diff --git a/MANUAL.md b/MANUAL.md
index f57d610..8abd49d 100644
--- a/MANUAL.md
+++ b/MANUAL.md
@@ -63,20 +63,24 @@ cmp -l assets/disk.1 build/disk_1.bin   # 0 differences
 | `-m <module> analyze --trace [--budget N]` | Trace-driven analysis: run the binary from its entry point in the built-in sandboxed M68000 interpreter (`m68kemu`) + minimal Amiga chipset, then resolve indirect dispatch (trampolines, `d16(An)`/indexed computed calls), self-installed interrupt/trap handlers, and hardware-register accesses **by observation** and seed them into recursive descent. Opt-in, for **flat self-booting binaries** (games/demos); default `analyze` is unchanged. `--budget` caps the instruction count (default 20,000,000). All facts are non-byte-affecting (labels/edges/comments) — parity is preserved. |
 | `-m <module> emit [--amiga] [--all] [--relocatable] [--force]` | Emit modular Amiga assembly (`--amiga`: `src/<module>/hunk*.asm` + `disasm/<module>.asm` + shared `src/equates.i`) or single-file assembly (`disasm/<module>.asm`). Refuses to overwrite existing files unless `--force` is passed. |
 | `-m <module> callgraph` / `cg [TARGET...] [FLAGS]` | Inspect multi-hunk call graphs, bottom-up worklists, string/HW anchors, indirect dispatch sites (`--indirect`), and function disassembly |
+| `-m <module> disasm` / `d TARGET [-n INSTS] [--len BYTES] [--try-code] [-f text\|json]` | Disassemble `N` instructions or `BYTES` starting at any address or mid-function label without dumping the full function (`--try-code` previews candidate instructions on `DATA` bytes read-only) |
 | `-m <module> search QUERY [-s SEG] [-n LIMIT] [--dense] [-f text\|json]` | Search instructions, operands, strings, labels, comments, bytes, hardware/math clusters (`cluster:<name>`), or self-modifying code (`smc`) |
-| `-m <module> data` / `inspect TARGET [--len N] [--copper] [--struct NAME [--count N]] [-f text\|json]` | Inspect non-code data, pointer tables, strings, Amiga Copper lists (`--copper`), or structured record arrays (`--struct`) |
+| `-m <module> data` / `inspect TARGET [--len N] [--copper] [--struct NAME [--count N]] [--try-code] [-f text\|json]` | Inspect non-code data, pointer tables, strings, Amiga Copper lists (`--copper`), structured record arrays (`--struct`), or candidate instructions (`--code` / `--try-code`) |
 | `-m <module> xref TARGET_OR_RANGE [-f text\|json]` | Query all incoming cross-references to an address/label (`xref $1178`) or external references into an address/offset range (`xref $1000..$1FFF`, `xref +3DDEE..+3EFFF`) |
-| `-m <module> hint code TARGET` | Mark target as code entry (`confidence = 100`) and run incremental analysis |
+| `-m <module> hint [--batch FILE \| -f FILE]` | Apply multiple `code`, `data`, `pointer`, or `jump-table` hints in a single transaction + one incremental analysis pass |
+| `-m <module> hint code TARGET... [--batch FILE]` | Mark one or more targets as code entries (`confidence = 100`), reclaim unreferenced interior labels, and run incremental analysis once |
 | `-m <module> hint data TARGET [COUNT] [--string] [--comment TEXT]` | Mark byte/data range or null-terminated string (`--string`) at `confidence = 100` |
 | `-m <module> hint pointer TARGET [COUNT] [--follow] [--comment TEXT]` | Mark 32-bit pointer(s) (`confidence = 100`), create target labels + `DATA_ADDR` xrefs, and seed code targets when `--follow` is passed |
+| `-m <module> hint jump-table TARGET [COUNT] [--base BASE] [--count N] [--entry-size 2\|4]` | Mark a relative offset jump table (`dc.w Target-Base` or `dc.l Target-Base`), create `Target-Base` expressions + `DATA_ADDR` xrefs, and seed all target handlers as `CODE` |
 | `-m <module> hint base-reg REG BASE_HEX [--segment NAME] [--function LABEL]` | Declare a base-register invariant (`REG` = `a4`/`a5`/`a6`, e.g. `hint base-reg a6 0xDFF000`) so `d16(An)` accesses resolve to hardware names / global `DATA`/`BSS` xrefs. Scope is global, or limited to one `--segment` or `--function`; re-runs analysis |
-| `-m <module> rename OLD_NAME NEW_NAME` | Rename a symbol (or multiple `OLD=NEW` pairs, or `--file <path>` batch file) across all segments in a single transaction |
-| `-m <module> comment TARGET [TEXT] [--block] [--batch FILE]` | Set or clear inline comment or function/block header comment (`--block` / `-b`), with strict cell-boundary & function-bounds validation and batch file support (`--batch` / `--file`) |
-| `-m <module> abi [TARGET [SIGNATURE]] [--verify] [--batch FILE] [-f text\|json]` | Set, inspect, or statically verify (`--verify`) a function's register call signature (`(a0=Model*) -> d0 \| clobbers: d1/a1`) |
-| `-m <module> struct add NAME [--size BYTES] OFFSET=FIELD[.b\|.w\|.l\|.p]...` | Define or update a named struct and its field offsets (`struct list [-f text\|json]`, `struct remove NAME`); emitted as `<field> equ <offset>` and `<Struct>_SIZEOF equ <size>` |
+| `-m <module> label delete TARGET...` | Delete one or more bogus/mid-instruction labels (and associated renames) and re-format covering cells |
+| `-m <module> rename [OLD_NAME NEW_NAME \| --delete TARGET... \| --batch FILE \| -f FILE]` | Rename a symbol (or multiple `OLD=NEW` pairs, `--batch`/`-f <path>` batch file, or `--delete` labels) across all segments in a single transaction |
+| `-m <module> comment [TARGET [TEXT]] [--block] [--batch FILE \| -f FILE]` | Set or clear inline comment or function/block header comment (`--block` / `-b`), with strict cell-boundary & function-bounds validation and batch file support (`--batch` / `--file` / `-f`) |
+| `-m <module> abi [TARGET [SIGNATURE]] [--verify] [--batch FILE \| -f FILE] [-f text\|json]` | Set, inspect, or statically verify (`--verify`) a function's register call signature (`(a0=Model*) -> d0 \| clobbers: d1/a1`) |
+| `-m <module> struct add NAME [--size BYTES] OFFSET=FIELD[.b\|.w\|.l\|.p]...` | Define or update a named struct and its field offsets (including negative stack-frame offsets like `-220=rf_NormTablePtr.l`; `struct list [-f text\|json]`, `struct remove NAME`) |
 | `-m <module> alias [REG STRUCT [--fn FUNC]]` | Bind an address register (`a0`..`a6`) globally or per-function (`--fn <func>`) to a struct so `d16(An)` renders symbolically (`alias list [-f text\|json]`, `alias remove REG [--fn FUNC]`) |
 | `-m <module> dump [-f text\|json] [--section SEC]` | Export all durable reverse-engineering state (`entry_points`, `memory_regions`, `renames`, non-auto `comments`, `structs`, `register_aliases`, `carves`) |
-| `-m <module> operand TARGET FORMAT` | Set operand numeric format (`HEX`, `DEC`, `BIN`) and reformat the instruction |
+| `-m <module> operand [TARGET FORMAT] [--batch FILE \| -f FILE]` | Set operand numeric format (`HEX`, `DEC`, `BIN`) for one target or a batch file (`<target> <HEX\|DEC\|BIN>`) and reformat instructions |
 | `-m <module> segment add --file F --base HEX --name N` | Add a binary segment to the module |
 | `-m <module> segment split PARENT --at OFF (--len N \| --to OFF) --base HEX --name N` | Slice an extent out of a segment into a new static-base part (`<name>.bin` + shared DB), filed into the active space |
 | `-m <module> segment remove NAME` | Remove a segment from the module |
@@ -96,13 +100,13 @@ cmp -l assets/disk.1 build/disk_1.bin   # 0 differences
 
 ## Target Address & Label Resolution Syntax
 
-Every CLI command that takes a `TARGET` (`callgraph`, `hint`, `comment`, `operand`) as well as the TUI `Goto` (`g`) prompt accepts any of the following human- and LLM-friendly formats:
+Every CLI command that takes a `TARGET` (`callgraph`, `disasm`, `data`, `xref`, `hint`, `comment`, `operand`, `label delete`) as well as the TUI `Goto` (`g`) prompt accepts any of the following human- and LLM-friendly formats:
 
 | Format | Example | Meaning |
 |--------|---------|---------|
 | `<segment>:<label>` | `hunk5:LAB_5_24BE8` or `hunk3:RenderSprite` | Exact label (original or renamed) within a specific segment |
 | `<label>` | `LAB_5_24BE8` or `RenderSprite` | Unqualified label name (auto-generated or renamed) |
-| `<segment>:+<hex>` | `hunk5:+24BE8` or `hunk3:+$10` | Hex byte offset relative to the start of `<segment>` |
+| `<segment>:+<hex>` / `<segment>:<hex>` | `hunk5:+24BE8`, `hunk5:0x24BE8`, or `hunk3:$10` | Hex byte offset relative to the start of `<segment>` |
 | `<label>+<hex>` | `LAB_5_24BE8+2C` or `hunk5:LAB_5_24BE8+2C` | Hex byte offset relative to a label (ideal for targeting individual instructions inside a function) |
 | `+<hex>` / `+$<hex>` | `+24BE8` | Hex byte offset relative to the currently active segment |
 | `0x<hex>` / `$<hex>` | `0x72580` / `$72580` | Internal virtual address |
@@ -133,7 +137,7 @@ Every CLI command that takes a `TARGET` (`callgraph`, `hint`, `comment`, `operan
 
 ---
 
-## Atomic Analysis & Annotation Primitives (`search`, `data`, `xref`, `struct`, `alias`, `abi`, `dump`)
+## Atomic Analysis & Annotation Primitives (`search`, `disasm`, `data`, `xref`, `struct`, `alias`, `abi`, `dump`)
 
 ### 1. Code, Pattern & Cluster Search (`hunks search`)
 ```bash
@@ -144,8 +148,10 @@ hunks -m <module> search cluster:blitter                # presets: 3dmath, mul,
 hunks -m <module> search smc                            # self-modifying code writes into CODE cells
 ```
 
-### 2. Data, Copper & Struct Array Inspection (`hunks data` / `inspect`)
+### 2. Direct Address-Range Disassembly (`hunks disasm`) & Data Inspection (`hunks data` / `inspect`)
 ```bash
+hunks -m <module> disasm hunk5:0x1DD50 -n 16            # disassemble 16 instructions at any address or mid-function label
+hunks -m <module> disasm +1EF10 -n 12 --try-code        # read-only preview of candidate M68000 instructions on DATA bytes
 hunks -m <module> data +001A4 --len 64                  # formatted dc.b/dc.w/dc.l/pointer/string cells
 hunks -m <module> data CopperList_Main --copper         # decode Amiga Copper MOVE/WAIT/SKIP words
 hunks -m <module> data 0x6B6E --struct Model --count 8  # decode N records using a defined struct stride
@@ -161,9 +167,10 @@ hunks -m <module> xref '+3DDEE..+3EFFF'                 # rollup of all external
 ### 4. Structs, Scoped Register Aliases & Call ABI (`struct`, `alias`, `abi`)
 ```bash
 hunks -m <module> struct add Model --size 18 0=Model_Radius.w 2=Model_Verts.p
+hunks -m <module> struct add RenderFrame --size 240 -220=rf_NormTablePtr.l -216=rf_VertTablePtr.l
 hunks -m <module> alias a0 Model --fn Poly_RenderObject # scope a0 -> Model to a single function
 hunks -m <module> abi Poly_RenderObject "(a0=Model*, d0.w=id) -> d0.l | clobbers: d1-d7/a1-a3"
-hunks -m <module> abi --verify                          # check all ABI strings against static ReadRegs/WriteRegs
+hunks -m <module> abi --verify                          # check all ABI strings against static ReadRegs/WriteRegs/SavedRegs
 ```
 
 ### 5. Structured State Export (`hunks dump`)
@@ -214,13 +221,15 @@ For a freshly `init`'d binary, work top-down to the spine, then bottom-up to nam
