js-confuser-vm 0.0.5 → 0.0.6

package/dist/compiler.js

@@ -12,158 +12,152 @@ import { selfModifying } from "./transforms/bytecode/selfModifying.js";
 import { macroOpcodes } from "./transforms/bytecode/macroOpcodes.js";
 import * as b from "./types.js";
 import { specializedOpcodes } from "./transforms/bytecode/specializedOpcodes.js";
-import { getRandomInt } from "./transforms/utils/random-utils.js";
-import { U16_MAX } from "./transforms/utils/op-utils.js";
+import { aliasedOpcodes } from "./transforms/bytecode/aliasedOpcodes.js";
+import { getRandomInt } from "./utils/random-utils.js";
+import { U16_MAX } from "./utils/op-utils.js";
+import { concealConstants } from "./transforms/bytecode/concealConstants.js";
 const traverse = traverseImport.default || traverseImport;
-const readVMRuntimeFile = () => "import { OP_ORIGINAL as OP } from \"./compiler.ts\";\r\nconst BYTECODE = [];\r\nconst MAIN_START_PC = 0;\r\nconst CONSTANTS = [];\r\nconst ENCODE_BYTECODE = false;\r\nconst TIMING_CHECKS = false;\r\n// The text above is not included in the compiled output - for type intellisense only\r\n// @START\r\n\r\nfunction decodeBytecode(s) {\r\n  if (!ENCODE_BYTECODE) return s;\r\n\r\n  var b =\r\n    typeof Buffer !== \"undefined\"\r\n      ? Buffer.from(s, \"base64\")\r\n      : Uint8Array.from(atob(s), function (c) {\r\n          return c.charCodeAt(0);\r\n        });\r\n  // Each slot is a u16 stored as 2 little-endian bytes.\r\n  var r = new Uint16Array(b.length / 2);\r\n  for (var i = 0; i < r.length; i++) r[i] = b[i * 2] | (b[i * 2 + 1] << 8);\r\n  return r;\r\n}\r\n\r\n// Closure symbol\r\n// Used to tag shell functions so the VM can fast-path back to the\r\n// inner Closure instead of going through a sub-VM on internal calls.\r\nvar CLOSURE_SYM = Symbol(); // Nameless for obfuscation\r\n\r\n// Upvalue\r\n// While the outer frame is alive: reads/writes go to frame.locals[slot].\r\n// After the outer frame returns (closed): reads/writes hit this.value.\r\nfunction Upvalue(frame, slot) {\r\n  this._frame = frame;\r\n  this._slot = slot;\r\n  this._closed = false;\r\n  this._value = undefined;\r\n}\r\nUpvalue.prototype._read = function () {\r\n  return this._closed ? this._value : this._frame.locals[this._slot];\r\n};\r\nUpvalue.prototype._write = function (v) {\r\n  if (this._closed) this._value = v;\r\n  else this._frame.locals[this._slot] = v;\r\n};\r\nUpvalue.prototype._close = function () {\r\n  this._value = this._frame.locals[this._slot];\r\n  this._closed = true;\r\n};\r\n\r\n// Closure & Frame\r\nfunction Closure(fn) {\r\n  this.fn = fn;\r\n  this.upvalues = [];\r\n  this.prototype = {}; // <- default prototype object for \\`new\\`\r\n}\r\n\r\nfunction Frame(closure, returnPc, parent, thisVal ) {\r\n  this.closure = closure;\r\n  this.locals = new Array(closure.fn.localCount).fill(undefined);\r\n  this._pc = closure.fn.startPc; // <- initialize from fn descriptor\r\n  this._returnPc = returnPc; // pc to resume in parent frame after RETURN\r\n  this._parent = parent;\r\n  this.thisVal = thisVal !== undefined ? thisVal : undefined;\r\n  this._newObj = null; // <- set by NEW so RETURN can see it\r\n  this._handlerStack = []; // <- exception handlers pushed by TRY_SETUP\r\n}\r\n\r\n// VM\r\nfunction VM(bytecode, mainStartPc, constants, globals) {\r\n  this.bytecode = bytecode;\r\n  this.constants = constants;\r\n  this.globals = globals;\r\n  this._stack = [];\r\n  this._frameStack = [];\r\n  this._openUpvalues = []; // all currently open Upvalue objects across all frames\r\n\r\n  var mainFn = {\r\n    paramCount: 0,\r\n    localCount: 0,\r\n    startPc: mainStartPc, // <- where main begins\r\n  };\r\n  this._currentFrame = new Frame(new Closure(mainFn), null, null);\r\n}\r\n\r\nVM.prototype._push = function (v) {\r\n  this._stack.push(v);\r\n};\r\nVM.prototype._pop = function () {\r\n  return this._stack.pop();\r\n};\r\nVM.prototype.peek = function () {\r\n  return this._stack[this._stack.length - 1];\r\n};\r\n\r\n// Consume the next slot from the flat bytecode stream and advance the PC.\r\n// Called by opcode handlers to read each of their operands in order.\r\nVM.prototype._operand = function () {\r\n  return this.bytecode[this._currentFrame._pc++];\r\n};\r\n\r\nVM.prototype.captureUpvalue = function (frame, slot) {\r\n  // Reuse existing open upvalue for this frame+slot if one exists.\r\n  // This is what makes two closures share the same mutable cell.\r\n  for (var i = 0; i < this._openUpvalues.length; i++) {\r\n    var uv = this._openUpvalues[i];\r\n    if (uv._frame === frame && uv._slot === slot) return uv;\r\n  }\r\n  var uv = new Upvalue(frame, slot);\r\n  this._openUpvalues.push(uv);\r\n  return uv;\r\n};\r\n\r\nVM.prototype._closeUpvaluesFor = function (frame) {\r\n  // Called on RETURN - close every upvalue that was pointing into this frame.\r\n  // After this, closures that captured from the frame read from upvalue.value.\r\n  this._openUpvalues = this._openUpvalues.filter(function (uv) {\r\n    if (uv._frame === frame) {\r\n      uv._close();\r\n      return false;\r\n    }\r\n    return true;\r\n  });\r\n};\r\n\r\nVM.prototype.run = function () {\r\n  var now = () => {\r\n    return performance.now();\r\n  };\r\n\r\n  var lastTime = now();\r\n\r\n  while (true) {\r\n    var frame = this._currentFrame;\r\n    var bc = this.bytecode;\r\n    if (frame._pc >= bc.length) break;\r\n\r\n    var op = this.bytecode[frame._pc++];\r\n\r\n    // console.log(frame._pc - 1, op);\r\n\r\n    // Debugging protection: Detects debugger by checking for >1s pauses which can only happen from debugger; or extremely slow sync tasks\r\n    if (TIMING_CHECKS) {\r\n      var currentTime = now();\r\n      var isTamper = currentTime - lastTime > 1000;\r\n      lastTime = currentTime;\r\n      if (isTamper) {\r\n        // Poison the bytecode\r\n        for (var i = 0; i < this.bytecode.length; i++) this.bytecode[i] = 0;\r\n        // Break the current state\r\n        op = OP.POP;\r\n        this._stack = [];\r\n      }\r\n    }\r\n\r\n    try {\r\n      /* @SWITCH */\r\n      switch (op) {\r\n        case OP.LOAD_CONST:\r\n          this._push(this.constants[this._operand()]);\r\n          break;\r\n\r\n        case OP.LOAD_INT:\r\n          this._push(this._operand());\r\n          break;\r\n\r\n        case OP.LOAD_LOCAL:\r\n          this._push(frame.locals[this._operand()]);\r\n          break;\r\n\r\n        case OP.STORE_LOCAL:\r\n          frame.locals[this._operand()] = this._pop();\r\n          break;\r\n\r\n        case OP.LOAD_GLOBAL:\r\n          this._push(this.globals[this.constants[this._operand()]]);\r\n          break;\r\n\r\n        case OP.STORE_GLOBAL:\r\n          this.globals[this.constants[this._operand()]] = this._pop();\r\n          break;\r\n\r\n        case OP.GET_PROP: {\r\n          // Stack: [..., obj, key] -> [..., obj, obj[key]]\r\n          // obj is PEEKED (not popped) - CALL_METHOD needs it as receiver\r\n          var key = this._pop();\r\n          var obj = this.peek();\r\n          this._push(obj[key]);\r\n          break;\r\n        }\r\n\r\n        case OP.ADD: {\r\n          var b = this._pop();\r\n          this._push(this._pop() + b);\r\n          break;\r\n        }\r\n        case OP.SUB: {\r\n          var b = this._pop();\r\n          this._push(this._pop() - b);\r\n          break;\r\n        }\r\n        case OP.MUL: {\r\n          var b = this._pop();\r\n          this._push(this._pop() * b);\r\n          break;\r\n        }\r\n        case OP.DIV: {\r\n          var b = this._pop();\r\n          this._push(this._pop() / b);\r\n          break;\r\n        }\r\n        case OP.MOD: {\r\n          var b = this._pop();\r\n          this._push(this._pop() % b);\r\n          break;\r\n        }\r\n        case OP.BAND: {\r\n          var b = this._pop();\r\n          this._push(this._pop() & b);\r\n          break;\r\n        }\r\n        case OP.BOR: {\r\n          var b = this._pop();\r\n          this._push(this._pop() | b);\r\n          break;\r\n        }\r\n        case OP.BXOR: {\r\n          var b = this._pop();\r\n          this._push(this._pop() ^ b);\r\n          break;\r\n        }\r\n        case OP.SHL: {\r\n          var b = this._pop();\r\n          this._push(this._pop() << b);\r\n          break;\r\n        }\r\n        case OP.SHR: {\r\n          var b = this._pop();\r\n          this._push(this._pop() >> b);\r\n          break;\r\n        }\r\n        case OP.USHR: {\r\n          var b = this._pop();\r\n          this._push(this._pop() >>> b);\r\n          break;\r\n        }\r\n\r\n        case OP.LT: {\r\n          var b = this._pop();\r\n          this._push(this._pop() < b);\r\n          break;\r\n        }\r\n        case OP.GT: {\r\n          var b = this._pop();\r\n          this._push(this._pop() > b);\r\n          break;\r\n        }\r\n        case OP.EQ: {\r\n          var b = this._pop();\r\n          this._push(this._pop() === b);\r\n          break;\r\n        }\r\n\r\n        case OP.LTE: {\r\n          var b = this._pop();\r\n          this._push(this._pop() <= b);\r\n          break;\r\n        }\r\n        case OP.GTE: {\r\n          var b = this._pop();\r\n          this._push(this._pop() >= b);\r\n          break;\r\n        }\r\n        case OP.NEQ: {\r\n          var b = this._pop();\r\n          this._push(this._pop() !== b);\r\n          break;\r\n        }\r\n        case OP.LOOSE_EQ: {\r\n          var b = this._pop();\r\n          this._push(this._pop() == b);\r\n          break;\r\n        }\r\n        case OP.LOOSE_NEQ: {\r\n          var b = this._pop();\r\n          this._push(this._pop() != b);\r\n          break;\r\n        }\r\n\r\n        case OP.IN: {\r\n          var b = this._pop();\r\n          this._push(this._pop() in b);\r\n          break;\r\n        }\r\n\r\n        case OP.INSTANCEOF: {\r\n          var ctor = this._pop();\r\n          var obj = this._pop();\r\n          if (typeof ctor === \"function\") {\r\n            // Native constructor (e.g. Array, Date) - native instanceof is fine\r\n            this._push(obj instanceof ctor);\r\n          } else {\r\n            // VM Closure - ctor.prototype was set by MAKE_CLOSURE / user assignment.\r\n            // Walk obj's prototype chain looking for identity with ctor.prototype.\r\n            var proto = ctor.prototype; // the .prototype property on the Closure\r\n            var target = Object.getPrototypeOf(obj);\r\n            var result = false;\r\n            while (target !== null) {\r\n              if (target === proto) {\r\n                result = true;\r\n                break;\r\n              }\r\n              target = Object.getPrototypeOf(target);\r\n            }\r\n            this._push(result);\r\n          }\r\n          break;\r\n        }\r\n\r\n        case OP.UNARY_NEG:\r\n          this._push(-this._pop());\r\n          break;\r\n        case OP.UNARY_POS:\r\n          this._push(this._pop());\r\n          break;\r\n        case OP.UNARY_NOT:\r\n          this._push(!this._pop());\r\n          break;\r\n        case OP.UNARY_BITNOT:\r\n          this._push(~this._pop());\r\n          break;\r\n        case OP.TYPEOF:\r\n          this._push(typeof this._pop());\r\n          break;\r\n        case OP.VOID:\r\n          this._pop();\r\n          this._push(undefined);\r\n          break;\r\n\r\n        case OP.TYPEOF_SAFE: {\r\n          // operand is a const index holding the variable name string.\r\n          // Mimics JS semantics: typeof undeclaredVar === \"undefined\" (no throw).\r\n          var name = this._pop(); // LOAD_CONST pushed the name - consume it\r\n          var val = Object.prototype.hasOwnProperty.call(this.globals, name)\r\n            ? this.globals[name]\r\n            : undefined;\r\n          this._push(typeof val);\r\n          break;\r\n        }\r\n\r\n        case OP.JUMP:\r\n          frame._pc = this._operand();\r\n          break;\r\n\r\n        case OP.JUMP_IF_FALSE: {\r\n          var target = this._operand();\r\n          if (!this._pop()) frame._pc = target;\r\n          break;\r\n        }\r\n\r\n        case OP.JUMP_IF_TRUE_OR_POP: {\r\n          // || semantics: if truthy, we're done - leave value, jump over RHS.\r\n          // If falsy, discard it and fall through to evaluate RHS.\r\n          var target = this._operand();\r\n          if (this.peek()) {\r\n            frame._pc = target;\r\n          } else {\r\n            this._pop();\r\n          }\r\n          break;\r\n        }\r\n\r\n        case OP.JUMP_IF_FALSE_OR_POP: {\r\n          // && semantics: if falsy, we're done - leave value, jump over RHS.\r\n          // If truthy, discard it and fall through to evaluate RHS.\r\n          var target = this._operand();\r\n          if (!this.peek()) {\r\n            frame._pc = target;\r\n          } else {\r\n            this._pop();\r\n          }\r\n          break;\r\n        }\r\n\r\n        case OP.MAKE_CLOSURE: {\r\n          // Inline operands: startPc, paramCount, localCount, uvCount,\r\n          //                  [isLocal_0, idx_0, isLocal_1, idx_1, ...]\r\n          var startPc = this._operand();\r\n          var paramCount = this._operand();\r\n          var localCount = this._operand();\r\n          var uvCount = this._operand();\r\n\r\n          var uvDescs = new Array(uvCount);\r\n          for (var i = 0; i < uvCount; i++) {\r\n            var isLocalRaw = this._operand();\r\n            var uvIndex = this._operand();\r\n            uvDescs[i] = { isLocal: isLocalRaw, _index: uvIndex };\r\n          }\r\n\r\n          var fn = {\r\n            paramCount: paramCount,\r\n            localCount: localCount,\r\n            startPc: startPc,\r\n            upvalueDescriptors: uvDescs,\r\n          };\r\n\r\n          var closure = new Closure(fn);\r\n          for (var i = 0; i < uvDescs.length; i++) {\r\n            var uvd = uvDescs[i];\r\n            if (uvd.isLocal) {\r\n              // Capture directly from current frame's local slot\r\n              closure.upvalues.push(this.captureUpvalue(frame, uvd._index));\r\n            } else {\r\n              // Relay - take upvalue from the enclosing closure's list\r\n              closure.upvalues.push(frame.closure.upvalues[uvd._index]);\r\n            }\r\n          }\r\n          // Wrap in a native callable shell so host code (array methods,\r\n          // test assertions, setTimeout, etc.) can invoke VM closures.\r\n          // CLOSURE_SYM lets VM-internal CALL/NEW bypass the sub-VM entirely.\r\n          var self = this;\r\n          var shell = (function (c) {\r\n            return function () {\r\n              var args = Array.prototype.slice.call(arguments);\r\n              var sub = new VM(self.bytecode, 0, self.constants, self.globals);\r\n              // Sloppy-mode: null/undefined thisArg \u2192 global object\r\n              var f = new Frame(\r\n                c,\r\n                null,\r\n                null,\r\n                this == null ? self.globals : this,\r\n              );\r\n              for (var i = 0; i < args.length; i++) f.locals[i] = args[i];\r\n              f.locals[c.fn.paramCount] = args;\r\n              sub._currentFrame = f;\r\n              return sub.run();\r\n            };\r\n          })(closure);\r\n          shell[CLOSURE_SYM] = closure;\r\n          shell.prototype = closure.prototype; // unified prototype for new/instanceof\r\n          this._push(shell);\r\n          break;\r\n        }\r\n\r\n        case OP.LOAD_UPVALUE:\r\n          this._push(frame.closure.upvalues[this._operand()]._read());\r\n          break;\r\n\r\n        case OP.STORE_UPVALUE:\r\n          frame.closure.upvalues[this._operand()]._write(this._pop());\r\n          break;\r\n\r\n        case OP.BUILD_ARRAY: {\r\n          var elems = this._stack.splice(this._stack.length - this._operand());\r\n          this._push(elems);\r\n          break;\r\n        }\r\n\r\n        case OP.BUILD_OBJECT: {\r\n          // Stack has: key0, val0, key1, val1 ... keyN, valN  (pushed left->right)\r\n          // Pop all pairs and build the object.\r\n          var pairs = this._stack.splice(\r\n            this._stack.length - this._operand() * 2,\r\n          );\r\n          var o = {};\r\n          for (var i = 0; i < pairs.length; i += 2) {\r\n            o[pairs[i]] = pairs[i + 1]; // key at even index, val at odd\r\n          }\r\n          this._push(o);\r\n          break;\r\n        }\r\n        case OP.SET_PROP: {\r\n          // Stack: [..., obj, key, val]\r\n          // Leaves val on stack - assignment is an expression in JS.\r\n          var val = this._pop();\r\n          var key = this._pop();\r\n          var obj = this._pop();\r\n          // Reflect.set performs [[Set]] without throwing on failure,\r\n          // correctly simulating sloppy-mode assignment from a strict-mode host\r\n          // (output.js is an ES module). This also properly invokes inherited\r\n          // or prototype-chain setter functions.\r\n          Reflect.set(obj, key, val);\r\n          this._push(val); // assignment expression evaluates to the assigned value\r\n          break;\r\n        }\r\n        case OP.GET_PROP_COMPUTED: {\r\n          // Stack: [..., obj, key]  - key is a runtime value (nums[i])\r\n          // Mirrors GET_PROP but pops the key that was pushed dynamically.\r\n          var key = this._pop();\r\n          var obj = this._pop();\r\n          this._push(obj[key]);\r\n          break;\r\n        }\r\n        case OP.DELETE_PROP: {\r\n          var key = this._pop();\r\n          var obj = this._pop();\r\n          this._push(delete obj[key]);\r\n          break;\r\n        }\r\n\r\n        case OP.CALL: {\r\n          var args = this._stack.splice(this._stack.length - this._operand());\r\n          var callee = this._pop();\r\n          if (callee && callee[CLOSURE_SYM]) {\r\n            // VM closure - run directly in this VM, no sub-VM overhead\r\n            var c = callee[CLOSURE_SYM];\r\n            // Sloppy-mode: plain function call \u2192 global object as this\r\n            var f = new Frame(c, frame._pc, frame, this.globals);\r\n            for (var i = 0; i < args.length; i++) f.locals[i] = args[i];\r\n            f.locals[c.fn.paramCount] = args;\r\n            this._frameStack.push(this._currentFrame);\r\n            this._currentFrame = f;\r\n          } else {\r\n            // Native function\r\n            this._push(callee.apply(null, args));\r\n          }\r\n          break;\r\n        }\r\n\r\n        case OP.CALL_METHOD: {\r\n          var args = this._stack.splice(this._stack.length - this._operand());\r\n          var callee = this._pop();\r\n          var receiver = this._pop(); // left on stack by GET_PROP\r\n          if (callee && callee[CLOSURE_SYM]) {\r\n            // VM closure - run directly in this VM with receiver as this\r\n            var c = callee[CLOSURE_SYM];\r\n            var f = new Frame(c, frame._pc, frame, receiver);\r\n            for (var i = 0; i < args.length; i++) f.locals[i] = args[i];\r\n            f.locals[c.fn.paramCount] = args;\r\n            this._frameStack.push(this._currentFrame);\r\n            this._currentFrame = f;\r\n          } else {\r\n            // Native method\r\n            this._push(callee.apply(receiver, args));\r\n          }\r\n          break;\r\n        }\r\n\r\n        case OP.LOAD_THIS:\r\n          this._push(frame.thisVal);\r\n          break;\r\n\r\n        case OP.NEW: {\r\n          var args = this._stack.splice(this._stack.length - this._operand());\r\n          var callee = this._pop();\r\n          if (callee && callee[CLOSURE_SYM]) {\r\n            // VM closure constructor - prototype is unified via shell.prototype = closure.prototype\r\n            var c = callee[CLOSURE_SYM];\r\n            var newObj = Object.create(c.prototype || null);\r\n            var f = new Frame(c, frame._pc, frame, newObj);\r\n            f._newObj = newObj;\r\n            for (var i = 0; i < args.length; i++) f.locals[i] = args[i];\r\n            f.locals[c.fn.paramCount] = args;\r\n            this._frameStack.push(this._currentFrame);\r\n            this._currentFrame = f;\r\n          } else {\r\n            // Native constructor (e.g. new Error(), new Date()).\r\n            // Reflect.construct is required - Object.create+apply does NOT set\r\n            // internal slots ([[NumberData]], [[StringData]], etc.) for built-ins.\r\n            this._push(Reflect.construct(callee, args));\r\n          }\r\n          break;\r\n        }\r\n\r\n        case OP.RETURN: {\r\n          var retVal = this._pop();\r\n          this._closeUpvaluesFor(frame); // must happen before frame is abandoned\r\n          if (this._frameStack.length === 0) return retVal;\r\n\r\n          // new-call rule: primitive return -> discard, use the constructed object instead\r\n          if (frame._newObj !== null) {\r\n            if (typeof retVal !== \"object\" || retVal === null)\r\n              retVal = frame._newObj;\r\n          }\r\n\r\n          this._currentFrame = this._frameStack.pop();\r\n          this._push(retVal);\r\n          break;\r\n        }\r\n\r\n        case OP.POP:\r\n          this._pop();\r\n          break;\r\n\r\n        case OP.DUP:\r\n          this._push(this.peek());\r\n          break;\r\n\r\n        case OP.THROW:\r\n          throw this._pop();\r\n\r\n        case OP.FOR_IN_SETUP: {\r\n          // Pop the object; build an ordered list of all enumerable own+inherited\r\n          // string keys by walking the prototype chain manually.