diff --git a/crates/js/src/jit/assembler.rs b/crates/js/src/jit/assembler.rs
new file mode 100644
index 0000000..3b25123
--- /dev/null
+++ b/crates/js/src/jit/assembler.rs
@@ -0,0 +1,1500 @@
+//! AArch64 machine code assembler.
+//!
+//! Emits fixed-width 32-bit AArch64 instructions into a byte buffer.
+//! Supports label-based forward references with backpatching.
+
+use super::buffer::{CodePtr, JitBuffer};
+use super::memory::MemoryError;
+
+// ── AArch64 register definitions ─────────────────────────────────────────────
+
+/// A 64-bit general-purpose register (X0–X30, SP/ZR).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Reg(u8);
+
+impl Reg {
+    pub const fn new(n: u8) -> Self {
+        assert!(n < 32, "register index must be 0-31");
+        Reg(n)
+    }
+
+    pub const fn index(self) -> u8 {
+        self.0
+    }
+}
+
+// Arguments / return value
+pub const X0: Reg = Reg(0);
+pub const X1: Reg = Reg(1);
+pub const X2: Reg = Reg(2);
+pub const X3: Reg = Reg(3);
+pub const X4: Reg = Reg(4);
+pub const X5: Reg = Reg(5);
+pub const X6: Reg = Reg(6);
+pub const X7: Reg = Reg(7);
+
+// Indirect result location
+pub const X8: Reg = Reg(8);
+
+// Temporaries (caller-saved)
+pub const X9: Reg = Reg(9);
+pub const X10: Reg = Reg(10);
+pub const X11: Reg = Reg(11);
+pub const X12: Reg = Reg(12);
+pub const X13: Reg = Reg(13);
+pub const X14: Reg = Reg(14);
+pub const X15: Reg = Reg(15);
+
+// Intra-procedure-call temporary
+pub const X16: Reg = Reg(16);
+pub const X17: Reg = Reg(17);
+
+// Platform register (reserved)
+pub const X18: Reg = Reg(18);
+
+// Callee-saved registers
+pub const X19: Reg = Reg(19);
+pub const X20: Reg = Reg(20);
+pub const X21: Reg = Reg(21);
+pub const X22: Reg = Reg(22);
+pub const X23: Reg = Reg(23);
+pub const X24: Reg = Reg(24);
+pub const X25: Reg = Reg(25);
+pub const X26: Reg = Reg(26);
+pub const X27: Reg = Reg(27);
+pub const X28: Reg = Reg(28);
+
+// Frame pointer
+pub const FP: Reg = Reg(29);
+// Link register
+pub const LR: Reg = Reg(30);
+// Stack pointer / zero register (context-dependent)
+pub const SP: Reg = Reg(31);
+pub const ZR: Reg = Reg(31);
+
+/// A 64-bit floating-point / SIMD register (D0–D31).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct FpReg(u8);
+
+impl FpReg {
+    pub const fn new(n: u8) -> Self {
+        assert!(n < 32, "FP register index must be 0-31");
+        FpReg(n)
+    }
+
+    pub const fn index(self) -> u8 {
+        self.0
+    }
+}
+
+pub const D0: FpReg = FpReg(0);
+pub const D1: FpReg = FpReg(1);
+pub const D2: FpReg = FpReg(2);
+pub const D3: FpReg = FpReg(3);
+pub const D4: FpReg = FpReg(4);
+pub const D5: FpReg = FpReg(5);
+pub const D6: FpReg = FpReg(6);
+pub const D7: FpReg = FpReg(7);
+
+// ── Condition codes ──────────────────────────────────────────────────────────
+
+/// AArch64 condition codes for conditional branches.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[repr(u8)]
+pub enum Cond {
+    EQ = 0b0000, // Equal (Z=1)
+    NE = 0b0001, // Not equal (Z=0)
+    CS = 0b0010, // Carry set / unsigned higher or same (C=1)
+    CC = 0b0011, // Carry clear / unsigned lower (C=0)
+    MI = 0b0100, // Minus / negative (N=1)
+    PL = 0b0101, // Plus / positive or zero (N=0)
+    VS = 0b0110, // Overflow (V=1)
+    VC = 0b0111, // No overflow (V=0)
+    HI = 0b1000, // Unsigned higher (C=1 && Z=0)
+    LS = 0b1001, // Unsigned lower or same (C=0 || Z=1)
+    GE = 0b1010, // Signed greater or equal (N==V)
+    LT = 0b1011, // Signed less than (N!=V)
+    GT = 0b1100, // Signed greater than (Z==0 && N==V)
+    LE = 0b1101, // Signed less or equal (Z==1 || N!=V)
+    AL = 0b1110, // Always
+}
+
+// ── Labels ───────────────────────────────────────────────────────────────────
+
+/// A label for forward/backward branch references.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Label(u32);
+
+/// Tracks pending fixups for forward references.
+struct PendingFixup {
+    /// Byte offset in the code buffer where the branch instruction lives.
+    instruction_offset: usize,
+    /// The label being referenced.
+    label: Label,
+    /// What kind of fixup is needed.
+    kind: FixupKind,
+}
+
+#[derive(Debug, Clone, Copy)]
+enum FixupKind {
+    /// B/BL: 26-bit signed offset (imm26), in words
+    Branch26,
+    /// B.cond/CBZ/CBNZ: 19-bit signed offset (imm19), in words
+    Branch19,
+}
+
+// ── Assembler ────────────────────────────────────────────────────────────────
+
+/// AArch64 machine code assembler.
+///
+/// Emits instructions into an internal byte buffer, then finalizes into
+/// executable code via a JitBuffer.
+pub struct Assembler {
+    /// Emitted machine code bytes.
+    code: Vec<u8>,
+    /// Label ID → byte offset (None if not yet bound).
+    labels: Vec<Option<usize>>,
+    /// Forward references to patch when labels are bound.
+    fixups: Vec<PendingFixup>,
+}
+
+impl Default for Assembler {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl Assembler {
+    pub fn new() -> Self {
+        Assembler {
+            code: Vec::with_capacity(1024),
+            labels: Vec::new(),
+            fixups: Vec::new(),
+        }
+    }
+
+    /// Current byte offset in the code buffer.
+    pub fn offset(&self) -> usize {
+        self.code.len()
+    }
+
+    /// Get the emitted code as a byte slice.
+    pub fn code(&self) -> &[u8] {
+        &self.code
+    }
+
+    /// Create a new unbound label.
+    pub fn new_label(&mut self) -> Label {
+        let id = self.labels.len() as u32;
+        self.labels.push(None);
+        Label(id)
+    }
+
+    /// Bind a label to the current code offset.
+    /// Patches all pending forward references to this label.
+    pub fn bind_label(&mut self, label: Label) {
+        let offset = self.code.len();
+        assert!(
+            self.labels[label.0 as usize].is_none(),
+            "label already bound"
+        );
+        self.labels[label.0 as usize] = Some(offset);
+
+        // Backpatch pending fixups
+        let fixups: Vec<_> = self
+            .fixups
+            .iter()
+            .filter(|f| f.label == label)
+            .map(|f| (f.instruction_offset, f.kind))
+            .collect();
+
+        for (inst_offset, kind) in fixups {
+            let word_offset = (offset as i64 - inst_offset as i64) / 4;
+            self.patch_branch(inst_offset, word_offset, kind);
+        }
+        self.fixups.retain(|f| f.label != label);
+    }
+
+    /// Finalize: resolve all labels, emit code into a JitBuffer, return CodePtr.
+    pub fn finalize(&self, buffer: &mut JitBuffer) -> Result<CodePtr, MemoryError> {
+        assert!(self.fixups.is_empty(), "unresolved forward references");
+        buffer.emit_code(&self.code)
+    }
+
+    /// Finalize and return the raw code bytes (for testing without executable memory).
