded = null
-var compiled = null
-var optimized = null
-var mcode_json = null
-var bytecode = null
-var f = null
-var errs = null
-var ei = 0
-var e = null
-var had_errors = false
-
-while (i < length(files)) {
-  entry = files[i]
-  src = text(fd.slurp(entry.src))
-  tok_result = tokenize(src, entry.src)
-  ast = parse(tok_result.tokens, src, entry.src, tokenize)
-  // Check for parse/semantic errors
-  errs = ast.errors
-  if (errs != null && length(errs) > 0) {
-    ei = 0
-    while (ei < length(errs)) {
-      e = errs[ei]
-      if (e.line != null) {
-        print(`${entry.src}:${text(e.line)}:${text(e.column)}: error: ${e.message}`)
-      } else {
-        print(`${entry.src}: error: ${e.message}`)
-      }
-      ei = ei + 1
-    }
-    had_errors = true
-    i = i + 1
-    continue
-  }
-  folded = fold(ast)
-  compiled = mcode(folded)
-  optimized = streamline(compiled)
-  mcode_json = json.encode(optimized)
-  bytecode = mach_compile_mcode_bin(entry.name, mcode_json)
-  f = fd.open(entry.out, "w")
-  fd.write(f, bytecode)
-  fd.close(f)
-  print(`wrote ${entry.out}`)
-  i = i + 1
-}
-if (had_errors) {
-  print("regen aborted: fix errors above")
-}

source/cell.c

@@ -11,8 +11,9 @@
 #include "cell_internal.h"
 #include "cJSON.h"
 
-#define BOOTSTRAP_MACH "internal/bootstrap.mach"
-#define BOOTSTRAP_SRC  "internal/bootstrap.cm"
+#define BOOTSTRAP_MACH  "internal/bootstrap.cm.mach"
+#define BOOTSTRAP_MCODE "internal/bootstrap.cm.mcode"
+#define BOOTSTRAP_SRC   "internal/bootstrap.cm"
 #define CELL_SHOP_DIR ".cell"
 #define CELL_CORE_DIR "packages/core"
 
@@ -178,9 +179,14 @@ void script_startup(cell_rt *prt)
   cell_rt *crt = JS_GetContextOpaque(js);
   JS_FreeValue(js, js_blob_use(js));
 
-  // Load pre-compiled bootstrap bytecode (.mach)
+  // Load pre-compiled bootstrap (.cm.mach or .cm.mcode)
   size_t boot_size;
   char *boot_data = load_core_file(BOOTSTRAP_MACH, &boot_size);
+  int boot_is_mcode = 0;
+  if (!boot_data) {
+    boot_data = load_core_file(BOOTSTRAP_MCODE, &boot_size);
+    boot_is_mcode = 1;
+  }
   if (!boot_data) {
     printf("ERROR: Could not load bootstrap from %s!\n", core_path);
     return;
@@ -218,7 +224,9 @@ void script_startup(cell_rt *prt)
 
   // Run through MACH VM
   crt->state = ACTOR_RUNNING;
-  JSValue v = JS_RunMachBin(js, (const uint8_t *)boot_data, boot_size, hidden_env);
+  JSValue v = boot_is_mcode
+    ? JS_RunMachMcode(js, boot_data, boot_size, hidden_env)
+    : JS_RunMachBin(js, (const uint8_t *)boot_data, boot_size, hidden_env);
   free(boot_data);
   uncaught_exception(js, v);
   crt->state = ACTOR_IDLE;
@@ -269,13 +277,12 @@ static int run_test_suite(size_t heap_size)
 
 static void print_usage(const char *prog)
 {
-  printf("Usage: %s [options] <script> [args...]\n\n", prog);
-  printf("Run a cell script (.ce actor or .cm module).\n\n");
+  printf("Usage: %s [options] <program> [args...]\n\n", prog);
+  printf("Run a cell program (.ce actor).\n\n");
   printf("Options:\n");
   printf("  --core <path>              Set core path directly (overrides CELL_CORE)\n");
   printf("  --shop <path>              Set shop path (overrides CELL_SHOP)\n");
-  printf("  --emit-qbe                 Emit QBE IL (for native compilation)\n");
-  printf("  --dump-mach                Dump MACH bytecode disassembly\n");
+  printf("  --dev                      Dev mode (shop=.cell, core=.)\n");
   printf("  --test [heap_size]         Run C test suite\n");
   printf("  -h, --help                 Show this help message\n");
   printf("\nEnvironment:\n");
@@ -307,24 +314,13 @@ int cell_init(int argc, char **argv)
   }
 
   /* Default: run script through bootstrap pipeline */
-  int emit_qbe = 0;
-  int dump_mach = 0;
   int arg_start = 1;
   const char *shop_override = NULL;
   const char *core_override = NULL;
 
   // Parse flags (order-independent)
   while (arg_start < argc && argv[arg_start][0] == '-') {
-    if (strcmp(argv[arg_start], "--mcode") == 0) {
-      /* --mcode is now always on; accept and ignore for compat */
-      arg_start++;
-    } else if (strcmp(argv[arg_start], "--emit-qbe") == 0) {
-      emit_qbe = 1;
-      arg_start++;
-    } else if (strcmp(argv[arg_start], "--dump-mach") == 0) {
-      dump_mach = 1;
-      arg_start++;
-    } else if (strcmp(argv[arg_start], "--shop") == 0) {
+    if (strcmp(argv[arg_start], "--shop") == 0) {
       if (arg_start + 1 >= argc) {
         printf("ERROR: --shop requires a path argument\n");
         return 1;
@@ -338,17 +334,38 @@ int cell_init(int argc, char **argv)
       }
       core_override = argv[arg_start + 1];
       arg_start += 2;
+    } else if (strcmp(argv[arg_start], "--dev") == 0) {
+      shop_override = ".cell";
+      core_override = ".";
+      mkdir(".cell", 0755);
+      mkdir(".cell/build", 0755);
+      mkdir(".cell/packages", 0755);
+      /* Ensure .cell/packages/core -> . symlink exists */
+      struct stat lst;
+      if (lstat(".cell/packages/core", &lst) != 0)
+        symlink("../..", ".cell/packages/core");
+      arg_start++;
     } else {
       break;
     }
   }
 
+  if (arg_start >= argc) {
+    print_usage(argv[0]);
+    return 1;
+  }
+
   if (!find_cell_shop(shop_override, core_override)) return 1;
 
   actor_initialize();
 
   size_t boot_size;
   char *boot_data = load_core_file(BOOTSTRAP_MACH, &boot_size);
+  int boot_is_mcode = 0;
+  if (!boot_data) {
+    boot_data = load_core_file(BOOTSTRAP_MCODE, &boot_size);
+    boot_is_mcode = 1;
+  }
   if (!boot_data) {
     printf("ERROR: Could not load bootstrap from %s\n", core_path);
     return 1;
@@ -360,7 +377,7 @@ int cell_init(int argc, char **argv)
     free(boot_data);
     return 1;
   }
-  JSContext *ctx = JS_NewContextWithHeapSize(g_runtime, 16 * 1024 * 1024);
+  JSContext *ctx = JS_NewContextWithHeapSize(g_runtime, 1024 * 1024);
   if (!ctx) {
     printf("Failed to create JS context\n");
     free(boot_data); JS_FreeRuntime(g_runtime);
@@ -402,8 +419,9 @@ int cell_init(int argc, char **argv)
   JS_SetPropertyStr(ctx, hidden_env, "core_path", JS_NewString(ctx, core_path));
   JS_SetPropertyStr(ctx, hidden_env, "shop_path",
     shop_path ? JS_NewString(ctx, shop_path) : JS_NULL);
-  JS_SetPropertyStr(ctx, hidden_env, "emit_qbe", JS_NewBool(ctx, emit_qbe));
-  JS_SetPropertyStr(ctx, hidden_env, "dump_mach", JS_NewBool(ctx, dump_mach));
+  /* TODO: remove after next 'make regen' — old bootstrap.mach reads these */
+  JS_SetPropertyStr(ctx, hidden_env, "emit_qbe", JS_FALSE);
+  JS_SetPropertyStr(ctx, hidden_env, "dump_mach", JS_FALSE);
   JS_SetPropertyStr(ctx, hidden_env, "actorsym", JS_DupValue(ctx, cli_rt->actor_sym_ref.val));
   JS_SetPropertyStr(ctx, hidden_env, "json", js_json_use(ctx));
   JS_SetPropertyStr(ctx, hidden_env, "nota", js_nota_use(ctx));
@@ -417,7 +435,9 @@ int cell_init(int argc, char **argv)
   JS_SetPropertyStr(ctx, hidden_env, "args", args_arr);
   hidden_env = JS_Stone(ctx, hidden_env);
 
-  JSValue result = JS_RunMachBin(ctx, (const uint8_t *)boot_data, boot_size, hidden_env);
+  JSValue result = boot_is_mcode
+    ? JS_RunMachMcode(ctx, boot_data, boot_size, hidden_env)
+    : JS_RunMachBin(ctx, (const uint8_t *)boot_data, boot_size, hidden_env);
   free(boot_data);
 
   int exit_code = 0;

source/cell.h

@@ -78,8 +78,7 @@ void cell_trace_sethook(cell_hook);
 #define QJSCLASS(TYPE, ...)\
 JSClassID js_##TYPE##_id;\
 static void js_##TYPE##_finalizer(JSRuntime *rt, JSValue val){\
-JSContext *js = JS_GetContext(rt);\
-TYPE *n = JS_GetOpaque2(js, val, js_##TYPE##_id); \
+TYPE *n = JS_GetOpaque(val, js_##TYPE##_id); \
 TYPE##_free(rt,n);}\
 static JSClassDef js_##TYPE##_class = {\
   .class_name = #TYPE,\

source/mach.c

@@ -442,7 +442,7 @@ JSFrameRegister *alloc_frame_register(JSContext *ctx, int slot_count) {
   if (!frame) return NULL;
 
   /* cap56 = slot count (used by gc_object_size) */
-  frame->hdr = objhdr_make(slot_count, OBJ_FRAME, 0, 0, 0, 0);
+  frame->header = objhdr_make(slot_count, OBJ_FRAME, 0, 0, 0, 0);
   frame->function = JS_NULL;
   frame->caller = JS_NULL;
   frame->address = JS_NewInt32(ctx, 0);
@@ -547,7 +547,7 @@ static JSValue reg_vm_binop(JSContext *ctx, int op, JSValue a, JSValue b) {
   }
 
   /* String concat for ADD */
-  if (op == MACH_ADD && JS_IsText(a) && JS_IsText(b))
+  if (op == MACH_ADD && mist_is_text(a) && mist_is_text(b))
     return JS_ConcatString(ctx, a, b);
 
   /* Comparison ops allow mixed types — return false for mismatches */
@@ -576,7 +576,7 @@ static JSValue reg_vm_binop(JSContext *ctx, int op, JSValue a, JSValue b) {
       }
     }
     /* String comparisons */
-    if (JS_IsText(a) && JS_IsText(b)) {
+    if (mist_is_text(a) && mist_is_text(b)) {
       int cmp = js_string_compare_value(ctx, a, b, FALSE);
       switch (op) {
       case MACH_EQ: return JS_NewBool(ctx, cmp == 0);
@@ -696,7 +696,7 @@ void __asan_on_error(void) {
   fprintf(stderr, "\n=== ASAN error: VM stack trace ===\n");
   int is_first = 1;
   while (frame) {
-    if (!JS_IsFunction(frame->function)) break;
+    if (!mist_is_function(frame->function)) break;
     JSFunction *fn = JS_VALUE_GET_FUNCTION(frame->function);
     const char *func_name = NULL;
     const char *file = NULL;
@@ -767,9 +767,7 @@ JSValue JS_CallRegisterVM(JSContext *ctx, JSCodeRegister *code,
   /* Setup initial frame — wrap top-level code in a function object so that
      returning from a called register function can read code/env from frame */
   JSValue top_fn = js_new_register_function(ctx, code, env_gc.val, of_gc.val);
-  JS_PopGCRef(ctx, &of_gc);
   env = env_gc.val; /* refresh — GC may have moved env during allocation */
-  JS_PopGCRef(ctx, &env_gc);
   frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
   frame->function = top_fn;
   frame->slots[0] = this_gc.val;  /* slot 0 = this */
@@ -780,6 +778,8 @@ JSValue JS_CallRegisterVM(JSContext *ctx, JSCodeRegister *code,
   }
   for (int i = nargs_copy - 1; i >= 0; i--) JS_PopGCRef(ctx, &arg_gcs[i]);
   JS_PopGCRef(ctx, &this_gc);
+  JS_PopGCRef(ctx, &of_gc);
+  JS_PopGCRef(ctx, &env_gc);
 
   uint32_t pc = code->entry_point;
   JSValue result = JS_NULL;
@@ -882,7 +882,7 @@ JSValue JS_CallRegisterVM(JSContext *ctx, JSCodeRegister *code,
         JS_ToFloat64(ctx, &dt, tol);
         BOOL eq = fabs(da - db) <= dt;
         frame->slots[a] = JS_NewBool(ctx, is_eq_op ? eq : !eq);
-      } else if (JS_IsText(left) && JS_IsText(right) && JS_VALUE_GET_TAG(tol) == JS_TAG_BOOL && JS_VALUE_GET_BOOL(tol)) {
+      } else if (mist_is_text(left) && mist_is_text(right) && JS_VALUE_GET_TAG(tol) == JS_TAG_BOOL && JS_VALUE_GET_BOOL(tol)) {
         BOOL eq = js_string_compare_value_nocase(ctx, left, right) == 0;
         frame->slots[a] = JS_NewBool(ctx, is_eq_op ? eq : !eq);
       } else {
@@ -960,7 +960,7 @@ JSValue JS_CallRegisterVM(JSContext *ctx, JSCodeRegister *code,
       JSValue obj = frame->slots[b];
       JSValue key = code->cpool[c];
       /* Non-proxy functions (arity != 2) can't have properties read */
-      if (JS_IsFunction(obj)) {
+      if (mist_is_function(obj)) {
         JSFunction *fn_chk = JS_VALUE_GET_FUNCTION(obj);
         if (fn_chk->length != 2) {
           JS_ThrowTypeError(ctx, "cannot read property of non-proxy function");
@@ -987,13 +987,9 @@ JSValue JS_CallRegisterVM(JSContext *ctx, JSCodeRegister *code,
     }
 
     case MACH_GETINDEX: {
+      /* R(A) = R(B)[R(C)] — mcode guarantees R(C) is int */
       JSValue obj = frame->slots[b];
-      JSValue idx = frame->slots[c];
-      JSValue val;
-      if (JS_IsInt(idx))
-        val = JS_GetPropertyNumber(ctx, obj, JS_VALUE_GET_INT(idx));
-      else
-        val = JS_GetProperty(ctx, obj, idx);
+      JSValue val = JS_GetPropertyNumber(ctx, obj, JS_VALUE_GET_INT(frame->slots[c]));
       frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
       if (JS_IsException(val)) goto disrupt;
       frame->slots[a] = val;
@@ -1001,25 +997,12 @@ JSValue JS_CallRegisterVM(JSContext *ctx, JSCodeRegister *code,
     }
 
     case MACH_SETINDEX: {
-      /* R(A)[R(B)] = R(C) */
+      /* R(A)[R(B)] = R(C) — mcode guarantees R(B) is int */
       JSValue obj = frame->slots[a];
-      JSValue idx = frame->slots[b];
       JSValue val = frame->slots[c];
-      int ret;
-      if (JS_IsInt(idx)) {
-        JSValue r = JS_SetPropertyNumber(ctx, obj, JS_VALUE_GET_INT(idx), val);
-        ret = JS_IsException(r) ? -1 : 0;
-      } else if (JS_IsArray(obj)) {
-        JS_ThrowTypeError(ctx, "array index must be a number");
-        ret = -1;
-      } else if (JS_IsRecord(obj) && !JS_IsText(idx) && !JS_IsRecord(idx)) {
-        JS_ThrowTypeError(ctx, "object key must be a string or object");
-        ret = -1;
-      } else {
-        ret = JS_SetProperty(ctx, obj, idx, val);
-      }
+      JSValue r = JS_SetPropertyNumber(ctx, obj, JS_VALUE_GET_INT(frame->slots[b]), val);
       frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
-      if (ret < 0) goto disrupt;
+      if (JS_IsException(r)) goto disrupt;
       break;
     }
 
@@ -1187,16 +1170,10 @@ JSValue JS_CallRegisterVM(JSContext *ctx, JSCodeRegister *code,
     }
 
     case MACH_NEWARRAY: {
-      int count = b;
       JSValue arr = JS_NewArray(ctx);
       frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
       if (JS_IsException(arr)) { goto disrupt; }
-      /* Store array in dest immediately so GC can track it */
       frame->slots[a] = arr;
-      for (int i = 0; i < count; i++) {
-        JS_SetPropertyNumber(ctx, frame->slots[a], i, frame->slots[a + 1 + i]);
-        frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
-      }
       break;
     }
 