\r\n          // Uses getOwnPropertyNames (includes non-enumerable) + descriptor check,\r\n          // so we never rely on Object.keys() and we handle inheritance correctly.\r\n          var obj = this._pop();\r\n          var keys = [];\r\n          if (obj !== null && obj !== undefined) {\r\n            var seen = Object.create(null);\r\n            var cur = Object(obj); // box primitives\r\n            while (cur !== null) {\r\n              var ownNames = Object.getOwnPropertyNames(cur);\r\n              for (var i = 0; i < ownNames.length; i++) {\r\n                var k = ownNames[i];\r\n                if (!(k in seen)) {\r\n                  seen[k] = true;\r\n                  var propDesc = Object.getOwnPropertyDescriptor(cur, k);\r\n                  if (propDesc && propDesc.enumerable) {\r\n                    keys.push(k);\r\n                  }\r\n                }\r\n              }\r\n              cur = Object.getPrototypeOf(cur);\r\n            }\r\n          }\r\n          this._push({ _keys: keys, i: 0 });\r\n          break;\r\n        }\r\n\r\n        case OP.FOR_IN_NEXT: {\r\n          // Operand = jump target for the done case. Must be read before the\r\n          // conditional so the PC stays correctly aligned either way.\r\n          var target = this._operand();\r\n          var iter = this._pop();\r\n          if (iter.i >= iter._keys.length) {\r\n            frame._pc = target;\r\n          } else {\r\n            this._push(iter._keys[iter.i++]);\r\n          }\r\n          break;\r\n        }\r\n\r\n        case OP.PATCH: {\r\n          // Inline operands: destPc, sliceStart, sliceEnd\r\n          // Copies bytecode[sliceStart..sliceEnd) flat u16 slots to destPc.\r\n          var destPc = this._operand();\r\n          var sliceStart = this._operand();\r\n          var sliceEnd = this._operand();\r\n\r\n          for (var pi = sliceStart; pi < sliceEnd; pi++) {\r\n            this.bytecode[destPc + (pi - sliceStart)] = this.bytecode[pi];\r\n          }\r\n          break;\r\n        }\r\n\r\n        case OP.TRY_SETUP: {\r\n          // Push an exception handler record onto the current frame.\r\n          // Saves: catch PC (operand), current stack depth, current frame-stack depth.\r\n          // If an exception is thrown before TRY_END fires, the VM jumps here.\r\n          frame._handlerStack.push({\r\n            handlerPc: this._operand(),\r\n            stackDepth: this._stack.length,\r\n            frameStackDepth: this._frameStack.length,\r\n          });\r\n          break;\r\n        }\r\n\r\n        case OP.TRY_END: {\r\n          // Normal exit from a try block \u2014 disarm the exception handler.\r\n          frame._handlerStack.pop();\r\n          break;\r\n        }\r\n\r\n        case OP.DEFINE_GETTER: {\r\n          // Stack: [..., obj, key, getterFn]\r\n          // Pops all three; defines an enumerable, configurable getter on obj.\r\n          // If a setter was already defined for this key, it is preserved.\r\n          var getterFn = this._pop();\r\n          var key = this._pop();\r\n          var obj = this._pop();\r\n          var existingDesc = Object.getOwnPropertyDescriptor(obj, key);\r\n          var getDesc                     = {\r\n            get: getterFn,\r\n            configurable: true,\r\n            enumerable: true,\r\n          };\r\n          if (existingDesc && typeof existingDesc.set === \"function\") {\r\n            getDesc.set = existingDesc.set;\r\n          }\r\n          Object.defineProperty(obj, key, getDesc);\r\n          break;\r\n        }\r\n\r\n        case OP.DEFINE_SETTER: {\r\n          // Stack: [..., obj, key, setterFn]\r\n          // Pops all three; defines an enumerable, configurable setter on obj.\r\n          // If a getter was already defined for this key, it is preserved.\r\n          var setterFn = this._pop();\r\n          var key = this._pop();\r\n          var obj = this._pop();\r\n          var existingDesc = Object.getOwnPropertyDescriptor(obj, key);\r\n          var setDesc                     = {\r\n            set: setterFn,\r\n            configurable: true,\r\n            enumerable: true,\r\n          };\r\n          if (existingDesc && typeof existingDesc.get === \"function\") {\r\n            setDesc.get = existingDesc.get;\r\n          }\r\n          Object.defineProperty(obj, key, setDesc);\r\n          break;\r\n        }\r\n\r\n        case OP.DEBUGGER: {\r\n          debugger;\r\n          break;\r\n        }\r\n\r\n        default:\r\n          throw new Error(\r\n            \"Unknown opcode: \" + op + \" at pc \" + (frame._pc - 1),\r\n          );\r\n      }\r\n    } catch (err) {\r\n      // Exception handler unwinding (CPython-style frame walk, Lua-style upvalue close).\r\n      // Walk from the current frame upward until we find a frame that has an open\r\n      // exception handler (TRY_SETUP without a matching TRY_END).\r\n      // For every frame we abandon along the way, close its captured upvalues.\r\n      var handledFrame = null;\r\n      var searchFrame = this._currentFrame;\r\n      while (true) {\r\n        if (searchFrame._handlerStack.length > 0) {\r\n          handledFrame = searchFrame;\r\n          break;\r\n        }\r\n        // No handler in this frame \u2014 abandon it and walk up.\r\n        this._closeUpvaluesFor(searchFrame);\r\n        if (this._frameStack.length === 0) break;\r\n        searchFrame = this._frameStack.pop();\r\n        this._currentFrame = searchFrame;\r\n      }\r\n\r\n      if (!handledFrame) throw err; // no handler anywhere \u2014 propagate to host\r\n\r\n      var h = handledFrame._handlerStack.pop();\r\n      // Restore the VM value stack to the depth recorded at TRY_SETUP time,\r\n      // then push the caught exception so the catch binding can store it.\r\n      this._stack.length = h.stackDepth;\r\n      this._push(err);\r\n      // Discard any call-frames that were pushed inside the try body\r\n      // (functions called from within the try block that are still live).\r\n      this._frameStack.length = h.frameStackDepth;\r\n      // Jump to the catch block.\r\n      handledFrame._pc = h.handlerPc;\r\n      this._currentFrame = handledFrame;\r\n    }\r\n  }\r\n};\r\n\r\n// Boot\r\nvar globals      = {}; // global object for globals\r\n\r\n// Always pull built-ins from globalThis so eval() scoping can't shadow them\r\n// with a local `window` variable (e.g. the test harness fake window).\r\nfor (var k of Object.getOwnPropertyNames(globalThis)) {\r\n  globals[k] = globalThis[k];\r\n}\r\n// If a window object is in scope (browser or test harness), capture it\r\n// explicitly so VM code can read/write window.TEST_OUTPUT etc.\r\nif (typeof window !== \"undefined\") {\r\n  globals[\"window\"] = window;\r\n}\r\n\r\n// Transfer common primitives\r\nglobals.undefined = undefined;\r\nglobals.Infinity = Infinity;\r\nglobals.NaN = NaN;\r\n\r\nvar vm = new VM(decodeBytecode(BYTECODE), MAIN_START_PC, CONSTANTS, globals);\r\nvm.run();\r\n";
+const readVMRuntimeFile = () => "import { OP_ORIGINAL as OP } from \"./compiler.ts\";\nconst BYTECODE = [];\nconst MAIN_START_PC = 0;\nconst MAIN_REG_COUNT = 0;\nconst CONSTANTS = [];\nconst ENCODE_BYTECODE = false;\nconst TIMING_CHECKS = false;\n// The text above is not included in the compiled output - for type intellisense only\n// @START\n\nfunction decodeBytecode(s) {\n  if (!ENCODE_BYTECODE) return s;\n\n  var b =\n    typeof Buffer !== \"undefined\"\n      ? Buffer.from(s, \"base64\")\n      : Uint8Array.from(atob(s), function (c) {\n          return c.charCodeAt(0);\n        });\n  // Each slot is a u16 stored as 2 little-endian bytes.\n  var r = new Uint16Array(b.length / 2);\n  for (var i = 0; i < r.length; i++) r[i] = b[i * 2] | (b[i * 2 + 1] << 8);\n  return r;\n}\n\n// Closure symbol\n// Used to tag shell functions so the VM can fast-path back to the\n// inner Closure instead of going through a sub-VM on internal calls.\nvar CLOSURE_SYM = Symbol(); // Nameless for obfuscation\n\n// Upvalue\n// While the outer frame is alive: reads/writes go to frame.regs[slot].\n// After the outer frame returns (closed): reads/writes hit this._value.\nfunction Upvalue(frame, slot) {\n  this._frame = frame;\n  this._slot = slot;\n  this._closed = false;\n  this._value = undefined;\n}\nUpvalue.prototype._read = function () {\n  return this._closed ? this._value : this._frame.regs[this._slot];\n};\nUpvalue.prototype._write = function (v) {\n  if (this._closed) this._value = v;\n  else this._frame.regs[this._slot] = v;\n};\nUpvalue.prototype._close = function () {\n  this._value = this._frame.regs[this._slot];\n  this._closed = true;\n};\n\n// Closure & Frame\nfunction Closure(fn) {\n  this.fn = fn;\n  this.upvalues = [];\n  this.prototype = {}; // <- default prototype object for `new`\n}\n\nfunction Frame(closure, returnPc, parent, thisVal, retDstReg) {\n  this.closure = closure;\n  this.regs = new Array(closure.fn.regCount).fill(undefined);\n  this._pc = closure.fn.startPc; // <- initialize from fn descriptor\n  this._returnPc = returnPc; // pc to resume in parent frame after RETURN\n  this._parent = parent;\n  this.thisVal = thisVal !== undefined ? thisVal : undefined;\n  this._retDstReg = retDstReg !== undefined ? retDstReg : 0; // register in parent to write return value\n  this._newObj = null; // <- set by NEW so RETURN can see it\n  this._handlerStack = []; // <- exception handlers pushed by TRY_SETUP\n}\n\n// VM\nfunction VM(bytecode, mainStartPc, mainRegCount, constants, globals) {\n  this.bytecode = bytecode;\n  this.constants = constants;\n  this.globals = globals;\n  this._frameStack = [];\n  this._openUpvalues = []; // all currently open Upvalue objects across all frames\n\n  var mainFn = {\n    paramCount: 0,\n    regCount: mainRegCount,\n    startPc: mainStartPc, // <- where main begins\n  };\n  this._currentFrame = new Frame(new Closure(mainFn), null, null, undefined, 0);\n}\n\n// Consume the next slot from the flat bytecode stream and advance the PC.\n// Called by opcode handlers to read each of their operands in order.\nVM.prototype._operand = function () {\n  return this.bytecode[this._currentFrame._pc++];\n};\n\nVM.prototype.captureUpvalue = function (frame, slot) {\n  // Reuse existing open upvalue for this frame+slot if one exists.\n  // This is what makes two closures share the same mutable cell.\n  for (var i = 0; i < this._openUpvalues.length; i++) {\n    var uv = this._openUpvalues[i];\n    if (uv._frame === frame && uv._slot === slot) return uv;\n  }\n  var uv = new Upvalue(frame, slot);\n  this._openUpvalues.push(uv);\n  return uv;\n};\n\n// Reads and decodes a constant from the pool.\n// idx  \u2014 pool index (first operand of the constant pair emitted by resolveConstants).\n// key  \u2014 conceal key (second operand). 0 means no concealment.\n//\n// For integers:  stored value is (original ^ key); XOR again to recover.\n// For strings:   stored value is a base64 string containing u16 LE byte pairs.\n//                Mirrors decodeBytecode: base64 \u2192 bytes \u2192 u16 LE \u2192 XOR with\n//                (key + i) & 0xFFFF to recover the original char codes.\n// idxIn, keyIn are passed in from specializedOpcodes when the operands are determined at compile time.\nVM.prototype._constant = function (idxIn, keyIn) {\n  var idx = idxIn ?? this._operand();\n  var key = keyIn ?? this._operand();\n\n  var v = this.constants[idx];\n  if (!key) return v;\n  if (typeof v === \"number\") return v ^ key;\n  // String: base64-decode to u16 LE byte pairs, then XOR each code with (key+i).\n  var b =\n    typeof Buffer !== \"undefined\"\n      ? Buffer.from(v, \"base64\")\n      : Uint8Array.from(atob(v), function (c) {\n          return c.charCodeAt(0);\n        });\n  var out = \"\";\n  for (var i = 0; i < b.length / 2; i++) {\n    var code = b[i * 2] | (b[i * 2 + 1] << 8); // u16 LE\n    out += String.fromCharCode(code ^ ((key + i) & 0xffff));\n  }\n  return out;\n};\n\nVM.prototype._closeUpvaluesFor = function (frame) {\n  // Called on RETURN - close every upvalue that was pointing into this frame.\n  // After this, closures that captured from the frame read from upvalue.value.\n  this._openUpvalues = this._openUpvalues.filter(function (uv) {\n    if (uv._frame === frame) {\n      uv._close();\n      return false;\n    }\n    return true;\n  });\n};\n\nVM.prototype.run = function () {\n  var now = () => {\n    return performance.now();\n  };\n\n  var lastTime = now();\n\n  while (true) {\n    var frame = this._currentFrame;\n    var bc = this.bytecode;\n    if (frame._pc >= bc.length) break;\n\n    var pc = frame._pc++;\n    var op = this.bytecode[pc];\n    var opcode = this.bytecode[pc];\n    // console.log(\n    //   \"pc=\" + pc,\n    //   \"opcode=\" + opcode,\n    //   Object.keys(OP).find((key) => OP[key] === opcode),\n    // );\n\n    // Debugging protection: Detects debugger by checking for >1s pauses which can only happen from debugger; or extremely slow sync tasks\n    if (TIMING_CHECKS) {\n      var currentTime = now();\n      var isTamper = currentTime - lastTime > 1000;\n      lastTime = currentTime;\n      if (isTamper) {\n        // Poison the bytecode\n        for (var i = 0; i < this.bytecode.length; i++) this.bytecode[i] = 0;\n        // Break the current state\n        frame.regs.fill(undefined);\n        op = OP.JUMP;\n        frame._pc = this.bytecode.length; // jump past end to halt\n      }\n    }\n\n    try {\n      /* @SWITCH */\n      switch (op) {\n        case OP.LOAD_CONST: {\n          var dst = this._operand();\n          frame.regs[dst] = this._constant();\n          break;\n        }\n\n        case OP.LOAD_INT: {\n          var dst = this._operand();\n          frame.regs[dst] = this._operand();\n          break;\n        }\n\n        case OP.LOAD_GLOBAL: {\n          var dst = this._operand();\n          var globalName = this._constant();\n\n          if (!(globalName in this.globals)) {\n            throw new ReferenceError(`${globalName} is not defined`);\n          }\n\n          frame.regs[dst] = this.globals[globalName];\n          break;\n        }\n\n        case OP.LOAD_UPVALUE: {\n          var dst = this._operand();\n          frame.regs[dst] = frame.closure.upvalues[this._operand()]._read();\n          break;\n        }\n\n        case OP.LOAD_THIS: {\n          var dst = this._operand();\n          frame.regs[dst] = frame.thisVal;\n          break;\n        }\n\n        case OP.MOVE: {\n          var dst = this._operand();\n          frame.regs[dst] = frame.regs[this._operand()];\n          break;\n        }\n\n        case OP.STORE_GLOBAL: {\n          // nameIdx and key are consumed inline so the concealConstants runtime\n          // transform can rewrite this._constant() consistently.\n          this.globals[this._constant()] = frame.regs[this._operand()];\n          break;\n        }\n\n        case OP.STORE_UPVALUE: {\n          var uvIdx = this._operand();\n          frame.closure.upvalues[uvIdx]._write(frame.regs[this._operand()]);\n          break;\n        }\n\n        case OP.GET_PROP: {\n          // dst = regs[obj][regs[key]]\n          var dst = this._operand();\n          var obj = frame.regs[this._operand()];\n          var key = frame.regs[this._operand()];\n          frame.regs[dst] = obj[key];\n          break;\n        }\n\n        case OP.SET_PROP: {\n          // regs[obj][regs[key]] = regs[val]\n          var obj = frame.regs[this._operand()];\n          var key = frame.regs[this._operand()];\n          var val = frame.regs[this._operand()];\n          // Reflect.set performs [[Set]] without throwing on failure,\n          // correctly simulating sloppy-mode assignment from a strict-mode host.\n          Reflect.set(obj, key, val);\n          break;\n        }\n\n        case OP.DELETE_PROP: {\n          var dst = this._operand();\n          var obj = frame.regs[this._operand()];\n          var key = frame.regs[this._operand()];\n          frame.regs[dst] = delete obj[key];\n          break;\n        }\n\n        // \u2500\u2500 Arithmetic  (dst, src1, src2) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.ADD: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a + frame.regs[this._operand()];\n          break;\n        }\n        case OP.SUB: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a - frame.regs[this._operand()];\n          break;\n        }\n        case OP.MUL: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a * frame.regs[this._operand()];\n          break;\n        }\n        case OP.DIV: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a / frame.regs[this._operand()];\n          break;\n        }\n        case OP.MOD: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a % frame.regs[this._operand()];\n          break;\n        }\n        case OP.BAND: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a & frame.regs[this._operand()];\n          break;\n        }\n        case OP.BOR: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a | frame.regs[this._operand()];\n          break;\n        }\n        case OP.BXOR: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a ^ frame.regs[this._operand()];\n          break;\n        }\n        case OP.SHL: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a << frame.regs[this._operand()];\n          break;\n        }\n        case OP.SHR: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a >> frame.regs[this._operand()];\n          break;\n        }\n        case OP.USHR: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a >>> frame.regs[this._operand()];\n          break;\n        }\n\n        // \u2500\u2500 Comparison  (dst, src1, src2) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.LT: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a < frame.regs[this._operand()];\n          break;\n        }\n        case OP.GT: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a > frame.regs[this._operand()];\n          break;\n        }\n        case OP.LTE: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a <= frame.regs[this._operand()];\n          break;\n        }\n        case OP.GTE: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a >= frame.regs[this._operand()];\n          break;\n        }\n        case OP.EQ: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a === frame.regs[this._operand()];\n          break;\n        }\n        case OP.NEQ: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a !== frame.regs[this._operand()];\n          break;\n        }\n        case OP.LOOSE_EQ: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a == frame.regs[this._operand()];\n          break;\n        }\n        case OP.LOOSE_NEQ: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a != frame.regs[this._operand()];\n          break;\n        }\n        case OP.IN: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a in frame.regs[this._operand()];\n          break;\n        }\n        case OP.INSTANCEOF: {\n          var dst = this._operand();\n          var obj = frame.regs[this._operand()];\n          var ctor = frame.regs[this._operand()];\n          if (typeof ctor === \"function\") {\n            frame.regs[dst] = obj instanceof ctor;\n          } else {\n            // VM Closure - walk prototype chain for identity with ctor.prototype.\n            var proto = ctor.prototype;\n            var target = Object.getPrototypeOf(obj);\n            var result = false;\n            while (target !== null) {\n              if (target === proto) {\n                result = true;\n                break;\n              }\n              target = Object.getPrototypeOf(target);\n            }\n            frame.regs[dst] = result;\n          }\n          break;\n        }\n\n        // \u2500\u2500 Unary  (dst, src) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.UNARY_NEG: {\n          var dst = this._operand();\n          frame.regs[dst] = -frame.regs[this._operand()];\n          break;\n        }\n        case OP.UNARY_POS: {\n          var dst = this._operand();\n          frame.regs[dst] = +frame.regs[this._operand()];\n          break;\n        }\n        case OP.UNARY_NOT: {\n          var dst = this._operand();\n          frame.regs[dst] = !frame.regs[this._operand()];\n          break;\n        }\n        case OP.UNARY_BITNOT: {\n          var dst = this._operand();\n          frame.regs[dst] = ~frame.regs[this._operand()];\n          break;\n        }\n        case OP.TYPEOF: {\n          var dst = this._operand();\n          frame.regs[dst] = typeof frame.regs[this._operand()];\n          break;\n        }\n        case OP.VOID: {\n          var dst = this._operand();\n          this._operand(); // consume src \u2014 evaluated for side-effects by compiler\n          frame.regs[dst] = undefined;\n          break;\n        }\n        case OP.TYPEOF_SAFE: {\n          // dst, nameConstIdx \u2014 safe typeof for potentially-undeclared globals.\n          var dst = this._operand();\n          var name = this._constant();\n          var val = Object.prototype.hasOwnProperty.call(this.globals, name)\n            ? this.globals[name]\n            : undefined;\n          frame.regs[dst] = typeof val;\n          break;\n        }\n\n        // \u2500\u2500 Control flow \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.JUMP:\n          frame._pc = this._operand();\n          break;\n\n        case OP.JUMP_IF_FALSE: {\n          var src = this._operand();\n          var target = this._operand();\n          if (!frame.regs[src]) frame._pc = target;\n          break;\n        }\n\n        case OP.JUMP_IF_TRUE: {\n          // || short-circuit: if truthy, jump over RHS.