tishlang_vm 2.2.5

//! Stack-based bytecode VM.

use std::collections::{HashMap, HashSet};
use std::sync::Arc;

#[cfg(not(feature = "send-values"))]
use std::rc::Rc;
use tishlang_core::VmRef;

use tishlang_ast::{BinOp, UnaryOp};
use tishlang_builtins::array as arr_builtins;
use tishlang_builtins::construct as construct_builtin;
use tishlang_builtins::globals as globals_builtins;
use tishlang_builtins::math as math_builtins;
use tishlang_builtins::number as num_builtins;
use tishlang_builtins::string as str_builtins;
use tishlang_bytecode::{u8_to_binop, u8_to_unaryop, Chunk, Constant, Opcode, NO_REST_PARAM};
use tishlang_core::{
    merge_object_data, object_get, object_has, object_set, to_int32, to_uint32, NativeFn,
    ObjectData, ObjectMap, PropMap, Value,
};

/// Error string returned by `run_chunk`/`run_framed` to mean "a thrown value is parked in
/// [`VM_PENDING_THROW`]; keep unwinding toward an enclosing `catch`" (issue #60). The leading
/// control char makes it unmistakable for a real diagnostic. `Callable::call` returns a bare
/// `Value`, so the thrown *value* can't ride the `Result`; it travels in this thread-local
/// instead and is picked up at the next call site (or the top-level boundary).
const PENDING_THROW_SENTINEL: &str = "\u{1}__tish_pending_throw__";

thread_local! {
    static VM_PENDING_THROW: std::cell::RefCell<Option<Value>> =
        const { std::cell::RefCell::new(None) };
}

fn set_pending_throw(v: Value) {
    VM_PENDING_THROW.with(|c| *c.borrow_mut() = Some(v));
}
fn take_pending_throw() -> Option<Value> {
    VM_PENDING_THROW.with(|c| c.borrow_mut().take())
}
fn pending_throw_is_set() -> bool {
    VM_PENDING_THROW.with(|c| c.borrow().is_some())
}

/// Append the source location of the instruction at `off` to a runtime-error message, e.g.
/// `Cannot read property 'x' of null (at app.tish:4)` (issue #74). No-ops when the chunk
/// carries no line table (e.g. deserialized bytecode).
fn locate_error(chunk: &Chunk, off: usize, msg: &str) -> String {
    match chunk.line_at(off) {
        Some(line) => match &chunk.source {
            Some(src) => format!("{msg} (at {src}:{line})"),
            None => format!("{msg} (at line {line})"),
        },
        None => msg.to_string(),
    }
}

/// Wrap a closure in the right shared pointer for the current build.
/// Under `send-values` that's `Arc<dyn Fn + Send + Sync>`; otherwise it's
/// plain `Rc<dyn Fn>`. Call sites can stay ignorant of the distinction.
#[cfg(feature = "send-values")]
#[inline]
fn make_native_fn<F>(f: F) -> NativeFn
where
    F: Fn(&[Value]) -> Value + Send + Sync + 'static,
{
    tishlang_core::native_fn(f)
}

#[cfg(not(feature = "send-values"))]
#[inline]
fn make_native_fn<F>(f: F) -> NativeFn
where
    F: Fn(&[Value]) -> Value + 'static,
{
    tishlang_core::native_fn(f)
}

// Array / string / object methods have the same shape as `NativeFn`, which
// is already feature-gated (`Rc<dyn Fn>` vs `Arc<dyn Fn + Send + Sync>`).
// Alias to that so the VM picks the right pointer type automatically.
type ArrayMethodFn = NativeFn;

/// Feature names enabled for this VM run (`tish run --feature …`). `full` enables every optional capability.
#[cfg_attr(
    not(any(
        feature = "fs",
        feature = "http",
        feature = "promise",
        feature = "timers",
        feature = "process",
        feature = "ws"
    )),
    allow(dead_code)
)]
#[inline]
fn value_object_from_map(m: ObjectMap) -> Value {
    Value::Object(VmRef::new(ObjectData::from_strings(m)))
}

#[cfg(any(
    feature = "fs",
    feature = "http",
    feature = "promise",
    feature = "timers",
    feature = "process",
    feature = "ws"
))]
#[inline]
fn cap_allows(enabled: &HashSet<String>, name: &str) -> bool {
    enabled.contains("full") || enabled.contains(name)
}

/// Capabilities linked into this `tishlang_vm` binary (compile-time). Used by [`Vm::new`] and `run()`.
pub fn all_compiled_capabilities() -> HashSet<String> {
    #[allow(unused_mut)]
    let mut s = HashSet::new();
    #[cfg(feature = "http")]
    s.insert("http".to_string());
    #[cfg(feature = "promise")]
    s.insert("promise".to_string());
    #[cfg(feature = "timers")]
    s.insert("timers".to_string());
    #[cfg(feature = "fs")]
    s.insert("fs".to_string());
    #[cfg(feature = "process")]
    s.insert("process".to_string());
    #[cfg(feature = "regex")]
    s.insert("regex".to_string());
    #[cfg(feature = "ws")]
    s.insert("ws".to_string());
    #[cfg(feature = "tty")]
    s.insert("tty".to_string());
    s
}

/// Look up built-in module export for LoadNativeExport. Returns None if unknown or feature disabled.
#[cfg_attr(
    not(any(
        feature = "fs",
        feature = "http",
        feature = "promise",
        feature = "timers",
        feature = "process",
        feature = "ws",
        feature = "tty"
    )),
    allow(unused_variables)
)]
fn get_builtin_export(enabled: &HashSet<String>, spec: &str, export_name: &str) -> Option<Value> {
    #[cfg(feature = "fs")]
    if spec == "tish:fs" && cap_allows(enabled, "fs") {
        return match export_name {
            "readFile" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::read_file(args)
            })),
            "writeFile" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::write_file(args)
            })),
            "fileExists" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::file_exists(args)
            })),
            "isDir" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::is_dir(args)
            })),
            "readDir" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::read_dir(args)
            })),
            "mkdir" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::mkdir(args)
            })),
            "readFileBytes" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::read_file_bytes(args)
            })),
            _ => None,
        };
    }
    #[cfg(feature = "http")]
    if spec == "tish:http" && cap_allows(enabled, "http") {
        return match export_name {
            // Bytecode compiler lowers `await expr` to `tish:http.await(promise)` (see tish_bytecode compiler).
            "await" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::await_promise(args.first().cloned().unwrap_or(Value::Null))
            })),
            "fetch" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::fetch_promise(args.to_vec())
            })),
            "fetchAll" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::fetch_all_promise(args.to_vec())
            })),
            "Promise" => Some(tishlang_runtime::promise_object()),
            "serve" => Some(Value::native(|args: &[Value]| {
                // Phase-1 item 2: support `serve(port, { handler, onWorker })`
                // in addition to `serve(port, handler)`. When an options
                // object is given and onWorker is a function, invoke it with
                // worker id 0 and expect it to return the request handler.
                let raw = args.get(1).cloned().unwrap_or(Value::Null);
                let handler_value = match raw {
                    Value::Function(_) => raw,
                    Value::Object(ref obj) => {
                        let obj_ref = obj.borrow();
                        if let Some(Value::Function(on_worker)) =
                            obj_ref.strings.get(&std::sync::Arc::from("onWorker")).cloned()
                        {
                            let args_for_init = [Value::Number(0.0)];
                            on_worker.call(&args_for_init)
                        } else if let Some(h) =
                            obj_ref.strings.get(&std::sync::Arc::from("handler")).cloned()
                        {
                            h
                        } else {
                            Value::Null
                        }
                    }
                    _ => Value::Null,
                };
                if let Value::Function(f) = handler_value {
                    tishlang_runtime::http_serve(args, move |req_args| f.call(req_args))
                } else {
                    Value::Null
                }
            })),
            _ => None,
        };
    }
    #[cfg(all(feature = "promise", not(feature = "http")))]
    if spec == "tish:http" && cap_allows(enabled, "promise") {
        return match export_name {
            "Promise" => Some(tishlang_runtime::promise_object()),
            "await" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::await_promise(args.first().cloned().unwrap_or(Value::Null))
            })),
            _ => None,
        };
    }
    #[cfg(feature = "timers")]
    if spec == "tish:timers" && cap_allows(enabled, "timers") {
        return match export_name {
            "setTimeout" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::timer_set_timeout(args)
            })),
            "setInterval" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::timer_set_interval(args)
            })),
            "clearTimeout" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::timer_clear_timeout(args)
            })),
            "clearInterval" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::timer_clear_interval(args)
            })),
            _ => None,
        };
    }
    #[cfg(feature = "process")]
    if spec == "tish:process" && cap_allows(enabled, "process") {
        return match export_name {
            "exit" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::process_exit(args)
            })),
            "cwd" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::process_cwd(args)
            })),
            "exec" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::process_exec(args)
            })),
            "argv" => Some(Value::Array(VmRef::new(
                std::env::args().map(|s| Value::String(s.into())).collect(),
            ))),
            "env" => Some(value_object_from_map(
                std::env::vars()
                    .map(|(k, v)| (Arc::from(k.as_str()), Value::String(v.into())))
                    .collect(),
            )),
            "process" => {
                let mut m = ObjectMap::default();
                m.insert(
                    "exit".into(),
                    Value::native(|args: &[Value]| tishlang_runtime::process_exit(args)),
                );
                m.insert(
                    "cwd".into(),
                    Value::native(|args: &[Value]| tishlang_runtime::process_cwd(args)),
                );
                m.insert(
                    "exec".into(),
                    Value::native(|args: &[Value]| tishlang_runtime::process_exec(args)),
                );
                m.insert(
                    "argv".into(),
                    Value::Array(VmRef::new(
                        std::env::args().map(|s| Value::String(s.into())).collect(),
                    )),
                );
                m.insert(
                    "env".into(),
                    value_object_from_map(
                        std::env::vars()
                            .map(|(k, v)| (Arc::from(k.as_str()), Value::String(v.into())))
                            .collect(),
                    ),
                );
                Some(value_object_from_map(m))
            }
            _ => None,
        };
    }
    #[cfg(feature = "ws")]
    if spec == "tish:ws" && cap_allows(enabled, "ws") {
        return match export_name {
            "WebSocket" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::web_socket_client(args)
            })),
            "Server" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::web_socket_server_construct(args)
            })),
            "wsSend" => Some(Value::native(|args: &[Value]| {
                Value::Bool(tishlang_runtime::ws_send_native(
                    args.first().unwrap_or(&Value::Null),
                    &args
                        .get(1)
                        .map(|v| v.to_display_string())
                        .unwrap_or_default(),
                ))
            })),
            "wsBroadcast" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::ws_broadcast_native(args)
            })),
            _ => None,
        };
    }
    #[cfg(feature = "tty")]
    if spec == "tish:tty" && cap_allows(enabled, "tty") {
        return match export_name {
            "size" => Some(Value::native(|args: &[Value]| tishlang_runtime::tty_size(args))),
            "isTTY" => Some(Value::native(|args: &[Value]| tishlang_runtime::tty_is_tty(args))),
            "setRawMode" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::tty_set_raw_mode(args)
            })),
            "enterAltScreen" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::tty_enter_alt_screen(args)
            })),
            "leaveAltScreen" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::tty_leave_alt_screen(args)
            })),
            "read" => Some(Value::native(|args: &[Value]| tishlang_runtime::tty_read(args))),
            "readLine" => Some(Value::native(|args: &[Value]| {
                tishlang_runtime::tty_read_line(args)
            })),
            _ => None,
        };
    }
    None
}

/// Console output: println! on native, web_sys::console on wasm
#[cfg(not(feature = "wasm"))]
fn vm_log(s: &str) {
    println!("{}", s);
}
#[cfg(not(feature = "wasm"))]
fn vm_log_err(s: &str) {
    eprintln!("{}", s);
}
#[cfg(feature = "wasm")]
fn vm_log(s: &str) {
    #[wasm_bindgen::prelude::wasm_bindgen]
    extern "C" {
        #[wasm_bindgen(js_namespace = console)]
        fn log(s: &str);
    }
    log(s);
}
#[cfg(feature = "wasm")]
fn vm_log_err(s: &str) {
    #[wasm_bindgen::prelude::wasm_bindgen]
    extern "C" {
        #[wasm_bindgen(js_namespace = console)]
        fn error(s: &str);
    }
    error(s);
}

/// Initialize default globals (console, Math, JSON, etc.)
#[allow(unused_variables)]
fn init_globals(enabled: &HashSet<String>) -> ObjectMap {
    let mut g = ObjectMap::default();

    let mut console = ObjectMap::default();
    console.insert(
        "debug".into(),
        Value::native(|args: &[Value]| {
            let s =
                tishlang_core::format_values_for_console(args, tishlang_core::use_console_colors());
            vm_log(&s);
            Value::Null
        }),
    );
    console.insert(
        "log".into(),
        Value::native(|args: &[Value]| {
            let s =
                tishlang_core::format_values_for_console(args, tishlang_core::use_console_colors());
            vm_log(&s);
            Value::Null
        }),
    );
    console.insert(
        "info".into(),
        Value::native(|args: &[Value]| {
            let s =
                tishlang_core::format_values_for_console(args, tishlang_core::use_console_colors());
            vm_log(&s);
            Value::Null
        }),
    );
    console.insert(
        "warn".into(),
        Value::native(|args: &[Value]| {
            let s =
                tishlang_core::format_values_for_console(args, tishlang_core::use_console_colors());
            vm_log_err(&s);
            Value::Null
        }),
    );
    console.insert(
        "error".into(),
        Value::native(|args: &[Value]| {
            let s =
                tishlang_core::format_values_for_console(args, tishlang_core::use_console_colors());
            vm_log_err(&s);
            Value::Null
        }),
    );
    g.insert("console".into(), value_object_from_map(console));

    let mut math = ObjectMap::default();
    math.insert(
        "abs".into(),
        Value::native(|args: &[Value]| {
            let n = args.first().and_then(|v| v.as_number()).unwrap_or(f64::NAN);
            Value::Number(n.abs())
        }),
    );
    math.insert(
        "sqrt".into(),
        Value::native(|args: &[Value]| {
            let n = args.first().and_then(|v| v.as_number()).unwrap_or(f64::NAN);
            Value::Number(n.sqrt())
        }),
    );
    math.insert(
        "floor".into(),
        Value::native(|args: &[Value]| {
            let n = args.first().and_then(|v| v.as_number()).unwrap_or(f64::NAN);
            Value::Number(n.floor())
        }),
    );
    math.insert(
        "ceil".into(),
        Value::native(|args: &[Value]| {
            let n = args.first().and_then(|v| v.as_number()).unwrap_or(f64::NAN);
            Value::Number(n.ceil())
        }),
    );
    math.insert(
        "round".into(),
        Value::native(|args: &[Value]| {
            let n = args.first().and_then(|v| v.as_number()).unwrap_or(f64::NAN);
            Value::Number(n.round())
        }),
    );
    math.insert(
        "random".into(),
        Value::native(|_| Value::Number(rand::random::<f64>())),
    );
    math.insert(
        "min".into(),
        Value::native(|args: &[Value]| {
            let nums: Vec<f64> = args.iter().filter_map(|v| v.as_number()).collect();
            Value::Number(nums.into_iter().fold(f64::NAN, |a, b| a.min(b)))
        }),
    );
    math.insert(
        "max".into(),
        Value::native(|args: &[Value]| {
            let nums: Vec<f64> = args.iter().filter_map(|v| v.as_number()).collect();
            Value::Number(nums.into_iter().fold(f64::NAN, |a, b| a.max(b)))
        }),
    );
    math.insert(
        "pow".into(),
        Value::native(|args: &[Value]| math_builtins::pow(args)),
    );
    math.insert(
        "sin".into(),
        Value::native(|args: &[Value]| math_builtins::sin(args)),
    );
    math.insert(
        "cos".into(),
        Value::native(|args: &[Value]| math_builtins::cos(args)),
    );
    math.insert(
        "tan".into(),
        Value::native(|args: &[Value]| math_builtins::tan(args)),
    );
    math.insert(
        "log".into(),
        Value::native(|args: &[Value]| math_builtins::log(args)),
    );
    math.insert(
        "exp".into(),
        Value::native(|args: &[Value]| math_builtins::exp(args)),
    );
    math.insert(
        "sign".into(),
        Value::native(|args: &[Value]| math_builtins::sign(args)),
    );
    math.insert(
        "trunc".into(),
        Value::native(|args: &[Value]| math_builtins::trunc(args)),
    );
    // Trig/hypot not covered by `math_builtins`; needed by the 3D engine's
    // camera + character-controller math (atan2/hypot) on the wasm VM, where
    // (unlike `--target js`) there is no host `Math` to fall through to.
    math.insert(
        "atan2".into(),
        Value::native(|args: &[Value]| {
            let y = args.first().and_then(|v| v.as_number()).unwrap_or(f64::NAN);
            let x = args.get(1).and_then(|v| v.as_number()).unwrap_or(f64::NAN);
            Value::Number(y.atan2(x))
        }),
    );
    math.insert(
        "atan".into(),
        Value::native(|args: &[Value]| {
            let n = args.first().and_then(|v| v.as_number()).unwrap_or(f64::NAN);
            Value::Number(n.atan())
        }),
    );
    math.insert(
        "asin".into(),
        Value::native(|args: &[Value]| {
            let n = args.first().and_then(|v| v.as_number()).unwrap_or(f64::NAN);
            Value::Number(n.asin())
        }),
    );
    math.insert(
        "acos".into(),
        Value::native(|args: &[Value]| {
            let n = args.first().and_then(|v| v.as_number()).unwrap_or(f64::NAN);
            Value::Number(n.acos())
        }),
    );
    math.insert(
        "hypot".into(),
        Value::native(|args: &[Value]| {
            let nums: Vec<f64> = args.iter().filter_map(|v| v.as_number()).collect();
            let sum_sq: f64 = nums.iter().map(|n| n * n).sum();
            Value::Number(sum_sq.sqrt())
        }),
    );
    // Hyperbolic, inverse-hyperbolic, cbrt and base-2/10 logs. Like the trig block above
    // these aren't in `math_builtins`, and on the wasm/native VM there is no host `Math`
    // to fall through to, so they previously returned `undefined` (issue #61).
    macro_rules! math_unary {
        ($name:literal, $method:ident) => {
            math.insert(
                $name.into(),
                Value::native(|args: &[Value]| {
                    let n = args.first().and_then(|v| v.as_number()).unwrap_or(f64::NAN);
                    Value::Number(n.$method())
                }),
            );
        };
    }
    math_unary!("sinh", sinh);
    math_unary!("cosh", cosh);
    math_unary!("tanh", tanh);
    math_unary!("asinh", asinh);
    math_unary!("acosh", acosh);
    math_unary!("atanh", atanh);
    math_unary!("cbrt", cbrt);
    math_unary!("log2", log2);
    math_unary!("log10", log10);
    math.insert("PI".into(), Value::Number(std::f64::consts::PI));
    math.insert("E".into(), Value::Number(std::f64::consts::E));
    g.insert("Math".into(), value_object_from_map(math));

