diff --git a/README.md b/README.md
index 044e1ccd..318d0176 100644
--- a/README.md
+++ b/README.md
@@ -22,12 +22,13 @@
 
 ## Core Model in One Screen
 
-**No IR layers — source IS the IR.** The program counter is a kvspace path string; call-stack depth equals path depth:
+**No IR layers — source IS the IR.** The program counter is a kvspace path string; call-stack depth is the frame number in that path:
 
 ```
-PC    = "/vthread/tid/[0,0]/[0,0]/[1,0]"   the program counter is a KV path
-fetch = kv.Get(PC)                           instruction fetch is one KV read
-call  = create subtree; return = clean it    crash? restart and resume from PC
+PC    = "/vthread/tid/[1]/[3,0]"              vthread tid, frame 1, instruction 3
+fetch = GetBatch(frame/, ["[3,0]"])           take opcode from the frame dir (extindex → /lib)
+call  = create frame [d+1]; return = DelTree  crash? restart and resume from PC
+goto/br = rewrite the irseq in the same frame  if/while do not create frames
 ```
 
 Every instruction occupies a 2-D coordinate `[s0, s1]`: `[s0,0]` is always the opcode, `[s0,-j]` read params, `[s0,+j]` write params.
diff --git a/README_CN.md b/README_CN.md
index 3e86e3d1..c1fbc91a 100644
--- a/README_CN.md
+++ b/README_CN.md
@@ -22,12 +22,13 @@
 
 ## 核心模型：一屏看懂
 
-**不分 IR 层，源码即 IR。** 程序计数器是 kvspace 路径字符串，调用栈深度 = 路径深度：
+**不分 IR 层，源码即 IR。** 程序计数器是 kvspace 路径字符串，调用栈深度是路径里的帧号：
 
 ```
-PC   = "/vthread/tid/[0,0]/[0,0]/[1,0]"   程序计数器是 KV 路径
-指令 = kv.Get(PC)                           取指是一次 KV 读
-调用 = 创建子树；返回 = 清理子树             崩溃后按 PC 重启继续
+PC   = "/vthread/tid/[1]/[3,0]"            vthread tid、第 1 帧、第 3 条指令
+取指 = GetBatch(帧目录/, ["[3,0]"])         从帧目录取 opcode（extindex → /lib）
+调用 = 创建 [d+1] 帧；返回 = DelTree        崩溃后按 PC 重启继续
+goto/br = 只改同一帧的 irseq                if/while 不建帧
 ```
 
 每条指令占据二维坐标 `[s0, s1]`：`[s0,0]` 恒为操作码，`[s0,-j]` 读参，`[s0,+j]` 写参。
diff --git a/layout/src/code.rs b/layout/src/code.rs
index 5dc128c7..10f3caad 100644
--- a/layout/src/code.rs
+++ b/layout/src/code.rs
@@ -4,12 +4,14 @@
 //!   /lib/<pkg>·<name>/[0,0]         编译后签名（kind=rwfunc）
 //!   /lib/<pkg>·<name>/<param>       命名参数→slot 指针（kind=char, isptr=1）
 //!   /lib/<pkg>·<name>/[i,j]         编译后指令（kind=rwir），i 从 1 开始
-//!   /lib/<pkg>·<name>/<label>/      基本块子路径（scope 指令）
+//!   /lib/<pkg>·<name>/‥labels/<l>   label → irseq
 //!   /lib/<pkg>·<name>.src           源码副本
+//!
+//! WriteBody: DFS-number insts (incl. ScopeStmt), emit [i,j], rewrite goto/br labels to irseq.
 
 use std::collections::HashMap;
 
-use super::ast::{Func, RwirDecl, Stmt};
+use super::ast::{Func, Instruction, RwirDecl, Stmt};
 use super::ffi::Kv;
 use super::{builtin, ffi, keytree, kvkind, lower, parser};
 
@@ -373,6 +375,10 @@ pub fn write_func(kv: &mut Kv, pkg: &str, fn_: &mut Func) {
         eprintln!("debug: func {qual} already defined — overwriting");
     }
 
+    let mut seq: Vec<Instruction> = Vec::new();
+    let mut labels: HashMap<String, i32> = HashMap::new();
+    collect_insts(&fn_.body, &mut seq, &mut labels);
+
     // 按函数覆盖（文件夹复制式合并）：只 del_tree 本函数子树，不动 /lib 下其它函数。
     // 禁止整库删除——layoutcode 必须可增量：多次 layout 各自覆盖其函数，不误删先前的函数。
     let _ = kv.del_tree(&func_dir);
@@ -385,7 +391,7 @@ pub fn write_func(kv: &mut Kv, pkg: &str, fn_: &mut Func) {
     let mut pairs: Vec<(String, Vec<u8>)> = Vec::new();
     pairs.push((
         format!("{func_dir}/[0,0]"),
-        kvkind::new_rwfunc(count_direct_insts(&fn_.body), nr, nw, &param_types),
+        kvkind::new_rwfunc(seq.len() as i32, nr, nw, &param_types),
     ));
     pairs.push((
         keytree::lib_src(pkg, &fn_.sig.name),
@@ -407,7 +413,17 @@ pub fn write_func(kv: &mut Kv, pkg: &str, fn_: &mut Func) {
     }
     let _ = kv.set(&pairs);
 
-    write_body(kv, pkg, &fn_.sig.name, &fn_.body, &mut type_map, 1);
+    for (i, inst) in seq.iter().enumerate() {
+        write_linear_inst(kv, &func_dir, (i as i32) + 1, inst, &labels, &mut type_map);
+    }
+    if !labels.is_empty() {
+        let _ = kv.mkindex(&keytree::lib_labels_dir(pkg, &fn_.sig.name));
+        let lpairs: Vec<(String, Vec<u8>)> = labels
+            .iter()
+            .map(|(label, irseq)| (keytree::lib_label(pkg, &fn_.sig.name, label), ffi::new_int64(*irseq as i64)))
+            .collect();
+        let _ = kv.set(&lpairs);
+    }
 }
 
 /// 写用户声明的 rwir（无体）到 /lib/<opcode>。
@@ -424,148 +440,96 @@ pub fn write_rwir_decl(kv: &mut Kv, decl: &RwirDecl) {
     let _ = kv.set(&[(keytree::rwir(&opcode), v)]);
 }
 
-/// 将 body 写入 /lib/<pkg>/<name>/ 下。offset 起始 idx（顶层函数=1）。
-fn write_body(
-    kv: &mut Kv,
-    pkg: &str,
-    name: &str,
-    body: &[Stmt],
-    type_map: &mut HashMap<String, String>,
-    offset: i32,
-) {
-    let prefix = keytree::lib_func(pkg, name);
-    let mut idx = offset;
+/// Flatten body into seq; ScopeStmt records label → irseq (1-based; [0,0] is the signature).
+fn collect_insts(body: &[Stmt], seq: &mut Vec<Instruction>, labels: &mut HashMap<String, i32>) {
     for st in body {
-        write_stmt(kv, st, &prefix, &mut idx, type_map, pkg);
+        match st {
+            Stmt::Instruction(s) => seq.push(s.clone()),
+            Stmt::Scope(s) => {
+                if s.label.is_empty() {
+                    panic!("WriteBody: ScopeStmt with empty label");
+                }
+                if labels.contains_key(&s.label) {
+                    panic!("WriteBody: duplicate label {}", s.label);
+                }
+                let start = seq.len() as i32 + 1;
+                if start > 1 && !inst_is_terminator(seq.last().unwrap()) {
+                    panic!("WriteBody: fall through into label {}", s.label);
+                }
+                labels.insert(s.label.clone(), start);
+                collect_insts(&s.body, seq, labels);
+                if (seq.len() as i32) < start || !inst_is_terminator(seq.last().unwrap()) {
+                    panic!("WriteBody: unterminated block {}", s.label);
+                }
+            }
+            _ => panic!("WriteBody: unexpected stmt {} after lower", st.first_line()),
+        }
     }
 }
 
-fn write_stmt(
+fn write_linear_inst(
     kv: &mut Kv,
-    st: &Stmt,
     prefix: &str,
-    idx: &mut i32,
+    n: i32,
+    s: &Instruction,
+    labels: &HashMap<String, i32>,
     type_map: &mut HashMap<String, String>,
-    pkg: &str,
 ) {
-    match st {
-        Stmt::Instruction(s) => {
-            let n = *idx;
-            for (j, w) in s.writes.iter().enumerate() {
-                if j < s.write_types.len() && !s.write_types[j].is_empty() {
-                    type_map.insert(w.clone(), s.write_types[j].clone());
-                }
-            }
-            let (opcode, reads) = s.flat();
-            let target_char = if s.writes.len() == 1
-                && !s.write_types.is_empty()
-                && kvkind::is_char_kind(&s.write_types[0])
-            {
-                s.write_types[0].as_str()
-            } else {
-                ""
-            };
-
-            let mut pairs: Vec<(String, Vec<u8>)> =
-                Vec::with_capacity(1 + reads.len() + s.writes.len());
-            if !opcode.is_empty() {
-                pairs.push((format!("{prefix}/[{n},0]"), opcode_value(&opcode)));
-            }
-            for (j, r) in reads.iter().enumerate() {
-                pairs.push((
-                    format!("{prefix}/[{n},-{}]", j + 1),
-                    slot_value(r, target_char),
-                ));
-            }
-            for (j, w) in s.writes.iter().enumerate() {
-                pairs.push((format!("{prefix}/[{n},{}]", j + 1), slot_value(w, "")));
-            }
-            if !pairs.is_empty() {
-                let _ = kv.set(&pairs);
+    for (j, w) in s.writes.iter().enumerate() {
+        if j < s.write_types.len() && !s.write_types[j].is_empty() {
+            type_map.insert(w.clone(), s.write_types[j].clone());
+        }
+    }
+    let (opcode, mut reads) = s.flat();
+    match opcode.as_str() {
+        "goto" => {
+            if reads.len() != 1 {
+                panic!("WriteBody: goto expects 1 read, got {}", reads.len());
             }
-            *idx = n + 1;
+            reads[0] = resolve_label(labels, &reads[0], "goto").to_string();
         }
-        Stmt::Scope(s) => {
-            let scope_prefix = format!("{prefix}/{}", s.label);
-            let mut scope_idx = 0;
-            for child in &s.body {
-                write_stmt_scope(
-                    kv,
-                    child,
-                    &scope_prefix,
-                    &mut scope_idx,
-                    type_map,
-                    pkg,
-                    prefix,
-                );
+        "br" => {
+            if reads.len() != 3 {
+                panic!("WriteBody: br expects 3 reads, got {}", reads.len());
             }
+            reads[1] = resolve_label(labels, &reads[1], "br").to_string();
+            reads[2] = resolve_label(labels, &reads[2], "br").to_string();
         }
         _ => {}
     }
+    let target_char = if s.writes.len() == 1 && !s.write_types.is_empty() && kvkind::is_char_kind(&s.write_types[0]) {
+        s.write_types[0].as_str()
+    } else {
+        ""
+    };
+
+    let mut pairs: Vec<(String, Vec<u8>)> = Vec::with_capacity(1 + reads.len() + s.writes.len());
+    if !opcode.is_empty() {
+        pairs.push((format!("{prefix}/[{n},0]"), opcode_value(&opcode)));
+    }
+    for (j, r) in reads.iter().enumerate() {
+        pairs.push((format!("{prefix}/[{n},-{}]", j + 1), slot_value(r, target_char)));
+    }
+    for (j, w) in s.writes.iter().enumerate() {
+        pairs.push((format!("{prefix}/[{n},{}]", j + 1), slot_value(w, "")));
+    }
+    if !pairs.is_empty() {
+        let _ = kv.set(&pairs);
+    }
 }
 
-fn write_stmt_scope(
-    kv: &mut Kv,
-    st: &Stmt,
-    scope_prefix: &str,
-    idx: &mut i32,
-    type_map: &mut HashMap<String, String>,
-    pkg: &str,
-    func_prefix: &str,
-) {
-    match st {
-        Stmt::Instruction(s) => {
-            let n = *idx;
-            for (j, w) in s.writes.iter().enumerate() {
-                if j < s.write_types.len() && !s.write_types[j].is_empty() {
-                    type_map.insert(w.clone(), s.write_types[j].clone());
-                }
-            }
-            let (opcode, reads) = s.flat();
-            let target_char = if s.writes.len() == 1
-                && !s.write_types.is_empty()
-                && kvkind::is_char_kind(&s.write_types[0])
-            {
-                s.write_types[0].as_str()
-            } else {
-                ""
-            };
+fn inst_is_terminator(inst: &Instruction) -> bool {
+    match &inst.expr {
+        Some(e) if e.is_leaf() => e.val == "return",
+        Some(e) => matches!(e.op.as_str(), "return" | "goto" | "br"),
+        None => false,
+    }
+}
 
-            let mut pairs: Vec<(String, Vec<u8>)> =
-                Vec::with_capacity(1 + reads.len() + s.writes.len());
-            if !opcode.is_empty() {
-                pairs.push((format!("{scope_prefix}[{n},0]"), opcode_value(&opcode)));
-            }
-            for (j, r) in reads.iter().enumerate() {
-                pairs.push((
-                    format!("{scope_prefix}[{n},-{}]", j + 1),
-                    slot_value(r, target_char),
-                ));
-            }
-            for (j, w) in s.writes.iter().enumerate() {
-                pairs.push((format!("{scope_prefix}[{n},{}]", j + 1), slot_value(w, "")));
-            }
-            if !pairs.is_empty() {
-                let _ = kv.set(&pairs);
-            }
-            *idx = n + 1;
-        }
-        Stmt::Scope(s) => {
-            let child_prefix = format!("{func_prefix}/{}", s.label);
-            let mut child_idx = 0;
-            for child in &s.body {
-                write_stmt_scope(
-                    kv,
-                    child,
-                    &child_prefix,
-                    &mut child_idx,
-                    type_map,
-                    pkg,
-                    func_prefix,
-                );
-            }
-        }
-        _ => {}
+fn resolve_label(labels: &HashMap<String, i32>, name: &str, opcode: &str) -> i32 {
+    match labels.get(name) {
+        Some(&irseq) => irseq,
+        None => panic!("WriteBody: {opcode} unknown label {name:?}"),
     }
 }
 
@@ -609,12 +573,6 @@ fn slot_value(val: &str, target_char: &str) -> Vec<u8> {
     kvkind::new_rwir(0, 0, val)
 }
 
