diff --git a/CMakeLists.txt b/CMakeLists.txt
index 81210ad7..9d8e63e9 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -5,7 +5,7 @@ include(CheckCXXSourceCompiles)
 
 project(python++)
 
-set(CMAKE_CXX_STANDARD 20)
+set(CMAKE_CXX_STANDARD 23)
 
 include(cmake/CPM.cmake)
 
diff --git a/integration/run_python_tests.sh b/integration/run_python_tests.sh
index 94a4dc1e..3471ceb6 100755
--- a/integration/run_python_tests.sh
+++ b/integration/run_python_tests.sh
@@ -5,7 +5,7 @@
 SCRIPT_DIR="$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
 
 PYTHON_EXECUTABLE=$1
-GC_FREQUENCY=100000
+GC_FREQUENCY=${GC_FREQUENCY:-100000}
 
 # start by calling the tests that we need to work in order to trust the result of the other python tests
 if timeout 10s $PYTHON_EXECUTABLE $SCRIPT_DIR/tests/lemmas/assert_false.py --gc-frequency $GC_FREQUENCY &> /dev/null; then
diff --git a/integration/tests/dict.py b/integration/tests/dict.py
index ec6c754d..5704fdd6 100644
--- a/integration/tests/dict.py
+++ b/integration/tests/dict.py
@@ -45,3 +45,26 @@ def dict_setdefault():
     assert a["b"] == 10
 
 dict_setdefault()
+
+def dict_pop_missing_key_with_failing_repr():
+    # Regression: PyDict::pop formatted KeyError via key.__repr__() and
+    # unconditionally unwrapped the result, aborting if __repr__ raised.
+    class Bad:
+        def __hash__(self):
+            return 0
+        def __eq__(self, other):
+            return False
+        def __repr__(self):
+            raise ValueError("bad repr")
+
+    d = {}
+    raised = None
+    try:
+        d.pop(Bad())
+    except KeyError:
+        raised = "KeyError"
+    except ValueError:
+        raised = "ValueError"
+    assert raised is not None, "dict.pop on missing key with failing __repr__ must not abort"
+
+dict_pop_missing_key_with_failing_repr()
diff --git a/integration/tests/list.py b/integration/tests/list.py
index b5415cf2..bb52bdfd 100644
--- a/integration/tests/list.py
+++ b/integration/tests/list.py
@@ -23,3 +23,13 @@
     exception_raised = True
 finally:
     assert exception_raised, "list.pop with empty list should raise an IndexError"
+
+def list_recursive_repr():
+    a = []
+    a.append(a)
+    assert repr(a) == "[[...]]", "recursive list repr should use [...] sentinel"
+    # Calling repr again must drain the visited set; otherwise nested
+    # repr() would still see `a` as visited.
+    assert repr(a) == "[[...]]", "recursive list repr should be idempotent"
+
+list_recursive_repr()
diff --git a/integration/tests/weakref.py b/integration/tests/weakref.py
new file mode 100644
index 00000000..944a86f9
--- /dev/null
+++ b/integration/tests/weakref.py
@@ -0,0 +1,64 @@
+import _weakref
+import gc
+
+# A class that supports weakrefs (built-ins like int/list typically don't).
+class Foo:
+    pass
+
+def weakref_registers_and_counts():
+    f = Foo()
+    r = _weakref.ref(f)
+    # Holding a weakref does not bump the strong-ref count, but the runtime
+    # must record the registration so weakref_count is observable.
+    assert _weakref.getweakrefcount(f) == 1
+    # The weakref still resolves to the target while the target is alive.
+    assert r() is f
+
+weakref_registers_and_counts()
+
+def weakref_resolves_through_gc_collect():
+    # gc.collect() forces a full mark/sweep regardless of cadence/pause
+    # state, so this scope can deterministically check that the weakref
+    # keeps tracking the target across collection cycles.
+    f = Foo()
+    r = _weakref.ref(f)
+    gc.collect()
+    # `f` is still on the stack here, so it must survive the collection.
+    assert r() is f
+    assert _weakref.getweakrefcount(f) == 1
+
+weakref_resolves_through_gc_collect()
+
+def gc_collect_does_not_crash_when_disabled():
+    # Disabling the GC must not prevent gc.collect() from running; this
+    # mirrors CPython's gc.collect() semantics.
+    gc.disable()
+    try:
+        assert gc.isenabled() is False
+        gc.collect()
+    finally:
+        gc.enable()
+    assert gc.isenabled() is True
+
+gc_collect_does_not_crash_when_disabled()
+
+def weakref_wrapper_unregisters_on_its_own_collection():
+    # Regression test for B8. Whenever a weakref wrapper is collected,
+    # the runtime must scrub the heap's m_weakrefs table — otherwise
+    # the per-target vector accumulates dangling pointers and
+    # getweakrefcount lies. Create N immediately-unreachable wrappers
+    # and confirm the count is zero after gc.collect(). Pre-fix this
+    # interpreter reported 100/100 survived; post-fix and on CPython
+    # (which refcounts wrappers away on the spot) it reports 0/100.
+    N = 100
+    def churn(target):
+        for _ in range(N):
+            _weakref.ref(target)  # result discarded
+    t = Foo()
+    churn(t)
+    gc.collect()
+    remaining = _weakref.getweakrefcount(t)
+    assert remaining == 0, \
+        f"expected all wrappers collected, {remaining}/{N} survived"
+
+weakref_wrapper_unregisters_on_its_own_collection()
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index c31ceb1c..90b4ff04 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -144,6 +144,7 @@ set(RUNTIME_SOURCE_FILES
     runtime/modules/struct/module.cpp
     runtime/modules/SysModule.cpp
     runtime/modules/WarningsModule.cpp
+    runtime/modules/GcModule.cpp
     runtime/types/builtin.cpp
     runtime/warnings/DeprecationWarning.cpp
     runtime/warnings/ImportWarning.cpp
diff --git a/src/executable/bytecode/Bytecode.cpp b/src/executable/bytecode/Bytecode.cpp
index dc07dfdc..d1f09aa1 100644
--- a/src/executable/bytecode/Bytecode.cpp
+++ b/src/executable/bytecode/Bytecode.cpp
@@ -106,14 +106,14 @@ PyResult<Value> Bytecode::call_without_setup(VirtualMachine &vm, Interpreter &in
 	// create main stack frame
 	ASSERT(!vm.stack().empty());
 
-	constexpr auto sentinel = decltype(vm.stack().top().get().last_instruction_pointer)();
-	if (vm.stack().top().get().last_instruction_pointer == sentinel) {
+	constexpr auto sentinel = decltype(vm.stack().back().get().last_instruction_pointer)();
+	if (vm.stack().back().get().last_instruction_pointer == sentinel) {
 		// first time calling with the stack frame, so we don't have a last instruction pointer yet
 		vm.set_instruction_pointer(begin());
 	} else {
 		// otherwise resume execution, by starting execution from the instruction after the last run
 		// instruction
-		vm.set_instruction_pointer(vm.stack().top().get().last_instruction_pointer + 1);
+		vm.set_instruction_pointer(vm.stack().back().get().last_instruction_pointer + 1);
 	}
 
 	return eval_loop(vm, interpreter);
diff --git a/src/interpreter/Interpreter.cpp b/src/interpreter/Interpreter.cpp
index ad60b8a1..eb43d508 100644
--- a/src/interpreter/Interpreter.cpp
+++ b/src/interpreter/Interpreter.cpp
@@ -269,7 +269,7 @@ PyModule *Interpreter::get_imported_module(PyString *name) const
 ScopedStack::~ScopedStack()
 {
 	auto &vm = VirtualMachine::the();
-	if (!vm.stack().empty() && top_frame && &vm.stack().top().get() == top_frame.get()) {
+	if (!vm.stack().empty() && top_frame && &vm.stack().back().get() == top_frame.get()) {
 		vm.pop_frame(true);
 	}
 }
diff --git a/src/memory/GarbageCollector.cpp b/src/memory/GarbageCollector.cpp
index a7de26c6..fd0d334e 100644
--- a/src/memory/GarbageCollector.cpp
+++ b/src/memory/GarbageCollector.cpp
@@ -59,27 +59,38 @@ __attribute__((no_sanitize_address)) std::stack<Cell *> collect_roots_on_the_sta
 {
 	std::stack<Cell *> roots;
 
-	// push register values onto the stack
+	// Spill all callee-saved registers into `jump_buffer`. setjmp captures
+	// them as part of saving the calling environment.
 	std::jmp_buf jump_buffer;
 	setjmp(jump_buffer);
 
-	// traverse the stack from the stack pointer to the stack origin/bottom
-	// uintptr_t *rsp_;
-	// asm volatile("movq %%rsp, %0" : "=r"(rsp_));
+	auto scan_range = [&](uint8_t *begin, uint8_t *end) {
+		for (uint8_t *p = begin; p < end; p += sizeof(uintptr_t)) {
+			uint8_t *address =
+				bit_cast_without_sanitizer<uint8_t *>(*bit_cast_without_sanitizer<uintptr_t *>(p))
+				- sizeof(GarbageCollected);
+			spdlog::trace("checking address {}, pointer address={}", (void *)address, (void *)p);
+			if (heap.slab().has_address(address)) {
+				spdlog::trace("valid address {}", (void *)address);
+				auto *obj_header = bit_cast<GarbageCollected *>(address);
+				add_root(obj_header, roots);
+			}
+		}
+	};
 
-	// uint8_t *rsp = bit_cast<uint8_t *>(rsp_);
+	// jump_buffer is a local variable, so it sits below the current frame
+	// pointer on stacks that grow downward. The frame-pointer-to-stack-bottom
+	// scan below therefore skips it, which would lose any GC root whose only
+	// live reference is in a callee-saved register at this point. Scan the
+	// buffer's bytes explicitly to recover those spilled values.
+	auto *jb_begin = bit_cast_without_sanitizer<uint8_t *>(&jump_buffer);
+	scan_range(jb_begin, jb_begin + sizeof(jump_buffer));
+
+	// Traverse the stack from the current frame pointer up to the recorded
+	// stack bottom; this covers everything in our callers' frames.
 	uint8_t *rsp = bit_cast_without_sanitizer<uint8_t *>(__builtin_frame_address(0));
-	for (; rsp < stack_bottom; rsp += sizeof(uintptr_t)) {
-		uint8_t *address =
-			bit_cast_without_sanitizer<uint8_t *>(*bit_cast_without_sanitizer<uintptr_t *>(rsp))
-			- sizeof(GarbageCollected);
-		spdlog::trace("checking address {}, pointer address={}", (void *)address, (void *)rsp);
-		if (heap.slab().has_address(address)) {
-			spdlog::trace("valid address {}", (void *)address);
-			auto *obj_header = bit_cast<GarbageCollected *>(address);
-			add_root(obj_header, roots);
-		}
-	}
+	scan_range(rsp, stack_bottom);
+
 	spdlog::debug("Done collecting roots from the stack, found {} roots", roots.size());
 	return roots;
 }
@@ -149,20 +160,27 @@ struct MarkGCVisitor : Cell::Visitor
 	Heap &m_heap;
 	std::stack<Cell *> &m_to_visit;
 
+	// Collects the 1-hop neighbours of a given cell. visit_graph(visitor) on
+	// the root invokes Visitor::visit() for each thing the root references
+	// (which, by convention, may include the root itself for leaf cells); the
+	// `m_collecting` gate isolates those nested calls so only direct
+	// neighbours land in the vector and we do not recurse further.
 	struct NeighbourVisitor : Cell::Visitor
 	{
 		std::vector<Cell *> m_neighbours;
-		size_t m_depth{ 0 };
+		bool m_collecting{ false };
 
-		void visit(Cell &cell)
+		void collect_neighbours_of(Cell &root)
 		{
-			m_depth++;
-			if (m_depth == 1) {
-				cell.visit_graph(*this);
-			} else if (m_depth == 2) {
-				m_neighbours.push_back(&cell);
-			}
-			m_depth--;
+			m_neighbours.clear();
+			m_collecting = true;
+			root.visit_graph(*this);
+			m_collecting = false;
+		}
+
+		void visit(Cell &cell) override
+		{
+			if (m_collecting) { m_neighbours.push_back(&cell); }
 		}
 	};
 
