diff --git a/Cargo.lock b/Cargo.lock
index 8375271b12f..b9991ae7207 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -67,9 +67,9 @@ checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
 
 [[package]]
 name = "cc"
-version = "1.2.53"
+version = "1.2.54"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "755d2fce177175ffca841e9a06afdb2c4ab0f593d53b4dee48147dfaade85932"
+checksum = "6354c81bbfd62d9cfa9cb3c773c2b7b2a3a482d569de977fd0e961f6e7c00583"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -125,18 +125,18 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.54"
+version = "4.5.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6e6ff9dcd79cff5cd969a17a545d79e84ab086e444102a591e288a8aa3ce394"
+checksum = "3e34525d5bbbd55da2bb745d34b36121baac88d07619a9a09cfcf4a6c0832785"
 dependencies = [
  "clap_builder",
 ]
 
 [[package]]
 name = "clap_builder"
-version = "4.5.54"
+version = "4.5.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa42cf4d2b7a41bc8f663a7cab4031ebafa1bf3875705bfaf8466dc60ab52c00"
+checksum = "59a20016a20a3da95bef50ec7238dbd09baeef4311dcdd38ec15aba69812fb61"
 dependencies = [
  "anstyle",
  "clap_lex",
@@ -348,6 +348,14 @@ version = "0.4.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
 
+[[package]]
+name = "lsh"
+version = "0.0.0"
+dependencies = [
+ "regex-syntax",
+ "stdext",
+]
+
 [[package]]
 name = "memchr"
 version = "2.7.6"
@@ -427,18 +435,18 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.105"
+version = "1.0.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "535d180e0ecab6268a3e718bb9fd44db66bbbc256257165fc699dadf70d16fe7"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.43"
+version = "1.0.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc74d9a594b72ae6656596548f56f667211f8a97b3d4c3d467150794690dc40a"
+checksum = "21b2ebcf727b7760c461f091f9f0f539b77b8e87f2fd88131e7f1b433b3cece4"
 dependencies = [
  "proc-macro2",
 ]
@@ -813,9 +821,9 @@ dependencies = [
 
 [[package]]
 name = "winresource"
-version = "0.1.29"
+version = "0.1.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17cdfa8da4b111045a5e47c7c839e6c5e11c942de1309bc624393ed5d87f89c6"
+checksum = "e287ced0f21cd11f4035fe946fd3af145f068d1acb708afd248100f89ec7432d"
 dependencies = [
  "version_check",
 ]
@@ -828,18 +836,18 @@ checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
 
 [[package]]
 name = "zerocopy"
-version = "0.8.33"
+version = "0.8.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "668f5168d10b9ee831de31933dc111a459c97ec93225beb307aed970d1372dfd"
+checksum = "71ddd76bcebeed25db614f82bf31a9f4222d3fbba300e6fb6c00afa26cbd4d9d"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.33"
+version = "0.8.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c7962b26b0a8685668b671ee4b54d007a67d4eaf05fda79ac0ecf41e32270f1"
+checksum = "d8187381b52e32220d50b255276aa16a084ec0a9017a0ca2152a1f55c539758d"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -848,9 +856,9 @@ dependencies = [
 
 [[package]]
 name = "zmij"
-version = "1.0.16"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfcd145825aace48cff44a8844de64bf75feec3080e0aa5cdbde72961ae51a65"
+checksum = "02aae0f83f69aafc94776e879363e9771d7ecbffe2c7fbb6c14c5e00dfe88439"
 
 [[package]]
 name = "zstd"
diff --git a/Cargo.toml b/Cargo.toml
index fb53ab464f5..52f2424021e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -28,5 +28,6 @@ lto = "thin"                # Similarly, speed up linking by a ton
 
 [workspace.dependencies]
 edit = { path = "./crates/edit" }
+lsh = { path = "./crates/lsh" }
 stdext = { path = "./crates/stdext" }
 unicode-gen = { path = "./crates/unicode-gen" }
diff --git a/assets/highlighting-tests/COMMIT_EDITMSG b/assets/highlighting-tests/COMMIT_EDITMSG
new file mode 100644
index 00000000000..cfba35d08da
--- /dev/null
+++ b/assets/highlighting-tests/COMMIT_EDITMSG
@@ -0,0 +1,62 @@
+lsh: flip legacy flag, add follow-up hook & diff test
+
+Refactors placeholder logic and introduces a lightweight follow-up hook.
+Adds diff highlighting test and removes outdated asset to streamline visuals.
+
+# Please enter the commit message for your changes. Lines starting
+# with '#' will be ignored, and an empty message aborts the commit.
+#
+# On branch foobar
+# Your branch is up to date with 'origin/foobar'.
+#
+# Changes to be committed:
+#	renamed:    foo.rs -> bar.rs
+#	modified:   src/lsh/definitions.rs
+#	deleted:    assets/old_logo.svg
+#	new file:   baz.rs
+#
+# ------------------------ >8 ------------------------
+# Do not modify or remove the line above.
+# Everything below it will be ignored.
+diff --git a/src/lsh/definitions.rs b/src/lsh/definitions.rs
+index a1b2c3d..d4c3b2a 100644
+--- a/src/lsh/definitions.rs
++++ b/src/lsh/definitions.rs
+@@ -12,9 +12,11 @@ // context line 12
+ // context line 13
+-// old placeholder logic A
+-const LEGACY_FLAG: bool = true;
+-// end legacy block
++// updated placeholder logic A
++const LEGACY_FLAG: bool = false; // flipped for test
++// added note: migration in progress
++// end legacy block
+ // context line 19
+ // context line 20
+@@ -42,7 +44,12 @@ // context line 42
+ // context line 43
+-    do_placeholder_action(alpha, beta);
++    // Split actions for clarity
++    do_placeholder_prepare(alpha);
++    do_placeholder_action(alpha, beta);
++    if (enable_extra()) {
++        do_placeholder_followup(beta);
++    }
+ // context line 50
+ // context line 51
+ // context line 52
+@@ -90,6 +97,15 @@ // context line 90
+ // context line 91
+ // context line 92
++/// Added lightweight fake helper
++fn enable_extra() -> bool {
++    // Pretend this consults a config value
++    true
++}
++
++// Temporary debug instrumentation (to be removed)
++const _DEBUG_HOOK: &str = "lsh:extra";
++
+ // context line 93
+ // context line 94
+ // context line 95
diff --git a/assets/highlighting-tests/diff.diff b/assets/highlighting-tests/diff.diff
new file mode 100644
index 00000000000..8d033f94bfc
--- /dev/null
+++ b/assets/highlighting-tests/diff.diff
@@ -0,0 +1,142 @@
+diff --git a/src/lsh/definitions.rs b/src/lsh/definitions.rs
+index a1b2c3d..d4c3b2a 100644
+--- a/src/lsh/definitions.rs
++++ b/src/lsh/definitions.rs
+@@ -12,9 +12,11 @@ // context line 12
+ // context line 13
+-// old placeholder logic A
+-const LEGACY_FLAG: bool = true;
+-// end legacy block
++// updated placeholder logic A
++const LEGACY_FLAG: bool = false; // flipped for test
++// added note: migration in progress
++// end legacy block
+ // context line 19
+ // context line 20
+@@ -42,7 +44,12 @@ // context line 42
+ // context line 43
+-    do_placeholder_action(alpha, beta);
++    // Split actions for clarity
++    do_placeholder_prepare(alpha);
++    do_placeholder_action(alpha, beta);
++    if (enable_extra()) {
++        do_placeholder_followup(beta);
++    }
+ // context line 50
+ // context line 51
+ // context line 52
+@@ -90,6 +97,15 @@ // context line 90
+ // context line 91
+ // context line 92
++/// Added lightweight fake helper
++fn enable_extra() -> bool {
++    // Pretend this consults a config value
++    true
++}
++
++// Temporary debug instrumentation (to be removed)
++const _DEBUG_HOOK: &str = "lsh:extra";
++
+ // context line 93
+ // context line 94
+ // context line 95
+
+diff --git a/src/tui.rs b/src/tui.rs
+index 1122334..5566778 100644
+--- a/src/tui.rs
++++ b/src/tui.rs
+@@ -5,8 +5,13 @@ // context line 5
+ // context line 6
+ // context line 7
+-// previous rendering stub
+-render_placeholder(frame);
++// refined rendering sequence
++begin_frame(frame);
++render_header(frame);
++render_body(frame);
++render_footer(frame);
++end_frame(frame);
++
+ // context line 14
+ // context line 15
+ // context line 16
+
+diff --git a/README.md b/README.md
+index 9aa9aa9..1bb1bb1 100644
+--- a/README.md
++++ b/README.md
+@@ -1,6 +1,11 @@
+ # Project Title
+-Some brief description here.
++Some brief description here (updated).
++
++Experimental notes:
++- Added fake diff example
++- Demonstrates multi-hunk & multi-file patch
++
+ ## Usage
+ Run the binary as needed.
+
+diff --git a/Cargo.toml b/Cargo.toml
+index cafe123..fade321 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -8,7 +8,10 @@ edition = "2021"
+ # context
+ [features]
+-default = []
++default = ["experimental-preview"]
++experimental-preview = []
++
++# NOTE: Above feature is placeholder & fake
+
+ [dependencies]
+ # context
+@@ -20,6 +23,7 @@ anyhow = "1"
+ # context
+ # instrumentation (fake addition)
+ tracing = "0.1"
++tracing-subscriber = "0.3"
+
+diff --git a/src/feature/experimental.rs b/src/feature/experimental.rs
+new file mode 100644
+index 0000000..abc1234
+--- /dev/null
++++ b/src/feature/experimental.rs
+@@ -0,0 +1,24 @@
++//! Placeholder experimental module (fake content).
++//! This file exists only to demonstrate a multi-file diff.
++#![allow(dead_code)]
++
++pub struct ExperimentalToggle {
++    enabled: bool,
++}
++
++impl ExperimentalToggle {
++    pub fn new() -> Self {
++        Self { enabled: true }
++    }
++    pub fn enabled(&self) -> bool {
++        self.enabled
++    }
++}
++
++pub fn run_experimental_path() {
++    if ExperimentalToggle::new().enabled() {
++        // Fake behavior
++        eprintln!("(fake) running experimental path");
++    }
++}
++
+
+diff --git a/assets/old_logo.svg b/assets/old_logo.svg
+deleted file mode 100644
+index 55aa55a..0000000
+--- a/assets/old_logo.svg
++++ /dev/null
+@@ -1,5 +0,0 @@
+-<!-- Fake removed asset -->
+-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 10 10">
+-  <rect width="10" height="10" fill="#FF00FF"/>
+-  <text x="1" y="9" font-size="3">X</text>
+-</svg>
diff --git a/assets/highlighting-tests/git-rebase-todo b/assets/highlighting-tests/git-rebase-todo
new file mode 100644
index 00000000000..d051d122292
--- /dev/null
+++ b/assets/highlighting-tests/git-rebase-todo
@@ -0,0 +1,54 @@
+pick 3f9d2ab # chore(ci): add initial pipeline
+pick e12c0ff # feat(io): introduce streaming reader
+reword 7ac14d0 feat(io): add zero-copy buffered writer
+edit 4d92b67 fix(io): handle partial UTF-8 sequences at buffer boundary
+pick 8bb3a21 docs: expand README performance section
+squash 1c02f55 docs: tidy wording in performance section
+pick 54ae91b feat(cli): add --color=auto detection
+fixup 0b77c3e feat(cli): typo in help text
+fixup -c 2f4e8ab feat(cli): adjust arg parsing error message
+pick 6d8e5f1 refactor(core): split large module into submodules
+break
+pick a41e9d3 test(core): add regression tests for issue #410
+exec cargo test --package edit --lib --quiet
+pick c3bb921 perf(render): SIMD accelerate line diffing
+drop 91d0f2e debug(render): temporary logging (to be dropped)
+label pre-merge-split
+pick d2f7ac4 feat(ui): add mouse wheel smooth scrolling
+pick f1a4bd9 feat(ui): add high-DPI awareness
+label post-ui
+update-ref refs/heads/feature/ui-stack-post
+reset pre-merge-split
+merge -C 5ab77e3 post-ui # Merge UI feature stack
+pick d8c4b91 build: bump version to 0.9.0
+
+# Rebase 3f9d2ab..d8c4b91 onto d8c4b91 (18 commands)
+#
+# Commands:
+# p, pick <commit> = use commit
+# r, reword <commit> = use commit, but edit the commit message
+# e, edit <commit> = use commit, but stop for amending
+# s, squash <commit> = use commit, but meld into previous commit
+# f, fixup [-C | -c] <commit> = like "squash" but keep only the previous
+#                    commit's log message, unless -C is used, in which case
+#                    keep only this commit's message; -c is same as -C but
+#                    opens the editor
+# x, exec <command> = run command (the rest of the line) using shell
+# b, break = stop here (continue rebase later with 'git rebase --continue')
+# d, drop <commit> = remove commit
+# l, label <label> = label current HEAD with a name
+# t, reset <label> = reset HEAD to a label
+# m, merge [-C <commit> | -c <commit>] <label> [# <oneline>]
+#         create a merge commit using the original merge commit's
+#         message (or the oneline, if no original merge commit was
+#         specified); use -c <commit> to reword the commit message
+# u, update-ref <ref> = track a placeholder for the <ref> to be updated
+#                       to this position in the new commits. The <ref> is
+#                       updated at the end of the rebase
+#
+# These lines can be re-ordered; they are executed from top to bottom.
+#
+# If you remove a line here THAT COMMIT WILL BE LOST.
+#
+# However, if you remove everything, the rebase will be aborted.
+#
diff --git a/crates/edit/src/buffer/mod.rs b/crates/edit/src/buffer/mod.rs
index 251fa401d14..468174e75b4 100644
--- a/crates/edit/src/buffer/mod.rs
+++ b/crates/edit/src/buffer/mod.rs
@@ -2501,7 +2501,7 @@ impl TextBuffer {
     }
 
     /// Extracts the contents of the current selection the user made.
-    /// This differs from [`TextBuffer::extract_selection()`] in that
+    /// This differs from `TextBuffer::extract_selection()` in that
     /// it does nothing if the selection was made by searching.
     pub fn extract_user_selection(&mut self, delete: bool) -> Option<Vec<u8>> {
         if !self.has_selection() {
diff --git a/crates/lsh/Cargo.toml b/crates/lsh/Cargo.toml
new file mode 100644
index 00000000000..9cb5e20d674
--- /dev/null
+++ b/crates/lsh/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "lsh"
+version = "0.0.0"
+
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+
+[dependencies]
+regex-syntax = { version = "0.8", default-features = false }
+stdext.workspace = true
diff --git a/crates/lsh/definitions/git_commit_messsage.lsh b/crates/lsh/definitions/git_commit_messsage.lsh
new file mode 100644
index 00000000000..d0896f5fd8d
--- /dev/null
+++ b/crates/lsh/definitions/git_commit_messsage.lsh
@@ -0,0 +1,25 @@
+#[display_name = "Git Commit Message"]
+#[path = "**/COMMIT_EDITMSG"]
+#[path = "**/MERGE_MSG"]
+pub fn git_commit_message() {
+    if /#\s*/ {
+        yield comment;
+        if /(?:modified:|renamed:).*/ {
+            yield markup.changed;
+        } else if /deleted:.*/ {
+            yield markup.deleted;
+        } else if /new file:.*/ {
+            yield markup.inserted;
+        } else if /.*/ {
+        }
+    } else if /diff --git.*/ {
+        yield meta.header;
+        loop {
+            await input;
+            diff();
+            // diff() may not have eaten that line.
+            // It doesn't have to. That's our responsibility.
+            if /.*/ {}
+        }
+    }
+}
diff --git a/crates/lsh/definitions/git_ignore.lsh b/crates/lsh/definitions/git_ignore.lsh
new file mode 100644
index 00000000000..72da71fce16
--- /dev/null
+++ b/crates/lsh/definitions/git_ignore.lsh
@@ -0,0 +1,8 @@
+#[display_name = "Ignore"]
+#[path = "**/.git-blame-ignore-revs"]
+#[path = "**/.gitignore"]
+pub fn git_ignore() {
+    if /#.*/ {
+        yield comment;
+    }
+}
diff --git a/crates/lsh/definitions/git_rebase_todo.lsh b/crates/lsh/definitions/git_rebase_todo.lsh
new file mode 100644
index 00000000000..ee6de0a4b9a
--- /dev/null
+++ b/crates/lsh/definitions/git_rebase_todo.lsh
@@ -0,0 +1,27 @@
+#[display_name = "Git Rebase Message"]
+#[path = "**/git-rebase-todo"]
+#[path = "**/rebase-merge/done"]
+pub fn git_rebase_todo() {
+    if /#.*/ {
+        yield comment;
+    } else if /(?:break|exec|b|x)\b{end-half}/ {
+        yield keyword.control;
+        if /.*/ {
+            yield comment;
+        }
+    } else if /(?:drop|edit|fixup|pick|reword|squash|d|e|f|p|r|s)\b{end-half}/ {
+        yield keyword.control;
+
+        if /\s+/ {
+        }
+
+        if /\S+/ {
+            // Hash parameter
+            yield constant.numeric;
+
+            if /.*/ {
+                yield comment;
+            }
+        }
+    }
+}
diff --git a/crates/lsh/src/compiler/backend.rs b/crates/lsh/src/compiler/backend.rs
new file mode 100644
index 00000000000..214332f9742
--- /dev/null
+++ b/crates/lsh/src/compiler/backend.rs
@@ -0,0 +1,737 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Backend: IR graph -> bytecode
+//!
+//! ## Algorithm
+//!
+//! Source: <https://www.cs.cornell.edu/courses/cs4120/2022sp/notes/>
+//!
+//! - Linearize IR nodes using DFS to assign instruction indices
+//! - Compute liveness using backward dataflow analysis
+//! - Compute live intervals from liveness sets
+//! - Linear scan register allocation
+//! - Generate bytecode with physical registers
+//!
+//! ## Relocation system
+//!
+//! Jump targets aren't known during code generation (forward references). The backend
+//! emits placeholder zeros and records `Relocation` entries. After each function,
+//! `process_relocations()` patches the bytecode with resolved addresses.
+//!
+//! Two relocation types:
+//! - `ByName` - cross-function calls, resolved when the target function is compiled
+//! - `ByNode` - intra-function jumps to IR nodes not yet serialized
+//!
+//! ## Quirks
+//!
+//! - `IR.offset` starts as `usize::MAX` (unvisited). Codegen sets it to the bytecode
+//!   address. If we encounter a node with `offset != MAX`, it's a backward reference (loop)
+//!   We need to then emit a jump to the already-assigned address.
+//! - Physical registers have `physical = Some(...)`.
+//!   Liveness analysis ignores them (they're always "live").
+//!
+//! ### DFS
+//!
+//! Live intervals are `[min_index, max_index]` across all instructions where a vreg is live.
+//! BFS interleaves independent branches, making branch-local vregs appear to span the whole function.
+//!
+//! Example: `if /a/ { x = off } else if /b/ { y = off }` with BFS numbering:
+//! ```text
+//! [0: if /a/] [1: if /b/] [2: x=off] [3: y=off] [4: use x] [5: use y]
+//! ```
+//! Here `x` appears live `[2,4]` and `y` appears live `[3,5]`, overlapping at `[3,4]`.
+//!
+//! DFS numbers each branch contiguously: `[0: if /a/] [1: x=off] [2: use x] [3: if /b/] ...`
+//! Now `x` is live `[1,2]` and `y` is live `[4,5]` - no overlap & can share a register.
+//!
+//! ## TODO
+//!
+//! - The liveness analysis is a much later addition so it doesn't fit into existing structures very well.
+//! - The linear scan allocator has spill logic but doesn't generate spill code.
