From 2103709fe816af33285a969698df2068459a250a Mon Sep 17 00:00:00 2001
From: Evan <evan@boon.org>
Date: Sun, 16 Aug 2026 15:35:41 -0700
Subject: [PATCH 1/7] docs: remove the macro system from the language, add
 assert, and, or

The v0 language drops defmacro, qq, and unquote, and gains assert,
and, and or as fixed compiler forms beside if and list, with the
semantics Chialisp's utility_macros.clib macros give the same
spellings: assert nests lazy ifs over a raise, and yields 1 or nil
short-circuiting at the first falsy operand, or yields 1 at the
first truthy operand. docs/lang/macros.md is deleted and the
deviations section now records the removal and its rationale.

Decision by Evan, 2026-08-16, reversing unit 6 (PR 52) on
production evidence: across Chia's canonical deployed puzzle corpus
(91 puzzles), the corpora vendored in references/, and the
chia-gaming state-channel codebase, no production puzzle defines a
novel macro, and the only macros in production use are
short-circuit assert (17 of 91 canonical puzzles), and, and or
(about 5 files). chia-gaming's production referee uses built-in
destructuring where a macro-based alternative beside it sits
unbuilt. The fixed forms cover the complete observed vocabulary
while removing the expansion machinery's audit surface.

The reserved-word set change is a deliberate source and symbol-file
compatibility break in both directions: assert, and, and or become
reserved, defmacro, qq, and unquote become ordinary names.
---
 docs/README.md        |   3 -
 docs/glossary.md      |   2 +-
 docs/lang/language.md |  99 ++++++++++++--------
 docs/lang/macros.md   | 211 ------------------------------------------
 docs/lang/repl.md     |  27 ++----
 5 files changed, 68 insertions(+), 274 deletions(-)
 delete mode 100644 docs/lang/macros.md

diff --git a/docs/README.md b/docs/README.md
index a743ffe..c0e9613 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -25,9 +25,6 @@
 - [lang/language.md](lang/language.md): the v0 authoring language,
   the program form, its declarations and special forms, the
   compiled environment shape, and the symbol table format.
-- [lang/macros.md](lang/macros.md): the macro system, defmacro with
-  qq and unquote, compile-time expansion, its limits, and its sharp
-  edges.
 - [lang/repl.md](lang/repl.md): the bitlisp REPL, its debugger, and
   the one-shot converter and compiler commands beside it.
 - [lang/curry.md](lang/curry.md): currying and program identity,
diff --git a/docs/glossary.md b/docs/glossary.md
index eddf4c4..925f03d 100644
--- a/docs/glossary.md
+++ b/docs/glossary.md
@@ -56,7 +56,7 @@ A term enters this table in the same PR that introduces it.
 | REPL stepper | compare btcdeb, the Bitcoin script stepping debugger | the bllsh debugger, cldb (clvm_tools_rs) | the bitlisp command's stepping session over a pausable debug machine pinned differentially to the consensus evaluator, landed 2026-08-15 |
 | program form | nearest relative is a policy in miniscript, source that compiles to the committed script | mod (Chialisp) | the v0 authoring language's module form, (program params declarations body), compiling to one program tree (docs/lang/language.md), landed 2026-08-15 |
 | defun, defconstant | no script equivalent, script has no authoring language | defun, defconstant (Chialisp) | the two declaration forms, names adopted unchanged as generic Lisp vocabulary, defconstant literal-only (docs/lang/language.md), landed 2026-08-15 |
-| defmacro, qq, unquote | no script equivalent, script has no authoring language | defmacro, qq, unquote (clvm_tools stage 2) | the macro declaration and its template forms, names adopted unchanged, expansion depth-capped and cost-budgeted where Chialisp is unbounded (docs/lang/macros.md), landed 2026-08-16 |
+| assert, and, or | no script equivalent, IF/NOTIF are the nearest control flow | the assert, and, or macros (utility_macros.clib) | short-circuit fixed compiler forms where Chialisp uses library macros, the complete macro vocabulary observed in production, adopted 2026-08-16 with the macro system's removal (docs/lang/language.md deviations) |
 | symbol file (bitlisp-sym-v0) | compare debug symbols beside a stripped binary | main.sym (clvm_tools), .sym (clvm_tools_rs) | the compiler's JSON table mapping each compiled function body's tree hash to its source name and parameter names, consumed by the REPL stepper (docs/lang/language.md), landed 2026-08-15 |
 | tree hash | nearest relatives are the tagged leaf and branch hashes of BIP341's script tree | sha256tree, puzzle hash | the sha256tree digest over a program tree, one rule per atom and one per pair, the program's identity for commitment and for symbol-file keys (spec/VM.md, docs/lang/curry.md), glossed 2026-08-16 with the currying unit |
 | curry, uncurry | compare filling the placeholder keys of a script template before deriving its address | curry, uncurry (clvm_tools, chia_rs) | fixing values into a program to make a new committed program and reading them back out, the shape and the strict uncurry contract in docs/lang/curry.md, landed 2026-08-16 |
diff --git a/docs/lang/language.md b/docs/lang/language.md
index 47b29ac..9afe069 100644
--- a/docs/lang/language.md
+++ b/docs/lang/language.md
@@ -11,7 +11,7 @@ name is exactly a token the raw reader rejects as an unknown symbol,
 so strings, hex, operator names, and decimals keep their raw
 spelling rules, and the language occupies only text that previously
 errored. The reserved words are `program`, `defun`, `defconstant`,
-`defmacro`, `if`, `list`, `qq`, and `unquote`.
+`if`, `list`, `assert`, `and`, and `or`.
 
 ## The program form
 
@@ -21,9 +21,8 @@ errored. The reserved words are `program`, `defun`, `defconstant`,
 
 A source program is one self-contained form: a parameter tree, any
 number of declarations in any order, and exactly one body
-expression. The declarations are `defun`, `defconstant`, and
-`defmacro`, and nothing else may appear in declaration position.
-Compiling a
+expression. The declarations are `defun` and `defconstant`, and
+nothing else may appear in declaration position. Compiling a
 program uses nothing outside the form, so a program that compiles
 in a file compiles identically pasted into the REPL.
 
@@ -72,7 +71,7 @@ compiles to its quoted value at the use site. `(defconstant K
 (+ 1 2))` therefore binds the three-element tree whose head is the
 byte 0x10, not 3, exactly as `(q . (+ 1 2))` would read it.
 
-A name is defined once: functions, constants, macros, condition
+A name is defined once: functions, constants, condition
 constants, and reserved words share one namespace, and
 redefinition is an error.
 
@@ -115,16 +114,48 @@ Builds a proper list of its evaluated arguments, folding into `c`
 calls: `(list A B)` compiles as `(c A (c B ()))`, and `(list)` is
 nil. Condition output is written with it.
 
-## defmacro, qq, and unquote
+## assert
 
 ```
-(defmacro <name> <params> <body>)
+(assert <condition>* <value>)
 ```
 
-Declares a macro, a compile-time program whose calls expand into
-source before anything else compiles, with `qq` and `unquote` as
-its template forms. The system, its visibility rules, its limits,
-and its sharp edges are `macros.md`.
+Evaluates each condition in order and yields the final operand once
+every condition holds. A falsy condition raises, failing the spend,
+and nothing after it evaluates. Each level compiles to the same
+apply-a-quoted-branch idiom as `if`, with the raise operator as the
+untaken branch, so `(assert C V)` compiles as
+
+```
+(a (i C (q . V) (q 8)) 1)
+```
+
+With a single operand there is nothing to check and the value
+compiles bare. `(assert)` is rejected at compile time: "assert
+takes conditions and a final value".
+
+## and
+
+```
+(and <expr>*)
+```
+
+Yields 1 when every operand is truthy and nil at the first falsy
+operand, whose successors never evaluate. The result is boolean, 1
+or nil, never an operand's value, exactly as Chialisp's `and` macro
+behaves. `(and)` is 1. Each level compiles to a lazy `if` whose
+untaken branch is the remaining chain.
+
+## or
+
+```
+(or <expr>*)
+```
+
+Yields 1 at the first truthy operand, whose successors never
+evaluate, and nil when every operand is falsy. `(or)` is nil.
+`(and X)` and `(or X)` compile to the same tree, both meaning X as
+a boolean.
 
 ## Expressions and quoting
 
@@ -182,11 +213,8 @@ it, not at the declaration. A body error names its function,
 because in the REPL the offset indexes the declaring line's text,
 not the line that triggered the compile.
 
-Macro expansion is the compiler's one source rewrite, finished
-before reachability is computed and anything emits, which is why a
-macro's expansion may call a function its source never names.
-Emission itself is direct: what the rules above produce is what
-serializes.
+The compiler performs no source rewrites. Emission is direct: what
+the rules above produce is what serializes.
 
 The worked example, `bitlisp-compile` output disassembled:
 
@@ -239,32 +267,27 @@ nothing forces a change. The deliberate differences:
   environment tree, so no optimizer is needed to collapse them and
   the symbol table holds only function bodies.
 - The function tree is ordered by declaration, not alphabetically.
-- Call arity is checked at compile time, macro calls included.
+- Call arity is checked at compile time.
 - `defconstant` is literal-only. There is no compile-time-evaluated
   constant form.
 - Unknown bare operator atoms in call position are rejected at
   compile time rather than at run time.
-- `if` and `list` are compiler forms, not macros, with the same
-  emitted semantics. Macros therefore cannot shadow them, or
-  anything else: where Chialisp's newest macro silently wins, the
-  one-namespace rule makes redefinition an error.
-- Macro expansion is bounded, by the depth cap, the total
-  execution cap, and the execution budget `macros.md` states,
-  where Chialisp expands until the interpreter dies. A macro name
-  used as a value is an error in ordinary code, as a function
-  name is.
-- Macro read-back catches caller-side typos. Chialisp reads an
-  unresolving output atom back as data, so a misspelled macro
-  argument silently compiles. BitLisp additionally lifts names
-  the caller wrote in the call's own arguments, so those fail as
-  unknown names, a deliberately one-hop guarantee: the call's
-  argument source is the only place provenance survives the VM
-  boundary. Capture and stale template spellings are kept as
-  Chialisp has them, documented sharp edges in `macros.md`.
-- There is no `function` or `com` reflection form. Macro output
-  cannot carry names into quoted data, so a user macro cannot
-  introduce laziness, and lazy branching exists only through the
-  built-in `if`.
+- `if`, `list`, `assert`, `and`, and `or` are compiler forms, not
+  macros, with the semantics Chialisp's stage-2 and utility_macros
+  macros give the same spellings. Nothing can shadow them: where
+  Chialisp's newest macro silently wins, the one-namespace rule
+  makes redefinition an error.
+- There is no macro system. Chialisp's `defmacro`, `qq`, and
+  `unquote` are omitted, a removal decided on production evidence:
+  across Chia's deployed puzzle corpus and its largest application
+  codebases, the only macros in production use are short-circuit
+  `assert`, `and`, and `or`, which ship here as fixed forms. The
+  cut removes the expansion machinery's audit surface, and it
+  means user code cannot rewrite source: what is written is what
+  compiles.
+- There is no `function` or `com` reflection form, and lazy
+  evaluation exists only through the built-in lazy forms, `if`,
+  `assert`, `and`, and `or`.
 - There is no include mechanism and no inline functions in v0.
   Currying is not a language form either: it operates on compiled
   programs, through the surfaces defined in `curry.md`.
diff --git a/docs/lang/macros.md b/docs/lang/macros.md
deleted file mode 100644
index a2d06aa..0000000
--- a/docs/lang/macros.md
+++ /dev/null
@@ -1,211 +0,0 @@
-# Macros
-
-The v0 language's macro system: `defmacro` declares a small program
-that runs at compile time and writes source, and `qq` with
-`unquote` is how such a body writes a code template around the
-pieces it was handed. The semantics follow classic Chialisp, with
-the deliberate differences recorded in `language.md` and the two
-limits stated at the end of this page.
-
-## defmacro
-
-```
-(defmacro <name> <params> <body>)
-```
-
-A macro call looks exactly like a function call and is gone before
-anything runs: the compiler replaces the call with whatever the
-macro's body computes, and only that replacement compiles into the
-program.
-
-The difference from a function is when the body runs and what it
-receives. A function body runs at run time, on the values its
-arguments evaluated to. A macro body runs at compile time, on the
-argument source itself, unevaluated: a name arrives as its
-spelling, an atom as itself, a form as the tree the reader built.
-`(add 50 60)` under `(defmacro add (n1 n2) (+ n1 n2))` therefore
-compiles to the constant `(q . 110)`. The addition happened inside
-the compiler, and nothing of it remains at run time.
-
-Parameters bind positionally, exactly as function parameters do,
-shapes and arity checks included. A bare-name tail binds the whole
-remaining argument list, which is what a variadic macro walks.
-
-## What a macro body can see
-
-A macro body compiles at its declaration, as its own self-contained
-program. It sees its parameters, the macros declared before it, the
-operators, the condition constants, and the expression forms `if`,
-`list`, and `qq`. It does not see the program's functions or
-constants: those exist at run time, and a macro runs before run
-time exists. A macro used inside another macro's body must
-therefore be declared earlier. A call in a function body or the
-main body may name a macro declared anywhere in the program,
-because those bodies expand only when the whole program compiles.
-
-## qq and unquote
-
-```
-(qq <template>)
-(unquote <expression>)      inside a template only
-```
-
-`qq` evaluates to the template as data, except that each
-`(unquote E)` hole evaluates E and splices the value in place. A
-name in a template becomes its spelling, so a template can mention
-functions and operators that will only mean something where the
-expansion lands. Templates nest by level: a `qq` inside a template
-deepens it one level, an `unquote` steps one level back, and only
-an `unquote` at the outermost level escapes. Both forms are
-ordinary expressions, usable outside macro bodies too, where a
-template simply builds data.
-
-There is no splicing unquote. Splicing is spelled by hand, by
-consing a macro's name onto a shortened argument list, the idiom
-below.
-
-## How an expansion is read back
-
-The value a macro returns is read as source and compiled, and it
-may contain further macro calls, which expand the same way, so a
-macro can build on other macros or splice its own name back in.
-
-Reading bytes back as source means deciding which atoms are
-names. An atom that spells a name the reader would accept becomes
-a name in two cases. It resolves where the call sits: a parameter
-of the surrounding body, a function, a constant, a macro, a
-condition constant, or an expression form. That is the classic
-Chialisp rule, and it is what makes every ordinary template work.
-Or the caller wrote that name in this call's own arguments,
-outside quoted content and templates. A caller-written name that
-resolves nowhere then fails as the unknown name it is, exactly as
-the direct spelling would. This second case is the recorded
-divergence from Chialisp, which reads such an atom back as data
-and silently compiles the typo, and its scope is deliberately one
-hop: the call's own argument source is the only place a name's
-provenance is still attached when the expansion is read back,
-because everything that crosses the VM boundary comes back as
-bare bytes.
-
-Every other atom stays data, and a pair whose head is the quote
-opcode passes through whole, its content data, so a macro that
-must emit name-shaped bytes as data wraps them in `(q . ...)`.
-Inside another macro's body, at declaration time, the same
-resolve-or-stay-data reading applies with no argument check, and
-what stays data rides the compiled body outward to resolve where
-a program finally uses it, which is what keeps macro composition
-working.
-
-## The sharp edges, Chialisp's and ours
-
-Beyond the one-hop guarantee, read-back behaves exactly as
-Chialisp's, sharp edges included, because once the reader is done
-a computed number, a string, and a spelled name are the same
-bytes, and no compile-time rule can tell them apart.
-
-Capture: the number 110 and the letter `n` are the same byte, so
-
-```
-(program (n) (defmacro add (n1 n2) (+ n1 n2)) (add 50 60))
-```
-
-compiles not to `(q . 110)` but to a reference to the parameter
-`n`. The macro computed 110, the read-back found an `n` in scope,
-and the program now returns whatever its argument is. Nothing
-warns. Keep macro output away from name-shaped bytes unless
-naming things is the intent, and quote data that must stay data:
-a `(q . ...)` wrapper survives read-back untouched.
-
-Stale spellings: a name written only in a template, or reaching
-the program through another macro, is outside the one-hop
-guarantee. If it resolves nowhere it is data, compiling silently
-in value position and failing as an unknown operator that spells
-its bytes in head position. Recompile and rerun after renaming
-things, and keep the worked session's habit of checking `compile`
-output when a macro changes.
-
-Macros are also positionally unhygienic in Chialisp's sense: an
-unquoted argument is spliced as source, so a template that
-unquotes the same parameter twice evaluates that argument twice
-at run time, cost included, and a template may deliberately name
-whatever is in scope at the call site.
-
-At the REPL, `def` bindings are barred from macro output entirely
-and in both directions: any output atom spelling a def-bound name
-is rejected as an unknown name, written or computed, because the
-raw path reads that spelling as the binding and one spelling must
-never mean two things. This holds through macro composition.
-
-## The splicing idiom
-
-A variadic macro that rebuilds the built-in `list` form, verbatim
-from the Chialisp corpus apart from its name:
-
-```
-(defmacro list1 args
-    (if args
-        (qq (c (unquote (f args)) (unquote (c list1 (r args)))))
-        ()))
-```
-
-With arguments, the template conses the first argument onto a
-spliced call of `list1` itself over the rest, one element shorter.
-Without, it is nil. Each expansion round consumes one element, so
-the recursion terminates, and the result compiles to exactly what
-`(list ...)` emits.
-
-## Limits
-
-Three guards bound compile time, all deliberate departures from
-Chialisp, which lets a runaway macro run until the interpreter
-dies:
-
-- Expansion depth. A chain of expansions more than 100 levels deep
-  is rejected with `macro expansion depth exceeded 100 levels`. A
-  self-splicing macro spends one level per argument plus one for
-  the final empty round, so the cap bounds such calls at 99
-  arguments.
-- Total expansions. One compile may run at most 10000 macro
-  executions across all its bodies, rejected past that with
-  `macro expansion exceeded 10000 executions`. Depth alone would
-  not do: a template that splices two calls to itself doubles the
-  work per level while every chain stays shallow.
-- Execution cost. Each macro execution runs under the same
-  11000000000 budget a spend gets, and a burst is rejected with
-  `macro '<name>' failed: cost_exceeded` naming the macro.
-
-Any other error inside a running macro is reported the same way,
-`macro '<name>' failed:` with the VM's error code, at the call
-site's offset.
-
-## A worked session
-
-Every line below pastes into the REPL as written, and the same
-declarations compile from a file.
-
-```
-$ bitlisp
-bitlisp> (defmacro add (n1 n2) (+ n1 n2))
-bitlisp> compile (add 50 60)
-(q . 110)
-bitlisp> (defmacro inc (e) (qq (+ (unquote e) 1)))
-bitlisp> compile (inc 5)
-(+ (q . 5) (q . 1))
-bitlisp> (inc 41)
-42
-cost: 796 of 11000000000
-bitlisp> (defmacro list1 args (if args (qq (c (unquote (f args)) (unquote (c list1 (r args))))) ()))
-bitlisp> compile (list1 300 40 50)
-(c (q . 300) (c (q . 40) (c (q . 50) ())))
-bitlisp> compile (list 300 40 50)
-(c (q . 300) (c (q . 40) (c (q . 50) ())))
-bitlisp> (list1 300 40 50)
-(300 40 50)
-cost: 257 of 11000000000
-bitlisp> exit
-```
-
-The `add` call folded to a constant at compile time. The `inc`
-call left run-time work in place but spliced its argument into the
-template. The `list1` macro expands to the same tree the built-in
-`list` form emits, which is the point of the idiom.
diff --git a/docs/lang/repl.md b/docs/lang/repl.md
index 28cb9a5..7eaa5e7 100644
--- a/docs/lang/repl.md
+++ b/docs/lang/repl.md
@@ -45,7 +45,6 @@ lines.
 | `maxcost [<n>]` | show or set the cost budget for eval, spend, and debug |
 | `(defun <name> <params> <body>)` | define a named function |
 | `(defconstant <name> <value>)` | define a constant |
-| `(defmacro <name> <params> <body>)` | define a macro |
 | `def <name> <sexpr>` | bind a name to a parsed node |
 | `undef <name>` | remove a definition or binding |
 | `defs` | list definitions and bindings |
@@ -84,26 +83,12 @@ A definition body assembles under the bindings current at `def`
 time, so definitions snapshot: redefining a dependency later does
 not rewrite what an earlier definition captured.
 