 | Are any functions cut off early by unreached branches or inline data tables? | `hunks -m <mod> cg --suspect -n 20` |
 | What indirect calls (`jsr (An)`, `jmp d16(An)`, `jmp d8(PC,Xn)`) exist and which are unresolved? | `hunks -m <mod> cg --indirect [-f json]` |
 | How does function `X` work, what registers/globals does it read/write, and how do callers invoke it? | `hunks -m <mod> cg <X> --code` |
+| How do I inspect a mid-function local label or preview candidate instructions on `DATA` bytes without dumping a huge function? | `hunks -m <mod> disasm <target> [-n 20]`<br>`hunks -m <mod> disasm <target> -n 15 --try-code` |
 | Where are 3D math, Blitter, Copper, Paula audio, bitplane, sprite, CIA, or DMA routines? | `hunks -m <mod> search cluster:<3dmath\|blitter\|copper\|paula\|bitplane\|sprite\|cia\|dma> [--dense]` |
 | Where does the program use a specific opcode (`muls.w`, `divs.w`, `movem.l`) or operand (`$1178`)? | `hunks -m <mod> search m:divs.w`<br>`hunks -m <mod> search 'o:$1178'` |
 | Does this program use self-modifying code (SMC), and what code addresses are patched? | `hunks -m <mod> search smc` |
 | What is inside a non-code table, string block, Copper list, or array of structs? | `hunks -m <mod> data <target> [--len N]`<br>`hunks -m <mod> data <target> --copper`<br>`hunks -m <mod> data <target> --struct <Name> --count <N>` |
 | What reads, writes, or calls a specific variable/function or a whole memory/code region? | `hunks -m <mod> xref <addr_or_label>`<br>`hunks -m <mod> xref '$1000..$1FFF'`<br>`hunks -m <mod> xref '+3DDEE..+3EFFF'` |
-| A jump/pointer table in `DATA` points to unseeded subroutines — how do I mark & trace them? | `hunks -m <mod> hint pointer <addr> <count> --follow` |
-| How do I make `d16(An)` struct offsets readable in `cg --code` and emitted `.asm`? | `hunks -m <mod> struct add <Name> --size <N> 0=field.w ...`<br>`hunks -m <mod> alias <a0..a6> <Name> [--fn <Func>]` |
+| A jump/pointer table in `DATA` points to unseeded subroutines — how do I mark & trace them? | `hunks -m <mod> hint pointer <addr> <count> --follow`<br>`hunks -m <mod> hint jump-table <addr> [count] [--base <base>]`<br>`hunks -m <mod> hint code <addr1> <addr2>...` |
+| How do I remove a bogus/mid-instruction label so the covering instruction can decode cleanly? | `hunks -m <mod> label delete <addr_or_label>...` |
+| How do I make `d16(An)` struct or negative `link a6,#-N` stack-frame offsets readable in `cg --code` and emitted `.asm`? | `hunks -m <mod> struct add <Name> --size <N> 0=field.w -220=local.l ...`<br>`hunks -m <mod> alias <a0..a6> <Name> [--fn <Func>]` |
 | How do I record and statically verify a function's register calling convention? | `hunks -m <mod> abi <Func> "(a0=Model*, d0.w=id) -> d0.l \| clobbers: d1-d3/a1"`<br>`hunks -m <mod> abi --verify` |
 | How do I reconcile all renames, comments, ABIs, structs, and regions with `FINDINGS.md`? | `hunks -m <mod> dump -f json` |
 
@@ -446,8 +455,11 @@ hunks -m frontier cg hunk9:LAB_9_03E44 --code
 ```
 If `+03EF4` is valid code that was not reached, mark it as `code`; if it is a pointer table or string, mark it explicitly:
 ```bash
-# Mark unreached instructions at hunk9:+03EF4 as code and re-trace:
-hunks -m frontier hint code hunk9:+03EF4
+# Mark one or more unreached instructions as code and re-trace in a single pass:
+hunks -m frontier hint code hunk9:0x03EF4 hunk5:0x1EF10
+
+# Or mark a 16-bit relative offset jump table (positive/negative offsets) and seed all handlers:
+hunks -m frontier hint jump-table hunk5:0x1DD6A 24 --base hunk5:0x1DD66
 
 # Or mark 8 longword pointers at hunk5:+1ABB2 and follow their code targets:
 hunks -m frontier hint pointer hunk5:+1ABB2 8 --follow
diff --git a/cmd/hunks/agent_cmds.go b/cmd/hunks/agent_cmds.go
index 98d9205..36ca5df 100644
--- a/cmd/hunks/agent_cmds.go
+++ b/cmd/hunks/agent_cmds.go
@@ -14,8 +14,10 @@ import (
 	"strings"
 
 	"github.com/mikolas/hunks/internal/amiga"
+	"github.com/mikolas/hunks/internal/analyzer"
 	"github.com/mikolas/hunks/internal/callgraph"
 	"github.com/mikolas/hunks/internal/db"
+	"github.com/mikolas/hunks/internal/m68k"
 	"github.com/mikolas/hunks/internal/project"
 	"github.com/spf13/cobra"
 )
@@ -55,7 +57,7 @@ func registerAgentCommands(
 
 	// --- 2. data (alias: inspect) ---
 	var dataLen, dataCount int
-	var dataCopper bool
+	var dataCopper, dataTryCode bool
 	var dataStruct, dataFormat string
 	dataCmd := &cobra.Command{
 		Use:     "data <addr_or_label>",
@@ -86,6 +88,14 @@ func registerAgentCommands(
 			if err != nil {
 				return err
 			}
+			if dataTryCode {
+				out, err := renderDisasmRange(proj, ctrl, cg, addr, 0, dataLen, true, dataFormat)
+				if err != nil {
+					return err
+				}
+				fmt.Print(out)
+				return nil
+			}
 			out, err := renderDataInspection(proj, ctrl, cg, addr, dataLen, dataCopper, dataStruct, dataCount, dataFormat)
 			if err != nil {
 				return err
@@ -96,11 +106,116 @@ func registerAgentCommands(
 	}
 	dataCmd.Flags().IntVar(&dataLen, "len", 64, "Number of bytes to inspect when target is not a single bounded table/string")
 	dataCmd.Flags().BoolVar(&dataCopper, "copper", false, "Decode words as Amiga Copper MOVE/WAIT/SKIP instructions")
+	dataCmd.Flags().BoolVar(&dataTryCode, "code", false, "Decode bytes as candidate M68000 instructions without modifying the DB")
+	dataCmd.Flags().BoolVar(&dataTryCode, "try-code", false, "Alias for --code")
 	dataCmd.Flags().StringVar(&dataStruct, "struct", "", "Decode bytes as records of the named struct")
 	dataCmd.Flags().IntVar(&dataCount, "count", 1, "Number of struct records to decode with --struct")
 	dataCmd.Flags().StringVarP(&dataFormat, "format", "f", "text", "Output format: text or json")
 	rootCmd.AddCommand(dataCmd)
 
+	// --- 2b. disasm ---
+	var disasmCount, disasmLen int
+	var disasmTryCode bool
+	var disasmFormat string
+	disasmCmd := &cobra.Command{
+		Use:   "disasm <addr_or_label>",
+		Short: "Disassemble a bounded address range directly (even outside functions or in unreached DATA)",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(_ *cobra.Command, args []string) error {
+			proj, err := loadTargetProject(getWorkspaceRoot(), *moduleName)
+			if err != nil {
+				return err
+			}
+			seg, err := requireSegment(proj)
+			if err != nil {
+				return err
+			}
+			ctrl, err := db.New(seg.DB)
+			if err != nil {
+				return err
+			}
+			defer ctrl.Close()
+			proj.SyncDBScope(ctrl)
+
+			addr, err := resolveAddrOrLabel(proj, ctrl, args[0])
+			if err != nil {
+				return fmt.Errorf("cannot resolve address or label %q: %w", args[0], err)
+			}
+			cg, err := callgraph.Build(proj)
+			if err != nil {
+				return err
+			}
+			out, err := renderDisasmRange(proj, ctrl, cg, addr, disasmCount, disasmLen, disasmTryCode, disasmFormat)
+			if err != nil {
+				return err
+			}
+			fmt.Print(out)
+			return nil
+		},
+	}
+	disasmCmd.Flags().IntVarP(&disasmCount, "count", "n", 30, "Number of instructions/cells to disassemble (ignored when --len > 0)")
+	disasmCmd.Flags().IntVar(&disasmLen, "len", 0, "Byte length to disassemble (overrides -n when > 0)")
+	disasmCmd.Flags().BoolVar(&disasmTryCode, "try-code", false, "Decode DATA_* cells in range as candidate M68000 instructions without modifying the DB")
+	disasmCmd.Flags().BoolVar(&disasmTryCode, "code", false, "Alias for --try-code")
+	disasmCmd.Flags().StringVarP(&disasmFormat, "format", "f", "text", "Output format: text or json")
+	rootCmd.AddCommand(disasmCmd)
+
+	// --- 2c. label ---
+	labelCmd := &cobra.Command{
+		Use:   "label",
+		Short: "Manage labels (e.g. delete bogus or stale interior labels)",
+	}
+	labelDeleteCmd := &cobra.Command{
+		Use:     "delete <addr_or_label>...",
+		Aliases: []string{"rm", "remove"},
+		Short:   "Delete one or more labels (and any associated rename or function entry)",
+		Args:    cobra.MinimumNArgs(1),
+		RunE: func(_ *cobra.Command, args []string) error {
+			proj, err := loadTargetProject(getWorkspaceRoot(), *moduleName)
+			if err != nil {
+				return err
+			}
+			seg, err := requireSegment(proj)
+			if err != nil {
+				return err
+			}
+			ctrl, err := db.New(seg.DB)
+			if err != nil {
+				return err
+			}
+			defer ctrl.Close()
+			proj.SyncDBScope(ctrl)
+
+			var deleted []uint32
+			if err := ctrl.WithTransaction(func() error {
+				for _, arg := range args {
+					addr, err := resolveAddrOrLabel(proj, ctrl, arg)
+					if err != nil {
+						return fmt.Errorf("cannot resolve address or label %q: %w", arg, err)
+					}
+					if err := ctrl.DeleteLabelAndRename(addr); err != nil {
+						return err
+					}
+					proj.Data.EntryPoints = slices.DeleteFunc(proj.Data.EntryPoints, func(ep project.EntryPoint) bool {
+						return ep.Addr == addr
+					})
+					deleted = append(deleted, addr)
+					fmt.Printf("Deleted label at 0x%X (%s)\n", addr, arg)
+				}
+				return nil
+			}); err != nil {
+				return err
+			}
+			_ = proj.Save()
+			if an, err := analyzer.New(proj, ctrl); err == nil {
+				an.ReanalyzeXrefsBatch(deleted)
+			}
+			return nil
+		},
+	}
+	labelCmd.AddCommand(labelDeleteCmd)
+	rootCmd.AddCommand(labelCmd)
+
 	// --- 3. xref ---
 	var xrefFormat string
 	xrefCmd := &cobra.Command{
@@ -345,6 +460,10 @@ func registerAgentCommands(
 			if err != nil {
 				return err
 			}
+			if abiBatchFile == "" && abiFormat != "text" && abiFormat != "json" {
+				abiBatchFile = abiFormat
+				abiFormat = "text"
+			}
 			return runABICommand(proj, args, abiBatchFile, abiVerify, abiFormat, resolveCallerPath)
 		},
 	}
@@ -885,11 +1004,15 @@ func renderDataInspection(
 			case db.CellDataW:
 				if bIdx+2 <= len(segBytes) {
 					val := binary.BigEndian.Uint16(segBytes[bIdx : bIdx+2])
+					asmStr := fmt.Sprintf("dc.w $%04X (%d)", val, int16(val))
+					if c.OpStr != nil && *c.OpStr != "" {
+						asmStr = fmt.Sprintf("dc.w %s ($%04X / %d)", *c.OpStr, val, int16(val))
+					}
 					items = append(items, dataItemJSON{
 						Offset:  fmt.Sprintf("+%05X", off),
 						Addr:    fmt.Sprintf("0x%X", cur),
 						Type:    c.Type.AsStr(),
-						Asm:     fmt.Sprintf("dc.w $%04X (%d)", val, int16(val)),
+						Asm:     asmStr,
 						Comment: cg.Comments[cur].EffectiveComment(),
 					})
 					cur += 2
@@ -1520,7 +1643,11 @@ func renderStructList(proj *project.Project, format string) error {
 		}
 		slices.Sort(offs)
 		for _, off := range offs {
-			fmt.Printf("    +%-4d ($%02X)  %s\n", off, uint32(off), sdef[strconv.Itoa(off)])
+			if off < 0 {
+				fmt.Printf("    %-5d (-$%02X)  %s\n", off, uint32(-off), sdef[strconv.Itoa(off)])
+			} else {
+				fmt.Printf("    +%-4d ($%02X)  %s\n", off, uint32(off), sdef[strconv.Itoa(off)])
+			}
 		}
 	}
 	return nil
@@ -2016,3 +2143,329 @@ func runDumpCommand(proj *project.Project, section string, format string) (strin
 	}
 	return out.String(), nil
 }
+
+type disasmItemJSON struct {
+	Offset   string `json:"offset"`
+	FnOffset string `json:"fn_offset,omitempty"`
+	Addr     string `json:"addr"`
+	Label    string `json:"label,omitempty"`