    let mut json = ObjectMap::default();
    json.insert(
        "parse".into(),
        Value::native(|args: &[Value]| {
            let s = args
                .first()
                .map(|v| v.to_display_string())
                .unwrap_or_default();
            tishlang_core::json_parse(&s).unwrap_or(Value::Null)
        }),
    );
    json.insert(
        "stringify".into(),
        Value::native(|args: &[Value]| {
            let v = args.first().unwrap_or(&Value::Null);
            Value::String(tishlang_core::json_stringify(v).into())
        }),
    );
    g.insert("JSON".into(), value_object_from_map(json));

    g.insert(
        "parseInt".into(),
        Value::native(|args: &[Value]| globals_builtins::parse_int(args)),
    );
    g.insert(
        "parseFloat".into(),
        Value::native(|args: &[Value]| globals_builtins::parse_float(args)),
    );
    g.insert(
        "encodeURI".into(),
        Value::native(|args: &[Value]| globals_builtins::encode_uri(args)),
    );
    g.insert(
        "decodeURI".into(),
        Value::native(|args: &[Value]| globals_builtins::decode_uri(args)),
    );
    g.insert(
        "htmlEscape".into(),
        Value::native(|args: &[Value]| {
            tishlang_builtins::string::escape_html(args.first().unwrap_or(&Value::Null))
        }),
    );
    g.insert(
        "Boolean".into(),
        Value::native(|args: &[Value]| globals_builtins::boolean(args)),
    );
    g.insert(
        "isFinite".into(),
        Value::native(|args: &[Value]| globals_builtins::is_finite(args)),
    );
    g.insert(
        "isNaN".into(),
        Value::native(|args: &[Value]| globals_builtins::is_nan(args)),
    );
    g.insert("Infinity".into(), Value::Number(f64::INFINITY));
    g.insert("NaN".into(), Value::Number(f64::NAN));
    g.insert(
        "typeof".into(),
        Value::native(|args: &[Value]| {
            let v = args.first().unwrap_or(&Value::Null);
            Value::String(v.type_name().into())
        }),
    );
    g.insert(
        "Symbol".into(),
        tishlang_builtins::symbol::symbol_object(),
    );

    // Date - full constructor (new Date(...)) plus statics now()/parse()/UTC().
    g.insert(
        "Date".into(),
        tishlang_builtins::date::date_constructor_value(),
    );
    g.insert(
        "Set".into(),
        tishlang_builtins::collections::set_constructor_value(),
    );
    g.insert(
        "Map".into(),
        tishlang_builtins::collections::map_constructor_value(),
    );

    for (name, ctor) in [
        (
            "Float64Array",
            tishlang_builtins::typedarrays::float64_array_constructor_value as fn() -> Value,
        ),
        ("Float32Array", tishlang_builtins::typedarrays::float32_array_constructor_value),
        ("Int8Array", tishlang_builtins::typedarrays::int8_array_constructor_value),
        ("Uint8Array", tishlang_builtins::typedarrays::uint8_array_constructor_value),
        ("Uint8ClampedArray", tishlang_builtins::typedarrays::uint8_clamped_array_constructor_value),
        ("Int16Array", tishlang_builtins::typedarrays::int16_array_constructor_value),
        ("Uint16Array", tishlang_builtins::typedarrays::uint16_array_constructor_value),
        ("Int32Array", tishlang_builtins::typedarrays::int32_array_constructor_value),
        ("Uint32Array", tishlang_builtins::typedarrays::uint32_array_constructor_value),
    ] {
        g.insert(name.into(), ctor());
    }
    g.insert(
        "AudioContext".into(),
        construct_builtin::audio_context_constructor_value(),
    );
    // Error constructors (issue #60): `new Error(msg)` / `Error(msg)` → `{ name, message }`.
    for name in ["Error", "TypeError", "RangeError", "SyntaxError"] {
        g.insert(name.into(), construct_builtin::error_constructor_value(name));
    }

    // Object methods - delegate to tishlang_builtins::globals
    let mut object_methods = ObjectMap::default();
    object_methods.insert(
        "assign".into(),
        Value::native(|args: &[Value]| globals_builtins::object_assign(args)),
    );
    object_methods.insert(
        "fromEntries".into(),
        Value::native(|args: &[Value]| globals_builtins::object_from_entries(args)),
    );
    object_methods.insert(
        "keys".into(),
        Value::native(|args: &[Value]| globals_builtins::object_keys(args)),
    );
    object_methods.insert(
        "values".into(),
        Value::native(|args: &[Value]| globals_builtins::object_values(args)),
    );
    object_methods.insert(
        "entries".into(),
        Value::native(|args: &[Value]| globals_builtins::object_entries(args)),
    );
    g.insert("Object".into(), value_object_from_map(object_methods));

    // Array.isArray + the `Array(n)` / `new Array(n)` constructor (issue #72). `__call`
    // serves both forms — `construct()` falls back to `__call` when there's no `__construct`.
    let mut array_static = ObjectMap::default();
    array_static.insert(
        "isArray".into(),
        Value::native(|args: &[Value]| globals_builtins::array_is_array(args)),
    );
    array_static.insert(
        Arc::from("__call"),
        Value::native(|args: &[Value]| construct_builtin::array_construct(args)),
    );
    g.insert("Array".into(), value_object_from_map(array_static));

    // String(value) as callable + String.fromCharCode
    let string_convert_fn = Value::native(|args: &[Value]| globals_builtins::string_convert(args));
    let mut string_static = ObjectMap::default();
    string_static.insert(
        "fromCharCode".into(),
        Value::native(|args: &[Value]| globals_builtins::string_from_char_code(args)),
    );
    string_static.insert(Arc::from("__call"), string_convert_fn);
    g.insert("String".into(), value_object_from_map(string_static));

    // Number(value) coercion as a callable global (issue #36).
    let mut number_static = ObjectMap::default();
    number_static.insert(
        Arc::from("__call"),
        Value::native(|args: &[Value]| globals_builtins::number_convert(args)),
    );
    g.insert("Number".into(), value_object_from_map(number_static));

    // JSX / Lattish: stubs for bytecode VM when no DOM (e.g. console). Override via set_global in browser.
    g.insert("h".into(), Value::native(|_args: &[Value]| Value::Null));
    g.insert(
        "Fragment".into(),
        value_object_from_map(ObjectMap::default()),
    );
    g.insert(
        "createRoot".into(),
        Value::native(|_args: &[Value]| {
            let mut render_obj = ObjectMap::default();
            render_obj.insert(
                "render".into(),
                Value::native(|_args: &[Value]| Value::Null),
            );
            value_object_from_map(render_obj)
        }),
    );
    g.insert(
        "useState".into(),
        Value::native(|args: &[Value]| {
            let init = args.first().cloned().unwrap_or(Value::Null);
            let arr = vec![init, Value::native(|_| Value::Null)];
            Value::Array(VmRef::new(arr))
        }),
    );
    let mut document_obj = ObjectMap::default();
    document_obj.insert("body".into(), Value::Null);
    g.insert("document".into(), value_object_from_map(document_obj));

    #[cfg(feature = "process")]
    if cap_allows(enabled, "process") {
        let mut process_obj = ObjectMap::default();
        process_obj.insert(
            "exit".into(),
            Value::native(|args: &[Value]| tishlang_runtime::process_exit(args)),
        );
        process_obj.insert(
            "cwd".into(),
            Value::native(|args: &[Value]| tishlang_runtime::process_cwd(args)),
        );
        process_obj.insert(
            "exec".into(),
            Value::native(|args: &[Value]| tishlang_runtime::process_exec(args)),
        );
        process_obj.insert(
            "argv".into(),
            Value::Array(VmRef::new(
                std::env::args().map(|s| Value::String(s.into())).collect(),
            )),
        );
        process_obj.insert(
            "env".into(),
            value_object_from_map(
                std::env::vars()
                    .map(|(k, v)| (Arc::from(k.as_str()), Value::String(v.into())))
                    .collect(),
            ),
        );
        g.insert("process".into(), value_object_from_map(process_obj));
    }

    #[cfg(feature = "timers")]
    if cap_allows(enabled, "timers") {
        g.insert(
            "setTimeout".into(),
            Value::native(|args: &[Value]| tishlang_runtime::timer_set_timeout(args)),
        );
        g.insert(
            "clearTimeout".into(),
            Value::native(|args: &[Value]| tishlang_runtime::timer_clear_timeout(args)),
        );
        g.insert(
            "setInterval".into(),
            Value::native(|args: &[Value]| tishlang_runtime::timer_set_interval(args)),
        );
        g.insert(
            "clearInterval".into(),
            Value::native(|args: &[Value]| tishlang_runtime::timer_clear_interval(args)),
        );
    }

    #[cfg(feature = "http")]
    if cap_allows(enabled, "http") {
        g.insert(
            "fetch".into(),
            Value::native(|args: &[Value]| tishlang_runtime::fetch_promise(args.to_vec())),
        );
        g.insert(
            "fetchAll".into(),
            Value::native(|args: &[Value]| tishlang_runtime::fetch_all_promise(args.to_vec())),
        );
        g.insert(
            "registerStaticRoute".into(),
            Value::native(|args: &[Value]| {
                let path = match args.first() {
                    Some(Value::String(s)) => s.to_string(),
                    _ => return Value::Null,
                };
                let body = match args.get(1) {
                    Some(Value::String(s)) => s.as_bytes().to_vec(),
                    _ => return Value::Null,
                };
                let ct = match args.get(2) {
                    Some(Value::String(s)) => s.to_string(),
                    _ => "application/octet-stream".to_string(),
                };
                tishlang_runtime::register_static_route(&path, &body, &ct);
                Value::Null
            }),
        );
        g.insert(
            "serve".into(),
            Value::native(|args: &[Value]| {
                // Phase-1 item 2 (see tish:http.serve above for full docs).
                let raw = args.get(1).cloned().unwrap_or(Value::Null);
                let handler_value = match raw {
                    Value::Function(_) => raw,
                    Value::Object(ref obj) => {
                        let obj_ref = obj.borrow();
                        if let Some(Value::Function(on_worker)) =
                            obj_ref.strings.get(&std::sync::Arc::from("onWorker")).cloned()
                        {
                            let args_for_init = [Value::Number(0.0)];
                            on_worker.call(&args_for_init)
                        } else if let Some(h) =
                            obj_ref.strings.get(&std::sync::Arc::from("handler")).cloned()
                        {
                            h
                        } else {
                            Value::Null
                        }
                    }
                    _ => Value::Null,
                };
                if let Value::Function(f) = handler_value {
                    tishlang_runtime::http_serve(args, move |req_args| f.call(req_args))
                } else {
                    Value::Null
                }
            }),
        );
    }

    #[cfg(any(feature = "http", feature = "promise"))]
    if cap_allows(enabled, "http") || cap_allows(enabled, "promise") {
        g.insert("Promise".into(), tishlang_runtime::promise_object());
    }

    // `RegExp(pattern, flags)` constructor. A language feature (not a sandboxed capability),
    // so it's available whenever the `regex` feature is compiled — matching the interpreter.
    // Routes to the same `regexp_new` the rust backend uses (full-backend-parity-plan.md).
    #[cfg(feature = "regex")]
    g.insert(
        "RegExp".into(),
        Value::native(|args: &[Value]| tishlang_runtime::regexp_new(args)),
    );

    g
}

/// Shared scope for closure capture (parent frame's locals).
type ScopeMap = VmRef<ObjectMap>;

/// The captured lexical chain for closures. Shared immutably (never mutated after a closure is
/// built — `run_chunk` only reads it: `.len()`/`.iter()`/`.is_empty()`), so it lives behind an
/// `Rc`/`Arc` instead of a `Vec` that would be deep-cloned on every call. This makes the per-call
/// `enclosing` propagation a single refcount bump rather than a `Vec` allocation + N element clones
/// — a direct cut to function-call overhead. `Arc` under `send-values` (closures must be `Send`),
/// `Rc` otherwise.
#[cfg(feature = "send-values")]
type SharedChain = std::sync::Arc<Vec<ScopeMap>>;
#[cfg(not(feature = "send-values"))]
type SharedChain = std::rc::Rc<Vec<ScopeMap>>;

/// Options for the convenience [`run_with_options`] helper (one-shot VM run from the CLI).
#[derive(Clone, Debug, Default)]
pub struct VmRunOptions {
    /// When true and not inside a nested chunk (`enclosing` is `None`), top-level [`Opcode::DeclareVar`]
    /// also writes to globals so the REPL keeps bindings across input lines.
    pub repl_mode: bool,
    /// Enabled capabilities for this run (e.g. `fs`, `http`, `full`). Empty = none (secure default).
    pub capabilities: HashSet<String>,
}

pub struct Vm {
    stack: Vec<Value>,
    scope: ObjectMap,
    /// Captured enclosing scopes for closures, **innermost first**. A free variable resolves by
    /// walking `local_scope` → each entry here in order → `scope` → `globals`. This is the full
    /// lexical chain: a closure captures its defining frame's scope *plus that frame's own
    /// enclosing chain*, so a function nested N levels deep still sees every ancestor's locals
    /// (was a fixed `enclosing` + `enclosing2`, which silently lost captures >2 levels deep — see
    /// `nested_complex`). Per-iteration `let`: a fresh frozen overlay of the loop var(s) is
    /// prepended as the innermost entry, shadowing the still-shared frame scope that follows it,
    /// so the loop var is frozen per-iteration while everything else stays live. Empty at top level.
    /// Shared via `SharedChain` (Rc/Arc) so per-call propagation is a refcount bump, not a Vec clone.
    enclosing: SharedChain,
    globals: VmRef<ObjectMap>,
    /// Capabilities for `LoadNativeExport` and globals such as `process` / `serve`.
    capabilities: Arc<HashSet<String>>,
    /// Externally registered native modules, keyed by import spec (e.g.
    /// `"cargo:tish_pg"`). Populated by embedders before `run` (see
    /// [`register_native_module`]). Phase-2 item 11: unblocks `cargo:`
    /// imports on the cranelift and llvm backends which run this VM.
    native_modules: VmRef<HashMap<String, VmRef<ObjectMap>>>,
}