+    pub fn finalize_to_vec(&self) -> Vec<u8> {
+        assert!(self.fixups.is_empty(), "unresolved forward references");
+        self.code.clone()
+    }
+
+    // ── Instruction emission helpers ─────────────────────────────────────
+
+    fn emit_u32(&mut self, inst: u32) {
+        self.code.extend_from_slice(&inst.to_le_bytes());
+    }
+
+    fn patch_branch(&mut self, inst_offset: usize, word_offset: i64, kind: FixupKind) {
+        let mut inst =
+            u32::from_le_bytes(self.code[inst_offset..inst_offset + 4].try_into().unwrap());
+
+        match kind {
+            FixupKind::Branch26 => {
+                assert!(
+                    (-(1i64 << 25)..(1i64 << 25)).contains(&word_offset),
+                    "branch26 offset out of range: {}",
+                    word_offset
+                );
+                let imm26 = (word_offset as u32) & 0x03FF_FFFF;
+                inst = (inst & 0xFC00_0000) | imm26;
+            }
+            FixupKind::Branch19 => {
+                assert!(
+                    (-(1i64 << 18)..(1i64 << 18)).contains(&word_offset),
+                    "branch19 offset out of range: {}",
+                    word_offset
+                );
+                let imm19 = (word_offset as u32) & 0x7FFFF;
+                inst = (inst & 0xFF00_001F) | (imm19 << 5);
+            }
+        }
+
+        self.code[inst_offset..inst_offset + 4].copy_from_slice(&inst.to_le_bytes());
+    }
+
+    fn emit_branch_to_label(&mut self, label: Label, kind: FixupKind, base_inst: u32) {
+        if let Some(target) = self.labels[label.0 as usize] {
+            // Backward reference — patch immediately
+            let word_offset = (target as i64 - self.code.len() as i64) / 4;
+            let inst = match kind {
+                FixupKind::Branch26 => {
+                    let imm26 = (word_offset as u32) & 0x03FF_FFFF;
+                    (base_inst & 0xFC00_0000) | imm26
+                }
+                FixupKind::Branch19 => {
+                    let imm19 = (word_offset as u32) & 0x7FFFF;
+                    (base_inst & 0xFF00_001F) | (imm19 << 5)
+                }
+            };
+            self.emit_u32(inst);
+        } else {
+            // Forward reference — emit placeholder and record fixup
+            self.fixups.push(PendingFixup {
+                instruction_offset: self.code.len(),
+                label,
+                kind,
+            });
+            self.emit_u32(base_inst);
+        }
+    }
+
+    // ── Arithmetic instructions ──────────────────────────────────────────
+
+    /// ADD Xd, Xn, Xm
+    pub fn add_reg(&mut self, rd: Reg, rn: Reg, rm: Reg) {
+        // 1_00_01011_00_0_Rm_000000_Rn_Rd
+        let inst = 0x8B000000
+            | ((rm.index() as u32) << 16)
+            | ((rn.index() as u32) << 5)
+            | (rd.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// ADD Xd, Xn, #imm12
+    pub fn add_imm(&mut self, rd: Reg, rn: Reg, imm12: u16) {
+        assert!(imm12 < 4096, "immediate must be < 4096");
+        // 1_00_100010_0_imm12_Rn_Rd
+        let inst =
+            0x91000000 | ((imm12 as u32) << 10) | ((rn.index() as u32) << 5) | (rd.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// SUB Xd, Xn, Xm
+    pub fn sub_reg(&mut self, rd: Reg, rn: Reg, rm: Reg) {
+        // 1_10_01011_00_0_Rm_000000_Rn_Rd
+        let inst = 0xCB000000
+            | ((rm.index() as u32) << 16)
+            | ((rn.index() as u32) << 5)
+            | (rd.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// SUB Xd, Xn, #imm12
+    pub fn sub_imm(&mut self, rd: Reg, rn: Reg, imm12: u16) {
+        assert!(imm12 < 4096, "immediate must be < 4096");
+        // 1_10_100010_0_imm12_Rn_Rd
+        let inst =
+            0xD1000000 | ((imm12 as u32) << 10) | ((rn.index() as u32) << 5) | (rd.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// MUL Xd, Xn, Xm (alias for MADD Xd, Xn, Xm, XZR)
+    pub fn mul(&mut self, rd: Reg, rn: Reg, rm: Reg) {
+        // 1_00_11011_000_Rm_0_11111_Rn_Rd (MADD with Ra=XZR)
+        let inst = 0x9B007C00
+            | ((rm.index() as u32) << 16)
+            | ((rn.index() as u32) << 5)
+            | (rd.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// SDIV Xd, Xn, Xm
+    pub fn sdiv(&mut self, rd: Reg, rn: Reg, rm: Reg) {
+        // 1_00_11010110_Rm_00001_1_Rn_Rd
+        let inst = 0x9AC00C00
+            | ((rm.index() as u32) << 16)
+            | ((rn.index() as u32) << 5)
+            | (rd.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    // ── Logic instructions ───────────────────────────────────────────────
+
+    /// AND Xd, Xn, Xm
+    pub fn and_reg(&mut self, rd: Reg, rn: Reg, rm: Reg) {
+        // 1_00_01010_00_0_Rm_000000_Rn_Rd
+        let inst = 0x8A000000
+            | ((rm.index() as u32) << 16)
+            | ((rn.index() as u32) << 5)
+            | (rd.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// ORR Xd, Xn, Xm
+    pub fn orr_reg(&mut self, rd: Reg, rn: Reg, rm: Reg) {
+        // 1_01_01010_00_0_Rm_000000_Rn_Rd
+        let inst = 0xAA000000
+            | ((rm.index() as u32) << 16)
+            | ((rn.index() as u32) << 5)
+            | (rd.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// EOR Xd, Xn, Xm
+    pub fn eor_reg(&mut self, rd: Reg, rn: Reg, rm: Reg) {
+        // 1_10_01010_00_0_Rm_000000_Rn_Rd
+        let inst = 0xCA000000
+            | ((rm.index() as u32) << 16)
+            | ((rn.index() as u32) << 5)
+            | (rd.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// LSL Xd, Xn, Xm (alias for LSLV)
+    pub fn lsl_reg(&mut self, rd: Reg, rn: Reg, rm: Reg) {
+        // 1_00_11010110_Rm_00100_0_Rn_Rd
+        let inst = 0x9AC02000
+            | ((rm.index() as u32) << 16)
+            | ((rn.index() as u32) << 5)
+            | (rd.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// LSR Xd, Xn, Xm (alias for LSRV)
+    pub fn lsr_reg(&mut self, rd: Reg, rn: Reg, rm: Reg) {
+        // 1_00_11010110_Rm_00100_1_Rn_Rd
+        let inst = 0x9AC02400
+            | ((rm.index() as u32) << 16)
+            | ((rn.index() as u32) << 5)
+            | (rd.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// ASR Xd, Xn, Xm (alias for ASRV)
+    pub fn asr_reg(&mut self, rd: Reg, rn: Reg, rm: Reg) {
+        // 1_00_11010110_Rm_00101_0_Rn_Rd
+        let inst = 0x9AC02800
+            | ((rm.index() as u32) << 16)
+            | ((rn.index() as u32) << 5)
+            | (rd.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    // ── Memory instructions ──────────────────────────────────────────────
+
+    /// LDR Xd, [Xn, Xm] (register offset)
+    pub fn ldr_reg(&mut self, rt: Reg, rn: Reg, rm: Reg) {
+        // 11_111_0_00_01_1_Rm_011_0_10_Rn_Rt (LSL #0)
+        let inst = 0xF8606800
+            | ((rm.index() as u32) << 16)
+            | ((rn.index() as u32) << 5)
+            | (rt.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// LDR Xd, [Xn, #imm12] (unsigned offset, scaled by 8)
+    pub fn ldr_imm(&mut self, rt: Reg, rn: Reg, imm12: u16) {
+        assert!(imm12.is_multiple_of(8), "offset must be 8-byte aligned");
+        let scaled = imm12 / 8;
+        assert!(scaled < 4096, "scaled offset must be < 4096");
+        // 11_111_0_01_01_imm12_Rn_Rt
+        let inst =
+            0xF9400000 | ((scaled as u32) << 10) | ((rn.index() as u32) << 5) | (rt.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// LDR Xd, [Xn, #simm9]! (pre-index)
+    pub fn ldr_pre(&mut self, rt: Reg, rn: Reg, simm9: i16) {
+        assert!(
+            (-256..=255).contains(&simm9),
+            "pre-index offset must be -256..255"
+        );
+        let imm9 = (simm9 as u32) & 0x1FF;
+        // 11_111_0_00_01_0_imm9_11_Rn_Rt
+        let inst = 0xF8400C00 | (imm9 << 12) | ((rn.index() as u32) << 5) | (rt.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// LDR Xd, [Xn], #simm9 (post-index)
+    pub fn ldr_post(&mut self, rt: Reg, rn: Reg, simm9: i16) {
+        assert!(
+            (-256..=255).contains(&simm9),
+            "post-index offset must be -256..255"
+        );