\n          var src = this._operand();\n          var target = this._operand();\n          if (frame.regs[src]) frame._pc = target;\n          break;\n        }\n\n        // \u2500\u2500 Calls \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.CALL: {\n          // dst, calleeReg, argc, [argReg...]\n          var dst = this._operand();\n          var callee = frame.regs[this._operand()];\n          var argc = this._operand();\n          var args = new Array(argc);\n          for (var i = 0; i < argc; i++) args[i] = frame.regs[this._operand()];\n\n          if (callee && callee[CLOSURE_SYM]) {\n            var c = callee[CLOSURE_SYM];\n            var f = new Frame(c, frame._pc, frame, this.globals, dst);\n            for (var i = 0; i < args.length; i++) f.regs[i] = args[i];\n            f.regs[c.fn.paramCount] = args;\n            this._frameStack.push(this._currentFrame);\n            this._currentFrame = f;\n          } else {\n            frame.regs[dst] = callee.apply(null, args);\n          }\n          break;\n        }\n\n        case OP.CALL_METHOD: {\n          // dst, receiverReg, calleeReg, argc, [argReg...]\n          var dst = this._operand();\n          var receiver = frame.regs[this._operand()];\n          var callee = frame.regs[this._operand()];\n          var argc = this._operand();\n          var args = new Array(argc);\n          for (var i = 0; i < argc; i++) args[i] = frame.regs[this._operand()];\n\n          if (callee && callee[CLOSURE_SYM]) {\n            var c = callee[CLOSURE_SYM];\n            var f = new Frame(c, frame._pc, frame, receiver, dst);\n            for (var i = 0; i < args.length; i++) f.regs[i] = args[i];\n            f.regs[c.fn.paramCount] = args;\n            this._frameStack.push(this._currentFrame);\n            this._currentFrame = f;\n          } else {\n            frame.regs[dst] = callee.apply(receiver, args);\n          }\n          break;\n        }\n\n        case OP.NEW: {\n          // dst, calleeReg, argc, [argReg...]\n          var dst = this._operand();\n          var callee = frame.regs[this._operand()];\n          var argc = this._operand();\n          var args = new Array(argc);\n          for (var i = 0; i < argc; i++) args[i] = frame.regs[this._operand()];\n\n          if (callee && callee[CLOSURE_SYM]) {\n            var c = callee[CLOSURE_SYM];\n            var newObj = Object.create(c.prototype || null);\n            var f = new Frame(c, frame._pc, frame, newObj, dst);\n            f._newObj = newObj;\n            for (var i = 0; i < args.length; i++) f.regs[i] = args[i];\n            f.regs[c.fn.paramCount] = args;\n            this._frameStack.push(this._currentFrame);\n            this._currentFrame = f;\n          } else {\n            // Reflect.construct is required - Object.create+apply does NOT set\n            // internal slots ([[NumberData]], [[StringData]], etc.) for built-ins.\n            frame.regs[dst] = Reflect.construct(callee, args);\n          }\n          break;\n        }\n\n        case OP.RETURN: {\n          var retVal = frame.regs[this._operand()];\n          this._closeUpvaluesFor(frame); // must happen before frame is abandoned\n\n          if (this._frameStack.length === 0) return retVal; // main script returning\n\n          // new-call rule: primitive return -> discard, use the constructed object instead\n          if (frame._newObj !== null) {\n            if (typeof retVal !== \"object\" || retVal === null)\n              retVal = frame._newObj;\n          }\n\n          var parentFrame = this._frameStack.pop();\n          parentFrame.regs[frame._retDstReg] = retVal;\n          this._currentFrame = parentFrame;\n          break;\n        }\n\n        case OP.THROW:\n          throw frame.regs[this._operand()];\n\n        // \u2500\u2500 Closures \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.MAKE_CLOSURE: {\n          // dst, startPc, paramCount, regCount, uvCount, [isLocal, idx, ...]\n          var dst = this._operand();\n          var startPc = this._operand();\n          var paramCount = this._operand();\n          var regCount = this._operand();\n          var uvCount = this._operand();\n\n          var uvDescs = new Array(uvCount);\n          for (var i = 0; i < uvCount; i++) {\n            var isLocalRaw = this._operand();\n            var uvIndex = this._operand();\n            uvDescs[i] = { isLocal: isLocalRaw, _index: uvIndex };\n          }\n\n          var fn = {\n            paramCount: paramCount,\n            regCount: regCount,\n            startPc: startPc,\n            upvalueDescriptors: uvDescs,\n          };\n\n          var closure = new Closure(fn);\n          for (var i = 0; i < uvDescs.length; i++) {\n            var uvd = uvDescs[i];\n            if (uvd.isLocal) {\n              closure.upvalues.push(this.captureUpvalue(frame, uvd._index));\n            } else {\n              closure.upvalues.push(frame.closure.upvalues[uvd._index]);\n            }\n          }\n\n          // Wrap in a native callable shell so host code (array methods,\n          // test assertions, setTimeout, etc.) can invoke VM closures.\n          // CLOSURE_SYM lets VM-internal CALL/NEW bypass the sub-VM entirely.\n          var self = this;\n          var shell = (function (c) {\n            return function () {\n              var args = Array.prototype.slice.call(arguments);\n              var sub = new VM(\n                self.bytecode,\n                0,\n                c.fn.regCount,\n                self.constants,\n                self.globals,\n              );\n              var f = new Frame(\n                c,\n                null,\n                null,\n                this == null ? self.globals : this,\n                0,\n              );\n              for (var i = 0; i < args.length; i++) f.regs[i] = args[i];\n              f.regs[c.fn.paramCount] = args;\n              sub._currentFrame = f;\n              return sub.run();\n            };\n          })(closure);\n          shell[CLOSURE_SYM] = closure;\n          shell.prototype = closure.prototype; // unified prototype for new/instanceof\n          frame.regs[dst] = shell;\n          break;\n        }\n\n        // \u2500\u2500 Collections \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.BUILD_ARRAY: {\n          // dst, count, [elemReg...]\n          var dst = this._operand();\n          var count = this._operand();\n          var elems = new Array(count);\n          for (var i = 0; i < count; i++)\n            elems[i] = frame.regs[this._operand()];\n          frame.regs[dst] = elems;\n          break;\n        }\n\n        case OP.BUILD_OBJECT: {\n          // dst, pairCount, [keyReg, valReg, ...]\n          var dst = this._operand();\n          var pairCount = this._operand();\n          var o = {};\n          for (var i = 0; i < pairCount; i++) {\n            var key = frame.regs[this._operand()];\n            var val = frame.regs[this._operand()];\n            o[key] = val;\n          }\n          frame.regs[dst] = o;\n          break;\n        }\n\n        // \u2500\u2500 Property definitions (getters / setters) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.DEFINE_GETTER: {\n          // obj, key, fn\n          var obj = frame.regs[this._operand()];\n          var key = frame.regs[this._operand()];\n          var getterFn = frame.regs[this._operand()];\n          var existingDesc = Object.getOwnPropertyDescriptor(obj, key);\n          var getDesc                     = {\n            get: getterFn,\n            configurable: true,\n            enumerable: true,\n          };\n          if (existingDesc && typeof existingDesc.set === \"function\") {\n            getDesc.set = existingDesc.set;\n          }\n          Object.defineProperty(obj, key, getDesc);\n          break;\n        }\n\n        case OP.DEFINE_SETTER: {\n          // obj, key, fn\n          var obj = frame.regs[this._operand()];\n          var key = frame.regs[this._operand()];\n          var setterFn = frame.regs[this._operand()];\n          var existingDesc = Object.getOwnPropertyDescriptor(obj, key);\n          var setDesc                     = {\n            set: setterFn,\n            configurable: true,\n            enumerable: true,\n          };\n          if (existingDesc && typeof existingDesc.get === \"function\") {\n            setDesc.get = existingDesc.get;\n          }\n          Object.defineProperty(obj, key, setDesc);\n          break;\n        }\n\n        // \u2500\u2500 For-in iteration \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.FOR_IN_SETUP: {\n          // dst, src \u2014 build iterator object from enumerable keys of regs[src]\n          var dst = this._operand();\n          var obj = frame.regs[this._operand()];\n          var keys = [];\n          if (obj !== null && obj !== undefined) {\n            var seen = Object.create(null);\n            var cur = Object(obj); // box primitives\n            while (cur !== null) {\n              var ownNames = Object.getOwnPropertyNames(cur);\n              for (var i = 0; i < ownNames.length; i++) {\n                var k = ownNames[i];\n                if (!(k in seen)) {\n                  seen[k] = true;\n                  var propDesc = Object.getOwnPropertyDescriptor(cur, k);\n                  if (propDesc && propDesc.enumerable) {\n                    keys.push(k);\n                  }\n                }\n              }\n              cur = Object.getPrototypeOf(cur);\n            }\n          }\n          frame.regs[dst] = { _keys: keys, i: 0 };\n          break;\n        }\n\n        case OP.FOR_IN_NEXT: {\n          // dst, iterReg, exitTarget\n          // Advances iterator; writes next key to dst, or jumps to exitTarget when done.\n          var dst = this._operand();\n          var iter = frame.regs[this._operand()];\n          var exitTarget = this._operand();\n          if (iter.i >= iter._keys.length) {\n            frame._pc = exitTarget;\n          } else {\n            frame.regs[dst] = iter._keys[iter.i++];\n          }\n          break;\n        }\n\n        // \u2500\u2500 Exception handling \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.TRY_SETUP: {\n          // handlerPc, exceptionReg \u2014 push exception handler record onto current frame.\n          frame._handlerStack.push({\n            handlerPc: this._operand(),\n            exceptionReg: this._operand(),\n            frameStackDepth: this._frameStack.length,\n          });\n          break;\n        }\n\n        case OP.TRY_END: {\n          // Normal exit from a try block \u2014 disarm the exception handler.\n          frame._handlerStack.pop();\n          break;\n        }\n\n        // \u2500\u2500 Self-modifying bytecode \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.PATCH: {\n          // destPc, sliceStart, sliceEnd\n          var destPc = this._operand();\n          var sliceStart = this._operand();\n          var sliceEnd = this._operand();\n          for (var pi = sliceStart; pi < sliceEnd; pi++) {\n            this.bytecode[destPc + (pi - sliceStart)] = this.bytecode[pi];\n          }\n          break;\n        }\n\n        case OP.DEBUGGER: {\n          debugger;\n          break;\n        }\n\n        default:\n          throw new Error(\n            \"Unknown opcode: \" + op + \" at pc \" + (frame._pc - 1),\n          );\n      }\n    } catch (err) {\n      // Exception handler unwinding (CPython-style frame walk, Lua-style upvalue close).\n      // Walk from the current frame upward until we find a frame that has an open\n      // exception handler (TRY_SETUP without a matching TRY_END).\n      // For every frame we abandon along the way, close its captured upvalues.\n      var handledFrame = null;\n      var searchFrame = this._currentFrame;\n      while (true) {\n        if (searchFrame._handlerStack.length > 0) {\n          handledFrame = searchFrame;\n          break;\n        }\n        // No handler in this frame \u2014 abandon it and walk up.\n        this._closeUpvaluesFor(searchFrame);\n        if (this._frameStack.length === 0) break;\n        searchFrame = this._frameStack.pop();\n        this._currentFrame = searchFrame;\n      }\n\n      if (!handledFrame) throw err; // no handler anywhere \u2014 propagate to host\n\n      var h = handledFrame._handlerStack.pop();\n      // Discard any call-frames that were pushed inside the try body.\n      this._frameStack.length = h.frameStackDepth;\n      // Write the caught exception directly into the designated register.\n      handledFrame.regs[h.exceptionReg] = err;\n      // Jump to the catch block.\n      handledFrame._pc = h.handlerPc;\n      this._currentFrame = handledFrame;\n    }\n  }\n};\n\n// Boot\nvar globals      = {}; // global object for globals\n\n// Always pull built-ins from globalThis so eval() scoping can't shadow them\n// with a local `window` variable (e.g. the test harness fake window).\nfor (var k of Object.getOwnPropertyNames(globalThis)) {\n  globals[k] = globalThis[k];\n}\n// If a window object is in scope (browser or test harness), capture it\n// explicitly so VM code can read/write window.TEST_OUTPUT etc.\nif (typeof window !== \"undefined\") {\n  globals[\"window\"] = window;\n}\n\n// Transfer common primitives\nglobals.undefined = undefined;\nglobals.Infinity = Infinity;\nglobals.NaN = NaN;\n\nvar vm = new VM(\n  decodeBytecode(BYTECODE),\n  MAIN_START_PC,\n  MAIN_REG_COUNT,\n  CONSTANTS,\n  globals,\n);\nvm.run();\n";
 export const VM_RUNTIME = readVMRuntimeFile().split("@START")[1];
-export const SOURCE_NODE_SYM = Symbol("SOURCE_NODE"); // Attach source node location to pseudo bytecode instructions
-
-// Opcodes
+export const SOURCE_NODE_SYM = Symbol("SOURCE_NODE");
+
+// ── Opcodes ──────────────────────────────────────────────────────────────────
+// Register-based encoding.  Operand convention (x86 / CPython style):
+//   destination register first, then source registers, then immediates.
+//
+//   dst      – register index that receives the result
+//   src      – register index holding an input value
+//   imm/Idx  – immediate integer (constant-pool index, upvalue index, argc …)
+//
+// Every arithmetic/comparison/unary instruction: [op, dst, src1, src2?]
+// Every load:                                    [op, dst, ...]
+// Every store:                                   [op, target, src]
+// Calls:     CALL  [op, dst, callee, argc, arg0, arg1, …]
+//            CALL_METHOD [op, dst, receiver, callee, argc, arg0, …]
 export const OP_ORIGINAL = {
+  // ── Loads ─────────────────────────────────────────────────────────────────
   LOAD_CONST: 0,
-  LOAD_LOCAL: 1,
-  STORE_LOCAL: 2,
-  LOAD_GLOBAL: 3,
-  STORE_GLOBAL: 4,
-  GET_PROP: 5,
-  ADD: 6,
-  // a + b (both are popped)
-  SUB: 7,
-  // a - b
-  MUL: 8,
-  // a * b
-  DIV: 9,
-  // a / b
-  MAKE_CLOSURE: 10,
-  CALL: 11,
-  CALL_METHOD: 12,
-  RETURN: 13,
-  POP: 14,
-  // discard top of stack
-  LT: 15,
-  // pop b, pop a -> push (a < b)
-  GT: 16,
-  // pop b, pop a -> push (a > b)
-  EQ: 17,
-  // pop b, pop a -> push (a === b)
-  JUMP: 18,
-  // unconditional - operand = absolute bytecode index
-  JUMP_IF_FALSE: 19,
-  // pop value; jump if falsy
-  LTE: 20,
-  // a <= b
-  GTE: 21,
-  // a >= b
-  NEQ: 22,
-  // a !== b
-  LOAD_UPVALUE: 23,
-  // push frame.closure.upvalues[operand].read()
-  STORE_UPVALUE: 24,
-  // frame.closure.upvalues[operand].write(pop())
-
-  //  Unary
-  UNARY_NEG: 25,
-  // -x
-  UNARY_POS: 26,
-  // +x
-  UNARY_NOT: 27,
-  // !x
-  UNARY_BITNOT: 28,
-  // ~x
-  TYPEOF: 29,
-  // typeof x
-  VOID: 30,
-  // void x  -> always undefined
-
-  TYPEOF_SAFE: 31,
-  // operand = name constIdx - typeof guard for undeclared globals
-  BUILD_ARRAY: 32,
-  // operand = element count - pops N values -> pushes array
-  BUILD_OBJECT: 33,
-  // operand = pair count   - pops N*2 (key,val) -> pushes object
-  SET_PROP: 34,
-  // pop val, pop key, peek obj -> obj[key] = val (obj stays on stack)
-  GET_PROP_COMPUTED: 35,
-  // pop key, peek obj -> push obj[key]  (computed: nums[i])
-
-  MOD: 36,
-  // a % b
-  BAND: 37,
-  // a & b
-  BOR: 38,
-  // a | b
-  BXOR: 39,
-  // a ^ b
-  SHL: 40,
-  // a << b
-  SHR: 41,
-  // a >> b
-  USHR: 42,
-  // a >>> b
-
-  JUMP_IF_FALSE_OR_POP: 43,
-  // && - if top falsy:  jump (keep), else: pop, eval RHS
-  JUMP_IF_TRUE_OR_POP: 44,
-  // || - if top truthy: jump (keep), else: pop, eval RHS
-
-  DELETE_PROP: 45,
-  IN: 46,
-  // a in b
-  INSTANCEOF: 47,
-  // a instanceof b
-
-  // NEW
-  LOAD_THIS: 48,
-  // push frame.thisVal
-  NEW: 49,
-  // operand = argCount - construct a new object
-  DUP: 50,
-  // duplicate top of stack
-  THROW: 51,
-  // pop value, throw it
-  LOOSE_EQ: 52,
-  // a == b  (abstract equality)
-  LOOSE_NEQ: 53,
-  // a != b  (abstract inequality)
-
-  FOR_IN_SETUP: 54,
-  // pop obj -> build enumerable-key iterator -> push {keys,i}
-  FOR_IN_NEXT: 55,
-  // operand=exit_pc; pop iter; if done->jump; else push next key
-
-  // Self-modifying bytecode
+  // dst, constIdx      regs[dst] = constants[constIdx]
+  LOAD_INT: 1,
+  // dst, imm           regs[dst] = imm  (raw u16 literal)
+  LOAD_GLOBAL: 2,
+  // dst, nameIdx       regs[dst] = globals[constants[nameIdx]]
+  LOAD_UPVALUE: 3,
+  // dst, uvIdx         regs[dst] = upvalues[uvIdx].read()
+  LOAD_THIS: 4,
+  // dst                regs[dst] = frame.thisVal
+  MOVE: 5,
+  // dst, src           regs[dst] = regs[src]
+
+  // ── Stores ────────────────────────────────────────────────────────────────
+  STORE_GLOBAL: 6,
+  // nameIdx, src       globals[constants[nameIdx]] = regs[src]
+  STORE_UPVALUE: 7,
+  // uvIdx,   src       upvalues[uvIdx].write(regs[src])
+
+  // ── Property access ───────────────────────────────────────────────────────
+  GET_PROP: 8,
+  // dst, obj, key      regs[dst] = regs[obj][regs[key]]
+  SET_PROP: 9,
+  // obj, key, val      regs[obj][regs[key]] = regs[val]  (result stays in val reg)
+  DELETE_PROP: 10,
+  // dst, obj, key      regs[dst] = delete regs[obj][regs[key]]
+
+  // ── Arithmetic / bitwise  (dst, src1, src2) ───────────────────────────────
+  ADD: 11,
+  SUB: 12,
+  MUL: 13,
+  DIV: 14,
+  MOD: 15,
+  BAND: 16,
+  BOR: 17,
+  BXOR: 18,
+  SHL: 19,
+  SHR: 20,
+  USHR: 21,
+  // ── Comparison  (dst, src1, src2) ─────────────────────────────────────────
+  LT: 22,
+  GT: 23,
+  LTE: 24,
+  GTE: 25,
+  EQ: 26,
+  NEQ: 27,
+  LOOSE_EQ: 28,
+  LOOSE_NEQ: 29,
+  IN: 30,
+  INSTANCEOF: 31,
+  // ── Unary  (dst, src) ─────────────────────────────────────────────────────
+  UNARY_NEG: 32,
+  UNARY_POS: 33,
+  UNARY_NOT: 34,
+  UNARY_BITNOT: 35,
+  TYPEOF: 36,
+  // dst, src
+  VOID: 37,
+  // dst, src   – regs[dst] = undefined (src evaluated for side-effects)
+  TYPEOF_SAFE: 38,
+  // dst, nameConstIdx – safe typeof for potentially-undeclared globals
+
+  // ── Control flow ──────────────────────────────────────────────────────────
+  JUMP: 39,
+  // target
+  JUMP_IF_FALSE: 40,
+  // src, target    if !regs[src] then pc = target
+  JUMP_IF_TRUE: 41,
+  // src, target    if  regs[src] then pc = target  (|| short-circuit)
+
+  // ── Calls & constructors ──────────────────────────────────────────────────
+  CALL: 42,
+  // dst, callee, argc, [argRegs…]
+  CALL_METHOD: 43,
+  // dst, receiver, callee, argc, [argRegs…]
+  NEW: 44,
+  // dst, callee, argc, [argRegs…]
+  RETURN: 45,
+  // src
+  THROW: 46,
+  // src
+
+  // ── Closures ──────────────────────────────────────────────────────────────
+  // dst, startPc, paramCount, regCount, uvCount, [isLocal, idx, …]
+  MAKE_CLOSURE: 47,
+  // ── Collections ───────────────────────────────────────────────────────────
+  BUILD_ARRAY: 48,
+  // dst, count,     [elemRegs…]
+  BUILD_OBJECT: 49,
+  // dst, pairCount, [keyReg, valReg, …]
+
+  // ── Property definitions (getters / setters) ──────────────────────────────
+  DEFINE_GETTER: 50,
+  // obj, key, fn
+  DEFINE_SETTER: 51,
+  // obj, key, fn
+
+  // ── For-in iteration ──────────────────────────────────────────────────────
+  FOR_IN_SETUP: 52,
+  // dst, src              dst = { _keys: enumKeys(src), i: 0 }
+  FOR_IN_NEXT: 53,
+  // dst, iter, exitTarget
+
+  // ── Exception handling ────────────────────────────────────────────────────
+  TRY_SETUP: 54,
+  // handlerPc, exceptionReg
+  TRY_END: 55,
+  // ── Self-modifying bytecode ───────────────────────────────────────────────
   PATCH: 56,
-  // pop destPc; constants[operand]=word[]; write words into bytecode[destPc..]
-
-  // Try-Catch
-  TRY_SETUP: 57,
-  // operand = catch_pc; push exception handler onto frame._handlerStack
-  TRY_END: 58,
-  // pop exception handler (normal exit from try body)
-
-  // Getter / Setter (ES5 object literal accessor syntax)
-  DEFINE_GETTER: 59,
-  // pop fn, pop key, pop obj -> Object.defineProperty(obj, key, {get: fn})
-  DEFINE_SETTER: 60,
-  // pop fn, pop key, pop obj -> Object.defineProperty(obj, key, {set: fn})
-
-  DEBUGGER: 61,
-  // emits a "debugger" statement
-
-  // Push the raw integer operand directly onto the stack (no constant pool lookup).
-  // Identical pipeline to JUMP ops: {type:"label"} pseudo-operands resolve to a
-  // raw PC number that becomes the operand, which is pushed as-is at runtime.
-  LOAD_INT: 62
+  // destPc, sliceStart, sliceEnd
+
+  // ── Debug ─────────────────────────────────────────────────────────────────
+  DEBUGGER: 57
 };
 