+	Type     string `json:"type"`
+	Mnemonic string `json:"mnemonic"`
+	Operands string `json:"operands,omitempty"`
+	Comment  string `json:"comment,omitempty"`
+}
+
+func formatReadOnlyTryInsn(proj *project.Project, cg *callgraph.CallGraph, relocs map[uint32]uint32, addr uint32, insn *m68k.Insn) (string, string) {
+	mnem := insn.FullMnemonic()
+	if insn.NumOps == 0 {
+		return mnem, ""
+	}
+	fmtOp := func(op m68k.Operand) string {
+		switch op.Mode {
+		case m68k.EABranch:
+			t := op.UVal
+			if l, ok := cg.Labels[t]; ok && l != "" {
+				return l
+			}
+			return proj.AutoLabel(t)
+		case m68k.EAPCDisp16, m68k.EAPCIndex:
+			t := op.UVal
+			l := cg.Labels[t]
+			if l == "" {
+				l = proj.AutoLabel(t)
+			}
+			if op.Mode == m68k.EAPCIndex {
+				return l + "(pc," + op.IndexRegName() + op.IndexSize.DotSuffix() + ")"
+			}
+			return l + "(pc)"
+		case m68k.EAAbsLong:
+			extAddr := addr + uint32(op.ExtOffset)
+			if rTgt, ok := relocs[extAddr]; ok {
+				l := cg.Labels[rTgt]
+				if l == "" {
+					l = proj.AutoLabel(rTgt)
+				}
+				return l + ".l"
+			}
+			if hw, ok := amiga.GetAmigaHWOperand(op.UVal); ok {
+				return hw + ".l"
+			}
+		case m68k.EAAbsShort:
+			if hw, ok := amiga.GetAmigaHWOperand(op.UVal); ok {
+				return hw + ".w"
+			}
+		case m68k.EAImm:
+			if op.ImmSize == m68k.SizeL && op.ExtSize == 4 && insn.Size >= 6 {
+				extAddr := addr + uint32(op.ExtOffset)
+				if rTgt, ok := relocs[extAddr]; ok {
+					l := cg.Labels[rTgt]
+					if l == "" {
+						l = proj.AutoLabel(rTgt)
+					}
+					return "#" + l
+				}
+			}
+		}
+		return op.FormatASM(insn.Op)
+	}
+	if insn.NumOps == 1 {
+		return mnem, fmtOp(insn.Ops[0])
+	}
+	return mnem, fmtOp(insn.Ops[0]) + "," + fmtOp(insn.Ops[1])
+}
+
+func renderDisasmRange(
+	proj *project.Project,
+	ctrl *db.Controller,
+	cg *callgraph.CallGraph,
+	startAddr uint32,
+	maxInsts int,
+	byteLen int,
+	tryCode bool,
+	format string,
+) (string, error) {
+	seg := proj.SegmentAtAddr(startAddr)
+	if seg == nil {
+		return "", fmt.Errorf("address $%X is not inside any active segment", startAddr)
+	}
+	segBytes := seg.LoadBinaryData()
+	segBase := seg.Base
+	segEnd := segBase + uint32(len(segBytes))
+	if startAddr >= segEnd {
+		return "", fmt.Errorf("address $%X is past end of segment %s ($%X)", startAddr, seg.Name, segEnd)
+	}
+
+	relocs, _ := ctrl.GetAllRelocs()
+
+	var enclosingFn *callgraph.FunctionNode
+	if fAddr, ok := cg.InsnToFunc[startAddr]; ok {
+		enclosingFn = cg.Functions[fAddr]
+	} else if fn, ok := cg.Functions[startAddr]; ok {
+		enclosingFn = fn
+	}
+
+	if maxInsts <= 0 && byteLen <= 0 {
+		maxInsts = 30
+	}
+	var endBound uint32 = segEnd
+	if byteLen > 0 {
+		if startAddr+uint32(byteLen) < endBound {
+			endBound = startAddr + uint32(byteLen)
+		}
+	}
+
+	var items []disasmItemJSON
+	cur := startAddr
+	count := 0
+	for cur < endBound && (byteLen > 0 || count < maxInsts) {
+		off := cur - segBase
+		bIdx := int(off)
+		if bIdx >= len(segBytes) {
+			break
+		}
+
+		curFn := enclosingFn
+		if fAddr, ok := cg.InsnToFunc[cur]; ok {
+			if fn, okF := cg.Functions[fAddr]; okF {
+				curFn = fn
+			}
+		} else if fn, okF := cg.Functions[cur]; okF {
+			curFn = fn
+		}
+
+		var fnOffStr, fnName, fnAuto string
+		if curFn != nil {
+			fnOffStr = fmt.Sprintf("(%s)", formatFnOffset(cur, curFn.EntryAddr))
+			fnName = curFn.Name
+			fnAuto = proj.AutoLabel(curFn.EntryAddr)
+		} else {
+			fnOffStr = fmt.Sprintf("(+%03X)", cur-startAddr)
+		}
+
+		lbl := cg.Labels[cur]
+		cmt := cg.Comments[cur].EffectiveComment()
+		cell, hasCell := cg.Cells[cur]
+
+		if hasCell && cell.Type == db.CellCode {
+			mnem := cell.MnemonicStr()
+			opStr := proj.ApplyStructAliasesToOpStr(cell.OpStrVal(), fnName, fnAuto)
+			items = append(items, disasmItemJSON{
+				Offset:   fmt.Sprintf("+%05X", off),
+				FnOffset: fnOffStr,
+				Addr:     fmt.Sprintf("0x%X", cur),
+				Label:    lbl,
+				Type:     "CODE",
+				Mnemonic: mnem,
+				Operands: opStr,
+				Comment:  cmt,
+			})
+			step := cell.Size
+			if step == 0 {
+				step = 2
+			}
+			cur += step
+			count++
+			continue
+		}
+
+		if tryCode {
+			rem := min(10, len(segBytes)-bIdx)
+			if insn, ok := m68k.Decode(segBytes[bIdx:bIdx+rem], cur); ok && insn.Size > 0 && cur+uint32(insn.Size) <= segEnd {
+				mnem, opStr := formatReadOnlyTryInsn(proj, cg, relocs, cur, &insn)
+				opStr = proj.ApplyStructAliasesToOpStr(opStr, fnName, fnAuto)
+				cellTag := "TRY_CODE"
+				if hasCell {
+					cellTag = fmt.Sprintf("TRY_CODE (was %s)", cell.Type.AsStr())
+				}
+				tryCmt := cmt
+				if tryCmt != "" {
+					tryCmt += " ; [" + cellTag + "]"
+				} else {
+					tryCmt = "[" + cellTag + "]"
+				}
+				items = append(items, disasmItemJSON{
+					Offset:   fmt.Sprintf("+%05X", off),
+					FnOffset: fnOffStr,
+					Addr:     fmt.Sprintf("0x%X", cur),
+					Label:    lbl,
+					Type:     cellTag,
+					Mnemonic: mnem,
+					Operands: opStr,
+					Comment:  tryCmt,
+				})
+				cur += uint32(insn.Size)
+				count++
+				continue
+			}
+		}
+
+		if hasCell {
+			var mnem, opStr string
+			switch cell.Type {
+			case db.CellPointer:
+				mnem = "dc.l"
+				opStr = cell.OpStrVal()
+				if opStr == "" && bIdx+4 <= len(segBytes) {
+					v := binary.BigEndian.Uint32(segBytes[bIdx : bIdx+4])
+					if tLbl := cg.Labels[v]; tLbl != "" {
+						opStr = tLbl
+					} else {
+						opStr = fmt.Sprintf("$%08X", v)
+					}
+				}
+			case db.CellDataL:
+				mnem = "dc.l"
+				if cell.OpStr != nil && *cell.OpStr != "" {
+					opStr = *cell.OpStr
+				} else if bIdx+4 <= len(segBytes) {
+					opStr = fmt.Sprintf("$%08X", binary.BigEndian.Uint32(segBytes[bIdx:bIdx+4]))
+				}
+			case db.CellDataW:
+				mnem = "dc.w"
+				if cell.OpStr != nil && *cell.OpStr != "" {
+					opStr = *cell.OpStr
+				} else if bIdx+2 <= len(segBytes) {
+					opStr = fmt.Sprintf("$%04X", binary.BigEndian.Uint16(segBytes[bIdx:bIdx+2]))
+				}
+			case db.CellStr:
+				mnem = "dc.b"
+				endC := min(bIdx+int(cell.Size), len(segBytes))
+				opStr = fmt.Sprintf("%q,0", strings.TrimRight(string(segBytes[bIdx:endC]), "\x00"))
+			default:
+				mnem = "dc.b"
+				opStr = fmt.Sprintf("$%02X", segBytes[bIdx])
+			}
+			items = append(items, disasmItemJSON{
+				Offset:   fmt.Sprintf("+%05X", off),
+				FnOffset: fnOffStr,
+				Addr:     fmt.Sprintf("0x%X", cur),
+				Label:    lbl,
+				Type:     cell.Type.AsStr(),
+				Mnemonic: mnem,
+				Operands: opStr,
+				Comment:  cmt,
+			})
+			step := cell.Size
+			if step == 0 {
+				step = 2
+			}
+			cur += step
+			count++
+			continue
+		}
+
+		// Raw unmapped word/byte fallback
+		if bIdx+2 <= len(segBytes) {
+			val := binary.BigEndian.Uint16(segBytes[bIdx : bIdx+2])
+			items = append(items, disasmItemJSON{
+				Offset:   fmt.Sprintf("+%05X", off),
+				FnOffset: fnOffStr,
+				Addr:     fmt.Sprintf("0x%X", cur),
+				Label:    lbl,
+				Type:     "RAW",
+				Mnemonic: "dc.w",
+				Operands: fmt.Sprintf("$%04X", val),
+				Comment:  cmt,
+			})
+			cur += 2
+		} else {
+			items = append(items, disasmItemJSON{
+				Offset:   fmt.Sprintf("+%05X", off),
+				FnOffset: fnOffStr,
+				Addr:     fmt.Sprintf("0x%X", cur),
+				Label:    lbl,
+				Type:     "RAW",
+				Mnemonic: "dc.b",
+				Operands: fmt.Sprintf("$%02X", segBytes[bIdx]),
+				Comment:  cmt,
+			})
+			cur++
+		}
+		count++
+	}
+
+	titleLbl := cg.Labels[startAddr]
+	if titleLbl == "" {
+		titleLbl = proj.AutoLabel(startAddr)
+	}
+	fnCtx := "unowned"
+	if enclosingFn != nil {
+		fnCtx = fmt.Sprintf("%s%s", enclosingFn.QualifiedName(), formatFnOffset(startAddr, enclosingFn.EntryAddr))
+	}
+
+	if format == "json" {
+		payload := map[string]any{
+			"label":    titleLbl,
+			"segment":  seg.Name,
+			"offset":   fmt.Sprintf("+%05X", startAddr-segBase),
+			"addr":     fmt.Sprintf("0x%X", startAddr),
+			"function": fnCtx,
+			"try_code": tryCode,
+			"items":    items,
+		}
+		b, err := json.MarshalIndent(payload, "", "  ")
+		if err != nil {
+			return "", err
+		}
+		return string(b) + "\n", nil
+	}
+
+	var out strings.Builder
+	fmt.Fprintf(&out, "=== Disassembly @ %s [+%05X / $%X] (%s, fn: %s) ===\n",
+		titleLbl, startAddr-segBase, startAddr, seg.Name, fnCtx)
+	for _, it := range items {
+		if it.Label != "" {
+			fmt.Fprintf(&out, "%s:\n", it.Label)
+		}
+		cmtSuffix := ""
+		if it.Comment != "" {
+			cmtSuffix = " ; " + it.Comment
+		}
+		if it.Operands != "" {
+			fmt.Fprintf(&out, "  %s %-7s  %-8s %s%s\n", it.Offset, it.FnOffset, it.Mnemonic, it.Operands, cmtSuffix)
+		} else {
+			fmt.Fprintf(&out, "  %s %-7s  %-8s%s\n", it.Offset, it.FnOffset, it.Mnemonic, cmtSuffix)
+		}
+	}
+	return out.String(), nil
+}
diff --git a/cmd/hunks/agent_cmds_test.go b/cmd/hunks/agent_cmds_test.go
index a62934c..cd70c96 100644
--- a/cmd/hunks/agent_cmds_test.go
+++ b/cmd/hunks/agent_cmds_test.go
@@ -151,4 +151,42 @@ func TestAgentWorkflowCommands(t *testing.T) {
 	if !strings.Contains(dumpJSON, "\"scale X\"") || !strings.Contains(dumpJSON, "\"3D math kernel\"") {
 		t.Fatalf("expected user comments in dump JSON:\n%s", dumpJSON)
 	}
+
+	// 5. Test seg:offset without '+' in Project.ResolveTarget and CallGraph.ResolveTarget
+	if addr, ok := proj.ResolveTarget(ctrl, "main:0x0004"); !ok || addr != 0x10004 {
+		t.Fatalf("expected main:0x0004 -> 0x10004, got (%#x, %v)", addr, ok)
+	}
+	if addr, ok := cg.ResolveTarget(proj, "main:0x0004", ""); !ok || addr != 0x10000 {
+		t.Fatalf("expected cg.ResolveTarget(\"main:0x0004\") -> enclosing function 0x10000, got (%#x, %v)", addr, ok)
+	}
+
+	// 6. Test VerifyABI with callee-saved input register (no false-positive warning)
+	if warns := callgraph.VerifyABI("(a1:color_table_ptr, a6:globals_base) -> void", []string{"a6"}, []string{"d0"}, []string{"a1", "a5"}); len(warns) != 0 {
+		t.Fatalf("expected VerifyABI not to warn when claimed input a1 is in savedRegs, got %v", warns)
+	}
+
+	// 7. Test renderDisasmRange (with and without --try-code)
+	disasmOut, err := renderDisasmRange(proj, ctrl, cg, 0x10000, 3, 0, false, "text")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(disasmOut, "MathKernel:") || !strings.Contains(disasmOut, "muls.w") || !strings.Contains(disasmOut, "; scale X") {
+		t.Fatalf("unexpected renderDisasmRange output:\n%s", disasmOut)
+	}
+	tryCodeOut, err := renderDisasmRange(proj, ctrl, cg, 0x1000C, 1, 0, true, "text")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(tryCodeOut, "[TRY_CODE") {
+		t.Fatalf("expected [TRY_CODE annotation on data bytes in renderDisasmRange --try-code, got:\n%s", tryCodeOut)
+	}
+
+	// 8. Test DeleteLabelAndRename (`hunks label delete`)
+	_ = ctrl.SetLabel(0x10006, "LAB_10006", db.LabelLab, true)
+	if err := ctrl.DeleteLabelAndRename(0x10006); err != nil {
+		t.Fatal(err)
+	}
+	if lbl, _ := ctrl.GetLabelFull(0x10006); lbl != nil {
+		t.Fatalf("expected deleted label at 0x10006 to be nil, got %+v", lbl)
+	}
 }
diff --git a/cmd/hunks/main.go b/cmd/hunks/main.go
index 72de072..12d87ce 100644
--- a/cmd/hunks/main.go