@@ -1216,14 +1193,9 @@ JSValue JS_CallRegisterVM(JSContext *ctx, JSCodeRegister *code,
     }
 
     case MACH_PUSH: {
-      /* push R(B) onto array R(A) */
+      /* push R(B) onto array R(A) — mcode guarantees R(A) is array */
       JSValue arr = frame->slots[a];
       JSValue val = frame->slots[b];
-      if (!JS_IsArray(arr)) {
-        JS_ThrowTypeError(ctx, "cannot push to non-array");
-        frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
-        goto disrupt;
-      }
       JSGCRef arr_gc;
       JS_PushGCRef(ctx, &arr_gc);
       arr_gc.val = arr;
@@ -1236,13 +1208,8 @@ JSValue JS_CallRegisterVM(JSContext *ctx, JSCodeRegister *code,
     }
 
     case MACH_POP: {
-      /* R(A) = pop last element from array R(B) */
+      /* R(A) = pop last element from array R(B) — mcode guarantees R(B) is array */
       JSValue arr = frame->slots[b];
-      if (!JS_IsArray(arr)) {
-        JS_ThrowTypeError(ctx, "cannot pop from non-array");
-        frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
-        goto disrupt;
-      }
       JSValue val = JS_ArrayPop(ctx, arr);
       frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
       if (JS_IsException(val)) goto disrupt;
@@ -1295,100 +1262,6 @@ JSValue JS_CallRegisterVM(JSContext *ctx, JSCodeRegister *code,
 
     /* === New mcode-derived opcodes === */
 
-    /* Typed integer arithmetic — inline with overflow to float */
-    case MACH_ADD_INT: {
-      int32_t ia = JS_VALUE_GET_INT(frame->slots[b]);
-      int32_t ib = JS_VALUE_GET_INT(frame->slots[c]);
-      int64_t r = (int64_t)ia + (int64_t)ib;
-      frame->slots[a] = (r >= INT32_MIN && r <= INT32_MAX)
-          ? JS_NewInt32(ctx, (int32_t)r) : JS_NewFloat64(ctx, (double)r);
-      break;
-    }
-    case MACH_SUB_INT: {
-      int32_t ia = JS_VALUE_GET_INT(frame->slots[b]);
-      int32_t ib = JS_VALUE_GET_INT(frame->slots[c]);
-      int64_t r = (int64_t)ia - (int64_t)ib;
-      frame->slots[a] = (r >= INT32_MIN && r <= INT32_MAX)
-          ? JS_NewInt32(ctx, (int32_t)r) : JS_NewFloat64(ctx, (double)r);
-      break;
-    }
-    case MACH_MUL_INT: {
-      int32_t ia = JS_VALUE_GET_INT(frame->slots[b]);
-      int32_t ib = JS_VALUE_GET_INT(frame->slots[c]);
-      int64_t r = (int64_t)ia * (int64_t)ib;
-      frame->slots[a] = (r >= INT32_MIN && r <= INT32_MAX)
-          ? JS_NewInt32(ctx, (int32_t)r) : JS_NewFloat64(ctx, (double)r);
-      break;
-    }
-    case MACH_DIV_INT: {
-      int32_t ia = JS_VALUE_GET_INT(frame->slots[b]);
-      int32_t ib = JS_VALUE_GET_INT(frame->slots[c]);
-      if (ib == 0) { frame->slots[a] = JS_NULL; break; }
-      if (ia % ib == 0) frame->slots[a] = JS_NewInt32(ctx, ia / ib);
-      else frame->slots[a] = JS_NewFloat64(ctx, (double)ia / (double)ib);
-      break;
-    }
-    case MACH_MOD_INT: {
-      int32_t ia = JS_VALUE_GET_INT(frame->slots[b]);
-      int32_t ib = JS_VALUE_GET_INT(frame->slots[c]);
-      if (ib == 0) { frame->slots[a] = JS_NULL; break; }
-      frame->slots[a] = JS_NewInt32(ctx, ia % ib);
-      break;
-    }
-    case MACH_NEG_INT: {
-      int32_t i = JS_VALUE_GET_INT(frame->slots[b]);
-      if (i == INT32_MIN)
-        frame->slots[a] = JS_NewFloat64(ctx, -(double)i);
-      else
-        frame->slots[a] = JS_NewInt32(ctx, -i);
-      break;
-    }
-
-    /* Typed float arithmetic */
-    case MACH_ADD_FLOAT: {
-      double da, db;
-      JS_ToFloat64(ctx, &da, frame->slots[b]);
-      JS_ToFloat64(ctx, &db, frame->slots[c]);
-      frame->slots[a] = JS_NewFloat64(ctx, da + db);
-      break;
-    }
-    case MACH_SUB_FLOAT: {
-      double da, db;
-      JS_ToFloat64(ctx, &da, frame->slots[b]);
-      JS_ToFloat64(ctx, &db, frame->slots[c]);
-      frame->slots[a] = JS_NewFloat64(ctx, da - db);
-      break;
-    }
-    case MACH_MUL_FLOAT: {
-      double da, db;
-      JS_ToFloat64(ctx, &da, frame->slots[b]);
-      JS_ToFloat64(ctx, &db, frame->slots[c]);
-      frame->slots[a] = JS_NewFloat64(ctx, da * db);
-      break;
-    }
-    case MACH_DIV_FLOAT: {
-      double da, db;
-      JS_ToFloat64(ctx, &da, frame->slots[b]);
-      JS_ToFloat64(ctx, &db, frame->slots[c]);
-      if (db == 0.0) { frame->slots[a] = JS_NULL; break; }
-      frame->slots[a] = JS_NewFloat64(ctx, da / db);
-      break;
-    }
-    case MACH_MOD_FLOAT: {
-      double da, db;
-      JS_ToFloat64(ctx, &da, frame->slots[b]);
-      JS_ToFloat64(ctx, &db, frame->slots[c]);
-      if (db == 0.0) { frame->slots[a] = JS_NULL; break; }
-      frame->slots[a] = JS_NewFloat64(ctx, fmod(da, db));
-      break;
-    }
-    case MACH_NEG_FLOAT: {
-      double d;
-      JS_ToFloat64(ctx, &d, frame->slots[b]);
-      frame->slots[a] = JS_NewFloat64(ctx, -d);
-      break;
-    }
-
     /* Text concatenation */
     case MACH_CONCAT: {
       JSValue res = JS_ConcatString(ctx, frame->slots[b], frame->slots[c]);
@@ -1482,7 +1355,7 @@ JSValue JS_CallRegisterVM(JSContext *ctx, JSCodeRegister *code,
       frame->slots[a] = JS_NewBool(ctx, JS_IsNumber(frame->slots[b]));
       break;
     case MACH_IS_TEXT:
-      frame->slots[a] = JS_NewBool(ctx, JS_IsText(frame->slots[b]));
+      frame->slots[a] = JS_NewBool(ctx, mist_is_text(frame->slots[b]));
       break;
     case MACH_IS_BOOL:
       frame->slots[a] = JS_NewBool(ctx, JS_IsBool(frame->slots[b]));
@@ -1490,35 +1363,43 @@ JSValue JS_CallRegisterVM(JSContext *ctx, JSCodeRegister *code,
     case MACH_IS_NULL:
       frame->slots[a] = JS_NewBool(ctx, JS_IsNull(frame->slots[b]));
       break;
-    case MACH_IS_FUNC:
-      frame->slots[a] = JS_NewBool(ctx, JS_IsFunction(frame->slots[b]));
+    case MACH_IS_ARRAY:
+      frame->slots[a] = JS_NewBool(ctx, mist_is_array(frame->slots[b]));
       break;
+    case MACH_IS_FUNC:
+      frame->slots[a] = JS_NewBool(ctx, mist_is_function(frame->slots[b]));
+      break;
+    case MACH_IS_RECORD:
+      frame->slots[a] = JS_NewBool(ctx, mist_is_record(frame->slots[b]));
+      break;
+    case MACH_IS_STONE:
+      frame->slots[a] = JS_NewBool(ctx, mist_is_stone(frame->slots[b]));
+      break;
+    case MACH_LENGTH: {
+      JSValue v = frame->slots[b];
+      if (mist_is_array(v)) {
+        JSArray *arr = JS_VALUE_GET_ARRAY(v);
+        frame->slots[a] = JS_NewInt32(ctx, (int32_t)arr->len);
+      } else if (MIST_IsImmediateASCII(v)) {
+        frame->slots[a] = JS_NewInt32(ctx, MIST_GetImmediateASCIILen(v));
+      } else {
+        /* fallback to C for text/blob/function (still a GC safepoint) */
+        JSValue res = JS_CellLength(ctx, v);
+        frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
+        frame->slots[a] = res;
+      }
+      break;
+    }
     case MACH_IS_PROXY: {
       JSValue v = frame->slots[b];
       int is_proxy = 0;
-      if (JS_IsFunction(v)) {
+      if (mist_is_function(v)) {
         JSFunction *fn = JS_VALUE_GET_FUNCTION(v);
         is_proxy = (fn->length == 2);
       }
       frame->slots[a] = JS_NewBool(ctx, is_proxy);
       break;
     }
-    case MACH_TYPEOF: {
-      JSValue val = frame->slots[b];
-      const char *tname = "unknown";
-      if (JS_IsNull(val)) tname = "null";
-      else if (JS_IsInt(val) || JS_IsNumber(val)) tname = "number";
-      else if (JS_IsBool(val)) tname = "logical";
-      else if (JS_IsText(val)) tname = "text";
-      else if (JS_IsFunction(val)) tname = "function";
-      else if (JS_IsArray(val)) tname = "array";
-      else if (JS_IsRecord(val)) tname = "object";
-      JSValue res = JS_NewString(ctx, tname);
-      frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
-      frame->slots[a] = res;
-      break;
-    }
-
     /* Logical */
     case MACH_NOT: {
       int bval = JS_ToBool(ctx, frame->slots[b]);
@@ -1565,7 +1446,7 @@ JSValue JS_CallRegisterVM(JSContext *ctx, JSCodeRegister *code,
     case MACH_LOAD_FIELD: {
       JSValue obj = frame->slots[b];
       JSValue key = code->cpool[c];
-      if (JS_IsFunction(obj)) {
+      if (mist_is_function(obj)) {
         JS_ThrowTypeError(ctx, "cannot read property of function");
         frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
         goto disrupt;
@@ -1586,30 +1467,21 @@ JSValue JS_CallRegisterVM(JSContext *ctx, JSCodeRegister *code,
       break;
     }
     case MACH_LOAD_INDEX: {
+      /* R(A) = R(B)[R(C)] — mcode guarantees R(C) is int */
       JSValue obj = frame->slots[b];
-      JSValue idx = frame->slots[c];
-      JSValue val;
-      if (JS_IsInt(idx))
-        val = JS_GetPropertyNumber(ctx, obj, JS_VALUE_GET_INT(idx));
-      else
-        val = JS_GetProperty(ctx, obj, idx);
+      JSValue val = JS_GetPropertyNumber(ctx, obj, JS_VALUE_GET_INT(frame->slots[c]));
       frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
       if (JS_IsException(val)) goto disrupt;
       frame->slots[a] = val;
       break;
     }
     case MACH_STORE_INDEX: {
+      /* R(A)[R(B)] = R(C) — mcode guarantees R(B) is int */
       JSValue obj = frame->slots[a];
-      JSValue idx = frame->slots[b];
       JSValue val = frame->slots[c];
-      int ret;
-      if (JS_IsInt(idx)) {
-        JSValue r = JS_SetPropertyNumber(ctx, obj, JS_VALUE_GET_INT(idx), val);
-        ret = JS_IsException(r) ? -1 : 0;
-      } else
-        ret = JS_SetProperty(ctx, obj, idx, val);
+      JSValue r = JS_SetPropertyNumber(ctx, obj, JS_VALUE_GET_INT(frame->slots[b]), val);
       frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
-      if (ret < 0) goto disrupt;
+      if (JS_IsException(r)) goto disrupt;
       break;
     }
     case MACH_LOAD_DYNAMIC: {
@@ -1633,10 +1505,10 @@ JSValue JS_CallRegisterVM(JSContext *ctx, JSCodeRegister *code,
       if (JS_IsInt(key)) {
         JSValue r = JS_SetPropertyNumber(ctx, obj, JS_VALUE_GET_INT(key), val);
         ret = JS_IsException(r) ? -1 : 0;
-      } else if (JS_IsArray(obj)) {
+      } else if (mist_is_array(obj)) {
         JS_ThrowTypeError(ctx, "array index must be a number");
         ret = -1;
-      } else if (JS_IsBool(key) || JS_IsNull(key) || JS_IsArray(key) || JS_IsFunction(key)) {
+      } else if (JS_IsBool(key) || JS_IsNull(key) || mist_is_array(key) || mist_is_function(key)) {
         JS_ThrowTypeError(ctx, "object key must be text");
         ret = -1;
       } else {
@@ -1661,7 +1533,7 @@ JSValue JS_CallRegisterVM(JSContext *ctx, JSCodeRegister *code,
     case MACH_GOFRAME: {
       /* A=frame_slot, B=func_reg, C=argc */
       JSValue func_val = frame->slots[b];
-      if (!JS_IsFunction(func_val)) {
+      if (!mist_is_function(func_val)) {
         JS_ThrowTypeError(ctx, "not a function");
         frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
         goto disrupt;
@@ -1687,7 +1559,7 @@ JSValue JS_CallRegisterVM(JSContext *ctx, JSCodeRegister *code,
     case MACH_INVOKE: {
       /* A=frame_slot, B=result_slot */
       JSFrameRegister *fr = (JSFrameRegister *)JS_VALUE_GET_PTR(frame->slots[a]);
-      int nr = (int)objhdr_cap56(fr->hdr);
+      int nr = (int)objhdr_cap56(fr->header);
       int c_argc = (nr >= 2) ? nr - 2 : 0;
       JSValue fn_val = fr->function;
       JSFunction *fn = JS_VALUE_GET_FUNCTION(fn_val);
@@ -1736,17 +1608,68 @@ JSValue JS_CallRegisterVM(JSContext *ctx, JSCodeRegister *code,
       break;
     }
     case MACH_GOINVOKE: {
-      /* Async invoke: call and discard result */
+      /* Tail call: replace current frame with callee */
       JSFrameRegister *fr = (JSFrameRegister *)JS_VALUE_GET_PTR(frame->slots[a]);
-      int nr = (int)objhdr_cap56(fr->hdr);
+      int nr = (int)objhdr_cap56(fr->header);
       int c_argc = (nr >= 2) ? nr - 2 : 0;
-      ctx->reg_current_frame = frame_ref.val;
-      ctx->current_register_pc = pc > 0 ? pc - 1 : 0;
-      JSValue ret = JS_Call(ctx, fr->function, fr->slots[0],
-                            c_argc, &fr->slots[1]);
-      frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
-      ctx->reg_current_frame = JS_NULL;
-      if (JS_IsException(ret)) goto disrupt;
+      JSValue fn_val = fr->function;
+      JSFunction *fn = JS_VALUE_GET_FUNCTION(fn_val);
+
+      if (fn->kind == JS_FUNC_KIND_REGISTER) {
+        /* Register function: tail call by replacing current frame */
+        JSCodeRegister *fn_code = fn->u.reg.code;
+        JSFrameRegister *new_frame = alloc_frame_register(ctx, fn_code->nr_slots);
+        if (!new_frame) {
+          frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
+          goto disrupt;
+        }
+        frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
+        fr = (JSFrameRegister *)JS_VALUE_GET_PTR(frame->slots[a]);
+        fn_val = fr->function;
+        fn = JS_VALUE_GET_FUNCTION(fn_val);
+        fn_code = fn->u.reg.code;
+        new_frame->function = fn_val;
+        /* Copy this + args from call frame to new frame */
+        int copy_count = (c_argc < fn_code->arity) ? c_argc : fn_code->arity;
+        new_frame->slots[0] = fr->slots[0]; /* this */
+        for (int i = 0; i < copy_count; i++)
+          new_frame->slots[1 + i] = fr->slots[1 + i];
+        /* Tail call: callee returns to OUR caller, not to us */
+        new_frame->caller = frame->caller;
+        frame->caller = JS_NULL; /* detach current frame */
+        /* Switch to callee */
+        frame = new_frame;
+        frame_ref.val = JS_MKPTR(frame);
+        code = fn_code;
+        env = fn->u.reg.env_record;
+        pc = code->entry_point;
+      } else {
+        /* C/bytecode function: call it, then return result to our caller */
+        ctx->reg_current_frame = frame_ref.val;
+        ctx->current_register_pc = pc > 0 ? pc - 1 : 0;
+        JSValue ret;
+        if (fn->kind == JS_FUNC_KIND_C)
+          ret = js_call_c_function(ctx, fn_val, fr->slots[0], c_argc, &fr->slots[1]);
+        else
+          ret = JS_CallInternal(ctx, fn_val, fr->slots[0], c_argc, &fr->slots[1], 0);
+        frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
+        ctx->reg_current_frame = JS_NULL;
+        if (JS_IsException(ret)) goto disrupt;
+        /* Tail-return: act like MACH_RETURN with the result */
+        result = ret;
+        if (JS_IsNull(frame->caller)) goto done;
+        JSFrameRegister *caller = (JSFrameRegister *)JS_VALUE_GET_PTR(frame->caller);
+        frame->caller = JS_NULL;
+        frame = caller;
+        frame_ref.val = JS_MKPTR(frame);
+        int ret_info = JS_VALUE_GET_INT(frame->address);
+        JSFunction *ret_fn = JS_VALUE_GET_FUNCTION(frame->function);
+        code = ret_fn->u.reg.code;
+        env = ret_fn->u.reg.env_record;
+        pc = ret_info >> 16;
+        int ret_slot = ret_info & 0xFFFF;
+        if (ret_slot != 0xFFFF) frame->slots[ret_slot] = ret;
+      }
       break;
     }
 