+
+use std::collections::{HashMap, HashSet, VecDeque};
+
+use stdext::arena::scratch_arena;
+
+use super::*;
+use crate::runtime::Instruction;
+
+#[derive(Debug, Clone, Copy)]
+enum Relocation<'a> {
+    ByName(usize, &'a str),
+    ByNode(usize, IRCell<'a>),
+}
+
+pub struct Backend<'a> {
+    assembly: Assembly<'a>,
+    relocations: Vec<Relocation<'a>>,
+    functions_seen: HashMap<&'a str, usize>,
+    charsets_seen: HashMap<*const Charset, usize>,
+    strings_seen: HashMap<*const str, usize>,
+}
+
+impl<'a> Backend<'a> {
+    pub fn new() -> Self {
+        Self {
+            assembly: Assembly {
+                instructions: Default::default(),
+                entrypoints: Default::default(),
+                charsets: Default::default(),
+                strings: Default::default(),
+                highlight_kinds: Default::default(),
+            },
+            relocations: Default::default(),
+            functions_seen: Default::default(),
+            charsets_seen: Default::default(),
+            strings_seen: Default::default(),
+        }
+    }
+
+    pub fn compile(mut self, compiler: &Compiler<'a>) -> CompileResult<Assembly<'a>> {
+        for function in &compiler.functions {
+            self.allocate_registers(function)?;
+
+            let entrypoint_offset = self.assembly.instructions.len();
+            self.functions_seen.insert(function.name, entrypoint_offset);
+            self.generate_code(function)?;
+            self.process_relocations();
+        }
+
+        if !self.relocations.is_empty() {
+            let names: String = self
+                .relocations
+                .iter()
+                .filter_map(|reloc| match reloc {
+                    Relocation::ByName(_, name) => Some(*name),
+                    Relocation::ByNode(_, _) => None,
+                })
+                .collect::<Vec<&str>>()
+                .join(", ");
+            return Err(CompileError {
+                path: String::new(),
+                line: 0,
+                column: 0,
+                message: if !names.is_empty() {
+                    format!("unresolved function call names: {names}")
+                } else {
+                    "unresolved IR nodes".to_string()
+                },
+            });
+        }
+
+        self.assembly.entrypoints = compiler
+            .functions
+            .iter()
+            .filter(|f| f.public)
+            .map(|f| Entrypoint {
+                name: f.name.to_string(),
+                display_name: f.attributes.display_name.unwrap_or(f.name).to_string(),
+                paths: f.attributes.paths.iter().map(|s| s.to_string()).collect(),
+                address: f.body.borrow().offset,
+            })
+            .collect();
+        self.assembly.highlight_kinds = compiler.highlight_kinds.clone();
+
+        Ok(self.assembly)
+    }
+
+    /// Perform liveness analysis and register allocation for a function.
+    fn allocate_registers(&mut self, function: &Function<'a>) -> CompileResult<()> {
+        let mut analysis = LivenessAnalysis::new(function);
+        if analysis.is_empty() {
+            return Ok(());
+        }
+
+        analysis.compute_liveness();
+        let intervals = analysis.compute_intervals();
+        let allocation = self.linear_scan_allocation(intervals)?;
+        analysis.apply_allocation(&allocation);
+
+        Ok(())
+    }
+
+    /// Linear scan register allocation (Poletto-Sarkar).
+    ///
+    /// Processes intervals in order of start position, expiring old intervals
+    /// and allocating registers greedily. When out of registers, spills the
+    /// interval with the furthest end point.
+    fn linear_scan_allocation(
+        &mut self,
+        intervals: Vec<LiveInterval>,
+    ) -> CompileResult<HashMap<u32, Register>> {
+        let mut allocation: HashMap<u32, Register> = HashMap::new();
+
+        if intervals.is_empty() {
+            return Ok(allocation);
+        }
+
+        // Active intervals sorted by end position
+        let mut active: Vec<LiveInterval> = Vec::new();
+
+        // Available user registers
+        let mut available: Vec<Register> =
+            (Register::FIRST_USER_REG..Register::COUNT).rev().map(Register::from_usize).collect();
+
+        for interval in intervals {
+            // Expire intervals that ended before this one starts
+            active.retain(|active_interval| {
+                if active_interval.end < interval.start {
+                    if let Some(&reg) = allocation.get(&active_interval.vreg_id)
+                        && reg as usize >= Register::FIRST_USER_REG
+                    {
+                        available.push(reg);
+                    }
+                    false
+                } else {
+                    true
+                }
+            });
+
+            // Allocate or spill
+            if let Some(reg) = available.pop() {
+                allocation.insert(interval.vreg_id, reg);
+                active.push(interval);
+                active.sort_by_key(|i| i.end);
+            } else if let Some(last) = active.last() {
+                if last.end > interval.end {
+                    // Spill the longest-living active interval
+                    let spilled = active.pop().unwrap();
+                    if let Some(&reg) = allocation.get(&spilled.vreg_id) {
+                        allocation.remove(&spilled.vreg_id);
+                        allocation.insert(interval.vreg_id, reg);
+                        active.push(interval);
+                        active.sort_by_key(|i| i.end);
+                    }
+                }
+            } else {
+                // TODO: current interval gets spilled
+                return Err(CompileError {
+                    path: String::new(),
+                    line: 0,
+                    column: 0,
+                    message: "out of physical registers".to_string(),
+                });
+            }
+        }
+
+        Ok(allocation)
+    }
+
+    /// Generate bytecode for a function (assumes registers already allocated).
+    fn generate_code(&mut self, function: &Function<'a>) -> CompileResult<()> {
+        use Instruction::*;
+
+        let mut stack: VecDeque<IRCell<'a>> = VecDeque::new();
+        stack.push_back(function.body);
+
+        while let Some(ir_cell) = stack.pop_front() {
+            let mut ir = ir_cell.borrow_mut();
+
+            if ir.offset != usize::MAX {
+                // Already serialized
+                continue;
+            }
+
+            loop {
+                ir.offset = self.assembly.instructions.len();
+
+                match ir.instr {
+                    IRI::Noop => {}
+                    IRI::Mov { dst, src } => {
+                        let dst_reg = dst.borrow();
+                        let src_reg = src.borrow();
+                        let dst = dst_reg.physical.unwrap();
+                        let src = src_reg.physical.unwrap();
+                        self.push_instruction(Mov { dst, src });
+                    }
+                    IRI::MovImm { dst, imm } => {
+                        let dst_reg = dst.borrow();
+                        let dst = dst_reg.physical.unwrap();
+                        self.push_instruction(MovImm { dst, imm });
+                    }
+                    IRI::MovKind { dst, kind } => {
+                        let dst_reg = dst.borrow();
+                        let dst = dst_reg.physical.unwrap();
+                        self.push_instruction(MovImm { dst, imm: kind });
+                    }
+                    IRI::AddImm { dst, imm } => {
+                        let dst_reg = dst.borrow();
+                        let dst = dst_reg.physical.unwrap();
+                        self.push_instruction(AddImm { dst, imm });
+                    }
+                    IRI::If { condition, then } => {
+                        stack.push_back(then);
+
+                        match condition {
+                            Condition::Cmp { lhs, rhs, op } => {
+                                let lhs_phys = lhs.borrow().physical.unwrap();
+                                let rhs_phys = rhs.borrow().physical.unwrap();
+                                let tgt = self.dst_by_node(then) as u32;
+
+                                match op {
+                                    ComparisonOp::Eq => self.push_instruction(JumpEQ {
+                                        lhs: lhs_phys,
+                                        rhs: rhs_phys,
+                                        tgt,
+                                    }),
+                                    ComparisonOp::Ne => self.push_instruction(JumpNE {
+                                        lhs: lhs_phys,
+                                        rhs: rhs_phys,
+                                        tgt,
+                                    }),
+                                    ComparisonOp::Lt => self.push_instruction(JumpLT {
+                                        lhs: lhs_phys,
+                                        rhs: rhs_phys,
+                                        tgt,
+                                    }),
+                                    ComparisonOp::Gt => self.push_instruction(JumpGT {
+                                        lhs: lhs_phys,
+                                        rhs: rhs_phys,
+                                        tgt,
+                                    }),
+                                    ComparisonOp::Le => self.push_instruction(JumpLE {
+                                        lhs: lhs_phys,
+                                        rhs: rhs_phys,
+                                        tgt,
+                                    }),
+                                    ComparisonOp::Ge => self.push_instruction(JumpGE {
+                                        lhs: lhs_phys,
+                                        rhs: rhs_phys,
+                                        tgt,
+                                    }),
+                                }
+                            }
+                            Condition::EndOfLine => {
+                                let tgt = self.dst_by_node(then) as u32;
+                                self.push_instruction(JumpIfEndOfLine { tgt });
+                            }
+                            Condition::Charset(h) => {
+                                let idx = self.visit_charset(h) as u32;
+                                let tgt = self.dst_by_node(then) as u32;
+                                self.push_instruction(JumpIfMatchCharset { idx, tgt });
+                            }
+                            Condition::Prefix(s) => {
+                                let idx = self.visit_string(s) as u32;
+                                let tgt = self.dst_by_node(then) as u32;
+                                self.push_instruction(JumpIfMatchPrefix { idx, tgt });
+                            }
+                            Condition::PrefixInsensitive(s) => {
+                                let idx = self.visit_string(s) as u32;
+                                let tgt = self.dst_by_node(then) as u32;
+                                self.push_instruction(JumpIfMatchPrefixInsensitive { idx, tgt });
+                            }
+                        }
+                    }
+                    IRI::Call { name } => {
+                        let tgt = self.dst_by_name(name) as u32;
+                        self.push_instruction(Call { tgt });
+                    }
+                    IRI::Return => {
+                        self.push_instruction(Return);
+                    }
+                    IRI::Flush { kind } => {
+                        let kind = kind.borrow().physical.unwrap();
+                        self.push_instruction(FlushHighlight { kind });
+                    }
+                    IRI::AwaitInput => {
+                        self.push_instruction(AwaitInput);
+                    }
+                }
+
+                let Some(next) = ir.next else {
+                    break;
+                };
+
+                ir = next.borrow_mut();
+
+                if ir.offset != usize::MAX {
+                    self.push_instruction(MovImm {
+                        dst: Register::ProgramCounter,
+                        imm: ir.offset as u32,
+                    });
+                    break;
+                }
+            }
+        }
+
+        Ok(())
+    }
+
+    fn push_instruction(&mut self, instr: Instruction) {
+        if let Some(reloc) = self.relocations.last_mut() {
+            let offset = match reloc {
+                Relocation::ByName(off, _) => off,
+                Relocation::ByNode(off, _) => off,
+            };
+
+            if *offset == self.assembly.instructions.len()
+                && let Some(delta) = instr.address_offset()
+            {
+                *offset += delta;
+            }
+        }
+
+        let scratch = scratch_arena(None);
+        self.assembly.instructions.extend(instr.encode(&scratch));
+    }
+
+    fn visit_charset(&mut self, h: &'a Charset) -> usize {
+        *self.charsets_seen.entry(h as *const _).or_insert_with(|| {
+            let idx = self.assembly.charsets.len();
+            self.assembly.charsets.push(h);
+            idx
+        })
+    }
+
+    fn visit_string(&mut self, s: &'a str) -> usize {
+        *self.strings_seen.entry(s as *const _).or_insert_with(|| {
+            let idx = self.assembly.strings.len();
+            self.assembly.strings.push(s);
+            idx
+        })
+    }
+
+    fn dst_by_node(&mut self, ir: IRCell<'a>) -> usize {
+        let off = ir.borrow().offset;
+        if off != usize::MAX {
+            off
+        } else {
+            self.relocations.push(Relocation::ByNode(self.assembly.instructions.len(), ir));
+            0
+        }
+    }
+
+    fn dst_by_name(&mut self, name: &'a str) -> usize {
+        match self.functions_seen.get(name) {
+            Some(&dst) => dst,
+            None => {
+                self.relocations.push(Relocation::ByName(self.assembly.instructions.len(), name));
+                0
+            }
+        }
+    }
+
+    fn process_relocations(&mut self) {
+        self.relocations.retain_mut(|reloc| {
+            let (off, resolved) = match *reloc {
+                Relocation::ByName(off, name) => match self.functions_seen.get(name) {
+                    None => return true,
+                    Some(&resolved) => (off, resolved),
+                },
+                Relocation::ByNode(off, node) => match node.borrow().offset {
+                    usize::MAX => return true,
+                    resolved => (off, resolved),
+                },
+            };
+
+            let range = off..off + 4;
+            if let Some(target) = self.assembly.instructions.get_mut(range) {
+                target.copy_from_slice(&(resolved as u32).to_le_bytes());
+            } else {
+                panic!("Unexpected relocation target offset: {off}");
+            }
+
+            false
+        });
+    }
+}
+
+/// A live interval represents the range of instructions where a vreg is live.
+#[derive(Debug, Clone, Copy)]
+struct LiveInterval {
+    vreg_id: u32,
+    start: usize,
+    end: usize,
+}
+
+/// Encapsulates liveness analysis state for a single function.
+///
+/// Performs DFS linearization, builds the CFG, and computes liveness sets.
+/// The analysis owns all intermediate data structures, exposing only what's
+/// needed for register allocation.
+struct LivenessAnalysis<'a> {
+    /// IR nodes in DFS order (instruction indices correspond to positions here).
+    nodes: Vec<IRCell<'a>>,
+    /// CFG: `successors[i]` contains indices of nodes that can follow node i.
+    successors: Vec<Vec<usize>>,
+    /// Map from vreg ID to its [`IRRegCell`] (for applying allocation results).
+    vreg_cells: HashMap<u32, IRRegCell<'a>>,
+    /// Liveness sets: `live_in[i]` = vregs live at entry to instruction i.
+    live_in: Vec<HashSet<u32>>,
+    /// Liveness sets: `live_out[i]` = vregs live at exit from instruction i.
+    live_out: Vec<HashSet<u32>>,
+}
+
+impl<'a> LivenessAnalysis<'a> {
+    /// Create a new liveness analysis for a function.
+    ///
+    /// This linearizes the IR using DFS and builds the CFG. Call `compute_liveness()`
+    /// to fill in the liveness sets, then `compute_intervals()` to get live intervals.
+    fn new(function: &Function<'a>) -> Self {
+        let mut nodes = Vec::new();
+        let mut node_to_idx = HashMap::new();
+        let mut vreg_cells = HashMap::new();
+        let mut visited = HashSet::new();
+
+        // DFS is essential for correctness. See module docs for details.
+        Self::dfs(function.body, &mut nodes, &mut node_to_idx, &mut vreg_cells, &mut visited);
+
+        // Build successor relationships from the node_to_idx map
+        let successors = Self::build_successors(&nodes, &node_to_idx);
+
+        let n = nodes.len();
+        Self {
+            nodes,
+            successors,
+            vreg_cells,
+            live_in: vec![HashSet::new(); n],
+            live_out: vec![HashSet::new(); n],
+        }
+    }
+
+    fn is_empty(&self) -> bool {
+        self.nodes.is_empty()
+    }
+
+    /// DFS traversal to linearize IR nodes.
+    ///
+    /// Visits "then" branches before "next" (fallthrough) to keep branch
+    /// instructions contiguous in the numbering.
+    fn dfs(
+        cell: IRCell<'a>,
+        nodes: &mut Vec<IRCell<'a>>,
+        node_to_idx: &mut HashMap<*const RefCell<IR<'a>>, usize>,
+        vreg_cells: &mut HashMap<u32, IRRegCell<'a>>,
+        visited: &mut HashSet<*const RefCell<IR<'a>>>,
+    ) {
+        if !visited.insert(cell as *const _) {
+            return;
+        }
+
+        let idx = nodes.len();
+        node_to_idx.insert(cell as *const _, idx);
+        nodes.push(cell);
+
+        let ir = cell.borrow();
+
+        match ir.instr {
+            IRI::Mov { dst, src } => {
+                if dst.borrow().physical.is_none() {
+                    vreg_cells.insert(dst.borrow().id, dst);
+                }
+                if src.borrow().physical.is_none() {
+                    vreg_cells.insert(src.borrow().id, src);
+                }
+            }
+            IRI::MovImm { dst, .. } => {
+                if dst.borrow().physical.is_none() {
+                    vreg_cells.insert(dst.borrow().id, dst);
+                }
+            }
+            IRI::MovKind { dst, .. } => {
+                if dst.borrow().physical.is_none() {
+                    vreg_cells.insert(dst.borrow().id, dst);
+                }
+            }
+            IRI::AddImm { dst, .. } => {
+                if dst.borrow().physical.is_none() {
+                    vreg_cells.insert(dst.borrow().id, dst);
+                }
+            }
+            IRI::If { condition: Condition::Cmp { lhs, rhs, .. }, .. } => {
+                if lhs.borrow().physical.is_none() {
+                    vreg_cells.insert(lhs.borrow().id, lhs);
+                }
+                if rhs.borrow().physical.is_none() {
+                    vreg_cells.insert(rhs.borrow().id, rhs);
+                }
+            }
+            IRI::Flush { kind, .. } => {
+                if kind.borrow().physical.is_none() {
+                    vreg_cells.insert(kind.borrow().id, kind);
+                }
+            }
+            _ => {}
+        }
+
+        // Visit "then" branch first (DFS into branches), then "next" (fallthrough).
+        if let IRI::If { then, .. } = ir.instr {
+            Self::dfs(then, nodes, node_to_idx, vreg_cells, visited);
+            let ir = cell.borrow();
+            if let Some(next) = ir.next {
+                Self::dfs(next, nodes, node_to_idx, vreg_cells, visited);
+            }
+        } else if let Some(next) = ir.next {
+            Self::dfs(next, nodes, node_to_idx, vreg_cells, visited);
+        }
+    }
+
+    /// Build CFG successor relationships from the linearized nodes.
+    fn build_successors(
+        nodes: &[IRCell<'a>],
+        node_to_idx: &HashMap<*const RefCell<IR<'a>>, usize>,
+    ) -> Vec<Vec<usize>> {
+        let mut successors = vec![Vec::new(); nodes.len()];
+        for (idx, cell) in nodes.iter().enumerate() {
+            let ir = cell.borrow();
+            if let Some(next) = ir.next
+                && let Some(&next_idx) = node_to_idx.get(&(next as *const _))
+            {
+                successors[idx].push(next_idx);
+            }
+            if let IRI::If { then, .. } = ir.instr
+                && let Some(&then_idx) = node_to_idx.get(&(then as *const _))
+            {
+                successors[idx].push(then_idx);
+            }
+        }
+        successors
+    }
+
+    /// Compute liveness using backward dataflow analysis (worklist algorithm).
+    ///
+    /// Dataflow equations:
+    /// - `in[n] = use[n] ∪ (out[n] - def[n])`
+    /// - `out[n] = ∪_{s ∈ succ(n)} in[s]`
+    fn compute_liveness(&mut self) {
+        let n = self.nodes.len();
+        if n == 0 {
+            return;
+        }
+
+        // Build predecessors from successors (needed for worklist propagation)
+        let mut predecessors: Vec<Vec<usize>> = vec![Vec::new(); n];
+        for (idx, succs) in self.successors.iter().enumerate() {
+            for &succ in succs {
+                predecessors[succ].push(idx);
+            }
+        }
+
+        // Worklist: start with all nodes
+        let mut worklist: VecDeque<usize> = (0..n).collect();
+        let mut in_worklist = vec![true; n];
+
+        while let Some(idx) = worklist.pop_front() {
+            in_worklist[idx] = false;
+
+            // out[n] = ∪_{s ∈ succ(n)} in[s]
+            let mut new_out = HashSet::new();
+            for &succ in &self.successors[idx] {
+                new_out.extend(self.live_in[succ].iter().copied());
+            }
+
+            // in[n] = use[n] ∪ (out[n] - def[n])
+            let (use_set, def_set) = Self::compute_use_def(&self.nodes[idx].borrow());
+            let mut new_in = use_set;
+            for &vreg in &new_out {
+                if !def_set.contains(&vreg) {
+                    new_in.insert(vreg);
+                }
+            }
+
+            // If in[n] changed, propagate to predecessors
+            if new_in != self.live_in[idx] {
+                self.live_in[idx] = new_in;
+                for &pred in &predecessors[idx] {
+                    if !in_worklist[pred] {
+                        worklist.push_back(pred);
+                        in_worklist[pred] = true;
+                    }
+                }
+            }
+
+            self.live_out[idx] = new_out;
+        }
+    }
+
+    /// Compute use and def sets for a single IR instruction.