-fn count_direct_insts(body: &[Stmt]) -> i32 {
-    body.iter()
-        .filter(|st| matches!(st, Stmt::Instruction(_)))
-        .count() as i32
-}
-
 fn is_literal(s: &str) -> bool {
     if s.is_empty() {
         return false;
@@ -678,6 +636,7 @@ mod tests {
     fn dot_is_ordinary_char_contiguous_coords() {
         // '.' 是普通字符（小数点/后缀等），foo.bar 视作单一 opcode，不再被切成 foo bar 两 token
         // 而摊出畸形坐标（#106）。断言：opcode 原样保留，且指令坐标连续、无空缺行。
+        // #116 flat 模型：终结符补全后 [3,0] 为 terminate 追加的 return，[4,0] 才是帧末尾。
         let mut kv = Kv::conn(&format!(
             "fs:///tmp/kvlanglayout_dot_{}",
             std::process::id()
@@ -698,8 +657,58 @@ mod tests {
             "[2,0] 应有指令：坐标不得空缺"
         );
         assert!(
-            kv.get_one("/lib/t·main/[3,0]").is_empty(),
-            "[3,0] 应为帧末尾（连续无空缺）"
+            kvkind::value_string(&kv.get_one("/lib/t·main/[3,0]")).contains("return"),
+            "[3,0] 应为 terminate 追加的 return（连续无空缺）"
+        );
+        assert!(
+            kv.get_one("/lib/t·main/[4,0]").is_empty(),
+            "[4,0] 应为帧末尾（连续无空缺）"
+        );
+    }
+
+    #[test]
+    #[should_panic(expected = "fall through into label")]
+    fn fallthrough_into_label_panics() {
+        let mut seq = Vec::new();
+        let mut labels = HashMap::new();
+        collect_insts(
+            &[
+                Stmt::Instruction(Instruction {
+                    expr: Some(crate::ast::leaf("1")),
+                    writes: vec!["x".into()],
+                    ..Default::default()
+                }),
+                Stmt::Scope(crate::ast::ScopeStmt {
+                    comments: Vec::new(),
+                    label: "_open".into(),
+                    body: vec![Stmt::Instruction(Instruction {
+                        expr: Some(crate::ast::leaf("return")),
+                        ..Default::default()
+                    })],
+                }),
+            ],
+            &mut seq,
+            &mut labels,
+        );
+    }
+
+    #[test]
+    #[should_panic(expected = "unterminated block")]
+    fn unterminated_block_panics() {
+        let mut seq = Vec::new();
+        let mut labels = HashMap::new();
+        collect_insts(
+            &[Stmt::Scope(crate::ast::ScopeStmt {
+                comments: Vec::new(),
+                label: "_open".into(),
+                body: vec![Stmt::Instruction(Instruction {
+                    expr: Some(crate::ast::leaf("1")),
+                    writes: vec!["x".into()],
+                    ..Default::default()
+                })],
+            })],
+            &mut seq,
+            &mut labels,
         );
     }
 }
diff --git a/layout/src/keytree.rs b/layout/src/keytree.rs
index faa46094..463a103b 100644
--- a/layout/src/keytree.rs
+++ b/layout/src/keytree.rs
@@ -20,7 +20,7 @@ pub const SEG_CTIME: &str = "ctime";
 pub const SEG_DEBUGGER: &str = "debugger";
 
 pub const SEG_LIB: &str = "\u{2025}lib"; // 帧 extindex 标记
-pub const SCOPE_SEP: &str = "/\u{2025}"; // scope 帧路径前缀
+pub const SEG_LABELS: &str = "labels"; // /lib/<func>/‥labels/<name> → irseq
 pub const SRC_EXT: &str = ".src"; // 函数源码文件后缀
 
 pub const LIB_ROOT: &str = "/lib";
@@ -45,6 +45,16 @@ pub fn lib_src(pkg: &str, name: &str) -> String {
     }
 }
 
+/// `/lib/<pkg>·<name>/‥labels/`
+pub fn lib_labels_dir(pkg: &str, name: &str) -> String {
+    format!("{}/{RUNTIME_MEMBER_SEP}{SEG_LABELS}/", lib_func(pkg, name))
+}
+
+/// `/lib/<pkg>·<name>/‥labels/<label>`
+pub fn lib_label(pkg: &str, name: &str, label: &str) -> String {
+    format!("{}{label}", lib_labels_dir(pkg, name))
+}
+
 pub fn rwir(opcode: &str) -> String {
     format!("{RWIR_ROOT}/{opcode}")
 }
@@ -71,16 +81,7 @@ pub fn return_pc(root: &str) -> String {
     frame_member(root, SEG_RETURNPC)
 }
 
-/// 父帧根（label 帧返回上级目录）。
-pub fn parent_frame(frame_root: &str) -> String {
-    let trimmed = frame_root.trim_end_matches(PATH_SEG_SEP);
-    match trimmed.rfind(PATH_SEG_SEP) {
-        None => String::new(),
-        Some(i) => format!("{}/", &trimmed[..i]),
-    }
-}
-
-/// 从 PC 提取帧根（pc 形如 /vthread/42/[3,0]）。
+/// Frame root of a PC (`/vthread/42/[3]/[5,0]` → `/vthread/42/[3]`).
 pub fn frame_root(pc: &str) -> &str {
     if let Some(idx) = pc.rfind("/[") {
         &pc[..idx]
@@ -97,10 +98,6 @@ pub fn is_entry_pc(pc: &str) -> bool {
     pc.ends_with("/[1,0]")
 }
 
-pub fn scope_entry_pc(root: &str) -> String {
-    format!("{}/[0,0]", root.trim_end_matches(PATH_SEG_SEP))
-}
-
 // ── 成员 ─────────────────────────────────────────────────────────────
 
 pub fn member(base: &str, name: &str) -> String {
diff --git a/layout/src/lower.rs b/layout/src/lower.rs
index b8046852..0bc793b6 100644
--- a/layout/src/lower.rs
+++ b/layout/src/lower.rs
@@ -110,12 +110,36 @@ pub fn lower_func(fn_: &Func) -> Func {
     // 收集已有 br/goto 的跳转目标：这些 label 已可达，lower 时不再补 fall-through goto（幂等）。
     let mut targets = HashSet::new();
     collect_goto_targets(&fn_.body, &mut targets);
-    let body = lower_body(&fn_.body, &mut lg, None, &tm, &targets);
-    Func {
+    let body = terminate(lower_body(&fn_.body, &mut lg, None, &tm, &targets));
+    Func { comments: Vec::new(), sig: fn_.sig.clone(), body, pkg: String::new() }
+}
+
+fn return_inst() -> Stmt {
+    Stmt::Instruction(Instruction {
         comments: Vec::new(),
-        sig: fn_.sig.clone(),
-        body,
-        pkg: String::new(),
+        expr: Some(ast::leaf("return")),
+        writes: Vec::new(),
+        write_types: Vec::new(),
+        arrow_left: false,
+        eq: false,
+    })
+}
+
+/// Append `return` on open paths. Layout panics if a block is still unterminated.
+fn terminate(mut body: Vec<Stmt>) -> Vec<Stmt> {
+    for st in &mut body {
+        if let Stmt::Scope(s) = st {
+            s.body = terminate(std::mem::take(&mut s.body));
+        }
+    }
+    match body.last() {
+        None => vec![return_inst()],
+        Some(Stmt::Instruction(s)) if is_terminator(s) => body,
+        Some(Stmt::Scope(_)) => body,
+        _ => {
+            body.push(return_inst());
+            body
+        }
     }
 }
 
@@ -638,6 +662,7 @@ fn inject_goto(mut body: Vec<Stmt>, label: &str) -> Vec<Stmt> {
 