@@ -174,7 +192,7 @@ struct MarkGCVisitor : Cell::Visitor
 
 		if (!is_static_memory(cell_start, m_heap)) {
 			NeighbourVisitor nv{};
-			nv.visit(cell);
+			nv.collect_neighbours_of(cell);
 			auto &neighbours = nv.m_neighbours;
 			spdlog::trace("node: {}", static_cast<void *>(&cell));
 			for (auto *neighbour : neighbours) {
@@ -212,8 +230,15 @@ struct MarkGCVisitor : Cell::Visitor
 
 void MarkSweepGC::mark_all_cell_unreachable(Heap &heap) const
 {
-	// TODO: once the ideal block sizes are fixed there should be an iterator
-	//       returning a list of all blocks
+	// NOTE: this site intentionally does NOT use Slab::for_each_block. Doing
+	// so produces a stack layout (lambda captures across inlining) that
+	// keeps a Block pointer alive in a slot the next collect_roots scan
+	// reads as a heap root, regressing
+	// TestHeap.GarbageCollectorDeallocatesGCPointersWhenStackFrameIsPopped.
+	// The conservative-GC fragility this exposes is the underlying issue;
+	// until it is replaced by a precise RootSet, keep the explicit array
+	// here so the test stays green. The other sweep/has_address sites are
+	// fine because they run after the scan, not before.
 	std::array blocks = {
 		std::reference_wrapper{ heap.slab().block_16() },
 		std::reference_wrapper{ heap.slab().block_32() },
@@ -262,21 +287,8 @@ void MarkSweepGC::sweep(Heap &heap) const
 {
 	spdlog::trace("MarkSweepGC::sweep start");
 
-	// TODO: once the ideal block sizes are fixed there should be an iterator
-	//       returning a list of all blocks
-	std::array blocks = {
-		std::reference_wrapper{ heap.slab().block_16() },
-		std::reference_wrapper{ heap.slab().block_32() },
-		std::reference_wrapper{ heap.slab().block_64() },
-		std::reference_wrapper{ heap.slab().block_128() },
-		std::reference_wrapper{ heap.slab().block_256() },
-		std::reference_wrapper{ heap.slab().block_512() },
-		std::reference_wrapper{ heap.slab().block_1024() },
-		std::reference_wrapper{ heap.slab().block_2048() },
-	};
-	// sweep all the dead objects
-	for (const auto &block : blocks) {
-		for (auto &chunk : block.get()->chunks()) {
+	heap.slab().for_each_block([this, &heap](Block &block) {
+		for (auto &chunk : block.chunks()) {
 			chunk.for_each_cell_alive([this, &chunk, &heap](uint8_t *memory) {
 				auto *header = bit_cast<GarbageCollected *>(memory);
 				if (header->white()) {
@@ -293,27 +305,29 @@ void MarkSweepGC::sweep(Heap &heap) const
 				}
 			});
 		}
-	}
+	});
 	spdlog::trace("MarkSweepGC::sweep done");
 }
 
 
-void MarkSweepGC::run(Heap &heap) const
+void MarkSweepGC::mark_and_sweep(Heap &heap)
 {
-	if (m_pause) { return; }
-	if (++m_iterations_since_last_sweep < m_frequency) { return; }
-
 	mark_all_cell_unreachable(heap);
-
 	auto roots = collect_roots(heap);
-
 	mark_all_live_objects(heap, std::move(roots));
-
 	sweep(heap);
-
 	m_iterations_since_last_sweep = 0;
 }
 
+void MarkSweepGC::run(Heap &heap)
+{
+	if (m_pause) { return; }
+	if (++m_iterations_since_last_sweep < m_frequency) { return; }
+	mark_and_sweep(heap);
+}
+
+void MarkSweepGC::force_run(Heap &heap) { mark_and_sweep(heap); }
+
 void MarkSweepGC::resume()
 {
 	ASSERT(!is_active());
diff --git a/src/memory/GarbageCollector.hpp b/src/memory/GarbageCollector.hpp
index 865d6844..113936da 100644
--- a/src/memory/GarbageCollector.hpp
+++ b/src/memory/GarbageCollector.hpp
@@ -64,7 +64,15 @@ class GarbageCollector
 {
   public:
 	virtual ~GarbageCollector() = default;
-	virtual void run(Heap &) const = 0;
+	// Not const: a GC pass advances the collector's per-call cadence
+	// counter, flips every cell's mark colour, and may destroy a large
+	// chunk of the heap. Pretending the GC instance is immutable across
+	// the call is a const-correctness lie that this signature avoids.
+	virtual void run(Heap &) = 0;
+	// Unconditional collection. Bypasses both the pause flag and the
+	// cadence counter; used by gc.collect() so user code can force a
+	// full sweep even while the GC has been disabled.
+	virtual void force_run(Heap &) = 0;
 	virtual void resume() = 0;
 	virtual void pause() = 0;
 	virtual bool is_active() const = 0;
@@ -81,7 +89,8 @@ class MarkSweepGC : public GarbageCollector
 {
   public:
 	MarkSweepGC();
-	void run(Heap &) const override;
+	void run(Heap &) override;
+	void force_run(Heap &) override;
 	void resume() override;
 	void pause() override;
 	bool is_active() const override;
@@ -92,7 +101,11 @@ class MarkSweepGC : public GarbageCollector
 	void sweep(Heap &heap) const;
 
   private:
+	void mark_and_sweep(Heap &);
+
+	// Lazily initialised once on first collect_roots; afterwards immutable.
+	// `mutable` is the textbook one-time-cache use case.
 	mutable uint8_t *m_stack_bottom{ nullptr };
-	mutable size_t m_iterations_since_last_sweep{ 0 };
+	size_t m_iterations_since_last_sweep{ 0 };
 	bool m_pause{ false };
 };
diff --git a/src/memory/GarbageCollector_tests.cpp b/src/memory/GarbageCollector_tests.cpp
index ae363a9a..f5591ba3 100644
--- a/src/memory/GarbageCollector_tests.cpp
+++ b/src/memory/GarbageCollector_tests.cpp
@@ -77,4 +77,52 @@ TEST_F(TestHeap, GarbageCollectorDeallocatesGCPointersWhenStackFrameIsPopped)
 	m_heap->collect_garbage();
 
 	ASSERT_EQ(g_counter, 5);
-}
\ No newline at end of file
+}
+
+namespace {
+
+struct Cycle : Cell
+{
+	Cycle *other{ nullptr };
+	int64_t &counter;
+	explicit Cycle(int64_t &counter_) : counter(counter_) {}
+	~Cycle() { counter++; }
+	std::string to_string() const override { return "Cycle"; }
+	void visit_graph(Visitor &visitor) override
+	{
+		visitor.visit(*this);
+		if (other) { visitor.visit(*other); }
+	}
+};
+
+// Allocates two mutually-referencing Cycle objects in a popped frame so
+// the conservative stack scan can't keep them alive past return.
+#if defined(__clang__)
+__attribute__((noinline, optnone)) void allocate_cycle_in_popped_frame(Heap &heap, int64_t &counter)
+#elif defined(__GNUC__)
+__attribute__((noinline, optimize("-O0"))) void allocate_cycle_in_popped_frame(Heap &heap,
+	int64_t &counter)
+#endif
+{
+	auto *a = heap.allocate<Cycle>(counter);
+	auto *b = heap.allocate<Cycle>(counter);
+	a->other = b;
+	b->other = a;
+}
+
+}// namespace
+
+TEST_F(TestHeap, MutuallyReferencingObjectsAreCollected)
+{
+	// Two Cycle objects pointing at each other should be collected once
+	// no external roots reach them — this is the canonical mark-sweep
+	// reachability test that a refcount-only GC would fail.
+	int64_t counter = 0;
+	m_heap->garbage_collector().set_frequency(1);
+
+	allocate_cycle_in_popped_frame(*m_heap, counter);
+
+	m_heap->collect_garbage();
+
+	ASSERT_EQ(counter, 2);
+}
diff --git a/src/memory/Heap.cpp b/src/memory/Heap.cpp
index 5d3292a3..0b1434d1 100644
--- a/src/memory/Heap.cpp
+++ b/src/memory/Heap.cpp
@@ -137,24 +137,17 @@ void Block::deallocate(uint8_t *ptr)
 
 bool Slab::has_address(uint8_t *address) const
 {
-	// TODO: once the ideal block sizes are fixed there should be an iterator
-	//       returning a list of all blocks
-	std::array blocks = {
-		block16.get(),
-		block32.get(),
-		block64.get(),
-		block128.get(),
-		block256.get(),
-		block512.get(),
-		block1024.get(),
-		block2048.get(),
-	};
-	for (const auto &block : blocks) {
-		for (auto &chunk : block->chunks()) {
-			if (chunk.has_address(address)) { return true; }
+	bool found = false;
+	for_each_block([&](const Block &block) {
+		if (found) { return; }
+		for (const auto &chunk : block.chunks()) {
+			if (chunk.has_address(address)) {
+				found = true;
+				return;
+			}
 		}
-	}
-	return false;
+	});
+	return found;
 }
 
 Heap::Heap()
diff --git a/src/memory/Heap.hpp b/src/memory/Heap.hpp
index 75eceb73..abdf17d6 100644
--- a/src/memory/Heap.hpp
+++ b/src/memory/Heap.hpp
@@ -4,6 +4,8 @@
 #include "runtime/forward.hpp"
 #include "utilities.hpp"
 
+#include <algorithm>
+#include <array>
 #include <bitset>
 #include <cstdint>
 #include <memory>
@@ -98,8 +100,7 @@ class Block
 		void deallocate(uint8_t *ptr)
 		{
 			uintptr_t start = bit_cast<uintptr_t>(m_memory);
-			uintptr_t end =
-				bit_cast<uintptr_t>(m_memory + (m_object_size + 1) * ChunkView<>::ChunkCount);
+			uintptr_t end = bit_cast<uintptr_t>(m_memory + m_object_size * ChunkView<>::ChunkCount);
 			ASSERT(bit_cast<uintptr_t>(ptr) >= start && bit_cast<uintptr_t>(ptr) < end);
 			ASSERT((bit_cast<uintptr_t>(ptr) - start) % m_object_size == 0);
 
@@ -160,6 +161,7 @@ class Block
 	void deallocate(uint8_t *ptr);
 
 	std::vector<Chunk> &chunks() { return m_chunks; }
+	const std::vector<Chunk> &chunks() const { return m_chunks; }
 
 	size_t object_size() const { return m_chunks.back().object_size(); }
 
@@ -171,47 +173,58 @@ class Block
 class Slab
 {
   public:
+	static constexpr std::array<size_t, 8> kBlockSizes{ 16, 32, 64, 128, 256, 512, 1024, 2048 };
+	static constexpr size_t kBlockCount = kBlockSizes.size();
+
 	Slab()
 	{
-		block16 = std::make_unique<Block>(16, 1000);
-		block32 = std::make_unique<Block>(32, 1000);
-		block64 = std::make_unique<Block>(64, 1000);
-		block128 = std::make_unique<Block>(128, 1000);
-		block256 = std::make_unique<Block>(256, 1000);
-		block512 = std::make_unique<Block>(512, 1000);
-		block1024 = std::make_unique<Block>(1024, 1000);
-		block2048 = std::make_unique<Block>(2048, 1000);
+		for (size_t i = 0; i < kBlockCount; ++i) {
+			m_blocks[i] = std::make_unique<Block>(kBlockSizes[i], 1000);
+		}
 	}
 
-	std::unique_ptr<Block> &block_16() { return block16; }
-	std::unique_ptr<Block> &block_32() { return block32; }
-	std::unique_ptr<Block> &block_64() { return block64; }
-	std::unique_ptr<Block> &block_128() { return block128; }
-	std::unique_ptr<Block> &block_256() { return block256; }
-	std::unique_ptr<Block> &block_512() { return block512; }
-	std::unique_ptr<Block> &block_1024() { return block1024; }
-	std::unique_ptr<Block> &block_2048() { return block2048; }
+	std::unique_ptr<Block> &block_16() { return m_blocks[0]; }
+	std::unique_ptr<Block> &block_32() { return m_blocks[1]; }
+	std::unique_ptr<Block> &block_64() { return m_blocks[2]; }
+	std::unique_ptr<Block> &block_128() { return m_blocks[3]; }
+	std::unique_ptr<Block> &block_256() { return m_blocks[4]; }
+	std::unique_ptr<Block> &block_512() { return m_blocks[5]; }
+	std::unique_ptr<Block> &block_1024() { return m_blocks[6]; }
+	std::unique_ptr<Block> &block_2048() { return m_blocks[7]; }
+
+	template<typename F> void for_each_block(F &&f)
+	{
+		for (auto &b : m_blocks) { f(*b); }
+	}
+	template<typename F> void for_each_block(F &&f) const
+	{
+		for (const auto &b : m_blocks) { f(*b); }
+	}
 
 	template<typename T>
 	uint8_t *allocate()
 		requires std::is_base_of_v<Cell, T>
 	{
 		spdlog::trace("Allocating Cell object memory for object of size {}", sizeof(T));
-		if constexpr (sizeof(T) + sizeof(GarbageCollected) <= 16) { return block16->allocate(); }
-		if constexpr (sizeof(T) + sizeof(GarbageCollected) <= 32) { return block32->allocate(); }
-		if constexpr (sizeof(T) + sizeof(GarbageCollected) <= 64) { return block64->allocate(); }
-		if constexpr (sizeof(T) + sizeof(GarbageCollected) <= 128) { return block128->allocate(); }
-		if constexpr (sizeof(T) + sizeof(GarbageCollected) <= 256) { return block256->allocate(); }
-		if constexpr (sizeof(T) + sizeof(GarbageCollected) <= 512) { return block512->allocate(); }
-		if constexpr (sizeof(T) + sizeof(GarbageCollected) <= 1024) {
-			return block1024->allocate();
-		}
-		if constexpr (sizeof(T) + sizeof(GarbageCollected) <= 2048) {
-			return block2048->allocate();
+		constexpr size_t needed = sizeof(T) + sizeof(GarbageCollected);
+		static_assert(needed <= kBlockSizes.back(),
+			"only object sizes <= 2048 bytes are currently supported");
+		if constexpr (needed <= 16) {
+			return m_blocks[0]->allocate();
+		} else if constexpr (needed <= 32) {
+			return m_blocks[1]->allocate();
+		} else if constexpr (needed <= 64) {
+			return m_blocks[2]->allocate();
+		} else if constexpr (needed <= 128) {
+			return m_blocks[3]->allocate();
+		} else if constexpr (needed <= 256) {
+			return m_blocks[4]->allocate();
+		} else if constexpr (needed <= 512) {
+			return m_blocks[5]->allocate();
+		} else if constexpr (needed <= 1024) {
+			return m_blocks[6]->allocate();
 		} else {
-			[]<bool flag = false>() {
-				static_assert(flag, "only object sizes <= 2048 bytes are currently supported");
-			}();
+			return m_blocks[7]->allocate();
 		}
 	}
 