@@ -1789,7 +1712,7 @@ JSValue JS_CallRegisterVM(JSContext *ctx, JSCodeRegister *code,
     }
 
     default:
-      result = JS_ThrowInternalError(ctx, "unknown register VM opcode %d", op);
+      result = JS_ThrowInternalError(ctx, "unknown register VM opcode %d: %s", op, mach_opcode_names[op]);
       goto done;
     }
     continue;
@@ -1812,12 +1735,38 @@ JSValue JS_CallRegisterVM(JSContext *ctx, JSCodeRegister *code,
           break;
         }
         if (JS_IsNull(frame->caller)) {
-          if (!JS_HasException(ctx)) {
-            /* Bare disrupt with no error message — provide location */
-            const char *fn_name = code->name_cstr ? code->name_cstr : "<anonymous>";
-            fprintf(stderr, "unhandled disruption in %s\n", fn_name);
-          } else {
-            fprintf(stderr, "unhandled disruption\n");
+          const char *fn_name = code->name_cstr ? code->name_cstr : "<anonymous>";
+          const char *file = code->filename_cstr ? code->filename_cstr : "<unknown>";
+          uint16_t line = 0, col = 0;
+          if (code->line_table && frame_pc > 0 && frame_pc - 1 < code->instr_count) {
+            line = code->line_table[frame_pc - 1].line;
+            col = code->line_table[frame_pc - 1].col;
+          }
+          fprintf(stderr, "unhandled disruption in %s (%s:%u:%u)\n", fn_name, file, line, col);
+          /* Walk and print the frame chain as a stack trace */
+          {
+            JSFrameRegister *trace_frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
+            int first = 1;
+            while (trace_frame) {
+              if (!mist_is_function(trace_frame->function)) break;
+              JSFunction *trace_fn = JS_VALUE_GET_FUNCTION(trace_frame->function);
+              if (trace_fn->kind == JS_FUNC_KIND_REGISTER && trace_fn->u.reg.code) {
+                JSCodeRegister *tc = trace_fn->u.reg.code;
+                uint32_t tpc = first ? (frame_pc > 0 ? frame_pc - 1 : 0)
+                                     : (uint32_t)(JS_VALUE_GET_INT(trace_frame->address) >> 16);
+                uint16_t tl = 0, tcol = 0;
+                if (tc->line_table && tpc < tc->instr_count) {
+                  tl = tc->line_table[tpc].line;
+                  tcol = tc->line_table[tpc].col;
+                }
+                fprintf(stderr, "    at %s (%s:%u:%u)\n",
+                        tc->name_cstr ? tc->name_cstr : "<anonymous>",
+                        tc->filename_cstr ? tc->filename_cstr : "<unknown>", tl, tcol);
+              }
+              if (JS_IsNull(trace_frame->caller)) break;
+              trace_frame = (JSFrameRegister *)JS_VALUE_GET_PTR(trace_frame->caller);
+              first = 0;
+            }
           }
           result = JS_Throw(ctx, JS_NULL);
           frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
@@ -1979,7 +1928,7 @@ static int mcode_reg_items(cJSON *it, cJSON **out) {
     { ADD(1); return c; }
 
   /* invoke: [1]=frame, [2]=dest (result register) */
-  if (!strcmp(op, "invoke")) { ADD(1); ADD(2); return c; }
+  if (!strcmp(op, "invoke") || !strcmp(op, "tail_invoke")) { ADD(1); ADD(2); return c; }
   /* goinvoke: [1]=frame only (no result) */
   if (!strcmp(op, "goinvoke")) { ADD(1); return c; }
 
@@ -2332,24 +2281,16 @@ static MachCode *mcode_lower_func(cJSON *fobj, const char *filename) {
     else if (strcmp(op, "false") == 0)   { EM(MACH_ABC(MACH_LOADFALSE, A1, 0, 0)); }
     else if (strcmp(op, "null") == 0)    { EM(MACH_ABC(MACH_LOADNULL, A1, 0, 0)); }
     else if (strcmp(op, "move") == 0)    { AB2(MACH_MOVE); }
-    /* Typed integer arithmetic */
-    else if (strcmp(op, "add_int") == 0) { ABC3(MACH_ADD_INT); }
-    else if (strcmp(op, "sub_int") == 0) { ABC3(MACH_SUB_INT); }
-    else if (strcmp(op, "mul_int") == 0) { ABC3(MACH_MUL_INT); }
-    else if (strcmp(op, "div_int") == 0) { ABC3(MACH_DIV_INT); }
-    else if (strcmp(op, "mod_int") == 0) { ABC3(MACH_MOD_INT); }
-    else if (strcmp(op, "neg_int") == 0) { AB2(MACH_NEG_INT); }
-    /* Typed float arithmetic */
-    else if (strcmp(op, "add_float") == 0) { ABC3(MACH_ADD_FLOAT); }
-    else if (strcmp(op, "sub_float") == 0) { ABC3(MACH_SUB_FLOAT); }
-    else if (strcmp(op, "mul_float") == 0) { ABC3(MACH_MUL_FLOAT); }
-    else if (strcmp(op, "div_float") == 0) { ABC3(MACH_DIV_FLOAT); }
-    else if (strcmp(op, "mod_float") == 0) { ABC3(MACH_MOD_FLOAT); }
-    else if (strcmp(op, "neg_float") == 0) { AB2(MACH_NEG_FLOAT); }
     /* Text */
     else if (strcmp(op, "concat") == 0)  { ABC3(MACH_CONCAT); }
     /* Generic arithmetic */
+    else if (strcmp(op, "add") == 0)     { ABC3(MACH_ADD); }
+    else if (strcmp(op, "subtract") == 0) { ABC3(MACH_SUB); }
+    else if (strcmp(op, "multiply") == 0) { ABC3(MACH_MUL); }
+    else if (strcmp(op, "divide") == 0)  { ABC3(MACH_DIV); }
+    else if (strcmp(op, "modulo") == 0)  { ABC3(MACH_MOD); }
     else if (strcmp(op, "pow") == 0)     { ABC3(MACH_POW); }
+    else if (strcmp(op, "negate") == 0)  { AB2(MACH_NEG); }
     /* Typed integer comparisons */
     else if (strcmp(op, "eq_int") == 0)  { ABC3(MACH_EQ_INT); }
     else if (strcmp(op, "ne_int") == 0)  { ABC3(MACH_NE_INT); }
@@ -2400,11 +2341,14 @@ static MachCode *mcode_lower_func(cJSON *fobj, const char *filename) {
     else if (strcmp(op, "is_int") == 0)  { AB2(MACH_IS_INT); }
     else if (strcmp(op, "is_num") == 0)  { AB2(MACH_IS_NUM); }
     else if (strcmp(op, "is_text") == 0) { AB2(MACH_IS_TEXT); }
-    else if (strcmp(op, "is_bool") == 0) { AB2(MACH_IS_BOOL); }
-    else if (strcmp(op, "is_null") == 0) { AB2(MACH_IS_NULL); }
-    else if (strcmp(op, "is_func") == 0) { AB2(MACH_IS_FUNC); }
-    else if (strcmp(op, "is_proxy") == 0) { AB2(MACH_IS_PROXY); }
-    else if (strcmp(op, "typeof") == 0)  { AB2(MACH_TYPEOF); }
+    else if (strcmp(op, "is_bool") == 0)   { AB2(MACH_IS_BOOL); }
+    else if (strcmp(op, "is_null") == 0)   { AB2(MACH_IS_NULL); }
+    else if (strcmp(op, "is_array") == 0)  { AB2(MACH_IS_ARRAY); }
+    else if (strcmp(op, "is_func") == 0)   { AB2(MACH_IS_FUNC); }
+    else if (strcmp(op, "is_record") == 0) { AB2(MACH_IS_RECORD); }
+    else if (strcmp(op, "is_stone") == 0)  { AB2(MACH_IS_STONE); }
+    else if (strcmp(op, "length") == 0)    { AB2(MACH_LENGTH); }
+    else if (strcmp(op, "is_proxy") == 0)  { AB2(MACH_IS_PROXY); }
     /* Logical */
     else if (strcmp(op, "not") == 0)     { AB2(MACH_NOT); }
     else if (strcmp(op, "and") == 0)     { ABC3(MACH_AND); }
@@ -2523,7 +2467,7 @@ static MachCode *mcode_lower_func(cJSON *fobj, const char *filename) {
     else if (strcmp(op, "setarg") == 0) {
       EM(MACH_ABC(MACH_SETARG, A1, A2, A3));
     }
-    else if (strcmp(op, "invoke") == 0) {
+    else if (strcmp(op, "invoke") == 0 || strcmp(op, "tail_invoke") == 0) {
       EM(MACH_ABC(MACH_INVOKE, A1, A2, 0));
     }
     else if (strcmp(op, "goframe") == 0) {
@@ -3147,6 +3091,29 @@ JSValue JS_RunMachBin(JSContext *ctx, const uint8_t *data, size_t size, JSValue
   return result;
 }
 
+JSValue JS_RunMachMcode(JSContext *ctx, const char *json_str, size_t len, JSValue env) {
+  (void)len;
+  cJSON *mcode = cJSON_Parse(json_str);
+  if (!mcode)
+    return JS_ThrowSyntaxError(ctx, "failed to parse mcode JSON");
+
+  MachCode *mc = mach_compile_mcode(mcode);
+  cJSON_Delete(mcode);
+  if (!mc)
+    return JS_ThrowInternalError(ctx, "mcode compilation failed");
+
+  JSGCRef env_ref;
+  JS_PushGCRef(ctx, &env_ref);
+  env_ref.val = env;
+
+  JSCodeRegister *code = JS_LoadMachCode(ctx, mc, env_ref.val);
+  JS_FreeMachCode(mc);
+
+  JSValue result = JS_CallRegisterVM(ctx, code, ctx->global_obj, 0, NULL, env_ref.val, JS_NULL);
+  JS_PopGCRef(ctx, &env_ref);
+  return result;
+}
+
 void JS_DumpMachBin(JSContext *ctx, const uint8_t *data, size_t size, JSValue env) {
   MachCode *mc = JS_DeserializeMachCode(data, size);
   if (!mc) {

source/qbe_helpers.c

@@ -333,7 +333,7 @@ void cell_rt_setarg(JSValue frame_val, int64_t idx, JSValue val) {
 
 JSValue cell_rt_invoke(JSContext *ctx, JSValue frame_val) {
   JSFrameRegister *fr = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_val);
-  int nr_slots = (int)objhdr_cap56(fr->hdr);
+  int nr_slots = (int)objhdr_cap56(fr->header);
   int c_argc = (nr_slots >= 2) ? nr_slots - 2 : 0;
 
   /* Copy args to C stack */
@@ -351,8 +351,8 @@ JSValue cell_rt_goframe(JSContext *ctx, JSValue fn, int64_t nargs) {
   return cell_rt_frame(ctx, fn, nargs);
 }
 
-void cell_rt_goinvoke(JSContext *ctx, JSValue frame_val) {
-  cell_rt_invoke(ctx, frame_val);
+JSValue cell_rt_goinvoke(JSContext *ctx, JSValue frame_val) {
+  return cell_rt_invoke(ctx, frame_val);
 }
 
 /* --- Array push/pop --- */

source/quickjs-internal.h

@@ -115,6 +115,14 @@
 #define gc_poison_region(addr, size) ((void)0)
 #define gc_unpoison_region(addr, size) ((void)0)
 #endif
+
+#include <sys/mman.h>
+#include <unistd.h>
+
+static inline size_t poison_page_align(size_t size) {
+  size_t ps = (size_t)sysconf(_SC_PAGESIZE);
+  return (size + ps - 1) & ~(ps - 1);
+}
 #endif /* POISON_HEAP */
 
 #ifdef HAVE_ASAN
@@ -294,7 +302,6 @@ typedef enum JSErrorEnum {
 #define __exception __attribute__ ((warn_unused_result))
 
 /* Forward declaration for bytecode freeing */
-struct JSFunctionBytecode;
 
 #define JS_VALUE_GET_ARRAY(v) ((JSArray *)chase (v))
 #define JS_VALUE_GET_OBJ(v) ((JSRecord *)chase (v))
@@ -302,15 +309,12 @@ struct JSFunctionBytecode;
 #define JS_VALUE_GET_BLOB(v) ((JSBlob *)JS_VALUE_GET_PTR (v))
 #define JS_VALUE_GET_FUNCTION(v) ((JSFunction *)chase (v))
 #define JS_VALUE_GET_FRAME(v) ((JSFrame *)chase (v))
-#define JS_VALUE_GET_CODE(v) ((JSFunctionBytecode *)JS_VALUE_GET_PTR (v))
+#define JS_VALUE_GET_CODE(v) (JS_VALUE_GET_PTR (v))
 #define JS_VALUE_GET_STRING(v) ((JSText *)chase (v))
 
 /* Compatibility: JS_TAG_STRING is an alias for text type checks */
 #define JS_TAG_STRING JS_TAG_STRING_IMM
 
-/* JS_TAG_FUNCTION doesn't exist in new encoding - use JS_IsFunction check instead */
-#define JS_TAG_FUNCTION 0xFE  /* dummy value, never matches any tag */
-
 /* JS_ThrowMemoryError is an alias for JS_ThrowOutOfMemory */
 #define JS_ThrowMemoryError(ctx) JS_ThrowOutOfMemory(ctx)
 
@@ -319,8 +323,6 @@ static inline objhdr_t objhdr_set_cap56 (objhdr_t h, uint64_t cap) {
   return (h & 0xFF) | ((cap & OBJHDR_CAP_MASK) << OBJHDR_CAP_SHIFT);
 }
 
-typedef enum OPCodeEnum OPCodeEnum;
-
 /* ============================================================
    Buddy Allocator for Actor Memory Blocks
    ============================================================ */
@@ -367,13 +369,7 @@ struct JSClass {
 #define JS_MODE_BACKTRACE_BARRIER \
   (1 << 3) /* stop backtrace before this frame */
 
-typedef struct JSFrameRegister {
-  objhdr_t hdr; // capacity in this is the total number of words of the object, including the 4 words of overhead and all slots
-  JSValue function; // JSFunction, function object being invoked
-  JSValue caller; // JSFrameRegister, the frame that called this one
-  JSValue address; // address of the instruction in the code that should be executed upon return
-  JSValue slots[]; // inline memory. order is [this][input args][closed over vars][non closed over vars][temporaries]
-} JSFrameRegister; /// extra note: when this frame returns, caller should be set to 0. If caller is found to be 0, then the GC can reduce this frame's slots down to [this][input_args][closed over vars]; if no closed over vars it can be totally removed; may happen naturally in GC since it would have no refs?
+/* JSFrameRegister is now an alias for JSFrame — see JSFrame definition below */
 
 /* ============================================================
    Register-Based VM Data Structures
@@ -405,6 +401,72 @@ typedef struct { uint16_t line; uint16_t col; } MachLineEntry;
 #define MACH_GET_sBx(i)  ((int16_t)((i) >> 16))
 #define MACH_GET_sJ(i)   ((int32_t)((i) & 0xFFFFFF00) >> 8)
 
+/* ============================================================
+   GC Safepoint Classification for the MACH VM Dispatch Loop
+   ============================================================
+
+   Every opcode falls into one of three categories:
+
+   [P] Pure inline — never calls C, never allocates. No GC possible.
+       No frame re-derivation needed after execution.
+
+   [N] Non-allocating C call — calls a C function that is guaranteed
+       to never allocate (e.g. JS_ToBool, js_string_compare_value).
+       No frame re-derivation needed.
+
+   [G] GC safepoint — calls C that may allocate, triggering GC.
+       After the call, all heap pointers (including `frame`) MUST be
+       re-derived via: frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
+
+   The 18 C entry points that can allocate (GC safepoints):
+    1. JS_GetProperty        — key interning for string keys >7 chars
+    2. JS_SetProperty        — rec_resize when record grows
+    3. JS_GetPropertyNumber   — text substring extraction
+    4. JS_SetPropertyNumber   — array grow
+    5. JS_NewObject           — allocates record
+    6. JS_NewArray / JS_NewArrayLen — allocates array
+    7. js_new_register_function — allocates function object (closure)
+    8. alloc_frame_register   — allocates frame via js_mallocz
+    9. js_call_c_function     — arbitrary C code
+   10. JS_CallInternal        — arbitrary bytecode
+   11. JS_Call                — arbitrary call
+   12. JS_ConcatString        — allocates new string
+   13. JS_ArrayPush           — array grow
+   14. JS_ArrayPop            — reads, but frame refresh needed
+   15. JS_DeleteProperty      — mutates record
+   16. JS_HasProperty         — complex traversal
+   17. js_regexp_constructor  — allocates regex
+   18. reg_vm_binop           — polymorphic dispatch (legacy opcodes)
+
+   Opcode-level classification:
+     [P] LOADK, LOADI, LOADNULL, LOADTRUE, LOADFALSE, MOVE, NOP
+     [P] ADD_INT..MOD_INT, NEG_INT, ADD_FLOAT..MOD_FLOAT, NEG_FLOAT
+     [P] EQ_INT..GE_INT, EQ_FLOAT..GE_FLOAT, EQ_BOOL, NE_BOOL
+     [P] IS_IDENTICAL, IS_INT, IS_NUM, IS_TEXT, IS_BOOL, IS_NULL
+     [P] IS_ARRAY, IS_FUNC, IS_RECORD, IS_STONE, IS_PROXY
+     [P] NOT, AND, OR, BITNOT, BITAND, BITOR, BITXOR
+     [P] JMP, JMPTRUE, JMPFALSE, JMPNULL, JMPNOTNULL
+     [P] RETURN, RETNIL, SETARG, GETUP, SETUP, DISRUPT, THROW
+     [P] LENGTH (array + imm-ASCII fast path only; text/blob fallback is [G])
+     [N] EQ_TEXT..GE_TEXT (js_string_compare_value — no allocation)
+     [N] LNOT (JS_ToBool — no allocation)
+     [G] ADD..USHR, NEG, INC, DEC, EQ..GE (legacy: reg_vm_binop)
+     [G] EQ_TOL, NEQ_TOL (tolerance comparison, may fall back)
+     [G] CONCAT (JS_ConcatString)
+     [G] GETFIELD, SETFIELD, GETINDEX, SETINDEX (property access)
+     [G] LOAD_FIELD, STORE_FIELD, LOAD_INDEX, STORE_INDEX
+     [G] LOAD_DYNAMIC, STORE_DYNAMIC
+     [G] GETNAME, GETINTRINSIC, GETENV, SET_VAR
+     [G] NEWOBJECT, NEWRECORD, NEWARRAY (object/array creation)
+     [G] CLOSURE (js_new_register_function)
+     [G] FRAME, GOFRAME (alloc_frame_register)
+     [G] INVOKE, GOINVOKE (function calls)
+     [G] PUSH (JS_ArrayPush), POP (JS_ArrayPop)
+     [G] DELETE, DELETEINDEX (JS_DeleteProperty)
+     [G] HASPROP, IN (JS_HasProperty)
+     [G] REGEXP (js_regexp_constructor)
+   ============================================================ */
+
 typedef enum MachOpcode {
   /* === Legacy opcodes (used by existing .mach files) === */
 
