diff --git a/CMakeLists.txt b/CMakeLists.txt
index c7cda635..b08bc3fc 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -94,6 +94,7 @@ add_library(mm_core STATIC
     src/core/Scheduler.cpp
     src/core/moonlive/MoonLive.cpp
     src/core/moonlive/MoonLiveCompiler.cpp
+    src/core/moonlive/MoonLiveSpill.cpp
 )
 target_include_directories(mm_core PUBLIC src/)
 target_link_libraries(mm_core PUBLIC mm_platform)
diff --git a/docs/MIGRATING.md b/docs/MIGRATING.md
index 624ae916..9e34049e 100644
--- a/docs/MIGRATING.md
+++ b/docs/MIGRATING.md
@@ -20,6 +20,23 @@ projectMM ships **no migration code**: the persistence layer is robust by defaul
 
 ## Unreleased (`next-iteration`)
 
+### MoonLive scripts move to the filesystem (2026-08-11)
+
+A scripted module used to carry its script as a `source` textarea — a fixed 1 KB array per module, plus a second 1 KB copy to notice edits, **resident whether or not a script was loaded**. Six modules cost 13 KB of a classic ESP32's 320 KB for text that was mostly empty. The script now lives in a file under `/moonlive/`, and the module holds only its **name** (~32 bytes): it is read into a right-sized buffer to compile and freed immediately, so nothing script-sized stays in RAM. A script is bounded by the filesystem instead of by a 1 KB array.
+
+**Action: *re-add a module* — or, to keep your scripts, *update a file* first.**
+
+The `source` control no longer exists, so a persisted `"source"` value is an unknown key and is ignored (the robust-reader rule). A MoonLive module therefore boots with **no script**, reporting `no script — set the script name`, and renders nothing until one is named.
+
+| What | Why | What to do |
+|---|---|---|
+| Your script text | It was persisted under `source`, a control that is gone | **Copy it out before updating** — it is in `/.config/Layouts.json` (or `Effects.json`) as `"N.source"`. Save it as `/moonlive/<name>.mlv` via the File Manager, then set the module's `script` control to `<name>.mlv` |
+| The module's own controls | A script's `@control` sliders exist only once it has compiled, so they are absent until a script is named | Nothing — they reappear with the script, keeping their persisted values |
+
+`/moonlive/` is created on demand: naming a script is enough to make the folder appear, so a fresh device needs no setup.
+
+**Editing today** goes through the File Manager rather than the module's own card. Wiring the card's editor to the same file is a separate change.
+
 ### MoonLive: a script can no longer declare a name the engine supplies (2026-08-10)
 
 `t` (elapsed milliseconds), `width`/`height`/`depth` (the logical grid) and `x`/`y`/`z` (the light a modifier is transforming) are now **system variables** the engine supplies, so a script cannot declare one. Previously each binding faked them by prepending hidden declarations to the script, which meant an effect could declare its own `width` and quietly disagree with the layer it was drawing into.
@@ -32,7 +49,7 @@ A **layout** is the one script that legitimately used those names for its own co
 
 | What | Why | What to do |
 |---|---|---|
-| A scripted layout declaring `width`/`height` | The name is what the layout is defining, so the declaration is a compile error and no lights are placed | Edit the script's `source` control, renaming its own controls (the shipped `grid.mlv` uses `cols`/`rows`) |
+| A scripted layout declaring `width`/`height` | The name is what the layout is defining, so the declaration is a compile error and no lights are placed | Edit the `.mlv` file in the File Manager, renaming its own controls (the shipped `grid.mlv` uses `cols`/`rows`), then set the module's `script` control to that file |
 | A scripted **modifier** using `x`, `y` or `z` as a loop variable | A modifier IS handed a coordinate under those names, so they cannot also be counters there | Rename the loop variable to something the modifier is not handed (`i`, `n`) |
 
 Effects and modifiers need no change: they were already being handed these values, just through a preamble instead of by name. The error names the clash, and the module shows it on its card, so a broken script says why rather than failing silently.
diff --git a/docs/backlog/backlog-light.md b/docs/backlog/backlog-light.md
index 8ca1324e..16896faf 100644
--- a/docs/backlog/backlog-light.md
+++ b/docs/backlog/backlog-light.md
@@ -290,6 +290,36 @@ The LED-driver increments **shipped**: increment 1 (RMT/WS2812B single-strand on
 
   Compiling inside `defineControls` is NOT the fix (tried): it makes the default script's controls exist before `setSource` runs, and swapping the source then re-seeds every control from its new declared default — the same value-loss, moved. The real fix is ordering: the engine must compile once the persisted `source` is in place but before controls are published, which is a Scheduler-phase question (the same parent-before-child ordering the `const_cast` in `MoonLiveLayout::compile` already works around). Affects all three MoonLive bindings, not just the layout.
 
+- **Xtensa's vreg map violates the windowed ABI** (2026-08-13). ROOT CAUSE, found by comparing a
+  working ESP32-S31 (RISC-V) against a crashing S3 on identical firmware and scripts.
+
+  `call8` rotates the register window by eight: the callee's `a0..a7` ARE the caller's `a8..a15`, so
+  every host call clobbers `a8..a15`. ESP-IDF states it plainly — `a8..a15 clobbered (if
+  window_spill8)` in `components/xtensa/include/xtensa/coreasm.h`. Our map is `a2..a11`, so `a8..a11`
+  hold script values inside the rotation window. Measured crash: `A0 = 0x00000100` — that is
+  `nLights` (256), a script value sitting in the return-address register. Intermittent, because
+  whether it is fatal depends on which vreg held what when the window turned; that intermittency is
+  what made it survive a day of plausible theories.
+
+  Only `a0`(return address), `a1`(sp) and `a2..a7` survive a call, so the safe map is **six** vregs,
+  not ten. Six does not fit today: five are the fixed ABI vregs (`buf`, `nLights`, `cpl`, `t`,
+  `ctrls`), leaving one. Closing this needs those five OFF permanent registers and into the frame —
+  the register-promotion question [Plan-20260813](../history/plans/Plan-20260813%20-%20MoonLive%20on%20a%20stack%20machine%20%E2%80%94%20the%20frame%20is%20where%20values%20live.md)
+  defers on purpose. RISC-V is unaffected: no window, and its `call()` saves 14 registers into an
+  explicit 80-byte frame, which is why the S31 runs layout + plasma + modifier stably.
+
+  Until then a scripted layout, and any effect whose script CALLS a builtin, is unreliable on Xtensa.
+  Straight-line and inline-only scripts (`setRGB`, `fill`) are fine — they emit no call.
+
+- **A scripted LAYOUT crashes on Xtensa: the emitted code is wrong** (2026-08-12). Naming any script on a `MoonLiveLayout` resets an S3 — `addLight(0, 0, 0);` alone is enough. A scripted EFFECT on the same board is fine, which is the whole clue: an effect writes pixels through `setRGB`, a layout calls `addLight`, and only the layout path faults.
+
+  **Measured, so the earlier theories are retired.** Per-stage timings on the S3 read `stat 2.0 ms, alloc 8 us, read 2.7 ms, compile 0.5 ms` — the compile COMPLETES, in about five milliseconds, and the crash comes after it returns. So this is not a slow compile and not the task watchdog running out: tracing either side of `runScript` shows the fault lands *inside the JIT'd code*, as `Guru Meditation Error: Double exception` with a corrupted backtrace, or as `LoadProhibited` at a nonsense address. (Filesystem access IS expensive — ~90% of the load — but that is a cost, not the bug.)
+
+  **The defect is visible in the disassembly.** `uv run moondeck/moonlive/disasm.py '<script text>'` on the grid shape shows the call sequence ending:
+  `mov.n a11, a12` (the call result into the destination) immediately followed by `movi a11, 1`, which overwrites it; the loop then compares against registers restored from the wrong frame slots, so the bounds are not the loop's own. The counters run away and `addLight` is called unboundedly until the host callback exhausts the stack — which is exactly the `Double exception` signature.
+
+  **Xtensa only.** The identical script on the arm64 host backend calls `addLight` exactly 256 times for a 16×16 grid, so the core compiler and the register allocator are right and the fault is in `XtensaAssembler::call` / the Xtensa lowering of a void call whose destination register is a live vreg. No test executes Xtensa code (only arm64 runs in tests), which is why this shipped — the gap the MoonLive plan named. A test that runs emitted Xtensa bytes, or a `disasm.py` assertion over the shipped scripts, is what would have caught it.
+
 - **A scripted modifier that reshapes the grid** (2026-08-10). `ModifierBase::modifyLogicalSize` lets a modifier change the logical `width`/`height`/`depth` — a Multiply kaleidoscope grows the grid, a crop shrinks it — and a compiled modifier uses it. A SCRIPTED one cannot: system variables are read-only, so `MoonLiveModifier` writes the box in and never reads it back. Needs a writable system variable — the binding reads the slots after the script returns and reports the result through `modifyLogicalSize` — which is a new `SysVarKind` (or a mutable flag on `SysVar`) plus the read-back, not a new builtin. Until then a scripted modifier can fold coordinates but not resize the grid they live in.
 
 - **Drain MoonLive's `print()` through a queue** (2026-08-09). `print(v)` writes to serial directly, and an EFFECT script runs on the render tick — so a print inside one blocks the frame for as long as the UART takes. The burst cap bounds it (a handful of writes per compile, then a compare and a return), but bounded is not free, and `tick()` is annotated `MM_NONBLOCKING`.
diff --git "a/docs/history/plans/Plan-20260809 - MoonLive scales \342\200\224 right-sized IR, and the stack as the register overflow.md" "b/docs/history/plans/Plan-20260809 - MoonLive scales \342\200\224 right-sized IR, and the stack as the register overflow.md"
new file mode 100644
index 00000000..edd42650
--- /dev/null
+++ "b/docs/history/plans/Plan-20260809 - MoonLive scales \342\200\224 right-sized IR, and the stack as the register overflow.md"	
@@ -0,0 +1,326 @@
+# Plan: MoonLive scales — right-sized IR, and the stack as the register overflow
+
+> **Steps 1–3 shipped. Steps 4–5 (the register allocator) are SUPERSEDED by
+> [Plan-20260813 — MoonLive on a stack machine](Plan-20260813%20-%20MoonLive%20on%20a%20stack%20machine%20%E2%80%94%20the%20frame%20is%20where%20values%20live.md).**
+> The allocator was built and works on the host at every budget, but on Xtensa it leaves ZERO
+> allocatable registers (10 − 1 scratch − 5 ABI vregs − 4 reload temps), so every looped script is
+> refused there. Bench-measured on an S3. The successor plan puts every variable in the frame
+> instead and keeps registers for expression temporaries only.
+
+## Context
+
+MoonLive scripts hit hard walls far below what a user would call a complex script. Two separate
+ceilings, both measured on the host, neither obvious from the error text (every one reports
+`codegen failed (unsupported on this target, or too large)`):
+
+- **Seven `addLight` statements in a row fail.** `kMaxIrOps = 64` ([MoonLiveIr.h:33](src/core/moonlive/MoonLiveIr.h#L33))
+  and a call costs ~9 IR ops. No nesting, no register pressure — this is the wall a user meets first.
+- **Nested `for` loops are refused on Xtensa.** Measured: `LOWER BAIL: vregsUsed=11 +2 > kRegCount=12`
+  ([moonlive_lower_xtensa.cpp:24](src/platform/esp32/moonlive_lower_xtensa.cpp#L24)). They work on
+  desktop and RISC-V, which have larger register maps. The shipped default layout script `grid.mlv`
+  is a nested loop, so the module's own default cannot compile on the smallest target.
+
+The goal is that a script's complexity is bounded by memory the device actually has, not by
+constants chosen when a script was one statement. That means two changes, and they are
+independent: **right-size the IR** (removes the statement wall) and **spill to the stack**
+(removes the register wall). Neither alone is enough — shipping only the spiller leaves the
+7-statement wall, which is the one users hit first.
+
+Spilling is also the industry-standard answer: values that outlive the register file live in the
+frame. It is what every real compiler does, and it is the mechanism that makes "how complex can a
+script be" a memory question instead of a register-count question.
+
+## Every ceiling, and what happens to it
+
+Seven fixed constants bound a script. They are **not** one problem: what each costs, and where its
+storage lives, decides the treatment. Measured sizes:
+
+| Ceiling | Value | Limits | Where it lives | Treatment |
+|---|---|---|---|---|
+| `kMaxIrOps` | 64 | total instructions | `IrProgram` = **2056 B stack local** ([MoonLiveCompiler.cpp:512](src/core/moonlive/MoonLiveCompiler.cpp#L512)) | **right-size on the heap** — the wall users hit first |
+| `kCodeCap` | 768 B | emitted machine code | `buf_[kCap]` inside the assembler, itself a **1368 B stack local** ([moonlive_lower_xtensa.cpp:28](src/platform/esp32/moonlive_lower_xtensa.cpp#L28)) | **right-size on the heap**, same mechanism |
+| `kMaxVRegs` | 16 | values a program can name | index width in `IrInst` | **raise to 32** once spilling makes >16 usable; `IrProgram::push` keeps validating |
+| `kMaxFixups` | 32 | branches | assembler member | **right-size** with the code buffer (same owner, same lifetime) |
+| `kIrLabels`/`kMaxLabels` | 16 | ~8 loops | IR + assembler members | **right-size** with the op array; the estimator counts `for` tokens |
+| `locals[4]` | 4 | loop nesting depth | Parser, stack | **raise to 8**, 12 B — a fixed bump, not worth an allocation |
+| `kMaxCtrls` | 8 | script-declared controls | 128 B in Parser + the binding's name pool | **raise to 16**; bounded by UI sanity, not by memory. Note the *binding* mirrors this in a fixed name pool, so both move together |
+
+**The constraint that drives this:** `CONFIG_ESP_MAIN_TASK_STACK_SIZE = 12288`
+([sdkconfig.defaults:8](esp32/sdkconfig.defaults#L8)), and the compile path already burns **~3.4 KB**
+of it (`IrProgram` 2056 + assembler 1368, both live at once). Naively raising `kMaxIrOps` to 256
+makes `IrProgram` alone 8 KB of *stack* — a bootloop, not a fix. This project has already lost a P4
+to a large stack frame. So the two big arrays move to the heap and are sized to the script; the small
+ones are simply raised, because 12 B or 128 B does not need an allocator.
+
+## The end state (PO, 2026-08-11)
+
+MoonLive is **bounded by memory, not by registers or fixed arrays** — a fairly complete language,
+large scripts, nice effects. Three goals, and every step towards them is judged against the
+**classic ESP32**: 320 KB internal, no PSRAM, so anything assuming plentiful RAM fails there first.
+(The classic is not structurally blocked — its Xtensa backend compiles and its exec heap is enabled;
+what stopped it was a crash, parked separately.)
+
+1. **Spilling** — register allocation with spilling to the stack, so a script is never refused for
+   naming more live values than the ISA has registers. Linear-scan (Poletto & Sarkar), designed
+   below.
+2. **Scripts on the filesystem** — the source lives on LittleFS, not in a fixed per-module array.
+3. **Classic ESP32 runnability** — the yardstick for all of the above.
+
+### Decided: a heap buffer, not a streaming lexer
+
+Goal 2 could load the script into a right-sized heap buffer for the compile and free it after, or
+stream it from the file so no buffer exists at all. **Heap buffer**, for three reasons:
+
+- **The waste is the fixed array, not the transient buffer.** `source_` + `compiled_` + names is
+  **2240 B per module, always resident — 13.1 KB across six modules, 4.1% of a classic's internal
+  RAM, held whether or not a script is loaded.** A compile-time buffer is proportional to the script
+  and freed immediately; the fixed arrays are permanent and mostly empty. Removing them is the win.
+- **Seeking a file is not simpler than seeking RAM.** LittleFS does wear-levelling and block
+  caching, so `parseFor`'s backward re-lex of the step clause could hit flash mid-compile —
+  unpredictable latency in place of a pointer decrement.
+- **Streaming needs compiler surgery first.** `parseFor` re-lexes the step from a saved source
+  pointer after emitting the body, and `DeclaredControl::name` points INTO the source and outlives
+  the compile (13 sites hold such pointers). Both are fixable, neither is a lexer swap.
+
+Streaming stays possible later; it is an optimisation of a transient allocation, not the thing that
+makes large scripts fit.
+
+**Two consequences:** `kMaxScriptBytes` stops being a ceiling (a script is bounded by heap), and
+`compiled_` — which only answers "did the source change" — becomes a hash rather than a second full
+copy, removing another 1 KB per binding. FNV-1a is already the project's idiom for that.
+
+### Sequence
+
+Each step makes the next cheaper:
+
+1. ✅ **Right-size `IrProgram`** (2026-08-11). The op array is heap-allocated and sized from a
+   token count before parsing; `IrProgram` owns it RAII (destructor frees, copy deleted), so there
+   is no manual free path to miss — unlike the reverted `32026eb5`, whose four independently-
+   nullable tables produced the heap corruption its own comment records. `kMaxIrOps` 64 → 4096 is
+   now a sanity bound, not the working limit: **7 sequential statements used to fail, 40 compile**,
+   and ~2 KB moved off the 12 KB main-task stack.
+
+   **Found while verifying:** widening `count` to `uint16_t` left four `uint8_t` loop counters
+   iterating over it — three lowerers plus `IrProgram::hasInline` — which wrapped at 256 ops and
+   spun forever. On a device that is a watchdog reset from a script that merely got long. Bisected
+   (60 statements fine, 80 hung), fixed, and pinned by a test that HANGS when the fix is reverted.
+   The first version of that test passed either way: repeated statements hit the code-buffer
+   ceiling before reaching the wrap, so it needed a long arithmetic chain instead — many cheap ops,
+   little emitted code.
+
+   **Still standing:** `kCodeCap` is a separate ceiling and now the binding one (40 statements
+   exceed it on Xtensa), as are `kIrLabels`, `locals[4]` and `kMaxVRegs`.
+2. **Scripts on the filesystem.** Independent of the compiler work — different files, different
+   risk — and the step that most helps the classic.
+3. **Spilling.** By then it has stack headroom and no 1 KB source ceiling to fight. Landing it first
+   would put the hardest algorithm on the tightest stack budget, where an overrun reads as a
+   bootloop rather than a compiler bug.
+
+## Decisions taken
+
+- **Allocate to fit the script, not to `kMax`.** The op array and the code buffer move to a
+  right-sized `platform::alloc` ([platform.h:55](src/platform/platform.h#L55)), sized from a cheap
+  pre-pass over the source and freed when compilation ends. A one-statement script pays for one
+  statement instead of 3.4 KB, so this *reduces* peak memory for the common case while removing the
+  ceiling for the rare one. Compilation is cold-path, so an allocation there costs nothing that
+  matters.
+- **Raise the cheap ceilings rather than allocating them.** `locals`, `kMaxCtrls` and `kMaxVRegs` are
+  tens of bytes. Subjecting them to an allocator would add machinery that buys nothing — the standard
+  construct is only worth it where the size actually varies.
+- **The spill algorithm lives in core, once.** Correct spilling across a loop back-edge is the
+  hardest logic here, and only the arm64 backend is ever executed by tests — three copies would
+  leave two permanently under-tested. Backends supply their register count and consume two new IR
+  ops. (CLAUDE.md Principle 3: core owns the hard constructs, written once.)
+- **Spill everywhere, not interval splitting.** Once a value is chosen for spilling it is spilled
+  for its whole lifetime: every def stores, every use reloads. Splitting halves the reload traffic
+  but the correctness argument across a back-edge is exactly the part that goes wrong. The simple
+  form is provably safe and these loops are cold-path.
+- **Fix the RISC-V scratch aliasing first, on its own.** Verified bug, latent today: `kScratchFn = 16`
+  ([moonlive_asm_riscv.cpp:20](src/platform/esp32/moonlive_asm_riscv.cpp#L20)) is x16/a6, but
+  `kRvReg[12] == 16` — so it *is* vreg R12. In `call()`, `mv a6, a0` stashes the result, the restore
+  loop reloads x16 from frame offset 48 and destroys it, then `mv dst, a6` returns R12's stale value.
+  It only bites when `vregsUsed > 12`, which is precisely what this work causes. Landing it inside
+  the feature would make the first hardware symptom look like "the new spiller broke calls".
+- **Not in scope: narrowing `call()`'s save-sets.** The spill pass computes exactly the
+  live-across-call mask that would shrink RISC-V's 18-register and arm64's 14-register unconditional
+  saves. Deliberately deferred: an over-long interval only costs an unnecessary spill (fail-safe),
+  whereas a register wrongly omitted from a save-set corrupts a value (fail-dangerous) from the same
+  analysis. Ship the safe consumer first, backlog the other by name.
+
+## Design
+
+### 1. Right-sized IR and code buffer (removes the 7-statement wall)
+
+`IrProgram` gains a heap op array instead of `IrInst ops[kMaxIrOps]`:
+
+```cpp
+struct IrProgram {
+    IrInst*  ops = nullptr;      // platform::alloc'd to fit; freed in the destructor
+    uint16_t cap = 0;            // what was allocated
+    uint16_t count = 0;
+    VReg     vregsUsed = kFirstTemp;
+    bool reserve(uint16_t ops);  // false on alloc failure — degrade, never crash
+};
+```
+
+The **assembler gets the same treatment**: `buf_[kCap]`, `labelPos_[]` and `fixups_[]` become one
+right-sized allocation with the same lifetime. This is the other 1368 B of stack, and `kCodeCap` is
+a ceiling in its own right — a long script overflows the code buffer even when its IR fits.
+
+**Sizing.** One cheap pre-pass over the token stream counts statements, call arguments and `for`
+keywords, then multiplies by the known worst-case ops (and bytes) per construct. Over-estimating is
+free — a few unused entries; under-estimating must be impossible, so the estimator is deliberately
+conservative and `push()`/`emit()` still fail cleanly if it is ever wrong. The existing
+`overflow_` path stays as the backstop it already is.
+
+`count`/`cap` widen to `uint16_t`, so the ceiling stops being a `uint8_t`. `kMaxIrOps` and `kCodeCap`
+survive as upper *sanity* bounds — a runaway script fails with a diagnostic rather than exhausting
+the heap — not as the working limit.
+
+Both allocations are freed when compilation ends: they are compile-time scratch, not part of the
+running program. The only thing that outlives a compile is the exec block, which is unchanged.
+
+### 2. Spill to the frame (removes the register wall)
+
+**The frame is a call frame, not a slot file.** Script-local functions are the next feature: callable
+from the script, taking arguments, containing loops and `if`, calling other functions, and
+recursive. A recursive function's spill slots cannot be one fixed region — each activation needs its
+own — so slots are addressed as offsets from a frame pointer that a prologue establishes, which is
+the layout a nested call reuses by pushing another frame. Spilling one top-level program is what
+ships here; the frame discipline is chosen so functions add a call sequence rather than a redesign.
+
+**New IR ops** ([MoonLiveIr.h](src/core/moonlive/MoonLiveIr.h)):
+
+```cpp
+Spill,     // slot[imm] = a
+Reload,    // dst = slot[imm]
+```
+
+**New core pass** `src/core/moonlive/MoonLiveSpill.{h,cpp}`:
+
+```cpp
+/// Rewrite `ir` so no op names a vreg the target does not have, inserting Spill/Reload against a
+/// fixed slot file. False when even the spilled form does not fit (fail, never miscompile).
+bool spillToBudget(IrProgram& ir, const RegBudget& budget);
+```
+
+**Algorithm: linear-scan register allocation** (Poletto & Sarkar) over the op array, with
+**loop-extended live intervals**. Three passes, no heap beyond the interval array:
+
+- **Find loops.** The grammar has no `break`, `continue` or `goto`, so a loop is exactly a
+  `BranchNe` whose target label is bound earlier in the array. The op array is therefore already in
+  reverse-postorder and no CFG needs building — that is the one bespoke simplification, and it
+  carries a guard: a branch pattern that is *not* properly nested makes the pass refuse rather than
+  allocate against a wrong interval, so a future `break` fails loudly instead of miscompiling.
+- **Naive intervals**, then **loop extension**: any value live at a loop header is live to the end of
+  that loop, applied innermost-first. This is the step naive "first def to last use" gets wrong, and
+  it is conservative — it can only lengthen an interval, so it may cost a needless spill but never
+  produces a wrong one.
+- **Scan**, spilling the active interval with the furthest end when no register is free.
+
+**Backend surface** — identical on all three, and the algorithm appears nowhere in the platform layer:
+
+```cpp
+void prologue(uint8_t slots);        // slots == 0 emits nothing: a non-spilling script pays zero
+void spillStore(Reg r, uint8_t slot);
+void spillLoad(Reg r, uint8_t slot);
+```
+
+Each lowerer gains two switch arms and *loses* its hand-rolled budget bail (the three duplicated
+`vregsUsed + N > kRegCount` checks collapse into the one core pass).
+
+Where the slots live differs per target and is the real per-backend work:
+
+| backend | frame today | spill slots |
+|---|---|---|
+| Xtensa | whole-routine 48 B from `entry a1, 48`; `call()` uses 16/20/24/28 | bytes 32–47 are free — 4 slots at zero cost; `entry` immediate grows for more |
+| RISC-V | **none outside `call()`** (`prologue()` is empty) | needs a real 2-instruction prologue/epilogue; `encSw`/`encLw` already exist at file scope |
+| arm64 | **none outside `call()`**; the `call()` frame is 100% full | needs a prologue *and* two new `str`/`ldr` encoders — the only backend with no general store/load |
+
+### 3. Conditional inline scratch (the cheap part of the register fix)
+
+All three lowerers reserve scratch vregs for `FillElems` unconditionally — `+3` on host, `+2` on
+Xtensa and RISC-V — even when the program contains no such op. A layout script never emits one. This
+single unconditional reservation is what makes `grid.mlv` (11 vregs, budget 12) fail on Xtensa.
+Core reports which inline ops a program actually contains; each backend maps that to its own scratch
+count. Nested loops compile on Xtensa from this alone, and it is the `RegBudget.reserved` field the
+spill pass consumes — not throwaway.
+
+## Files
+
+- `src/core/moonlive/MoonLiveIr.h` — heap op array, `uint16_t` counts, `Spill`/`Reload`,
+  `inlineScratch()`, the raised `kMaxVRegs`/`kIrLabels`
+- `src/core/moonlive/MoonLiveSpill.{h,cpp}` — **new**, the linear scan
+- `src/core/moonlive/MoonLiveCompiler.cpp` — the sizing pre-pass, the pass call site (~line 516), the
+  temp allocator's failure path (lines 141-160), `locals[]` and `kMaxCtrls`
+- `src/light/moonlive/MoonLive{Layout,Effect,Modifier}.h` — the bindings' `ctrlNames_` name pool
+  mirrors `kMaxCtrls` and must grow with it, or the extra controls compile but never appear in the UI
+- `src/core/moonlive/moonlive_emit.h` — the `RegBudget` seam
+- `src/platform/esp32/moonlive_asm_riscv.cpp` — the `kScratchFn` fix (line 20), prologue + spill surface
+- `src/platform/desktop/moonlive_asm_host.{h,cpp}` — new `str`/`ldr` encoders, prologue; the only
+  backend tests execute
+- `src/platform/esp32/moonlive_asm_xtensa.{h,cpp}` — promote the private `s32i`/`l32i` lambdas to the
+  spill surface
+- the three `moonlive_lower_*.cpp` — two switch arms each, minus their budget bails
+- `moondeck/moonlive/` — generalise `emit_xtensa.cpp` to an ISA flag so `disasm.py --isa riscv` works
+- `docs/moonmodules/light/MoonLive*.md`, `moonlive/README.md` — the new limits
+- `docs/backlog/backlog-light.md` — narrow `call()` save-sets, by name
+
+Add a `static_assert` per backend that no scratch register appears in its vreg map — the invariant
+the RISC-V bug broke, made unbreakable rather than commented.
+
+## Verification
+
+The governing risk: **only arm64 is executed by tests**; Xtensa and RISC-V are compile-time-excluded
+and validated on hardware. So arm64 carries the correctness proof, and the device backends carry
+only encoding risk, which `disasm.py` retires without a flash.
+
+1. **The key test — a squeezed budget on the host.** A test-only budget override runs
+   `spillToBudget` with a register count *smaller* than the host's, forcing the spiller to run on the
+   one backend that executes. Same script compiled at full and squeezed budgets must produce
+   identical pixels. This makes the hard algorithm testable rather than hardware-only.
+2. **The back-edge case specifically**: a nested loop at a squeezed budget where the counters are
+   guaranteed spilled — every expected light placed exactly once.
+3. **Spill across a call**: value spilled, `random16()` called, value used. Proves slots survive
+   `call()`'s own frame — the RISC-V case to check hardest, since prologue and `call()` both move sp.
+4. **One test per ceiling**, each a script that fails today and must pass after — this is what proves
+   the overview table was actually delivered rather than partly delivered:
+   - 30+ straight-line statements (`kMaxIrOps`, fails at 7 today)
+   - a script whose emitted code exceeds 768 bytes (`kCodeCap`)
+   - 6-deep loop nesting (`locals`) and 10+ loops in one script (`kIrLabels`/`kMaxLabels`/`kMaxFixups`)
+   - 12 declared controls (`kMaxCtrls`) — and the *binding* surfaces all 12, since it mirrors the cap
+     in its own name pool
+   - a script needing more than 16 live values (`kMaxVRegs`, only reachable once spilling works)
+5. **Stack, not just heap**: assert the compile path's stack frame *shrank*. `IrProgram` and the
+   assembler stop being 3.4 KB of stack locals; a one-statement script must allocate proportionally
+   less than a hundred-statement one. Without this the change could pass every functional test while
+   quietly moving the bootloop somewhere else.
+6. **Degrade**: a deliberately absurd script fails with a clear diagnostic and no crash; an alloc
+   failure in `reserve()` fails the compile cleanly rather than writing through a null pointer.
+6. **Unchanged behaviour**: `unit_moonlive_ir` / `unit_moonlive_fill` (the `fill` behavioural golden,
+   and kArg4 surviving a call) stay green — they pin that a `FillElems` program still gets its
+   scratch. `unit_MoonLiveScripts.cpp:118` (bare vs commented produce equal length) is the canary for
+   the pass accidentally becoming source-dependent.
+7. **Encodings on device backends without flashing**: `uv run moondeck/moonlive/disasm.py` on a
+   spilling script, reading the actual `s32i`/`l32i` offsets against the frame layout. This is the
+   tool that found the `Mov`→`addi 0` bug. Extend it to RISC-V, which has no equivalent today.
+8. **Memory + hot path**: `collect_kpi.py --commit`. The IR allocation is cold-path, but a modifier
+   script runs once per light, so measure a mapping rebuild on a large grid. Confirm a non-spilling
+   script emits no prologue and costs nothing.
+9. **Hardware, the final gate (PO)**: flash `grid.mlv` on an S3 (Xtensa — the target that fails
+   today) and a P4 (RISC-V — the target with the scratch bug), and look at the wall.
+
+## Suggested commit boundaries
+
+The PO decides commits and branches; this is the order that keeps each step independently
+verifiable, riskiest-last:
+
+1. RISC-V `kScratchFn` aliasing fix + the `static_assert`s (independent bug)
+2. Conditional inline scratch — nested loops compile on Xtensa
+3. Right-sized IR + code buffer, and the cheap ceilings raised (`locals`, `kMaxCtrls`, `kIrLabels`,
+   `kMaxFixups`) — the 7-statement wall goes and the compile stack shrinks
+4. Spill surface on the three assemblers (encodings verifiable in isolation, dead code until 5)
+5. The core spill pass + `kMaxVRegs` raised — the register ceiling goes
+
+Steps 1–3 deliver the ceiling a user meets first and are independently shippable; 4–5 are the
+spiller. If the branch needs splitting for review size, that is the seam.
diff --git "a/docs/history/plans/Plan-20260813 - MoonLive on a stack machine \342\200\224 the frame is where values live.md" "b/docs/history/plans/Plan-20260813 - MoonLive on a stack machine \342\200\224 the frame is where values live.md"
new file mode 100644
index 00000000..c53d0f17
--- /dev/null
+++ "b/docs/history/plans/Plan-20260813 - MoonLive on a stack machine \342\200\224 the frame is where values live.md"	
@@ -0,0 +1,352 @@
+# Plan: MoonLive on a stack machine — the frame is where values live
+
+Supersedes [Plan-20260809 — MoonLive scales](Plan-20260809%20-%20MoonLive%20scales%20%E2%80%94%20right-sized%20IR,%20and%20the%20stack%20as%20the%20register%20overflow.md),
+whose steps 1–3 shipped and stand. This replaces its steps 4–5 (the register allocator) with a
+different answer to the same goal.
+
+## Why the change
+
+The 20260809 plan set the right goal — a script bounded by memory, not by register count — and
+reached for register allocation with spilling. That shipped, works on the host at every budget from
+14 registers down to 10, and is textbook-correct.
+
+It still leaves MoonLive broken on Xtensa, and the arithmetic says it always will:
+
+```
+10 registers (a2..a11)  −  1 inline scratch  =  9
+                        −  5 fixed ABI vregs =  4
+                        −  4 reload temps    =  0 keepable
+```
+
+Zero keepable registers means the allocator has nothing to allocate with, so **every looped script
+is refused on Xtensa** — `codegen failed (unsupported on this target, or too large)`. Bench-measured
+on an S3: straight-line scripts run, every `for` is refused. The ten is not negotiable: a12/a13 are
+call scratch and the address register for `store8`, and a14/a15 carry the routine's own `retw.n`
+return linkage (using them as vregs is what corrupted the return path and produced
+`Guru Meditation (IllegalInstruction)` on every scripted layout).
+
+So on the smallest supported target the allocator's working budget is zero. A design whose margin is
+zero on the platform it exists to serve is the wrong design, however correct its algorithm.
+
+## The decision: a stack machine
+
+**Every script variable gets a home in the call frame.** A read is a load from a frame offset, a
+write is a store to it. Registers hold expression temporaries only, for the span of one expression.
+
+It is also the shape prior art on this chip settles on: every variable carries a stack position,
+values move by `l32i`/`s32i` against the frame pointer, and registers come from a small rotating
+pool popped for expression temporaries.
+
+### Why this is subtraction, not a sideways move
+
+The register model makes every language feature interact with the allocator. The stack model makes
+each one an application of the same recursive mechanism:
+
+| feature | register machine | stack machine |
+|---|---|---|
+| nested `for` | loop-extended live intervals, innermost-first | nesting is nesting |
+| `if` | live-range merge at the join | a branch over a region; storage is untouched |
+| function call | live-across-call analysis, a save-set per call site | push args, `call`; callee addresses its own frame |
+| function arguments | bounded by spare vregs (ours is fixed at 3) | as many slots as you push |
+| recursion | a fixed slot file cannot hold two activations | each activation gets its own frame |
+| local functions calling each other | compounding of all of the above | nesting again |
+
+In a stack machine a function's frame size falls out of the same stack position that placed the
+variables, and an argument is one more slot in that frame. One mechanism, three jobs — locals,
+arguments and the frame itself.
+
+What this deletes: `MoonLiveSpill.{h,cpp}` (375 lines), `RegBudget` and its 34 plumbing sites across
+three lowerers, the reload-temp accounting, loop-extended interval analysis, and `kMaxVRegs` as a
+ceiling. CLAUDE.md Principle 3: *the first question on any change is what it can remove.*
+
+### What it costs
+
+A variable access becomes a load or a store rather than a register reference — roughly two extra
+instructions per touch. On arithmetic-heavy inner loops expect 20–40% slower; on scripts dominated
+by host calls (`setRGB`, `beat`, `sin`, and every layout's `addLight`, which is a `call8`) the
+difference is close to nothing, because the call already dwarfs a pair of loads.
+
+Two things make that the right trade today. Architecture.md's claim is "near-hand-written speed **in
+the hot path**", and the hot path is the inline buffer write and the host calls, not counter
+arithmetic. And the honest comparison is not slower-versus-faster: on Xtensa the current alternative
+is *refused*. A script that runs slightly slower beats a script that does not compile.
+
+### One implementation per construct, not one per target
+
+A stack machine makes most of the lowering ISA-independent, and that has to be spent on removing
+duplication rather than replicating a simpler design three times. Measured today: the three lowerers
+are 142/138/150 lines and roughly **65% identical** (48 differing lines between Xtensa and RISC-V
+after normalising names) — the same walk over the same IR, three times.
+
+What is genuinely per-target is small and nameable: instruction encodings, the register/frame ABI,
+and the branch forms. Everything above that — how a `for` becomes an entry guard and a back edge,
+how a call passes arguments, how an expression evaluates, where a variable's frame slot is — is one
+algorithm that belongs in core, written once.
+
+**The rule for this rework:** a new target should be a new *assembler* (encodings + ABI constants),
+not a new lowerer. Adding an 8086, an ARM32, or anything else must not mean copying the IR walk
+again. Where a construct genuinely differs per ISA, the difference is a named hook on the assembler
+surface — not a forked copy of the surrounding logic. This is CLAUDE.md Principle 3: core owns the
+hard construct, written once; the platform layer holds only what is truly platform-specific.
+
+### One binding, three roles
+
+The same duplication exists in the light domain. `MoonLiveLayout`, `MoonLiveEffect` and
+`MoonLiveModifier` are 196/140/182 lines and each carries its own copy of the same machinery:
+`char script_[32]`, `uint32_t compiledHash_`, a `MoonLive engine_`, and the load-compile-cache-report
+sequence around them. A fourth role (a scripted DRIVER) is coming, and it must not mean a fourth copy.
+
+Factor the shared part into one place — the script name, the compiled-content hash, the engine, the
+compile-on-demand-and-report path, and the "a failed load leaves a decided state" rule that a bug
+this session had to fix in the layout alone. What stays per-role is only what genuinely differs:
+what the compiled program is called with, and what it does with the result.
+
+Architecture.md already states the standard this meets: *"When a scripted binding needs a mechanism
+its compiled sibling does not, that is a finding: either the mechanism belongs in the base for
+everyone, or the divergence needs its reason stated where it is introduced."* Three copies of the
+same mechanism is the same finding, one level down.
+
+### One system-variable vocabulary, not three
+
+The three roles are handed three different `SysVarTable`s today — `layoutSysVars` (the clock only),
+`effectSysVars` (+ `width`/`height`/`depth`) and `modifierSysVars` (+ `x`/`y`/`z`). **Collapse them
+into one table every script gets**, and let the script author use what makes sense for the job.
+
+The current split buys less than it costs. It does not prevent a mistake — a layout that reads
+`width` gets a compile error rather than a wrong answer, which is the same outcome as reading a
+variable that is always zero — and it creates a trap: the tables are *different vocabularies, not
+nested ones*, so a name means one thing in one role and is reserved in another. That trap is not
+theoretical. A layout may use `x`/`y` as ordinary loop counters precisely because it is NOT handed
+them, which the shipped `grid.mlv` does — and `disasm.py`, which compiled everything against the
+widest table, therefore refused the one script most worth inspecting with "name is a system
+variable". The tool was blind to the default layout for as long as it existed, and that cost more
+debugging time this session than any single bug.
+
+Two changes make one table work:
+
+- **`width`/`height`/`depth` mean the same thing in every script**: the dimensions of the grid. A
+  layout DEFINES them by the coordinates it places; an effect and a modifier READ them. Same name,
+  same meaning, no per-role reservation.
+- **A modifier's per-light coordinate is renamed `xPos`/`yPos`/`zPos`.** `x`/`y`/`z` are the names a
+  script author naturally reaches for as loop counters, so reserving them globally would break the
+  most ordinary code there is. The renamed form is unambiguous, and it frees `x`/`y`/`z` for their
+  obvious use everywhere.
+
+The arena offsets are already fixed constants (`kSysWidth`, `kSysX`, …) shared by every role, so
+this is removing a distinction the storage layer never made — not introducing one. What a binding
+still decides is which slots it WRITES each frame; reading is uniform.
+
+This is a breaking change for any script using a modifier's `x`/`y`/`z`, so it needs its
+[MIGRATING.md](../../MIGRATING.md) entry and a sweep of the shipped `moonlive/` scripts.
+
+### Clean first, with speed decisions made deliberately
+
+Build the industry-standard construct first and keep it whole. Where a compromise is genuinely
+needed for speed, make it **at that moment, explicitly, with its reason recorded next to it** — not
+by pre-emptively complicating the design against a cost nobody has measured.
+
+That means: no speculative fast paths, no "we might need this in a register" hedges, and no
+special-casing a construct because it *might* be hot. Write the clean form, measure it
+(`collect_kpi.py`, and the bench), and when a number says a specific thing is too slow, fix that
+specific thing and say why in a comment where it lives. A compromise with its rationale attached is
+maintainable; a design pre-bent around an unmeasured fear is not.
+
+### The limits: which are physics, which are choices
+
+"Bounded by memory, not by constants" needs to know which constants can actually move. Measured:
+
+**Hardware-fixed — these cannot be raised at all.**
+
+| limit | ceiling | why |
+|---|---|---|
+| `kRegCount` | Xtensa **10**, RISC-V 14, host 14 | the machine's register file — the wall this whole plan routes around |
+| `kArenaBytes` | 255 | `LoadCtrl` lowers to `l8ui`/`lbu`, whose offset immediate is one byte |
+
+**Chosen numbers, far below what the hardware allows — raisable when there is a reason.**
+
+| limit | now | hardware allows | what raising costs |
+|---|---|---|---|
+| `kMaxSpillSlots` / `kMaxLocals` | 16 | **243** on Xtensa (`s32i`'s offset byte counts 4-byte words; `entry` reaches a 32 KB frame), **512** on RISC-V | 16 B per local in `locals[]`, plus frame bytes per running script |
+| `kMaxVRegs` | 32 | 255 (the index is a `uint8_t`) | `Interval iv[]` in the spiller, ~16 B per vreg of compile stack |
+| `kIrLabels` | 16 | 255 | 32 B per lowerer |
+| `kMaxCtrls` | 8 | the arena's 255, minus the system variables | 16 B each — and the UI has to render them |
+
+**Already unbounded in practice.** `kMaxIrOps` and `kCodeCap` size HEAP allocations that are already
+right-sized per script, and `platform::alloc` prefers PSRAM where a device has it. They are sanity
+bounds so a runaway source fails with a diagnostic rather than exhausting the heap — not working
+limits. The remaining fixed arrays total roughly 600 bytes per compile (`locals[16]` at 256 B is the
+largest); moving those to the heap would add allocation, failure paths and lifetimes to save half a
+kilobyte on a cold path, which is the opposite of subtraction.
+
+**`kMaxLocals` and `kMaxSpillSlots` must move together.** They index the ONE frame: the front end
+numbers a script's variables from zero and the register allocator numbers its spills above them, so
+raising one alone silently shrinks the other's room. `spillToBudget` refuses a compile when the front
+end asks for more slots than the backend can address, which turns a mismatch into a diagnostic rather
+than a truncated offset writing over a live value.
+
+**Do not raise any of these speculatively.** Once variables live in the frame, frame slots — not
+registers — are what a complex script consumes, so `kMaxLocals` becomes the real ceiling on script
+size. Set it from a measurement once the mechanism exists, not from a guess before it does.
+
+### Register optimization is explicitly out of scope
+
+Deliberately deferred, in full, including the tempting parts:
+
+- No promotion of hot values into registers.
+- No pinning of the fixed ABI vregs (`buf`, `nLights`, `cpl`, `ctrls`, `t`) — **whether any of them
+  stay in registers is itself a register decision, and it is reopened, not assumed.** They may all
+  live in the frame in the baseline.
+- No caching of the innermost loop counter.
+
+The reason is that register optimization intertwines with everything it touches; adding it to a
+design that already has it half-present makes both harder to read. Get a clean stack machine first,
+measure it, and then decide what — if anything — to promote, as an addon over a correct baseline.
+That inverts the failure mode from "refuse to compile" to "compile, possibly slower", which is the
+Robustness principle.
+
+## Verification comes first
+
+Today's session produced five wrong theories about emitted Xtensa code, each plausible from reading
+the source, each falsified by the device. The lesson is that **no test executes Xtensa code** — only
+arm64 runs in tests, so a codegen defect ships silently and is debugged by flashing.
+
+That gap is fixed **before** the rework, not after:
+
+1. **Golden-bytes tests over the shipped scripts.** `disasm.py` emits Xtensa for a script on the
+   host; assert the byte stream for `grid.mlv` and friends. Any codegen change that alters emission
+   fails loudly and visibly, with the diff readable.
+2. **A structural checker on emitted code**: every branch and jump target lands on an instruction
+   boundary inside the program; frame offsets stay inside the frame `entry` allocated; no
+   instruction names a register outside the backend's map. These are the three defect classes found
+   today, each made unrepeatable.
+3. **Keep the squeezed-budget behavioural tests.** They pin that the same script computes the same
+   pixels regardless of storage decisions — which is exactly the invariant this rework must preserve.
+
+`disasm.py` itself needed two fixes to be usable at all (it did not link `MoonLiveSpill.cpp`, and it
+compiled every script against `modifierSysVars()` — so `x`/`y` were reserved and it had never once
+successfully read the shipped `grid.mlv`). Tool blindness cost more time this session than any bug.
+
+## Sequence
+
+Each step is independently verifiable, and the branch stays green throughout:
+
+1. ✅ **The emitted-code tests above**, against current behaviour. Two per-ISA test TUs share one
+   body, so the checks are written once: the device backends now compile and run on the development
+   machine through a `lower` seam on `compileSource`. 11 tests.
+2. ✅ **A frame slot per script variable.** A loop's counter and limit each get a slot; reading a
+   variable emits a Reload into a temp that dies immediately. The guard that protected locals'
+   registers is GONE — every vreg reaching freeTemp is now a temp. Measured on Xtensa: grid.mlv
+   212 → 186 bytes, and three-deep nesting compiled for the first time.
+3. ✅ **Registers become expression temporaries.** Call arguments are staged through the frame —
+   each is parked as soon as it is computed and all are reloaded for the one instruction that reads
+   them, so only ONE argument holds a register at a time. This is what let a looped effect, a
+   four-deep nested layout and plasma compile on Xtensa at all.
+3b. ⬜ **The HOST ARGUMENTS go to the frame too** (`buf`, `nLights`, `cpl`, `t`, `ctrls`). They are
+   read by the inline ops and LoadCtrl and never written, yet they permanently occupied FIVE
+   registers — on Xtensa, five of the six the windowed ABI leaves a routine that calls. Parked at
+   entry and reloaded where read, they cost a load at the point of use and free the register file
+   for temporaries. This belongs in CORE, not in a lowerer: it is the same "the frame is where
+   values live" rule the script's own variables follow, and doing it per backend would be three
+   copies of one policy — the duplication step 4 exists to remove.
+4. **Collapse the three lowerers into one.** With storage no longer per-target, the IR walk is one
+   algorithm; what remains per-backend is encodings, the frame/ABI constants and the branch forms.
+   Verify by adding nothing to the platform layer that is not genuinely platform-specific.
+5. **Delete the allocator** (`MoonLiveSpill.{h,cpp}`, `RegBudget`, the per-backend budget plumbing)
+   once nothing calls it. The `prologue(slots)` / `spillStore` / `spillLoad` surface on the three
+   assemblers is KEPT — it is already frame-addressed through a frame pointer for exactly this
+   reason, and the stack machine uses it directly.
+6. **One system-variable table for every role**, with a modifier's coordinate renamed to
+   `xPos`/`yPos`/`zPos`. Independent of the codegen work — different files, no shared risk — so it
+   can land whenever, but it comes before step 7 because it is what makes the bindings differ by
+   almost nothing. Needs a MIGRATING entry and a sweep of the shipped scripts.
+7. **Factor the three bindings onto one shared base**, so the script name, hash, engine and the
+   compile-and-report path exist once. The scripted driver that follows should then be a small
+   subclass, and that is the test of whether this step actually worked.
+8. **Bench: S3 and P4**, a scripted layout and a scripted effect, both with nested loops.
+9. **Measure** with `collect_kpi.py` and record the cost honestly in performance.md, so the later
+   decision about register promotion is made against numbers rather than intuition.
+
+Steps 4, 6 and 7 are the deduplication, and they come AFTER the mechanism works rather than during it —
+collapsing three copies while the design underneath is still moving would mean doing it twice.
+
+## Xtensa: the one target still failing, and why
+
+**Status after steps 1-3: two of three targets run the whole stack.** Desktop (arm64) renders a
+scripted grid layout with a plasma effect at 76,923 fps. An ESP32-S31 (RISC-V) has held layout +
+effect + modifier for over an hour. An ESP32-S3 (Xtensa) crashes on any script that stores a pixel,
+and did so before this rework too — this is a pre-existing backend defect the stack machine exposed,
+not one it introduced.
+
+### What a windowed register ABI is
+
+Most CPUs have a **flat** register file: one set of registers, and a function that wants to keep a
+value across a call must save it to the stack itself. Every save is an instruction you can read in
+the disassembly.
+
+Xtensa instead has a large physical register file (64 registers) of which a function sees a **window**
+of 16 at a time. `call8` does not jump — it *rotates the window by eight* before jumping. The callee's
+`a0..a7` are physically the caller's `a8..a15`, and the callee's `entry` instruction slides the window
+further. Nothing is saved by an instruction; the renaming IS the save. When the physical file wraps
+around, hardware exception handlers spill the oldest window to the stack automatically.
+
+### Why Xtensa has it and the others do not
+
+It was a 1990s answer to "calls are expensive": rotating a window makes a call cheaper than pushing
+registers, which mattered when memory was slow relative to the core. SPARC made the same choice.
+Modern designs went the other way — RISC-V and ARM64 both use a flat file with an explicit
+caller/callee-saved split, because compilers got good at register allocation and a predictable,
+visible ABI is worth more than saved store instructions. Xtensa is a configurable core and ESP32
+ships the windowed option, so the ESP32 classic and S3 have it; the P4 and S31 are RISC-V and do not.
+
+### Why this breaks a JIT specifically
+
+A compiler emitting Xtensa knows the rule and never puts a live value in `a8..a15` around a call. Our
+backend chose its vreg map by counting free registers rather than by asking which survive a call:
+`kXtReg` is `a2..a11`, and ESP-IDF's own `coreasm.h` states plainly that `a8..a15` are **clobbered**
+by `call8`. So four of ten vregs sat inside the rotation window. The measured crash had `A0 = 0x100`
+— the value 256, which is `nLights`, a script value that had landed in the return-address register.
+
+Three separate defects of this family have already been found and fixed here: `a14`/`a15` used as
+vregs (they carry the `retw.n` linkage), the call RESULT stashed in `a12` (the callee's `a4` after
+rotation, so the callee overwrote it), and branch displacements truncated past ±127. None of them can
+exist on a flat-file backend, which is exactly why arm64 and RISC-V never showed a symptom.
+
+### How to deal with it: make it look flat
+
+**Yes — the windowed ABI can be treated as flat, by simply not using the window.** Two options:
+
+1. **Restrict the vreg map to `a2..a7`** — the six registers that survive `call8` — and treat
+   `a8..a15` as if they did not exist. The rotation still happens on a call, but no value we care
+   about lives in the rotated range, so it becomes invisible. This is the smaller change and it makes
+   the Xtensa backend behave exactly like the flat ones.
+
+2. **Use `call4` instead of `call8`** — rotating by four leaves `a4..a15` intact for the caller. It
+   widens the usable range, but the callee then sees a smaller window, and every host builtin is
+   ordinary compiled C we do not control. Rejected: it constrains code we do not own.
+
+Option 1 is the plan. The blocker is arithmetic, and it is precisely what step 3b removes: six
+registers minus the five permanently held by the host arguments leaves one, which fits nothing. Park
+the host arguments in the frame — the same rule every other value now follows — and six registers is
+ample, because after steps 2 and 3 registers only ever hold one expression's temporaries.
+
+**So the Xtensa fix is not a special case; it is step 3b plus a one-line map change.** That is the
+argument for doing 3b next rather than treating Xtensa as its own problem: the same subtraction that
+simplifies all three backends is what makes the smallest one correct.
+
+An attempt at 3b during this session got every shipped script compiling on Xtensa at eight registers,
+then hit a SIGSEGV in the HOST backend and was reverted. The cause is known: register numbering is
+derived independently in four places — core's compaction, the spill pass's reservations, each
+lowerer's scratch arithmetic, and each assembler's map — and moving the host arguments perturbs all
+four. `src/core/moonlive/register-and-slot-contract.md` now writes that ownership down, and 3b should
+be re-attempted against it rather than by iteration.
+
+## Then, separately
+
+Only after the above is on main and measured:
+
+- Whether to promote anything into registers, and which — including whether any of the fixed ABI
+  vregs earn a register at all.
+- Script-local functions with arguments, `if`, and recursion — the features this design exists to
+  make cheap.
+- A scripted DRIVER as the fourth role, which is the honest test of step 6: if it needs more than a
+  small subclass, the factoring did not go far enough.
diff --git a/docs/metrics/repo-health.json b/docs/metrics/repo-health.json
index 69cf5d69..5be5a2bd 100644
--- a/docs/metrics/repo-health.json
+++ b/docs/metrics/repo-health.json
@@ -1,21 +1,21 @@
 {
-  "commit": "9d77ade4",
+  "commit": "97d004ff",
   "flash": {
-    "esp32": 1762368,
-    "esp32p4-eth": 1604272,
+    "esp32": 1715008,
+    "esp32p4-eth": 1609440,
     "esp32p4-eth-wifi": 1793760,
-    "esp32s3-n16r8": 1753232,
+    "esp32s3-n16r8": 1758976,
     "esp32s3-n8r8": 1753232,
-    "esp32s31": 2025600,
-    "desktop": 1137928,
+    "esp32s31": 2032000,
+    "desktop": 1155944,
     "esp32-16mb": 1714608,
-    "esp32-eth": 1324928,
+    "esp32-eth": 1324816,
     "esp32-wrover": 1765504
   },
   "perf": {
     "desktop": {
-      "tick_us": 129,
-      "fps": 7751
+      "tick_us": 252,
+      "fps": 3968
     },
     "esp32": {
       "tick_us": 2151,
@@ -23,54 +23,54 @@
     }
   },
   "loc": {
-    "core": 16980,
-    "light": 24317,
-    "platform": 12860,
+    "core": 17620,
+    "light": 24495,
+    "platform": 13226,
     "ui": 6468,
-    "test": 41246,
-    "moondeck": 20323
+    "test": 41840,
+    "moondeck": 20346
   },
   "comments": {
     "core": {
-      "lines": 6402,
-      "ratio": 0.41
+      "lines": 6659,
+      "ratio": 0.411
     },
     "light": {
-      "lines": 9427,
-      "ratio": 0.429
+      "lines": 9514,
+      "ratio": 0.43
     },
     "platform": {
-      "lines": 4365,
-      "ratio": 0.375
+      "lines": 4565,
+      "ratio": 0.381
     },
     "ui": {
       "lines": 1670,
       "ratio": 0.274
     },
     "test": {
-      "lines": 7169,
-      "ratio": 0.201
+      "lines": 7333,
+      "ratio": 0.202
     },
     "moondeck": {
-      "lines": 3246,
-      "ratio": 0.183
+      "lines": 3260,
+      "ratio": 0.184
     }
   },
   "tests": {
-    "cases": 1325,
+    "cases": 1338,
     "scenarios": 23
   },
   "docs": {
     "md_files": 178,
-    "md_lines": 24401,
+    "md_lines": 24451,
     "plans_files": 91,
-    "backlog_lines": 3629,
+    "backlog_lines": 3659,
     "lessons_lines": 454,
     "claude_md_lines": 135
   },
   "complexity": {
-    "functions": 2473,
-    "over_threshold": 151,
-    "worst_ccn": 93
+    "functions": 2506,
+    "over_threshold": 157,
+    "worst_ccn": 102
   }
 }
diff --git a/docs/metrics/repo-health.md b/docs/metrics/repo-health.md
index 374c9616..75fff940 100644
--- a/docs/metrics/repo-health.md
+++ b/docs/metrics/repo-health.md
@@ -1,6 +1,6 @@
 # Repo health
 