+++ b/cmd/hunks/main.go
@@ -16,6 +16,7 @@ import (
 	"github.com/mikolas/hunks/internal/db"
 	"github.com/mikolas/hunks/internal/emitter"
 	"github.com/mikolas/hunks/internal/hunk"
+	"github.com/mikolas/hunks/internal/m68k"
 	"github.com/mikolas/hunks/internal/modules"
 	"github.com/mikolas/hunks/internal/project"
 	"github.com/mikolas/hunks/internal/tui"
@@ -36,20 +37,26 @@ func resolveAddrOrLabel(proj *project.Project, ctrl *db.Controller, val string)
 }
 
 func listWorkspaceTargets(workspaceRoot string) []string {
-	workDir := filepath.Join(workspaceRoot, "work")
-	entries, err := os.ReadDir(workDir)
-	if err != nil {
-		return nil
-	}
 	var targets []string
-	for _, entry := range entries {
-		if entry.IsDir() {
-			p := filepath.Join(workDir, entry.Name(), "project.json")
-			if _, err := os.Stat(p); err == nil {
-				targets = append(targets, entry.Name())
+	seen := make(map[string]bool)
+	scanDir := func(dir string) {
+		entries, err := os.ReadDir(dir)
+		if err != nil {
+			return
+		}
+		for _, entry := range entries {
+			if entry.IsDir() && !seen[entry.Name()] {
+				p := filepath.Join(dir, entry.Name(), "project.json")
+				if _, err := os.Stat(p); err == nil {
+					seen[entry.Name()] = true
+					targets = append(targets, entry.Name())
+				}
 			}
 		}
 	}
+	scanDir(filepath.Join(workspaceRoot, "work"))
+	scanDir(workspaceRoot)
+	scanDir(filepath.Join(workspaceRoot, "work", "work"))
 	slices.Sort(targets)
 	return targets
 }
@@ -70,8 +77,25 @@ func loadTargetProject(workspaceRoot string, moduleOpt string) (*project.Project
 	targetName = strings.TrimSuffix(targetName, "/")
 	targetWorkDir := filepath.Join(workspaceRoot, "work", targetName)
 	projJSON := filepath.Join(targetWorkDir, "project.json")
+	effectiveRoot := workspaceRoot
 	if _, err := os.Stat(projJSON); err != nil {
-		return nil, fmt.Errorf("Module '%s' not found at %s. Run 'hunks init' first.%s", targetName, projJSON, availHint)
+		altDir := filepath.Join(workspaceRoot, targetName)
+		altJSON := filepath.Join(altDir, "project.json")
+		nestedDir := filepath.Join(workspaceRoot, "work", "work", targetName)
+		nestedJSON := filepath.Join(nestedDir, "project.json")
+		if _, errAlt := os.Stat(altJSON); errAlt == nil {
+			targetWorkDir = altDir
+			projJSON = altJSON
+			if filepath.Base(workspaceRoot) == "work" {
+				effectiveRoot = filepath.Dir(workspaceRoot)
+			}
+		} else if _, errNested := os.Stat(nestedJSON); errNested == nil {
+			targetWorkDir = nestedDir
+			projJSON = nestedJSON
+			effectiveRoot = filepath.Join(workspaceRoot, "work")
+		} else {
+			return nil, fmt.Errorf("Module '%s' not found at %s. Run 'hunks init' first.%s", targetName, projJSON, availHint)
+		}
 	}
 
 	if err := os.Chdir(targetWorkDir); err != nil {
@@ -81,7 +105,7 @@ func loadTargetProject(workspaceRoot string, moduleOpt string) (*project.Project
 	if err := proj.Load(); err != nil {
 		return nil, err
 	}
-	proj.WorkspaceRoot = workspaceRoot
+	proj.WorkspaceRoot = effectiveRoot
 	if proj.Data.TargetName == "" {
 		proj.Data.TargetName = targetName
 	}
@@ -96,6 +120,135 @@ func requireSegment(proj *project.Project) (project.Segment, error) {
 	return *seg, nil
 }
 
+func applyCodeHintsBatch(proj *project.Project, ctrl *db.Controller, rawAddrs []uint32) ([]uint32, error) {
+	if len(rawAddrs) == 0 {
+		return nil, nil
+	}
+	aligned := make([]uint32, 0, len(rawAddrs))
+	var singleSegName string
+	multiOrReloc := false
+	segDataCache := make(map[string][]byte)
+
+	for i, rawAddr := range rawAddrs {
+		addr := rawAddr &^ 1
+		aligned = append(aligned, addr)
+		autoLbl := proj.AutoLabel(addr)
+
+		var segName string
+		isReloc := false
+		var segData []byte
+		var segBase uint32
+		if targetSeg := proj.SegmentAtAddr(addr); targetSeg != nil {
+			segName = targetSeg.Name
+			isReloc = targetSeg.IsRelocatable()
+			segBase = targetSeg.Base
+			data, ok := segDataCache[segName]
+			if !ok {
+				data = targetSeg.LoadBinaryData()
+				segDataCache[segName] = data
+			}
+			segData = data
+		}
+		if i == 0 {
+			singleSegName = segName
+			if isReloc || segName == "" {
+				multiOrReloc = true
+			}
+		} else if isReloc || segName == "" || !strings.EqualFold(segName, singleSegName) {
+			multiOrReloc = true
+		}
+
+		cur := addr
+		for step := 0; step < 32; step++ {
+			insnSize := uint32(2)
+			var decoded m68k.Insn
+			hasDecoded := false
+			if len(segData) > 0 && cur >= segBase {
+				off := int(cur - segBase)
+				if off < 0 || off+2 > len(segData) {
+					break
+				}
+				end := min(off+10, len(segData))
+				if insn, ok := m68k.Decode(segData[off:end], cur); ok && insn.Size >= 2 {
+					insnSize = uint32(insn.Size)
+					decoded = insn
+					hasDecoded = true
+				} else if step > 0 {
+					break
+				}
+			} else if step > 0 {
+				break
+			}
+			if step > 0 {
+				if existing, err := ctrl.GetCell(cur); err == nil && existing != nil && existing.Type == db.CellCode && existing.Size == insnSize {
+					break
+				}
+			}
+			_ = ctrl.DeleteCellsInRange(cur, cur+insnSize)
+			_ = ctrl.ClearOverlaps(cur, insnSize)
+			for inner := cur + 1; inner < cur+insnSize; inner++ {
+				selfTarget := false
+				if hasDecoded {
+					for opIdx := uint8(0); opIdx < decoded.NumOps; opIdx++ {
+						if decoded.Ops[opIdx].UVal == inner {
+							selfTarget = true
+							break
+						}
+					}
+				}
+				if !selfTarget {
+					_ = ctrl.DeleteLabelAndRename(inner)
+					_ = ctrl.DeleteEdgesAndXrefsTo(inner)
+				}
+			}
+			if !hasDecoded || decoded.IsTerminator() {
+				break
+			}
+			cur += insnSize
+		}
+
+		hasEP := false
+		for _, ep := range proj.Data.EntryPoints {
+			if (ep.Segment == "" || strings.EqualFold(ep.Segment, segName)) && ep.Addr == addr {
+				hasEP = true
+				break
+			}
+		}
+		if !hasEP {
+			proj.Data.EntryPoints = append(proj.Data.EntryPoints, project.EntryPoint{
+				Addr:    addr,
+				Name:    autoLbl,
+				Segment: segName,
+			})
+		}
+
+		if lbl, err := ctrl.GetLabelFull(addr); err != nil || lbl == nil || lbl.IsAuto {
+			_ = ctrl.SetLabel(addr, autoLbl, db.LabelLab, true)
+		}
+	}
+	_ = proj.Save()
+
+	var an *analyzer.Analyzer
+	var err error
+	if multiOrReloc || singleSegName == "" {
+		an, err = analyzer.New(proj, ctrl)
+	} else {
+		an, err = analyzer.NewForSegment(proj, ctrl, singleSegName)
+	}
+	if err != nil {
+		proj.SyncDBScope(ctrl)
+		return aligned, err
+	}
+	an.AnalyzeIncremental(aligned)
+	if !multiOrReloc && singleSegName != "" {
+		proj.RefreshCoverageStats(ctrl)
+		_ = proj.Save()
+	} else {
+		proj.SyncDBScope(ctrl)
+	}
+	return aligned, nil
+}
+
 func runTraceAnalysis(proj *project.Project, ctrl *db.Controller, budget uint64) error {
 	segs := proj.ActiveSegments()
 	if len(segs) == 0 {
@@ -340,6 +493,9 @@ func main() {
 			targetName := strings.TrimPrefix(rawTarget, "work/")
 			targetName = strings.TrimSuffix(targetName, "/")
 
+			if workspacePath == "." && filepath.Base(workspaceRoot) == "work" {
+				workspaceRoot = filepath.Dir(workspaceRoot)
+			}
 			targetWorkDir := filepath.Join(workspaceRoot, "work", targetName)
 			projJSON := filepath.Join(targetWorkDir, "project.json")
 			if _, err := os.Stat(projJSON); err == nil && !initForce {
@@ -826,22 +982,147 @@ func main() {
 
 	// --- hint ---
 	var hintFollow, hintString bool
-	var hintComment, hintSegment, hintFunction string
+	var hintComment, hintSegment, hintFunction, hintBase, hintBatchFile string
+	var hintCount, hintEntrySize int
 	hintCmd := &cobra.Command{
-		Use:   "hint <pointer|data|code|base-reg> <addr> [count]",
-		Short: "Provide an analysis hint (pointer, data, code, or base-reg)",
-		Args:  cobra.RangeArgs(2, 3),
+		Use:   "hint [pointer|data|code|base-reg|jump-table] [addr...]",
+		Short: "Provide one or more analysis hints (pointer, data, code, base-reg, or jump-table; supports --batch/-f)",
+		Args:  cobra.ArbitraryArgs,
 		RunE: func(_ *cobra.Command, args []string) error {
-			typeStr := args[0]
-			addrStr := args[1]
-			var countStr string
-			if len(args) >= 3 {
-				countStr = args[2]
-			}
-			switch typeStr {
-			case "pointer", "data", "code", "base-reg":
-			default:
-				return fmt.Errorf("invalid hint type %q (expected pointer, data, code, or base-reg)", typeStr)
+			type hintSpec struct {
+				kind      string
+				addrStr   string
+				countStr  string
+				baseStr   string
+				entrySize int
+				follow    bool
+				isString  bool
+				comment   string
+			}
+			var specs []hintSpec
+
+			if hintBatchFile != "" {
+				var r io.Reader
+				if hintBatchFile == "-" {
+					r = os.Stdin
+				} else {
+					fpath := resolveCallerPath(hintBatchFile)
+					f, err := os.Open(fpath)
+					if err != nil {
+						return fmt.Errorf("failed to open hint batch file '%s': %w", fpath, err)
+					}
+					defer f.Close()
+					r = f
+				}
+				scanner := bufio.NewScanner(r)
+				lineIdx := 0
+				for scanner.Scan() {
+					lineIdx++
+					line := scanner.Text()
+					trimmed := line
+					if idx := strings.IndexByte(trimmed, '#'); idx >= 0 {
+						trimmed = trimmed[:idx]
+					}
+					if idx := strings.IndexByte(trimmed, ';'); idx >= 0 {
+						trimmed = trimmed[:idx]
+					}
+					trimmed = strings.TrimSpace(trimmed)
+					if trimmed == "" {
+						continue
+					}
+					fields := strings.Fields(trimmed)
+					if len(fields) == 1 {
+						specs = append(specs, hintSpec{
+							kind:      "code",
+							addrStr:   fields[0],
+							entrySize: hintEntrySize,
+							follow:    hintFollow,
+							isString:  hintString,
+						})
+						continue
+					}
+					k := strings.ToLower(fields[0])
+					switch k {
+					case "code":
+						for _, a := range fields[1:] {
+							specs = append(specs, hintSpec{kind: "code", addrStr: a})
+						}
+					case "pointer", "data", "base-reg", "jump-table":
+						sp := hintSpec{
+							kind:      k,
+							addrStr:   fields[1],
+							baseStr:   hintBase,
+							entrySize: hintEntrySize,
+							follow:    hintFollow,
+							isString:  hintString,
+						}
+						for _, extra := range fields[2:] {
+							switch {
+							case extra == "--follow":
+								sp.follow = true
+							case extra == "--string":
+								sp.isString = true
+							case strings.HasPrefix(extra, "--base="):
+								sp.baseStr = strings.TrimPrefix(extra, "--base=")
+							case strings.HasPrefix(extra, "--count="):
+								sp.countStr = strings.TrimPrefix(extra, "--count=")
+							case sp.countStr == "":
+								sp.countStr = extra
+							case sp.baseStr == "":
+								sp.baseStr = extra
+							}
+						}
+						specs = append(specs, sp)
+					default:
+						return fmt.Errorf("invalid hint type %q on line %d (expected pointer, data, code, base-reg, or jump-table)", fields[0], lineIdx)
+					}
+				}
+				if err := scanner.Err(); err != nil {
+					return err
+				}
+			}
+
+			if len(args) > 0 {
+				typeStr := strings.ToLower(args[0])
+				switch typeStr {
+				case "code":
+					if len(args) < 2 {
+						return fmt.Errorf("usage: hunks hint code <addr1> [addr2...]")