+    fn compute_use_def(ir: &IR<'a>) -> (HashSet<u32>, HashSet<u32>) {
+        let mut use_set = HashSet::new();
+        let mut def_set = HashSet::new();
+
+        match ir.instr {
+            IRI::Mov { dst, src } => {
+                let dst_reg = dst.borrow();
+                if dst_reg.physical.is_none() {
+                    def_set.insert(dst_reg.id);
+                }
+                let src_reg = src.borrow();
+                if src_reg.physical.is_none() {
+                    use_set.insert(src_reg.id);
+                }
+            }
+            IRI::MovImm { dst, .. } => {
+                let dst_reg = dst.borrow();
+                if dst_reg.physical.is_none() {
+                    def_set.insert(dst_reg.id);
+                }
+            }
+            IRI::MovKind { dst, .. } => {
+                let dst_reg = dst.borrow();
+                if dst_reg.physical.is_none() {
+                    def_set.insert(dst_reg.id);
+                }
+            }
+            IRI::AddImm { dst, .. } => {
+                let dst_reg = dst.borrow();
+                if dst_reg.physical.is_none() {
+                    def_set.insert(dst_reg.id);
+                }
+            }
+            IRI::If { condition: Condition::Cmp { lhs, rhs, .. }, .. } => {
+                let lhs_reg = lhs.borrow();
+                if lhs_reg.physical.is_none() {
+                    use_set.insert(lhs_reg.id);
+                }
+                let rhs_reg = rhs.borrow();
+                if rhs_reg.physical.is_none() {
+                    use_set.insert(rhs_reg.id);
+                }
+            }
+            IRI::Flush { kind, .. } => {
+                let kind_reg = kind.borrow();
+                if kind_reg.physical.is_none() {
+                    use_set.insert(kind_reg.id);
+                }
+            }
+            _ => {}
+        }
+
+        (use_set, def_set)
+    }
+
+    /// Compute live intervals from liveness sets, sorted by start position.
+    fn compute_intervals(&self) -> Vec<LiveInterval> {
+        let mut vreg_ranges: HashMap<u32, (usize, usize)> = HashMap::new();
+
+        for idx in 0..self.nodes.len() {
+            for &vreg_id in self.live_in[idx].iter().chain(self.live_out[idx].iter()) {
+                vreg_ranges
+                    .entry(vreg_id)
+                    .and_modify(|(start, end)| {
+                        *start = (*start).min(idx);
+                        *end = (*end).max(idx);
+                    })
+                    .or_insert((idx, idx));
+            }
+        }
+
+        let mut intervals: Vec<LiveInterval> = vreg_ranges
+            .into_iter()
+            .map(|(vreg_id, (start, end))| LiveInterval { vreg_id, start, end })
+            .collect();
+
+        intervals.sort_by_key(|i| i.start);
+        intervals
+    }
+
+    /// Apply register allocation results to the IRReg cells.
+    fn apply_allocation(&self, allocation: &HashMap<u32, Register>) {
+        for (&vreg_id, &reg) in allocation {
+            if let Some(cell) = self.vreg_cells.get(&vreg_id) {
+                cell.borrow_mut().physical = Some(reg);
+            }
+        }
+    }
+}
diff --git a/crates/lsh/src/compiler/charset.rs b/crates/lsh/src/compiler/charset.rs
new file mode 100644
index 00000000000..4b1cd3b0b0b
--- /dev/null
+++ b/crates/lsh/src/compiler/charset.rs
@@ -0,0 +1,193 @@
+use std::fmt;
+use std::ops::RangeInclusive;
+
+use stdext::arena::Arena;
+
+use super::Intern;
+
+const WORD_BITS: usize = usize::BITS as usize;
+
+pub type SerializedCharset = [u16; 16];
+
+#[derive(Clone, PartialEq, Eq, Hash)]
+pub struct Charset {
+    bits: [usize; 256 / WORD_BITS],
+}
+
+impl Charset {
+    pub const fn no() -> Self {
+        Charset { bits: [usize::MIN; _] }
+    }
+
+    pub fn invert(&mut self) {
+        for b in &mut self.bits {
+            *b = !*b;
+        }
+    }
+
+    pub fn get(&self, b: u8) -> bool {
+        let hi = b as usize / WORD_BITS;
+        let lo = b as usize % WORD_BITS;
+        (self.bits[hi] & (1 << lo)) != 0
+    }
+
+    pub fn covers_none(&self) -> bool {
+        self.bits.iter().all(|&b| b == usize::MIN)
+    }
+
+    pub fn covers_range(&self, range: RangeInclusive<u8>) -> bool {
+        range.into_iter().all(|b| self.get(b))
+    }
+
+    pub const fn set(&mut self, index: u8, value: bool) {
+        let hi = index as usize / WORD_BITS;
+        let lo = index as usize % WORD_BITS;
+        self.bits[hi] = if value { self.bits[hi] | (1 << lo) } else { self.bits[hi] & !(1 << lo) };
+    }
+
+    pub const fn set_range(&mut self, range: RangeInclusive<u8>, value: bool) {
+        let start = *range.start() as usize;
+        let end = *range.end() as usize;
+
+        let start_word = start / WORD_BITS;
+        let start_bit = start % WORD_BITS;
+        let end_word = end / WORD_BITS;
+        let end_bit = end % WORD_BITS;
+
+        // Write the starting bits of the first word
+        let mask = usize::MAX << start_bit;
+        self.bits[start_word] =
+            if value { self.bits[start_word] | mask } else { self.bits[start_word] & !mask };
+
+        // Fill the full words in between, if any
+        let mut word = start_word + 1;
+        while word <= end_word {
+            self.bits[word] = if value { usize::MAX } else { usize::MIN };
+            word += 1;
+        }
+
+        // Fix the trailing bits of the last word we wrote above
+        let shift = end_bit + 1;
+        let mask = if shift < WORD_BITS { usize::MAX << shift } else { 0 };
+        self.bits[end_word] =
+            if value { self.bits[end_word] & !mask } else { self.bits[end_word] | mask };
+    }
+
+    pub fn merge(&mut self, other: &Charset) {
+        for (a, b) in self.bits.iter_mut().zip(other.bits.iter()) {
+            *a |= *b;
+        }
+    }
+
+    pub fn is_superset_of(&self, other: &Charset) -> bool {
+        for (&s, &o) in self.bits.iter().zip(other.bits.iter()) {
+            // For self to be a superset, every bit in other must be in self
+            if (o & !s) != 0 {
+                return false;
+            }
+        }
+        true
+    }
+
+    pub fn serialize(&self) -> SerializedCharset {
+        let mut arr = [0u16; 16];
+        for lo in 0..16 {
+            let mut u = 0u16;
+            for hi in 0..16 {
+                u |= (self.get(hi * 16 + lo) as u16) << hi;
+            }
+            arr[lo as usize] = u;
+        }
+        arr
+    }
+}
+
+impl Default for Charset {
+    fn default() -> Self {
+        Self::no()
+    }
+}
+
+impl fmt::Debug for Charset {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let show_char = |f: &mut fmt::Formatter<'_>, b: usize| {
+            let b = b as u8;
+            if b == b'"' {
+                write!(f, "&quot;")
+            } else if b.is_ascii_graphic() {
+                let b = b as char;
+                write!(f, "{b}")
+            } else {
+                write!(f, "0x{b:02X}")
+            }
+        };
+
+        let get_bit = |index: usize| -> bool {
+            let hi = index / WORD_BITS;
+            let lo = index % WORD_BITS;
+            (self.bits[hi] & (1 << lo)) != 0
+        };
+
+        let mut beg = 0;
+        let mut first = true;
+
+        write!(f, "[")?;
+
+        while beg < 256 {
+            while beg < 256 && !get_bit(beg) {
+                beg += 1;
+            }
+            if beg >= 256 {
+                break;
+            }
+
+            let mut end = beg;
+            while end < 256 && get_bit(end) {
+                end += 1;
+            }
+
+            if !first {
+                write!(f, ", ")?;
+            }
+            show_char(f, beg)?;
+            if end - beg > 1 {
+                write!(f, "-")?;
+                show_char(f, end - 1)?;
+            }
+
+            beg = end;
+            first = false;
+        }
+
+        write!(f, "]")
+    }
+}
+
+impl<'a> Intern<'a, Charset> for Vec<&'a Charset> {
+    fn intern(&mut self, arena: &'a Arena, value: &Charset) -> &'a Charset {
+        if let Some(&s) = self.iter().find(|&&v| v == value) {
+            s
+        } else {
+            let s = arena.alloc_uninit().write(value.clone());
+            self.push(s);
+            s
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn set_range() {
+        for range in [5..=7, 10..=245, 0..=255] {
+            let mut cs = Charset::no();
+            cs.set_range(range.clone(), true);
+
+            for i in 0u8..=255 {
+                assert_eq!(cs.get(i), range.contains(&i), "range {range:?}, bit {i}");
+            }
+        }
+    }
+}
diff --git a/crates/lsh/src/compiler/frontend.rs b/crates/lsh/src/compiler/frontend.rs
new file mode 100644
index 00000000000..5ec660f34f1
--- /dev/null
+++ b/crates/lsh/src/compiler/frontend.rs
@@ -0,0 +1,834 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Frontend: DSL source code -> IR graph
+//!
+//! ## Gotchas
+//!
+//! - Variables are in SSA-ish form: `var x = off; x = x + 1;` creates a new vreg for the
+//!   second `x`. But the variable *name* still maps to the new vreg, so later reads see it.
+//! - Physical registers (off, etc.) don't follow SSA. Reading them doesn't create a vreg;
+//!   the `parse_expression` function handles this by copying to a fresh vreg.
+//! - The `raise!` macro captures token_start position at call time. Don't advance before raising.
+
+use std::collections::HashMap;
+use std::collections::hash_map::Entry;
+
+use super::*;
+
+macro_rules! raise {
+    ($self:ident, $msg:literal) => {{
+        let path = $self.path.to_string();
+        let (line, column) = $self.position();
+        return Err(CompileError { path, line, column, message: $msg.to_string() })
+    }};
+    ($self:ident, $($arg:tt)*) => {{
+        let path = $self.path.to_string();
+        let (line, column) = $self.position();
+        return Err(CompileError { path, line, column, message: format!($($arg)*) })
+    }};
+}
+
+struct RegexSpan<'a> {
+    pub src: IRCell<'a>,
+    pub dst_good: IRCell<'a>,
+    pub dst_bad: IRCell<'a>,
+    pub capture_groups: Vec<(IRRegCell<'a>, IRRegCell<'a>), &'a Arena>,
+}
+
+struct Context<'a> {
+    loop_start: Option<IRCell<'a>>,
+    loop_exit: Option<IRCell<'a>>,
+    capture_groups: Vec<(IRRegCell<'a>, IRRegCell<'a>), &'a Arena>,
+}
+
+pub struct Parser<'a, 'c, 'src> {
+    compiler: &'c mut Compiler<'a>,
+    path: &'src str,
+    src: &'src str,
+    pos: usize,
+    token_start: usize,
+    context: Vec<Context<'a>, &'a Arena>,
+    variables: HashMap<&'src str, IRRegCell<'a>>,
+}
+
+impl<'a, 'c, 'src> Parser<'a, 'c, 'src> {
+    pub fn new(compiler: &'c mut Compiler<'a>, path: &'src str, src: &'src str) -> Self {
+        let context = Vec::new_in(compiler.arena);
+        Self { compiler, path, src, pos: 0, token_start: 0, context, variables: Default::default() }
+    }
+
+    pub fn run(&mut self) -> CompileResult<()> {
+        while !self.is_at_eof() {
+            let f = self.parse_function()?;
+            self.compiler.functions.push(f);
+        }
+        Ok(())
+    }
+
+    fn parse_attributes(&mut self) -> CompileResult<FunctionAttributes<'a>> {
+        let mut attributes = FunctionAttributes::default();
+
+        while self.peek() == Some('#') {
+            self.pos += 1;
+            self.expect('[')?;
+
+            let key = self.read_identifier()?;
+            self.expect('=')?;
+            let value = arena_clone_str(self.compiler.arena, self.read_string()?);
+            self.expect(']')?;
+
+            match key {
+                "display_name" => attributes.display_name = Some(value),
+                "path" => attributes.paths.push(value),
+                _ => raise!(self, "unknown attribute '{}'", key),
+            }
+        }
+
+        Ok(attributes)
+    }
+
+    fn parse_function(&mut self) -> CompileResult<Function<'a>> {
+        // Reset symbol table for new function
+        self.variables =
+            HashMap::from_iter([("off", self.compiler.get_reg(Register::InputOffset))]);
+
+        let attributes = self.parse_attributes()?;
+
+        let public = if self.is_keyword("pub") {
+            self.pos += 3;
+            true
+        } else {
+            false
+        };
+
+        self.expect_keyword("fn")?;
+
+        let name = arena_clone_str(self.compiler.arena, self.read_identifier()?);
+
+        self.expect('(')?;
+        self.expect(')')?;
+
+        let span = self.parse_block()?;
+
+        if let mut last = span.last.borrow_mut()
+            && last.wants_next()
+        {
+            last.set_next(self.compiler.alloc_iri(IRI::Return));
+        }
+
+        Ok(Function { name, attributes, body: span.first, public })
+    }
+
+    fn parse_block(&mut self) -> CompileResult<IRSpan<'a>> {
+        self.expect('{')?;
+
+        // TODO: a bit inoptimal to always allocate a noop node
+        let mut result: Option<IRSpan> = None;
+
+        while !matches!(self.peek(), Some('}') | None) {
+            let s = self.parse_statement()?;
+            if let Some(span) = &mut result {
+                span.last.borrow_mut().set_next(s.first);
+                span.last = s.last;
+            } else {
+                result = Some(s);
+            }
+        }
+
+        self.expect('}')?;
+        Ok(match result {
+            Some(span) => span,
+            None => IRSpan::single(self.compiler.alloc_noop()),
+        })
+    }
+
+    fn parse_statement(&mut self) -> CompileResult<IRSpan<'a>> {
+        if self.is_keyword("var") {
+            return self.parse_var_declaration();
+        }
+        if self.is_keyword("loop") {
+            return self.parse_loop();
+        }
+        if self.is_keyword("until") {
+            return self.parse_until();
+        }
+        if self.is_keyword("break") {
+            return self.parse_break();
+        }
+        if self.is_keyword("continue") {
+            return self.parse_continue();
+        }
+        if self.is_keyword("return") {
+            return self.parse_return();
+        }
+        if self.is_keyword("if") {
+            return self.parse_if();
+        }
+        if self.is_keyword("await") {
+            return self.parse_await();
+        }
+        if self.is_keyword("yield") {
+            return self.parse_yield();
+        }
+        if self.peek().is_some_and(Self::is_ident_start) {
+            return self.parse_identifier_stmt();
+        }
+        self.mark();
+        raise!(self, "unexpected token")
+    }
+
+    fn parse_loop(&mut self) -> CompileResult<IRSpan<'a>> {
+        self.expect_keyword("loop")?;
+
+        let loop_start = self.compiler.alloc_noop();
+        let loop_exit = self.compiler.alloc_noop();
+        self.parse_until_impl(loop_start, loop_start, loop_exit)
+    }
+
+    fn parse_until(&mut self) -> CompileResult<IRSpan<'a>> {
+        self.expect_keyword("until")?;
+
+        let re = self.parse_if_regex()?;
+
+        let loop_exit = self.compiler.alloc_noop();
+        re.dst_good.borrow_mut().set_next(loop_exit);
+        self.parse_until_impl(re.src, re.dst_bad, loop_exit)
+    }
+
+    fn parse_until_impl(
+        &mut self,
+        loop_start: IRCell<'a>,
+        loop_good: IRCell<'a>,
+        loop_exit: IRCell<'a>,
+    ) -> CompileResult<IRSpan<'a>> {
+        // First, save the current input offset.
+        // This is used to detect if the loop made any progress.
+        let saved_offset = self.compiler.alloc_vreg();
+        let first = self.compiler.alloc_iri(IRI::Mov {
+            dst: saved_offset,
+            src: self.compiler.get_reg(Register::InputOffset),
+        });
+
+        self.context.push(Context {
+            loop_start: Some(loop_start),
+            loop_exit: Some(loop_exit),
+            capture_groups: Vec::new_in(self.compiler.arena),
+        });
+        let block = self.parse_block()?;
+        self.context.pop();
+
+        // Force advance the input offset by 1 if it got stuck in the loop iteration.
+        //   if input_offset == saved_offset {
+        //       input_offset += 1;
+        //   }
+        let advance = self.compiler.alloc_ir(IR {
+            next: Some(first),
+            instr: IRI::AddImm { dst: self.compiler.get_reg(Register::InputOffset), imm: 1 },
+            offset: usize::MAX,
+        });
+        let advance_check = self.compiler.alloc_ir(IR {
+            next: Some(first),
+            instr: IRI::If {
+                condition: Condition::Cmp {
+                    lhs: self.compiler.get_reg(Register::InputOffset),
+                    rhs: saved_offset,
+                    op: ComparisonOp::Eq,
+                },
+                then: advance,
+            },
+            offset: usize::MAX,
+        });
+
+        // NOTE: It's crucial that we connect the block with the loop before calling collect_interesting_charset,
+        // as the until statement's regex is not part of the loop but still counts as an "interesting charset",
+        // for the purpose of skipping uninteresting characters.
+        first.borrow_mut().set_next(loop_start);
+        loop_good.borrow_mut().set_next(block.first);
+
+        // Skip any uninteresting characters before the next loop iteration.
+        //   if /.*?/ {}
+        let interesting = self.compiler.collect_interesting_charset(loop_start);
+        let fast_skip = if interesting.covers_none() {
+            advance_check
+        } else {
+            let mut skip_charset = interesting.clone();
+            skip_charset.invert();
+            let skip_charset = self.compiler.intern_charset(&skip_charset);
+            self.compiler.alloc_ir(IR {
+                next: Some(advance_check),
+                instr: IRI::If { condition: Condition::Charset(skip_charset), then: advance_check },
+                offset: usize::MAX,
+            })
+        };
+
+        if let mut block_last = block.last.borrow_mut()
+            && block_last.wants_next()
+        {
+            block_last.set_next(fast_skip);
+        }
+
+        Ok(IRSpan { first, last: loop_exit })
+    }
+
+    fn parse_break(&mut self) -> CompileResult<IRSpan<'a>> {
+        self.expect_keyword("break")?;
+        self.expect(';')?;
+
+        if let Some(exit) = self.context.last_mut().and_then(|ctx| ctx.loop_exit) {
+            let ir = self.compiler.alloc_noop();
+            ir.borrow_mut().set_next(exit);
+            Ok(IRSpan::single(ir))
+        } else {
+            raise!(self, "loop control statement outside of a loop")
+        }
+    }
+
+    fn parse_continue(&mut self) -> CompileResult<IRSpan<'a>> {
+        self.expect_keyword("continue")?;
+        self.expect(';')?;
+
+        if let Some(start) = self.context.last_mut().and_then(|ctx| ctx.loop_start) {
+            let ir = self.compiler.alloc_noop();
+            ir.borrow_mut().set_next(start);
+            Ok(IRSpan::single(ir))
+        } else {
+            raise!(self, "loop control statement outside of a loop")
+        }
+    }
+
+    fn parse_return(&mut self) -> CompileResult<IRSpan<'a>> {
+        self.expect_keyword("return")?;
+        self.expect(';')?;
+        Ok(IRSpan::single(self.compiler.alloc_iri(IRI::Return)))
+    }
+
+    fn parse_if(&mut self) -> CompileResult<IRSpan<'a>> {
+        self.expect_keyword("if")?;
+
+        if self.peek() == Some('/') {
+            self.parse_if_regex_chain()
+        } else {
+            self.parse_if_comparison()
+        }
+    }
+
+    fn parse_if_regex_chain(&mut self) -> CompileResult<IRSpan<'a>> {
+        let mut prev: Option<IRCell<'a>> = None;
+
+        // First, save the current input offset.
+        // This is used to restore the position on failed matches.