 fn is_terminator(s: &Instruction) -> bool {
     match &s.expr {
+        Some(e) if e.is_leaf() => e.val == "return",
         Some(e) => matches!(e.op.as_str(), "return" | "goto" | "br"),
         None => false,
     }
diff --git a/layout/tests/issue116.rs b/layout/tests/issue116.rs
new file mode 100644
index 00000000..01de704f
--- /dev/null
+++ b/layout/tests/issue116.rs
@@ -0,0 +1,468 @@
+//! Control-flow after lower: one [irseq,j] plane, goto/br to int64, no scope keys.
+use std::collections::{BTreeMap, HashMap};
+
+use kvlanglayout::{compile, init_dirs, kvkind, Kv};
+
+fn body(data: &[u8]) -> &[u8] {
+    let h = kvkind::head(data);
+    kvkind::body(data, &h)
+}
+
+fn sig(data: &[u8]) -> String {
+    let b = body(data);
+    String::from_utf8_lossy(&b[4.min(b.len())..]).into_owned()
+}
+
+fn slot_text(data: &[u8]) -> String {
+    let k = kvkind::kind(data);
+    if k == "int64" || k == "bool" || k == "float64" {
+        kvkind::display(data).rsplit(':').next().unwrap_or("").to_string()
+    } else {
+        sig(data)
+    }
+}
+
+fn fresh_kv() -> Kv {
+    let dsn = format!(
+        "fs:///tmp/kvlanglayout_i116_{}_{}",
+        std::process::id(),
+        std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap()
+            .as_nanos()
+    );
+    let mut kv = Kv::conn(&dsn);
+    init_dirs(&mut kv).unwrap();
+    kv
+}
+
+fn children_of(kv: &mut Kv, dir: &str) -> Vec<String> {
+    kv.list(dir, false, false)
+}
+
+fn is_terminator_op(op: &str) -> bool {
+    matches!(op, "return" | "goto" | "br")
+}
+
+fn parse_coord(name: &str) -> Option<(i32, i32)> {
+    let t = name.trim_end_matches('/');
+    if !t.starts_with('[') || !t.ends_with(']') || !t.contains(',') {
+        return None;
+    }
+    let inner = &t[1..t.len() - 1];
+    let mut it = inner.split(',');
+    let row = it.next()?.parse().ok()?;
+    let col = it.next()?.parse().ok()?;
+    if it.next().is_some() {
+        return None;
+    }
+    Some((row, col))
+}
+
+fn parse_row(name: &str) -> Option<i32> {
+    let (row, col) = parse_coord(name)?;
+    (col == 0).then_some(row)
+}
+
+struct Inst {
+    op: String,
+    reads: Vec<String>,
+    writes: Vec<String>,
+}
+
+fn plane(kv: &mut Kv, fn_: &str) -> BTreeMap<i32, Inst> {
+    let prefix = format!("/lib/{fn_}/");
+    let children = children_of(kv, &prefix);
+    let mut slots: BTreeMap<(i32, i32), String> = BTreeMap::new();
+    for c in &children {
+        let Some((row, col)) = parse_coord(c) else {
+            continue;
+        };
+        slots.insert((row, col), slot_text(&kv.get_one(&format!("{prefix}{c}"))));
+    }
+    let mut out = BTreeMap::new();
+    for ((row, col), text) in slots {
+        let e = out.entry(row).or_insert_with(|| Inst {
+            op: String::new(),
+            reads: Vec::new(),
+            writes: Vec::new(),
+        });
+        if col == 0 {
+            e.op = text;
+        } else if col < 0 {
+            let i = ((-col) as usize).saturating_sub(1);
+            if e.reads.len() <= i {
+                e.reads.resize(i + 1, String::new());
+            }
+            e.reads[i] = text;
+        } else {
+            let i = (col as usize).saturating_sub(1);
+            if e.writes.len() <= i {
+                e.writes.resize(i + 1, String::new());
+            }
+            e.writes[i] = text;
+        }
+    }
+    out
+}
+
+fn dump_ir(p: &BTreeMap<i32, Inst>) -> String {
+    let mut s = String::new();
+    for (n, inst) in p {
+        if *n == 0 {
+            continue;
+        }
+        s.push_str(&format!("{n}: {}", inst.op));
+        if !inst.reads.is_empty() {
+            s.push(' ');
+            s.push_str(&inst.reads.join(" "));
+        }
+        if !inst.writes.is_empty() {
+            s.push_str(" -> ");
+            s.push_str(&inst.writes.join(" "));
+        }
+        s.push('\n');
+    }
+    s
+}
+
+fn labels_of(kv: &mut Kv, fn_: &str) -> HashMap<String, i32> {
+    let dir = format!("/lib/{fn_}/\u{2025}labels/");
+    let mut out = HashMap::new();
+    for name in children_of(kv, &dir) {
+        let n = name.trim_end_matches('/');
+        if n.is_empty() {
+            continue;
+        }
+        let v = kv.get_one(&format!("{dir}{n}"));
+        if kvkind::kind(&v) != "int64" {
+            continue;
+        }
+        let disp = kvkind::display(&v);
+        let irseq: i32 = disp
+            .split(':')
+            .nth(1)
+            .unwrap_or_else(|| panic!("label {n} display={disp}"))
+            .parse()
+            .unwrap_or_else(|_| panic!("label {n} display={disp}"));
+        out.insert(n.to_string(), irseq);
+    }
+    out
+}
+
+fn assert_single_plane(kv: &mut Kv, fn_: &str) {
+    let children = children_of(kv, &format!("/lib/{fn_}/"));
+    assert!(!children.is_empty(), "{fn_}: empty");
+    let nested: Vec<_> = children
+        .iter()
+        .filter(|c| {
+            let b = c.trim_end_matches('/');
+            b.contains('/') || (b.starts_with('_') && b.contains('['))
+        })
+        .cloned()
+        .collect();
+    assert!(nested.is_empty(), "{fn_} nested/scope keys: {nested:?} all={children:?}");
+    let dirs: Vec<_> = children
+        .iter()
+        .filter(|c| c.ends_with('/') && !c.contains("labels") && parse_coord(c).is_none())
+        .cloned()
+        .collect();
+    assert!(dirs.is_empty(), "{fn_} extra dirs: {dirs:?} all={children:?}");
+    assert!(children.iter().any(|c| c.starts_with('[')), "{fn_} has no [i,j]: {children:?}");
+}
+
+fn assert_jumps_are_int64(kv: &mut Kv, fn_: &str, p: &BTreeMap<i32, Inst>) {
+    let mut saw = false;
+    for (n, inst) in p {
+        if inst.op != "goto" && inst.op != "br" {
+            continue;
+        }
+        saw = true;
+        let prefix = format!("/lib/{fn_}/");
+        let cols: &[i32] = if inst.op == "goto" { &[-1] } else { &[-2, -3] };
+        for col in cols {
+            let v = kv.get_one(&format!("{prefix}[{n},{col}]"));
+            assert_eq!(
+                kvkind::kind(&v),
+                "int64",
+                "{fn_} [{n},{col}] {} {}",
+                inst.op,
+                kvkind::display(&v)
+            );
+            let irseq: i32 = slot_text(&v).parse().unwrap();
+            assert!(irseq >= 1, "{fn_} [{n}] {} target {irseq} < 1", inst.op);
+            assert!(p.contains_key(&irseq), "{fn_} [{n}] {} -> missing {irseq}", inst.op);
+        }
+    }
+    assert!(saw, "{fn_}: no goto/br in\n{}", dump_ir(p));
+}
+
+fn assert_no_scope_opcode(p: &BTreeMap<i32, Inst>, fn_: &str) {
+    for (n, inst) in p {
+        if *n == 0 {
+            continue;
+        }
+        assert_ne!(inst.op, "scope", "{fn_} [{n}] still has scope opcode");
+        assert!(
+            !inst.op.starts_with('_'),
+            "{fn_} [{n}] opcode looks like a lowered label: {}",
+            inst.op
+        );
+        if inst.op == "call" {
+            let target = inst.reads.first().map(String::as_str).unwrap_or("");
+            assert!(
+                !target.contains("_then_")
+                    && !target.contains("_else_")
+                    && !target.contains("_while_")
+                    && !target.contains("_do_")
+                    && !target.contains("_if_")
+                    && !target.contains("_merge_")
+                    && !target.contains("_for_"),
+                "{fn_} [{n}] call still targets a scope: {target}"
+            );
+        }
+    }
+}
+
+fn compile_fn(src: &str) -> Kv {
+    let mut kv = fresh_kv();
+    compile(&mut kv, src).unwrap();
+    kv
+}
+
+#[test]
+fn lib_plane_has_no_scope_flat_keys() {
+    let mut kv = fresh_kv();
+    let src = std::fs::read_to_string("../tutorial/03-control/while.kv").unwrap();
+    compile(&mut kv, &src).unwrap();
+    for fn_ in ["sum_to", "first_div7", "sum_odds"] {
+        let prefix = format!("/lib/{fn_}/");
+        let children = children_of(&mut kv, &prefix);
+        assert!(!children.is_empty(), "{fn_}: empty");
+        let bad: Vec<_> = children
+            .iter()
+            .filter(|c| {
+                let b = c.trim_end_matches('/');
+                b.starts_with('_') && b.contains('[')
+            })
+            .cloned()
+            .collect();
+        assert!(bad.is_empty(), "{fn_} still has scope flat keys: {bad:?} all={children:?}");
+        assert!(children.iter().any(|c| c.starts_with('[')), "{fn_} has no [i,j]: {children:?}");
+        assert!(children.iter().any(|c| c.contains("labels")), "{fn_} missing ‥labels: {children:?}");
+    }
+}
+
+#[test]
+fn labeled_irseq_is_not_fallen_into() {
+    let mut kv = fresh_kv();
+    let src = std::fs::read_to_string("../tutorial/03-control/guess.kv").unwrap();
+    compile(&mut kv, &src).unwrap();
+    let fn_ = "guess_number";
+    let prefix = format!("/lib/{fn_}/");
+    let labels = children_of(&mut kv, &format!("{prefix}\u{2025}labels/"));
+    assert!(!labels.is_empty(), "no labels");
+    let mut labeled = std::collections::HashSet::new();
+    for name in &labels {
+        let n = name.trim_end_matches('/');
+        if n.is_empty() {
+            continue;
+        }
+        let v = kv.get_one(&format!("{prefix}\u{2025}labels/{n}"));
+        if kvkind::kind(&v) != "int64" {
+            continue;
+        }
+        let disp = kvkind::display(&v);
+        let irseq: i32 = disp
+            .split(':')
+            .nth(1)
+            .unwrap_or_else(|| panic!("label {n} display={disp}"))
+            .parse()
+            .unwrap_or_else(|_| panic!("label {n} display={disp}"));
+        labeled.insert(irseq);
+    }
+    let children = children_of(&mut kv, &prefix);
+    let mut ops = std::collections::BTreeMap::new();
+    for c in &children {
+        if let Some(row) = parse_row(c) {
+            ops.insert(row, sig(&kv.get_one(&format!("{prefix}{c}"))));
+        }
+    }
+    for irseq in labeled {
+        if irseq <= 1 {
+            continue;
+        }
+        let prev = irseq - 1;
+        let op = ops.get(&prev).unwrap_or_else(|| panic!("no opcode at [{prev},0] before label {irseq}"));
+        assert!(is_terminator_op(op), "irseq {prev} ({op}) falls through into labeled {irseq}");
+    }
+}
+
+#[test]
+fn br_true_false_are_int64() {
+    let mut kv = fresh_kv();
+    compile(&mut kv, "rwfunc f(X:int64) -> (Y:int64) {\n    if (X > 0) { X -> Y } else { 0 -> Y }\n}\n").unwrap();
+    let children = children_of(&mut kv, "/lib/f/");
+    let mut saw_br = false;
+    for c in &children {
+        let Some(row) = parse_row(c) else { continue };
+        if sig(&kv.get_one(&format!("/lib/f/[{row},0]"))) != "br" {
+            continue;
+        }
+        let t = kv.get_one(&format!("/lib/f/[{row},-2]"));
+        let f = kv.get_one(&format!("/lib/f/[{row},-3]"));
+        assert_eq!(kvkind::kind(&t), "int64", "br true {}", kvkind::display(&t));
+        assert_eq!(kvkind::kind(&f), "int64", "br false {}", kvkind::display(&f));
+        saw_br = true;
+    }
+    assert!(saw_br, "no br in {children:?}");
+}
+
+#[test]
+fn abs_if_is_numbered_jumps() {
+    let mut kv = compile_fn(
+        "rwfunc abs(x:int64) -> (r:int64) {\n    if (x < 0) {\n        0 - x -> r\n    } else {\n        x -> r\n    }\n}\n",
+    );
+    assert_single_plane(&mut kv, "abs");
+    let p = plane(&mut kv, "abs");
+    let ir = dump_ir(&p);
+    eprintln!("abs IR:\n{ir}");
+    assert_jumps_are_int64(&mut kv, "abs", &p);
+    assert_no_scope_opcode(&p, "abs");
+    let ops: Vec<_> = p.iter().filter(|(n, _)| **n > 0).map(|(_, i)| i.op.as_str()).collect();
+    assert!(ops.contains(&"br"), "abs missing br:\n{ir}");
+    assert!(ops.contains(&"goto"), "abs missing goto:\n{ir}");
+    assert!(ops.contains(&"return"), "abs missing return:\n{ir}");
+    assert!(!ops.contains(&"call"), "abs if lowered to call:\n{ir}");
+    let labs = labels_of(&mut kv, "abs");
+    assert!(labs.keys().any(|k| k.contains("_if_")), "abs labels={labs:?}");
+    assert!(labs.keys().any(|k| k.contains("_then_")), "abs labels={labs:?}");
+    assert!(labs.keys().any(|k| k.contains("_else_")), "abs labels={labs:?}");
+    assert!(labs.keys().any(|k| k.contains("_merge_")), "abs labels={labs:?}");
+    for (name, irseq) in &labs {
+        let inst = p.get(irseq).unwrap_or_else(|| panic!("label {name} -> {irseq} missing"));
+        assert!(!inst.op.is_empty(), "label {name} -> empty op at {irseq}");
+    }
+}
+
+#[test]
+fn while_back_edge_is_goto_int64() {
+    let mut kv = compile_fn(
+        "rwfunc sum_to(n:int64) -> (acc:int64) {\n    0 -> acc\n    1 -> i\n    while (i <= n) {\n        acc + i -> acc\n        i + 1 -> i\n    }\n}\n",
+    );
+    assert_single_plane(&mut kv, "sum_to");
+    let p = plane(&mut kv, "sum_to");
+    let ir = dump_ir(&p);
+    eprintln!("sum_to IR:\n{ir}");
+    assert_jumps_are_int64(&mut kv, "sum_to", &p);
+    assert_no_scope_opcode(&p, "sum_to");
+    let labs = labels_of(&mut kv, "sum_to");
+    let cond = labs
+        .iter()
+        .find(|(k, _)| k.contains("_while_"))
+        .map(|(_, v)| *v)
+        .unwrap_or_else(|| panic!("no _while_ label: {labs:?}"));
+    let back = p.iter().any(|(n, inst)| {
+        *n > 0 && inst.op == "goto" && inst.reads.first().map(|s| s.parse() == Ok(cond)).unwrap_or(false)
+    });
+    assert!(back, "while body has no goto {cond}:\n{ir}\nlabels={labs:?}");
+    assert!(!p.values().any(|i| i.op == "call"), "while lowered to call:\n{ir}");
+}
+
+#[test]
+fn break_is_goto_exit() {
+    let mut kv = compile_fn(
+        "rwfunc f() -> (i:int64) {\n    0 -> i\n    while (i < 10) {\n        if (i == 5) {\n            break\n        }\n        i <- i + 1\n    }\n}\n",
+    );
+    assert_single_plane(&mut kv, "f");
+    let p = plane(&mut kv, "f");
+    let ir = dump_ir(&p);
+    eprintln!("break IR:\n{ir}");
+    assert_jumps_are_int64(&mut kv, "f", &p);
+    assert_no_scope_opcode(&p, "f");
+    let labs = labels_of(&mut kv, "f");
+    let exit = labs
+        .iter()
+        .find(|(k, _)| k.contains("_exit_"))
+        .map(|(_, v)| *v)
+        .unwrap_or_else(|| panic!("no _exit_ label: {labs:?}"));
+    let to_exit = p.iter().filter(|(_, inst)| {
+        inst.op == "goto" && inst.reads.first().map(|s| s.parse() == Ok(exit)).unwrap_or(false)
+    }).count();
+    assert!(to_exit >= 1, "break did not emit goto {exit}:\n{ir}\nlabels={labs:?}");
+}
+
+#[test]
+fn continue_is_goto_cond() {
+    let mut kv = compile_fn(
+        "rwfunc f() -> (acc:int64) {\n    0 -> acc\n    1 -> i\n    while (i <= 5) {\n        if (i == 3) {\n            i <- i + 1\n            continue\n        }\n        acc <- acc + i\n        i <- i + 1\n    }\n}\n",
+    );
+    assert_single_plane(&mut kv, "f");
+    let p = plane(&mut kv, "f");
+    let ir = dump_ir(&p);
+    eprintln!("continue IR:\n{ir}");
+    assert_jumps_are_int64(&mut kv, "f", &p);
+    assert_no_scope_opcode(&p, "f");
+    let labs = labels_of(&mut kv, "f");
+    let cond = labs
+        .iter()
+        .find(|(k, _)| k.contains("_while_"))
+        .map(|(_, v)| *v)
+        .unwrap_or_else(|| panic!("no _while_ label: {labs:?}"));
+    let to_cond = p.iter().filter(|(_, inst)| {
+        inst.op == "goto" && inst.reads.first().map(|s| s.parse() == Ok(cond)).unwrap_or(false)
+    }).count();
+    assert!(to_cond >= 2, "continue+latch should goto cond {cond} at least twice, got {to_cond}:\n{ir}\nlabels={labs:?}");
+}
+
+#[test]
+fn for_is_br_goto_single_plane() {
+    let mut kv = compile_fn(
+        "rwfunc f() -> () {\n    data·0 <- 0\n    data·1 <- 1\n    for (x in data) {\n        x -> _\n    }\n}\n",
+    );
+    assert_single_plane(&mut kv, "f");
+    let p = plane(&mut kv, "f");
+    let ir = dump_ir(&p);
+    eprintln!("for IR:\n{ir}");
+    assert_jumps_are_int64(&mut kv, "f", &p);
+    assert_no_scope_opcode(&p, "f");
+    let labs = labels_of(&mut kv, "f");
+    assert!(labs.keys().any(|k| k.contains("_for_")), "for labels={labs:?}");
+    assert!(p.values().any(|i| i.op == "br"), "for missing br:\n{ir}");
+    assert!(!p.values().any(|i| i.op == "call" && i.reads.first().map(|s| s.contains("_for_")).unwrap_or(false)), "for still calls a scope:\n{ir}");
+}
+
+#[test]
+fn nested_if_while_single_plane() {
+    let mut kv = compile_fn(
+        "rwfunc f() -> (acc:int64) {\n    0 -> acc\n    1 -> i\n    while (i <= 3) {\n        if (i == 2) {\n            acc <- acc + i\n        } else {\n            acc <- acc + 1\n        }\n        i <- i + 1\n    }\n}\n",
+    );
+    assert_single_plane(&mut kv, "f");
+    let p = plane(&mut kv, "f");
+    assert_jumps_are_int64(&mut kv, "f", &p);
+    assert_no_scope_opcode(&p, "f");
+    let brs = p.values().filter(|i| i.op == "br").count();
+    assert!(brs >= 2, "nested if+while should have >=2 br, got {brs}:\n{}", dump_ir(&p));
+}
+
+#[test]
+fn tutorial_control_files_single_plane() {
+    for (file, fns) in [
+        ("../tutorial/03-control/if.kv", &["my·abs"][..]),
+        ("../tutorial/03-control/while.kv", &["sum_to", "first_div7", "sum_odds"][..]),
+        ("../tutorial/03-control/guess.kv", &["guess_number"][..]),
+        ("../tutorial/03-control/classify.kv", &["classify"][..]),
+        ("../tutorial/03-control/for.kv", &["test"][..]),
+        ("../tutorial/06-algo/prime_sieve.kv", &["prime_sieve"][..]),
+    ] {
+        let mut kv = fresh_kv();
+        let src = std::fs::read_to_string(file).unwrap();
+        compile(&mut kv, &src).unwrap();
+        for fn_ in fns {
+            assert_single_plane(&mut kv, fn_);
+            let p = plane(&mut kv, fn_);
+            assert_jumps_are_int64(&mut kv, fn_, &p);
+            assert_no_scope_opcode(&p, fn_);
+        }
+    }
+}
diff --git a/layout/tests/pipeline_test.rs b/layout/tests/pipeline_test.rs
index a1aab968..eab8894b 100644
--- a/layout/tests/pipeline_test.rs
+++ b/layout/tests/pipeline_test.rs
@@ -26,7 +26,7 @@ fn compile_simple_func() {
     // 函数签名
     let sig_val = kv.get_one("/lib/sum/[0,0]");
     assert_eq!(kvkind::kind(&sig_val), "defrwfunc");
-    assert_eq!(kvkind::array_len(&sig_val), 1);
+    assert_eq!(kvkind::array_len(&sig_val), 2); // add + return
     let b = body(&sig_val);
     assert_eq!(kvkind::rwfunc_num_reads(b), 2);
     assert_eq!(kvkind::rwfunc_num_writes(b), 1);
@@ -51,6 +51,7 @@ fn compile_simple_func() {
     assert_eq!(sig(&kv.get_one("/lib/sum/[1,-1]")), "A");
     assert_eq!(sig(&kv.get_one("/lib/sum/[1,-2]")), "B");
     assert_eq!(sig(&kv.get_one("/lib/sum/[1,1]")), "C");
+    assert_eq!(sig(&kv.get_one("/lib/sum/[2,0]")), "return");
 
     // 源码副本
     let src_val = kv.get_one("/lib/sum.src");
@@ -95,15 +96,57 @@ fn compile_multiline_string_literal() {
 }
 