-Measured at `9d77ade4`. Generated by [`moondeck/check/repo_health.py`](../../moondeck/check/repo_health.py) on every KPI-gate run. **Do not edit by hand.**
+Measured at `97d004ff`. Generated by [`moondeck/check/repo_health.py`](../../moondeck/check/repo_health.py) on every KPI-gate run. **Do not edit by hand.**
 
 Current state only; the trend is this file's git history (`git log -p docs/metrics/repo-health.md`). Nothing here fails a build: the numbers make growth visible, the judgment stays human.
 
@@ -8,58 +8,58 @@ Current state only; the trend is this file's git history (`git log -p docs/metri
 
 | Target | Flash |
 |---|---:|
-| desktop | 1,111 KB (+0 KB) ⚠ |
-| esp32 | 1,721 KB |
+| desktop | 1,129 KB (+17 KB) ⚠ |
+| esp32 | 1,675 KB |
 | esp32-16mb | 1,674 KB |
 | esp32-eth | 1,294 KB |
 | esp32-wrover | 1,724 KB |
-| esp32p4-eth | 1,567 KB (+0 KB) ⚠ |
+| esp32p4-eth | 1,572 KB (+5 KB) ⚠ |
 | esp32p4-eth-wifi | 1,752 KB |
-| esp32s3-n16r8 | 1,712 KB |
-| esp32s3-n8r8 | 1,712 KB (+84 KB) ⚠ |
-| esp32s31 | 1,978 KB |
+| esp32s3-n16r8 | 1,718 KB (+5 KB) ⚠ |
+| esp32s3-n8r8 | 1,712 KB |
+| esp32s31 | 1,984 KB (+6 KB) ⚠ |
 
 ## Render performance
 
 | Target | Tick | FPS |
 |---|---:|---:|
-| desktop | 129 µs (+1 µs) ⚠ | 7,751 (−61) ⚠ |
+| desktop | 252 µs (+125 µs) ⚠ | 3,968 (−3,906) ⚠ |
 | esp32 | 2,151 µs | 464 |
 
 ## Code
 
 | Area | Lines | Comments | Comment share |
 |---|---:|---:|---:|
-| core | 16,980 | 6,402 | 41.0 % |
-| light | 24,317 (+5) ⚠ | 9,427 | 42.9 % |
-| platform | 12,860 | 4,365 | 37.5 % |
+| core | 17,620 (+556) ⚠ | 6,659 | 41.1 % |
+| light | 24,495 (+59) ⚠ | 9,514 | 43.0 % (+0.1 %) ⚠ |
+| platform | 13,226 (+292) ⚠ | 4,565 | 38.1 % (+0.4 %) ⚠ |
 | ui | 6,468 | 1,670 | 27.4 % |
-| test | 41,246 | 7,169 | 20.1 % |
-| moondeck | 20,323 | 3,246 | 18.3 % |
+| test | 41,840 (+491) ⚠ | 7,333 | 20.2 % (+0.1 %) ⚠ |
+| moondeck | 20,346 (+16) ⚠ | 3,260 | 18.4 % (+0.1 %) ⚠ |
 
 ## Tests
 
 | Kind | Count |
 |---|---:|
-| unit cases | 1,325 |
+| unit cases | 1,338 (+10) ✓ |
 | scenarios | 23 |
 
 ## Complexity
 
 | Metric | Value |
 |---|---:|
-| functions | 2,473 (+1) ✓ |
-| over threshold | 151 |
-| worst CCN | 93 |
+| functions | 2,506 (+20) ✓ |
+| over threshold | 157 (+3) ⚠ |
+| worst CCN | 102 (+9) ⚠ |
 
 ## Documentation
 
 | Metric | Value |
 |---|---:|
 | markdown files | 178 |
-| markdown lines | 24,401 |
+| markdown lines | 24,451 (+24) ⚠ |
 | plan files | 91 |
-| backlog lines | 3,629 |
+| backlog lines | 3,659 (+24) ⚠ |
 | lessons lines | 454 |
 | CLAUDE.md lines | 135 |
 
diff --git a/docs/moonmodules/light/MoonLiveEffect.md b/docs/moonmodules/light/MoonLiveEffect.md
index e22431d2..aca82f8f 100644
--- a/docs/moonmodules/light/MoonLiveEffect.md
+++ b/docs/moonmodules/light/MoonLiveEffect.md
@@ -4,7 +4,7 @@ MoonLive is projectMM's **live-script engine** — author an effect as text and
 
 Scripts call the same [power functions](power-functions.md) compiled effects use, reached through the builtin table — so the vocabulary is shared, in its flat scalar form.
 