-// Scope
-// Each function call gets its own Scope. Locals are resolved to
-// numeric slots at compile time -- zero name lookups at runtime.
+// ── Scope ─────────────────────────────────────────────────────────────────────
+// Maps variable names to register indices (slot numbers).
+// Locals are allocated at compile time; zero name lookups at runtime.
 class Scope {
   constructor(parent = null) {
     this.parent = parent;
-    this._locals = new Map(); // name -> slot index
+    this._locals = new Map();
     this._next = 0;
   }
   define(name) {
@@ -172,8 +166,6 @@ class Scope {
     }
     return this._locals.get(name);
   }
-
-  // Walk up scope chain. If we fall off the top -> global.
   resolve(name) {
     if (this._locals.has(name)) {
       return {
@@ -191,21 +183,33 @@ class Scope {
   }
 }
 
-// FnContext
+// ── FnContext ─────────────────────────────────────────────────────────────────
 // Compiler-side state for the function currently being compiled.
-// Distinct from runtime Frame -- this is compile-time only.
+// Distinct from the runtime Frame — this is compile-time only.
 class FnContext {
+  // Register allocator.  Locals occupy regs[0..scope.localCount-1];
+  // temps are allocated above that and freed at statement boundaries.
+  regTop = 0;
+  maxRegTop = 0;
   constructor(compiler, parentCtx = null) {
     this.compiler = compiler;
     this.parentCtx = parentCtx;
     this.scope = new Scope();
     this.bc = [];
-    this.upvalues = []; // { name, isLocal, index }
+    this.upvalues = [];
+  }
+
+  /** Allocate the next free temp register and return its index. */
+  allocReg() {
+    const r = this.regTop++;
+    if (this.regTop > this.maxRegTop) this.maxRegTop = this.regTop;
+    return r;
   }
 
-  // Find or register a captured variable as an upvalue.
-  // isLocal=true  -> captured directly from parent's locals[index]
-  // isLocal=false -> relayed from parent's own upvalue list[index]
+  /** Release all temps above the local region. Called at each statement boundary. */
+  resetTemps() {
+    this.regTop = this.scope.localCount;
+  }
   addUpvalue(name, isLocal, index) {
     const existing = this.upvalues.findIndex(u => u.name === name);
     if (existing !== -1) return existing;
@@ -213,41 +217,35 @@ class FnContext {
     this.upvalues.push({
       name,
       isLocal,
-      index: index
+      index
     });
     return idx;
   }
 }
-
-// Compiler
+// ── Compiler ──────────────────────────────────────────────────────────────────
 export class Compiler {
   emit(bc, instr, node) {
     bc.push(instr);
     instr[SOURCE_NODE_SYM] = node;
   }
-
-  // DO NOT USE THIS KEY UNLESS YOU ARE "RESOLVE CONSTANTS"
-  // CONSTANTS DURING COMPILATION MUST BE USED BY REFERENCE WITH b.constantOperand("myConstantHere")
-
   constructor(options = DEFAULT_OPTIONS) {
     this.options = options;
-    this.fnDescriptors = []; // populated in pass 1
+    this.fnDescriptors = [];
     this.bytecode = [];
     this.mainStartPc = 0;
-    this._currentCtx = null; // FnContext of the function being compiled, null at top-level
-    this._loopStack = []; // per active loop/switch/block/try
+    this.mainRegCount = 0;
+    this._currentCtx = null;
+    this._loopStack = [];
     this._pendingLabel = null;
-    this._forInCount = 0; // counter for synthetic for-in iterator global names
-    this._labelCount = 0; // monotonically increasing counter for unique label names
-
+    this._forInCount = 0;
+    this._labelCount = 0;
     this.serializer = new Serializer(this);
     this.MACRO_OPS = {};
     this.SPECIALIZED_OPS = {};
+    this.ALIASED_OPS = {};
     this.OP = {
       ...OP_ORIGINAL
     };
-
-    // Construct randomized opcode mapping
     if (this.options.randomizeOpcodes) {
       let usedNumbers = new Set();
       for (const key in this.OP) {
@@ -259,59 +257,122 @@ export class Compiler {
         this.OP[key] = val;
       }
     }
-
-    // Reverse map for comment generation
     this.OP_NAME = Object.fromEntries(Object.entries(this.OP).map(([k, v]) => [v, k]));
-    this.JUMP_OPS = new Set([this.OP.JUMP, this.OP.JUMP_IF_FALSE, this.OP.JUMP_IF_TRUE_OR_POP, this.OP.JUMP_IF_FALSE_OR_POP, this.OP.FOR_IN_NEXT, this.OP.TRY_SETUP // catch_pc operand needs offset adjustment like jump targets
-    ]);
+    this.JUMP_OPS = new Set([this.OP.JUMP, this.OP.JUMP_IF_FALSE, this.OP.JUMP_IF_TRUE, this.OP.FOR_IN_NEXT, this.OP.TRY_SETUP]);
   }
-
-  // Generate a globally unique label string with an optional hint for readability.
   _makeLabel(hint = "") {
-    var id = this._labelCount++;
-    return `${hint || "L"}_${id}`;
+    return `${hint || "L"}_${this._labelCount++}`;
   }
-
-  // Variable resolution
-  // Walks up the FnContext chain. Crossing a context boundary means
-  // we're capturing from an outer function - register an upvalue.
   _resolve(name, ctx) {
     if (!ctx) return {
       kind: "global"
     };
-
-    // 1. Own locals
     if (ctx.scope._locals.has(name)) {
       return {
         kind: "local",
         slot: ctx.scope._locals.get(name)
       };
     }
-
-    // 2. No parent context -> must be global
     if (!ctx.parentCtx) return {
       kind: "global"
     };
-
-    // 3. Ask parent -- recurse up the chain
     const parentResult = this._resolve(name, ctx.parentCtx);
     if (parentResult.kind === "global") return {
       kind: "global"
     };
-
-    // 4. Parent has it (as local or upvalue) -- register an upvalue here.
-    //    isLocal=true means "take it straight from parent's locals[index]"
-    //    isLocal=false means "relay parent's upvalue[index]" (multi-level capture)
     const isLocal = parentResult.kind === "local";
     const index = isLocal ? parentResult.slot : parentResult.index;
-    const uvIdx = ctx.addUpvalue(name, isLocal, index);
+    const uvIdx = ctx.addUpvalue(name, isLocal ? 1 : 0, index);
     return {
       kind: "upvalue",
       index: uvIdx
     };
   }
 
-  // Entry point
+  // ── Variable hoisting ──────────────────────────────────────────────────────
+  // Pre-scan a statement list and reserve scope slots for every var declaration,
+  // function declaration, for-in iterator, and try-catch binding.
+  // Must be called before compilation begins so that ctx.regTop can be set
+  // safely above ALL locals (including those declared late in the body).
+  _hoistVars(stmts, scope) {
+    for (const stmt of stmts) {
+      switch (stmt.type) {
+        case "VariableDeclaration":
+          for (const decl of stmt.declarations) {
+            if (decl.id.type === "Identifier") scope.define(decl.id.name);
+          }
+          break;
+        case "FunctionDeclaration":
+          if (stmt.id) scope.define(stmt.id.name);
+          break;
+        case "BlockStatement":
+          this._hoistVars(stmt.body, scope);
+          break;
+        case "IfStatement":
+          {
+            const cons = stmt.consequent.type === "BlockStatement" ? stmt.consequent.body : [stmt.consequent];
+            this._hoistVars(cons, scope);
+            if (stmt.alternate) {
+              const alt = stmt.alternate.type === "BlockStatement" ? stmt.alternate.body : [stmt.alternate];
+              this._hoistVars(alt, scope);
+            }
+            break;
+          }
+        case "WhileStatement":
+        case "DoWhileStatement":
+          {
+            const body = stmt.body.type === "BlockStatement" ? stmt.body.body : [stmt.body];
+            this._hoistVars(body, scope);
+            break;
+          }
+        case "ForStatement":
+          {
+            if (stmt.init?.type === "VariableDeclaration") {
+              for (const decl of stmt.init.declarations) {
+                if (decl.id.type === "Identifier") scope.define(decl.id.name);
+              }
+            }
+            const body = stmt.body.type === "BlockStatement" ? stmt.body.body : [stmt.body];
+            this._hoistVars(body, scope);
+            break;
+          }
+        case "ForInStatement":
+          {
+            // Reserve a hidden register for the iterator object.
+            stmt._iterSlot = scope._next++;
+            if (stmt.left.type === "VariableDeclaration") {
+              for (const decl of stmt.left.declarations) {
+                if (decl.id.type === "Identifier") scope.define(decl.id.name);
+              }
+            }
+            const body = stmt.body.type === "BlockStatement" ? stmt.body.body : [stmt.body];
+            this._hoistVars(body, scope);
+            break;
+          }
+        case "SwitchStatement":
+          for (const c of stmt.cases) this._hoistVars(c.consequent, scope);
+          break;
+        case "TryStatement":
+          this._hoistVars(stmt.block.body, scope);
+          if (stmt.handler) {
+            if (stmt.handler.param?.type === "Identifier") {
+              // Catch parameter IS the exception register.
+              scope.define(stmt.handler.param.name);
+            } else {
+              // No catch binding – reserve a dummy slot for the exception value.
+              stmt._exceptionSlot = scope._next++;
+            }
+            this._hoistVars(stmt.handler.body.body, scope);
+          }
+          break;
+        case "LabeledStatement":
+          this._hoistVars([stmt.body], scope);
+          break;
+      }
+    }
+  }
+
+  // ── Entry point ───────────────────────────────────────────────────────────
   compile(source) {
     const ast = parse(source, {
       sourceType: "script"
@@ -319,146 +380,127 @@ export class Compiler {
     return this.compileAST(ast);
   }
   compileAST(ast) {
-    // Pass 1 - compile every FunctionDeclaration into a descriptor.
-    //           Traverse finds them regardless of nesting depth.
     traverse(ast, {
       FunctionDeclaration: path => {
-        // Only handle top-level functions for this MVP.
-        // (Parent is Program node)
         if (path.parent.type !== "Program") return;
         this._compileFunctionDecl(path.node);
-        path.skip(); // don't recurse into nested functions
+        path.skip();
       }
     });
-
-    // Pass 2 -- compile top-level statements into BYTECODE.
     this._compileMain(ast.program.body);
     return this.bytecode;
   }
 
-  // Function Declaration
-
+  // ── Function compilation ───────────────────────────────────────────────────
   _compileFunctionDecl(node) {
-    // Reserve a slot in fnDescriptors NOW, before compiling the body, so that
-    // any nested _compileFunctionDecl calls see the correct .length and get a
-    // distinct _fnIdx.  The placeholder object is mutated in-place below once
-    // the body and header are ready.
+    ok(!node.generator, "Generator functions are not supported");
+    ok(!node.async, "Async functions are not supported");
     var fnIdx = this.fnDescriptors.length;
     const entryLabel = this._makeLabel(`fn_${fnIdx}`);
-    var desc = {}; // placeholder — filled in after compilation
+    var desc = {};
     this.fnDescriptors.push(desc);
-
-    // Create a context whose parent is whatever we're currently compiling.
-    // This is what lets _resolve cross function boundaries correctly.
     const ctx = new FnContext(this, this._currentCtx);
     const savedCtx = this._currentCtx;
     this._currentCtx = ctx;
-
-    // Isolate the loop stack so that try/loop entries from the outer scope
-    // don't cause spurious TRY_END / extra jumps inside this function body.
     const savedLoopStack = this._loopStack;
     this._loopStack = [];
 
-    // Params occupy the first N local slots (args are copied in on CALL)
+    // 1. Define parameters (occupy regs 0..paramCount-1).
     for (const param of node.params) {
       let identifier = param.type === "AssignmentPattern" ? param.left : param;
       ok(identifier.type === "Identifier", "Only simple identifiers allowed as parameters");
       ctx.scope.define(identifier.name);
     }
 
-    // Reserve the next slot for the implicit `arguments` object.
-    // Slot index will always equal paramCount (params are 0..paramCount-1).
+    // 2. Reserve the `arguments` slot (reg index = paramCount).
     ctx.scope.define("arguments");
 