 #[test]
-fn compile_control_flow_lowers_to_blocks() {
+fn compile_control_flow_is_single_plane() {
     let mut kv = fresh_kv();
     let src = "rwfunc f(X:int64) -> (Y:int64) {\n    if (X > 0) {\n        X -> Y\n    } else {\n        0 -> Y\n    }\n}\n";
     compile(&mut kv, src).unwrap();
 
     let sig_val = kv.get_one("/lib/f/[0,0]");
     assert_eq!(kvkind::kind(&sig_val), "defrwfunc");
-    // 降级后存在 if/then 基本块（label 指令以 _label[coord] 扁平键存在；空 merge 块不落盘）
     let children = kv.list("/lib/f/", false, false);
-    assert!(children.iter().any(|c| c.contains("_if_")));
-    assert!(children.iter().any(|c| c.contains("_then_")));
+    let old_scope = children.iter().any(|c| {
+        let b = c.trim_end_matches('/');
+        b.contains("_if_") || b.contains("_then_") || b.contains("_else_") || b.contains("_merge_")
+    });
+    assert!(!old_scope, "scope keys still present: {children:?}");
+    assert!(children.iter().any(|c| c.contains("labels")), "missing ‥labels: {children:?}");
+
+    let labels = kv.list("/lib/f/\u{2025}labels/", false, false);
+    let if_name = labels.iter().map(|c| c.trim_end_matches('/')).find(|c| c.contains("_if_"));
+    assert!(if_name.is_some(), "‥labels={labels:?}");
+    let if_irseq = kv.get_one(&format!("/lib/f/\u{2025}labels/{}", if_name.unwrap()));
+    assert_eq!(kvkind::kind(&if_irseq), "int64", "label kind={} labels={labels:?}", kvkind::display(&if_irseq));
+
+    // irseq 1 is preamble goto; target is int64
+    let goto_op = kv.get_one("/lib/f/[1,0]");
+    assert_eq!(sig(&goto_op), "goto");
+    let tgt = kv.get_one("/lib/f/[1,-1]");
+    assert_eq!(kvkind::kind(&tgt), "int64", "goto target {}", kvkind::display(&tgt));
+}
+
+#[test]
+fn compile_while_goto_targets_are_int64() {
+    let mut kv = fresh_kv();
+    let src = "rwfunc sum_to(n:int64) -> (acc:int64) {\n    0 -> acc\n    1 -> i\n    while (i <= n) {\n        acc + i -> acc\n        i + 1 -> i\n    }\n}\n";
+    compile(&mut kv, src).unwrap();
+    let children = kv.list("/lib/sum_to/", false, false);
+    assert!(
+        !children.iter().any(|c| c.contains("_while_") || c.contains("_do_")),
+        "while still has scope keys: {children:?}"
+    );
+    let mut saw_int_goto = false;
+    for c in &children {
+        let t = c.trim_end_matches('/');
+        if !t.starts_with('[') || !t.ends_with(",0]") {
+            continue;
+        }
+        if sig(&kv.get_one(&format!("/lib/sum_to/{t}"))) != "goto" {
+            continue;
+        }
+        let row: i32 = t.trim_start_matches('[').split(',').next().unwrap().parse().unwrap();
+        let tgt = kv.get_one(&format!("/lib/sum_to/[{row},-1]"));
+        assert_eq!(kvkind::kind(&tgt), "int64");
+        saw_int_goto = true;
+    }
+    assert!(saw_int_goto, "no goto found in {children:?}");
 }
diff --git a/runtime/src/builtin.c b/runtime/src/builtin.c
index ae1245c2..0a10c5a9 100644
--- a/runtime/src/builtin.c
+++ b/runtime/src/builtin.c
@@ -70,26 +70,9 @@ static int cmp_int(const kvlangXvalue_t *a, const kvlangXvalue_t *b) {
 }
 
 /* ── resolve ───────────────────────────────────────────────────────── */
+/* #116 后 if/while 不再建 scope 帧，当前帧 [d] 即 rwfunc 帧，frame_root 直接可用。 */
 
-char *kvlangBuiltinFuncFrameRoot(kvlangKv_t *kv, const char *frame_root) {
-    char *cur = strdup(frame_root);
-    for (;;) {
-        kvlangStrbuf_t k; kvlangStrbufInit(&k);
-        char *stk = kvlangKeytreeStack(cur);
-        kvlangStrbufPuts(&k, stk); free(stk);
-        kvlangStrbufPuts(&k, SEG_LIB);
-        kvlangXvalue_t v; kvlangXvalueZero(&v);
-        kvlangKvGetOne(kv, k.p, &v);
-        bool found = !kvlangXvalueNone(&v);
-        kvlangXvalueFree(&v); kvlangStrbufFree(&k);
-        if (found) return cur;
-        char *parent = kvlangKeytreeParentFrame(cur);
-        if (parent[0] == 0) { free(parent); return cur; }
-        free(cur); cur = parent;
-    }
-}
-
-void kvlangBuiltinResolveReadValue(kvlangKv_t *kv, const char *frame_path, const char *name,
+void kvlangBuiltinResolveReadValue(kvlangKv_t *kv, const char *frame_root, const char *name,
                            const kvlangXvalue_t *val, kvlangXvalue_t *out) {
     kvlangXvalueZero(out);
     if (val && !kvlangXvalueNone(val) && !kvlangXvalueKindIs(val, KVSPACE_KIND_RWIR) && !kvlangXvalueKindIs(val, KVSPACE_KIND_RWFUNC)) {
@@ -100,49 +83,37 @@ void kvlangBuiltinResolveReadValue(kvlangKv_t *kv, const char *frame_path, const
     }
     if (!name || !name[0]) return;
     if (name[0] == '/') { kvlangKvGetOne(kv, name, out); return; }
-    char *rw = kvlangBuiltinFuncFrameRoot(kv, frame_path);
-    kvlangStrbuf_t key; kvlangStrbufInit(&key);
-    char *stk = kvlangKeytreeStack(rw);
-    kvlangStrbufPuts(&key, stk); free(stk); kvlangStrbufPuts(&key, name);
+    char *stk = kvlangKeytreeStack(frame_root);
     kvlangXvalue_t pv; kvlangXvalueZero(&pv);
-    kvlangKvGetOne(kv, key.p, &pv);
+    kvlangKvGetMember(kv, stk, name, &pv);
     if (kvlangXvalueIsPtr(&pv)) {
         char *target = kvlangXvaluePtrTarget(&pv);
-        kvlangStrbuf_t ak; kvlangStrbufInit(&ak);
-        char *stk2 = kvlangKeytreeStack(rw);
-        kvlangStrbufPuts(&ak, stk2); free(stk2); kvlangStrbufPuts(&ak, target);
-        free(target);
         kvlangXvalue_t av; kvlangXvalueZero(&av);
-        kvlangKvGetOne(kv, ak.p, &av);
+        kvlangKvGetMember(kv, stk, target, &av);
+        free(target);
         if (!kvlangXvalueNone(&av)) {
             char *path = kvlangXvalueValueString(&av);
             kvlangKvGetOne(kv, path, out);
             free(path);
         }
-        kvlangXvalueFree(&av); kvlangStrbufFree(&ak);
+        kvlangXvalueFree(&av);
     } else if (!kvlangXvalueNone(&pv)) {
         *out = pv; pv.data = NULL; pv.len = 0;
     }
-    kvlangXvalueFree(&pv); kvlangStrbufFree(&key); free(rw);
+    kvlangXvalueFree(&pv); free(stk);
 }
 
-char *kvlangBuiltinResolveWriteSlot(kvlangKv_t *kv, const char *frame_path, const char *name) {
+char *kvlangBuiltinResolveWriteSlot(kvlangKv_t *kv, const char *frame_root, const char *name) {
     if (name[0] == '/') return strdup(name);
-    char *rw = kvlangBuiltinFuncFrameRoot(kv, frame_path);
-    kvlangStrbuf_t key; kvlangStrbufInit(&key);
-    char *stk = kvlangKeytreeStack(rw);
-    kvlangStrbufPuts(&key, stk); free(stk); kvlangStrbufPuts(&key, name);
+    char *stk = kvlangKeytreeStack(frame_root);
     kvlangXvalue_t pv; kvlangXvalueZero(&pv);
-    kvlangKvGetOne(kv, key.p, &pv);
+    kvlangKvGetMember(kv, stk, name, &pv);
     char *result = NULL;
     if (kvlangXvalueIsPtr(&pv)) {
         char *target = kvlangXvaluePtrTarget(&pv);
-        kvlangStrbuf_t ak; kvlangStrbufInit(&ak);
-        char *stk2 = kvlangKeytreeStack(rw);
-        kvlangStrbufPuts(&ak, stk2); free(stk2); kvlangStrbufPuts(&ak, target);
-        free(target);
         kvlangXvalue_t av; kvlangXvalueZero(&av);
-        kvlangKvGetOne(kv, ak.p, &av);
+        kvlangKvGetMember(kv, stk, target, &av);
+        free(target);
         if (!kvlangXvalueNone(&av)) {
             /* 只追显式指针（ptr, ref==1）链；av 是 handle_call 已 resolve 好的
              * 最终写目标路径（普通 char），直接取字符串，勿再按值读下一跳——
@@ -159,16 +130,13 @@ char *kvlangBuiltinResolveWriteSlot(kvlangKv_t *kv, const char *frame_path, cons
             if (!kvlangXvalueNone(&v)) result = kvlangXvalueValueString(&v);
             kvlangXvalueFree(&v);
         }
-        kvlangXvalueFree(&av); kvlangStrbufFree(&ak);
+        kvlangXvalueFree(&av);
     }
-    kvlangXvalueFree(&pv); kvlangStrbufFree(&key); free(rw);
-    if (result) return result;
-    /* fallback: Stack(rw) + name */
-    char *rw2 = kvlangBuiltinFuncFrameRoot(kv, frame_path);
+    kvlangXvalueFree(&pv);
+    if (result) { free(stk); return result; }
     kvlangStrbuf_t o; kvlangStrbufInit(&o);
-    char *stk3 = kvlangKeytreeStack(rw2);
-    kvlangStrbufPuts(&o, stk3); free(stk3); kvlangStrbufPuts(&o, name);
-    free(rw2);
+    kvlangStrbufPuts(&o, stk); kvlangStrbufPuts(&o, name);
+    free(stk);
     return kvlangStrbufDetach(&o);
 }
 
@@ -239,14 +207,12 @@ void kvlangDisplay(const kvlangXvalue_t *v, char **out) {
 
 int kvlangBuiltinReadInputs(kvlangFrame_t *f, kvlangXvalue_t *out, int cap) {
     char *fr = kvlangKeytreeFrameRoot(f->pc);
-    char *ff = kvlangBuiltinFuncFrameRoot(f->kv, fr);
-    free(fr);
     int n = 0;
     for (int i = 0; i < f->inst->nr && n < cap; i++) {
-        kvlangBuiltinResolveReadValue(f->kv, ff, f->inst->reads[i].name, &f->inst->reads[i].val, &out[n]);
+        kvlangBuiltinResolveReadValue(f->kv, fr, f->inst->reads[i].name, &f->inst->reads[i].val, &out[n]);
         n++;
     }
-    free(ff);
+    free(fr);
     return n;
 }
 
@@ -662,10 +628,8 @@ int kvlangBuiltinExecuteCopy(kvlangKv_t *kv, const char *vtid, const char *pc, k
     char *fr = kvlangKeytreeFrameRoot(pc);
     kvlangFrame_t f = { kv, vtid, pc, inst };
     if (inst->nr == 0) { free(fr); kvlangBuiltinNextPc(&f); return 0; }
-    char *ff = kvlangBuiltinFuncFrameRoot(kv, fr);
     kvlangXvalue_t v; kvlangXvalueZero(&v);
-    kvlangBuiltinResolveReadValue(kv, ff, inst->reads[0].name, &inst->reads[0].val, &v);
-    free(ff);
+    kvlangBuiltinResolveReadValue(kv, fr, inst->reads[0].name, &inst->reads[0].val, &v);
     for (int i = 0; i < inst->nw; i++) {
         char *key = kvlangBuiltinResolveWriteSlot(kv, fr, inst->writes[i].name);
         kvlangKvPair_t pair = { key, v };
diff --git a/runtime/src/builtin_kv.c b/runtime/src/builtin_kv.c
index 0d73c647..0072ef23 100644
--- a/runtime/src/builtin_kv.c
+++ b/runtime/src/builtin_kv.c
@@ -24,9 +24,8 @@ static char *path_arg(kvlangFrame_t *f, int idx, const kvlangXvalue_t *in) {
 static char *member_path(kvlangFrame_t *f, const kvlangXvalue_t *in, int n) {
     const kvlangXvalue_t *base = &in[0];
     char *fr = kvlangKeytreeFrameRoot(f->pc);
-    char *ff = kvlangBuiltinFuncFrameRoot(f->kv, fr);
-    char *bp = kvlangXvalueNone(base) || (strcmp(kvlangXvalueKind(base), KVSPACE_KIND_OBJ) == 0 || strcmp(kvlangXvalueKind(base), KVSPACE_KIND_MAP) == 0 || strcmp(kvlangXvalueKind(base), KVSPACE_KIND_INDEX) == 0 || strcmp(kvlangXvalueKind(base), KVSPACE_KIND_EXT_INDEX) == 0) ? kvlangBuiltinResolveWriteSlot(f->kv, ff, f->inst->reads[0].name) : kvlangXvalueValueString(base);
-    free(ff); free(fr);
+    char *bp = kvlangXvalueNone(base) || (strcmp(kvlangXvalueKind(base), KVSPACE_KIND_OBJ) == 0 || strcmp(kvlangXvalueKind(base), KVSPACE_KIND_MAP) == 0 || strcmp(kvlangXvalueKind(base), KVSPACE_KIND_INDEX) == 0 || strcmp(kvlangXvalueKind(base), KVSPACE_KIND_EXT_INDEX) == 0) ? kvlangBuiltinResolveWriteSlot(f->kv, fr, f->inst->reads[0].name) : kvlangXvalueValueString(base);
+    free(fr);
     /* 成员链：base 之后逐段拼 key（变参），每段可为静态字面量或动态键（运行时值）。 */
     for (int i = 1; i < n; i++) {
         char *kk = kvlangKvKey(&in[i]);
@@ -84,9 +83,8 @@ int kvlangBuiltinKvList(kvlangFrame_t *f) {
         const char *name = f->inst->reads[0].name;
         if (name[0] != '/') {
             char *fr = kvlangKeytreeFrameRoot(f->pc);
-            char *ff = kvlangBuiltinFuncFrameRoot(f->kv, fr);
-            char *base = kvlangBuiltinResolveWriteSlot(f->kv, ff, name);
-            free(ff); free(fr);
+            char *base = kvlangBuiltinResolveWriteSlot(f->kv, fr, name);
+            free(fr);
             key = kvlangKeytreeMember(base, "");
             free(base);
         }
@@ -141,9 +139,8 @@ static char *kv_list_dir(kvlangFrame_t *f, kvlangXvalue_t *in, int n) {
         const char *name = f->inst->reads[0].name;
         if (name[0] != '/') {
             char *fr = kvlangKeytreeFrameRoot(f->pc);
-            char *ff = kvlangBuiltinFuncFrameRoot(f->kv, fr);
-            char *base = kvlangBuiltinResolveWriteSlot(f->kv, ff, name);
-            free(ff); free(fr);
+            char *base = kvlangBuiltinResolveWriteSlot(f->kv, fr, name);
+            free(fr);
             key = kvlangKeytreeMember(base, "");
             free(base);
         }
diff --git a/runtime/src/keytree.c b/runtime/src/keytree.c
index 7f93cdd5..5d63eecf 100644
--- a/runtime/src/keytree.c
+++ b/runtime/src/keytree.c
@@ -40,19 +40,68 @@ static char *trim_right_join(const char *root, const char *suffix) {
 }
 
 char *kvlangKeytreeEntryPc(const char *root) { return trim_right_join(root, "/[1,0]"); }
-char *kvlangKeytreeScopeEntryPc(const char *root) { return trim_right_join(root, "/[0,0]"); }
 