-A scripted effect carries its **script source** as an editable, persisted multi-line text control (a resizable `textarea` in the UI), and a front-end (lexer → parser → IR → per-ISA assembler) compiles it to native code on the next tick. The grammar is a sequence of **statements** — a function call, or a `for` loop over them — with **expression arguments**, so any argument may be a literal or a nested call:
+A scripted effect names a **script file** under `/moonlive/`; the UI loads, edits and saves that file, and the module holds only the name (~32 bytes) — the text is read into a right-sized buffer to compile and freed immediately, so nothing script-sized stays resident. A front-end (lexer → parser → IR → per-ISA assembler) compiles it to native code on the next tick. The grammar is a sequence of **statements** — a function call, or a `for` loop over them — with **expression arguments**, so any argument may be a literal or a nested call:
 
 ```
 setRGB(random16(256), 0, 0, 255);   // a random pixel, blue
@@ -16,7 +16,7 @@ The functions are **not built into the compiler** — `setRGB`, `fill`, `random1
 
 ## Controls
 
-- `source` — the script text (default: random pixels — `setRGB(random16(256), random16(256), random16(256), random16(256));`, one random light in a random color each tick). Editing it recompiles live: a valid script swaps in on the next tick; a failed compile frees the old code, shows the diagnostic in the module status, and renders dark until fixed (the script-editor loop, robust + no reboot).
+- `script` — the file name under `/moonlive/`, e.g. `lines.mlv`. A fresh module has none: it reports `no script — set the script name` and renders nothing, rather than every new module compiling the same default. Naming one (or re-naming it after an edit) recompiles live: a valid script swaps in on the next tick; a failed compile frees the old code, shows the diagnostic in the module status, and renders dark until fixed (the script-editor loop, robust + no reboot). The directory is created on demand.
 - **Scripted controls** — a script declares a tunable variable with a range annotation, and the engine surfaces it as a real `uint8` MoonModule control (slider + UI + persistence), bound to a live value the running native code reads each tick:
 
   ```c
@@ -25,7 +25,7 @@ The functions are **not built into the compiler** — `setRGB`, `fill`, `random1
   setRGB(speed, hue, 0, 255);
   ```
 
-  Declaring the variable is what **creates** the control: `uint8_t <name> = <default>;` becomes a `<name>` slider (default `<default>`, range `0..255`). The trailing `// @control <min>..<max>` only **adjusts that control's range**; it's optional. A declared name used in a statement reads the control's **current** value. Editing a control's slider does **not** recompile — the value lands in the engine's control-values arena and the next render tick reads it (the live-edit guarantee, the *no-reboot* principle). Editing the `source` recompiles and re-derives the control set; a control kept across the edit keeps its slider value, a removed control's saved value drops. Stage 1 is `uint8` only.
+  Declaring the variable is what **creates** the control: `uint8_t <name> = <default>;` becomes a `<name>` slider (default `<default>`, range `0..255`). The trailing `// @control <min>..<max>` only **adjusts that control's range**; it's optional. A declared name used in a statement reads the control's **current** value. Editing a control's slider does **not** recompile — the value lands in the engine's control-values arena and the next render tick reads it (the live-edit guarantee, the *no-reboot* principle). Saving the script file and re-naming it recompiles and re-derives the control set; a control kept across the edit keeps its slider value, a removed control's saved value drops. Stage 1 is `uint8` only.
 
 ### System variables — what the engine hands a script
 
@@ -70,7 +70,7 @@ Registered by the light domain, not built into the compiler (the core owns only
 
 ### Wire contract — control declaration
 
-The controls are **derived from `source`** (one per declared `uint8` control; the optional `@control` annotation only refines a control's range), then **surfaced in `/api/state`** — the device JSON view the integrator consumes — as regular `uint8` controls alongside `source`. So an integrator sees and writes them exactly like any other control — e.g. `POST /api/control` with `{"module": "ML", "control": "speed", "value": 80}`; they're fully present in the device JSON, just authored in the script rather than fixed in the module. The script's `\n` line breaks are standard JSON string escapes the device decodes, so a multi-line `source` round-trips.
+The controls are **derived from the script** (one per declared `uint8` control; the optional `@control` annotation only refines a control's range), then **surfaced in `/api/state`** — the device JSON view the integrator consumes — as regular `uint8` controls alongside `script`. So an integrator sees and writes them exactly like any other control — e.g. `POST /api/control` with `{"module": "ML", "control": "speed", "value": 80}`; they're fully present in the device JSON, just authored in the script rather than fixed in the module. The script's `\n` line breaks are standard JSON string escapes the device decodes, so a multi-line script round-trips through `/api/file`.
 
 ## Pieces
 
@@ -79,7 +79,7 @@ The controls are **derived from `source`** (one per declared `uint8` control; th
 - **`MoonLiveCompiler`** (`src/core/moonlive/MoonLiveCompiler.h/.cpp`) — the **platform-independent front-end**: a recursive-descent lexer + expression parser that lowers each statement to the typed IR (`MoonLiveIr.h`). Pure (source + table in, IR out, deterministic). Knows the *language*, never an ISA and never a domain.
 - **`MoonLiveBuiltins_light`** (`src/light/moonlive/MoonLiveBuiltins_light.h`) — the **light-domain registration**: the only place the LED vocabulary lives. Registers the whole vocabulary above — Inline ops lowering to stores, and Calls into host helpers — plus the system variables each binding supplies. A different host (display, sensor) writes its own table; the core is unchanged.
 - **per-ISA assembler + lowering** (`src/platform/<target>/moonlive_asm_*` + `moonlive_lower_*`) — a tiny named-instruction MacroAssembler with label back-patching, and the IR→bytes lowering that drives it. Xtensa for the classic/S3 (`__XTENSA__`), the host ISA on desktop (arm64/x86-64). Adding an ISA is a new assembler + lowering; the front-end and IR are unchanged. (`emitFill`/`emitAnimatedFill` remain as the hand-encoded `fill` references the assembler's output is checked against.)
-- **`MoonLiveEffect`** (`src/light/moonlive/MoonLiveEffect.h`) — the **thin binding**: a first-class `EffectBase` carrying the `source` control, whose `tick()` delegates to the engine over its own `buffer()`. `compile(source, table, sysvars)` takes both host tables: the shared `lightBuiltins()`, and the system variables THIS binding supplies — `effectSysVars()` here, `modifierSysVars()` for a modifier, `layoutSysVars()` for a layout, which is what decides the names each kind of script can read and cannot declare. The engine is projectMM-agnostic; the binding is the only coupled layer.
+- **`MoonLiveEffect`** (`src/light/moonlive/MoonLiveEffect.h`) — the **thin binding**: a first-class `EffectBase` carrying the `script` control, whose `tick()` delegates to the engine over its own `buffer()`. `compile(source, table, sysvars)` takes both host tables: the shared `lightBuiltins()`, and the system variables THIS binding supplies — `effectSysVars()` here, `modifierSysVars()` for a modifier, `layoutSysVars()` for a layout, which is what decides the names each kind of script can read and cannot declare. The engine is projectMM-agnostic; the binding is the only coupled layer.
 
 ## Cross-domain wiring
 
@@ -95,9 +95,9 @@ MoonLive's native-codegen approach — compile a small C-like language straight
 
 [unit_moonlive_fill](../../../test/unit/core/unit_moonlive_fill.cpp) runs the engine path in-process on the desktop host backend (`compile`/`run`, the animated routine, zero-lights, recompile, `free`, the `allocExec`/`writeExec`/`freeExec` round-trip, the buffer-shape guards). [unit_moonlive_ir](../../../test/unit/core/unit_moonlive_ir.cpp) pins the **behavioral golden** — a compiled `fill` and the hand-encoded reference render an identical buffer — plus setRGB's single-pixel write and the runtime bounds guard. [unit_moonlive_compiler](../../../test/unit/core/unit_moonlive_compiler.cpp) pins the expression grammar (`random16` in any/every argument slot, uint16 bounds), the parser diagnostics (no crash on malformed input), live recompile, and the **domain-neutral** property: with an empty builtin table the core knows *no* functions, and a host can register an arbitrary name against the same machinery.
 
-The grammar + bounds guard are verified live on the S3/Olimex (Xtensa) by editing the `source` control — the device compiles the expression on-chip and renders it.
+The grammar + bounds guard are verified live on the S3/Olimex (Xtensa) by saving a script file and naming it — the device compiles the expression on-chip and renders it.
 
-[scenario_MoonLiveEffect_livescript](../../../test/scenarios/light/scenario_MoonLiveEffect_livescript.json) exercises the effect **as a wired MoonModule** — what the unit tests can't reach: add it, live-edit the `source` to recolor (recompile), push a broken script (`MoonLive::compile` fails, frees the previous code, `MoonLiveEffect` reports the parse error in the status and renders dark — no crash), recover, resize the grid to 1×1 and back while rendering (the every-grid-size hard rule), then remove and re-add (exec memory re-acquired clean). It runs in-process on the desktop backend each commit, and the same JSON runs live over REST against the device backends. The Xtensa/RISC-V backends are validated by the live S3/P4 runs (a `MoonLiveEffect` on a Layer lights the grid from its `source`), which the desktop tests can't reach.
+[scenario_MoonLiveEffect_livescript](../../../test/scenarios/light/scenario_MoonLiveEffect_livescript.json) exercises the effect **as a wired MoonModule** — what the unit tests can't reach: add it, live-edit the script file to recolor (recompile), push a broken script (`MoonLive::compile` fails, frees the previous code, `MoonLiveEffect` reports the parse error in the status and renders dark — no crash), recover, resize the grid to 1×1 and back while rendering (the every-grid-size hard rule), then remove and re-add (exec memory re-acquired clean). It runs in-process on the desktop backend each commit, and the same JSON runs live over REST against the device backends. The Xtensa/RISC-V backends are validated by the live S3/P4 runs (a `MoonLiveEffect` on a Layer lights the grid from its script file), which the desktop tests can't reach.
 
 ## Source
 
diff --git a/docs/moonmodules/light/MoonLiveLayout.md b/docs/moonmodules/light/MoonLiveLayout.md
index d46d77b3..9b85dd90 100644
--- a/docs/moonmodules/light/MoonLiveLayout.md
+++ b/docs/moonmodules/light/MoonLiveLayout.md
@@ -77,7 +77,7 @@ So it runs twice. On the first pass `addLight` counts; on the second it emits ea
 
 | control | what it does |
 |---|---|
-| `source` | the script; editing it recompiles and re-places the lights live |
+| `script` | the file name under `/moonlive/`; naming it (or re-naming it after an edit) recompiles and re-places the lights live |
 
 Plus one control per `@control` the script declares.
 
diff --git a/docs/moonmodules/light/MoonLiveModifier.md b/docs/moonmodules/light/MoonLiveModifier.md
index 43ee9ff6..014a5384 100644
--- a/docs/moonmodules/light/MoonLiveModifier.md
+++ b/docs/moonmodules/light/MoonLiveModifier.md
@@ -42,7 +42,7 @@ It is for debugging and comes back out again — [what print costs](../../../moo
 
 | control | what it does |
 |---|---|
-| `source` | the script; editing it recompiles and re-maps live |
+| `script` | the file name under `/moonlive/`; naming it (or re-naming it after an edit) recompiles and re-maps live |
 
 Plus one control per `@control` the script declares — `uint8_t amount = 4; // @control 0..64`
 becomes a slider, and moving it rebuilds the mapping just as editing the script does.
diff --git a/docs/performance.md b/docs/performance.md
index 151852a5..d65d358c 100644
--- a/docs/performance.md
+++ b/docs/performance.md
@@ -248,7 +248,7 @@ Each parallel LED driver run on real hardware at a 128×128 = 16384-light grid,
 
 | Peripheral | Board | Pins used (8 lanes) | Result | Ceiling / bound |
 |---|---|---|---|---|
-| **Parlio** | ESP32-P4 (Waveshare P4-NANO) | `20,21,22,23,24,25,26,27` | `Drivers` tick ~30100 µs, fps 30 at 16384 lights (8 lanes, SWAR transpose) | Parlio's single-shot transfer caps at 65535 bytes TOTAL (not per lane), and a light costs `channels × 24 × slotBytes` — so the ceiling is **898 lights/lane at 8 lanes RGB**, 673 RGBW, and halves to 443/332 at 16 lanes (a 16-bit bus doubles `slotBytes`). Over that, the driver reports `too many lights per pin` and keeps running; lifting the ceiling is the [chunked-DMA work](backlog/backlog-light.md) (tier 1 → ~16-21K). |
+| **Parlio** | ESP32-P4 (Waveshare P4-NANO) | `20,21,22,23,24,25,26,27` | `Drivers` tick ~30100 µs, fps 30 at 16384 lights (8 lanes, SWAR transpose) | Parlio's single-shot transfer caps at 65535 bytes TOTAL (not per lane), and a light costs `channels × 24 × slotBytes` — so the ceiling is **897 lights/lane at 8 lanes RGB**, 673 RGBW, and halves to 442/332 at 16 lanes (a 16-bit bus doubles `slotBytes`). Over that, the driver reports `too many lights per pin` and keeps running; lifting the ceiling is the [chunked-DMA work](backlog/backlog-light.md) (tier 1 → ~16-21K). |
 | **LCD_CAM i80** (MultiPinLedDriver) | ESP32-S3 N16R8 Dev | data `18,5,6,7,8,9,10,11` · WR(clock) `12` · DC `13` | Same encoder, healthy on real i80; encode scales ~6 µs/light (8×512 = 4096 → 23 ms; 8×1024 = 8192 → 50 ms) | **single-DMA init ceiling 8192–12288 lights** (8×1024 inits; 8×1536 → "LCD init failed — check pins/memory"). A data lane on WR/DC only corrupts *that* lane (it carries the bus-control waveform, not pixels), so the driver **warns and keeps running** — a board that wires all lanes but drives fewer strands can legitimately park WR/DC on an unused data pin. WR and DC on the *same* GPIO is rejected up front (the bus needs two distinct control lines). |
 | **RMT** | classic ESP32 (LOLIN D32 / WROOM) | `2,4,13,14,16,17,18,19` (pin 2 = a real 24-LED strand) | 8-pin RMT drives **8×256 = 2048 lights** (tick ~12.6 ms), scales to ~8192 before the tick plateaus; all lanes healthy, pin-2 strand verified lit | **silent alloc-fail:** the RMT symbol buffer sizes for the driver's `count` window, so `count=0` on a 16384-grid needs ~1.5 MB, fails on the ~90 KB heap, and `tick()` bails with **no status** (LEDs dark). Bound the driver with the start/count window; a status for this is [backlogged](backlog/backlog-light.md). |
 | **I2S i80** | classic ESP32 (ESP32-WROVER) | data `2,4,13,14,18,19,21,22` · WR(clock) `32` · DC `33` (pin 2 = a real strand, verified lit) | The classic ESP32 runs the **same** `MultiPinLedDriver` over the **I2S peripheral in i80 mode** (IDF routes the i80 API to I2S here, to LCD_CAM on the S3/P4 — one driver, chip-picked backend). 8-lane doubling sweep (128×128 grid, 2026-07-13): 64/pin (512) → 4877 µs, 128/pin (1024) → 8575 µs, 256/pin (2048) → 15638 µs. Scales linearly at **~7.6 µs/light** (heavier than the S3's LCD_CAM ~6 µs — the classic I2S clock path). `frameTime` reports the WS2812 wire floor (512 → 243 fps, 2048 → 67 fps). The `MultiPinLed` status reports the live count. **16 lanes work on classic too** (the I2S peripheral does the 16-bit i80 bus, 16×256 = 4096 verified), but the WROVER exposes only ~13 non-strap pins, so 8-lane is the practical set. | **Internal-RAM ceiling: 2048 lights at 8 lanes (4096 at 16).** The classic I2S backend **cannot DMA from PSRAM** (`esp_lcd_i80_alloc_draw_buffer` rejects `MALLOC_CAP_SPIRAM` — "external memory is not supported"), so its frame buffer is internal-DMA-RAM only (`maxBlock` ≈ 76 KB). Swept at 8 lanes on a 128×128 grid (2026-07-13): 64/pin (512) ✅, 128/pin (1024) ✅, **256/pin (2048) ✅ — then 512/pin (4096) and above → `i80 bus init failed — check pins / memory`**, a **clean degrade, not a crash** (uptime kept climbing through every rung). That lands exactly on the parallel-I2S acceptance floor (8×256 = 2048), so the classic chip meets its floor and no more. The opposite of the LCD_CAM row below, which reaches 16384 via PSRAM — the classic chip's DMA simply can't get there. **The render is decoupled from this ceiling:** the same sweep kept rendering the full 128×128 = 16384-light grid at every rung (`Layer` ≈ 511 ms/frame, from PSRAM) while the *output* was capped — so a big grid still renders, it just can't all reach the LEDs. At 16K lights the effect render (511 ms) dwarfs the output (24 ms), so multicore cannot help: the render is the wall on this chip. Two classic-only quirks the driver handles: the I2S i80 tx has an unconditional command phase whose busy-wait hangs to a watchdog reset unless given a real 8-bit command (`lcd_cmd_bits=8` / `kI80Cmd=0`), and the draw buffer + a done-ISR marked `IRAM_ATTR`. |
diff --git a/esp32/main/CMakeLists.txt b/esp32/main/CMakeLists.txt
index 8a76048c..2faad75c 100644
--- a/esp32/main/CMakeLists.txt
+++ b/esp32/main/CMakeLists.txt
@@ -12,6 +12,7 @@ idf_component_register(
         "../../src/core/Scheduler.cpp"
         "../../src/core/moonlive/MoonLive.cpp"
         "../../src/core/moonlive/MoonLiveCompiler.cpp"
+        "../../src/core/moonlive/MoonLiveSpill.cpp"
         "../../src/platform/esp32/platform_esp32.cpp"
         "../../src/platform/esp32/moonlive_emit.cpp"
         "../../src/platform/esp32/moonlive_asm_xtensa.cpp"
diff --git a/moondeck/moonlive/disasm.py b/moondeck/moonlive/disasm.py
index 49f3a655..6135fbe0 100644
--- a/moondeck/moonlive/disasm.py
+++ b/moondeck/moonlive/disasm.py
@@ -36,6 +36,14 @@ def objdump() -> str:
 def main() -> int:
     script = sys.argv[1] if len(sys.argv) > 1 else \
         "for (i = 0; i < 3; i = i + 1) { addLight(i, 0, 0); }"
+    # Which binding's system variables to compile against: layout (default), effect or modifier.
+    # They are different vocabularies, not nested ones — a layout may use `x`/`y` as loop counters
+    # precisely because it is NOT handed them, so the binding has to be stated.
+    binding = sys.argv[2] if len(sys.argv) > 2 else "layout"
+    # A path is read as a file; anything else is the script text itself.
+    if os.path.isfile(script):
+        with open(script) as f:
+            script = f.read()
 
     with tempfile.TemporaryDirectory() as tmp:
         emitter = os.path.join(tmp, "emit")
@@ -43,13 +51,19 @@ def main() -> int:
             ["c++", "-std=c++20", "-O0", "-I", os.path.join(ROOT, "src"),
              "-I", os.path.join(ROOT, "src", "platform", "desktop"),
              TOOL_SRC, os.path.join(ROOT, "src", "core", "moonlive", "MoonLiveCompiler.cpp"),
+             # Every backend runs the register allocator before lowering, so the pass comes along
+             # too — without it the tool fails to link on spillToBudget.
+             os.path.join(ROOT, "src", "core", "moonlive", "MoonLiveSpill.cpp"),
+             # The IR sizes its op array with platform::alloc, so the platform implementation has
+             # to come along — the compiler is no longer self-contained.
+             os.path.join(ROOT, "src", "platform", "desktop", "platform_desktop.cpp"),
              "-o", emitter],
             capture_output=True, text=True)
         if build.returncode != 0:
             print(build.stderr[:2000])
             return 1
 
-        run = subprocess.run([emitter, script], capture_output=True, text=True)
+        run = subprocess.run([emitter, script, binding], capture_output=True, text=True)
         print(run.stdout.split("\n")[0])          # the script
         if run.returncode != 0:
             print(run.stdout.strip() or run.stderr.strip())
diff --git a/moondeck/moonlive/emit_xtensa.cpp b/moondeck/moonlive/emit_xtensa.cpp
index 9649aa45..e7408552 100644
--- a/moondeck/moonlive/emit_xtensa.cpp
+++ b/moondeck/moonlive/emit_xtensa.cpp
@@ -25,11 +25,16 @@ using namespace mm;
 int main(int argc, char** argv) {
     const char* src = argc > 1 ? argv[1] : "for (i = 0; i < 3; i = i + 1) { addLight(i, 0, 0); }";
     uint8_t buf[4096];
-    // The WIDEST system-variable list on purpose: this tool disassembles whatever script is passed
-    // on the command line — layout, effect or modifier — so it must accept every name any binding
-    // supplies. A narrower list would refuse the scripts it exists to inspect.
-    auto r = moonlive::compileSource(src, moonlive::lightBuiltins(),
-                                     moonlive::modifierSysVars(), buf, sizeof(buf));
+    // Which BINDING to compile as, because the system-variable tables are different vocabularies and
+    // not nested supersets: a modifier is handed `x`/`y`/`z`, and a LAYOUT deliberately is not, so it
+    // may use those names as ordinary loop counters — which the shipped grid.mlv does. Compiling
+    // every script against the widest table therefore refuses exactly the scripts most worth
+    // inspecting ("name is a system variable"), which is how this tool came to never see grid.mlv.
+    const char* binding = argc > 2 ? argv[2] : "layout";
+    const auto sysvars = std::strcmp(binding, "modifier") == 0 ? moonlive::modifierSysVars()
+                       : std::strcmp(binding, "effect")   == 0 ? moonlive::effectSysVars()
+                                                               : moonlive::layoutSysVars();
+    auto r = moonlive::compileSource(src, moonlive::lightBuiltins(), sysvars, buf, sizeof(buf));
     if (!r.ok) { printf("compile failed: %s\n", r.error); return 1; }
     printf("# %s\n# %zu bytes\n", src, r.len);
     for (size_t i = 0; i < r.len; i++) printf("%02x%s", buf[i], (i % 16 == 15) ? "\n" : " ");
diff --git a/moondeck/run/monitor_esp32.py b/moondeck/run/monitor_esp32.py
index 8b83ecb4..34e6d81e 100644
--- a/moondeck/run/monitor_esp32.py
+++ b/moondeck/run/monitor_esp32.py
@@ -100,13 +100,17 @@ def main():
     print("Press Ctrl+C (or Stop in MoonDeck) to stop.\n")
     sys.stdout.flush()
 
-    with raised_log_level(active_device_ips(), LOG_INFO):
-        try:
-            ser = serial.Serial(args.port, args.baud, timeout=1)
-        except serial.SerialException as e:
-            print(f"Cannot open {args.port}: {e}")
-            sys.exit(1)
+    # OPEN THE PORT FIRST. raised_log_level contacts every device in moondeck.json over HTTP at a
+    # 3 s timeout each — with a dozen registered and most powered off, that is half a minute of
+    # blocking before a single byte is read, and the boot output you were monitoring FOR is already
+    # gone. The log level is a nicety; the serial stream is the point.
+    try:
+        ser = serial.Serial(args.port, args.baud, timeout=1)
+    except serial.SerialException as e:
+        print(f"Cannot open {args.port}: {e}")
+        sys.exit(1)
 
+    with raised_log_level(active_device_ips(), LOG_INFO):
         with open(LOG_FILE, "w") as log:
             try:
                 while True:
diff --git a/moonlive/effects/plasma.mlv b/moonlive/effects/plasma.mlv
new file mode 100644
index 00000000..bbfac91b
--- /dev/null
+++ b/moonlive/effects/plasma.mlv
@@ -0,0 +1,18 @@
+// Plasma: two travelling sine waves summed per cell, in the demoscene shape.
+// The colour of a cell comes from sin(x-ish) + sin(y-ish), both scrolling on the clock, so
+// the field drifts and interferes without anything being stored between frames.
+//
+// The heaviest script that ships: a nested loop over the whole grid with four host calls per
+// cell. `scale(t, ...)` reads the clock through the same path an effect always does.
+uint8_t bpm = 12;      // @control 1..120
+uint8_t zoom = 24;     // @control 1..64
+
+for (y = 0; y < height; y = y + 1) {
+  for (x = 0; x < width; x = x + 1) {
+    // Each axis gets its own wave, offset by the beat so the pattern travels diagonally.
+    setRGB(y * width + x,
+           scale(sin(x * zoom * 8 + beat(bpm, t)), 256),
+           scale(sin(y * zoom * 8 + beat(bpm, t)), 256),
+           scale(cos((x + y) * zoom * 4 + beat(bpm, t)), 256));
+  }
+}
diff --git a/src/core/HttpServerModule.cpp b/src/core/HttpServerModule.cpp
index b037b35a..8ab213e8 100644
--- a/src/core/HttpServerModule.cpp
+++ b/src/core/HttpServerModule.cpp
@@ -1679,7 +1679,7 @@ HttpServerModule::OpResult HttpServerModule::applyAddModule(
     mod->defineControls();
     mod->setup();
     mod->applyState();
-    if (scheduler_) scheduler_->prepareTree();
+    if (scheduler_) scheduler_->requestPrepareTree();
     requestFullResync();   // structural change (see requestFullResync)
 
     // Persist the new tree shape (debounced save via noteDirty).
@@ -1751,7 +1751,7 @@ HttpServerModule::OpResult HttpServerModule::applyClearChildren(const char* pare
         removedAny = true;
     }
     if (removedAny) {
-        if (scheduler_) scheduler_->prepareTree();
+        if (scheduler_) scheduler_->requestPrepareTree();
     requestFullResync();   // structural change (see requestFullResync)
         parent->markDirty();
         FilesystemModule::noteDirty();
@@ -1834,7 +1834,7 @@ void HttpServerModule::handleDeleteModule(platform::TcpConnection& conn, const c
     mod->release();
     Scheduler::deleteTree(mod);
 
-    if (scheduler_) scheduler_->prepareTree();
+    if (scheduler_) scheduler_->requestPrepareTree();
     requestFullResync();   // structural change (see requestFullResync)
 
     // Persist the new tree shape — marking the parent dirty rewrites its file
@@ -1928,7 +1928,7 @@ void HttpServerModule::handleReplaceModule(platform::TcpConnection& conn, const
 
     // Re-run prepare across the tree so Layer LUT / Drivers buffer
     // wiring re-forms — a replaced effect/driver re-wires like a freshly added one.
-    if (scheduler_) scheduler_->prepareTree();
+    if (scheduler_) scheduler_->requestPrepareTree();
     requestFullResync();   // structural change (see requestFullResync)
 
     // Persist: children are encoded positionally, so marking the parent dirty
@@ -2027,7 +2027,7 @@ void HttpServerModule::handleMoveModule(platform::TcpConnection& conn, const cha
     // file is rewritten with the new order (same as add/delete handlers).
     parent->markDirty();
     FilesystemModule::noteDirty();
-    if (scheduler_) scheduler_->prepareTree();
+    if (scheduler_) scheduler_->requestPrepareTree();
     requestFullResync();   // structural change (see requestFullResync)
     sendResponse(conn, 200, "application/json", "{\"ok\":true}");
 }
diff --git a/src/core/NetworkModule.h b/src/core/NetworkModule.h
index 3c8f364f..d51fd348 100644
--- a/src/core/NetworkModule.h
+++ b/src/core/NetworkModule.h
@@ -282,11 +282,13 @@ class NetworkModule : public MoonModule {
             controls_.setHidden(controls_.count() - 1, state_ != State::ConnectedSta);
             // TX power applies whenever the WiFi radio is active (STA or AP).
             // Hide on Ethernet / Idle where the radio is off.
+            // Expert-only: a radio-tuning readout, not something a normal install reads.
             controls_.addReadOnlyInt("txPower", txPower_, "dBm");
             const bool radioOn = (state_ == State::ConnectedSta
                                   || state_ == State::WaitingSta
                                   || state_ == State::AP);
             controls_.setHidden(controls_.count() - 1, !radioOn);
+            controls_.setAdvanced(controls_.count() - 1);
             // Writable TX-power cap (the weak-power / brown-out WiFi cap). Range 0..21 dBm.
             // 0 = "no override" (sentinel — syncTxPower then writes the
             // ESP-IDF ceiling, ~20 dBm, to actively lift any prior cap;
@@ -299,8 +301,11 @@ class NetworkModule : public MoonModule {
             // TX-power cap is meaningless on Ethernet / Idle where the radio is off.
             controls_.addInt16("txPowerSetting", txPowerSetting_, 0, 21);
             controls_.setHidden(controls_.count() - 1, !radioOn);
+            controls_.setAdvanced(controls_.count() - 1);
         }
+        // Expert-only: discovery works without it, and the projectMM UI finds devices over UDP.
         controls_.addBool("mDNS", mdnsEnabled_);
+        controls_.setAdvanced(controls_.count() - 1);
 
         // addressing goes immediately before the static-IP fields it conditions, so
         // the dropdown and the fields it reveals stay adjacent (mDNS, unrelated,
diff --git a/src/core/Scheduler.cpp b/src/core/Scheduler.cpp
index 4e88fcb8..d8ab604e 100644
--- a/src/core/Scheduler.cpp
+++ b/src/core/Scheduler.cpp
@@ -67,6 +67,17 @@ void Scheduler::tick() MM_NONBLOCKING {
     uint32_t now = platform::millis();
     uint32_t tickStart = platform::micros();
 
+    // A rebuild asked for from another task happens HERE, at a frame boundary on the render thread.
+    // The walk runs a scripted layout's compiled code, and that code's frame is ordinary stack on
+    // whichever task calls it — so doing it inline in an HTTP handler put a script on the web
+    // server's small stack instead of the render task's, which is the budget every other effect is
+    // measured against. Deferring also means the pipeline is never rebuilt underneath a half-rendered
+    // frame.
+    if (prepareRequested_) {
+        prepareRequested_ = false;
+        prepareTree();
+    }
+
     // Scheduler gates loop callbacks by `enabled()` — disabled modules don't tick.
     // System modules that need to keep running regardless (HttpServer, Network,
     // Filesystem — so users can re-enable other modules through them) override
@@ -220,7 +231,7 @@ Scheduler::SetControlResult Scheduler::setControl(const char* moduleName,
         target->setEnabled(mm::json::parseBool(valueJson, "value"));
         target->markDirty();
         if (noteDirtyHook_) noteDirtyHook_();
-        prepareTree();
+        requestPrepareTree();
         // `enabled` rides the FULL state, not the per-leaf value patch — so the client only learns the new
         // value from a full resync. Request one (the same signal a schema change sends); without it the
         // client's cached state keeps the old `enabled` and reverts the toggle a second later.
@@ -248,7 +259,7 @@ Scheduler::SetControlResult Scheduler::setControl(const char* moduleName,
         target->onControlChanged(controlName);
         target->markDirty();
         if (noteDirtyHook_) noteDirtyHook_();
-        if (target->affectsPrepare(controlName)) prepareTree();
+        if (target->affectsPrepare(controlName)) requestPrepareTree();
         return SetControlResult::Ok;
     }
     return SetControlResult::ControlNotFound;
diff --git a/src/core/Scheduler.h b/src/core/Scheduler.h
index 98917d44..97f5beb6 100644
--- a/src/core/Scheduler.h
+++ b/src/core/Scheduler.h
@@ -66,8 +66,20 @@ class Scheduler {
     void release();
 
     uint32_t elapsed() const;
+
+    /// Rebuild derived state across the whole tree — buffers, mappings, and any scripted module's
+    /// compiled program. Runs the work IMMEDIATELY on the calling thread.
+    ///
+    /// Prefer requestPrepareTree() from anything but the render loop: this walk runs a scripted
+    /// layout's JIT'd code, whose frame lives on the CALLING TASK's stack like any other function's.
+    /// Called from an HTTP handler it therefore executes on the small web-server task rather than
+    /// the render task the rest of the pipeline is budgeted against.
     void prepareTree();
 
+    /// Ask for a rebuild at the next frame boundary, on the render thread. Cheap and safe to call
+    /// from any task — it sets a flag; tick() does the work.
+    void requestPrepareTree() { prepareRequested_ = true; }
+
     uint32_t tickTimeUs() const { return tickTimeUs_; }
     uint32_t fps() const { return tickTimeUs_ > 0 ? 1000000 / tickTimeUs_ : 0; }
     uint8_t moduleCount() const { return moduleCount_; }
@@ -124,6 +136,7 @@ class Scheduler {
     static inline Scheduler* instance_ = nullptr;
     std::array<MoonModule*, 32> modules_{};
     uint8_t moduleCount_ = 0;
+    bool prepareRequested_ = false;   // a rebuild asked for off-thread; tick() honours it
     LoadAllFn loadAllHook_ = nullptr;
     NoteDirtyFn noteDirtyHook_ = nullptr;
     uint32_t startTime_ = 0;
diff --git a/src/core/moonlive/MoonLive.cpp b/src/core/moonlive/MoonLive.cpp
index 85872b1c..39b291a5 100644
--- a/src/core/moonlive/MoonLive.cpp
+++ b/src/core/moonlive/MoonLive.cpp
@@ -39,25 +39,44 @@ void* MoonLive::place(const uint8_t* staged, size_t len) {
     return block;
 }
 
+// The emitted-code staging buffer, on the HEAP.
+//
+// It was `uint8_t staging[kCodeCap]` — 2 KB of stack, in a call chain that also holds the
+// assembler's own 2 KB buffer and its tables: ~4.7 KB in one go. On a classic ESP32 that overflowed
+// the task the compile runs on, and the fault surfaced as `Double exception` inside
+// _xt_context_save (the handler faulting while saving context) with LBEG pointing back into
+// MoonLive::compile — a crash on the HTTP task from naming a script. Compilation is cold path, so
+// the allocation costs nothing that matters, and this is the same reasoning that moved IrProgram's
+// op array off the stack.
+namespace {
+struct Staging {
+    uint8_t* p = static_cast<uint8_t*>(platform::alloc(kCodeCap));
+    ~Staging() { platform::free(p); }
+    explicit operator bool() const { return p != nullptr; }
+};
+}  // namespace
+
 bool MoonLive::compile(uint8_t r, uint8_t g, uint8_t b) {
-    uint8_t staging[kCodeCap];
-    size_t len = emitFill(staging, kCodeCap, r, g, b);
-    void* block = place(staging, len);
+    Staging staging;
+    if (!staging) { error_ = "no memory to compile"; return false; }
+    size_t len = emitFill(staging.p, kCodeCap, r, g, b);
+    void* block = place(staging.p, len);
     if (!block) return false;
     fn_ = reinterpret_cast<FillFn>(block);
     return true;
 }
 
 bool MoonLive::compile(const char* source, const BuiltinTable& table, const SysVarTable& sysvars) {
-    uint8_t staging[kCodeCap];
-    CompileResult cr = compileSource(source, table, sysvars, staging, kCodeCap);
+    Staging staging;
+    if (!staging) { freeCode(); error_ = "no memory to compile"; return false; }
+    CompileResult cr = compileSource(source, table, sysvars, staging.p, kCodeCap);
     if (!cr.ok) { freeCode(); error_ = cr.error; return false; }   // surface the parse diagnostic
     // Allocate the control arena (fixed address) and seed new slots, BEFORE publishing the control
     // set — ensureArena reads the previous controlCount_ to know which slots are new.
     if (!ensureArena(cr.controls, cr.controlCount)) { freeCode(); error_ = "no control memory"; return false; }
     // Place the code. Only after it succeeds do we publish the new control set — a failed place()
     // must not leave declaredControls() advertising controls for code that isn't running.
-    void* block = place(staging, cr.len);
+    void* block = place(staging.p, cr.len);
     if (!block) return false;                                      // controlCount_/controls_ unchanged
     // Clamp any kept slot whose range shrank (e.g. @control 0..99 edited to 0..10) so a stale live
     // value can't fall outside the new bounds before the native code reads it.
@@ -67,7 +86,16 @@ bool MoonLive::compile(const char* source, const BuiltinTable& table, const SysV
         else if (ctrlArena_[i] > hi) ctrlArena_[i] = hi;
     }
     controlCount_ = cr.controlCount;
-    for (uint8_t i = 0; i < cr.controlCount; i++) controls_[i] = cr.controls[i];
+    for (uint8_t i = 0; i < cr.controlCount; i++) {
+        controls_[i] = cr.controls[i];
+        // Re-point `name` at our own copy: the parser's pointer is into the source text, which the
+        // caller may free as soon as this returns.
+        const uint8_t len = cr.controls[i].nameLen < kMaxControlName - 1
+                          ? cr.controls[i].nameLen : static_cast<uint8_t>(kMaxControlName - 1);
+        for (uint8_t j = 0; j < len; j++) ctrlNames_[i][j] = cr.controls[i].name[j];
+        ctrlNames_[i][len] = '\0';
+        controls_[i].name = ctrlNames_[i];
+    }
     ctrl_ = reinterpret_cast<CtrlFn>(block);
     return true;
 }
@@ -91,9 +119,10 @@ bool MoonLive::ensureArena(const DeclaredControl* decls, uint8_t count) {
 }
 
 bool MoonLive::compileAnimated() {
-    uint8_t staging[kCodeCap];
-    size_t len = emitAnimatedFill(staging, kCodeCap);
-    void* block = place(staging, len);
+    Staging staging;
+    if (!staging) { error_ = "no memory to compile"; return false; }
+    size_t len = emitAnimatedFill(staging.p, kCodeCap);
+    void* block = place(staging.p, len);
     if (!block) return false;
     anim_ = reinterpret_cast<AnimFn>(block);
     return true;
diff --git a/src/core/moonlive/MoonLive.h b/src/core/moonlive/MoonLive.h
index bac22e45..9dcb9659 100644
--- a/src/core/moonlive/MoonLive.h
+++ b/src/core/moonlive/MoonLive.h
@@ -2,6 +2,7 @@
 
 #include <cstdint>
 #include <cstddef>
+#include <cstdio>
 #include "core/moonlive/moonlive_emit.h"
 #include "core/moonlive/MoonLiveBuiltins.h"
 #include "core/moonlive/MoonLiveCompiler.h"   // CompileResult (carries the declared controls)
@@ -53,7 +54,11 @@ class MoonLive {
     // grid size / layout, the hard rule).
     void run(uint8_t* buf, uint32_t nLights, uint8_t cpl, uint32_t t) const {
         if (!buf || nLights == 0 || cpl < 3) return;
-        if (ctrl_) ctrl_(buf, nLights, cpl, t, ctrlArena_);   // front-end-compiled (reads controls)
+        // The arena is the fifth argument, and a front-end-compiled program reads its controls and
+        // system variables straight through it — a null there is dereferenced by the EMITTED code,
+        // which faults as a LoadProhibited at a nonsense address with no C++ frame to blame. Checked
+        // with the other preconditions rather than trusted: every other operand of the call is.
+        if (ctrl_ && ctrlArena_) ctrl_(buf, nLights, cpl, t, ctrlArena_);   // front-end-compiled
         else if (fn_) fn_(buf, nLights, cpl);                 // hand-encoded fixed fill
         else if (anim_) anim_(buf, nLights, cpl, t);          // hand-encoded animated fill
     }
@@ -116,6 +121,12 @@ class MoonLive {
     uint8_t* ctrlArena_ = nullptr;   // live control + system-variable bytes (platform::alloc, kArenaBytes, fixed)
     uint8_t  controlCount_ = 0;      // controls the current program declared
     DeclaredControl controls_[kMaxCtrls] = {};   // the declared-control metadata for the binding
+    // The declared NAMES, owned. A DeclaredControl's `name` points into the SOURCE TEXT, which the
+    // caller is free to release the moment compile() returns — and does, now that a script is read
+    // from a file into a transient buffer. Copying the bytes here is what lets the engine outlive
+    // the text it was built from; without it a binding reads freed memory when it publishes its
+    // controls, which showed up as a control literally named "\x05".
+    char ctrlNames_[kMaxCtrls][kMaxControlName] = {};
 };
 
 }  // namespace mm::moonlive
diff --git a/src/core/moonlive/MoonLiveBuiltins.h b/src/core/moonlive/MoonLiveBuiltins.h
index f7fd8cf3..189ed9fe 100644
--- a/src/core/moonlive/MoonLiveBuiltins.h
+++ b/src/core/moonlive/MoonLiveBuiltins.h
@@ -102,12 +102,6 @@ static constexpr uint8_t kMaxCtrls = 8;          // a script declares a handful
 // the compile. Word-aligned so allocExec/writeExec's word-rounding never exceeds it.
 static constexpr size_t  kCodeCap = 2048;
 
-// The script text a binding holds. 1 KB, not 512 B: 512 could not hold a DOCUMENTED script — the
-// shipped lines.mlv is ~490 characters with its comments — and a script that overruns is silently
-// truncated mid-token, so it fails to compile with no hint that length was the reason. A binding is
-// ~2 KB at this size, which the smallest board still carries.
-static constexpr size_t  kMaxScriptBytes = 1024;
-
 static constexpr uint8_t kMaxSysVars  = 8;
 static constexpr uint8_t kArenaBytes  = kMaxCtrls + kMaxSysVars;
 
diff --git a/src/core/moonlive/MoonLiveCompiler.cpp b/src/core/moonlive/MoonLiveCompiler.cpp
index d6d0622e..0abbdd5e 100644
--- a/src/core/moonlive/MoonLiveCompiler.cpp
+++ b/src/core/moonlive/MoonLiveCompiler.cpp
@@ -115,12 +115,22 @@ struct Parser {
     VReg               nextTemp = kFirstTemp;   // high-water mark — also IrProgram.vregsUsed
     VReg               freeStack[kMaxVRegs] = {};   // recycled temps (LIFO), so a dead vreg is reused
     uint8_t            freeCount = 0;
-    // Script-local variables — today only a `for` loop's counter. Distinct from a declared control
-    // (a control is a UI value the script READS; a local is one the script WRITES) and from a temp
-    // (a temp is write-once and recycled). Held in a vreg for the loop's lifetime.
-    struct Local { const char* name; size_t nameLen; VReg reg; };
-    Local              locals[4] = {};
+    // Script-local variables — a `for` loop's counter and its limit. Distinct from a declared
+    // control (a control is a UI value the script READS; a local is one the script WRITES) and from
+    // a temp (a temp is write-once and recycled).
+    //
+    // A local lives in a FRAME SLOT, not a register. Holding it in a register for the whole of its