-A line whose head is `defun`, `defconstant`, or `defmacro` is a
-language declaration, `language.md` syntax exactly, and adds to
-the session's compiler definitions. A macro's body compiles on its
-own line, so its errors print there. Declarations and `def`
-bindings share one namespace with the reserved words and the
-condition constants, so one spelling can never mean two things,
-and `undef` removes a name from whichever space holds it.
-
-Removing a macro changes what later lines mean. A macro whose
-template spliced the removed name back out looks it up again at
-every call, so those calls now fail, while a direct call, already
-run when the later macro declared, stays baked into that macro's
-program.
-
-A `def` binding is raw-reader vocabulary, not a language name,
-and macro output cannot touch one in either direction: any
-expansion atom spelling a def-bound name is rejected as an
-unknown name, written or computed, through macro composition
-included. The binding is never read through a macro, and the raw
-path and the macro path never disagree about one spelling.
+A line whose head is `defun` or `defconstant` is a language
+declaration, `language.md` syntax exactly, and adds to the
+session's compiler definitions. Declarations and `def` bindings
+share one namespace with the reserved words and the condition
+constants, so one spelling can never mean two things, and `undef`
+removes a name from whichever space holds it.
 
 The shared namespace narrows `def` from its original surface, a
 deliberate change with the compiler landing: a reserved word or a

From 6f00e22c2fc1695fae69c2d6b09c41f233cba774 Mon Sep 17 00:00:00 2001
From: Evan <evan@boon.org>
Date: Sun, 16 Aug 2026 15:42:32 -0700
Subject: [PATCH 2/7] tools: remove the macro machinery, emit assert, and, or
 as lazy forms

The compiler drops defmacro, qq, unquote, and everything that
existed to serve them: the expansion pre-pass with its depth, count,
and cost guards, the read-back lift with its one-hop typo evidence,
the macro world in Definitions, and the macro arms in resolution and
emission. _expanded_bodies collapses back to plain reachability over
source bodies, and compile_expression loses its session_names
parameter, whose only purpose was shadowing macro output. The
unknown-operator spelling hint goes too: its rationale was
macro-computed head bytes, which can no longer arise.

The three new forms compile through _lazy_if, the apply-a-quoted-
branch idiom extracted from if, so laziness composes by
construction: assert folds conditions over a raise, and folds to 1
or nil short-circuiting at the first falsy operand, or yields 1 at
the first truthy operand. Semantics match Chialisp's
utility_macros.clib, per the language doc's deviations section.

The tests and vectors that pinned the removed behavior go in this
commit so every commit in the PR stays green: the macro sections of
test_compiler.py and test_repl.py, the macro error-table rows, the
old reserved-word loader pin (its flipped replacement lands with the
new pins), and vectors/vm/macro-programs.json, which pinned compiled
representatives of programs that can no longer be compiled from
source. New pins for assert, and, and or follow in the next commit.

Upstream reference note: the semantics were established against the
classic clvm_tools utility_macros.clib macros and verified by
compiled-shape probes, not copied from any source.
---
 python/bitlisp_tools/compiler.py | 559 ++++++-------------------------
 python/bitlisp_tools/repl.py     |  52 +--
 python/tests/test_compiler.py    | 430 +-----------------------
 python/tests/test_repl.py        |  91 -----
 vectors/vm/macro-programs.json   |  43 ---
 5 files changed, 108 insertions(+), 1067 deletions(-)
 delete mode 100644 vectors/vm/macro-programs.json

diff --git a/python/bitlisp_tools/compiler.py b/python/bitlisp_tools/compiler.py
index 5f2417a..872367c 100644
--- a/python/bitlisp_tools/compiler.py
+++ b/python/bitlisp_tools/compiler.py
@@ -5,9 +5,9 @@
 operator names, and decimals keep exactly their raw meaning and the
 language occupies only text that previously errored. Atoms quote
 themselves, names resolve to environment paths or inline constant
-values, and the special forms are program, defun, defconstant,
-defmacro, if, list, and qq with unquote. Everything else a source
-expression can say is an operator application.
+values, and the special forms are program, defun, defconstant, if,
+list, assert, and, and or. Everything else a source expression can
+say is an operator application.
 
 A compiled program's environment is the pair (function tree . args).
 The function tree holds every reachable function body, balanced in
@@ -18,19 +18,16 @@
 environment root. Constants never enter the tree: a constant
 reference inlines its value as a quoted literal at the use site.
 
-Macro expansion is the one source-to-source rewrite: before
-anything compiles, every macro call is replaced by the value its
-compiled body computes over the raw argument source, repeatedly,
-until no macro call remains. Emission after expansion is direct,
-with one size-only exception: a nil literal is emitted as the nil
-atom, whose path lookup yields nil, one byte instead of the two a
-quoted nil takes.
+There are no source-to-source rewrites. Emission is direct, with
+one size-only exception: a nil literal is emitted as the nil atom,
+whose path lookup yields nil, one byte instead of the two a quoted
+nil takes.
 
 Parsing and every other tree walk here are iterative. Code
-emission and macro expansion recurse with the source's nesting
-depth, a bound accepted because source is authored rather than
-attacker-supplied: past the interpreter's limit every surface
-reports unusable input, exit 2, never a crash or a wrong artifact.
+emission recurses with the source's nesting depth, a bound
+accepted because source is authored rather than attacker-supplied:
+past the interpreter's limit every surface reports unusable input,
+exit 2, never a crash or a wrong artifact.
 
 The compiler also builds a symbol table for the debugger: the tree
 hash of each compiled function body, keyed exactly as the VM's
@@ -42,8 +39,6 @@
 import hashlib
 
 from bitlisp import conditions
-from bitlisp.errors import BitLispError
-from bitlisp.machine import run
 from bitlisp.operators import OPERATORS
 from bitlisp.sexp import NIL, int_to_atom, is_atom, is_pair
 
@@ -55,66 +50,26 @@
 _APPLY = b"\x02"
 _IF_OP = b"\x03"
 _CONS = b"\x04"
+_RAISE = b"\x08"
 
 # The environment root, its first child, and its rest child, as the
 # VM's path lookup numbers them.
 _TOP, _LEFT, _RIGHT = 1, 2, 3
 
-_PROGRAM, _DEFUN, _DEFCONSTANT, _DEFMACRO, _IF, _LIST, _QQ, _UNQUOTE = (
+_PROGRAM, _DEFUN, _DEFCONSTANT, _IF, _LIST, _ASSERT, _AND, _OR = (
     "program",
     "defun",
     "defconstant",
-    "defmacro",
     "if",
     "list",
-    "qq",
-    "unquote",
+    "assert",
+    "and",
+    "or",
 )
 RESERVED_WORDS = frozenset(
-    {_PROGRAM, _DEFUN, _DEFCONSTANT, _DEFMACRO, _IF, _LIST, _QQ, _UNQUOTE}
+    {_PROGRAM, _DEFUN, _DEFCONSTANT, _IF, _LIST, _ASSERT, _AND, _OR}
 )
 
-# The names a macro's returned atoms may resolve to besides the
-# caller's own definitions: the expression forms the compiler
-# provides everywhere.
-_EXPRESSION_FORMS = frozenset({_IF, _LIST, _QQ, _UNQUOTE})
-
-# One macro execution's compile-time budget on the reference VM,
-# the same inclusive cost the spend runner applies when the caller
-# names none.
-MACRO_COST_BUDGET = 11_000_000_000
-
-# How many times a macro's output may itself expand before the
-# compiler rejects the chain. A self-splicing macro spends one
-# level per argument plus one for the final empty round, so this
-# bounds such calls at 99 arguments while staying far inside the
-# interpreter's recursion limit.
-MACRO_DEPTH_LIMIT = 100
-
-# How many macro executions one compile may spend in total, all
-# bodies combined. The depth cap bounds each chain but not the
-# number of chains: a macro whose template splices two calls to
-# itself doubles the work per level, staying under both per-chain
-# guards while the total explodes, so the total is guarded too.
-MACRO_EXPANSION_LIMIT = 10_000
-
-
-class _ExpansionWork:
-    """One compile's expansion context: the remaining macro
-    executions, shared by every body so branching expansion cannot
-    multiply work past the cap, and which world is expanding.
-    strict is the program world, where a caller's misspelled
-    argument names become errors. The macro world, a declaration
-    expanding inside another macro's body, judges nothing extra:
-    what it cannot resolve stays data and rides the compiled body
-    out to the call sites."""
-
-    __slots__ = ("remaining", "strict")
-
-    def __init__(self, strict=True):
-        self.remaining = MACRO_EXPANSION_LIMIT
-        self.strict = strict
-
 
 # The condition vocabulary, one name per assigned opcode, written
 # out literally so a reviewer can check it by eye. A test pins the
@@ -298,10 +253,9 @@ def _check_params(tree):
 
 
 class Definitions:
-    """The compile-time namespace: functions, constants, and macros
-    by name.
+    """The compile-time namespace: functions and constants by name.
 