-char *kvlangKeytreeParentFrame(const char *root) {
-    size_t n = strlen(root);
-    while (n > 0 && root[n - 1] == '/') n--;
-    if (n == 0) return strdup("");
-    size_t last = (size_t)-1;
-    for (size_t i = 0; i < n; i++) if (root[i] == '/') last = i;
-    if (last == (size_t)-1) return strdup("");
-    size_t cut = last + 1;
-    char *r = malloc(cut + 1);
-    memcpy(r, root, cut); r[cut] = 0;
-    return r;
+static void keytree_die(const char *fmt, ...) {
+    fputs("panic: ", stderr);
+    va_list ap; va_start(ap, fmt);
+    vfprintf(stderr, fmt, ap);
+    va_end(ap);
+    fputc('\n', stderr);
+    abort();
+}
+
+char *kvlangKeytreeFrameAt(const char *vtid, int depth) {
+    if (!vtid || !vtid[0]) keytree_die("FrameAt: empty vtid");
+    if (depth < 1) keytree_die("FrameAt: depth %d < 1", depth);
+    kvlangStrbuf_t b; kvlangStrbufInit(&b);
+    kvlangStrbufPrintf(&b, "%s/%s/[%d]", VTHREAD_ROOT, vtid, depth);
+    return kvlangStrbufDetach(&b);
+}
+
+int kvlangKeytreeFrameNum(const char *path) {
+    kvlangStrbuf_t vtid_b; kvlangStrbufInit(&vtid_b);
+    const char *vtid = kvlangKeytreeVtidFromPc(path, &vtid_b);
+    if (!vtid[0]) keytree_die("FrameNum: not a vthread path: %s", path);
+    kvlangStrbuf_t pfx; kvlangStrbufInit(&pfx);
+    kvlangKeytreeVthread(vtid, &pfx);
+    kvlangStrbufPutc(&pfx, '/');
+    if (strncmp(path, pfx.p, pfx.len) != 0) keytree_die("FrameNum: not a vthread path: %s", path);
+    const char *rest = path + pfx.len;
+    if (rest[0] != '[') keytree_die("FrameNum: no frame coord in %s", path);
+    const char *end = strchr(rest, ']');
+    if (!end) keytree_die("FrameNum: unterminated frame coord in %s", path);
+    size_t clen = (size_t)(end - (rest + 1));
+    if (clen == 0 || memchr(rest + 1, ',', clen)) {
+        keytree_die("FrameNum: expected [d] frame coord in %s", path);
+    }
+    char buf[32];
+    if (clen >= sizeof buf) keytree_die("FrameNum: frame coord too long in %s", path);
+    memcpy(buf, rest + 1, clen); buf[clen] = 0;
+    char *ep = NULL;
+    long n = strtol(buf, &ep, 10);
+    if (ep == buf || *ep != 0 || n < 1) keytree_die("FrameNum: invalid frame number %s in %s", buf, path);
+    const char *after = end + 1;
+    if (after[0] == 0 || (after[0] == '/' && after[1] == 0)) {
+        /* frame root */
+    } else if (after[0] == '/' && after[1] == '[') {
+        const char *tail = after + 1;
+        if (strchr(tail, '/')) keytree_die("FrameNum: nested path after [d]: %s", path);
+        if (!strchr(tail, ',')) keytree_die("FrameNum: expected [irseq,j] after [d] in %s", path);
+    } else {
+        keytree_die("FrameNum: expected /[irseq,j] after [d] in %s", path);
+    }
+    kvlangStrbufFree(&vtid_b); kvlangStrbufFree(&pfx);
+    return (int)n;
+}
+
+char *kvlangKeytreeIrseqPc(const char *frame_root, int irseq) {
+    if (irseq < 0) keytree_die("IrseqPC: irseq %d < 0", irseq);
+    kvlangStrbuf_t b; kvlangStrbufInit(&b);
+    size_t n = strlen(frame_root);
+    while (n > 0 && frame_root[n - 1] == '/') n--;
+    kvlangStrbufPutn(&b, frame_root, n);
+    kvlangStrbufPrintf(&b, "/[%d,0]", irseq);
+    return kvlangStrbufDetach(&b);
 }
 
 char *kvlangKeytreeMember(const char *base, const char *name) {
diff --git a/runtime/src/kv.c b/runtime/src/kv.c
index a5c4caeb..0a694a5f 100644
--- a/runtime/src/kv.c
+++ b/runtime/src/kv.c
@@ -33,6 +33,14 @@ int kvlangKvGetOne(kvlangKv_t *k, const char *key, kvlangXvalue_t *out) {
     return 0;
 }
 
+/* Frame member: GetBatch(dir, name). Full-path Get does not ext-fallback on [d] frames. */
+int kvlangKvGetMember(kvlangKv_t *k, const char *dir, const char *name, kvlangXvalue_t *out) {
+    kvlangXvalueZero(out);
+    if (!name || !name[0]) return 0;
+    char *nm = (char *)name;
+    return kvlangKvGetBatch(k, dir, &nm, 1, out);
+}
+
 int kvlangKvGetBatch(kvlangKv_t *k, const char *prefix, char **names, int n, kvlangXvalue_t *out) {
     for (int i = 0; i < n; i++) kvlangXvalueZero(&out[i]);
     const char **ns = malloc(sizeof(char *) * (size_t)n);
diff --git a/runtime/src/kvcpu.c b/runtime/src/kvcpu.c
index 64cddc13..4d9cf415 100644
--- a/runtime/src/kvcpu.c
+++ b/runtime/src/kvcpu.c
@@ -10,23 +10,31 @@ static const char *rfind_sep(const char *s) {
     return found;
 }
 
-static int stack_depth(const char *pc) {
-    int d = 0;
-    for (; *pc; pc++) if (*pc == '[') d++;
-    return d;
+/* goto/br 目标：layout 已把 label 解析为 int64 irseq（≥1）。非 int64 / 越界返回 -1。 */
+static int irseq_of(const kvlangParam_t *p) {
+    if (kvlangXvalueNone(&p->val) || !kvlangXvalueKindIs(&p->val, KVSPACE_KIND_INT64)) return -1;
+    int64_t n = kvlangXvalueAsInt64(&p->val);
+    if (n < 1 || n > 0x7fffffff) return -1;
+    return (int)n;
 }
 
-/* ExtKind：有 .lib → rwfunc，否则空 */
-static const char *ext_kind(kvlangKv_t *kv, const char *frame_root) {
-    kvlangStrbuf_t k; kvlangStrbufInit(&k);
-    char *stk = kvlangKeytreeStack(frame_root);
-    kvlangStrbufPuts(&k, stk); free(stk);
-    kvlangStrbufPuts(&k, SEG_LIB);
-    kvlangXvalue_t v; kvlangXvalueZero(&v);
-    kvlangKvGetOne(kv, k.p, &v);
-    bool has = !kvlangXvalueNone(&v);
-    kvlangXvalueFree(&v); kvlangStrbufFree(&k);
-    return has ? KVSPACE_KIND_RWFUNC : "";
+/* 函数内跳转：只改 PC 的 [irseq]，帧不变。目标非法 → RuntimeError，返回 -1。 */
+static int jump_to(kvlangKv_t *kv, const char *vtid, const char *pc, const kvlangParam_t *target, const char *op) {
+    int irseq = irseq_of(target);
+    if (irseq < 0) {
+        char msg[256];
+        snprintf(msg, sizeof msg, "RuntimeError: %s target is not an int64 irseq: %s (kind=%s)",
+                 op, target->name ? target->name : "", kvlangXvalueKind(&target->val));
+        kvlangVthreadSetError(kv, vtid, pc, msg);
+        return -1;
+    }
+    char *fr = kvlangKeytreeFrameRoot(pc);
+    char *np = kvlangKeytreeIrseqPc(fr, irseq);
+    free(fr);
+    kvlangVthreadSet(kv, vtid, np, "running");
+    kvlangLogDebug("[%s] %s → %s", vtid, op, np);
+    free(np);
+    return 0;
 }
 
 static bool is_literal(const char *s) {
@@ -121,125 +129,73 @@ static char *frame_slot_key(const char *frame_root, const char *slot) {
     return kvlangStrbufDetach(&b);
 }
 
-static char *resolve_read_path(kvlangKv_t *kv, const char *frame_path, const char *name) {
+/* 实参名 → 其存储键（写入被调帧 [0,-k]/[0,k]）。字面量返回 NULL。
+ * 命名参数经 Ptr 指到本帧 [0,±k]，槽内是上层 handle_call 已 resolve 好的最终键路径；
+ * 之后只追显式 Ptr（ref==1）链，勿把 char 值当路径再追——否则字符串实参的内容会被
+ * 误当键（穿两层调用即变 None）。写侧 kvlangBuiltinResolveWriteSlot 同此纪律（#124）。 */
+static char *resolve_read_path(kvlangKv_t *kv, const char *frame_root, const char *name) {
     if (is_literal(name)) return NULL;
-    char *func_frame = kvlangBuiltinFuncFrameRoot(kv, frame_path);
-    kvlangStrbuf_t k; kvlangStrbufInit(&k);
-    char *stk = kvlangKeytreeStack(func_frame);
-    kvlangStrbufPuts(&k, stk); free(stk);
-    kvlangStrbufPuts(&k, name);
+    char *stk = kvlangKeytreeStack(frame_root);
     kvlangXvalue_t v; kvlangXvalueZero(&v);
-    kvlangKvGetOne(kv, k.p, &v);
+    kvlangKvGetMember(kv, stk, name, &v);
     char *result = NULL;
-    if (kvlangXvalueNone(&v)) {
-        result = frame_slot_key(func_frame, name);
-    } else if (kvlangXvalueIsPtr(&v)) {
+    if (kvlangXvalueIsPtr(&v)) {
         char *target = kvlangXvaluePtrTarget(&v);
-        kvlangStrbuf_t path; kvlangStrbufInit(&path);
-        char *stk2 = kvlangKeytreeStack(func_frame);
-        kvlangStrbufPuts(&path, stk2); free(stk2);
-        kvlangStrbufPuts(&path, target);
-        free(target);
-        for (;;) {
-            kvlangXvalue_t nv; kvlangXvalueZero(&nv);
-            kvlangKvGetOne(kv, path.p, &nv);
-            if (kvlangXvalueNone(&nv) || !kvlangXvalueIsCharKind(kvlangXvalueKind(&nv))) { result = kvlangStrbufDetach(&path); kvlangXvalueFree(&nv); break; }
-            char *p2 = kvlangXvalueValueString(&nv);
-            kvlangXvalueFree(&nv);
-            kvlangStrbufClear(&path); kvlangStrbufPuts(&path, p2);
-            free(p2);
+        kvlangXvalue_t nv; kvlangXvalueZero(&nv);
+        kvlangKvGetMember(kv, stk, target, &nv);
+        if (kvlangXvalueNone(&nv) || !kvlangXvalueIsCharKind(kvlangXvalueKind(&nv))) {
+            result = frame_slot_key(frame_root, target);
+        } else {
+            char *path = kvlangXvalueValueString(&nv);
+            for (;;) {
+                kvlangXvalue_t hop; kvlangXvalueZero(&hop);
+                kvlangKvGetOne(kv, path, &hop);
+                if (!kvlangXvalueIsPtr(&hop)) { kvlangXvalueFree(&hop); result = path; break; }
+                char *p2 = kvlangXvaluePtrTarget(&hop);
+                kvlangXvalueFree(&hop);
+                free(path);
+                path = p2;
+            }
         }
+        kvlangXvalueFree(&nv);
+        free(target);
     } else {
-        kvlangStrbuf_t b; kvlangStrbufInit(&b);
-        char *stk3 = kvlangKeytreeStack(func_frame);
-        kvlangStrbufPuts(&b, stk3); free(stk3);
-        kvlangStrbufPuts(&b, name);
-        result = kvlangStrbufDetach(&b);
+        result = frame_slot_key(frame_root, name);
     }
-    kvlangXvalueFree(&v); kvlangStrbufFree(&k); free(func_frame);
+    kvlangXvalueFree(&v); free(stk);
     return result;
 }
 
-static char *handle_scope_return(kvlangKv_t *kv, const char *pc) {
+/* return：弹出当前帧 [d]。d==1 → 顶层结束（*out_next=NULL）；否则 *out_next=‥returnpc。
+ * 返回链断裂（帧无 ‥returnpc）→ RuntimeError（#109），保留该帧供排查，返回 -1。 */
+static int handle_return(kvlangKv_t *kv, const char *vtid, const char *pc, char **out_next) {
+    *out_next = NULL;
     char *fr = kvlangKeytreeFrameRoot(pc);
-    kvlangStrbuf_t rk; kvlangStrbufInit(&rk);
-    kvlangKeytreeFrameReturnpc(fr, &rk);
-    kvlangXvalue_t v; kvlangXvalueZero(&v);
-    kvlangKvGetOne(kv, rk.p, &v);
-    char *parent = kvlangXvalueNone(&v) ? NULL : kvlangXvalueValueString(&v);
-    kvlangXvalueFree(&v);
-    char *stk = kvlangKeytreeStack(fr);
-    char err[256];
-    kvlangKvDelExtIndex(kv, stk, err, sizeof err);
-    kvlangKvDelTree(kv, fr, err, sizeof err);
-    free(stk); free(fr); kvlangStrbufFree(&rk);
-    return parent;
-}
-
-static char *handle_return(kvlangKv_t *kv, const char *pc) {
-    kvlangStrbuf_t vtid_b; kvlangStrbufInit(&vtid_b);
-    const char *vtid = kvlangKeytreeVtidFromPc(pc, &vtid_b);
-    kvlangStrbuf_t vtroot; kvlangStrbufInit(&vtroot);
-    kvlangKeytreeVthread(vtid, &vtroot);
-    char *fr = kvlangKeytreeFrameRoot(pc);
-    if (strcmp(fr, vtroot.p) == 0) { free(fr); kvlangStrbufFree(&vtid_b); kvlangStrbufFree(&vtroot); return NULL; }
-    kvlangStrbuf_t rk; kvlangStrbufInit(&rk);
-    kvlangKeytreeFrameReturnpc(fr, &rk);
-    kvlangXvalue_t v; kvlangXvalueZero(&v);
-    kvlangKvGetOne(kv, rk.p, &v);
-    char *next = kvlangXvalueNone(&v) ? strdup("") : kvlangXvalueValueString(&v);
-    kvlangXvalueFree(&v);
+    int d = kvlangKeytreeFrameNum(fr);
+    char *next = NULL;
+    if (d > 1) {
+        kvlangStrbuf_t rk; kvlangStrbufInit(&rk);
+        kvlangKeytreeFrameReturnpc(fr, &rk);
+        kvlangXvalue_t v; kvlangXvalueZero(&v);
+        kvlangKvGetOne(kv, rk.p, &v);
+        if (!kvlangXvalueNone(&v)) next = kvlangXvalueValueString(&v);
+        kvlangXvalueFree(&v);
+        kvlangStrbufFree(&rk);
+        if (!next || !next[0]) {
+            char msg[512];
+            snprintf(msg, sizeof msg, "RuntimeError: broken return chain: frame %s has no returnpc (pc=%s)", fr, pc);
+            kvlangVthreadSetError(kv, vtid, pc, msg);
+            free(next); free(fr);
+            return -1;
+        }
+    }
     char *stk = kvlangKeytreeStack(fr);
     char err[256];
     kvlangKvDelExtIndex(kv, stk, err, sizeof err);
     kvlangKvDelTree(kv, fr, err, sizeof err);
-    free(stk); free(fr); kvlangStrbufFree(&rk);
-    kvlangStrbufFree(&vtid_b); kvlangStrbufFree(&vtroot);
-    return next;
-}
-
-static char *handle_scope(kvlangKv_t *kv, const char *pc, const char *scope_name) {
-    char *fr = kvlangKeytreeFrameRoot(pc);
-    char *rw_root = kvlangBuiltinFuncFrameRoot(kv, fr);
-    free(fr);
-    size_t n = strlen(rw_root);
-    while (n > 0 && rw_root[n - 1] == '/') n--;
-    kvlangStrbuf_t scope_frame; kvlangStrbufInit(&scope_frame);
-    kvlangStrbufPutn(&scope_frame, rw_root, n);
-    kvlangStrbufPutc(&scope_frame, '/');
-    kvlangStrbufPuts(&scope_frame, scope_name);
-    kvlangStrbufPutc(&scope_frame, '/');
-    free(rw_root);
-
-    kvlangStrbuf_t callpc; kvlangStrbufInit(&callpc);
-    kvlangKeytreeFrameCallpc(scope_frame.p, &callpc);
-    kvlangXvalue_t v; kvlangXvalueZero(&v);
-    kvlangKvGetOne(kv, callpc.p, &v);
-    bool exists = !kvlangXvalueNone(&v);
-    kvlangXvalueFree(&v);
-
-    char err[256];
-    if (!exists) {
-        kvlangKvMkindex(kv, scope_frame.p, err, sizeof err);
-        kvlangStrbuf_t npc; kvlangStrbufInit(&npc);
-        kvlangRwirNextPc(pc, &npc);
-        kvlangStrbuf_t retpc; kvlangStrbufInit(&retpc);
-        kvlangKeytreeFrameReturnpc(scope_frame.p, &retpc);
-        kvlangXvalue_t rv; kvlangXvalueNewCharUtf8(&rv, npc.p);
-        kvlangKvPair_t p = { retpc.p, rv };
-        kvlangKvSet(kv, &p, 1, err, sizeof err);
-        kvlangXvalueFree(&rv); kvlangStrbufFree(&npc); kvlangStrbufFree(&retpc);
-    }
-    char *sep = kvlangKeytreeScopeEntryPc(scope_frame.p);
-    kvlangStrbuf_t callpc2; kvlangStrbufInit(&callpc2);
-    kvlangKeytreeFrameCallpc(scope_frame.p, &callpc2);
-    kvlangXvalue_t cv; kvlangXvalueNewCharUtf8(&cv, sep);
-    kvlangKvPair_t p = { callpc2.p, cv };
-    kvlangKvSet(kv, &p, 1, err, sizeof err);
-    kvlangXvalueFree(&cv);
-
-    kvlangStrbufFree(&callpc); kvlangStrbufFree(&callpc2); kvlangStrbufFree(&scope_frame);
-    return sep;
+    free(stk); free(fr);
+    *out_next = next;
+    return 0;
 }
 