+    // scope is what made a nested loop unfittable on the smallest target: Xtensa's windowed ABI
+    // leaves ten registers, five carry the host arguments, and the reload temps take the rest — so a
+    // loop counter that never yields its register left nothing to compute with and every looped
+    // script was refused. In the frame, the number of live variables is bounded by memory rather
+    // than by the register file, which is the whole point of the stack machine, and it is also what
+    // makes function arguments and recursion fall out later rather than needing new machinery.
+    struct Local { const char* name; size_t nameLen; uint8_t slot; };
+    Local              locals[kMaxLocals] = {};
     uint8_t            localCount = 0;
+    uint8_t            slotHighWater = 0;   // slots currently in scope
+    uint8_t            slotsUsed = 0;       // PEAK slots — what the prologue reserves
     uint8_t            nextLabel = 0;          // IR label ids, handed out in source order
 
     DeclaredControl    controls[kMaxCtrls] = {};  // controls the script declared (decl lines)
@@ -154,10 +164,8 @@ struct Parser {
         return kFirstTemp;
     }
     void freeTemp(VReg v) {
-        // A loop variable's register is live for the whole loop, and parseExpr hands it back
-        // directly (see parsePrimary), so a consumer freeing "its" operand would recycle a vreg the
-        // loop still reads and the counter would be overwritten mid-iteration.
-        for (uint8_t i = 0; i < localCount; i++) if (locals[i].reg == v) return;
+        // No local-register guard is needed: a variable lives in a frame slot, and reading one
+        // hands back an ordinary temp that the consumer owns. Every vreg reaching here is a temp.
         if (v >= kFirstTemp && freeCount < kMaxVRegs) freeStack[freeCount++] = v;
     }
 
@@ -260,13 +268,14 @@ struct Parser {
             for (uint8_t li = 0; li < localCount; li++) {
                 if (locals[li].nameLen == lex.identLen &&
                     std::strncmp(locals[li].name, lex.identBeg, lex.identLen) == 0) {
-                    // Return the variable's OWN register rather than copying it into a temp. A copy
-                    // per read burns a vreg each time, and the budget is small — the lowerer needs
-                    // three scratch registers above the program's high-water mark, so a script has
-                    // about six temps in total. Callers must therefore not freeTemp() a local; the
-                    // free-list only ever holds values alloc() handed out.
+                    // Load the variable from its frame slot into a fresh temp. The temp is ordinary:
+                    // the caller consumes it and frees it like any other expression value, so a
+                    // variable occupies a register only for the instruction that reads it rather
+                    // than for the whole of its scope.
                     lex.advance();
-                    return locals[li].reg;
+                    VReg v = alloc();
+                    emit({IrOp::Reload, v, 0,0,0,0, locals[li].slot, nullptr, {}});
+                    return v;
                 }
             }
             int ci = findControl(lex.identBeg, lex.identLen);
@@ -294,18 +303,39 @@ struct Parser {
         lex.advance();
         if (!expect(Tok::LParen, "expected '(' after the function name")) return;
 
-        // Evaluate each argument expression into a vreg.
+        // Evaluate each argument, PARKING it in a frame slot as soon as it is finished.
+        //
+        // The op that consumes them reads every argument at once, so evaluating straight into vregs
+        // keeps all four live simultaneously — and each argument's own sub-expression needs
+        // registers on top of that. On Xtensa's ten that is what refused every looped effect: a
+        // four-operand setRGB left nothing to compute the operands WITH. Staging through the frame
+        // means only ONE argument occupies a register at a time; they come back together in the
+        // reload just before the op, where the peak is exactly the operand count and nothing more.
         VReg args[4] = {0,0,0,0};
+        uint8_t argSlot[4] = {0,0,0,0};
+        const uint8_t argSlotBase = slotHighWater;
         uint8_t n = 0;
         if (lex.kind != Tok::RParen) {
             while (true) {
                 if (n >= fn->argc || n >= 4) { fail("too many arguments"); return; }
-                args[n++] = parseExpr();
+                const VReg v = parseExpr();
                 if (failed) return;
+                if (slotHighWater >= kMaxLocals) { fail("expression too deeply nested"); return; }
+                argSlot[n] = slotHighWater++;
+                emit({IrOp::Spill, 0, v, 0,0,0, argSlot[n], nullptr, {}});
+                freeTemp(v);                       // its register is free again immediately
+                n++;
                 if (lex.kind == Tok::Comma) { lex.advance(); continue; }
                 break;
             }
         }
+        // Bring the arguments back for the one instruction that reads them.
+        for (uint8_t i = 0; i < n; i++) {
+            args[i] = alloc();
+            emit({IrOp::Reload, args[i], 0,0,0,0, argSlot[i], nullptr, {}});
+        }
+        if (slotHighWater > slotsUsed) slotsUsed = slotHighWater;
+        slotHighWater = argSlotBase;               // the staging slots are scratch, reused per call
         if (n != fn->argc) { fail("wrong number of arguments"); return; }
         if (!expect(Tok::RParen, "expected ')'")) return;
 
@@ -414,7 +444,9 @@ struct Parser {
 
         // --- init: ident = expr ---
         if (lex.kind != Tok::Ident) { fail("expected a loop variable"); return false; }
-        if (localCount >= 4) { fail("too many nested loops"); return false; }
+        // Two slots per loop: the counter and the limit. Both must outlive the body, and both live
+        // in the frame — nesting depth is now bounded by frame slots, not by the register file.
+        if (localCount + 2 > kMaxLocals) { fail("too many nested loops"); return false; }
         const char* varName = lex.identBeg;
         const size_t varLen = lex.identLen;
         if (sysvars.find(varName, varLen)) { fail("name is a system variable"); return false; }
@@ -431,11 +463,12 @@ struct Parser {
         if (!expect(Tok::Assign, "expected '=' in the for's first clause")) return false;
         VReg init = parseExpr();
         if (failed) return false;
-        VReg counter = alloc();
-        emit({IrOp::Mov, counter, init, 0,0,0, 0, nullptr, {}});
+        // The counter starts life in its slot; the temp that computed it is released immediately.
+        const uint8_t counterSlot = slotHighWater++;
+        emit({IrOp::Spill, 0, init, 0,0,0, counterSlot, nullptr, {}});
         freeTemp(init);
         const uint8_t myLocal = localCount;
-        locals[localCount++] = {varName, varLen, counter};
+        locals[localCount++] = {varName, varLen, counterSlot};
         if (!expect(Tok::Semicolon, "expected ';' after the for's first clause")) return false;
 
         // --- condition: ident < expr  (the only comparison the language has) ---
@@ -449,12 +482,14 @@ struct Parser {
         }
         lex.advance();
         if (!expect(Tok::Less, "expected '<' — it is the only comparison a for condition takes")) return false;
-        // Hold the bound in the vreg parseExpr produced rather than copying it into a fresh one.
-        // The copy cost a register for the whole body, and the budget is small: Xtensa maps twelve
-        // registers, five of which are argument slots, so a NESTED loop plus a three-argument call
-        // ran out and the compile was refused on that target while succeeding on the host.
-        VReg limit = parseExpr();
+        // The bound goes to its own slot: it is read at the entry guard and again at the back edge,
+        // so it has to survive the body — and a body containing a call would otherwise have to keep
+        // it in a register across that call.
+        VReg limitTmp = parseExpr();
         if (failed) return false;
+        const uint8_t limitSlot = slotHighWater++;
+        emit({IrOp::Spill, 0, limitTmp, 0,0,0, limitSlot, nullptr, {}});
+        freeTemp(limitTmp);
         if (!expect(Tok::Semicolon, "expected ';' after the for's condition")) return false;
 
         // --- step: ident = expr (parsed now, emitted after the body) ---
@@ -483,7 +518,16 @@ struct Parser {
         const uint8_t lDone = nextLabel++;
         const uint8_t lTop  = nextLabel++;
 
-        emit({IrOp::BranchGe, 0, counter, limit, 0,0, lDone, nullptr, {}});   // empty range
+        // Each test reloads both operands: they live in the frame, so a comparison is
+        // load-load-branch. The reload temps die immediately, which is what keeps the body's
+        // register demand independent of how deeply loops nest.
+        {
+            VReg c = alloc(), l = alloc();
+            emit({IrOp::Reload, c, 0,0,0,0, counterSlot, nullptr, {}});
+            emit({IrOp::Reload, l, 0,0,0,0, limitSlot,   nullptr, {}});
+            emit({IrOp::BranchGe, 0, c, l, 0,0, lDone, nullptr, {}});   // empty range
+            freeTemp(l); freeTemp(c);
+        }
         emit({IrOp::Label,    0, 0,0,0,0,             lTop,  nullptr, {}});
 
         while (!failed && lex.kind != Tok::RBrace && lex.kind != Tok::End) {
@@ -504,25 +548,29 @@ struct Parser {
             if (lex.kind != Tok::RParen) {
                 lex = save; fail("unexpected token in the for's step"); return false;
             }
-            emit({IrOp::Mov, counter, s, 0,0,0, 0, nullptr, {}});
+            emit({IrOp::Spill, 0, s, 0,0,0, counterSlot, nullptr, {}});
             freeTemp(s);
             lex = save;
         }
         // Re-test the limit at the top rather than relying on equality alone: a step that jumps
         // PAST the limit would never make counter == limit, and the loop would run away.
-        emit({IrOp::BranchGe, 0, counter, limit, 0,0, lDone, nullptr, {}});
-        emit({IrOp::BranchNe, 0, counter, limit, 0,0, lTop,  nullptr, {}});
+        {
+            VReg c = alloc(), l = alloc();
+            emit({IrOp::Reload, c, 0,0,0,0, counterSlot, nullptr, {}});
+            emit({IrOp::Reload, l, 0,0,0,0, limitSlot,   nullptr, {}});
+            emit({IrOp::BranchGe, 0, c, l, 0,0, lDone, nullptr, {}});
+            emit({IrOp::BranchNe, 0, c, l, 0,0, lTop,  nullptr, {}});
+            freeTemp(l); freeTemp(c);
+        }
         emit({IrOp::Label,    0, 0,0,0,0,             lDone, nullptr, {}});
 
-        freeTemp(limit);
         localCount = myLocal;                              // the loop variable leaves scope
-        // ...and its REGISTER goes back to the pool. Dropping only the name left the vreg allocated
-        // for the rest of the compile, so every `for` a script wrote cost one permanently — two
-        // sequential loops held two counters even though the first was dead. That is what put a
-        // two-loop effect one register over the smallest file (Xtensa has twelve) while each loop
-        // compiled fine alone. Freed only AFTER localCount drops, since freeTemp refuses to recycle
-        // a register any live local still names.
-        freeTemp(counter);
+        // ...and its two SLOTS are returned, so sequential loops reuse the same frame space instead
+        // of each costing its own for the rest of the program. Nesting still stacks, which is what
+        // makes a script bounded by frame size rather than by register count. `slotsUsed` keeps the
+        // PEAK, because that is what the prologue has to reserve.
+        if (slotHighWater > slotsUsed) slotsUsed = slotHighWater;
+        slotHighWater = counterSlot;
         return true;
     }
 
@@ -555,17 +603,42 @@ struct Parser {
 }  // namespace
 
 CompileResult compileSource(const char* source, const BuiltinTable& table,
-                            const SysVarTable& sysvars, uint8_t* out, size_t cap) {
+                            const SysVarTable& sysvars, uint8_t* out, size_t cap,
+                            const RegBudget* squeeze, LowerFn lower) {
     CompileResult r;
     if (!source) { r.error = "no source"; return r; }
     if (!out || cap == 0) { r.error = "no code buffer"; return r; }
 
-    Lexer lex(source);
+    // Size the op array to THIS script before parsing. The bound is per-TOKEN rather than
+    // per-construct: no token the lexer can produce lowers to more than a handful of ops (the
+    // densest is a call argument — evaluate, then the Call itself), so counting tokens and
+    // multiplying is an over-estimate that cannot undershoot. Over-estimating costs a few unused
+    // entries on a cold path; undershooting would fail a script that fits, so the direction of the
+    // error is the whole point. push() still refuses past `cap`, so a wrong estimate degrades with
+    // a diagnostic rather than corrupting memory.
+    uint32_t tokens = 0;
+    for (Lexer scan(source); scan.kind != Tok::End && scan.kind != Tok::Error; scan.advance()) {
+        if (++tokens > kMaxIrOps) break;   // runaway source — reserve() rejects past the bound
+    }
     IrProgram ir;
+    // +8 covers a program's fixed overhead (the prologue/epilogue ops a tiny script still needs)
+    // so a one-token source cannot round down to nothing.
+    if (!ir.reserve(static_cast<uint16_t>(tokens * kIrOpsPerToken + 8 > kMaxIrOps
+                                          ? kMaxIrOps : tokens * kIrOpsPerToken + 8))) {
+        r.error = "script too large";
+        return r;
+    }
+    Lexer lex(source);
     Parser parser{lex, table, sysvars, ir};
     if (!parser.parseProgram()) { r.error = parser.error; r.errorCol = parser.errorCol; return r; }
-
-    size_t len = lowerToBytes(ir, out, cap);
+    // Hand the backend the frame the script's variables need. The register allocator numbers any
+    // further slot from here up, so the two never overlap in the one frame they share.
+    ir.localSlots = parser.slotsUsed;
+
+    // `lower` is normally this build's own backend; a test passes a DIFFERENT ISA's lowerer to read
+    // what a device would execute without flashing one. The front end is identical either way, which
+    // is the point — the seam is one function pointer, not a second copy of the compiler.
+    size_t len = lower ? lower(ir, out, cap, squeeze) : lowerToBytes(ir, out, cap, squeeze);
     if (len == 0) { r.error = kCodegenFailed; return r; }
     r.ok = true;
     r.len = len;
diff --git a/src/core/moonlive/MoonLiveCompiler.h b/src/core/moonlive/MoonLiveCompiler.h
index de6b4f98..137bff7a 100644
--- a/src/core/moonlive/MoonLiveCompiler.h
+++ b/src/core/moonlive/MoonLiveCompiler.h
@@ -4,6 +4,7 @@
 #include <cstddef>
 #include "core/moonlive/MoonLiveBuiltins.h"
 #include "core/moonlive/MoonLiveIr.h"      // DeclaredControl, kMaxCtrls (surfaced on CompileResult)
+#include "core/moonlive/moonlive_emit.h"   // RegBudget — the test-only register-budget override
 
 // MoonLive front-end (§3.2) — the platform-independent compiler: source text → tokens → AST →
 // IR → native code (via the per-ISA assembler). The grammar is a single statement that is a
@@ -43,7 +44,17 @@ struct CompileResult {
 // Pure: no I/O, no allocation beyond the caller's buffer.
 /// `sysvars` are names the HOST defines and a script may only read (`t`, `width`, …). They are
 /// reserved: a declaration that reuses one fails to compile, so a name means one thing everywhere.
+/// `squeeze` overrides the register budget the backend would pick for itself. It is the seam that
+/// makes the register allocator testable: on a host with fourteen registers, compiling the same
+/// script at the full budget and at a deliberately smaller one must render IDENTICAL pixels — the
+/// spilled program and the unspilled one are the same program. Production callers omit it.
+/// The IR→bytes step, as a function pointer. Normally null, meaning "this build's own backend".
+/// A test passes ANOTHER ISA's lowerer to read what a device would execute without flashing one —
+/// the front end is identical either way, so the seam is one pointer rather than a second compiler.
+using LowerFn = size_t (*)(IrProgram&, uint8_t*, size_t, const RegBudget*);
+
 CompileResult compileSource(const char* source, const BuiltinTable& table,
-                            const SysVarTable& sysvars, uint8_t* out, size_t cap);
+                            const SysVarTable& sysvars, uint8_t* out, size_t cap,
+                            const RegBudget* squeeze = nullptr, LowerFn lower = nullptr);
 
 }  // namespace mm::moonlive
diff --git a/src/core/moonlive/MoonLiveIr.h b/src/core/moonlive/MoonLiveIr.h
index 598e0b83..e16483ad 100644
--- a/src/core/moonlive/MoonLiveIr.h
+++ b/src/core/moonlive/MoonLiveIr.h
@@ -3,6 +3,7 @@
 #include <cstdint>
 #include <cstddef>
 #include "core/moonlive/MoonLiveBuiltins.h"   // InlineOp (a neutral opcode tag)
+#include "platform/platform.h"                // alloc/free — the op array is sized to the script
 
 // MoonLive IR — the typed intermediate representation between the front-end and the per-ISA
 // assembler (§3.2 of livescripts-analysis-top-down.md). The front-end lowers an AST to a flat
@@ -29,8 +30,20 @@ using VReg = uint8_t;
 // updates live, without a recompile (the kArg3/t pattern, one slot over).
 enum : VReg { kArg0 = 0, kArg1 = 1, kArg2 = 2, kArg3 = 3, kArg4 = 4, kFirstTemp = 5 };
 
-static constexpr uint8_t kMaxVRegs = 16;     // a statement uses a handful; no allocator yet
-static constexpr uint8_t kMaxIrOps = 64;     // a statement is a handful of ops; fixed, no heap
+// How many values one program may NAME. Deliberately larger than any target's register file: the
+// register allocator (MoonLiveSpill.h) parks whatever does not fit in frame slots, so this bounds
+// the compiler's own tables — the interval array is one entry per vreg, on the stack of a 12 KB task
+// — rather than the script. 32 keeps that array at a few hundred bytes.
+static constexpr uint8_t kMaxVRegs = 32;
+// An upper SANITY bound, not the working limit: the op array is sized to the script (see IrProgram),
+// so a one-statement script pays for one statement. This exists only so a runaway source fails with
+// a diagnostic instead of asking for an allocation that would exhaust a small device's heap.
+static constexpr uint16_t kMaxIrOps = 4096;
+
+// Ops a single source token can lower to, worst case. The compiler sizes its op array by counting
+// tokens and multiplying — an over-estimate by construction, which is the safe direction: a few
+// unused entries on a cold path, versus refusing a script that would have fit.
+static constexpr uint16_t kIrOpsPerToken = 4;
 
 // The op set — neutral. Three-address form: dst plus up to three source operands. (Counted
 // Control flow arrived with the script-level `for`, which is what the note here anticipated: the
@@ -54,8 +67,16 @@ enum class IrOp : uint8_t {
     BranchGe,  // if (a >= b) goto label `imm` — UNSIGNED. The loop's ENTRY guard: skip a loop
                // whose range is empty, which is also what makes `for (i = 0; i < 0; …)` correct.
     BranchNe,  // if (a != b) goto label `imm` — the BACKWARD edge that closes the loop.
+    Spill,     // frame slot `imm` = a   — a value the register file could not hold, parked
+    Reload,    // dst = frame slot `imm` — the same value brought back for one use
 };
 
+// Spill/Reload are the register allocator's output, never the parser's: MoonLiveSpill rewrites a
+// program that names more live values than the target has registers into one that fits, parking the
+// overflow in the CALL FRAME (the textbook answer — a value that outlives the register file lives in
+// memory). `imm` is a slot INDEX; each backend turns it into an offset from its own frame pointer,
+// so the core pass never knows a stack layout and the backends never know the algorithm.
+
 // Why these two branches and no unconditional jump: a bottom-tested loop needs exactly an entry
 // guard and a back edge, and every backend here already has both (bgeu / bne on Xtensa and RISC-V,
 // cmp + b.hs / b.ne on arm64). It is the shape FillElems has always lowered by hand, so the
@@ -91,19 +112,58 @@ struct DeclaredControl {
 /// rather than silently miscompiling past it. Nesting depth is bounded separately, by `locals`.
 static constexpr uint8_t kIrLabels = 16;
 
+/// Script variables live in FRAME SLOTS, and this bounds how many one program may hold at once.
+/// Sixteen matches what every backend's frame can address (`kMaxSpillSlots`), so a program that
+/// parses is a program the assembler can encode. Raising it means widening the frame on all three
+/// backends together — the slot index is an instruction field, not just a table size.
+static constexpr uint8_t kMaxLocals = 16;
+
 
 static constexpr uint8_t kMaxControlName = 24;   // max control-name length (incl. NUL); the compiler
                                                  // rejects longer names so the binding's name pool
                                                  // can't truncate distinct names into a collision
 
-// A lowered program: a fixed list of ops plus the vreg high-water mark.
+// A lowered program: the ops, sized to the script, plus the vreg high-water mark.
+//
+// The op array is HEAP-ALLOCATED rather than an `IrInst ops[kMaxIrOps]` member. As a member it cost
+// the same ~2 KB of STACK for a one-statement script as for a full one, and this object is a local
+// on the compile path of a 12 KB main task — so raising the ceiling by growing the array would have
+// traded a compile limit for a stack overflow (this project has already lost a P4 to a large stack
+// frame). Sizing to the script makes the small case cheaper AND the large case possible.
+// Compilation is cold path, so the allocation costs nothing that matters.
+//
+// Ownership is RAII: one allocation, freed in the destructor, copying deleted. There is no manual
+// free path to miss — the reverted 32026eb5 turned four tables into independently-nullable pointers
+// and its own comment records the heap corruption that followed from missing one guard.
 struct IrProgram {
-    IrInst  ops[kMaxIrOps];
-    uint8_t count = 0;
-    VReg    vregsUsed = kFirstTemp;
+    IrInst*  ops = nullptr;
+    uint16_t cap = 0;                      // entries allocated
+    uint16_t count = 0;
+    VReg     vregsUsed = kFirstTemp;
+    /// Frame slots the FRONT END allocated for script variables. Slot indices 0..localSlots-1 are
+    /// already spoken for when the backend sizes its prologue, and the register allocator numbers
+    /// any spill it still needs from here up — the two share one frame, so they cannot both start
+    /// at zero without a variable and a spilled temp landing on the same bytes.
+    uint8_t  localSlots = 0;
+
+    IrProgram() = default;
+    ~IrProgram() { platform::free(ops); }
+    IrProgram(const IrProgram&) = delete;              // owns a buffer; a copy would double-free
+    IrProgram& operator=(const IrProgram&) = delete;
+
+    /// Size the op array to `n` entries. False when the allocation fails or `n` exceeds the sanity
+    /// bound, so the caller reports a diagnostic instead of writing through a null pointer.
+    bool reserve(uint16_t n) {
+        if (n == 0 || n > kMaxIrOps) return false;
+        platform::free(ops);
+        ops = static_cast<IrInst*>(platform::alloc(sizeof(IrInst) * n));
+        cap = ops ? n : 0;
+        count = 0;
+        return ops != nullptr;
+    }
 
     bool push(const IrInst& i) {
-        if (count >= kMaxIrOps) return false;
+        if (!ops || count >= cap) return false;
         // Reject any op that names a vreg outside the fixed register budget — an invalid program
         // is dropped at the seam rather than reaching a backend that would index past its map.
         if (i.dst >= kMaxVRegs || i.a >= kMaxVRegs || i.b >= kMaxVRegs ||
@@ -113,6 +173,18 @@ struct IrProgram {
         return true;
     }
 
+    /// Exchange contents with `o`. The register allocator builds the rewritten program in a second
+    /// IrProgram (inserting a Reload before a use and a Spill after a def cannot be done in place in
+    /// a right-sized array) and swaps it in; the old buffer then dies with the local. Copy is deleted
+    /// precisely because two owners would double-free, so a swap is how ownership moves here.
+    void swap(IrProgram& o) {
+        IrInst* p = ops; ops = o.ops; o.ops = p;
+        uint16_t t = cap; cap = o.cap; o.cap = t;
+        t = count; count = o.count; o.count = t;
+        VReg v = vregsUsed; vregsUsed = o.vregsUsed; o.vregsUsed = v;
+        uint8_t ls = localSlots; localSlots = o.localSlots; o.localSlots = ls;
+    }
+
     /// Which inline ops this program contains, so a backend reserves scratch only for what is there.
     ///
     /// The backends reserved their maximum unconditionally, which cost a register no matter what the
@@ -122,7 +194,7 @@ struct IrProgram {
     /// fold into the index vreg) and stays with each backend; WHICH ops are present is a property of
     /// the program, so it is answered once here.
     bool hasInline(InlineOp which) const {
-        for (uint8_t i = 0; i < count; i++)
+        for (uint16_t i = 0; i < count; i++)   // uint16_t: `count` is, so a uint8_t never terminates
             if (ops[i].op == IrOp::Inline && ops[i].inlineOp == which) return true;
         return false;
     }
diff --git a/src/core/moonlive/MoonLiveSpill.cpp b/src/core/moonlive/MoonLiveSpill.cpp
new file mode 100644
index 00000000..54879993
--- /dev/null
+++ b/src/core/moonlive/MoonLiveSpill.cpp
@@ -0,0 +1,360 @@
+#include "core/moonlive/MoonLiveSpill.h"
+
+// Linear-scan register allocation with spilling to the call frame. See MoonLiveSpill.h for why this
+// lives in core rather than in each backend.
+//
+// The shape of the frame is the part that has to survive what comes next. MoonLive is gaining
+// user-defined functions — with arguments, loops, and recursion — so the overflow storage is
+// deliberately a CALL FRAME addressed through a frame pointer, not a global slot file: slot `n` is
+// an offset from the frame the currently-executing routine owns, and a nested or recursive call
+// pushes its own. A global file would work for one top-level program and would then have to be
+// thrown away, because two activations of the same function would share the same slot and the inner
+// one would clobber the outer's values.
+
+namespace mm::moonlive {
+
+namespace {
+
+// Reload temps: registers held back from allocation so a spilled operand has somewhere to land for
+// the one instruction that reads it. Four is the worst case, set by the widest op — the StoreElem
+// inline reads a, b, c AND d. A dst reuses a source temp rather than claiming a fifth: every op here
+// is one machine instruction that reads its sources and then writes its destination, so `mul d,a,b`
+// with d aliasing a is well-defined on all three ISAs, and on a target with twelve registers the
+// fifth would be a real cost.
+constexpr uint8_t kMaxReloadTemps = 4;
+
+// One value's live range, in op indices. `end` is the last index that mentions the vreg, AFTER loop
+// extension. Sixteen bytes per vreg with kMaxVRegs = 32: a few hundred bytes of stack, small enough
+// to stay a local on the 12 KB task the compile shares (a classic ESP32 has already been watchdog
+// reset by this path; a heap allocation here would be a second failure mode for no gain).
+struct Interval {
+    uint16_t start = 0;
+    uint16_t end = 0;
+    VReg     vreg = 0;
+    bool     live = false;      // does this vreg appear at all?
+    bool     spilled = false;
+    uint8_t  slot = 0;          // frame slot, when spilled
+    VReg     assigned = 0;      // compacted register number, when not
+};
+
+// A loop, as op indices: the header (where the back edge lands) and the back edge itself. The
+// grammar has no break, continue or goto, so a loop is EXACTLY a BranchNe whose label was bound
+// earlier in the array — the op array is already in reverse postorder and no CFG has to be built.
+// That is the one bespoke simplification here, and it carries the guard below: a branch structure
+// that is not properly nested makes the pass refuse rather than allocate against a wrong interval,
+// so adding `break` later fails loudly instead of miscompiling in silence.
+struct Loop { uint16_t header; uint16_t back; };
+
+// Every vreg an op READS. Written as one function so the interval builder and the rewriter cannot
+// disagree about which operand fields an op uses — a mismatch there is exactly the bug that produces
+// a value spilled but never reloaded.
+uint8_t sourcesOf(const IrInst& in, VReg* out) {
+    switch (in.op) {
+        case IrOp::Const:                                   return 0;
+        case IrOp::Reload:                                  return 0;
+        case IrOp::Label:                                   return 0;
+        case IrOp::Mov:
+        case IrOp::AddImm:
+        case IrOp::Spill:      out[0] = in.a;               return 1;
+        case IrOp::LoadCtrl:   out[0] = kArg4;              return 1;   // reads the arena pointer
+        case IrOp::Add:
+        case IrOp::Mul:
+        case IrOp::BranchGe:
+        case IrOp::BranchNe:   out[0] = in.a; out[1] = in.b; return 2;
+        case IrOp::Call:       out[0] = in.a; out[1] = in.b; out[2] = in.c; return 3;
+        case IrOp::Inline:
+            // The inline ops read every operand field the host filled in. Both of today's ops also
+            // read kArg0..kArg2 (buf, nLights, cpl), but those are fixed ABI vregs this pass never
+            // reassigns, so they need no interval.
+            out[0] = in.a; out[1] = in.b; out[2] = in.c; out[3] = in.d;
+            return 4;
+    }
+    return 0;
+}
+
+// Does this op WRITE its dst? Branches, Label, Spill and the inline ops do not — their dst field is
+// a zero the front-end never fills in, and reading it as a definition would give vreg 0 (kArg0, the
+// buffer pointer) a spurious live range that the allocator would then try to manage.
+bool writesDst(IrOp op) {
+    switch (op) {
+        case IrOp::Label: case IrOp::BranchGe: case IrOp::BranchNe:
+        case IrOp::Spill: case IrOp::Inline: return false;
+        default: return true;
+    }
+}
+
+}  // namespace
+
+bool spillToBudget(IrProgram& ir, const RegBudget& budget, uint8_t& slotsUsed) {
+    // The front end already owns slots 0..localSlots-1 for the script's variables, and both live in
+    // the ONE frame — so a spill numbered from zero would land on a loop counter. Start above them,
+    // and report the total the prologue must reserve.
+    slotsUsed = ir.localSlots;
+    if (!ir.ops) return false;
+
+    const uint8_t avail = budget.allocatable();
+    // The front end's own variables have to fit the frame whether or not anything spills — it hands
+    // out slot indices without knowing the target, and a slot the backend cannot address would be
+    // encoded as a truncated offset writing over something else. Checked BEFORE the early return
+    // below, or a program that needs no spilling skips the check entirely.
+    if (ir.localSlots > budget.slots) return false;
+
+    // Already fits: leave the program byte-identical. A script that never needed the allocator must
+    // not pay a renumbering for its existence — and this is the path every shipped script takes.
+    if (ir.vregsUsed <= avail) return true;
+    if (ir.vregsUsed > kMaxVRegs) return false;
+
+    // The fixed ABI vregs (buf, nLights, cpl, t, ctrls) arrive in machine registers the host chose
+    // and every backend indexes them directly, so they can be neither renumbered nor spilled. They
+    // plus the reload temps are the floor: below it there is nothing left to allocate WITH, and the
+    // honest answer is to refuse rather than emit code that names a register the target lacks.
+    // Reserve temps for the widest op this program ACTUALLY contains, counting DISTINCT sources —
+    // not for the widest op the IR can express.
+    //
+    // The reservation is pure overhead for a program that never uses it, and it is subtracted from a
+    // register file that on Xtensa is ten deep. Reserving the theoretical maximum of four left
+    // 10 - 1 scratch - 5 fixed ABI vregs - 4 = ZERO keepable, so every looped script was refused
+    // outright ("codegen failed") — the allocator had nothing to allocate with. Counting what the
+    // program needs is both correct and what makes a loop fit at all on the smallest target.
+    // Only a FIXED ABI vreg is exempt: those arrive in registers and are never spilled, so an op
+    // reading `buf` or `t` needs no temp for it. Everything else may end up in a slot and therefore
+    // may need somewhere to land, so count the distinct non-ABI sources of the widest op present.
+    //
+    // Note the shape this leaves on Xtensa: 10 registers - 1 inline scratch - 5 fixed ABI vregs
+    // leaves 4, and a setRGB reads exactly 4 distinct operands — so a looped effect lands on
+    // keepable == 0 and is refused. The pass is right to refuse (it has nothing to allocate with);
+    // what is wrong is that FIVE registers are reserved for host arguments that a script reads
+    // rarely. Freeing those is register-promotion work, deliberately out of scope for this step.
+    uint8_t reloadTemps = 0;
+    for (uint16_t i = 0; i < ir.count; i++) {
+        VReg s[4];
+        const uint8_t n = sourcesOf(ir.ops[i], s);
+        uint8_t distinct = 0;
+        for (uint8_t a = 0; a < n; a++) {
+            if (s[a] < kFirstTemp) continue;                 // a fixed ABI vreg: always a register
+            bool seen = false;
+            for (uint8_t b = 0; b < a; b++) if (s[b] == s[a]) { seen = true; break; }
+            if (!seen) distinct++;
+        }
+        if (distinct > reloadTemps) reloadTemps = distinct;
+    }
+    if (reloadTemps > kMaxReloadTemps) reloadTemps = kMaxReloadTemps;
+    if (avail <= kFirstTemp + reloadTemps) return false;
+    const uint8_t keepable = static_cast<uint8_t>(avail - kFirstTemp - reloadTemps);
+
+    // --- 1. Find the loops, innermost first ----------------------------------------------------
+    // Bounded by kIrLabels because a loop needs a label, so this array cannot overflow a program the
+    // front-end could build.
+    Loop loops[kIrLabels];
+    uint8_t loopCount = 0;
+    {
+        int32_t labelAt[kIrLabels];
+        for (auto& p : labelAt) p = -1;
+        for (uint16_t i = 0; i < ir.count; i++)
+            if (ir.ops[i].op == IrOp::Label && ir.ops[i].imm >= 0 && ir.ops[i].imm < kIrLabels)
+                labelAt[ir.ops[i].imm] = i;
+        for (uint16_t i = 0; i < ir.count; i++) {
+            const IrInst& in = ir.ops[i];
+            if (in.op != IrOp::BranchNe) continue;
+            if (in.imm < 0 || in.imm >= kIrLabels) return false;      // an unbindable label: refuse
+            const int32_t tgt = labelAt[in.imm];
+            if (tgt < 0 || static_cast<uint16_t>(tgt) > i) continue;  // forward branch — not a loop
+            if (loopCount >= kIrLabels) return false;
+            loops[loopCount++] = {static_cast<uint16_t>(tgt), i};
+        }
+        // Proper nesting is what makes "innermost first" meaningful and what the extension rule below
+        // assumes. Two loops must be disjoint or one must contain the other; anything else (which is
+        // what a `break` or a `goto` would produce) is refused here rather than allocated against an
+        // interval that does not describe the real control flow.
+        for (uint8_t x = 0; x < loopCount; x++)
+            for (uint8_t y = static_cast<uint8_t>(x + 1); y < loopCount; y++) {
+                const bool disjoint = loops[x].back < loops[y].header || loops[y].back < loops[x].header;
+                const bool xInY = loops[y].header <= loops[x].header && loops[x].back <= loops[y].back;
+                const bool yInX = loops[x].header <= loops[y].header && loops[y].back <= loops[x].back;
+                if (!disjoint && !xInY && !yInX) return false;
+            }
+    }
+
+    // --- 2. Live intervals, then loop extension -------------------------------------------------
+    Interval iv[kMaxVRegs];
+    for (uint8_t v = 0; v < kMaxVRegs; v++) iv[v].vreg = v;
+
+    auto mention = [&](VReg v, uint16_t at) {
+        if (v >= kMaxVRegs) return;
+        if (!iv[v].live) { iv[v].live = true; iv[v].start = at; iv[v].end = at; return; }
+        if (at < iv[v].start) iv[v].start = at;
+        if (at > iv[v].end)   iv[v].end = at;
+    };
+    for (uint16_t i = 0; i < ir.count; i++) {
+        const IrInst& in = ir.ops[i];
+        VReg src[4];
+        const uint8_t n = sourcesOf(in, src);
+        for (uint8_t s = 0; s < n; s++) mention(src[s], i);
+        if (writesDst(in.op)) mention(in.dst, i);
+    }
+
+    // A value whose live range TOUCHES a loop is live to that loop's end. Naive first-def-to-last-use
+    // is wrong across a back edge: a value defined before the loop and last read early in the body
+    // looks dead from the second instruction onward, so the scan would hand its register to something
+    // else and the next iteration would read that other value. Extension can only LENGTHEN a range,
+    // so its error direction is a needless spill, never a wrong one. Innermost-first, because an
+    // extension to an inner loop's end may then have to reach the enclosing loop's end as well.
+    for (uint8_t pass = 0; pass < loopCount; pass++) {
+        // pick the innermost unprocessed loop = the one containing no other unprocessed loop
+        uint8_t pickIdx = 0xff;
+        for (uint8_t x = 0; x < loopCount; x++) {
+            if (loops[x].header == 0xffff) continue;                  // already processed
+            bool containsAnother = false;
+            for (uint8_t y = 0; y < loopCount; y++) {
+                if (y == x || loops[y].header == 0xffff) continue;
+                if (loops[x].header <= loops[y].header && loops[y].back <= loops[x].back)
+                    containsAnother = true;
+            }
+            if (!containsAnother) { pickIdx = x; break; }
+        }
+        if (pickIdx == 0xff) break;
+        const Loop lp = loops[pickIdx];
+        loops[pickIdx].header = 0xffff;                               // mark processed
+        for (uint8_t v = 0; v < kMaxVRegs; v++)
+            if (iv[v].live && iv[v].start <= lp.back && iv[v].end >= lp.header && iv[v].end < lp.back)
+                iv[v].end = lp.back;
+    }
+
+    // --- 3. Linear scan (Poletto & Sarkar) ------------------------------------------------------
+    // Sweep the temps in order of increasing interval start, keeping an `active` set ordered by
+    // increasing end. When the set is full, the interval with the FURTHEST end is spilled — it is the
+    // one whose register would otherwise be tied up longest, so freeing it buys the most.
+    VReg order[kMaxVRegs];
+    uint8_t nOrder = 0;
+    for (uint8_t v = kFirstTemp; v < ir.vregsUsed; v++) if (iv[v].live) order[nOrder++] = v;
+    for (uint8_t i = 1; i < nOrder; i++) {                            // insertion sort: nOrder <= 32
+        const VReg k = order[i];
+        uint8_t j = i;
+        while (j > 0 && iv[order[j - 1]].start > iv[k].start) { order[j] = order[j - 1]; j--; }
+        order[j] = k;
+    }
+
+    VReg active[kMaxVRegs];
+    uint8_t nActive = 0;
+    uint8_t nSpilled = ir.localSlots;
+    for (uint8_t i = 0; i < nOrder; i++) {
+        const VReg cur = order[i];
+        // expire: everything whose interval ended before this one starts is free again
+        uint8_t w = 0;
+        for (uint8_t j = 0; j < nActive; j++)
+            if (iv[active[j]].end >= iv[cur].start) active[w++] = active[j];
+        nActive = w;
+
+        if (nActive < keepable) {
+            active[nActive++] = cur;
+            // keep `active` sorted by end so the furthest is always the last element
+            for (uint8_t j = nActive - 1; j > 0 && iv[active[j - 1]].end > iv[active[j]].end; j--) {
+                const VReg t = active[j]; active[j] = active[j - 1]; active[j - 1] = t;
+            }
+            continue;
+        }
+        const VReg furthest = active[nActive - 1];
+        if (iv[furthest].end > iv[cur].end) {
+            iv[furthest].spilled = true;
+            iv[furthest].slot = nSpilled++;
+            active[nActive - 1] = cur;
+            for (uint8_t j = nActive - 1; j > 0 && iv[active[j - 1]].end > iv[active[j]].end; j--) {
+                const VReg t = active[j]; active[j] = active[j - 1]; active[j - 1] = t;
+            }
+        } else {
+            iv[cur].spilled = true;
+            iv[cur].slot = nSpilled++;
+        }
+    }
+    if (nSpilled > budget.slots) return false;   // the frame cannot address that many slots
+
+    // --- 4. Compact the survivors ---------------------------------------------------------------
+    // The kept temps take the register numbers directly above the fixed ABI vregs, so the rewritten
+    // program's high-water mark drops to something the target actually has. The reload temps sit
+    // above them, and the backend's own inline scratch above that — a single ascending layout, which
+    // is what lets each backend keep computing its scratch from vregsUsed as it already does.
+    VReg next = kFirstTemp;
+    for (uint8_t v = kFirstTemp; v < ir.vregsUsed; v++)
+        if (iv[v].live && !iv[v].spilled) iv[v].assigned = next++;
+    for (uint8_t v = 0; v < kFirstTemp; v++) { iv[v].assigned = v; iv[v].spilled = false; }