/// A bytecode-VM closure: a compiled chunk plus its captured lexical chain and shared VM state.
/// Implements [`tishlang_core::Callable`] so it lives in `Value::Function` like any callable, but
/// the `Call` opcode can `as_any`-downcast to it to run the call on the VM's explicit frame stack
/// (the frame-VM, task #39) instead of recursively re-entering `run_chunk`. `call()` is the
/// fallback path (builtin callbacks, and any not-yet-framed call) — byte-identical to the former
/// inline `Value::native` closure, so building these instead of raw closures changes nothing on
/// its own; the behavioural win comes when `Call` starts using the downcast + frame stack.
/// Try the array-mode JIT for `nf` (`array_param_mask != 0`). Splits `args` into numeric `f64`s and
/// flat [`crate::jit::ArrayHandle`]s — extracting all-numeric `Value::Array`s into scratch `Vec<f64>`s
/// that outlive the call. Returns `None` (caller falls back to the interpreter, so behaviour is always
/// correct) when an array arg is not an all-numeric `Value::Array` (covers `NumberArray`, whose
/// NaN-hole semantics differ), a numeric arg isn't a `Number`, or the JIT signals an OOB deopt.
#[cfg(not(target_arch = "wasm32"))]
fn try_call_array_jit(
    nf: &crate::jit::NumericFn,
    args: &[Value],
    arity: usize,
    mask: u8,
) -> Option<Value> {
    let mut numeric: Vec<f64> = Vec::with_capacity(arity);
    // `scratch` OWNS the extracted f64 data; handles point into it. Build handles only AFTER scratch is
    // fully populated so its backing buffers never reallocate out from under a live pointer.
    let mut scratch: Vec<Vec<f64>> = Vec::new();
    #[allow(clippy::needless_range_loop)] // `i` drives bit-mask math (`mask >> i`), not just indexing
    for i in 0..arity {
        if (mask >> i) & 1 == 1 {
            match &args[i] {
                Value::Array(a) => {
                    let b = a.borrow();
                    let mut buf: Vec<f64> = Vec::with_capacity(b.len());
                    for el in b.iter() {
                        match el {
                            Value::Number(n) => buf.push(*n),
                            _ => return None, // non-numeric element → interpreter
                        }
                    }
                    scratch.push(buf);
                }
                _ => return None, // NumberArray / non-array → interpreter
            }
        } else {
            match &args[i] {
                Value::Number(n) => numeric.push(*n),
                _ => return None,
            }
        }
    }
    let handles: Vec<crate::jit::ArrayHandle> = scratch
        .iter()
        .map(|buf| crate::jit::ArrayHandle {
            ptr: buf.as_ptr(),
            len: buf.len(),
        })
        .collect();
    let (res, deopt) = nf.call_arrays(&numeric, &handles);
    if deopt {
        return None; // OOB access → re-run interpreter (OOB reads coerce as Value::Null)
    }
    Some(Value::Number(res))
}

struct VmClosure {
    chunk: Arc<Chunk>,
    /// Whether this closure can run on the frame stack — computed ONCE at creation (eligibility is an
    /// O(chunk) bytecode scan; doing it per call regressed perf). `true` iff the chunk is frame-eligible
    /// and there is no numeric JIT for it.
    frameable: bool,
    #[cfg(not(target_arch = "wasm32"))]
    jit_fn: Option<crate::jit::NumericFn>,
    enclosing: SharedChain,
    globals: VmRef<ObjectMap>,
    capabilities: Arc<HashSet<String>>,
    native_modules: VmRef<HashMap<String, VmRef<ObjectMap>>>,
}

impl tishlang_core::Callable for VmClosure {
    fn call(&self, args: &[Value]) -> Value {
        #[cfg(not(target_arch = "wasm32"))]
        {
            if let Some(nf) = self.jit_fn {
                let arity = nf.arity();
                if args.len() >= arity {
                    let mask = nf.array_param_mask();
                    if mask == 0 {
                        // Pure-numeric register-f64 path.
                        let mut nums = [0f64; 8];
                        let mut all_numbers = true;
                        for i in 0..arity {
                            if let Value::Number(n) = &args[i] {
                                nums[i] = *n;
                            } else {
                                all_numbers = false;
                                break;
                            }
                        }
                        if all_numbers {
                            let res = nf.call(&nums[..arity]);
                            return if nf.result_is_bool() {
                                Value::Bool(res != 0.0)
                            } else {
                                Value::Number(res)
                            };
                        }
                    } else if let Some(v) = try_call_array_jit(&nf, args, arity, mask) {
                        // Array-mode path: succeeded (all-numeric arrays, in-bounds). On any bail
                        // (non-numeric element, NumberArray, OOB deopt) this returns None and we fall
                        // through to the interpreter — so behaviour is always correct.
                        return v;
                    }
                }
            }
        }
        let mut vm = Vm {
            stack: Vec::new(),
            scope: ObjectMap::default(),
            enclosing: self.enclosing.clone(),
            globals: self.globals.clone(),
            capabilities: Arc::clone(&self.capabilities),
            native_modules: self.native_modules.clone(),
        };
        #[cfg(not(target_arch = "wasm32"))]
        {
            stacker::maybe_grow(128 * 1024, 2 * 1024 * 1024, || {
                vm.run_chunk(self.chunk.as_ref(), &self.chunk.nested, args, false)
                    .unwrap_or(Value::Null)
            })
        }
        #[cfg(target_arch = "wasm32")]
        {
            vm.run_chunk(&self.chunk, &self.chunk.nested, args, false)
                .unwrap_or(Value::Null)
        }
    }
    fn as_any(&self) -> &dyn std::any::Any {
        self
    }
}

impl Vm {
    /// VM with every capability that exists in this `tishlang_vm` build (embedders, tests, `run()`).
    pub fn new() -> Self {
        Self::with_capabilities_arc(Arc::new(all_compiled_capabilities()))
    }

    /// VM with an explicit capability set (e.g. from `tish run --feature …`).
    pub fn with_capabilities(capabilities: HashSet<String>) -> Self {
        Self::with_capabilities_arc(Arc::new(capabilities))
    }

    fn with_capabilities_arc(capabilities: Arc<HashSet<String>>) -> Self {
        Self {
            stack: Vec::new(),
            scope: ObjectMap::default(),
            enclosing: SharedChain::new(Vec::new()),
            globals: VmRef::new(init_globals(capabilities.as_ref())),
            capabilities,
            native_modules: VmRef::new(HashMap::new()),
        }
    }

    /// Register an externally-supplied native module under a `cargo:`-style
    /// spec (e.g. `"cargo:tish_pg"`). The `exports` map is what
    /// `LoadNativeExport` will index into when user code imports from this
    /// spec. Intended to be called by the `tishlang_cranelift_runtime` /
    /// `tishlang_llvm` link step, or by external embedders that want to
    /// expose Rust crates to `.tish` programs running on the bytecode VM.
    pub fn register_native_module(&mut self, spec: impl Into<String>, exports: ObjectMap) {
        self.native_modules
            .borrow_mut()
            .insert(spec.into(), VmRef::new(exports));
    }

    pub fn get_global(&self, name: &str) -> Option<Value> {
        self.globals.borrow().get(name).cloned()
    }

    pub fn set_global(&mut self, name: Arc<str>, value: Value) {
        self.globals.borrow_mut().insert(name, value);
    }

    /// Names of all globals (for REPL bare-word tab completion).
    pub fn global_names(&self) -> Vec<String> {
        self.globals
            .borrow()
            .keys()
            .map(|k| k.as_ref().to_string())
            .collect()
    }

    fn read_u16(code: &[u8], ip: &mut usize) -> u16 {
        let a = code[*ip] as u16;
        let b = code[*ip + 1] as u16;
        *ip += 2;
        (a << 8) | b
    }

    fn read_i16(code: &[u8], ip: &mut usize) -> i16 {
        Self::read_u16(code, ip) as i16
    }

    /// Pop innermost try handler, truncate stack, push thrown value, jump to catch.
    fn unwind_throw(
        try_handlers: &mut Vec<(usize, usize)>,
        stack: &mut Vec<Value>,
        ip: &mut usize,
        v: Value,
    ) -> Result<(), String> {
        let (catch_ip, stack_len) = try_handlers
            .pop()
            .ok_or_else(|| format!("Uncaught throw: {}", v.to_display_string()))?;
        stack.truncate(stack_len);
        stack.push(v);
        *ip = catch_ip;
        Ok(())
    }

    pub fn run(&mut self, chunk: &Chunk) -> Result<Value, String> {
        self.run_with_options(chunk, false)
    }

    /// Run a chunk using this VM's capability set. `repl_mode` persists top-level `let` across REPL lines.
    pub fn run_with_options(&mut self, chunk: &Chunk, repl_mode: bool) -> Result<Value, String> {
        let result = self.run_chunk(chunk, &chunk.nested, &[], repl_mode);
        // A throw that escaped every `catch` reaches here as the pending-throw sentinel; turn the
        // parked value into the conventional uncaught-error message (issue #60).
        if let Err(e) = &result {
            if e == PENDING_THROW_SENTINEL {
                let v = take_pending_throw().unwrap_or(Value::Null);
                return Err(format!("Uncaught {}", v.to_display_string()));
            }
        }
        result
    }

    /// Whether the experimental frame-VM path is on (`TISH_FRAME_VM=1`). Flag-off (default) is
    /// byte-identical to the recursive `run_chunk` model — every `Value::Function` call goes through
    /// `VmClosure::call` exactly as before.
    #[inline]
    fn frame_vm_enabled() -> bool {
        // Read the env var ONCE and cache it. This is checked on the hot path (every Call opcode +
        // every closure creation), so a per-call `std::env::var` (a lock + String alloc) is a severe
        // regression to the DEFAULT path — caching makes the flag-off check a single atomic load.
        use std::sync::OnceLock;
        static ENABLED: OnceLock<bool> = OnceLock::new();
        *ENABLED.get_or_init(|| std::env::var("TISH_FRAME_VM").map(|v| v == "1").unwrap_or(false))
    }

    /// A `VmClosure` runs on the frame stack iff its chunk is frame-eligible AND it has no numeric
    /// JIT (jit'd functions stay on the faster native path via `VmClosure::call`; the frame loop's
    /// niche is non-jit'd call-heavy / mutually-recursive functions + wasi where there is no JIT).
    fn vmclosure_frameable(vc: &VmClosure) -> bool {
        vc.frameable
    }

    /// A chunk is frame-eligible iff slot-based and every opcode is one `run_framed` handles.
    /// `LoadConst` of a nested `Closure` is excluded (closure creation needs the full `run_chunk`).
    fn chunk_frame_eligible(chunk: &Chunk) -> bool {
        if !chunk.slot_based {
            return false;
        }
        let code = &chunk.code;
        let mut ip = 0usize;
        while ip < code.len() {
            let op = match Opcode::from_u8(code[ip]) {
                Some(o) => o,
                None => return false,
            };
            match op {
                Opcode::Nop
                | Opcode::LoadLocal
                | Opcode::StoreLocal
                | Opcode::LoadVar
                | Opcode::BinOp
                | Opcode::Jump
                | Opcode::JumpIfFalse
                | Opcode::JumpBack
                | Opcode::Pop
                | Opcode::Call
                | Opcode::SelfCall
                | Opcode::Return => {}
                Opcode::LoadConst => {
                    let idx = (((*code.get(ip + 1).unwrap_or(&0)) as usize) << 8)
                        | ((*code.get(ip + 2).unwrap_or(&0)) as usize);
                    if matches!(chunk.constants.get(idx), Some(Constant::Closure(_))) {
                        return false;
                    }
                }
                _ => return false,
            }
            ip += match op.instruction_size(code, ip) {
                Some(s) => s,
                None => return false,
            };
        }
        true
    }

    /// Iterative frame-stack execution of a frame-eligible `VmClosure` (the frame-VM, flag-on).
    /// Returns `None` if the entry chunk is ineligible (caller falls back to `VmClosure::call`).
    /// Calls + recursion run on the heap `frames` stack — no per-call `Vm`, no recursive `run_chunk`
    /// re-entry, so deep + mutual recursion can't overflow and it works on wasi (no JIT there).
    fn run_framed(&mut self, top: &VmClosure, args: &[Value]) -> Option<Result<Value, String>> {
        if !Self::vmclosure_frameable(top) {
            return None;
        }
        let mut cur: Arc<Chunk> = top.chunk.clone();
        let mut enclosing: SharedChain = top.enclosing.clone();
        let mut ip: usize = 0;
        let mut stack_base: usize = self.stack.len();
        // Slot-region pooling: ALL frames' locals share one `slots` Vec; each frame occupies
        // `slots[slot_base .. slot_base + num_slots]`. A call does `resize` (amortized, no per-call
        // heap alloc — unlike `run_chunk` which `vec!`s a fresh `slot_locals` every call); a return
        // does `truncate`. This is what makes the frame loop cheaper than the recursive path.
        let mut slots: Vec<Value> = Vec::new();
        let mut slot_base: usize = 0;
        slots.resize(cur.num_slots as usize, Value::Null);
        for i in 0..(cur.param_count as usize) {
            if let Some(v) = args.get(i) {
                if let Some(d) = slots.get_mut(slot_base + i) {
                    *d = v.clone();
                }
            }
        }
        // Suspended callers: (chunk, return ip, caller slot_base, caller stack_base, enclosing).
        let mut frames: Vec<(Arc<Chunk>, usize, usize, usize, SharedChain)> = Vec::new();

        macro_rules! ferr {
            ($($t:tt)*) => {
                return Some(Err(format!($($t)*)))
            };
        }
        macro_rules! fpop {
            () => {
                match self.stack.pop() {
                    Some(v) => v,
                    None => ferr!("Stack underflow in run_framed"),
                }
            };
        }

        // SAFETY: `code` aliases the current frame's chunk bytecode. The chunk is kept alive by `cur`
        // (and suspended-frame chunks by `frames`), so the slice stays valid for as long as we read
        // it; it is re-derived via `rebind_code!()` after every frame switch (Call/Return/end).
        // Laundering the borrow lets the hot opcode path index `code[ip]` directly with no per-opcode
        // Arc deref — matching run_chunk (the per-opcode Arc deref was a measured ~10% shallow-call regression).
        let mut code: &[u8] = unsafe { &*(cur.code.as_slice() as *const [u8]) };