 /* HandleCall：创建子帧。返回 EntryPC(frameRoot)，失败 NULL */
@@ -261,9 +217,7 @@ static char *handle_call(kvlangKv_t *kv, const char *pc, kvlangRwirInst_t *inst)
         else {
             /* 裸名调用（无 /lib/ 无 ·）：同 pkg 优先——当前函数所在 lib 下有同名 rwfunc 就用之
              * （lib aaa/bbb/math 内 sum(A,A) → /lib/aaa/bbb/math·sum），否则退回根 /lib/<fn>。 */
-            char *fr = kvlangKeytreeFrameRoot(pc);
-            char *ff = fr ? kvlangBuiltinFuncFrameRoot(kv, fr) : NULL;
-            free(fr);
+            char *ff = kvlangKeytreeFrameRoot(pc);
             if (ff) {
                 /* 函数目录在帧的 ‥lib 槽（/lib/aaa/bbb/math·double/）：由此取调用者 pkg。 */
                 kvlangStrbuf_t lk; kvlangStrbufInit(&lk);
@@ -339,10 +293,11 @@ static char *handle_call(kvlangKv_t *kv, const char *pc, kvlangRwirInst_t *inst)
     }
 
     char *caller_fr = kvlangKeytreeFrameRoot(pc);
-    char *frame_root = strdup(pc);
-
-    char *stack_fr = kvlangKeytreeStack(frame_root);
+    int d = kvlangKeytreeFrameNum(pc);
+    char *frame_root = kvlangKeytreeFrameAt(vtid, d + 1);
     char err[256];
+    kvlangKvDelTree(kv, frame_root, err, sizeof err);
+    char *stack_fr = kvlangKeytreeStack(frame_root);
     kvlangKvMkindex(kv, stack_fr, err, sizeof err);
     kvlangKvExtIndex(kv, stack_fr, func_dir.p, err, sizeof err);
 
@@ -436,35 +391,39 @@ static int handle_control(kvlangKv_t *kv, const char *vtid, const char *pc, kvla
         return 0;
     }
     if (strcmp(inst->opcode, OP_RETURN) == 0) {
-        char *parent = handle_return(kv, pc);
+        char *parent = NULL;
+        if (handle_return(kv, vtid, pc, &parent) != 0) return -1;
         if (!parent) { kvlangVthreadSetDone(kv, vtid, "ok"); return 0; }
         kvlangVthreadSet(kv, vtid, parent, "running");
         free(parent);
         return 0;
     }
     if (strcmp(inst->opcode, OP_GOTO) == 0) {
-        if (inst->nr == 0) return -1;
-        char *np = handle_scope(kv, pc, inst->reads[0].name);
-        if (!np) { kvlangVthreadSetError(kv, vtid, pc, "RuntimeError: goto failed"); return -1; }
-        kvlangVthreadSet(kv, vtid, np, "running");
-        free(np);
-        return 0;
+        if (inst->nr != 1) {
+            char msg[128]; snprintf(msg, sizeof msg, "RuntimeError: goto expects 1 irseq, got %d", inst->nr);
+            kvlangVthreadSetError(kv, vtid, pc, msg);
+            return -1;
+        }
+        return jump_to(kv, vtid, pc, &inst->reads[0], OP_GOTO);
     }
     if (strcmp(inst->opcode, OP_BR) == 0) {
-        if (inst->nr < 3) return -1;
+        if (inst->nr != 3) {
+            char msg[128]; snprintf(msg, sizeof msg, "RuntimeError: br expects cond trueIrseq falseIrseq, got %d", inst->nr);
+            kvlangVthreadSetError(kv, vtid, pc, msg);
+            return -1;
+        }
         char *fr = kvlangKeytreeFrameRoot(pc);
         kvlangXvalue_t cond; kvlangXvalueZero(&cond);
         kvlangBuiltinResolveReadValue(kv, fr, inst->reads[0].name, &inst->reads[0].val, &cond);
         free(fr);
-        if (kvlangXvalueNone(&cond)) { kvlangVthreadSetError(kv, vtid, pc, "TypeError: None in branch condition"); kvlangXvalueFree(&cond); return -1; }
-        const char *label = inst->reads[2].name;
-        if (kvlangXvalueAsBool(&cond)) label = inst->reads[1].name;
+        if (kvlangXvalueNone(&cond)) {
+            kvlangVthreadSetError(kv, vtid, pc, "TypeError: None in branch condition");
+            kvlangXvalueFree(&cond);
+            return -1;
+        }
+        bool taken = kvlangXvalueAsBool(&cond);
         kvlangXvalueFree(&cond);
-        char *np = handle_scope(kv, pc, label);
-        if (!np) { kvlangVthreadSetError(kv, vtid, pc, "RuntimeError: br failed"); return -1; }
-        kvlangVthreadSet(kv, vtid, np, "running");
-        free(np);
-        return 0;
+        return jump_to(kv, vtid, pc, &inst->reads[taken ? 1 : 2], OP_BR);
     }
     return -1;
 }
@@ -540,15 +499,15 @@ char *kvlangKvcpuBootstrap(kvlangKv_t *kv, const char *vtid, const char *funcnam
     const uint8_t *sbody = sig.data + h.body_offset;
     int nr = sbody[0] | (sbody[1] << 8);
 
-    kvlangStrbuf_t vtroot; kvlangStrbufInit(&vtroot); kvlangKeytreeVthread(vtid, &vtroot);
-    char *stack_vt = kvlangKeytreeStack(vtroot.p);
+    char *frame_root = kvlangKeytreeFrameAt(vtid, 1);
+    char *stack_fr = kvlangKeytreeStack(frame_root);
     char err[256];
-    kvlangKvMkindex(kv, stack_vt, err, sizeof err);
-    kvlangKvExtIndex(kv, stack_vt, func_dir.p, err, sizeof err);
+    kvlangKvMkindex(kv, stack_fr, err, sizeof err);
+    kvlangKvExtIndex(kv, stack_fr, func_dir.p, err, sizeof err);
 
-    char *ep = kvlangKeytreeEntryPc(vtroot.p);
-    kvlangStrbuf_t callpc; kvlangStrbufInit(&callpc); kvlangKeytreeFrameCallpc(vtroot.p, &callpc);
-    kvlangStrbuf_t seglib; kvlangStrbufInit(&seglib); kvlangStrbufPuts(&seglib, stack_vt); kvlangStrbufPuts(&seglib, SEG_LIB);
+    char *ep = kvlangKeytreeEntryPc(frame_root);
+    kvlangStrbuf_t callpc; kvlangStrbufInit(&callpc); kvlangKeytreeFrameCallpc(frame_root, &callpc);
+    kvlangStrbuf_t seglib; kvlangStrbufInit(&seglib); kvlangStrbufPuts(&seglib, stack_fr); kvlangStrbufPuts(&seglib, SEG_LIB);
     kvlangXvalue_t v_ep, v_fn; kvlangXvalueZero(&v_ep); kvlangXvalueZero(&v_fn);
     kvlangXvalueNewCharUtf8(&v_ep, ep);
     kvlangXvalueNewCharUtf8(&v_fn, func_key);
@@ -560,7 +519,7 @@ char *kvlangKvcpuBootstrap(kvlangKv_t *kv, const char *vtid, const char *funcnam
         kvlangKvPair_t pairs[128]; int np = 0;
         for (int i = 0; i < nr && i < nargs; i++) {
             kvlangStrbuf_t slot; kvlangStrbufInit(&slot);
-            kvlangStrbufPrintf(&slot, "%s/[0,-%d]", vtroot.p, i + 1);
+            kvlangStrbufPrintf(&slot, "%s/[0,-%d]", frame_root, i + 1);
             kvlangXvalue_t av; kvlangXvalueZero(&av);
             kvlangBuiltinResolveReadValue(kv, "", args[i], NULL, &av);
             pairs[np].key = kvlangStrbufDetach(&slot);
@@ -572,8 +531,8 @@ char *kvlangKvcpuBootstrap(kvlangKv_t *kv, const char *vtid, const char *funcnam
     }
 
     kvlangXvalueFree(&sig); kvlangStrbufFree(&sig_key); kvlangStrbufFree(&func_dir);
-    kvlangStrbufFree(&vtroot); kvlangStrbufFree(&callpc); kvlangStrbufFree(&seglib);
-    free(stack_vt); free(func_key); free(pkg); free(name);
+    kvlangStrbufFree(&callpc); kvlangStrbufFree(&seglib);
+    free(stack_fr); free(frame_root); free(func_key); free(pkg); free(name);
     return ep;
 }
 
@@ -594,7 +553,7 @@ int kvlangKvcpuExecuteMode(kvlangKv_t *kv, const char *pc, kvmode_t mode, char *
         }
         free(pcv); free(status);
 
-        int depth = stack_depth(cur);
+        int depth = kvlangKeytreeFrameNum(cur);
         if (depth > MAX_STACK_DEPTH) {
             char msg[256];
             snprintf(msg, sizeof msg, "RecursionError: stack overflow: depth=%d pc=%s", depth, cur);
@@ -616,29 +575,17 @@ int kvlangKvcpuExecuteMode(kvlangKv_t *kv, const char *pc, kvmode_t mode, char *
         }
         free(link_base);
 
-        kvlangLogDebug("[%s] PC=%s OP=%s R=%d W=%d", vtid, cur, inst.opcode ? inst.opcode : "(end)", inst.nr, inst.nw);
+        kvlangLogDebug("[%s] PC=%s OP=%s R=%d W=%d", vtid, cur, inst.opcode ? inst.opcode : "(empty)", inst.nr, inst.nw);
 
         if (!inst.opcode || !inst.opcode[0]) {
-            /* 帧结束 */
-            kvlangStrbuf_t vtroot; kvlangStrbufInit(&vtroot); kvlangKeytreeVthread(vtid, &vtroot);
-            if (strcmp(fr, vtroot.p) == 0) {
-                kvlangVthreadSetDone(kv, vtid, "ok");
-                kvlangStrbufFree(&vtroot); free(fr); kvlangRwirInstFree(&inst);
-                break;
-            }
-            if (strcmp(ext_kind(kv, fr), KVSPACE_KIND_RWFUNC) != 0) {
-                char *parent = handle_scope_return(kv, cur);
-                if (!parent || !parent[0]) { free(parent); char msg[512]; snprintf(msg, sizeof msg, "RuntimeError: broken return chain: scope frame %s has no returnpc (pc=%s)", fr, cur); kvlangVthreadSetError(kv, vtid, cur, msg); kvlangStrbufFree(&vtroot); free(fr); kvlangRwirInstFree(&inst); rc = -1; break; }
-                kvlangVthreadSet(kv, vtid, parent, "running");
-                free(cur); cur = parent;
-            } else {
-                char *parent = handle_return(kv, cur);
-                if (!parent || !parent[0]) { free(parent); char msg[512]; snprintf(msg, sizeof msg, "RuntimeError: broken return chain: frame %s has no returnpc (pc=%s)", fr, cur); kvlangVthreadSetError(kv, vtid, cur, msg); kvlangStrbufFree(&vtroot); free(fr); kvlangRwirInstFree(&inst); rc = -1; break; }
-                kvlangVthreadSet(kv, vtid, parent, "running");
-                free(cur); cur = parent;
-            }
-            kvlangStrbufFree(&vtroot); free(fr); kvlangRwirInstFree(&inst);
-            continue;
+            /* layout 对每条路径都补了 return（lower::terminate），走到空槽只能是 /lib 损坏
+             * 或 goto/br 越界；报 RuntimeError 让该 vthread 停下，不拖垮整个进程。 */
+            char msg[512];
+            snprintf(msg, sizeof msg, "RuntimeError: no instruction at %s", cur);
+            kvlangVthreadSetError(kv, vtid, cur, msg);
+            free(fr); kvlangRwirInstFree(&inst);
+            rc = -1;
+            break;
         }
 