+        let imm9 = (simm9 as u32) & 0x1FF;
+        // 11_111_0_00_01_0_imm9_01_Rn_Rt
+        let inst = 0xF8400400 | (imm9 << 12) | ((rn.index() as u32) << 5) | (rt.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// STR Xd, [Xn, Xm] (register offset)
+    pub fn str_reg(&mut self, rt: Reg, rn: Reg, rm: Reg) {
+        // 11_111_0_00_00_1_Rm_011_0_10_Rn_Rt (LSL #0)
+        let inst = 0xF8206800
+            | ((rm.index() as u32) << 16)
+            | ((rn.index() as u32) << 5)
+            | (rt.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// STR Xd, [Xn, #imm12] (unsigned offset, scaled by 8)
+    pub fn str_imm(&mut self, rt: Reg, rn: Reg, imm12: u16) {
+        assert!(imm12.is_multiple_of(8), "offset must be 8-byte aligned");
+        let scaled = imm12 / 8;
+        assert!(scaled < 4096, "scaled offset must be < 4096");
+        // 11_111_0_01_00_imm12_Rn_Rt
+        let inst =
+            0xF9000000 | ((scaled as u32) << 10) | ((rn.index() as u32) << 5) | (rt.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// STR Xd, [Xn, #simm9]! (pre-index)
+    pub fn str_pre(&mut self, rt: Reg, rn: Reg, simm9: i16) {
+        assert!(
+            (-256..=255).contains(&simm9),
+            "pre-index offset must be -256..255"
+        );
+        let imm9 = (simm9 as u32) & 0x1FF;
+        // 11_111_0_00_00_0_imm9_11_Rn_Rt
+        let inst = 0xF8000C00 | (imm9 << 12) | ((rn.index() as u32) << 5) | (rt.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// STR Xd, [Xn], #simm9 (post-index)
+    pub fn str_post(&mut self, rt: Reg, rn: Reg, simm9: i16) {
+        assert!(
+            (-256..=255).contains(&simm9),
+            "post-index offset must be -256..255"
+        );
+        let imm9 = (simm9 as u32) & 0x1FF;
+        // 11_111_0_00_00_0_imm9_01_Rn_Rt
+        let inst = 0xF8000400 | (imm9 << 12) | ((rn.index() as u32) << 5) | (rt.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// STP Xt1, Xt2, [Xn, #imm7]! (pre-index, store pair)
+    pub fn stp_pre(&mut self, rt1: Reg, rt2: Reg, rn: Reg, simm7: i16) {
+        assert!(simm7 % 8 == 0, "offset must be 8-byte aligned");
+        let scaled = simm7 / 8;
+        assert!(
+            (-64..=63).contains(&scaled),
+            "scaled offset must be -64..63"
+        );
+        let imm7 = (scaled as u32) & 0x7F;
+        // 10_101_0_011_imm7_Rt2_Rn_Rt1
+        let inst = 0xA9800000
+            | (imm7 << 15)
+            | ((rt2.index() as u32) << 10)
+            | ((rn.index() as u32) << 5)
+            | (rt1.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// LDP Xt1, Xt2, [Xn], #imm7 (post-index, load pair)
+    pub fn ldp_post(&mut self, rt1: Reg, rt2: Reg, rn: Reg, simm7: i16) {
+        assert!(simm7 % 8 == 0, "offset must be 8-byte aligned");
+        let scaled = simm7 / 8;
+        assert!(
+            (-64..=63).contains(&scaled),
+            "scaled offset must be -64..63"
+        );
+        let imm7 = (scaled as u32) & 0x7F;
+        // 10_101_0_001_1_imm7_Rt2_Rn_Rt1
+        let inst = 0xA8C00000
+            | (imm7 << 15)
+            | ((rt2.index() as u32) << 10)
+            | ((rn.index() as u32) << 5)
+            | (rt1.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    // ── Branch instructions ──────────────────────────────────────────────
+
+    /// B <label> (unconditional branch)
+    pub fn b(&mut self, label: Label) {
+        // 0_00101_imm26
+        self.emit_branch_to_label(label, FixupKind::Branch26, 0x14000000);
+    }
+
+    /// B <offset> (unconditional branch, immediate word offset)
+    pub fn b_offset(&mut self, word_offset: i32) {
+        let imm26 = (word_offset as u32) & 0x03FF_FFFF;
+        self.emit_u32(0x14000000 | imm26);
+    }
+
+    /// B.cond <label> (conditional branch)
+    pub fn b_cond(&mut self, cond: Cond, label: Label) {
+        // 0101010_0_imm19_0_cond
+        let base = 0x54000000 | (cond as u32);
+        self.emit_branch_to_label(label, FixupKind::Branch19, base);
+    }
+
+    /// BL <label> (branch with link — function call)
+    pub fn bl(&mut self, label: Label) {
+        // 1_00101_imm26
+        self.emit_branch_to_label(label, FixupKind::Branch26, 0x94000000);
+    }
+
+    /// BL <offset> (branch with link, immediate word offset)
+    pub fn bl_offset(&mut self, word_offset: i32) {
+        let imm26 = (word_offset as u32) & 0x03FF_FFFF;
+        self.emit_u32(0x94000000 | imm26);
+    }
+
+    /// BLR Xn (branch with link to register — indirect call)
+    pub fn blr(&mut self, rn: Reg) {
+        // 1101011_0_0_01_11111_0000_0_0_Rn_00000
+        self.emit_u32(0xD63F0000 | ((rn.index() as u32) << 5));
+    }
+
+    /// BR Xn (branch to register — indirect jump)
+    pub fn br(&mut self, rn: Reg) {
+        // 1101011_0_0_00_11111_0000_0_0_Rn_00000
+        self.emit_u32(0xD61F0000 | ((rn.index() as u32) << 5));
+    }
+
+    /// RET (return from subroutine, default LR=X30)
+    pub fn ret(&mut self) {
+        self.ret_reg(LR);
+    }
+
+    /// RET Xn (return from subroutine via specified register)
+    pub fn ret_reg(&mut self, rn: Reg) {
+        // 1101011_0_0_10_11111_0000_0_0_Rn_00000
+        self.emit_u32(0xD65F0000 | ((rn.index() as u32) << 5));
+    }
+
+    /// CBZ Xt, <label> (compare and branch if zero, 64-bit)
+    pub fn cbz(&mut self, rt: Reg, label: Label) {
+        // 1_011010_0_imm19_Rt
+        let base = 0xB4000000 | (rt.index() as u32);
+        self.emit_branch_to_label(label, FixupKind::Branch19, base);
+    }
+
+    /// CBNZ Xt, <label> (compare and branch if not zero, 64-bit)
+    pub fn cbnz(&mut self, rt: Reg, label: Label) {
+        // 1_011010_1_imm19_Rt
+        let base = 0xB5000000 | (rt.index() as u32);
+        self.emit_branch_to_label(label, FixupKind::Branch19, base);
+    }
+
+    // ── Comparison instructions ──────────────────────────────────────────
+
+    /// CMP Xn, Xm (alias for SUBS XZR, Xn, Xm)
+    pub fn cmp_reg(&mut self, rn: Reg, rm: Reg) {
+        // SUBS XZR, Xn, Xm
+        // 1_11_01011_00_0_Rm_000000_Rn_11111
+        let inst = 0xEB00001F | ((rm.index() as u32) << 16) | ((rn.index() as u32) << 5);
+        self.emit_u32(inst);
+    }
+
+    /// CMP Xn, #imm12 (alias for SUBS XZR, Xn, #imm12)
+    pub fn cmp_imm(&mut self, rn: Reg, imm12: u16) {
+        assert!(imm12 < 4096, "immediate must be < 4096");
+        // 1_11_100010_0_imm12_Rn_11111
+        let inst = 0xF100001F | ((imm12 as u32) << 10) | ((rn.index() as u32) << 5);
+        self.emit_u32(inst);
+    }
+
+    /// TST Xn, Xm (alias for ANDS XZR, Xn, Xm)
+    pub fn tst_reg(&mut self, rn: Reg, rm: Reg) {
+        // 1_11_01010_00_0_Rm_000000_Rn_11111
+        let inst = 0xEA00001F | ((rm.index() as u32) << 16) | ((rn.index() as u32) << 5);
+        self.emit_u32(inst);
+    }
+
+    // ── Move instructions ────────────────────────────────────────────────
+
+    /// MOV Xd, Xm (alias for ORR Xd, XZR, Xm)
+    pub fn mov_reg(&mut self, rd: Reg, rm: Reg) {
+        self.orr_reg(rd, ZR, rm);
+    }
+
+    /// MOVZ Xd, #imm16 (move wide with zero, at specified shift)
+    /// shift must be 0, 16, 32, or 48.
+    pub fn movz(&mut self, rd: Reg, imm16: u16, shift: u8) {
+        assert!(
+            shift == 0 || shift == 16 || shift == 32 || shift == 48,
+            "shift must be 0, 16, 32, or 48"
+        );
+        let hw = (shift / 16) as u32;
+        // 1_10_100101_hw_imm16_Rd
+        let inst = 0xD2800000 | (hw << 21) | ((imm16 as u32) << 5) | (rd.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// MOVK Xd, #imm16, LSL #shift (move wide with keep)
+    /// shift must be 0, 16, 32, or 48.
+    pub fn movk(&mut self, rd: Reg, imm16: u16, shift: u8) {
+        assert!(
+            shift == 0 || shift == 16 || shift == 32 || shift == 48,
+            "shift must be 0, 16, 32, or 48"
+        );
+        let hw = (shift / 16) as u32;
+        // 1_11_100101_hw_imm16_Rd
+        let inst = 0xF2800000 | (hw << 21) | ((imm16 as u32) << 5) | (rd.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// Load a full 64-bit immediate into a register using movz/movk sequence.
+    /// Uses the minimum number of instructions needed.