        loop {
            if ip >= code.len() {
                self.stack.truncate(stack_base);
                slots.truncate(slot_base);
                match frames.pop() {
                    Some((c, rip, sbase, sb, enc)) => {
                        cur = c;
                        ip = rip;
                        slot_base = sbase;
                        stack_base = sb;
                        enclosing = enc;
                        code = unsafe { &*(cur.code.as_slice() as *const [u8]) };
                        self.stack.push(Value::Null);
                        continue;
                    }
                    None => return Some(Ok(Value::Null)),
                }
            }
            let op = match Opcode::from_u8(code[ip]) {
                Some(o) => o,
                None => ferr!("Bad opcode {} in run_framed", code[ip]),
            };
            ip += 1;
            match op {
                Opcode::Nop => {}
                Opcode::LoadLocal => {
                    let slot = Self::read_u16(code, &mut ip) as usize;
                    match slots.get(slot_base + slot) {
                        Some(v) => self.stack.push(v.clone()),
                        None => ferr!("Local slot out of bounds: {}", slot),
                    }
                }
                Opcode::StoreLocal => {
                    let slot = Self::read_u16(code, &mut ip) as usize;
                    let v = fpop!();
                    match slots.get_mut(slot_base + slot) {
                        Some(d) => *d = v,
                        None => ferr!("Local slot out of bounds: {}", slot),
                    }
                }
                Opcode::LoadConst => {
                    let idx = Self::read_u16(code, &mut ip) as usize;
                    let v = match cur.constants.get(idx) {
                        Some(Constant::Number(n)) => Value::Number(*n),
                        Some(Constant::String(s)) => Value::String(tishlang_core::ArcStr::from(s.as_ref())),
                        Some(Constant::Bool(b)) => Value::Bool(*b),
                        Some(Constant::Null) => Value::Null,
                        _ => ferr!("Ineligible constant {} in run_framed", idx),
                    };
                    self.stack.push(v);
                }
                Opcode::LoadVar => {
                    let idx = Self::read_u16(code, &mut ip) as usize;
                    let name = match cur.names.get(idx) {
                        Some(n) => n.clone(),
                        None => ferr!("Name index out of bounds: {}", idx),
                    };
                    let v = enclosing
                        .iter()
                        .find_map(|e| e.borrow().get(name.as_ref()).cloned())
                        .or_else(|| self.scope.get(name.as_ref()).cloned())
                        .or_else(|| self.globals.borrow().get(name.as_ref()).cloned());
                    match v {
                        Some(v) => self.stack.push(v),
                        None => ferr!("Undefined variable: {}", name),
                    }
                }
                Opcode::BinOp => {
                    let op_u8 = Self::read_u16(code, &mut ip) as u8;
                    let r = fpop!();
                    let l = fpop!();
                    let bop = match u8_to_binop(op_u8) {
                        Some(b) => b,
                        None => ferr!("Unknown binop: {}", op_u8),
                    };
                    match eval_binop(bop, &l, &r) {
                        Ok(res) => self.stack.push(res),
                        Err(e) => return Some(Err(e)),
                    }
                }
                Opcode::Jump => {
                    let offset = Self::read_i16(code, &mut ip) as isize;
                    ip = (ip as isize + offset).max(0) as usize;
                }
                Opcode::JumpIfFalse => {
                    let offset = Self::read_i16(code, &mut ip) as isize;
                    let v = fpop!();
                    if !v.is_truthy() {
                        ip = (ip as isize + offset).max(0) as usize;
                    }
                }
                Opcode::JumpBack => {
                    let dist = Self::read_u16(code, &mut ip) as usize;
                    ip = ip.saturating_sub(dist);
                }
                Opcode::Pop => {
                    let _ = fpop!();
                }
                Opcode::SelfCall => {
                    let argc = Self::read_u16(code, &mut ip) as usize;
                    let mut call_args = Vec::with_capacity(argc);
                    for _ in 0..argc {
                        call_args.push(fpop!());
                    }
                    call_args.reverse();
                    frames.push((cur.clone(), ip, slot_base, stack_base, enclosing.clone()));
                    let new_base = slots.len();
                    slots.resize(new_base + cur.num_slots as usize, Value::Null);
                    slot_base = new_base;
                    ip = 0;
                    stack_base = self.stack.len();
                    for i in 0..(cur.param_count as usize) {
                        if let Some(v) = call_args.get(i) {
                            if let Some(d) = slots.get_mut(slot_base + i) {
                                *d = v.clone();
                            }
                        }
                    }
                }
                Opcode::Call => {
                    let argc = Self::read_u16(code, &mut ip) as usize;
                    let mut call_args = Vec::with_capacity(argc);
                    for _ in 0..argc {
                        call_args.push(fpop!());
                    }
                    call_args.reverse();
                    let callee = fpop!();
                    match &callee {
                        Value::Function(f) => {
                            let framed = f
                                .as_any()
                                .downcast_ref::<VmClosure>()
                                .filter(|vc| Self::vmclosure_frameable(vc));
                            if let Some(vc) = framed {
                                let next_chunk = vc.chunk.clone();
                                let next_enc = vc.enclosing.clone();
                                // Move (not clone) the caller's chunk+chain into the frame; the Arc
                                // refcounts are unchanged (the chunk heap data doesn't move, so the
                                // laundered `code` ptr stays valid until rebind below). Halves the
                                // per-call Arc traffic vs cloning for the push.
                                frames.push((cur, ip, slot_base, stack_base, enclosing));
                                cur = next_chunk;
                                enclosing = next_enc;
                                code = unsafe { &*(cur.code.as_slice() as *const [u8]) };
                                let new_base = slots.len();
                                slots.resize(new_base + cur.num_slots as usize, Value::Null);
                                slot_base = new_base;
                                ip = 0;
                                stack_base = self.stack.len();
                                for i in 0..(cur.param_count as usize) {
                                    if let Some(v) = call_args.get(i) {
                                        if let Some(d) = slots.get_mut(slot_base + i) {
                                            *d = v.clone();
                                        }
                                    }
                                }
                            } else {
                                let r = f.call(&call_args);
                                // A throw escaping the callee can't be caught here (frameable
                                // chunks have no `try`); bubble it to an enclosing frame (#60).
                                if pending_throw_is_set() {
                                    return Some(Err(PENDING_THROW_SENTINEL.to_string()));
                                }
                                self.stack.push(r);
                            }
                        }
                        Value::Object(o) => {
                            let cf = match o.borrow().strings.get("__call") {
                                Some(Value::Function(cf)) => cf.clone(),
                                _ => ferr!("Call of non-function: {}", callee.type_name()),
                            };
                            let r = cf.call(&call_args);
                            if pending_throw_is_set() {
                                return Some(Err(PENDING_THROW_SENTINEL.to_string()));
                            }
                            self.stack.push(r);
                        }
                        _ => ferr!("Call of non-function: {}", callee.type_name()),
                    }
                }
                Opcode::Return => {
                    let result = self.stack.pop().unwrap_or(Value::Null);
                    self.stack.truncate(stack_base);
                    slots.truncate(slot_base);
                    match frames.pop() {
                        Some((c, rip, sbase, sb, enc)) => {
                            cur = c;
                            ip = rip;
                            slot_base = sbase;
                            stack_base = sb;
                            enclosing = enc;
                            code = unsafe { &*(cur.code.as_slice() as *const [u8]) };
                            self.stack.push(result);
                        }
                        None => return Some(Ok(result)),
                    }
                }
                other => ferr!("Unhandled opcode {:?} in run_framed", other),
            }
        }
    }

    fn run_chunk(
        &mut self,
        chunk: &Chunk,
        nested: &[Chunk],
        args: &[Value],
        repl_mode: bool,
    ) -> Result<Value, String> {
        let code = &chunk.code;
        let constants = &chunk.constants;
        let names = &chunk.names;

        let mut ip = 0;
        // Lazily allocated name-keyed scope. Slot-based chunks never WRITE it (params + body locals
        // live in `slot_locals`; `StoreVar` checks-then-falls-through to globals; a slot-based chunk
        // has no captured locals by construction), so on the hot slot-based call path we skip the
        // `VmRef::new(Arc<Mutex<HashMap>>)` box entirely. Non-slot chunks need it eagerly for params.
        // `ls_get_or_init!()` lazily creates it on the first write/capture; reads treat `None` as empty.
        let mut local_scope: Option<ScopeMap> = if chunk.slot_based {
            None
        } else {
            Some(VmRef::new(ObjectMap::default()))
        };
        macro_rules! ls_get_or_init {
            () => {{
                local_scope.get_or_insert_with(|| VmRef::new(ObjectMap::default()))
            }};
        }
        // Slot-based chunks (self-contained functions) use a bare `Vec<Value>`
        // frame indexed by slot — no per-call hashmap, no name lookups. Args bind
        // to slots 0..param_count. Empty for name-based chunks.
        let mut slot_locals: Vec<Value> = Vec::new();
        if chunk.slot_based {
            slot_locals = vec![Value::Null; chunk.num_slots as usize];
            let param_count = chunk.param_count as usize;
            for i in 0..param_count {
                if let Some(v) = args.get(i) {
                    if let Some(dst) = slot_locals.get_mut(i) {
                        *dst = v.clone();
                    }
                }
            }
        } else {
            let mut ls = ls_get_or_init!().borrow_mut();
            let param_count = chunk.param_count as usize;
            if chunk.rest_param_index != NO_REST_PARAM {
                let ri = chunk.rest_param_index as usize;
                for (i, name) in chunk.names.iter().take(param_count).enumerate() {
                    if i < ri {
                        let v = args.get(i).cloned().unwrap_or(Value::Null);
                        ls.insert(Arc::clone(name), v);
                    } else if i == ri {
                        let rest_arr: Vec<Value> = args.iter().skip(ri).cloned().collect();
                        ls.insert(Arc::clone(name), Value::Array(VmRef::new(rest_arr)));
                    }
                }
            } else {
                for (i, name) in chunk.names.iter().take(param_count).enumerate() {
                    if let Some(v) = args.get(i) {
                        ls.insert(Arc::clone(name), v.clone());
                    }
                }
            }
        }
        let mut try_handlers: Vec<(usize, usize)> = vec![];
        let mut block_undo_stack: Vec<Vec<(Arc<str>, Option<Value>)>> = vec![];
        // Names of loop variables currently in a per-iteration binding region (ES `let` semantics).
        // A closure created while this is non-empty snapshots these into a fresh overlay so it
        // captures the loop variable's value for THIS iteration. Pushed/popped by LoopVarsBegin/End.
        let mut active_loop_vars: Vec<Arc<str>> = Vec::new();
        // Offset of the instruction currently executing — updated each iteration, read by the
        // error macros to attach a source location (issue #74). Declared here (not in the loop)
        // so it's in scope where `catchable!` is defined (macro hygiene).
        let mut instr_off = 0usize;

        // Throw `$v` to the nearest enclosing handler (issue #60): if this frame has a live
        // `try`, jump to its `catch` with `$v` on the stack; otherwise park `$v` in the
        // thread-local and bubble the sentinel so an enclosing frame's catch can take it.
        macro_rules! raise {
            ($v:expr) => {{
                let __thrown = $v;
                if let Some((catch_ip, stack_len)) = try_handlers.pop() {
                    self.stack.truncate(stack_len);
                    self.stack.push(__thrown);
                    ip = catch_ip;
                    continue;
                } else {
                    set_pending_throw(__thrown);
                    return Err(PENDING_THROW_SENTINEL.to_string());
                }
            }};
        }
        // Evaluate a fallible, JS-throwable opcode helper: on `Err(msg)` the message becomes a
        // catchable `TypeError` (`x.foo()` on null, calling a non-function, …) routed through
        // `raise!` instead of aborting the whole VM.
        macro_rules! catchable {
            ($expr:expr) => {
                match $expr {
                    Ok(v) => v,
                    Err(msg) => raise!(construct_builtin::error_object(
                        "TypeError",
                        &locate_error(chunk, instr_off, &msg)
                    )),
                }
            };
        }

        loop {
            if ip >= code.len() {
                break;
            }
            // Offset of the instruction about to execute (read by the error macros, #74).
            instr_off = ip;
            let op = code[ip];
            ip += 1;
            if op == Opcode::Nop as u8 {
                continue;
            }
            let opcode = Opcode::from_u8(op).ok_or_else(|| format!("Unknown opcode: {}", op))?;