@@ -220,32 +233,11 @@ class Slab
 		requires std::is_base_of_v<Cell, T>
 	{
 		spdlog::trace("Allocating Cell object memory for object of size {}", sizeof(T));
-		if (sizeof(T) + extra_bytes + sizeof(GarbageCollected) <= 16) {
-			return block16->allocate();
-		}
-		if (sizeof(T) + extra_bytes + sizeof(GarbageCollected) <= 32) {
-			return block32->allocate();
-		}
-		if (sizeof(T) + extra_bytes + sizeof(GarbageCollected) <= 64) {
-			return block64->allocate();
-		}
-		if (sizeof(T) + extra_bytes + sizeof(GarbageCollected) <= 128) {
-			return block128->allocate();
-		}
-		if (sizeof(T) + extra_bytes + sizeof(GarbageCollected) <= 256) {
-			return block256->allocate();
-		}
-		if (sizeof(T) + extra_bytes + sizeof(GarbageCollected) <= 512) {
-			return block512->allocate();
-		}
-		if (sizeof(T) + extra_bytes + sizeof(GarbageCollected) <= 1024) {
-			return block1024->allocate();
-		}
-		if (sizeof(T) + extra_bytes + sizeof(GarbageCollected) <= 2048) {
-			return block2048->allocate();
-		} else {
-			TODO();
+		const size_t needed = sizeof(T) + extra_bytes + sizeof(GarbageCollected);
+		for (size_t i = 0; i < kBlockCount; ++i) {
+			if (needed <= kBlockSizes[i]) { return m_blocks[i]->allocate(); }
 		}
+		TODO();
 	}
 
 	template<typename T> uint8_t *allocate()
@@ -254,50 +246,17 @@ class Slab
 			static_assert(flag, "only GC collected objects are currently supported");
 		}();
 		return nullptr;
-
-		// uint8_t *ptr{ nullptr };
-		// spdlog::debug("Allocating memory for object of size {}", sizeof(T));
-		// if constexpr (sizeof(T) <= 16) { ptr = block16->allocate(); }
-		// if constexpr (sizeof(T) <= 32) { ptr = block32->allocate(); }
-		// if constexpr (sizeof(T) <= 64) { ptr = block64->allocate(); }
-		// if constexpr (sizeof(T) <= 128) { ptr = block128->allocate(); }
-		// if constexpr (sizeof(T) <= 256) { ptr = block256->allocate(); }
-		// if constexpr (sizeof(T) <= 512) {
-		// 	return block512->allocate();
-		// } else {
-		// 	[]<bool flag = false>()
-		// 	{
-		// 		static_assert(flag, "only object sizes <= 512 bytes are currently supported");
-		// 	}
-		// 	();
-		// }
-		// new (ptr + sizeof(GarbageCollected)) T(std::forward<Args>(args)...);
-		// return ptr;
 	}
 
 	bool has_address(uint8_t *addr) const;
 
 	void reset()
 	{
-		block16->reset();
-		block32->reset();
-		block64->reset();
-		block128->reset();
-		block256->reset();
-		block512->reset();
-		block1024->reset();
-		block2048->reset();
+		for (auto &b : m_blocks) { b->reset(); }
 	}
 
   private:
-	std::unique_ptr<Block> block16{ nullptr };
-	std::unique_ptr<Block> block32{ nullptr };
-	std::unique_ptr<Block> block64{ nullptr };
-	std::unique_ptr<Block> block128{ nullptr };
-	std::unique_ptr<Block> block256{ nullptr };
-	std::unique_ptr<Block> block512{ nullptr };
-	std::unique_ptr<Block> block1024{ nullptr };
-	std::unique_ptr<Block> block2048{ nullptr };
+	std::array<std::unique_ptr<Block>, kBlockCount> m_blocks;
 };
 
 class Heap
@@ -432,6 +391,19 @@ class Heap
 		return {};
 	}
 
+	// Called from a weakref wrapper's destructor when the wrapper itself
+	// (not the target) is being collected. Without this, m_weakrefs[target]
+	// would retain a dangling pointer that getweakrefs/getweakrefcount
+	// would later hand back to user code.
+	void unregister_weakref(uint8_t *target, py::PyObject *wrapper)
+	{
+		auto it = m_weakrefs.find(target);
+		if (it == m_weakrefs.end()) { return; }
+		auto &wrappers = it->second;
+		wrappers.erase(std::remove(wrappers.begin(), wrappers.end(), wrapper), wrappers.end());
+		if (wrappers.empty()) { m_weakrefs.erase(it); }
+	}
+
   private:
 	uint8_t *allocate_gc(uint8_t *ptr) const;
 
diff --git a/src/memory/Heap_tests.cpp b/src/memory/Heap_tests.cpp
index 46b2ca60..21d2692b 100644
--- a/src/memory/Heap_tests.cpp
+++ b/src/memory/Heap_tests.cpp
@@ -71,6 +71,35 @@ TEST_F(TestHeap, AllocatesInOldBlockWhenPossible)
 	ASSERT_EQ(ptr, old_ptr);
 }
 
+TEST_F(TestHeap, DeallocatesAllChunkSlotsIncludingLast)
+{
+	// Regression test for Chunk::deallocate's bound check. The bound previously
+	// accepted pointers up to (object_size + 1) * ChunkCount past base, leaving
+	// a slack region that should not exist. Fill an entire chunk and deallocate
+	// every slot; every pointer must fall within the tight [base, base+size*N)
+	// range without firing the bound assert.
+	struct Data : Cell
+	{
+		int64_t foo;
+		Data(int64_t foo_) : foo(foo_) {}
+		std::string to_string() const override { return "Data"; }
+		void visit_graph(Visitor &) override {}
+	};
+
+	static_assert(sizeof(Data) + sizeof(GarbageCollected) > 16
+				  && sizeof(Data) + sizeof(GarbageCollected) <= 32);
+
+	[[maybe_unused]] auto scope = m_heap->scoped_gc_pause();
+
+	std::vector<Data *> data;
+	data.reserve(chunk_size);
+	for (size_t idx = 0; idx < chunk_size; ++idx) { data.push_back(m_heap->allocate<Data>(idx)); }
+
+	for (auto *d : data) {
+		m_heap->slab().block_32()->deallocate(bit_cast<uint8_t *>(d) - sizeof(GarbageCollected));
+	}
+}
+
 TEST_F(TestHeap, ResetCallsDestructorOfAllHeapAllocatecObjects)
 {
 	int64_t counter = 0;
diff --git a/src/runtime/PyByteArray.cpp b/src/runtime/PyByteArray.cpp
index be5bd773..abf56e7c 100644
--- a/src/runtime/PyByteArray.cpp
+++ b/src/runtime/PyByteArray.cpp
@@ -570,6 +570,7 @@ PyType *PyByteArrayIterator::static_type() const { return types::bytearray_itera
 
 void PyByteArrayIterator::visit_graph(Visitor &visitor)
 {
+	PyObject::visit_graph(visitor);
 	if (m_bytes) { visitor.visit(*m_bytes); }
 }
 
diff --git a/src/runtime/PyDict.cpp b/src/runtime/PyDict.cpp
index ef9f46ce..4d044cbb 100644
--- a/src/runtime/PyDict.cpp
+++ b/src/runtime/PyDict.cpp
@@ -18,7 +18,9 @@
 
 namespace py {
 
-static std::unordered_set<PyObject *> visited_dict_values;
+// Tracks dict_values currently being repr'd on this thread. Same rationale as
+// PyList::visited; drained by the RAII Cleanup in PyDictValues::__repr__.
+thread_local std::unordered_set<PyObject *> visited_dict_values;
 
 template<> PyDict *as(PyObject *obj)
 {
@@ -241,7 +243,14 @@ PyResult<PyObject *> PyDict::pop(PyObject *key, PyObject *default_value)
 	} else if (default_value) {
 		return Ok(default_value);
 	}
-	return Err(key_error("{}", key->repr().unwrap()->to_string()));
+	auto repr = key->repr();
+	if (repr.is_err()) {
+		// A failing user-defined __repr__ must not abort the process. Fall back
+		// to the type name so the caller still sees a KeyError rather than the
+		// unrelated repr exception.
+		return Err(key_error("<{} object>", key->type()->name()));
+	}
+	return Err(key_error("{}", repr.unwrap()->to_string()));
 }
 
 PyResult<std::monostate> PyDict::merge(PyObject *other, bool override)
diff --git a/src/runtime/PyFrame.cpp b/src/runtime/PyFrame.cpp
index 210cf50d..c81ccafe 100644
--- a/src/runtime/PyFrame.cpp
+++ b/src/runtime/PyFrame.cpp
@@ -141,18 +141,22 @@ PyResult<std::monostate> PyFrame::put_global(const std::string &name, const Valu
 
 PyObject *PyFrame::locals() const
 {
+	// locals() returns PyObject* and cannot propagate failures, so any
+	// errors from setitem/delitem on a non-PyDict m_locals are silently
+	// swallowed here. TODO: change locals() to PyResult<PyObject*> so
+	// __setitem__/__delitem__ exceptions surface to the caller.
 	auto insert = [this](const Value &key, const Value &value) {
 		if (auto l = as<PyDict>(m_locals)) {
 			l->insert(key, value);
 		} else {
-			m_locals->setitem(PyObject::from(key).unwrap(), PyObject::from(value).unwrap());
+			(void)m_locals->setitem(PyObject::from(key).unwrap(), PyObject::from(value).unwrap());
 		}
 	};
 	auto remove = [this](const Value &key) {
 		if (auto l = as<PyDict>(m_locals)) {
 			l->remove(key);
 		} else {
-			m_locals->delitem(PyObject::from(key).unwrap());
+			(void)m_locals->delitem(PyObject::from(key).unwrap());
 		}
 	};
 	const auto &fast_locals = VirtualMachine::the().stack_locals();
diff --git a/src/runtime/PyGenericAlias.cpp b/src/runtime/PyGenericAlias.cpp
index 723db28c..31f28183 100644
--- a/src/runtime/PyGenericAlias.cpp
+++ b/src/runtime/PyGenericAlias.cpp
@@ -94,6 +94,7 @@ PyType *PyGenericAlias::static_type() const { return types::generic_alias(); }
 
 void PyGenericAlias::visit_graph(Visitor &visitor)
 {
+	PyObject::visit_graph(visitor);
 	if (m_origin) visitor.visit(*m_origin);
 	if (m_args) visitor.visit(*m_args);
 	if (m_parameters) visitor.visit(*m_parameters);
diff --git a/src/runtime/PyList.cpp b/src/runtime/PyList.cpp
index 399da8a5..b50577f0 100644
--- a/src/runtime/PyList.cpp
+++ b/src/runtime/PyList.cpp
@@ -33,7 +33,11 @@
 
 namespace py {
 
-static std::unordered_set<PyObject *> visited;
+// Tracks lists currently being repr'd on this thread so that cyclic structures
+// emit "[...]" instead of recursing forever. Drained by the RAII Cleanup in
+// __repr__; thread_local rather than file-scope static so concurrent
+// interpreters/threads do not see each other's in-flight repr stack.
+thread_local std::unordered_set<PyObject *> visited;
 
 template<> PyList *as(PyObject *obj)
 {
@@ -131,7 +135,9 @@ PyResult<PyObject *> PyList::extend(PyObject *iterable)
 	auto *tmp_list = tmp_list_.unwrap();
 	auto value = iterator.unwrap()->next();
 	while (value.is_ok()) {
-		tmp_list->append(value.unwrap());
+		if (auto appended = tmp_list->append(value.unwrap()); appended.is_err()) {
+			return Err(appended.unwrap_err());
+		}
 		value = iterator.unwrap()->next();
 	}
 
diff --git a/src/runtime/PyObject.hpp b/src/runtime/PyObject.hpp
index df8c0e86..595f99f8 100644
--- a/src/runtime/PyObject.hpp
+++ b/src/runtime/PyObject.hpp
@@ -531,11 +531,64 @@ namespace detail {
 	size_t slot_count(PyType *);
 }
 