-    A name is claimed once across functions, constants, macros, the
+    A name is claimed once across functions, constants, the
     condition constants, the reserved words, and any caller-supplied
     taken set, so one spelling can never mean two things.
     """
@@ -309,16 +263,10 @@ class Definitions:
     def __init__(self):
         self.functions = {}
         self.constants = {}
-        self.macros = {}
 
     def _claim(self, symbol, taken):
         name = _check_name(symbol, "definition")
-        if (
-            name in self.functions
-            or name in self.constants
-            or name in self.macros
-            or name in taken
-        ):
+        if name in self.functions or name in self.constants or name in taken:
             raise CompileError(f"{name!r} is already defined", symbol.offset)
         return name
 
@@ -348,35 +296,6 @@ def add_defconstant(self, form, taken=frozenset()):
         self.constants[name] = items[2]
         return name
 
-    def add_defmacro(self, form, taken=frozenset()):
-        """Adds one (defmacro name params body) source form. The
-        body compiles here, at declaration, in the macro world: its
-        parameters, the macros declared before it, the operators,
-        and the expression forms, but never the program's functions
-        or constants, so each macro is a self-contained program.
-        Later macros can therefore use earlier ones in their
-        bodies, while calls in function bodies and the main body
-        expand against every macro regardless of order. What an
-        earlier macro splices in stays data when it resolves
-        nowhere here, and resolves again wherever the compiled
-        body's output finally lands."""
-        items = _form_items(form, _DEFMACRO, 4)
-        name = self._claim(items[1], taken)
-        arity = _check_params(items[2])
-        macro_defs = Definitions()
-        macro_defs.macros = dict(self.macros)
-        expanded = _expand(
-            items[3],
-            macro_defs,
-            _symbol_names(items[2]),
-            0,
-            _ExpansionWork(strict=False),
-        )
-        compilation = _Compilation(macro_defs, {}, macro_name=name)
-        program = compilation.expression(expanded, _bind_params(items[2], _TOP))
-        self.macros[name] = (items[2], items[3], arity, program)
-        return name
-
 
 def _form_items(form, keyword, count):
     """The exactly-count items of a special form, head included."""
@@ -395,14 +314,13 @@ def _form_items(form, keyword, count):
 _FORM_SHAPES = {
     _DEFUN: "(defun name params body)",
     _DEFCONSTANT: "(defconstant name value)",
-    _DEFMACRO: "(defmacro name params body)",
 }
 
 
 def declaration_keyword(tree):
     """The declaration keyword heading a source tree, or None."""
     if is_pair(tree) and isinstance(tree[0], Symbol):
-        if tree[0].name in (_DEFUN, _DEFCONSTANT, _DEFMACRO):
+        if tree[0].name in (_DEFUN, _DEFCONSTANT):
             return tree[0].name
     return None
 
@@ -428,183 +346,9 @@ def _bind_params(tree, root):
     return bindings
 
 
-def _lower_symbols(tree):
-    """The argument source as the value a macro runs over: every
-    name becomes its spelling as an atom, exactly how the macro's
-    own compiled body expects to read it."""
-    if isinstance(tree, Symbol):
-        return tree.name.encode()
-    if is_pair(tree):
-        return (_lower_symbols(tree[0]), _lower_symbols(tree[1]))
-    return tree
-
-
-def _name_spelling(atom):
-    """The name an atom's bytes spell, or None when they spell no
-    single reader-accepted name."""
-    try:
-        text = atom.decode()
-    except UnicodeDecodeError:
-        return None
-    if text and text.isprintable() and definable(text):
-        return text
-    return None
-
-
-def _lift(value, defs, shadowed, evidence, offset):
-    """The value a macro returned, read back as one expression. An
-    expression headed by the quote opcode passes through whole, its
-    content data by construction, and the walk is expression
-    directed so only a head position can mean quote: an argument
-    whose value merely starts with the quote byte, like the number
-    one, stays an ordinary argument.
-
-    An atom whose bytes spell one name the reader would accept
-    becomes a name when the name resolves where the call sits, the
-    classic Chialisp rule, and also when it is in the evidence,
-    the names the caller wrote in this call's own arguments. The
-    second clause is a recorded divergence with a deliberately
-    one-hop scope: this call's argument source is the only place
-    the reader's provenance is still attached, so a misspelled
-    argument reaches the resolver as a name and fails as the
-    unknown name it is, exactly as the direct spelling would,
-    where Chialisp reads it back as data and compiles the typo
-    silently. Everything else is data, including names spelled
-    only inside templates or inherited through other macros, whose
-    provenance the VM boundary erased: computed bytes that spell
-    an in-scope name resolve and capture, and stale spellings that
-    resolve nowhere pass as data, the sharp edges Chialisp authors
-    already know. Quote data that must stay data.
-
-    evidence is None in the macro world, declaration-time
-    expansion inside another macro's body, where what resolves
-    lifts and the rest stays data, riding the compiled body out
-    to the call sites where resolution happens against real
-    scope.
-
-    The lifted names carry the macro call's offset, so a
-    downstream error points at the call site."""
-    if is_pair(value):
-        if is_atom(value[0]) and value[0] == _QUOTE:
-            return value
-        return (
-            _lift(value[0], defs, shadowed, evidence, offset),
-            _lift_tail(value[1], defs, shadowed, evidence, offset),
-        )
-    if value == NIL:
-        return value
-    text = _name_spelling(value)
-    if text is None:
-        return value
-    if _resolvable(text, defs, shadowed):
-        return Symbol(text, offset)
-    if evidence is not None and text in evidence:
-        return Symbol(text, offset)
-    return value
-
-
-def _resolvable(name, defs, shadowed):
-    """True when a name means something where an expansion sits.
-    This is the read-back's copy of the resolution domain that
-    _reference and _named_form implement as control flow, and the
-    two must cover the same names: a category added to one and not
-    the other either turns valid names into silent data or valid
-    data into spurious names."""
-    return (
-        name in shadowed
-        or name in defs.functions
-        or name in defs.constants
-        or name in defs.macros
-        or name in CONDITION_CONSTANTS
-        or name in _EXPRESSION_FORMS
-    )
-
-
-def _lift_tail(node, defs, shadowed, evidence, offset):
-    """An argument spine of a macro's returned value, each element
-    lifted as an expression. The spine's own pairs never mean
-    quote, whatever their first bytes are."""
-    if not is_pair(node):
-        return node
-    return (
-        _lift(node[0], defs, shadowed, evidence, offset),
-        _lift_tail(node[1], defs, shadowed, evidence, offset),
-    )
-
-
-def _expand(tree, defs, shadowed, depth, work):
-    """The source tree with every macro call replaced by what the
-    macro's program computes over the raw, unevaluated argument
-    source. The returned value is read back as source and expanded
-    again, one depth level deeper, so a macro may emit calls to
-    other macros or splice its own name back in, terminating by
-    consuming its argument list. Quoted content is data and is
-    never entered. A qq template is entered only through its
-    unquote escapes. strict selects the read-back rule: the
-    program world judges, the macro world defers, as _lift
-    states."""
-    if not is_pair(tree):
-        return tree
-    head, tail = tree
-    if is_atom(head) and head == _QUOTE:
-        return tree
-    if isinstance(head, Symbol):
-        if head.name == _QQ:
-            return (head, _expand_template(tail, defs, shadowed, depth, work, 1))
-        if head.name in defs.macros and head.name not in shadowed:
-            return _expand_call(head, tail, defs, shadowed, depth, work)
-    return (
-        _expand(head, defs, shadowed, depth, work),
-        _expand_tail(tail, defs, shadowed, depth, work),
-    )
-
-
-def _expand_tail(node, defs, shadowed, depth, work):
-    """The argument spine of a form, each element expanded as an
-    expression. The spine itself is never mistaken for a call, so
-    a bare macro name sitting as an argument stays a name and gets
-    the value-position error at emission."""
-    if not is_pair(node):
-        return node
-    return (
-        _expand(node[0], defs, shadowed, depth, work),
-        _expand_tail(node[1], defs, shadowed, depth, work),
-    )
-
-
-def _expand_template(node, defs, shadowed, depth, work, level):
-    """A qq template with its level-one unquote escapes expanded.
-    A nested qq deepens the level, an unquote raises it back, and
-    both are walked as data otherwise, mirroring how the template
-    emits: this walk and _Compilation._template must locate the
-    same escape positions on every tree, and a test holds them to
-    it. Malformed escape arities pass through untouched here and
-    are rejected once, at emission."""
-    if not is_pair(node):
-        return node
-    head, tail = node
-    if isinstance(head, Symbol):
-        if head.name == _QQ:
-            return (
-                head,
-                _expand_template(tail, defs, shadowed, depth, work, level + 1),
-            )
-        if head.name == _UNQUOTE:
-            if level == 1:
-                return (head, _expand_tail(tail, defs, shadowed, depth, work))
-            return (
-                head,
-                _expand_template(tail, defs, shadowed, depth, work, level - 1),
-            )
-    return (
-        _expand_template(head, defs, shadowed, depth, work, level),
-        _expand_template(tail, defs, shadowed, depth, work, level),
-    )
-
-
 def _check_arity(name, arguments, arity, offset):
-    """One arity check for calls and macro calls, so the two sites
-    cannot drift apart in behavior or wording."""
+    """The one arity check every call site shares, so wording and
+    behavior cannot drift apart."""
     exact, count = arity
     if exact and len(arguments) != count:
         raise CompileError(
@@ -617,80 +361,13 @@ def _check_arity(name, arguments, arity, offset):
         )
 
 
-def _argument_names(node):
-    """The names a caller wrote in a macro call's own arguments,
-    the one place the reader's provenance is still attached when
-    the expansion is read back. The walk is expression directed
-    like the read-back itself: spine pairs never mean quote, and
-    quoted content and qq templates are excluded, because their
-    spellings are data to the read-back and must not vouch for
-    output atoms."""
-    names = set()
-
-    def spine(node):
-        while is_pair(node):
-            element(node[0])
-            node = node[1]
-        if isinstance(node, Symbol):
-            names.add(node.name)
-
-    def element(expr):
-        if isinstance(expr, Symbol):
-            names.add(expr.name)
-            return
-        if not is_pair(expr):
-            return
-        head = expr[0]
-        if is_atom(head) and head == _QUOTE:
-            return
-        if isinstance(head, Symbol) and head.name == _QQ:
-            return
-        element(head)
-        spine(expr[1])
-
-    spine(node)
-    return names
-
-
-def _expand_call(head, tail, defs, shadowed, depth, work):
-    """One macro call replaced by its expansion."""
-    name = head.name
-    if depth == MACRO_DEPTH_LIMIT:
-        raise CompileError(
-            f"macro expansion depth exceeded {MACRO_DEPTH_LIMIT} levels",
-            head.offset,
-        )
-    if work.remaining == 0:
-        raise CompileError(
-            f"macro expansion exceeded {MACRO_EXPANSION_LIMIT} executions",
-            head.offset,
-        )
-    work.remaining -= 1
-    arguments = _proper_items(tail, name, head.offset)
-    _check_arity(name, arguments, defs.macros[name][2], head.offset)
-    program = defs.macros[name][3]
-    try:
-        _, value = run(program, _lower_symbols(tail), MACRO_COST_BUDGET)
-    except BitLispError as exc:
-        raise CompileError(
-            f"macro {name!r} failed: {exc.code}: {exc}", head.offset
-        ) from None
-    # Typo evidence: only what the caller wrote in this call, and
-    # only in the program world. The macro world passes none.
-    evidence = _argument_names(tail) if work.strict else None
-    lifted = _lift(value, defs, shadowed, evidence, head.offset)
-    return _expand(lifted, defs, shadowed, depth + 1, work)
-
-
-def _expanded_bodies(defs, body, work, session_names):
-    """The reachable function bodies, expanded, conservatively:
-    every name a post-expansion body mentions counts, shadowing
-    ignored, so the set can only be too large, never too small.
-    Expansion must come first because a macro may emit a call to a
-    function its source never names. An unreached body never
-    expands and never compiles. The sweep runs in declaration
-    order, restarting until no new body is reached, so which body
-    an expansion error names is deterministic."""
+def _reachable_bodies(defs, body):
+    """The reachable function bodies, conservatively: every name a
+    body mentions counts, shadowing ignored, so the set can only be
+    too large, never too small. An unreached body never compiles,
+    so an error inside one surfaces the first time a program
+    reaches it. The sweep runs in declaration order, restarting
+    until no new body is reached."""
     bodies = {}
     mentioned = _symbol_names(body)
     changed = True
@@ -699,14 +376,9 @@ def _expanded_bodies(defs, body, work, session_names):
         for name in defs.functions:
             if name in bodies or name not in mentioned:
                 continue
-            fn_params, fn_body, _ = defs.functions[name]
-            shadow = _symbol_names(fn_params) | session_names
-            try:
-                expanded = _expand(fn_body, defs, shadow, 0, work)
-            except CompileError as exc:
-                raise CompileError(f"in {name!r}: {exc}") from None
-            bodies[name] = expanded
-            mentioned |= _symbol_names(expanded)
+            _, fn_body, _ = defs.functions[name]
+            bodies[name] = fn_body
+            mentioned |= _symbol_names(fn_body)
             changed = True
     return bodies
 
@@ -759,17 +431,22 @@ def _proper_list(*nodes):
     return result
 
 
+def _lazy_if(condition, then_branch, else_branch):
+    """The lazy branch idiom every branching form compiles through.
+    The VM's i evaluates all three arguments, so the branches
+    travel quoted and apply runs only the selected one in the
+    unchanged environment, path 1."""
+    selector = _proper_list(_IF_OP, condition, _quote(then_branch), _quote(else_branch))
+    return _proper_list(_APPLY, selector, int_to_atom(_TOP))
+
+
 class _Compilation:
-    """One compile: the definitions, the function paths, and the
-    reachable set, shared by the main body and every function body.
-    macro_name is set only when the body being compiled is a
-    macro's own, where macro names quote themselves as spellings so
-    a template can splice them back into emitted source."""
+    """One compile: the definitions and the function paths, shared
+    by the main body and every function body."""
 