            match opcode {
                Opcode::Nop => {}
                Opcode::LoadLocal => {
                    let slot = Self::read_u16(code, &mut ip) as usize;
                    let v = slot_locals
                        .get(slot)
                        .cloned()
                        .ok_or_else(|| format!("Local slot out of bounds: {}", slot))?;
                    self.stack.push(v);
                }
                Opcode::StoreLocal => {
                    let slot = Self::read_u16(code, &mut ip) as usize;
                    let v = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow in StoreLocal".to_string())?;
                    match slot_locals.get_mut(slot) {
                        Some(dst) => *dst = v,
                        None => return Err(format!("Local slot out of bounds: {}", slot)),
                    }
                }
                Opcode::LoadUpvalue | Opcode::StoreUpvalue => {
                    // Reserved for the linked-frame upvalue model (not emitted yet).
                    return Err("Upvalue opcodes not supported in this VM build".to_string());
                }
                Opcode::LoadConst => {
                    let idx = Self::read_u16(code, &mut ip);
                    let c = constants
                        .get(idx as usize)
                        .ok_or_else(|| format!("Constant index out of bounds: {}", idx))?;
                    let v = match c {
                        Constant::Number(n) => Value::Number(*n),
                        Constant::String(s) => Value::String(tishlang_core::ArcStr::from(s.as_ref())),
                        Constant::Bool(b) => Value::Bool(*b),
                        Constant::Null => Value::Null,
                        Constant::Closure(nested_idx) => {
                            let inner = nested
                                .get(*nested_idx)
                                .ok_or_else(|| "Nested chunk index out of bounds".to_string())?;
                            // Numeric JIT fast path (native codegen, non-wasm): if this is a
                            // straight-line numeric function, compile it once (cached per chunk)
                            // and call native code when all args are numbers; else fall back to
                            // the interpreter below. Purely additive — can't change behaviour.
                            #[cfg(not(target_arch = "wasm32"))]
                            let jit_fn = crate::jit::try_compile_numeric(inner);
                            let inner_clone = inner.clone();
                            let globals = self.globals.clone();
                            // The closure captures its defining frame's scope PLUS that frame's own
                            // enclosing chain, so functions nested arbitrarily deep still resolve
                            // every ancestor's locals (innermost first).
                            // A closure must capture a real scope (even if empty) so that, post-creation,
                            // the parent's name-based locals are visible. Materialise local_scope here.
                            let captured_scope: ScopeMap = ls_get_or_init!().clone();
                            let enclosing_chain: SharedChain = SharedChain::new(if active_loop_vars.is_empty() {
                                let mut chain = Vec::with_capacity(self.enclosing.len() + 1);
                                chain.push(captured_scope.clone());
                                chain.extend(self.enclosing.iter().cloned());
                                chain
                            } else {
                                // Per-iteration `let`: freeze the loop var(s) into an overlay that
                                // shadows the still-shared frame scope, then the inherited chain.
                                let mut overlay = ObjectMap::default();
                                {
                                    let ls = captured_scope.borrow();
                                    for n in &active_loop_vars {
                                        if let Some(v) = ls.get(n.as_ref()) {
                                            overlay.insert(Arc::clone(n), v.clone());
                                        }
                                    }
                                }
                                let mut chain = Vec::with_capacity(self.enclosing.len() + 2);
                                chain.push(VmRef::new(overlay));
                                chain.push(captured_scope.clone());
                                chain.extend(self.enclosing.iter().cloned());
                                chain
                            });
                            let capabilities = Arc::clone(&self.capabilities);
                            let native_modules = self.native_modules.clone();
                            // Frame-eligibility is an O(chunk) bytecode scan; gate it behind the
                            // (cached) frame-VM flag so the DEFAULT path skips it entirely — flag-off
                            // closure creation pays nothing.
                            let frameable = Vm::frame_vm_enabled()
                                && {
                                    #[cfg(not(target_arch = "wasm32"))]
                                    {
                                        jit_fn.is_none() && Vm::chunk_frame_eligible(&inner_clone)
                                    }
                                    #[cfg(target_arch = "wasm32")]
                                    {
                                        Vm::chunk_frame_eligible(&inner_clone)
                                    }
                                };
                            let vmclosure = VmClosure {
                                chunk: std::sync::Arc::new(inner_clone),
                                frameable,
                                #[cfg(not(target_arch = "wasm32"))]
                                jit_fn,
                                enclosing: enclosing_chain,
                                globals,
                                capabilities,
                                native_modules,
                            };
                            #[cfg(feature = "send-values")]
                            {
                                Value::Function(std::sync::Arc::new(vmclosure))
                            }
                            #[cfg(not(feature = "send-values"))]
                            {
                                Value::Function(std::rc::Rc::new(vmclosure))
                            }
                        }
                    };
                    self.stack.push(v);
                }
                Opcode::LoadVar => {
                    let idx = Self::read_u16(code, &mut ip);
                    let name = names
                        .get(idx as usize)
                        .ok_or_else(|| format!("Name index out of bounds: {}", idx))?;
                    let v = local_scope
                        .as_ref()
                        .and_then(|ls| ls.borrow().get(name.as_ref()).cloned())
                        .or_else(|| {
                            // Walk the captured lexical chain, innermost first.
                            self.enclosing
                                .iter()
                                .find_map(|e| e.borrow().get(name.as_ref()).cloned())
                        })
                        .or_else(|| self.scope.get(name.as_ref()).cloned())
                        .or_else(|| self.globals.borrow().get(name.as_ref()).cloned())
                        .ok_or_else(|| format!("Undefined variable: {}", name))?;
                    self.stack.push(v);
                }
                Opcode::StoreVar => {
                    let idx = Self::read_u16(code, &mut ip);
                    let name = names
                        .get(idx as usize)
                        .ok_or_else(|| format!("Name index out of bounds: {}", idx))?;
                    let v = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    // Update innermost scope that has the variable (matches interpreter Scope.assign)
                    if local_scope.as_ref().is_some_and(|ls| ls.borrow().contains_key(name.as_ref())) {
                        ls_get_or_init!().borrow_mut().insert(Arc::clone(name), v);
                    } else if let Some(e) = self
                        .enclosing
                        .iter()
                        .find(|e| e.borrow().contains_key(name.as_ref()))
                    {
                        // Innermost captured scope that already binds the name (matches the
                        // interpreter's Scope.assign walking the lexical chain).
                        e.borrow_mut().insert(Arc::clone(name), v);
                    } else if self.scope.contains_key(name.as_ref()) {
                        self.scope.insert(Arc::clone(name), v);
                    } else if self.globals.borrow().contains_key(name.as_ref()) {
                        self.globals.borrow_mut().insert(Arc::clone(name), v);
                    } else {
                        // New variable: at top level (no enclosing) store in globals so REPL persists across lines
                        if self.enclosing.is_empty() {
                            self.globals.borrow_mut().insert(Arc::clone(name), v);
                        } else {
                            ls_get_or_init!().borrow_mut().insert(Arc::clone(name), v);
                        }
                    }
                }
                Opcode::DeclareVar => {
                    let idx = Self::read_u16(code, &mut ip);
                    let name = names
                        .get(idx as usize)
                        .ok_or_else(|| format!("Name index out of bounds: {}", idx))?;
                    let v = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    if let Some(frame) = block_undo_stack.last_mut() {
                        let old = local_scope
                            .as_ref()
                            .and_then(|ls| ls.borrow().get(name.as_ref()).cloned());
                        frame.push((Arc::clone(name), old));
                    }
                    // REPL: persist top-level bindings only (not block-locals shadowing globals).
                    if repl_mode && self.enclosing.is_empty() && block_undo_stack.is_empty() {
                        self.globals
                            .borrow_mut()
                            .insert(Arc::clone(name), v.clone());
                    }
                    ls_get_or_init!().borrow_mut().insert(Arc::clone(name), v);
                }
                Opcode::DeclareVarPlain => {
                    let idx = Self::read_u16(code, &mut ip);
                    let name = names
                        .get(idx as usize)
                        .ok_or_else(|| format!("Name index out of bounds: {}", idx))?;
                    let v = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    if repl_mode && self.enclosing.is_empty() && block_undo_stack.is_empty() {
                        self.globals
                            .borrow_mut()
                            .insert(Arc::clone(name), v.clone());
                    }
                    ls_get_or_init!().borrow_mut().insert(Arc::clone(name), v);
                }
                Opcode::EnterBlock => {
                    block_undo_stack.push(Vec::new());
                }
                Opcode::ExitBlock => {
                    let frame = block_undo_stack
                        .pop()
                        .ok_or_else(|| "ExitBlock without matching EnterBlock".to_string())?;
                    for (name, old) in frame.into_iter().rev() {
                        let mut ls = ls_get_or_init!().borrow_mut();
                        match old {
                            Some(prev) => {
                                ls.insert(name, prev);
                            }
                            None => {
                                ls.remove(name.as_ref());
                            }
                        }
                    }
                }
                Opcode::LoopVarsBegin => {
                    let idx = Self::read_u16(code, &mut ip);
                    let name = names
                        .get(idx as usize)
                        .ok_or_else(|| format!("Name index out of bounds: {}", idx))?;
                    active_loop_vars.push(Arc::clone(name));
                }
                Opcode::LoopVarsEnd => {
                    active_loop_vars.pop();
                }
                Opcode::ArgMissing => {
                    // True iff the positional arg at `idx` was not supplied → the function
                    // prologue applies the param's default. Matches the interpreter: an
                    // explicit `null` arg is "supplied" and keeps the `null`.
                    let idx = Self::read_u16(code, &mut ip) as usize;
                    self.stack.push(Value::Bool(idx >= args.len()));
                }
                Opcode::LoadGlobal => {
                    let idx = Self::read_u16(code, &mut ip);
                    let name = names
                        .get(idx as usize)
                        .ok_or_else(|| format!("Name index out of bounds: {}", idx))?;
                    let v = self
                        .globals
                        .borrow()
                        .get(name.as_ref())
                        .cloned()
                        .ok_or_else(|| format!("Undefined global: {}", name))?;
                    self.stack.push(v);
                }
                Opcode::StoreGlobal => {
                    let idx = Self::read_u16(code, &mut ip);
                    let name = names
                        .get(idx as usize)
                        .ok_or_else(|| format!("Name index out of bounds: {}", idx))?;
                    let v = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    self.globals.borrow_mut().insert(Arc::clone(name), v);
                }
                Opcode::Pop => {
                    self.stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                }
                Opcode::PopN => {
                    let n = Self::read_u16(code, &mut ip) as usize;
                    for _ in 0..n {
                        self.stack
                            .pop()
                            .ok_or_else(|| "Stack underflow".to_string())?;
                    }
                }
                Opcode::Dup => {
                    let v = self
                        .stack
                        .last()
                        .ok_or_else(|| "Stack underflow".to_string())?
                        .clone();
                    self.stack.push(v);
                }
                Opcode::IterNormalize => {
                    // `for…of`: turn a JS iterator object (callable `next()` → `{ value, done }`,
                    // e.g. a Map/Set `.values()` result) into an array so the index loop iterates
                    // it. Arrays/strings/everything else pass through unchanged.
                    let v = self
                        .stack
                        .last()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    if let Some(items) = tishlang_core::drain_iterator(v) {
                        self.stack.pop();
                        self.stack.push(Value::Array(VmRef::new(items)));
                    }
                }
                Opcode::Call => {
                    let argc = Self::read_u16(code, &mut ip) as usize;
                    let mut args = Vec::with_capacity(argc);
                    for _ in 0..argc {
                        args.push(
                            self.stack
                                .pop()
                                .ok_or_else(|| "Stack underflow in call".to_string())?,
                        );
                    }
                    args.reverse();
                    let callee = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow: no callee".to_string())?;
                    // Call the function in place — no `Arc` clone on the hot direct-call path. The
                    // immutable borrow of `callee` is held only across the call, which never touches it.
                    let result = match &callee {
                        Value::Function(f) => {
                            // Frame-VM (flag-on): a frameable VmClosure runs on the heap frame stack
                            // (iterative, no per-call Vm / native recursion). Else the normal path.
                            if Self::frame_vm_enabled() {
                                match f.as_any().downcast_ref::<VmClosure>() {
                                    Some(vc) if Self::vmclosure_frameable(vc) => {
                                        match self.run_framed(vc, &args) {
                                            // A pending throw is handled by the post-call check
                                            // below (issue #60); a real fatal error propagates.
                                            Some(Ok(v)) => v,
                                            Some(Err(e)) if e == PENDING_THROW_SENTINEL => {
                                                Value::Null
                                            }
                                            Some(Err(e)) => return Err(e),
                                            None => f.call(&args),
                                        }
                                    }
                                    _ => f.call(&args),
                                }
                            } else {
                                f.call(&args)
                            }
                        }
                        Value::Object(o) => {
                            let call_fn = match o.borrow().strings.get("__call") {
                                Some(Value::Function(cf)) => cf.clone(),
                                _ => raise!(construct_builtin::error_object(
                                    "TypeError",
                                    &format!("Call of non-function: {}", callee.type_name())
                                )),
                            };
                            call_fn.call(&args)
                        }
                        _ => raise!(construct_builtin::error_object(
                            "TypeError",
                            &format!("Call of non-function: {}", callee.type_name())
                        )),
                    };
                    // A throw that escaped the callee's own `catch` is parked in the thread-local;
                    // surface it here so this frame's `try` (if any) can catch it (issue #60).
                    if let Some(v) = take_pending_throw() {
                        raise!(v);
                    }
                    self.stack.push(result);
                }
                Opcode::SelfCall => {
                    // Direct recursive call to the CURRENT function (`chunk`). The compiler emits
                    // this only when the function's own name is provably stable, so the callee is
                    // implicitly `chunk` — no callee on the stack, no name lookup, no closure
                    // dispatch. Behaviour matches `LoadVar name; Call argc` (a closure call that
                    // swallows errors to Null), and uses the SAME captured `enclosing`.
                    let argc = Self::read_u16(code, &mut ip) as usize;
                    let mut args = Vec::with_capacity(argc);
                    for _ in 0..argc {
                        args.push(
                            self.stack
                                .pop()
                                .ok_or_else(|| "Stack underflow in self-call".to_string())?,
                        );
                    }
                    args.reverse();
                    let mut vm = Vm {
                        stack: Vec::new(),
                        scope: ObjectMap::default(),
                        enclosing: self.enclosing.clone(),
                        globals: self.globals.clone(),
                        capabilities: Arc::clone(&self.capabilities),
                        native_modules: self.native_modules.clone(),
                    };
                    #[cfg(not(target_arch = "wasm32"))]
                    let result = stacker::maybe_grow(128 * 1024, 2 * 1024 * 1024, || {
                        vm.run_chunk(chunk, nested, &args, false)
                            .unwrap_or(Value::Null)
                    });
                    #[cfg(target_arch = "wasm32")]
                    let result = vm.run_chunk(chunk, nested, &args, false).unwrap_or(Value::Null);
                    if let Some(v) = take_pending_throw() {
                        raise!(v);
                    }
                    self.stack.push(result);
                }
                Opcode::CallSpread => {
                    let callee = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow: no callee in CallSpread".to_string())?;
                    let args_array = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow in CallSpread".to_string())?;
                    // A lone iterator spread (`f(...m.values())`) — drain to an array.
                    let args_array = match tishlang_core::drain_iterator(&args_array) {
                        Some(items) => Value::Array(VmRef::new(items)),
                        None => args_array,
                    };
                    let args: Vec<Value> = match &args_array {
                        Value::Array(a) => a.borrow().clone(),
                        _ => {
                            return Err(format!(
                                "CallSpread: args must be array, got {}",
                                args_array.to_display_string()
                            ));
                        }
                    };
                    let f = match &callee {
                        Value::Function(f) => f.clone(),
                        Value::Object(o) => {
                            if let Some(Value::Function(call_fn)) =
                                o.borrow().strings.get("__call")
                            {
                                call_fn.clone()
                            } else {
                                return Err(format!(
                                    "Call of non-function: {}",
                                    callee.type_name()
                                ));
                            }
                        }
                        _ => {
                            return Err(format!("Call of non-function: {}", callee.type_name()));
                        }
                    };
                    let result = f.call(&args);
                    if let Some(v) = take_pending_throw() {
                        raise!(v);
                    }
                    self.stack.push(result);
                }
                Opcode::Construct => {
                    let argc = Self::read_u16(code, &mut ip) as usize;
                    let mut args = Vec::with_capacity(argc);
                    for _ in 0..argc {
                        args.push(
                            self.stack
                                .pop()
                                .ok_or_else(|| "Stack underflow in construct".to_string())?,
                        );
                    }
                    args.reverse();
                    let callee = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow: no callee for construct".to_string())?;
                    let result = construct_builtin::construct(&callee, &args);
                    if let Some(v) = take_pending_throw() {
                        raise!(v);
                    }
                    self.stack.push(result);
                }
                Opcode::ConstructSpread => {
                    let callee = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow: callee in ConstructSpread".to_string())?;
                    let args_array = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow in ConstructSpread".to_string())?;
                    // A lone iterator spread (`new X(...m.values())`) — drain to an array.
                    let args_array = match tishlang_core::drain_iterator(&args_array) {
                        Some(items) => Value::Array(VmRef::new(items)),
                        None => args_array,
                    };
                    let args: Vec<Value> = match &args_array {
                        Value::Array(a) => a.borrow().clone(),
                        _ => {
                            return Err(format!(
                                "ConstructSpread: args must be array, got {}",
                                args_array.to_display_string()
                            ));
                        }
                    };
                    let result = construct_builtin::construct(&callee, &args);
                    if let Some(v) = take_pending_throw() {
                        raise!(v);
                    }
                    self.stack.push(result);
                }
                Opcode::Return => {
                    let v = self.stack.pop().unwrap_or(Value::Null);
                    return Ok(v);
                }
                Opcode::Jump => {
                    let offset = Self::read_i16(code, &mut ip) as isize;
                    ip = (ip as isize + offset).max(0) as usize;
                }
                Opcode::JumpIfFalse => {
                    let offset = Self::read_i16(code, &mut ip) as isize;
                    let v = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    if !v.is_truthy() {
                        ip = (ip as isize + offset).max(0) as usize;
                    }
                }
                Opcode::JumpBack => {
                    let dist = Self::read_u16(code, &mut ip) as usize;
                    ip = ip.saturating_sub(dist);
                }
                Opcode::BinOp => {
                    let op_u8 = Self::read_u16(code, &mut ip) as u8;
                    let r = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    let l = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    let op =
                        u8_to_binop(op_u8).ok_or_else(|| format!("Unknown binop: {}", op_u8))?;
                    let result = eval_binop(op, &l, &r)?;
                    self.stack.push(result);
                }
                Opcode::UnaryOp => {
                    let op_u8 = Self::read_u16(code, &mut ip) as u8;
                    let o = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    let op = u8_to_unaryop(op_u8)
                        .ok_or_else(|| format!("Unknown unary op: {}", op_u8))?;
                    let result = eval_unary(op, &o)?;
                    self.stack.push(result);
                }
                Opcode::GetMember => {
                    let idx = Self::read_u16(code, &mut ip);
                    let key = names
                        .get(idx as usize)
                        .ok_or_else(|| "Name index out of bounds".to_string())?;
                    let obj = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    let v = catchable!(ic_get_member(chunk, idx, &obj, key));
                    self.stack.push(v);
                }
                Opcode::GetMemberOptional => {
                    let idx = Self::read_u16(code, &mut ip);
                    let key = names
                        .get(idx as usize)
                        .ok_or_else(|| "Name index out of bounds".to_string())?;
                    let obj = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    let v = ic_get_member(chunk, idx, &obj, key).unwrap_or(Value::Null);
                    self.stack.push(v);
                }
                Opcode::SetMember => {
                    let idx = Self::read_u16(code, &mut ip);
                    let key = names
                        .get(idx as usize)
                        .ok_or_else(|| "Name index out of bounds".to_string())?;
                    let val = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    let obj = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    catchable!(ic_set_member(chunk, idx, &obj, key, val.clone()));
                    self.stack.push(val); // assignment yields value
                }
                Opcode::GetIndex => {
                    let idx_val = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    let obj = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    let v = catchable!(get_index(&obj, &idx_val));
                    self.stack.push(v);
                }
                Opcode::SetIndex => {
                    // Stack: [obj, idx, val, val] (Dup of val for expression result).
                    // Pop val (dup), val, idx, obj; use (obj, idx, val) for set_index; leave val on stack.
                    let dup_val = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    let val = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    let idx_val = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    let obj = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    catchable!(set_index(&obj, &idx_val, val.clone()));
                    self.stack.push(dup_val); // assignment yields the assigned value
                }
                Opcode::DeleteIndex => {
                    // `delete obj[key]` / `delete obj.prop`: pop [obj, key], remove, push true.
                    let key = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    let obj = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    delete_index(&obj, &key);
                    self.stack.push(Value::Bool(true));
                }
                Opcode::NewArray => {
                    let n = Self::read_u16(code, &mut ip) as usize;
                    let mut elems = Vec::with_capacity(n);
                    for _ in 0..n {
                        elems.push(
                            self.stack
                                .pop()
                                .ok_or_else(|| "Stack underflow".to_string())?,
                        );
                    }
                    elems.reverse();
                    // Packed-array fast path: if every element is a number AND there is at
                    // least one element, store as Vec<f64>. Empty arrays stay as Value::Array
                    // because they are commonly used as general-purpose containers (the type
                    // can't be inferred from zero elements).
                    if Value::packed_arrays_enabled() && !elems.is_empty() {
                        if let Some(nums) = elems.iter().try_fold(
                            Vec::<f64>::with_capacity(elems.len()),
                            |mut acc, v| {
                                if let Value::Number(n) = v { acc.push(*n); Some(acc) }
                                else { None }
                            },
                        ) {
                            self.stack.push(Value::number_array(nums));
                        } else {
                            self.stack.push(Value::Array(VmRef::new(elems)));
                        }
                    } else {
                        self.stack.push(Value::Array(VmRef::new(elems)));
                    }
                }
                Opcode::NewObject => {
                    let n = Self::read_u16(code, &mut ip) as usize;
                    if self.stack.len() < 2 * n {
                        return Err("Stack underflow".to_string());
                    }
                    // Pairs sit on the stack in source order: key1,val1,…,keyN,valN. Read them
                    // in place into the PropMap (insertion order = JS order) and drop them in
                    // one truncate — no intermediate Vec per object literal (a hot path: every
                    // `{...}` and every HTTP JSON response).
                    let base = self.stack.len() - 2 * n;
                    let mut map = PropMap::with_capacity(n);
                    for i in 0..n {
                        let key_val =
                            std::mem::replace(&mut self.stack[base + 2 * i], Value::Null);
                        let val =
                            std::mem::replace(&mut self.stack[base + 2 * i + 1], Value::Null);
                        let key: Arc<str> = key_val.to_display_string().into();
                        map.insert(key, val);
                    }
                    self.stack.truncate(base);
                    self.stack.push(Value::Object(VmRef::new(ObjectData {
                        strings: map,
                        symbols: None,
                    })));
                }
                Opcode::EnterTry => {
                    let offset = Self::read_u16(code, &mut ip) as usize;
                    let catch_ip = ip + offset;
                    try_handlers.push((catch_ip, self.stack.len()));
                }
                Opcode::ExitTry => {
                    try_handlers.pop();
                }
                Opcode::ConcatArray => {
                    let right = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    let left = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    // Materialise NumberArray on either side before concatenation.
                    let left = left.coerce_number_array();
                    let right = right.coerce_number_array();
                    // Spread of a Map/Set iterator (`[...m.values()]`): drain to an array.
                    let left = match tishlang_core::drain_iterator(&left) {
                        Some(items) => Value::Array(VmRef::new(items)),
                        None => left,
                    };
                    let right = match tishlang_core::drain_iterator(&right) {
                        Some(items) => Value::Array(VmRef::new(items)),
                        None => right,
                    };
                    let (mut a, b) = (
                        match &left {
                            Value::Array(arr) => arr.borrow().clone(),
                            _ => {
                                return Err(format!(
                                    "ConcatArray: left must be array, got {}",
                                    left.to_display_string()
                                ));
                            }
                        },
                        match &right {
                            Value::Array(arr) => arr.borrow().clone(),
                            _ => {
                                return Err(format!(
                                    "ConcatArray: right must be array, got {}",
                                    right.to_display_string()
                                ));
                            }
                        },
                    );
                    a.extend(b);
                    self.stack.push(Value::Array(VmRef::new(a)));
                }
                Opcode::MergeObject => {
                    let right = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    let left = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    match (&left, &right) {
                        (Value::Object(l), Value::Object(r)) => {
                            let merged = merge_object_data(l, r);
                            self.stack.push(Value::Object(VmRef::new(merged)));
                        }
                        _ => {
                            return Err(format!(
                                "MergeObject: expected two objects, got {} and {}",
                                left.to_display_string(),
                                right.to_display_string()
                            ));
                        }
                    }
                }
                Opcode::ArraySortNumeric => {
                    let operand = Self::read_u16(code, &mut ip);
                    let asc = operand == 0;
                    let arr = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    let result = if asc {
                        arr_builtins::sort_numeric_asc(&arr)
                    } else {
                        arr_builtins::sort_numeric_desc(&arr)
                    };
                    self.stack.push(result);
                }
                Opcode::ArraySortByProperty => {
                    let prop_idx = Self::read_u16(code, &mut ip);
                    let asc = Self::read_u16(code, &mut ip) == 0;
                    let arr = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    let prop = constants
                        .get(prop_idx as usize)
                        .and_then(|c| {
                            if let Constant::String(s) = c {
                                Some(s.as_ref())
                            } else {
                                None
                            }
                        })
                        .unwrap_or("");
                    let result = arr_builtins::sort_by_property_numeric(&arr, prop, asc);
                    self.stack.push(result);
                }
                Opcode::ArrayMapIdentity => {
                    let arr = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    let result = match &arr {
                        Value::Array(a) => Value::Array(VmRef::new(a.borrow().clone())),
                        // Identity map on a NumberArray = clone the packed vec (stays packed).
                        Value::NumberArray(a) => Value::NumberArray(VmRef::new(a.borrow().clone())),
                        _ => Value::Null,
                    };
                    self.stack.push(result);
                }
                Opcode::ArrayMapBinOp => {
                    let binop_u8 = code[ip];
                    ip += 1;
                    let const_idx = Self::read_u16(code, &mut ip);
                    let param_left = code[ip] == 0; // 0 = param on left (x op const), 1 = param on right (const op x)
                    ip += 1;
                    let binop = u8_to_binop(binop_u8)
                        .ok_or_else(|| format!("Unknown binop in ArrayMapBinOp: {}", binop_u8))?;
                    let arr = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    let const_val = constants
                        .get(const_idx as usize)
                        .map(|c| c.to_value())
                        .unwrap_or(Value::Null);
                    let result = match &arr {
                        Value::NumberArray(a) => {
                            // All-numeric fast path: operate on raw f64, no boxing/unboxing.
                            let arr_borrow = a.borrow();
                            let mapped: Vec<Value> = arr_borrow
                                .iter()
                                .map(|&n| {
                                    let elem = Value::Number(n);
                                    let (l, r) = if param_left { (elem, const_val.clone()) } else { (const_val.clone(), elem) };
                                    eval_binop(binop, &l, &r).unwrap_or(Value::Null)
                                })
                                .collect();
                            // If every result is numeric, stay packed (the common case for x*2, x+1, etc).
                            if mapped.iter().all(|v| matches!(v, Value::Number(_))) {
                                Value::number_array(mapped.into_iter().map(|v| match v { Value::Number(n) => n, _ => unreachable!() }).collect())
                            } else {
                                Value::Array(VmRef::new(mapped))
                            }
                        }
                        Value::Array(a) => {
                            let arr_borrow = a.borrow();
                            let mapped: Vec<Value> = arr_borrow
                                .iter()
                                .map(|v| {
                                    let l: Value = if param_left { (*v).clone() } else { const_val.clone() };
                                    let r: Value = if param_left { const_val.clone() } else { (*v).clone() };
                                    eval_binop(binop, &l, &r).unwrap_or(Value::Null)
                                })
                                .collect();
                            Value::Array(VmRef::new(mapped))
                        }
                        _ => Value::Null,
                    };
                    self.stack.push(result);
                }
                Opcode::ArrayFilterBinOp => {
                    let binop_u8 = code[ip];
                    ip += 1;
                    let const_idx = Self::read_u16(code, &mut ip);
                    let param_left = code[ip] == 0; // 0 = param on left (x op const), 1 = param on right (const op x)
                    ip += 1;
                    let binop = u8_to_binop(binop_u8).ok_or_else(|| {
                        format!("Unknown binop in ArrayFilterBinOp: {}", binop_u8)
                    })?;
                    let arr = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    let const_val = constants
                        .get(const_idx as usize)
                        .map(|c| c.to_value())
                        .unwrap_or(Value::Null);
                    let result = match &arr {
                        Value::NumberArray(a) => {
                            let arr_borrow = a.borrow();
                            let filtered: Vec<f64> = arr_borrow
                                .iter()
                                .filter(|&&n| {
                                    let elem = Value::Number(n);
                                    let (l, r) = if param_left { (elem, const_val.clone()) } else { (const_val.clone(), elem) };
                                    eval_binop(binop, &l, &r).unwrap_or(Value::Null).is_truthy()
                                })
                                .copied()
                                .collect();
                            Value::number_array(filtered)
                        }
                        Value::Array(a) => {
                            let arr_borrow = a.borrow();
                            let filtered: Vec<Value> = arr_borrow
                                .iter()
                                .filter(|v| {
                                    let (l, r) = if param_left { ((*v).clone(), const_val.clone()) } else { (const_val.clone(), (*v).clone()) };
                                    eval_binop(binop, &l, &r).unwrap_or(Value::Null).is_truthy()
                                })
                                .cloned()
                                .collect();
                            Value::Array(VmRef::new(filtered))
                        }
                        _ => Value::Null,
                    };
                    self.stack.push(result);
                }
                Opcode::Throw => {
                    let v = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow".to_string())?;
                    raise!(v);
                }
                Opcode::AwaitPromise => {
                    let v = self
                        .stack
                        .pop()
                        .ok_or_else(|| "Stack underflow in AwaitPromise".to_string())?;
                    #[cfg(any(feature = "http", feature = "promise"))]
                    {
                        use tishlang_core::Value as V;
                        match v {
                            V::Promise(p) => match p.block_until_settled() {
                                Ok(val) => self.stack.push(val),
                                Err(rej) => {
                                    Self::unwind_throw(
                                        &mut try_handlers,
                                        &mut self.stack,
                                        &mut ip,
                                        rej,
                                    )?;
                                }
                            },
                            other => self.stack.push(tishlang_runtime::await_promise(other)),
                        }
                    }
                    #[cfg(not(any(feature = "http", feature = "promise")))]
                    {
                        self.stack.push(v);
                    }
                }
                Opcode::LoadNativeExport => {
                    let spec_idx = Self::read_u16(code, &mut ip);
                    let export_idx = Self::read_u16(code, &mut ip);
                    let spec = match constants.get(spec_idx as usize) {
                        Some(Constant::String(s)) => s.as_ref(),
                        _ => {
                            return Err(
                                "LoadNativeExport: spec constant out of bounds or not string"
                                    .to_string(),
                            );
                        }
                    };
                    let export_name = match constants.get(export_idx as usize) {
                        Some(Constant::String(s)) => s.as_ref(),
                        _ => {
                            return Err("LoadNativeExport: export_name constant out of bounds or not string".to_string());
                        }
                    };
                    // Phase-2 item 11: consult externally registered native
                    // modules (populated via `Vm::register_native_module`)
                    // before falling through to the built-in lookup. Embedders
                    // on the cranelift / llvm backends that want to expose
                    // `cargo:…` Rust crates should register the module's
                    // exports map before calling `vm.run(chunk)`.
                    let from_registry: Option<Value> = if spec.starts_with("cargo:")
                        || spec.starts_with("ffi:")
                    {
                        let regs = self.native_modules.borrow();
                        regs.get(spec)
                            .and_then(|m| m.borrow().get(&Arc::from(export_name)).cloned())
                    } else {
                        None
                    };
                    let v = from_registry
                        .or_else(|| get_builtin_export(self.capabilities.as_ref(), spec, export_name))
                        .ok_or_else(|| {
                            if spec.starts_with("cargo:") {
                                format!(
                                    "cargo:{} is not registered on the bytecode VM. Embedders must call Vm::register_native_module before run(). Spec: {} export: {}",
                                    spec.trim_start_matches("cargo:"),
                                    spec,
                                    export_name,
                                )
                            } else {
                                format!(
                                    "Built-in module '{}' does not export '{}' or capability not enabled for this run. Use e.g. tish run --feature fs (or full). The tish binary must also be built with that capability linked in.",
                                    spec, export_name
                                )
                            }
                        })?;
                    self.stack.push(v);
                }
                Opcode::Closure | Opcode::LoadThis => {
                    return Err(format!("Unhandled opcode: {:?}", opcode));
                }
            }
        }