-    // Pass 2: emit default-value guards at top of fn body
-    // Mirrors what JS engines do: if the caller passed undefined (or
-    // nothing), evaluate the default expression and overwrite the slot.
+    // 3. Hoist all var declarations so temps start above every local.
+    this._hoistVars(node.body.body, ctx.scope);
+
+    // 4. Temps now start above all locals.
+    ctx.regTop = ctx.scope.localCount;
+    ctx.maxRegTop = ctx.regTop;
+
+    // 5. Emit default-value guards.
     for (const param of node.params) {
       if (param.type !== "AssignmentPattern") continue;
       const slot = ctx.scope._locals.get(param.left.name);
       const skipLabel = this._makeLabel("param_skip");
 
-      // if (param === undefined) param = <default expr>
-      this.emit(ctx.bc, [this.OP.LOAD_LOCAL, slot], param);
-      this.emit(ctx.bc, [this.OP.LOAD_CONST, b.constantOperand(undefined)], param);
-      this.emit(ctx.bc, [this.OP.EQ], param);
-      this.emit(ctx.bc, [this.OP.JUMP_IF_FALSE, {
+      // if (param === undefined) param = <default>
+      const reg_undef = ctx.allocReg();
+      this.emit(ctx.bc, [this.OP.LOAD_CONST, reg_undef, b.constantOperand(undefined)], param);
+      const reg_cmp = ctx.allocReg();
+      this.emit(ctx.bc, [this.OP.EQ, reg_cmp, slot, reg_undef], param);
+      this.emit(ctx.bc, [this.OP.JUMP_IF_FALSE, reg_cmp, {
         type: "label",
         label: skipLabel
       }], param);
-      this._compileExpr(param.right, ctx.scope, ctx.bc); // eval default
-      this.emit(ctx.bc, [this.OP.STORE_LOCAL, slot], param);
+      ctx.resetTemps();
+      const srcReg = this._compileExpr(param.right, ctx.scope, ctx.bc);
+      if (srcReg !== slot) {
+        this.emit(ctx.bc, [this.OP.MOVE, slot, srcReg], param);
+      }
+      ctx.resetTemps();
       this.emit(ctx.bc, [null, {
         type: "defineLabel",
         label: skipLabel
       }], param);
     }
+
+    // 6. Compile body.
     for (const stmt of node.body.body) {
       this._compileStatement(stmt, ctx.scope, ctx.bc);
     }
 
-    // If we fall off the end of the function, implicitly return undefined.
-    this.emit(ctx.bc, [this.OP.LOAD_CONST, b.constantOperand(undefined)], node);
-    this.emit(ctx.bc, [this.OP.RETURN], node);
-    this._currentCtx = savedCtx; // restore before touching fnDescriptors
+    // Implicit return undefined at end of function.
+    const reg_undef = ctx.allocReg();
+    this.emit(ctx.bc, [this.OP.LOAD_CONST, reg_undef, b.constantOperand(undefined)], node);
+    this.emit(ctx.bc, [this.OP.RETURN, reg_undef], node);
+    this._currentCtx = savedCtx;
     this._loopStack = savedLoopStack;
     node._fnIdx = fnIdx;
-
-    // Fill the placeholder that was reserved at the top of this function.
-    // Metadata (paramCount, localCount, upvalues) is stored on desc and emitted
-    // as inline operands on the MAKE_CLOSURE instruction via _emitMakeClosure.
     desc.name = node.id?.name || "<anonymous>";
     desc.entryLabel = entryLabel;
     desc.bytecode = ctx.bc;
     desc._fnIdx = fnIdx;
     desc.paramCount = node.params.length;
-    desc.localCount = ctx.scope.localCount;
+    desc.regCount = ctx.maxRegTop; // total registers needed at runtime
     desc.upvalues = ctx.upvalues.slice();
     return desc;
   }
 
-  // Emit a single MAKE_CLOSURE instruction with all closure metadata packed
-  // as inline operands.  The runtime reads them via _operand() — no stack
-  // shuffling needed.
-  //
-  // Flat operand layout:  startPc, paramCount, localCount, uvCount,
-  //                       [isLocal_0, idx_0, isLocal_1, idx_1, ...]
+  // Emit MAKE_CLOSURE with all metadata as inline operands.
+  // Layout: dst, startPc, paramCount, regCount, uvCount, [isLocal, idx, …]
   _emitMakeClosure(desc, node, bc) {
+    const ctx = this._currentCtx;
+    const dst = ctx.allocReg();
     const uvOperands = [];
     for (const uv of desc.upvalues) {
       uvOperands.push(uv.isLocal ? 1 : 0);
       uvOperands.push(uv.index);
     }
-    this.emit(bc, [this.OP.MAKE_CLOSURE, {
+    this.emit(bc, [this.OP.MAKE_CLOSURE, dst, {
       type: "label",
       label: desc.entryLabel
-    }, desc.paramCount, desc.localCount, desc.upvalues.length, ...uvOperands], node);
+    }, desc.paramCount, desc.regCount, desc.upvalues.length, ...uvOperands], node);
+    return dst;
   }
 
-  // Main (top-level)
+  // ── Main (top-level) ───────────────────────────────────────────────────────
   _compileMain(body) {
-    const bc = this.bytecode;
-
-    // Hoist all FunctionDeclarations: MAKE_CLOSURE -> STORE_GLOBAL
-    // (mirrors JS hoisting -- functions are available before other code)
-    for (const node of body) {
-      if (node.type !== "FunctionDeclaration") continue;
-      const desc = this.fnDescriptors.find(d => d._fnIdx === node._fnIdx);
-      const nameRef = b.constantOperand(node.id.name);
-      this._emitMakeClosure(desc, node, bc);
-      this.emit(bc, [this.OP.STORE_GLOBAL, nameRef], node);
-    }
-
-    // Compile everything else in order
-    for (const node of body) {
-      if (node.type === "FunctionDeclaration") continue;
-      this._compileStatement(node, null, bc); // null scope -> global context
-    }
-    this.emit(bc, [this.OP.RETURN], null); // end program
-
-    // Append all function bodies. Each function's entryLabel (already generated
-    // in _compileFunctionDecl) points directly to the first body instruction;
-    // metadata is pushed onto the stack at each call site, not stored inline.
+    const mainCtx = new FnContext(this, null);
+    const savedCtx = this._currentCtx;
+    this._currentCtx = mainCtx;
+    var desc = this._compileFunctionDecl({
+      type: "FunctionDeclaration",
+      async: false,
+      generator: false,
+      params: [],
+      id: null,
+      body: t.blockStatement([...body])
+    });
     for (const descriptor of this.fnDescriptors) {
       this.bytecode.push([null, {
         type: "defineLabel",
@@ -468,88 +510,103 @@ export class Compiler {
         this.bytecode.push(instr);
       }
     }
+    this.mainRegCount = mainCtx.maxRegTop;
+    this.mainFn = desc;
+    this._currentCtx = savedCtx;
   }
 
-  // Statements
+  // ── Statements ────────────────────────────────────────────────────────────
+  // Wrapper that resets temps after every statement so that short-lived
+  // expression temps don't accumulate across statements.
   _compileStatement(node, scope, bc) {
+    this._compileStatementImpl(node, scope, bc);
+    this._currentCtx?.resetTemps();
+  }
+  _compileStatementImpl(node, scope, bc) {
+    const ctx = this._currentCtx;
     switch (node.type) {
       case "EmptyStatement":
-        {
-          // nothing to emit -- bare semicolon is a no-op
-          break;
-        }
+        break;
       case "DebuggerStatement":
         this.emit(bc, [this.OP.DEBUGGER], node);
         break;
       case "BlockStatement":
-        {
-          for (const stmt of node.body) {
-            this._compileStatement(stmt, scope, bc);
-          }
-          break;
+        for (const stmt of node.body) {
+          this._compileStatement(stmt, scope, bc);
         }
+        break;
       case "FunctionDeclaration":
         {
-          // Nested function -- compile it into a descriptor, then emit
-          // MAKE_CLOSURE so it's captured as a live closure at runtime.
-          // (_compileFunctionDecl pushes/pops _currentCtx internally)
           const desc = this._compileFunctionDecl(node);
-          this._emitMakeClosure(desc, node, bc);
+          const closureReg = this._emitMakeClosure(desc, node, bc);
           if (scope) {
-            const slot = scope.define(node.id.name);
-            this.emit(bc, [this.OP.STORE_LOCAL, slot], node);
+            const slot = scope._locals.get(node.id.name);
+            if (closureReg !== slot) {
+              this.emit(bc, [this.OP.MOVE, slot, closureReg], node);
+            }
           } else {
-            this.emit(bc, [this.OP.STORE_GLOBAL, b.constantOperand(node.id.name)], node);
+            this.emit(bc, [this.OP.STORE_GLOBAL, b.constantOperand(node.id.name), closureReg], node);
           }
           break;
         }
       case "ThrowStatement":
         {
-          this._compileExpr(node.argument, scope, bc);
-          this.emit(bc, [this.OP.THROW], node);
+          const reg = this._compileExpr(node.argument, scope, bc);
+          this.emit(bc, [this.OP.THROW, reg], node);
           break;
         }
       case "ReturnStatement":
         {
+          let reg;
           if (node.argument) {
-            this._compileExpr(node.argument, scope, bc);
+            reg = this._compileExpr(node.argument, scope, bc);
           } else {
-            this.emit(bc, [this.OP.LOAD_CONST, b.constantOperand(undefined)], node);
+            reg = ctx.allocReg();
+            this.emit(bc, [this.OP.LOAD_CONST, reg, b.constantOperand(undefined)], node);
           }
-          // Disarm any open try handlers before leaving the function.
-          // TRY_END only touches frame._handlerStack, not the value stack,
-          // so the return value sitting on top is safe.
           for (let _ri = this._loopStack.length - 1; _ri >= 0; _ri--) {
             if (this._loopStack[_ri].type === "try") {
               this.emit(bc, [this.OP.TRY_END], node);
             }
           }
-          this.emit(bc, [this.OP.RETURN], node);
+          this.emit(bc, [this.OP.RETURN, reg], node);
           break;
         }
       case "ExpressionStatement":
-        {
-          this._compileExpr(node.expression, scope, bc);
-          this.emit(bc, [this.OP.POP], node); // discard return value of statement-level expressions
-          break;
-        }
+        this._compileExpr(node.expression, scope, bc);
+        // Result is discarded; resetTemps in the wrapper handles cleanup.
+        break;
       case "VariableDeclaration":
         {
           for (const decl of node.declarations) {
-            // Push the initialiser (or undefined if absent)
-            if (decl.init) {
-              this._compileExpr(decl.init, scope, bc);
-            } else {
-              this.emit(bc, [this.OP.LOAD_CONST, b.constantOperand(undefined)], node);
-            }
             ok(decl.id.type === "Identifier", "Only simple identifiers can be declared");
-
-            // Store: local slot if inside a function, global name otherwise
+            const name = decl.id.name;
             if (scope) {
-              const slot = scope.define(decl.id.name);
-              this.emit(bc, [this.OP.STORE_LOCAL, slot], node);
+              const slot = scope._locals.get(name); // already defined by _hoistVars
+              if (decl.init) {
+                const srcReg = this._compileExpr(decl.init, scope, bc);
+                if (srcReg !== slot) {
+                  this.emit(bc, [this.OP.MOVE, slot, srcReg], node);
+                }
+              } else {
+                this.emit(bc, [this.OP.MOVE, slot, ctx.allocReg()], node);
+                // Load undefined into the just-allocated temp, then move.
+                // Actually: just emit LOAD_CONST directly into slot.
+                // Undo the allocReg – instead emit directly:
+                ctx.regTop--; // undo the allocReg above
+                const tmp = ctx.allocReg();
+                this.emit(bc, [this.OP.LOAD_CONST, tmp, b.constantOperand(undefined)], node);
+                if (tmp !== slot) this.emit(bc, [this.OP.MOVE, slot, tmp], node);
+              }
             } else {
-              this.emit(bc, [this.OP.STORE_GLOBAL, b.constantOperand(decl.id.name)], node);
+              if (decl.init) {
+                const srcReg = this._compileExpr(decl.init, scope, bc);
+                this.emit(bc, [this.OP.STORE_GLOBAL, b.constantOperand(name), srcReg], node);
+              } else {
+                const tmp = ctx.allocReg();
+                this.emit(bc, [this.OP.LOAD_CONST, tmp, b.constantOperand(undefined)], node);
+                this.emit(bc, [this.OP.STORE_GLOBAL, b.constantOperand(name), tmp], node);
+              }
             }
           }
           break;
@@ -557,42 +614,37 @@ export class Compiler {
       case "IfStatement":
         {
           const elseOrEndLabel = this._makeLabel("if_else");
-          // 1. Compile the test expression -> leaves a value on the stack
-          this._compileExpr(node.test, scope, bc);
-          // 2. Emit JUMP_IF_FALSE to the else branch (or end if no else)
-          this.emit(bc, [this.OP.JUMP_IF_FALSE, {
+          const savedTop = ctx.regTop;
+          const testReg = this._compileExpr(node.test, scope, bc);
+          this.emit(bc, [this.OP.JUMP_IF_FALSE, testReg, {
             type: "label",
             label: elseOrEndLabel
           }], node);
-          // 3. Compile the consequent block (the "then" branch)
+          ctx.regTop = savedTop; // free test temps
+
           const consequentBody = node.consequent.type === "BlockStatement" ? node.consequent.body : [node.consequent];
           for (const stmt of consequentBody) {
             this._compileStatement(stmt, scope, bc);
           }
           if (node.alternate) {
-            // 4a. Consequent needs to jump OVER the else block when done
             const endLabel = this._makeLabel("if_end");
             this.emit(bc, [this.OP.JUMP, {
               type: "label",
               label: endLabel
             }], node);
-            // Mark start of else
             this.emit(bc, [null, {
               type: "defineLabel",
               label: elseOrEndLabel
             }], node);
-            // 5. Compile the alternate (else) block
-            const altBody = node.alternate.type === "BlockStatement" ? node.alternate.body : [node.alternate]; // handles `else if` -- it's just a nested IfStatement
+            const altBody = node.alternate.type === "BlockStatement" ? node.alternate.body : [node.alternate];
             for (const stmt of altBody) {
               this._compileStatement(stmt, scope, bc);
             }
-            // Mark end (consequent's jump lands here)
             this.emit(bc, [null, {
               type: "defineLabel",
               label: endLabel
             }], node);
           } else {
-            // 4b. No else -- label lands right after the then block
             this.emit(bc, [null, {
               type: "defineLabel",
               label: elseOrEndLabel
@@ -610,17 +662,19 @@ export class Compiler {
             type: "loop",
             label: _wLabel,
             breakLabel: exitLabel,
-            continueLabel: loopTopLabel // continue re-evaluates the test
+            continueLabel: loopTopLabel
           });
           this.emit(bc, [null, {
             type: "defineLabel",
             label: loopTopLabel
           }], node);
-          this._compileExpr(node.test, scope, bc);
-          this.emit(bc, [this.OP.JUMP_IF_FALSE, {
+          const savedTop = ctx.regTop;
+          const testReg = this._compileExpr(node.test, scope, bc);
+          this.emit(bc, [this.OP.JUMP_IF_FALSE, testReg, {
             type: "label",
             label: exitLabel
           }], node);
+          ctx.regTop = savedTop;
           const whileBody = node.body.type === "BlockStatement" ? node.body.body : [node.body];
           for (const stmt of whileBody) {
             this._compileStatement(stmt, scope, bc);
@@ -647,7 +701,7 @@ export class Compiler {
             type: "loop",
             label: _dwLabel,
             breakLabel: exitLabel,
-            continueLabel: continueLabel // continue falls to the test
+            continueLabel: continueLabel
           });
           this.emit(bc, [null, {
             type: "defineLabel",
@@ -657,17 +711,17 @@ export class Compiler {
           for (const stmt of doWhileBody) {
             this._compileStatement(stmt, scope, bc);
           }
-
-          // continue -> skip rest of body, fall through to test
           this.emit(bc, [null, {
             type: "defineLabel",
             label: continueLabel
           }], node);
-          this._compileExpr(node.test, scope, bc);
-          this.emit(bc, [this.OP.JUMP_IF_FALSE, {
+          const savedTop = ctx.regTop;
+          const testReg = this._compileExpr(node.test, scope, bc);
+          this.emit(bc, [this.OP.JUMP_IF_FALSE, testReg, {
             type: "label",
             label: exitLabel
           }], node);
+          ctx.regTop = savedTop;
           this.emit(bc, [this.OP.JUMP, {
             type: "label",
             label: loopTopLabel
@@ -685,7 +739,6 @@ export class Compiler {
           this._pendingLabel = null;
           const loopTopLabel = this._makeLabel("for_top");
           const exitLabel = this._makeLabel("for_exit");
-          // continue jumps to the update clause if present, else straight to test
           const updateLabel = node.update ? this._makeLabel("for_update") : loopTopLabel;
           this._loopStack.push({
             type: "loop",
@@ -698,7 +751,7 @@ export class Compiler {
               this._compileStatement(node.init, scope, bc);
             } else {
               this._compileExpr(node.init, scope, bc);
-              this.emit(bc, [this.OP.POP], node);
+              // result discarded; resetTemps in next iteration
             }
           }
           this.emit(bc, [null, {
@@ -706,25 +759,25 @@ export class Compiler {
             label: loopTopLabel
           }], node);
           if (node.test) {
-            this._compileExpr(node.test, scope, bc);
-            this.emit(bc, [this.OP.JUMP_IF_FALSE, {
+            const savedTop = ctx.regTop;
+            const testReg = this._compileExpr(node.test, scope, bc);
+            this.emit(bc, [this.OP.JUMP_IF_FALSE, testReg, {
               type: "label",
               label: exitLabel
             }], node);
+            ctx.regTop = savedTop;
           }
           const forBody = node.body.type === "BlockStatement" ? node.body.body : [node.body];
           for (const stmt of forBody) {
             this._compileStatement(stmt, scope, bc);
           }
-
-          // continue -> run update (if any) then back to test
           if (node.update) {
             this.emit(bc, [null, {
               type: "defineLabel",
               label: updateLabel
             }], node);
             this._compileExpr(node.update, scope, bc);
-            this.emit(bc, [this.OP.POP], node);
+            ctx.resetTemps(); // discard update expression result
           }
           this.emit(bc, [this.OP.JUMP, {
             type: "label",
@@ -739,7 +792,6 @@ export class Compiler {
         }
       case "BreakStatement":
         {
-          // Find the jump target in the loop stack.
           let _bTargetIdx = -1;
           if (node.label) {
             const _bLabelName = node.label.name;
@@ -751,7 +803,6 @@ export class Compiler {
             }
             if (_bTargetIdx === -1) throw new Error(`Label '${node.label.name}' not found`);
           } else {
-            // Find innermost loop/switch/block (skip "try" entries)
             for (let _bi = this._loopStack.length - 1; _bi >= 0; _bi--) {
               if (this._loopStack[_bi].type !== "try") {
                 _bTargetIdx = _bi;
@@ -760,7 +811,6 @@ export class Compiler {
             }
             if (_bTargetIdx === -1) throw new Error("break outside loop");
           }
-          // Emit TRY_END for every open try block between here and the target.
           for (let _bi = this._loopStack.length - 1; _bi > _bTargetIdx; _bi--) {
             if (this._loopStack[_bi].type === "try") {
               this.emit(bc, [this.OP.TRY_END], node);
@@ -774,7 +824,6 @@ export class Compiler {
         }
       case "ContinueStatement":
         {
-          // Find the target loop in the loop stack.
           let _cTargetIdx = -1;
           if (node.label) {
             const _cLabelName = node.label.name;
@@ -786,7 +835,6 @@ export class Compiler {
             }
             if (_cTargetIdx === -1) throw new Error(`Label '${node.label.name}' not found for continue`);
           } else {
-            // Find the innermost loop (skip switch, block, and try contexts)
             for (let _ci = this._loopStack.length - 1; _ci >= 0; _ci--) {
               if (this._loopStack[_ci].type === "loop") {
                 _cTargetIdx = _ci;
@@ -795,7 +843,6 @@ export class Compiler {
             }
             if (_cTargetIdx === -1) throw new Error("continue outside loop");
           }
-          // Emit TRY_END for every open try block between here and the target loop.
           for (let _ci = this._loopStack.length - 1; _ci > _cTargetIdx; _ci--) {
             if (this._loopStack[_ci].type === "try") {
               this.emit(bc, [this.OP.TRY_END], node);
@@ -816,32 +863,29 @@ export class Compiler {
             type: "switch",
             label: _swLabel,
             breakLabel: switchBreakLabel,
-            continueLabel: switchBreakLabel // not used for switch
+            continueLabel: switchBreakLabel
           });
 