+        let save_reg = self.compiler.alloc_vreg();
+        let first = self.compiler.alloc_iri(IRI::Mov {
+            dst: save_reg,
+            src: self.compiler.get_reg(Register::InputOffset),
+        });
+
+        let last = self.compiler.alloc_noop();
+
+        loop {
+            let re = self.parse_if_regex()?;
+
+            // Push context with capture groups for the block
+            let (loop_start, loop_exit) = self
+                .context
+                .last()
+                .map(|ctx| (ctx.loop_start, ctx.loop_exit))
+                .unwrap_or((None, None));
+            self.context.push(Context { loop_start, loop_exit, capture_groups: re.capture_groups });
+            let bl = self.parse_block()?;
+            self.context.pop();
+
+            // Connect the previous else branch to form an "else if".
+            // If there's no previous one, we're in the first iteration,
+            // and so we connect it to the instruction that saves the position.
+            prev.unwrap_or(first).borrow_mut().set_next(re.src);
+
+            // Connect the if to the {}.
+            re.dst_good.borrow_mut().set_next(bl.first);
+            // Connect the end of the {} to the end of the if/else chain.
+            if let mut block_last = bl.last.borrow_mut()
+                && block_last.wants_next()
+            {
+                block_last.set_next(last);
+            }
+
+            // The "else" branch of the if needs to restore the position.
+            let dst_bad = self.compiler.alloc_iri(IRI::Mov {
+                dst: self.compiler.get_reg(Register::InputOffset),
+                src: save_reg,
+            });
+            re.dst_bad.borrow_mut().set_next(dst_bad);
+
+            // No else branch? dst_bad (= no hit) means we're done, so make that connection.
+            if !self.is_keyword("else") {
+                dst_bad.borrow_mut().set_next(last);
+                break;
+            }
+
+            // Gobble the "else" keyword.
+            self.pos += 4;
+
+            // The else branch has a block? That's our dst_bad.
+            if !self.is_keyword("if") {
+                let bl = self.parse_block()?;
+                dst_bad.borrow_mut().set_next(bl.first);
+                // Connect the end of the {} to the end of the if/else chain.
+                if let mut bl_last = bl.last.borrow_mut()
+                    && bl_last.wants_next()
+                {
+                    bl_last.set_next(last);
+                }
+                break;
+            }
+
+            // Otherwise, we expect an "if" in the next iteration to form an "else if".
+            self.expect_keyword("if")?;
+            prev = Some(dst_bad);
+        }
+
+        Ok(IRSpan { first, last })
+    }
+
+    fn parse_if_comparison(&mut self) -> CompileResult<IRSpan<'a>> {
+        // Parse: if var1 OP var2 { block } where OP is ==, !=, <, >, <=, >=
+        let lhs_name = self.read_identifier()?;
+        let lhs_vreg = self.get_variable(lhs_name)?;
+
+        self.mark();
+        let op = if self.is_str("==") {
+            self.pos += 2;
+            ComparisonOp::Eq
+        } else if self.is_str("!=") {
+            self.pos += 2;
+            ComparisonOp::Ne
+        } else if self.is_str("<=") {
+            self.pos += 2;
+            ComparisonOp::Le
+        } else if self.is_str(">=") {
+            self.pos += 2;
+            ComparisonOp::Ge
+        } else if self.is_str("<") {
+            self.pos += 1;
+            ComparisonOp::Lt
+        } else if self.is_str(">") {
+            self.pos += 1;
+            ComparisonOp::Gt
+        } else {
+            raise!(self, "expected comparison operator (==, !=, <, >, <=, >=)")
+        };
+
+        let rhs_name = self.read_identifier()?;
+        let rhs_vreg = self.get_variable(rhs_name)?;
+
+        let dst_good = self.compiler.alloc_noop();
+        let dst_bad = self.compiler.alloc_noop();
+        let cmp = self.compiler.alloc_ir(IR {
+            next: Some(dst_bad),
+            instr: IRI::If {
+                condition: Condition::Cmp { lhs: lhs_vreg, rhs: rhs_vreg, op },
+                then: dst_good,
+            },
+            offset: usize::MAX,
+        });
+
+        let bl = self.parse_block()?;
+        dst_good.borrow_mut().set_next(bl.first);
+
+        let end = self.compiler.alloc_noop();
+
+        // Handle optional else branch
+        if self.is_keyword("else") {
+            self.pos += 4;
+
+            // Check for else if
+            if self.is_keyword("if") {
+                let else_if_span = self.parse_if()?;
+                dst_bad.borrow_mut().set_next(else_if_span.first);
+                if let mut block_last = bl.last.borrow_mut()
+                    && block_last.wants_next()
+                {
+                    block_last.set_next(end);
+                }
+                if let mut else_if_last = else_if_span.last.borrow_mut()
+                    && else_if_last.wants_next()
+                {
+                    else_if_last.set_next(end);
+                }
+                Ok(IRSpan { first: cmp, last: end })
+            } else {
+                let else_bl = self.parse_block()?;
+                dst_bad.borrow_mut().set_next(else_bl.first);
+                if let mut block_last = bl.last.borrow_mut()
+                    && block_last.wants_next()
+                {
+                    block_last.set_next(end);
+                }
+                if let mut else_last = else_bl.last.borrow_mut()
+                    && else_last.wants_next()
+                {
+                    else_last.set_next(end);
+                }
+                Ok(IRSpan { first: cmp, last: end })
+            }
+        } else {
+            dst_bad.borrow_mut().set_next(end);
+            if let mut block_last = bl.last.borrow_mut()
+                && block_last.wants_next()
+            {
+                block_last.set_next(end);
+            }
+            Ok(IRSpan { first: cmp, last: end })
+        }
+    }
+
+    fn parse_if_regex(&mut self) -> CompileResult<RegexSpan<'a>> {
+        let pattern = self.read_regex()?;
+        let dst_good = self.compiler.alloc_noop();
+        let dst_bad = self.compiler.alloc_noop();
+        let mut capture_groups = Vec::new_in(self.compiler.arena);
+        let src = match regex::parse(self.compiler, pattern, dst_good, dst_bad, &mut capture_groups)
+        {
+            Ok(s) => s,
+            Err(e) => raise!(self, "{}", e),
+        };
+
+        Ok(RegexSpan { src, dst_good, dst_bad, capture_groups })
+    }
+
+    fn parse_await(&mut self) -> CompileResult<IRSpan<'a>> {
+        self.expect_keyword("await")?;
+
+        let ident = self.read_identifier()?;
+        if ident != "input" {
+            raise!(self, "expected 'input' after await");
+        }
+
+        self.expect(';')?;
+
+        let ir = self.compiler.alloc_iri(IRI::AwaitInput);
+        Ok(IRSpan::single(ir))
+    }
+
+    fn parse_yield(&mut self) -> CompileResult<IRSpan<'a>> {
+        self.expect_keyword("yield")?;
+
+        // Check if this is a capture group reference: yield $n as color
+        if self.peek() == Some('$') {
+            self.pos += 1;
+            let capture_index = self.read_integer()? as usize - 1;
+
+            // Expect "as"
+            let kw = self.read_identifier()?;
+            if kw != "as" {
+                raise!(self, "expected 'as' after capture group reference");
+            }
+
+            let color = self.read_identifier()?;
+            let kind = self.compiler.intern_highlight_kind(color).value;
+            self.expect(';')?;
+
+            let (start_vreg, end_vreg) = match self.context.last() {
+                Some(ctx) if capture_index < ctx.capture_groups.len() => {
+                    ctx.capture_groups[capture_index]
+                }
+                Some(_) => raise!(
+                    self,
+                    "capture group ${} not found in current context",
+                    capture_index + 1
+                ),
+                None => raise!(self, "no regex context available for capture group reference"),
+            };
+
+            let kind_vreg = self.compiler.alloc_vreg();
+
+            let span = self
+                .compiler
+                .build_chain()
+                // Set HighlightStart to the start of the capture group
+                .append(IRI::Mov {
+                    dst: self.compiler.get_reg(Register::HighlightStart),
+                    src: start_vreg,
+                })
+                // Set HighlightKind to the color
+                .append(IRI::MovKind { dst: kind_vreg, kind })
+                // Set InputOffset to the end of the capture group and flush
+                .append(IRI::Mov {
+                    dst: self.compiler.get_reg(Register::InputOffset),
+                    src: end_vreg,
+                })
+                .append(IRI::Flush { kind: kind_vreg })
+                .build();
+            Ok(span)
+        } else {
+            // Normal yield: yield color;
+            let color = self.read_identifier()?;
+            let kind = self.compiler.intern_highlight_kind(color).value;
+
+            self.expect(';')?;
+
+            let vreg = self.compiler.alloc_vreg();
+            let span = self
+                .compiler
+                .build_chain()
+                .append(IRI::MovKind { dst: vreg, kind })
+                .append(IRI::Flush { kind: vreg })
+                .build();
+            Ok(span)
+        }
+    }
+
+    fn parse_var_declaration(&mut self) -> CompileResult<IRSpan<'a>> {
+        self.expect_keyword("var")?;
+
+        let name = self.read_identifier()?;
+        self.expect('=')?;
+        let (expr, vreg) = self.parse_expression()?;
+        self.expect(';')?;
+
+        match self.variables.entry(name) {
+            Entry::Vacant(e) => _ = e.insert(vreg),
+            Entry::Occupied(_) => raise!(self, "variable '{}' already declared", name),
+        }
+
+        Ok(expr)
+    }
+
+    fn parse_identifier_stmt(&mut self) -> CompileResult<IRSpan<'a>> {
+        let name = self.read_identifier()?;
+
+        match self.peek() {
+            // foo();
+            Some('(') => {
+                self.pos += 1;
+                self.expect(')')?;
+                self.expect(';')?;
+                let name = self.compiler.strings.intern(self.compiler.arena, name);
+                Ok(IRSpan::single(self.compiler.alloc_iri(IRI::Call { name })))
+            }
+            // foo = expr;
+            Some('=') if !self.is_str("==") => {
+                self.pos += 1;
+                let (expr, vreg) = self.parse_expression()?;
+                self.expect(';')?;
+                self.variables.insert(name, vreg);
+                Ok(expr)
+            }
+            // foo += expr;
+            Some('+') if self.is_str("+=") => {
+                let lhs_vreg = self.get_variable(name)?;
+                self.pos += 2;
+
+                let val = self.read_integer()?;
+                self.expect(';')?;
+
+                let ir = self.compiler.alloc_iri(IRI::AddImm { dst: lhs_vreg, imm: val });
+                self.variables.insert(name, lhs_vreg);
+                Ok(IRSpan::single(ir))
+            }
+            _ => {
+                self.mark();
+                raise!(self, "expected '(', '=' or '+=' after identifier")
+            }
+        }
+    }
+
+    fn parse_expression(&mut self) -> CompileResult<(IRSpan<'a>, IRRegCell<'a>)> {
+        self.mark();
+        let (lhs_span, lhs_vreg) = match self.peek() {
+            Some('0'..='9') => {
+                let val = self.read_integer()?;
+                let vreg = self.compiler.alloc_vreg();
+                let ir = self.compiler.alloc_iri(IRI::MovImm { dst: vreg, imm: val });
+                (IRSpan::single(ir), vreg)
+            }
+            Some(c) if Self::is_ident_start(c) => {
+                let name = self.read_identifier()?;
+                let vreg = self.get_variable(name)?;
+                (IRSpan::single(self.compiler.alloc_noop()), vreg)
+            }
+            _ => raise!(self, "expected integer or identifier in expression"),
+        };
+
+        // Check for binary operator
+        if self.peek() == Some('+') && !self.is_str("+=") {
+            self.pos += 1;
+
+            // Parse right-hand side - only integer literals supported
+            let val = self.read_integer()?;
+            let add_ir = self.compiler.alloc_iri(IRI::AddImm { dst: lhs_vreg, imm: val });
+            lhs_span.last.borrow_mut().set_next(add_ir);
+            Ok((IRSpan { first: lhs_span.first, last: add_ir }, lhs_vreg))
+        } else if lhs_vreg.borrow().physical.is_some() {
+            // For expressions of type `var virtual = phyiscal;`, we need to ensure
+            // that we actually copy the physical register into a new virtual one.
+            // The remaining code assumes single assignment form, while physical registers are permanent.
+            let dst = self.compiler.alloc_vreg();
+            let node = self.compiler.alloc_iri(IRI::Mov { dst, src: lhs_vreg });
+            Ok((IRSpan::single(node), dst))
+        } else {
+            Ok((lhs_span, lhs_vreg))
+        }
+    }
+
+    fn get_variable(&self, name: &str) -> CompileResult<IRRegCell<'a>> {
+        match self.variables.get(name) {
+            Some(&reg) => Ok(reg),
+            None => raise!(self, "undefined variable '{}'", name),
+        }
+    }
+
+    //
+    // vvv Tokenization helpers start here vvv
+    //
+
+    fn is_ident_start(ch: char) -> bool {
+        ch.is_ascii_alphabetic() || ch == '_'
+    }
+
+    fn is_ident_char(ch: char) -> bool {
+        ch.is_ascii_alphanumeric() || ch == '_' || ch == '.'
+    }
+
+    fn rest(&self) -> &'src str {
+        &self.src[self.pos..]
+    }
+
+    fn skip_whitespace_comments(&mut self) {
+        loop {
+            let rest = self.rest();
+            let trimmed = rest.trim_ascii_start();
+            self.pos = self.src.len() - trimmed.len();
+
+            if let Some(after_comment) = trimmed.strip_prefix("//") {
+                self.pos += 2 + after_comment.find('\n').unwrap_or(after_comment.len());
+            } else {
+                break;
+            }
+        }
+    }
+
+    fn peek(&mut self) -> Option<char> {
+        self.skip_whitespace_comments();
+        self.rest().chars().next()
+    }
+
+    fn is_str(&self, s: &str) -> bool {
+        self.rest().starts_with(s)
+    }
+
+    fn is_at_eof(&mut self) -> bool {
+        self.skip_whitespace_comments();
+        self.pos >= self.src.len()
+    }
+
+    /// Mark current position for error reporting.
+    fn mark(&mut self) {
+        self.skip_whitespace_comments();
+        self.token_start = self.pos;
+    }
+
+    fn position(&self) -> (usize, usize) {
+        let before = &self.src[..self.token_start];
+        let line = before.bytes().filter(|&b| b == b'\n').count() + 1;
+        let column = before.rfind('\n').map_or(before.len(), |i| before.len() - i - 1) + 1;
+        (line, column)
+    }
+
+    fn expect(&mut self, ch: char) -> CompileResult<()> {
+        self.mark();
+        if self.rest().starts_with(ch) {
+            self.pos += ch.len_utf8();
+            Ok(())
+        } else {
+            raise!(self, "expected '{}'", ch)
+        }
+    }
+
+    fn expect_keyword(&mut self, kw: &str) -> CompileResult<()> {
+        self.mark();
+        if let Some(rest) = self.rest().strip_prefix(kw)
+            && !rest.chars().next().is_some_and(Self::is_ident_char)
+        {
+            self.pos += kw.len();
+            Ok(())
+        } else {
+            raise!(self, "expected '{}'", kw)
+        }
+    }
+
+    /// Check if next token is keyword (without consuming).
+    fn is_keyword(&mut self, kw: &str) -> bool {
+        self.skip_whitespace_comments();
+        self.rest()
+            .strip_prefix(kw)
+            .is_some_and(|rest| !rest.chars().next().is_some_and(Self::is_ident_char))
+    }
+
+    fn read_identifier(&mut self) -> CompileResult<&'src str> {
+        self.mark();
+        let start = self.pos;
+
+        if !self.rest().chars().next().is_some_and(Self::is_ident_start) {
+            raise!(self, "expected identifier");
+        }
+
+        let rest = self.rest();
+        let len = rest.find(|c| !Self::is_ident_char(c)).unwrap_or(rest.len());
+        self.pos += len;
+        Ok(&self.src[start..self.pos])
+    }
+
+    fn read_integer(&mut self) -> CompileResult<u32> {
+        self.mark();
+        let start = self.pos;
+
+        let rest = self.rest();
+        let len = rest.find(|c: char| !c.is_ascii_digit()).unwrap_or(rest.len());
+        self.pos += len;
+
+        if start == self.pos {
+            raise!(self, "expected integer");
+        }
+
+        self.src[start..self.pos].parse().map_err(|_| {
+            let path = self.path.to_string();
+            let (line, column) = self.position();
+            CompileError { path, line, column, message: "invalid integer".to_string() }
+        })
+    }
+
+    fn read_string(&mut self) -> CompileResult<&'src str> {
+        self.mark();
+        self.expect('"')?;
+        let start = self.pos;
+        let end = self.find_closing_delimiter(b'"');
+        self.pos = end;
+        self.expect('"')?;
+        Ok(&self.src[start..end])
+    }
+
+    fn read_regex(&mut self) -> CompileResult<&'src str> {
+        self.mark();
+        self.expect('/')?;
+        let start = self.pos;
+        let end = self.find_closing_delimiter(b'/');
+        self.pos = end;
+        self.expect('/')?;
+        Ok(&self.src[start..end])
+    }
+
+    /// Find unescaped closing delimiter (handles `\x` escapes).
+    fn find_closing_delimiter(&self, delim: u8) -> usize {
+        let bytes = self.rest().as_bytes();
+        let mut i = 0;
+        while i < bytes.len() {
+            match bytes[i] {
+                b'\\' => i += 2,
+                b if b == delim => return self.pos + i,
+                _ => i += 1,
+            }
+        }
+        self.pos + bytes.len()
+    }
+}
diff --git a/crates/lsh/src/compiler/generator.rs b/crates/lsh/src/compiler/generator.rs
new file mode 100644
index 00000000000..b97b7eb0ab4
--- /dev/null
+++ b/crates/lsh/src/compiler/generator.rs
@@ -0,0 +1,314 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Code generators for different output formats.
+//!
+//! ## TODO
+//!
+//! - The label lookup (with a `HashMap`) is just plain dumb.
+//!   The backend should emit metadata, I think.
+
+use std::collections::HashMap;
+use std::ffi::OsStr;
+use std::fs::read_dir;
+use std::io;
+use std::path::PathBuf;
+
+use stdext::arena::scratch_arena;
+
+use super::*;
+use crate::runtime::{Instruction, MnemonicFormattingConfig};
+
+pub struct Generator<'a> {
+    compiler: Compiler<'a>,
+}
+
+impl<'a> Generator<'a> {
+    pub fn new(arena: &'a Arena) -> Self {
+        Self { compiler: Compiler::new(arena) }
+    }
+
+    pub fn read_file(&mut self, path: &Path) -> CompileResult<()> {
+        let path_str = path.display().to_string();
+        match std::fs::read_to_string(path) {
+            Ok(src) => self.compiler.parse(&path_str, &src),
+            Err(e) => {
+                Err(CompileError { path: path_str, line: 0, column: 0, message: e.to_string() })
+            }
+        }
+    }
+
+    pub fn read_directory(&mut self, path: &Path) -> CompileResult<()> {
+        let files = Self::read_dir_to_vec(path).map_err(|e| CompileError {
+            path: path.display().to_string(),
+            line: 0,
+            column: 0,
+            message: e.to_string(),
+        })?;
+
+        for path in files {
+            if path.extension() == Some(OsStr::new("lsh")) {
+                self.read_file(&path)?;
+            }
+        }
+        Ok(())
+    }
+
+    fn read_dir_to_vec(path: &Path) -> io::Result<Vec<PathBuf>> {
+        let mut paths = Vec::new();
+
+        for entry in read_dir(path)? {
+            let entry = entry?;
+            if entry.metadata().is_ok_and(|f| f.is_file())
+                && entry.file_name().as_encoded_bytes().ends_with(b".lsh")
+            {
+                paths.push(entry.path());
+            }
+        }
+
+        paths.sort_unstable();
+        Ok(paths)
+    }
+
+    pub fn assemble(mut self) -> CompileResult<Assembly<'a>> {
+        self.compiler.assemble()
+    }
+
+    pub fn generate_assembly(mut self, vt: bool) -> CompileResult<String> {
+        let mut output = String::new();
+        let assembly = self.compiler.assemble()?;
+        let line_num_width = assembly.instructions.len().checked_ilog10().unwrap_or(0) as usize + 1;
+        let mnemonic_config = if vt {
+            MnemonicFormattingConfig {
+                instruction_prefix: "\x1b[33m", // yellow
+                instruction_suffix: "\x1b[39m", // default
+
+                register_prefix: "\x1b[32m", // green
+                register_suffix: "\x1b[39m",
+
+                address_prefix: "\x1b[90m", // bright black
+                address_suffix: "\x1b[39m",
+
+                numeric_prefix: "\x1b[36m", // cyan
+                numeric_suffix: "\x1b[39m",
+            }
+        } else {
+            Default::default()
+        };
+        let label_prefix = if vt { "\x1b[4;94m" } else { "" }; // underlined & bright blue
+        let label_suffix = if vt { "\x1b[m" } else { "" };
+        let line_prefix = if vt { "\x1b[90m" } else { "" }; // bright black
+        let comment_prefix = if vt { "\x1b[32m" } else { "" }; // green
+        let comment_suffix = if vt { "\x1b[39m" } else { "" };
+
+        // TODO: This is kind of stupid. There should be per-instruction annotations.