        #[cfg(feature = "timers")]
        if cap_allows(self.capabilities.as_ref(), "timers") {
            tishlang_runtime::drain_timers();
        }

        Ok(self.stack.pop().unwrap_or(Value::Null))
    }
}

impl Default for Vm {
    fn default() -> Self {
        Self::new()
    }
}

/// Rough byte capacity for string coercion (matches hot paths like `"x" + n + "ms"`).
fn estimate_string_concat_len(v: &Value) -> usize {
    match v {
        Value::String(s) => s.len(),
        Value::Number(_) => 24,
        Value::Bool(_) => 5,
        Value::Null => 4,
        _ => 32,
    }
}

/// Append JS-style string conversion without an intermediate `String` per operand (unlike
/// `format!("{}{}", a.to_display_string(), b.to_display_string())`, which triple-allocates).
fn append_value_for_string_concat(out: &mut String, v: &Value) {
    match v {
        // JS `Number.prototype.toString` (exponential past digit 21 / before −6), shared
        // with `console.log` so `"" + n` and `` `${n}` `` match Node exactly.
        Value::Number(n) => out.push_str(&tishlang_core::js_number_to_string(*n)),
        Value::String(s) => out.push_str(s.as_ref()),
        Value::Bool(b) => out.push_str(if *b { "true" } else { "false" }),
        Value::Null => out.push_str("null"),
        // Arrays/objects use JS `ToString` (recursive comma-join / "[object Object]"),
        // not the inspect form, so `"" + [1,[2,3]]` and templates match Node.
        _ => out.push_str(&v.to_js_string()),
    }
}

fn eval_binop(op: BinOp, l: &Value, r: &Value) -> Result<Value, String> {
    use tishlang_ast::BinOp::*;
    use tishlang_core::Value::*;
    let ln = l.as_number().unwrap_or(f64::NAN);
    let rn = r.as_number().unwrap_or(f64::NAN);
    match op {
        Add => {
            if matches!(l, Value::String(_)) || matches!(r, Value::String(_)) {
                let cap = estimate_string_concat_len(l) + estimate_string_concat_len(r);
                let mut buf = std::string::String::with_capacity(cap);
                append_value_for_string_concat(&mut buf, l);
                append_value_for_string_concat(&mut buf, r);
                Ok(String(buf.into()))
            } else {
                Ok(Number(ln + rn))
            }
        }
        Sub => Ok(Number(ln - rn)),
        Mul => Ok(Number(ln * rn)),
        // IEEE division/remainder, matching JS (and the interp + rust-AOT backends): `5/0` → Infinity,
        // `-5/0` → -Infinity, `0/0` → NaN, `5%0` → NaN. The former `if rn==0 { NaN }` special-case made
        // the VM the only backend that returned NaN for `n/0` at runtime (literals were masked by
        // constant-folding) — a cross-backend divergence. Null/non-number operands already coerce to
        // NaN via `as_number().unwrap_or(NaN)` above, so `5/null` stays NaN (tish's null-coercion).
        Div => Ok(Number(ln / rn)),
        Mod => Ok(Number(ln % rn)),
        Pow => Ok(Number(ln.powf(rn))),
        Eq => Ok(Bool(l.strict_eq(r))),
        Ne => Ok(Bool(!l.strict_eq(r))),
        StrictEq => Ok(Bool(l.strict_eq(r))),
        StrictNe => Ok(Bool(!l.strict_eq(r))),
        // Relational operators: when BOTH operands are strings, compare them
        // lexicographically (JS semantics). Otherwise coerce to numbers — a string
        // mixed with a number still falls through to numeric coercion (NaN → false).
        Lt => Ok(Bool(match (l, r) {
            (String(a), String(b)) => a.as_str() < b.as_str(),
            _ => ln < rn,
        })),
        Le => Ok(Bool(match (l, r) {
            (String(a), String(b)) => a.as_str() <= b.as_str(),
            _ => ln <= rn,
        })),
        Gt => Ok(Bool(match (l, r) {
            (String(a), String(b)) => a.as_str() > b.as_str(),
            _ => ln > rn,
        })),
        Ge => Ok(Bool(match (l, r) {
            (String(a), String(b)) => a.as_str() >= b.as_str(),
            _ => ln >= rn,
        })),
        And => Ok(Bool(l.is_truthy() && r.is_truthy())),
        Or => Ok(Bool(l.is_truthy() || r.is_truthy())),
        // `to_int32`/`to_uint32` = JS ToInt32/ToUint32 (modulo 2³², NaN/±Infinity → 0); not a
        // saturating cast, so out-of-range operands wrap exactly like JS instead of clamping.
        BitAnd => Ok(Number((to_int32(ln) & to_int32(rn)) as f64)),
        BitOr => Ok(Number((to_int32(ln) | to_int32(rn)) as f64)),
        BitXor => Ok(Number((to_int32(ln) ^ to_int32(rn)) as f64)),
        // JS shifts mask the count to 5 bits; `wrapping_sh*` matches that and avoids
        // the debug-mode panic that plain `<<`/`>>` raise for a count of 32+.
        Shl => Ok(Number(to_int32(ln).wrapping_shl(to_uint32(rn)) as f64)),
        Shr => Ok(Number(to_int32(ln).wrapping_shr(to_uint32(rn)) as f64)),
        UShr => Ok(Number(to_uint32(ln).wrapping_shr(to_uint32(rn)) as f64)),
        In => Ok(Bool(match r {
            Value::Object(_) => object_has(r, l),
            Value::Array(a) => {
                let key_s: Arc<str> = match l {
                    Value::String(s) => Arc::from(s.as_str()),
                    Value::Number(n) => n.to_string().into(),
                    _ => l.to_display_string().into(),
                };
                if key_s.as_ref() == "length" {
                    true
                } else if let Ok(idx) = key_s.parse::<usize>() {
                    idx < a.borrow().len()
                } else {
                    false
                }
            }
            Value::NumberArray(a) => {
                let key_s: Arc<str> = match l {
                    Value::String(s) => Arc::from(s.as_str()),
                    Value::Number(n) => n.to_string().into(),
                    _ => l.to_display_string().into(),
                };
                if key_s.as_ref() == "length" {
                    true
                } else if let Ok(idx) = key_s.parse::<usize>() {
                    idx < a.borrow().len()
                } else {
                    false
                }
            }
            _ => false,
        })),
    }
}

fn eval_unary(op: UnaryOp, o: &Value) -> Result<Value, String> {
    use tishlang_ast::UnaryOp::*;
    use tishlang_core::Value::*;
    match op {
        Not => Ok(Bool(!o.is_truthy())),
        Neg => Ok(Number(-o.as_number().unwrap_or(f64::NAN))),
        Pos => Ok(Number(o.as_number().unwrap_or(f64::NAN))),
        BitNot => Ok(Number(!to_int32(o.as_number().unwrap_or(0.0)) as f64)),
        Void => Ok(Null),
    }
}

