步骤A：isa+toml 新增 RS_OFF 形态（LOAD_PTR/STORE_PTR，0010 前缀 op=8/9）+ 强校验放行 + isa_test roundtrip

isa/include/isa/Instr.h

@@ -295,6 +295,17 @@ namespace isa {
         return instr_len(out);
     }
 
+    /// @brief 编码 RS_OFF（LOAD_PTR/STORE_PTR，0010 区），返回指令长度。
+    inline size_t enc_rs_off(uint8_t* out, uint8_t op, uint8_t func,
+                             uint8_t rd, uint8_t rs, int32_t off) {
+        set_byte0(out, "0010", op);
+        set_func(out, func);
+        set_rd(out, rd);
+        set_rs1(out, rs);
+        set_off32_hi(out, off);
+        return instr_len(out);
+    }
+
     /// @brief 编码 RET（10 区），返回指令长度。
     inline size_t enc_ret(uint8_t* out) {
         set_byte0(out, "10", static_cast<uint8_t>(Op::RET));

isa/include/isa/Op.h

@@ -46,6 +46,7 @@ namespace isa {
         // 16B（前缀 0010/0011，op 4 位）
         LOAD_OFF = 0, STORE_OFF = 1, STR_LEN = 2, STR_CMP = 3,
         STR_EQ = 4, STR_MID = 5, STR_LEFT = 6, STR_RIGHT = 7,
+        LOAD_PTR = 8, STORE_PTR = 9,
         LOADK64 = 0,
         // 32B 预留（前缀 0001，op 4 位）
         JTBL = 0, STR_CONCAT = 1, STR_FIND = 2, STR_REPLACE = 3,
@@ -66,6 +67,7 @@ namespace isa {
         CALL,      ///< fn_id32（8B）
         CAL,       ///< fb_id16, slot32（8B）
         SLOT_OFF,  ///< rd, slot32, off32（16B）
+        RS_OFF,    ///< rd, rs(基址寄存器), off32（16B）
         IMM64,     ///< rd, imm64（16B）
         RESERVED,  ///< 32B 预留
     };

isa/src/Encode.cpp

@@ -84,6 +84,8 @@ Decoded decode(const uint8_t* code, size_t len) {
     } else if (f == OpFormat::SLOT_OFF) {
         d.imm32 = slot32_of(code);
         d.off_hi = off32_hi_of(code);
+    } else if (f == OpFormat::RS_OFF) {
+        d.off_hi = off32_hi_of(code);
     }
     return d;
 }
@@ -112,6 +114,8 @@ size_t encode(const Decoded& d, uint8_t* out) {
     } else if (f == OpFormat::SLOT_OFF) {
         set_slot32(out, d.imm32);
         set_off32_hi(out, d.off_hi);
+    } else if (f == OpFormat::RS_OFF) {
+        set_off32_hi(out, d.off_hi);
     }
     return instr_len(out);
 }
@@ -178,6 +182,11 @@ void disasm(const uint8_t* code, size_t len, char* out, size_t cap) {
                      static_cast<unsigned>(d.rd), static_cast<unsigned>(d.imm32),
                      static_cast<int>(d.off_hi));
             break;
+        case OpFormat::RS_OFF:
+            snprintf(out, cap, "%s%s r%u, r%u, %d", od.name, suffix.c_str(),
+                     static_cast<unsigned>(d.rd), static_cast<unsigned>(d.rs1),
+                     static_cast<int>(d.off_hi));
+            break;
         case OpFormat::IMM64:
         case OpFormat::NONE:
         case OpFormat::RESERVED:

isa/src/Op.cpp

@@ -88,6 +88,8 @@ namespace isa {
         {"STR_MID", "0010", Op::STR_MID, OpFormat::SLOT_OFF, FuncMode::None},
         {"STR_LEFT", "0010", Op::STR_LEFT, OpFormat::SLOT_OFF, FuncMode::None},
         {"STR_RIGHT", "0010", Op::STR_RIGHT, OpFormat::SLOT_OFF, FuncMode::None},
+        {"LOAD_PTR", "0010", Op::LOAD_PTR, OpFormat::RS_OFF, FuncMode::Full},
+        {"STORE_PTR", "0010", Op::STORE_PTR, OpFormat::RS_OFF, FuncMode::Full},
         {"LOADK64", "0011", Op::LOADK64, OpFormat::IMM64, FuncMode::Full},
         // 32B 预留
         {"JTBL", "0001", Op::JTBL, OpFormat::RESERVED, FuncMode::None},
@@ -144,11 +146,11 @@ namespace isa {
     bool uses_rd(OpFormat f) {
         return f == OpFormat::RR || f == OpFormat::RRR || f == OpFormat::IMM ||
                f == OpFormat::SLOT || f == OpFormat::JC || f == OpFormat::SLOT_OFF ||
-               f == OpFormat::IMM64;
+               f == OpFormat::RS_OFF || f == OpFormat::IMM64;
     }
 
     bool uses_rs1(OpFormat f) {
-        return f == OpFormat::RR || f == OpFormat::RRR;
+        return f == OpFormat::RR || f == OpFormat::RRR || f == OpFormat::RS_OFF;
     }
 
     bool uses_rs2(OpFormat f) {