+namespace detail {
+	// Lazy-initialize the optional protocol structs that hold mapping /
+	// sequence / buffer slots, returning a reference to the live one.
+	inline MappingTypePrototype &ensure_mapping_proto(TypePrototype &tp)
+	{
+		if (!tp.mapping_type_protocol.has_value()) {
+			tp.mapping_type_protocol = MappingTypePrototype{};
+		}
+		return *tp.mapping_type_protocol;
+	}
+	inline SequenceTypePrototype &ensure_sequence_proto(TypePrototype &tp)
+	{
+		if (!tp.sequence_type_protocol.has_value()) {
+			tp.sequence_type_protocol = SequenceTypePrototype{};
+		}
+		return *tp.sequence_type_protocol;
+	}
+	inline PyBufferProcs &ensure_buffer_proto(TypePrototype &tp)
+	{
+		if (!tp.as_buffer.has_value()) { tp.as_buffer = PyBufferProcs{}; }
+		return *tp.as_buffer;
+	}
+}// namespace detail
+
+// Slot-installer macros. Each one expands to the same shape:
+//   if constexpr (concepts::Concept<Type>) { <slot> = +[](sig){ cast(self)->method(args...); }; }
+// The macro names encode the trampoline signature so picking the right one
+// is mechanical. Defined here as local macros for TypePrototype::create only
+// and #undef'd at the end of the function so they don't leak.
+#define PYC_SLOT_UNARY_CONST_PYOBJ(Concept, Slot, Method)                          \
+	if constexpr (concepts::Concept<Type>) {                                       \
+		type_prototype->Slot = +[](const PyObject *self) -> PyResult<PyObject *> { \
+			return static_cast<const Type *>(self)->Method();                      \
+		};                                                                         \
+	}
+#define PYC_SLOT_UNARY_PYOBJ(Concept, Slot, Method)                          \
+	if constexpr (concepts::Concept<Type>) {                                 \
+		type_prototype->Slot = +[](PyObject *self) -> PyResult<PyObject *> { \
+			return static_cast<Type *>(self)->Method();                      \
+		};                                                                   \
+	}
+#define PYC_SLOT_BINARY_CONST_PYOBJ(Concept, Slot, Method)                             \
+	if constexpr (concepts::Concept<Type>) {                                           \
+		type_prototype->Slot =                                                         \
+			+[](const PyObject *self, const PyObject *other) -> PyResult<PyObject *> { \
+			return static_cast<const Type *>(self)->Method(other);                     \
+		};                                                                             \
+	}
+#define PYC_SLOT_BINARY_PYOBJ(Concept, Slot, Method)                                          \
+	if constexpr (concepts::Concept<Type>) {                                                  \
+		type_prototype->Slot = +[](PyObject *self, PyObject *other) -> PyResult<PyObject *> { \
+			return static_cast<Type *>(self)->Method(other);                                  \
+		};                                                                                    \
+	}
+
 template<typename Type, typename... Args>
 std::unique_ptr<TypePrototype> TypePrototype::create(std::string_view name, Args &&...args)
 {
-	using namespace concepts;
-
 	auto type_prototype = std::make_unique<TypePrototype>();
 	type_prototype->__name__ = std::string(name);
 	type_prototype->__bases__ = std::vector<PyType *>{ args... };
@@ -552,390 +605,196 @@ std::unique_ptr<TypePrototype> TypePrototype::create(std::string_view name, Args
 		if (!obj) { return Err(memory_error(sizeof(Type))); }
 		return Ok(obj);
 	};
-	if constexpr (HasRepr<Type>) {
-		type_prototype->__repr__ = +[](const PyObject *self) -> PyResult<PyObject *> {
-			return static_cast<const Type *>(self)->__repr__();
-		};
-	}
-	if constexpr (HasCall<Type>) {
+
+	// Plain slots that follow the standard `cast(self)->__x__(args)` shape.
+	PYC_SLOT_UNARY_CONST_PYOBJ(HasRepr, __repr__, __repr__)
+	PYC_SLOT_UNARY_CONST_PYOBJ(HasIter, __iter__, __iter__)
+	PYC_SLOT_UNARY_PYOBJ(HasNext, __next__, __next__)
+	PYC_SLOT_UNARY_PYOBJ(HasStr, __str__, __str__)
+	PYC_SLOT_UNARY_CONST_PYOBJ(HasAbs, __abs__, __abs__)
+	PYC_SLOT_UNARY_CONST_PYOBJ(HasNeg, __neg__, __neg__)
+	PYC_SLOT_UNARY_CONST_PYOBJ(HasPos, __pos__, __pos__)
+	PYC_SLOT_UNARY_CONST_PYOBJ(HasInvert, __invert__, __invert__)
+	PYC_SLOT_BINARY_CONST_PYOBJ(HasLt, __lt__, __lt__)
+	PYC_SLOT_BINARY_CONST_PYOBJ(HasLe, __le__, __le__)
+	PYC_SLOT_BINARY_CONST_PYOBJ(HasEq, __eq__, __eq__)
+	PYC_SLOT_BINARY_CONST_PYOBJ(HasNe, __ne__, __ne__)
+	PYC_SLOT_BINARY_CONST_PYOBJ(HasGt, __gt__, __gt__)
+	PYC_SLOT_BINARY_CONST_PYOBJ(HasGe, __ge__, __ge__)
+	PYC_SLOT_BINARY_CONST_PYOBJ(HasSub, __sub__, __sub__)
+	PYC_SLOT_BINARY_CONST_PYOBJ(HasLshift, __lshift__, __lshift__)
+	PYC_SLOT_BINARY_CONST_PYOBJ(HasRshift, __rshift__, __rshift__)
+	PYC_SLOT_BINARY_CONST_PYOBJ(HasModulo, __mod__, __mod__)
+	PYC_SLOT_BINARY_PYOBJ(HasTrueDiv, __truediv__, __truediv__)
+	PYC_SLOT_BINARY_PYOBJ(HasFloorDiv, __floordiv__, __floordiv__)
+	PYC_SLOT_BINARY_PYOBJ(HasDivmod, __divmod__, __divmod__)
+	PYC_SLOT_BINARY_PYOBJ(HasAnd, __and__, __and__)
+	PYC_SLOT_BINARY_PYOBJ(HasOr, __or__, __or__)
+	PYC_SLOT_BINARY_PYOBJ(HasXor, __xor__, __xor__)
+
+	// Slots whose trampoline shape doesn't match the generic macros.
+	if constexpr (concepts::HasCall<Type>) {
 		type_prototype->__call__ =
 			+[](PyObject *self, PyTuple *args, PyDict *kwargs) -> PyResult<PyObject *> {
 			return static_cast<Type *>(self)->__call__(args, kwargs);
 		};
 	}
-	if constexpr (HasNew<Type>) {
+	if constexpr (concepts::HasNew<Type>) {
 		type_prototype->__new__ =
 			+[](const PyType *type, PyTuple *args, PyDict *kwargs) -> PyResult<PyObject *> {
 			return Type::__new__(type, args, kwargs);
 		};
 	}
-	if constexpr (HasInit<Type>) {
+	if constexpr (concepts::HasInit<Type>) {
 		type_prototype->__init__ =
 			+[](PyObject *self, PyTuple *args, PyDict *kwargs) -> PyResult<int32_t> {
 			return static_cast<Type *>(self)->__init__(args, kwargs);
 		};
 	}
-	if constexpr (HasDoc<Type>) { type_prototype->__doc__ = Type::__doc__; }
-	if constexpr (HasHash<Type>) {
+	if constexpr (concepts::HasDoc<Type>) { type_prototype->__doc__ = Type::__doc__; }
+	if constexpr (concepts::HasHash<Type>) {
 		type_prototype->__hash__ = +[](const PyObject *self) -> PyResult<int64_t> {
 			return static_cast<const Type *>(self)->__hash__();
 		};
 	}
-	if constexpr (HasLt<Type>) {
-		type_prototype->__lt__ =
-			+[](const PyObject *self, const PyObject *other) -> PyResult<PyObject *> {
-			return static_cast<const Type *>(self)->__lt__(other);
-		};
-	}
-	if constexpr (HasLe<Type>) {
-		type_prototype->__le__ =
-			+[](const PyObject *self, const PyObject *other) -> PyResult<PyObject *> {
-			return static_cast<const Type *>(self)->__le__(other);
-		};
-	}
-	if constexpr (HasEq<Type>) {
-		type_prototype->__eq__ =
-			+[](const PyObject *self, const PyObject *other) -> PyResult<PyObject *> {
-			return static_cast<const Type *>(self)->__eq__(other);
-		};
-	}
-	if constexpr (HasNe<Type>) {
-		type_prototype->__ne__ =
-			+[](const PyObject *self, const PyObject *other) -> PyResult<PyObject *> {
-			return static_cast<const Type *>(self)->__ne__(other);
-		};
-	}
-	if constexpr (HasGt<Type>) {
-		type_prototype->__gt__ =
-			+[](const PyObject *self, const PyObject *other) -> PyResult<PyObject *> {
-			return static_cast<const Type *>(self)->__gt__(other);
-		};
-	}
-	if constexpr (HasGe<Type>) {
-		type_prototype->__ge__ =
-			+[](const PyObject *self, const PyObject *other) -> PyResult<PyObject *> {
-			return static_cast<const Type *>(self)->__ge__(other);
-		};
-	}
-	if constexpr (HasIter<Type>) {
-		type_prototype->__iter__ = +[](const PyObject *self) -> PyResult<PyObject *> {
-			return static_cast<const Type *>(self)->__iter__();
-		};
-	}
-	if constexpr (HasNext<Type>) {
-		type_prototype->__next__ = +[](PyObject *self) -> PyResult<PyObject *> {
-			return static_cast<Type *>(self)->__next__();
-		};
-	}
-	if constexpr (HasLength<Type>) {
-		if (!type_prototype->mapping_type_protocol.has_value()) {
-			type_prototype->mapping_type_protocol =
-				MappingTypePrototype{ .__len__ = +[](const PyObject *self) -> PyResult<size_t> {
-					return static_cast<const Type *>(self)->__len__();
-				} };
-		} else {
-			type_prototype->mapping_type_protocol->__len__ =
-				+[](const PyObject *self) -> PyResult<size_t> {
-				return static_cast<const Type *>(self)->__len__();
-			};
-		}
-	}
-	if constexpr (HasSetItem<Type>) {
-		if (!type_prototype->mapping_type_protocol.has_value()) {
-			type_prototype->mapping_type_protocol =
-				MappingTypePrototype{ .__setitem__ =
-										  +[](PyObject *self,
-											   PyObject *name,
-											   PyObject *value) -> PyResult<std::monostate> {
-					return static_cast<Type *>(self)->__setitem__(name, value);
-				} };
-		} else {
-			type_prototype->mapping_type_protocol->__setitem__ =
-				+[](PyObject *self, PyObject *name, PyObject *value) -> PyResult<std::monostate> {
-				return static_cast<Type *>(self)->__setitem__(name, value);
-			};
-		}
-	}
-	if constexpr (HasGetItem<Type>) {
-		if (!type_prototype->mapping_type_protocol.has_value()) {
-			type_prototype->mapping_type_protocol = MappingTypePrototype{
-				.__getitem__ = +[](PyObject *self, PyObject *name) -> PyResult<PyObject *> {
-					return static_cast<Type *>(self)->__getitem__(name);
-				}
-			};
-		} else {
-			type_prototype->mapping_type_protocol->__getitem__ =
-				+[](PyObject *self, PyObject *name) -> PyResult<PyObject *> {
-				return static_cast<Type *>(self)->__getitem__(name);
-			};
-		}
-	}
-	if constexpr (HasDelItem<Type>) {
-		if (!type_prototype->mapping_type_protocol.has_value()) {
-			type_prototype->mapping_type_protocol = MappingTypePrototype{
-				.__delitem__ = +[](PyObject *self, PyObject *name) -> PyResult<std::monostate> {
-					return static_cast<Type *>(self)->__delitem__(name);
-				}
-			};
-		} else {
-			type_prototype->mapping_type_protocol->__delitem__ =
-				+[](PyObject *self, PyObject *name) -> PyResult<std::monostate> {
-				return static_cast<Type *>(self)->__delitem__(name);
-			};
-		}
-	}
-	if constexpr (HasContains<Type>) {
-		if (!type_prototype->sequence_type_protocol.has_value()) {
-			type_prototype->sequence_type_protocol =
-				SequenceTypePrototype{ .__contains__ =
-										   +[](PyObject *self, PyObject *value) -> PyResult<bool> {
-					return static_cast<Type *>(self)->__contains__(value);
-				} };
-		} else {
-			type_prototype->sequence_type_protocol->__contains__ =
-				+[](PyObject *self, PyObject *value) -> PyResult<bool> {
-				return static_cast<Type *>(self)->__contains__(value);
-			};
-		}
-	}
-	if constexpr (HasSequenceGetItem<Type>) {
-		if (!type_prototype->sequence_type_protocol.has_value()) {
-			type_prototype->sequence_type_protocol = SequenceTypePrototype{
-				.__getitem__ = +[](PyObject *self, int64_t index) -> PyResult<PyObject *> {
-					return static_cast<Type *>(self)->__getitem__(index);
-				}
-			};
-		} else {
-			type_prototype->sequence_type_protocol->__getitem__ =
-				+[](PyObject *self, int64_t index) -> PyResult<PyObject *> {
-				return static_cast<Type *>(self)->__getitem__(index);
-			};
-		}
-	}
-	if constexpr (HasSequenceSetItem<Type>) {
-		if (!type_prototype->sequence_type_protocol.has_value()) {
-			type_prototype->sequence_type_protocol =
-				SequenceTypePrototype{ .__setitem__ =
-										   +[](PyObject *self,
-												int64_t index,
-												PyObject *value) -> PyResult<std::monostate> {
-					return static_cast<Type *>(self)->__setitem__(index, value);
-				} };
-		} else {
-			type_prototype->sequence_type_protocol->__setitem__ =
-				+[](PyObject *self, int64_t index, PyObject *value) -> PyResult<std::monostate> {
-				return static_cast<Type *>(self)->__setitem__(index, value);
-			};
-		}
-	}
-	if constexpr (HasSequenceDelItem<Type>) {
-		if (!type_prototype->sequence_type_protocol.has_value()) {
-			type_prototype->sequence_type_protocol = SequenceTypePrototype{
-				.__delitem__ = +[](PyObject *self, int64_t index) -> PyResult<std::monostate> {
-					return static_cast<Type *>(self)->__delitem__(index);
-				}
-			};
-		} else {
-			type_prototype->sequence_type_protocol->__delitem__ =
-				+[](PyObject *self, int64_t index) -> PyResult<std::monostate> {
-				return static_cast<Type *>(self)->__delitem__(index);
-			};
-		}
-	}
-	if constexpr (std::is_base_of_v<PySequence, Type> && HasAdd<Type>) {
-		if (!type_prototype->sequence_type_protocol.has_value()) {
-			type_prototype->sequence_type_protocol = SequenceTypePrototype{
-				.__concat__ =
-					+[](const PyObject *self, const PyObject *value) -> PyResult<PyObject *> {
-					return static_cast<const Type *>(self)->__add__(value);
-				}
-			};
-		} else {
-			type_prototype->sequence_type_protocol->__concat__ =
-				+[](const PyObject *self, const PyObject *value) -> PyResult<PyObject *> {
-				return static_cast<const Type *>(self)->__add__(value);
-			};
-		}
-	} else {
-		if constexpr (HasAdd<Type>) {
-			type_prototype->__add__ =
-				+[](const PyObject *self, const PyObject *other) -> PyResult<PyObject *> {
-				return static_cast<const Type *>(self)->__add__(other);
-			};
-		}
-	}
-	if constexpr (HasSub<Type>) {
-		type_prototype->__sub__ =
-			+[](const PyObject *self, const PyObject *other) -> PyResult<PyObject *> {
-			return static_cast<const Type *>(self)->__sub__(other);
+	if constexpr (concepts::HasBool<Type>) {
+		type_prototype->__bool__ = +[](const PyObject *self) -> PyResult<bool> {
+			return static_cast<const Type *>(self)->__bool__();
 		};
 	}
-	if constexpr (std::is_base_of_v<PySequence, Type> && HasRepeat<Type>) {
-		if (!type_prototype->sequence_type_protocol.has_value()) {
-			type_prototype->sequence_type_protocol = SequenceTypePrototype{
-				.__repeat__ = +[](const PyObject *self, size_t count) -> PyResult<PyObject *> {
-					return static_cast<const Type *>(self)->__mul__(count);
-				}
-			};
-		} else {
-			type_prototype->sequence_type_protocol->__repeat__ =
-				+[](const PyObject *self, size_t count) -> PyResult<PyObject *> {
-				return static_cast<const Type *>(self)->__mul__(count);
-			};
-		}
-	} else {
-		if constexpr (HasMul<Type>) {
-			type_prototype->__mul__ =
-				+[](const PyObject *self, const PyObject *other) -> PyResult<PyObject *> {
-				return static_cast<const Type *>(self)->__mul__(other);
-			};
-		}
-	}
-
-	if constexpr (HasPow<Type>) {
+	if constexpr (concepts::HasPow<Type>) {
 		type_prototype->__pow__ = +[](const PyObject *self,
 									   const PyObject *other,
 									   const PyObject *modulo) -> PyResult<PyObject *> {
 			return static_cast<const Type *>(self)->__pow__(other, modulo);
 		};
 	}
-	if constexpr (HasTrueDiv<Type>) {
-		type_prototype->__truediv__ = +[](PyObject *self, PyObject *other) -> PyResult<PyObject *> {
-			return static_cast<Type *>(self)->__truediv__(other);
-		};
-	}
-	if constexpr (HasFloorDiv<Type>) {
-		type_prototype->__floordiv__ =
-			+[](PyObject *self, PyObject *other) -> PyResult<PyObject *> {
-			return static_cast<Type *>(self)->__floordiv__(other);
-		};
-	}
-	if constexpr (HasLshift<Type>) {
-		type_prototype->__lshift__ =
-			+[](const PyObject *self, const PyObject *other) -> PyResult<PyObject *> {
-			return static_cast<const Type *>(self)->__lshift__(other);
-		};
-	}
-	if constexpr (HasRshift<Type>) {
-		type_prototype->__rshift__ =
-			+[](const PyObject *self, const PyObject *other) -> PyResult<PyObject *> {
-			return static_cast<const Type *>(self)->__rshift__(other);
+	if constexpr (concepts::HasGetAttro<Type>) {
+		type_prototype->__getattribute__ =
+			+[](const PyObject *self, PyObject *attr) -> PyResult<PyObject *> {
+			return static_cast<const Type *>(self)->__getattribute__(attr);
 		};
 	}
-	if constexpr (HasModulo<Type>) {
-		type_prototype->__mod__ =
-			+[](const PyObject *self, const PyObject *other) -> PyResult<PyObject *> {
-			return static_cast<const Type *>(self)->__mod__(other);
+	if constexpr (concepts::HasSetAttro<Type>) {
+		type_prototype->__setattribute__ =
+			+[](PyObject *self, PyObject *attr, PyObject *value) -> PyResult<std::monostate> {
+			return static_cast<Type *>(self)->__setattribute__(attr, value);
 		};
 	}
-	if constexpr (HasDivmod<Type>) {
-		type_prototype->__divmod__ = +[](PyObject *self, PyObject *other) -> PyResult<PyObject *> {
-			return static_cast<Type *>(self)->__divmod__(other);
+	if constexpr (concepts::HasDelAttro<Type>) {
+		type_prototype->__delattribute__ =
+			+[](PyObject *self, PyObject *attr) -> PyResult<std::monostate> {
+			return static_cast<Type *>(self)->__delattribute__(attr);
 		};
 	}
-	if constexpr (HasAnd<Type>) {
-		type_prototype->__and__ = +[](PyObject *self, PyObject *other) -> PyResult<PyObject *> {
-			return static_cast<Type *>(self)->__and__(other);
+	if constexpr (concepts::HasGet<Type>) {
+		type_prototype->__get__ =
+			+[](const PyObject *self, PyObject *instance, PyObject *owner) -> PyResult<PyObject *> {
+			return static_cast<const Type *>(self)->__get__(instance, owner);
 		};
 	}
-	if constexpr (HasOr<Type>) {
-		type_prototype->__or__ = +[](PyObject *self, PyObject *other) -> PyResult<PyObject *> {
-			return static_cast<Type *>(self)->__or__(other);
+	if constexpr (concepts::HasSet<Type>) {
+		type_prototype->__set__ =
+			+[](PyObject *self, PyObject *attribute, PyObject *value) -> PyResult<std::monostate> {
+			return static_cast<Type *>(self)->__set__(attribute, value);
 		};
 	}
-	if constexpr (HasXor<Type>) {
-		type_prototype->__xor__ = +[](PyObject *self, PyObject *other) -> PyResult<PyObject *> {
-			return static_cast<Type *>(self)->__xor__(other);
+	if constexpr (concepts::HasDelete<Type>) {
+		type_prototype->__delete__ =
+			+[](PyObject *self, PyObject *attribute) -> PyResult<std::monostate> {
+			return static_cast<Type *>(self)->__delete__(attribute);
 		};
 	}
-	if constexpr (HasAbs<Type>) {
-		type_prototype->__abs__ = +[](const PyObject *self) -> PyResult<PyObject *> {
-			return static_cast<const Type *>(self)->__abs__();
+
+	// mapping_type_protocol slots — the protocol struct is created lazily.
+	if constexpr (concepts::HasLength<Type>) {
+		detail::ensure_mapping_proto(*type_prototype).__len__ =
+			+[](const PyObject *self) -> PyResult<size_t> {
+			return static_cast<const Type *>(self)->__len__();
 		};
 	}
-	if constexpr (HasNeg<Type>) {
-		type_prototype->__neg__ = +[](const PyObject *self) -> PyResult<PyObject *> {
-			return static_cast<const Type *>(self)->__neg__();
+	if constexpr (concepts::HasGetItem<Type>) {
+		detail::ensure_mapping_proto(*type_prototype).__getitem__ =
+			+[](PyObject *self, PyObject *name) -> PyResult<PyObject *> {
+			return static_cast<Type *>(self)->__getitem__(name);
 		};
 	}
-	if constexpr (HasPos<Type>) {
-		type_prototype->__pos__ = +[](const PyObject *self) -> PyResult<PyObject *> {
-			return static_cast<const Type *>(self)->__pos__();
+	if constexpr (concepts::HasSetItem<Type>) {
+		detail::ensure_mapping_proto(*type_prototype).__setitem__ =
+			+[](PyObject *self, PyObject *name, PyObject *value) -> PyResult<std::monostate> {
+			return static_cast<Type *>(self)->__setitem__(name, value);
 		};
 	}
-	if constexpr (HasInvert<Type>) {
-		type_prototype->__invert__ = +[](const PyObject *self) -> PyResult<PyObject *> {
-			return static_cast<const Type *>(self)->__invert__();
+	if constexpr (concepts::HasDelItem<Type>) {
+		detail::ensure_mapping_proto(*type_prototype).__delitem__ =
+			+[](PyObject *self, PyObject *name) -> PyResult<std::monostate> {
+			return static_cast<Type *>(self)->__delitem__(name);
 		};
 	}
-	if constexpr (HasBool<Type>) {
-		type_prototype->__bool__ = +[](const PyObject *self) -> PyResult<bool> {
-			return static_cast<const Type *>(self)->__bool__();
+
+	// sequence_type_protocol slots.
+	if constexpr (concepts::HasContains<Type>) {
+		detail::ensure_sequence_proto(*type_prototype).__contains__ =
+			+[](PyObject *self, PyObject *value) -> PyResult<bool> {
+			return static_cast<Type *>(self)->__contains__(value);
 		};
 	}
-	if constexpr (HasGetAttro<Type>) {
-		type_prototype->__getattribute__ =
-			+[](const PyObject *self, PyObject *attr) -> PyResult<PyObject *> {
-			return static_cast<const Type *>(self)->__getattribute__(attr);
+	if constexpr (concepts::HasSequenceGetItem<Type>) {
+		detail::ensure_sequence_proto(*type_prototype).__getitem__ =
+			+[](PyObject *self, int64_t index) -> PyResult<PyObject *> {
+			return static_cast<Type *>(self)->__getitem__(index);
 		};
 	}
-	if constexpr (HasSetAttro<Type>) {
-		type_prototype->__setattribute__ =
-			+[](PyObject *self, PyObject *attr, PyObject *value) -> PyResult<std::monostate> {
-			return static_cast<Type *>(self)->__setattribute__(attr, value);
+	if constexpr (concepts::HasSequenceSetItem<Type>) {
+		detail::ensure_sequence_proto(*type_prototype).__setitem__ =
+			+[](PyObject *self, int64_t index, PyObject *value) -> PyResult<std::monostate> {
+			return static_cast<Type *>(self)->__setitem__(index, value);
 		};
 	}
-	if constexpr (HasDelAttro<Type>) {
-		type_prototype->__delattribute__ =
-			+[](PyObject *self, PyObject *attr) -> PyResult<std::monostate> {
-			return static_cast<Type *>(self)->__delattribute__(attr);
+	if constexpr (concepts::HasSequenceDelItem<Type>) {
+		detail::ensure_sequence_proto(*type_prototype).__delitem__ =
+			+[](PyObject *self, int64_t index) -> PyResult<std::monostate> {
+			return static_cast<Type *>(self)->__delitem__(index);
 		};
 	}
-	if constexpr (HasGet<Type>) {
-		type_prototype->__get__ =
-			+[](const PyObject *self, PyObject *instance, PyObject *owner) -> PyResult<PyObject *> {
-			return static_cast<const Type *>(self)->__get__(instance, owner);
+
+	// PySequence subtypes route __add__/__mul__ through the sequence
+	// __concat__/__repeat__ slots; everyone else gets the binary operators.
+	if constexpr (std::is_base_of_v<PySequence, Type> && concepts::HasAdd<Type>) {
+		detail::ensure_sequence_proto(*type_prototype).__concat__ =
+			+[](const PyObject *self, const PyObject *value) -> PyResult<PyObject *> {
+			return static_cast<const Type *>(self)->__add__(value);
 		};
-	}
-	if constexpr (HasSet<Type>) {
-		type_prototype->__set__ =
-			+[](PyObject *self, PyObject *attribute, PyObject *value) -> PyResult<std::monostate> {
-			return static_cast<Type *>(self)->__set__(attribute, value);
+	} else if constexpr (concepts::HasAdd<Type>) {
+		type_prototype->__add__ =
+			+[](const PyObject *self, const PyObject *other) -> PyResult<PyObject *> {
+			return static_cast<const Type *>(self)->__add__(other);
 		};
 	}
-	if constexpr (HasDelete<Type>) {
-		type_prototype->__delete__ =
-			+[](PyObject *self, PyObject *attribute) -> PyResult<std::monostate> {
-			return static_cast<Type *>(self)->__delete__(attribute);
+	if constexpr (std::is_base_of_v<PySequence, Type> && concepts::HasRepeat<Type>) {
+		detail::ensure_sequence_proto(*type_prototype).__repeat__ =
+			+[](const PyObject *self, size_t count) -> PyResult<PyObject *> {
+			return static_cast<const Type *>(self)->__mul__(count);
 		};
-	}
-	if constexpr (HasStr<Type>) {
-		type_prototype->__str__ = +[](PyObject *self) -> PyResult<PyObject *> {
-			return static_cast<Type *>(self)->__str__();
+	} else if constexpr (concepts::HasMul<Type>) {
+		type_prototype->__mul__ =
+			+[](const PyObject *self, const PyObject *other) -> PyResult<PyObject *> {
+			return static_cast<const Type *>(self)->__mul__(other);
 		};
 	}
 