/// `GetMember` with the per-name inline cache (JSC-style, Phase 1a). On a shape hit the property is at
/// a cached slot index → a direct load, no key hash/compare. A miss (or a non-plain-object, or a
/// `DICT_SHAPE` object) falls to [`get_member`] (arrays/strings/`length`/methods/missing-property
/// error), refilling the cache when the object *does* have the property. Result-equivalent to
/// `get_member` — the cache only skips the lookup; the shape uniquely fixes the slot for a property.
#[inline]
fn ic_get_member(chunk: &Chunk, name_idx: u16, obj: &Value, key: &Arc<str>) -> Result<Value, String> {
    use std::sync::atomic::Ordering::Relaxed;
    if let Value::Object(od) = obj {
        let b = od.borrow();
        let shape = b.strings.shape();
        if shape != tishlang_core::DICT_SHAPE {
            if let Some(cell) = chunk.inline_caches.0.get(name_idx as usize) {
                let ic = cell.load(Relaxed);
                let cached_shape = (ic >> 32) as u32; // 0 == uncached
                if cached_shape != 0 && cached_shape == shape {
                    if let Some(v) = b.strings.value_at_index((ic & 0xffff_ffff) as usize) {
                        return Ok(v.clone());
                    }
                }
                // Miss: do the real lookup once, and if the property exists, cache its slot.
                if let Some((v, i)) = b.strings.get_with_index(key.as_ref()) {
                    cell.store(((shape as u64) << 32) | i as u64, Relaxed);
                    return Ok(v.clone());
                }
            }
        }
        // `b` drops at the end of this block → safe to re-borrow `obj` in `get_member` below.
    }
    get_member(obj, key)
}

/// `SetMember` with the per-name inline cache. On a shape hit for an existing property → an in-place
/// store at the cached slot (no key lookup, no shape change). Otherwise the slow path inserts (a new
/// key transitions the shape) and refills the cache. Non-objects fall to [`set_member`].
#[inline]
fn ic_set_member(
    chunk: &Chunk,
    name_idx: u16,
    obj: &Value,
    key: &Arc<str>,
    val: Value,
) -> Result<(), String> {
    use std::sync::atomic::Ordering::Relaxed;
    if let Value::Object(od) = obj {
        let mut b = od.borrow_mut();
        let shape = b.strings.shape();
        let cell = chunk.inline_caches.0.get(name_idx as usize);
        if shape != tishlang_core::DICT_SHAPE {
            if let Some(c) = cell {
                let ic = c.load(Relaxed);
                let cached_shape = (ic >> 32) as u32;
                if cached_shape != 0 && cached_shape == shape {
                    if let Some(slot) = b.strings.value_at_index_mut((ic & 0xffff_ffff) as usize) {
                        *slot = val; // existing property, same shape → in-place update
                        return Ok(());
                    }
                }
            }
        }
        // Slow path: insert (a new key transitions the shape) + refill the cache for next time.
        b.strings.insert(Arc::clone(key), val);
        if let Some(c) = cell {
            let ns = b.strings.shape();
            if ns != tishlang_core::DICT_SHAPE {
                if let Some((_, i)) = b.strings.get_with_index(key.as_ref()) {
                    c.store(((ns as u64) << 32) | i as u64, Relaxed);
                }
            }
        }
        return Ok(());
    }
    set_member(obj, key, val)
}

fn get_member(obj: &Value, key: &Arc<str>) -> Result<Value, String> {
    match obj {
        Value::Object(m) => {
            // `Set`/`Map` instances expose a computed `.size` (via a hidden `SizeProbe` opaque).
            if key.as_ref() == "size" {
                if let Some(n) = tishlang_builtins::collections::collection_size(obj) {
                    return Ok(Value::Number(n));
                }
            }
            let map = m.borrow();
            // Reading a missing own property returns `null` (tish's nullish value), matching
            // JS object semantics and the tree-walk interpreter — not a thrown error (#66).
            Ok(map.strings.get(key.as_ref()).cloned().unwrap_or(Value::Null))
        }
        Value::NumberArray(a) => {
            let key_s = key.as_ref();
            // Numeric index fast path.
            if let Ok(idx) = key_s.parse::<usize>() {
                return Ok(a.borrow().get(idx).map(|&n| Value::Number(n)).unwrap_or(Value::Null));
            }
            if key_s == "length" {
                return Ok(Value::Number(a.borrow().len() as f64));
            }
            // push/pop/sort — stay packed; everything else materialise + delegate.
            let a_clone = a.clone();
            let method: ArrayMethodFn = match key_s {
                "push" => make_native_fn(move |args: &[Value]| {
                    let mut arr = a_clone.borrow_mut();
                    for v in args {
                        match v {
                            Value::Number(n) => arr.push(*n),
                            _ => {
                                arr.push(f64::NAN); // hole-marker for non-numeric
                            }
                        }
                    }
                    Value::Number(arr.len() as f64)
                }),
                "pop" => make_native_fn(move |_: &[Value]| {
                    a_clone.borrow_mut().pop()
                        .map(|n| if n.is_nan() { Value::Null } else { Value::Number(n) })
                        .unwrap_or(Value::Null)
                }),
                "shift" => make_native_fn(move |_: &[Value]| {
                    let mut arr = a_clone.borrow_mut();
                    if arr.is_empty() { Value::Null }
                    else { let n = arr.remove(0); if n.is_nan() { Value::Null } else { Value::Number(n) } }
                }),
                "unshift" => make_native_fn(move |args: &[Value]| {
                    let mut arr = a_clone.borrow_mut();
                    for (i, v) in args.iter().enumerate() {
                        let n = match v { Value::Number(n) => *n, _ => f64::NAN };
                        arr.insert(i, n);
                    }
                    Value::Number(arr.len() as f64)
                }),
                "reverse" => make_native_fn(move |_: &[Value]| {
                    a_clone.borrow_mut().reverse();
                    Value::NumberArray(a_clone.clone())
                }),
                "splice" => {
                    let a2 = a_clone.clone();
                    make_native_fn(move |args: &[Value]| {
                        // Check if there are non-numeric items to insert (args[2..]).
                        let has_non_numeric = args.get(2..).unwrap_or(&[]).iter()
                            .any(|v| !matches!(v, Value::Number(_)));
                        if has_non_numeric {
                            // Deopt: materialise, splice on the boxed array, then write numeric
                            // elements back to the original Vec<f64>. This preserves the VmRef
                            // identity for subsequent accesses. The array may have non-numeric
                            // elements after this splice — they become NaN holes in the VmRef.
                            let boxed = Value::materialize_number_array(&a2);
                            let result = arr_builtins::splice(&boxed, args.first().unwrap_or(&Value::Null), args.get(1), args.get(2..).unwrap_or(&[]));
                            // Sync the modified boxed Vec back into the original VmRef.
                            if let Value::Array(boxed_vmref) = &boxed {
                                let mut packed = a2.borrow_mut();
                                *packed = boxed_vmref.borrow().iter().map(|v| match v { Value::Number(n) => *n, _ => f64::NAN }).collect();
                            }
                            result
                        } else {
                            let mut arr = a2.borrow_mut();
                            let len = arr.len() as i64;
                            let start = match args.first() {
                                Some(Value::Number(n)) => { let s = *n as i64; if s < 0 { (len + s).max(0) as usize } else { (s as usize).min(arr.len()) } }
                                _ => 0,
                            };
                            let del = match args.get(1) {
                                Some(Value::Number(n)) => (*n as i64).max(0) as usize,
                                _ => arr.len().saturating_sub(start),
                            };
                            let del = del.min(arr.len().saturating_sub(start));
                            let new_nums: Vec<f64> = args.get(2..).unwrap_or(&[]).iter().map(|v| match v { Value::Number(n) => *n, _ => f64::NAN }).collect();
                            let removed: Vec<f64> = arr.splice(start..start + del, new_nums).collect();
                            Value::number_array(removed)
                        }
                    })
                }
                "sort" => make_native_fn(move |args: &[Value]| {
                    let arr_val = Value::NumberArray(a_clone.clone());
                    let cmp = args.first();
                    if let Some(Value::Function(_)) = cmp {
                        // Comparator sort: materialise first (comparator may return non-numeric).
                        let boxed = Value::materialize_number_array(&a_clone);
                        arr_builtins::sort_with_comparator(&boxed, cmp.unwrap())
                    } else {
                        arr_builtins::sort_numeric_asc(&arr_val)
                    }
                }),
                _ => {
                    // All other methods: materialise to a boxed Array and delegate.
                    // The a_clone is the original NumberArray VmRef; we materialise once per
                    // method lookup (not per call) so the closure captures a stable boxed Array.
                    let boxed = Value::materialize_number_array(&a_clone);
                    let bv = boxed.clone();
                    match key_s {
                        "map"       => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::map(&bv, &cb) }),
                        "filter"    => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::filter(&bv, &cb) }),
                        "reduce"    => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); let init = args.get(1).cloned().unwrap_or(Value::Null); arr_builtins::reduce(&bv, &cb, &init) }),
                        "forEach"   => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::for_each(&bv, &cb) }),
                        "find"      => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::find(&bv, &cb) }),
                        "findIndex" => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::find_index(&bv, &cb) }),
                        "some"      => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::some(&bv, &cb) }),
                        "every"     => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::every(&bv, &cb) }),
                        "join"      => make_native_fn(move |args| { let sep = args.first().cloned().unwrap_or(Value::Null); arr_builtins::join(&bv, &sep) }),
                        "flat"      => make_native_fn(move |args| { let d = args.first().cloned().unwrap_or(Value::Number(1.0)); arr_builtins::flat(&bv, &d) }),
                        "flatMap"   => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::flat_map(&bv, &cb) }),
                        "reverse"   => make_native_fn(move |_| arr_builtins::reverse(&bv)),
                        "fill"      => make_native_fn(move |args| { let v = args.first().cloned().unwrap_or(Value::Null); let s = args.get(1).cloned().unwrap_or(Value::Null); let e = args.get(2).cloned().unwrap_or(Value::Null); arr_builtins::fill(&bv, &v, &s, &e) }),
                        "slice"     => make_native_fn(move |args| { let s = args.first().cloned().unwrap_or(Value::Null); let e = args.get(1).cloned().unwrap_or(Value::Null); arr_builtins::slice(&bv, &s, &e) }),
                        "concat"    => make_native_fn(move |args| arr_builtins::concat(&bv, args)),
                        "indexOf"   => make_native_fn(move |args| { let s = args.first().cloned().unwrap_or(Value::Null); arr_builtins::index_of(&bv, &s) }),
                        "includes"  => make_native_fn(move |args| { let s = args.first().cloned().unwrap_or(Value::Null); let f = args.get(1).cloned(); arr_builtins::includes(&bv, &s, f.as_ref()) }),
                        "unshift"   => make_native_fn(move |args| arr_builtins::unshift(&bv, args)),
                        "shift"     => make_native_fn(move |_| arr_builtins::shift(&bv)),
                        "splice"    => make_native_fn(move |args| { let s = args.first().cloned().unwrap_or(Value::Null); let dc = args.get(1).cloned(); let items: Vec<Value> = args.get(2..).unwrap_or(&[]).to_vec(); arr_builtins::splice(&bv, &s, dc.as_ref(), &items) }),
                        _ => return Err(format!("Property '{}' not found", key)),
                    }
                }
            };
            Ok(Value::Function(method))
        }
        Value::Array(a) => {
            let key_s = key.as_ref();
            if let Ok(idx) = key_s.parse::<usize>() {
                let arr = a.borrow();
                return arr
                    .get(idx)
                    .cloned()
                    .ok_or_else(|| "Index out of bounds".to_string());
            }
            if key_s == "length" {
                return Ok(Value::Number(a.borrow().len() as f64));
            }
            let a_clone = a.clone();
            let method: ArrayMethodFn = match key_s {
                "push" => make_native_fn(move |args: &[Value]| {
                    arr_builtins::push(&Value::Array(a_clone.clone()), args)
                }),
                "pop" => make_native_fn(move |_args: &[Value]| {
                    arr_builtins::pop(&Value::Array(a_clone.clone()))
                }),
                "shift" => make_native_fn(move |_args: &[Value]| {
                    arr_builtins::shift(&Value::Array(a_clone.clone()))
                }),
                "unshift" => make_native_fn(move |args: &[Value]| {
                    arr_builtins::unshift(&Value::Array(a_clone.clone()), args)
                }),
                "reverse" => make_native_fn(move |_args: &[Value]| {
                    arr_builtins::reverse(&Value::Array(a_clone.clone()))
                }),
                "fill" => make_native_fn(move |args: &[Value]| {
                    let value = args.first().unwrap_or(&Value::Null);
                    let start = args.get(1).unwrap_or(&Value::Null);
                    let end = args.get(2).unwrap_or(&Value::Null);
                    arr_builtins::fill(&Value::Array(a_clone.clone()), value, start, end)
                }),
                "shuffle" => make_native_fn(move |_args: &[Value]| {
                    arr_builtins::shuffle(&Value::Array(a_clone.clone()))
                }),
                "slice" => make_native_fn(move |args: &[Value]| {
                    let start = args.first().unwrap_or(&Value::Null);
                    let end = args.get(1).unwrap_or(&Value::Null);
                    arr_builtins::slice(&Value::Array(a_clone.clone()), start, end)
                }),
                "concat" => make_native_fn(move |args: &[Value]| {
                    arr_builtins::concat(&Value::Array(a_clone.clone()), args)
                }),
                "join" => make_native_fn(move |args: &[Value]| {
                    let sep = args.first().unwrap_or(&Value::Null);
                    arr_builtins::join(&Value::Array(a_clone.clone()), sep)
                }),
                "indexOf" => make_native_fn(move |args: &[Value]| {
                    let search = args.first().unwrap_or(&Value::Null);
                    arr_builtins::index_of(&Value::Array(a_clone.clone()), search)
                }),
                "includes" => make_native_fn(move |args: &[Value]| {
                    let search = args.first().unwrap_or(&Value::Null);
                    let from = args.get(1);
                    arr_builtins::includes(&Value::Array(a_clone.clone()), search, from)
                }),
                "map" => make_native_fn(move |args: &[Value]| {
                    let cb = args.first().cloned().unwrap_or(Value::Null);
                    arr_builtins::map(&Value::Array(a_clone.clone()), &cb)
                }),
                "filter" => make_native_fn(move |args: &[Value]| {
                    let cb = args.first().cloned().unwrap_or(Value::Null);
                    arr_builtins::filter(&Value::Array(a_clone.clone()), &cb)
                }),
                "reduce" => make_native_fn(move |args: &[Value]| {
                    let cb = args.first().cloned().unwrap_or(Value::Null);
                    let init = args.get(1).cloned().unwrap_or(Value::Null);
                    arr_builtins::reduce(&Value::Array(a_clone.clone()), &cb, &init)
                }),
                "forEach" => make_native_fn(move |args: &[Value]| {
                    let cb = args.first().cloned().unwrap_or(Value::Null);
                    arr_builtins::for_each(&Value::Array(a_clone.clone()), &cb)
                }),
                "find" => make_native_fn(move |args: &[Value]| {
                    let cb = args.first().cloned().unwrap_or(Value::Null);
                    arr_builtins::find(&Value::Array(a_clone.clone()), &cb)
                }),
                "findIndex" => make_native_fn(move |args: &[Value]| {
                    let cb = args.first().cloned().unwrap_or(Value::Null);
                    arr_builtins::find_index(&Value::Array(a_clone.clone()), &cb)
                }),
                "some" => make_native_fn(move |args: &[Value]| {
                    let cb = args.first().cloned().unwrap_or(Value::Null);
                    arr_builtins::some(&Value::Array(a_clone.clone()), &cb)
                }),
                "every" => make_native_fn(move |args: &[Value]| {
                    let cb = args.first().cloned().unwrap_or(Value::Null);
                    arr_builtins::every(&Value::Array(a_clone.clone()), &cb)
                }),
                "flat" => make_native_fn(move |args: &[Value]| {
                    let depth = args.first().unwrap_or(&Value::Number(1.0));
                    arr_builtins::flat(&Value::Array(a_clone.clone()), depth)
                }),
                "flatMap" => make_native_fn(move |args: &[Value]| {
                    let cb = args.first().cloned().unwrap_or(Value::Null);
                    arr_builtins::flat_map(&Value::Array(a_clone.clone()), &cb)
                }),
                "sort" => make_native_fn(move |args: &[Value]| {
                    let cmp = args.first();
                    if let Some(Value::Function(_)) = cmp {
                        arr_builtins::sort_with_comparator(
                            &Value::Array(a_clone.clone()),
                            cmp.unwrap(),
                        )
                    } else {
                        arr_builtins::sort_default(&Value::Array(a_clone.clone()))
                    }
                }),
                "splice" => make_native_fn(move |args: &[Value]| {
                    let start = args.first().unwrap_or(&Value::Null);
                    let delete_count = args.get(1).map(|v| v as &Value);
                    let items: Vec<Value> = args.get(2..).unwrap_or(&[]).to_vec();
                    arr_builtins::splice(
                        &Value::Array(a_clone.clone()),
                        start,
                        delete_count,
                        &items,
                    )
                }),
                _ => return Err(format!("Property '{}' not found", key)),
            };
            Ok(Value::Function(method))
        }
        Value::String(s) => {
            let key_s = key.as_ref();
            if let Ok(idx) = key_s.parse::<usize>() {
                return match s.chars().nth(idx) {
                    Some(c) => Ok(Value::String(tishlang_core::ArcStr::from(c.to_string()))),
                    None => Err("Index out of bounds".to_string()),
                };
            }
            if key_s == "length" {
                return Ok(Value::Number(s.chars().count() as f64));
            }
            let s_clone: tishlang_core::ArcStr = s.clone();
            let method: ArrayMethodFn = match key_s {
                "indexOf" => make_native_fn(move |args: &[Value]| {
                    let search = args.first().unwrap_or(&Value::Null);
                    let from = args.get(1);
                    str_builtins::index_of(&Value::String(s_clone.clone()), search, from)
                }),
                "lastIndexOf" => make_native_fn(move |args: &[Value]| {
                    let search = args.first().unwrap_or(&Value::Null);
                    let position = args.get(1).cloned().unwrap_or(Value::Number(f64::INFINITY));
                    str_builtins::last_index_of(
                        &Value::String(s_clone.clone()),
                        search,
                        &position,
                    )
                }),
                "includes" => make_native_fn(move |args: &[Value]| {
                    let search = args.first().unwrap_or(&Value::Null);
                    let from = args.get(1);
                    str_builtins::includes(&Value::String(s_clone.clone()), search, from)
                }),
                "slice" => make_native_fn(move |args: &[Value]| {
                    let start = args.first().unwrap_or(&Value::Null);
                    let end = args.get(1).unwrap_or(&Value::Null);
                    str_builtins::slice(&Value::String(s_clone.clone()), start, end)
                }),
                "substring" => make_native_fn(move |args: &[Value]| {
                    let start = args.first().unwrap_or(&Value::Null);
                    let end = args.get(1).unwrap_or(&Value::Null);
                    str_builtins::substring(&Value::String(s_clone.clone()), start, end)
                }),
                "split" => make_native_fn(move |args: &[Value]| {
                    let sep = args.first().unwrap_or(&Value::Null);
                    #[cfg(feature = "regex")]
                    if matches!(sep, Value::RegExp(_)) {
                        return tishlang_runtime::string_split_regex(
                            &Value::String(s_clone.clone()),
                            sep,
                            None,
                        );
                    }
                    str_builtins::split(&Value::String(s_clone.clone()), sep)
                }),
                "trim" => make_native_fn(move |_args: &[Value]| {
                    str_builtins::trim(&Value::String(s_clone.clone()))
                }),
                "toUpperCase" => make_native_fn(move |_args: &[Value]| {
                    str_builtins::to_upper_case(&Value::String(s_clone.clone()))
                }),
                "toLowerCase" => make_native_fn(move |_args: &[Value]| {
                    str_builtins::to_lower_case(&Value::String(s_clone.clone()))
                }),
                "startsWith" => make_native_fn(move |args: &[Value]| {
                    let search = args.first().unwrap_or(&Value::Null);
                    str_builtins::starts_with(&Value::String(s_clone.clone()), search)
                }),
                "endsWith" => make_native_fn(move |args: &[Value]| {
                    let search = args.first().unwrap_or(&Value::Null);
                    str_builtins::ends_with(&Value::String(s_clone.clone()), search)
                }),
                "replace" => make_native_fn(move |args: &[Value]| {
                    let search = args.first().unwrap_or(&Value::Null);
                    let replacement = args.get(1).unwrap_or(&Value::Null);
                    // RegExp search (incl. global flag + function replacer) routes to the runtime's
                    // regex-aware string_replace, identical to the rust backend.
                    #[cfg(feature = "regex")]
                    if matches!(search, Value::RegExp(_)) {
                        return tishlang_runtime::string_replace(
                            &Value::String(s_clone.clone()),
                            search,
                            replacement,
                        );
                    }
                    str_builtins::replace(&Value::String(s_clone.clone()), search, replacement)
                }),
                "replaceAll" => make_native_fn(move |args: &[Value]| {
                    let search = args.first().unwrap_or(&Value::Null);
                    let replacement = args.get(1).unwrap_or(&Value::Null);
                    str_builtins::replace_all(
                        &Value::String(s_clone.clone()),
                        search,
                        replacement,
                    )
                }),
                #[cfg(feature = "regex")]
                "match" => make_native_fn(move |args: &[Value]| {
                    let re = args.first().unwrap_or(&Value::Null);
                    tishlang_runtime::string_match_regex(&Value::String(s_clone.clone()), re)
                }),
                #[cfg(feature = "regex")]
                "search" => make_native_fn(move |args: &[Value]| {
                    let re = args.first().unwrap_or(&Value::Null);
                    tishlang_runtime::string_search_regex(&Value::String(s_clone.clone()), re)
                }),
                "charAt" => make_native_fn(move |args: &[Value]| {
                    let idx = args.first().unwrap_or(&Value::Null);
                    str_builtins::char_at(&Value::String(s_clone.clone()), idx)
                }),
                "charCodeAt" => make_native_fn(move |args: &[Value]| {
                    let idx = args.first().unwrap_or(&Value::Null);
                    str_builtins::char_code_at(&Value::String(s_clone.clone()), idx)
                }),
                "repeat" => make_native_fn(move |args: &[Value]| {
                    let count = args.first().unwrap_or(&Value::Null);
                    str_builtins::repeat(&Value::String(s_clone.clone()), count)
                }),
                "padStart" => make_native_fn(move |args: &[Value]| {
                    let target_len = args.first().unwrap_or(&Value::Null);
                    let pad = args.get(1).unwrap_or(&Value::Null);
                    str_builtins::pad_start(&Value::String(s_clone.clone()), target_len, pad)
                }),
                "padEnd" => make_native_fn(move |args: &[Value]| {
                    let target_len = args.first().unwrap_or(&Value::Null);
                    let pad = args.get(1).unwrap_or(&Value::Null);
                    str_builtins::pad_end(&Value::String(s_clone.clone()), target_len, pad)
                }),
                _ => return Err(format!("Property '{}' not found", key)),
            };
            Ok(Value::Function(method))
        }
        Value::Number(n) => {
            // Number.prototype methods. Shared impls live in tishlang_builtins::number so
            // the VM, rust runtime, and interpreter stay byte-identical (full-backend-parity-plan.md).
            let n_val = *n;
            let method: ArrayMethodFn = match key.as_ref() {
                "toFixed" => make_native_fn(move |args: &[Value]| {
                    let digits = args.first().unwrap_or(&Value::Null);
                    num_builtins::to_fixed(&Value::Number(n_val), digits)
                }),
                "toString" => make_native_fn(move |args: &[Value]| {
                    let radix = args.first().unwrap_or(&Value::Null);
                    num_builtins::to_string(&Value::Number(n_val), radix)
                }),
                _ => return Err(format!("Property '{}' not found", key)),
            };
            Ok(Value::Function(method))
        }
        #[cfg(feature = "regex")]
        Value::RegExp(re) => match key.as_ref() {
            // `test`/`exec` route to the same runtime impls the rust backend uses, so the match
            // object shape (keys "0".."n" + "index") and lastIndex advancement are identical.
            "test" => {
                let rc = re.clone();
                Ok(Value::native(move |args: &[Value]| {
                    let input = args.first().unwrap_or(&Value::Null);
                    tishlang_runtime::regexp_test(&Value::RegExp(rc.clone()), input)
                }))
            }
            "exec" => {
                let rc = re.clone();
                Ok(Value::native(move |args: &[Value]| {
                    let input = args.first().unwrap_or(&Value::Null);
                    tishlang_runtime::regexp_exec(&Value::RegExp(rc.clone()), input)
                }))
            }
            // Properties mirror the interpreter (eval.rs get_prop RegExp arm) exactly.
            "source" => Ok(Value::String(re.borrow().source.clone().into())),
            "flags" => Ok(Value::String(re.borrow().flags_string().into())),
            "lastIndex" => Ok(Value::Number(re.borrow().last_index as f64)),
            "global" => Ok(Value::Bool(re.borrow().flags.global)),
            "ignoreCase" => Ok(Value::Bool(re.borrow().flags.ignore_case)),
            "multiline" => Ok(Value::Bool(re.borrow().flags.multiline)),
            "dotAll" => Ok(Value::Bool(re.borrow().flags.dot_all)),
            "unicode" => Ok(Value::Bool(re.borrow().flags.unicode)),
            "sticky" => Ok(Value::Bool(re.borrow().flags.sticky)),
            _ => Err(format!("Property '{}' not found", key)),
        },
        #[cfg(any(feature = "http", feature = "promise"))]
        Value::Promise(p) => match key.as_ref() {
            "then" => {
                let pc = Arc::clone(p);
                Ok(Value::native(move |args| {
                    tishlang_runtime::promise_instance_then(&pc, args)
                }))
            }
            "catch" => {
                let pc = Arc::clone(p);
                Ok(Value::native(move |args| {
                    tishlang_runtime::promise_instance_catch(&pc, args)
                }))
            }
            _ => Err(format!("Property '{}' not found", key)),
        },
        _ => Err(format!(
            "Cannot read property '{}' of {}",
            key,
            obj.type_name()
        )),
    }
}