+    pub fn mov_imm64(&mut self, rd: Reg, value: u64) {
+        let hw0 = value as u16;
+        let hw1 = (value >> 16) as u16;
+        let hw2 = (value >> 32) as u16;
+        let hw3 = (value >> 48) as u16;
+
+        // Find the first non-zero halfword for movz, then movk the rest
+        let halfwords = [(hw0, 0u8), (hw1, 16), (hw2, 32), (hw3, 48)];
+        let non_zero: Vec<(u16, u8)> = halfwords
+            .iter()
+            .filter(|(hw, _)| *hw != 0)
+            .copied()
+            .collect();
+
+        if non_zero.is_empty() {
+            // Value is zero
+            self.movz(rd, 0, 0);
+            return;
+        }
+
+        let (first_hw, first_shift) = non_zero[0];
+        self.movz(rd, first_hw, first_shift);
+
+        for &(hw, shift) in &non_zero[1..] {
+            self.movk(rd, hw, shift);
+        }
+    }
+
+    // ── Floating-point instructions ──────────────────────────────────────
+
+    /// FMOV Dd, Dn (double-precision move)
+    pub fn fmov(&mut self, rd: FpReg, rn: FpReg) {
+        // 0_00_11110_01_1_000000_10000_Rn_Rd
+        let inst = 0x1E604000 | ((rn.index() as u32) << 5) | (rd.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// FMOV Dd, Xn (move general register to FP register, 64-bit)
+    pub fn fmov_from_gpr(&mut self, rd: FpReg, rn: Reg) {
+        // 1_00_11110_01_1_00_111_000000_Rn_Rd
+        let inst = 0x9E670000 | ((rn.index() as u32) << 5) | (rd.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// FMOV Xd, Dn (move FP register to general register, 64-bit)
+    pub fn fmov_to_gpr(&mut self, rd: Reg, rn: FpReg) {
+        // 1_00_11110_01_1_00_110_000000_Rn_Rd
+        let inst = 0x9E660000 | ((rn.index() as u32) << 5) | (rd.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// FADD Dd, Dn, Dm (double-precision add)
+    pub fn fadd(&mut self, rd: FpReg, rn: FpReg, rm: FpReg) {
+        // 0_00_11110_01_1_Rm_001_0_10_Rn_Rd
+        let inst = 0x1E602800
+            | ((rm.index() as u32) << 16)
+            | ((rn.index() as u32) << 5)
+            | (rd.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// FSUB Dd, Dn, Dm (double-precision subtract)
+    pub fn fsub(&mut self, rd: FpReg, rn: FpReg, rm: FpReg) {
+        // 0_00_11110_01_1_Rm_001_1_10_Rn_Rd
+        let inst = 0x1E603800
+            | ((rm.index() as u32) << 16)
+            | ((rn.index() as u32) << 5)
+            | (rd.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// FMUL Dd, Dn, Dm (double-precision multiply)
+    pub fn fmul(&mut self, rd: FpReg, rn: FpReg, rm: FpReg) {
+        // 0_00_11110_01_1_Rm_000_0_10_Rn_Rd
+        let inst = 0x1E600800
+            | ((rm.index() as u32) << 16)
+            | ((rn.index() as u32) << 5)
+            | (rd.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// FDIV Dd, Dn, Dm (double-precision divide)
+    pub fn fdiv(&mut self, rd: FpReg, rn: FpReg, rm: FpReg) {
+        // 0_00_11110_01_1_Rm_000_1_10_Rn_Rd
+        let inst = 0x1E601800
+            | ((rm.index() as u32) << 16)
+            | ((rn.index() as u32) << 5)
+            | (rd.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// FCMP Dn, Dm (double-precision compare, sets NZCV)
+    pub fn fcmp(&mut self, rn: FpReg, rm: FpReg) {
+        // 0_00_11110_01_1_Rm_00_1000_Rn_00_000
+        let inst = 0x1E602000 | ((rm.index() as u32) << 16) | ((rn.index() as u32) << 5);
+        self.emit_u32(inst);
+    }
+
+    /// SCVTF Dd, Xn (signed integer to double-precision float)
+    pub fn scvtf(&mut self, rd: FpReg, rn: Reg) {
+        // 1_00_11110_01_1_00_010_000000_Rn_Rd
+        let inst = 0x9E620000 | ((rn.index() as u32) << 5) | (rd.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// FCVTZS Xd, Dn (double-precision float to signed integer, round toward zero)
+    pub fn fcvtzs(&mut self, rd: Reg, rn: FpReg) {
+        // 1_00_11110_01_1_11_000_000000_Rn_Rd
+        let inst = 0x9E780000 | ((rn.index() as u32) << 5) | (rd.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    // ── FP memory instructions ───────────────────────────────────────────
+
+    /// LDR Dd, [Xn, #imm12] (load double from memory, unsigned offset scaled by 8)
+    pub fn fp_ldr_imm(&mut self, rt: FpReg, rn: Reg, imm12: u16) {
+        assert!(imm12.is_multiple_of(8), "offset must be 8-byte aligned");
+        let scaled = imm12 / 8;
+        assert!(scaled < 4096, "scaled offset must be < 4096");
+        // 11_111_1_01_01_imm12_Rn_Rt
+        let inst =
+            0xFD400000 | ((scaled as u32) << 10) | ((rn.index() as u32) << 5) | (rt.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    /// STR Dd, [Xn, #imm12] (store double to memory, unsigned offset scaled by 8)
+    pub fn fp_str_imm(&mut self, rt: FpReg, rn: Reg, imm12: u16) {
+        assert!(imm12.is_multiple_of(8), "offset must be 8-byte aligned");
+        let scaled = imm12 / 8;
+        assert!(scaled < 4096, "scaled offset must be < 4096");
+        // 11_111_1_01_00_imm12_Rn_Rt
+        let inst =
+            0xFD000000 | ((scaled as u32) << 10) | ((rn.index() as u32) << 5) | (rt.index() as u32);
+        self.emit_u32(inst);
+    }
+
+    // ── Entry/exit stubs ─────────────────────────────────────────────────
+
+    /// Emit a function prologue that saves callee-saved registers and sets up
+    /// the frame pointer. This is the entry stub for JIT-compiled functions.
+    ///
+    /// Saves: FP, LR, X19-X28 (12 registers = 96 bytes)
+    /// Frame layout after prologue:
+    /// ```text
+    ///   [SP+88] X28
+    ///   [SP+80] X27
+    ///   [SP+72] X26
+    ///   [SP+64] X25
+    ///   [SP+56] X24
+    ///   [SP+48] X23
+    ///   [SP+40] X22
+    ///   [SP+32] X21
+    ///   [SP+24] X20
+    ///   [SP+16] X19
+    ///   [SP+8]  LR
+    ///   [SP+0]  FP  <-- FP points here
+    /// ```
+    pub fn emit_prologue(&mut self) {
+        // Save FP and LR, pre-index SP by -96 (room for 12 registers)
+        self.stp_pre(FP, LR, SP, -96);
+        // Set up frame pointer
+        self.mov_reg(FP, SP);
+        // Save callee-saved registers
+        self.str_imm(X19, SP, 16);
+        self.str_imm(X20, SP, 24);
+        self.str_imm(X21, SP, 32);
+        self.str_imm(X22, SP, 40);
+        self.str_imm(X23, SP, 48);
+        self.str_imm(X24, SP, 56);
+        self.str_imm(X25, SP, 64);
+        self.str_imm(X26, SP, 72);
+        self.str_imm(X27, SP, 80);
+        self.str_imm(X28, SP, 88);
+    }
+
+    /// Emit a function epilogue that restores callee-saved registers and returns.
+    /// This is the exit stub for JIT-compiled functions.
+    pub fn emit_epilogue(&mut self) {
+        // Restore callee-saved registers
+        self.ldr_imm(X19, SP, 16);
+        self.ldr_imm(X20, SP, 24);
+        self.ldr_imm(X21, SP, 32);
+        self.ldr_imm(X22, SP, 40);
+        self.ldr_imm(X23, SP, 48);
+        self.ldr_imm(X24, SP, 56);
+        self.ldr_imm(X25, SP, 64);
+        self.ldr_imm(X26, SP, 72);
+        self.ldr_imm(X27, SP, 80);
+        self.ldr_imm(X28, SP, 88);
+        // Restore FP and LR, post-index SP by +96
+        self.ldp_post(FP, LR, SP, 96);
+        self.ret();
+    }
+
+    /// Emit a NOP (no-operation) instruction.
+    pub fn nop(&mut self) {
+        self.emit_u32(0xD503201F);
+    }
+
+    /// Emit a BRK #imm16 (breakpoint) instruction.
+    pub fn brk(&mut self, imm16: u16) {
+        // 1101_0100_001_imm16_000_00
+        self.emit_u32(0xD4200000 | ((imm16 as u32) << 5));
+    }
+}
+
+// ── Tests ────────────────────────────────────────────────────────────────────
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Helper: assemble one instruction and return the 32-bit encoding.
+    fn encode_one(f: impl FnOnce(&mut Assembler)) -> u32 {
+        let mut asm = Assembler::new();
+        f(&mut asm);
+        assert_eq!(asm.code().len(), 4, "expected exactly one instruction");
+        u32::from_le_bytes(asm.code().try_into().unwrap())
+    }
+
+    // ── Arithmetic ───────────────────────────────────────────────────────
+
+    #[test]
+    fn test_add_reg() {
+        // ADD X0, X1, X2 → 0x8B020020
+        let inst = encode_one(|a| a.add_reg(X0, X1, X2));
+        assert_eq!(inst, 0x8B020020);
+    }
+
+    #[test]
+    fn test_add_imm() {
+        // ADD X0, X1, #42 → 0x9100A820
+        let inst = encode_one(|a| a.add_imm(X0, X1, 42));
+        assert_eq!(inst, 0x9100A820);
+    }
+
+    #[test]
+    fn test_sub_reg() {
+        // SUB X3, X4, X5 → 0xCB050083
+        let inst = encode_one(|a| a.sub_reg(X3, X4, X5));
+        assert_eq!(inst, 0xCB050083);
+    }
+
+    #[test]
+    fn test_sub_imm() {
+        // SUB X0, X1, #10 → 0xD1002820
+        let inst = encode_one(|a| a.sub_imm(X0, X1, 10));
+        assert_eq!(inst, 0xD1002820);
+    }
+
+    #[test]
+    fn test_mul() {
+        // MUL X0, X1, X2 → MADD X0, X1, X2, XZR → 0x9B027C20
+        let inst = encode_one(|a| a.mul(X0, X1, X2));
+        assert_eq!(inst, 0x9B027C20);
+    }
+
+    #[test]