+					}
+					for _, a := range args[1:] {
+						specs = append(specs, hintSpec{
+							kind:    "code",
+							addrStr: a,
+							comment: hintComment,
+						})
+					}
+				case "pointer", "data", "base-reg", "jump-table":
+					if len(args) < 2 {
+						return fmt.Errorf("usage: hunks hint %s <addr> [count]", typeStr)
+					}
+					var countStr string
+					if len(args) >= 3 {
+						countStr = args[2]
+					} else if hintCount > 0 {
+						countStr = fmt.Sprintf("%d", hintCount)
+					}
+					specs = append(specs, hintSpec{
+						kind:      typeStr,
+						addrStr:   args[1],
+						countStr:  countStr,
+						baseStr:   hintBase,
+						entrySize: hintEntrySize,
+						follow:    hintFollow,
+						isString:  hintString,
+						comment:   hintComment,
+					})
+				default:
+					return fmt.Errorf("invalid hint type %q (expected pointer, data, code, base-reg, or jump-table)", args[0])
+				}
+			}
+
+			if len(specs) == 0 {
+				return fmt.Errorf("expected `hunks hint <pointer|data|code|base-reg|jump-table> <addr>...` or `--batch <file>`")
 			}
 
 			proj, err := loadTargetProject(getWorkspaceRoot(), moduleName)
@@ -859,124 +1140,285 @@ func main() {
 			defer ctrl.Close()
 			proj.SyncDBScope(ctrl)
 
-			if typeStr == "base-reg" {
-				reg := strings.ToLower(addrStr)
-				if reg != "a4" && reg != "a5" && reg != "a6" {
-					return fmt.Errorf("base-reg: register must be a4, a5 or a6 (got '%s')", addrStr)
-				}
-				if countStr == "" {
-					return fmt.Errorf("base-reg: missing base address (usage: hint base-reg a4 0x<addr>)")
-				}
-				baseAddr, err := parseHex(countStr)
-				if err != nil {
-					return err
-				}
-				scopeKind := "global"
-				scopeKey := ""
-				if hintFunction != "" {
-					scopeKind = "function"
-					scopeKey = hintFunction
-				} else if hintSegment != "" {
-					scopeKind = "segment"
-					scopeKey = hintSegment
-				}
-				if err := ctrl.SetBaseReg(scopeKind, scopeKey, reg, baseAddr, "hint"); err != nil {
-					return err
-				}
-				an, err := analyzer.New(proj, ctrl)
-				if err != nil {
-					return err
-				}
-				an.Analyze(nil)
-				fmt.Printf("Set base-reg %s = 0x%X (scope: %s %s)\n", reg, baseAddr, scopeKind, scopeKey)
-				return nil
-			}
+			var allCodeSeeds []uint32
+			type jtEntry struct {
+				entryAddr  uint32
+				targetAddr uint32
+				baseAddr   uint32
+			}
+			var jtEntries []jtEntry
+			needFullAnalyze := false
+
+			for _, sp := range specs {
+				switch sp.kind {
+				case "base-reg":
+					reg := strings.ToLower(sp.addrStr)
+					if reg != "a4" && reg != "a5" && reg != "a6" {
+						return fmt.Errorf("base-reg: register must be a4, a5 or a6 (got '%s')", sp.addrStr)
+					}
+					if sp.countStr == "" {
+						return fmt.Errorf("base-reg: missing base address (usage: hint base-reg a4 0x<addr>)")
+					}
+					baseAddr, err := parseHex(sp.countStr)
+					if err != nil {
+						return err
+					}
+					scopeKind := "global"
+					scopeKey := ""
+					if hintFunction != "" {
+						scopeKind = "function"
+						scopeKey = hintFunction
+					} else if hintSegment != "" {
+						scopeKind = "segment"
+						scopeKey = hintSegment
+					}
+					if err := ctrl.SetBaseReg(scopeKind, scopeKey, reg, baseAddr, "hint"); err != nil {
+						return err
+					}
+					needFullAnalyze = true
+					fmt.Printf("Set base-reg %s = 0x%X (scope: %s %s)\n", reg, baseAddr, scopeKind, scopeKey)
 
-			addrU32, err := resolveAddrOrLabel(proj, ctrl, addrStr)
-			if err != nil {
-				return err
-			}
+				case "pointer":
+					addrU32, err := resolveAddrOrLabel(proj, ctrl, sp.addrStr)
+					if err != nil {
+						return err
+					}
+					cnt := uint32(1)
+					if sp.countStr != "" {
+						cnt, err = parseHex(sp.countStr)
+						if err != nil {
+							return err
+						}
+					}
+					an, err := analyzer.New(proj, ctrl)
+					if err != nil {
+						return err
+					}
+					var ptrSeeds []uint32
+					if err := ctrl.WithTransaction(func() error {
+						for i := uint32(0); i < cnt; i++ {
+							slotAddr := addrU32 + (i * 4)
+							if err := ctrl.MarkData(slotAddr, 4, db.CellPointer); err != nil {
+								return err
+							}
+							var tgt uint32
+							hasTgt := false
+							if rTgt, ok := an.Relocs[slotAddr]; ok {
+								tgt = rTgt
+								hasTgt = true
+							} else if u32Tgt, ok := an.ReadU32(slotAddr); ok {
+								tgt = u32Tgt
+								hasTgt = true
+							}
+							if hasTgt && (an.IsInAnySegment(tgt) || an.IsInMemoryRegion(tgt)) {
+								an.AddLabel(&slotAddr, tgt)
+								_ = ctrl.InsertXref(slotAddr, tgt, db.XrefDataAddr)
+								lbl := an.GetOrDefaultLabel(tgt)
+								_ = ctrl.SetCellOp(slotAddr, lbl)
+								if sp.follow && tgt%2 == 0 && an.IsInCodeSegment(tgt) && !slices.Contains(allCodeSeeds, tgt) {
+									allCodeSeeds = append(allCodeSeeds, tgt)
+									ptrSeeds = append(ptrSeeds, tgt)
+								}
+							}
+						}
+						if sp.comment != "" {
+							return ctrl.UpdateComment(addrU32, sp.comment)
+						}
+						return nil
+					}); err != nil {
+						return err
+					}
+					fmt.Printf("Added pointer hint at 0x%X with count %d (%d code target(s) queued)\n", addrU32, cnt, len(ptrSeeds))
 
-			switch typeStr {
-			case "pointer":
-				cnt := uint32(1)
-				if countStr != "" {
-					cnt, err = parseHex(countStr)
+				case "data":
+					addrU32, err := resolveAddrOrLabel(proj, ctrl, sp.addrStr)
 					if err != nil {
 						return err
 					}
-				}
-				an, err := analyzer.New(proj, ctrl)
-				if err != nil {
-					return err
-				}
-				var codeSeeds []uint32
-				if err := ctrl.WithTransaction(func() error {
-					for i := uint32(0); i < cnt; i++ {
-						slotAddr := addrU32 + (i * 4)
-						if err := ctrl.MarkData(slotAddr, 4, db.CellPointer); err != nil {
+					size := uint32(1)
+					if sp.countStr != "" {
+						size, err = parseHex(sp.countStr)
+						if err != nil {
+							return err
+						}
+					}
+					regionType := db.CellDataB
+					if sp.isString {
+						regionType = db.CellStr
+					}
+					if err := ctrl.MarkData(addrU32, size, regionType); err != nil {
+						return err
+					}
+					if sp.comment != "" {
+						_ = ctrl.UpdateComment(addrU32, sp.comment)
+					}
+					fmt.Printf("Added data hint at 0x%X with size %d\n", addrU32, size)
+
+				case "jump-table":
+					tableAddr, err := resolveAddrOrLabel(proj, ctrl, sp.addrStr)
+					if err != nil {
+						return err
+					}
+					tableAddr &= ^uint32(1)
+					baseAddr := tableAddr
+					if sp.baseStr != "" {
+						baseAddr, err = resolveAddrOrLabel(proj, ctrl, sp.baseStr)
+						if err != nil {
+							return fmt.Errorf("cannot resolve --base %q: %w", sp.baseStr, err)
+						}
+					}
+					entSize := uint32(2)
+					if sp.entrySize == 4 {
+						entSize = 4
+					} else if sp.entrySize != 0 && sp.entrySize != 2 {
+						return fmt.Errorf("invalid --entry-size %d (expected 2 or 4)", sp.entrySize)
+					}
+					var explicitCnt uint32
+					if sp.countStr != "" {
+						explicitCnt, err = parseHex(sp.countStr)
+						if err != nil {
 							return err
 						}
-						var tgt uint32
-						hasTgt := false
-						if rTgt, ok := an.Relocs[slotAddr]; ok {
-							tgt = rTgt
-							hasTgt = true
-						} else if u32Tgt, ok := an.ReadU32(slotAddr); ok {
-							tgt = u32Tgt
-							hasTgt = true
+					}
+					an, err := analyzer.New(proj, ctrl)
+					if err != nil {
+						return err
+					}
+					maxEntries := explicitCnt
+					if maxEntries == 0 {
+						maxEntries = 256
+					}
+					var minFwdTarget uint32 = 0xFFFFFFFF
+					var tableEntries []jtEntry
+					for i := uint32(0); i < maxEntries; i++ {
+						entryAddr := tableAddr + i*entSize
+						if explicitCnt == 0 && entryAddr >= minFwdTarget {
+							break
+						}
+						if !an.IsSameSegment(tableAddr, entryAddr) {
+							break
 						}
-						if hasTgt && (an.IsInAnySegment(tgt) || an.IsInMemoryRegion(tgt)) {
-							an.AddLabel(&slotAddr, tgt)
-							_ = ctrl.InsertXref(slotAddr, tgt, db.XrefDataAddr)
-							lbl := an.GetOrDefaultLabel(tgt)
-							_ = ctrl.SetCellOp(slotAddr, lbl)
-							if hintFollow && tgt%2 == 0 && an.IsInCodeSegment(tgt) && !slices.Contains(codeSeeds, tgt) {
-								codeSeeds = append(codeSeeds, tgt)
+						var off int64
+						var okOff bool
+						if entSize == 2 {
+							if v, ok16 := an.ReadI16(entryAddr); ok16 {
+								off = int64(v)
+								okOff = true
 							}
+						} else {
+							if v, ok32 := an.ReadU32(entryAddr); ok32 {
+								off = int64(int32(v))
+								okOff = true
+							}
+						}
+						if !okOff {
+							break
+						}
+						targetAddr := uint32(int64(baseAddr) + off)
+						if explicitCnt == 0 {
+							if off == 0 || targetAddr%2 != 0 || !an.IsSameSegment(tableAddr, targetAddr) {
+								break
+							}
+							if targetAddr > tableAddr && targetAddr < entryAddr+entSize {
+								break
+							}
+							if _, okInsn := an.DecodeValidInsn(targetAddr, false); !okInsn {
+								break
+							}
+						}
+						if targetAddr > tableAddr {
+							minFwdTarget = min(minFwdTarget, targetAddr)
 						}
+						tableEntries = append(tableEntries, jtEntry{
+							entryAddr:  entryAddr,
+							targetAddr: targetAddr,
+							baseAddr:   baseAddr,
+						})
 					}
-					if hintComment != "" {
-						return ctrl.UpdateComment(addrU32, hintComment)
+					if len(tableEntries) == 0 {
+						return fmt.Errorf("no valid jump-table entries found at 0x%X", tableAddr)
 					}
-					return nil
-				}); err != nil {
-					return err
-				}
-				for _, seed := range codeSeeds {
-					if _, err := analyzer.ApplyCodeHint(proj, ctrl, seed); err != nil {
+					cellType := db.CellDataW
+					if entSize == 4 {
+						cellType = db.CellDataL
+					}
+					if err := ctrl.WithTransaction(func() error {
+						an.AddLabel(nil, tableAddr)
+						if baseAddr != tableAddr {
+							an.AddLabel(nil, baseAddr)
+						}
+						baseLbl := an.GetOrDefaultLabel(baseAddr)
+						for _, je := range tableEntries {
+							if err := ctrl.MarkData(je.entryAddr, entSize, cellType); err != nil {
+								return err
+							}
+							if je.targetAddr%2 == 0 && an.IsInAnySegment(je.targetAddr) {
+								src := je.entryAddr
+								an.AddLabel(&src, je.targetAddr)
+								_ = ctrl.InsertXref(je.entryAddr, je.targetAddr, db.XrefDataAddr)
+								tgtLbl := an.GetOrDefaultLabel(je.targetAddr)
+								_ = ctrl.SetCellOp(je.entryAddr, fmt.Sprintf("%s-%s", tgtLbl, baseLbl))