-	if constexpr (HasGetBuffer<Type>) {
-		type_prototype->as_buffer = PyBufferProcs{
-			.getbuffer =
-				+[](PyObject *self, PyBuffer &view, int flags) -> PyResult<std::monostate> {
-				return static_cast<Type *>(self)->__getbuffer__(view, flags);
-			},
+	// Buffer protocol.
+	if constexpr (concepts::HasGetBuffer<Type>) {
+		detail::ensure_buffer_proto(*type_prototype).getbuffer =
+			+[](PyObject *self, PyBuffer &view, int flags) -> PyResult<std::monostate> {
+			return static_cast<Type *>(self)->__getbuffer__(view, flags);
 		};
 	}
-	if constexpr (HasReleaseBuffer<Type>) {
-		if (!type_prototype->as_buffer.has_value()) {
-			type_prototype->as_buffer = PyBufferProcs{
-				.releasebuffer = +[](PyObject *self, PyBuffer &view) -> PyResult<std::monostate> {
-					return static_cast<Type *>(self)->__releasebuffer__(view);
-				},
-			};
-		} else {
-			type_prototype->as_buffer->releasebuffer =
-				+[](PyObject *self, PyBuffer &view) -> PyResult<std::monostate> {
-				return static_cast<Type *>(self)->__releasebuffer__(view);
-			};
-		}
+	if constexpr (concepts::HasReleaseBuffer<Type>) {
+		detail::ensure_buffer_proto(*type_prototype).releasebuffer =
+			+[](PyObject *self, PyBuffer &view) -> PyResult<std::monostate> {
+			return static_cast<Type *>(self)->__releasebuffer__(view);
+		};
 	}
 