+    fn test_sdiv() {
+        // SDIV X0, X1, X2 → 0x9AC20C20
+        let inst = encode_one(|a| a.sdiv(X0, X1, X2));
+        assert_eq!(inst, 0x9AC20C20);
+    }
+
+    // ── Logic ────────────────────────────────────────────────────────────
+
+    #[test]
+    fn test_and_reg() {
+        // AND X0, X1, X2 → 0x8A020020
+        let inst = encode_one(|a| a.and_reg(X0, X1, X2));
+        assert_eq!(inst, 0x8A020020);
+    }
+
+    #[test]
+    fn test_orr_reg() {
+        // ORR X0, X1, X2 → 0xAA020020
+        let inst = encode_one(|a| a.orr_reg(X0, X1, X2));
+        assert_eq!(inst, 0xAA020020);
+    }
+
+    #[test]
+    fn test_eor_reg() {
+        // EOR X0, X1, X2 → 0xCA020020
+        let inst = encode_one(|a| a.eor_reg(X0, X1, X2));
+        assert_eq!(inst, 0xCA020020);
+    }
+
+    #[test]
+    fn test_lsl_reg() {
+        // LSL X0, X1, X2 → LSLV → 0x9AC22020
+        let inst = encode_one(|a| a.lsl_reg(X0, X1, X2));
+        assert_eq!(inst, 0x9AC22020);
+    }
+
+    #[test]
+    fn test_lsr_reg() {
+        // LSR X0, X1, X2 → LSRV → 0x9AC22420
+        let inst = encode_one(|a| a.lsr_reg(X0, X1, X2));
+        assert_eq!(inst, 0x9AC22420);
+    }
+
+    #[test]
+    fn test_asr_reg() {
+        // ASR X0, X1, X2 → ASRV → 0x9AC22820
+        let inst = encode_one(|a| a.asr_reg(X0, X1, X2));
+        assert_eq!(inst, 0x9AC22820);
+    }
+
+    // ── Memory ───────────────────────────────────────────────────────────
+
+    #[test]
+    fn test_ldr_reg() {
+        // LDR X0, [X1, X2] → 0xF8626820
+        let inst = encode_one(|a| a.ldr_reg(X0, X1, X2));
+        assert_eq!(inst, 0xF8626820);
+    }
+
+    #[test]
+    fn test_ldr_imm() {
+        // LDR X0, [X1, #16] → offset=16/8=2 → 0xF9400820
+        let inst = encode_one(|a| a.ldr_imm(X0, X1, 16));
+        assert_eq!(inst, 0xF9400820);
+    }
+
+    #[test]
+    fn test_str_imm() {
+        // STR X0, [X1, #8] → offset=8/8=1 → 0xF9000420
+        let inst = encode_one(|a| a.str_imm(X0, X1, 8));
+        assert_eq!(inst, 0xF9000420);
+    }
+
+    #[test]
+    fn test_ldr_pre() {
+        // LDR X0, [X1, #-16]! → simm9=-16 → 0xF85F0C20
+        let inst = encode_one(|a| a.ldr_pre(X0, X1, -16));
+        let imm9 = ((-16i16) as u32) & 0x1FF;
+        let expected = 0xF8400C00 | (imm9 << 12) | (1 << 5) | 0;
+        assert_eq!(inst, expected);
+    }
+
+    #[test]
+    fn test_str_post() {
+        // STR X0, [X1], #8 → simm9=8 → 0xF8000420 | (8<<12) | (1<<5) | 0
+        let inst = encode_one(|a| a.str_post(X0, X1, 8));
+        let expected = 0xF8000400 | (8 << 12) | (1 << 5) | 0;
+        assert_eq!(inst, expected);
+    }
+
+    #[test]
+    fn test_stp_pre() {
+        // STP FP, LR, [SP, #-96]! → scaled=-12 → imm7 bits
+        let inst = encode_one(|a| a.stp_pre(FP, LR, SP, -96));
+        let scaled = ((-12i16) as u32) & 0x7F;
+        let expected =
+            0xA9800000 | (scaled << 15) | ((LR.index() as u32) << 10) | ((31u32) << 5) | 29;
+        assert_eq!(inst, expected);
+    }
+
+    #[test]
+    fn test_ldp_post() {
+        // LDP FP, LR, [SP], #96 → scaled=12 → imm7 bits
+        let inst = encode_one(|a| a.ldp_post(FP, LR, SP, 96));
+        let expected = 0xA8C00000 | (12 << 15) | ((LR.index() as u32) << 10) | ((31u32) << 5) | 29;
+        assert_eq!(inst, expected);
+    }
+
+    // ── Branch ───────────────────────────────────────────────────────────
+
+    #[test]
+    fn test_ret() {
+        // RET → 0xD65F03C0
+        let inst = encode_one(|a| a.ret());
+        assert_eq!(inst, 0xD65F03C0);
+    }
+
+    #[test]
+    fn test_blr() {
+        // BLR X8 → 0xD63F0100
+        let inst = encode_one(|a| a.blr(X8));
+        assert_eq!(inst, 0xD63F0100);
+    }
+
+    #[test]
+    fn test_br() {
+        // BR X16 → 0xD61F0200
+        let inst = encode_one(|a| a.br(X16));
+        assert_eq!(inst, 0xD61F0200);
+    }
+
+    #[test]
+    fn test_b_offset() {
+        // B +4 words → 0x14000004
+        let inst = encode_one(|a| a.b_offset(4));
+        assert_eq!(inst, 0x14000004);
+    }
+
+    #[test]
+    fn test_bl_offset() {
+        // BL +1 word → 0x94000001
+        let inst = encode_one(|a| a.bl_offset(1));
+        assert_eq!(inst, 0x94000001);
+    }
+
+    // ── Comparison ───────────────────────────────────────────────────────
+
+    #[test]
+    fn test_cmp_reg() {
+        // CMP X0, X1 → SUBS XZR, X0, X1 → 0xEB01001F
+        let inst = encode_one(|a| a.cmp_reg(X0, X1));
+        assert_eq!(inst, 0xEB01001F);
+    }
+
+    #[test]
+    fn test_cmp_imm() {
+        // CMP X0, #5 → SUBS XZR, X0, #5 → 0xF100141F
+        let inst = encode_one(|a| a.cmp_imm(X0, 5));
+        assert_eq!(inst, 0xF100141F);
+    }
+
+    #[test]
+    fn test_tst_reg() {
+        // TST X0, X1 → ANDS XZR, X0, X1 → 0xEA01001F
+        let inst = encode_one(|a| a.tst_reg(X0, X1));
+        assert_eq!(inst, 0xEA01001F);
+    }
+
+    // ── Move ─────────────────────────────────────────────────────────────
+
+    #[test]
+    fn test_mov_reg() {
+        // MOV X0, X1 → ORR X0, XZR, X1 → 0xAA0103E0
+        let inst = encode_one(|a| a.mov_reg(X0, X1));
+        assert_eq!(inst, 0xAA0103E0);
+    }
+
+    #[test]
+    fn test_movz() {
+        // MOVZ X0, #42 → 0xD2800540
+        let inst = encode_one(|a| a.movz(X0, 42, 0));
+        assert_eq!(inst, 0xD2800540);
+    }
+
+    #[test]
+    fn test_movz_shifted() {
+        // MOVZ X0, #0xFFFF, LSL #16 → hw=1
+        let inst = encode_one(|a| a.movz(X0, 0xFFFF, 16));
+        let expected = 0xD2800000 | (1 << 21) | (0xFFFF << 5) | 0;
+        assert_eq!(inst, expected);
+    }
+
+    #[test]
+    fn test_movk() {
+        // MOVK X0, #0x1234, LSL #16 → hw=1
+        let inst = encode_one(|a| a.movk(X0, 0x1234, 16));
+        let expected = 0xF2800000 | (1 << 21) | (0x1234 << 5) | 0;
+        assert_eq!(inst, expected);
+    }
+
+    #[test]
+    fn test_mov_imm64_small() {
+        // Small value: just one MOVZ
+        let mut asm = Assembler::new();
+        asm.mov_imm64(X0, 42);
+        assert_eq!(asm.code().len(), 4); // Single MOVZ
+        let inst = u32::from_le_bytes(asm.code().try_into().unwrap());
+        assert_eq!(inst, 0xD2800540); // MOVZ X0, #42
+    }
+
+    #[test]
+    fn test_mov_imm64_large() {
+        // 0xDEAD_BEEF_CAFE_BABE needs all four halfwords
+        let mut asm = Assembler::new();
+        asm.mov_imm64(X0, 0xDEAD_BEEF_CAFE_BABE);
+        // 4 non-zero halfwords → 4 instructions (1 movz + 3 movk)
+        assert_eq!(asm.code().len(), 16);
+    }
+
+    #[test]
+    fn test_mov_imm64_zero() {
+        let mut asm = Assembler::new();
+        asm.mov_imm64(X0, 0);
+        assert_eq!(asm.code().len(), 4); // Single MOVZ X0, #0
+    }
+
+    // ── Floating-point ───────────────────────────────────────────────────
+
+    #[test]
+    fn test_fadd() {
+        // FADD D0, D1, D2 → 0x1E622820
+        let inst = encode_one(|a| a.fadd(D0, D1, D2));
+        assert_eq!(inst, 0x1E622820);
+    }
+
+    #[test]
+    fn test_fsub() {
+        // FSUB D0, D1, D2 → 0x1E623820
+        let inst = encode_one(|a| a.fsub(D0, D1, D2));
+        assert_eq!(inst, 0x1E623820);
+    }
+
+    #[test]
+    fn test_fmul() {
+        // FMUL D0, D1, D2 → 0x1E620820
+        let inst = encode_one(|a| a.fmul(D0, D1, D2));
+        assert_eq!(inst, 0x1E620820);
+    }
+
+    #[test]
+    fn test_fdiv() {
+        // FDIV D0, D1, D2 → 0x1E621820
+        let inst = encode_one(|a| a.fdiv(D0, D1, D2));
+        assert_eq!(inst, 0x1E621820);
+    }
+
+    #[test]
+    fn test_fcmp() {
+        // FCMP D0, D1 → 0x1E612000
+        let inst = encode_one(|a| a.fcmp(D0, D1));
+        assert_eq!(inst, 0x1E612000);
+    }
+
+    #[test]
+    fn test_scvtf() {
+        // SCVTF D0, X0 → 0x9E620000
+        let inst = encode_one(|a| a.scvtf(D0, X0));
+        assert_eq!(inst, 0x9E620000);
+    }
+
+    #[test]
+    fn test_fcvtzs() {
+        // FCVTZS X0, D0 → 0x9E780000
+        let inst = encode_one(|a| a.fcvtzs(X0, D0));
+        assert_eq!(inst, 0x9E780000);
+    }
+
+    #[test]
+    fn test_fmov() {
+        // FMOV D0, D1 → 0x1E604020
+        let inst = encode_one(|a| a.fmov(D0, D1));
+        assert_eq!(inst, 0x1E604020);
+    }
+
+    #[test]
+    fn test_fmov_from_gpr() {
+        // FMOV D0, X0 → 0x9E670000
+        let inst = encode_one(|a| a.fmov_from_gpr(D0, X0));
+        assert_eq!(inst, 0x9E670000);
+    }
+
+    #[test]
+    fn test_fmov_to_gpr() {
+        // FMOV X0, D0 → 0x9E660000
+        let inst = encode_one(|a| a.fmov_to_gpr(X0, D0));
+        assert_eq!(inst, 0x9E660000);
+    }
+
+    // ── Labels and branches ──────────────────────────────────────────────
+
+    #[test]
+    fn test_backward_branch() {
+        let mut asm = Assembler::new();
+        let top = asm.new_label();
+        asm.bind_label(top); // offset 0
+        asm.nop(); // offset 0, 4 bytes
+        asm.b(top); // offset 4, branch back to 0 → offset = -1 word
+        let code = asm.finalize_to_vec();