fn set_member(obj: &Value, key: &Arc<str>, val: Value) -> Result<(), String> {
    match obj {
        Value::Object(m) => {
            m.borrow_mut().strings.insert(Arc::clone(key), val);
            Ok(())
        }
        Value::Array(a) => {
            if key.as_ref() == "length" {
                // `arr.length = k` truncates or grows (holes read back as Null), JS-style.
                let new_len = array_length_arg(&val)?;
                let mut arr = a.borrow_mut();
                arr.resize(new_len, Value::Null);
                return Ok(());
            }
            let idx: usize = key.as_ref().parse().unwrap_or(0);
            let mut arr = a.borrow_mut();
            if idx < arr.len() {
                arr[idx] = val;
            } else {
                arr.resize(idx + 1, Value::Null);
                arr[idx] = val;
            }
            Ok(())
        }
        Value::NumberArray(a) => {
            if key.as_ref() == "length" {
                let new_len = array_length_arg(&val)?;
                // NaN is the packed-array hole marker (read back as Null), matching get_index.
                a.borrow_mut().resize(new_len, f64::NAN);
                return Ok(());
            }
            Err(format!("Cannot set property of {}", obj.type_name()))
        }
        _ => Err(format!("Cannot set property of {}", obj.type_name())),
    }
}

/// JS `arr.length = v`: `v` is coerced to a number and must be a valid array length —
/// a non-negative integer below 2³². Anything else is a RangeError ("Invalid array length").
fn array_length_arg(val: &Value) -> Result<usize, String> {
    let n = val.as_number().unwrap_or(f64::NAN);
    if n.is_nan() || n < 0.0 || n.fract() != 0.0 || n > 4_294_967_295.0 {
        return Err("Invalid array length".to_string());
    }
    Ok(n as usize)
}

fn get_index(obj: &Value, idx: &Value) -> Result<Value, String> {
    match obj {
        Value::NumberArray(a) => {
            let i = match idx {
                Value::Number(n) => *n as usize,
                _ => return Err(format!("Array index must be number, got {}", idx.type_name())),
            };
            // NaN is used as the hole marker (sparse-array positions); reads return Null.
            Ok(a.borrow().get(i).map(|&n| if n.is_nan() { Value::Null } else { Value::Number(n) }).unwrap_or(Value::Null))
        }
        Value::Array(a) => {
            let i = match idx {
                Value::Number(n) => *n as usize,
                _ => {
                    return Err(format!(
                        "Array index must be number, got {}",
                        idx.type_name()
                    ));
                }
            };
            Ok(a
                .borrow()
                .get(i)
                .cloned()
                .unwrap_or(Value::Null))
        }
        Value::String(s) => {
            let i = match idx {
                Value::Number(n) => {
                    let n = *n;
                    if n < 0.0 || n.fract() != 0.0 {
                        return Err(format!(
                            "String index must be non-negative integer, got {}",
                            n
                        ));
                    }
                    let i = n as usize;
                    let len = s.chars().count();
                    if i >= len {
                        return Err("Index out of bounds".to_string());
                    }
                    i
                }
                _ => {
                    return Err(format!(
                        "String index must be number, got {}",
                        idx.type_name()
                    ));
                }
            };
            match s.chars().nth(i) {
                Some(c) => Ok(Value::String(tishlang_core::ArcStr::from(c.to_string()))),
                None => Err("Index out of bounds".to_string()),
            }
        }
        // A missing own property returns `null`, not a thrown error — matching dot reads
        // (#66) and JS object semantics. Keeps `obj[key]` and `obj.key` in lockstep (#113).
        Value::Object(_) => Ok(object_get(obj, idx).unwrap_or(Value::Null)),
        #[cfg(any(feature = "http", feature = "promise"))]
        Value::Promise(_) => {
            let key_arc: std::sync::Arc<str> = match idx {
                Value::String(s) => std::sync::Arc::from(s.as_str()),
                _ => {
                    return Err(format!(
                        "Promise bracket access requires a string key, got {}",
                        idx.type_name()
                    ));
                }
            };
            get_member(obj, &key_arc)
        },
        _ => Err(format!(
            "Cannot read property '{}' of {}",
            idx.to_display_string(),
            obj.type_name()
        )),
    }
}

/// `delete obj[key]` semantics (issue #40). Objects drop the string key; arrays clear the
/// element at a numeric index to a `null` hole (length is preserved, JS-style). Anything else
/// is a no-op. The operator always evaluates to `true` (handled by the caller).
fn delete_index(obj: &Value, key: &Value) {
    match obj {
        Value::Object(m) => {
            let key_s: Arc<str> = match key {
                Value::String(s) => Arc::from(s.as_str()),
                other => Arc::from(other.to_display_string().as_str()),
            };
            m.borrow_mut().strings.remove(key_s.as_ref());
        }
        Value::Array(a) => {
            if let Value::Number(n) = key {
                let n = *n;
                if n >= 0.0 && n.fract() == 0.0 {
                    let i = n as usize;
                    let mut arr = a.borrow_mut();
                    if i < arr.len() {
                        arr[i] = Value::Null;
                    }
                }
            }
        }
        _ => {}
    }
}

fn set_index(obj: &Value, idx: &Value, val: Value) -> Result<(), String> {
    match obj {
        Value::NumberArray(a) => {
            let i = match idx {
                Value::Number(n) => *n as usize,
                _ => return Err(format!("Array index must be number, got {}", idx.type_name())),
            };
            // In-bounds numeric assignment stays packed.
            // Out-of-bounds or non-numeric falls through to the Array path by returning
            // a sentinel error — the caller (SetIndex opcode) does NOT handle deopt.
            // Instead we only do in-bounds-or-next-element numeric assignments here;
            // anything that creates holes (i > len) or sets a non-number is unsupported.
            match val {
                Value::Number(n) => {
                    let mut arr = a.borrow_mut();
                    // Extend with NaN "holes" if needed (NaN = sparse hole; read back as Null).
                    while arr.len() <= i { arr.push(f64::NAN); }
                    arr[i] = n;
                }
                // Non-numeric set: the Vec<f64> can't represent this type. Extend with NaN holes
                // up to the index, then leave the slot as NaN (the value is lost). This is a
                // known limitation of NumberArray; the uncommon mixed-type path should not produce
                // a NumberArray in the first place. The caller will see the correct index reads for
                // numeric elements and Null for the NaN holes.
                _ => {
                    let mut arr = a.borrow_mut();
                    while arr.len() <= i { arr.push(f64::NAN); }
                    // arr[i] is already NaN (hole); we can't store the non-numeric value — acceptable
                    // for the experimental TISH_PACKED_ARRAYS path.
                }
            }
            Ok(())
        }
        Value::Array(a) => {
            let i = match idx {
                Value::Number(n) => *n as usize,
                _ => {
                    return Err(format!(
                        "Array index must be number, got {}",
                        idx.type_name()
                    ));
                }
            };
            let mut arr = a.borrow_mut();
            while arr.len() <= i {
                arr.push(Value::Null);
            }
            arr[i] = val;
            Ok(())
        }
        Value::Object(_) => object_set(obj, idx, val),
        _ => Err(format!("Cannot set property of {}", obj.type_name())),
    }
}

/// Run a chunk with every capability linked into this `tishlang_vm` build (tests, embedders).
pub fn run(chunk: &Chunk) -> Result<Value, String> {
    let mut vm = Vm::new();
    vm.run_with_options(chunk, false)
}

/// Run a chunk with options (e.g. REPL persistence for top-level declarations).
pub fn run_with_options(chunk: &Chunk, opts: VmRunOptions) -> Result<Value, String> {
    let mut vm = Vm::with_capabilities(opts.capabilities);
    vm.run_with_options(chunk, opts.repl_mode)
}