-    def __init__(self, defs, fn_paths, macro_name=None):
+    def __init__(self, defs, fn_paths):
         self.defs = defs
         self.fn_paths = fn_paths
-        self.macro_name = macro_name
 
     def expression(self, expr, bindings):
         if isinstance(expr, Symbol):
@@ -809,14 +486,6 @@ def _reference(self, symbol, bindings):
             return _quote(CONDITION_CONSTANTS[name])
         if name in self.defs.functions:
             raise CompileError(f"function {name!r} used as a value", symbol.offset)
-        if name in self.defs.macros or name == self.macro_name:
-            if self.macro_name is not None:
-                # In a macro body a macro's name is its spelling,
-                # so a template can cons it onto a shortened
-                # argument list and splice the call back into the
-                # emitted source, its own name included.
-                return _quote(name.encode())
-            raise CompileError(f"macro {name!r} used as a value", symbol.offset)
         raise CompileError(f"unknown name {name!r}", symbol.offset)
 
     def _named_form(self, head, tail, bindings):
@@ -825,20 +494,18 @@ def _named_form(self, head, tail, bindings):
             return self._if(head, tail, bindings)
         if name == _LIST:
             return self._list(head, tail, bindings)
-        if name == _QQ:
-            return self._qq(head, tail, bindings)
-        if name == _UNQUOTE:
-            raise CompileError("unquote outside a qq template", head.offset)
-        if name in (_PROGRAM, _DEFUN, _DEFCONSTANT, _DEFMACRO):
+        if name == _ASSERT:
+            return self._assert(head, tail, bindings)
+        if name == _AND:
+            return self._and(head, tail, bindings)
+        if name == _OR:
+            return self._or(head, tail, bindings)
+        if name in (_PROGRAM, _DEFUN, _DEFCONSTANT):
             raise CompileError(f"{name} form is not an expression", head.offset)
         if name in bindings:
             raise CompileError(f"{name!r} is a parameter, not a function", head.offset)
         if name in self.defs.functions:
             return self._call(head, tail, bindings)
-        if name == self.macro_name:
-            raise CompileError(
-                f"macro {name!r} cannot be called inside its own body", head.offset
-            )
         if name in self.defs.constants or name in CONDITION_CONSTANTS:
             raise CompileError(f"{name!r} is a constant, not a function", head.offset)
         raise CompileError(f"unknown name {name!r}", head.offset)
@@ -850,13 +517,7 @@ def _if(self, head, tail, bindings):
         condition, then_branch, else_branch = (
             self.expression(item, bindings) for item in items
         )
-        # The VM's i evaluates all three arguments, so the branches
-        # travel quoted and apply runs only the selected one in the
-        # unchanged environment, path 1.
-        selector = _proper_list(
-            _IF_OP, condition, _quote(then_branch), _quote(else_branch)
-        )
-        return _proper_list(_APPLY, selector, int_to_atom(_TOP))
+        return _lazy_if(condition, then_branch, else_branch)
 
     def _list(self, head, tail, bindings):
         items = _proper_items(tail, _LIST, head.offset)
@@ -865,49 +526,37 @@ def _list(self, head, tail, bindings):
             result = _proper_list(_CONS, self.expression(item, bindings), result)
         return result
 
-    def _qq(self, head, tail, bindings):
-        items = _proper_items(tail, _QQ, head.offset)
-        if len(items) != 1:
-            raise CompileError("qq takes 1 part: (qq template)", head.offset)
-        return self._template(items[0], bindings, 1)
-
-    def _template(self, node, bindings, level):
-        # A template emits code that builds itself as data: names
-        # become their spellings, atoms quote, pairs cons. A nested
-        # qq deepens the level and is rebuilt as data, an unquote
-        # raises it back, and only a level-one unquote escapes to
-        # an ordinary compiled expression.
-        if isinstance(node, Symbol):
-            return _quote(node.name.encode())
-        if is_atom(node):
-            if node == NIL:
-                return NIL
-            return _quote(node)
-        nhead, ntail = node
-        if isinstance(nhead, Symbol) and nhead.name == _QQ:
-            return _proper_list(
-                _CONS,
-                _quote(nhead.name.encode()),
-                self._template(ntail, bindings, level + 1),
-            )
-        if isinstance(nhead, Symbol) and nhead.name == _UNQUOTE:
-            if level == 1:
-                items = _proper_items(ntail, _UNQUOTE, nhead.offset)
-                if len(items) != 1:
-                    raise CompileError(
-                        "unquote takes 1 part: (unquote expression)", nhead.offset
-                    )
-                return self.expression(items[0], bindings)
-            return _proper_list(
-                _CONS,
-                _quote(nhead.name.encode()),
-                self._template(ntail, bindings, level - 1),
-            )
-        return _proper_list(
-            _CONS,
-            self._template(nhead, bindings, level),
-            self._template(ntail, bindings, level),
-        )
+    def _assert(self, head, tail, bindings):
+        items = _proper_items(tail, _ASSERT, head.offset)
+        if not items:
+            raise CompileError("assert takes conditions and a final value", head.offset)
+        compiled = [self.expression(item, bindings) for item in items]
+        # A falsy condition selects the raise, so nothing after it
+        # evaluates and the spend fails there.
+        result = compiled[-1]
+        for condition in reversed(compiled[:-1]):
+            result = _lazy_if(condition, result, (_RAISE, NIL))
+        return result
+
+    def _and(self, head, tail, bindings):
+        items = _proper_items(tail, _AND, head.offset)
+        # The result is boolean, 1 or nil, never an operand's
+        # value, and the first falsy operand ends evaluation.
+        result = _quote(int_to_atom(1))
+        compiled = [self.expression(item, bindings) for item in items]
+        for condition in reversed(compiled):
+            result = _lazy_if(condition, result, NIL)
+        return result
+
+    def _or(self, head, tail, bindings):
+        items = _proper_items(tail, _OR, head.offset)
+        # 1 at the first truthy operand, which ends evaluation, nil
+        # when every operand is falsy.
+        result = NIL
+        compiled = [self.expression(item, bindings) for item in items]
+        for condition in reversed(compiled):
+            result = _lazy_if(condition, _quote(int_to_atom(1)), result)
+        return result
 
     def _call(self, head, tail, bindings):
         name = head.name
@@ -930,12 +579,6 @@ def _operator(self, op, tail, bindings):
         # that can never do anything but fail.
         if op != _APPLY and op not in OPERATORS:
             label = "0x" + op.hex() if op else "()"
-            # A macro can emit computed bytes that spell a name,
-            # which stay data and can land here as head bytes, so
-            # the error spells what a reader would see in the hex.
-            text = _name_spelling(op)
-            if text is not None:
-                label = f"{label}, which spells {text!r}"
             raise CompileError(f"unknown operator {label}")
         name = ATOM_TO_NAME[op]
         arguments = _proper_items(tail, name)
@@ -964,21 +607,11 @@ def tree_hash(node):
     return hashes[0]
 
 
-def _compile(defs, params, body, session_names=frozenset()):
+def _compile(defs, params, body):
     """The program node and symbol table for one body against one
-    definitions space, params None for a bare expression.
-    session_names are the REPL's def bindings, folded into the
-    resolution shadow: any macro output atom spelling one becomes
-    a name and fails as unknown, however it arose, because the
-    raw path reads that spelling as the binding and one spelling
-    must never mean two things. Resolution-side, the rule holds
-    through macro composition for free."""
-    shadow = _symbol_names(params) if params is not None else frozenset()
-    shadow = shadow | session_names
-    work = _ExpansionWork()
-    body = _expand(body, defs, shadow, 0, work)
-    expanded = _expanded_bodies(defs, body, work, session_names)
-    fn_names = [name for name in defs.functions if name in expanded]
+    definitions space, params None for a bare expression."""
+    reachable = _reachable_bodies(defs, body)
+    fn_names = [name for name in defs.functions if name in reachable]
     has_tree = bool(fn_names)
     fn_paths = _tree_paths(fn_names, _LEFT) if has_tree else {}
     compilation = _Compilation(defs, fn_paths)
@@ -994,7 +627,7 @@ def _compile(defs, params, body, session_names=frozenset()):
         fn_params, _, _ = defs.functions[name]
         try:
             compiled = compilation.expression(
-                expanded[name], _bind_params(fn_params, _RIGHT)
+                reachable[name], _bind_params(fn_params, _RIGHT)
             )
         except CompileError as exc:
             # A body compiles when a program reaches it, which in
@@ -1043,24 +676,20 @@ def compile_program(source):
             defs.add_defun(declaration)
         elif keyword == _DEFCONSTANT:
             defs.add_defconstant(declaration)
-        elif keyword == _DEFMACRO:
-            defs.add_defmacro(declaration)
         else:
-            raise CompileError("expected defun, defconstant, or defmacro")
+            raise CompileError("expected defun or defconstant")
     return _compile(defs, params, items[-1])
 
 
-def compile_expression(source, defs, session_names=frozenset()):
+def compile_expression(source, defs):
     """The program node and symbol table for one bare expression
     against a definitions space. The expression has no parameters,
-    so the compiled program ignores its environment. session_names
-    are the caller's bindings outside the language, the REPL's def
-    names, barred from macro output. A program form ignores them,
-    staying self-contained."""
+    so the compiled program ignores its environment. A program form
+    ignores the definitions, staying self-contained."""
     tree = parse_source(source) if isinstance(source, str) else source
     if program_form(tree):
         return compile_program(tree)
-    return _compile(defs, None, tree, session_names)
+    return _compile(defs, None, tree)
 
 
 def bind_values(params, env):
diff --git a/python/bitlisp_tools/repl.py b/python/bitlisp_tools/repl.py
index 53fb0b4..1c06245 100644
--- a/python/bitlisp_tools/repl.py
+++ b/python/bitlisp_tools/repl.py
@@ -16,7 +16,6 @@
 Definitions:
     (defun <name> <params> <body>)   define a named function
     (defconstant <name> <value>)     define a constant
-    (defmacro <name> <params> <body>)   define a macro
     def <name> <sexpr>             bind a name to a parsed node
     undef <name>                   remove a definition or binding
     defs                           list definitions and bindings
@@ -52,9 +51,9 @@ def <name> <sexpr>             bind a name to a parsed node
 The same rule shapes the compiler surface: eval, spend, and debug
 read their text as raw VM syntax first, and only text the reader
 rejects on an unknown name retries as language source against the
-session's defun, defconstant, and defmacro definitions, the
-condition constants included. A program's solution is always data
-and never compiles.
+session's defun and defconstant definitions, the condition
+constants included. A program's solution is always data and never
+compiles.
 """
 
 import argparse
@@ -120,7 +119,7 @@ def _declaration_line(stripped):
     return (
         len(tokens) >= 2
         and tokens[0][0] == "("
-        and tokens[1][0] in ("defun", "defconstant", "defmacro")
+        and tokens[1][0] in ("defun", "defconstant")
     )
 
 
@@ -226,9 +225,7 @@ def _forms(self, arg, what, wants, least, most, data_noun):
                         "which is data and cannot hold names",
                         symbol.offset,
                     )
-            program, table = compile_expression(
-                nodes[0], self.defs, frozenset(self.names)
-            )
+            program, table = compile_expression(nodes[0], self.defs)
             self._register_symbols(table)
             nodes = [program, *nodes[1:]]
         return nodes
@@ -365,18 +362,14 @@ def do_maxcost(self, arg):
 
     @_survives
     def _declare(self, line):
-        """A (defun ...), (defconstant ...), or (defmacro ...) line
-        adds to the compiler definitions space. Names are claimed
-        once across this space and the def bindings, so one
-        spelling can never mean two things. A defmacro's body
-        compiles here, on this line, so its errors print now."""
+        """A (defun ...) or (defconstant ...) line adds to the
+        compiler definitions space. Names are claimed once across
+        this space and the def bindings, so one spelling can never
+        mean two things."""
         tree = parse_source(line)
         taken = set(self.names)
-        keyword = declaration_keyword(tree)
-        if keyword == "defun":
+        if declaration_keyword(tree) == "defun":
             self.defs.add_defun(tree, taken)
-        elif keyword == "defmacro":
-            self.defs.add_defmacro(tree, taken)
         else:
             self.defs.add_defconstant(tree, taken)
 
@@ -400,11 +393,7 @@ def do_def(self, arg):
         if name in RESERVED_WORDS or name in CONDITION_CONSTANTS:
             print(f"error: {name!r} is reserved by the language")
             return
-        if (
-            name in self.defs.functions
-            or name in self.defs.constants
-            or name in self.defs.macros
-        ):
+        if name in self.defs.functions or name in self.defs.constants:
             print(f"error: {name!r} is already defined")
             return
         nodes = assemble_many(body, self.names)
@@ -417,19 +406,9 @@ def do_def(self, arg):
     def do_undef(self, arg):
         """undef <name>: remove a definition or binding."""
         name = arg.strip()
-        spaces = (
-            self.names,
-            self.defs.functions,
-            self.defs.constants,
-            self.defs.macros,
-        )
+        spaces = (self.names, self.defs.functions, self.defs.constants)
         for space in spaces:
             if name in space:
-                # Removal changes what later lines mean. A macro
-                # whose expansion splices this name back out needs
-                # it again at every later call, so those calls now
-                # fail. Only a direct call, already run at the
-                # later macro's declaration, stays baked in.
                 del space[name]
                 return
         print(f"error: {name!r} is not defined")
@@ -444,17 +423,12 @@ def do_defs(self, arg):
         for name in sorted(self.defs.functions):
             params, body, _ = self.defs.functions[name]
             print(f"(defun {name} {source_text(params)} {source_text(body)})")
-        for name in sorted(self.defs.macros):
-            params, body = self.defs.macros[name][:2]
-            print(f"(defmacro {name} {source_text(params)} {source_text(body)})")
 
     @_survives
     def do_compile(self, arg):
         """compile <expr-or-program>: show the compiled tree as
         canonical text, the artifact itself, never renamed."""
-        program, table = compile_expression(
-            parse_source(arg), self.defs, frozenset(self.names)
-        )
+        program, table = compile_expression(parse_source(arg), self.defs)
         self._register_symbols(table)
         print(self._node_text(program))
 
diff --git a/python/tests/test_compiler.py b/python/tests/test_compiler.py
index da015fd..82c5091 100644
--- a/python/tests/test_compiler.py
+++ b/python/tests/test_compiler.py
@@ -20,11 +20,8 @@
 from bitlisp_tools import assemble, disassemble  # noqa: E402
 from bitlisp_tools.compiler import (  # noqa: E402
     CONDITION_CONSTANTS,
-    MACRO_DEPTH_LIMIT,
-    MACRO_EXPANSION_LIMIT,
     CompileError,
     Definitions,
-    Symbol,
     bind_values,
     compile_expression,
     compile_program,
@@ -49,25 +46,13 @@ def _defs(*declarations):
     defs = Definitions()
     for declaration in declarations:
         tree = parse_source(declaration)
-        if declaration.startswith("(defmacro"):
-            defs.add_defmacro(tree)
-        elif declaration.startswith("(defun"):
+        if declaration.startswith("(defun"):
             defs.add_defun(tree)
         else:
             defs.add_defconstant(tree)
     return defs
 
 
-# The Chialisp self-splicing idiom, verbatim from the clvm_tools
-# regression corpus: the template conses the macro's own name onto
-# the shortened argument list, so each expansion round consumes one
-# element and the recursion terminates at nil.
-LIST1 = (
-    "(defmacro list1 args (if args "
-    "(qq (c (unquote (f args)) (unquote (c list1 (r args))))) ()))"
-)
-
-
 # The CONDITIONS.md section 2 table, transcribed row by row so a
 # vocabulary change must be made here too, in the test_syntax
 # doc-table style.
@@ -364,22 +349,6 @@ def test_load_symbols_rejects(mutate):
         load_symbols(data)
 
 
-def test_load_symbols_rejects_newly_reserved_names():
-    # A symbol file written before this unit may name a function
-    # qq, unquote, or defmacro, spellings the compiler accepted
-    # then. The loader validates against today's language, so such
-    # a file is rejected whole: a deliberate compatibility break,
-    # recorded in the execution plan.
-    _, table = compile_program("(program (X) (defun fun (N) (* 2 N)) (fun X))")
-    data = symbols_to_json(table)
-    (key,) = data["functions"]
-    for name in ("qq", "unquote", "defmacro"):
-        data["functions"][key]["name"] = name
-        with pytest.raises(ValueError) as excinfo:
-            load_symbols(data)
-        assert "malformed function name" in str(excinfo.value)
-
-
 def test_atom_bodies_stay_out_of_the_table():
     _, table = compile_program("(program (X) (defun own (N) N) (c (own X) X))")
     assert table["functions"] == {}
@@ -430,334 +399,6 @@ def test_variadic_call_binds_the_rest():
 # Error paths.
 