         int exec_err = 0;
diff --git a/runtime/src/runtime_internal.h b/runtime/src/runtime_internal.h
index 892e1719..4a3e6890 100644
--- a/runtime/src/runtime_internal.h
+++ b/runtime/src/runtime_internal.h
@@ -133,6 +133,7 @@ kvlangKv_t *kvlangKvConnect(const char *dsn);
 void kvlangKvDisconnect(kvlangKv_t *k);
 int kvlangKvGetOne(kvlangKv_t *k, const char *key, kvlangXvalue_t *out);   /* None → out len=0 */
 int kvlangKvGetBatch(kvlangKv_t *k, const char *prefix, char **names, int n, kvlangXvalue_t *out);
+int kvlangKvGetMember(kvlangKv_t *k, const char *dir, const char *name, kvlangXvalue_t *out);
 int kvlangKvSet(kvlangKv_t *k, const kvlangKvPair_t *pairs, int n, char *err, uint32_t err_cap);
 int kvlangKvDel(kvlangKv_t *k, const char *key, char *err, uint32_t err_cap);
 int kvlangKvDelTree(kvlangKv_t *k, const char *prefix, char *err, uint32_t err_cap);
@@ -161,8 +162,9 @@ const char *kvlangKeytreeVtidFromPc(const char *pc, kvlangStrbuf_t *out);   /* "
 char *kvlangKeytreeStack(const char *root);                            /* malloc */
 char *kvlangKeytreeFrameRoot(const char *pc);                         /* malloc，无效 NULL */
 char *kvlangKeytreeEntryPc(const char *root);                         /* malloc */
-char *kvlangKeytreeScopeEntryPc(const char *root);                   /* malloc */
-char *kvlangKeytreeParentFrame(const char *root);                     /* malloc，"" 顶层 */
+char *kvlangKeytreeFrameAt(const char *vtid, int depth);             /* malloc */
+int   kvlangKeytreeFrameNum(const char *path);                        /* [d]; panics if invalid */
+char *kvlangKeytreeIrseqPc(const char *frame_root, int irseq);        /* malloc */
 char *kvlangKeytreeMember(const char *base, const char *name);         /* malloc */
 char *kvlangKeytreeLibFunc(const char *pkg, const char *name);        /* malloc */
 char *kvlangKeytreeRwir(const char *opcode);                           /* malloc */
@@ -225,10 +227,9 @@ bool kvlangBuiltinIsNative(const char *opcode);
 bool kvlangBuiltinNumOp(const char *opcode);
 int kvlangBuiltinNative(kvlangFrame_t *f);   /* dispatch + call，0 成功 */
 int kvlangBuiltinExecuteCopy(kvlangKv_t *kv, const char *vtid, const char *pc, kvlangRwirInst_t *inst);
-void kvlangBuiltinResolveReadValue(kvlangKv_t *kv, const char *frame_path, const char *name,
+void kvlangBuiltinResolveReadValue(kvlangKv_t *kv, const char *frame_root, const char *name,
                            const kvlangXvalue_t *val, kvlangXvalue_t *out);
-char *kvlangBuiltinResolveWriteSlot(kvlangKv_t *kv, const char *frame_path, const char *name);
-char *kvlangBuiltinFuncFrameRoot(kvlangKv_t *kv, const char *frame_root);   /* malloc */
+char *kvlangBuiltinResolveWriteSlot(kvlangKv_t *kv, const char *frame_root, const char *name);
 bool kvlangBuiltinTryParseNumber(const char *s, kvlangXvalue_t *out);          /* 成功 out 接管 */
 void kvlangDisplay(const kvlangXvalue_t *v, char **out);                     /* malloc，对齐 Go Display */
 
diff --git a/runtime/src/rwir.c b/runtime/src/rwir.c
index 39a873f6..ad75eb33 100644
--- a/runtime/src/rwir.c
+++ b/runtime/src/rwir.c
@@ -18,67 +18,6 @@ int kvlangRwirNextPc(const char *pc, kvlangStrbuf_t *out) {
     return 0;
 }
 
-/* scopePrefixAndBase：从 linkBase 提取 scope 链与 rwfunc 帧 lookupBase。 */
-static void scope_prefix_and_base(const char *link_base, kvlangStrbuf_t *sp, kvlangStrbuf_t *lb) {
-    kvlangStrbufClear(sp);
-    kvlangStrbufClear(lb);
-    kvlangStrbufPuts(sp, "");
-    kvlangStrbufPuts(lb, link_base);
-
-    size_t n = strlen(link_base);
-    while (n > 0 && link_base[n - 1] == '/') n--;
-    if (n == 0) return;
-    bool has_bracket = false;
-    for (size_t i = 0; i < n; i++) if (link_base[i] == '[') { has_bracket = true; break; }
-    if (!has_bracket) {
-        /* 无 bracket：函数帧即 vthread 根 /vthread/<vtid>/（bootstrap 入口帧）。
-         * 锚点固定为根，其后各段皆为 scope（· 连接），使根上的 extindex 覆盖所有嵌套 scope。 */
-        int slashes = 0; size_t third = (size_t)-1;
-        for (size_t i = 0; i < n; i++) if (link_base[i] == '/') { if (++slashes == 3) { third = i; break; } }
-        if (third == (size_t)-1) return; /* 就是 vthread 根本身：sp="" lb=link_base */
-        kvlangStrbufClear(lb);
-        kvlangStrbufPutn(lb, link_base, third);
-        kvlangStrbufPutc(lb, '/');
-        for (size_t i = third + 1; i < n; ) {
-            size_t j = i; while (j < n && link_base[j] != '/') j++;
-            if (sp->len > 0) kvlangStrbufPuts(sp, MEMBER_SEP);
-            kvlangStrbufPutn(sp, link_base + i, j - i);
-            i = (j < n) ? j + 1 : j;
-        }
-        return;
-    }
-
-    char *scopes[MAX_STACK_DEPTH];
-    int nscopes = 0;
-    size_t rest = n;
-    while (rest > 0) {
-        size_t sep = (size_t)-1;
-        for (size_t i = 0; i < rest; i++) if (link_base[i] == '/') sep = i;
-        if (sep == (size_t)-1) break;
-        size_t start = sep + 1, len = rest - start;
-        rest = sep;
-        if (len > 0 && link_base[start] == '[') {
-            kvlangStrbufClear(lb);
-            kvlangStrbufPutn(lb, link_base, rest);
-            kvlangStrbufPutc(lb, '/');
-            kvlangStrbufPutn(lb, link_base + start, len);
-            kvlangStrbufPutc(lb, '/');
-            break;
-        }
-        if (nscopes < MAX_STACK_DEPTH) {
-            scopes[nscopes] = malloc(len + 1);
-            memcpy(scopes[nscopes], link_base + start, len);
-            scopes[nscopes][len] = 0;
-            nscopes++;
-        }
-    }
-    for (int i = nscopes - 1; i >= 0; i--) {
-        if (sp->len > 0) kvlangStrbufPuts(sp, MEMBER_SEP);
-        kvlangStrbufPuts(sp, scopes[i]);
-        free(scopes[i]);
-    }
-}
-
 void kvlangRwirInstFree(kvlangRwirInst_t *inst) {
     free(inst->opcode);
     for (int i = 0; i < inst->nr; i++) { free(inst->reads[i].name); kvlangXvalueFree(&inst->reads[i].val); }
@@ -96,24 +35,27 @@ int kvlangRwirDecode(kvlangKv_t *kv, const char *link_base, const char *pc, kvla
     if (!last) { snprintf(err, err_cap, "Decode: invalid pc (no /[coord]): %s", pc); return -1; }
     int addr0 = kvlangRwirExtractAddr0(last + 1);
 
-    kvlangStrbuf_t sp, lb, key;
-    kvlangStrbufInit(&sp); kvlangStrbufInit(&lb); kvlangStrbufInit(&key);
-    scope_prefix_and_base(link_base, &sp, &lb);
+    kvlangStrbuf_t key;
+    kvlangStrbufInit(&key);
 
     int nslots = 1 + 2 * MAX_PARAMS;
     char **names = malloc(sizeof(char *) * (size_t)nslots);
-    kvlangStrbufPrintf(&key, "%s[%d,0]", sp.p, addr0);
+    kvlangStrbufPrintf(&key, "[%d,0]", addr0);
     names[0] = kvlangStrbufDetach(&key);
     for (int i = 1; i <= MAX_PARAMS; i++) {
-        kvlangStrbufPrintf(&key, "%s[%d,-%d]", sp.p, addr0, i);
+        kvlangStrbufPrintf(&key, "[%d,-%d]", addr0, i);
         names[(i - 1) * 2 + 1] = kvlangStrbufDetach(&key);
-        kvlangStrbufPrintf(&key, "%s[%d,%d]", sp.p, addr0, i);
+        kvlangStrbufPrintf(&key, "[%d,%d]", addr0, i);
         names[(i - 1) * 2 + 2] = kvlangStrbufDetach(&key);
     }
-    kvlangStrbufFree(&key);
 
     kvlangXvalue_t *vals = malloc(sizeof(kvlangXvalue_t) * (size_t)nslots);
-    kvlangKvGetBatch(kv, lb.p, names, nslots, vals);
+    if (kvlangKvGetBatch(kv, link_base, names, nslots, vals) != 0) {
+        snprintf(err, err_cap, "Decode: GetBatch failed at %s", pc);
+        for (int i = 0; i < nslots; i++) free(names[i]);
+        free(names); free(vals); kvlangStrbufFree(&key);
+        return -1;
+    }
 
     if (!kvlangXvalueNone(&vals[0])) out->opcode = kvlangXvalueValueString(&vals[0]);
 