+        let labels: HashMap<usize, &str> =
+            assembly.entrypoints.iter().map(|ep| (ep.address, ep.name.as_str())).collect();
+
+        let mut off = 0;
+        while off < assembly.instructions.len() {
+            if let Some(label) = labels.get(&off) {
+                if off != 0 {
+                    output.push('\n');
+                }
+                _ = writeln!(output, "{label_prefix}{}:{label_suffix}", label);
+            }
+
+            let (Some(instr), len) = Instruction::decode(&assembly.instructions[off..]) else {
+                break;
+            };
+            let mnemonic_width = match instr {
+                Instruction::JumpIfMatchCharset { .. }
+                | Instruction::JumpIfMatchPrefix { .. }
+                | Instruction::JumpIfMatchPrefixInsensitive { .. } => {
+                    if vt {
+                        60
+                    } else {
+                        30
+                    }
+                }
+                _ => 0,
+            };
+
+            let scratch = scratch_arena(None);
+            _ = write!(
+                output,
+                "{line_prefix}{off:>line_num_width$}:  {mnemonic:mnemonic_width$}",
+                mnemonic = instr.mnemonic(&scratch, &mnemonic_config),
+            );
+
+            match instr {
+                Instruction::JumpIfMatchCharset { idx, .. } => {
+                    _ = write!(
+                        output,
+                        " {comment_prefix}// {:?}{comment_suffix}",
+                        assembly.charsets[idx as usize]
+                    )
+                }
+                Instruction::JumpIfMatchPrefix { idx, .. }
+                | Instruction::JumpIfMatchPrefixInsensitive { idx, .. } => {
+                    _ = write!(
+                        output,
+                        " {comment_prefix}// {:?}{comment_suffix}",
+                        assembly.strings[idx as usize]
+                    )
+                }
+                _ => {}
+            }
+
+            output.push('\n');
+            off += len;
+        }
+
+        Ok(output)
+    }
+
+    pub fn generate_rust(mut self) -> CompileResult<String> {
+        let assembly = self.compiler.assemble()?;
+
+        let mut output = String::new();
+        output.push_str("// This file is auto-generated. Do not edit it manually.\n\n");
+        output.push_str("use lsh::runtime::Language;\n\n");
+
+        output.push_str("#[derive(Debug, Clone, Copy, PartialEq, Eq)]\npub enum HighlightKind {\n");
+        let members: Vec<_> = assembly
+            .highlight_kinds
+            .iter()
+            .map(|hk| (hk, format!("{} = {},", hk.fmt_camelcase(), hk.value)))
+            .collect();
+        let width = members.iter().map(|s| s.1.len()).max().unwrap_or(0);
+        for (hk, member) in members {
+            _ = writeln!(output, "    {member:<width$} // {}", hk.identifier);
+        }
+        output.push_str("}\n");
+
+        if let Some(last) = assembly.highlight_kinds.last() {
+            _ = write!(
+                output,
+                "
+impl TryFrom<u32> for HighlightKind {{
+    type Error = ();
+
+    #[inline]
+    fn try_from(value: u32) -> Result<Self, Self::Error> {{
+        if value <= Self::{} as u32 {{
+            Ok(unsafe {{ std::mem::transmute::<u8, Self>(value as u8) }})
+        }} else {{
+            Err(())
+        }}
+    }}
+}}
+",
+                last.fmt_camelcase()
+            );
+        }
+
+        output.push_str("/*\n");
+        output.push_str(&self.compiler.as_mermaid());
+        output.push_str("*/\n");
+
+        output.push_str("\n#[rustfmt::skip] pub const LANGUAGES: &[Language] = &[\n");
+        for ep in &assembly.entrypoints {
+            _ = writeln!(
+                output,
+                "    Language {{ id: {:?}, name: {:?}, entrypoint: {} }},",
+                ep.name, ep.display_name, ep.address
+            );
+        }
+        output.push_str("];\n");
+
+        output.push_str(
+            "\n#[rustfmt::skip] pub const FILE_ASSOCIATIONS: &[(&str, &Language)] = &[\n",
+        );
+        for (idx, ep) in assembly.entrypoints.iter().enumerate() {
+            for path in &ep.paths {
+                _ = writeln!(output, "    ({path:?}, &LANGUAGES[{idx}]),");
+            }
+        }
+        output.push_str("];\n");
+
+        _ = writeln!(
+            output,
+            "\n#[rustfmt::skip] pub const ASSEMBLY: [u8; {len}] = [",
+            len = assembly.instructions.len() + Instruction::MAX_ENCODED_SIZE,
+        );
+        let line_num_width = assembly.instructions.len().checked_ilog10().unwrap_or(0) as usize + 1;
+
+        // TODO: This is kind of stupid. There should be per-instruction annotations.
+        let labels: HashMap<usize, &str> =
+            assembly.entrypoints.iter().map(|ep| (ep.address, ep.name.as_str())).collect();
+
+        let mut off = 0;
+        while off < assembly.instructions.len() {
+            if let Some(label) = labels.get(&off) {
+                if off != 0 {
+                    output.push('\n');
+                }
+                _ = writeln!(output, "    // {}:", label);
+            }
+
+            output.push_str("    ");
+
+            let (instr, len) = Instruction::decode(&assembly.instructions[off..]);
+            let scratch = scratch_arena(None);
+            for i in 0..len {
+                _ = write!(output, "0x{:02x}, ", assembly.instructions[off + i]);
+            }
+
+            if let Some(instr) = instr {
+                _ = writeln!(
+                    output,
+                    "{:<padding_width$}// {off:>line_num_width$}:  {mnemonic}",
+                    "",
+                    padding_width = Instruction::MAX_ENCODED_SIZE.saturating_sub(len) * 6,
+                    mnemonic = instr.mnemonic(&scratch, &Default::default())
+                );
+            } else {
+                output.push('\n');
+            }
+
+            off += len;
+        }
+        // Normally the runtime would need to do bounds checks at all times to be safe,
+        // since there may be malformed bytecode (e.g. a bug in this compiler).
+        // We can fix that by padding the instruction stream with invalid opcodes at the end.
+        // This works as long as the runtime checks for valid opcodes. Even if the last valid
+        // opcode is chopped off (due to a bug above), the runtime can do an unchecked read
+        // of `MAX_ENCODED_SIZE` bytes without risking OOB access.
+        output.push_str("\n    // padding\n");
+        for _ in 0..Instruction::MAX_ENCODED_SIZE {
+            _ = writeln!(output, "    0xff,");
+        }
+        output.push_str("];\n");
+
+        _ = writeln!(
+            output,
+            "\n#[rustfmt::skip] pub const CHARSETS: [[u16; 16]; {len}] = [",
+            len = assembly.charsets.len(),
+        );
+        for cs in assembly.charsets {
+            let cs = cs.serialize();
+            output.push_str("    [");
+            for (i, &v) in cs.iter().enumerate() {
+                if i != 0 {
+                    _ = write!(output, ", ");
+                }
+                _ = write!(output, "0x{v:04x}");
+            }
+            output.push_str("],\n");
+        }
+        output.push_str("];\n");
+
+        _ = writeln!(
+            output,
+            "\n#[rustfmt::skip] pub const STRINGS: [&str; {len}] = [",
+            len = assembly.strings.len(),
+        );
+        for s in assembly.strings {
+            _ = writeln!(output, "    {s:?},");
+        }
+        output.push_str("];\n");
+
+        Ok(output)
+    }
+}
diff --git a/crates/lsh/src/compiler/mod.rs b/crates/lsh/src/compiler/mod.rs
new file mode 100644
index 00000000000..321547a73f5
--- /dev/null
+++ b/crates/lsh/src/compiler/mod.rs
@@ -0,0 +1,572 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Compiler core: IR definitions, instruction encoding, and shared infrastructure.
+//!
+//! ## IR representation
+//!
+//! The IR is a graph of `RefCell<IR>` nodes linked via `next` and `then` pointers.
+//! This isn't a traditional SSA or basic block representation - it's more like a
+//! flowchart where each node is one instruction. The `offset` field is set during
+//! codegen to the final bytecode address.
+//!
+//! ## Register architecture
+//!
+//! The `IRReg.physical` field starts as `None` for vregs and gets filled in by regalloc.
+//! For physical registers, it's set during `Compiler::new()`.
+//!
+//! ## Charset representation
+//!
+//! `Charset` is a 256-bit bitmap (`[bool; 256]`). The runtime uses a transposed `[u16; 16]`
+//! layout for SIMD reasons - see `generator.rs` where the conversion happens.
+//!
+//! ## Instruction encoding
+//!
+//! Variable-length encoding, 1-9 bytes per instruction. See `Instruction::encode/decode`.
+//! The `address_offset()` method returns where within an instruction the jump target lives,
+//! used by the backend's relocation system.
+//!
+//! ## Quirks
+//!
+//! - `TreeVisitor` does BFS, which is fine for iteration but *not* for linearization.
+//!   The backend has its own DFS traversal for liveness analysis.
+
+mod backend;
+mod charset;
+mod frontend;
+mod generator;
+mod optimizer;
+mod regex;
+
+use std::cell::{Cell, RefCell};
+use std::collections::{HashSet, VecDeque};
+use std::fmt;
+use std::fmt::Write as _;
+use std::mem::zeroed;
+use std::path::Path;
+
+use stdext::arena::{Arena, ArenaString};
+
+pub use self::charset::{Charset, SerializedCharset};
+use self::frontend::*;
+pub use self::generator::Generator;
+use crate::runtime::Register;
+
+pub fn builtin_definitions_path() -> &'static Path {
+    #[cfg(windows)]
+    let path = concat!(env!("CARGO_MANIFEST_DIR"), "\\definitions");
+    #[cfg(not(windows))]
+    let path = concat!(env!("CARGO_MANIFEST_DIR"), "/definitions");
+    Path::new(path)
+}
+
+pub type CompileResult<T> = Result<T, CompileError>;
+
+#[derive(Debug)]
+pub struct CompileError {
+    pub path: String,
+    pub line: usize,
+    pub column: usize,
+    pub message: String,
+}
+
+impl std::error::Error for CompileError {}
+
+impl fmt::Display for CompileError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "error at {}:{}:{}: {}", self.path, self.line, self.column, self.message)
+    }
+}
+
+pub struct Compiler<'a> {
+    arena: &'a Arena,
+    physical_registers: [IRRegCell<'a>; Register::COUNT],
+    functions: Vec<Function<'a>>,
+    charsets: Vec<&'a Charset>,
+    strings: Vec<&'a str>,
+    highlight_kinds: Vec<HighlightKind<'a>>,
+    next_vreg_id: Cell<u32>,
+}
+
+impl<'a> Compiler<'a> {
+    pub fn new(arena: &'a Arena) -> Self {
+        #[allow(invalid_value)]
+        let mut s = Self {
+            arena,
+            physical_registers: unsafe { zeroed() },
+            functions: Default::default(),
+            charsets: Default::default(),
+            strings: Default::default(),
+            highlight_kinds: vec![HighlightKind { identifier: "other", value: 0 }],
+            next_vreg_id: Cell::new(0),
+        };
+
+        for i in 0..Register::COUNT {
+            let reg = s.alloc_vreg();
+            reg.borrow_mut().physical = Some(Register::from_usize(i));
+            s.physical_registers[i] = reg;
+        }
+
+        s
+    }
+
+    pub fn parse<'src>(&mut self, path: &'src str, src: &'src str) -> CompileResult<()> {
+        let mut parser = Parser::new(self, path, src);
+        parser.run()?;
+        Ok(())
+    }
+
+    pub fn assemble(&mut self) -> CompileResult<Assembly<'a>> {
+        optimizer::optimize(self);
+        backend::Backend::new().compile(self)
+    }
+
+    fn alloc_ir(&self, ir: IR<'a>) -> IRCell<'a> {
+        self.arena.alloc_uninit().write(RefCell::new(ir))
+    }
+
+    fn alloc_iri(&self, instr: IRI<'a>) -> IRCell<'a> {
+        self.arena.alloc_uninit().write(RefCell::new(IR { next: None, instr, offset: usize::MAX }))
+    }
+
+    fn alloc_noop(&self) -> IRCell<'a> {
+        self.alloc_iri(IRI::Noop)
+    }
+
+    fn build_chain<'s>(&'s self) -> IRChainBuilder<'a, 's> {
+        IRChainBuilder { compiler: self, span: None }
+    }
+
+    fn get_reg(&self, reg: Register) -> IRRegCell<'a> {
+        self.physical_registers[reg as usize]
+    }
+
+    fn alloc_vreg(&self) -> IRRegCell<'a> {
+        let id = self.next_vreg_id.get();
+        self.next_vreg_id.set(id + 1);
+        self.arena.alloc_uninit().write(RefCell::new(IRReg::new(id)))
+    }
+
+    fn intern_charset(&mut self, charset: &Charset) -> &'a Charset {
+        self.charsets.intern(self.arena, charset)
+    }
+
+    fn intern_string(&mut self, s: &str) -> &'a str {
+        self.strings.intern(self.arena, s)
+    }
+
+    fn intern_highlight_kind(&mut self, identifier: &str) -> &HighlightKind<'a> {
+        let idx = match self.highlight_kinds.binary_search_by(|hk| hk.identifier.cmp(identifier)) {
+            Ok(idx) => idx,
+            Err(idx) => {
+                let identifier = arena_clone_str(self.arena, identifier);
+                let value = self.highlight_kinds.len() as u32;
+                self.highlight_kinds.insert(idx, HighlightKind { identifier, value });
+                idx
+            }
+        };
+        &self.highlight_kinds[idx]
+    }
+
+    fn visit_nodes_from(&self, root: IRCell<'a>) -> TreeVisitor<'a> {
+        let mut stack = VecDeque::new();
+        stack.push_back(root);
+        TreeVisitor { current: None, stack, visited: Default::default() }
+    }
+
+    /// Collect all "interesting" characters from conditions in a loop body.
+    /// Returns a charset where true = interesting character that should be checked.
+    fn collect_interesting_charset(&self, loop_body: IRCell<'a>) -> Charset {
+        let mut charset = Charset::no();
+        let mut visited = HashSet::new();
+
+        for node in self.visit_nodes_from(loop_body) {
+            let node_ptr = node as *const _;
+            if !visited.insert(node_ptr) {
+                continue;
+            }
+
+            if let IRI::If { condition, .. } = node.borrow().instr {
+                match condition {
+                    Condition::Cmp { .. } => {}
+                    Condition::EndOfLine => {}
+                    Condition::Charset(cs) => {
+                        // Merge this charset
+                        charset.merge(cs);
+                    }
+                    Condition::Prefix(s) | Condition::PrefixInsensitive(s) => {
+                        // First character of the prefix is interesting
+                        if let Some(&b) = s.as_bytes().first() {
+                            charset.set(b, true);
+                            if matches!(condition, Condition::PrefixInsensitive(_)) {
+                                charset.set(b.to_ascii_uppercase(), true);
+                                charset.set(b.to_ascii_lowercase(), true);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        charset
+    }
+
+    pub fn as_mermaid(&self) -> String {
+        let mut output = String::new();
+
+        // ---
+        // config:
+        // layout: elk
+        // elk:
+        //   considerModelOrder: NONE
+        // ---
+        output.push_str("flowchart TB\n");
+
+        for func in &self.functions {
+            _ = writeln!(output, "  subgraph {}", func.name);
+            _ = writeln!(output, "    direction TB");
+            _ = writeln!(
+                output,
+                "    {}_start@{{shape: start}} --> {}",
+                func.name,
+                func.body.borrow()
+            );
+
+            let mut visited = HashSet::new();
+            let mut to_visit = vec![func.body];
+
+            while let Some(node_cell) = to_visit.pop() {
+                if !visited.insert(node_cell.as_ptr()) {
+                    continue;
+                }
+
+                let node = node_cell.borrow();
+                let offset = node.offset;
+                _ = write!(output, "    {}", node);
+
+                match node.instr {
+                    IRI::Noop => {
+                        _ = write!(output, "[{offset}: noop]");
+                    }
+                    IRI::Mov { dst, src } => {
+                        let src = src.borrow();
+                        let dst = dst.borrow();
+                        _ = write!(output, "[\"{offset}: {dst:?} = {src:?}\"]");
+                    }
+                    IRI::MovImm { dst, imm } => {
+                        let dst = dst.borrow();
+                        _ = write!(output, "[\"{offset}: {dst:?} = {imm}\"]");
+                    }
+                    IRI::MovKind { dst, kind } => {
+                        let dst = dst.borrow();
+                        let kind = self
+                            .highlight_kinds
+                            .iter()
+                            .find(|hk| hk.value == kind)
+                            .map_or("???", |hk| hk.identifier);
+                        _ = write!(output, "[\"{offset}: {dst:?} = {kind}\"]");
+                    }
+                    IRI::AddImm { dst, imm } => {
+                        let dst = dst.borrow();
+                        _ = write!(output, "[\"{offset}: {dst:?} += {imm}\"]");
+                    }
+                    IRI::If { condition, then } => {
+                        _ = write!(output, "{{\"{offset}: ");
+                        _ = match condition {
+                            Condition::Cmp { lhs, rhs, op } => {
+                                let op_str = match op {
+                                    ComparisonOp::Eq => "==",
+                                    ComparisonOp::Ne => "!=",
+                                    ComparisonOp::Lt => "<",
+                                    ComparisonOp::Gt => ">",
+                                    ComparisonOp::Le => "<=",
+                                    ComparisonOp::Ge => ">=",
+                                };
+                                write!(output, "{lhs:?} {op_str} {rhs:?}")
+                            }
+                            Condition::EndOfLine => write!(output, "eol"),
+                            Condition::Charset(cs) => write!(output, "charset: {cs:?}"),
+                            Condition::Prefix(s) => write!(output, "match: {s}"),
+                            Condition::PrefixInsensitive(s) => write!(output, "imatch: {s}"),
+                        };
+                        _ = writeln!(output, "\"}}");
+                        _ = writeln!(output, "    {} -->|yes| {}", node, then.borrow());
+                        to_visit.push(then);
+                    }
+                    IRI::Call { name } => {
+                        _ = write!(output, "[\"{offset}: call {name}\"]");
+                    }
+                    IRI::Return => {
+                        _ = write!(output, "[{offset}: return]");
+                    }
+                    IRI::Flush { kind } => {
+                        _ = write!(output, "[{offset}: flush {kind:?}]");
+                    }
+                    IRI::AwaitInput => {
+                        _ = write!(output, "[{offset}: await input]");
+                    }
+                }
+
+                match node.instr {
+                    IRI::If { .. } => {
+                        if let Some(next) = node.next {
+                            _ = writeln!(output, "    {} -->|no| {}", node, next.borrow());
+                        }
+                    }
+                    _ => {
+                        if let Some(next) = node.next {
+                            _ = writeln!(output, " --> {}", next.borrow());
+                        } else {
+                            _ = writeln!(output);
+                        }
+                    }
+                }
+
+                if let Some(next) = node.next {
+                    to_visit.push(next);
+                }
+            }
+
+            _ = writeln!(output, "  end");
+        }
+
+        output
+    }
+}
+
+struct TreeVisitor<'a> {
+    current: Option<IRCell<'a>>,
+    stack: VecDeque<IRCell<'a>>,
+    visited: HashSet<*const RefCell<IR<'a>>>,
+}
+
+impl<'a> Iterator for TreeVisitor<'a> {
+    type Item = IRCell<'a>;
+
+    fn next(&mut self) -> Option<Self::Item> {
+        if let Some(cell) = self.current.take() {
+            {
+                let ir = cell.borrow();
+                if let IRI::If { then, .. } = ir.instr {
+                    self.stack.push_back(then);
+                }
+                if let Some(next) = ir.next {
+                    self.stack.push_back(next);
+                }
+            }
+        }
+
+        while let Some(cell) = self.stack.pop_front() {
+            if self.visited.insert(cell) {
+                self.current = Some(cell);
+                return self.current;
+            }
+        }
+
+        None
+    }
+}
+
+pub struct Assembly<'a> {
+    pub instructions: Vec<u8>,
+    pub entrypoints: Vec<Entrypoint>,
+    pub charsets: Vec<&'a Charset>,
+    pub strings: Vec<&'a str>,
+    pub highlight_kinds: Vec<HighlightKind<'a>>,
+}
+
+pub struct Entrypoint {
+    pub name: String,
+    pub display_name: String,
+    pub paths: Vec<String>,
+    pub address: usize,
+}
+
+#[derive(Clone)]
+pub struct HighlightKind<'a> {
+    pub identifier: &'a str,
+    pub value: u32,
+}
+
+impl<'a> HighlightKind<'a> {
+    pub fn fmt_camelcase(&self) -> HighlightKindCamelcaseFormatter<'a> {
+        HighlightKindCamelcaseFormatter { identifier: self.identifier }
+    }
+}
+
+pub struct HighlightKindCamelcaseFormatter<'a> {
+    identifier: &'a str,
+}
+
+impl<'a> fmt::Display for HighlightKindCamelcaseFormatter<'a> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let mut capitalize_next = true;
+        for c in self.identifier.chars() {
+            if c == '.' {
+                capitalize_next = true;
+            } else if capitalize_next {
+                capitalize_next = false;
+                f.write_char(c.to_ascii_uppercase())?;
+            } else {
+                f.write_char(c)?;
+            }
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone, Default)]
+struct FunctionAttributes<'a> {
+    display_name: Option<&'a str>,
+    paths: Vec<&'a str>,
+}
+
+#[derive(Debug, Clone)]
+struct Function<'a> {
+    name: &'a str,
+    attributes: FunctionAttributes<'a>,
+    body: IRCell<'a>,
+    public: bool,
+}
+
+// To be honest, I don't think this qualifies as an "intermediate representation",
+// if we compare this to popular compilers. But whatever. It's still intermediate to us.