 
-# Macros: expansion runs at compile time on the reference VM over
-# the raw unevaluated argument source, classic Chialisp semantics.
-
-
-def test_pin_macro_constant_folds():
-    program, _ = compile_program(
-        "(program () (defmacro add (n1 n2) (+ n1 n2)) (add 50 60))"
-    )
-    assert disassemble(program) == "(q . 110)"
-
-
-def test_pin_capture_matches_chialisp():
-    # 110 spells the letter n, and with a caller parameter named n
-    # in scope the folded atom becomes a reference to it: the
-    # classic capture, kept deliberately because no static
-    # evidence can tell written bytes from computed bytes once the
-    # reader's token kinds are gone. The doc teaches the remedy,
-    # quote data that must stay data.
-    program, _ = compile_program(
-        "(program (n) (defmacro add (n1 n2) (+ n1 n2)) (add 50 60))"
-    )
-    assert disassemble(program) == "2"
-
-
-def test_written_names_lift_computed_data_stays():
-    # The same fold with no colliding name in scope stays data, so
-    # constant folding works, and a spliced caller-written name
-    # still lifts: the two evidence sources side by side.
-    program, _ = compile_program(
-        "(program () (defmacro add (n1 n2) (+ n1 n2)) (add 50 60))"
-    )
-    assert disassemble(program) == "(q . 110)"
-    program, _ = compile_program(
-        "(program (n) (defmacro keep (e) (qq (+ (unquote e) 1))) (keep n))"
-    )
-    assert disassemble(program) == "(+ 2 (q . 1))"
-
-
-def test_pin_qq_escapes_compile_in_place():
-    program, _ = compile_program(
-        "(program (X) (defmacro inc (e) (qq (+ (unquote e) 1))) (inc X))"
-    )
-    assert disassemble(program) == "(+ 2 (q . 1))"
-
-
-def test_pin_nested_qq_rebuilds_heads_as_data():
-    # A nested qq deepens the level, so its unquote does not escape
-    # and both heads come back as spellings in the built data.
-    _, _, result = _run_program("(program () (qq (qq (unquote (+ 1 2)))))")
-    assert result == (
-        b"qq",
-        ((b"unquote", ((b"\x10", (b"\x01", (b"\x02", NIL))), NIL)), NIL),
-    )
-
-
-def test_pin_list1_macro_matches_builtin_list():
-    macro_program, _, macro_result = _run_program(
-        f"(program () {LIST1} (list1 300 40 50))"
-    )
-    builtin_program, _, builtin_result = _run_program("(program () (list 300 40 50))")
-    assert macro_program == builtin_program
-    assert macro_result == builtin_result
-
-
-def test_list1_of_nothing_is_nil():
-    _, _, result = _run_program(f"(program () {LIST1} (list1))")
-    assert result == NIL
-
-
-def test_macro_depth_boundary_is_exact():
-    # A self-splicing call spends one level per argument plus one
-    # for the final empty round, so 99 arguments is the last count
-    # that compiles under the cap.
-    spelled = " ".join("1" for _ in range(99))
-    compile_program(f"(program () {LIST1} (list1 {spelled}))")
-    with pytest.raises(CompileError) as excinfo:
-        compile_program(f"(program () {LIST1} (list1 {spelled} 1))")
-    assert f"depth exceeded {MACRO_DEPTH_LIMIT} levels" in str(excinfo.value)
-
-
-def test_macro_expansion_reaches_a_function():
-    # The expansion calls a defun the pre-expansion source never
-    # names, so reachability has to run over expanded bodies.
-    program, table, result = _run_program(
-        "(program (X) (defun dbl (v) (* v 2)) "
-        "(defmacro twice (e) (qq (dbl (unquote e)))) (twice X))",
-        "(21)",
-    )
-    assert result == int_to_atom(42)
-    assert {name for name, _ in table["functions"].values()} == {"dbl"}
-
-
-def test_macro_uses_earlier_macro():
-    _, _, result = _run_program(
-        "(program (X) (defmacro inc (e) (qq (+ (unquote e) 1))) "
-        "(defmacro inc2 (e) (qq (inc (inc (unquote e))))) (inc2 X))",
-        "(40)",
-    )
-    assert result == int_to_atom(42)
-
-
-def test_macro_in_function_body_ignores_declaration_order():
-    # A macro body sees only macros declared before it, but a defun
-    # body expands when the program compiles, against every macro.
-    _, _, result = _run_program(
-        "(program (X) (defun bump (v) (inc v)) "
-        "(defmacro inc (e) (qq (+ (unquote e) 1))) (bump X))",
-        "(41)",
-    )
-    assert result == int_to_atom(42)
-
-
-def test_macro_body_sees_condition_constants():
-    _, _, result = _run_program("(program () (defmacro seal () SEAL) (seal))")
-    assert result == CONDITION_CONSTANTS["SEAL"]
-
-
-def test_macro_quoted_output_passes_verbatim():
-    # The expansion is (q . "X"): quote-headed output stays data
-    # even though its bytes spell an in-scope parameter name.
-    _, _, result = _run_program(
-        "(program (X) (defmacro lit () (c (q . 1) 'X')) (lit))", "(7)"
-    )
-    assert result == b"X"
-
-
-def test_qq_in_ordinary_code_builds_data():
-    _, _, result = _run_program("(program (X) (qq (foo (unquote X))))", "(7)")
-    assert result == (b"foo", (int_to_atom(7), NIL))
-
-
-def test_expression_compiles_against_session_macros():
-    defs = _defs("(defmacro inc (e) (qq (+ (unquote e) 1)))")
-    program, _ = compile_expression("(inc 41)", defs)
-    cost, result = run(program, NIL, BUDGET)
-    assert result == int_to_atom(42)
-
-
-def test_branching_macro_hits_the_execution_cap():
-    # Every chain stays far under the depth cap and every run far
-    # under the cost budget, but the template splices two calls to
-    # itself, doubling the work per level, so only the total
-    # execution guard stops the compile.
-    source = (
-        "(program (N) (defmacro m (n) (if n "
-        "(qq (c (unquote (c m (c (- n 1) ()))) "
-        "(unquote (c m (c (- n 1) ()))))) (q . 1))) (m 20))"
-    )
-    with pytest.raises(CompileError) as excinfo:
-        compile_program(source)
-    assert f"exceeded {MACRO_EXPANSION_LIMIT} executions" in str(excinfo.value)
-
-
-def test_expansion_errors_name_the_first_declared_function():
-    # The reachability sweep runs in declaration order, so which
-    # function an expansion error is attributed to cannot vary
-    # with string-hash randomization.
-    source = (
-        "(program (X) (defmacro boom (e) (x)) "
-        "(defun zz (v) (boom v)) (defun aa (v) (boom v)) (c (zz X) (aa X)))"
-    )
-    with pytest.raises(CompileError) as excinfo:
-        compile_program(source)
-    assert str(excinfo.value).startswith("in 'zz':")
-
-
-def test_caller_written_typo_is_an_unknown_name():
-    # The caller wrote Y as a name, so it is evidence, and it
-    # resolves nowhere: the macro path reports exactly what the
-    # direct spelling would, never compiling the typo as data.
-    with pytest.raises(CompileError) as excinfo:
-        compile_program(
-            "(program (X) (defmacro inc (e) (qq (+ (unquote e) 1))) (inc Y))"
-        )
-    assert "unknown name 'Y'" in str(excinfo.value)
-
-
-def test_stale_template_name_is_a_documented_edge():
-    # A template name is beyond the one-hop typo guarantee: its
-    # provenance died at the VM boundary, so an unresolvable one
-    # is data, and in head position the operator error at least
-    # spells the bytes. The Chialisp edge, kept and documented.
-    defs = _defs("(defmacro call-gone (e) (qq (gone (unquote e))))")
-    with pytest.raises(CompileError) as excinfo:
-        compile_expression("(call-gone 1)", defs)
-    assert "unknown operator 0x676f6e65, which spells 'gone'" in str(excinfo.value)
-
-
-def test_composed_typo_is_a_documented_edge():
-    # Same boundary one hop further out: a spelling written only
-    # in an inner macro's body reaches the program world as data,
-    # so in value position it silently compiles, the documented
-    # limit of the one-hop guarantee.
-    program, _ = compile_program(
-        "(program (X) (defmacro getg () (qq Gone)) "
-        "(defmacro passg () (getg)) (+ X (passg)))"
-    )
-    assert disassemble(program) == '(+ 2 (q . "Gone"))'
-
-
-def test_deliberate_data_spellings_never_condemn_output():
-    # Names written as quoted data or template data are not typo
-    # evidence, so unrelated computed bytes in the same expansion
-    # compile exactly as Chialisp would compile them.
-    program, _ = compile_program(
-        "(program () (defmacro tag () (qq (c (q . n) (unquote (+ 100 10))))) (tag))"
-    )
-    cost, result = run(program, NIL, BUDGET)
-    assert result == (b"n", int_to_atom(110))
-    program, _ = compile_program(
-        "(program (w) (defmacro tagd (d) (c 4 (c (+ 100 10) (c d ())))) (tagd (q . n)))"
-    )
-    cost, result = run(program, (int_to_atom(1), NIL), BUDGET)
-    # The emitted (c 110 (q . n)) conses to the dotted pair whose
-    # halves are the same byte: 110 is the letter n.
-    assert result == (int_to_atom(110), b"n")
-
-
-def test_string_built_names_resolve_like_chialisp():
-    # A string-built spelling is computed bytes to the reader, so
-    # the classic rule judges it: resolving, it calls the
-    # function, and unresolving, it stays data and the head
-    # position rejects it with the spelling in the hex.
-    defs = _defs(
-        "(defun dbl (v) (* v 2))",
-        "(defmacro m (v) (c 'dbl' (c v ())))",
-    )
-    program, _ = compile_expression("(m 7)", defs)
-    cost, result = run(program, NIL, BUDGET)
-    assert result == int_to_atom(14)
-    defs = _defs("(defmacro bad () (c 'zzz' ()))")
-    with pytest.raises(CompileError) as excinfo:
-        compile_expression("(bad)", defs)
-    assert "unknown operator 0x7a7a7a, which spells 'zzz'" in str(excinfo.value)
-
-
-def test_computed_operator_bytes_error_with_their_spelling():
-    # Bytes with no evidence stay data even when they spell a
-    # would-be name, and in head position the operator error spells
-    # them so the hex is traceable: 122 is the letter z.
-    defs = _defs("(defmacro bad () (c (+ 100 22) ()))")
-    with pytest.raises(CompileError) as excinfo:
-        compile_expression("(bad)", defs)
-    assert "unknown operator 0x7a, which spells 'z'" in str(excinfo.value)
-
-
-def test_macro_params_are_not_typo_evidence():
-    # 28209 spells n1, the macro's own parameter. Parameters
-    # substitute at expansion and never reach output as their own
-    # spelling, so they are not typo evidence: the computed fold
-    # stays data instead of dying as unknown name 'n1', and
-    # renaming a macro parameter never changes what a macro can
-    # compute. With a caller n1 in scope the bytes resolve and
-    # capture, the pinned Chialisp edge.
-    program, _ = compile_program(
-        "(program (m1) (defmacro add (n1 n2) (+ n1 n2)) (add 28000 209))"
-    )
-    assert disassemble(program) == "(q . 28209)"
-    program, _ = compile_program(
-        "(program (n1) (defmacro add (n1 n2) (+ n1 n2)) (add 28209 0))"
-    )
-    assert disassemble(program) == "2"
-
-
-def test_macro_composition_defers_judgment():
-    # An earlier macro's output stays data inside the declaring
-    # macro's world when it resolves nowhere there, so composition
-    # that splices program-world names works and the spelling is
-    # judged where the program finally uses it.
-    program, _, result = _run_program(
-        "(program (X) (defconstant G 7) (defmacro getg () (qq G)) "
-        "(defmacro passg () (getg)) (+ X (passg)))",
-        "(35)",
-    )
-    assert disassemble(program) == "(+ 2 (q . 7))"
-    assert result == int_to_atom(42)
-
-
-def test_generated_template_keeps_deliberate_spellings():
-    # A macro that emits a qq template holding a bare name is
-    # generating code whose spelling is data either way, so the
-    # lifted name emits identically and nothing rejects it.
-    _, _, result = _run_program("(program (y) (defmacro gen () (qq (qq foo))) (gen))")
-    assert result == b"foo"
-
-
-def test_spliced_names_survive_quote_bytes_in_arguments():
-    # A literal 1 is the quote opcode's byte, and it must not
-    # disturb the evidence walk over the argument spine: the
-    # spliced name n still lifts and the typo variant still errs.
-    _, _, result = _run_program(
-        "(program (n) (defmacro second (u v) v) (second 1 n))", "(9)"
-    )
-    assert result == int_to_atom(9)
-    with pytest.raises(CompileError) as excinfo:
-        compile_program("(program (w) (defmacro second (u v) v) (second 1 typo))")
-    assert "unknown name 'typo'" in str(excinfo.value)
-
-
-def test_qq_levels_agree_between_expansion_and_emission():
-    # The expansion pre-pass and template emission each walk qq
-    # nesting levels, and they must locate the same escapes: the
-    # level-one unquote expands its macro call, the one under a
-    # nested qq keeps the call as spelled data.
-    _, _, result = _run_program(
-        "(program (X) (defmacro inc (e) (qq (+ (unquote e) 1))) "
-        "(qq ((unquote (inc X)) (qq (unquote (inc X))))))",
-        "(41)",
-    )
-    nested = (b"qq", ((b"unquote", ((b"inc", (b"X", NIL)), NIL)), NIL))
-    assert result == (int_to_atom(42), (nested, NIL))
-
-
-def test_macro_budget_matches_the_runner_default():
-    from bitlisp_tools import compiler, runner
-
-    assert compiler.MACRO_COST_BUDGET == runner.DEFAULT_MAX_COST
-
-
-def test_macro_cost_burst_is_reported(monkeypatch):
-    from bitlisp_tools import compiler
-
-    monkeypatch.setattr(compiler, "MACRO_COST_BUDGET", 100)
-    with pytest.raises(CompileError) as excinfo:
-        compile_program("(program () (defmacro m (e) (+ e 1)) (m 5))")
-    assert "macro 'm' failed: cost_exceeded" in str(excinfo.value)
-
-
 @pytest.mark.parametrize(
     ("source", "message"),
     [
@@ -806,49 +447,6 @@ def test_macro_cost_burst_is_reported(monkeypatch):
         ("(program (X) (defun SEAL (N) N) X)", "condition constant"),
         ("(program (X) (defun f N) X)", "defun takes 3 parts"),
         ("(program (X) (defconstant K) X)", "defconstant takes 2 parts"),
-        ("(program (X) (defmacro m N) X)", "defmacro takes 3 parts"),
-        ("(program (qq) 1)", "'qq' is a reserved word"),
-        ("(program (unquote) 1)", "'unquote' is a reserved word"),
-        ("(program (X) (defmacro list (N) N) X)", "'list' is a reserved word"),
-        (
-            "(program (X) (defmacro m (N) N) (defun m (N) N) X)",
-            "already defined",
-        ),
-        (
-            "(program (X) (defun m (N) N) (defmacro m (N) N) X)",
-            "already defined",
-        ),
-        ("(program (X) (defmacro m (N) N) (c m X))", "macro 'm' used as a value"),
-        ("(program (X) (defmacro m (N) N) (m 1 2))", "'m' takes 1 argument(s)"),
-        ("(program (X) (defmacro m (N . R) N) (m))", "at least 1 argument(s)"),
-        ("(program (X) (defmacro m (N) N) (m 1 . 2))", "proper argument list"),
-        ("(program (X) (unquote X))", "unquote outside a qq template"),
-        ("(program (X) (qq X X))", "qq takes 1 part"),
-        ("(program (X) (qq (unquote X X)))", "unquote takes 1 part"),
-        (
-            "(program (X) (defmacro m (N) (x)) (m X))",
-            "macro 'm' failed: user_raise",
-        ),
-        (
-            "(program (X) (defun dbl (v) v) (defmacro m (N) (dbl N)) (m X))",
-            "unknown name 'dbl'",
-        ),
-        (
-            "(program (X) (defconstant K 1) (defmacro m (N) K) (m X))",
-            "unknown name 'K'",
-        ),
-        (
-            "(program (X) (defmacro m (N) (uses N)) (defmacro uses (N) N) X)",
-            "unknown name 'uses'",
-        ),
-        (
-            "(program (X) (defmacro m (N) (m N)) (m X))",
-            "macro 'm' cannot be called inside its own body",
-        ),
-        (
-            "(program () (defmacro m args (qq (m 1 (unquote args)))) (m 1))",
-            f"macro expansion depth exceeded {MACRO_DEPTH_LIMIT} levels",
-        ),
     ],
 )
 def test_compile_errors(source, message):
@@ -933,29 +531,3 @@ def test_runtime_errors_stay_pinned():
     with pytest.raises(BitLispError) as excinfo:
         run(program, (int_to_atom(4), NIL), BUDGET)
     assert excinfo.value.code == "div_by_zero"
-
-
-@given(_node_trees)
-def test_macro_quoted_output_survives_arbitrary_trees(node):
-    # A macro whose value is (q . tree) expands to exactly that
-    # quoted tree for any tree: the lift never enters quote-headed
-    # output, whatever the content's bytes spell. The form is built
-    # as a tree because arbitrary bytes have no source spelling.
-    body = (b"\x04", ((b"\x01", b"\x01"), ((b"\x01", node), NIL)))
-    form = (
-        Symbol("defmacro", 0),
-        (Symbol("m", 0), (NIL, (body, NIL))),
-    )
-    defs = Definitions()
-    defs.add_defmacro(form)
-    program, _ = compile_expression("(m)", defs)
-    cost, result = run(program, NIL, BUDGET)
-    assert result == node
-
-
-@given(st.lists(st.integers(min_value=0, max_value=2**63 - 1), max_size=6))
-def test_list1_matches_builtin_list(values):
-    spelled = " ".join(str(value) for value in values)
-    macro_program, _ = compile_program(f"(program () {LIST1} (list1 {spelled}))")
-    builtin_program, _ = compile_program(f"(program () (list {spelled}))")
-    assert macro_program == builtin_program
diff --git a/python/tests/test_repl.py b/python/tests/test_repl.py
index 6e87129..0df6263 100644
--- a/python/tests/test_repl.py
+++ b/python/tests/test_repl.py
@@ -638,97 +638,6 @@ def test_defs_lists_all_three_kinds(shell, capsys):
     )
 