@@ -494,22 +556,6 @@ typedef enum MachOpcode {
 
   /* === New mcode-derived opcodes (1:1 mapping to mcode IR) === */
 
-  /* Typed integer arithmetic (ABC) */
-  MACH_ADD_INT,       /* R(A) = R(B) + R(C) — int, overflow → float */
-  MACH_SUB_INT,       /* R(A) = R(B) - R(C) — int */
-  MACH_MUL_INT,       /* R(A) = R(B) * R(C) — int */
-  MACH_DIV_INT,       /* R(A) = R(B) / R(C) — int */
-  MACH_MOD_INT,       /* R(A) = R(B) % R(C) — int */
-  MACH_NEG_INT,       /* R(A) = -R(B) — int (AB) */
-
-  /* Typed float arithmetic (ABC) */
-  MACH_ADD_FLOAT,     /* R(A) = R(B) + R(C) — float */
-  MACH_SUB_FLOAT,     /* R(A) = R(B) - R(C) — float */
-  MACH_MUL_FLOAT,     /* R(A) = R(B) * R(C) — float */
-  MACH_DIV_FLOAT,     /* R(A) = R(B) / R(C) — float */
-  MACH_MOD_FLOAT,     /* R(A) = R(B) % R(C) — float */
-  MACH_NEG_FLOAT,     /* R(A) = -R(B) — float (AB) */
-
   /* Text */
   MACH_CONCAT,        /* R(A) = R(B) ++ R(C) — string concatenation */
 
@@ -550,7 +596,6 @@ typedef enum MachOpcode {
   MACH_IS_TEXT,       /* R(A) = is_text(R(B)) */
   MACH_IS_BOOL,       /* R(A) = is_bool(R(B)) */
   MACH_IS_NULL,       /* R(A) = is_null(R(B)) */
-  MACH_TYPEOF,        /* R(A) = typeof(R(B)) */
 
   /* Logical (mcode-style) */
   MACH_NOT,           /* R(A) = !R(B) — boolean not (AB) */
@@ -592,7 +637,13 @@ typedef enum MachOpcode {
 
   /* Misc */
   MACH_IN,            /* R(A) = (R(B) in R(C)) — has property (ABC) */
+
+  /* Extended type checks (AB) */
+  MACH_IS_ARRAY,      /* R(A) = is_array(R(B)) */
   MACH_IS_FUNC,       /* R(A) = is_function(R(B)) */
+  MACH_IS_RECORD,     /* R(A) = is_object(R(B)) */
+  MACH_IS_STONE,      /* R(A) = is_stone(R(B)) */
+  MACH_LENGTH,        /* R(A) = length(R(B)) — array/text/blob length */
   MACH_IS_PROXY,      /* R(A) = is_function(R(B)) && R(B).length == 2 */
 
   MACH_OP_COUNT
@@ -658,18 +709,6 @@ static const char *mach_opcode_names[MACH_OP_COUNT] = {
   [MACH_NEQ_TOL] = "neq_tol",
   [MACH_NOP] = "nop",
   /* Mcode-derived */
-  [MACH_ADD_INT] = "add_int",
-  [MACH_SUB_INT] = "sub_int",
-  [MACH_MUL_INT] = "mul_int",
-  [MACH_DIV_INT] = "div_int",
-  [MACH_MOD_INT] = "mod_int",
-  [MACH_NEG_INT] = "neg_int",
-  [MACH_ADD_FLOAT] = "add_float",
-  [MACH_SUB_FLOAT] = "sub_float",
-  [MACH_MUL_FLOAT] = "mul_float",
-  [MACH_DIV_FLOAT] = "div_float",
-  [MACH_MOD_FLOAT] = "mod_float",
-  [MACH_NEG_FLOAT] = "neg_float",
   [MACH_CONCAT] = "concat",
   [MACH_EQ_INT] = "eq_int",
   [MACH_NE_INT] = "ne_int",
@@ -697,7 +736,6 @@ static const char *mach_opcode_names[MACH_OP_COUNT] = {
   [MACH_IS_TEXT] = "is_text",
   [MACH_IS_BOOL] = "is_bool",
   [MACH_IS_NULL] = "is_null",
-  [MACH_TYPEOF] = "typeof",
   [MACH_NOT] = "not",
   [MACH_AND] = "and",
   [MACH_OR] = "or",
@@ -721,7 +759,12 @@ static const char *mach_opcode_names[MACH_OP_COUNT] = {
   [MACH_DISRUPT] = "disrupt",
   [MACH_SET_VAR] = "set_var",
   [MACH_IN] = "in",
+  /* Extended type checks */
+  [MACH_IS_ARRAY] = "is_array",
   [MACH_IS_FUNC] = "is_func",
+  [MACH_IS_RECORD] = "is_record",
+  [MACH_IS_STONE] = "is_stone",
+  [MACH_LENGTH] = "length",
   [MACH_IS_PROXY] = "is_proxy",
 };
 
@@ -754,37 +797,17 @@ typedef struct JSCodeRegister {
 } JSCodeRegister;
 
 
-/* Frame for closures - used by link-time relocation model where closures
-   reference outer frames via (depth, slot) addressing.
-   Stores function as JSValue to survive GC movements. */
+/* Unified frame struct — used by the register VM and closures.
+   All fields are JSValues so the GC can scan them uniformly. */
 typedef struct JSFrame {
   objhdr_t header;           /* OBJ_FRAME, cap56 = slot count */
-  JSValue function;          /* JSValue for GC safety (use JS_VALUE_GET_FUNCTION) */
-  JSValue caller;            /* JSValue for GC safety (unused currently) */
-  uint32_t return_pc;
+  JSValue function;          /* JSFunction, function object being invoked */
+  JSValue caller;            /* JSFrame, the frame that called this one */
+  JSValue address;           /* return PC stored as JS_NewInt32 */
   JSValue slots[];           /* [this][args][captured][locals][temps] */
 } JSFrame;
 
-/* Execution state returned by vm_execute_frame */
-typedef enum {
-  VM_EXEC_NORMAL,    /* Continue executing current frame */
-  VM_EXEC_RETURN,    /* Frame returned, pop and resume caller */
-  VM_EXEC_CALL,      /* Need to push new frame for call */
-  VM_EXEC_EXCEPTION, /* Exception thrown, unwind frames */
-} VMExecState;
-
-/* Call info for frame push */
-typedef struct {
-  JSValue func_obj;
-  JSValue this_obj;
-  int argc;
-  JSValue *argv;
-  const uint8_t *ret_pc;
-  int ret_sp_offset;
-  int call_argc;
-  int call_has_this;
-  int is_tail_call;
-} VMCallInfo;
+typedef JSFrame JSFrameRegister;
 
 static inline objhdr_t objhdr_set_s (objhdr_t h, bool s) {
   return s ? (h | OBJHDR_S_MASK) : (h & ~OBJHDR_S_MASK);
@@ -815,6 +838,38 @@ static inline objhdr_t *chase(JSValue v) {
   return oh;
 }
 
+/* Inline type checks — use these in the VM dispatch loop to avoid
+   function call overhead. The public API (JS_IsArray etc. in quickjs.h)
+   remains non-inline for external callers; those wrappers live in runtime.c. */
+
+static inline JS_BOOL mist_is_gc_object(JSValue v) {
+  return JS_IsPtr(v);
+}
+
+static inline JS_BOOL mist_is_array(JSValue v) {
+  return mist_is_gc_object(v) && objhdr_type(*chase(v)) == OBJ_ARRAY;
+}
+
+static inline JS_BOOL mist_is_record(JSValue v) {
+  return mist_is_gc_object(v) && objhdr_type(*chase(v)) == OBJ_RECORD;
+}
+
+static inline JS_BOOL mist_is_function(JSValue v) {
+  return mist_is_gc_object(v) && objhdr_type(*chase(v)) == OBJ_FUNCTION;
+}
+
+static inline JS_BOOL mist_is_text(JSValue v) {
+  return MIST_IsImmediateASCII(v)
+    || (mist_is_gc_object(v) && objhdr_type(*chase(v)) == OBJ_TEXT);
+}
+
+static inline JS_BOOL mist_is_blob(JSValue v) {
+  return mist_is_gc_object(v) && objhdr_type(*chase(v)) == OBJ_BLOB;
+}
+
+static inline JS_BOOL mist_is_stone(JSValue v) {
+  return !mist_is_gc_object(v) || objhdr_s(*chase(v));
+}
 
 /* Intrinsic array type - tagged as JS_TAG_PTR with mist_hdr type OBJ_ARRAY */
 typedef struct JSArray {
@@ -823,7 +878,8 @@ typedef struct JSArray {
   JSValue values[];               /* inline flexible array member */
 } JSArray;
 
-/* JSBlob - binary data per memory.md */
+/* JSBlob — not allocated on GC heap (blobs use JSRecord + opaque).
+   Struct kept for reference; gc_object_size/gc_scan_object do not handle OBJ_BLOB. */
 typedef struct JSBlob {
   objhdr_t mist_hdr;
   word_t length;
@@ -846,7 +902,7 @@ typedef slot JSRecordEntry;
 
 typedef struct JSRecord {
   objhdr_t mist_hdr;
-  struct JSRecord *proto;
+  JSValue proto;                  /* prototype as JSValue (JS_NULL if none) */
   word_t len;                     /* number of entries */
   slot slots[]; /* slots[0] reserved: key low32=class_id, key high32=rec_id, val=opaque */
 } JSRecord;
@@ -991,6 +1047,13 @@ static JS_BOOL JSText_equal_ascii (const JSText *text, JSValue imm) {
    enough to call the interrupt callback often. */
 #define JS_INTERRUPT_COUNTER_INIT 10000
 
+/* Auto-rooted C call argv — GC updates values in-place */
+typedef struct CCallRoot {
+  JSValue *argv;          /* points to C-stack-local array */
+  int argc;
+  struct CCallRoot *prev; /* stack for nesting (C -> JS -> C -> ...) */
+} CCallRoot;
+
 struct JSContext {
   JSRuntime *rt;
 
@@ -1001,18 +1064,18 @@ struct JSContext {
   size_t current_block_size; /* current block size (64KB initially) */
   size_t next_block_size;    /* doubles if <10% recovered after GC */
 
-  /* Stone arena - permanent immutable allocations */
-  uint8_t *stone_base;       /* stone arena base */
-  uint8_t *stone_free;       /* stone arena bump pointer */
-  uint8_t *stone_end;        /* stone arena end */
+  /* Constant text pool — compilation constants */
+  uint8_t *ct_base;              /* pool base */
+  uint8_t *ct_free;              /* pool bump pointer */
+  uint8_t *ct_end;               /* pool end */
 
-  /* Stone text intern table */
-  void *st_pages;            /* stone page list for large allocations */
-  uint32_t *st_text_hash;    /* hash table (slot -> id) */
-  JSText **st_text_array;    /* array of JSText pointers indexed by id */
-  uint32_t st_text_size;     /* hash table size (power of 2) */
-  uint32_t st_text_count;    /* number of interned texts */
-  uint32_t st_text_resize;   /* threshold for resize */
+  /* Constant text intern table */
+  void *ct_pages;                /* page list for large allocations */
+  uint32_t *ct_hash;             /* hash table (slot -> id) */
+  JSText **ct_array;             /* array of JSText pointers indexed by id */
+  uint32_t ct_size;              /* hash table size (power of 2) */
+  uint32_t ct_count;             /* number of interned texts */
+  uint32_t ct_resize_threshold;  /* threshold for resize */
 
   uint16_t binary_object_count;
   int binary_object_size;
@@ -1022,6 +1085,7 @@ struct JSContext {
 
   JSGCRef *top_gc_ref;  /* used to reference temporary GC roots (stack top) */
   JSGCRef *last_gc_ref; /* used to reference temporary GC roots (list) */
+  CCallRoot *c_call_root; /* stack of auto-rooted C call argv arrays */
 
   int class_count; /* size of class_array and class_proto */
   JSClass *class_array;
@@ -1057,9 +1121,6 @@ struct JSContext {
   // todo: want this, but should be a simple increment/decrement counter while frames are pushed
   size_t stack_depth;
   size_t stack_limit;
-
-  /* Parser state (for GC to scan cpool during parsing) */
-  struct JSFunctionDef *current_parse_fd;
 };
 
 /* ============================================================
@@ -1084,22 +1145,22 @@ static inline const char *JS_KeyGetStr (JSContext *ctx, char *buf, size_t buf_si
 
 
 /* ============================================================
-   Stone Arena Functions
+   Constant Text Pool Functions
    ============================================================ */
 
-/* Stone page for large allocations */
-typedef struct StonePage {
-  struct StonePage *next;
+/* Constant text page for large allocations */
+typedef struct CTPage {
+  struct CTPage *next;
   size_t size;
   uint8_t data[];
-} StonePage;
+} CTPage;
 
-/* Initial stone text table size */
-#define ST_TEXT_INITIAL_SIZE 256
+/* Initial constant text table size */
+#define CT_INITIAL_SIZE 256
 
-/* Allocate from stone arena (permanent, immutable memory) */
+/* Allocate from constant text pool */
 
-/* Resize the stone text intern hash table */
+/* Resize the constant text intern hash table */
 
 /* Realloc with slack reporting (for bump allocator)
    WARNING: This function is NOT GC-safe! The caller must protect the source
@@ -1115,9 +1176,9 @@ static int ctx_gc (JSContext *ctx, int allow_grow, size_t alloc_size);
 /* JS_MarkValue - mark a value during GC traversal.
    With copying GC, this is a no-op as we discover live objects by tracing. */
 
-/* Helper to check if a pointer is in stone memory */
-static inline int is_stone_ptr (JSContext *ctx, void *ptr) {
-  return (uint8_t *)ptr >= ctx->stone_base && (uint8_t *)ptr < ctx->stone_end;
+/* Helper to check if a pointer is in constant text pool memory */
+static inline int is_ct_ptr (JSContext *ctx, void *ptr) {
+  return (uint8_t *)ptr >= ctx->ct_base && (uint8_t *)ptr < ctx->ct_end;
 }
 
 /* Intern a UTF-32 string as a stone text, returning a JSValue string */
@@ -1157,7 +1218,7 @@ typedef struct JSRegExp {
 
 /* Get prototype from object (works for both JSRecord and JSRecord since they
  * share layout) */
-#define JS_OBJ_GET_PROTO(p) ((JSRecord *)((JSRecord *)(p))->proto)
+#define JS_OBJ_GET_PROTO(p) (JS_IsNull(((JSRecord *)(p))->proto) ? NULL : (JSRecord *)JS_VALUE_GET_PTR(((JSRecord *)(p))->proto))
 
 /* Initial capacity for new records (mask = 7, 8 slots total) */
 #define JS_RECORD_INITIAL_MASK 7
@@ -1226,11 +1287,6 @@ typedef struct JSFunction {
       uint8_t cproto;
       int16_t magic;
     } cfunc;
-    struct {
-      struct JSFunctionBytecode *function_bytecode;
-      JSValue outer_frame;      /* JSFrame JSValue, lexical parent for closures */
-      JSValue env_record;       /* stone record, module environment */
-    } func;
     struct {
       JSCodeRegister *code;     /* compiled register code (off-heap) */
       JSValue env_record;       /* stone record, module environment */
@@ -1239,150 +1295,11 @@ typedef struct JSFunction {
   } u;
 } JSFunction;
 