+								if an.IsInCodeSegment(je.targetAddr) && !slices.Contains(allCodeSeeds, je.targetAddr) {
+									allCodeSeeds = append(allCodeSeeds, je.targetAddr)
+								}
+							}
+							jtEntries = append(jtEntries, je)
+						}
+						if sp.comment != "" {
+							return ctrl.UpdateComment(tableAddr, sp.comment)
+						}
+						return nil
+					}); err != nil {
 						return err
 					}
-				}
-				fmt.Printf("Added pointer hint at 0x%X with count %d (%d code target(s) followed)\n", addrU32, cnt, len(codeSeeds))
-			case "data":
-				size := uint32(1)
-				if countStr != "" {
-					size, err = parseHex(countStr)
+					fmt.Printf("Marked jump-table at 0x%X (%d entries, base 0x%X, %d code target(s) queued)\n",
+						tableAddr, len(tableEntries), baseAddr, len(allCodeSeeds))
+
+				case "code":
+					addrU32, err := resolveAddrOrLabel(proj, ctrl, sp.addrStr)
 					if err != nil {
 						return err
 					}
+					addrAligned := addrU32 &^ 1
+					if !slices.Contains(allCodeSeeds, addrAligned) {
+						allCodeSeeds = append(allCodeSeeds, addrAligned)
+					}
+					if sp.comment != "" {
+						_ = ctrl.UpdateComment(addrAligned, sp.comment)
+					}
 				}
-				regionType := db.CellDataB
-				if hintString {
-					regionType = db.CellStr
-				}
-				if err := ctrl.MarkData(addrU32, size, regionType); err != nil {
+			}
+
+			if needFullAnalyze {
+				an, err := analyzer.New(proj, ctrl)
+				if err != nil {
 					return err
 				}
-				if hintComment != "" {
-					_ = ctrl.UpdateComment(addrU32, hintComment)
-				}
-				fmt.Printf("Added data hint at 0x%X with size %d\n", addrU32, size)
-			case "code":
-				addrAligned, err := analyzer.ApplyCodeHint(proj, ctrl, addrU32)
+				an.Analyze(nil)
+			}
+			if len(allCodeSeeds) > 0 {
+				aligned, err := applyCodeHintsBatch(proj, ctrl, allCodeSeeds)
 				if err != nil {
 					return err
 				}
-				if hintComment != "" {
-					_ = ctrl.UpdateComment(addrAligned, hintComment)
+				if len(jtEntries) > 0 {
+					if an, err := analyzer.New(proj, ctrl); err == nil {
+						an.RefreshCaches()
+						_ = ctrl.WithTransaction(func() error {
+							for _, je := range jtEntries {
+								tgtLbl := an.GetOrDefaultLabel(je.targetAddr)
+								baseLbl := an.GetOrDefaultLabel(je.baseAddr)
+								_ = ctrl.SetCellOp(je.entryAddr, fmt.Sprintf("%s-%s", tgtLbl, baseLbl))
+							}
+							return nil
+						})
+					}
+				}
+				if len(aligned) == 1 && len(specs) == 1 && specs[0].kind == "code" {
+					fmt.Printf("Marked code and incrementally analyzed at 0x%X\n", aligned[0])
+				} else {
+					fmt.Printf("Marked %d code seed(s) and incrementally analyzed (first: 0x%X)\n", len(aligned), aligned[0])
 				}
-				fmt.Printf("Marked code and incrementally analyzed at 0x%X\n", addrAligned)
 			}
 			return nil
 		},
@@ -986,14 +1428,64 @@ func main() {
 	hintCmd.Flags().BoolVar(&hintString, "string", false, "Mark data as string")
 	hintCmd.Flags().StringVar(&hintSegment, "segment", "", "For base-reg: limit the invariant to a specific segment")
 	hintCmd.Flags().StringVar(&hintFunction, "function", "", "For base-reg: limit the invariant to a specific function label")
+	hintCmd.Flags().StringVar(&hintBase, "base", "", "For jump-table: base address/label added to each relative offset (default: table_addr)")
+	hintCmd.Flags().IntVar(&hintCount, "count", 0, "Number of entries or bytes (alternative to positional [count])")
+	hintCmd.Flags().IntVar(&hintEntrySize, "entry-size", 2, "For jump-table: byte width of each signed offset entry (2 or 4)")
+	hintCmd.Flags().StringVar(&hintBatchFile, "batch", "", "Batch file of hint directives per line (use '-' for stdin)")
+	hintCmd.Flags().StringVarP(&hintBatchFile, "file", "f", "", "Alias for --batch")
 	rootCmd.AddCommand(hintCmd)
 
 	// --- rename ---
 	var renameFile string
+	var renameDelete bool
 	renameCmd := &cobra.Command{
 		Use:   "rename [args...]",
-		Short: "Rename one or more symbols",
+		Short: "Rename one or more symbols (or delete labels with --delete)",
 		RunE: func(_ *cobra.Command, args []string) error {
+			if renameDelete {
+				if len(args) == 0 {
+					return fmt.Errorf("expected `hunks rename --delete <addr_or_label>...`")
+				}
+				proj, err := loadTargetProject(getWorkspaceRoot(), moduleName)
+				if err != nil {
+					return err
+				}
+				seg, err := requireSegment(proj)
+				if err != nil {
+					return err
+				}
+				ctrl, err := db.New(seg.DB)
+				if err != nil {
+					return err
+				}
+				defer ctrl.Close()
+				proj.SyncDBScope(ctrl)
+				var deleted []uint32
+				if err := ctrl.WithTransaction(func() error {
+					for _, arg := range args {
+						addr, err := resolveAddrOrLabel(proj, ctrl, arg)
+						if err != nil {
+							return fmt.Errorf("cannot resolve address or label %q: %w", arg, err)
+						}
+						if err := ctrl.DeleteLabelAndRename(addr); err != nil {
+							return err
+						}
+						proj.Data.EntryPoints = slices.DeleteFunc(proj.Data.EntryPoints, func(ep project.EntryPoint) bool {
+							return ep.Addr == addr
+						})
+						deleted = append(deleted, addr)
+						fmt.Printf("Deleted label at 0x%X (%s)\n", addr, arg)
+					}
+					return nil
+				}); err != nil {
+					return err
+				}
+				_ = proj.Save()
+				if an, err := analyzer.New(proj, ctrl); err == nil {
+					an.ReanalyzeXrefsBatch(deleted)
+				}
+				return nil
+			}
 			type pair struct{ oldName, newName string }
 			var pairs []pair
 
@@ -1163,6 +1655,8 @@ func main() {
 		},
 	}
 	renameCmd.Flags().StringVarP(&renameFile, "file", "f", "", "Batch file containing '<old_name> <new_name>' or '<old_name>=<new_name>' per line (use '-' for stdin)")
+	renameCmd.Flags().StringVar(&renameFile, "batch", "", "Alias for --file")
+	renameCmd.Flags().BoolVarP(&renameDelete, "delete", "d", false, "Delete the specified label(s) and any associated rename entry")
 	rootCmd.AddCommand(renameCmd)
 
 	// --- comment ---
@@ -1299,22 +1793,103 @@ func main() {
 	}
 	commentCmd.Flags().BoolVarP(&commentBlock, "block", "b", false, "Set block comment (above function/instruction) instead of inline comment")
 	commentCmd.Flags().StringVar(&commentBatchFile, "batch", "", "Batch file containing '<addr_or_label+off> = <comment>' per line (use '-' for stdin)")
-	commentCmd.Flags().StringVar(&commentBatchFile, "file", "", "Alias for --batch")
+	commentCmd.Flags().StringVarP(&commentBatchFile, "file", "f", "", "Alias for --batch")
 	rootCmd.AddCommand(commentCmd)
 
 	// --- operand ---
+	var operandBatchFile string
 	operandCmd := &cobra.Command{
-		Use:   "operand <addr> <HEX|DEC|BIN>",
-		Short: "Set immediate operand format at an address",
-		Args:  cobra.ExactArgs(2),
+		Use:   "operand [addr] [HEX|DEC|BIN]",
+		Short: "Set immediate operand format at one or more addresses (supports --batch/-f)",
+		Args:  cobra.ArbitraryArgs,
 		RunE: func(_ *cobra.Command, args []string) error {
-			addrStr := args[0]
-			format := args[1]
-			switch format {
-			case "HEX", "DEC", "BIN":
-			default:
-				return fmt.Errorf("invalid operand format %q (expected HEX, DEC, or BIN)", format)
+			type opEntry struct {
+				addrStr string
+				format  string
+			}
+			var entries []opEntry
+
+			if operandBatchFile != "" {
+				var r io.Reader
+				if operandBatchFile == "-" {
+					r = os.Stdin
+				} else {
+					fpath := resolveCallerPath(operandBatchFile)
+					f, err := os.Open(fpath)
+					if err != nil {
+						return fmt.Errorf("failed to open operand batch file '%s': %w", fpath, err)
+					}
+					defer f.Close()
+					r = f
+				}
+				scanner := bufio.NewScanner(r)
+				lineIdx := 0
+				for scanner.Scan() {
+					lineIdx++
+					line := scanner.Text()
+					trimmed := line
+					if idx := strings.IndexByte(trimmed, '#'); idx >= 0 {
+						trimmed = trimmed[:idx]
+					}
+					if idx := strings.IndexByte(trimmed, ';'); idx >= 0 {
+						trimmed = trimmed[:idx]
+					}
+					trimmed = strings.TrimSpace(trimmed)
+					if trimmed == "" {
+						continue
+					}
+					if aPart, fPart, ok := strings.Cut(trimmed, "="); ok {
+						entries = append(entries, opEntry{
+							addrStr: strings.TrimSpace(aPart),
+							format:  strings.ToUpper(strings.TrimSpace(fPart)),
+						})
+						continue
+					}
+					fields := strings.Fields(trimmed)
+					if len(fields) >= 2 {
+						entries = append(entries, opEntry{
+							addrStr: fields[0],
+							format:  strings.ToUpper(fields[1]),
+						})
+					} else {
+						return fmt.Errorf("invalid operand entry on line %d: %q (expected '<addr> <HEX|DEC|BIN>')", lineIdx, line)
+					}
+				}
+				if err := scanner.Err(); err != nil {
+					return err
+				}
 			}
+
+			for i := 0; i < len(args); {
+				if aPart, fPart, ok := strings.Cut(args[i], "="); ok {
+					entries = append(entries, opEntry{
+						addrStr: strings.TrimSpace(aPart),
+						format:  strings.ToUpper(strings.TrimSpace(fPart)),
+					})
+					i++
+					continue
+				}
+				if i+1 >= len(args) {
+					return fmt.Errorf("expected '<addr> <HEX|DEC|BIN>', '<addr>=<HEX|DEC|BIN>', or '--batch <file>'")
+				}
+				entries = append(entries, opEntry{
+					addrStr: args[i],
+					format:  strings.ToUpper(args[i+1]),
+				})
+				i += 2
+			}
+
+			if len(entries) == 0 {
+				return fmt.Errorf("no operand entries provided; pass '<addr> <HEX|DEC|BIN>' or '--batch <file>'")
+			}
+			for _, e := range entries {
+				switch e.format {
+				case "HEX", "DEC", "BIN":
+				default:
+					return fmt.Errorf("invalid operand format %q for %s (expected HEX, DEC, or BIN)", e.format, e.addrStr)
+				}
+			}
+
 			proj, err := loadTargetProject(getWorkspaceRoot(), moduleName)
 			if err != nil {
 				return err
@@ -1329,32 +1904,47 @@ func main() {
 			}
 			defer ctrl.Close()
 			proj.SyncDBScope(ctrl)
-			addrVal, err := resolveAddrOrLabel(proj, ctrl, addrStr)
-			if err != nil {
-				return err
-			}
-			targetSeg := proj.SegmentAtAddr(addrVal)
-			if targetSeg != nil {
-				ctrl.SetActiveSeg(targetSeg.Name)
-			}
-			if err := ctrl.SetOperandFormat(addrVal, format); err != nil {
+
+			var resolvedAddrs []uint32
+			if err := ctrl.WithTransaction(func() error {
+				for _, e := range entries {
+					addrVal, err := resolveAddrOrLabel(proj, ctrl, e.addrStr)
+					if err != nil {
+						return err
+					}
+					if targetSeg := proj.SegmentAtAddr(addrVal); targetSeg != nil {
+						ctrl.SetActiveSeg(targetSeg.Name)
+					}
+					if err := ctrl.SetOperandFormat(addrVal, e.format); err != nil {
+						return err
+					}