 
-def test_defmacro_line_and_call(shell, capsys):
-    shell.onecmd("(defmacro inc (e) (qq (+ (unquote e) 1)))")
-    assert capsys.readouterr().out == ""
-    shell.onecmd("(inc 41)")
-    assert capsys.readouterr().out.startswith("42\n")
-
-
-def test_defmacro_body_errors_print_on_its_line(shell, capsys):
-    # A macro body compiles at its declaration, in the macro world,
-    # where the session's functions are invisible. The failed line
-    # claims nothing, so the name stays free.
-    shell.onecmd("(defun dbl (N) (* 2 N))")
-    shell.onecmd("(defmacro m (e) (dbl e))")
-    assert "unknown name 'dbl'" in capsys.readouterr().out
-    shell.onecmd("(defmacro m (e) e)")
-    assert capsys.readouterr().out == ""
-
-
-def test_def_and_defmacro_share_one_namespace(shell, capsys):
-    shell.onecmd("def m (q . 1)")
-    shell.onecmd("(defmacro m (e) e)")
-    assert "'m' is already defined" in capsys.readouterr().out
-    shell.onecmd("(defmacro held (e) e)")
-    shell.onecmd("def held (q . 1)")
-    assert "'held' is already defined" in capsys.readouterr().out
-
-
-def test_undef_removes_a_macro(shell, capsys):
-    shell.onecmd("(defmacro m (e) e)")
-    shell.onecmd("undef m")
-    shell.onecmd("(m 1)")
-    assert "unknown name 'm'" in capsys.readouterr().out
-
-
-def test_defs_lists_macros_after_functions(shell, capsys):
-    shell.onecmd("(defun double (N) (* 2 N))")
-    shell.onecmd("(defmacro inc (e) (qq (+ (unquote e) 1)))")
-    shell.onecmd("defs")
-    assert capsys.readouterr().out == (
-        "(defun double (N) (* 2 N))\n(defmacro inc (e) (qq (+ (unquote e) 1)))\n"
-    )
-
-
-def test_macro_cannot_reach_def_bindings(shell, capsys):
-    # The raw path reads val as its binding, but def names are not
-    # language names: through a macro the caller-written spelling
-    # is evidence that resolves nowhere, so the general unknown
-    # name rule rejects it, one spelling never meaning two things.
-    shell.onecmd("def val (q . 5)")
-    shell.onecmd("(defmacro inc (e) (qq (+ (unquote e) 1)))")
-    shell.onecmd("(inc val)")
-    assert "unknown name 'val'" in capsys.readouterr().out
-
-
-def test_computed_def_spelling_is_rejected(shell, capsys):
-    # Any macro output atom spelling a def name is rejected,
-    # written or computed, because the raw path reads that
-    # spelling as the binding and one spelling must never mean
-    # two things. Resolution-side, the rule survives macro
-    # composition, which per-call evidence cannot.
-    shell.onecmd("def n (q . 5)")
-    shell.onecmd("(defmacro add (n1 n2) (+ n1 n2))")
-    shell.onecmd("(add 50 60)")
-    assert "unknown name 'n'" in capsys.readouterr().out
-    shell.onecmd("def val (q . 7)")
-    shell.onecmd("(defmacro getval () (qq val))")
-    shell.onecmd("(defmacro use2 () (getval))")
-    shell.onecmd("(use2)")
-    assert "unknown name 'val'" in capsys.readouterr().out
-
-
-def test_undef_breaks_template_spliced_macros(shell, capsys):
-    # inc2's template splices the spelling of inc back out, so
-    # every inc2 call needs inc again, and after undef the stale
-    # spelling is rejected with the name in the error.
-    shell.onecmd("(defmacro inc (e) (qq (+ (unquote e) 1)))")
-    shell.onecmd("(defmacro inc2 (e) (qq (inc (inc (unquote e)))))")
-    shell.onecmd("undef inc")
-    shell.onecmd("(inc2 40)")
-    out = capsys.readouterr().out
-    assert "unknown operator 0x696e63, which spells 'inc'" in out
-
-
-def test_program_form_ignores_session_macros(shell, capsys):
-    # Self-containment: a pasted program form compiles against its
-    # own declarations only, exactly as it would from a file.
-    shell.onecmd("(defmacro inc (e) (qq (+ (unquote e) 1)))")
-    shell.onecmd("eval (program (X) (inc X)) (1)")
-    assert "unknown name 'inc'" in capsys.readouterr().out
-
-
 def test_compile_command_shows_canonical_text(shell, capsys):
     shell.onecmd("(defun double (N) (* 2 N))")
     shell.onecmd("compile (double 3)")
diff --git a/vectors/vm/macro-programs.json b/vectors/vm/macro-programs.json
deleted file mode 100644
index 8920618..0000000
--- a/vectors/vm/macro-programs.json
+++ /dev/null
@@ -1,43 +0,0 @@
-{
- "schema": "bitlisp-vector-v0",
- "suite": "vm",
- "spec": "VM.md sections 3 and 4: macro-program pins, bitlisp-compile output where expansion ran at compile time, so the emitted trees hold only ordinary path lookup, apply, and operator forms",
- "cases": [
-  {
-   "name": "macro_folds_at_compile_time",
-   "program": "ff016e",
-   "env": "80",
-   "expect": {
-    "result": "6e",
-    "cost": 20
-   }
-  },
-  {
-   "name": "self_splicing_macro_builds_a_list",
-   "program": "ff04ffff0182012cffff04ffff0128ffff04ffff0132ff80808080",
-   "env": "80",
-   "expect": {
-    "result": "ff82012cff28ff3280",
-    "cost": 257
-   }
-  },
-  {
-   "name": "qq_escape_compiles_against_the_argument",
-   "program": "ff10ff02ffff010180",
-   "env": "ff2980",
-   "expect": {
-    "result": "2a",
-    "cost": 824
-   }
-  },
-  {
-   "name": "expansion_reaches_an_unnamed_function",
-   "program": "ff02ffff01ff02ff02ffff04ff02ffff04ff05ff80808080ffff04ffff01ff12ff05ffff010280ff018080",
-   "env": "ff1580",
-   "expect": {
-    "result": "2a",
-    "cost": 1683
-   }
-  }
- ]
-}

From 325f8edc3aee29b107f6bae1e647f5f7aa7edb79 Mon Sep 17 00:00:00 2001
From: Evan <evan@boon.org>
Date: Sun, 16 Aug 2026 15:46:13 -0700
Subject: [PATCH 3/7] tests+vectors: pin assert, and, or and the reserved-word
 flip

Codegen pins for every shape of the three forms, empty and
single-operand cases included: single-operand and and or emit the
identical boolean tree, pinned so a value-returning regression
fails loudly. Compile-and-run cases prove the boolean value
semantics and the short circuit with guarded raises an eager
reading would trip. Error-table rows pin the empty assert rejection
and the reserved-word claims in parameter, defun, and defconstant
position. A hypothesis property holds and and or to Python's all
and any over integer lists, empty included.

The symbol-file loader test returns flipped: assert, and, and or
are rejected as function names, and qq, reserved before this unit,
loads again, pinning the compatibility break in both directions.
REPL tests cover the raw-first retry reaching the new forms, a
failed assert printing as invalid: user_raise, def rejecting the
new reserved words, and def qq binding again.

vectors/vm/compiled-programs.json grows from 8 to 13 cases, the
compiled representatives replaying the laziness and the raise on
the consensus VM: empty forms folding to constants, and and or
short-circuiting before a guarded raise, and assert passing its
value or raising user_raise.
---
 python/tests/test_compiler.py     | 95 +++++++++++++++++++++++++++++++
 python/tests/test_repl.py         | 19 +++++++
 vectors/vm/compiled-programs.json | 44 ++++++++++++++
 3 files changed, 158 insertions(+)

diff --git a/python/tests/test_compiler.py b/python/tests/test_compiler.py
index 82c5091..269c848 100644
--- a/python/tests/test_compiler.py
+++ b/python/tests/test_compiler.py
@@ -158,6 +158,41 @@ def test_pin_condition_constant_inlines():
     assert disassemble(program) == "(q . 1)"
 
 
+def test_pin_assert_shapes():
+    # One operand has nothing to check and compiles bare. Each
+    # condition adds one lazy if level whose untaken branch is the
+    # raise.
+    program, _, _ = _run_program("(program (V) (assert V))", "(1)")
+    assert disassemble(program) == "2"
+    program, _, _ = _run_program("(program (C V) (assert C V))", "(1 7)")
+    assert disassemble(program) == "(a (i 2 (q . 5) (q 8)) 1)"
+    program, _, _ = _run_program("(program (C1 C2 V) (assert C1 C2 V))", "(1 1 7)")
+    assert disassemble(program) == "(a (i 2 (q 2 (i 5 (q . 11) (q 8)) 1) (q 8)) 1)"
+
+
+def test_pin_and_shapes():
+    # Empty and is the constant 1. Single-operand and and or emit
+    # the identical boolean-normalizing tree, pinned in both tests
+    # so a value-returning regression fails loudly.
+    program, _, _ = _run_program("(program (A) (and))", "(1)")
+    assert disassemble(program) == "(q . 1)"
+    program, _, _ = _run_program("(program (A) (and A))", "(1)")
+    assert disassemble(program) == "(a (i 2 (q 1 . 1) (q)) 1)"
+    program, _, _ = _run_program("(program (A B) (and A B))", "(1 1)")
+    assert disassemble(program) == "(a (i 2 (q 2 (i 5 (q 1 . 1) (q)) 1) (q)) 1)"
+
+
+def test_pin_or_shapes():
+    # Empty or is bare nil, the one-byte emission every nil literal
+    # gets.
+    program, _, _ = _run_program("(program (A) (or))", "(1)")
+    assert disassemble(program) == "()"
+    program, _, _ = _run_program("(program (A) (or A))", "(1)")
+    assert disassemble(program) == "(a (i 2 (q 1 . 1) (q)) 1)"
+    program, _, _ = _run_program("(program (A B) (or A B))", "(1 1)")
+    assert disassemble(program) == "(a (i 2 (q 1 . 1) (q 2 (i 5 (q 1 . 1) (q)) 1)) 1)"
+
+
 # Compile-and-run: language constructs against the reference VM.
 