-typedef struct JSClosureVar {
-  uint8_t is_local : 1;
-  uint8_t is_arg : 1;
-  uint8_t is_const : 1;
-  uint8_t is_lexical : 1;
-  uint8_t var_kind : 4; /* see JSVarKindEnum */
-  /* 8 bits available */
-  uint16_t var_idx; /* is_local = TRUE: index to a normal variable of the
-                  parent function. otherwise: index to a closure
-                  variable of the parent function */
-  JSValue var_name;
-} JSClosureVar;
-
-#define ARG_SCOPE_INDEX 1
-#define ARG_SCOPE_END (-2)
-
-typedef struct JSVarScope {
-  int parent; /* index into fd->scopes of the enclosing scope */
-  int first;  /* index into fd->vars of the last variable in this scope */
-} JSVarScope;
-
-typedef enum {
-  /* XXX: add more variable kinds here instead of using bit fields */
-  JS_VAR_NORMAL,
-  JS_VAR_FUNCTION_DECL,     /* lexical var with function declaration */
-  JS_VAR_NEW_FUNCTION_DECL, /* lexical var with async/generator
-                               function declaration */
-  JS_VAR_CATCH,
-  JS_VAR_FUNCTION_NAME, /* function expression name */
-} JSVarKindEnum;
-
-/* XXX: could use a different structure in bytecode functions to save
-   memory */
-typedef struct JSVarDef {
-  JSValue var_name;
-  /* index into fd->scopes of this variable lexical scope */
-  int scope_level;
-  /* during compilation:
-      - if scope_level = 0: scope in which the variable is defined
-      - if scope_level != 0: index into fd->vars of the next
-        variable in the same or enclosing lexical scope
-     in a bytecode function:
-     index into fd->vars of the next
-     variable in the same or enclosing lexical scope
-  */
-  int scope_next;
-  uint8_t is_const : 1;
-  uint8_t is_lexical : 1;
-  uint8_t is_captured : 1;
-  uint8_t var_kind : 4; /* see JSVarKindEnum */
-  /* only used during compilation: function pool index for lexical
-     variables with var_kind =
-     JS_VAR_FUNCTION_DECL/JS_VAR_NEW_FUNCTION_DECL or scope level of
-     the definition of the 'var' variables (they have scope_level =
-     0) */
-  int func_pool_idx : 24; /* only used during compilation : index in
-                             the constant pool for hoisted function
-                             definition */
-} JSVarDef;
-
-/* for the encoding of the pc2line table */
-#define PC2LINE_BASE (-1)
-#define PC2LINE_RANGE 5
-#define PC2LINE_OP_FIRST 1
-#define PC2LINE_DIFF_PC_MAX ((255 - PC2LINE_OP_FIRST) / PC2LINE_RANGE)
-
-typedef struct JSFunctionBytecode {
-  objhdr_t header; /* must come first */
-  uint8_t js_mode;
-  uint8_t has_prototype : 1; /* true if a prototype field is necessary */
-  uint8_t has_simple_parameter_list : 1;
-  uint8_t func_kind : 2;
-  uint8_t has_debug : 1;
-  uint8_t read_only_bytecode : 1;
-  uint8_t is_direct_or_indirect_eval
-    : 1; /* used by JS_GetScriptOrModuleName() */
-  /* XXX: 10 bits available */
-  uint8_t *byte_code_buf; /* (self pointer) */
-  int byte_code_len;
-  JSValue func_name;
-  JSVarDef *vardefs; /* arguments + local variables (arg_count + var_count)
-                        (self pointer) */
-  JSClosureVar
-    *closure_var; /* list of variables in the closure (self pointer) */
-  uint16_t arg_count;
-  uint16_t var_count;
-  uint16_t defined_arg_count; /* for length function property */
-  uint16_t stack_size;        /* maximum stack size */
-  JSValue *cpool;             /* constant pool (self pointer) */
-  int cpool_count;
-  int closure_var_count;
-  struct {
-    /* debug info, move to separate structure to save memory? */
-    JSValue filename;
-    int source_len;
-    int pc2line_len;
-    uint8_t *pc2line_buf;
-    char *source;
-  } debug;
-} JSFunctionBytecode;
-
-/* New simplified compiled unit structure for Phase 1+ simplification.
-   Replaces JSFunctionBytecode with a simpler model:
-   - No closure machinery (uses outer_frame chain at runtime)
-   - Free variables resolved at link time against env + globals
-   - Nested functions stored as separate units in cpool */
-typedef struct JSCompiledUnit {
-  objhdr_t header; /* must come first */
-
-  /* Bytecode (self pointer) */
-  uint8_t *byte_code_buf;
-  int byte_code_len;
-
-  /* Constants - strings, numbers, nested unit refs (self pointer) */
-  JSValue *cpool;
-  int cpool_count;
-
-  /* Stack requirements */
-  uint16_t local_count;  /* total local slots (args + vars) */
-  uint16_t stack_size;   /* operand stack depth */
-
-  /* Flags */
-  uint8_t has_debug : 1;
-  uint8_t read_only_bytecode : 1;
-
-  /* Debug info (optional - only present if has_debug) */
-  struct {
-    JSValue filename;
-    int source_len;
-    int pc2line_len;
-    uint8_t *pc2line_buf;
-    char *source;
-  } debug;
-} JSCompiledUnit;
-
 /* ============================================================
    Context-Neutral Module Format (Phase 2+)
    Struct definitions are in quickjs.h
    ============================================================ */
 
-typedef struct JSProperty {
-  JSValue value;
-} JSProperty;
-
 #define JS_PROP_INITIAL_SIZE 2
 #define JS_PROP_INITIAL_HASH_SIZE 4 /* must be a power of two */
 #define JS_ARRAY_INITIAL_SIZE 2
@@ -1395,7 +1312,6 @@ typedef struct JSProperty {
 #endif
 
 JSValue js_call_c_function (JSContext *ctx, JSValue func_obj, JSValue this_obj, int argc, JSValue *argv);
-JSValue js_call_bound_function (JSContext *ctx, JSValue func_obj, JSValue this_obj, int argc, JSValue *argv);
 JSValue JS_CallInternal (JSContext *ctx, JSValue func_obj, JSValue this_obj, int argc, JSValue *argv, int flags);
 JSValue JS_CallRegisterVM(JSContext *ctx, JSCodeRegister *code, JSValue this_obj, int argc, JSValue *argv, JSValue env, JSValue outer_frame);
 int JS_DeleteProperty (JSContext *ctx, JSValue obj, JSValue prop);
@@ -1410,17 +1326,9 @@ void js_dump_value_write (void *opaque, const char *buf, size_t len);
 void js_regexp_finalizer (JSRuntime *rt, JSValue val);
 JSValue js_new_function (JSContext *ctx, JSFunctionKind kind);
 
-/* Forward declarations for intrinsics (now declared in quickjs.h) */
-
 /* Forward declaration - helper to set cap in objhdr */
 static inline objhdr_t objhdr_set_cap56 (objhdr_t h, uint64_t cap);
 
-/* JS_VALUE_GET_STRING is an alias for getting JSText from a string value */
-/* Note: Uses chase() for GC safety - already defined at line 293 */
-
-/* JS_ThrowMemoryError is an alias for JS_ThrowOutOfMemory */
-#define JS_ThrowMemoryError(ctx) JS_ThrowOutOfMemory(ctx)
-
 /* GC-SAFE: JS_SetPropertyInternal: same as JS_SetProperty but doesn't check stone.
    Internal use only. May trigger GC if record needs to resize. */
 
@@ -1600,118 +1508,6 @@ static inline __exception int js_poll_interrupts (JSContext *ctx) {
   }
 }
 
-/* === Token enum (shared by parser, tokenizer, AST) === */
-enum {
-  TOK_NUMBER = -128,
-  TOK_STRING,
-  TOK_TEMPLATE,
-  TOK_IDENT,
-  TOK_REGEXP,
-  /* warning: order matters (see js_parse_assign_expr) */
-  TOK_MUL_ASSIGN,
-  TOK_DIV_ASSIGN,
-  TOK_MOD_ASSIGN,
-  TOK_PLUS_ASSIGN,
-  TOK_MINUS_ASSIGN,
-  TOK_SHL_ASSIGN,
-  TOK_SAR_ASSIGN,
-  TOK_SHR_ASSIGN,
-  TOK_AND_ASSIGN,
-  TOK_XOR_ASSIGN,
-  TOK_OR_ASSIGN,
-  TOK_POW_ASSIGN,
-  TOK_LAND_ASSIGN,
-  TOK_LOR_ASSIGN,
-  TOK_DEC,
-  TOK_INC,
-  TOK_SHL,
-  TOK_SAR,
-  TOK_SHR,
-  TOK_LT,
-  TOK_LTE,
-  TOK_GT,
-  TOK_GTE,
-  TOK_EQ,
-  TOK_STRICT_EQ,
-  TOK_NEQ,
-  TOK_STRICT_NEQ,
-  TOK_LAND,
-  TOK_LOR,
-  TOK_POW,
-  TOK_ARROW,
-  TOK_ERROR,
-  TOK_PRIVATE_NAME,
-  TOK_EOF,
-  /* whitespace/comment tokens for tokenizer */
-  TOK_COMMENT,
-  TOK_NEWLINE,
-  TOK_SPACE,
-  /* keywords: WARNING: same order as atoms */
-  TOK_NULL, /* must be first */
-  TOK_FALSE,
-  TOK_TRUE,
-  TOK_IF,
-  TOK_ELSE,
-  TOK_RETURN,
-  TOK_GO,
-  TOK_VAR,
-  TOK_DEF,
-  TOK_THIS,
-  TOK_DELETE,
-  TOK_IN,
-  TOK_DO,
-  TOK_WHILE,
-  TOK_FOR,
-  TOK_BREAK,
-  TOK_CONTINUE,
-  TOK_DISRUPT,
-  TOK_DISRUPTION,
-  TOK_FUNCTION,
-  TOK_DEBUGGER,
-  TOK_WITH,
-  /* FutureReservedWord */
-  TOK_CLASS,
-  TOK_CONST,
-  TOK_ENUM,
-  TOK_EXPORT,
-  TOK_EXTENDS,
-  TOK_IMPORT,
-  TOK_SUPER,
-  /* FutureReservedWords when parsing strict mode code */
-  TOK_IMPLEMENTS,
-  TOK_INTERFACE,
-  TOK_LET,
-  TOK_PRIVATE,
-  TOK_PROTECTED,
-  TOK_PUBLIC,
-  TOK_STATIC,
-  TOK_YIELD,
-  TOK_AWAIT, /* must be last */
-  TOK_OF,    /* only used for js_parse_skip_parens_token() */
-};
-
-#define TOK_FIRST_KEYWORD TOK_NULL
-#define TOK_LAST_KEYWORD TOK_AWAIT
-
-/* unicode code points */
-#define CP_NBSP 0x00a0
-#define CP_BOM 0xfeff
-
-#define CP_LS 0x2028
-#define CP_PS 0x2029
-
-
-/* === Line/column cache === */
-typedef struct {
-  /* last source position */
-  const uint8_t *ptr;
-  int line_num;
-  int col_num;
-  const uint8_t *buf_start;
-} GetLineColCache;
-
-
-
 /* === PPretext (parser pretext, system-malloc, used by cell_js.c parser) === */
 typedef struct PPretext {
   uint32_t *data;
@@ -1719,8 +1515,6 @@ typedef struct PPretext {
   int cap;
 } PPretext;
 
-#define JS_CALL_FLAG_COPY_ARGV (1 << 1)
-
 extern JSClassID js_class_id_alloc;
 
 /* === Forward declarations for functions split across modules === */
@@ -1728,16 +1522,8 @@ extern JSClassID js_class_id_alloc;
 /* runtime.c — line/column, GC, and VM dispatch */
 int ctx_gc (JSContext *ctx, int allow_grow, size_t alloc_size);
 JSValue JS_CallInternal (JSContext *ctx, JSValue func_obj, JSValue this_obj, int argc, JSValue *argv, int flags);
-int get_line_col (int *pcol_num, const uint8_t *buf, size_t len);
-int get_line_col_cached (GetLineColCache *s, int *pcol_num, const uint8_t *ptr);
 
 /* runtime.c exports */
-JSValue JS_ThrowStackOverflow (JSContext *ctx);
-int JS_DefineObjectName (JSContext *ctx, JSValue obj, JSValue name);
-int JS_DefineObjectNameComputed (JSContext *ctx, JSValue obj, JSValue str);
-int js_method_set_properties (JSContext *ctx, JSValue func_obj, JSValue name, int flags, JSValue home_obj);
-JSValue JS_GetPropertyValue (JSContext *ctx, JSValue this_obj, JSValue prop);
-__exception int JS_CopyDataProperties (JSContext *ctx, JSValue target, JSValue source, JSValue excluded, BOOL setprop);
 int js_string_compare_value (JSContext *ctx, JSValue op1, JSValue op2, BOOL eq_only);
 int js_string_compare_value_nocase (JSContext *ctx, JSValue op1, JSValue op2);
 JSValue js_regexp_constructor (JSContext *ctx, JSValue this_val, int argc, JSValue *argv);
@@ -1746,20 +1532,15 @@ int JS_HasPropertyKey (JSContext *ctx, JSValue obj, JSValue key);
 void *js_realloc_rt (void *ptr, size_t size);
 char *js_strdup_rt (const char *str);
 JSValue JS_ConcatString (JSContext *ctx, JSValue op1, JSValue op2);
-__exception int js_post_inc_slow (JSContext *ctx, JSValue *sp, OPCodeEnum op);
-no_inline int js_not_slow (JSContext *ctx, JSValue *sp);
-no_inline int js_relational_slow (JSContext *ctx, JSValue *sp, OPCodeEnum op);
-__exception int js_operator_in (JSContext *ctx, JSValue *sp);
-__exception int js_operator_delete (JSContext *ctx, JSValue *sp);
 JSText *pretext_init (JSContext *ctx, int capacity);
 JSText *pretext_putc (JSContext *ctx, JSText *s, uint32_t c);
 JSText *pretext_concat_value (JSContext *ctx, JSText *s, JSValue v);
 JSValue js_new_blob (JSContext *ctx, blob *b);
 /* Functions from header region (defined in runtime.c) */
 void *js_realloc (JSContext *ctx, void *ptr, size_t size);
-void *st_alloc (JSContext *ctx, size_t bytes, size_t align);
-void st_free_all (JSContext *ctx);
-int st_text_resize (JSContext *ctx);
+void *ct_alloc (JSContext *ctx, size_t bytes, size_t align);
+void ct_free_all (JSContext *ctx);
+int ct_resize (JSContext *ctx);
 JSValue intern_text_to_value (JSContext *ctx, const uint32_t *utf32, uint32_t len);
 JSValue js_key_new (JSContext *ctx, const char *str);
 JSValue js_key_new_len (JSContext *ctx, const char *str, size_t len);
@@ -1776,19 +1557,6 @@ uint64_t get_text_hash (JSText *text);
 void pack_utf32_to_words (const uint32_t *utf32, uint32_t len, uint64_t *packed);
 int text_equal (JSText *a, const uint64_t *packed_b, uint32_t len_b);
 
-static inline JSValue *get_upvalue_ptr (JSValue frame_val, int depth, int slot) {
-  if (JS_IsNull(frame_val)) return NULL;
-  JSFrame *frame = JS_VALUE_GET_FRAME(frame_val);
-  while (depth > 0) {
-    JSFunction *fn = JS_VALUE_GET_FUNCTION(frame->function);
-    frame_val = fn->u.func.outer_frame;
-    if (JS_IsNull(frame_val)) return NULL;
-    frame = JS_VALUE_GET_FRAME(frame_val);
-    depth--;
-  }
-  return &frame->slots[slot];
-}
-
 void print_backtrace (JSContext *ctx, const char *filename, int line_num, int col_num);
 JSValue JS_ThrowError2 (JSContext *ctx, JSErrorEnum error_num, const char *fmt, va_list ap, BOOL add_backtrace);
 JSValue gc_copy_value (JSContext *ctx, JSValue v, uint8_t *from_base, uint8_t *from_end, uint8_t *to_base, uint8_t **to_free, uint8_t *to_end);
@@ -1800,10 +1568,6 @@ PPretext *ppretext_append_jsvalue (PPretext *p, JSValue str);
 PPretext *ppretext_append_int (PPretext *p, int n);
 JSValue js_atof (JSContext *ctx, const char *str, const char **pp, int radix, int flags);
 
-/* Defines from runtime section needed by cell_js.c */
-#define DEFINE_GLOBAL_LEX_VAR (1 << 7)
-#define DEFINE_GLOBAL_FUNC_VAR (1 << 6)
-
 #define ATOD_INT_ONLY (1 << 0)
 /* accept Oo and Ob prefixes in addition to 0x prefix if radix = 0 */
 #define ATOD_ACCEPT_BIN_OCT (1 << 2)
@@ -1820,14 +1584,6 @@ JSValue js_atof (JSContext *ctx, const char *str, const char **pp, int radix, in
 /* accept -0x1 */
 #define ATOD_ACCEPT_PREFIX_AFTER_SIGN (1 << 10)
 
-#define GLOBAL_VAR_OFFSET 0x40000000
-#define ARGUMENT_VAR_OFFSET 0x20000000
-
-/* Inline functions from runtime section needed by cell_js.c */
-static inline void js_dbuf_init (JSContext *ctx, DynBuf *s) {
-  dbuf_init2 (s, ctx->rt, NULL);
-}
-
 static inline int to_digit (int c) {
   if (c >= '0' && c <= '9') return c - '0';
   else if (c >= 'A' && c <= 'Z') return c - 'A' + 10;
@@ -1835,54 +1591,6 @@ static inline int to_digit (int c) {
   else return 36;
 }
 