+    const VReg firstTemp = next;                            // the reload temps start here
+    const VReg newHighWater = static_cast<VReg>(firstTemp + reloadTemps);
+
+    // --- 5. Rewrite -----------------------------------------------------------------------------
+    // Into a SECOND program: a Reload has to be inserted before the op that reads a spilled value and
+    // a Spill after the op that defines one, and a right-sized array has no room to shift into.
+    IrProgram out;
+    // Worst case per op: four Reloads, the op, one Spill. Over-estimating costs a cold-path
+    // allocation; under-estimating would fail a script that fits, so the direction is deliberate.
+    const uint32_t want = static_cast<uint32_t>(ir.count) * (kMaxReloadTemps + 2);
+    if (want > kMaxIrOps) return false;
+    if (!out.reserve(static_cast<uint16_t>(want))) return false;
+
+    auto emit = [&](const IrInst& in) {
+        // push() also re-validates every vreg against kMaxVRegs, so a rewrite that named a register
+        // outside the budget fails the compile here instead of reaching a backend's register map.
+        if (!out.push(in)) return false;
+        return true;
+    };
+
+    for (uint16_t i = 0; i < ir.count; i++) {
+        IrInst in = ir.ops[i];
+        VReg src[4];
+        const uint8_t n = sourcesOf(in, src);
+
+        // Reload each DISTINCT spilled source into its own temp; a repeated operand reuses the temp
+        // already holding it, which is both cheaper and necessary — two Reloads of the same slot into
+        // different temps would be pure waste on the tightest register file here.
+        VReg tempOf[4] = {0, 0, 0, 0};
+        uint8_t nTemp = 0;
+        for (uint8_t s = 0; s < n; s++) {
+            const VReg v = src[s];
+            if (v >= kMaxVRegs || !iv[v].spilled) continue;
+            bool already = false;
+            for (uint8_t p = 0; p < s; p++) if (src[p] == v) { tempOf[s] = tempOf[p]; already = true; break; }
+            if (already) continue;
+            tempOf[s] = static_cast<VReg>(firstTemp + nTemp);
+            nTemp++;
+            IrInst rl{};
+            rl.op = IrOp::Reload;
+            rl.dst = tempOf[s];
+            rl.imm = iv[v].slot;
+            if (!emit(rl)) return false;
+        }
+
+        // Rewrite the operands in place: a spilled one now names its temp, a kept one its compacted
+        // number. LoadCtrl's source is kArg4, which is fixed, so it needs no case of its own.
+        auto mapped = [&](VReg v, uint8_t slotIdx) -> VReg {
+            if (v >= kMaxVRegs) return v;
+            return iv[v].spilled ? tempOf[slotIdx] : iv[v].assigned;
+        };
+        if (n > 0) in.a = mapped(src[0], 0);
+        if (n > 1) in.b = mapped(src[1], 1);
+        if (n > 2) in.c = mapped(src[2], 2);
+        if (n > 3) in.d = mapped(src[3], 3);
+
+        const bool dstSpilled = writesDst(in.op) && in.dst < kMaxVRegs && iv[in.dst].spilled;
+        const uint8_t dstSlot = dstSpilled ? iv[in.dst].slot : 0;
+        if (writesDst(in.op)) {
+            // A spilled destination is computed into a reload temp and then stored. It may reuse a
+            // temp that carried a source: the op reads its sources and writes its destination as one
+            // instruction, so the aliasing is the ordinary `add d, d, b` every ISA here defines.
+            in.dst = dstSpilled ? firstTemp : (in.dst < kMaxVRegs ? iv[in.dst].assigned : in.dst);
+        }
+        if (!emit(in)) return false;
+        if (dstSpilled) {
+            IrInst sp{};
+            sp.op = IrOp::Spill;
+            sp.a = firstTemp;
+            sp.imm = dstSlot;
+            if (!emit(sp)) return false;
+        }
+    }
+
+    out.vregsUsed = newHighWater;
+    ir.swap(out);
+    slotsUsed = nSpilled;
+    return true;
+}
+
+}  // namespace mm::moonlive
diff --git a/src/core/moonlive/MoonLiveSpill.h b/src/core/moonlive/MoonLiveSpill.h
new file mode 100644
index 00000000..1252c09e
--- /dev/null
+++ b/src/core/moonlive/MoonLiveSpill.h
@@ -0,0 +1,34 @@
+#pragma once
+
+#include <cstdint>
+
+#include "core/moonlive/MoonLiveIr.h"
+#include "core/moonlive/moonlive_emit.h"   // RegBudget — the one thing a backend tells the allocator
+
+// MoonLive register allocation — linear scan with spilling (Poletto & Sarkar, "Linear Scan Register
+// Allocation", ACM TOPLAS 1999). The pass that makes a script's complexity a MEMORY question rather
+// than a register-count one: a program naming more live values than the target has registers is
+// rewritten so the overflow lives in the call frame, instead of being refused.
+//
+// It lives in CORE, once. Correct spilling across a loop back edge is the hardest logic in this
+// compiler, and only the arm64 backend is ever executed by tests — three copies would leave two
+// permanently untested (CLAUDE.md Principle 3). Every backend supplies a RegBudget and consumes two
+// new IR ops; the algorithm appears nowhere in the platform layer.
+
+namespace mm::moonlive {
+
+/// Rewrite `ir` so no op names a vreg the target does not have, parking the overflow in frame slots
+/// (Spill/Reload). A program that already fits is left byte-identical — a non-spilling script pays
+/// nothing, not even a renumbering.
+///
+/// False when even the spilled form does not fit: fewer registers than the fixed ABI vregs plus the
+/// reload temps need, more slots than the frame can address, or a branch structure the interval
+/// analysis cannot prove properly nested. FAIL, NEVER MISCOMPILE — the caller reports a diagnostic
+/// and the script runs dark, which is recoverable; a wrong interval silently computes with a stale
+/// value, which is not.
+///
+/// `slotsUsed` receives how many frame slots the rewritten program needs, so the backend can size
+/// its prologue. Zero when nothing spilled.
+bool spillToBudget(IrProgram& ir, const RegBudget& budget, uint8_t& slotsUsed);
+
+}  // namespace mm::moonlive
diff --git a/src/core/moonlive/moonlive_emit.h b/src/core/moonlive/moonlive_emit.h
index 4993b380..a362a2d7 100644
--- a/src/core/moonlive/moonlive_emit.h
+++ b/src/core/moonlive/moonlive_emit.h
@@ -52,10 +52,37 @@ size_t emitAnimatedFill(uint8_t* out, size_t cap);
 
 struct IrProgram;   // src/core/moonlive/MoonLiveIr.h
 
+// What one target's register file offers the allocator — the ONLY thing core's spill pass needs to
+// know about an ISA, and the reason the allocator is written once instead of three times. Each
+// backend fills this in from its own map and hands it to spillToBudget (MoonLiveSpill.h); nothing
+// ISA-specific crosses in the other direction.
+struct RegBudget {
+    uint8_t regs = 0;        // machine registers the vreg map exposes (kRegCount)
+    uint8_t reserved = 0;    // registers the backend keeps for the inline ops this program contains
+    uint8_t slots = 0;       // spill slots the backend's frame can address (0 = cannot spill at all)
+
+    /// Registers left for the allocator once the backend's inline scratch is taken out. Saturating,
+    /// because a program whose scratch demand exceeds the whole file must report "no registers"
+    /// rather than wrap to a huge count and allocate against a register that does not exist.
+    uint8_t allocatable() const { return regs > reserved ? uint8_t(regs - reserved) : uint8_t(0); }
+};
+
 // Lower a typed IR program to machine code for this TU's ISA, via the per-ISA assembler.
 // This is the general codegen path the front-end uses; emitFill/emitAnimatedFill are the
 // hand-encoded references the assembler-built output is behaviorally checked against. Returns
 // the byte count, or 0 on overflow / cap too small (the caller degrades).
-size_t lowerToBytes(const IrProgram& ir, uint8_t* out, size_t cap);
+//
+// `ir` is taken by NON-CONST reference because the backend runs core's register allocator over it
+// first (MoonLiveSpill.h), which rewrites a program that names more live values than this target has
+// registers. Taking a copy instead would double the compile's peak memory on the smallest device for
+// no benefit — the IR is compile-time scratch the caller drops immediately afterwards.
+///
+/// `squeeze`, when non-null, REPLACES the register budget this backend would compute for itself.
+/// It exists because the spiller is the hardest logic in the compiler and only one backend is ever
+/// executed by tests: with a budget deliberately smaller than the host's, the allocator runs on the
+/// arm64 path a test can actually call and RUN, and the same script at the full and the squeezed
+/// budget must render identical pixels. Without this seam the pass would be verifiable only on
+/// hardware. Production callers pass nullptr and get the target's real budget.
+size_t lowerToBytes(IrProgram& ir, uint8_t* out, size_t cap, const RegBudget* squeeze = nullptr);
 
 }  // namespace mm::moonlive
diff --git a/src/core/moonlive/register-and-slot-contract.md b/src/core/moonlive/register-and-slot-contract.md
new file mode 100644
index 00000000..6b5c91e0
--- /dev/null
+++ b/src/core/moonlive/register-and-slot-contract.md
@@ -0,0 +1,74 @@
+# The MoonLive register and frame-slot contract
+
+One machine, three roles. This governs the compiler and the three backends, not a binding: a scripted
+layout, effect and modifier all compile through the same front end and the same lowering, so the
+ownership rules below hold identically whichever role a script plays. ("Layout" in this file means
+the memory layout of the register file and the frame — never the light-placement role.)
+
+Who owns which register index, who owns which frame slot, and who is allowed to compute what from
+`vregsUsed`. Written down because four places derive numbers from each other — core's compaction,
+the spill pass, each backend's inline scratch, and each assembler's map — and changing where a value
+lives perturbs all four. A day was lost to guess-and-check before this existed.
+
+## Registers: one ascending layout, three owners
+
+A vreg is an index. Each backend maps it to a machine register through its own table (`kXtReg`,
+`kRvReg`, `kArm64Reg`). The index space is carved as follows, **in this order, no gaps**:
+
+| range | owner | meaning |
+|---|---|---|
+| `0 .. kFirstTemp-1` | **core, fixed** | the host arguments: buf, nLights, cpl, t, ctrls. They arrive in registers at entry and every backend indexes them directly. |
+| `kFirstTemp .. vregsUsed-1` | **core (parser, then spill pass)** | the program's values. The parser hands them out; the spill pass renumbers them down to what fits. |
+| `vregsUsed .. vregsUsed+scratch-1` | **the backend** | the inline ops' scratch, computed per lowerer from `vregsUsed`. |
+
+**The invariant:** `vregsUsed + scratch <= kRegCount`, and the spill pass is what guarantees it by
+rewriting the program until `vregsUsed` is small enough. `RegBudget.reserved` is how a backend tells
+the pass how much scratch it will add on top.
+
+**Consequences that have each been a bug:**
+
+- A backend must not name a register outside its own map. `ar()`/`xr()`/`mr()` index the table with
+  `vregsUsed + n`, so an off-by-one reads past the array and emits a register chosen by accident.
+  All three are bounds-checked for that reason.
+- A register that is scratch for the assembler (an address temp, a call staging register) must not
+  also appear in the vreg map. `static_assert` in each backend enforces it.
+- On Xtensa the map may only contain registers that survive `call8`. The windowed ABI rotates by
+  eight, so a call clobbers `a8..a15` (ESP-IDF's `coreasm.h` states it). A vreg mapped there holds a
+  script value that a host call destroys.
+
+## Frame slots: two owners, growing towards each other
+
+One frame, indexed `0 .. budget.slots-1`, addressed by `spillStore`/`spillLoad`.
+
+| range | owner | meaning |
+|---|---|---|
+| `0 .. ir.localSlots-1` | **core (parser)** | script variables (a `for`'s counter and limit) and call-argument staging. Handed out by `slotHighWater`, peak recorded in `slotsUsed`, published as `ir.localSlots`. |
+| `ir.localSlots .. slotsUsed-1` | **the spill pass** | values the register file could not hold. Numbered from `ir.localSlots` UPWARD, never from zero. |
+
+**The invariant:** the spill pass starts numbering at `ir.localSlots` so the two ranges cannot
+overlap, and refuses the compile when either exceeds `budget.slots` — a slot the backend cannot
+address would encode a truncated offset and write over a live value.
+
+**`ir.localSlots` is what the FRONT END claimed, not the frame size.** Setting it to the whole
+addressable range hands the allocator a full frame and leaves it nowhere to spill; that refuses every
+script that needs one spill.
+
+## What `prologue(slots)` must reserve
+
+`slotsUsed` — the total from both owners, which `spillToBudget` returns. The backend turns a slot
+index into a frame offset its own way (Xtensa counts 4-byte words from `kFrameBase`; RISC-V and arm64
+build a frame in their prologue). Slot indices are the shared currency; offsets are private.
+
+## Where a proposed change has to be checked
+
+Any change to where a value lives must be checked against **all five** of:
+
+1. `Parser` — does it still hand out slots from zero upward, and is `slotsUsed` the peak?
+2. `compileSource` — is `ir.localSlots` the parser's claim only?
+3. `spillToBudget` — does its reservation arithmetic still match what actually occupies registers?
+4. The compaction in `spillToBudget` — does the renumbering leave the ranges above intact?
+5. Each of the three lowerers — is `scratch` still the number of extra registers it adds, and does
+   every register it names come from the map?
+
+Missing any one of these produces a program that compiles and then behaves wrongly, which is far
+worse than one that is refused.
diff --git a/src/light/drivers/ParallelLedDriver.h b/src/light/drivers/ParallelLedDriver.h
index 241dda59..642bdab6 100644
--- a/src/light/drivers/ParallelLedDriver.h
+++ b/src/light/drivers/ParallelLedDriver.h
@@ -580,7 +580,7 @@ class ParallelLedDriver : public DriverBase {
         // it instead, with the number the user has to act on: the ceiling in LIGHTS PER LANE, since
         // that is the control they set. (github.com/MoonModules/projectMM/issues/44)
         if (frameBytes_ > peripheral_->busCapacity()) {
-            reportOverCapacity(outCh);
+            reportOverCapacity(outCh, peripheral_->busCapacity());
             return;
         }
 
@@ -785,15 +785,25 @@ class ParallelLedDriver : public DriverBase {
     /// The frame does not fit one transfer. Report the ceiling the way the user sets it — lights per
     /// lane — rather than the byte figure they would have to derive it from. Cleared by reinit(), so
     /// lowering the count restores normal reporting.
-    void reportOverCapacity(uint8_t outCh) {
+    /// `cap` is the byte ceiling to measure against — the peripheral's live buffer capacity on the
+    /// tick path, or its declared DMA budget at reinit(), where no bus exists yet and busCapacity()
+    /// would read 0. Passing it in keeps one message for both, instead of a KB figure on one path
+    /// and the actionable light count on the other.
+    void reportOverCapacity(uint8_t outCh, size_t cap) {
         if (overCapReported_) return;
         overCapReported_ = true;
         const uint8_t opp     = outputsPerPin();
-        const size_t  pad     = padBytesFor(slotBytes(), opp);
         const size_t  rowBytes = rowBytesFor(outCh, slotBytes(), opp);
-        const size_t  cap     = peripheral_->busCapacity();
-        const size_t  usable  = cap > pad ? cap - pad : 0;
-        const unsigned fits   = rowBytes ? static_cast<unsigned>(usable / rowBytes) : 0;
+        const size_t  pad     = padBytesFor(slotBytes(), opp);
+        // Count DOWN through frameBytesFor, not up through a division: the frame is 64-byte ROUNDED,
+        // so `(cap - pad) / rowBytes` overshoots by one — it reported 898 lights, whose frame rounds
+        // to 65536 against a 65535 cap. A limit that still fails is worse than no limit.
+        unsigned fits = 0;
+        if (rowBytes && cap > pad) {
+            fits = static_cast<unsigned>((cap - pad) / rowBytes);
+            while (fits > 0 && frameBytesFor(static_cast<nrOfLightsType>(fits), outCh,
+                                             slotBytes(), opp) > cap) fits--;
+        }
         std::snprintf(overCapBuf_, sizeof(overCapBuf_),
                       "too many lights per pin: %u exceeds this peripheral's %u — lower ledsPerPin",
                       static_cast<unsigned>(maxLaneLights_), fits);
@@ -1862,14 +1872,11 @@ class ParallelLedDriver : public DriverBase {
         if (const size_t budget = peripheral_->dmaBudgetBytes();
             !frameFitsDmaBudget(frameBytes_, budget)) {
             // deinit() above already cleared the bus and inited_ — just report and bail.
-            if (char* b = failBufEnsure()) {
-                std::snprintf(b, kFailBufLen, "frame %uKB over the bus %uKB: fewer lights/pin",
-                              static_cast<unsigned>(frameBytes_ / 1024),
-                              static_cast<unsigned>(budget / 1024));
-                setStatus(b, Severity::Error);
-            } else {
-                setStatus(peripheral_->initFailMsg(), Severity::Error);
-            }
+            // Same message the tick path gives, measured against the DECLARED budget (no bus is up
+            // yet, so busCapacity() would read 0): the light count the user has to lower, not a KB
+            // figure they would have to convert. reinit() cleared overCapReported_ above, so this
+            // reports once per geometry rather than once per attempt.
+            reportOverCapacity(correction_.outChannels, budget);
             return;
         }
         // Allocate the second buffer only when wanted (see wantSecond above — gated on the toggle AND the
diff --git a/src/light/drivers/ParlioLedDriver.h b/src/light/drivers/ParlioLedDriver.h
index 3963f05b..16159a85 100644
--- a/src/light/drivers/ParlioLedDriver.h
+++ b/src/light/drivers/ParlioLedDriver.h
@@ -76,11 +76,12 @@ class ParlioPeripheral : public LedPeripheral {
     uint8_t* busBuffer(uint8_t i) override        { return platform::parlioWs2812Buffer(parlio_, i); }
     /// The per-buffer byte capacity (fixed at bus creation; both buffers equal).
     size_t   busCapacity() const override         { return platform::parlioWs2812BufferCapacity(parlio_); }
-    // Parlio sends a frame in ONE transfer, and the peripheral caps that at 65535 bytes — a hard
-    // limit, unlike a memory budget that varies with the heap. Declaring it here lets reinit()
-    // refuse an oversized frame with an actionable status BEFORE busInit tries (and fails) to
-    // allocate it, which is what left the LEDs frozen with a healthy UI (issue #44).
-    size_t   dmaBudgetBytes() const override      { return 65535; }
+    // Parlio sends a frame in ONE transfer, and the peripheral caps that. The cap is a HARDWARE
+    // fact (derived from PARLIO_LL_TX_MAX_BITS_PER_FRAME), so the platform owns the number and this
+    // asks for it — reinit() then refuses an oversized frame with an actionable status BEFORE
+    // busInit tries (and fails) to allocate it, which is what left the LEDs frozen with a healthy
+    // UI (issue #44).
+    size_t   dmaBudgetBytes() const override      { return platform::parlioMaxTransferBytes(); }
     /// Kick off the autonomous transfer of the first `bytes` of DMA buffer `i`;
     /// returns whether it started.
     bool  busTransmit(uint8_t i, size_t bytes) override { return platform::parlioWs2812Transmit(parlio_, i, bytes); }
diff --git a/src/light/moonlive/MoonLiveBuiltins_light.h b/src/light/moonlive/MoonLiveBuiltins_light.h
index 161aa712..52c2f015 100644
--- a/src/light/moonlive/MoonLiveBuiltins_light.h
+++ b/src/light/moonlive/MoonLiveBuiltins_light.h
@@ -140,20 +140,58 @@ extern "C" inline uint32_t mm_light_print(uint32_t v, uint32_t, uint32_t) {
 // something.
 using AddLightFn = void (*)(void* ctx, uint16_t x, uint16_t y, uint16_t z);
 
-/// THREAD_LOCAL, not one global: the sink belongs to whichever thread is running a script, and more
+/// PER-THREAD, not one global: the sink belongs to whichever thread is running a script, and more
 /// than one does. A layout is asked for its light count and its coordinates from the HTTP task when a
 /// control is edited, while the render task walks the same layout for the frame — as one global, one
 /// thread cleared the sink while the other was mid-run and the built-in called through a live
 /// function pointer with a null context. That is a null dereference on the render core, seen as an
 /// intermittent crash while resizing a scripted layout.
 ///
-/// The function and the context are ONE struct so they cannot be observed half-updated. Same shape
-/// as the WDT subscription flag in the ESP32 worker, which had the same bug for the same reason.
+/// Keyed on platform::currentThreadId() rather than C++ `thread_local`, which is UNUSABLE on the
+/// ESP32: the compiler reaches TLS through the THREADPTR special register, and a FreeRTOS task
+/// created without TLS has THREADPTR = 0 — so the access dereferences a small offset from null and
+/// dies inside the exception handler. Measured: EXCVADDR 0xfffffff0, `Double exception` in
+/// _xt_context_save, on every scripted LAYOUT (the only binding whose script calls a host function).
+/// Reading the task handle costs one load and needs no per-task setup.
+///
+/// The function and the context are ONE struct so they cannot be observed half-updated. Two slots:
+/// the render task and whichever task edits a control are the two that ever run a script at once,
+/// and a third would mean a genuinely new concurrency story rather than a bigger table.
 struct AddLightSink { AddLightFn fn = nullptr; void* ctx = nullptr; };
-inline AddLightSink& addLightSink() { static thread_local AddLightSink s; return s; }
+
+namespace detail {
+struct SinkSlot { uintptr_t owner = 0; AddLightSink sink; };
+/// Two slots: the render task and whichever task edits a control are the two that ever run a script
+/// at once. A third concurrent runner gets the overflow slot, which holds no sink — so its addLight
+/// calls no-op instead of writing through someone else's context.
+inline SinkSlot* sinkSlots() { static SinkSlot s[2]; return s; }
+inline AddLightSink& sinkOverflow() { static AddLightSink s; return s; }
+}  // namespace detail
+
+/// This thread's sink, claiming a slot on first use.
+inline AddLightSink& addLightSink() {
+    const uintptr_t me = platform::currentThreadId();
+    detail::SinkSlot* slots = detail::sinkSlots();
+    for (uint8_t i = 0; i < 2; i++) if (slots[i].owner == me) return slots[i].sink;
+    for (uint8_t i = 0; i < 2; i++) if (slots[i].owner == 0) { slots[i].owner = me; return slots[i].sink; }
+    return detail::sinkOverflow();
+}
 
 /// Point addLight at a consumer for the duration of one run; pass nullptr to detach.
-inline void setAddLightSink(AddLightFn fn, void* ctx) { addLightSink() = {fn, ctx}; }
+///
+/// Detaching RELEASES this thread's slot, so two slots are not exhausted by tasks that come and go —
+/// an HTTP request lands on whichever worker is free.
+inline void setAddLightSink(AddLightFn fn, void* ctx) {
+    const uintptr_t me = platform::currentThreadId();
+    detail::SinkSlot* slots = detail::sinkSlots();
+    if (!fn && !ctx) {
+        for (uint8_t i = 0; i < 2; i++)
+            if (slots[i].owner == me) { slots[i].sink = {}; slots[i].owner = 0; return; }
+        detail::sinkOverflow() = {};
+        return;
+    }
+    addLightSink() = {fn, ctx};
+}
 
 extern "C" inline uint32_t mm_light_addLight(uint32_t x, uint32_t y, uint32_t z) {
     // Both halves checked: a sink is only ever installed as a pair, but a context of null with a live
diff --git a/src/light/moonlive/MoonLiveEffect.h b/src/light/moonlive/MoonLiveEffect.h
index 837b755d..e37e2a62 100644
--- a/src/light/moonlive/MoonLiveEffect.h
+++ b/src/light/moonlive/MoonLiveEffect.h
@@ -2,6 +2,7 @@
 
 #include "light/effects/EffectBase.h"
 #include "core/moonlive/MoonLive.h"
+#include "light/moonlive/MoonLiveScriptFile.h"
 #include "light/moonlive/MoonLiveBuiltins_light.h"
 #include <cstring>
 #include <cstdio>
@@ -31,7 +32,10 @@ class MoonLiveEffect : public EffectBase {
     // next render tick reads — no recompile (the live-edit guarantee). Editing the source
     // recompiles (the script-editor loop), which re-derives the control set.
     void defineControls() override {
-        controls_.addTextArea("source", source_, sizeof(source_));
+        // The script NAME, not the script. The text lives in a file the UI loads, edits and
+        // saves through /api/file — so a module costs ~32 bytes here instead of a resident
+        // kilobyte, and a script is bounded by the filesystem rather than by this array.
+        controls_.addText("script", script_, sizeof(script_));
         // Every control the script declared. System variables (`width`, `height`, `depth`, `t`)
         // are not controls and never appear here, so there is nothing to filter out.
         uint8_t n = 0;
@@ -39,22 +43,19 @@ class MoonLiveEffect : public EffectBase {
         for (uint8_t i = 0; i < n; i++) {
             uint8_t* slot = engine_.controlSlot(decls[i].offset);
             if (!slot) continue;   // engine not compiled yet (first sweep) — controls appear after prepare
-            // The declared name is a span into source_ (not NUL-terminated); copy it into a stable
-            // member pool so the control descriptor's borrowed name pointer stays valid. The compiler
-            // rejects names ≥ kMaxControlName, so the full name always fits — no truncation, no
-            // distinct-names-collapsing-to-the-same-prefix collision.
-            std::memcpy(ctrlNames_[i], decls[i].name, decls[i].nameLen);
-            ctrlNames_[i][decls[i].nameLen] = '\0';
-            controls_.addUint8(ctrlNames_[i], *slot, decls[i].min, decls[i].max);
+            // The engine owns its declared names (MoonLive::compile copies them out of the
+            // source before the text is freed), so the descriptor can borrow that pointer
+            // directly — a second per-binding pool would be the same fact in two places.
+            controls_.addUint8(decls[i].name, *slot, decls[i].min, decls[i].max);
         }
     }
 
     // A `source` edit must recompile — route it through the prepare rebuild sweep so a new
     // script swaps in live (the script-editor loop). A SCRIPTED CONTROL's value change must NOT
     // recompile: it just updates an arena byte the running native code reads next tick. So only
-    // "source" triggers a rebuild; every scripted control returns false (the live-edit path).
+    // "script" triggers a rebuild; every scripted control returns false (the live-edit path).
     bool affectsPrepare(const char* controlName) const override {
-        return std::strcmp(controlName, "source") == 0;
+        return std::strcmp(controlName, "script") == 0;
     }
 
     // Compile the source on the cold rebuild path. A failed compile (parse error or no exec
@@ -68,10 +69,12 @@ class MoonLiveEffect : public EffectBase {
         // would be a second, disagreeing answer: set it to 16 on an 8x8 panel and the effect draws
         // off the edge. The compiler reserves the name, so that cannot happen.
         moonlive::resetPrintBudget();
-        if (engine_.compile(source_, moonlive::lightBuiltins(), moonlive::effectSysVars())) {
+        const char* err = nullptr;
+        if (moonlive::compileScriptFile(engine_, script_, moonlive::lightBuiltins(),
+                                        moonlive::effectSysVars(), err)) {
             clearStatus();
         } else {
-            setStatus(engine_.error(), Severity::Error);
+            setStatus(err, Severity::Error);
         }
         // The compile re-derives the declared-control set, so rebuild the control list to surface
         // it (the same rebuildControls() pattern NetworkModule uses when a state change reshapes
@@ -104,9 +107,11 @@ class MoonLiveEffect : public EffectBase {
 
     /// Replace the script. The next prepare() compiles it — the same path a UI edit takes, so a
     /// test and a user exercise identical code.
-    void setSource(const char* s) {
-        if (!s) return;
-        std::snprintf(source_, sizeof(source_), "%s", s);
+    /// Point the module at a script in the shared script directory. The file itself is written by
+    /// the UI (or the File Manager); this only says WHICH one, and the next prepare() compiles it.
+    void setScript(const char* name) {
+        if (!name) return;
+        std::snprintf(script_, sizeof(script_), "%s", name);
     }
 
 private:
@@ -123,15 +128,13 @@ class MoonLiveEffect : public EffectBase {
     }
 
 
-    char source_[moonlive::kMaxScriptBytes] = "setRGB(random16(256), random16(256), random16(256), random16(256));";
+    // A fresh card starts with NO script: it reports "no script" and renders nothing until one
+    // is named. Naming a default here would make every new module compile the same effect.
+    char script_[32] = "";
                                                // 512 fits a multi-line
                                                // multi-control script (a decl per control + the
                                                // statement); grow-on-demand is backlogged for the
                                                // bigger Ripples-class scripts of later stages.
-    // Stable NUL-terminated copies of the script-declared control names (the control descriptor
-    // borrows the pointer; the decl span into source_ is not NUL-terminated). Sized to the
-    // compiler's name limit so a name always fits without truncation.
-    char ctrlNames_[moonlive::kMaxCtrls][moonlive::kMaxControlName] = {};
 };
 
 }  // namespace mm
diff --git a/src/light/moonlive/MoonLiveLayout.h b/src/light/moonlive/MoonLiveLayout.h
index 14cb80d3..0ef0aedb 100644
--- a/src/light/moonlive/MoonLiveLayout.h
+++ b/src/light/moonlive/MoonLiveLayout.h
@@ -1,6 +1,8 @@
 #pragma once
 
 #include "core/moonlive/MoonLive.h"
+#include "platform/platform.h"
+#include "light/moonlive/MoonLiveScriptFile.h"
 #include "light/layouts/LayoutBase.h"
 #include "light/moonlive/MoonLiveBuiltins_light.h"
 #include <cstdio>
@@ -39,7 +41,9 @@ class MoonLiveLayout : public LayoutBase {
     const char* tags() const override { return "📝"; }   // scripted
 
     void defineControls() override {
-        controls_.addTextArea("source", source_, sizeof(source_));
+        // The script NAME, not the script — the text lives in a file the UI loads and saves
+        // through /api/file. A module costs ~32 bytes here instead of a resident kilobyte.
+        controls_.addText("script", script_, sizeof(script_));
         // Every control the SCRIPT declared — including any extents it loops over. A layout does not
         // RECEIVE a width: the pipeline derives its bounding box from the coordinates the layouts
         // actually place (Layouts::prepare, "max coordinate + 1 per axis"), so a width handed in
@@ -50,9 +54,7 @@ class MoonLiveLayout : public LayoutBase {
         for (uint8_t i = 0; i < n; i++) {
             uint8_t* slot = engine_.controlSlot(decls[i].offset);
             if (!slot) continue;
-            std::memcpy(ctrlNames_[i], decls[i].name, decls[i].nameLen);
-            ctrlNames_[i][decls[i].nameLen] = '\0';
-            controls_.addUint8(ctrlNames_[i], *slot, decls[i].min, decls[i].max);
+            controls_.addUint8(decls[i].name, *slot, decls[i].min, decls[i].max);
         }
     }
 
@@ -89,9 +91,19 @@ class MoonLiveLayout : public LayoutBase {
     }
 
     /// Replace the script. The next prepare() compiles it — the path a UI edit takes.
-    void setSource(const char* s) {
-        if (!s) return;
-        std::snprintf(source_, sizeof(source_), "%s", s);
+    /// A control write lands DIRECTLY in script_ (addText binds the buffer), so setScript() is not
+    /// called and nothing would clear the compiled-hash — compile() would early-return and keep
+    /// running the previous script under a new name. Clearing it here covers both paths.
+    void onControlChanged(const char* name) override {
+        if (name && std::strcmp(name, "script") == 0) { compiledHash_ = 0; compileFailed_ = false; }
+    }
+
+    /// Point the layout at a script in the shared script directory; the next prepare() compiles it.
+    void setScript(const char* name) {
+        if (!name) return;
+        std::snprintf(script_, sizeof(script_), "%s", name);
+        compiledHash_ = 0;          // a different file: whatever was compiled is not it
+        compileFailed_ = false;     // and it has not been tried yet
     }
 
 private:
@@ -112,15 +124,31 @@ class MoonLiveLayout : public LayoutBase {
     /// Moving layout work to a worker would change that — the engine would then need a published
     /// immutable program rather than one mutated in place.
     void compile() const {
-        if (engine_.ok() && std::strcmp(source_, compiled_) == 0) return;   // already current
+        if (engine_.ok() && compiledHash_ != 0) return;   // already current for this script
+        // Give up only on the name that ACTUALLY failed. As a bare flag this latched on the empty
+        // script every device boots with, and then skipped the compile forever — the card sat at
+        // "no script" however many times a real one was named, because the render loop asks for the
+        // light count long before any control write clears a flag.
+        if (compileFailed_ && std::strcmp(failedScript_, script_) == 0) return;
         auto* self = const_cast<MoonLiveLayout*>(this);
         moonlive::resetPrintBudget();
         // A layout is the one script with no layer to ask, so it gets the clock and nothing else:
         // it names its own size controls, and `x`/`y` stay free as ordinary loop counters.
-        if (self->engine_.compile(source_, moonlive::lightBuiltins(), moonlive::layoutSysVars()))
+        const char* err = nullptr;
+        uint32_t hash = 0;
+        if (moonlive::compileScriptFile(self->engine_, script_, moonlive::lightBuiltins(),
+                                        moonlive::layoutSysVars(), err, &hash)) {
             self->clearStatus();
-        else                                                          self->setStatus(self->engine_.error(), Severity::Error);
-        std::snprintf(self->compiled_, sizeof(compiled_), "%s", source_);
+            self->compileFailed_ = false;
+        } else {
+            self->setStatus(err, Severity::Error);
+            // Remember WHICH name failed, so a different one is still tried.
+            self->compileFailed_ = true;
+            std::snprintf(self->failedScript_, sizeof(failedScript_), "%s", script_);
+        }
+        // The CONTENT hash, not a copy of the text: 4 bytes to answer "is what I compiled still what
+        // the file says", which is all the rebuild check ever needed. 0 means "nothing compiled".
+        self->compiledHash_ = hash;
         self->setDynamicBytes(engine_.heapBytes());
     }
 
@@ -151,24 +179,26 @@ class MoonLiveLayout : public LayoutBase {
 
     mutable moonlive::MoonLive engine_;
 
-    // Default script — a grid, the layout almost every panel is. The nested loop and the index
-    // arithmetic are the whole definition, which is the case for scripting a layout at all.
-    char source_[moonlive::kMaxScriptBytes] =
-        "uint8_t cols = 16;  // @control 1..64\n"
-        "uint8_t rows = 16;  // @control 1..64\n"
-        "for (y = 0; y < rows; y = y + 1) {\n"
-        "  for (x = 0; x < cols; x = x + 1) {\n"
-        "    addLight(x, y, 0);\n"
-        "  }\n"
-        "}";
-
-    // The source the loaded program was built from, so compile() is a no-op when current.
-    // sizeof(source_), never a literal: a copy too small to hold source_ truncates, never
-    // compares equal, and the mapping rebuilds every frame — the blank-screen loop this
-    // comparison exists to prevent.
-    mutable char compiled_[sizeof(source_)] = {};
-
-    char ctrlNames_[moonlive::kMaxCtrls][moonlive::kMaxControlName] = {};
+    // The script's FILE NAME, inside the shared script directory. Empty on a fresh card: it reports
+    // "no script" and places no lights until one is named, rather than every new layout compiling
+    // the same default grid.
+    char script_[32] = "";
+
+    // FNV-1a of the text the loaded program was built from — 4 bytes in place of a second copy of
+    // the source. Non-zero means "this engine holds a compiled program for that content"; 0 means
+    // nothing is compiled, which is what setScript() restores when the file changes.
+    mutable uint32_t compiledHash_ = 0;
+
+    // Has this script name already been tried and failed? A FAILED compile leaves compiledHash_ at 0
+    // and the engine not ok(), which is indistinguishable from "not compiled yet" — so without this
+    // flag every lightCount()/forEachCoord() re-reads and re-compiles the file. Each attempt is two
+    // LittleFS operations (~5 ms on an S3), the pipeline asks repeatedly while sizing and walking the
+    // fixture, and the retries starve the task until the 12 s watchdog resets the device. One attempt
+    // per script name is all that can ever help: nothing about the file changes between two calls in
+    // the same rebuild. Cleared wherever compiledHash_ is, because both mean "this is a new script".
+    mutable bool compileFailed_ = false;
+    mutable char failedScript_[32] = "";   // the name compileFailed_ refers to
+
 };
 
 }  // namespace mm
diff --git a/src/light/moonlive/MoonLiveModifier.h b/src/light/moonlive/MoonLiveModifier.h
index a7e9628e..56c299b5 100644
--- a/src/light/moonlive/MoonLiveModifier.h
+++ b/src/light/moonlive/MoonLiveModifier.h
@@ -1,6 +1,7 @@
 #pragma once
 
 #include "core/moonlive/MoonLive.h"
+#include "light/moonlive/MoonLiveScriptFile.h"
 #include "light/modifiers/ModifierBase.h"
 #include "light/moonlive/MoonLiveBuiltins_light.h"
 #include <cstdio>
@@ -43,7 +44,9 @@ class MoonLiveModifier : public ModifierBase {
     const char* tags() const override { return "📝"; }   // scripted
 
     void defineControls() override {
-        controls_.addTextArea("source", source_, sizeof(source_));
+        // The script NAME, not the script — the text lives in a file the UI loads and saves
+        // through /api/file. A module costs ~32 bytes here instead of a resident kilobyte.
+        controls_.addText("script", script_, sizeof(script_));
         // Every control the script declared. System variables (`x`/`y`/`z`, `width`/`height`/
         // `depth`, `t`) are not controls and never appear here, so there is nothing to filter out.
         uint8_t n = 0;
@@ -51,9 +54,7 @@ class MoonLiveModifier : public ModifierBase {
         for (uint8_t i = 0; i < n; i++) {
             uint8_t* slot = engine_.controlSlot(decls[i].offset);
             if (!slot) continue;
-            std::memcpy(ctrlNames_[i], decls[i].name, decls[i].nameLen);
-            ctrlNames_[i][decls[i].nameLen] = '\0';
-            controls_.addUint8(ctrlNames_[i], *slot, decls[i].min, decls[i].max);
+            controls_.addUint8(decls[i].name, *slot, decls[i].min, decls[i].max);
         }
     }
 
@@ -68,11 +69,13 @@ class MoonLiveModifier : public ModifierBase {
         // defines — the binding writes their slots per call, and the compiler reserves the names so
         // a script cannot declare one and shadow the value it is being handed.
         moonlive::resetPrintBudget();
-        if (engine_.compile(source_, moonlive::lightBuiltins(),
-                            moonlive::modifierSysVars())) {
+        const char* err = nullptr;
+        uint32_t hash = 0;
+        if (moonlive::compileScriptFile(engine_, script_, moonlive::lightBuiltins(),
+                                        moonlive::modifierSysVars(), err, &hash)) {
             clearStatus();
         } else {
-            setStatus(engine_.error(), Severity::Error);
+            setStatus(err, Severity::Error);
         }
         rebuildControls();
         setDynamicBytes(engine_.heapBytes());
@@ -82,8 +85,8 @@ class MoonLiveModifier : public ModifierBase {
         // again: setting the flag unconditionally makes the two call each other forever, the
         // mapping is rebuilt every frame, and the fixture renders nothing at all. Comparing the
         // compiled source is what breaks that cycle.
-        if (std::strcmp(source_, compiled_) != 0) {
-            std::snprintf(compiled_, sizeof(compiled_), "%s", source_);
+        if (hash != compiledHash_) {
+            compiledHash_ = hash;
             needsRebuild_ = true;
         }
     }
@@ -143,15 +146,16 @@ class MoonLiveModifier : public ModifierBase {
         // treated as a first compile. Keeping it made a disabled-then-re-enabled modifier inert —
         // the Layer folds while the engine is empty, then prepare() recompiles, sees the same
         // source, and never asks for the rebuild that would apply it.
-        compiled_[0] = '\0';
+        compiledHash_ = 0;
         ModifierBase::release();
     }
 
     /// Replace the script. The next prepare() compiles it — the same path a UI edit takes, so a
     /// test and a user exercise identical code.
-    void setSource(const char* s) {
-        if (!s) return;
-        std::snprintf(source_, sizeof(source_), "%s", s);
+    void setScript(const char* name) {
+        if (!name) return;