 
@@ -189,6 +224,29 @@ def test_if_is_lazy():
     assert result == int_to_atom(9)
 
 
+def test_assert_passes_its_value_and_raises_on_falsy():
+    _, _, result = _run_program("(program (X) (assert X (* X 3)))", "(14)")
+    assert result == int_to_atom(42)
+    program, _ = compile_program("(program (X) (assert X (* X 3)))")
+    with pytest.raises(BitLispError) as excinfo:
+        run(program, assemble("(())"), BUDGET)
+    assert excinfo.value.code == "user_raise"
+
+
+def test_and_or_are_boolean_and_lazy():
+    # The result is 1 or nil, never an operand value, and the
+    # guarded raise proves the short circuit: an eager reading
+    # would fail.
+    _, _, result = _run_program("(program () (and 1 2))")
+    assert result == int_to_atom(1)
+    _, _, result = _run_program("(program () (or () 3))")
+    assert result == int_to_atom(1)
+    _, _, result = _run_program("(program (X) (and X (x)))", "(())")
+    assert result == NIL
+    _, _, result = _run_program("(program (X) (or X (x)))", "(1)")
+    assert result == int_to_atom(1)
+
+
 def test_destructured_parameters():
     source = "(program ((A B) C) (+ A (* B C)))"
     program, _, _ = _run_program(source, "((2 3) 10)")
@@ -349,6 +407,25 @@ def test_load_symbols_rejects(mutate):
         load_symbols(data)
 
 
+def test_load_symbols_tracks_the_reserved_words():
+    # The loader validates names against today's language, so the
+    # reserved-word set change is a compatibility break in both
+    # directions, recorded in the execution plan: a symbol file
+    # naming a function assert, and, or is rejected whole, and one
+    # naming a function qq, a spelling reserved before this unit,
+    # loads again.
+    _, table = compile_program("(program (X) (defun fun (N) (* 2 N)) (fun X))")
+    data = symbols_to_json(table)
+    (key,) = data["functions"]
+    for name in ("assert", "and", "or"):
+        data["functions"][key]["name"] = name
+        with pytest.raises(ValueError) as excinfo:
+            load_symbols(data)
+        assert "malformed function name" in str(excinfo.value)
+    data["functions"][key]["name"] = "qq"
+    assert load_symbols(data)[key][0] == "qq"
+
+
 def test_atom_bodies_stay_out_of_the_table():
     _, table = compile_program("(program (X) (defun own (N) N) (c (own X) X))")
     assert table["functions"] == {}
@@ -447,6 +524,10 @@ def test_variadic_call_binds_the_rest():
         ("(program (X) (defun SEAL (N) N) X)", "condition constant"),
         ("(program (X) (defun f N) X)", "defun takes 3 parts"),
         ("(program (X) (defconstant K) X)", "defconstant takes 2 parts"),
+        ("(program (X) (assert))", "assert takes conditions and a final value"),
+        ("(program (assert) 1)", "'assert' is a reserved word"),
+        ("(program (X) (defun and (N) N) X)", "'and' is a reserved word"),
+        ("(program (X) (defconstant or 1) X)", "'or' is a reserved word"),
     ],
 )
 def test_compile_errors(source, message):
@@ -494,6 +575,20 @@ def test_list_builds_the_literal_list(values):
     assert result == expected
 
 
+@given(st.lists(st.integers(min_value=0, max_value=3), max_size=6))
+def test_and_or_match_all_and_any(values):
+    # The boolean value semantics against Python's own fold, empty
+    # lists included, pinning that no operand value ever leaks out.
+    defs = Definitions()
+    spelled = " ".join(str(value) for value in values)
+    program, _ = compile_expression(f"(and {spelled})", defs)
+    _, result = run(program, NIL, BUDGET)
+    assert result == (int_to_atom(1) if all(values) else NIL)
+    program, _ = compile_expression(f"(or {spelled})", defs)
+    _, result = run(program, NIL, BUDGET)
+    assert result == (int_to_atom(1) if any(values) else NIL)
+
+
 _node_trees = st.recursive(
     st.binary(max_size=8), lambda child: st.tuples(child, child), max_leaves=25
 )
diff --git a/python/tests/test_repl.py b/python/tests/test_repl.py
index 0df6263..5b969b1 100644
--- a/python/tests/test_repl.py
+++ b/python/tests/test_repl.py
@@ -559,6 +559,19 @@ def test_defun_line_and_call(shell, capsys):
     assert out.startswith("42\n")
 
 
+def test_new_forms_compile_at_the_prompt(shell, capsys):
+    # assert, and, and or are unknown to the raw reader, so a bare
+    # line reaches them only through the compiler retry, exactly
+    # like if and list.
+    shell.onecmd("(and 1 2)")
+    assert capsys.readouterr().out.startswith("1\n")
+    shell.onecmd("(defun safe-div (A B) (assert B (/ A B)))")
+    shell.onecmd("(safe-div 10 2)")
+    assert capsys.readouterr().out.startswith("5\n")
+    shell.onecmd("(safe-div 10 0)")
+    assert "invalid: user_raise" in capsys.readouterr().out
+
+
 def test_raw_meaning_is_unchanged(shell, capsys):
     # Numbers in raw VM text are environment paths, and a line that
     # parses raw never reaches the compiler, definitions or not.
@@ -619,6 +632,12 @@ def test_def_and_defun_share_one_namespace(shell, capsys):
     assert "reserved by the language" in capsys.readouterr().out
     shell.onecmd("def list (q . 1)")
     assert "reserved by the language" in capsys.readouterr().out
+    shell.onecmd("def and (q . 1)")
+    assert "reserved by the language" in capsys.readouterr().out
+    # qq left the reserved words with the macro system, so the
+    # spelling is an ordinary binding again.
+    shell.onecmd("def qq (q . 1)")
+    assert capsys.readouterr().out == ""
 
 
 def test_undef_removes_declarations(shell, capsys):
diff --git a/vectors/vm/compiled-programs.json b/vectors/vm/compiled-programs.json
index 1031e6d..8af0d67 100644
--- a/vectors/vm/compiled-programs.json
+++ b/vectors/vm/compiled-programs.json
@@ -74,6 +74,50 @@
     "result": "07",
     "cost": 277
    }
+  },
+  {
+   "name": "empty_and_or_fold_to_constants",
+   "program": "ff04ffff0101ffff04ff80ff808080",
+   "env": "80",
+   "expect": {
+    "result": "ff01ff8080",
+    "cost": 210
+   }
+  },
+  {
+   "name": "and_short_circuits_before_a_raise",
+   "program": "ff02ffff03ff02ffff01ff02ffff03ffff0880ffff01ff0101ffff018080ff0180ffff018080ff0180",
+   "env": "ff8080",
+   "expect": {
+    "result": "80",
+    "cost": 301
+   }
+  },
+  {
+   "name": "or_short_circuits_before_a_raise",
+   "program": "ff02ffff03ff02ffff01ff0101ffff01ff02ffff03ffff0880ffff01ff0101ffff018080ff018080ff0180",
+   "env": "ff0180",
+   "expect": {
+    "result": "01",
+    "cost": 277
+   }
+  },
+  {
+   "name": "assert_passes_its_value",
+   "program": "ff02ffff03ff02ffff01ff12ff02ffff010380ffff01ff088080ff0180",
+   "env": "ff0e80",
+   "expect": {
+    "result": "2a",
+    "cost": 1325
+   }
+  },
+  {
+   "name": "failed_assert_raises",
+   "program": "ff02ffff03ff02ffff01ff12ff02ffff010380ffff01ff088080ff0180",
+   "env": "ff8080",
+   "expect": {
+    "error": "user_raise"
+   }
   }
  ]
 }

From 2c911d182619d162df7505c8fe687618b71437d0 Mon Sep 17 00:00:00 2001
From: Evan <evan@boon.org>
Date: Sun, 16 Aug 2026 15:46:44 -0700
Subject: [PATCH 4/7] docs: record the macro reversal and the reframed include
 deferral

The unit 6 bullet gains its reversal note, unit 6c enters the plan
as landed with the three-survey evidence summarized, unit 6b's
includes are deferred behind unit 7 with the design target reframed
to program-and-hash import on the chia-gaming evidence, and the
unit 7 style constraint and the typed v1 ledger note track the cut.
---
 docs/execution-plan.md | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/docs/execution-plan.md b/docs/execution-plan.md
index 94e2cdd..85903e4 100644
--- a/docs/execution-plan.md
+++ b/docs/execution-plan.md
@@ -79,13 +79,14 @@ descriptions, and commit messages*
 - [x] **Unit 3: REPL with stepper.** Landed 2026-08-15 (PR 49) as `bitlisp`, with `bitlisp-asm` and `bitlisp-disasm` beside it, surface stated in `docs/lang/repl.md`. Decisions by Evan, 2026-08-14: a standalone DebugMachine in the tools package, the consensus loop untouched, pinned differentially to `machine.run`; the command names; `def` is constants-only at the reader's unknown-symbol seam. The rendering seam and step-over predicate landed for unit 4 to consume.
 - [x] **Unit 4: language core.** Landed 2026-08-15 (PR 50) as the compiler, `bitlisp-compile`, and the REPL language surface, the language stated in `docs/lang/language.md`. Decisions by Evan, 2026-08-15: the module form is named `program`; `if` and `list` ship as compiler special forms; the symbol table keys on compiled-body tree hashes (refining this bullet's earlier "bytecode positions" wording); the REPL accepts source forms at the prompt under the raw-first rule, raw VM text never changing meaning. Constants inline with no optimizer, the function tree orders by declaration, one namespace covers declarations, bindings, condition constants, and reserved words. Compiled representatives pinned in `vectors/vm/compiled-programs.json`.
 - [x] **Unit 5: currying and program identity.** Added 2026-08-15 (decision by Evan, skeleton change under ground rule 6) and landed 2026-08-16 (PR 51): `curry` and `uncurry` as library, one-shot (`bitlisp-curry`, `bitlisp-uncurry`), and REPL surfaces, plus the tree-hash flag, the surfaces stated in `docs/lang/curry.md`. Decisions by Evan, 2026-08-15 and 2026-08-16: the standalone commands ship beside the REPL commands, the flag covers all three converters including `bitlisp-compile`, the identity story gets its own doc, and the surfaces are named `treehash` and `-T` rather than the `opc -H` spelling. The curried shape matches Chialisp tooling byte for byte, and uncurry is deliberately stricter than Chia's deployed uncurry, a divergence stated in the doc and pinned by a test. Discrete from unit 4 (no call-semantics contact) and from macros (operates on programs, not source). The unit 7 puzzles consume all three. The Phase 4 commitment-hash deferral stands.
-- [x] **Unit 6: macros.** Landed 2026-08-16 (PR 52) as `defmacro` with `qq` and `unquote`, classic Chialisp semantics stated in `docs/lang/macros.md`. Decisions by Evan, 2026-08-16: macros only, includes split to their own unit below (skeleton change under ground rule 6). `if` and `list` stay compiler forms, so macros cannot shadow built-ins. Expansion is depth-capped and cost-budgeted, a recorded deviation from Chialisp's unbounded expansion. No `function` or `com` reflection form, the laziness expressiveness gap recorded in the language doc. No refactor rode along, the shared emission-primitives cleanup stays a candidate for a standalone PR. Expansion runs as a source pre-pass before reachability, macro bodies compile at declaration against earlier macros only, and read-back diverges from clvm_tools by one hop only (decision by Evan, 2026-08-16, steelmanned both ways, then narrowed twice as four review rounds showed every wider evidence scheme unsound on post-reader bytes): names the caller writes in a call's own arguments error when unresolved, REPL def spellings are barred resolution-side, and capture plus stale template spellings stay as Chialisp has them, documented sharp edges. The three new reserved words are a deliberate source and symbol-file compatibility break for earlier programs that used them as names, pinned by a loader test. Compiled representatives pinned in `vectors/vm/macro-programs.json`. Kept after the 2026-08-16 public-record review (decision by Evan): the fixed special forms and capped expansion avoid the macro-built-language failure mode on that record, and re-evaluation stays open at unit 7.
-- [ ] **Unit 6b: includes.** Split from unit 6 (decision by Evan, 2026-08-16): an include mechanism needs its own recorded decision against the self-containment rule, a program compiling identically pasted into the REPL.
-- [ ] **Unit 7: the four benchmark puzzles, written in the language, as the acceptance artifact:** payment pool, async offer, vault, singleton wrapper. This phase makes them exist and run, Phase 4 measures them. One PR per puzzle where size warrants. Style constraint (decision by Evan, 2026-08-16): the puzzles prefer functions over macros, macros only where they clearly improve legibility for a hostile reader, and the authoring experience feeds the typed v1 gate's macro ledger note.
+- [x] **Unit 6: macros.** Landed 2026-08-16 (PR 52) as `defmacro` with `qq` and `unquote`, classic Chialisp semantics stated in `docs/lang/macros.md`. Decisions by Evan, 2026-08-16: macros only, includes split to their own unit below (skeleton change under ground rule 6). `if` and `list` stay compiler forms, so macros cannot shadow built-ins. Expansion is depth-capped and cost-budgeted, a recorded deviation from Chialisp's unbounded expansion. No `function` or `com` reflection form, the laziness expressiveness gap recorded in the language doc. No refactor rode along, the shared emission-primitives cleanup stays a candidate for a standalone PR. Expansion runs as a source pre-pass before reachability, macro bodies compile at declaration against earlier macros only, and read-back diverges from clvm_tools by one hop only (decision by Evan, 2026-08-16, steelmanned both ways, then narrowed twice as four review rounds showed every wider evidence scheme unsound on post-reader bytes): names the caller writes in a call's own arguments error when unresolved, REPL def spellings are barred resolution-side, and capture plus stale template spellings stay as Chialisp has them, documented sharp edges. The three new reserved words are a deliberate source and symbol-file compatibility break for earlier programs that used them as names, pinned by a loader test. Compiled representatives pinned in `vectors/vm/macro-programs.json`. Kept after the 2026-08-16 public-record review (decision by Evan): the fixed special forms and capped expansion avoid the macro-built-language failure mode on that record, and re-evaluation stays open at unit 7. Reversed by unit 6c the same day.
+- [ ] **Unit 6b: includes.** Split from unit 6 (decision by Evan, 2026-08-16): an include mechanism needs its own recorded decision against the self-containment rule, a program compiling identically pasted into the REPL. Deferred behind unit 7 evidence (decision by Evan, 2026-08-16): the usage surveys behind unit 6c showed real include demand but reframed the design target, since chia-gaming abandoned textual include for importing a compiled sibling program plus its tree hash as a compile-time constant, the mechanism that keeps a multi-puzzle system's interlocking hashes consistent. `bitlisp-compile -T` covers that need manually in v0, and the puzzles decide whether duplication or hash plumbing justifies the mechanism.
+- [x] **Unit 6c: the macro reversal.** Landed 2026-08-16 as the removal of `defmacro`, `qq`, and `unquote` and the addition of `assert`, `and`, and `or` as fixed compiler forms with classic utility_macros semantics, reversing unit 6 (decision by Evan, 2026-08-16, both sides steelmanned under ground rule 3). The evidence: three usage surveys (Chia's canonical 91-puzzle corpus, the corpora vendored in references/, and chia-gaming) found no novel macro in any deployed puzzle, short-circuit assert, and, and or the entire production vocabulary, and chia-gaming's production referee choosing built-in destructuring over the structural macro sitting unbuilt beside it. The reserved-word set change breaks compatibility in both directions, pinned by the loader test. Compiled representatives joined `vectors/vm/compiled-programs.json`, and `macro-programs.json` left with the feature.
+- [ ] **Unit 7: the four benchmark puzzles, written in the language, as the acceptance artifact:** payment pool, async offer, vault, singleton wrapper. This phase makes them exist and run, Phase 4 measures them. One PR per puzzle where size warrants. Style constraint (decision by Evan, 2026-08-16, simplified by unit 6c): the puzzles are plain functions and the fixed forms, there being no macro system, and the authoring experience feeds the typed v1 gate's ledger note on whether unit 6c's cut ever binds.
 
