1 files changed, 36 insertions, 4 deletions
diff --git a/doc/0/0-value.md b/doc/0/0-value.md
index 16e1a58..050d003 100644
--- a/doc/0/0-value.md
+++ b/doc/0/0-value.md
@@ -186,10 +186,42 @@ Forbidden Value #4, Positive Infinity, is avoided thanks to the fact that heap
 pointers always have a non-zero heap-type tag.  (See further above.)
 
 The first four categories simply mirror those of the previous 51-bit range, but
-mark the values as being constants rather than code to evaluate.
-
-The remaining four categories are somewhat similar to VM instructions.
-
+mark the values as being constants rather than code to evaluate.  This way, we
+can inject direct data pointers into the AST without needing to worry about the
+data being confused for code to evaluate, and without needing the `(quote ...)`
+wrapper anymore.
+
+The remaining four categories could be seen as instructions for a tree-walking
+virtual machine executing Zisp code.
+
+### Local reference
+
+Local variables, regardless of whether they are function parameters, variables
+closed over lexically, or explicit local declarations, all use a single flat
+"locals" array at run-time.  References are then optimized into direct indexes
+into this array.  The actual index value is the lowest 16 bits, with the other
+32 bits being reserved for other purposes.
+
+### Expression pointers
+
+The final three pointer types are derivatives of list pointers, using three low
+tag bits indicating the count of elements making up the expression.
+
+A pointer to a constant function-call expression indicates that the destination
+is an array whose first element is a raw, unpacked, untagged pointer to a Zisp
+function object; the remaining elements need to be evaluated to produce the
+arguments to the function.  As a further optimization trick, the first element
+may actually be an integer up to 255, that indicates dispatch to a built-in VM
+operation acting as a function.
+
+In a variable function-call expression, the first element needs evaluation to
+produce a function pointer: It could be a local variable reference, one of the
+expression pointer types, or else a raw pointer into a module exports table.
+
+A special-form or macro-call expression is similar to a constant function-call
+except that the arguments are passed as context-wrapped source code objects.
+The first element can be an integer up to 255, dispatching to a VM built-in;
+otherwise, it must be a pointer to a macro function.
 
 
 <!--