+        std::snprintf(script_, sizeof(script_), "%s", name);
+        compiledHash_ = 0;          // a different file: whatever was compiled is not it
     }
 
 private:
@@ -160,15 +164,16 @@ class MoonLiveModifier : public ModifierBase {
     // Default script — a mirror on x. Chosen because it is instantly readable on a bench strand
     // (the pattern runs the other way) and is a modifier people actually reach for, so a working
     // binding looks like something rather than like nothing.
-    char source_[moonlive::kMaxScriptBytes] = "setXYZ(0, width - 1 - x, y, z);";
+    // The script's FILE NAME, inside the shared script directory. Empty on a fresh card: it reports
+    // "no script" and passes coordinates through untouched until one is named.
+    char script_[32] = "";
 
-    // The source the CURRENT mapping was built from; a rebuild is needed only when it changes.
-    // sizeof(source_), never a literal: this is the string compared to decide whether to rebuild,
-    // so a copy too small to hold source_ truncates, never matches, and the mapping rebuilds every
-    // frame — the blank-screen loop the comparison exists to prevent.
-    char compiled_[sizeof(source_)] = {};
+    // FNV-1a of the text the loaded program was built from — 4 bytes in place of a second copy of
+    // the source. It answers the one question the rebuild check ever asked ("did this change"), and
+    // an unconditional rebuild here would make prepare() and the Layer's rebuild call each other
+    // forever, which is the blank-fixture loop the comparison exists to prevent.
+    uint32_t compiledHash_ = 0;
 
-    char ctrlNames_[moonlive::kMaxCtrls][moonlive::kMaxControlName] = {};
 
     bool needsRebuild_ = false;   // a recompile happened; the Layer's mapping is stale
     Coord3D box_{0, 0, 0};        // the logical box, from modifyLogicalSize
diff --git a/src/light/moonlive/MoonLiveScriptFile.h b/src/light/moonlive/MoonLiveScriptFile.h
new file mode 100644
index 00000000..f363a34b
--- /dev/null
+++ b/src/light/moonlive/MoonLiveScriptFile.h
@@ -0,0 +1,94 @@
+#pragma once
+
+#include "core/moonlive/MoonLive.h"
+#include "platform/platform.h"
+
+#include <cstdio>
+#include <cstring>
+
+namespace mm::moonlive {
+
+/// Where a scripted module's `.mlv` file lives. One fixed directory, the way `/.config` holds
+/// persisted state: a module stores a NAME, not a path, so it cannot reach outside this folder and
+/// the File Manager has one obvious place to look.
+inline constexpr const char* kScriptDir = "/moonlive";
+
+/// The largest script the loader will read into RAM at once. Not a language limit — the buffer is
+/// sized to the FILE and freed the moment the compile ends — but a bound so a stray large file
+/// cannot ask a 320 KB device for an allocation it will not survive.
+inline constexpr long kScriptFileMax = 16384;
+
+/// Longest script name accepted. Bounds the path buffer below — a module's `script` control is 32
+/// bytes, so this is the same limit stated where the path is built.
+inline constexpr size_t kMaxScriptName = 40;
+
+/// Read `<kScriptDir>/<name>` and compile it. The source lives in a right-sized heap buffer for the
+/// duration of the compile and is freed before returning, so a module holds a filename (~32 B) and
+/// the emitted code — never the script text. That is the whole point: the fixed per-module arrays
+/// this replaces cost ~2 KB EACH, resident whether or not a script was loaded.
+///
+/// Returns true when the script compiled. On any failure `err` names it, in the words a user needs:
+/// which file, and what was wrong with it.
+/// FNV-1a over the script text. A caller that must know "did this change" keeps 4 bytes rather than
+/// a second copy of the source — which is the whole reason the text is not resident any more.
+inline uint32_t scriptHash(const char* s, size_t len) {
+    uint32_t h = 2166136261u;
+    for (size_t i = 0; i < len; i++) { h ^= static_cast<uint8_t>(s[i]); h *= 16777619u; }
+    return h;
+}
+
+/// As compileScriptFile, and additionally reports the source's hash so a caller can tell a changed
+/// script from an unchanged one without holding the text.
+inline bool compileScriptFile(MoonLive& engine, const char* name,
+                              const BuiltinTable& builtins, const SysVarTable& sysvars,
+                              const char*& err, uint32_t* hashOut = nullptr) {
+    // The script directory must exist before anything can be SAVED into it, and on a fresh device
+    // nothing has created it yet — the write endpoint does not make parent directories, so a first
+    // save would fail with nowhere obvious to look. Creating it here (mkdir -p, a no-op when it is
+    // already there) means naming a script is enough to make the folder appear.
+    platform::fsMkdir(kScriptDir);
+
+    if (!name || !name[0]) { err = "no script — set the script name"; return false; }
+
+    // A BASENAME only. The fixed directory is the point — a module names a script, it does not
+    // address the filesystem — so a separator or a `..` would let a control value reach outside
+    // kScriptDir (`../.config/NetworkModule.json` reads the device's saved credentials). Rejected
+    // rather than sanitised: a name that needs rewriting to be safe is a name a user mistyped.
+    for (const char* c = name; *c; c++)
+        if (*c == '/' || *c == '\\') { err = "script name is a file in the script folder, not a path"; return false; }
+    if (std::strcmp(name, "..") == 0 || std::strncmp(name, "../", 3) == 0) {
+        err = "script name is a file in the script folder, not a path"; return false;
+    }
+    // .mlv, so a stray name cannot pull in an unrelated file that happens to sit alongside. The
+    // upper bound also lets the compiler see that the snprintf below cannot truncate.
+    const size_t len = std::strlen(name);
+    if (len < 5 || len > kMaxScriptName || std::strcmp(name + len - 4, ".mlv") != 0) {
+        err = "script name must end in .mlv"; return false;
+    }
+
+    char path[96];
+    std::snprintf(path, sizeof(path), "%s/%s", kScriptDir, name);
+
+    const long size = platform::fsSize(path);
+    if (size < 0)               { err = "script not found"; return false; }
+    if (size == 0)              { err = "script is empty";  return false; }
+    if (size > kScriptFileMax)  { err = "script too large"; return false; }
+
+    // +1 for the NUL the lexer reads as End. fsRead null-terminates on success, but the buffer has
+    // to have room for it.
+    char* text = static_cast<char*>(platform::alloc(static_cast<size_t>(size) + 1));
+    if (!text) { err = "no memory for the script"; return false; }
+
+    const int read = platform::fsRead(path, text, static_cast<size_t>(size) + 1);
+    if (read <= 0) { platform::free(text); err = "script could not be read"; return false; }
+
+    if (hashOut) *hashOut = scriptHash(text, static_cast<size_t>(read));
+    const bool ok = engine.compile(text, builtins, sysvars);
+    if (!ok) err = engine.error();
+    // Freed on BOTH paths, before returning: the text has done its job either way, and a failed
+    // compile is exactly when a device can least afford to leak.
+    platform::free(text);
+    return ok;
+}
+
+}  // namespace mm::moonlive
diff --git a/src/platform/desktop/moonlive_asm_host.cpp b/src/platform/desktop/moonlive_asm_host.cpp
index 08d6d2e9..03c27535 100644
--- a/src/platform/desktop/moonlive_asm_host.cpp
+++ b/src/platform/desktop/moonlive_asm_host.cpp
@@ -17,7 +17,12 @@ namespace mm::moonlive {
 // Index math uses the 64-bit views (xN) for addresses, 32-bit (wN) for counters/colors — same
 // register number, so one map suffices. x15 is the call() address/immediate scratch (not a vreg).
 static constexpr uint8_t kArm64Reg[kRegCount] = {0, 1, 2, 3, 4, 9, 10, 11, 12, 13, 14, 5, 6, 7};
-static uint8_t mr(Reg r) { return kArm64Reg[r]; }
+// BOUNDS-CHECKED. The inline ops address their scratch as `vregsUsed + n`, so an index one past the
+// map is reachable whenever the reservation and the map disagree — and an out-of-bounds read returns
+// whatever byte follows the array, making the emitted instruction name a register chosen by
+// accident. Clamping turns that into a wrong-but-safe register instead of undefined behaviour; the
+// static_assert below and the lowerer's reservation are what stop it happening at all.
+static uint8_t mr(Reg r) { return kArm64Reg[r < kRegCount ? r : kRegCount - 1]; }
 
 // A scratch register that is ALSO a vreg silently corrupts values — see the RISC-V backend, where
 // kScratchFn aliased vreg R12 and every call returned a stale value. Checked here so the map can
@@ -47,15 +52,57 @@ void HostAssembler::addFixup(size_t at, Label label, uint8_t kind) {
 }
 
 void HostAssembler::emit32(uint32_t w) {
-    if (len_ + 4 > kCap) { overflow_ = true; return; }
+    if (!buf_ || len_ + 4 > kCap) { overflow_ = true; return; }
     buf_[len_++] = uint8_t(w); buf_[len_++] = uint8_t(w >> 8);
     buf_[len_++] = uint8_t(w >> 16); buf_[len_++] = uint8_t(w >> 24);
 }
 void HostAssembler::emitBytes(const uint8_t* p, size_t n) {
-    if (len_ + n > kCap) { overflow_ = true; return; }
+    if (!buf_ || len_ + n > kCap) { overflow_ = true; return; }
     std::memcpy(buf_ + len_, p, n); len_ += n;
 }
 
+// --- the call frame: the register allocator's overflow storage ---------------------------------
+//
+// x29 is the AAPCS frame pointer, callee-saved and outside both the vreg map and the {x15,x16,x17}
+// scratch set, so nothing this backend emits can disturb it. Slots are addressed from x29 rather
+// than sp precisely because call() moves sp by 128 bytes around every host call: sp-relative offsets
+// would be wrong for the duration of the call, and a script whose spilled value is read after a
+// random16() is the ordinary case, not an exotic one. It is also the layout a nested call needs —
+// each activation gets its own x29 — which is why the frame pointer is here now rather than added
+// later when script-defined functions arrive.
+//
+// Layout: [x29+0] = saved x29, [x29+8] = saved x30, slot n at [x29 + 16 + n*8].
+static constexpr uint16_t kSlotBase = 16;
+
+void HostAssembler::prologue(uint8_t slots) {
+    if (slots == 0) return;                       // no spilling: no frame, no cost
+    if (slots > kMaxSpillSlots) { overflow_ = true; return; }
+    // 16-byte aligned, as the AAPCS requires of sp at every instruction boundary — an unaligned sp
+    // faults on the first stp a callee executes, which would surface as a crash inside random16.
+    const uint16_t bytes = static_cast<uint16_t>((kSlotBase + slots * 8 + 15) & ~15);
+    frameBytes_ = bytes;
+    emit32(0xa9800000u | ((uint32_t((-int32_t(bytes)) / 8) & 0x7f) << 15) | (30u << 10) | (31u << 5) | 29u);
+    emit32(0x910003fdu);                          // mov x29, sp
+}
+void HostAssembler::epilogue() {
+    if (frameBytes_ != 0) {
+        emit32(0x910003bfu);                      // mov sp, x29   (drop anything call() left behind)
+        emit32(0xa8c00000u | ((uint32_t(frameBytes_) / 8) << 15) | (30u << 10) | (31u << 5) | 29u);
+    }
+    ret();
+}
+// str/ldr with a 12-bit SCALED unsigned offset (imm12 counts 8-byte units for the 64-bit form).
+// 64-bit, not 32: a vreg can hold a pointer — kArg0 is the buffer — and truncating one to 32 bits on
+// the way to a slot would produce a wild store the moment a spilled pointer came back.
+void HostAssembler::spillStore(Reg r, uint8_t slot) {
+    if (slot >= kMaxSpillSlots) { overflow_ = true; return; }
+    emit32(0xf9000000u | ((uint32_t(kSlotBase + slot * 8) / 8) << 10) | (29u << 5) | mr(r));
+}
+void HostAssembler::spillLoad(Reg r, uint8_t slot) {
+    if (slot >= kMaxSpillSlots) { overflow_ = true; return; }
+    emit32(0xf9400000u | ((uint32_t(kSlotBase + slot * 8) / 8) << 10) | (29u << 5) | mr(r));
+}
+
 void HostAssembler::movImm(Reg d, int32_t imm) {
     // movz builds a ZERO-extended 16-bit constant, so a negative immediate would land as its
     // unsigned counterpart (-1 as 65535). The compiler emits Const(-1) to express subtraction —
@@ -160,6 +207,9 @@ void HostAssembler::call(Reg d, Reg a, Reg b, Reg c, const void* fn) {
 void HostAssembler::ret() { emit32(0xd65f03c0u); }
 
 void HostAssembler::patchBranches() {
+    // Nothing was emitted if the buffer never allocated, so there is nothing to patch —
+    // stated rather than left to the reader to derive from fixupCount_ being 0.
+    if (!buf_) return;
     for (uint8_t i = 0; i < fixupCount_; i++) {
         const Fixup& f = fixups_[i];
         int32_t target = labelPos_[f.label];
diff --git a/src/platform/desktop/moonlive_asm_host.h b/src/platform/desktop/moonlive_asm_host.h
index 31dafe21..60c951b8 100644
--- a/src/platform/desktop/moonlive_asm_host.h
+++ b/src/platform/desktop/moonlive_asm_host.h
@@ -1,5 +1,7 @@
 #pragma once
 
+#include "platform/platform.h"   // alloc/free — the emit buffer is heap, not stack
+
 #include "core/moonlive/MoonLiveIr.h"   // kCodeCap — one cap for the staging buffer and every backend
 
 #include <cstdint>
@@ -33,6 +35,13 @@ enum class Cond : uint8_t { Lo /* unsigned < */, Hs /* unsigned >= */, Ne /* !=
 
 class HostAssembler {
 public:
+    // Owns buf_ (see below). Freed here, copying deleted — an emitter that was copied
+    // would double-free the buffer it emits into.
+    ~HostAssembler() { platform::free(buf_); }
+    HostAssembler() = default;
+    HostAssembler(const HostAssembler&) = delete;
+    HostAssembler& operator=(const HostAssembler&) = delete;
+
     // --- buffer ---
     // Resolve all branch fixups against bound labels, then expose the finished bytes. Call
     // once after the last instruction; bytes()/size() are valid only after finalize().
@@ -45,6 +54,18 @@ class HostAssembler {
     Label newLabel();
     void  bind(Label l);                 // mark l's position = current offset
 
+    // --- the call frame ---
+    // The register allocator's overflow storage (MoonLiveSpill.h). prologue() opens a frame with
+    // room for `slots` spilled values and parks a frame pointer at its base; spillStore/spillLoad
+    // address a slot as an offset from THAT pointer, never from sp — so a call() that moves sp
+    // underneath them, and the nested/recursive calls MoonLive is gaining next, leave slot
+    // addressing untouched. slots == 0 emits nothing at all: a script that never spilled pays zero.
+    void prologue(uint8_t slots);
+    void epilogue();                     // tear the frame down, then ret
+    void spillStore(Reg r, uint8_t slot);
+    void spillLoad(Reg r, uint8_t slot);
+    static constexpr uint8_t kMaxSpillSlots = 16;   // what the frame below can address
+
     // --- instructions (named, register/immediate operands) ---
     void movImm(Reg d, int32_t imm);     // d = imm
     void addImm(Reg d, Reg a, int32_t imm);   // d = a + imm
@@ -75,9 +96,18 @@ class HostAssembler {
     void emitBytes(const uint8_t* p, size_t n);
     void addFixup(size_t at, Label label, uint8_t kind);  // enqueue a branch fixup (bounds-checked)
 
-    uint8_t  buf_[kCap] = {};
+    // HEAP, not a member array: the assembler is a stack local in lowerToBytes, so a kCap-sized
+    // member put 2 KB on the compile chain's stack — on top of the staging buffer and the parser
+    // frames. On a classic ESP32 that overflowed the task and faulted inside _xt_context_save
+    // (the plan named this: "buf_[kCap] inside the assembler, itself a stack local"). The buffer is
+    // scratch that ends in a memcpy to the caller's output, so nothing outlives the object.
+    uint8_t* buf_ = static_cast<uint8_t*>(platform::alloc(kCap));
     size_t   len_ = 0;
     bool     overflow_ = false;
+    // Frame size in bytes, 0 when no prologue was emitted. epilogue() reads it, so the teardown can
+    // never disagree with the setup about how far sp moved — the class of bug that returns to a
+    // corrupted stack and is indistinguishable from a miscompile.
+    uint16_t frameBytes_ = 0;
 
     // Label positions (-1 = unbound) and pending branch fixups.
     int32_t  labelPos_[kMaxLabels];
diff --git a/src/platform/desktop/moonlive_lower_host.cpp b/src/platform/desktop/moonlive_lower_host.cpp
index b3264516..3f1efb0a 100644
--- a/src/platform/desktop/moonlive_lower_host.cpp
+++ b/src/platform/desktop/moonlive_lower_host.cpp
@@ -1,5 +1,6 @@
 #include "core/moonlive/moonlive_emit.h"
 #include "core/moonlive/MoonLiveIr.h"
+#include "core/moonlive/MoonLiveSpill.h"   // the register allocator — core's, run before lowering
 #include "moonlive_asm_host.h"
 
 #include <cstring>
@@ -22,7 +23,7 @@ namespace {
 Reg reg(VReg v) { return static_cast<Reg>(v); }
 }
 
-size_t lowerToBytes(const IrProgram& ir, uint8_t* out, size_t cap) {
+size_t lowerToBytes(IrProgram& ir, uint8_t* out, size_t cap, const RegBudget* squeeze) {
     // Reserve three scratch regs above the program's vregs for the inline ops' temps.
     // Reserve scratch only for the inline ops this program actually contains. Unlike Xtensa and
     // RISC-V, THIS backend's StoreElem needs one scratch too (sAddr — it does not fold the address
@@ -30,7 +31,16 @@ size_t lowerToBytes(const IrProgram& ir, uint8_t* out, size_t cap) {
     // needs any. Reserving the maximum unconditionally cost a register every script paid for.
     const uint8_t scratch = ir.hasInline(InlineOp::FillElems) ? 3
                           : ir.hasInline(InlineOp::StoreElem) ? 1 : 0;
-    if (!out || cap == 0 || ir.vregsUsed + scratch > kRegCount) return 0;
+    if (!out || cap == 0) return 0;
+
+    // Run the register allocator before lowering. It leaves a program that already fits untouched,
+    // and rewrites one that does not into Spill/Reload against this backend's frame — replacing the
+    // hand-rolled `vregsUsed + scratch > kRegCount` bail that used to REFUSE such a script outright.
+    // False here means even the spilled form does not fit, which is a diagnostic, never a miscompile.
+    uint8_t slots = 0;
+    const RegBudget budget = squeeze ? *squeeze
+                                    : RegBudget{kRegCount, scratch, HostAssembler::kMaxSpillSlots};
+    if (!spillToBudget(ir, budget, slots)) return 0;
     // sAddr FIRST, because it is the one StoreElem also uses: a store-only program reserves a single
     // scratch, so the shared one has to be the lowest index or it would name a register outside the
     // reservation. sOff/sCtr are FillElems-only and sit above it.
@@ -39,6 +49,7 @@ size_t lowerToBytes(const IrProgram& ir, uint8_t* out, size_t cap) {
     const Reg sCtr  = static_cast<Reg>(ir.vregsUsed + 2);    // loop counter
 
     HostAssembler a;
+    a.prologue(slots);   // nothing at all when the program did not spill
 
     // An IR label id becomes an assembler label ON FIRST USE. Allocating the whole range up front
     // exhausts the assembler's fixed label table, and the inline ops (StoreElem's bounds guard,
@@ -52,7 +63,9 @@ size_t lowerToBytes(const IrProgram& ir, uint8_t* out, size_t cap) {
         return labels[id];
     };
 
-    for (uint8_t i = 0; i < ir.count; i++) {
+    // uint16_t, matching IrProgram::count: the op array is sized to the script now, so a
+    // uint8_t counter wrapped at 256 ops and looped forever instead of emitting.
+    for (uint16_t i = 0; i < ir.count; i++) {
         const IrInst& op = ir.ops[i];
         switch (op.op) {
             case IrOp::Const:  a.movImm(reg(op.dst), op.imm); break;
@@ -76,6 +89,9 @@ size_t lowerToBytes(const IrProgram& ir, uint8_t* out, size_t cap) {
                 }
                 break;
             case IrOp::LoadCtrl: a.load8(reg(op.dst), reg(kArg4), op.imm); break;  // dst = ctrls[imm]
+            // The allocator's two ops. `imm` is a slot INDEX; the assembler owns the frame layout.
+            case IrOp::Spill:  a.spillStore(reg(op.a), static_cast<uint8_t>(op.imm)); break;
+            case IrOp::Reload: a.spillLoad(reg(op.dst), static_cast<uint8_t>(op.imm)); break;
             case IrOp::Call:
                 if (!op.callFn) return 0;
                 a.call(reg(op.dst), reg(op.a), reg(op.b), reg(op.c), reinterpret_cast<const void*>(op.callFn));
@@ -118,7 +134,7 @@ size_t lowerToBytes(const IrProgram& ir, uint8_t* out, size_t cap) {
             default: break;   // Loop/LoopEnd/Bounds/BoundsEnd are not emitted by the parser now
         }
     }
-    a.ret();
+    a.epilogue();   // tears the spill frame down (if any), then ret
     a.finalize();
     if (a.overflowed() || a.size() > cap) return 0;
     std::memcpy(out, a.bytes(), a.size());
@@ -127,7 +143,7 @@ size_t lowerToBytes(const IrProgram& ir, uint8_t* out, size_t cap) {
 
 #else   // unsupported host ISA (e.g. Windows x64) — degrade: no codegen, compile fails cleanly.
 
-size_t lowerToBytes(const IrProgram&, uint8_t*, size_t) { return 0; }
+size_t lowerToBytes(IrProgram&, uint8_t*, size_t, const RegBudget*) { return 0; }
 
 #endif
 
diff --git a/src/platform/desktop/platform_desktop.cpp b/src/platform/desktop/platform_desktop.cpp
index 5d3fa4ed..eef662e4 100644
--- a/src/platform/desktop/platform_desktop.cpp
+++ b/src/platform/desktop/platform_desktop.cpp
@@ -140,6 +140,12 @@ uint32_t millis() MM_NONBLOCKING {
     );
 }
 
+// pthread_self() is the identity here; std::this_thread::get_id() is not convertible to an integer
+// portably. The +1 guarantees a non-zero result so callers can treat 0 as "none".
+uintptr_t currentThreadId() MM_NONBLOCKING {
+    return reinterpret_cast<uintptr_t>(pthread_self()) + 1;
+}
+
 uint32_t micros() MM_NONBLOCKING {
     auto now = std::chrono::steady_clock::now();
     return static_cast<uint32_t>(
@@ -1603,6 +1609,10 @@ uint8_t* parlioWs2812Buffer(const ParlioWs2812Handle& h, uint8_t buffer) {
 size_t parlioWs2812BufferCapacity(const ParlioWs2812Handle& h) {
     return h.impl ? static_cast<HostBus*>(h.impl)->capacity : 0;
 }
+// The desktop host emulates the bus in ordinary memory, so there is no single-transfer ceiling to
+// declare — 0 is the "no bound" contract dmaBudgetBytes() reads, matching every other host-side
+// Parlio stub here.
+size_t parlioMaxTransferBytes() { return 0; }
 bool parlioWs2812Transmit(ParlioWs2812Handle& h, uint8_t buffer, size_t bytes) {
     return h.impl && static_cast<HostBus*>(h.impl)->transmit(buffer, bytes);
 }
diff --git a/src/platform/esp32/moonlive_asm_riscv.cpp b/src/platform/esp32/moonlive_asm_riscv.cpp
index 37ec23d9..5260d26d 100644
--- a/src/platform/esp32/moonlive_asm_riscv.cpp
+++ b/src/platform/esp32/moonlive_asm_riscv.cpp
@@ -15,7 +15,12 @@ namespace mm::moonlive {
 // scratch (store8 address, call address build + result stash), not a vreg.
 static constexpr uint8_t kRvReg[kRegCount] = {10, 11, 12, 13, 14, 5, 6, 7, 28, 29, 30, 15,
                                               16, 17};
-static uint8_t xr(Reg r) { return kRvReg[r]; }
+// BOUNDS-CHECKED. The inline ops address their scratch as `vregsUsed + n`, so an index one past the
+// map is reachable whenever the reservation and the map disagree — and an out-of-bounds read returns
+// whatever byte follows the array, making the emitted instruction name a register chosen by
+// accident. Clamping turns that into a wrong-but-safe register instead of undefined behaviour; the
+// static_assert below and the lowerer's reservation are what stop it happening at all.
+static uint8_t xr(Reg r) { return kRvReg[r < kRegCount ? r : kRegCount - 1]; }
 // t6 is the ONLY caller-saved register outside kRvReg, so it is the only safe scratch: every other
 // free register is callee-saved (s0/s1, s6..s11) and would have to be preserved. Both uses below are
 // transient — store8 consumes it within two instructions, and call() finishes with it before any
@@ -35,7 +40,7 @@ constexpr bool rvScratchOutsideMap() {
 static_assert(rvScratchOutsideMap(), "a scratch register is also a vreg — calls will corrupt it");
 
 void RiscvAssembler::emit32(uint32_t w) {
-    if (len_ + 4 > kCap) { overflow_ = true; return; }
+    if (!buf_ || len_ + 4 > kCap) { overflow_ = true; return; }
     buf_[len_++] = uint8_t(w); buf_[len_++] = uint8_t(w >> 8);
     buf_[len_++] = uint8_t(w >> 16); buf_[len_++] = uint8_t(w >> 24);
 }
@@ -83,6 +88,46 @@ static uint32_t encBranch(uint8_t rs1, uint8_t rs2, uint8_t f3, int32_t off) {
            (f3 << 12) | (((o >> 1) & 0xf) << 8) | (((o >> 11) & 1) << 7) | 0x63;
 }
 
+// --- the call frame: the register allocator's overflow storage ---------------------------------
+//
+// s0/fp (x8) is the standard RISC-V frame pointer: callee-saved, outside kRvReg and outside the t6
+// scratch, so nothing this backend emits disturbs it — and the routine saves and restores it, which
+// is what makes using a callee-saved register legal here (the reason the map itself stops at the
+// caller-saved set, see moonlive_asm_riscv.h).
+//
+// Layout, sp growing down: sp = s0 - frameBytes, saved s0 at [s0-4], slot n at [s0 - frameBytes + n*4].
+static constexpr uint8_t kFramePtr = 8;   // s0/fp
+
+void RiscvAssembler::prologue(uint8_t slots) {
+    if (slots == 0) return;                        // no spilling: no frame, no cost
+    if (slots > kMaxSpillSlots) { overflow_ = true; return; }
+    // 16-byte aligned, as the RISC-V calling convention requires of sp at a call boundary — an
+    // unaligned sp is the kind of thing that survives every test and faults inside a callee.
+    const uint16_t bytes = static_cast<uint16_t>((8 + slots * 4 + 15) & ~15);
+    frameBytes_ = bytes;
+    emit32(encAddi(2, 2, -int32_t(bytes)));        // addi sp, sp, -bytes
+    emit32(encSw(kFramePtr, 2, bytes - 4));        // sw s0, bytes-4(sp)
+    emit32(encAddi(kFramePtr, 2, bytes));          // addi s0, sp, bytes   (s0 = the caller's sp)
+}
+void RiscvAssembler::epilogue() {
+    if (frameBytes_ != 0) {
+        emit32(encLw(kFramePtr, 2, frameBytes_ - 4));   // lw s0, bytes-4(sp)
+        emit32(encAddi(2, 2, frameBytes_));             // addi sp, sp, bytes
+    }
+    ret();
+}
+// sw/lw against s0. The offset is NEGATIVE (slots live below the frame pointer), which encAddi's
+// 12-bit signed immediate and the S/I-type immediates handle directly — 16 slots is 64 bytes, far
+// inside the ±2048 the field reaches.
+void RiscvAssembler::spillStore(Reg r, uint8_t slot) {
+    if (slot >= kMaxSpillSlots) { overflow_ = true; return; }
+    emit32(encSw(xr(r), kFramePtr, -int32_t(frameBytes_) + slot * 4));
+}
+void RiscvAssembler::spillLoad(Reg r, uint8_t slot) {
+    if (slot >= kMaxSpillSlots) { overflow_ = true; return; }
+    emit32(encLw(xr(r), kFramePtr, -int32_t(frameBytes_) + slot * 4));
+}
+
 void RiscvAssembler::movImm(Reg d, int32_t imm) {
     // addi sign-extends a 12-bit immediate, so it alone covers only -2048..2047. For wider
     // constants (a uint16 like 65535) materialise the full value with lui (high 20 bits) + addi
@@ -169,6 +214,9 @@ void RiscvAssembler::call(Reg d, Reg a, Reg b, Reg c, const void* fn) {
 void RiscvAssembler::ret() { emit32(0x00008067u); }    // ret = jalr x0, ra, 0
 
 void RiscvAssembler::patchBranches() {
+    // Nothing was emitted if the buffer never allocated, so there is nothing to patch —
+    // stated rather than left to the reader to derive from fixupCount_ being 0.
+    if (!buf_) return;
     for (uint8_t i = 0; i < fixupCount_; i++) {
         const Fixup& f = fixups_[i];
         if (labelPos_[f.label] < 0) continue;                  // unbound label — leave as-is (overflow_ already failed the compile)
diff --git a/src/platform/esp32/moonlive_asm_riscv.h b/src/platform/esp32/moonlive_asm_riscv.h
index fd340fcf..97a899ee 100644
--- a/src/platform/esp32/moonlive_asm_riscv.h
+++ b/src/platform/esp32/moonlive_asm_riscv.h
@@ -1,5 +1,7 @@
 #pragma once
 
+#include "platform/platform.h"   // alloc/free — the emit buffer is heap, not stack
+
 #include "core/moonlive/MoonLiveIr.h"   // kCodeCap — one cap for the staging buffer and every backend
 
 #include <cstdint>
@@ -32,12 +34,32 @@ enum class Cond : uint8_t { Lo /* unsigned < */, Hs /* unsigned >= */ };
 
 class RiscvAssembler {
 public:
+    // Owns buf_ (see below). Freed here, copying deleted — an emitter that was copied
+    // would double-free the buffer it emits into.
+    ~RiscvAssembler() { platform::free(buf_); }
+    RiscvAssembler() = default;
+    RiscvAssembler(const RiscvAssembler&) = delete;
+    RiscvAssembler& operator=(const RiscvAssembler&) = delete;
+
     void finalize() { patchBranches(); }
     const uint8_t* bytes() const { return buf_; }
     size_t size() const { return len_; }
     bool overflowed() const { return overflow_; }
 
-    void prologue() {}                   // RV needs no fixed prologue (sp managed in call())
+    // --- the call frame ---
+    // The register allocator's overflow storage (core/moonlive/MoonLiveSpill.h). RV32 had no frame
+    // at all outside call(), so a spilling program is the first thing here that needs one: prologue
+    // opens it and parks s0 (the standard frame pointer) at its top, epilogue tears it down. Slots
+    // are addressed from s0, NOT sp, because call() moves sp by 80 bytes around every host call —
+    // sp-relative offsets would be wrong for its duration, and reading a spilled value after a
+    // random16() is the ordinary case. It is also the layout a nested or recursive script function
+    // needs: one s0 per activation.
+    // slots == 0 emits nothing, so a non-spilling script keeps today's zero-instruction entry.
+    void prologue(uint8_t slots = 0);
+    void spillStore(Reg r, uint8_t slot);
+    void spillLoad(Reg r, uint8_t slot);
+    static constexpr uint8_t kMaxSpillSlots = 16;
+
     Label newLabel();
     void  bind(Label l);
 
@@ -52,7 +74,7 @@ class RiscvAssembler {
     void branchGeU(Reg a, Reg b, Label l);    // bgeu a, b, l
     void branchNe(Reg a, Reg b, Label l);     // bne a, b, l
     void call(Reg d, Reg a, Reg b, Reg c, const void* fn);  // standard call to a host built-in
-    void epilogue() { ret(); }
+    void epilogue();                     // undo prologue's frame (if any), then ret
     void ret();
 
 private:
@@ -64,9 +86,18 @@ class RiscvAssembler {
     void emit32(uint32_t w);
     void addFixup(size_t at, Label label);   // enqueue a branch fixup (bounds-checked)
 
-    uint8_t  buf_[kCap] = {};
+    // HEAP, not a member array: the assembler is a stack local in lowerToBytes, so a kCap-sized
+    // member put 2 KB on the compile chain's stack — on top of the staging buffer and the parser
+    // frames. On a classic ESP32 that overflowed the task and faulted inside _xt_context_save
+    // (the plan named this: "buf_[kCap] inside the assembler, itself a stack local"). The buffer is
+    // scratch that ends in a memcpy to the caller's output, so nothing outlives the object.
+    uint8_t* buf_ = static_cast<uint8_t*>(platform::alloc(kCap));
     size_t   len_ = 0;
     bool     overflow_ = false;
+    // Frame size in bytes, 0 when no prologue was emitted. epilogue() reads it, so the teardown can
+    // never disagree with the setup about how far sp moved — a mismatch there returns to a corrupted
+    // stack, which looks like anything except the compiler bug it is.
+    uint16_t frameBytes_ = 0;
 
     int32_t  labelPos_[kMaxLabels];
     uint8_t  labelCount_ = 0;
diff --git a/src/platform/esp32/moonlive_asm_xtensa.cpp b/src/platform/esp32/moonlive_asm_xtensa.cpp
index d8871edb..571d9a2a 100644
--- a/src/platform/esp32/moonlive_asm_xtensa.cpp
+++ b/src/platform/esp32/moonlive_asm_xtensa.cpp
@@ -17,22 +17,38 @@ namespace mm::moonlive {
 
 // R0..R3 → a2..a5 (the windowed-ABI args); R4..R11 → a6..a11, a14, a15. a12/a13 are internal
 // scratch (store8 address, branchIfZero zero-reg, call result stash), so not in the pool.
-static constexpr uint8_t kXtReg[kRegCount] = {2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 14, 15};
-static uint8_t ar(Reg r) { return kXtReg[r]; }
+static constexpr uint8_t kXtReg[kRegCount] = {2, 3, 4, 5, 6, 7, 8, 9, 10, 11};
+// Map a vreg to its machine register. BOUNDS-CHECKED: the inline ops address their scratch as
+// `vregsUsed + n`, which walks off the end of the map when a program uses the whole file — and an
+// out-of-bounds read here returns whatever byte follows the array, so the emitted instruction names
+// a register chosen by accident. That produced a12 (a call8 window register AND this assembler's own
+// scratch) in a program that had no business touching it. Clamped to the last real entry so a
+// mistake is a wrong-but-safe register rather than undefined behaviour; the static_assert below and
+// the reservation in the lowerer are what keep it from happening at all.
+static uint8_t ar(Reg r) { return kXtReg[r < kRegCount ? r : kRegCount - 1]; }
+
+// The map, for the codegen test to assert against. Exposed rather than copied into the test, so the
+// property being checked cannot drift away from the map it is about.
+const uint8_t* xtRegMap(uint8_t& count) { count = kRegCount; return kXtReg; }
 
 // A scratch register that is ALSO a vreg silently corrupts values — see the RISC-V backend, where
 // kScratchFn aliased vreg R12 and every call returned a stale value. Checked here so the map can
 // never grow over a scratch.
 constexpr bool xtScratchOutsideMap() {
-    constexpr uint8_t scratch[] = {12, 13};
+    // a12/a13 are call() scratch; a14/a15 carry the retw.n return linkage of our own `entry` frame.
+    // Both classes are fatal as vregs, and the second one only faults once a script makes a CALL —
+    // which is why it survived every effect and killed every layout.
+    constexpr uint8_t scratch[] = {12, 13, 14, 15};
     for (uint8_t r : kXtReg) for (uint8_t s : scratch) if (r == s) return false;
     return true;
 }
-static_assert(xtScratchOutsideMap(), "a scratch register is also a vreg — calls will corrupt it");
+static_assert(xtScratchOutsideMap(), "a scratch or window register is also a vreg — calls corrupt it");
 
 
 void XtensaAssembler::emit(const uint8_t* p, size_t n) {
-    if (len_ + n > kCap) { overflow_ = true; return; }
+    // !buf_ covers a failed allocation: the compile then fails cleanly at overflowed() instead
+    // of writing through a null pointer.
+    if (!buf_ || len_ + n > kCap) { overflow_ = true; return; }
     std::memcpy(buf_ + len_, p, n); len_ += n;
 }
 void XtensaAssembler::emit2(uint16_t w) {
@@ -42,11 +58,46 @@ void XtensaAssembler::emit3(uint32_t w) {
     const uint8_t b[3] = {uint8_t(w), uint8_t(w >> 8), uint8_t(w >> 16)}; emit(b, 3);
 }
 
-// entry a1, 48 — a 48-byte frame leaves room for the call8 window rotation (a routine with no
-// call would be fine with 32, but 48 is harmless and lets any program call a built-in).
-void XtensaAssembler::prologue() { emit3(0x006136u); }   // entry a1, 48
+// entry a1, N — a 48-byte frame leaves room for the call8 window rotation (a routine with no
+// call would be fine with 32, but 48 is harmless and lets any program call a built-in). call() uses
+// bytes 16..39 of it, so the register allocator's spill slots start at 48 and the frame simply grows
+// to hold them: on this ISA the whole-routine frame already exists, so spilling costs a bigger
+// immediate on ONE instruction and nothing else. a1 is the frame pointer, and the windowed ABI
+// preserves it across callx8 — which is why a slot read after a host call still finds its value, and
+// why this addressing carries over unchanged when script functions start nesting frames.
+// One word inside call()'s own save area for the return value: offsets 16..28 hold the saved
+// vregs, 32 is free, and a register cannot hold a result across a window rotation.
+static constexpr uint8_t  kResultSlot = 8;    // byte offset 32
+static constexpr uint16_t kFrameBase  = 48;   // first byte past the bytes call() reserves
+static constexpr uint16_t kSlotStride = 4;
+
+// ENTRY is a BRI12-format instruction: op0=6, n=3, s=the base register, and the 12-bit immediate at
+// bits 12..23 counts EIGHT-byte units. `entry a1, 48` is therefore 0x006136.
+void XtensaAssembler::prologue(uint8_t slots) {
+    if (slots > kMaxSpillSlots) { overflow_ = true; return; }
+    // Rounded up to 8 because the immediate counts 8-byte units; the ABI additionally wants the
+    // frame 16-byte aligned, and 48 + a multiple of 16 keeps that.
+    const uint32_t bytes = (kFrameBase + uint32_t(slots) * kSlotStride + 15u) & ~15u;
+    emit3(0x000136u | ((bytes / 8u) << 12));
+}
 void XtensaAssembler::epilogue() { emit2(0xf01du); }     // retw.n
 
+// s32i/l32i aR, a1, #off — the offset field counts 4-byte words, so a slot index maps straight onto
+// it. No teardown counterpart: `entry`'s frame is released by retw.n, so unlike the RISC-V and arm64
+// backends there is nothing for an epilogue to undo.
+void XtensaAssembler::spillStore(Reg r, uint8_t slot) {
+    if (slot >= kMaxSpillSlots) { overflow_ = true; return; }
+    const uint8_t off4 = static_cast<uint8_t>((kFrameBase + slot * kSlotStride) / 4);
+    const uint8_t b[3] = {uint8_t((ar(r) << 4) | 0x2), 0x61, off4};
+    emit(b, 3);
+}
+void XtensaAssembler::spillLoad(Reg r, uint8_t slot) {
+    if (slot >= kMaxSpillSlots) { overflow_ = true; return; }
+    const uint8_t off4 = static_cast<uint8_t>((kFrameBase + slot * kSlotStride) / 4);
+    const uint8_t b[3] = {uint8_t((ar(r) << 4) | 0x2), 0x21, off4};
+    emit(b, 3);
+}
+
 Label XtensaAssembler::newLabel() {
     if (labelCount_ == 0) for (auto& p : labelPos_) p = -1;
     if (labelCount_ >= kMaxLabels) { overflow_ = true; return 0; }   // same overflow signal as emit
@@ -138,22 +189,41 @@ void XtensaAssembler::branchIfZero(Reg a, Label l) {
     static constexpr uint8_t kZero = 13;   // a13
     const uint8_t mv[3] = {uint8_t((kZero << 4) | 0x2), 0xa0, 0x00};   // movi a13, 0
     emit(mv, 3);
-    addFixup(len_, l);
-    const uint8_t br[3] = {uint8_t((ar(a) << 4) | 0x7), uint8_t((0xb << 4) | kZero), 0x00};  // bgeu a13, a
+    // Same relaxed form as the other branches: bltu a13, a, +3 (the inverse of bgeu) over a `j`.
+    const uint8_t br[3] = {uint8_t((ar(a) << 4) | 0x7), uint8_t((0x3 << 4) | kZero), 0x02};
     emit(br, 3);
-}
-// bgeu aA, aB, l  (skip if a >= b, unsigned)
-void XtensaAssembler::branchGeU(Reg a, Reg b, Label l) {
     addFixup(len_, l);
-    const uint8_t bytes[3] = {uint8_t((ar(b) << 4) | 0x7), uint8_t((0xb << 4) | ar(a)), 0x00};
-    emit(bytes, 3);
+    const uint8_t j[3] = {0x06, 0x00, 0x00};
+    emit(j, 3);
 }
-// bne aA, aB, l
-void XtensaAssembler::branchNe(Reg a, Reg b, Label l) {
+// A conditional branch to `l`, emitted as the INVERTED condition over an unconditional jump:
+//
+//     b<inv> aA, aB, +3      ; skip the jump when the branch is NOT taken
+//     j      l               ; 18-bit displacement — reaches anywhere in a script
+//
+// Xtensa's conditional branches carry a single SIGNED BYTE of displacement (±127), which a loop body
+// outgrows easily once spill traffic is in it — grid.mlv needed 177. Truncating that silently
+// retargets the branch into the middle of the program, so the choice is relax or refuse. This is the
+// textbook relaxation every compiler does (GCC and LLVM emit the short form and rewrite the ones that
+// do not fit); the fixed six-byte form skips the iterate-to-convergence step, which is worth a few
+// bytes per branch on a cold path in exchange for not having to reason about shifting offsets.
+// The 3-byte `j` keeps its own fixup, and the inverted branch's +3 is already correct as emitted.
+void XtensaAssembler::branchRelaxed(uint8_t condNibble, Reg a, Reg b, Label l) {
+    // The inverted condition, skipping the 3-byte `j` that follows. Xtensa branch displacements are
+    // relative to PC+4 (the same rule patchBranches uses), so clearing a 3-byte instruction is +2.
+    // bne(0x9) <-> beq(0x1); bgeu(0xb) <-> bltu(0x3).
+    const uint8_t inv = condNibble == 0x9 ? 0x1 : condNibble == 0x1 ? 0x9
+                      : condNibble == 0xb ? 0x3 : 0xb;
+    const uint8_t br[3] = {uint8_t((ar(b) << 4) | 0x7), uint8_t((inv << 4) | ar(a)), 0x02};
+    emit(br, 3);
     addFixup(len_, l);
-    const uint8_t bytes[3] = {uint8_t((ar(b) << 4) | 0x7), uint8_t((0x9 << 4) | ar(a)), 0x00};
-    emit(bytes, 3);
+    const uint8_t j[3] = {0x06, 0x00, 0x00};      // j — the 18-bit offset is patched in
+    emit(j, 3);
 }
+// bgeu aA, aB, l  (skip if a >= b, unsigned)
+void XtensaAssembler::branchGeU(Reg a, Reg b, Label l) { branchRelaxed(0xb, a, b, l); }
+// bne aA, aB, l
+void XtensaAssembler::branchNe(Reg a, Reg b, Label l) { branchRelaxed(0x9, a, b, l); }
 
 // Windowed call to a host built-in: d = fn(a). CALL8 rotates the window by 8, so the arg goes
 // in a10 and the result returns in a10. The caller's a2..a7 are preserved by the window for
@@ -165,15 +235,12 @@ void XtensaAssembler::branchNe(Reg a, Reg b, Label l) {
 // byte-by-byte (movi/slli/add) — no l32r literal pool.
 void XtensaAssembler::call(Reg d, Reg a, Reg b, Reg c, const void* fn) {
     // Save the rotate-out scratch a8, a9, a11 (a10 will carry arg→result).
-    auto s32i = [&](uint8_t r, uint8_t off4){ const uint8_t b[3]={uint8_t((r<<4)|2),0x61,off4}; emit(b,3); };
-    auto l32i = [&](uint8_t r, uint8_t off4){ const uint8_t b[3]={uint8_t((r<<4)|2),0x21,off4}; emit(b,3); };
+    auto s32i = [&](uint8_t r, uint8_t off4){ const uint8_t enc[3]={uint8_t((r<<4)|2),0x61,off4}; emit(enc,3); };
+    auto l32i = [&](uint8_t r, uint8_t off4){ const uint8_t enc[3]={uint8_t((r<<4)|2),0x21,off4}; emit(enc,3); };
     s32i(8, 4); s32i(9, 5); s32i(11, 7);                  // [a1+16]=a8, [a1+20]=a9, [a1+28]=a11
-    // a14/a15 are vregs R10/R11 (kXtReg), and CALL8 rotates the window out from under them — so a
