FANCO-16 v6 BYTE ENCODING
========================
All numbers here are hex; multibyte extensions are little endian.
Register indices: 0=a,1=b,2=x,3=y,4=p,5=r,6=sp,7=pc.

Opcode families
---------------
00 HALT
01 WAIT
02 RETI
03 CALL absolute word
04 CALL packed word source (destination bits must be zero)
05 SLEEP unsigned word duration
06 BLIT
07 SYS service byte: 00=PRESENT, 01=LOAD
08–0F MOV word immediate: destination = opcode&7, two payload bytes
10–17 INC word register
18–1F DEC word register
20–2E Short branch + signed byte displacement
2F RET
30–3E Absolute branch + word target
3F stack/math descriptor: 00=two-byte NOP alias, 08–0F=PUSH register,
   10–17=POP register; 20=SMULSHIFT, 21=UMULHI, 22=ADC, 23=SBC,
   24=ABS, 25=SMIN, 26=SMAX.
   Math has a following register descriptor: bits0–2=destination 0–6,
   bits3–5=source 0–7, bits6–7 MUST be zero. ABS requires bits3–7 zero.
   SMULSHIFT then has one unsigned shift byte 00–1F.
   Other descriptors/shift bytes trap atomically.
40–7F MOV word register/register: destination=(opcode>>3)&7,
   source=opcode&7. 40 (MOV a,a) is the canonical one-byte NOP.
80–AF MOVZX byte memory -> word register: dst=(opcode-80)>>3,
   base=opcode&7, followed by signed displacement byte. dst is 0–5.
B0–DF MOV low byte -> byte memory: src=(opcode-B0)>>3,
   base=opcode&7, followed by signed displacement byte. src is 0–5.
E0–EE packed word operation + descriptor/extensions
EF stores + store descriptor/extensions
F0–FE packed low-byte operation + descriptor/extensions
FF original full operand encoding (separate old-semantic decoder)

Branch index (added to 20 or 30):
0 BRA,1 BZ,2 BNZ,3 BLT,4 BGE,5 BLO,6 BHS,7 BLE,8 BGT,9 BLS,A BHI,
B BMI,C BPL,D BVS,E BVC.

Packed operation index (low nibble):
0 MOV,1 ADD,2 SUB,3 AND,4 OR,5 XOR,6 CMP,7 SHL,8 SHR,9 SAR,
A MUL,B DIV,C LEA word / OUT byte,D MOVZX word / IN byte,E MOD.
LEA rejects auto-update and non-address sources. MOVZX targets a non-PC word
register and consumes a BYTE source even though its opcode is in the E family.
OUT descriptor destination is the source byte register; its packed source
identifies the framebuffer destination address. IN reads a framebuffer byte.

ALU/source descriptor
---------------------
Bits 0–2: destination register (low-byte alias for F operations).
Bits 3–5: source ID.
Bits 6–7: source category:

00 Register. ID 0–7 selects a word or corresponding low byte.
01 Literal:
   ID0 = unsigned byte payload
   ID1 = 0; ID2 = 1; ID3 = 2; ID4 = 4; ID5 = 8; ID6 = 0F; ID7 = FF
   There is NO overlap between literal-class and byte-payload descriptors.
10 Memory [register+signed-byte], ID selects base; one displacement payload.
11 Extended:
   ID0 = absolute byte address payload
   ID1 = absolute word address payload
   ID2 = [register++] with base-index payload 0–7
   ID3 = [--register] with base-index payload 0–6 (PC update forbidden)
   ID4 = word immediate payload, word operations only
   ID5–7 trap

Widths and source/destination validity are checked before execution. SP/PC
and high-byte cases missing a compact form use the full operand escape, not
an assembler feature omission. MOV to PC takes effect as an ordinary jump.

EF store descriptor
-------------------
Top two bits select the family:

00 Word register -> [base+signed-byte]
   bits0–2=base, bits3–5=source word register, displacement payload.

01 Immediate -> [base+signed-byte]
   bits0–2=base; bits3–4=literal kind; bit5=word (0=byte);
   displacement payload, then literal payload when required.

10 Immediate -> absolute address
   bit0=word address (0=byte address); bits1–2=literal kind;
   bits3–4 MUST be zero; bit5=word data (0=byte);
   address payload, then literal payload when required.

Literal kinds for 01/10:
 0 zero, no data payload
 1 all ones for selected width, no data payload
 2 unsigned byte payload (zero-extended for word data)
 3 word payload, WORD data only; byte data with kind3 traps

11 Register -> absolute/auto memory
   bits3–5=source register; bits0–2=subtype:
   0 word to absolute byte address
   1 word to absolute word address
   2 word to [base++]
   3 word to [--base]
   4 low byte to absolute byte address
   5 low byte to absolute word address
   6 low byte to [base++]
   7 low byte to [--base]
   Auto forms have one base-index payload; pre-PC update is forbidden.

Escapes
-------
FF consumes an original opcode below 80 hex, then ONLY the original operand
semantics. It does not reinterpret old 6C/6D as new LEA/MOVZX or enable invalid
old word OUT/IN. Original operand widths, validation, alias transaction rules
and immediate interpretation remain. This supports uncommon high-byte loads,
stores, signed widening and old auto-update forms without doubling fast opcodes.
It does not make a version-05 program executable as a version-06 app.

Assembler layout never selects a shorter literal/address form just because an
unresolved label temporarily has value zero. Numeric constants may use compact
forms; symbolic label addresses retain stable word width through relaxation.