-static inline void dbuf_put_leb128 (DynBuf *s, uint32_t v) {
-  uint32_t a;
-  for (;;) {
-    a = v & 0x7f;
-    v >>= 7;
-    if (v != 0) {
-      dbuf_putc (s, a | 0x80);
-    } else {
-      dbuf_putc (s, a);
-      break;
-    }
-  }
-}
-
-static inline void dbuf_put_sleb128 (DynBuf *s, int32_t v1) {
-  uint32_t v = v1;
-  dbuf_put_leb128 (s, (2 * v) ^ -(v >> 31));
-}
-
-static inline int get_leb128 (uint32_t *pval, const uint8_t *buf, const uint8_t *buf_end) {
-  const uint8_t *ptr = buf;
-  uint32_t v, a, i;
-  v = 0;
-  for (i = 0; i < 5; i++) {
-    if (unlikely (ptr >= buf_end)) break;
-    a = *ptr++;
-    v |= (a & 0x7f) << (i * 7);
-    if (!(a & 0x80)) {
-      *pval = v;
-      return ptr - buf;
-    }
-  }
-  *pval = 0;
-  return -1;
-}
-
-static inline int get_sleb128 (int32_t *pval, const uint8_t *buf, const uint8_t *buf_end) {
-  int ret;
-  uint32_t val;
-  ret = get_leb128 (&val, buf, buf_end);
-  if (ret < 0) {
-    *pval = 0;
-    return -1;
-  }
-  *pval = (val >> 1) ^ -(val & 1);
-  return ret;
-}
-
 no_inline int js_realloc_array (JSContext *ctx, void **parray, int elem_size, int *psize, int req_size);
 static inline int js_resize_array (JSContext *ctx, void **parray, int elem_size, int *psize, int req_size) {
   if (unlikely (req_size > *psize))
@@ -1897,7 +1605,6 @@ JSValue js_key_from_string (JSContext *ctx, JSValue val);
 /* mach.c exports */
 JSValue JS_CallRegisterVM(JSContext *ctx, JSCodeRegister *code, JSValue this_obj, int argc, JSValue *argv, JSValue env, JSValue outer_frame);
 JSFrameRegister *alloc_frame_register(JSContext *ctx, int slot_count);
-cJSON *mach_find_scope_record(cJSON *scopes, int function_nr);
 int reg_vm_check_interrupt(JSContext *ctx);
 
 

source/quickjs.h

@@ -92,7 +92,6 @@ static inline int objhdr_s (objhdr_t h) { return (h & OBJHDR_S_MASK) != 0; }
 typedef struct JSRuntime JSRuntime; // the entire VM
 typedef struct JSContext JSContext; // Each actor
 typedef struct JSClass JSClass;
-typedef struct JSFunctionBytecode JSFunctionBytecode;
 typedef uint32_t JSClassID;
 
 /* Forward declaration - JSGCRef moved after JSValue definition */
@@ -284,13 +283,6 @@ JS_IsShortFloat (JSValue v) {
 #define JS_TRUE ((JSValue)(JS_TAG_BOOL | (1 << 5)))
 #define JS_EXCEPTION ((JSValue)JS_TAG_EXCEPTION)
 
-/* flags for object properties - simplified model:
-   - No per-property writable/configurable (use stone() for immutability)
-   - Text keys are enumerable, object keys are not */
-#define JS_PROP_TMASK (3 << 4) /* mask for NORMAL, VARREF */
-#define JS_PROP_NORMAL (0 << 4)
-#define JS_PROP_VARREF (2 << 4) /* used internally for closures */
-
 #ifndef JS_DEFAULT_STACK_SIZE
 #define JS_DEFAULT_STACK_SIZE (1024 * 1024)
 #endif
@@ -306,49 +298,34 @@ typedef JSValue JSCFunctionData (JSContext *ctx, JSValue this_val,
                                  int argc, JSValue *argv, int magic,
                                  JSValue *data);
 
-JSValue JS_Stone (JSContext *ctx, JSValue this_val);
+/* ============================================================
+   1. Runtime / Context Lifecycle
+   ============================================================ */
 
 JSRuntime *JS_NewRuntime (void);
-/* info lifetime must exceed that of rt */
+void JS_FreeRuntime (JSRuntime *rt);
 void JS_SetMemoryLimit (JSRuntime *rt, size_t limit);
+
+JSContext *JS_NewContext (JSRuntime *rt);
+JSContext *JS_NewContextWithHeapSize (JSRuntime *rt, size_t heap_size);
+void JS_FreeContext (JSContext *s);
+void *JS_GetContextOpaque (JSContext *ctx);
+void JS_SetContextOpaque (JSContext *ctx, void *opaque);
+JSRuntime *JS_GetRuntime (JSContext *ctx);
 /* use 0 to disable maximum stack size check */
 void JS_SetMaxStackSize (JSContext *ctx, size_t stack_size);
 /* should be called when changing thread to update the stack top value
    used to check stack overflow. */
 void JS_UpdateStackTop (JSContext *ctx);
-void JS_FreeRuntime (JSRuntime *rt);
+
+/* return != 0 if the JS code needs to be interrupted */
+typedef int JSInterruptHandler (JSRuntime *rt, void *opaque);
+void JS_SetInterruptHandler (JSContext *ctx, JSInterruptHandler *cb,
+                             void *opaque);
+
 JS_BOOL JS_IsLiveObject (JSRuntime *rt, JSValue obj);
 
-JSContext *JS_NewContext (JSRuntime *rt);
-void JS_FreeContext (JSContext *s);
-JSContext *JS_DupContext (JSContext *ctx);
-JSContext *JS_GetContext (JSRuntime *rt);
-void *JS_GetContextOpaque (JSContext *ctx);
-void JS_SetContextOpaque (JSContext *ctx, void *opaque);
-JSRuntime *JS_GetRuntime (JSContext *ctx);
-void JS_SetClassProto (JSContext *ctx, JSClassID class_id, JSValue obj);
-JSValue JS_GetClassProto (JSContext *ctx, JSClassID class_id);
-
-JSContext *JS_NewContextWithHeapSize (JSRuntime *rt, size_t heap_size);
-
-typedef struct JSMemoryUsage {
-  int64_t malloc_size, malloc_limit, memory_used_size;
-  int64_t malloc_count;
-  int64_t memory_used_count;
-  int64_t str_count, str_size;
-  int64_t obj_count, obj_size;
-  int64_t prop_count, prop_size;
-  int64_t shape_count, shape_size;
-  int64_t js_func_count, js_func_size, js_func_code_size;
-  int64_t js_func_pc2line_count, js_func_pc2line_size;
-  int64_t c_func_count, array_count;
-  int64_t fast_array_count, fast_array_elements;
-  int64_t binary_object_count, binary_object_size;
-} JSMemoryUsage;
-
-void JS_ComputeMemoryUsage (JSRuntime *rt, JSMemoryUsage *s);
-void JS_DumpMemoryUsage (FILE *fp, const JSMemoryUsage *s, JSRuntime *rt);
-
+/* Class system */
 typedef void JSClassFinalizer (JSRuntime *rt, JSValue val);
 typedef JSValue JSClassCall (JSContext *ctx, JSValue func_obj,
                              JSValue this_val, int argc,
@@ -361,6 +338,7 @@ typedef struct JSClassDef {
 } JSClassDef;
 
 #define JS_INVALID_CLASS_ID 0
+extern JSClassID js_class_id_alloc;
 JSClassID JS_NewClassID (JSClassID *pclass_id);
 /* Returns the class ID if `v` is an object, otherwise returns
  * JS_INVALID_CLASS_ID. */
@@ -368,22 +346,12 @@ JSClassID JS_GetClassID (JSValue v);
 int JS_NewClass (JSContext *ctx, JSClassID class_id,
                  const JSClassDef *class_def);
 int JS_IsRegisteredClass (JSContext *ctx, JSClassID class_id);
-
-extern JSClassID js_class_id_alloc;
+void JS_SetClassProto (JSContext *ctx, JSClassID class_id, JSValue obj);
+JSValue JS_GetClassProto (JSContext *ctx, JSClassID class_id);
 
 /* ============================================================
-   Copying GC - No Reference Counting Needed
-   ============================================================
-   With a copying GC, reference counting is not needed since all live
-   objects are discovered by tracing from roots. These macros make
-   existing DupValue/FreeValue calls into no-ops.
+   2. Value Creation and Type Checks
    ============================================================ */
-#define JS_DupValue(ctx, v) (v)
-#define JS_FreeValue(ctx, v) ((void)0)
-#define JS_DupValueRT(rt, v) (v)
-#define JS_FreeValueRT(rt, v) ((void)0)
-
-/* value handling */
 
 static inline JSValue
 JS_NewBool (JSContext *ctx, JS_BOOL val) {
@@ -435,6 +403,7 @@ JS_NewFloat64 (JSContext *ctx, double d) {
   return __JS_NewFloat64 (ctx, d);
 }
 
+/* Inline type checks (immediate tags) */
 static inline JS_BOOL JS_IsNumber (JSValue v) {
   int tag = JS_VALUE_GET_TAG (v);
   return tag == JS_TAG_INT || JS_TAG_IS_FLOAT64 (tag);
@@ -452,7 +421,7 @@ static inline JS_BOOL JS_IsException (JSValue v) {
   return (JS_VALUE_GET_TAG (v) == JS_TAG_EXCEPTION);
 }
 
-/* Immediate String Helpers */
+/* Immediate ASCII string helpers */
 #define MIST_ASCII_MAX_LEN 7
 
 static inline JS_BOOL
@@ -480,17 +449,100 @@ static inline JSValue MIST_TryNewImmediateASCII (const char *str, size_t len) {
   return v;
 }
 
+/* Heap object type checks (non-inline — see mist_is_* in quickjs-internal.h
+   for inline versions used by the VM dispatch loop) */
 JS_BOOL JS_IsArray(JSValue v);
 JS_BOOL JS_IsRecord(JSValue v);
 #define JS_IsObject JS_IsRecord
 JS_BOOL JS_IsFunction(JSValue v);
 JS_BOOL JS_IsBlob(JSValue v);
 JS_BOOL JS_IsText(JSValue v);
-static JS_BOOL JS_IsStone(JSValue v);
+JS_BOOL JS_IsStone(JSValue v);
 
-// Fundamental
+/* ============================================================
+   3. GC References
+   ============================================================
+   With a copying GC, reference counting is not needed since all live
+   objects are discovered by tracing from roots. These macros make
+   existing DupValue/FreeValue calls into no-ops.
+   ============================================================ */
+#define JS_DupValue(ctx, v) (v)
+#define JS_FreeValue(ctx, v) ((void)0)
+#define JS_DupValueRT(rt, v) (v)
+#define JS_FreeValueRT(rt, v) ((void)0)
+
+/* ============================================================
+   4. Property Access
+   ============================================================ */
+
+JSValue JS_GetProperty (JSContext *ctx, JSValue this_obj, JSValue prop);
+int JS_SetProperty (JSContext *ctx, JSValue this_obj, JSValue prop, JSValue val);
+
+JSValue JS_GetPropertyStr (JSContext *ctx, JSValue this_obj, const char *prop);
+int JS_SetPropertyStr (JSContext *ctx, JSValue this_obj, const char *prop, JSValue val);
+
+JSValue JS_GetPropertyNumber (JSContext *ctx, JSValue this_obj, int idx);
+JSValue JS_SetPropertyNumber (JSContext *ctx, JSValue obj, int idx, JSValue val);
+
+JSValue JS_GetPrototype (JSContext *ctx, JSValue val);
+JSValue JS_GetOwnPropertyNames (JSContext *ctx, JSValue obj);
 int JS_GetLength (JSContext *ctx, JSValue obj, int64_t *pres);
 
+void JS_SetOpaque (JSValue obj, void *opaque);
+void *JS_GetOpaque (JSValue obj, JSClassID class_id);
+void *JS_GetOpaque2 (JSContext *ctx, JSValue obj, JSClassID class_id);
+void *JS_GetAnyOpaque (JSValue obj, JSClassID *class_id);
+
+/* ============================================================
+   5. Object / Array / String Creation
+   ============================================================ */
+
+JSValue JS_NewObjectProtoClass (JSContext *ctx, JSValue proto, JSClassID class_id);
+JSValue JS_NewObjectClass (JSContext *ctx, int class_id);
+JSValue JS_NewObjectProto (JSContext *ctx, JSValue proto);
+JSValue JS_NewObject (JSContext *ctx);
+
+JSValue JS_NewArray (JSContext *ctx);
+JSValue JS_NewArrayLen (JSContext *ctx, uint32_t len);
+JSValue JS_NewArrayFrom (JSContext *ctx, int count, JSValue *values);
+int JS_ArrayPush (JSContext *ctx, JSValue *arr_ptr, JSValue val);
+JSValue JS_ArrayPop (JSContext *ctx, JSValue obj);
+
+JSValue JS_NewStringLen (JSContext *ctx, const char *str1, size_t len1);
+static inline JSValue JS_NewString (JSContext *ctx, const char *str) {
+  return JS_NewStringLen (ctx, str, strlen (str));
+}
+
+/* ============================================================
+   6. Type Conversion
+   ============================================================ */
+
+int JS_ToBool (JSContext *ctx, JSValue val); /* return -1 for JS_EXCEPTION */
+int JS_ToInt32 (JSContext *ctx, int32_t *pres, JSValue val);
+static inline int JS_ToUint32 (JSContext *ctx, uint32_t *pres, JSValue val) {
+  return JS_ToInt32 (ctx, (int32_t *)pres, val);
+}
+int JS_ToInt64 (JSContext *ctx, int64_t *pres, JSValue val);
+int JS_ToFloat64 (JSContext *ctx, double *pres, JSValue val);
+
+JSValue JS_ToString (JSContext *ctx, JSValue val);
+JSValue JS_ToPropertyKey (JSContext *ctx, JSValue val);
+
+const char *JS_ToCStringLen2 (JSContext *ctx, size_t *plen, JSValue val1, JS_BOOL cesu8);
+static inline const char * JS_ToCStringLen (JSContext *ctx, size_t *plen, JSValue val1) {
+  return JS_ToCStringLen2 (ctx, plen, val1, 0);
+}
+static inline const char * JS_ToCString (JSContext *ctx, JSValue val1) {
+  return JS_ToCStringLen2 (ctx, NULL, val1, 0);
+}
+void JS_FreeCString (JSContext *ctx, const char *ptr);
+
+JS_BOOL JS_StrictEq (JSContext *ctx, JSValue op1, JSValue op2);
+
+/* ============================================================
+   7. Error Handling
+   ============================================================ */
+
 JSValue JS_Throw (JSContext *ctx, JSValue obj);
 JSValue JS_GetException (JSContext *ctx);
 JS_BOOL JS_HasException (JSContext *ctx);
@@ -506,45 +558,28 @@ JSValue __js_printf_like (2, 3)
   JS_ThrowInternalError (JSContext *ctx, const char *fmt, ...);
 JSValue JS_ThrowOutOfMemory (JSContext *ctx);
 
-// TODO: rename this to just "eq"
-JS_BOOL JS_StrictEq (JSContext *ctx, JSValue op1, JSValue op2);
+/* ============================================================
+   8. Function Creation and Invocation
+   ============================================================ */
 
-int JS_ToBool (JSContext *ctx, JSValue val); /* return -1 for JS_EXCEPTION */
-int JS_ToInt32 (JSContext *ctx, int32_t *pres, JSValue val);
-static inline int JS_ToUint32 (JSContext *ctx, uint32_t *pres, JSValue val) {
-  return JS_ToInt32 (ctx, (int32_t *)pres, val);
-}
-int JS_ToInt64 (JSContext *ctx, int64_t *pres, JSValue val);
-int JS_ToFloat64 (JSContext *ctx, double *pres, JSValue val);
-/* return an exception if 'val' is a Number */
+JSValue JS_Call (JSContext *ctx, JSValue func_obj, JSValue this_obj, int argc, JSValue *argv);
+JSValue JS_Stone (JSContext *ctx, JSValue this_val);
 
-JSValue JS_NewStringLen (JSContext *ctx, const char *str1, size_t len1);
-static inline JSValue JS_NewString (JSContext *ctx, const char *str) {
-  return JS_NewStringLen (ctx, str, strlen (str));
-}
-JSValue JS_ToString (JSContext *ctx, JSValue val);
-JSValue JS_ToPropertyKey (JSContext *ctx, JSValue val);
-const char *JS_ToCStringLen2 (JSContext *ctx, size_t *plen, JSValue val1, JS_BOOL cesu8);
-static inline const char * JS_ToCStringLen (JSContext *ctx, size_t *plen, JSValue val1) {
-  return JS_ToCStringLen2 (ctx, plen, val1, 0);
-}
-static inline const char * JS_ToCString (JSContext *ctx, JSValue val1) {
-  return JS_ToCStringLen2 (ctx, NULL, val1, 0);
-}
-void JS_FreeCString (JSContext *ctx, const char *ptr);
+/* JSON */
+/* 'buf' must be zero terminated i.e. buf[buf_len] = '\0'. */
+JSValue JS_ParseJSON (JSContext *ctx, const char *buf, size_t buf_len,
+                      const char *filename);
+#define JS_PARSE_JSON_EXT (1 << 0) /* allow extended JSON */
+JSValue JS_ParseJSON2 (JSContext *ctx, const char *buf, size_t buf_len,
+                       const char *filename, int flags);
+JSValue JS_JSONStringify (JSContext *ctx, JSValue obj,
+                          JSValue replacer, JSValue space0);
 
-JSValue JS_NewObjectProtoClass (JSContext *ctx, JSValue proto, JSClassID class_id);
-JSValue JS_NewObjectClass (JSContext *ctx, int class_id);
-JSValue JS_NewObjectProto (JSContext *ctx, JSValue proto);
-JSValue JS_NewObject (JSContext *ctx);
+/* ============================================================
+   9. Intrinsic Wrappers (JS_Cell* / JS_Array*)
+   ============================================================ */
 