+        let branch_inst = u32::from_le_bytes(code[4..8].try_into().unwrap());
+        // B -1 → imm26 = 0x03FFFFFF (2's complement of -1 masked to 26 bits)
+        assert_eq!(branch_inst, 0x14000000 | (0x03FFFFFFu32));
+    }
+
+    #[test]
+    fn test_forward_branch() {
+        let mut asm = Assembler::new();
+        let skip = asm.new_label();
+        asm.b(skip); // offset 0, forward ref
+        asm.nop(); // offset 4
+        asm.bind_label(skip); // offset 8 → branch offset = +2 words
+        let code = asm.finalize_to_vec();
+        let branch_inst = u32::from_le_bytes(code[0..4].try_into().unwrap());
+        assert_eq!(branch_inst, 0x14000002); // B +2
+    }
+
+    #[test]
+    fn test_conditional_branch() {
+        let mut asm = Assembler::new();
+        let target = asm.new_label();
+        asm.cmp_imm(X0, 0); // offset 0
+        asm.b_cond(Cond::EQ, target); // offset 4, forward ref
+        asm.nop(); // offset 8
+        asm.bind_label(target); // offset 12 → branch offset = +2 words
+        let code = asm.finalize_to_vec();
+        let branch_inst = u32::from_le_bytes(code[4..8].try_into().unwrap());
+        // B.EQ +2 → 0x54000040 (imm19=2, cond=0)
+        assert_eq!(branch_inst, 0x54000040);
+    }
+
+    #[test]
+    fn test_cbz() {
+        let mut asm = Assembler::new();
+        let target = asm.new_label();
+        asm.cbz(X0, target); // offset 0, forward ref
+        asm.nop(); // offset 4
+        asm.bind_label(target); // offset 8 → branch offset = +2 words
+        let code = asm.finalize_to_vec();
+        let inst = u32::from_le_bytes(code[0..4].try_into().unwrap());
+        // CBZ X0, +2 → imm19=2 → 0xB4000040
+        assert_eq!(inst, 0xB4000040);
+    }
+
+    #[test]
+    fn test_cbnz() {
+        let mut asm = Assembler::new();
+        let target = asm.new_label();
+        asm.cbnz(X1, target); // offset 0
+        asm.nop(); // offset 4
+        asm.nop(); // offset 8
+        asm.bind_label(target); // offset 12 → +3 words
+        let code = asm.finalize_to_vec();
+        let inst = u32::from_le_bytes(code[0..4].try_into().unwrap());
+        // CBNZ X1, +3 → imm19=3 → 0xB5000061
+        assert_eq!(inst, 0xB5000061);
+    }
+
+    // ── Misc ─────────────────────────────────────────────────────────────
+
+    #[test]
+    fn test_nop() {
+        let inst = encode_one(|a| a.nop());
+        assert_eq!(inst, 0xD503201F);
+    }
+
+    #[test]
+    fn test_brk() {
+        // BRK #0 → 0xD4200000
+        let inst = encode_one(|a| a.brk(0));
+        assert_eq!(inst, 0xD4200000);
+        // BRK #1 → 0xD4200020
+        let inst = encode_one(|a| a.brk(1));
+        assert_eq!(inst, 0xD4200020);
+    }
+
+    // ── Prologue/epilogue ────────────────────────────────────────────────
+
+    #[test]
+    fn test_prologue_epilogue_size() {
+        let mut asm = Assembler::new();
+        asm.emit_prologue();
+        let prologue_size = asm.offset();
+        asm.emit_epilogue();
+        let total_size = asm.offset();
+
+        // Prologue: STP + MOV + 10 STR = 12 instructions = 48 bytes
+        assert_eq!(prologue_size, 48);
+        // Epilogue: 10 LDR + LDP + RET = 12 instructions = 48 bytes
+        assert_eq!(total_size - prologue_size, 48);
+    }
+
+    // ── Execution tests (run actual JIT code) ────────────────────────────
+
+    #[test]
+    fn test_execute_add() {
+        let mut asm = Assembler::new();
+        asm.emit_prologue();
+        // x0 already has first arg, add 5
+        asm.add_imm(X0, X0, 5);
+        asm.emit_epilogue();
+
+        let mut buf = JitBuffer::new().expect("buffer");
+        let ptr = asm.finalize(&mut buf).expect("finalize");
+        let result = unsafe { ptr.call_u64_to_u64(10) };
+        assert_eq!(result, 15);
+    }
+
+    #[test]
+    fn test_execute_multiply() {
+        let mut asm = Assembler::new();
+        asm.emit_prologue();
+        // return x0 * x1
+        asm.mul(X0, X0, X1);
+        asm.emit_epilogue();
+
+        let mut buf = JitBuffer::new().expect("buffer");
+        let ptr = asm.finalize(&mut buf).expect("finalize");
+        let result = unsafe { ptr.call_u64x2_to_u64(7, 6) };
+        assert_eq!(result, 42);
+    }
+
+    #[test]
+    fn test_execute_branch_loop() {
+        // Compute sum 1..=10 using a loop
+        let mut asm = Assembler::new();
+        asm.emit_prologue();
+
+        // x19 = counter (1..=10), x20 = accumulator
+        asm.movz(X19, 1, 0); // counter = 1
+        asm.movz(X20, 0, 0); // sum = 0
+        asm.movz(X21, 10, 0); // limit = 10
+
+        let loop_top = asm.new_label();
+        let loop_end = asm.new_label();
+
+        asm.bind_label(loop_top);
+        asm.cmp_reg(X19, X21);
+        asm.b_cond(Cond::GT, loop_end); // if counter > 10, exit
+
+        asm.add_reg(X20, X20, X19); // sum += counter
+        asm.add_imm(X19, X19, 1); // counter++
+        asm.b(loop_top);
+
+        asm.bind_label(loop_end);
+        asm.mov_reg(X0, X20); // return sum
+
+        asm.emit_epilogue();
+
+        let mut buf = JitBuffer::new().expect("buffer");
+        let ptr = asm.finalize(&mut buf).expect("finalize");
+        let result = unsafe { ptr.call_void_to_u64() };
+        assert_eq!(result, 55); // 1+2+...+10 = 55
+    }
+
+    #[test]
+    fn test_execute_conditional() {
+        // if (x0 == 0) return 100 else return 200
+        let mut asm = Assembler::new();
+        asm.emit_prologue();
+
+        let is_zero = asm.new_label();
+        let done = asm.new_label();
+
+        asm.cbz(X0, is_zero);
+        asm.movz(X0, 200, 0);
+        asm.b(done);
+        asm.bind_label(is_zero);
+        asm.movz(X0, 100, 0);
+        asm.bind_label(done);
+
+        asm.emit_epilogue();
+
+        let mut buf = JitBuffer::new().expect("buffer");
+        let ptr = asm.finalize(&mut buf).expect("finalize");
+        assert_eq!(unsafe { ptr.call_u64_to_u64(0) }, 100);
+        assert_eq!(unsafe { ptr.call_u64_to_u64(1) }, 200);
+        assert_eq!(unsafe { ptr.call_u64_to_u64(42) }, 200);
+    }
+
+    #[test]
+    fn test_execute_memory_ops() {
+        // Store a value to stack, load it back
+        let mut asm = Assembler::new();
+        asm.emit_prologue();
+
+        // Allocate 16 bytes on stack
+        asm.sub_imm(SP, SP, 16);
+        // Store x0 at [SP]
+        asm.str_imm(X0, SP, 0);
+        // Load it back into x1
+        asm.ldr_imm(X1, SP, 0);
+        // Add 1 to prove we loaded the right value
+        asm.add_imm(X0, X1, 1);
+        // Deallocate
+        asm.add_imm(SP, SP, 16);
+
+        asm.emit_epilogue();
+
+        let mut buf = JitBuffer::new().expect("buffer");
+        let ptr = asm.finalize(&mut buf).expect("finalize");
+        let result = unsafe { ptr.call_u64_to_u64(99) };
+        assert_eq!(result, 100); // 99 + 1
+    }
+
+    #[test]
+    fn test_execute_mov_imm64() {
+        let mut asm = Assembler::new();
+        asm.emit_prologue();
+        asm.mov_imm64(X0, 0x0000_DEAD_0000_BEEF);
+        asm.emit_epilogue();
+
+        let mut buf = JitBuffer::new().expect("buffer");
+        let ptr = asm.finalize(&mut buf).expect("finalize");
+        let result = unsafe { ptr.call_void_to_u64() };
+        assert_eq!(result, 0x0000_DEAD_0000_BEEF);
+    }
+
+    #[test]
+    fn test_execute_fp_arithmetic() {
+        // Return 3.0 + 4.0 as u64 bits
+        let mut asm = Assembler::new();
+        asm.emit_prologue();
+
+        // Load 3.0 into D0: move bits via GPR
+        asm.mov_imm64(X0, 3.0f64.to_bits());
+        asm.fmov_from_gpr(D0, X0);
+
+        // Load 4.0 into D1
+        asm.mov_imm64(X0, 4.0f64.to_bits());
+        asm.fmov_from_gpr(D1, X0);
+
+        // D0 = D0 + D1 (3.0 + 4.0 = 7.0)
+        asm.fadd(D0, D0, D1);
+
+        // Move result back to X0 as raw bits
+        asm.fmov_to_gpr(X0, D0);
+
+        asm.emit_epilogue();
+
+        let mut buf = JitBuffer::new().expect("buffer");
+        let ptr = asm.finalize(&mut buf).expect("finalize");
+        let result = unsafe { ptr.call_void_to_u64() };
+        let value = f64::from_bits(result);
+        assert_eq!(value, 7.0);
+    }
+
+    #[test]
+    fn test_execute_int_to_float_roundtrip() {
+        // Convert 42 (int) to float, then back to int
+        let mut asm = Assembler::new();
+        asm.emit_prologue();
+
+        asm.movz(X0, 42, 0);
+        asm.scvtf(D0, X0); // D0 = 42.0
+        asm.fcvtzs(X0, D0); // X0 = 42
+
+        asm.emit_epilogue();
+
+        let mut buf = JitBuffer::new().expect("buffer");
+        let ptr = asm.finalize(&mut buf).expect("finalize");
+        let result = unsafe { ptr.call_void_to_u64() };
+        assert_eq!(result, 42);
+    }
+}
diff --git a/crates/js/src/jit/buffer.rs b/crates/js/src/jit/buffer.rs
new file mode 100644
index 0000000..debc6f4
--- /dev/null
+++ b/crates/js/src/jit/buffer.rs
@@ -0,0 +1,218 @@
+//! JIT code buffer: manages executable memory pages and compiled code regions.