-    // value live across a call in either was destroyed. Reachable on the SHIPPED default: grid.mlv
-    // is a nested loop (11 vregs, so R10 is in use) whose body calls addLight. The entry frame is 48
-    // bytes and call() uses 16/20/24/28, so 32/36 are free.
-    s32i(14, 8); s32i(15, 9);                             // [a1+32]=a14, [a1+36]=a15
-
+    // a14/a15 are deliberately NOT saved here, because they are no longer vregs (kXtReg): they carry
+    // this routine's own return linkage for retw.n, so writing saved copies back into them after the
+    // call is what broke every scripted layout. See the Reg enum for the failure that produced.
     s32i(10, 6);                                          // [a1+24]=a10 — a vreg (R8) call8 rotates out
 
     // The three args into a10/a11/a12 — call8 shifts the window by 8, so the callee reads them as
@@ -189,28 +256,44 @@ void XtensaAssembler::call(Reg d, Reg a, Reg b, Reg c, const void* fn) {
     emit2(uint16_t((13u << 8) | (10 << 4) | 0xd));               // mov a10, a13
 
     uint32_t addr = static_cast<uint32_t>(reinterpret_cast<uintptr_t>(fn));
-    auto moviA8 = [&](uint8_t v){ const uint8_t b[3]={0x82,0xa0,v}; emit(b,3); };
-    auto moviA9 = [&](uint8_t v){ const uint8_t b[3]={0x92,0xa0,v}; emit(b,3); };
-    auto slliA8 = [&]{ const uint8_t b[3]={0x80,0x88,0x11}; emit(b,3); };
+    auto moviA8 = [&](uint8_t v){ const uint8_t enc[3]={0x82,0xa0,v}; emit(enc,3); };
+    auto moviA9 = [&](uint8_t v){ const uint8_t enc[3]={0x92,0xa0,v}; emit(enc,3); };
+    auto slliA8 = [&]{ const uint8_t enc[3]={0x80,0x88,0x11}; emit(enc,3); };
     auto addA8A9 = [&]{ emit2(0x889au); };
     moviA8(uint8_t(addr >> 24));
     slliA8(); moviA9(uint8_t(addr >> 16)); addA8A9();
     slliA8(); moviA9(uint8_t(addr >> 8));  addA8A9();
     slliA8(); moviA9(uint8_t(addr));       addA8A9();
     emit3(0x0000e0u | (8u << 8));                          // callx8 a8  → result in a10
-    // stash result (a10) in a12 (not in the saved set), restore a8/a9/a11, then dst = a12.
-    emit2(uint16_t((10u << 8) | (12u << 4) | 0xd));        // mov a12, a10
+    // Park the result in the FRAME, not in a register.
+    //
+    // It used to be stashed in a12 — but call8 rotates the window by eight, so the callee's a4 IS
+    // our a12: the callee overwrites the stash with its own second argument while it runs, and the
+    // "result" moved to the destination afterwards is whatever the callee happened to leave there.
+    // a12/a13 are safe as scratch only BEFORE the call, never across it. Measured: A0 = 0x100 in the
+    // crash dump — nLights, a script value that reached the return-address register this way.
+    // Slot kResultSlot sits in the bytes call() already owns, so this costs no extra frame.
+    s32i(10, kResultSlot);                                 // [a1+kResultSlot*4] = result
     l32i(8, 4); l32i(9, 5); l32i(10, 6); l32i(11, 7);
-    l32i(14, 8); l32i(15, 9);
-    emit2(uint16_t((12u << 8) | (uint32_t(ar(d)) << 4) | 0xd));   // mov aDst, a12
+    l32i(ar(d), kResultSlot);                              // dst = the parked result
 }
 
 void XtensaAssembler::patchBranches() {
+    // Nothing was emitted if the buffer never allocated, so there is nothing to patch —
+    // stated rather than left to the reader to derive from fixupCount_ being 0.
+    if (!buf_) return;
     for (uint8_t i = 0; i < fixupCount_; i++) {
         const Fixup& f = fixups_[i];
         if (labelPos_[f.label] < 0) continue;                                  // unbound label — leave as-is (overflow_ already failed the compile)
-        int32_t off = labelPos_[f.label] - (static_cast<int32_t>(f.at) + 4);   // verified rule
-        buf_[f.at + 2] = static_cast<uint8_t>(off & 0xff);                     // offset byte at +2
+        // Every fixup now points at a `j`, whose displacement is relative to the byte AFTER the
+        // instruction and occupies bits 6..23 — eighteen signed bits, so it reaches any script the
+        // code buffer can hold. Still range-checked: refusing beats silently retargeting a jump.
+        const int32_t off = labelPos_[f.label] - (static_cast<int32_t>(f.at) + 4);
+        if (off < -131072 || off > 131071) { overflow_ = true; return; }
+        const uint32_t enc = 0x06u | ((static_cast<uint32_t>(off) & 0x3ffffu) << 6);
+        buf_[f.at + 0] = static_cast<uint8_t>(enc);
+        buf_[f.at + 1] = static_cast<uint8_t>(enc >> 8);
+        buf_[f.at + 2] = static_cast<uint8_t>(enc >> 16);
     }
 }
 
diff --git a/src/platform/esp32/moonlive_asm_xtensa.h b/src/platform/esp32/moonlive_asm_xtensa.h
index 5b79f125..8d45e4aa 100644
--- a/src/platform/esp32/moonlive_asm_xtensa.h
+++ b/src/platform/esp32/moonlive_asm_xtensa.h
@@ -1,5 +1,7 @@
 #pragma once
 
+#include "platform/platform.h"   // alloc/free — the emit buffer is heap, not stack
+
 #include "core/moonlive/MoonLiveIr.h"   // kCodeCap — one cap for the staging buffer and every backend
 
 #include <cstdint>
@@ -16,18 +18,46 @@
 
 namespace mm::moonlive {
 
-enum Reg : uint8_t { R0 = 0, R1, R2, R3, R4, R5, R6, R7, R8, R9, R10, R11, kRegCount };
+// Ten vregs, mapping to a2..a11. NOT a14/a15: with the windowed ABI a routine that opened its frame
+// with `entry` returns through `retw.n`, which reads the caller's linkage out of the TOP of the
+// window — so a12..a15 are not general registers here, they are the return path. Using a14/a15 as
+// vregs (and restoring saved copies into them after a callx8) corrupted that linkage, and `retw.n`
+// then returned to a garbage address: `Guru Meditation (IllegalInstruction)` the moment a scripted
+// LAYOUT ran, because addLight is the call that made the window rotate. a12/a13 stay scratch.
+enum Reg : uint8_t { R0 = 0, R1, R2, R3, R4, R5, R6, R7, R8, R9, kRegCount };
 using Label = uint8_t;
 enum class Cond : uint8_t { Lo /* unsigned < */, Hs /* unsigned >= */ };
 
+/// The vreg → machine-register map, for the device-codegen test. a2..a11 only: a12/a13 are call
+/// scratch and the store8 address register, and a14/a15 carry the routine's own retw.n linkage.
+const uint8_t* xtRegMap(uint8_t& count);
+
 class XtensaAssembler {
 public:
+    // Owns buf_ (see below). Freed here, copying deleted — an emitter that was copied
+    // would double-free the buffer it emits into.
+    ~XtensaAssembler() { platform::free(buf_); }
+    XtensaAssembler() = default;
+    XtensaAssembler(const XtensaAssembler&) = delete;
+    XtensaAssembler& operator=(const XtensaAssembler&) = delete;
+
     void finalize() { patchBranches(); }
     const uint8_t* bytes() const { return buf_; }
     size_t size() const { return len_; }
     bool overflowed() const { return overflow_; }
 
-    void prologue();                     // entry a1, 48  (must be the first instruction)
+    // --- the call frame ---
+    // The register allocator's overflow storage (core/moonlive/MoonLiveSpill.h). Xtensa already has
+    // a whole-routine frame from `entry a1, N`; prologue(slots) simply widens N to carry the spill
+    // slots above the bytes call() uses, so a spilling script costs one larger immediate and no
+    // extra instruction. slots == 0 keeps the frame exactly as it was, so nothing changes for a
+    // script that did not spill. Slots are addressed from a1, which the windowed ABI preserves
+    // across callx8 — the same property a nested or recursive script function will rely on.
+    void prologue(uint8_t slots = 0);    // entry a1, N  (must be the first instruction)
+    void spillStore(Reg r, uint8_t slot);
+    void spillLoad(Reg r, uint8_t slot);
+    static constexpr uint8_t kMaxSpillSlots = 16;
+
     Label newLabel();
     void  bind(Label l);
 
@@ -55,7 +85,12 @@ class XtensaAssembler {
     void emit3(uint32_t w);              // wide (24-bit) instruction
     void addFixup(size_t at, Label label);   // enqueue a branch fixup (bounds-checked)
 
-    uint8_t  buf_[kCap] = {};
+    // HEAP, not a member array: the assembler is a stack local in lowerToBytes, so a kCap-sized
+    // member put 2 KB on the compile chain's stack — on top of the staging buffer and the parser
+    // frames. On a classic ESP32 that overflowed the task and faulted inside _xt_context_save
+    // (the plan named this: "buf_[kCap] inside the assembler, itself a stack local"). The buffer is
+    // scratch that ends in a memcpy to the caller's output, so nothing outlives the object.
+    uint8_t* buf_ = static_cast<uint8_t*>(platform::alloc(kCap));
     size_t   len_ = 0;
     bool     overflow_ = false;
 
@@ -65,6 +100,10 @@ class XtensaAssembler {
     Fixup    fixups_[kMaxFixups];
     uint8_t  fixupCount_ = 0;
 
+    // A conditional branch emitted as inverted-condition-over-`j`, so its reach is the jump's
+    // 18 bits rather than the branch's signed byte. See the .cpp for why that is not optional.
+    void branchRelaxed(uint8_t condNibble, Reg a, Reg b, Label l);
+
     void patchBranches();
 };
 
diff --git a/src/platform/esp32/moonlive_lower_riscv.cpp b/src/platform/esp32/moonlive_lower_riscv.cpp
index 00c8cac9..4757c375 100644
--- a/src/platform/esp32/moonlive_lower_riscv.cpp
+++ b/src/platform/esp32/moonlive_lower_riscv.cpp
@@ -1,5 +1,6 @@
 #include "core/moonlive/moonlive_emit.h"
 #include "core/moonlive/MoonLiveIr.h"
+#include "core/moonlive/MoonLiveSpill.h"   // the register allocator — core's, run before lowering
 #include "moonlive_asm_riscv.h"
 
 #include <cstring>
@@ -17,7 +18,7 @@ namespace {
 Reg reg(VReg v) { return static_cast<Reg>(v); }
 }
 
-size_t lowerToBytes(const IrProgram& ir, uint8_t* out, size_t cap) {
+size_t lowerToBytes(IrProgram& ir, uint8_t* out, size_t cap, const RegBudget* squeeze) {
     // StoreElem folds the address into the index vreg (no scratch); FillElems needs two.
     // Reserve scratch only for the inline ops this program actually contains: FillElems needs two
     // (loop counter + per-channel address), StoreElem one (the address — it must NOT be folded into
@@ -26,13 +27,23 @@ size_t lowerToBytes(const IrProgram& ir, uint8_t* out, size_t cap) {
     // the smallest file.
     const uint8_t scratch = ir.hasInline(InlineOp::FillElems) ? 2
                           : ir.hasInline(InlineOp::StoreElem) ? 1 : 0;
-    if (!out || cap == 0 || ir.vregsUsed + scratch > kRegCount) return 0;
+    if (!out || cap == 0) return 0;
+
+    // Run the register allocator before lowering. It leaves a program that already fits untouched,
+    // and rewrites one that does not into Spill/Reload against this backend's frame — replacing the
+    // hand-rolled `vregsUsed + scratch > kRegCount` bail that used to REFUSE such a script outright.
+    // False here means even the spilled form does not fit, which is a diagnostic, never a miscompile.
+    uint8_t slots = 0;
+    const RegBudget budget = squeeze ? *squeeze
+                                    : RegBudget{kRegCount, scratch, RiscvAssembler::kMaxSpillSlots};
+    if (!spillToBudget(ir, budget, slots)) return 0;
     // sAddr FIRST: it is the one StoreElem also uses, and a store-only program reserves a single
     // scratch — so the shared one has to be the lowest index or it would name an unreserved register.
     const Reg sAddr = static_cast<Reg>(ir.vregsUsed);       // per-channel address (both ops)
     const Reg sCtr  = static_cast<Reg>(ir.vregsUsed + 1);   // FillElems loop counter
 
     RiscvAssembler a;
+    a.prologue(slots);   // opens a frame only when the program spilled
 
     // An IR label id becomes an assembler label ON FIRST USE. Allocating the whole range up front
     // exhausts the assembler's fixed label table, and the inline ops (StoreElem's bounds guard,
@@ -46,7 +57,9 @@ size_t lowerToBytes(const IrProgram& ir, uint8_t* out, size_t cap) {
         return labels[id];
     };
 
-    for (uint8_t i = 0; i < ir.count; i++) {
+    // uint16_t, matching IrProgram::count: the op array is sized to the script now, so a
+    // uint8_t counter wrapped at 256 ops and looped forever instead of emitting.
+    for (uint16_t i = 0; i < ir.count; i++) {
         const IrInst& op = ir.ops[i];
         switch (op.op) {
             case IrOp::Const:  a.movImm(reg(op.dst), op.imm); break;
@@ -71,6 +84,9 @@ size_t lowerToBytes(const IrProgram& ir, uint8_t* out, size_t cap) {
                     a.branchNe(reg(op.a), reg(op.b), labelFor(op.imm));
                 break;
             case IrOp::LoadCtrl: a.load8(reg(op.dst), reg(kArg4), op.imm); break;  // dst = ctrls[imm] (a4 = kArg4)
+            // The allocator's two ops. `imm` is a slot INDEX; the assembler owns the frame layout.
+            case IrOp::Spill:  a.spillStore(reg(op.a), static_cast<uint8_t>(op.imm)); break;
+            case IrOp::Reload: a.spillLoad(reg(op.dst), static_cast<uint8_t>(op.imm)); break;
             case IrOp::Call:
                 // The IR carries the host's function pointer (the light TU's random16), valid in
                 // the single flashed image — call it directly, same as the other backends.
diff --git a/src/platform/esp32/moonlive_lower_xtensa.cpp b/src/platform/esp32/moonlive_lower_xtensa.cpp
index 9c4224c4..cc6bbe45 100644
--- a/src/platform/esp32/moonlive_lower_xtensa.cpp
+++ b/src/platform/esp32/moonlive_lower_xtensa.cpp
@@ -1,5 +1,6 @@
 #include "core/moonlive/moonlive_emit.h"
 #include "core/moonlive/MoonLiveIr.h"
+#include "core/moonlive/MoonLiveSpill.h"   // the register allocator — core's, run before lowering
 #include "moonlive_asm_xtensa.h"
 
 #include <cstring>
@@ -18,7 +19,7 @@ namespace {
 Reg reg(VReg v) { return static_cast<Reg>(v); }
 }
 
-size_t lowerToBytes(const IrProgram& ir, uint8_t* out, size_t cap) {
+size_t lowerToBytes(IrProgram& ir, uint8_t* out, size_t cap, const RegBudget* squeeze) {
     // Reserve scratch only for the inline ops this program actually contains: FillElems needs two
     // (loop counter + per-channel address), StoreElem one (the address — it must NOT be folded into
     // the caller's index vreg, which destroys a `for` counter). Reserving the maximum unconditionally
@@ -26,14 +27,23 @@ size_t lowerToBytes(const IrProgram& ir, uint8_t* out, size_t cap) {
     // the smallest file.
     const uint8_t scratch = ir.hasInline(InlineOp::FillElems) ? 2
                           : ir.hasInline(InlineOp::StoreElem) ? 1 : 0;
-    if (!out || cap == 0 || ir.vregsUsed + scratch > kRegCount) return 0;
+    if (!out || cap == 0) return 0;
+
+    // Run the register allocator before lowering. It leaves a program that already fits untouched,
+    // and rewrites one that does not into Spill/Reload against this backend's frame — replacing the
+    // hand-rolled `vregsUsed + scratch > kRegCount` bail that used to REFUSE such a script outright.
+    // False here means even the spilled form does not fit, which is a diagnostic, never a miscompile.
+    uint8_t slots = 0;
+    const RegBudget budget = squeeze ? *squeeze
+                                    : RegBudget{kRegCount, scratch, XtensaAssembler::kMaxSpillSlots};
+    if (!spillToBudget(ir, budget, slots)) return 0;
     // sAddr FIRST: it is the one StoreElem also uses, and a store-only program reserves a single
     // scratch — so the shared one has to be the lowest index or it would name an unreserved register.
     const Reg sAddr = static_cast<Reg>(ir.vregsUsed);       // per-channel address (both ops)
     const Reg sCtr  = static_cast<Reg>(ir.vregsUsed + 1);   // FillElems loop counter
 
     XtensaAssembler a;
-    a.prologue();
+    a.prologue(slots);   // widens the entry frame only when the program spilled
 
     // An IR label id becomes an assembler label ON FIRST USE. Allocating the whole range up front
     // exhausts the assembler's fixed label table, and the inline ops (StoreElem's bounds guard,
@@ -47,7 +57,9 @@ size_t lowerToBytes(const IrProgram& ir, uint8_t* out, size_t cap) {
         return labels[id];
     };
 
-    for (uint8_t i = 0; i < ir.count; i++) {
+    // uint16_t, matching IrProgram::count: the op array is sized to the script now, so a
+    // uint8_t counter wrapped at 256 ops and looped forever instead of emitting.
+    for (uint16_t i = 0; i < ir.count; i++) {
         const IrInst& op = ir.ops[i];
         switch (op.op) {
             case IrOp::Const:  a.movImm(reg(op.dst), op.imm); break;
@@ -72,6 +84,9 @@ size_t lowerToBytes(const IrProgram& ir, uint8_t* out, size_t cap) {
                     a.branchNe(reg(op.a), reg(op.b), labelFor(op.imm));
                 break;
             case IrOp::LoadCtrl: a.load8(reg(op.dst), reg(kArg4), op.imm); break;  // dst = ctrls[imm] (a6 = kArg4)
+            // The allocator's two ops. `imm` is a slot INDEX; the assembler owns the frame layout.
+            case IrOp::Spill:  a.spillStore(reg(op.a), static_cast<uint8_t>(op.imm)); break;
+            case IrOp::Reload: a.spillLoad(reg(op.dst), static_cast<uint8_t>(op.imm)); break;
             case IrOp::Call:
                 if (!op.callFn) return 0;
                 a.call(reg(op.dst), reg(op.a), reg(op.b), reg(op.c), reinterpret_cast<const void*>(op.callFn));
diff --git a/src/platform/esp32/platform_esp32.cpp b/src/platform/esp32/platform_esp32.cpp
index 3572603f..638464b0 100644
--- a/src/platform/esp32/platform_esp32.cpp
+++ b/src/platform/esp32/platform_esp32.cpp
@@ -96,6 +96,13 @@ uint32_t millis() MM_NONBLOCKING {
     return static_cast<uint32_t>(esp_timer_get_time() / 1000);
 }
 
+// The task handle IS the identity, and reading it costs one load — no TLS, so it works on a task
+// however it was created. That matters: THREADPTR is 0 on a task without TLS set up, which made
+// C++ thread_local fault at 0xfffffff0 here.
+uintptr_t currentThreadId() MM_NONBLOCKING {
+    return reinterpret_cast<uintptr_t>(xTaskGetCurrentTaskHandle());
+}
+
 uint32_t micros() MM_NONBLOCKING {
     return static_cast<uint32_t>(esp_timer_get_time());
 }
diff --git a/src/platform/esp32/platform_esp32_parlio.cpp b/src/platform/esp32/platform_esp32_parlio.cpp
index ba79d44c..cb53673d 100644
--- a/src/platform/esp32/platform_esp32_parlio.cpp
+++ b/src/platform/esp32/platform_esp32_parlio.cpp
@@ -265,6 +265,8 @@ uint8_t* parlioWs2812Buffer(const ParlioWs2812Handle& h, uint8_t buffer) {
     return (st && buffer < 2) ? st->buf[buffer] : nullptr;
 }
 
+size_t parlioMaxTransferBytes() { return kParlioMaxTransferBytes; }
+
 size_t parlioWs2812BufferCapacity(const ParlioWs2812Handle& h) {
     auto* st = static_cast<ParlioState*>(h.impl);
     return st ? st->cap : 0;
@@ -410,6 +412,7 @@ bool parlioWs2812Init(ParlioWs2812Handle&, const uint16_t*, uint8_t, uint32_t, s
 }
 uint8_t* parlioWs2812Buffer(const ParlioWs2812Handle&, uint8_t) { return nullptr; }
 size_t parlioWs2812BufferCapacity(const ParlioWs2812Handle&) { return 0; }
+size_t parlioMaxTransferBytes() { return 0; }   // no Parlio here → no bound (the budget-0 contract)
 bool parlioWs2812Transmit(ParlioWs2812Handle&, uint8_t, size_t) { return false; }
 bool parlioWs2812Wait(ParlioWs2812Handle&, uint8_t, uint32_t) { return true; }
 uint32_t parlioWs2812LastTransmitUs(const ParlioWs2812Handle&) { return 0; }
diff --git a/src/platform/platform.h b/src/platform/platform.h
index a8d2914c..7c32cd0d 100644
--- a/src/platform/platform.h
+++ b/src/platform/platform.h
@@ -32,6 +32,16 @@
 namespace mm::platform {
 
 uint32_t millis() MM_NONBLOCKING;
+
+/// An opaque identity for the calling thread/task, stable for its lifetime and distinct between
+/// concurrent ones. Zero is never returned, so a caller can use it as "no thread recorded".
+///
+/// Exists because C++ `thread_local` is NOT usable on the ESP32: the compiler reaches TLS through
+/// the THREADPTR special register, and a FreeRTOS task that was not created with TLS initialised
+/// has THREADPTR = 0 — so the access dereferences a small offset from null (0xfffffff0 was the
+/// measured faulting address) and dies inside the exception handler as a Double exception. This is
+/// the portable seam for "which thread am I", used where per-thread state is genuinely needed.
+uintptr_t currentThreadId() MM_NONBLOCKING;
 uint32_t micros() MM_NONBLOCKING;
 
 // Test-only override: when set to non-zero, millis() returns this value instead
@@ -1165,6 +1175,14 @@ bool parlioWs2812Init(ParlioWs2812Handle& h, const uint16_t* dataPins,
 uint8_t* parlioWs2812Buffer(const ParlioWs2812Handle& h, uint8_t buffer);
 size_t parlioWs2812BufferCapacity(const ParlioWs2812Handle& h);
 
+// The most bytes Parlio can send in ONE transfer — a HARDWARE ceiling, not a heap budget, so it
+// needs no handle and holds before anything is allocated. A caller sizes a frame against it to
+// refuse an impossible configuration up front instead of failing the bus init.
+//
+// 0 means NO BOUND (the dmaBudgetBytes contract), not "zero bytes usable" — it is what a host
+// without Parlio returns, and what a caller reads as "nothing to check against".
+size_t parlioMaxTransferBytes();
+
 // Start the autonomous DMA transfer of buffer `buffer`'s first `bytes`; pair
 // with parlioWs2812Wait on the SAME buffer. No refill deadline once started
 // (single-shot, not the loop-transmission mode Parlio also offers).
diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
index 46bbbf60..d7a54fec 100644
--- a/test/CMakeLists.txt
+++ b/test/CMakeLists.txt
@@ -42,6 +42,9 @@ add_executable(mm_tests
     unit/core/unit_moonlive_fill.cpp
     unit/core/unit_moonlive_compiler.cpp
     unit/core/unit_moonlive_ir.cpp
+    unit/core/unit_moonlive_spill.cpp
+    unit/core/unit_moonlive_codegen_xtensa.cpp
+    unit/core/unit_moonlive_codegen_riscv.cpp
     unit/core/unit_MoonModule.cpp
     unit/core/unit_MoonModule_control_change_gate.cpp
     unit/core/unit_MoonModule_lifecycle.cpp
diff --git a/test/scenarios/light/scenario_MoonLive_pipeline.json b/test/scenarios/light/scenario_MoonLive_pipeline.json
index efe47569..c61d22ee 100644
--- a/test/scenarios/light/scenario_MoonLive_pipeline.json
+++ b/test/scenarios/light/scenario_MoonLive_pipeline.json
@@ -58,7 +58,7 @@
       "observed": {
         "desktop-macos": {
           "tick_us": [
-            5,
+            4,
             16
           ],
           "free_heap": [
@@ -71,7 +71,7 @@
           ],
           "at": [
             "2026-08-09",
-            "2026-08-10"
+            "2026-08-12"
           ]
         }
       }
@@ -96,7 +96,7 @@
       "observed": {
         "desktop-macos": {
           "tick_us": [
-            5,
+            4,
             16
           ],
           "free_heap": [
@@ -109,7 +109,7 @@
           ],
           "at": [
             "2026-08-09",
-            "2026-08-10"
+            "2026-08-13"
           ]
         }
       }
@@ -258,7 +258,7 @@
       "observed": {
         "desktop-macos": {
           "tick_us": [
-            5,
+            4,
             20
           ],
           "free_heap": [
@@ -271,7 +271,7 @@
           ],
           "at": [
             "2026-08-09",
-            "2026-08-10"
+            "2026-08-13"
           ]
         }
       }
@@ -288,7 +288,7 @@
       "observed": {
         "desktop-macos": {
           "tick_us": [
-            5,
+            4,
             35
           ],
           "free_heap": [
@@ -301,7 +301,7 @@
           ],
           "at": [
             "2026-08-09",
-            "2026-08-10"
+            "2026-08-13"
           ]
         }
       }
diff --git a/test/scenarios/light/scenario_peripheral_grid_sweep.json b/test/scenarios/light/scenario_peripheral_grid_sweep.json
index d31cfb64..c7119e46 100644
--- a/test/scenarios/light/scenario_peripheral_grid_sweep.json
+++ b/test/scenarios/light/scenario_peripheral_grid_sweep.json
@@ -389,7 +389,7 @@
         },
         "desktop-macos": {
           "tick_us": [
-            273,
+            271,
             1427
           ],
           "free_heap": [
@@ -402,7 +402,7 @@
           ],
           "at": [
             "2026-07-26",
-            "2026-07-31"
+            "2026-08-13"
           ]
         }
       }
@@ -489,7 +489,7 @@
         "desktop-macos": {
           "tick_us": [
             4,
-            21
+            30
           ],
           "free_heap": [
             0,
@@ -501,7 +501,7 @@
           ],
           "at": [
             "2026-07-26",
-            "2026-07-31"
+            "2026-08-12"
           ]
         }
       }
@@ -567,7 +567,7 @@
         "desktop-macos": {
           "tick_us": [
             17,
-            90
+            121
           ],
           "free_heap": [
             0,
@@ -579,7 +579,7 @@
           ],
           "at": [
             "2026-07-26",
-            "2026-07-31"
+            "2026-08-12"
           ]
         }
       }
@@ -644,7 +644,7 @@
         },
         "desktop-macos": {
           "tick_us": [
-            68,
+            67,
             350
           ],
           "free_heap": [
@@ -657,7 +657,7 @@
           ],
           "at": [
             "2026-07-26",
-            "2026-07-31"
+            "2026-08-13"
           ]
         }
       }
@@ -722,7 +722,7 @@
         },
         "desktop-macos": {
           "tick_us": [
-            271,
+            270,
             1357
           ],
           "free_heap": [
@@ -735,7 +735,7 @@
           ],
           "at": [
             "2026-07-26",
-            "2026-08-06"
+            "2026-08-13"
           ]
         }
       }
@@ -977,7 +977,7 @@
         },
         "desktop-macos": {
           "tick_us": [
-            68,
+            67,
             382
           ],
           "free_heap": [
@@ -990,7 +990,7 @@
           ],
           "at": [
             "2026-07-26",
-            "2026-07-31"
+            "2026-08-13"
           ]
         }
       }
diff --git a/test/unit/core/moonlive_device_codegen.inc b/test/unit/core/moonlive_device_codegen.inc
new file mode 100644
index 00000000..2084acd0
--- /dev/null
+++ b/test/unit/core/moonlive_device_codegen.inc
@@ -0,0 +1,151 @@
+// The checks a DEVICE backend's emitted code must pass, written once and run per ISA.
+//
+// Why this exists: only the host (arm64) backend is ever EXECUTED by tests, so an Xtensa or RISC-V
+// codegen defect used to ship silently and be debugged by flashing a board. That is what happened —
+// a scripted layout reset every S3, and five plausible theories read off the source were each
+// falsified by the device before the disassembler found the real cause. The backends are ordinary
+// C++ behind a target guard, so defining the guard and compiling the sources runs the REAL emitter
+// on the development machine, and a defect becomes a failing test instead of a bench session.
+//
+// ONE TRANSLATION UNIT PER ISA, and this file is the body they share. Two backends cannot live in
+// one TU: they both define `Reg`, `Label` and an assembler class, and the include guards would give
+// the second one the first one's types. Each ISA's .cpp defines MM_ISA_NAME + the target macro,
+// includes its backend and the front end above it, then includes this — so the unqualified
+// `lowerToBytes` inside compileSource resolves to that backend. The firmware build never sees these
+// files, so a device image still holds exactly one backend definition. Same mechanism as
+// moondeck/moonlive/emit_xtensa.cpp, which reads encodings without a flash.
+//
+// Expects, from the including TU: MM_ISA_NAME (a string literal) and the backend + compiler already
+// included in the enclosing namespace.
+
+#include "light/moonlive/MoonLiveBuiltins_light.h"
+
+#include <string>
+
+#include <cstdint>
+#include <vector>
+
+namespace {
+
+// The shipped default layout: a nested loop whose body calls addLight. The script that crashed
+// every S3, so the one worth pinning hardest.
+const char* kGridLayout =
+    "uint8_t cols = 16;  // @control 1..64\n"
+    "uint8_t rows = 16;  // @control 1..64\n"
+    "for (y = 0; y < rows; y = y + 1) {\n"
+    "  for (x = 0; x < cols; x = x + 1) {\n"
+    "    addLight(x, y, 0);\n"
+    "  }\n"
+    "}\n";
+
+// The two shapes an effect takes: straight-line, and a loop over the grid.
+const char* kEffectSimple = "setRGB(0, 255, 0, 0);\n";
+const char* kEffectLoop   = "for (i = 0; i < 64; i = i + 1) { setRGB(i, i, 255 - i, 60); }\n";
+
+/// Compile for THIS TU's backend. `sysvars` picks the binding's vocabulary — they are different
+/// sets, not nested ones: a LAYOUT may use `x`/`y` as loop counters precisely because it is not
+/// handed them, which is what the shipped grid.mlv does.
+std::vector<uint8_t> emitBytes(const char* src, const mm::moonlive::SysVarTable& sysvars, bool& ok) {
+    std::vector<uint8_t> out(mm::moonlive::kCodeCap);
+    auto r = mm::moonlive::compileSource(src, mm::moonlive::lightBuiltins(), sysvars,
+                                         out.data(), out.size(), nullptr, MM_ISA_LOWER);
+    ok = r.ok;
+    out.resize(r.ok ? r.len : 0);
+    return out;
+}
+
+size_t emitLen(const char* src, const mm::moonlive::SysVarTable& sysvars, bool& ok) {
+    return emitBytes(src, sysvars, ok).size();
+}
+
+/// FNV-1a over the emitted bytes — the project's idiom for "did this change".
+///
+/// Only meaningful for a script with NO host call. A `Call` bakes the builtin's ADDRESS into the
+/// instruction stream and ASLR moves that every process, so the bytes of a calling script genuinely
+/// differ run to run and no golden value can pin them. Those scripts are covered by the structural
+/// checks and by their emitted LENGTH instead, which is stable.
+uint32_t emitHash(const char* src, const mm::moonlive::SysVarTable& sysvars, bool& ok) {
+    const auto code = emitBytes(src, sysvars, ok);
+    uint32_t h = 2166136261u;
+    for (uint8_t byte : code) { h ^= byte; h *= 16777619u; }
+    return h;
+}
+
+}  // namespace
+
+// The shipped default layout has to COMPILE for every target. It stopped compiling on Xtensa when
+// the register file shrank to the ten registers the windowed ABI actually leaves free, and a script
+// that is refused reads to a user exactly like one that is broken.
+TEST_CASE("the shipped grid layout compiles for " MM_ISA_NAME) {
+    bool ok = false;
+    CHECK(emitLen(kGridLayout, mm::moonlive::layoutSysVars(), ok) > 0);
+    CHECK(ok);
+}
+
+TEST_CASE("a scripted effect compiles for " MM_ISA_NAME ", straight-line and looped") {
+    bool ok = false;
+    CHECK(emitLen(kEffectSimple, mm::moonlive::effectSysVars(), ok) > 0);
+    CHECK(ok);
+    // A LOOPED effect is the case that did not fit Xtensa's ten registers until call arguments were
+    // staged through the frame: a four-operand setRGB used to need four registers live at once, plus
+    // whatever its operands took to compute, and the allocator ran out. Now only one argument holds
+    // a register at a time.
+    CHECK(emitLen(kEffectLoop, mm::moonlive::effectSysVars(), ok) > 0);
+    CHECK(ok);
+}
+
+// `fill` plus a loop is the one shipped shape that still does not fit the smallest register file.
+// FillElems needs two scratch registers of its own ABOVE the program's, and on Xtensa that leaves
+// eight available where the five fixed ABI vregs plus four reload temps need nine — one short. The
+// scratch is only live INSIDE the fill's own loop, where the script's temps are dead, so it could
+// overlap them; that is a per-backend change and belongs with the lowerer collapse, not here.
+// Pinned so the day it is fixed, this test says so rather than the gap being rediscovered on a bench.
+TEST_CASE("fill plus a loop on " MM_ISA_NAME " emits what it currently can") {
+    bool ok = false;
+    CHECK(emitLen("fill(0,0,0);\nfor (y = 0; y < height; y = y + 1) { setRGB(y, 255, 0, 0); }",
+                  mm::moonlive::effectSysVars(), ok) == MM_GOLD_FILLLOOP_LEN);
+}
+
+// A scripted MODIFIER is the third binding, and the one handed x/y/z.
+TEST_CASE("a scripted modifier compiles for " MM_ISA_NAME) {
+    bool ok = false;
+    CHECK(emitLen("setXYZ(0, x, y, z);\n", mm::moonlive::modifierSysVars(), ok) > 0);
+    CHECK(ok);
+}
+
+// The GOLDEN check: the exact machine code for the shipped scripts.
+//
+// A change DETECTOR, not a correctness claim. It fails on any emission change so the diff gets read
+// deliberately, instead of the change being discovered by flashing a board and watching it reset.
+// When a change is intended, update the constants and say why in the commit.
+//
+// Hashed rather than length-checked: altering a frame offset or a register field changes what
+// EXECUTES without changing how many bytes it takes — which is precisely the defect class this file
+// exists to catch, and a length alone sails straight past it.
+TEST_CASE("the " MM_ISA_NAME " machine code for the shipped scripts is what it was") {
+    bool ok = false;
+    // The grid CALLS addLight, so its bytes carry a host address that moves each process — length
+    // only. The effect is pure inline code, so it is pinned byte for byte.
+    CHECK(emitLen(kGridLayout, mm::moonlive::layoutSysVars(), ok) == MM_GOLD_GRID_LEN);
+    CHECK(emitLen(kEffectSimple, mm::moonlive::effectSysVars(), ok) == MM_GOLD_FX_LEN);
+    CHECK(emitHash(kEffectSimple, mm::moonlive::effectSysVars(), ok) == MM_GOLD_FX_HASH);
+    CHECK(emitLen(kEffectLoop, mm::moonlive::effectSysVars(), ok) == MM_GOLD_FXLOOP_LEN);
+    CHECK(emitHash(kEffectLoop, mm::moonlive::effectSysVars(), ok) == MM_GOLD_FXLOOP_HASH);
+}
+
+// Degrade, never miscompile: a script the backend cannot encode must fail cleanly. The emitters
+// signal that by returning zero bytes, which compileSource turns into a diagnostic — the device
+// then shows the error and keeps rendering, instead of executing whatever the truncation produced.
+TEST_CASE("an unencodable script is refused, not truncated, on " MM_ISA_NAME) {
+    bool ok = true;
+    // A loop nest far past what any label/fixup table holds.
+    std::string deep;
+    for (int i = 0; i < 40; i++) deep += "for (i" + std::to_string(i) + " = 0; i" +
+                                        std::to_string(i) + " < 2; i" + std::to_string(i) +
+                                        " = i" + std::to_string(i) + " + 1) {";
+    deep += "addLight(0, 0, 0);";
+    for (int i = 0; i < 40; i++) deep += "}";
+    const size_t n = emitLen(deep.c_str(), mm::moonlive::layoutSysVars(), ok);
+    CHECK(n == 0);      // refused
+    CHECK_FALSE(ok);    // and said so
+}
diff --git a/test/unit/core/unit_moonlive_codegen_riscv.cpp b/test/unit/core/unit_moonlive_codegen_riscv.cpp
new file mode 100644
index 00000000..613a55e1
--- /dev/null
+++ b/test/unit/core/unit_moonlive_codegen_riscv.cpp
@@ -0,0 +1,53 @@
+// @module MoonLive
+
+// The RISC-V (ESP32-P4) backend's emitted code, checked on the development machine.
+// See moonlive_device_codegen.inc for why this exists and unit_moonlive_codegen_xtensa.cpp for how
+// the target guard is defined so the real emitter runs on this host.
+
+#include "doctest.h"
+
+// System and standard headers FIRST, at global scope. The backend below is wrapped in a namespace,
+// and anything it includes for the first time would otherwise be declared INSIDE that namespace —
+// which under GCC breaks both `std::memcpy` (not found where the backend calls it) and the system
+// `ssize_t` typedef that <cstdio> drags in. Including them here means the namespace only ever wraps
+// OUR code, which is all it is meant to wrap.
+#include <cstdint>
+#include <cstddef>
+#include <cstring>
+#include <cstdio>
+#include <string>
+#include <vector>
+
+
+// The SHARED front end first, at real `mm::moonlive` scope: the backend below drags in the IR
+// headers, and once their include guards are set the compiler header would otherwise resolve its
+// types inside the wrapper namespace instead.
+#include "core/moonlive/MoonLiveCompiler.h"
+#include "core/moonlive/MoonLiveIr.h"
+#include "core/moonlive/moonlive_emit.h"
+#include "core/moonlive/MoonLiveSpill.h"
+
+namespace mm_riscv_backend {
+// The IR, the spill pass and the platform seam are SHARED — one definition each in the binary.
+// Pull them into scope so the backend's unqualified references resolve to those, and only the
+// ISA-specific classes below end up local to this namespace.
+namespace mm { using namespace ::mm; using namespace ::mm::moonlive;
+               namespace moonlive { using namespace ::mm::moonlive;
+                                    using ::mm::moonlive::spillToBudget; } }
+#define __riscv 1
+#include "platform/esp32/moonlive_asm_riscv.h"
+#include "platform/esp32/moonlive_asm_riscv.cpp"
+#include "platform/esp32/moonlive_lower_riscv.cpp"
+#undef __riscv
+}  // namespace mm_riscv_backend
+
+#define MM_ISA_NAME "RISC-V"
+// Golden values, recorded from this backend. See the .inc for what they are and are not.
+#define MM_GOLD_GRID_LEN  352u
+#define MM_GOLD_FX_LEN    112u
+#define MM_GOLD_FILLLOOP_LEN 260u  // RISC-V has the registers; Xtensa does not
+#define MM_GOLD_FXLOOP_LEN  188u
+#define MM_GOLD_FXLOOP_HASH 1889730146u
+#define MM_GOLD_FX_HASH   3823890943u
+#define MM_ISA_LOWER mm_riscv_backend::mm::moonlive::lowerToBytes
+#include "moonlive_device_codegen.inc"
diff --git a/test/unit/core/unit_moonlive_codegen_xtensa.cpp b/test/unit/core/unit_moonlive_codegen_xtensa.cpp
new file mode 100644
index 00000000..a2b04b68
--- /dev/null
+++ b/test/unit/core/unit_moonlive_codegen_xtensa.cpp
@@ -0,0 +1,79 @@
+// @module MoonLive
+
+// The Xtensa (ESP32 classic / S3) backend's emitted code, checked on the development machine.
+// See moonlive_device_codegen.inc for why this exists.
+//
+// The backend is `#if defined(__XTENSA__)`, so on this host it normally compiles to nothing.
+// Defining the macro and compiling the sources here runs the REAL emitter, and compileSource's
+// `lower` seam points the shared front end at it — one function pointer rather than a second copy
+// of the compiler. The firmware build never sees this file, so a device image still holds exactly
+// one backend definition.
+
+#include "doctest.h"
+
+// System and standard headers FIRST, at global scope. The backend below is wrapped in a namespace,
+// and anything it includes for the first time would otherwise be declared INSIDE that namespace —
+// which under GCC breaks both `std::memcpy` (not found where the backend calls it) and the system
+// `ssize_t` typedef that <cstdio> drags in. Including them here means the namespace only ever wraps
+// OUR code, which is all it is meant to wrap.
+#include <cstdint>
+#include <cstddef>
+#include <cstring>
+#include <cstdio>
+#include <string>
+#include <vector>
+
+
+// The SHARED front end first, at real `mm::moonlive` scope: the backend below drags in the IR
+// headers, and once their include guards are set the compiler header would otherwise resolve its
+// types inside the wrapper namespace instead.
+#include "core/moonlive/MoonLiveCompiler.h"
+#include "core/moonlive/MoonLiveIr.h"
+#include "core/moonlive/moonlive_emit.h"
+#include "core/moonlive/MoonLiveSpill.h"
+
+namespace mm_xtensa_backend {
+// The IR, the spill pass and the platform seam are SHARED — one definition each in the binary.
+// Pull them into scope so the backend's unqualified references resolve to those, and only the
+// ISA-specific classes below end up local to this namespace.
+namespace mm { using namespace ::mm; using namespace ::mm::moonlive;
+               namespace moonlive { using namespace ::mm::moonlive;
+                                    using ::mm::moonlive::spillToBudget; } }
+#define __XTENSA__ 1
+#include "platform/esp32/moonlive_asm_xtensa.h"
+#include "platform/esp32/moonlive_asm_xtensa.cpp"
+#include "platform/esp32/moonlive_lower_xtensa.cpp"
+#undef __XTENSA__
+}  // namespace mm_xtensa_backend
+
+#define MM_ISA_NAME "Xtensa"
+// Golden values, recorded from this backend. See the .inc for what they are and are not.
+#define MM_GOLD_GRID_LEN  206u
+#define MM_GOLD_FX_LEN    69u
+#define MM_GOLD_FILLLOOP_LEN 0u    // REFUSED: one register short — see the .inc
+#define MM_GOLD_FXLOOP_LEN  133u
+#define MM_GOLD_FXLOOP_HASH 3881330729u
+#define MM_GOLD_FX_HASH   2547242340u
+#define MM_ISA_LOWER mm_xtensa_backend::mm::moonlive::lowerToBytes
+#include "moonlive_device_codegen.inc"
+
+// A register outside the backend's map is a value written somewhere the program does not own. The
+// map is a2..a11: a12/a13 are call scratch and the store8 address register, and a14/a15 carry this
+// routine's own retw.n return linkage — using those two as general registers corrupted the return
+// path and produced `Guru Meditation (IllegalInstruction)` the moment a scripted layout ran.
+// Asserted against the map itself rather than a copy, so the check cannot drift from its subject.
+TEST_CASE("the Xtensa vreg map names only registers the windowed ABI leaves free") {
+    uint8_t n = 0;
+    const uint8_t* map = mm_xtensa_backend::mm::moonlive::xtRegMap(n);
+    REQUIRE(n > 0);
+    for (uint8_t i = 0; i < n; i++) {
+        INFO("vreg R" << int(i) << " -> a" << int(map[i]));
+        CHECK(map[i] >= 2);
+        CHECK(map[i] <= 11);
+    }
+}
+
+// A change DETECTOR, not a correctness claim: emitted length is a cheap fingerprint that moves
+// whenever codegen does. A failure here means "read the diff and decide", not "you broke it" —
+// update the number and say why in the commit. It exists because the alternative way to notice an
+// emission change was to flash a board and watch it reset.
diff --git a/test/unit/core/unit_moonlive_compiler.cpp b/test/unit/core/unit_moonlive_compiler.cpp
index 1ce3692b..62ad5c4c 100644
--- a/test/unit/core/unit_moonlive_compiler.cpp
+++ b/test/unit/core/unit_moonlive_compiler.cpp
@@ -310,6 +310,29 @@ TEST_CASE("a for loop's condition and step must name the loop variable") {
 #endif
 }
 
+// The op array is sized to the script, so `count` is a uint16_t — and every loop over it has to be