-JSValue JS_NewArray (JSContext *ctx);
-JSValue JS_NewArrayLen (JSContext *ctx, uint32_t len);
-
-int JS_ArrayPush (JSContext *ctx, JSValue *arr_ptr, JSValue val);
-JSValue JS_ArrayPop (JSContext *ctx, JSValue obj);
-
-/* Intrinsic array operations - signatures match internal functions */
+/* Intrinsic array operations */
 JSValue JS_Array (JSContext *ctx, JSValue arg0, JSValue arg1, JSValue arg2, JSValue arg3);
 JSValue JS_ArrayFilter (JSContext *ctx, JSValue arr, JSValue fn);
 JSValue JS_ArraySort (JSContext *ctx, JSValue arr, JSValue selector);
@@ -552,9 +587,7 @@ JSValue JS_ArrayFind (JSContext *ctx, JSValue arr, JSValue target_or_fn, JSValue
 JSValue JS_ArrFor (JSContext *ctx, JSValue arr, JSValue fn, JSValue reverse, JSValue exit_val);
 JSValue JS_ArrayReduce (JSContext *ctx, JSValue arr, JSValue fn, JSValue initial, JSValue reverse);
 
-/* Cell intrinsic functions - C API wrappers */
-
-/* Core functions */
+/* Core cell functions */
 JSValue JS_CellStone (JSContext *ctx, JSValue val);
 JSValue JS_CellLength (JSContext *ctx, JSValue val);
 JSValue JS_CellReverse (JSContext *ctx, JSValue val);
@@ -567,7 +600,7 @@ JSValue JS_CellModulo (JSContext *ctx, JSValue a, JSValue b);
 JSValue JS_CellNeg (JSContext *ctx, JSValue val);
 JSValue JS_CellNot (JSContext *ctx, JSValue val);
 
-/* Text functions */
+/* Text cell functions */
 JSValue JS_CellText (JSContext *ctx, JSValue val);
 JSValue JS_CellLower (JSContext *ctx, JSValue text);
 JSValue JS_CellUpper (JSContext *ctx, JSValue text);
@@ -578,7 +611,7 @@ JSValue JS_CellSearch (JSContext *ctx, JSValue text, JSValue pattern, JSValue fr
 JSValue JS_CellExtract (JSContext *ctx, JSValue text, JSValue from, JSValue to);
 JSValue JS_CellCharacter (JSContext *ctx, JSValue codepoint);
 
-/* Number functions */
+/* Number cell functions */
 JSValue JS_CellNumber (JSContext *ctx, JSValue val);
 JSValue JS_CellAbs (JSContext *ctx, JSValue num);
 JSValue JS_CellSign (JSContext *ctx, JSValue num);
@@ -592,56 +625,20 @@ JSValue JS_CellMin (JSContext *ctx, JSValue a, JSValue b);
 JSValue JS_CellMax (JSContext *ctx, JSValue a, JSValue b);
 JSValue JS_CellRemainder (JSContext *ctx, JSValue a, JSValue b);
 
-/* Object functions */
+/* Object cell functions */
 JSValue JS_CellObject (JSContext *ctx, JSValue proto, JSValue props);
 
-/* Format function */
+/* Format */
 JSValue JS_CellFormat (JSContext *ctx, JSValue text, JSValue collection, JSValue transformer);
 
-/* Helper functions */
-JSValue JS_NewArrayFrom (JSContext *ctx, int count, JSValue *values);
+/* Output helpers */
 void JS_PrintText (JSContext *ctx, JSValue val);
 void JS_PrintTextLn (JSContext *ctx, JSValue val);
 void JS_PrintFormatted (JSContext *ctx, const char *fmt, int count, JSValue *values);
 
-JSValue JS_GetProperty (JSContext *ctx, JSValue this_obj, JSValue prop);
-int JS_SetProperty (JSContext *ctx, JSValue this_obj, JSValue prop, JSValue val);
-
-// For records
-JSValue JS_GetPropertyStr (JSContext *ctx, JSValue this_obj, const char *prop);
-int JS_SetPropertyStr (JSContext *ctx, JSValue this_obj, const char *prop, JSValue val);
-
-// Must be an array
-JSValue JS_GetPropertyNumber (JSContext *ctx, JSValue this_obj, int idx);
-JSValue JS_SetPropertyNumber (JSContext *ctx, JSValue obj, int idx, JSValue val);
-
-JSValue JS_GetPrototype (JSContext *ctx, JSValue val);
-
-/* Get property keys as array of text */
-JSValue JS_GetOwnPropertyNames (JSContext *ctx, JSValue obj);
-
-JSValue JS_Call (JSContext *ctx, JSValue func_obj, JSValue this_obj, int argc, JSValue *argv);
-
-void JS_SetOpaque (JSValue obj, void *opaque);
-void *JS_GetOpaque (JSValue obj, JSClassID class_id);
-void *JS_GetOpaque2 (JSContext *ctx, JSValue obj, JSClassID class_id);
-void *JS_GetAnyOpaque (JSValue obj, JSClassID *class_id);
-
-/* 'buf' must be zero terminated i.e. buf[buf_len] = '\0'. */
-JSValue JS_ParseJSON (JSContext *ctx, const char *buf, size_t buf_len,
-                      const char *filename);
-#define JS_PARSE_JSON_EXT (1 << 0) /* allow extended JSON */
-JSValue JS_ParseJSON2 (JSContext *ctx, const char *buf, size_t buf_len,
-                       const char *filename, int flags);
-JSValue JS_JSONStringify (JSContext *ctx, JSValue obj,
-                          JSValue replacer, JSValue space0);
-
-/* return != 0 if the JS code needs to be interrupted */
-typedef int JSInterruptHandler (JSRuntime *rt, void *opaque);
-void JS_SetInterruptHandler (JSContext *ctx, JSInterruptHandler *cb,
-                             void *opaque);
-
-/* C function definition */
+/* ============================================================
+   10. C Function Definition
+   ============================================================ */
 typedef enum JSCFunctionEnum {
   JS_CFUNC_generic,
   JS_CFUNC_generic_magic,
@@ -901,7 +898,27 @@ typedef struct JSCFunctionListEntry {
 int JS_SetPropertyFunctionList (JSContext *ctx, JSValue obj,
                                 const JSCFunctionListEntry *tab, int len);
 
-/* debug value output */
+/* ============================================================
+   11. Debug / Dump Utilities
+   ============================================================ */
+
+typedef struct JSMemoryUsage {
+  int64_t malloc_size, malloc_limit, memory_used_size;
+  int64_t malloc_count;
+  int64_t memory_used_count;
+  int64_t str_count, str_size;
+  int64_t obj_count, obj_size;
+  int64_t prop_count, prop_size;
+  int64_t shape_count, shape_size;
+  int64_t js_func_count, js_func_size, js_func_code_size;
+  int64_t js_func_pc2line_count, js_func_pc2line_size;
+  int64_t c_func_count, array_count;
+  int64_t fast_array_count, fast_array_elements;
+  int64_t binary_object_count, binary_object_size;
+} JSMemoryUsage;
+
+void JS_ComputeMemoryUsage (JSRuntime *rt, JSMemoryUsage *s);
+void JS_DumpMemoryUsage (FILE *fp, const JSMemoryUsage *s, JSRuntime *rt);
 
 typedef struct {
   JS_BOOL show_hidden : 8; /* only show enumerable properties */
@@ -957,7 +974,9 @@ JSValue js_debugger_fn_info (JSContext *ctx, JSValue fn);
 JSValue js_debugger_fn_bytecode (JSContext *js, JSValue fn);
 void *js_debugger_val_address (JSContext *js, JSValue val);
 
-/* Memory allocation functions (bump allocator) */
+/* ============================================================
+   12. Memory Allocation
+   ============================================================ */
 void *js_malloc (JSContext *ctx, size_t size);
 void *js_mallocz (JSContext *ctx, size_t size);
 void *js_realloc (JSContext *ctx, void *ptr, size_t size);
@@ -969,17 +988,13 @@ void *js_malloc_rt (size_t size);
 void *js_mallocz_rt (size_t size);
 void js_free_rt (void *ptr);
 
+/* ============================================================
+   13. Compilation and Bytecode
+   ============================================================ */
+
 struct cJSON;
-
-/* Compiled bytecode (context-free, serializable) */
 typedef struct MachCode MachCode;
 
-/* Compile AST cJSON tree to context-free MachCode. */
-MachCode *JS_CompileMachTree(struct cJSON *ast);
-
-/* Compile AST JSON string to context-free MachCode. */
-MachCode *JS_CompileMach(const char *ast_json);
-
 /* Free a compiled MachCode tree. */
 void JS_FreeMachCode(MachCode *mc);
 
@@ -995,6 +1010,9 @@ struct JSCodeRegister *JS_LoadMachCode(JSContext *ctx, MachCode *mc, JSValue env
 /* Deserialize and execute pre-compiled MACH binary bytecode. */
 JSValue JS_RunMachBin(JSContext *ctx, const uint8_t *data, size_t size, JSValue env);
 
+/* Parse mcode JSON IR, compile, and execute via register VM. */
+JSValue JS_RunMachMcode(JSContext *ctx, const char *json_str, size_t len, JSValue env);
+
 /* Dump disassembly of pre-compiled MACH binary bytecode. */
 void JS_DumpMachBin(JSContext *ctx, const uint8_t *data, size_t size, JSValue env);
 

streamline.ce

@@ -1,3 +1,7 @@
+// streamline.ce — run the full compile + optimize pipeline, output JSON
+//
+// Usage: ./cell --core . streamline.ce <file.ce|file.cm>
+
 var fd = use("fd")
 var json = use("json")
 var tokenize = use("tokenize")

test.ce

@@ -14,6 +14,13 @@ var target_pkg = null // null = current package
 var target_test = null // null = all tests, otherwise specific test file
 var all_pkgs = false
 var gc_after_each_test = false
+var verify_ir = false
+var diff_mode = false
+
+var os_ref = use('os')
+var analyze = os_ref.analyze
+var run_ast_fn = os_ref.run_ast_fn
+var run_ast_noopt_fn = os_ref.run_ast_noopt_fn
 
 // Actor test support
 def ACTOR_TEST_TIMEOUT = 30000 // 30 seconds timeout for actor tests
@@ -46,6 +53,11 @@ function get_current_package_name() {
 //   cell test package <name>           - run all tests for named package
 //   cell test package <name> <test>    - run specific test in named package
 //   cell test package all              - run all tests from all packages
+//
+// Flags:
+//   -g        - run GC after each test
+//   --verify  - enable IR verification (validates mcode IR after each optimizer pass)
+//   --diff    - enable differential testing (run each test optimized and unoptimized, compare results)
 
 function parse_args() {
     var cleaned_args = []
@@ -57,6 +69,10 @@ function parse_args() {
     for (i = 0; i < length(_args); i++) {
         if (_args[i] == '-g') {
             gc_after_each_test = true
+        } else if (_args[i] == '--verify') {
+            verify_ir = true
+        } else if (_args[i] == '--diff') {
+            diff_mode = true
         } else {
             push(cleaned_args, _args[i])
         }
@@ -162,6 +178,77 @@ if (!parse_args()) {
     return
 }
 
+// Enable IR verification if requested
+if (verify_ir) {
+    os_ref._verify_ir = true
+    log.console('IR verification enabled')
+}
+
+if (diff_mode && !run_ast_noopt_fn) {
+    log.console('error: --diff requires run_ast_noopt_fn (rebuild bootstrap)')
+    $stop()
+    return
+}
+
+// Diff mode: deep comparison helper
+function values_equal(a, b) {
+    var i = 0
+    if (a == b) return true
+    if (is_null(a) && is_null(b)) return true
+    if (is_null(a) || is_null(b)) return false
+    if (is_array(a) && is_array(b)) {
+        if (length(a) != length(b)) return false
+        i = 0
+        while (i < length(a)) {
+            if (!values_equal(a[i], b[i])) return false
+            i = i + 1
+        }
+        return true
+    }
+    return false
+}
+
+function describe(val) {
+    if (is_null(val)) return "null"
+    if (is_text(val)) return `"${val}"`
+    if (is_number(val)) return text(val)
+    if (is_logical(val)) return text(val)
+    if (is_function(val)) return "<function>"
+    return "<other>"
+}
+
+// Diff mode: run a test function through noopt and compare
+var diff_mismatches = 0
+function diff_check(test_name, file_path, opt_fn, noopt_fn) {
+    if (!diff_mode) return
+    var opt_result = null
+    var noopt_result = null
+    var opt_err = null
+    var noopt_err = null
+
+    var _opt = function() {
+        opt_result = opt_fn()
+    } disruption {
+        opt_err = "disrupted"
+    }
+    _opt()
+
+    var _noopt = function() {
+        noopt_result = noopt_fn()
+    } disruption {
+        noopt_err = "disrupted"
+    }
+    _noopt()
+
+    if (opt_err != noopt_err) {
+        log.console(`    DIFF ${test_name}: disruption mismatch opt=${opt_err != null ? opt_err : "ok"} noopt=${noopt_err != null ? noopt_err : "ok"}`)
+        diff_mismatches = diff_mismatches + 1
+    } else if (!values_equal(opt_result, noopt_result)) {
+        log.console(`    DIFF ${test_name}: result mismatch opt=${describe(opt_result)} noopt=${describe(noopt_result)}`)
+        diff_mismatches = diff_mismatches + 1
+    }
+}
+
 function ensure_dir(path) {
     if (fd.is_dir(path)) return true
 
@@ -320,9 +407,26 @@ function run_tests(package_name, specific_test) {
 
         _load_file = function() {
             var test_mod = null
+            var test_mod_noopt = null
             var use_pkg = package_name ? package_name : fd.realpath('.')
+            var _load_noopt = null
             test_mod = shop.use(mod_path, use_pkg)
 
+            // Load noopt version for diff mode
+            if (diff_mode) {
+                _load_noopt = function() {
+                    var src_path = prefix + '/' + f
+                    var src = text(fd.slurp(src_path))
+                    var ast = analyze(src, src_path)
+                    test_mod_noopt = run_ast_noopt_fn(mod_path + '_noopt', ast, {
+                        use: function(path) { return shop.use(path, use_pkg) }
+                    })
+                } disruption {
+                    log.console(`    DIFF: failed to load noopt module for ${f}`)
+                }
+                _load_noopt()
+            }
+
             var tests = []
             var j = 0
             var t = null
@@ -406,6 +510,12 @@ function run_tests(package_name, specific_test) {
                         }
                     }
                     _run_one()
+
+                    // Differential check: compare opt vs noopt
+                    if (diff_mode && test_mod_noopt && is_object(test_mod_noopt) && is_function(test_mod_noopt[t.name])) {
+                        diff_check(t.name, f, t.fn, test_mod_noopt[t.name])
+                    }
+
                     end_time = time.number()
                     test_entry.duration_ns = round((end_time - start_time) * 1000000000)
 
@@ -635,6 +745,9 @@ function finalize_results() {
 
     log.console(`----------------------------------------`)
     log.console(`Tests: ${totals.passed} passed, ${totals.failed} failed, ${totals.total} total`)
+    if (diff_mode) {
+        log.console(`Diff mismatches: ${text(diff_mismatches)}`)
+    }
 
     generate_reports(totals)
     $stop()
@@ -652,6 +765,9 @@ if (length(all_actor_tests) == 0) {
 
     log.console(`----------------------------------------`)
     log.console(`Tests: ${totals.passed} passed, ${totals.failed} failed, ${totals.total} total`)
+    if (diff_mode) {
+        log.console(`Diff mismatches: ${text(diff_mismatches)}`)
+    }
 } else {
     $delay(check_timeouts, 1000)
 }

test_backward.cm

@@ -0,0 +1,27 @@
+// Test backward type propagation
+// Functions that use typed ops on parameters should have
+// parameter types inferred and type checks eliminated
+
+var sum_ints = function(a, b, c) {
+  return a + b + c
+}
+
+var count_down = function(n) {
+  var i = n
+  var total = 0
+  while (i > 0) {
+    total = total + i
+    i = i - 1
+  }
+  return total
+}
+
+var concat_all = function(a, b, c) {
+  return a + b + c
+}
+
+if (sum_ints(1, 2, 3) != 6) { print("FAIL sum_ints") }
+if (count_down(5) != 15) { print("FAIL count_down") }
+if (concat_all("a", "b", "c") != "abc") { print("FAIL concat_all") }
+
+print("backward type tests passed")

test_guards.ce

@@ -0,0 +1,12 @@
+// Test array guard emission and optimization
+var a = [1, 2, 3]
+push(a, 4)
+var v = a[]
+
+var f = function(arr) {
+  push(arr, 99)
+  var x = arr[]
+  return x
+}
+
+f(a)