+#[derive(Debug)]
+struct IR<'a> {
+    next: Option<IRCell<'a>>,
+    instr: IRI<'a>,
+    offset: usize,
+}
+
+impl<'a> fmt::Display for IR<'a> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "i{self:p}")
+    }
+}
+
+type IRCell<'a> = &'a RefCell<IR<'a>>;
+
+// IRI = Immediate Representation Instruction
+#[derive(Debug, Clone, Copy)]
+enum IRI<'a> {
+    Noop,
+    Mov { dst: IRRegCell<'a>, src: IRRegCell<'a> },
+    MovImm { dst: IRRegCell<'a>, imm: u32 },
+    MovKind { dst: IRRegCell<'a>, kind: u32 },
+    AddImm { dst: IRRegCell<'a>, imm: u32 },
+    If { condition: Condition<'a>, then: IRCell<'a> },
+    Call { name: &'a str },
+    Return,
+    Flush { kind: IRRegCell<'a> },
+    AwaitInput,
+}
+
+#[derive(Default)]
+struct IRReg {
+    id: u32,
+    physical: Option<Register>,
+}
+
+type IRRegCell<'a> = &'a RefCell<IRReg>;
+
+impl IRReg {
+    fn new(id: u32) -> Self {
+        IRReg { id, physical: None }
+    }
+}
+
+impl fmt::Debug for IRReg {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        if let Some(p) = self.physical
+            && self.id < Register::COUNT as u32
+        {
+            write!(f, "{}", p.mnemonic())
+        } else {
+            write!(f, "v{}", self.id)
+        }
+    }
+}
+
+#[derive(Clone, Copy)]
+struct IRSpan<'a> {
+    first: IRCell<'a>,
+    last: IRCell<'a>,
+}
+
+impl<'a> IRSpan<'a> {
+    fn single(node: IRCell<'a>) -> Self {
+        Self { first: node, last: node }
+    }
+}
+
+struct IRChainBuilder<'a, 's> {
+    compiler: &'s Compiler<'a>,
+    span: Option<IRSpan<'a>>,
+}
+
+impl<'a, 's> IRChainBuilder<'a, 's> {
+    fn append(&mut self, instr: IRI<'a>) -> &mut Self {
+        let node = self.compiler.alloc_iri(instr);
+        if let Some(span) = &mut self.span {
+            span.last.borrow_mut().set_next(node);
+            span.last = node;
+        } else {
+            self.span = Some(IRSpan::single(node));
+        }
+        self
+    }
+
+    fn build(&self) -> IRSpan<'a> {
+        self.span.unwrap_or_else(|| IRSpan::single(self.compiler.alloc_noop()))
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum ComparisonOp {
+    Eq,
+    Ne,
+    Lt,
+    Gt,
+    Le,
+    Ge,
+}
+
+#[derive(Debug, Clone, Copy)]
+enum Condition<'a> {
+    Cmp { lhs: IRRegCell<'a>, rhs: IRRegCell<'a>, op: ComparisonOp },
+    EndOfLine,
+    Charset(&'a Charset),
+    Prefix(&'a str),
+    PrefixInsensitive(&'a str),
+}
+
+impl<'a> IR<'a> {
+    fn wants_next(&self) -> bool {
+        self.next.is_none() && !matches!(self.instr, IRI::Return)
+    }
+
+    fn set_next(&mut self, n: IRCell<'a>) {
+        debug_assert!(self.wants_next());
+        self.next = Some(n);
+    }
+}
+
+fn arena_clone_str<'a>(arena: &'a Arena, s: &str) -> &'a str {
+    ArenaString::from_str(arena, s).leak()
+}
+
+trait Intern<'a, T: ?Sized> {
+    fn intern(&mut self, arena: &'a Arena, item: &T) -> &'a T;
+}
+
+impl<'a> Intern<'a, str> for Vec<&'a str> {
+    fn intern(&mut self, arena: &'a Arena, value: &str) -> &'a str {
+        if let Some(&s) = self.iter().find(|&&v| v == value) {
+            s
+        } else {
+            let s = arena_clone_str(arena, value);
+            self.push(s);
+            s
+        }
+    }
+}
diff --git a/crates/lsh/src/compiler/optimizer.rs b/crates/lsh/src/compiler/optimizer.rs
new file mode 100644
index 00000000000..39d15ab252c
--- /dev/null
+++ b/crates/lsh/src/compiler/optimizer.rs
@@ -0,0 +1,208 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! IR optimization passes, run before register allocation.
+//!
+//! ## Quirks
+//!
+//! - Pass order matters
+//!
+//! ## TODO
+//!
+//! - Could do copy propagation: if `vreg1 = vreg2`, replace all uses of vreg1 with vreg2.
+//! - Could merge consecutive `Add { off, off, 1 }` instructions.
+//! - Could eliminate unreachable code after `Return`.
+
+use std::ptr;
+
+use stdext::arena::scratch_arena;
+
+use super::*;
+
+pub fn optimize<'a>(compiler: &mut Compiler<'a>) {
+    // Remove noops first, such that analyzing instruction chains becomes easier for the other passes.
+    optimize_noop(compiler);
+    optimize_redundant_offset_backup_restore(compiler);
+    optimize_highlight_kind_values(compiler);
+}
+
+/// Removes no-op instructions from the IR.
+fn optimize_noop<'a>(compiler: &mut Compiler<'a>) {
+    // Remove noops from the function entrypoint (the trunk of the tree).
+    for function in &mut compiler.functions {
+        while let body = function.body.borrow()
+            && let Some(next) = body.next
+            && matches!(body.instr, IRI::Noop)
+        {
+            function.body = next;
+        }
+    }
+
+    for function in &compiler.functions {
+        for current_cell in compiler.visit_nodes_from(function.body) {
+            // First, filter down to nodes that are not no-ops.
+            if let mut current = current_cell.borrow_mut()
+                && !matches!(current.instr, IRI::Noop)
+            {
+                // `IRI::If` nodes have an additional "next" pointer.
+                let current = &mut *current;
+                let nexts = [
+                    current.next.as_mut(),
+                    match &mut current.instr {
+                        IRI::If { then, .. } => Some(then),
+                        _ => None,
+                    },
+                ];
+
+                // Now, "pop_front" no-ops from the next pointer, until it
+                // points to a real op (or None, but that shouldn't happen).
+                for next_ref in nexts.into_iter().flatten() {
+                    while !ptr::eq(*next_ref, current_cell)
+                        && let next = next_ref.borrow()
+                        && matches!(next.instr, IRI::Noop)
+                        && let Some(skip_next) = next.next
+                    {
+                        *next_ref = skip_next;
+                    }
+                }
+            }
+        }
+    }
+}
+
+// Conditions in the VM advance the offset only if they match. The frontend doesn't
+// care about this and emits pointless backup/restore instructions for the offset.
+// This code is responsible for turning this chain of `.next` pointers:
+//   IRI::Add { off -> backup }
+//   IRI::If { .. }
+//   IRI::Add { backup -> off }
+//   IRI::If { .. }
+//   IRI::Add { backup -> off }
+//   IRI::If { .. }
+//   IRI::Add { backup -> off }
+// into this:
+//   IRI::Add { off -> backup }
+//   IRI::If { .. }
+//   IRI::If { .. }
+//   IRI::If { .. }
+fn optimize_redundant_offset_backup_restore<'a>(compiler: &mut Compiler<'a>) {
+    let off_reg = compiler.get_reg(Register::InputOffset);
+
+    // Remove pointless offset restore chains.
+    for function in &compiler.functions {
+        for current_cell in compiler.visit_nodes_from(function.body) {
+            // First, filter down to nodes that assign the `off` to a virtual register.
+            if let save = current_cell.borrow()
+                && let IRI::Mov { dst: backup_reg, src } = save.instr
+                && ptr::eq(src, off_reg)
+                && backup_reg.borrow().physical.is_none()
+            {
+                let mut next_cond = save.next;
+
+                // Next optimize an entire chain of `if` conditions that pointlessly restore `off`.
+                while let Some(cond) = next_cond
+                    && let mut cond = cond.borrow_mut()
+                    && matches!(cond.instr, IRI::If { .. })
+                    && let Some(restore) = cond.next
+                    && let restore = restore.borrow()
+                    && matches!(restore.instr, IRI::Mov { dst, src } if ptr::eq(dst, off_reg) && ptr::eq(src, backup_reg))
+                {
+                    cond.next = restore.next;
+                    next_cond = restore.next;
+                }
+            }
+        }
+    }
+
+    // Remove pointless offset backups.
+    // A backup is pointless if the destination vreg is never read.
+    for function in &compiler.functions {
+        // First, collect all vregs that are read anywhere in the function.
+        let mut used_vregs = HashSet::new();
+        for current_cell in compiler.visit_nodes_from(function.body) {
+            let current = current_cell.borrow();
+            match current.instr {
+                IRI::Mov { src, .. } => {
+                    let id = src.borrow().id;
+                    used_vregs.insert(id);
+                }
+                IRI::If { condition: Condition::Cmp { lhs, rhs, .. }, .. } => {
+                    used_vregs.insert(lhs.borrow().id);
+                    used_vregs.insert(rhs.borrow().id);
+                }
+                _ => {}
+            }
+        }
+
+        // Now remove dead stores (assignments to vregs that are never read).
+        for current_cell in compiler.visit_nodes_from(function.body) {
+            // First, filter down to nodes that assign the `off` to a virtual register.
+            if let mut cell = current_cell.borrow_mut()
+                && let IRI::Mov { dst, src } = cell.instr
+                && let src = src.borrow()
+                && let dst = dst.borrow()
+                // TODO: Technically we could also optimize vreg --> vreg assignments, but for that we
+                // need to be able to call `count_register_uses` multiple times, so that the count is
+                // accurate after removing an assignment. Physical registers don't care about that.
+                && src.physical.is_some()
+                // We can't optimize physical register --> physical register assignments.
+                && dst.physical.is_none()
+                && !used_vregs.contains(&dst.id)
+            {
+                cell.instr = IRI::Noop;
+            }
+        }
+    }
+    optimize_noop(compiler);
+}
+
+/// This isn't an optimization for the VM, it's one for my autistic side.
+/// I like it if the identifiers are sorted and the values contiguous.
+fn optimize_highlight_kind_values<'a>(compiler: &mut Compiler<'a>) {
+    let scratch = scratch_arena(None);
+    let mut mapping = Vec::new_in(&*scratch);
+
+    compiler.highlight_kinds.sort_unstable_by(|a, b| {
+        let a = a.identifier;
+        let b = b.identifier;
+
+        // Global identifiers without a dot come first.
+        let nested_a = a.contains('.');
+        let nested_b = b.contains('.');
+        let cmp = nested_a.cmp(&nested_b);
+        if cmp != std::cmp::Ordering::Equal {
+            return cmp;
+        }
+
+        // Among globals, "other" comes first. Due to the above,
+        // `nested_a == false` implies `nested_b == false`.
+        if !nested_a {
+            if a == "other" {
+                return std::cmp::Ordering::Less;
+            }
+            if b == "other" {
+                return std::cmp::Ordering::Greater;
+            }
+        }
+
+        // Otherwise, sort by dot-separated components.
+        a.split('.').cmp(b.split('.'))
+    });
+
+    mapping.resize(compiler.highlight_kinds.len(), u32::MAX);
+    for (idx, hk) in compiler.highlight_kinds.iter_mut().enumerate() {
+        let idx = idx as u32;
+        mapping[hk.value as usize] = idx;
+        hk.value = idx;
+    }
+
+    for function in &compiler.functions {
+        for current in compiler.visit_nodes_from(function.body) {
+            let mut current = current.borrow_mut();
+
+            if let IRI::MovKind { kind, .. } = &mut current.instr {
+                *kind = mapping[*kind as usize];
+            }
+        }
+    }
+}
diff --git a/crates/lsh/src/compiler/regex.rs b/crates/lsh/src/compiler/regex.rs
new file mode 100644
index 00000000000..43af4081398
--- /dev/null
+++ b/crates/lsh/src/compiler/regex.rs
@@ -0,0 +1,488 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Regex-to-IR compiler using `regex_syntax` as the parser.
+//!
+//! ## Supported patterns
+//!
+//! - Literals: `foo`, `bar`
+//! - Character classes: `[a-z]`, `[^0-9]`, `.` (any byte), `\w`, `\d`, etc.
+//! - Quantifiers: `?`, `+`, `*` (greedy only)
+//! - Alternation: `a|b|c`
+//! - Concatenation: `abc`
+//! - Capture groups: `(...)` (for `yield $1 as color`)
+//! - Word boundary: `\b` (ASCII only, via `Look::WordEndHalfAscii`)
+//! - End of line: `$`
+//!
+//! ## Gotchas
+//!
+//! - IMPORTANT (also the most important TODO):
+//!   Alternatives are not properly implemented, because backtracking doesn't exist.
+//!   E.g. matching `(a|ab)[0-9]+` will NOT match `ab123` because after matching `a` from the
+//!   first alternative, it immediately tries to match `[0-9]+` and fails.
+//!
+//! - Single-character classes like `[eE]` get expanded into a chain of `Prefix` conditions
+//!   rather than using `Charset`. This is because prefix matching advances `off` by exactly
+//!   the matched length, while charset matching is greedy (matches as many as possible).
+//! - For patterns like `[a-z]+|\w+`, the compiler tries to chain alternatives so that if
+//!   the more specific pattern fails partway through, it falls back to the more general one.
+//!   This is the `try_append_as_fallback` logic - it's complex and may have edge cases.
+//! - If a charset includes `\w` (word characters), the compiler also sets bits for UTF-8
+//!   continuation byte starters (0xC2-0xF4). This lets `\w+` consume multibyte characters
+//!   even though we operate on bytes. It's not Unicode-correct but works for identifiers.
+//! - The `parse()` function modifies `dst_good`/`dst_bad` nodes' `.next` pointers.
+//!   Don't pass nodes that are already wired into the IR graph.
+//!
+//! ## TODO
+//!
+//! - Delete the entire file.
+//! - Rewrite it based on a proper TDFA architecture.
+
+use std::ptr;
+
+use regex_syntax::hir::{Class, ClassBytes, ClassBytesRange, Hir, HirKind, Look};
+
+use super::*;
+
+const ASCII_WORD_CHARSET: Charset = {
+    let mut charset = Charset::no();
+    charset.set_range(b'0'..=b'9', true);
+    charset.set_range(b'A'..=b'Z', true);
+    charset.set_range(b'_'..=b'_', true);
+    charset.set_range(b'a'..=b'z', true);
+    charset.set_range(0xC2..=0xF4, true);
+    charset
+};
+
+pub fn parse<'a>(
+    compiler: &mut Compiler<'a>,
+    pattern: &str,
+    dst_good: IRCell<'a>,
+    dst_bad: IRCell<'a>,
+    capture_groups: &mut Vec<(IRRegCell<'a>, IRRegCell<'a>), &'a Arena>,
+) -> Result<IRCell<'a>, String> {
+    let hir = match regex_syntax::ParserBuilder::new()
+        .utf8(false)
+        .unicode(false)
+        .dot_matches_new_line(true)
+        .build()
+        .parse(pattern)
+    {
+        Ok(hir) => hir,
+        Err(e) => return Err(format!("{e}")),
+    };
+
+    let src = transform(compiler, dst_good, &hir, capture_groups)?;
+
+    // Connect all unset .next pointers to dst_bad.
+    for node in compiler.visit_nodes_from(src) {
+        if !ptr::eq(node, dst_good)
+            && !ptr::eq(node, dst_bad)
+            && let mut node = node.borrow_mut()
+            && node.wants_next()
+        {
+            node.set_next(dst_bad);
+        }
+    }
+
+    Ok(src)
+}
+
+fn transform<'a>(
+    compiler: &mut Compiler<'a>,
+    dst: IRCell<'a>,
+    hir: &Hir,
+    capture_groups: &mut Vec<(IRRegCell<'a>, IRRegCell<'a>), &'a Arena>,
+) -> Result<IRCell<'a>, String> {
+    fn is_any_class(class: &ClassBytes) -> bool {
+        class.ranges() == [ClassBytesRange::new(0, 255)]
+    }
+
+    match hir.kind() {
+        HirKind::Empty => Ok(dst),
+        HirKind::Literal(lit) => transform_literal(compiler, dst, &lit.0),
+        HirKind::Class(Class::Bytes(class)) if is_any_class(class) => transform_any(compiler, dst),
+        HirKind::Class(Class::Bytes(class)) => transform_class(compiler, dst, class),
+        HirKind::Class(Class::Unicode(class)) => {
+            transform_class(compiler, dst, &class.to_byte_class().unwrap())
+        }
+        HirKind::Look(Look::End) => {
+            Ok(compiler.alloc_iri(IRI::If { condition: Condition::EndOfLine, then: dst }))
+        }
+        HirKind::Look(Look::WordEndHalfAscii) => {
+            // If the test hits, then we failed the word boundary, so go to dst_bad.
+            // We don't have dst_bad here, so allocate a noop node, which later gets
+            // picked up with its unset .next pointer, and set to dst_bad automatically.