+
+use super::memory::{ExecutableMemory, MemoryError};
+
+/// Default code page size: 64 KiB.
+const DEFAULT_PAGE_SIZE: usize = 64 * 1024;
+
+/// A compiled code entry point that can be called.
+///
+/// Wraps a function pointer into JIT-compiled code. The caller is responsible
+/// for ensuring the underlying memory remains valid (not freed) while the
+/// CodePtr is in use.
+#[derive(Clone, Copy)]
+pub struct CodePtr {
+    ptr: *const u8,
+}
+
+impl CodePtr {
+    /// Create a new CodePtr from a raw pointer to executable code.
+    ///
+    /// # Safety
+    /// The pointer must point to valid AArch64 machine code in executable memory.
+    pub unsafe fn new(ptr: *const u8) -> Self {
+        CodePtr { ptr }
+    }
+
+    /// Get the raw function pointer.
+    pub fn as_ptr(&self) -> *const u8 {
+        self.ptr
+    }
+
+    /// Call this code as a function that takes no arguments and returns a u64.
+    ///
+    /// # Safety
+    /// The code must be valid AArch64 machine code that follows the calling
+    /// convention for `extern "C" fn() -> u64`.
+    pub unsafe fn call_void_to_u64(&self) -> u64 {
+        let func: extern "C" fn() -> u64 = std::mem::transmute(self.ptr);
+        func()
+    }
+
+    /// Call this code as a function that takes one u64 argument and returns u64.
+    ///
+    /// # Safety
+    /// The code must be valid AArch64 machine code that follows the calling
+    /// convention for `extern "C" fn(u64) -> u64`.
+    pub unsafe fn call_u64_to_u64(&self, arg: u64) -> u64 {
+        let func: extern "C" fn(u64) -> u64 = std::mem::transmute(self.ptr);
+        func(arg)
+    }
+
+    /// Call this code as a function that takes two u64 arguments and returns u64.
+    ///
+    /// # Safety
+    /// The code must be valid AArch64 machine code that follows the calling
+    /// convention for `extern "C" fn(u64, u64) -> u64`.
+    pub unsafe fn call_u64x2_to_u64(&self, arg0: u64, arg1: u64) -> u64 {
+        let func: extern "C" fn(u64, u64) -> u64 = std::mem::transmute(self.ptr);
+        func(arg0, arg1)
+    }
+}
+
+// SAFETY: CodePtr is a plain function pointer — safe to send across threads.
+unsafe impl Send for CodePtr {}
+unsafe impl Sync for CodePtr {}
+
+/// Manages allocated code pages and tracks used/free space.
+///
+/// Each page is an independently allocated region of executable memory.
+/// Code is appended linearly within a page. When a page is full, a new
+/// page is allocated.
+pub struct JitBuffer {
+    /// All allocated code pages.
+    pages: Vec<ExecutableMemory>,
+    /// Byte offset of the next free byte in the current (last) page.
+    offset: usize,
+    /// Size of each page allocation.
+    page_size: usize,
+}
+
+impl JitBuffer {
+    /// Create a new JitBuffer with the default page size (64 KiB).
+    pub fn new() -> Result<Self, MemoryError> {
+        Self::with_page_size(DEFAULT_PAGE_SIZE)
+    }
+
+    /// Create a new JitBuffer with a custom page size.
+    pub fn with_page_size(page_size: usize) -> Result<Self, MemoryError> {
+        let page = ExecutableMemory::allocate(page_size)?;
+        Ok(JitBuffer {
+            pages: vec![page],
+            offset: 0,
+            page_size,
+        })
+    }
+
+    /// Write compiled code into the buffer and return a CodePtr to it.
+    ///
+    /// The code is written in writable mode, then the page is made executable.
+    /// If the current page doesn't have enough space, a new page is allocated.
+    pub fn emit_code(&mut self, code: &[u8]) -> Result<CodePtr, MemoryError> {
+        // Need a new page?
+        if self.offset + code.len() > self.current_page().size() {
+            self.allocate_new_page()?;
+        }
+
+        let page = self.pages.last_mut().unwrap();
+        page.make_writable();
+        let code_offset = self.offset;
+        page.write_at(code_offset, code)?;
+        self.offset += code.len();
+        page.make_executable();
+
+        unsafe { Ok(CodePtr::new(page.as_ptr().add(code_offset))) }
+    }
+
+    /// Total bytes of code emitted across all pages.
+    pub fn total_code_size(&self) -> usize {
+        if self.pages.is_empty() {
+            return 0;
+        }
+        (self.pages.len() - 1) * self.page_size + self.offset
+    }
+
+    /// Available bytes in the current page.
+    pub fn available(&self) -> usize {
+        self.current_page().size() - self.offset
+    }
+
+    /// Number of allocated pages.
+    pub fn page_count(&self) -> usize {
+        self.pages.len()
+    }
+
+    fn current_page(&self) -> &ExecutableMemory {
+        self.pages.last().unwrap()
+    }
+
+    fn allocate_new_page(&mut self) -> Result<(), MemoryError> {
+        let page = ExecutableMemory::allocate(self.page_size)?;
+        self.pages.push(page);
+        self.offset = 0;
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn emit_and_call() {
+        let mut buf = JitBuffer::new().expect("buffer creation failed");
+        // movz x0, #7; ret
+        let code: [u8; 8] = [
+            0xE0, 0x00, 0x80, 0xD2, // movz x0, #7
+            0xC0, 0x03, 0x5F, 0xD6, // ret
+        ];
+        let ptr = buf.emit_code(&code).expect("emit failed");
+        let result = unsafe { ptr.call_void_to_u64() };
+        assert_eq!(result, 7);
+    }
+
+    #[test]
+    fn multiple_functions() {
+        let mut buf = JitBuffer::new().expect("buffer creation failed");
+
+        // Function 1: return 10
+        let code1: [u8; 8] = [
+            0x40, 0x01, 0x80, 0xD2, // movz x0, #10
+            0xC0, 0x03, 0x5F, 0xD6, // ret
+        ];
+        let ptr1 = buf.emit_code(&code1).expect("emit1 failed");
+
+        // Function 2: return 20
+        let code2: [u8; 8] = [
+            0x80, 0x02, 0x80, 0xD2, // movz x0, #20
+            0xC0, 0x03, 0x5F, 0xD6, // ret
+        ];
+        let ptr2 = buf.emit_code(&code2).expect("emit2 failed");
+
+        assert_eq!(unsafe { ptr1.call_void_to_u64() }, 10);
+        assert_eq!(unsafe { ptr2.call_void_to_u64() }, 20);
+        assert_eq!(buf.total_code_size(), 16);
+    }
+
+    #[test]
+    fn page_overflow_allocates_new_page() {
+        // Use a tiny page size to force overflow
+        let mut buf = JitBuffer::with_page_size(4096).expect("buffer creation failed");
+        assert_eq!(buf.page_count(), 1);
+
+        // Fill the page with ret instructions
+        let ret_inst = [0xC0u8, 0x03, 0x5F, 0xD6]; // ret
+        let count = 4096 / 4;
+        for _ in 0..count {
+            buf.emit_code(&ret_inst).expect("emit failed");
+        }
+        assert_eq!(buf.page_count(), 1);
+
+        // One more should trigger a new page
+        buf.emit_code(&ret_inst).expect("emit failed");
+        assert_eq!(buf.page_count(), 2);
+    }
+
+    #[test]
+    fn code_ptr_with_argument() {
+        let mut buf = JitBuffer::new().expect("buffer creation failed");
+        // add x0, x0, #5; ret  (return arg + 5)
+        let code: [u8; 8] = [
+            0x00, 0x14, 0x00, 0x91, // add x0, x0, #5
+            0xC0, 0x03, 0x5F, 0xD6, // ret
+        ];
+        let ptr = buf.emit_code(&code).expect("emit failed");
+        let result = unsafe { ptr.call_u64_to_u64(10) };
+        assert_eq!(result, 15);
+    }
+}
diff --git a/crates/js/src/jit/memory.rs b/crates/js/src/jit/memory.rs
new file mode 100644
index 0000000..3cd9154
--- /dev/null
+++ b/crates/js/src/jit/memory.rs
@@ -0,0 +1,220 @@
+//! Executable memory allocation using mmap/mprotect with W^X policy.