@@ -141,6 +83,6 @@ int kvlangRwirDecode(kvlangKv_t *kv, const char *link_base, const char *pc, kvla
     free(vals);
     for (int i = 0; i < nslots; i++) free(names[i]);
     free(names);
-    kvlangStrbufFree(&sp); kvlangStrbufFree(&lb);
+    kvlangStrbufFree(&key);
     return 0;
 }
diff --git a/tutorial/02-func/string_passthrough.kv b/tutorial/02-func/string_passthrough.kv
new file mode 100644
index 00000000..6883b533
--- /dev/null
+++ b/tutorial/02-func/string_passthrough.kv
@@ -0,0 +1,38 @@
+// string_passthrough: 字符串变量作实参穿过多层调用不丢值
+// 实参槽 [0,-k] 存的是键路径；resolve 只追显式 Ptr，勿把 char 值当路径再追（否则第二层即 None）
+// 期望输出:
+//   L1: hello world
+//   L2: hello world
+//   L3: hello world
+//   L2 int: 42
+//   L2 path-like: /lib
+rwfunc show(x:[]char/utf32, tag:[]char/utf32) -> () {
+	println(tag, x)
+}
+
+rwfunc show2(x:[]char/utf32, tag:[]char/utf32) -> () {
+	show(x, tag)
+}
+
+rwfunc show3(x:[]char/utf32, tag:[]char/utf32) -> () {
+	show2(x, tag)
+}
+
+rwfunc showi(n:int64) -> () {
+	println("L2 int:", n)
+}
+
+rwfunc showi2(n:int64) -> () {
+	showi(n)
+}
+
+rwfunc test() -> () {
+	s = "hello world"
+	show(s, "L1:")
+	show2(s, "L2:")
+	show3(s, "L3:")
+	k = 42
+	showi2(k)
+	p = "/lib"
+	show2(p, "L2 path-like:")
+}
diff --git a/tutorial/issue116_exp.py b/tutorial/issue116_exp.py
new file mode 100644
index 00000000..cd85888f
--- /dev/null
+++ b/tutorial/issue116_exp.py
@@ -0,0 +1,542 @@
+#!/usr/bin/env python3
+"""if/while/for lower to goto/br; execute changes irseq, does not open a scope frame.
+
+  KVSPACE_BACKEND_PATH=.deps/lib/kvspace \\
+  LD_LIBRARY_PATH=bin:.deps/lib:.deps/lib/kvspace \\
+  python3 tutorial/issue116_exp.py
+"""
+from __future__ import annotations
+
+import os
+import re
+import shutil
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+LAYOUT = os.environ.get("KVLANG_LAYOUT_BIN", str(ROOT / "bin" / "kvlanglayout"))
+TERM = os.environ.get("KVLANG_TERM_BIN", str(ROOT / "bin" / "kvlang"))
+PC_FLAT = re.compile(r"^/vthread/[0-9]+/\[[0-9]+\]/\[[0-9]+,-?[0-9]+\]$")
+SCOPE_MARK = re.compile(
+    r"_(then|else|while|do|if|merge|exit|for_init|for_cond|for_body|for_exit)_\d+"
+)
+
+
+def env_for(dsn: str) -> dict[str, str]:
+    e = dict(os.environ)
+    e["KVSPACE"] = dsn
+    deps = ROOT / ".deps"
+    lib = str(ROOT / "bin")
+    extra = [lib, str(deps / "lib"), str(deps / "lib" / "kvspace")]
+    e["LD_LIBRARY_PATH"] = ":".join(extra + [e.get("LD_LIBRARY_PATH", "")])
+    e["LIBRARY_PATH"] = ":".join([str(deps / "lib"), e.get("LIBRARY_PATH", "")])
+    e["KVSPACE_BACKEND_PATH"] = str(deps / "lib" / "kvspace")
+    return e
+
+
+def tlv_char(data: bytes) -> str:
+    # head: 1B kindexpr_len, kindexpr, padding... we only need trailing UTF-8 after last NUL run.
+    # fs dump of char/utf8: b'\x0e[20]char/utf8\x00...\x14\x00\x00\x00/vthread/...'
+    if b"char/utf8" in data:
+        i = data.find(b"char/utf8")
+        rest = data[i + len(b"char/utf8") :]
+        # skip NULs and 4B body_len
+        rest = rest.lstrip(b"\x00")
+        if len(rest) >= 4:
+            n = int.from_bytes(rest[:4], "little")
+            return rest[4 : 4 + n].decode("utf-8", "replace")
+        return rest.decode("utf-8", "replace").strip("\x00")
+    return data.decode("utf-8", "replace")
+
+
+def store_files(store: Path) -> list[Path]:
+    return [p for p in store.rglob("*") if p.is_file()]
+
+
+def rel(store: Path, p: Path) -> str:
+    return "/" + str(p.relative_to(store))
+
+
+def all_rels(store: Path) -> list[str]:
+    return [rel(store, p) for p in store.rglob("*")]
+
+
+def read_pc(store: Path, vtid: str = "1") -> str:
+    p = store / "vthread" / vtid / "‥pc"
+    if not p.is_file():
+        vt = store / "vthread" / vtid
+        if vt.is_dir():
+            for cand in vt.iterdir():
+                if cand.name.endswith("pc") and "pc" in cand.name:
+                    p = cand
+                    break
+    if not p.is_file():
+        return ""
+    return tlv_char(p.read_bytes()).strip()
+
+
+def frame_dirs(store: Path, vtid: str = "1") -> list[str]:
+    vt = store / "vthread" / vtid
+    out = []
+    if not vt.is_dir():
+        return out
+    for c in vt.iterdir():
+        name = c.name
+        if c.is_dir() and name.startswith("[") and name.endswith("]") and "," not in name:
+            out.append(name)
+    return sorted(out, key=lambda s: int(s[1:-1]))
+
+
+def vthread_rels(store: Path) -> list[str]:
+    return [r for r in all_rels(store) if r.startswith("/vthread/")]
+
+
+def scope_hits(paths: list[str]) -> list[str]:
+    return [p for p in paths if SCOPE_MARK.search(p)]
+
+
+def layout_and_run(src: str, store: Path, timeout: int = 30) -> subprocess.CompletedProcess[str]:
+    if store.exists():
+        shutil.rmtree(store)
+    store.mkdir(parents=True)
+    dsn = f"fs://{store}"
+    kvsrc = store / "prog.kv"
+    kvsrc.write_text(src, encoding="utf-8")
+    e = env_for(dsn)
+    lay = subprocess.run([LAYOUT, str(kvsrc), dsn], capture_output=True, text=True, cwd=str(ROOT), timeout=timeout, env=e)
+    if lay.returncode != 0:
+        raise RuntimeError(f"layout failed: {lay.stderr}\n{lay.stdout}")
+    return subprocess.run([TERM, "init"], capture_output=True, text=True, cwd=str(ROOT), timeout=timeout, env=e)
+
+
+def assert_pc_flat(pc: str, ctx: str) -> None:
+    if not PC_FLAT.match(pc):
+        raise AssertionError(f"{ctx}: PC not flat: {pc!r}")
+    if pc.count("[") != 2:
+        raise AssertionError(f"{ctx}: PC should have 2 coord segments: {pc!r}")
+    if SCOPE_MARK.search(pc):
+        raise AssertionError(f"{ctx}: PC still has scope segment: {pc!r}")
+
+
+def assert_no_vthread_scope(store: Path, ctx: str) -> None:
+    hits = scope_hits(vthread_rels(store))
+    if hits:
+        raise AssertionError(f"{ctx}: vthread still has scope keys: {hits[:12]}")
+
+
+def assert_frames(store: Path, ctx: str, n: int) -> list[str]:
+    frames = frame_dirs(store)
+    if len(frames) != n:
+        raise AssertionError(f"{ctx}: extra frames {frames} want {n} pc={read_pc(store)}")
+    return frames
+
+
+def run_ok(src: str, expect: str, ctx: str) -> str:
+    store = Path(tempfile.mkdtemp(prefix=f"i116-{ctx}-"))
+    try:
+        r = layout_and_run(src, store)
+        out = (r.stdout or "") + (r.stderr or "")
+        if r.returncode != 0:
+            raise AssertionError(f"{ctx}: exit {r.returncode} out={out[:400]}")
+        if expect not in r.stdout:
+            raise AssertionError(f"{ctx}: missing {expect!r} in stdout={r.stdout!r} stderr={r.stderr[:200]!r}")
+        assert_no_vthread_scope(store, ctx)
+        lib_hits = scope_hits([p for p in all_rels(store) if p.startswith("/lib/") and "/[" in p])
+        if lib_hits:
+            raise AssertionError(f"{ctx}: lib still has scope-flat keys: {lib_hits[:8]}")
+        print(f"  {ctx} stdout={r.stdout.strip()!r} frames={frame_dirs(store)}")
+        return r.stdout
+    finally:
+        shutil.rmtree(store, ignore_errors=True)
+
+
+def run_crash(src: str, ctx: str, want_frames: int) -> str:
+    store = Path(tempfile.mkdtemp(prefix=f"i116-{ctx}-"))
+    try:
+        r = layout_and_run(src, store)
+        pc = read_pc(store)
+        assert_pc_flat(pc, ctx)
+        assert_no_vthread_scope(store, ctx)
+        frames = assert_frames(store, ctx, want_frames)
+        n = int(re.search(r"/\[(\d+)\]/", pc).group(1))
+        if n != want_frames:
+            raise AssertionError(f"{ctx}: FrameNum={n} pc={pc} want {want_frames}")
+        print(f"  {ctx} pc={pc} frames={frames} err={(r.stderr or '')[:80]!r}")
+        return pc
+    finally:
+        shutil.rmtree(store, ignore_errors=True)
+
+
+def exp_bootstrap_depth1() -> None:
+    store = Path(tempfile.mkdtemp(prefix="i116-boot-"))
+    try:
+        src = 'rwfunc main() -> () { 1 -> /ok }\nmain()\n'
+        layout_and_run(src, store)
+        pc = read_pc(store)
+        # done: last PC is return slot on frame [1] or [2]
+        frames = frame_dirs(store)
+        # after return of depth-1, frame may be deleted; bootstrap created [1]
+        keys = [rel(store, p) for p in store_files(store)]
+        if any("/vthread/" in k and "_else" in k for k in keys):
+            raise AssertionError(f"scope path under vthread: {keys}")
+        print(f"  bootstrap pc={pc!r} frames={frames} keys={len(keys)}")
+        if pc:
+            assert_pc_flat(pc, "bootstrap")
+    finally:
+        shutil.rmtree(store, ignore_errors=True)
+
+
+def exp_while_same_frame() -> None:
+    store = Path(tempfile.mkdtemp(prefix="i116-while-"))
+    try:
+        src = """rwfunc main() -> () {
+    1 -> i
+    while (i <= 3) {
+        i <- i + 1
+    }
+    1 ÷ 0 -> x
+}
+main()
+"""
+        r = layout_and_run(src, store)
+        pc = read_pc(store)
+        assert_pc_flat(pc, "while")
+        n = int(re.search(r"/\[(\d+)\]/", pc).group(1))
+        if n != 2:
+            raise AssertionError(f"while FrameNum={n} pc={pc} want 2 (init+main)")
+        frames = frame_dirs(store)
+        if len(frames) != 2:
+            raise AssertionError(f"while extra frames: {frames} pc={pc}")
+        print(f"  while pc={pc} frames={frames} stderr={r.stderr.strip()[:80]!r}")
+    finally:
+        shutil.rmtree(store, ignore_errors=True)
+
+
+def exp_else_recursion_flat() -> None:
+    store = Path(tempfile.mkdtemp(prefix="i116-rec-"))
+    try:
+        src = """rwfunc rec(n:int64) -> (r:int64) {
+    if (n <= 0) {
+        1 ÷ 0 -> r
+    } else {
+        n - 1 -> n1
+        rec(n1) -> r
+    }
+}
+rec(3)
+"""
+        layout_and_run(src, store)
+        pc = read_pc(store)
+        assert_pc_flat(pc, "else-rec")
+        n = int(re.search(r"/\[(\d+)\]/", pc).group(1))
+        if n != 5:
+            raise AssertionError(f"else-rec FrameNum={n} pc={pc} want 5 (init+rec×4)")
+        print(f"  else-rec pc={pc} FrameNum={n} len={len(pc)}")
+    finally:
+        shutil.rmtree(store, ignore_errors=True)
+
+
+def exp_pc_len_vs_depth() -> None:
+    """PC byte length must stay ~constant as depth grows (not +14B/level)."""
+    rows = []
+    for depth in (3, 8, 15):
+        store = Path(tempfile.mkdtemp(prefix=f"i116-d{depth}-"))
+        try:
+            src = f"""rwfunc rec(n:int64) -> (r:int64) {{
+    if (n <= 0) {{
+        1 ÷ 0 -> r
+    }} else {{
+        n - 1 -> n1
+        rec(n1) -> r
+    }}
+}}
+rec({depth})
+"""
+            layout_and_run(src, store)
+            pc = read_pc(store)
+            assert_pc_flat(pc, f"depth={depth}")
+            n = int(re.search(r"/\[(\d+)\]/", pc).group(1))
+            rows.append((depth, n, len(pc), pc))
+        finally:
+            shutil.rmtree(store, ignore_errors=True)
+    print("  depth  FrameNum  PClen  PC")
+    for depth, n, L, pc in rows:
+        print(f"  {depth:5d}  {n:8d}  {L:5d}  {pc}")
+    lengths = [L for _, _, L, _ in rows]
+    # old model PC(d) ≈ 22+14(d-1); d=15 → ~218. new: ~23–26.
+    if max(lengths) - min(lengths) > 4:
+        raise AssertionError(f"PC length grew too much across depths: {rows}")
+    if max(lengths) > 40:
+        raise AssertionError(f"PC still O(D)? {rows}")
+
+
+def exp_stack_overflow_flat() -> None:
+    store = Path(tempfile.mkdtemp(prefix="i116-ovf-"))
+    try:
+        src = Path(ROOT / "tutorial/error_cases/recursion_error/stack_overflow.kv").read_text()
+        r = layout_and_run(src, store)
+        pc = read_pc(store)
+        assert_pc_flat(pc, "overflow")
+        n = int(re.search(r"/\[(\d+)\]/", pc).group(1))
+        if n != 257:
+            raise AssertionError(f"overflow FrameNum={n} pc={pc} want 257 (MaxStackDepth+1)")
+        err = r.stderr + r.stdout
+        if "RecursionError" not in err and "stack overflow" not in err:
+            raise AssertionError(f"overflow missing RecursionError: {err[:300]}")
+        print(f"  overflow pc={pc} FrameNum={n} len={len(pc)}")
+    finally:
+        shutil.rmtree(store, ignore_errors=True)
+
+
+def exp_lib_no_scope_keys() -> None:
+    store = Path(tempfile.mkdtemp(prefix="i116-lib-"))
+    try:
+        src = Path(ROOT / "tutorial/03-control/while.kv").read_text()
+        layout_and_run(src, store)
+        bad = []
+        for p in store_files(store):
+            r = rel(store, p)
+            if "/lib/" in r and re.search(r"/_[A-Za-z]+_[0-9]+\[", r):
+                bad.append(r)
+        if bad:
+            raise AssertionError(f"lib still has scope keys: {bad[:10]}")
+        print(f"  lib plane clean, files={len(store_files(store))}")
+    finally:
+        shutil.rmtree(store, ignore_errors=True)
+
+
+def exp_if_then_result() -> None:
+    src = """rwfunc main() -> () {
+    0 - 5 -> x
+    if (x < 0) {
+        0 - x -> x
+    } else {
+        x -> x
+    }
+    println(x)
+}
+main()
+"""
+    run_ok(src, "5", "if-then")
+
+
+def exp_if_else_result() -> None:
+    src = """rwfunc main() -> () {
+    3 -> x
+    if (x < 0) {
+        0 - x -> x
+    } else {
+        x + 1 -> x
+    }
+    println(x)
+}
+main()
+"""
+    run_ok(src, "4", "if-else")
+
+
+def exp_if_crash_same_frame() -> None:
+    run_crash(
+        """rwfunc main() -> () {
+    if (1 < 2) {
+        1 ÷ 0 -> x
+    } else {
+        0 -> x
+    }
+}
+main()
+""",
+        "if-then-crash",
+        2,
+    )
+    run_crash(
+        """rwfunc main() -> () {
+    if (2 < 1) {
+        0 -> x
+    } else {
+        1 ÷ 0 -> x
+    }
+}
+main()
+""",
+        "if-else-crash",
+        2,
+    )
+
+
+def exp_while_result() -> None:
+    src = """rwfunc main() -> () {
+    0 -> acc
+    1 -> i
+    while (i <= 10) {
+        acc + i -> acc
+        i <- i + 1
+    }
+    println(acc)
+}
+main()
+"""
+    run_ok(src, "55", "while-sum")
+
+
+def exp_break_result() -> None:
+    src = """rwfunc main() -> () {
+    0 -> i
+    while (i < 100) {
+        if (i == 5) {
+            break
+        }
+        i <- i + 1
+    }
+    println(i)
+}
+main()
+"""
+    run_ok(src, "5", "break")
+
+
+def exp_continue_result() -> None:
+    src = """rwfunc main() -> () {
+    0 -> acc
+    1 -> i
+    while (i <= 5) {
+        if (i == 3) {
+            i <- i + 1
+            continue
+        }
+        acc <- acc + i
+        i <- i + 1
+    }
+    println(acc)
+}
+main()
+"""
+    run_ok(src, "12", "continue")
+
+
+def exp_nested_while_if_crash() -> None:
+    run_crash(
+        """rwfunc main() -> () {
+    1 -> i
+    while (i <= 2) {
+        1 -> j
+        while (j <= 2) {
+            if (i == 2) {
+                1 ÷ 0 -> x
+            }
+            j <- j + 1
+        }
+        i <- i + 1
+    }
+}
+main()
+""",
+        "nest-while-if-crash",
+        2,
+    )
+
+
+def parse_expects(text: str) -> list[str]:
+    pats: list[str] = []
+    in_block = False
+    for line in text.splitlines():
+        if line.startswith("# 期望输出"):
+            in_block = True
+            continue
+        if in_block:
+            if line.startswith("#   ") or line.startswith("# \t"):
+                p = line[2:].strip()
+                p = re.sub(r"\s*\(.*\)\s*$", "", p)
+                if p:
+                    pats.append(p)
+            elif not line.startswith("#"):
+                break
+    return pats
+
+
+def exp_tutorial_control() -> None:
+    files = [
+        ROOT / "tutorial/03-control/if.kv",
+        ROOT / "tutorial/03-control/while.kv",
+        ROOT / "tutorial/03-control/guess.kv",
+        ROOT / "tutorial/03-control/classify.kv",
+        ROOT / "tutorial/03-control/for.kv",
+    ]
+    for f in files:
+        src = f.read_text(encoding="utf-8")
+        expects = parse_expects(src)
+        if not expects:
+            raise AssertionError(f"{f.name}: no 期望输出")
+        store = Path(tempfile.mkdtemp(prefix=f"i116-{f.stem}-"))
+        try:
+            r = layout_and_run(src, store, timeout=60)
+            out = r.stdout or ""
+            if r.returncode != 0:
+                raise AssertionError(f"{f.name}: exit {r.returncode} {r.stderr[:300]}")
+            missing = [e for e in expects if e not in out]
+            if missing:
+                raise AssertionError(f"{f.name}: missing {missing} stdout={out[:400]!r}")
+            assert_no_vthread_scope(store, f.name)
+            print(f"  tutorial {f.name} ok frames={frame_dirs(store)}")
+        finally:
+            shutil.rmtree(store, ignore_errors=True)
+
+
+def exp_break_in_prime_sieve_layout_run() -> None:
+    src = Path(ROOT / "tutorial/06-algo/prime_sieve.kv").read_text(encoding="utf-8")
+    src = src.replace("prime_sieve(200)", "prime_sieve(30)")
+    store = Path(tempfile.mkdtemp(prefix="i116-sieve-"))
+    try:
+        r = layout_and_run(src, store, timeout=60)
+        out = r.stdout or ""
+        if r.returncode != 0:
+            raise AssertionError(f"sieve: exit {r.returncode} {r.stderr[:300]}")
+        if "prime: 29" not in out:
+            raise AssertionError(f"sieve missing prime 29: {out[:400]!r}")
+        if "total primes up to 30 =" not in out:
+            raise AssertionError(f"sieve missing total: {out[:400]!r}")
+        assert_no_vthread_scope(store, "sieve")
+        print(f"  sieve(30) ok")
+    finally:
+        shutil.rmtree(store, ignore_errors=True)
+
+
+def main() -> int:
+    for binp, name in ((LAYOUT, "layout"), (TERM, "term")):
+        if not Path(binp).is_file():
+            print(f"missing {name} binary: {binp}", file=sys.stderr)
+            return 2
+    tests = [
+        ("lib-no-scope-keys", exp_lib_no_scope_keys),
+        ("bootstrap-depth1", exp_bootstrap_depth1),
+        ("while-same-frame", exp_while_same_frame),
+        ("else-recursion-flat", exp_else_recursion_flat),
+        ("pc-len-vs-depth", exp_pc_len_vs_depth),
+        ("stack-overflow-flat", exp_stack_overflow_flat),
+        ("if-then-result", exp_if_then_result),
+        ("if-else-result", exp_if_else_result),
+        ("if-crash-same-frame", exp_if_crash_same_frame),
+        ("while-result", exp_while_result),
+        ("break-result", exp_break_result),
+        ("continue-result", exp_continue_result),
+        ("nest-while-if-crash", exp_nested_while_if_crash),
+        ("tutorial-control", exp_tutorial_control),
+        ("break-sieve-30", exp_break_in_prime_sieve_layout_run),
+    ]
+    failed = 0
+    for name, fn in tests:
+        try:
+            print(f"== {name}")
+            fn()
+            print(f"OK {name}")
+        except Exception as e:
+            failed += 1
+            print(f"FAIL {name}: {e}")
+    print(f"══ PASS:{len(tests) - failed}  FAIL:{failed} ══")
+    return 1 if failed else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())