test_intrinsics.cm

@@ -0,0 +1,63 @@
+// Test all inlined intrinsics
+var arr = [1, 2, 3]
+var rec = {a: 1}
+var fn = function() { return 1 }
+var txt = "hello"
+var num = 42
+var boo = true
+
+// is_array
+if (!is_array(arr)) { print("FAIL is_array(arr)") }
+if (is_array(rec)) { print("FAIL is_array(rec)") }
+if (is_array(42)) { print("FAIL is_array(42)") }
+
+// is_object
+if (!is_object(rec)) { print("FAIL is_object(rec)") }
+if (is_object(arr)) { print("FAIL is_object(arr)") }
+if (is_object(42)) { print("FAIL is_object(42)") }
+
+// is_function
+if (!is_function(fn)) { print("FAIL is_function(fn)") }
+if (is_function(rec)) { print("FAIL is_function(rec)") }
+
+// is_stone
+var frozen = stone([1, 2])
+if (!is_stone(frozen)) { print("FAIL is_stone(frozen)") }
+if (is_stone(arr)) { print("FAIL is_stone(arr)") }
+if (!is_stone(42)) { print("FAIL is_stone(42)") }
+if (!is_stone("hi")) { print("FAIL is_stone(str)") }
+
+// length
+if (length(arr) != 3) { print("FAIL length(arr)") }
+if (length(txt) != 5) { print("FAIL length(txt)") }
+if (length([]) != 0) { print("FAIL length([])") }
+
+// is_integer (already existed but now inlined)
+if (!is_integer(42)) { print("FAIL is_integer(42)") }
+if (is_integer(3.14)) { print("FAIL is_integer(3.14)") }
+
+// is_text
+if (!is_text("hi")) { print("FAIL is_text(hi)") }
+if (is_text(42)) { print("FAIL is_text(42)") }
+
+// is_number
+if (!is_number(42)) { print("FAIL is_number(42)") }
+if (!is_number(3.14)) { print("FAIL is_number(3.14)") }
+if (is_number("hi")) { print("FAIL is_number(hi)") }
+
+// is_logical
+if (!is_logical(true)) { print("FAIL is_logical(true)") }
+if (is_logical(42)) { print("FAIL is_logical(42)") }
+
+// is_null
+if (!is_null(null)) { print("FAIL is_null(null)") }
+if (is_null(42)) { print("FAIL is_null(42)") }
+
+// push (inlined)
+var a = [1]
+push(a, 2)
+push(a, 3)
+if (length(a) != 3) { print("FAIL push length") }
+if (a[2] != 3) { print("FAIL push value") }
+
+print("all intrinsic tests passed")

verify_ir.cm

@@ -0,0 +1,452 @@
+// verify_ir.cm — validates mcode IR structure after optimizer passes
+// Used to catch structural bugs introduced by optimization.
+
+// Operand positions that are slots for each opcode.
+// Positions are 0-indexed from the first operand (after the opcode),
+// excluding the trailing line/col pair.
+var slot_positions = {
+  // Constant loaders — only dest
+  access: [0],
+  int: [0],
+  true: [0],
+  false: [0],
+  null: [0],
+  function: [0],
+  array: [0],
+  record: [0],
+
+  // Unary — dest, src
+  move: [0, 1],
+  not: [0, 1],
+  negate: [0, 1],
+  bitnot: [0, 1],
+  length: [0, 1],
+  typeof: [0, 1],
+  is_int: [0, 1],
+  is_text: [0, 1],
+  is_num: [0, 1],
+  is_bool: [0, 1],
+  is_null: [0, 1],
+  is_array: [0, 1],
+  is_func: [0, 1],
+  is_record: [0, 1],
+  is_stone: [0, 1],
+  is_identical: [0, 1, 2],
+
+  // Binary arithmetic/comparison — dest, src1, src2
+  add: [0, 1, 2],
+  subtract: [0, 1, 2],
+  multiply: [0, 1, 2],
+  divide: [0, 1, 2],
+  modulo: [0, 1, 2],
+  pow: [0, 1, 2],
+  eq: [0, 1, 2],
+  ne: [0, 1, 2],
+  lt: [0, 1, 2],
+  le: [0, 1, 2],
+  gt: [0, 1, 2],
+  ge: [0, 1, 2],
+  eq_int: [0, 1, 2],
+  ne_int: [0, 1, 2],
+  lt_int: [0, 1, 2],
+  gt_int: [0, 1, 2],
+  le_int: [0, 1, 2],
+  ge_int: [0, 1, 2],
+  eq_float: [0, 1, 2],
+  ne_float: [0, 1, 2],
+  lt_float: [0, 1, 2],
+  gt_float: [0, 1, 2],
+  le_float: [0, 1, 2],
+  ge_float: [0, 1, 2],
+  eq_text: [0, 1, 2],
+  ne_text: [0, 1, 2],
+  lt_text: [0, 1, 2],
+  gt_text: [0, 1, 2],
+  le_text: [0, 1, 2],
+  ge_text: [0, 1, 2],
+  eq_bool: [0, 1, 2],
+  ne_bool: [0, 1, 2],
+  eq_tol: [0, 1, 2],
+  ne_tol: [0, 1, 2],
+  concat: [0, 1, 2],
+  and: [0, 1, 2],
+  or: [0, 1, 2],
+  bitand: [0, 1, 2],
+  bitor: [0, 1, 2],
+  bitxor: [0, 1, 2],
+  shl: [0, 1, 2],
+  shr: [0, 1, 2],
+  ushr: [0, 1, 2],
+  in: [0, 1, 2],
+
+  // Element access — all operands are slots
+  load_index: [0, 1, 2],
+  load_dynamic: [0, 1, 2],
+  load_field: [0, 1],
+  store_index: [0, 1, 2],
+  store_dynamic: [0, 1, 2],
+  store_field: [0, 1],
+
+  // Push/pop
+  push: [0, 1],
+  pop: [0, 1],
+  get: [0, 1],
+
+  // Control flow — slot positions only
+  return: [0],
+  jump: [],
+  jump_true: [0],
+  jump_false: [0],
+  jump_not_null: [0],
+  disrupt: [],
+
+  // Invoke
+  invoke: [0, 1],
+  tail_invoke: [0, 1],
+  goinvoke: [0],
+  frame: [0, 1],
+  setarg: [0, 2]
+}
+
+// Opcodes that write to their first operand (position 0)
+var writes_dest = {
+  access: true, int: true, true: true, false: true, null: true,
+  function: true, array: true, record: true,
+  move: true, not: true, negate: true, bitnot: true,
+  length: true, typeof: true,
+  is_int: true, is_text: true, is_num: true,
+  is_bool: true, is_null: true, is_array: true,
+  is_func: true, is_record: true, is_stone: true, is_identical: true,
+  add: true, subtract: true, multiply: true, divide: true,
+  modulo: true, pow: true,
+  eq: true, ne: true, lt: true, le: true, gt: true, ge: true,
+  eq_int: true, ne_int: true, lt_int: true, gt_int: true, le_int: true, ge_int: true,
+  eq_float: true, ne_float: true, lt_float: true, gt_float: true, le_float: true, ge_float: true,
+  eq_text: true, ne_text: true, lt_text: true, gt_text: true, le_text: true, ge_text: true,
+  eq_bool: true, ne_bool: true, eq_tol: true, ne_tol: true,
+  concat: true, and: true, or: true,
+  bitand: true, bitor: true, bitxor: true, shl: true, shr: true, ushr: true,
+  in: true,
+  load_index: true, load_dynamic: true, load_field: true,
+  pop: true, get: true,
+  invoke: true,
+  tail_invoke: true
+}
+
+// Opcodes where invoke writes to position 1 (result slot), not position 0
+var invoke_result_pos = 1
+
+// Jump opcodes and the position of their label operand (0-indexed from first operand)
+var jump_label_pos = {
+  jump: 0,
+  jump_true: 1,
+  jump_false: 1,
+  jump_not_null: 1
+}
+
+// --- Check: slot_bounds ---
+// Verifies every slot operand is in 0..nr_slots-1.
+var check_slot_bounds = function(func) {
+  var instructions = func.instructions
+  var nr_slots = func.nr_slots
+  var errors = []
+  var i = 0
+  var instr = null
+  var op = null
+  var positions = null
+  var j = 0
+  var pos = null
+  var val = null
+
+  if (instructions == null) return errors
+
+  while (i < length(instructions)) {
+    instr = instructions[i]
+    if (is_array(instr)) {
+      op = instr[0]
+      positions = slot_positions[op]
+      if (positions != null) {
+        j = 0
+        while (j < length(positions)) {
+          pos = positions[j] + 1
+          if (pos < length(instr) - 2) {
+            val = instr[pos]
+            if (is_number(val) && (val < 0 || val >= nr_slots)) {
+              push(errors, `slot_bounds: instr ${text(i)} op=${op} slot[${text(positions[j])}]=${text(val)} out of range 0..${text(nr_slots - 1)}`)
+            }
+          }
+          j = j + 1
+        }
+      }
+    }
+    i = i + 1
+  }
+  return errors
+}
+
+// --- Check: jump_targets ---
+// Verifies every jump target label exists in the instruction stream.
+var check_jump_targets = function(func) {
+  var instructions = func.instructions
+  var errors = []
+  var labels = {}
+  var i = 0
+  var instr = null
+  var op = null
+  var label_pos = null
+  var target = null
+
+  if (instructions == null) return errors
+
+  // Collect all labels (non-nop strings)
+  while (i < length(instructions)) {
+    instr = instructions[i]
+    if (is_text(instr) && !starts_with(instr, "_nop_")) {
+      labels[instr] = true
+    }
+    i = i + 1
+  }
+
+  // Check jump targets
+  i = 0
+  while (i < length(instructions)) {
+    instr = instructions[i]
+    if (is_array(instr)) {
+      op = instr[0]
+      label_pos = jump_label_pos[op]
+      if (label_pos != null) {
+        target = instr[label_pos + 1]
+        if (is_text(target) && labels[target] != true) {
+          push(errors, `jump_targets: instr ${text(i)} op=${op} target label "${target}" not found`)
+        }
+      }
+    }
+    i = i + 1
+  }
+  return errors
+}
+
+// --- Check: type_consistency ---
+// Verifies typed operators receive compatible known types.
+var check_type_consistency = function(func) {
+  var instructions = func.instructions
+  var errors = []
+  var slot_types = {}
+  var i = 0
+  var instr = null
+  var op = null
+  var s2 = null
+  var s3 = null
+  var t2 = null
+  var t3 = null
+
+  if (instructions == null) return errors
+
+  // Type constants
+  var T_INT = "int"
+  var T_FLOAT = "float"
+  var T_TEXT = "text"
+  var T_BOOL = "bool"
+
+  var int_ops = {
+    eq_int: true, ne_int: true, lt_int: true, gt_int: true, le_int: true, ge_int: true
+  }
+  var float_ops = {
+    eq_float: true, ne_float: true, lt_float: true, gt_float: true, le_float: true, ge_float: true
+  }
+  var text_ops = {
+    eq_text: true, ne_text: true, lt_text: true, gt_text: true, le_text: true, ge_text: true,
+    concat: true
+  }
+  var bool_ops = {
+    eq_bool: true, ne_bool: true, not: true, and: true, or: true
+  }
+
+  while (i < length(instructions)) {
+    instr = instructions[i]
+
+    // Reset type info at labels (basic block boundaries)
+    if (is_text(instr) && !starts_with(instr, "_nop_")) {
+      slot_types = {}
+      i = i + 1
+      continue
+    }
+
+    if (!is_array(instr)) {
+      i = i + 1
+      continue
+    }
+
+    op = instr[0]
+
+    // Track known types from constant-producing ops
+    if (op == "int") {
+      slot_types[text(instr[1])] = T_INT
+    } else if (op == "access") {
+      if (is_number(instr[2])) {
+        if (is_integer(instr[2])) {
+          slot_types[text(instr[1])] = T_INT
+        } else {
+          slot_types[text(instr[1])] = T_FLOAT
+        }
+      } else if (is_text(instr[2])) {
+        slot_types[text(instr[1])] = T_TEXT
+      }
+    } else if (op == "true" || op == "false") {
+      slot_types[text(instr[1])] = T_BOOL
+    }
+
+    // Check typed binary ops
+    if (int_ops[op] == true && length(instr) >= 5) {
+      s2 = text(instr[2])
+      t2 = slot_types[s2]
+      if (t2 != null && t2 != T_INT && t2 != "unknown") {
+        push(errors, `type_consistency: instr ${text(i)} op=${op} src1 slot ${s2} has type ${t2}, expected int`)
+      }
+      if (length(instr) >= 6) {
+        s3 = text(instr[3])
+        t3 = slot_types[s3]
+        if (t3 != null && t3 != T_INT && t3 != "unknown") {
+          push(errors, `type_consistency: instr ${text(i)} op=${op} src2 slot ${s3} has type ${t3}, expected int`)
+        }
+      }
+    } else if (float_ops[op] == true && length(instr) >= 5) {
+      s2 = text(instr[2])
+      t2 = slot_types[s2]
+      if (t2 != null && t2 != T_FLOAT && t2 != "unknown") {
+        push(errors, `type_consistency: instr ${text(i)} op=${op} src1 slot ${s2} has type ${t2}, expected float`)
+      }
+      if (length(instr) >= 6) {
+        s3 = text(instr[3])
+        t3 = slot_types[s3]
+        if (t3 != null && t3 != T_FLOAT && t3 != "unknown") {
+          push(errors, `type_consistency: instr ${text(i)} op=${op} src2 slot ${s3} has type ${t3}, expected float`)
+        }
+      }
+    } else if (text_ops[op] == true && length(instr) >= 5) {
+      s2 = text(instr[2])
+      t2 = slot_types[s2]
+      if (t2 != null && t2 != T_TEXT && t2 != "unknown") {
+        push(errors, `type_consistency: instr ${text(i)} op=${op} src1 slot ${s2} has type ${t2}, expected text`)
+      }
+      if (length(instr) >= 6) {
+        s3 = text(instr[3])
+        t3 = slot_types[s3]
+        if (t3 != null && t3 != T_TEXT && t3 != "unknown") {
+          push(errors, `type_consistency: instr ${text(i)} op=${op} src2 slot ${s3} has type ${t3}, expected text`)
+        }
+      }
+    } else if (bool_ops[op] == true && length(instr) >= 5) {
+      s2 = text(instr[2])
+      t2 = slot_types[s2]
+      if (t2 != null && t2 != T_BOOL && t2 != "unknown") {
+        push(errors, `type_consistency: instr ${text(i)} op=${op} src1 slot ${s2} has type ${t2}, expected bool`)
+      }
+    }
+
+    // Clear type info for dest-producing ops
+    if (writes_dest[op] == true) {
+      slot_types[text(instr[1])] = null
+      // Restore type for known-result ops
+      if (op == "int" || (op == "access" && is_number(instr[2]))) {
+        // already set above
+      }
+    }
+    if (op == "invoke") {
+      slot_types[text(instr[2])] = null
+    }
+
+    i = i + 1
+  }
+  return errors
+}
+
+// --- Check: nop_consistency ---
+// Verifies nop markers are not referenced by jumps.
+var check_nop_consistency = function(func) {
+  var instructions = func.instructions
+  var errors = []
+  var nops = {}
+  var i = 0
+  var instr = null
+  var op = null
+  var label_pos = null
+  var target = null
+
+  if (instructions == null) return errors
+
+  // Collect all nop markers
+  while (i < length(instructions)) {
+    instr = instructions[i]
+    if (is_text(instr) && starts_with(instr, "_nop_")) {
+      nops[instr] = true
+    }
+    i = i + 1
+  }
+
+  // Check that no jump targets a nop
+  i = 0
+  while (i < length(instructions)) {
+    instr = instructions[i]
+    if (is_array(instr)) {
+      op = instr[0]
+      label_pos = jump_label_pos[op]
+      if (label_pos != null) {
+        target = instr[label_pos + 1]
+        if (is_text(target) && nops[target] == true) {
+          push(errors, `nop_consistency: instr ${text(i)} op=${op} jumps to nop marker "${target}"`)
+        }
+      }
+    }
+    i = i + 1
+  }
+  return errors
+}
+
+// --- verify_all ---
+// Runs all checks on a function. Returns array of error strings (empty = pass).
+var verify_all = function(func, pass_name) {
+  var all_errors = []
+  var check_errors = null
+  var i = 0
+  var prefix = pass_name != null ? pass_name + ": " : ""
+  var fn_name = func.name != null ? func.name : "<unknown>"
+
+  check_errors = check_slot_bounds(func)
+  i = 0
+  while (i < length(check_errors)) {
+    push(all_errors, `${prefix}${fn_name}: ${check_errors[i]}`)
+    i = i + 1
+  }
+
+  check_errors = check_jump_targets(func)
+  i = 0
+  while (i < length(check_errors)) {
+    push(all_errors, `${prefix}${fn_name}: ${check_errors[i]}`)
+    i = i + 1
+  }
+
+  check_errors = check_type_consistency(func)
+  i = 0
+  while (i < length(check_errors)) {
+    push(all_errors, `${prefix}${fn_name}: ${check_errors[i]}`)
+    i = i + 1
+  }
+
+  check_errors = check_nop_consistency(func)
+  i = 0
+  while (i < length(check_errors)) {
+    push(all_errors, `${prefix}${fn_name}: ${check_errors[i]}`)
+    i = i + 1
+  }
+
+  return all_errors
+}
+
+return {
+  verify_all: verify_all,
+  check_slot_bounds: check_slot_bounds,
+  check_jump_targets: check_jump_targets,
+  check_type_consistency: check_type_consistency,
+  check_nop_consistency: check_nop_consistency
+}

website/data/spec_sections.yaml

@@ -1,4 +1,16 @@
 sections:
+  - title: "Compilation Pipeline"
+    page: "/docs/spec/pipeline/"
+    id: "pipeline"
+  - title: "Mcode IR"
+    page: "/docs/spec/mcode/"
+    id: "mcode"
+  - title: "Streamline Optimizer"
+    page: "/docs/spec/streamline/"
+    id: "streamline"
+  - title: "Register VM"
+    page: "/docs/spec/mach/"
+    id: "mach"
   - title: "DEC64 Numbers"
     page: "/docs/spec/dec64/"
     id: "dec64"
@@ -14,12 +26,6 @@ sections:
   - title: "Garbage Collection"
     page: "/docs/spec/gc/"
     id: "gc"
-  - title: "Register VM"
-    page: "/docs/spec/mach/"
-    id: "mach"
-  - title: "Mcode IR"
-    page: "/docs/spec/mcode/"
-    id: "mcode"
   - title: "Kim Encoding"
     page: "/docs/kim/"
     id: "kim"