+					resolvedAddrs = append(resolvedAddrs, addrVal)
+				}
+				return nil
+			}); err != nil {
 				return err
 			}
-			var an *analyzer.Analyzer
-			if targetSeg != nil && !targetSeg.IsRelocatable() {
-				an, err = analyzer.NewForSegment(proj, ctrl, targetSeg.Name)
-			} else {
-				an, err = analyzer.New(proj, ctrl)
-			}
+
+			proj.SyncDBScope(ctrl)
+			an, err := analyzer.New(proj, ctrl)
 			if err != nil {
 				return err
 			}
-			an.ReanalyzeInstruction(addrVal)
+			an.RefreshCaches()
+			for _, addrVal := range resolvedAddrs {
+				an.ReanalyzeInstruction(addrVal)
+			}
 			proj.SyncDBScope(ctrl)
-			fmt.Printf("Set operand format at $%X to %s\n", addrVal, format)
+			if len(resolvedAddrs) == 1 {
+				fmt.Printf("Set operand format at $%X to %s\n", resolvedAddrs[0], entries[0].format)
+			} else {
+				fmt.Printf("Set operand format on %d instruction(s)\n", len(resolvedAddrs))
+			}
 			return nil
 		},
 	}
+	operandCmd.Flags().StringVar(&operandBatchFile, "batch", "", "Batch file containing '<addr> <HEX|DEC|BIN>' per line (use '-' for stdin)")
+	operandCmd.Flags().StringVarP(&operandBatchFile, "file", "f", "", "Alias for --batch")
 	rootCmd.AddCommand(operandCmd)
 
 	// --- callgraph / cg ---
diff --git a/internal/analyzer/analyzer_test.go b/internal/analyzer/analyzer_test.go
index febe0eb..1d78e1a 100644
--- a/internal/analyzer/analyzer_test.go
+++ b/internal/analyzer/analyzer_test.go
@@ -1345,3 +1345,43 @@ func TestScopedRegisterAliasAndFieldTypeStripping(t *testing.T) {
 		t.Fatalf("expected function-scoped alias vx(a0),d0 at 0x10008, got %+v", cSub)
 	}
 }
+
+func TestIndexedDispatchVsNegativeOffsetTable(t *testing.T) {
+	const base uint32 = 0x10000
+	// 0x10000: jsr    $10008(pc,d0.w)   4E BB 00 06  (direct indexed code call -> 0x10008)
+	// 0x10004: bra.s  $10012            60 0C
+	// 0x10006: nop                      4E 71
+	// 0x10008: lea.l  2(a0),a0          41 E8 00 02  (must NOT be misread as dc.w $41E8,$0002)
+	// 0x1000C: rts                      4E 75
+	// 0x1000E: moveq  #1,d0             70 01        (negative-offset jump table handler)
+	// 0x10010: rts                      4E 75
+	// 0x10012: move.w $1001A(pc,d0.w),d0 30 3B 00 06
+	// 0x10016: jmp    $1001A(pc,d0.w)   4E FB 00 02
+	// 0x1001A: dc.w   $FFF4             FF F4        (0x1001A - 12 = 0x1000E)
+	code := []byte{
+		0x4E, 0xBB, 0x00, 0x06,
+		0x60, 0x0C,
+		0x4E, 0x71,
+		0x41, 0xE8, 0x00, 0x02,
+		0x4E, 0x75,
+		0x70, 0x01,
+		0x4E, 0x75,
+		0x30, 0x3B, 0x00, 0x06,
+		0x4E, 0xFB, 0x00, 0x02,
+		0xFF, 0xF4,
+	}
+	a, ctrl := newTestTraceAnalyzer(t, code, base)
+	a.Analyze([]uint32{base})
+
+	c10008, _ := ctrl.GetCell(0x10008)
+	if c10008 == nil || c10008.Type != db.CellCode || c10008.Size != 4 {
+		t.Fatalf("expected 4-byte CODE cell at 0x10008 (lea 2(a0),a0), got %+v", c10008)
+	}
+	if _, hasLbl, _ := ctrl.GetLabel(0x1000A); hasLbl {
+		t.Fatalf("unexpected interior label at 0x1000A")
+	}
+	c1000E, _ := ctrl.GetCell(0x1000E)
+	if c1000E == nil || c1000E.Type != db.CellCode {
+		t.Fatalf("expected negative-offset jump table target 0x1000E to be decoded as CODE, got %+v", c1000E)
+	}
+}
diff --git a/internal/analyzer/stage2_code.go b/internal/analyzer/stage2_code.go
index 428230e..1a0175d 100644
--- a/internal/analyzer/stage2_code.go
+++ b/internal/analyzer/stage2_code.go
@@ -96,6 +96,12 @@ func (a *Analyzer) stage2DiscoverCode(initialEntries []uint32, jumpTable map[uin
 	for _, c := range a.DB.CodeCells() {
 		codeCells.ReplaceOrInsert(c)
 	}
+	isIncremental := codeCells.Len() > 0
+	if isIncremental {
+		for _, t := range a.DB.DataReadWriteTargets() {
+			dataReadTargets[t] = struct{}{}
+		}
+	}
 
 	const confProtected uint8 = 100
 	protected := a.DB.ProtectedNoncodeRanges(confProtected)
@@ -117,18 +123,20 @@ func (a *Analyzer) stage2DiscoverCode(initialEntries []uint32, jumpTable map[uin
 		}
 	}
 
-	var relocCodeTargets []uint32
-	for t := range a.RelocTargets {
-		if a.IsInCodeSegment(t) && t%2 == 0 {
-			relocCodeTargets = append(relocCodeTargets, t)
+	if !isIncremental {
+		var relocCodeTargets []uint32
+		for t := range a.RelocTargets {
+			if a.IsInCodeSegment(t) && t%2 == 0 {
+				relocCodeTargets = append(relocCodeTargets, t)
+			}
 		}
+		slices.Sort(relocCodeTargets)
+		candidateCode = append(candidateCode, relocCodeTargets...)
 	}
-	slices.Sort(relocCodeTargets)
-	candidateCode = append(candidateCode, relocCodeTargets...)
 
 	a.DB.Begin()
 
-	tablesScanned := false
+	tablesScanned := isIncremental
 	scanCursors := make([]uint32, len(a.Segments))
 	for i, s := range a.Segments {
 		scanCursors[i] = s.Base
@@ -357,26 +365,28 @@ func (a *Analyzer) stage2DiscoverCode(initialEntries []uint32, jumpTable map[uin
 			continue
 		}
 
-		// 5. Sandbox-validated gap sweep across all Code segments
-		gapEntries := a.scanCodeGapsForCandidates(codeCells, dataReadTargets, rejectedCandidates, scanCursors, protected, hintedBases)
-		if len(gapEntries) > 0 {
-			for _, addr := range gapEntries {
+		if !isIncremental {
+			// 5. Sandbox-validated gap sweep across all Code segments
+			gapEntries := a.scanCodeGapsForCandidates(codeCells, dataReadTargets, rejectedCandidates, scanCursors, protected, hintedBases)
+			if len(gapEntries) > 0 {
+				for _, addr := range gapEntries {
+					a.AddLabel(nil, addr)
+					labelName := a.GetOrDefaultLabel(addr)
+					_ = a.DB.InsertFunction(addr, labelName, ConfMedium)
+					worklist = append(worklist, workItem{addr: addr, confidence: ConfMedium})
+				}
+				continue
+			}
+
+			// 5.5 Prologue-DATA reclaim
+			if addr, ok := a.findPrologueDataToReclaim(codeCells, dataReadTargets, reclaimedPrologues, protected, hintedBases); ok {
+				_ = a.DB.ClearOverlaps(addr, 2)
 				a.AddLabel(nil, addr)
 				labelName := a.GetOrDefaultLabel(addr)
 				_ = a.DB.InsertFunction(addr, labelName, ConfMedium)
 				worklist = append(worklist, workItem{addr: addr, confidence: ConfMedium})
+				continue
 			}
-			continue
-		}
-
-		// 5.5 Prologue-DATA reclaim
-		if addr, ok := a.findPrologueDataToReclaim(codeCells, dataReadTargets, reclaimedPrologues, protected, hintedBases); ok {
-			_ = a.DB.ClearOverlaps(addr, 2)
-			a.AddLabel(nil, addr)
-			labelName := a.GetOrDefaultLabel(addr)
-			_ = a.DB.InsertFunction(addr, labelName, ConfMedium)
-			worklist = append(worklist, workItem{addr: addr, confidence: ConfMedium})
-			continue
 		}
 
 		break
@@ -906,9 +916,17 @@ func (a *Analyzer) resolveJumpTable(
 	case m68k.EAPCIndex:
 		targets, ok := a.scanIndexedJumpTable(siteAddr, op.UVal, op.IndexReg, codeCells, dataReadTargets)
 		if ok {
+			edgeKind := db.EdgeUncond
+			xrefKind := db.XrefCodeBranch
+			if isCall && len(targets) == 1 && targets[0] == op.UVal {
+				edgeKind = db.EdgeCall
+				xrefKind = db.XrefCodeCall
+				labelName := a.GetOrDefaultLabel(op.UVal)
+				_ = a.DB.InsertFunction(op.UVal, labelName, ConfHigh)
+			}
 			for _, t := range targets {
-				_ = a.DB.InsertEdge(siteAddr, t, db.EdgeUncond)
-				_ = a.DB.InsertXref(siteAddr, t, db.XrefCodeBranch)
+				_ = a.DB.InsertEdge(siteAddr, t, edgeKind)
+				_ = a.DB.InsertXref(siteAddr, t, xrefKind)
 			}
 		}
 		return targets, ok
@@ -1074,33 +1092,72 @@ func (a *Analyzer) scanIndexedJumpTable(
 	}
 
 	// 2. Check for 16-bit relative offset data table (dc.w target - table_addr)
+	_, hasDataReadAtTable := dataReadTargets[tableAddr]
+	isOffsetTable := hasDataReadAtTable || a.hasPrecedingOffsetLoad(siteAddr, idxReg, codeCells)
+	if !isOffsetTable {
+		if !hasCodeCell(codeCells, tableAddr) {
+			if _, ok := a.DecodeValidInsn(tableAddr, false); ok {
+				return []uint32{tableAddr}, true
+			}
+		} else {
+			return []uint32{tableAddr}, true
+		}
+		return nil, false
+	}
+
 	dataBounds := uint32(16)
 	if hasBound {
 		dataBounds = inferredBound
 	}
 	if firstWord, ok := a.ReadI16(tableAddr); ok {
 		firstTarget := uint32(int64(tableAddr) + int64(firstWord))
-		if a.IsSameSegment(tableAddr, firstTarget) && firstTarget%2 == 0 && firstTarget > tableAddr {
-			for i := uint32(0); i < dataBounds; i++ {
-				entryAddr := tableAddr + i*2
-				if entryAddr >= minTarget || !a.IsSameSegment(tableAddr, entryAddr) || hasCodeCell(codeCells, entryAddr) {
-					break
+		if a.IsSameSegment(tableAddr, firstTarget) && firstTarget%2 == 0 {
+			if firstWord > 0 && firstTarget > tableAddr {
+				for i := uint32(0); i < dataBounds; i++ {
+					entryAddr := tableAddr + i*2
+					if entryAddr >= minTarget || !a.IsSameSegment(tableAddr, entryAddr) || hasCodeCell(codeCells, entryAddr) {
+						break
+					}
+					offset, ok := a.ReadI16(entryAddr)
+					if !ok || offset <= 0 {
+						break
+					}
+					target := uint32(int64(tableAddr) + int64(offset))
+					if !a.IsSameSegment(tableAddr, target) || target%2 != 0 {
+						break
+					}
+					minTarget = min(minTarget, target)
+					dataReadTargets[entryAddr] = struct{}{}
+					a.AddLabel(&src, target)
+					targets = append(targets, target)
 				}
-				offset, ok := a.ReadI16(entryAddr)
-				if !ok || offset <= 0 {
-					break
+				if len(targets) > 0 {
+					return targets, true
 				}
-				target := uint32(int64(tableAddr) + int64(offset))
-				if !a.IsSameSegment(tableAddr, target) || target%2 != 0 {
-					break
+			} else if firstWord < 0 {
+				for i := uint32(0); i < dataBounds; i++ {
+					entryAddr := tableAddr + i*2
+					if !a.IsSameSegment(tableAddr, entryAddr) || hasCodeCell(codeCells, entryAddr) {
+						break
+					}
+					offset, ok := a.ReadI16(entryAddr)
+					if !ok || offset >= 0 || offset%2 != 0 {
+						break
+					}
+					target := uint32(int64(tableAddr) + int64(offset))
+					if !a.IsSameSegment(tableAddr, target) || target%2 != 0 {
+						break
+					}
+					if _, okInsn := a.DecodeValidInsn(target, false); !okInsn {
+						break
+					}
+					dataReadTargets[entryAddr] = struct{}{}
+					a.AddLabel(&src, target)
+					targets = append(targets, target)
+				}
+				if len(targets) > 0 {
+					return targets, true
 				}
-				minTarget = min(minTarget, target)
-				dataReadTargets[entryAddr] = struct{}{}
-				a.AddLabel(&src, target)
-				targets = append(targets, target)
-			}
-			if len(targets) > 0 {
-				return targets, true
 			}
 		}
 	}
@@ -1108,6 +1165,72 @@ func (a *Analyzer) scanIndexedJumpTable(
 	return nil, false
 }
 
+// hasPrecedingOffsetLoad reports whether the instructions immediately preceding siteAddr
+// load the dispatch index register `idxReg` from a 16-bit indexed memory operand
+// (`MOVE.W d8(PC/An,Xn),Dm`).