-          // Compile the discriminant and leave it on the stack
-          this._compileExpr(node.discriminant, scope, bc);
+          // Compile discriminant into a register that lives for the whole switch.
+          const discReg = this._compileExpr(node.discriminant, scope, bc);
           const cases = node.cases;
           const defaultIdx = cases.findIndex(c => c.test === null);
-
-          // Pre-allocate a label for each case body so dispatch can reference them
           const caseLabels = cases.map((_, i) => this._makeLabel(`sw_case_${i}`));
 
-          // Dispatch section: for each non-default case, check and jump to its body
+          // Dispatch: for each non-default case, test and jump.
           for (let i = 0; i < cases.length; i++) {
             const cas = cases[i];
-            if (cas.test === null) continue; // skip default in dispatch
-
+            if (cas.test === null) continue;
             const nextCheckLabel = this._makeLabel("sw_next");
-            this.emit(bc, [this.OP.DUP], node);
-            this._compileExpr(cas.test, scope, bc);
-            this.emit(bc, [this.OP.EQ], node);
-            // If not matched, fall through to the next check
-            this.emit(bc, [this.OP.JUMP_IF_FALSE, {
+            const savedTop = ctx.regTop;
+            const caseValReg = this._compileExpr(cas.test, scope, bc);
+            const cmpReg = ctx.allocReg();
+            this.emit(bc, [this.OP.EQ, cmpReg, discReg, caseValReg], node);
+            this.emit(bc, [this.OP.JUMP_IF_FALSE, cmpReg, {
               type: "label",
               label: nextCheckLabel
             }], node);
-            // If matched, jump directly to this case's body
+            ctx.regTop = savedTop;
             this.emit(bc, [this.OP.JUMP, {
               type: "label",
               label: caseLabels[i]
@@ -851,14 +895,10 @@ export class Compiler {
               label: nextCheckLabel
             }], node);
           }
-
-          // No case matched: jump to default body or exit (which pops discriminant)
           this.emit(bc, [this.OP.JUMP, {
             type: "label",
             label: defaultIdx !== -1 ? caseLabels[defaultIdx] : switchBreakLabel
           }], node);
-
-          // Body section: compile all case bodies in source order (fallthrough intact)
           for (let i = 0; i < cases.length; i++) {
             this.emit(bc, [null, {
               type: "defineLabel",
@@ -869,12 +909,11 @@ export class Compiler {
             }
           }
 
-          // break label lands here; pop the discriminant and continue after switch
+          // Break lands here – discriminant register is simply abandoned.
           this.emit(bc, [null, {
             type: "defineLabel",
             label: switchBreakLabel
           }], node);
-          this.emit(bc, [this.OP.POP], node);
           this._loopStack.pop();
           break;
         }
@@ -885,18 +924,16 @@ export class Compiler {
           const _lIsLoop = _lBody.type === "ForStatement" || _lBody.type === "WhileStatement" || _lBody.type === "DoWhileStatement" || _lBody.type === "ForInStatement";
           const _lIsSwitch = _lBody.type === "SwitchStatement";
           if (_lIsLoop || _lIsSwitch) {
-            // Pass label down to the loop/switch handler via _pendingLabel
             this._pendingLabel = _lName;
             this._compileStatement(_lBody, scope, bc);
-            this._pendingLabel = null; // safety clear if handler didn't consume it
+            this._pendingLabel = null;
           } else {
-            // Non-loop labeled statement (e.g. labeled block) -- only break is valid
             const blockBreakLabel = this._makeLabel("block_break");
             this._loopStack.push({
               type: "block",
               label: _lName,
               breakLabel: blockBreakLabel,
-              continueLabel: blockBreakLabel // unused
+              continueLabel: blockBreakLabel
             });
             this._compileStatement(_lBody, scope, bc);
             this._loopStack.pop();
@@ -912,72 +949,56 @@ export class Compiler {
           const _fiLabel = this._pendingLabel;
           this._pendingLabel = null;
 
-          // Evaluate the object expression -> on stack
-          this._compileExpr(node.right, scope, bc);
-          // FOR_IN_SETUP: pops obj, pushes iterator {keys, i}
-          this.emit(bc, [this.OP.FOR_IN_SETUP], node);
+          // Iterator register was reserved by _hoistVars.
+          const iterSlot = node._iterSlot;
 
-          // Store iterator in a hidden slot so break/continue need no cleanup
-          let emitLoadIter;
-          let emitStoreIter;
-          if (scope) {
-            // Reserve a hidden local slot (no name mapping needed)
-            const iterSlot = scope._next++;
-            emitLoadIter = () => this.emit(bc, [this.OP.LOAD_LOCAL, iterSlot], node);
-            emitStoreIter = () => this.emit(bc, [this.OP.STORE_LOCAL, iterSlot], node);
-          } else {
-            // Top level -- use a synthetic global that won't collide with user code
-            const iterNameIdx = b.constantOperand("__fi" + this._forInCount++);
-            emitLoadIter = () => this.emit(bc, [this.OP.LOAD_GLOBAL, iterNameIdx], node);
-            emitStoreIter = () => this.emit(bc, [this.OP.STORE_GLOBAL, iterNameIdx], node);
-          }
-          emitStoreIter();
+          // FOR_IN_SETUP dst, src
+          const objReg = this._compileExpr(node.right, scope, bc);
+          this.emit(bc, [this.OP.FOR_IN_SETUP, iterSlot, objReg], node);
           const loopTopLabel = this._makeLabel("forin_top");
           const exitLabel = this._makeLabel("forin_exit");
           this._loopStack.push({
             type: "loop",
             label: _fiLabel,
             breakLabel: exitLabel,
-            continueLabel: loopTopLabel // continue re-checks the iterator
+            continueLabel: loopTopLabel
           });
           this.emit(bc, [null, {
             type: "defineLabel",
             label: loopTopLabel
           }], node);
 
-          // Load iterator, attempt to get next key
-          emitLoadIter();
-          this.emit(bc, [this.OP.FOR_IN_NEXT, {
+          // FOR_IN_NEXT keyDst, iter, exitTarget
+          const keyReg = ctx.allocReg();
+          this.emit(bc, [this.OP.FOR_IN_NEXT, keyReg, iterSlot, {
             type: "label",
             label: exitLabel
           }], node);
 
-          // Assign the key (now on top of stack) to the loop variable
+          // Assign the key to the loop variable.
           if (node.left.type === "VariableDeclaration") {
             const identifier = node.left.declarations[0].id;
             ok(identifier.type === "Identifier", "Only simple identifiers can be declared in for-in loops");
             const name = identifier.name;
             if (scope) {
-              const slot = scope.define(name);
-              this.emit(bc, [this.OP.STORE_LOCAL, slot], node);
+              const slot = scope._locals.get(name);
+              if (keyReg !== slot) this.emit(bc, [this.OP.MOVE, slot, keyReg], node);
             } else {
-              this.emit(bc, [this.OP.STORE_GLOBAL, b.constantOperand(name)], node);
+              this.emit(bc, [this.OP.STORE_GLOBAL, b.constantOperand(name), keyReg], node);
             }
           } else if (node.left.type === "Identifier") {
             const res = this._resolve(node.left.name, this._currentCtx);
             if (res.kind === "local") {
-              this.emit(bc, [this.OP.STORE_LOCAL, res.slot], node);
+              if (keyReg !== res.slot) this.emit(bc, [this.OP.MOVE, res.slot, keyReg], node);
             } else if (res.kind === "upvalue") {
-              this.emit(bc, [this.OP.STORE_UPVALUE, res.index], node);
+              this.emit(bc, [this.OP.STORE_UPVALUE, res.index, keyReg], node);
             } else {
-              this.emit(bc, [this.OP.STORE_GLOBAL, b.constantOperand(node.left.name)], node);
+              this.emit(bc, [this.OP.STORE_GLOBAL, b.constantOperand(node.left.name), keyReg], node);
             }
           } else {
             const src = generate(node.left).code;
             throw new Error(`Unsupported for-in left-hand side: ${node.left.type}\n  -> ${src}`);
           }
-
-          // Compile the loop body
           const fiBody = node.body.type === "BlockStatement" ? node.body.body : [node.body];
           for (const stmt of fiBody) {
             this._compileStatement(stmt, scope, bc);
@@ -999,72 +1020,44 @@ export class Compiler {
             throw new Error("try..finally is not supported. Use a helper function instead");
           }
           if (!node.handler) {
-            // try without catch requires finally — not supported
             throw new Error("try without catch is not supported (requires finally).");
           }
           const catchLabel = this._makeLabel("catch");
           const afterCatchLabel = this._makeLabel("after_catch");
 
-          // Emit TRY_SETUP with the catch block's label as the handler PC.
-          // At runtime: saves stack depth + frame stack depth, pushes handler.
+          // Determine where the caught exception is written.
+          const exceptionReg = node.handler.param?.type === "Identifier" ? scope?._locals.get(node.handler.param.name) ?? ctx.allocReg() // shouldn't normally reach here
+          : node._exceptionSlot;
           this.emit(bc, [this.OP.TRY_SETUP, {
             type: "label",
             label: catchLabel
-          }], node);
-
-          // Track the open try block so that break/continue/return inside the
-          // try body can emit the matching TRY_END before their jump.
+          }, exceptionReg], node);
           this._loopStack.push({
             type: "try",
             label: null,
             breakLabel: "",
-            // unused
-            continueLabel: "" // unused
+            continueLabel: ""
           });
-
-          // Compile try body
           for (const stmt of node.block.body) {
             this._compileStatement(stmt, scope, bc);
           }
-
-          // Done compiling the try body — pop the tracking entry.
           this._loopStack.pop();
-
-          // Normal exit: disarm the exception handler.
           this.emit(bc, [this.OP.TRY_END], node);
-
-          // Jump over the catch block on normal path.
           this.emit(bc, [this.OP.JUMP, {
             type: "label",
             label: afterCatchLabel
           }], node);
 
-          // Catch block: exception is on top of the stack (pushed by the VM).
+          // Catch block: exceptionReg already holds the caught value.
           this.emit(bc, [null, {
             type: "defineLabel",
             label: catchLabel
           }], node);
-          const handler = node.handler;
-          if (handler.param) {
-            // Bind the exception value to the catch variable.
-            const name = handler.param.name;
-            if (scope) {
-              const slot = scope.define(name);
-              this.emit(bc, [this.OP.STORE_LOCAL, slot], node);
-            } else {
-              this.emit(bc, [this.OP.STORE_GLOBAL, b.constantOperand(name)], node);
-            }
-          } else {
-            // Optional catch binding (catch without a variable — ES2019+)
-            this.emit(bc, [this.OP.POP], node);
-          }
 
-          // Compile catch body
-          for (const stmt of handler.body.body) {
+          // If no param binding, just ignore the exception (it's in the dummy slot).
+          for (const stmt of node.handler.body.body) {
             this._compileStatement(stmt, scope, bc);
           }
-
-          // Normal-path jump lands here (after the catch block).
           this.emit(bc, [null, {
             type: "defineLabel",
             label: afterCatchLabel
@@ -1073,139 +1066,154 @@ export class Compiler {
         }
       default:
         {
-          // Use @babel/generator to reproduce the source of unsupported nodes
-          // so we can emit a clear error with context.
           const src = generate(node).code;
           throw new Error(`Unsupported statement: ${node.type}\n  -> ${src}`);
         }
     }
   }
 
-  // Expressions
+  // ── Expressions ───────────────────────────────────────────────────────────
+  // Returns the register index that holds the result.
+  // For local variables: returns their slot directly (no instruction emitted).
+  // For all others: allocates a fresh temp register, emits the instruction(s),
+  // and returns the allocated register.
   _compileExpr(node, scope, bc) {
+    const ctx = this._currentCtx;
     switch (node.type) {
       case "NumericLiteral":
       case "StringLiteral":
-        {
-          this.emit(bc, [this.OP.LOAD_CONST, b.constantOperand(node.value)], node);
-          break;
-        }
       case "BooleanLiteral":
         {
-          this.emit(bc, [this.OP.LOAD_CONST, b.constantOperand(node.value)], node);
-          break;
+          const dst = ctx.allocReg();
+          this.emit(bc, [this.OP.LOAD_CONST, dst, b.constantOperand(node.value)], node);
+          return dst;
         }
       case "NullLiteral":
         {
-          this.emit(bc, [this.OP.LOAD_CONST, b.constantOperand(null)], node);
-          break;
+          const dst = ctx.allocReg();
+          this.emit(bc, [this.OP.LOAD_CONST, dst, b.constantOperand(null)], node);
+          return dst;
         }
       case "Identifier":
         {
-          // scope=null means we're at the top-level -> always global
           const res = this._resolve(node.name, this._currentCtx);
-          if (res.kind === "local") {
-            this.emit(bc, [this.OP.LOAD_LOCAL, res.slot], node);
-          } else if (res.kind === "upvalue") {
-            this.emit(bc, [this.OP.LOAD_UPVALUE, res.index], node);
-          } else {
-            this.emit(bc, [this.OP.LOAD_GLOBAL, b.constantOperand(node.name)], node);
+          if (res.kind === "local") return res.slot; // register IS the local
+          if (res.kind === "upvalue") {
+            const dst = ctx.allocReg();
+            this.emit(bc, [this.OP.LOAD_UPVALUE, dst, res.index], node);
+            return dst;
           }
-          break;
+          // global
+          const dst = ctx.allocReg();
+          this.emit(bc, [this.OP.LOAD_GLOBAL, dst, b.constantOperand(node.name)], node);
+          return dst;
         }
       case "ThisExpression":
         {
-          this.emit(bc, [this.OP.LOAD_THIS], node);
-          break;
+          const dst = ctx.allocReg();
+          this.emit(bc, [this.OP.LOAD_THIS, dst], node);
+          return dst;
         }
       case "NewExpression":
         {
-          // Push callee, then args -- identical layout to CALL but uses NEW opcode
-          this._compileExpr(node.callee, scope, bc);
-          for (const arg of node.arguments) this._compileExpr(arg, scope, bc);
-          this.emit(bc, [this.OP.NEW, node.arguments.length], node);
-          break;
+          const calleeReg = this._compileExpr(node.callee, scope, bc);
+          const argRegs = node.arguments.map(a => this._compileExpr(a, scope, bc));
+          const dst = ctx.allocReg();
+          this.emit(bc, [this.OP.NEW, dst, calleeReg, node.arguments.length, ...argRegs], node);
+          return dst;
         }
       case "SequenceExpression":
         {
-          // (a, b, c)  ->  eval a -> POP, eval b -> POP, eval c -> leave on stack
-          for (let i = 0; i < node.expressions.length - 1; i++) {
-            this._compileExpr(node.expressions[i], scope, bc);
-            this.emit(bc, [this.OP.POP], node); // discard intermediate result
+          const exprs = node.expressions;
+          for (let i = 0; i < exprs.length - 1; i++) {
+            const savedTop = ctx.regTop;
+            this._compileExpr(exprs[i], scope, bc);
+            ctx.regTop = savedTop; // discard intermediate result
           }
-          // Last expression -- its value is the result of the whole sequence
-          this._compileExpr(node.expressions[node.expressions.length - 1], scope, bc);
-          break;
+          return this._compileExpr(exprs[exprs.length - 1], scope, bc);
         }
       case "ConditionalExpression":
         {
-          // test ? consequent : alternate
+          const n = node;
           const elseLabel = this._makeLabel("ternary_else");
           const endLabel = this._makeLabel("ternary_end");
-          this._compileExpr(node.test, scope, bc);
-          this.emit(bc, [this.OP.JUMP_IF_FALSE, {
+
+          // Compile test; free its temps after the jump is emitted.
+          const baseTop = ctx.regTop;
+          const testReg = this._compileExpr(n.test, scope, bc);
+          this.emit(bc, [this.OP.JUMP_IF_FALSE, testReg, {
             type: "label",
             label: elseLabel
           }], node);
-          this._compileExpr(node.consequent, scope, bc);
+          ctx.regTop = baseTop; // free test temps
+
+          // Reserve reg_result at the base of the temp space.
+          const reg_result = ctx.allocReg();
+
+          // Consequent branch.
+          const consReg = this._compileExpr(n.consequent, scope, bc);
+          if (consReg !== reg_result) this.emit(bc, [this.OP.MOVE, reg_result, consReg], node);
           this.emit(bc, [this.OP.JUMP, {
             type: "label",
             label: endLabel
           }], node);
+
+          // Alternate branch: reset to baseTop then re-reserve reg_result.
           this.emit(bc, [null, {
             type: "defineLabel",
             label: elseLabel
           }], node);
-          this._compileExpr(node.alternate, scope, bc);
+          ctx.regTop = baseTop;
+          ctx.allocReg(); // re-occupy reg_result slot
+          const altReg = this._compileExpr(n.alternate, scope, bc);
+          if (altReg !== reg_result) this.emit(bc, [this.OP.MOVE, reg_result, altReg], node);
           this.emit(bc, [null, {
             type: "defineLabel",
             label: endLabel
           }], node);
-          break;
+
+          // Leave reg_result allocated above baseTop.
+          ctx.regTop = baseTop + 1;
+          return reg_result;
         }
       case "LogicalExpression":
         {
-          // Pattern (CPython-style):
-          //   eval LHS
-          //   JUMP_IF_*_OR_POP  -> target (past RHS)
-          //   eval RHS          ← only reached if LHS didn't short-circuit
-          //   [target lands here, stack top is the result either way]
-
-          this._compileExpr(node.left, scope, bc);
-          if (node.operator === "||") {
-            // Short-circuit if LHS is TRUTHY -- keep it, skip RHS
-            const endLabel = this._makeLabel("or_end");
-            this.emit(bc, [this.OP.JUMP_IF_TRUE_OR_POP, {
-              type: "label",
-              label: endLabel
-            }], node);
-            this._compileExpr(node.right, scope, bc);
-            this.emit(bc, [null, {
-              type: "defineLabel",
-              label: endLabel
-            }], node);
-          } else if (node.operator === "&&") {
-            // Short-circuit if LHS is FALSY -- keep it, skip RHS
-            const endLabel = this._makeLabel("and_end");
-            this.emit(bc, [this.OP.JUMP_IF_FALSE_OR_POP, {
-              type: "label",
-              label: endLabel
-            }], node);
-            this._compileExpr(node.right, scope, bc);
-            this.emit(bc, [null, {
-              type: "defineLabel",
-              label: endLabel
-            }], node);
-          } else {
-            throw new Error(`Unsupported logical operator: ${node.operator}`);
-          }
-          break;
+          const n = node;
+          const endLabel = this._makeLabel("logical_end");
+          const isOr = n.operator === "||";
+          if (!isOr && n.operator !== "&&") throw new Error(`Unsupported logical operator: ${n.operator}`);
+          const baseTop = ctx.regTop;
+          const lhsReg = this._compileExpr(n.left, scope, bc);
+          ctx.regTop = baseTop;
+          const reg_result = ctx.allocReg();
+          if (lhsReg !== reg_result) this.emit(bc, [this.OP.MOVE, reg_result, lhsReg], node);
+
+          // For ||: if truthy keep LHS, jump past RHS.
+          // For &&: if falsy keep LHS, jump past RHS.
+          this.emit(bc, [isOr ? this.OP.JUMP_IF_TRUE : this.OP.JUMP_IF_FALSE, reg_result, {
+            type: "label",
+            label: endLabel
+          }], node);
+
+          // Compile RHS into reg_result.
+          ctx.regTop = baseTop;
+          ctx.allocReg(); // re-occupy reg_result
+          const rhsReg = this._compileExpr(n.right, scope, bc);
+          if (rhsReg !== reg_result) this.emit(bc, [this.OP.MOVE, reg_result, rhsReg], node);
+          this.emit(bc, [null, {
+            type: "defineLabel",
+            label: endLabel
+          }], node);
+          ctx.regTop = baseTop + 1;
+          return reg_result;
         }
       case "BinaryExpression":
         {
-          this._compileExpr(node.left, scope, bc);
-          this._compileExpr(node.right, scope, bc);
-          const arithOp = {
+          const n = node;
+          const lhsReg = this._compileExpr(n.left, scope, bc);
+          const rhsReg = this._compileExpr(n.right, scope, bc);
+          const dst = ctx.allocReg();
+          const op = {
             "+": this.OP.ADD,
             "-": this.OP.SUB,
             "*": this.OP.MUL,
@@ -1216,9 +1224,7 @@ export class Compiler {
             "^": this.OP.BXOR,
             "<<": this.OP.SHL,
             ">>": this.OP.SHR,
-            ">>>": this.OP.USHR
-          }[node.operator];
-          const cmpOp = {
+            ">>>": this.OP.USHR,
             "<": this.OP.LT,
             ">": this.OP.GT,
             "===": this.OP.EQ,
@@ -1228,38 +1234,65 @@ export class Compiler {
             "!==": this.OP.NEQ,
             "!=": this.OP.LOOSE_NEQ,
             in: this.OP.IN,
-            // ← add
-            instanceof: this.OP.INSTANCEOF // ← add
-          }[node.operator];
-          const resolvedOp = arithOp ?? cmpOp;
-          if (resolvedOp === undefined) throw new Error(`Unsupported operator: ${node.operator}`);
-          this.emit(bc, [resolvedOp], node);
-          break;
+            instanceof: this.OP.INSTANCEOF
+          }[n.operator];
+          if (op === undefined) throw new Error(`Unsupported operator: ${n.operator}`);
+          this.emit(bc, [op, dst, lhsReg, rhsReg], node);
+          return dst;
         }
       case "UpdateExpression":
         {
-          const res = this._resolve(node.argument.name, this._currentCtx);
-          const bumpOp = node.operator === "++" ? this.OP.ADD : this.OP.SUB;
-          const one = b.constantOperand(1);
-
-          // Helper closures: emit load / store for whichever resolution kind we have
-          const emitLoad = () => {
-            if (res.kind === "local") this.emit(bc, [this.OP.LOAD_LOCAL, res.slot], node);else if (res.kind === "upvalue") this.emit(bc, [this.OP.LOAD_UPVALUE, res.index], node);else this.emit(bc, [this.OP.LOAD_GLOBAL, b.constantOperand(node.argument.name)], node);
-          };
-          const emitStore = () => {
-            if (res.kind === "local") this.emit(bc, [this.OP.STORE_LOCAL, res.slot], node);else if (res.kind === "upvalue") this.emit(bc, [this.OP.STORE_UPVALUE, res.index], node);else this.emit(bc, [this.OP.STORE_GLOBAL, b.constantOperand(node.argument.name)], node);
-          };
-          emitLoad();
-          if (!node.prefix) this.emit(bc, [this.OP.DUP], node); // post: save old value before mutating
-          this.emit(bc, [this.OP.LOAD_CONST, one], node);
-          this.emit(bc, [bumpOp], node);
-          emitStore();
-          if (node.prefix) emitLoad(); // pre: reload new value as result
+          const n = node;
+          ok(n.argument.type === "Identifier", "UpdateExpression requires identifier");
+          const name = n.argument.name;
+          const res = this._resolve(name, this._currentCtx);
+          const bumpOp = n.operator === "++" ? this.OP.ADD : this.OP.SUB;
+
+          // Load current value into a register (locals are already in place)
+          let curReg;
+          if (res.kind === "local") {
+            curReg = res.slot;
+          } else if (res.kind === "upvalue") {
+            curReg = ctx.allocReg();
+            this.emit(bc, [this.OP.LOAD_UPVALUE, curReg, res.index], node);
+          } else {
+            curReg = ctx.allocReg();
+            this.emit(bc, [this.OP.LOAD_GLOBAL, curReg, b.constantOperand(name)], node);
+          }
 