 	type_prototype->traverse =
@@ -944,6 +803,11 @@ std::unique_ptr<TypePrototype> TypePrototype::create(std::string_view name, Args
 	return type_prototype;
 }
 
+#undef PYC_SLOT_UNARY_CONST_PYOBJ
+#undef PYC_SLOT_UNARY_PYOBJ
+#undef PYC_SLOT_BINARY_CONST_PYOBJ
+#undef PYC_SLOT_BINARY_PYOBJ
+
 
 class PyBaseObject : public PyObject
 {
diff --git a/src/runtime/PySlice.cpp b/src/runtime/PySlice.cpp
index 3b6404c8..41f44f13 100644
--- a/src/runtime/PySlice.cpp
+++ b/src/runtime/PySlice.cpp
@@ -327,6 +327,7 @@ PyType *PySlice::static_type() const { return types::slice(); }
 
 void PySlice::visit_graph(Visitor &visitor)
 {
+	PyObject::visit_graph(visitor);
 	if (m_start) visitor.visit(*m_start);
 	if (m_stop) visitor.visit(*m_stop);
 	if (m_step) visitor.visit(*m_step);
diff --git a/src/runtime/PyType.cpp b/src/runtime/PyType.cpp
index ceb960ba..36f7d6ba 100644
--- a/src/runtime/PyType.cpp
+++ b/src/runtime/PyType.cpp
@@ -1208,7 +1208,9 @@ PyResult<std::monostate> PyType::ready()
 	}
 
 	// initialize base class
-	if (base) { base->ready(); }
+	if (base) {
+		if (auto r = base->ready(); r.is_err()) { return r; }
+	}
 
 	// initialize bases
 	auto bases = underlying_type().__bases__;
@@ -1245,7 +1247,7 @@ PyResult<std::monostate> PyType::ready()
 				&& std::get<PyType *>(m_type) == types::type())
 			|| (&std::get<std::reference_wrapper<const TypePrototype>>(m_type).get()
 				== &types::BuiltinTypes::the().type())) {
-			inherit_slots(static_cast<PyType *>(base));
+			if (auto r = inherit_slots(static_cast<PyType *>(base)); r.is_err()) { return r; }
 		}
 	}
 
@@ -1528,15 +1530,19 @@ PyResult<PyType *> PyType::build_type(const PyType *metatype,
 		}
 	}
 
-	return PyType::create(const_cast<PyType *>(metatype)).and_then([&](PyType *type) {
-		type->underlying_type().is_heaptype = true;
-		type->__mro__ = nullptr;
-		type->initialize(type_name->value(), base, std::move(bases), ns);
+	return PyType::create(const_cast<PyType *>(metatype))
+		.and_then([&](PyType *type) -> PyResult<PyType *> {
+			type->underlying_type().is_heaptype = true;
+			type->__mro__ = nullptr;
+			if (auto r = type->initialize(type_name->value(), base, std::move(bases), ns);
+				r.is_err()) {
+				return Err(r.unwrap_err());
+			}
 
-		spdlog::trace("Created type@{} #{}", (void *)type, type->name());
+			spdlog::trace("Created type@{} #{}", (void *)type, type->name());
 
-		return Ok(type);
-	});
+			return Ok(type);
+		});
 }
 
 PyResult<const PyType *> PyType::calculate_metaclass(const PyType *type_,
diff --git a/src/runtime/Value.hpp b/src/runtime/Value.hpp
index a6232524..8e7c817e 100644
--- a/src/runtime/Value.hpp
+++ b/src/runtime/Value.hpp
@@ -10,6 +10,7 @@
 #include <algorithm>
 #include <cmath>
 #include <cstddef>
+#include <expected>
 #include <sstream>
 #include <variant>
 #include <vector>
@@ -230,59 +231,62 @@ namespace detail {
 }// namespace detail
 
 
-template<typename T> class PyResult
+template<typename T> class [[nodiscard]] PyResult
 {
   public:
 	using OkType = T;
 	using ErrType = BaseException *;
-	using StorageType = std::variant<Ok<T>, Err>;
+	using StorageType = std::expected<T, BaseException *>;
 
   private:
 	StorageType result;
 
   public:
-	PyResult(Ok<T> result_) : result(std::move(result_)) {}
-	template<typename U> constexpr PyResult(Ok<U> result_) : result(Ok<T>(std::move(result_.value)))
+	PyResult(Ok<T> result_) : result(std::move(result_.value)) {}
+	template<typename U>
+	constexpr PyResult(Ok<U> result_) : result(static_cast<T>(std::move(result_.value)))
 	{
 		static_assert(std::is_convertible_v<U, T>);
 	}
-	constexpr PyResult(Err result_) : result(result_) {}
+	constexpr PyResult(Err result_) : result(std::unexpected(result_.exc)) {}
 
-	template<typename U> constexpr PyResult(const PyResult<U> &other) : result(Err(nullptr))
+	template<typename U>
+	constexpr PyResult(const PyResult<U> &other)
+		: result(std::unexpected(static_cast<BaseException *>(nullptr)))
 	{
 		static_assert(std::is_convertible_v<U, T>);
 		if (other.is_ok()) {
-			result = Ok<T>(other.unwrap());
+			result = static_cast<T>(other.unwrap());
 		} else {
-			result = Err(other.unwrap_err());
+			result = std::unexpected(other.unwrap_err());
 		}
 	}
 
-	bool is_ok() const { return std::holds_alternative<Ok<T>>(result); }
-	bool is_err() const { return !is_ok(); }
+	[[nodiscard]] bool is_ok() const { return result.has_value(); }
+	[[nodiscard]] bool is_err() const { return !result.has_value(); }
 
-	const T &unwrap() const &
+	[[nodiscard]] const T &unwrap() const &
 	{
 		ASSERT(is_ok());
-		return std::get<Ok<T>>(result).value;
+		return result.value();
 	}
 
-	T &unwrap() &
+	[[nodiscard]] T &unwrap() &
 	{
 		ASSERT(is_ok());
-		return std::get<Ok<T>>(result).value;
+		return result.value();
 	}
 
-	T &&unwrap() &&
+	[[nodiscard]] T &&unwrap() &&
 	{
 		ASSERT(is_ok());
-		return std::move(std::get<Ok<T>>(result).value);
+		return std::move(result).value();
 	}
 
-	BaseException *unwrap_err() const
+	[[nodiscard]] BaseException *unwrap_err() const
 	{
 		ASSERT(is_err());
-		return std::get<Err>(result).exc;
+		return result.error();
 	}
 
 	template<typename FunctorType,
@@ -290,9 +294,9 @@ template<typename T> class PyResult
 			std::conditional_t<detail::is_ok<typename std::invoke_result_t<FunctorType, T>>{},
 				typename detail::is_ok<typename std::invoke_result_t<FunctorType, T>>::type,
 				typename detail::is_pyresult<typename std::invoke_result_t<FunctorType, T>>::type>>
-	PyResult<PyResultType> and_then(FunctorType &&op) const;
+	[[nodiscard]] PyResult<PyResultType> and_then(FunctorType &&op) const;
 
-	template<typename FunctorType> PyResult<T> or_else(FunctorType &&op) const;
+	template<typename FunctorType> [[nodiscard]] PyResult<T> or_else(FunctorType &&op) const;
 };
 
 template<typename T>
diff --git a/src/runtime/modules/BuiltinsModule.cpp b/src/runtime/modules/BuiltinsModule.cpp
index b898af1a..97511291 100644
--- a/src/runtime/modules/BuiltinsModule.cpp
+++ b/src/runtime/modules/BuiltinsModule.cpp
@@ -651,7 +651,9 @@ PyResult<PyObject *> dir(const PyTuple *args, const PyDict *, Interpreter &inter
 		}
 	}
 