+//!
+//! Memory is allocated with write permissions for code emission, then flipped
+//! to read+execute before the code is called. This follows the Write XOR
+//! Execute (W^X) security policy.
+
+use std::ptr;
+
+// macOS mmap/mprotect constants and FFI
+mod ffi {
+    pub const PROT_READ: i32 = 0x01;
+    pub const PROT_WRITE: i32 = 0x02;
+    pub const PROT_EXEC: i32 = 0x04;
+
+    pub const MAP_PRIVATE: i32 = 0x0002;
+    pub const MAP_ANONYMOUS: i32 = 0x1000;
+    pub const MAP_JIT: i32 = 0x0800;
+
+    pub const MAP_FAILED: *mut u8 = !0usize as *mut u8;
+
+    extern "C" {
+        pub fn mmap(
+            addr: *mut u8,
+            len: usize,
+            prot: i32,
+            flags: i32,
+            fd: i32,
+            offset: i64,
+        ) -> *mut u8;
+        pub fn munmap(addr: *mut u8, len: usize) -> i32;
+
+        // macOS specific: required for MAP_JIT pages on Apple Silicon
+        pub fn pthread_jit_write_protect_np(enabled: i32);
+    }
+}
+
+/// A region of memory that can be made executable.
+///
+/// Manages the lifecycle of mmap'd pages and provides W^X transitions.
+pub struct ExecutableMemory {
+    ptr: *mut u8,
+    size: usize,
+}
+
+impl ExecutableMemory {
+    /// Allocate `size` bytes of memory (rounded up to page size).
+    /// The memory starts with read+write permissions for code emission.
+    pub fn allocate(size: usize) -> Result<Self, MemoryError> {
+        let page_size = 4096usize; // AArch64 page size
+        let size = (size + page_size - 1) & !(page_size - 1);
+
+        // On Apple Silicon with MAP_JIT, we allocate with RWX and use
+        // pthread_jit_write_protect_np to toggle between W and X.
+        let prot = ffi::PROT_READ | ffi::PROT_WRITE | ffi::PROT_EXEC;
+        let flags = ffi::MAP_PRIVATE | ffi::MAP_ANONYMOUS | ffi::MAP_JIT;
+
+        let ptr = unsafe { ffi::mmap(ptr::null_mut(), size, prot, flags, -1, 0) };
+
+        if ptr == ffi::MAP_FAILED {
+            return Err(MemoryError::AllocationFailed);
+        }
+
+        // Start in writable mode
+        unsafe {
+            ffi::pthread_jit_write_protect_np(0);
+        }
+
+        Ok(ExecutableMemory { ptr, size })
+    }
+
+    /// Get a mutable pointer to the memory for writing code.
+    /// Must be in writable mode (call `make_writable` first if needed).
+    pub fn as_mut_ptr(&mut self) -> *mut u8 {
+        self.ptr
+    }
+
+    /// Get an immutable pointer to the memory.
+    pub fn as_ptr(&self) -> *const u8 {
+        self.ptr
+    }
+
+    /// Total allocated size in bytes.
+    pub fn size(&self) -> usize {
+        self.size
+    }
+
+    /// Switch to writable mode (disable execute permission on this thread).
+    /// On Apple Silicon, this uses pthread_jit_write_protect_np.
+    pub fn make_writable(&self) {
+        unsafe {
+            ffi::pthread_jit_write_protect_np(0);
+        }
+    }
+
+    /// Switch to executable mode (disable write permission on this thread).
+    /// Must be called before executing any code written to this memory.
+    pub fn make_executable(&self) {
+        unsafe {
+            ffi::pthread_jit_write_protect_np(1);
+            // Instruction cache flush — required on AArch64 after writing code
+            self.flush_icache();
+        }
+    }
+
+    /// Flush the instruction cache for the entire allocated region.
+    /// Required on AArch64 because instruction and data caches are not coherent.
+    unsafe fn flush_icache(&self) {
+        // Use the system call that works on macOS/ARM64
+        extern "C" {
+            fn sys_icache_invalidate(start: *const u8, size: usize);
+        }
+        sys_icache_invalidate(self.ptr, self.size);
+    }
+
+    /// Write bytes to the memory at the given offset.
+    /// Returns error if the write would exceed the allocated size.
+    pub fn write_at(&mut self, offset: usize, data: &[u8]) -> Result<(), MemoryError> {
+        if offset + data.len() > self.size {
+            return Err(MemoryError::OutOfBounds);
+        }
+        unsafe {
+            ptr::copy_nonoverlapping(data.as_ptr(), self.ptr.add(offset), data.len());
+        }
+        Ok(())
+    }
+}
+
+impl Drop for ExecutableMemory {
+    fn drop(&mut self) {
+        unsafe {
+            ffi::munmap(self.ptr, self.size);
+        }
+    }
+}
+
+// SAFETY: The memory region is owned and only accessed through &mut self for writes.
+// The raw pointer is not shared — only one ExecutableMemory instance owns each region.
+unsafe impl Send for ExecutableMemory {}
+
+/// Errors from executable memory operations.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum MemoryError {
+    /// mmap failed to allocate memory
+    AllocationFailed,
+    /// Write would exceed allocated memory bounds
+    OutOfBounds,
+}
+
+impl std::fmt::Display for MemoryError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            MemoryError::AllocationFailed => write!(f, "failed to allocate executable memory"),
+            MemoryError::OutOfBounds => write!(f, "write exceeds allocated memory bounds"),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn allocate_and_write() {
+        let mut mem = ExecutableMemory::allocate(4096).expect("allocation failed");
+        assert!(mem.size() >= 4096);
+        // Write a ret instruction (0xD65F03C0)
+        mem.write_at(0, &[0xC0, 0x03, 0x5F, 0xD6])
+            .expect("write failed");
+    }
+
+    #[test]
+    fn write_out_of_bounds() {
+        let mut mem = ExecutableMemory::allocate(4096).expect("allocation failed");
+        let result = mem.write_at(4095, &[0x00, 0x00]);
+        assert_eq!(result, Err(MemoryError::OutOfBounds));
+    }
+
+    #[test]
+    fn execute_ret_stub() {
+        let mut mem = ExecutableMemory::allocate(4096).expect("allocation failed");
+        // AArch64: mov x0, #42; ret
+        // movz x0, #42 = 0xD2800540
+        // ret          = 0xD65F03C0
+        let code: [u8; 8] = [
+            0x40, 0x05, 0x80, 0xD2, // movz x0, #42
+            0xC0, 0x03, 0x5F, 0xD6, // ret
+        ];
+        mem.write_at(0, &code).expect("write failed");
+        mem.make_executable();
+
+        let func: extern "C" fn() -> u64 = unsafe { std::mem::transmute(mem.as_ptr()) };
+        let result = func();
+        assert_eq!(result, 42);
+    }
+
+    #[test]
+    fn wxe_transitions() {
+        let mut mem = ExecutableMemory::allocate(4096).expect("allocation failed");
+        // Write code
+        let code: [u8; 8] = [
+            0x00, 0x01, 0x80, 0xD2, // movz x0, #8
+            0xC0, 0x03, 0x5F, 0xD6, // ret
+        ];
+        mem.write_at(0, &code).expect("write failed");
+        mem.make_executable();
+
+        let func: extern "C" fn() -> u64 = unsafe { std::mem::transmute(mem.as_ptr()) };
+        assert_eq!(func(), 8);
+
+        // Transition back to writable, patch code
+        mem.make_writable();
+        // movz x0, #99 = 0xD2800C60
+        mem.write_at(0, &[0x60, 0x0C, 0x80, 0xD2])
+            .expect("write failed");
+        mem.make_executable();
+
+        let func2: extern "C" fn() -> u64 = unsafe { std::mem::transmute(mem.as_ptr()) };
+        assert_eq!(func2(), 99);
+    }
+}
diff --git a/crates/js/src/jit/mod.rs b/crates/js/src/jit/mod.rs
new file mode 100644
index 0000000..15512c2
--- /dev/null
+++ b/crates/js/src/jit/mod.rs
@@ -0,0 +1,14 @@
+//! JIT compiler infrastructure for AArch64.
+//!
+//! This module provides the low-level building blocks for JIT compilation:
+//! - Executable memory allocation with W^X protection
+//! - AArch64 machine code assembler
+//! - Entry/exit stubs for VM ↔ JIT transitions
+
+pub mod assembler;
+pub mod buffer;
+pub mod memory;
+
+pub use assembler::Assembler;
+pub use buffer::{CodePtr, JitBuffer};
+pub use memory::ExecutableMemory;
diff --git a/crates/js/src/lib.rs b/crates/js/src/lib.rs
index 1528da7..ecea4c5 100644
--- a/crates/js/src/lib.rs
+++ b/crates/js/src/lib.rs
@@ -9,6 +9,7 @@ pub mod fetch;
 pub mod gc;
 pub mod iframe_bridge;
 pub mod indexeddb;
+pub mod jit;
 pub mod lexer;
 pub mod parser;
 pub mod regex;