 **Standing constraints:**
 
-- **Hard scope boundary.** v0 is a small s-expression language with Chialisp-class ergonomics, BitLisp-native, no BLS vocabulary. Out of scope: static types, a Rue-class frontend, editor tooling, optimization beyond the obvious. The typed v1 question is a separate gate after Phase 5 review (ledger notes: 2026-08-11, types would let the REPL print by known type. 2026-08-16, whether macros carry into v1, decided on the unit 7 authoring experience).
+- **Hard scope boundary.** v0 is a small s-expression language with Chialisp-class ergonomics, BitLisp-native, no BLS vocabulary. Out of scope: static types, a Rue-class frontend, editor tooling, optimization beyond the obvious. The typed v1 question is a separate gate after Phase 5 review (ledger notes: 2026-08-11, types would let the REPL print by known type. 2026-08-16, whether the unit 6c macro cut holds for v1, decided on the unit 7 authoring experience).
 - **Compiler correctness story.** The compiler sits outside spec-before-code, but compiler bugs become fund-loss bugs for users: every construct gets compile-and-run tests against the reference VM, and every compiled benchmark puzzle is pinned as a vector the same day.
 - **Fallback, pre-registered:** if v0 slips, Phase 4 proceeds with the stock Chialisp toolchain off-tree, constrained to the CLVM intersection. The stopgap never enters the tree. The fallback covers the language units only; the front end does not slip out of the phase.
 

From 35222e53debe3c21a93411de60839d7157614f0e Mon Sep 17 00:00:00 2001
From: Evan <evan@boon.org>
Date: Sun, 16 Aug 2026 16:04:55 -0700
Subject: [PATCH 5/7] docs: derive the and chain from the compiled form

Review fold-in: the and section said each level's untaken branch is
the remaining chain, but the chain is the taken branch, and the
section showed no compiled form to correct the misreading. It now
shows the two-operand tree exactly as the vectors pin it, so the
doc alone predicts the emission.
---
 docs/lang/language.md | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/docs/lang/language.md b/docs/lang/language.md
index 9afe069..89b53b3 100644
--- a/docs/lang/language.md
+++ b/docs/lang/language.md
@@ -143,8 +143,13 @@ takes conditions and a final value".
 Yields 1 when every operand is truthy and nil at the first falsy
 operand, whose successors never evaluate. The result is boolean, 1
 or nil, never an operand's value, exactly as Chialisp's `and` macro
-behaves. `(and)` is 1. Each level compiles to a lazy `if` whose
-untaken branch is the remaining chain.
+behaves. `(and)` is 1. Each level compiles through the same idiom
+as `assert`, the remaining chain as the taken branch and nil as
+the fallback, so `(and A B)` compiles as
+
+```
+(a (i A (q 2 (i B (q 1 . 1) (q)) 1) (q)) 1)
+```
 
 ## or
 

From a3ded489b5cc101a023e89c74bcf4d3700849910 Mon Sep 17 00:00:00 2001
From: Evan <evan@boon.org>
Date: Sun, 16 Aug 2026 16:04:55 -0700
Subject: [PATCH 6/7] tools: review fold-ins on the removal's residue

Restores the unknown-operator spelling hint: the removal commit
claimed name-spelling head bytes could no longer arise, but an
authored string or hex atom in head position still produces them,
so the hint returns with its rationale corrected in place.

DECLARATION_KEYWORDS becomes the one tuple both the compiler's
declaration dispatch and the REPL's line dispatch read, closing the
drift seam the macro removal had to hand-edit across five sites.

_reachable_bodies collapses to _reachable_names, a single-pass
worklist returning the reachable set: the parallel name-to-body
dict and the restart sweep existed for expansion-error attribution,
which left with the macros, and _compile now unpacks params and
body from the one authoritative store.

The branching forms share module-level _TRUE and _RAISE_CALL
nodes, making the doc-pinned byte identity of single-operand and
and or structural rather than coincidental.
---
 python/bitlisp_tools/compiler.py | 81 ++++++++++++++++++++------------
 python/bitlisp_tools/repl.py     |  3 +-
 2 files changed, 54 insertions(+), 30 deletions(-)

diff --git a/python/bitlisp_tools/compiler.py b/python/bitlisp_tools/compiler.py
index 872367c..227d68e 100644
--- a/python/bitlisp_tools/compiler.py
+++ b/python/bitlisp_tools/compiler.py
@@ -70,6 +70,10 @@
     {_PROGRAM, _DEFUN, _DEFCONSTANT, _IF, _LIST, _ASSERT, _AND, _OR}
 )
 
+# The declaration heads a program form accepts, the one tuple the
+# REPL's line dispatch reads too, so the two surfaces cannot drift.
+DECLARATION_KEYWORDS = (_DEFUN, _DEFCONSTANT)
+
 
 # The condition vocabulary, one name per assigned opcode, written
 # out literally so a reviewer can check it by eye. A test pins the
@@ -320,7 +324,7 @@ def _form_items(form, keyword, count):
 def declaration_keyword(tree):
     """The declaration keyword heading a source tree, or None."""
     if is_pair(tree) and isinstance(tree[0], Symbol):
-        if tree[0].name in (_DEFUN, _DEFCONSTANT):
+        if tree[0].name in DECLARATION_KEYWORDS:
             return tree[0].name
     return None
 
@@ -361,26 +365,21 @@ def _check_arity(name, arguments, arity, offset):
         )
 
 
-def _reachable_bodies(defs, body):
-    """The reachable function bodies, conservatively: every name a
-    body mentions counts, shadowing ignored, so the set can only be
-    too large, never too small. An unreached body never compiles,
-    so an error inside one surfaces the first time a program
-    reaches it. The sweep runs in declaration order, restarting
-    until no new body is reached."""
-    bodies = {}
-    mentioned = _symbol_names(body)
-    changed = True
-    while changed:
-        changed = False
-        for name in defs.functions:
-            if name in bodies or name not in mentioned:
-                continue
-            _, fn_body, _ = defs.functions[name]
-            bodies[name] = fn_body
-            mentioned |= _symbol_names(fn_body)
-            changed = True
-    return bodies
+def _reachable_names(defs, body):
+    """The functions a body can reach, conservatively: every
+    mentioned name counts, shadowing ignored, so the set can only
+    be too large, never too small. An unreached body never
+    compiles, so an error inside one surfaces the first time a
+    program reaches it."""
+    reachable = set()
+    pending = _symbol_names(body)
+    while pending:
+        name = pending.pop()
+        if name in reachable or name not in defs.functions:
+            continue
+        reachable.add(name)
+        pending |= _symbol_names(defs.functions[name][1])
+    return reachable
 
 
 def _tree_paths(names, root):
@@ -440,6 +439,26 @@ def _lazy_if(condition, then_branch, else_branch):
     return _proper_list(_APPLY, selector, int_to_atom(_TOP))
 
 
+# The two constant nodes the branching forms share. Emitted trees
+# are immutable, so one node can sit in many outputs, and building
+# each once makes the byte identity of single-operand and and or
+# structural rather than coincidental.
+_TRUE = _quote(int_to_atom(1))
+_RAISE_CALL = _proper_list(_RAISE)
+
+
+def _name_spelling(atom):
+    """The name an atom's bytes spell, or None when they spell no
+    single reader-accepted name."""
+    try:
+        text = atom.decode()
+    except UnicodeDecodeError:
+        return None
+    if text and text.isprintable() and definable(text):
+        return text
+    return None
+
+
 class _Compilation:
     """One compile: the definitions and the function paths, shared
     by the main body and every function body."""
@@ -535,14 +554,14 @@ def _assert(self, head, tail, bindings):
         # evaluates and the spend fails there.
         result = compiled[-1]
         for condition in reversed(compiled[:-1]):
-            result = _lazy_if(condition, result, (_RAISE, NIL))
+            result = _lazy_if(condition, result, _RAISE_CALL)
         return result
 
     def _and(self, head, tail, bindings):
         items = _proper_items(tail, _AND, head.offset)
         # The result is boolean, 1 or nil, never an operand's
         # value, and the first falsy operand ends evaluation.
-        result = _quote(int_to_atom(1))
+        result = _TRUE
         compiled = [self.expression(item, bindings) for item in items]
         for condition in reversed(compiled):
             result = _lazy_if(condition, result, NIL)
@@ -555,7 +574,7 @@ def _or(self, head, tail, bindings):
         result = NIL
         compiled = [self.expression(item, bindings) for item in items]
         for condition in reversed(compiled):
-            result = _lazy_if(condition, _quote(int_to_atom(1)), result)
+            result = _lazy_if(condition, _TRUE, result)
         return result
 
     def _call(self, head, tail, bindings):
@@ -579,6 +598,12 @@ def _operator(self, op, tail, bindings):
         # that can never do anything but fail.
         if op != _APPLY and op not in OPERATORS:
             label = "0x" + op.hex() if op else "()"
+            # An authored string or hex atom in head position can
+            # spell a name, so the error shows what a reader would
+            # see in the hex.
+            text = _name_spelling(op)
+            if text is not None:
+                label = f"{label}, which spells {text!r}"
             raise CompileError(f"unknown operator {label}")
         name = ATOM_TO_NAME[op]
         arguments = _proper_items(tail, name)
@@ -610,7 +635,7 @@ def tree_hash(node):
 def _compile(defs, params, body):
     """The program node and symbol table for one body against one
     definitions space, params None for a bare expression."""
-    reachable = _reachable_bodies(defs, body)
+    reachable = _reachable_names(defs, body)
     fn_names = [name for name in defs.functions if name in reachable]
     has_tree = bool(fn_names)
     fn_paths = _tree_paths(fn_names, _LEFT) if has_tree else {}
@@ -624,11 +649,9 @@ def _compile(defs, params, body):
     table = {"functions": {}, "main_params": params}
     bodies = []
     for name in fn_names:
-        fn_params, _, _ = defs.functions[name]
+        fn_params, fn_body, _ = defs.functions[name]
         try:
-            compiled = compilation.expression(
-                reachable[name], _bind_params(fn_params, _RIGHT)
-            )
+            compiled = compilation.expression(fn_body, _bind_params(fn_params, _RIGHT))
         except CompileError as exc:
             # A body compiles when a program reaches it, which in
             # the REPL is a later line than the one that declared
diff --git a/python/bitlisp_tools/repl.py b/python/bitlisp_tools/repl.py
index 1c06245..3531269 100644
--- a/python/bitlisp_tools/repl.py
+++ b/python/bitlisp_tools/repl.py
@@ -69,6 +69,7 @@ def <name> <sexpr>             bind a name to a parsed node
 
 from .compiler import (
     CONDITION_CONSTANTS,
+    DECLARATION_KEYWORDS,
     RESERVED_WORDS,
     CompileError,
     Definitions,
@@ -119,7 +120,7 @@ def _declaration_line(stripped):
     return (
         len(tokens) >= 2
         and tokens[0][0] == "("
-        and tokens[1][0] in ("defun", "defconstant")
+        and tokens[1][0] in DECLARATION_KEYWORDS
     )
 
 

From 5a1c1a4d47a1661785d8850c080dd3a82e947726 Mon Sep 17 00:00:00 2001
From: Evan <evan@boon.org>
Date: Sun, 16 Aug 2026 16:04:55 -0700
Subject: [PATCH 7/7] tests: review fold-ins restoring lost pins and adding
 drift guards

The self-containment pin returns: the deleted macro test was the
only test holding a pasted program form to ignore session
definitions, a guarantee that survived the removal, so it returns
with a defun in the macro's place. A new pin transcribes the
reserved-word set literally, condition-table style, and checks
every reserved word means something in head position, so a fixed
form added to dispatch but not the reserved set fails here. The
assert run test reuses the program _run_program already compiled
instead of recompiling a duplicated literal, and the loader test's
comment no longer points at a documentation file.
---
 python/tests/test_compiler.py | 25 +++++++++++++++++++++----
 python/tests/test_repl.py     |  8 ++++++++
 2 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/python/tests/test_compiler.py b/python/tests/test_compiler.py
index 269c848..2333909 100644
--- a/python/tests/test_compiler.py
+++ b/python/tests/test_compiler.py
@@ -20,6 +20,7 @@
 from bitlisp_tools import assemble, disassemble  # noqa: E402
 from bitlisp_tools.compiler import (  # noqa: E402
     CONDITION_CONSTANTS,
+    RESERVED_WORDS,
     CompileError,
     Definitions,
     bind_values,
@@ -225,9 +226,8 @@ def test_if_is_lazy():
 
 
 def test_assert_passes_its_value_and_raises_on_falsy():
-    _, _, result = _run_program("(program (X) (assert X (* X 3)))", "(14)")
+    program, _, result = _run_program("(program (X) (assert X (* X 3)))", "(14)")
     assert result == int_to_atom(42)
-    program, _ = compile_program("(program (X) (assert X (* X 3)))")
     with pytest.raises(BitLispError) as excinfo:
         run(program, assemble("(())"), BUDGET)
     assert excinfo.value.code == "user_raise"
@@ -409,8 +409,8 @@ def test_load_symbols_rejects(mutate):
 
 def test_load_symbols_tracks_the_reserved_words():
     # The loader validates names against today's language, so the
-    # reserved-word set change is a compatibility break in both
-    # directions, recorded in the execution plan: a symbol file
+    # reserved-word set change is a deliberate, recorded
+    # compatibility break in both directions: a symbol file
     # naming a function assert, and, or is rejected whole, and one
     # naming a function qq, a spelling reserved before this unit,
     # loads again.
@@ -549,6 +549,23 @@ def test_definitions_taken_names_conflict():
     assert "'fee' is already defined" in str(excinfo.value)
 
 
+def test_reserved_words_are_pinned_and_all_dispatch():
+    # The literal set, transcribed like the condition-name table, so
+    # growing the language forces this test to grow with it. Every
+    # reserved word must mean something in head position: a fixed
+    # form added to dispatch but not the reserved set would let one
+    # spelling be claimed as a definition and hijacked at its call
+    # sites, one spelling meaning two things.
+    assert RESERVED_WORDS == frozenset(
+        {"program", "defun", "defconstant", "if", "list", "assert", "and", "or"}
+    )
+    for word in sorted(RESERVED_WORDS):
+        try:
+            compile_program(f"(program (X) ({word}))")
+        except CompileError as exc:
+            assert "unknown name" not in str(exc)
+
+
 # Properties.
 
 _atoms = st.binary(max_size=24)
diff --git a/python/tests/test_repl.py b/python/tests/test_repl.py
index 5b969b1..f1fd5bc 100644
--- a/python/tests/test_repl.py
+++ b/python/tests/test_repl.py
@@ -607,6 +607,14 @@ def test_conditions_and_list_at_the_prompt(shell, capsys):
     assert out.splitlines()[0] == f"((q 0x{SPK_P2WPKH} 600))"
 
 
+def test_program_form_ignores_session_definitions(shell, capsys):
+    # Self-containment: a pasted program form compiles against its
+    # own declarations only, exactly as it would from a file.
+    shell.onecmd("(defun inc (N) (+ N 1))")
+    shell.onecmd("eval (program (X) (inc X)) (1)")
+    assert "unknown name 'inc'" in capsys.readouterr().out
+
+
 def test_declaration_errors_print(shell, capsys):
     # An operator name resolves before the compiler sees it, so it
     # can never name a function.