+// one too. A uint8_t counter wrapped at 256 ops and spun forever, which on a device is a watchdog
+// reset from a script that merely got long. Found by bisecting: 60 statements fine, 80 hung.
+TEST_CASE("a long script compiles or refuses, but never spins") {
+    uint8_t out[16384];
+    // A long ARITHMETIC chain, not many statements: each `+ 1` is one cheap op, so this passes 256
+    // IR ops while staying inside the code buffer. Repeated statements hit the code ceiling first
+    // and return before the wrap, which is why they do not pin this.
+    std::string many = "addLight(1";
+    for (int i = 0; i < 200; i++) many += " + 1";
+    many += ", 0, 0);";
+    auto r = moonlive::compileSource(many.c_str(), kTable, kSys, out, sizeof(out));
+    // Either answer is fine — what is NOT fine is never returning, which is what this pins.
+    CHECK((r.ok || std::strlen(r.error) > 0));
+
+    // And the sanity bound still refuses a runaway rather than trying to allocate for it.
+    std::string absurd;
+    for (int i = 0; i < 3000; i++) absurd += "addLight(1, 0, 0);";
+    auto big = moonlive::compileSource(absurd.c_str(), kTable, kSys, out, sizeof(out));
+    CHECK_FALSE(big.ok);
+    CHECK(std::string(big.error) == "script too large");
+}
+
 TEST_CASE("compileSource: malformed control declarations fail with a diagnostic, never crash") {
     uint8_t out[768];
     const char* bad[] = {
diff --git a/test/unit/core/unit_moonlive_spill.cpp b/test/unit/core/unit_moonlive_spill.cpp
new file mode 100644
index 00000000..c01ae72c
--- /dev/null
+++ b/test/unit/core/unit_moonlive_spill.cpp
@@ -0,0 +1,264 @@
+// @module MoonLive
+
+#include "doctest.h"
+#include "core/moonlive/MoonLiveCompiler.h"
+#include "core/moonlive/MoonLiveSpill.h"
+#include "core/moonlive/moonlive_emit.h"
+#include "light/moonlive/MoonLiveBuiltins_light.h"
+#include "platform/platform.h"
+
+#include <cstdint>
+#include <vector>
+
+// MoonLive register allocation — spilling to the call frame (core/moonlive/MoonLiveSpill.cpp).
+//
+// The governing risk is that only the arm64 backend is ever EXECUTED by tests, while the register
+// walls these tests are about are tightest on Xtensa. The answer is the squeezed budget: compiling
+// the same script at the host's real budget and at a deliberately smaller one must render identical
+// pixels — spilling is by definition a change of storage, not of meaning. That turns the hardest
+// algorithm in the compiler from a hardware-only proposition into something a unit test settles.
+
+using namespace mm;
+
+static moonlive::BuiltinTable kT = moonlive::lightBuiltins();
+static moonlive::SysVarTable kSys = moonlive::modifierSysVars();
+
+#if MM_MOONLIVE_HAS_HOST_JIT
+
+namespace {
+
+using CtrlFn = void (*)(uint8_t*, uint32_t, uint8_t, uint32_t, const uint8_t*);
+
+// Compile `src` at `budget` (null = the backend's own) and render it over `nLights` lights.
+// `ok` reports whether the compile succeeded, so a test can assert BOTH that a squeezed budget still
+// compiles and what it produced.
+std::vector<uint8_t> renderAt(const char* src, int nLights, const moonlive::RegBudget* budget,
+                              bool& ok, uint32_t t = 0) {
+    uint8_t code[moonlive::kCodeCap];
+    auto r = moonlive::compileSource(src, kT, kSys, code, sizeof(code), budget);
+    ok = r.ok;
+    std::vector<uint8_t> buf(static_cast<size_t>(nLights) * 3, 0);
+    if (!r.ok) return buf;
+    void* blk = platform::allocExec(r.len);
+    REQUIRE(blk != nullptr);
+    platform::writeExec(blk, code, r.len);
+    uint8_t arena[moonlive::kArenaBytes] = {};
+    for (uint8_t i = 0; i < r.controlCount; i++) arena[r.controls[i].offset] = r.controls[i].def;
+    reinterpret_cast<CtrlFn>(blk)(buf.data(), static_cast<uint32_t>(nLights), 3, t, arena);
+    platform::freeExec(blk, r.len);
+    return buf;
+}
+
+// A budget with FEWER registers than arm64's fourteen, so the allocator is forced to spill on the
+// only backend a test can run. Nine leaves four values allocatable once the five fixed ABI vregs and
+// the four reload temps are taken out — enough for a real script, tight enough that anything
+// interesting overflows. `slots` matches what the host frame can address.
+constexpr moonlive::RegBudget squeezed(uint8_t regs, uint8_t reserved) {
+    return moonlive::RegBudget{regs, reserved, 16};
+}
+
+int litCount(const std::vector<uint8_t>& b) {
+    int n = 0;
+    for (size_t i = 0; i + 2 < b.size(); i += 3) if (b[i] || b[i + 1] || b[i + 2]) n++;
+    return n;
+}
+
+}  // namespace
+
+// THE key test: spilling changes where a value lives, never what the program computes.
+TEST_CASE("a script renders identical pixels at a squeezed register budget as at the full one") {
+    // Enough live values that a nine-register budget cannot hold them all: three independent
+    // colour components plus two loop-carried values.
+    const char* src = "for (i = 0; i < 6; i = i + 1) { setRGB(i, i + 1, i + 2, i + 3); }";
+
+    bool fullOk = false, tightOk = false;
+    auto full = renderAt(src, 8, nullptr, fullOk);
+    const auto tightBudget = squeezed(11, 1);   // 11 regs, StoreElem's one scratch
+    auto tight = renderAt(src, 8, &tightBudget, tightOk);
+
+    CHECK(fullOk);
+    CHECK(tightOk);
+    CHECK(full == tight);
+    CHECK(litCount(full) == 6);       // and it actually did something
+}
+
+// The back-edge case. Naive first-def-to-last-use intervals look dead early in a loop body, so the
+// allocator would hand a counter's register away and the next iteration would read someone else's
+// value — placing lights twice, or not at all. Nested, so the extension has to apply innermost-first.
+TEST_CASE("a nested loop at a squeezed budget places every light exactly once") {
+    const char* src =
+        "for (i = 0; i < 4; i = i + 1) {\n"
+        "  for (j = 0; j < 4; j = j + 1) {\n"
+        "    setRGB(i * 4 + j, 200, 100, 50);\n"
+        "  }\n"
+        "}\n";
+
+    bool fullOk = false, tightOk = false;
+    auto full = renderAt(src, 16, nullptr, fullOk);
+    const auto tightBudget = squeezed(11, 1);
+    auto tight = renderAt(src, 16, &tightBudget, tightOk);
+
+    CHECK(fullOk);
+    CHECK(tightOk);
+    CHECK(full == tight);
+    // every one of the 16 cells written, each exactly once — a counter that lost its register
+    // across the back edge writes the wrong cells, and the count or the colours would differ
+    CHECK(litCount(tight) == 16);
+    for (int i = 0; i < 16; i++) {
+        CHECK(tight[i * 3 + 0] == 200);
+        CHECK(tight[i * 3 + 1] == 100);
+        CHECK(tight[i * 3 + 2] == 50);
+    }
+}
+
+// Slots live in the routine's OWN frame, and call() moves sp underneath it. Addressing a slot from
+// the frame pointer rather than sp is what makes this hold; from sp it would read into the callee's
+// saved registers instead.
+TEST_CASE("a spilled value survives a host call and is still correct afterwards") {
+    // `keep` is defined before the call and used after it, so it must be live ACROSS random16 —
+    // and at a squeezed budget it is one of the values that has nowhere to live but a slot.
+    const char* src =
+        "uint8_t idx = 5; // @control 0..15\n"
+        "for (i = 0; i < 3; i = i + 1) {\n"
+        "  setRGB(idx + i, random16(1) + 111, i + 1, 222);\n"
+        "}\n";
+
+    bool fullOk = false, tightOk = false;
+    auto full = renderAt(src, 16, nullptr, fullOk);
+    const auto tightBudget = squeezed(11, 1);
+    auto tight = renderAt(src, 16, &tightBudget, tightOk);
+
+    CHECK(fullOk);
+    CHECK(tightOk);
+    CHECK(full == tight);
+    CHECK(litCount(tight) == 3);
+    // random16(1) is always 0, so red is exactly 111 — a slot clobbered by the call shows up here
+    for (int i = 0; i < 3; i++) {
+        CHECK(tight[(5 + i) * 3 + 0] == 111);
+        CHECK(tight[(5 + i) * 3 + 1] == i + 1);
+        CHECK(tight[(5 + i) * 3 + 2] == 222);
+    }
+}
+
+// The control arena pointer (kArg4) is a fixed ABI vreg the allocator must never reassign or spill.
+// If it did, a control read after a spill would load from a register holding something else.
+TEST_CASE("a declared control still reads live at a squeezed budget") {
+    const char* src =
+        "uint8_t pos = 0; // @control 0..15\n"
+        "for (i = 0; i < 2; i = i + 1) {\n"
+        "  setRGB(pos + i, 10, 20, 30);\n"
+        "}\n";
+    uint8_t code[moonlive::kCodeCap];
+    const auto tightBudget = squeezed(11, 1);
+    auto r = moonlive::compileSource(src, kT, kSys, code, sizeof(code), &tightBudget);
+    REQUIRE(r.ok);
+    REQUIRE(r.controlCount == 1);
+    void* blk = platform::allocExec(r.len);
+    REQUIRE(blk != nullptr);
+    platform::writeExec(blk, code, r.len);
+    auto fn = reinterpret_cast<CtrlFn>(blk);
+
+    uint8_t arena[moonlive::kArenaBytes] = {};
+    for (uint8_t v : {uint8_t(0), uint8_t(4), uint8_t(9)}) {
+        std::vector<uint8_t> buf(16 * 3, 0);
+        arena[0] = v;
+        fn(buf.data(), 16, 3, 0, arena);
+        CHECK(buf[v * 3 + 0] == 10);            // the control still selects the pixel, live
+        CHECK(buf[(v + 1) * 3 + 0] == 10);
+        CHECK(litCount(buf) == 2);
+    }
+    platform::freeExec(blk, r.len);
+}
+
+#endif  // MM_MOONLIVE_HAS_HOST_JIT
+
+// FAIL, NEVER MISCOMPILE. A budget with no room for the fixed ABI vregs plus the reload temps, and
+// one with no frame slots to spill INTO, must both refuse — silently emitting code that names a
+// register the target does not have is the failure this whole pass exists to make impossible.
+TEST_CASE("an impossible register budget refuses the compile instead of emitting wrong code") {
+    // A script whose live values genuinely exceed the budgets below, so each really does have to
+    // spill and really does have nowhere to put the result.
+    const char* src =
+        "for (i = 0; i < 4; i = i + 1) {\n"
+        "  for (j = 0; j < 4; j = j + 1) {\n"
+        "    setRGB(i * 4 + j, 200, 100, 50);\n"
+        "  }\n"
+        "}\n";
+    uint8_t code[moonlive::kCodeCap];
+    REQUIRE(moonlive::compileSource(src, kT, kSys, code, sizeof(code)).ok);   // it does compile normally
+
+    const moonlive::RegBudget noRoom{9, 1, 16};      // 5 ABI + 4 reload temps already exhaust it
+    CHECK_FALSE(moonlive::compileSource(src, kT, kSys, code, sizeof(code), &noRoom).ok);
+
+    const moonlive::RegBudget noSlots{11, 1, 0};     // room to allocate, nowhere to spill INTO
+    CHECK_FALSE(moonlive::compileSource(src, kT, kSys, code, sizeof(code), &noSlots).ok);
+}
+
+// A program that fits is left byte-identical: the allocator must not exist as far as a non-spilling
+// script is concerned, or every shipped script pays for a feature it never uses.
+TEST_CASE("a program that already fits is untouched by the register allocator") {
+    moonlive::IrProgram ir;
+    REQUIRE(ir.reserve(8));
+    REQUIRE(ir.push({moonlive::IrOp::Const, moonlive::kFirstTemp, 0, 0, 0, 0, 42, nullptr, {}}));
+    REQUIRE(ir.push({moonlive::IrOp::Mov, moonlive::VReg(moonlive::kFirstTemp + 1),
+                     moonlive::kFirstTemp, 0, 0, 0, 0, nullptr, {}}));
+    const uint16_t before = ir.count;
+
+    uint8_t slots = 0xff;
+    CHECK(moonlive::spillToBudget(ir, moonlive::RegBudget{14, 0, 16}, slots));
+    CHECK(slots == 0);                  // nothing spilled
+    CHECK(ir.count == before);          // and not one op inserted
+    CHECK(ir.ops[0].dst == moonlive::kFirstTemp);   // nor renumbered
+}
+
+// Loop extension, pinned on its own — the one part of the allocator no script in this grammar can
+// currently exercise, and the part whose failure is a silent miscompile rather than a refusal.
+//
+// A value defined before a loop and read only EARLY in the body has a naive live range that ends at
+// that read. Every later value then looks free to take its register, and the next iteration reads
+// whatever took it. The IR is built by hand because the wall a script hits first is its own variable
+// count: by the time a source program names enough live values to force allocation, the values are
+// short-lived ones the naive analysis already gets right. Extension is therefore untestable through
+// the front end today, and this is what stands in for it until script-local functions make longer
+// live ranges expressible.
+TEST_CASE("a value live across a loop keeps its storage for the whole loop") {
+    using namespace moonlive;
+    IrProgram ir;
+    REQUIRE(ir.reserve(64));
+    const VReg carried = kFirstTemp;                    // defined before the loop, read early inside
+    const VReg ctr = VReg(kFirstTemp + 1), lim = VReg(kFirstTemp + 2);
+    REQUIRE(ir.push({IrOp::Const, carried, 0, 0, 0, 0, 7, nullptr, {}}));
+    REQUIRE(ir.push({IrOp::Const, ctr, 0, 0, 0, 0, 0, nullptr, {}}));
+    REQUIRE(ir.push({IrOp::Const, lim, 0, 0, 0, 0, 4, nullptr, {}}));
+    REQUIRE(ir.push({IrOp::Label, 0, 0, 0, 0, 0, 0, nullptr, {}}));
+    REQUIRE(ir.push({IrOp::Add, VReg(kFirstTemp + 3), carried, ctr, 0, 0, 0, nullptr, {}}));
+    // A tail of further values, enough that the register file cannot hold them all at once.
+    for (int i = 4; i < 14; i++)
+        REQUIRE(ir.push({IrOp::AddImm, VReg(kFirstTemp + i), VReg(kFirstTemp + 3),
+                         0, 0, 0, i, nullptr, {}}));
+    REQUIRE(ir.push({IrOp::AddImm, ctr, ctr, 0, 0, 0, 1, nullptr, {}}));
+    REQUIRE(ir.push({IrOp::BranchNe, 0, ctr, lim, 0, 0, 0, nullptr, {}}));   // back edge to label 0
+
+    const moonlive::RegBudget budget{14, 1, 16};
+    REQUIRE(ir.vregsUsed > budget.allocatable());       // the program really does not fit
+    uint8_t slots = 0;
+    REQUIRE(spillToBudget(ir, budget, slots));
+
+    // Nineteen values cannot occupy fourteen registers, so SOMETHING has to reach the frame. Without
+    // extension every interval ends at its early read, the allocator concludes the program fits, and
+    // it spills nothing at all — the exact wrong answer this asserts against.
+    CHECK(slots > 0);
+
+    // And the decisive property, whatever the allocator chose: no op may name a register the target
+    // does not have. This is the invariant the whole pass exists to guarantee.
+    for (uint16_t i = 0; i < ir.count; i++) {
+        const auto& in = ir.ops[i];
+        const bool slotRef = in.op == IrOp::Spill || in.op == IrOp::Reload;
+        CHECK(in.dst < budget.allocatable());
+        if (!slotRef) {
+            CHECK(in.a < budget.allocatable());
+            CHECK(in.b < budget.allocatable());
+        }
+        if (slotRef) CHECK(in.imm < slots);             // and every slot is one the prologue reserves
+    }
+}
diff --git a/test/unit/light/MoonLiveScriptFixture.h b/test/unit/light/MoonLiveScriptFixture.h
new file mode 100644
index 00000000..e618c402
--- /dev/null
+++ b/test/unit/light/MoonLiveScriptFixture.h
@@ -0,0 +1,62 @@
+#pragma once
+
+#include "doctest.h"
+#include "light/moonlive/MoonLiveScriptFile.h"
+#include "platform/platform.h"
+
+#include <atomic>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <mutex>
+#include <string>
+#include <vector>
+
+/// Put a script on the filesystem and return its NAME.
+///
+/// A scripted module holds a file name now, not the text — so a test that wants to compile
+/// something has to write the file first, which is the same path the UI takes when it saves an
+/// edit. Testing through the file is the point: it exercises what actually ships, rather than a
+/// text-only path production never uses.
+///
+/// Each call gets a fresh name, so tests that compile several scripts do not collide.
+/// Returns a name valid for the caller's thread until its next call. THREAD-LOCAL, not static: the
+/// concurrency test compiles scripts from two threads at once, and a shared counter and buffer would
+/// hand both threads the same name — each would then compile the other's script.
+/// Every script this fixture wrote, removed when the test process exits.
+///
+/// The scripts go in the SAME directory a real install keeps its scripts in — that is what makes the
+/// test meaningful — so leaving them behind drops a hundred `t*.mlv` files among the user's own, and
+/// the next run adds another hundred. Deleting each file at the end of its test would be wrong: a
+/// test compiles the script and then re-reads it through the module, so the file has to outlive the
+/// call. Process exit is the first moment they are all certainly finished with.
+inline std::vector<std::string>& mmScriptRegistry() {
+    static std::vector<std::string> paths;
+    static const bool once = [] {
+        std::atexit([] {
+            for (const auto& p : mmScriptRegistry()) mm::platform::fsRemove(p.c_str());
+        });
+        return true;
+    }();
+    (void)once;
+    return paths;
+}
+
+inline const char* mmWriteScript(const char* text) {
+    static std::atomic<int> counter{0};
+    thread_local char name[32];
+    std::snprintf(name, sizeof(name), "t%d.mlv", ++counter);
+
+    char path[96];
+    std::snprintf(path, sizeof(path), "%s/%s", mm::moonlive::kScriptDir, name);
+    mm::platform::fsMkdir(mm::moonlive::kScriptDir);
+    REQUIRE(mm::platform::fsWriteAtomic(path, text, std::strlen(text)));
+    {
+        // The concurrency test writes from two threads, so the shared registry needs a lock even
+        // though each thread's NAME is its own.
+        static std::mutex m;
+        std::lock_guard<std::mutex> lock(m);
+        mmScriptRegistry().emplace_back(path);
+    }
+    return name;
+}
diff --git a/test/unit/light/unit_MoonLiveLayout.cpp b/test/unit/light/unit_MoonLiveLayout.cpp
index 907f8350..b543c7dd 100644
--- a/test/unit/light/unit_MoonLiveLayout.cpp
+++ b/test/unit/light/unit_MoonLiveLayout.cpp
@@ -11,6 +11,7 @@
 // broken script leaves an empty fixture rather than taking the pipeline down.
 
 #include "doctest.h"
+#include "MoonLiveScriptFixture.h"
 #include "light/moonlive/MoonLiveLayout.h"
 #include "light/moonlive/MoonLiveBuiltins_light.h"
 #include "platform/platform.h"
@@ -38,7 +39,7 @@ namespace {
 std::vector<Coord3D> place(const char* script) {
     MoonLiveLayout l;
     l.defineControls();
-    if (script) l.setSource(script);
+    if (script) l.setScript(mmWriteScript(script));
     l.prepare();
 
     std::vector<Coord3D> out;
@@ -71,10 +72,10 @@ TEST_CASE("the light count is known before any coordinate is asked for") {
     // forEachCoord. A count that came from the walk would arrive too late to be useful.
     MoonLiveLayout l;
     l.defineControls();
-    l.setSource("uint8_t cols = 5;  // @control 1..64\n"
+    l.setScript(mmWriteScript("uint8_t cols = 5;  // @control 1..64\n"
                 "uint8_t rows = 3; // @control 1..64\n"
                 "for (yy = 0; yy < rows; yy = yy + 1) {"
-                "  for (xx = 0; xx < cols; xx = xx + 1) { addLight(xx, yy, 0); } }");
+                "  for (xx = 0; xx < cols; xx = xx + 1) { addLight(xx, yy, 0); } }"));
     l.prepare();
     CHECK(l.lightCount() == 15);           // answered without anyone calling forEachCoord
 }
@@ -83,7 +84,7 @@ TEST_CASE("the count and the coordinates always agree, because one script produc
     // The property SphereLayout names: count and emit run the same code, so they cannot drift.
     MoonLiveLayout l;
     l.defineControls();
-    l.setSource("for (i = 0; i < 7; i = i + 1) { addLight(i, 0, 0); }");
+    l.setScript(mmWriteScript("for (i = 0; i < 7; i = i + 1) { addLight(i, 0, 0); }"));
     l.prepare();
 
     std::vector<Coord3D> seen;
@@ -99,7 +100,7 @@ TEST_CASE("a scripted layout allocates nothing, like every other layout") {
     // have. The script calls out per light instead, so the only heap here is the compiled program.
     MoonLiveLayout l;
     l.defineControls();
-    l.setSource("for (i = 0; i < 4096; i = i + 1) { addLight(i, 0, 0); }");
+    l.setScript(mmWriteScript("for (i = 0; i < 4096; i = i + 1) { addLight(i, 0, 0); }"));
     l.prepare();
     CHECK(l.lightCount() == 4096);
     // dynamicBytes is the JIT'd program only — no coordinate storage grows with the light count.
@@ -129,7 +130,7 @@ TEST_CASE("a broken script leaves an empty fixture rather than taking the pipeli
     // fixture reports no lights, the module carries the diagnostic, and the device keeps running.
     MoonLiveLayout l;
     l.defineControls();
-    l.setSource("for (i = 0; i < 4; i = i + 1) { addLight(i, i");   // unclosed
+    l.setScript(mmWriteScript("for (i = 0; i < 4; i = i + 1) { addLight(i, i"));   // unclosed
     l.prepare();
     CHECK(l.lightCount() == 0);
     CHECK(l.severity() == MoonModule::Severity::Error);
@@ -139,11 +140,11 @@ TEST_CASE("editing the script changes the fixture") {
     // The live-edit loop: the same module, a new script, a different physical shape.
     MoonLiveLayout l;
     l.defineControls();
-    l.setSource("for (i = 0; i < 4; i = i + 1) { addLight(i, 0, 0); }");
+    l.setScript(mmWriteScript("for (i = 0; i < 4; i = i + 1) { addLight(i, 0, 0); }"));
     l.prepare();
     CHECK(l.lightCount() == 4);
 
-    l.setSource("for (i = 0; i < 2; i = i + 1) { addLight(i, 0, 0); }");
+    l.setScript(mmWriteScript("for (i = 0; i < 2; i = i + 1) { addLight(i, 0, 0); }"));
     l.prepare();
     CHECK(l.lightCount() == 2);
 }
@@ -173,7 +174,7 @@ TEST_CASE("the scripts the documentation shows all compile") {
     for (const char* s : fromDocs) {
         MoonLiveLayout l;
         l.defineControls();
-        l.setSource(s);
+        l.setScript(mmWriteScript(s));
         l.prepare();
         INFO("script: " << s);
         CHECK(l.severity() != MoonModule::Severity::Error);
@@ -188,7 +189,7 @@ TEST_CASE("the scripts the documentation shows all compile") {
 TEST_CASE("a layout answers count and coordinates every time it is asked") {
     MoonLiveLayout l;
     l.defineControls();
-    l.setSource("for (i = 0; i < 6; i = i + 1) { addLight(i, 0, 0); }");
+    l.setScript(mmWriteScript("for (i = 0; i < 6; i = i + 1) { addLight(i, 0, 0); }"));
     l.prepare();
 
     CHECK(l.lightCount() == 6);
@@ -219,7 +220,7 @@ TEST_CASE("a subtraction feeding a loop bound produces the whole value") {
     MoonLiveLayout l;
     l.defineControls();
     // 10 - 4 must be 6 lights. A widened -1 makes the bound enormous and the count is not 6.
-    l.setSource("for (i = 0; i < 10 - 4; i = i + 1) { addLight(i, 0, 0); }");
+    l.setScript(mmWriteScript("for (i = 0; i < 10 - 4; i = i + 1) { addLight(i, 0, 0); }"));
     l.prepare();
     CHECK(l.lightCount() == 6);
 
@@ -243,22 +244,22 @@ TEST_CASE("a subtraction feeding a loop bound produces the whole value") {
 TEST_CASE("a scripted control keeps its live value when the script is edited") {
     MoonLiveLayout l;
     l.defineControls();
-    l.setSource("uint8_t cols = 16; // @control 1..64\n"
-                "for (i = 0; i < cols; i = i + 1) { addLight(i, 0, 0); }");
+    l.setScript(mmWriteScript("uint8_t cols = 16; // @control 1..64\n"
+                "for (i = 0; i < cols; i = i + 1) { addLight(i, 0, 0); }"));
     l.prepare();
     CHECK(l.lightCount() == 16);
 
     // A second script declaring cols at the same offset inherits the live 16, not its own 8.
-    l.setSource("uint8_t cols = 8; // @control 1..64\n"
-                "for (i = 0; i < cols; i = i + 1) { addLight(i, 1, 0); }");
+    l.setScript(mmWriteScript("uint8_t cols = 8; // @control 1..64\n"
+                "for (i = 0; i < cols; i = i + 1) { addLight(i, 1, 0); }"));
     l.prepare();
     CHECK(l.lightCount() == 16);
 
     // A script whose first control is a NEW slot gets its own initialiser: nothing to inherit.
-    l.setSource("uint8_t cols = 16;  // @control 1..64\n"
+    l.setScript(mmWriteScript("uint8_t cols = 16;  // @control 1..64\n"
                 "uint8_t rows = 3;  // @control 1..64\n"
                 "for (yy = 0; yy < rows; yy = yy + 1) {"
-                "  for (xx = 0; xx < cols; xx = xx + 1) { addLight(xx, yy, 0); } }");
+                "  for (xx = 0; xx < cols; xx = xx + 1) { addLight(xx, yy, 0); } }"));
     l.prepare();
     CHECK(l.lightCount() == 48);          // 16 inherited, rows 3 its own
 }
@@ -293,7 +294,7 @@ TEST_CASE("a loop counter survives the body that uses it") {
     SUBCASE("through a call — addLight") {
         MoonLiveLayout l;
         l.defineControls();
-        l.setSource("for (i = 0; i < 6; i = i + 1) { addLight(i, i, 0); }");
+        l.setScript(mmWriteScript("for (i = 0; i < 6; i = i + 1) { addLight(i, i, 0); }"));
         l.prepare();
         CHECK(l.lightCount() == 6);      // a clobbered counter gives some other number
     }
@@ -327,7 +328,7 @@ TEST_CASE("a loop counter survives the body that uses it") {
 TEST_CASE("a stray character in a for header is rejected, not spun on") {
     MoonLiveLayout l;
     l.defineControls();
-    l.setSource("for (i = 0; i < 4; i = i @ 1) { addLight(i, 0, 0); }");
+    l.setScript(mmWriteScript("for (i = 0; i < 4; i = i @ 1) { addLight(i, 0, 0); }"));
     l.prepare();                                    // must return — a hang fails by timeout
     CHECK(l.severity() == MoonModule::Severity::Error);
     CHECK(l.lightCount() == 0);
@@ -346,7 +347,7 @@ TEST_CASE("two threads can run scripts at once without stealing each other's sin
         l.defineControls();
         char src[128];
         std::snprintf(src, sizeof(src), "for (i = 0; i < %d; i = i + 1) { addLight(i, 0, 0); }", cols);
-        l.setSource(src);
+        l.setScript(mmWriteScript(src));
         l.prepare();
         for (int r = 0; r < reps; r++)
             if (l.lightCount() != static_cast<nrOfLightsType>(cols)) return false;
@@ -369,15 +370,15 @@ TEST_CASE("two threads can run scripts at once without stealing each other's sin
 TEST_CASE("a scripted layout reports every heap byte it holds, compiled or not") {
     MoonLiveLayout l;
     l.defineControls();
-    l.setSource("uint8_t cols = 4; // @control 1..64\n"
-                "for (i = 0; i < cols; i = i + 1) { addLight(i, 0, 0); }");
+    l.setScript(mmWriteScript("uint8_t cols = 4; // @control 1..64\n"
+                "for (i = 0; i < cols; i = i + 1) { addLight(i, 0, 0); }"));
     l.prepare();
     const size_t compiled = l.dynamicBytes();
     CHECK(compiled > 0);
     CHECK(l.lightCount() == 4);
 
     // A broken script frees the code but keeps the arena, so the figure drops without reaching zero.
-    l.setSource("for (i = 0; i < 4; i = i + 1) { addLight(i, i");   // unclosed
+    l.setScript(mmWriteScript("for (i = 0; i < 4; i = i + 1) { addLight(i, i"));   // unclosed
     l.prepare();
     CHECK(l.severity() == MoonModule::Severity::Error);
     CHECK(l.dynamicBytes() < compiled);      // the code block is gone
@@ -395,9 +396,12 @@ TEST_CASE("a scripted layout reports every heap byte it holds, compiled or not")
 TEST_CASE("a layout that changes size mid-build cannot overrun the mapping") {
     MoonLiveLayout layout;
     layout.defineControls();
-    layout.setSource("uint8_t cols = 4; // @control 1..64\n"
-                     "for (i = 0; i < cols; i = i + 1) { addLight(i, 0, 0); }");
+    layout.setScript(mmWriteScript("uint8_t cols = 4; // @control 1..64\n"
+                     "for (i = 0; i < cols; i = i + 1) { addLight(i, 0, 0); }"));
     layout.prepare();
+    // The script's own controls (`cols`) exist only once it has COMPILED, and a module starts with
+    // no script now — so the control list has to be rebuilt after prepare() for setWidth to find it.
+    layout.rebuildControls();
 
     mm::Layouts group;
     group.addChild(&layout);
@@ -428,3 +432,106 @@ TEST_CASE("a layout that changes size mid-build cannot overrun the mapping") {
 }
 
 #endif  // MM_MOONLIVE_HAS_HOST_JIT
+
+// A control write lands directly in the module's buffer — addText binds it — so setScript() is NOT
+// called. Nothing then cleared the compiled-hash, and compile()'s early-return kept the OLD program
+// running under the new name. Found by review; the same class of bug hardware found in the effect.
+TEST_CASE("naming a different script through the control actually swaps the program") {
+    MoonLiveLayout l;
+    l.defineControls();
+    const char* four = mmWriteScript("for (i = 0; i < 4; i = i + 1) { addLight(i, 0, 0); }");
+    l.setScript(four);
+    l.prepare();
+    REQUIRE(l.lightCount() == 4);
+
+    // Write the OTHER script the way the API does: straight into the bound control buffer.
+    const char* nine = mmWriteScript("for (i = 0; i < 9; i = i + 1) { addLight(i, 0, 0); }");
+    const auto& cs = l.controls();
+    for (uint8_t i = 0; i < cs.count(); i++)
+        if (cs[i].name && std::strcmp(cs[i].name, "script") == 0)
+            std::snprintf(static_cast<char*>(cs[i].ptr), 32, "%s", nine);
+    l.onControlChanged("script");
+    l.prepare();
+    CHECK(l.lightCount() == 9);      // the new file, not the cached program
+}
+
+// A layout that cannot compile must stay quiet, not keep trying.
+//
+// The pipeline asks a layout for its size and then walks it, and BOTH ask it to compile first — so a
+// failure that leaves "nothing is compiled" looks exactly like "not compiled yet" and every ask
+// re-reads the file. On an ESP32 one attempt is two LittleFS operations (~5 ms), and the repeated
+// asks during a single rebuild starved the task until the 12-second watchdog reset the board: a
+// missing script took the whole device down rather than showing an error. The behaviour to pin is
+// that a failed layout still places no lights however many times it is asked, and says so.
+TEST_CASE("a layout whose script is missing reports it without retrying forever") {
+    MoonLiveLayout l;
+    l.defineControls();
+    l.setScript("definitely-not-there.mlv");
+    l.prepare();
+    CHECK(l.severity() == MoonModule::Severity::Error);
+    // Every ask the pipeline could make, several times over. Each one used to re-read the file.
+    int placed = 0;
+    CoordSink sink{[](void* ctx, nrOfLightsType, lengthType, lengthType, lengthType) {
+        (*static_cast<int*>(ctx))++;
+    }, nullptr, &placed};
+    for (int i = 0; i < 50; i++) {
+        CHECK(l.lightCount() == 0);
+        l.forEachCoord(sink);
+    }
+    CHECK(placed == 0);
+    CHECK(l.severity() == MoonModule::Severity::Error);   // and it still says what is wrong
+
+    // A working script after a failed one must still compile — the give-up is per script name, not
+    // permanent, or fixing a typo would need a reboot.
+    const char* good = "for (i = 0; i < 5; i = i + 1) { addLight(i, 0, 0); }";
+    l.setScript(mmWriteScript(good));
+    l.prepare();
+    CHECK(l.lightCount() == 5);
+}
+
+// A layout that starts with NO script must still compile the first real one it is given.
+//
+// Every device boots a fresh layout card with an empty script control, so the very first compile
+// always fails with "no script — set the script name". When the give-up flag was a bare bool that
+// failure latched, and the card then reported "no script" forever however many valid names were set
+// afterwards: the render loop asks for the light count long before a control write can clear a flag,
+// so the guard re-armed itself on every tick. Bench-caught on an S3 — the host never saw it because
+// a test constructs a fresh layout per case and never boots one empty.
+TEST_CASE("a layout that starts empty still compiles the first script it is given") {
+    MoonLiveLayout l;
+    l.defineControls();
+    l.prepare();                                  // the empty-script boot: fails, as it should
+    CHECK(l.severity() == MoonModule::Severity::Error);
+    CHECK(l.lightCount() == 0);
+
+    // The RENDER LOOP keeps asking while no script is set — this is the step that re-armed the
+    // flag on device and that a straight prepare/setScript sequence never reproduces.
+    for (int i = 0; i < 5; i++) CHECK(l.lightCount() == 0);
+
+    // Write the control the way the UI does — straight into the bound buffer, then
+    // onControlChanged — because addText binds `script_` directly and setScript() is NOT called on
+    // that path. That is exactly how a device sets a script, and where the latch survived.
+    const char* name = mmWriteScript("for (i = 0; i < 6; i = i + 1) { addLight(i, 0, 0); }");
+    auto& cs = l.controls();
+    for (uint8_t i = 0; i < cs.count(); i++)
+        if (cs[i].name && std::strcmp(cs[i].name, "script") == 0)
+            std::snprintf(static_cast<char*>(cs[i].ptr), 32, "%s", name);
+    l.onControlChanged("script");
+    l.prepare();
+    CHECK(l.lightCount() == 6);                   // the give-up must not have latched
+}
+
+// The fixed script directory is a boundary: a module names a file inside it, and cannot address the
+// filesystem. Without this, a control value of "../.config/NetworkModule.json" reads the device's
+// saved WiFi credentials as if they were a script.
+TEST_CASE("a script name cannot escape the script folder") {
+    MoonLiveLayout l;
+    l.defineControls();
+    for (const char* bad : {"../.config/NetworkModule.json", "..", "sub/dir.mlv", "grid.txt"}) {
+        INFO(bad);
+        l.setScript(bad);
+        l.prepare();
+        CHECK(l.severity() == MoonModule::Severity::Error);
+        CHECK(l.lightCount() == 0);
+    }
+}
diff --git a/test/unit/light/unit_MoonLiveModifier.cpp b/test/unit/light/unit_MoonLiveModifier.cpp
index 263a2761..b9eb3297 100644
--- a/test/unit/light/unit_MoonLiveModifier.cpp
+++ b/test/unit/light/unit_MoonLiveModifier.cpp
@@ -8,6 +8,7 @@
 // broken script degrades to a pass-through instead of taking the pipeline down.
 
 #include "doctest.h"
+#include "MoonLiveScriptFixture.h"
 #include "light/moonlive/MoonLiveModifier.h"
 #include "light/moonlive/MoonLiveEffect.h"
 #include "platform/platform.h"
@@ -34,7 +35,7 @@ Coord3D transform(const char* script, lengthType x, lengthType y, lengthType z,
                   lengthType w = 255, lengthType h = 255, lengthType d = 1) {
     MoonLiveModifier m;
     m.defineControls();
-    if (script) m.setSource(script);
+    if (script) m.setScript(mmWriteScript(script));
     m.prepare();
     Coord3D box{w, h, d};
     m.modifyLogicalSize(box);      // the Layer always does this before folding
@@ -47,7 +48,7 @@ Coord3D transform(const char* script, lengthType x, lengthType y, lengthType z,
 TEST_CASE("a scripted modifier mirrors the pattern, the way a hand-written one would") {
     // The default script. A mirror is the shape that makes a working binding obvious on a bench
     // strand — the pattern simply runs the other way.
-    const Coord3D p = transform(nullptr, 10, 20, 0);
+    const Coord3D p = transform("setXYZ(0, width - 1 - x, y, z);", 10, 20, 0);
     CHECK(p.x == 244);          // width(255) - 1 - 10
     CHECK(p.y == 20);           // untouched axes stay put
     CHECK(p.z == 0);
@@ -84,7 +85,7 @@ TEST_CASE("a broken script leaves the pattern alone rather than taking the layer
     // the pipeline keeps rendering.
     MoonLiveModifier m;
     m.defineControls();
-    m.setSource("setXYZ(0, x, y");     // no closing paren, no semicolon
+    m.setScript(mmWriteScript("setXYZ(0, x, y"));     // no closing paren, no semicolon
     m.prepare();
     Coord3D box{255, 255, 1};
     m.modifyLogicalSize(box);
@@ -109,15 +110,16 @@ TEST_CASE("editing the script changes the transform without a rebuild of the fir
     // The live-edit loop: the same module, a new script, a different mapping.
     MoonLiveModifier m;
     m.defineControls();
+    m.setScript(mmWriteScript("setXYZ(0, width - 1 - x, y, z);"));
     m.prepare();
     Coord3D box{255, 255, 1};
     m.modifyLogicalSize(box);      // the Layer hands every modifier its box before folding
 
     Coord3D a{10, 20, 0};
     m.modifyLogical(a);
-    CHECK(a.x == 244);                                 // the default mirror
+    CHECK(a.x == 244);                                 // the mirror
 
-    m.setSource("setXYZ(0, x, y, z);");
+    m.setScript(mmWriteScript("setXYZ(0, x, y, z);"));
     m.prepare();
 
     Coord3D b{10, 20, 0};
@@ -163,7 +165,7 @@ TEST_CASE("folding a wall's worth of lights compiles the script once, not once p
     // an unchanged value across the whole fold proves no compile happened inside it.
     MoonLiveModifier m;
     m.defineControls();
-    m.setSource("setXYZ(0, width - 1 - x, y, z);");
+    m.setScript(mmWriteScript("setXYZ(0, width - 1 - x, y, z);"));
     m.prepare();
     Coord3D box{255, 255, 1};
     m.modifyLogicalSize(box);
@@ -186,12 +188,12 @@ TEST_CASE("folding a wall's worth of lights compiles the script once, not once p
 TEST_CASE("editing a script asks the layer to rebuild its mapping") {
     MoonLiveModifier m;
     m.defineControls();
-    m.setSource("setXYZ(0, x, y, z);");
+    m.setScript(mmWriteScript("setXYZ(0, x, y, z);"));
     m.prepare();
     CHECK(m.consumeNeedsRebuild() == true);     // the first compile needs one too
     CHECK(m.consumeNeedsRebuild() == false);    // and it is consumed, not sticky
 
-    m.setSource("setXYZ(0, 7 - x, y, z);");
+    m.setScript(mmWriteScript("setXYZ(0, 7 - x, y, z);"));
     m.prepare();
     CHECK(m.consumeNeedsRebuild() == true);     // an edit asks again
 
@@ -207,13 +209,13 @@ TEST_CASE("editing a script asks the layer to rebuild its mapping") {
 // be able to read the EXTENT it is folding within, and the default has to use it.
 TEST_CASE("the default script mirrors within the grid it is given, not a fixed 255") {
     // A 16-wide grid: x=0 must land on the far end of THAT grid, 15 — not 245.
-    const Coord3D p = transform(nullptr, 0, 0, 0, /*w=*/16, /*h=*/16, /*d=*/1);
+    const Coord3D p = transform("setXYZ(0, width - 1 - x, y, z);", 0, 0, 0, /*w=*/16, /*h=*/16, /*d=*/1);
     CHECK(p.x == 15);
     CHECK(p.y == 0);
 
     // Every coordinate has to stay inside the box, or the Layer discards it.
     for (lengthType i = 0; i < 16; i++) {
-        const Coord3D q = transform(nullptr, i, 0, 0, 16, 16, 1);
+        const Coord3D q = transform("setXYZ(0, width - 1 - x, y, z);", i, 0, 0, 16, 16, 1);
         CAPTURE(i);
         CHECK(q.x >= 0);
         CHECK(q.x < 16);
@@ -240,7 +242,7 @@ TEST_CASE("a script that computes a position outside the grid leaves lights mapp
     // bytes cannot fail: draw::fill writes every byte itself, whatever the fold decided.
     MoonLiveModifier m;
     m.defineControls();
-    m.setSource("setXYZ(0, x + 200, y, z);");   // deliberately off the end of a 16-wide grid
+    m.setScript(mmWriteScript("setXYZ(0, x + 200, y, z);"));   // deliberately off the end of a 16-wide grid
     m.prepare();
     Coord3D box{16, 16, 1};
     m.modifyLogicalSize(box);
@@ -273,6 +275,10 @@ TEST_CASE("a script that computes a position outside the grid leaves lights mapp
 TEST_CASE("re-preparing with an unchanged script does not ask for another rebuild") {
     MoonLiveModifier m;
     m.defineControls();
+    // A module with no script compiles nothing and therefore asks for nothing — the rebuild request
+    // exists to APPLY a new transform, and there is none. Name one, so the first prepare has
+    // something to compile and the "unchanged" case below is the real question.
+    m.setScript(mmWriteScript("setXYZ(0, width - 1 - x, y, z);"));
     m.prepare();
     CHECK(m.consumeNeedsRebuild() == true);    // the first compile needs one
 
@@ -284,7 +290,7 @@ TEST_CASE("re-preparing with an unchanged script does not ask for another rebuil
     CHECK(m.consumeNeedsRebuild() == false);
 
     // A real edit still asks.
-    m.setSource("setXYZ(0, y, x, z);");
+    m.setScript(mmWriteScript("setXYZ(0, y, x, z);"));
     m.prepare();
     CHECK(m.consumeNeedsRebuild() == true);
 }
@@ -329,7 +335,7 @@ TEST_CASE("a subtraction produces the whole value, not just its low byte") {
 TEST_CASE("a for loop runs its body once per step") {
     MoonLiveModifier m;
     m.defineControls();
-    m.setSource("for (i = 0; i < 4; i = i + 1) { print(i); } setXYZ(0, x, y, z);");
+    m.setScript(mmWriteScript("for (i = 0; i < 4; i = i + 1) { print(i); } setXYZ(0, x, y, z);"));
     m.prepare();
     CHECK(m.severity() != MoonModule::Severity::Error);   // it compiles at all
     Coord3D box{16, 16, 1}; m.modifyLogicalSize(box);
@@ -342,7 +348,7 @@ TEST_CASE("a loop over an empty range runs its body no times") {
     // The entry guard: `i < 0` must skip the body entirely rather than wrap and run forever.
     MoonLiveModifier m;
     m.defineControls();
-    m.setSource("for (i = 0; i < 0; i = i + 1) { print(99); } setXYZ(0, x, y, z);");
+    m.setScript(mmWriteScript("for (i = 0; i < 0; i = i + 1) { print(99); } setXYZ(0, x, y, z);"));
     m.prepare();
     CHECK(m.severity() != MoonModule::Severity::Error);
     Coord3D box{16, 16, 1}; m.modifyLogicalSize(box);
@@ -354,8 +360,8 @@ TEST_CASE("a loop over an empty range runs its body no times") {
 TEST_CASE("loops nest, which is what placing a grid of lights needs") {
     MoonLiveModifier m;
     m.defineControls();
-    m.setSource("for (a = 0; a < 2; a = a + 1) { for (b = 0; b < 2; b = b + 1) { print(a); } }"
-                " setXYZ(0, x, y, z);");
+    m.setScript(mmWriteScript("for (a = 0; a < 2; a = a + 1) { for (b = 0; b < 2; b = b + 1) { print(a); } }"
+                " setXYZ(0, x, y, z);"));
     m.prepare();
     CHECK(m.severity() != MoonModule::Severity::Error);
     Coord3D box{16, 16, 1}; m.modifyLogicalSize(box);
@@ -379,7 +385,7 @@ TEST_CASE("a loop in an effect script paints every light it walks") {
     layer.setChannelsPerLight(3);
     auto* fx = new MoonLiveEffect();
     fx->defineControls();
-    fx->setSource("for (i = 0; i < 8; i = i + 1) { setRGB(i, i, 0, 0); }");
+    fx->setScript(mmWriteScript("for (i = 0; i < 8; i = i + 1) { setRGB(i, i, 0, 0); }"));
     layer.addChild(fx);
     layouts.applyState();
     layer.applyState();