-	dir_list->sort(nullptr, nullptr);
+	if (auto sort_result = dir_list->sort(nullptr, nullptr); sort_result.is_err()) {
+		return Err(sort_result.unwrap_err());
+	}
 	return Ok(static_cast<PyObject *>(dir_list_.unwrap()));
 }
 
diff --git a/src/runtime/modules/GcModule.cpp b/src/runtime/modules/GcModule.cpp
new file mode 100644
index 00000000..fd2ff58d
--- /dev/null
+++ b/src/runtime/modules/GcModule.cpp
@@ -0,0 +1,70 @@
+#include "Modules.hpp"
+#include "memory/GarbageCollector.hpp"
+#include "memory/Heap.hpp"
+#include "runtime/PyBool.hpp"
+#include "runtime/PyDict.hpp"
+#include "runtime/PyFunction.hpp"
+#include "runtime/PyNone.hpp"
+#include "runtime/PyString.hpp"
+#include "vm/VM.hpp"
+
+namespace py {
+
+namespace {
+
+	PyResult<PyObject *> gc_collect(PyTuple *, PyDict *)
+	{
+		// Force a full mark/sweep regardless of pause flag or cadence
+		// counter. CPython's gc.collect() returns the number of objects
+		// collected; we don't track that, so we just return 0 for
+		// compatibility.
+		auto &heap = VirtualMachine::the().heap();
+		heap.garbage_collector().force_run(heap);
+		return Ok(py_none());
+	}
+
+	PyResult<PyObject *> gc_enable(PyTuple *, PyDict *)
+	{
+		// Idempotent: calling enable() on an already-enabled GC must
+		// not abort. pause()/resume() ASSERT on state mismatch, so we
+		// gate on is_active() here.
+		auto &gc = VirtualMachine::the().heap().garbage_collector();
+		if (!gc.is_active()) { gc.resume(); }
+		return Ok(py_none());
+	}
+
+	PyResult<PyObject *> gc_disable(PyTuple *, PyDict *)
+	{
+		auto &gc = VirtualMachine::the().heap().garbage_collector();
+		if (gc.is_active()) { gc.pause(); }
+		return Ok(py_none());
+	}
+
+	PyResult<PyObject *> gc_isenabled(PyTuple *, PyDict *)
+	{
+		auto &gc = VirtualMachine::the().heap().garbage_collector();
+		return Ok(gc.is_active() ? py_true() : py_false());
+	}
+
+}// namespace
+
+PyModule *gc_module()
+{
+	auto *m = PyModule::create(PyDict::create().unwrap(),
+		PyString::create("gc").unwrap(),
+		PyString::create("Garbage collector interface.").unwrap())
+				  .unwrap();
+
+	m->add_symbol(PyString::create("collect").unwrap(),
+		PyNativeFunction::create("collect", &gc_collect).unwrap());
+	m->add_symbol(PyString::create("enable").unwrap(),
+		PyNativeFunction::create("enable", &gc_enable).unwrap());
+	m->add_symbol(PyString::create("disable").unwrap(),
+		PyNativeFunction::create("disable", &gc_disable).unwrap());
+	m->add_symbol(PyString::create("isenabled").unwrap(),
+		PyNativeFunction::create("isenabled", &gc_isenabled).unwrap());
+
+	return m;
+}
+
+}// namespace py
diff --git a/src/runtime/modules/IOModule.cpp b/src/runtime/modules/IOModule.cpp
index 486132ae..337ff8fd 100644
--- a/src/runtime/modules/IOModule.cpp
+++ b/src/runtime/modules/IOModule.cpp
@@ -928,7 +928,10 @@ struct Buffered
 	PyResult<PyObject *> _dealloc_warn(PyObject *source) const
 	{
 		if (this->ok && this->raw) {
-			this->raw->get_method(PyString::create("_dealloc_warn").unwrap())
+			// Best-effort warning fired from a deallocation path; any
+			// exception raised by the user's _dealloc_warn override has
+			// nowhere useful to land, so deliberately discard.
+			(void)this->raw->get_method(PyString::create("_dealloc_warn").unwrap())
 				.and_then([source](PyObject *_dealloc_warn) {
 					return _dealloc_warn->call(
 						PyTuple::create(source).unwrap(), PyDict::create().unwrap());
@@ -2872,7 +2875,9 @@ class TextIOWrapper : public TextIOBase
 		while (m_position < m_buffer_bytes->b.size()) {
 			auto line = readline(nullptr, nullptr);
 			if (line.is_err()) { return line; }
-			result->append(line.unwrap());
+			if (auto appended = result->append(line.unwrap()); appended.is_err()) {
+				return Err(appended.unwrap_err());
+			}
 		}
 
 		return Ok(result);
diff --git a/src/runtime/modules/Modules.hpp b/src/runtime/modules/Modules.hpp
index b3caced0..dfab2d67 100644
--- a/src/runtime/modules/Modules.hpp
+++ b/src/runtime/modules/Modules.hpp
@@ -6,6 +6,7 @@ PyModule *builtins_module(Interpreter &interpreter);
 PyModule *codecs_module();
 PyModule *collections_module();
 PyModule *errno_module();
+PyModule *gc_module();
 PyModule *imp_module();
 PyModule *io_module();
 PyModule *math_module();
diff --git a/src/runtime/modules/config.hpp b/src/runtime/modules/config.hpp
index b6934a88..2d5584db 100644
--- a/src/runtime/modules/config.hpp
+++ b/src/runtime/modules/config.hpp
@@ -23,6 +23,7 @@ static constexpr std::array builtin_modules{
 	std::tuple<std::string_view, PyModule *(*)()>{ "_signal", signal_module },
 	std::tuple<std::string_view, PyModule *(*)()>{ "errno", errno_module },
 	std::tuple<std::string_view, PyModule *(*)()>{ "_struct", struct_module },
+	std::tuple<std::string_view, PyModule *(*)()>{ "gc", gc_module },
 };
 
 inline bool is_builtin(std::string_view name)
diff --git a/src/runtime/modules/signal/module.cpp b/src/runtime/modules/signal/module.cpp
index 9800deba..8672aec8 100644
--- a/src/runtime/modules/signal/module.cpp
+++ b/src/runtime/modules/signal/module.cpp
@@ -72,7 +72,9 @@ PyResult<PyObject *> signal(PyTuple *args, PyDict *kwargs)
 	__sighandler_t sighandler = +[](int signumber) {
 		if (auto it = handlers->map().find(Number{ signumber }); it != handlers->map().end()) {
 			ASSERT(std::holds_alternative<PyObject *>(it->second));
-			std::get<PyObject *>(it->second)
+			// C-style signal context: any exception raised by the Python
+			// handler has nowhere to propagate. Best-effort fire-and-forget.
+			(void)std::get<PyObject *>(it->second)
 				->call(PyTuple::create(Number{ signumber }, py_none()).unwrap(), nullptr);
 		}
 	};
diff --git a/src/runtime/modules/weakref/PyCallableProxyType.cpp b/src/runtime/modules/weakref/PyCallableProxyType.cpp
index 65e2663c..81f483df 100644
--- a/src/runtime/modules/weakref/PyCallableProxyType.cpp
+++ b/src/runtime/modules/weakref/PyCallableProxyType.cpp
@@ -19,6 +19,13 @@ PyCallableProxyType::PyCallableProxyType(PyObject *object, PyObject *callback)
 	: PyBaseObject(s_weak_callableproxy), m_object(object), m_callback(callback)
 {}
 
+PyCallableProxyType::~PyCallableProxyType()
+{
+	if (m_object && m_object != py_none()) {
+		VirtualMachine::the().heap().unregister_weakref(bit_cast<uint8_t *>(m_object), this);
+	}
+}
+
 PyResult<PyCallableProxyType *> PyCallableProxyType::create(PyObject *object, PyObject *callback)
 {
 	auto *result =
diff --git a/src/runtime/modules/weakref/PyCallableProxyType.hpp b/src/runtime/modules/weakref/PyCallableProxyType.hpp
index 44d282ec..cc667a68 100644
--- a/src/runtime/modules/weakref/PyCallableProxyType.hpp
+++ b/src/runtime/modules/weakref/PyCallableProxyType.hpp
@@ -18,6 +18,8 @@ class PyCallableProxyType : public PyBaseObject
 	void visit_graph(Visitor &) override;
 
   public:
+	~PyCallableProxyType() override;
+
 	static PyResult<PyCallableProxyType *> create(PyObject *object, PyObject *callback);
 
 	std::string to_string() const override;
diff --git a/src/runtime/modules/weakref/PyWeakProxy.cpp b/src/runtime/modules/weakref/PyWeakProxy.cpp
index c8b74ab2..61e607b2 100644
--- a/src/runtime/modules/weakref/PyWeakProxy.cpp
+++ b/src/runtime/modules/weakref/PyWeakProxy.cpp
@@ -19,6 +19,13 @@ PyWeakProxy::PyWeakProxy(PyObject *object, PyObject *callback)
 	: PyBaseObject(s_weak_proxy), m_object(object), m_callback(callback)
 {}
 
+PyWeakProxy::~PyWeakProxy()
+{
+	if (m_object && m_object != py_none()) {
+		VirtualMachine::the().heap().unregister_weakref(bit_cast<uint8_t *>(m_object), this);
+	}
+}
+
 PyResult<PyWeakProxy *> PyWeakProxy::create(PyObject *object, PyObject *callback)
 {
 	auto *result = VirtualMachine::the().heap().allocate_weakref<PyWeakProxy>(object, callback);
diff --git a/src/runtime/modules/weakref/PyWeakProxy.hpp b/src/runtime/modules/weakref/PyWeakProxy.hpp
index 294d9785..b7e861ab 100644
--- a/src/runtime/modules/weakref/PyWeakProxy.hpp
+++ b/src/runtime/modules/weakref/PyWeakProxy.hpp
@@ -18,6 +18,8 @@ class PyWeakProxy : public PyBaseObject
 	void visit_graph(Visitor &) override;
 
   public:
+	~PyWeakProxy() override;
+
 	static PyResult<PyWeakProxy *> create(PyObject *object, PyObject *callback);
 
 	std::string to_string() const override;
diff --git a/src/runtime/modules/weakref/PyWeakRef.cpp b/src/runtime/modules/weakref/PyWeakRef.cpp
index b78034f3..850893a0 100644
--- a/src/runtime/modules/weakref/PyWeakRef.cpp
+++ b/src/runtime/modules/weakref/PyWeakRef.cpp
@@ -18,6 +18,18 @@ PyWeakRef::PyWeakRef(PyObject *object, PyObject *callback)
 	: PyBaseObject(s_weak_ref), m_object(object), m_callback(callback)
 {}
 
+PyWeakRef::~PyWeakRef()
+{
+	// If the target is still alive, scrub our entry from its weakref list
+	// so getweakrefcount/getweakrefs don't hand out a dangling pointer.
+	// When the target has already been collected, is_alive() has either
+	// switched m_object to py_none() or the entry was erased by sweep —
+	// either way, unregister_weakref is a safe no-op.
+	if (m_object && m_object != py_none()) {
+		VirtualMachine::the().heap().unregister_weakref(bit_cast<uint8_t *>(m_object), this);
+	}
+}
+
 PyResult<PyWeakRef *> PyWeakRef::create(PyObject *object, PyObject *callback)
 {
 	auto *result = VirtualMachine::the().heap().allocate_weakref<PyWeakRef>(object, callback);
diff --git a/src/runtime/modules/weakref/PyWeakRef.hpp b/src/runtime/modules/weakref/PyWeakRef.hpp
index 905fa337..0ac575dd 100644
--- a/src/runtime/modules/weakref/PyWeakRef.hpp
+++ b/src/runtime/modules/weakref/PyWeakRef.hpp
@@ -18,6 +18,8 @@ class PyWeakRef : public PyBaseObject
 	void visit_graph(Visitor &) override;
 
   public:
+	~PyWeakRef() override;
+
 	static PyResult<PyWeakRef *> create(PyObject *object, PyObject *callback);
 
 	std::string to_string() const override;
diff --git a/src/vm/VM.cpp b/src/vm/VM.cpp
index 270b022e..5a4b4a00 100644
--- a/src/vm/VM.cpp
+++ b/src/vm/VM.cpp
@@ -21,7 +21,7 @@ using namespace py;
 StackFrame::StackFrame(size_t register_count,
 	size_t locals_count,
 	size_t stack_size,
-	InstructionVector::const_iterator return_address,
+	std::optional<InstructionVector::const_iterator> return_address,
 	VirtualMachine *vm_)
 	: registers(register_count, nullptr),
 	  locals(vm_->m_stack_pointer, vm_->m_stack_pointer + stack_size),
@@ -83,19 +83,19 @@ StackFrame &StackFrame::restore()
 	auto start = stack_pointer;
 	for (const auto &el : locals_storage) { *start++ = el; }
 	vm->push_frame(*this);
-	return vm->stack().top();
+	return vm->stack().back();
 }
 
 void StackFrame::leave()
 {
 	ASSERT(vm);
-	// ASSERT(vm->m_stack_frames.top() == *this);
+	// ASSERT(vm->m_stack_frames.back() == *this);
 	vm->pop_frame(true);
 }
 
 VirtualMachine::VirtualMachine()
-	: m_stack(10'000, nullptr), m_stack_pointer(m_stack.begin()), m_base_pointer(m_stack_pointer),
-	  m_heap(Heap::create())
+	: m_stack(kStackSize, nullptr), m_stack_pointer(m_stack.begin()),
+	  m_base_pointer(m_stack_pointer), m_heap(Heap::create())
 {
 	uintptr_t *rbp;
 	asm volatile("movq %%rbp, %0" : "=r"(rbp));
@@ -105,6 +105,11 @@ VirtualMachine::VirtualMachine()
 std::unique_ptr<StackFrame>
 	VirtualMachine::setup_call_stack(size_t register_count, size_t locals_count, size_t stack_size)
 {
+	// Guard the invariant that m_stack is never reallocated after the VM
+	// is constructed. Every active StackFrame holds raw pointers/iterators
+	// into this buffer (locals span, base_pointer, stack_pointer), so any
+	// grow/shrink would silently dangle them.
+	ASSERT(m_stack.size() == kStackSize && "m_stack capacity changed; locals spans would dangle");
 	return push_frame(register_count, locals_count, stack_size);
 }
 