-          break;
+          // For postfix we need to preserve the *old* value as the result
+          let resultReg;
+          if (!n.prefix) {
+            resultReg = ctx.allocReg();
+            this.emit(bc, [this.OP.MOVE, resultReg, curReg], node);
+          } else {
+            resultReg = -1; // placeholder – will become newReg below
+          }
+          const oneReg = ctx.allocReg();
+          this.emit(bc, [this.OP.LOAD_CONST, oneReg, b.constantOperand(1)], node);
+
+          // Compute new value (always into a fresh register)
+          const newReg = ctx.allocReg();
+          this.emit(bc, [bumpOp, newReg, curReg, oneReg], node);
+
+          // Write the new value back (local = MOVE, others = STORE_xxx)
+          if (res.kind === "local") {
+            this.emit(bc, [this.OP.MOVE, res.slot, newReg], node);
+          } else if (res.kind === "upvalue") {
+            this.emit(bc, [this.OP.STORE_UPVALUE, res.index, newReg], node);
+          } else {
+            this.emit(bc, [this.OP.STORE_GLOBAL, b.constantOperand(name), newReg], node);
+          }
+
+          // Prefix returns the *new* value (we already have it in newReg – no reload needed)
+          if (n.prefix) {
+            resultReg = newReg;
+          }
+          return resultReg;
         }
       case "AssignmentExpression":
         {
+          const n = node;
           const compoundOp = {
             "+=": this.OP.ADD,
             "-=": this.OP.SUB,
@@ -1272,268 +1305,242 @@ export class Compiler {
             "<<=": this.OP.SHL,
             ">>=": this.OP.SHR,
             ">>>=": this.OP.USHR
-          }[node.operator];
+          }[n.operator];
           const isCompound = compoundOp !== undefined;
-          if (node.operator !== "=" && !isCompound) {
-            throw new Error(`Unsupported assignment operator: ${node.operator}`);
-          }
+          if (n.operator !== "=" && !isCompound) throw new Error(`Unsupported assignment operator: ${n.operator}`);
 
           // Member assignment: obj.x = val  or  arr[i] = val
-          if (node.left.type === "MemberExpression") {
-            this._compileExpr(node.left.object, scope, bc); // push obj
-
-            if (node.left.computed) {
-              this._compileExpr(node.left.property, scope, bc); // push key (runtime)
+          if (n.left.type === "MemberExpression") {
+            const objReg = this._compileExpr(n.left.object, scope, bc);
+            let keyReg;
+            if (n.left.computed) {
+              keyReg = this._compileExpr(n.left.property, scope, bc);
             } else {
-              this.emit(bc, [this.OP.LOAD_CONST, b.constantOperand(node.left.property.name)], node);
+              keyReg = ctx.allocReg();
+              this.emit(bc, [this.OP.LOAD_CONST, keyReg, b.constantOperand(n.left.property.name)], node);
             }
+            let valReg;
             if (isCompound) {
-              // Duplicate obj+key on the stack so we can read before we write.
-              // Stack before DUP2: [..., obj, key]
-              // We need: [..., obj, key, obj, key] -> GET_PROP_COMPUTED -> [..., obj, key, currentVal]
-              // Cheapest approach without a DUP opcode: re-compile the member read.
-              // (emits obj + key again; a future peephole pass could DUP instead)
-              this._compileExpr(node.left.object, scope, bc);
-              if (node.left.computed) {
-                this._compileExpr(node.left.property, scope, bc);
-              } else {
-                this.emit(bc, [this.OP.LOAD_CONST, b.constantOperand(node.left.property.name)], node);
-              }
-              this.emit(bc, [this.OP.GET_PROP_COMPUTED], node); // [..., obj, key, currentVal]
-              this._compileExpr(node.right, scope, bc); // [..., obj, key, currentVal, rhs]
-              this.emit(bc, [compoundOp], node); // [..., obj, key, newVal]
+              const curReg = ctx.allocReg();
+              this.emit(bc, [this.OP.GET_PROP, curReg, objReg, keyReg], node);
+              const rhsReg = this._compileExpr(n.right, scope, bc);
+              valReg = ctx.allocReg();
+              this.emit(bc, [compoundOp, valReg, curReg, rhsReg], node);
             } else {
-              this._compileExpr(node.right, scope, bc); // [..., obj, key, val]
+              valReg = this._compileExpr(n.right, scope, bc);
             }
-            this.emit(bc, [this.OP.SET_PROP], node); // obj[key] = val, leaves val on stack
-            break;
+            this.emit(bc, [this.OP.SET_PROP, objReg, keyReg, valReg], node);
+            return valReg;
           }
 
-          // Plain identifier assignment
-          const res = this._resolve(node.left.name, this._currentCtx);
+          // Plain identifier assignment.
+          const res = this._resolve(n.left.name, this._currentCtx);
+          let rhsReg;
           if (isCompound) {
-            // Load the current value of the target first
+            // Load current value of the variable.
+            let curReg;
             if (res.kind === "local") {
-              this.emit(bc, [this.OP.LOAD_LOCAL, res.slot], node);
+              curReg = res.slot;
             } else if (res.kind === "upvalue") {
-              this.emit(bc, [this.OP.LOAD_UPVALUE, res.index], node);
+              curReg = ctx.allocReg();
+              this.emit(bc, [this.OP.LOAD_UPVALUE, curReg, res.index], node);
             } else {
-              this.emit(bc, [this.OP.LOAD_GLOBAL, b.constantOperand(node.left.name)], node);
+              curReg = ctx.allocReg();
+              this.emit(bc, [this.OP.LOAD_GLOBAL, curReg, b.constantOperand(n.left.name)], node);
             }
-          }
-          this._compileExpr(node.right, scope, bc); // push RHS
-
-          if (isCompound) {
-            this.emit(bc, [compoundOp], node); // apply binary op -> leaves newVal on stack
+            const rhs2 = this._compileExpr(n.right, scope, bc);
+            rhsReg = ctx.allocReg();
+            this.emit(bc, [compoundOp, rhsReg, curReg, rhs2], node);
+          } else {
+            rhsReg = this._compileExpr(n.right, scope, bc);
           }
 
-          // Store & leave value on stack (assignment is an expression)
+          // Store result and return it.
           if (res.kind === "local") {
-            this.emit(bc, [this.OP.STORE_LOCAL, res.slot], node);
-            this.emit(bc, [this.OP.LOAD_LOCAL, res.slot], node);
+            if (rhsReg !== res.slot) this.emit(bc, [this.OP.MOVE, res.slot, rhsReg], node);
+            return res.slot;
           } else if (res.kind === "upvalue") {
-            this.emit(bc, [this.OP.STORE_UPVALUE, res.index], node);
-            this.emit(bc, [this.OP.LOAD_UPVALUE, res.index], node);
+            this.emit(bc, [this.OP.STORE_UPVALUE, res.index, rhsReg], node);
+            return rhsReg;
           } else {
-            const nameIdx = b.constantOperand(node.left.name);
-            this.emit(bc, [this.OP.STORE_GLOBAL, nameIdx], node);
-            this.emit(bc, [this.OP.LOAD_GLOBAL, nameIdx], node);
+            const nameIdx = b.constantOperand(n.left.name);
+            this.emit(bc, [this.OP.STORE_GLOBAL, nameIdx, rhsReg], node);
+            return rhsReg;
           }
-          break;
         }
       case "CallExpression":
         {
-          if (node.callee.type === "MemberExpression") {
-            // ── Method call: console.log(...)
-            // Push receiver first (GET_PROP leaves it; CALL_METHOD pops it as `this`)
-            this._compileExpr(node.callee.object, scope, bc);
-            const prop = node.callee.property.name;
-            const propIdx = b.constantOperand(prop);
-            this.emit(bc, [this.OP.LOAD_CONST, propIdx], node);
-            this.emit(bc, [this.OP.GET_PROP], node);
-            for (const arg of node.arguments) this._compileExpr(arg, scope, bc);
-            this.emit(bc, [this.OP.CALL_METHOD, node.arguments.length], node);
+          const n = node;
+          if (n.callee.type === "MemberExpression") {
+            // Method call: receiver.method(args)
+            const receiverReg = this._compileExpr(n.callee.object, scope, bc);
+            let methodKeyReg;
+            if (n.callee.computed) {
+              methodKeyReg = this._compileExpr(n.callee.property, scope, bc);
+            } else {
+              methodKeyReg = ctx.allocReg();
+              this.emit(bc, [this.OP.LOAD_CONST, methodKeyReg, b.constantOperand(n.callee.property.name)], node);
+            }
+            const calleeReg = ctx.allocReg();
+            this.emit(bc, [this.OP.GET_PROP, calleeReg, receiverReg, methodKeyReg], node);
+            const argRegs = n.arguments.map(a => this._compileExpr(a, scope, bc));
+            const dst = ctx.allocReg();
+            this.emit(bc, [this.OP.CALL_METHOD, dst, receiverReg, calleeReg, n.arguments.length, ...argRegs], node);
+            return dst;
           } else {
-            // ── Plain call: add(5, 10)
-            this._compileExpr(node.callee, scope, bc);
-            for (const arg of node.arguments) this._compileExpr(arg, scope, bc);
-            this.emit(bc, [this.OP.CALL, node.arguments.length], node);
+            // Plain call: fn(args)
+            const calleeReg = this._compileExpr(n.callee, scope, bc);
+            const argRegs = n.arguments.map(a => this._compileExpr(a, scope, bc));
+            const dst = ctx.allocReg();
+            this.emit(bc, [this.OP.CALL, dst, calleeReg, n.arguments.length, ...argRegs], node);
+            return dst;
           }
-          break;
         }
       case "UnaryExpression":
         {
-          // Special case: typeof on a bare identifier must not throw if undeclared.
-          // We emit TYPEOF_SAFE (operand = name constant index) instead of
-          // compiling the argument first. The VM does the guard itself.
-          if (node.operator === "typeof" && node.argument.type === "Identifier") {
-            const res = this._resolve(node.argument.name, this._currentCtx);
+          const n = node;
+
+          // typeof on a potentially-undeclared global -- safe guard.
+          if (n.operator === "typeof" && n.argument.type === "Identifier") {
+            const res = this._resolve(n.argument.name, this._currentCtx);
             if (res.kind === "global") {
-              // Potentially undeclared -- let VM guard it
-              this.emit(bc, [this.OP.LOAD_CONST, b.constantOperand(node.argument.name)], node);
-              this.emit(bc, [this.OP.TYPEOF_SAFE], node);
-              break;
+              const dst = ctx.allocReg();
+              this.emit(bc, [this.OP.TYPEOF_SAFE, dst, b.constantOperand(n.argument.name)], node);
+              return dst;
             }
-            // Known local or upvalue -- safe to load first, then typeof
           }
 
-          // Special case: delete -- argument must NOT be pre-evaluated.
-          if (node.operator === "delete") {
-            const arg = node.argument;
+          // delete expression.
+          if (n.operator === "delete") {
+            const arg = n.argument;
             if (arg.type === "MemberExpression") {
-              this._compileExpr(arg.object, scope, bc);
+              const objReg = this._compileExpr(arg.object, scope, bc);
+              let keyReg;
               if (arg.computed) {
-                this._compileExpr(arg.property, scope, bc);
+                keyReg = this._compileExpr(arg.property, scope, bc);
               } else {
-                this.emit(bc, [this.OP.LOAD_CONST, b.constantOperand(arg.property.name)], node);
+                keyReg = ctx.allocReg();
+                this.emit(bc, [this.OP.LOAD_CONST, keyReg, b.constantOperand(arg.property.name)], node);
               }
-              this.emit(bc, [this.OP.DELETE_PROP], node);
+              const dst = ctx.allocReg();
+              this.emit(bc, [this.OP.DELETE_PROP, dst, objReg, keyReg], node);
+              return dst;
             } else {
-              // delete x, delete 0, etc. -- always true in non-strict, just push true
-              this.emit(bc, [this.OP.LOAD_CONST, b.constantOperand(true)], node);
+              // delete x or delete 0 -- always true in sloppy mode.
+              const dst = ctx.allocReg();
+              this.emit(bc, [this.OP.LOAD_CONST, dst, b.constantOperand(true)], node);
+              return dst;
             }
-            break;
           }
 