+func (a *Analyzer) hasPrecedingOffsetLoad(siteAddr uint32, idxReg uint8, codeCells *btree.BTreeG[db.Cell]) bool {
+	seg := a.SegmentAt(siteAddr)
+	if seg == nil || idxReg >= 8 {
+		return false
+	}
+	isLoad := func(insn *m68k.Insn) bool {
+		if insn.Op != m68k.OpMOVE || insn.Suffix != m68k.SizeW || insn.NumOps < 2 {
+			return false
+		}
+		srcOp := insn.Ops[0]
+		dstOp := insn.Ops[1]
+		if dstOp.Mode != m68k.EADataReg || dstOp.Reg != idxReg {
+			return false
+		}
+		return srcOp.Mode == m68k.EAPCIndex || srcOp.Mode == m68k.EAIndex
+	}
+	if codeCells != nil && siteAddr > seg.Base {
+		expectedEnd := siteAddr
+		steps := 0
+		walked := false
+		found := false
+		codeCells.DescendLessOrEqual(db.Cell{Addr: siteAddr - 1}, func(c db.Cell) bool {
+			if c.Addr < seg.Base || c.Addr+c.Size != expectedEnd || steps >= 6 {
+				return false
+			}
+			walked = true
+			expectedEnd = c.Addr
+			steps++
+			raw := c.RawBytes
+			if len(raw) < 2 {
+				raw = a.ReadBytes(c.Addr, int(c.Size))
+			}
+			insn, ok := m68k.Decode(raw, c.Addr)
+			if !ok {
+				return false
+			}
+			if isLoad(&insn) {
+				found = true
+				return false
+			}
+			return true
+		})
+		if walked {
+			return found
+		}
+	}
+	addr := siteAddr
+	for step := 0; step < 6; step++ {
+		if addr <= seg.Base+2 {
+			break
+		}
+		addr -= 2
+		chunk := a.ReadBytes(addr, 10)
+		if len(chunk) < 2 {
+			continue
+		}
+		if insn, ok := m68k.Decode(chunk, addr); ok && isLoad(&insn) {
+			return true
+		}
+	}
+	return false
+}
+
 // extractJumpTableBounds scans backward before siteAddr for a range-check
 // `CMP`/`CMPI #maxIdx,Dn` or mask `AND`/`ANDI #mask,Dn` instruction to bound the number
 // of entries in a jump table.
diff --git a/internal/callgraph/callgraph.go b/internal/callgraph/callgraph.go
index bbd0374..29124b7 100644
--- a/internal/callgraph/callgraph.go
+++ b/internal/callgraph/callgraph.go
@@ -168,7 +168,7 @@ func VerifyABI(abiStr string, inRegs, modRegs, savedRegs []string) []string {
 
 	var warnings []string
 	for _, r := range extractRegs(inSection) {
-		if !slices.Contains(inRegs, r) {
+		if !slices.Contains(inRegs, r) && !slices.Contains(savedRegs, r) {
 			if slices.Contains(modRegs, r) {
 				warnings = append(warnings, fmt.Sprintf("claimed input register %s is overwritten before being read in function body", r))
 			} else {
@@ -559,7 +559,22 @@ func Build(proj *project.Project) (*CallGraph, error) {
 		hasLoop := false
 		hasSMC := false
 
-		for insnIdx, ia := range insnAddrs {
+		// Order instructions starting from entryAddr first, followed by any backward-branched
+		// tail/helper blocks at addresses < entryAddr, so prologue register saves (isEntrySave)
+		// and read-before-write liveness (inMask vs modMask) evaluate from the true entry point.
+		flowAddrs := make([]uint32, 0, len(insnAddrs))
+		for _, ia := range insnAddrs {
+			if ia >= entryAddr {
+				flowAddrs = append(flowAddrs, ia)
+			}
+		}
+		for _, ia := range insnAddrs {
+			if ia < entryAddr {
+				flowAddrs = append(flowAddrs, ia)
+			}
+		}
+
+		for insnIdx, ia := range flowAddrs {
 			cell, ok := cells[ia]
 			if !ok {
 				continue
@@ -1181,6 +1196,7 @@ func (cg *CallGraph) ResolveTarget(proj *project.Project, target string, segFilt
 				if fAddr, ok := cg.InsnToFunc[abs]; ok {
 					return fAddr, true
 				}
+				return 0, false
 			}
 		}
 	}
@@ -1190,7 +1206,7 @@ func (cg *CallGraph) ResolveTarget(proj *project.Project, target string, segFilt
 		if normSeg != "" {
 			if s := proj.SegmentByName(normSeg); s != nil {
 				abs := addr
-				if addr < s.FileSize() {
+				if addr < s.FileSize() || addr < s.AllocSize {
 					abs = s.Base + addr
 				}
 				if _, ok := cg.Functions[abs]; ok {
@@ -1199,6 +1215,15 @@ func (cg *CallGraph) ResolveTarget(proj *project.Project, target string, segFilt
 				if fAddr, ok := cg.InsnToFunc[abs]; ok {
 					return fAddr, true
 				}
+				if abs != addr && addr >= s.Base && addr < s.EndAddr() {
+					if _, ok := cg.Functions[addr]; ok {
+						return addr, true
+					}
+					if fAddr, ok := cg.InsnToFunc[addr]; ok {
+						return fAddr, true
+					}
+				}
+				return 0, false
 			}
 		}
 		if _, ok := cg.Functions[addr]; ok {
diff --git a/internal/db/controller.go b/internal/db/controller.go
index dede1ac..b3de6be 100644
--- a/internal/db/controller.go
+++ b/internal/db/controller.go
@@ -1003,10 +1003,50 @@ func (c *Controller) DeleteCellAndEdges(addr uint32) error {
 
 func (c *Controller) DeleteLabelAt(addr uint32) error {
 	seg := c.SegOf(addr)
-	_, err := c.conn.Exec("DELETE FROM labels WHERE seg = ?1 AND addr = ?2", seg, addr)
+	_, err := c.conn.Exec("DELETE FROM labels WHERE (seg = ?1 OR seg = '') AND addr = ?2", seg, addr)
 	return err
 }
 
+func (c *Controller) DeleteEdgesFrom(sourceAddr uint32) error {
+	seg := c.SegOf(sourceAddr)
+	_, err := c.conn.Exec("DELETE FROM edges WHERE seg = ?1 AND source_addr = ?2", seg, sourceAddr)
+	return err
+}
+
+func (c *Controller) DeleteXrefsFrom(sourceAddr uint32) error {
+	seg := c.SegOf(sourceAddr)
+	_, err := c.conn.Exec("DELETE FROM xrefs WHERE seg = ?1 AND source_addr = ?2", seg, sourceAddr)
+	return err
+}
+
+func (c *Controller) DeleteEdgesAndXrefsTo(targetAddr uint32) error {
+	seg := c.SegOf(targetAddr)
+	_, _ = c.conn.Exec("DELETE FROM edges WHERE (seg = ?1 OR seg = '') AND target_addr = ?2", seg, targetAddr)
+	_, err := c.conn.Exec("DELETE FROM xrefs WHERE (seg = ?1 OR seg = '') AND target_addr = ?2", seg, targetAddr)
+	return err
+}
+
+func (c *Controller) DeleteFunctionAt(entryAddr uint32) error {
+	seg := c.SegOf(entryAddr)
+	_, err := c.conn.Exec("DELETE FROM functions WHERE (seg = ?1 OR seg = '') AND entry_addr = ?2", seg, entryAddr)
+	return err
+}
+
+func (c *Controller) DeleteLabelAndRename(addr uint32) error {
+	seg := c.SegOf(addr)
+	if lbl, err := c.GetLabelFull(addr); err == nil && lbl != nil {
+		_, _ = c.conn.Exec(
+			"DELETE FROM renames WHERE (seg = ?1 OR seg = '') AND (original = ?2 OR renamed = ?2)",
+			seg, lbl.Name,
+		)
+	}
+	if _, err := c.conn.Exec("DELETE FROM labels WHERE (seg = ?1 OR seg = '') AND addr = ?2", seg, addr); err != nil {
+		return err
+	}
+	_, _ = c.conn.Exec("DELETE FROM functions WHERE (seg = ?1 OR seg = '') AND entry_addr = ?2", seg, addr)
+	return nil
+}
+
 func (c *Controller) RenameLabelAt(addr uint32, name string) error {
 	seg := c.SegOf(addr)
 	_, err := c.conn.Exec("UPDATE labels SET name = ?1 WHERE seg = ?2 AND addr = ?3", name, seg, addr)
@@ -1164,6 +1204,14 @@ func (c *Controller) FunctionLabelAddrs() []uint32 {
 	return queryInto(sql1)
 }
 
+func (c *Controller) DataReadWriteTargets() []uint32 {
+	inClause := c.spaceSegInClause(false)
+	return c.queryUint32s(fmt.Sprintf(
+		"SELECT DISTINCT target_addr FROM xrefs WHERE seg IN (%s) AND type IN ('DATA_READ', 'DATA_WRITE')",
+		inClause,
+	))
+}
+
 func (c *Controller) searchBoundsAndClause(rng *AddrRange, col string, includeEmpty bool) (uint32, uint32, string) {
 	if rng != nil {
 		seg := strings.ReplaceAll(c.SegOf(rng.Start), "'", "''")
diff --git a/internal/project/project.go b/internal/project/project.go
index 3afa938..582bbae 100644
--- a/internal/project/project.go
+++ b/internal/project/project.go
@@ -735,14 +735,42 @@ func (p *Project) ResolveTarget(ctrl *db.Controller, input string) (uint32, bool
 			var resolved uint32
 			var found bool
 			ctrl.WithActiveSeg(seg.Name, func() {
+				if a, ok := ctrl.LabelAddrByName(rest, false); ok {
+					resolved, found = a, true
+					return
+				}
+				if orig, ok := ctrl.RenameOriginalOf(rest, false); ok {
+					if a, ok := ctrl.LabelAddrByName(orig, false); ok {
+						resolved, found = a, true
+						return
+					}
+				}
+				if a, ok := ctrl.LabelAddrByName(rest, true); ok {
+					resolved, found = a, true
+					return
+				}
+				if orig, ok := ctrl.RenameOriginalOf(rest, true); ok {
+					if a, ok := ctrl.LabelAddrByName(orig, true); ok {
+						resolved, found = a, true
+						return
+					}
+				}
+				if off, err := ParseHex(rest); err == nil {
+					if seg.Base > 0 && off >= seg.Base && off < seg.EndAddr() && off >= seg.AllocSize {
+						resolved, found = off, true
+					} else {
+						resolved, found = seg.Base+off, true
+					}
+					return
+				}
 				resolved, found = p.ResolveTarget(ctrl, rest)
+				if found && seg.Base > 0 && resolved < seg.Base && resolved < seg.AllocSize {
+					resolved += seg.Base
+				}
 			})
 			if found {
 				return resolved, true
 			}
-			if off, err := ParseHex(rest); err == nil {
-				return seg.Base + off, true
-			}
 		}
 	}