@@ -151,27 +156,6 @@ const Interpreter &VirtualMachine::interpreter() const
 }
 
 
-void VirtualMachine::show_current_instruction(size_t index, size_t window) const
-{
-	TODO();
-	(void)index;
-	(void)window;
-
-	// size_t start = std::max(
-	// 	int64_t{ 0 }, static_cast<int64_t>(index) - static_cast<int64_t>((window - 1) / 2));
-	// size_t end = std::min(index + (window - 1) / 2 + 1, m_bytecode->instructions().size());
-
-	// for (size_t i = start; i < end; ++i) {
-	// 	if (i == index) {
-	// 		std::cout << "->" << m_bytecode->instructions()[i]->to_string() << '\n';
-	// 	} else {
-	// 		std::cout << "  " << m_bytecode->instructions()[i]->to_string() << '\n';
-	// 	}
-	// }
-	// std::cout << '\n';
-}
-
-
 void VirtualMachine::dump() const
 {
 	// size_t i = 0;
@@ -229,7 +213,7 @@ void VirtualMachine::dump() const
 void VirtualMachine::clear()
 {
 	m_heap->reset();
-	while (!m_stack_frames.empty()) m_stack_frames.pop();
+	while (!m_stack_frames.empty()) m_stack_frames.pop_back();
 	// should instruction pointer be optional?
 	// m_instruction_pointer = nullptr;
 }
@@ -249,15 +233,17 @@ void VirtualMachine::leave_cleanup_handling()
 std::unique_ptr<StackFrame>
 	VirtualMachine::push_frame(size_t register_count, size_t locals_count, size_t stack_size)
 {
-	auto new_frame =
-		m_stack_frames.empty()
-			? StackFrame::create(register_count,
-				  locals_count,
-				  stack_size,
-				  InstructionVector::const_iterator{},
-				  this)
-			: StackFrame::create(
-				  register_count, locals_count, stack_size, m_instruction_pointer, this);
+	auto new_frame = m_stack_frames.empty()
+						 ? StackFrame::create(register_count,
+							   locals_count,
+							   stack_size,
+							   std::optional<InstructionVector::const_iterator>{},
+							   this)
+						 : StackFrame::create(register_count,
+							   locals_count,
+							   stack_size,
+							   std::optional{ m_instruction_pointer },
+							   this);
 	push_frame(*new_frame);
 
 	return new_frame;
@@ -265,13 +251,24 @@ std::unique_ptr<StackFrame>
 
 void VirtualMachine::push_frame(StackFrame &frame)
 {
+	// Validate the incoming frame's footprint BEFORE mutating any VM state:
+	// frame.locals spans [sp, sp + stack_size) inside m_stack, so its end()
+	// is the highest slot the frame can legitimately address. If pushing
+	// this frame would extend past m_stack's tail, bail loudly here rather
+	// than corrupting unrelated memory later via push()/pop().
+	const auto *frame_top = frame.locals.data() + frame.locals.size();
+	const auto *stack_end = m_stack.data() + m_stack.size();
+	ASSERT(frame_top <= stack_end && "VM stack overflow at push_frame");
+	ASSERT(std::distance(m_stack_pointer, frame.stack_pointer) >= 0);
+	ASSERT(std::distance(m_base_pointer, frame.base_pointer) >= 0);
+
 	if (!m_stack_frames.empty()) {
 		// stash the current stack pointer so we can restore it later
-		m_stack_frames.top().get().stack_pointer = m_stack_pointer;
+		m_stack_frames.back().get().stack_pointer = m_stack_pointer;
 	}
-	m_stack_frames.push(frame);
+	m_stack_frames.push_back(frame);
 	// set a new state for this stack frame
-	m_state = m_stack_frames.top().get().state.get();
+	m_state = m_stack_frames.back().get().state.get();
 
 	const auto &r = registers();
 	auto &stack_objects = m_stack_objects.emplace_back();
@@ -280,14 +277,6 @@ void VirtualMachine::push_frame(StackFrame &frame)
 	}
 	for (const auto &v : stack_locals()) { stack_objects.push_back(&v); }
 
-	ASSERT(std::distance(m_stack_pointer, frame.stack_pointer) >= 0);
-	ASSERT(std::distance(m_base_pointer, frame.base_pointer) >= 0);
-
-	if (std::distance(m_stack.begin(), frame.stack_pointer)
-		>= static_cast<int64_t>(m_stack.size())) {
-		ASSERT(false && "Stack overflow!");
-	}
-
 	m_stack_pointer = frame.stack_pointer;
 	m_base_pointer = frame.base_pointer;
 
@@ -302,39 +291,35 @@ std::deque<std::vector<const py::Value *>> VirtualMachine::stack_objects() const
 void VirtualMachine::pop_frame(bool should_return_value)
 {
 	if (m_stack_frames.size() > 1) {
-		const size_t locals_size = m_stack_frames.top().get().locals.size();
-		auto return_value = m_stack_frames.top().get().registers[0];
-
-		ASSERT((*m_stack_frames.top().get().return_address).get());
-		m_instruction_pointer = m_stack_frames.top().get().return_address;
-		auto f = m_stack_frames.top();
+		const size_t locals_size = m_stack_frames.back().get().locals.size();
+		auto return_value = m_stack_frames.back().get().registers[0];
+
+		// Non-top-level frames are pushed with a concrete call-site
+		// instruction. If we ever see nullopt here, the VM was popping
+		// past the top-of-stack frame through a non-top path.
+		ASSERT(m_stack_frames.back().get().return_address.has_value());
+		m_instruction_pointer = *m_stack_frames.back().get().return_address;
+		auto f = m_stack_frames.back();
 		f.get().stack_pointer = m_stack_pointer;
-		m_stack_frames.pop();
+		m_stack_frames.pop_back();
 
 		// restore stack frame state
-		m_state = m_stack_frames.top().get().state.get();
+		m_state = m_stack_frames.back().get().state.get();
 		m_stack_objects.pop_back();
 		if (should_return_value) {
-			m_stack_frames.top().get().registers[0] = std::move(return_value);
+			m_stack_frames.back().get().registers[0] = std::move(return_value);
 		}
 
 		f.get().locals_storage.resize(locals_size, nullptr);
 		for (size_t i = 0; i < locals_size; ++i) { f.get().locals_storage[i] = f.get().locals[i]; }
 		f.get().locals = std::span{ f.get().locals_storage.begin(), f.get().locals_storage.end() };
 
-		ASSERT(std::distance(m_stack_frames.top().get().stack_pointer, m_stack_pointer) >= 0);
-		ASSERT(std::distance(m_stack_frames.top().get().base_pointer, m_base_pointer) >= 0);
-		m_base_pointer = m_stack_frames.top().get().base_pointer;
-		m_stack_pointer = m_stack_frames.top().get().stack_pointer;
+		ASSERT(std::distance(m_stack_frames.back().get().stack_pointer, m_stack_pointer) >= 0);
+		ASSERT(std::distance(m_stack_frames.back().get().base_pointer, m_base_pointer) >= 0);
+		m_base_pointer = m_stack_frames.back().get().base_pointer;
+		m_stack_pointer = m_stack_frames.back().get().stack_pointer;
 	} else {
-		m_stack_frames.pop();
+		m_stack_frames.pop_back();
 		m_stack_objects.pop_back();
 	}
 }
-
-PyModule *import(PyString *path)
-{
-	(void)path;
-	TODO();
-	return nullptr;
-}
diff --git a/src/vm/VM.hpp b/src/vm/VM.hpp
index ccd2a751..a0fbdf3e 100644
--- a/src/vm/VM.hpp
+++ b/src/vm/VM.hpp
@@ -6,8 +6,11 @@
 #include "runtime/Value.hpp"
 #include "utilities.hpp"
 
+#include <deque>
+#include <functional>
 #include <span>
 #include <stack>
+#include <vector>
 
 class VirtualMachine;
 
@@ -32,7 +35,7 @@ struct StackFrame : NonCopyable
 	StackFrame(size_t register_count,
 		size_t locals_count,
 		size_t stack_size,
-		InstructionVector::const_iterator return_address,
+		std::optional<InstructionVector::const_iterator> return_address,
 		VirtualMachine *);
 
 	StackFrame(StackFrame &&);
@@ -46,7 +49,11 @@ struct StackFrame : NonCopyable
 	Registers registers;
 	std::vector<py::Value> locals_storage;
 	std::span<py::Value> locals;
-	InstructionVector::const_iterator return_address;
+	// nullopt for the top-level frame: there is no instruction to resume at.
+	// For nested frames this holds the call-site instruction whose execution
+	// triggered the push; the VM resumes at that iterator on pop, after
+	// which the eval loop's `std::next` advances past it.
+	std::optional<InstructionVector::const_iterator> return_address;
 	InstructionVector::const_iterator last_instruction_pointer;
 	std::vector<py::Value>::const_iterator base_pointer;
 	std::vector<py::Value>::iterator stack_pointer;
@@ -65,8 +72,18 @@ class VirtualMachine
 	: NonCopyable
 	, NonMoveable
 {
+	// Fixed-capacity value stack. Every StackFrame::locals is a std::span
+	// pointing directly into this buffer, so the storage MUST NOT be
+	// resized or reallocated for the lifetime of the VM — doing so would
+	// dangle every existing frame's locals span and the m_stack_pointer
+	// iterator. If the stack ever needs to grow, switch StackFrame::locals
+	// to an (offset, size) pair against m_stack first.
+	static constexpr size_t kStackSize = 10'000;
 	std::vector<py::Value> m_stack;
-	std::stack<std::reference_wrapper<StackFrame>> m_stack_frames;
+	// m_stack_frames is a vector rather than a stack so callers can iterate
+	// over the frame chain (used by VirtualMachine::dump and the GC root
+	// scan). LIFO access is via back()/push_back()/pop_back().
+	std::vector<std::reference_wrapper<StackFrame>> m_stack_frames;
 	std::deque<std::vector<const py::Value *>> m_stack_objects;
 
 	InstructionVector::const_iterator m_instruction_pointer;
@@ -121,28 +138,28 @@ class VirtualMachine
 
 	std::optional<std::reference_wrapper<Registers>> registers()
 	{
-		if (!m_stack_frames.empty()) { return m_stack_frames.top().get().registers; }
+		if (!m_stack_frames.empty()) { return m_stack_frames.back().get().registers; }
 		return {};
 	}
 	std::optional<std::reference_wrapper<const Registers>> registers() const
 	{
-		if (!m_stack_frames.empty()) { return m_stack_frames.top().get().registers; }
+		if (!m_stack_frames.empty()) { return m_stack_frames.back().get().registers; }
 		return {};
 	}
 
 	std::span<py::Value> stack_locals()
 	{
-		if (!m_stack_frames.empty()) { return m_stack_frames.top().get().locals; }
+		if (!m_stack_frames.empty()) { return m_stack_frames.back().get().locals; }
 		return {};
 	}
 
-	std::span<py::Value> stack_locals() const
+	std::span<const py::Value> stack_locals() const
 	{
-		if (!m_stack_frames.empty()) { return m_stack_frames.top().get().locals; }
+		if (!m_stack_frames.empty()) { return m_stack_frames.back().get().locals; }
 		return {};
 	}
 
-	const std::stack<std::reference_wrapper<StackFrame>> &stack() const { return m_stack_frames; }
+	const std::vector<std::reference_wrapper<StackFrame>> &stack() const { return m_stack_frames; }
 	const State &state() const { return *m_state; }
 	State &state() { return *m_state; }
 
@@ -156,7 +173,7 @@ class VirtualMachine
 	void set_instruction_pointer(InstructionVector::const_iterator pos)
 	{
 		m_instruction_pointer = pos;
-		m_stack_frames.top().get().last_instruction_pointer = m_instruction_pointer;
+		m_stack_frames.back().get().last_instruction_pointer = m_instruction_pointer;
 	}
 
 	const InstructionVector::const_iterator &instruction_pointer() const
@@ -185,18 +202,26 @@ class VirtualMachine
 
 	void pop_frame(bool should_return_value);
 
-	void push(py::Value value) { *m_stack_pointer++ = value; }
+	void push(py::Value value)
+	{
+		ASSERT(m_stack_pointer != m_stack.end() && "VM stack overflow on push");
+		*m_stack_pointer++ = value;
+	}
 
-	py::Value pop() { return *--m_stack_pointer; }
+	py::Value pop()
+	{
+		ASSERT(m_stack_pointer != m_stack.begin() && "VM stack underflow on pop");
+		return *--m_stack_pointer;
+	}
 
 	std::deque<std::vector<const py::Value *>> stack_objects() const;
 
-	py::PyModule *import(py::PyString *path);
-
   private:
 	VirtualMachine();
 
 	int execute_internal(std::shared_ptr<Program> program);
-
-	void show_current_instruction(size_t index, size_t window) const;
 };
+
+static_assert(std::is_same_v<decltype(std::declval<const VirtualMachine &>().stack_locals()),
+				  std::span<const py::Value>>,
+	"stack_locals() const must return a span of const py::Value");