+            let bad = compiler.alloc_noop();
+            let c = compiler.intern_charset(&ASCII_WORD_CHARSET);
+            Ok(compiler.alloc_ir(IR {
+                next: Some(dst),
+                instr: IRI::If { condition: Condition::Charset(c), then: bad },
+                offset: usize::MAX,
+            }))
+        }
+        HirKind::Repetition(rep) => match (rep.min, rep.max, rep.greedy, rep.sub.kind()) {
+            (0, None, true, HirKind::Class(Class::Bytes(class))) => {
+                if is_any_class(class) {
+                    transform_any_star(compiler, dst)
+                } else {
+                    let src = transform_class_plus(compiler, dst, class)?;
+                    transform_option(src, dst)
+                }
+            }
+            (0, Some(1), true, _) => {
+                let src = transform(compiler, dst, &rep.sub, capture_groups)?;
+                transform_option(src, dst)
+            }
+            (1, None, true, HirKind::Literal(lit)) => transform_literal_plus(compiler, dst, lit),
+            (1, None, true, HirKind::Class(Class::Bytes(class))) => {
+                transform_class_plus(compiler, dst, class)
+            }
+            _ => panic!("Unsupported HIR: {hir:?}"),
+        },
+        HirKind::Concat(hirs) => transform_concat(compiler, dst, hirs, capture_groups),
+        HirKind::Alternation(hirs) => transform_alt(compiler, dst, hirs, capture_groups),
+        HirKind::Capture(capture) => {
+            // Save the current input offset before matching the capture group
+            let start_vreg = compiler.alloc_vreg();
+            let save_start = compiler.alloc_iri(IRI::Mov {
+                dst: start_vreg,
+                src: compiler.get_reg(Register::InputOffset),
+            });
+
+            // Transform the sub-expression
+            let end_marker = compiler.alloc_noop();
+            save_start.borrow_mut().set_next(transform(
+                compiler,
+                end_marker,
+                &capture.sub,
+                capture_groups,
+            )?);
+
+            // Save the end offset after matching
+            let end_vreg = compiler.alloc_vreg();
+            let save_end = compiler.alloc_iri(IRI::Mov {
+                dst: end_vreg,
+                src: compiler.get_reg(Register::InputOffset),
+            });
+            end_marker.borrow_mut().set_next(save_end);
+            save_end.borrow_mut().set_next(dst);
+
+            // Store the capture group (index is 1-based in regex, 0-based in our vec)
+            let vec_index = (capture.index as usize).saturating_sub(1);
+            // Ensure the vector is large enough
+            while capture_groups.len() <= vec_index {
+                let dummy_start = compiler.alloc_vreg();
+                let dummy_end = compiler.alloc_vreg();
+                capture_groups.push((dummy_start, dummy_end));
+            }
+            capture_groups[vec_index] = (start_vreg, end_vreg);
+
+            Ok(save_start)
+        }
+        _ => panic!("Unsupported HIR: {hir:?}"),
+    }
+}
+
+// string
+fn transform_literal<'a>(
+    compiler: &mut Compiler<'a>,
+    dst: IRCell<'a>,
+    lit: &[u8],
+) -> Result<IRCell<'a>, String> {
+    let s = String::from_utf8(lit.to_vec()).unwrap();
+    let s = compiler.intern_string(&s);
+    Ok(compiler.alloc_iri(IRI::If { condition: Condition::Prefix(s), then: dst }))
+}
+
+// a+
+fn transform_literal_plus<'a>(
+    compiler: &mut Compiler<'a>,
+    dst: IRCell<'a>,
+    lit: &regex_syntax::hir::Literal,
+) -> Result<IRCell<'a>, String> {
+    assert!(lit.0.len() == 1);
+    let mut c = Charset::default();
+    c.set(lit.0[0], true);
+    let c = compiler.intern_charset(&c);
+    Ok(compiler.alloc_iri(IRI::If { condition: Condition::Charset(c), then: dst }))
+}
+
+// [a-z]+
+fn transform_class_plus<'a>(
+    compiler: &mut Compiler<'a>,
+    dst: IRCell<'a>,
+    class: &ClassBytes,
+) -> Result<IRCell<'a>, String> {
+    let c = class_to_charset(class);
+    let c = compiler.intern_charset(&c);
+    Ok(compiler.alloc_iri(IRI::If { condition: Condition::Charset(c), then: dst }))
+}
+
+// [eE]
+fn transform_class<'a>(
+    compiler: &mut Compiler<'a>,
+    dst: IRCell<'a>,
+    class: &ClassBytes,
+) -> Result<IRCell<'a>, String> {
+    let mut charset = class_to_charset(class);
+    let mut first: Option<IRCell<'a>> = None;
+    let mut last: Option<IRCell<'a>> = None;
+
+    for ch in 0..=255 {
+        if !charset.get(ch) {
+            continue;
+        }
+
+        if ch >= 128 {
+            panic!("Invalid non-ASCII class character {ch}");
+        }
+
+        let mut str = String::new();
+        str.push(ch as char);
+
+        // Check if our given `class` covers lower- and uppercase of an ASCII letter,
+        // and if so, we have to turn that into a `PrefixInsensitive` condition.
+        //
+        // NOTE: Uppercase letters have a lower numerical value than lowercase letters.
+        // As such, we check for is_ascii_uppercase(), turn that into `insensitive == true`,
+        // and clear out the (numerically higher) lowercase bit from `class`, so we ignore it.
+        // We already handled it with our `PrefixInsensitive` condition after all.
+        let lower = ch.to_ascii_lowercase();
+        let insensitive = ch.is_ascii_uppercase() && charset.get(lower);
+
+        if insensitive {
+            charset.set(lower, false);
+            str.make_ascii_lowercase();
+        }
+
+        let str = compiler.intern_string(&str);
+        let condition =
+            if insensitive { Condition::PrefixInsensitive(str) } else { Condition::Prefix(str) };
+
+        let node = compiler.alloc_iri(IRI::If { condition, then: dst });
+        if first.is_none() {
+            first = Some(node);
+        }
+        if let Some(last) = &last {
+            last.borrow_mut().set_next(node);
+        }
+        last = Some(node);
+    }
+
+    Ok(first.unwrap())
+}
+
+// .?
+fn transform_option<'a>(src: IRCell<'a>, dst: IRCell<'a>) -> Result<IRCell<'a>, String> {
+    let mut n = src.borrow_mut();
+
+    while let Some(next) = n.next {
+        n = next.borrow_mut();
+    }
+
+    n.set_next(dst);
+    Ok(src)
+}
+
+// .*
+fn transform_any_star<'a>(
+    compiler: &mut Compiler<'a>,
+    dst: IRCell<'a>,
+) -> Result<IRCell<'a>, String> {
+    Ok(compiler.alloc_ir(IR {
+        next: Some(dst),
+        instr: IRI::MovImm { dst: compiler.get_reg(Register::InputOffset), imm: u32::MAX },
+        offset: usize::MAX,
+    }))
+}
+
+// .
+fn transform_any<'a>(compiler: &mut Compiler<'a>, dst: IRCell<'a>) -> Result<IRCell<'a>, String> {
+    Ok(compiler.alloc_ir(IR {
+        next: Some(dst),
+        instr: IRI::AddImm { dst: compiler.get_reg(Register::InputOffset), imm: 1 },
+        offset: usize::MAX,
+    }))
+}
+
+// (a)(b)
+fn transform_concat<'a>(
+    compiler: &mut Compiler<'a>,
+    dst: IRCell<'a>,
+    hirs: &[Hir],
+    capture_groups: &mut Vec<(IRRegCell<'a>, IRRegCell<'a>), &'a Arena>,
+) -> Result<IRCell<'a>, String> {
+    fn is_lowercase_literal(hir: &Hir) -> Option<u8> {
+        if let HirKind::Class(Class::Bytes(class)) = hir.kind()
+            && let ranges = class.ranges()
+            && ranges.len() == 2
+            && ranges[0].len() == 1
+            && ranges[1].len() == 1
+            && let lower_a = ranges[0].start().to_ascii_lowercase()
+            && let lower_b = ranges[1].start().to_ascii_lowercase()
+            && lower_a == lower_b
+        {
+            Some(lower_a)
+        } else {
+            None
+        }
+    }
+
+    let mut it = hirs.iter().peekable();
+    let mut first: Option<IRCell<'a>> = None;
+    let mut last: Option<IRCell<'a>> = None;
+
+    while let Some(hir) = it.next() {
+        // Transform [aA][bB][cC] into PrefixInsensitive("abc").
+        let prefix_insensitive = is_lowercase_literal(hir).map(|ch| {
+            let mut str = String::new();
+            str.push(ch as char);
+
+            while let Some(next_hir) = it.peek() {
+                if let Some(next_ch) = is_lowercase_literal(next_hir) {
+                    str.push(next_ch as char);
+                    it.next();
+                } else {
+                    break;
+                }
+            }
+
+            str.make_ascii_lowercase();
+            str
+        });
+
+        let dst = compiler.alloc_noop();
+        let src = if let Some(str) = prefix_insensitive {
+            let str = compiler.intern_string(&str);
+            compiler.alloc_iri(IRI::If { condition: Condition::PrefixInsensitive(str), then: dst })
+        } else {
+            transform(compiler, dst, hir, capture_groups)?
+        };
+        if first.is_none() {
+            first = Some(src);
+        }
+        if let Some(last) = &last {
+            last.borrow_mut().set_next(src);
+        }
+        last = Some(dst);
+    }
+
+    if let Some(last) = &last {
+        last.borrow_mut().set_next(dst);
+    }
+
+    Ok(first.unwrap())
+}
+
+// (a|b)
+fn transform_alt<'a>(
+    compiler: &mut Compiler<'a>,
+    dst: IRCell<'a>,
+    hirs: &[Hir],
+    capture_groups: &mut Vec<(IRRegCell<'a>, IRRegCell<'a>), &'a Arena>,
+) -> Result<IRCell<'a>, String> {
+    let mut first: Option<IRCell<'a>> = None;
+    let mut last: Option<IRCell<'a>> = None;
+
+    for hir in hirs {
+        let node = transform(compiler, dst, hir, capture_groups)?;
+        if first.is_none() {
+            first = Some(node);
+        }
+        if let Some(last) = &last {
+            // Try to merge this alternative as a fallback of previous alternatives
+            // if their charsets are compatible (superset relationship)
+            if !try_append_as_fallback(last, node) {
+                last.borrow_mut().set_next(node);
+            }
+        }
+        last = Some(node);
+    }
+
+    Ok(first.unwrap())
+}
+
+// Try to append `fallback` as a fallback to nodes in `tree` where the charset
+// of `fallback` is a superset of the charset in `tree`. This allows patterns like
+// `[a-z]+foo|\w+bar` to match `foobar` by trying the more specific pattern first,
+// and falling back to the more general pattern on failure.
+fn try_append_as_fallback<'a>(tree: &IRCell<'a>, fallback: IRCell<'a>) -> bool {
+    let fallback_charset = get_initial_charset(fallback);
+    if fallback_charset.is_none() {
+        return false;
+    }
+
+    append_fallback_recursive(tree, fallback, fallback_charset.unwrap())
+}
+
+fn append_fallback_recursive<'a>(
+    node: &IRCell<'a>,
+    fallback: IRCell<'a>,
+    fallback_charset: &Charset,
+) -> bool {
+    let mut node_ref = node.borrow_mut();
+
+    if let IRI::If { condition: Condition::Charset(charset), then } = &node_ref.instr {
+        // If the fallback charset is a superset of this node's charset,
+        // we can append the fallback to this node's failure path
+        if fallback_charset.is_superset_of(charset) {
+            // Recursively try to append to the success path first
+            let appended_to_then = append_fallback_recursive(then, fallback, fallback_charset);
+
+            // If not appended to success path, append to failure path (next)
+            if !appended_to_then {
+                if let Some(next) = node_ref.next {
+                    // Try to append recursively to the next node
+                    if !append_fallback_recursive(&next, fallback, fallback_charset) {
+                        // If we couldn't append recursively, this might be the right place
+                        // But we already have a next pointer, so we need to be careful
+                        // For now, don't override existing next pointers in this branch
+                    }
+                } else {
+                    // This node has no next pointer yet, so we can set it to the fallback
+                    node_ref.next = Some(fallback);
+                    return true;
+                }
+            }
+            return appended_to_then;
+        }
+    }
+
+    // Try recursively on the next node
+    if let Some(next) = node_ref.next {
+        drop(node_ref); // Release the borrow before recursing
+        return append_fallback_recursive(&next, fallback, fallback_charset);
+    }
+
+    false
+}
+
+// Get the initial charset that a regex tree matches
+fn get_initial_charset<'a>(node: IRCell<'a>) -> Option<&'a Charset> {
+    let node_ref = node.borrow();
+    match &node_ref.instr {
+        IRI::If { condition: Condition::Charset(charset), .. } => Some(*charset),
+        _ => None,
+    }
+}
+
+// [a-z] -> 256-ary LUT
+fn class_to_charset(class: &ClassBytes) -> Charset {
+    let mut charset = Charset::default();
+
+    for r in class.iter() {
+        charset.set_range(r.start()..=r.end(), true);
+    }
+
+    // If the class includes \w, we also set any non-ASCII UTF8 starters.
+    // That's not how Unicode works, but it simplifies the implementation.
+    if [b'0'..=b'9', b'A'..=b'Z', b'_'..=b'_', b'a'..=b'z']
+        .iter()
+        .all(|r| charset.covers_range(r.clone()))
+    {
+        charset.set_range(0xC2..=0xF4, true);
+    }
+
+    charset
+}
diff --git a/crates/lsh/src/lib.rs b/crates/lsh/src/lib.rs
new file mode 100644
index 00000000000..1a3a995d672
--- /dev/null
+++ b/crates/lsh/src/lib.rs
@@ -0,0 +1,55 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Welcome to Leonard's Syntax Highlighter (LSH), otherwise known as
+//! Leonard's Shitty Highlighter, which is really what it is.
+//!
+//! ## Architecture
+//!
+//!   DSL source
+//! → `frontend` (parse) → IR
+//! → `optimizer` → IR
+//! → `backend` (regalloc + codegen) → bytecode
+//! → `runtime` (execute)
+//!
+//! The IR is a graph of `RefCell<IR>` nodes. Each node has a `.next` pointer and `If` nodes
+//! in particular have a `.then` pointer. This makes CFG manipulation trivial but means you can't
+//! iterate in program order without linearization (see `backend::LivenessAnalysis`).
+//!
+//! ## Register semantics
+//!
+//! - `off` advances only on successful regex matches. Failed matches leave it alone.
+//!   This is why the frontend emits backup/restore pairs around regex chains.
+//! - `hs` (highlight start) is used to track the input offset of the last yield statement,
+//!   which permits the runtime to highlight everything inbetween with the next yield's highlight kind.
+//!
+//! ## Charset encoding
+//!
+//! Charsets are 256-bit bitmaps stored as `[u16; 16]`. The encoding is transposed for SIMD:
+//! `bitmap[lo_nibble] & (1 << hi_nibble)` tests if byte `(hi_nibble << 4) | lo_nibble` is set.
+//! See `in_set()`. This layout allows parallel lookup of multiple bytes using pshufb.
+//!
+//! ## Gotchas
+//!
+//! - Physical VS virtual registers:
+//!   `IRReg.physical` being `Some` means it's pre-colored (e.g., `off` register).
+//!   The backend must preserve these assignments.
+//! - Semi-SSA:
+//!   The frontend emits IR where each vreg is written once,
+//!   but physical registers like `off` are mutated repeatedly.
+//!   The optimizer relies on this.
+//!
+//! ## TODO
+//!
+//! - Most importantly, the architecture is A GODDAMN MESS.
+//! - The regex compiler (`regex.rs`) panics on unsupported patterns instead of returning errors.
+//!   Should bubble up `CompileError` instead.
+//! - No support for spill code generation. If you run out of user registers, you're dead.
+//!   The current definition files don't hit this, but complex patterns could.
+//! - No include statements, and all functions across all files share a single namespace.
+
+#![feature(allocator_api)]
+#![allow(irrefutable_let_patterns, clippy::upper_case_acronyms)]
+
+pub mod compiler;
+pub mod runtime;
diff --git a/crates/lsh/src/runtime.rs b/crates/lsh/src/runtime.rs
new file mode 100644
index 00000000000..d07742a1569
--- /dev/null
+++ b/crates/lsh/src/runtime.rs
@@ -0,0 +1,639 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! LSH bytecode interpreter.
+//!
+//! ## Performance notes
+//!
+//! - The main loop is "unsafe". Profile before "cleaning" it up.
+//! - `charset_gobble`, `inlined_mem(i)cmp` are hot paths.
+//!
+//! ## Gotchas
+//!
+//! - `Return` with empty stack resets the VM to entrypoint and clears registers.
+//!   This is how the DSL returns to the "idle" state between tokens.
+//! - `AwaitInput` only breaks the loop if `off >= line.len()`. If not at EOL, it's a no-op.
+//!   This allows the DSL to say "wait for more input OR continue if there is some".
+//! - The result always has a sentinel span at `line.len()`. Consumers can rely on this.
+
+use std::fmt::{self, Debug, Write as _};
+
+use stdext::arena::{Arena, ArenaString};
+
+/// A compiled language definition with its bytecode entrypoint.
+pub struct Language {
+    /// Unique identifier (e.g., "rust", "markdown").
+    pub id: &'static str,
+    /// Human-readable display name.
+    pub name: &'static str,
+    /// Bytecode address where execution begins for this language.
+    pub entrypoint: u32,
+}
+
+impl PartialEq for &'static Language {
+    fn eq(&self, other: &Self) -> bool {
+        std::ptr::eq(*self, *other)
+    }
+}
+
+/// A highlight span indicating that text from `start` to the next span has the given `kind`.
+///
+/// Spans are half-open: `[start, next.start)`. The final span in a line extends to EOL.
+#[derive(Clone, PartialEq, Eq)]
+pub struct Highlight<T> {
+    /// Byte offset where this highlight begins.
+    pub start: usize,
+    /// The token/highlight type (e.g., keyword, string, comment).
+    pub kind: T,
+}
+
+impl<T: Debug> Debug for Highlight<T> {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "({}, {:?})", self.start, self.kind)
+    }
+}
+
+#[repr(u8)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+pub enum Register {
+    // These two registers are shared across function calls...
+    InputOffset,
+    HighlightStart,
+    // ...and the rest is caller-saved.
+    ProgramCounter,
+    X3,
+    X4,
+    X5,
+    X6,
+    X7,
+    X8,
+    X9,
+    X10,
+    X11,
+    X12,
+    X13,
+    X14,
+    X15,
+}
+
+impl Register {
+    pub const FIRST_USER_REG: usize = 3; // aka x3
+    pub const COUNT: usize = 16;
+
+    #[inline(always)]
+    pub fn from_usize(value: usize) -> Self {
+        debug_assert!(value < Self::COUNT);
+        unsafe { std::mem::transmute::<u8, Register>(value as u8) }
+    }
+
+    pub fn mnemonic(&self) -> &'static str {
+        match self {
+            Register::InputOffset => "off",
+            Register::HighlightStart => "hs",
+            Register::ProgramCounter => "pc",
+            Register::X3 => "x3",
+            Register::X4 => "x4",
+            Register::X5 => "x5",
+            Register::X6 => "x6",
+            Register::X7 => "x7",
+            Register::X8 => "x8",
+            Register::X9 => "x9",
+            Register::X10 => "x10",
+            Register::X11 => "x11",
+            Register::X12 => "x12",
+            Register::X13 => "x13",
+            Register::X14 => "x14",
+            Register::X15 => "x15",
+        }
+    }
+}
+
+impl fmt::Display for Register {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}", self.mnemonic())
+    }
+}
+
+#[repr(C)]
+#[derive(Default, Clone, Copy)]
+pub struct Registers {
+    pub off: u32, // x0 = InputOffset
+    pub hs: u32,  // x1 = HighlightStart
+    pub pc: u32,  // x2 = ProgramCounter
+    pub x3: u32,
+    pub x4: u32,
+    pub x5: u32,
+    pub x6: u32,
+    pub x7: u32,
+    pub x8: u32,
+    pub x9: u32,
+    pub x10: u32,
+    pub x11: u32,
+    pub x12: u32,
+    pub x13: u32,
+    pub x14: u32,
+    pub x15: u32,
+}
+
+impl Registers {
+    #[inline(always)]
+    pub fn get(&self, reg: Register) -> u32 {
+        unsafe { self.as_ptr().add(reg as usize).read() }
+    }
+
+    #[inline(always)]
+    pub fn set(&mut self, reg: Register, val: u32) {
+        unsafe { self.as_mut_ptr().add(reg as usize).write(val) }
+    }
+
+    #[inline(always)]
+    unsafe fn as_ptr(&self) -> *const u32 {
+        self as *const _ as *const u32
+    }
+
+    #[inline(always)]
+    unsafe fn as_mut_ptr(&mut self) -> *mut u32 {
+        self as *mut _ as *mut u32
+    }
+}
+
+#[repr(u8)]
+#[derive(Debug, Clone, Copy)]
+pub enum Instruction {
+    // NOTE: This allows for jumps by manipulating Register::ProgramCounter.