-          // All other unary ops: compile argument first, then apply operator
-          this._compileExpr(node.argument, scope, bc);
-          switch (node.operator) {
-            case "-":
-              this.emit(bc, [this.OP.UNARY_NEG], node);
-              break;
-            case "+":
-              this.emit(bc, [this.OP.UNARY_POS], node);
-              break;
-            case "!":
-              this.emit(bc, [this.OP.UNARY_NOT], node);
-              break;
-            case "~":
-              this.emit(bc, [this.OP.UNARY_BITNOT], node);
-              break;
-            case "typeof":
-              this.emit(bc, [this.OP.TYPEOF], node);
-              break;
-            case "void":
-              this.emit(bc, [this.OP.VOID], node);
-              break;
-            default:
-              throw new Error(`Unsupported unary operator: ${node.operator}`);
-          }
-          break;
+          // All other unary operators.
+          const srcReg = this._compileExpr(n.argument, scope, bc);
+          const dst = ctx.allocReg();
+          const unaryOp = {
+            "-": this.OP.UNARY_NEG,
+            "+": this.OP.UNARY_POS,
+            "!": this.OP.UNARY_NOT,
+            "~": this.OP.UNARY_BITNOT,
+            typeof: this.OP.TYPEOF,
+            void: this.OP.VOID
+          }[n.operator];
+          if (unaryOp === undefined) throw new Error(`Unsupported unary operator: ${n.operator}`);
+          this.emit(bc, [unaryOp, dst, srcReg], node);
+          return dst;
         }
       case "RegExpLiteral":
         {
-          // Emit: new RegExp(pattern, flags)
-          // Fresh object per evaluation -- correct for stateful g/y flags.
-          this.emit(bc, [this.OP.LOAD_GLOBAL, b.constantOperand("RegExp")], node);
-          this.emit(bc, [this.OP.LOAD_CONST, b.constantOperand(node.pattern)], node);
-          this.emit(bc, [this.OP.LOAD_CONST, b.constantOperand(node.flags)], node);
-          this.emit(bc, [this.OP.NEW, 2], node);
-          break;
+          const n = node;
+          // new RegExp(pattern, flags)
+          const regExpReg = ctx.allocReg();
+          this.emit(bc, [this.OP.LOAD_GLOBAL, regExpReg, b.constantOperand("RegExp")], node);
+          const patternReg = ctx.allocReg();
+          this.emit(bc, [this.OP.LOAD_CONST, patternReg, b.constantOperand(n.pattern)], node);
+          const flagsReg = ctx.allocReg();
+          this.emit(bc, [this.OP.LOAD_CONST, flagsReg, b.constantOperand(n.flags)], node);
+          const dst = ctx.allocReg();
+          this.emit(bc, [this.OP.NEW, dst, regExpReg, 2, patternReg, flagsReg], node);
+          return dst;
         }
       case "FunctionExpression":
         {
-          // Compile into a descriptor exactly like a declaration,
-          // but leave the resulting closure ON THE STACK -- no store.
-          // The surrounding expression (assignment, call arg, return) consumes it.
           const desc = this._compileFunctionDecl(node);
-          this._emitMakeClosure(desc, node, bc);
-          break;
+          return this._emitMakeClosure(desc, node, bc);
         }
       case "MemberExpression":
         {
-          this._compileExpr(node.object, scope, bc);
-          if (node.computed) {
-            // nums[i] -- key is runtime value
-            this._compileExpr(node.property, scope, bc);
+          const n = node;
+          const objReg = this._compileExpr(n.object, scope, bc);
+          let keyReg;
+          if (n.computed) {
+            keyReg = this._compileExpr(n.property, scope, bc);
           } else {
-            // point.x -- push key as string, same opcode handles both
-            this.emit(bc, [this.OP.LOAD_CONST, b.constantOperand(node.property.name)], node);
+            keyReg = ctx.allocReg();
+            this.emit(bc, [this.OP.LOAD_CONST, keyReg, b.constantOperand(n.property.name)], node);
           }
-
-          // GET_PROP_COMPUTED pops the object -- correct for value access.
-          // GET_PROP (peek) is only used in CallExpression's method call path
-          // where the receiver must survive on the stack for CALL_METHOD.
-          this.emit(bc, [this.OP.GET_PROP_COMPUTED], node);
-          break;
+          const dst = ctx.allocReg();
+          this.emit(bc, [this.OP.GET_PROP, dst, objReg, keyReg], node);
+          return dst;
         }
       case "ArrayExpression":
         {
-          // Compile each element left->right, then BUILD_ARRAY collapses them.
-          // Sparse arrays (holes) get explicit undefined per slot.
-          for (const el of node.elements) {
+          const n = node;
+          const elemRegs = n.elements.map(el => {
             if (el === null) {
-              // hole: e.g. [1,,3]
-              this.emit(bc, [this.OP.LOAD_CONST, b.constantOperand(undefined)], node);
-            } else {
-              this._compileExpr(el, scope, bc);
+              const r = ctx.allocReg();
+              this.emit(bc, [this.OP.LOAD_CONST, r, b.constantOperand(undefined)], node);
+              return r;
             }
-          }
-          this.emit(bc, [this.OP.BUILD_ARRAY, node.elements.length], node);
-          break;
+            return this._compileExpr(el, scope, bc);
+          });
+          const dst = ctx.allocReg();
+          this.emit(bc, [this.OP.BUILD_ARRAY, dst, n.elements.length, ...elemRegs], node);
+          return dst;
         }
       case "ObjectExpression":
         {
-          // Separate regular data properties from ES5 accessor methods (get/set).
+          const n = node;
           const regularProps = [];
           const accessorProps = [];
-          for (const prop of node.properties) {
-            if (prop.type === "SpreadElement") {
-              throw new Error("Object spread not supported");
-            }
+          for (const prop of n.properties) {
+            if (prop.type === "SpreadElement") throw new Error("Object spread not supported");
             if (prop.type === "ObjectMethod") {
               if (prop.kind === "get" || prop.kind === "set") {
-                if (prop.computed) {
-                  throw new Error("Computed getter/setter keys are not supported");
-                }
+                if (prop.computed) throw new Error("Computed getter/setter keys are not supported");
                 accessorProps.push(prop);
               } else {
-                throw new Error(`Shorthand method syntax is not supported`);
+                throw new Error("Shorthand method syntax is not supported");
               }
             } else {
               regularProps.push(prop);
             }
           }
 
-          // Build the base object from data properties.
+          // Build flat [key, val, key, val, …] register list.
+          const pairRegs = [];
           for (const prop of regularProps) {
-            const key = prop.key;
             let keyStr;
-            if (key.type === "Identifier") {
-              keyStr = key.name;
-            } else if (key.type === "StringLiteral" || key.type === "NumericLiteral") {
-              keyStr = String(key.value);
-            } else {
-              throw new Error(`Unsupported object key type: ${key.type}`);
-            }
-            this.emit(bc, [this.OP.LOAD_CONST, b.constantOperand(keyStr)], node);
-            this._compileExpr(prop.value, scope, bc);
+            const key = prop.key;
+            if (key.type === "Identifier") keyStr = key.name;else if (key.type === "StringLiteral" || key.type === "NumericLiteral") keyStr = String(key.value);else throw new Error(`Unsupported object key type: ${key.type}`);
+            const keyReg = ctx.allocReg();
+            this.emit(bc, [this.OP.LOAD_CONST, keyReg, b.constantOperand(keyStr)], node);
+            const valReg = this._compileExpr(prop.value, scope, bc);
+            pairRegs.push(keyReg, valReg);
           }
-          this.emit(bc, [this.OP.BUILD_OBJECT, regularProps.length], node);
+          const dst = ctx.allocReg();
+          this.emit(bc, [this.OP.BUILD_OBJECT, dst, regularProps.length, ...pairRegs], node);
 
-          // Define each accessor on the object that is now on top of the stack.
-          // Stack after BUILD_OBJECT: [..., obj]
-          // For each accessor: DUP obj, push key, compile fn, DEFINE_GETTER/DEFINE_SETTER
-          // DEFINE_GETTER/DEFINE_SETTER pops fn+key+obj, leaving the original obj.
+          // Define accessors on the object now sitting in `dst`.
           for (const prop of accessorProps) {
             const key = prop.key;
             let keyStr;
-            if (key.type === "Identifier") {
-              keyStr = key.name;
-            } else if (key.type === "StringLiteral" || key.type === "NumericLiteral") {
-              keyStr = String(key.value);
-            } else {
-              throw new Error(`Unsupported object key type: ${key.type}`);
-            }
-            this.emit(bc, [this.OP.DUP], node); // dup so the original obj stays after the define
-            this.emit(bc, [this.OP.LOAD_CONST, b.constantOperand(keyStr)], node);
-
-            // Compile the accessor body as an anonymous function descriptor.
-            const desc = this._compileFunctionDecl(prop);
-            this._emitMakeClosure(desc, prop, bc);
-            this.emit(bc, [prop.kind === "get" ? this.OP.DEFINE_GETTER : this.OP.DEFINE_SETTER], node);
+            if (key.type === "Identifier") keyStr = key.name;else if (key.type === "StringLiteral" || key.type === "NumericLiteral") keyStr = String(key.value);else throw new Error(`Unsupported object key type: ${key.type}`);
+            const keyReg = ctx.allocReg();
+            this.emit(bc, [this.OP.LOAD_CONST, keyReg, b.constantOperand(keyStr)], node);
+            const fnReg = this._emitMakeClosure(this._compileFunctionDecl(prop), prop, bc);
+            this.emit(bc, [prop.kind === "get" ? this.OP.DEFINE_GETTER : this.OP.DEFINE_SETTER, dst, keyReg, fnReg], node);
           }
-          break;
+          return dst;
         }
       default:
         {
@@ -1543,10 +1550,7 @@ export class Compiler {
   }
 }
 
-// Serializer
-// Turns the compiled output into a commented JS source string.
-// Expects fully-resolved bytecode (all label refs and constant refs already
-// converted to plain integers by resolveLabels + resolveConstants passes).
+// ── Serializer ────────────────────────────────────────────────────────────────
 class Serializer {
   constructor(compiler) {
     this.compiler = compiler;
@@ -1563,18 +1567,27 @@ class Serializer {
   get JUMP_OPS() {
     return this.compiler.JUMP_OPS;
   }
-
-  // Produce a JS literal for a constant pool entry
   _serializeConst(val) {
     if (val === null) return "null";
     if (val === undefined) return "undefined";
-    return JSON.stringify(val); // number / string / bool
+    return JSON.stringify(val);
   }
 
-  // One instruction -> "[op, op1, op2, ...]  // MNEMONIC description"
-  // Expects a fully-resolved instruction: all operands are plain numbers.
-  // Returns { text, values } where values is the flat u16 slots for this
-  // instruction (opcode first, then one entry per operand).
+  // Reverse the concealment applied by resolveConstants so disassembly comments
+  // always show the plaintext value regardless of the concealConstants option.
+  _decryptConst(constants, idx, key) {
+    const v = constants[idx];
+    if (!key) return v;
+    if (typeof v === "number") return v ^ key;
+    // String: base64 → u16 LE byte pairs → XOR with (key + i) (mirrors _readConstant)
+    const bytes = Buffer.from(v, "base64");
+    let out = "";
+    for (let i = 0; i < bytes.length / 2; i++) {
+      const code = bytes[i * 2] | bytes[i * 2 + 1] << 8;
+      out += String.fromCharCode(code ^ key + i & 0xffff);
+    }
+    return out;
+  }
   _serializeInstr(instr, constants) {
     const op = instr[0];
     const operands = instr.slice(1);
@@ -1584,66 +1597,75 @@ class Serializer {
       ok(o >= 0 && o <= 0xffff, `Operand overflow (max 0xFFFF u16): ${o}`);
     }
     ok(op >= 0 && op <= 0xffff, `Opcode overflow (max 0xFFFF u16): ${op}`);
-    const operand = resolvedOperands[0]; // first operand for single-operand comment cases
     const name = this.OP_NAME[op] || `OP_${op}`;
     let comment = name;
+    function formatLoc(loc) {
+      return loc ? `${loc.line}:${loc.column}` : "";
+    }
     const sourceNode = instr[SOURCE_NODE_SYM];
-    const sourceLocation = sourceNode ? sourceNode.loc.start?.line + ":" + sourceNode.loc.start?.column + "-" + (sourceNode.loc.end?.line + ":" + sourceNode.loc.end?.column) : "";
-
-    // Annotate with human-readable operand meaning
+    const sourceLocation = sourceNode?.loc ? [formatLoc(sourceNode.loc.start), formatLoc(sourceNode.loc.end)].filter(Boolean).join("-") : "";
     if (resolvedOperands.length > 0) {
+      // Operand[0] is always `dst` for instruction types that produce a value.
+      const dst = resolvedOperands[0];
       switch (op) {
         case this.OP.LOAD_CONST:
           {
-            const val = constants[operand];
-            comment += `  ${this._serializeConst(val)}`;
+            // resolvedOperands: [dst, constIdx, concealKey]
+            const val = this._decryptConst(constants, resolvedOperands[1], resolvedOperands[2]);
+            comment += `  reg[${dst}] = ${this._serializeConst(val)}`;
             break;
           }
-        case this.OP.MAKE_CLOSURE:
-          {
-            comment += `  PC ${operand} (params=${resolvedOperands[1]} locals=${resolvedOperands[2]} upvalues=${resolvedOperands[3]})`;
-            break;
-          }
-        case this.OP.LOAD_LOCAL:
-        case this.OP.STORE_LOCAL:
-          comment += `  slot[${operand}]`;
+        case this.OP.LOAD_GLOBAL:
+          // resolvedOperands: [dst, constIdx, concealKey]
+          comment += `  reg[${dst}] = ${this._decryptConst(constants, resolvedOperands[1], resolvedOperands[2])}`;
+          break;
+        case this.OP.STORE_GLOBAL:
+          // resolvedOperands: [constIdx, concealKey, srcReg]
+          comment += `  ${this._decryptConst(constants, resolvedOperands[0], resolvedOperands[1])} = reg[${resolvedOperands[2]}]`;
           break;
         case this.OP.LOAD_UPVALUE:
+          comment += `  reg[${dst}] = upvalue[${resolvedOperands[1]}]`;
+          break;
         case this.OP.STORE_UPVALUE:
-          comment += `  upvalue[${operand}]`;
+          comment += `  upvalue[${resolvedOperands[0]}] = reg[${resolvedOperands[1]}]`;
           break;
-        case this.OP.LOAD_GLOBAL:
-        case this.OP.STORE_GLOBAL:
-          comment += `  "${constants[operand]}"`;
+        case this.OP.MOVE:
+          comment += `  reg[${dst}] = reg[${resolvedOperands[1]}]`;
+          break;
+        case this.OP.MAKE_CLOSURE:
+          comment += `  reg[${dst}] PC=${resolvedOperands[1]} (params=${resolvedOperands[2]} regs=${resolvedOperands[3]} upvalues=${resolvedOperands[4]})`;
           break;
         case this.OP.CALL:
+          comment += `  reg[${dst}] = call(reg[${resolvedOperands[1]}], ${resolvedOperands[2]} args)`;
+          break;
         case this.OP.CALL_METHOD:
-          comment += `  (${operand} args)`;
+          comment += `  reg[${dst}] = method(recv=reg[${resolvedOperands[1]}], fn=reg[${resolvedOperands[2]}], ${resolvedOperands[3]} args)`;
+          break;
+        case this.OP.NEW:
+          comment += `  reg[${dst}] = new reg[${resolvedOperands[1]}](${resolvedOperands[2]} args)`;
+          break;
+        case this.OP.RETURN:
+          comment += `  reg[${resolvedOperands[0]}]`;
           break;
         case this.OP.BUILD_ARRAY:
-          comment += `  (${operand} elements)`;
+          comment += `  reg[${dst}] = [${resolvedOperands[2]} elems]`;
           break;
         case this.OP.BUILD_OBJECT:
-          comment += `  (${operand} pairs)`;
-          break;
-        case this.OP.NEW:
-          comment += `  (${operand} args)`;
+          comment += `  reg[${dst}] = {${resolvedOperands[1]} pairs}`;
           break;
         default:
-          comment += resolvedOperands.length === 1 ? `  ${operand}` : `  [${resolvedOperands.join(", ")}]`;
+          comment += resolvedOperands.length === 1 ? `  ${resolvedOperands[0]}` : `  [${resolvedOperands.join(", ")}]`;
       }
     }
-    comment = comment.padEnd(40) + sourceLocation;
+    comment = comment.padEnd(50) + sourceLocation;
     const values = [op, ...resolvedOperands];
     const instrText = `[${values.join(", ")}]`;
-    const text = `${(instrText + ",").padEnd(12)} ${comment}`;
+    const text = `${(instrText + ",").padEnd(20)} ${comment}`;
     return {
       text,
       values
     };
   }
-
-  // Serialize the CONSTANTS array
   _serializeConstants(constants) {
     const lines = ["var CONSTANTS = ["];
     constants.forEach((val, idx) => {
@@ -1652,19 +1674,17 @@ class Serializer {
     lines.push("];");
     return lines.join("\n");
   }
-
-  // Filter out any remaining null-opcode pseudo-instructions.
-  // (defineLabel pseudo-ops are already stripped by resolveLabels.)
   _serializeBytecode(bytecode, compiler) {
     const serialized = [];
     for (const instr of bytecode) {
       if (instr[0] === null) continue;
       const specializedOpInfo = compiler.SPECIALIZED_OPS[instr[0]];
       if (specializedOpInfo) {
-        const resolvedValue = instr[1]?.resolvedValue ?? instr[1];
+        const operands = instr.slice(1);
+        const resolvedValues = operands.map(o => o?.resolvedValue ?? o);
         const originalName = compiler.OP_NAME[specializedOpInfo.originalOp];
-        compiler.OP_NAME[instr[0]] = `${originalName}_${resolvedValue}`;
-        specializedOpInfo.resolvedOperand = instr[1];
+        compiler.OP_NAME[instr[0]] = `${originalName}_${resolvedValues.join("_")}`;
+        specializedOpInfo.resolvedOperands = operands;
       }
       serialized.push(instr);
     }
@@ -1673,7 +1693,6 @@ class Serializer {
     };
   }
   _encodeBytecode(flat) {
-    // Encode as little-endian Uint16Array -> base64.
     const buf = new Uint8Array(flat.length * 2);
     flat.forEach((w, i) => {
       buf[i * 2] = w & 0xff;
@@ -1683,6 +1702,7 @@ class Serializer {
   }
   serialize(bytecode, constants, compiler) {
     const mainStartPc = compiler.mainStartPc;
+    const mainRegCount = compiler.mainRegCount;
     let sections = [];
     var textForm = [];
     var initBody = [];
@@ -1700,24 +1720,16 @@ class Serializer {
     if (this.options.encodeBytecode) {
       sections.push(`var BYTECODE = "${this._encodeBytecode(flat)}";`);
     } else {
-      // Flatten each [op, ...operands] instruction into individual u16 slots.
-
       sections.push(`var BYTECODE = [${flat.join(",")}]`);
     }
-
-    // MAIN_START_PC
     sections.push(`var MAIN_START_PC = ${mainStartPc};`);
+    sections.push(`var MAIN_REG_COUNT = ${mainRegCount};`);
     sections.push(`var ENCODE_BYTECODE = ${!!this.options.encodeBytecode};`);
     sections.push(`var TIMING_CHECKS = ${!!this.options.timingChecks};`);
-    // Opcodes
     const object = t.objectExpression(Object.entries(this.OP).map(([name, value]) => t.objectProperty(t.identifier(name), t.numericLiteral(value))));
     sections.push(`var OP = ${generate(object).code};`);
-
-    // Constants must be defined before the bytecode
     initBody.push(this._serializeConstants(constants));
     sections = [...initBody, ...sections];
-
-    // VM runtime
     sections.push(VM_RUNTIME);
     return sections.join("\n\n");
   }
@@ -1725,12 +1737,8 @@ class Serializer {
 export async function compileAndSerialize(sourceCode, options) {
   const compiler = new Compiler(options);
   let bytecode = compiler.compile(sourceCode);
-
-  // User transform passes (operate on unresolved IR with label/constant refs)
-  // macroOpcodes must run after selfModifying (so PATCH-stub bodies are in place)
   const passes = [];
-
-  // Due to current implementation, specialized must run BEFORE macroOpcodes
+  passes.push(concealConstants);
   if (options.specializedOpcodes) {
     passes.push(specializedOpcodes);
   }
@@ -1740,22 +1748,30 @@ export async function compileAndSerialize(sourceCode, options) {
   if (options.selfModifying) {
     passes.push(selfModifying);
   }
+  if (options.aliasedOpcodes) {
+    passes.push(aliasedOpcodes);
+  }
   for (const pass of passes) {
     const passResult = pass(bytecode, compiler);
     bytecode = passResult.bytecode;
   }
 
-  // Assembler phases: resolve IR operands to plain integers before printing
-  const {
-    bytecode: labelResolved
-  } = resolveLabels(bytecode, compiler);
-  let {
-    bytecode: finalBytecode,
-    constants
-  } = resolveConstants(labelResolved);
-  const output = compiler.serializer.serialize(finalBytecode, constants, compiler);
-  const finalOutput = await obfuscateRuntime(output, finalBytecode, options, compiler);
+  // Resolve label references to flat bytecode indices.
+  const labelsResult = resolveLabels(bytecode, compiler);
+  bytecode = labelsResult.bytecode;
+
+  // Set mainStartPc from the first function descriptor (or 0 for top-level start).
+  compiler.mainStartPc = compiler.mainFn.startPc;
+
+  // Resolve constant references to pool indices (+ conceal key operand).
+  const constResult = resolveConstants(bytecode, compiler);
+  bytecode = constResult.bytecode;
+  compiler.constants = constResult.constants;
+
+  // Build and obfuscate the runtime.
+  const runtimeSource = compiler.serializer.serialize(bytecode, constResult.constants, compiler);
+  const code = await obfuscateRuntime(runtimeSource, bytecode, options, compiler);
   return {
-    code: finalOutput
+    code
   };
 }