+    Mov { dst: Register, src: Register },
+    Add { dst: Register, src: Register },
+    Sub { dst: Register, src: Register },
+    MovImm { dst: Register, imm: u32 },
+    AddImm { dst: Register, imm: u32 },
+    SubImm { dst: Register, imm: u32 },
+
+    Call { tgt: u32 },
+    Return,
+
+    JumpEQ { lhs: Register, rhs: Register, tgt: u32 }, // ==
+    JumpNE { lhs: Register, rhs: Register, tgt: u32 }, // !=
+    JumpLT { lhs: Register, rhs: Register, tgt: u32 }, // <
+    JumpLE { lhs: Register, rhs: Register, tgt: u32 }, // <=
+    JumpGT { lhs: Register, rhs: Register, tgt: u32 }, // >
+    JumpGE { lhs: Register, rhs: Register, tgt: u32 }, // >=
+
+    // Jumps to `tgt` if we're at the end of the line.
+    JumpIfEndOfLine { tgt: u32 },
+
+    // Jumps to `tgt` if the test succeeds.
+    // `idx` specifies the charset/string to use.
+    JumpIfMatchCharset { idx: u32, tgt: u32 },
+    JumpIfMatchPrefix { idx: u32, tgt: u32 },
+    JumpIfMatchPrefixInsensitive { idx: u32, tgt: u32 },
+
+    // Flushes the current HighlightKind to the output.
+    FlushHighlight { kind: Register },
+
+    // Awaits more input to be available.
+    AwaitInput,
+}
+
+macro_rules! instruction_decode {
+    ($assembly:expr, $pc:expr, {
+        Mov { $mov_dst:ident, $mov_src:ident } => $mov_handler:block
+        Add { $add_dst:ident, $add_src:ident } => $add_handler:block
+        Sub { $sub_dst:ident, $sub_src:ident } => $sub_handler:block
+        MovImm { $movi_dst:ident, $movi_imm:ident } => $movi_handler:block
+        AddImm { $addi_dst:ident, $addi_imm:ident } => $addi_handler:block
+        SubImm { $subi_dst:ident, $subi_imm:ident } => $subi_handler:block
+
+        Call { $call_tgt:ident } => $call_handler:block
+        Return => $ret_handler:block
+
+        JumpEQ { $jeq_lhs:ident, $jeq_rhs:ident, $jeq_tgt:ident } => $jeq_handler:block
+        JumpNE { $jne_lhs:ident, $jne_rhs:ident, $jne_tgt:ident } => $jne_handler:block
+        JumpLT { $jlt_lhs:ident, $jlt_rhs:ident, $jlt_tgt:ident } => $jlt_handler:block
+        JumpLE { $jle_lhs:ident, $jle_rhs:ident, $jle_tgt:ident } => $jle_handler:block
+        JumpGT { $jgt_lhs:ident, $jgt_rhs:ident, $jgt_tgt:ident } => $jgt_handler:block
+        JumpGE { $jge_lhs:ident, $jge_rhs:ident, $jge_tgt:ident } => $jge_handler:block
+
+        JumpIfEndOfLine { $jeol_tgt:ident } => $jeol_handler:block
+
+        JumpIfMatchCharset { $jc_idx:ident, $jc_tgt:ident } => $jc_handler:block
+        JumpIfMatchPrefix { $jp_idx:ident, $jp_tgt:ident } => $jp_handler:block
+        JumpIfMatchPrefixInsensitive { $jpi_idx:ident, $jpi_tgt:ident } => $jpi_handler:block
+
+        FlushHighlight { $flush_kind:ident } => $flush_handler:block
+        AwaitInput => $await_handler:block
+
+        _ => $bad_opcode:expr $(,)?
+    }) => {{
+        #[inline(always)]
+        fn dec_reg_single(bytes: &[u8], off: usize) -> Register {
+            let b = unsafe { *bytes.as_ptr().add(off) as usize };
+            Register::from_usize(b & 0xf)
+        }
+
+        #[inline(always)]
+        fn dec_reg_pair(bytes: &[u8], off: usize) -> (Register, Register) {
+            let b = unsafe { *bytes.as_ptr().add(off) as usize };
+            let dst = Register::from_usize(b & 0xf);
+            let src = Register::from_usize(b >> 4);
+            (dst, src)
+        }
+
+        #[inline(always)]
+        fn dec_u32(bytes: &[u8], off: usize) -> u32 {
+            unsafe { (bytes.as_ptr().add(off) as *const u32).read_unaligned() }
+        }
+
+        let __asm: &[u8] = $assembly;
+        let __off = $pc as usize;
+
+        // The use of unsafe code above boosts performance by about 10%. We rely on the code
+        // generator to emit invalid 0xff opcodes at the end of the instruction stream as padding.
+        // This way we can read past-the-end, even if the last non-0xff instruction is truncated.
+        let __opcode = __asm[__off];
+
+        match __opcode {
+            0 => {
+                $pc += 2;
+                let ($mov_dst, $mov_src) = dec_reg_pair(__asm, __off + 1);
+                $mov_handler
+            }
+            1 => {
+                $pc += 2;
+                let ($add_dst, $add_src) = dec_reg_pair(__asm, __off + 1);
+                $add_handler
+            }
+            2 => {
+                $pc += 2;
+                let ($sub_dst, $sub_src) = dec_reg_pair(__asm, __off + 1);
+                $sub_handler
+            }
+            3 => {
+                $pc += 6;
+                let $movi_dst = dec_reg_single(__asm, __off + 1);
+                let $movi_imm = dec_u32(__asm, __off + 2);
+                $movi_handler
+            }
+            4 => {
+                $pc += 6;
+                let $addi_dst = dec_reg_single(__asm, __off + 1);
+                let $addi_imm = dec_u32(__asm, __off + 2);
+                $addi_handler
+            }
+            5 => {
+                $pc += 6;
+                let $subi_dst = dec_reg_single(__asm, __off + 1);
+                let $subi_imm = dec_u32(__asm, __off + 2);
+                $subi_handler
+            }
+            6 => {
+                $pc += 5;
+                let $call_tgt = dec_u32(__asm, __off + 1);
+                $call_handler
+            }
+            7 => {
+                $pc += 1;
+                $ret_handler
+            }
+            8 => {
+                $pc += 6;
+                let ($jeq_lhs, $jeq_rhs) = dec_reg_pair(__asm, __off + 1);
+                let $jeq_tgt = dec_u32(__asm, __off + 2);
+                $jeq_handler
+            }
+            9 => {
+                $pc += 6;
+                let ($jne_lhs, $jne_rhs) = dec_reg_pair(__asm, __off + 1);
+                let $jne_tgt = dec_u32(__asm, __off + 2);
+                $jne_handler
+            }
+            10 => {
+                $pc += 6;
+                let ($jlt_lhs, $jlt_rhs) = dec_reg_pair(__asm, __off + 1);
+                let $jlt_tgt = dec_u32(__asm, __off + 2);
+                $jlt_handler
+            }
+            11 => {
+                $pc += 6;
+                let ($jle_lhs, $jle_rhs) = dec_reg_pair(__asm, __off + 1);
+                let $jle_tgt = dec_u32(__asm, __off + 2);
+                $jle_handler
+            }
+            12 => {
+                $pc += 6;
+                let ($jgt_lhs, $jgt_rhs) = dec_reg_pair(__asm, __off + 1);
+                let $jgt_tgt = dec_u32(__asm, __off + 2);
+                $jgt_handler
+            }
+            13 => {
+                $pc += 6;
+                let ($jge_lhs, $jge_rhs) = dec_reg_pair(__asm, __off + 1);
+                let $jge_tgt = dec_u32(__asm, __off + 2);
+                $jge_handler
+            }
+            14 => {
+                $pc += 5;
+                let $jeol_tgt = dec_u32(__asm, __off + 1);
+                $jeol_handler
+            }
+            15 => {
+                $pc += 9;
+                let $jc_idx = dec_u32(__asm, __off + 1);
+                let $jc_tgt = dec_u32(__asm, __off + 5);
+                $jc_handler
+            }
+            16 => {
+                $pc += 9;
+                let $jp_idx = dec_u32(__asm, __off + 1);
+                let $jp_tgt = dec_u32(__asm, __off + 5);
+                $jp_handler
+            }
+            17 => {
+                $pc += 9;
+                let $jpi_idx = dec_u32(__asm, __off + 1);
+                let $jpi_tgt = dec_u32(__asm, __off + 5);
+                $jpi_handler
+            }
+            18 => {
+                $pc += 2;
+                let $flush_kind = dec_reg_single(__asm, __off + 1);
+                $flush_handler
+            }
+            19 => {
+                $pc += 1;
+                $await_handler
+            }
+            _ => $bad_opcode,
+        }
+    }};
+}
+
+impl Instruction {
+    // JumpIfMatchCharset, etc., are 1 byte opcode + two u32 parameters.
+    pub const MAX_ENCODED_SIZE: usize = 9;
+
+    pub fn address_offset(&self) -> Option<usize> {
+        match *self {
+            Instruction::MovImm { .. }
+            | Instruction::AddImm { .. }
+            | Instruction::SubImm { .. } => Some(2), // opcode + dst
+
+            Instruction::Call { .. } => Some(1), // opcode
+
+            Instruction::JumpEQ { .. }
+            | Instruction::JumpNE { .. }
+            | Instruction::JumpLT { .. }
+            | Instruction::JumpLE { .. }
+            | Instruction::JumpGT { .. }
+            | Instruction::JumpGE { .. } => Some(2), // opcode + lhs/rhs pair
+
+            Instruction::JumpIfEndOfLine { .. } => Some(1), // opcode
+
+            Instruction::JumpIfMatchCharset { .. }
+            | Instruction::JumpIfMatchPrefix { .. }
+            | Instruction::JumpIfMatchPrefixInsensitive { .. } => Some(5), // opcode + idx
+
+            _ => None,
+        }
+    }
+
+    #[allow(clippy::identity_op)]
+    pub fn encode<'a>(&self, arena: &'a Arena) -> Vec<u8, &'a Arena> {
+        fn enc_reg_pair(lo: Register, hi: Register) -> u8 {
+            ((hi as u8) << 4) | (lo as u8)
+        }
+
+        fn enc_reg_single(lo: Register) -> u8 {
+            lo as u8
+        }
+
+        fn enc_u32(val: u32) -> [u8; 4] {
+            val.to_le_bytes()
+        }
+
+        let mut bytes = Vec::with_capacity_in(16, arena);
+        #[allow(clippy::missing_transmute_annotations)]
+        bytes.push(unsafe { std::mem::transmute(std::mem::discriminant(self)) });
+
+        match *self {
+            Instruction::Mov { dst, src }
+            | Instruction::Add { dst, src }
+            | Instruction::Sub { dst, src } => {
+                bytes.push(enc_reg_pair(dst, src));
+            }
+            Instruction::MovImm { dst, imm }
+            | Instruction::AddImm { dst, imm }
+            | Instruction::SubImm { dst, imm } => {
+                bytes.push(enc_reg_single(dst));
+                bytes.extend_from_slice(&enc_u32(imm));
+            }
+
+            Instruction::Call { tgt } => {
+                bytes.extend_from_slice(&enc_u32(tgt));
+            }
+            Instruction::Return => {}
+
+            Instruction::JumpEQ { lhs, rhs, tgt }
+            | Instruction::JumpNE { lhs, rhs, tgt }
+            | Instruction::JumpLT { lhs, rhs, tgt }
+            | Instruction::JumpLE { lhs, rhs, tgt }
+            | Instruction::JumpGT { lhs, rhs, tgt }
+            | Instruction::JumpGE { lhs, rhs, tgt } => {
+                bytes.push(enc_reg_pair(lhs, rhs));
+                bytes.extend_from_slice(&enc_u32(tgt));
+            }
+
+            Instruction::JumpIfEndOfLine { tgt } => {
+                bytes.extend_from_slice(&enc_u32(tgt));
+            }
+            Instruction::JumpIfMatchCharset { idx, tgt }
+            | Instruction::JumpIfMatchPrefix { idx, tgt }
+            | Instruction::JumpIfMatchPrefixInsensitive { idx, tgt } => {
+                bytes.extend_from_slice(&enc_u32(idx));
+                bytes.extend_from_slice(&enc_u32(tgt));
+            }
+
+            Instruction::FlushHighlight { kind } => {
+                bytes.push(enc_reg_single(kind));
+            }
+            Instruction::AwaitInput => {}
+        }
+
+        bytes
+    }
+
+    pub fn decode(bytes: &[u8]) -> (Option<Self>, usize) {
+        let mut pc = 0;
+        let instr = instruction_decode!(bytes, pc, {
+            Mov { dst, src } => {
+                Instruction::Mov { dst, src }
+            }
+            Add { dst, src } => {
+                Instruction::Add { dst, src }
+            }
+            Sub { dst, src } => {
+                Instruction::Sub { dst, src }
+            }
+            MovImm { dst, imm } => {
+                Instruction::MovImm { dst, imm }
+            }
+            AddImm { dst, imm } => {
+                Instruction::AddImm { dst, imm }
+            }
+            SubImm { dst, imm } => {
+                Instruction::SubImm { dst, imm }
+            }
+            Call { tgt } => {
+                Instruction::Call { tgt }
+            }
+            Return => {
+                Instruction::Return
+            }
+            JumpEQ { lhs, rhs, tgt } => {
+                Instruction::JumpEQ { lhs, rhs, tgt }
+            }
+            JumpNE { lhs, rhs, tgt } => {
+                Instruction::JumpNE { lhs, rhs, tgt }
+            }
+            JumpLT { lhs, rhs, tgt } => {
+                Instruction::JumpLT { lhs, rhs, tgt }
+            }
+            JumpLE { lhs, rhs, tgt } => {
+                Instruction::JumpLE { lhs, rhs, tgt }
+            }
+            JumpGT { lhs, rhs, tgt } => {
+                Instruction::JumpGT { lhs, rhs, tgt }
+            }
+            JumpGE { lhs, rhs, tgt } => {
+                Instruction::JumpGE { lhs, rhs, tgt }
+            }
+            JumpIfEndOfLine { tgt }=> {
+                Instruction::JumpIfEndOfLine { tgt }
+            }
+            JumpIfMatchCharset { idx, tgt } => {
+                Instruction::JumpIfMatchCharset { idx, tgt }
+            }
+            JumpIfMatchPrefix { idx, tgt } => {
+                Instruction::JumpIfMatchPrefix { idx, tgt }
+            }
+            JumpIfMatchPrefixInsensitive { idx, tgt } => {
+                Instruction::JumpIfMatchPrefixInsensitive { idx, tgt }
+            }
+            FlushHighlight { kind } => {
+                Instruction::FlushHighlight { kind }
+            }
+            AwaitInput=> {
+                Instruction::AwaitInput
+            }
+            _ => return (None, 1),
+        });
+        (Some(instr), pc)
+    }
+
+    pub fn mnemonic<'a>(
+        &self,
+        arena: &'a Arena,
+        config: &MnemonicFormattingConfig,
+    ) -> ArenaString<'a> {
+        let mut str = ArenaString::new_in(arena);
+        let _i = config.instruction_prefix;
+        let i_ = config.instruction_suffix;
+        let _r = config.register_prefix;
+        let r_ = config.register_suffix;
+        let _a = config.address_prefix;
+        let a_ = config.address_suffix;
+        let _n = config.numeric_prefix;
+        let n_ = config.numeric_suffix;
+
+        match *self {
+            Instruction::Mov { dst, src } => {
+                _ = write!(str, "{_i}mov{i_}    {_r}{dst}{r_}, {_r}{src}{r_}");
+            }
+            Instruction::Add { dst, src } => {
+                _ = write!(str, "{_i}add{i_}    {_r}{dst}{r_}, {_r}{src}{r_}");
+            }
+            Instruction::Sub { dst, src } => {
+                _ = write!(str, "{_i}sub{i_}    {_r}{dst}{r_}, {_r}{src}{r_}");
+            }
+            Instruction::MovImm { dst, imm } => {
+                if dst == Register::ProgramCounter {
+                    _ = write!(str, "{_i}movi{i_}   {_r}{dst}{r_}, {_a}{imm}{a_}");
+                } else {
+                    _ = write!(str, "{_i}movi{i_}   {_r}{dst}{r_}, {_n}{imm}{n_}");
+                }
+            }
+            Instruction::AddImm { dst, imm } => {
+                _ = write!(str, "{_i}addi{i_}   {_r}{dst}{r_}, {_n}{imm}{n_}");
+            }
+            Instruction::SubImm { dst, imm } => {
+                _ = write!(str, "{_i}subi{i_}   {_r}{dst}{r_}, {_n}{imm}{n_}");
+            }
+
+            Instruction::Call { tgt } => {
+                _ = write!(str, "{_i}call{i_}   {_a}{tgt}{a_}");
+            }
+            Instruction::Return => {
+                _ = write!(str, "{_i}ret{i_}");
+            }
+
+            Instruction::JumpEQ { lhs, rhs, tgt } => {
+                _ = write!(str, "{_i}jeq{i_}    {_r}{lhs}{r_}, {_r}{rhs}{r_}, {_a}{tgt}{a_}");
+            }
+            Instruction::JumpNE { lhs, rhs, tgt } => {
+                _ = write!(str, "{_i}jne{i_}    {_r}{lhs}{r_}, {_r}{rhs}{r_}, {_a}{tgt}{a_}");
+            }
+            Instruction::JumpLT { lhs, rhs, tgt } => {
+                _ = write!(str, "{_i}jlt{i_}    {_r}{lhs}{r_}, {_r}{rhs}{r_}, {_a}{tgt}{a_}");
+            }
+            Instruction::JumpLE { lhs, rhs, tgt } => {
+                _ = write!(str, "{_i}jle{i_}    {_r}{lhs}{r_}, {_r}{rhs}{r_}, {_a}{tgt}{a_}");
+            }
+            Instruction::JumpGT { lhs, rhs, tgt } => {
+                _ = write!(str, "{_i}jgt{i_}    {_r}{lhs}{r_}, {_r}{rhs}{r_}, {_a}{tgt}{a_}");
+            }
+            Instruction::JumpGE { lhs, rhs, tgt } => {
+                _ = write!(str, "{_i}jge{i_}    {_r}{lhs}{r_}, {_r}{rhs}{r_}, {_a}{tgt}{a_}");
+            }
+
+            Instruction::JumpIfEndOfLine { tgt } => {
+                _ = write!(str, "{_i}jeol{i_}   {_a}{tgt}{a_}");
+            }
+            Instruction::JumpIfMatchCharset { idx, tgt } => {
+                _ = write!(str, "{_i}jc{i_}     {_n}{idx}{n_}, {_a}{tgt}{a_}");
+            }
+            Instruction::JumpIfMatchPrefix { idx, tgt } => {
+                _ = write!(str, "{_i}jp{i_}     {_n}{idx}{n_}, {_a}{tgt}{a_}");
+            }
+            Instruction::JumpIfMatchPrefixInsensitive { idx, tgt } => {
+                _ = write!(str, "{_i}jpi{i_}    {_n}{idx}{n_}, {_a}{tgt}{a_}");
+            }
+
+            Instruction::FlushHighlight { kind } => {
+                _ = write!(str, "{_i}flush{i_}  {_r}{kind}{r_}");
+            }
+            Instruction::AwaitInput => {
+                _ = write!(str, "{_i}await{i_}");
+            }
+        }
+
+        str
+    }
+}
+
+#[derive(Default)]
+pub struct MnemonicFormattingConfig<'a> {
+    // Color used for highlighting the instruction.
+    pub instruction_prefix: &'a str,
+    pub instruction_suffix: &'a str,
+
+    // Color used for highlighting a register name.
+    pub register_prefix: &'a str,
+    pub register_suffix: &'a str,
+
+    // Color used for highlighting an immediate value.
+    pub address_prefix: &'a str,
+    pub address_suffix: &'a str,
+
+    // Color used for highlighting an immediate value.
+    pub numeric_prefix: &'a str,
+    pub numeric_suffix: &'a str,
+}