diff --git a/README.ja.md b/README.ja.md
index 4ebbb714..88a0b81b 100644
--- a/README.ja.md
+++ b/README.ja.md
@@ -272,7 +272,7 @@ $NYASH_BIN --run-task smoke_obj_array
   - `NYASH_LLVM_USE_HARNESS=1`
   - `NYASH_NY_LLVM_COMPILER=$NYASH_ROOT/target/release/ny-llvmc`
   - `NYASH_EMIT_EXE_NYRT=$NYASH_ROOT/target/release`
-  - 例: `NYASH_LLVM_USE_HARNESS=1 NYASH_NY_LLVM_COMPILER=target/release/ny-llvmc NYASH_EMIT_EXE_NYRT=target/release ./target/release/nyash --backend llvm apps/ny-llvm-smoke/main.nyash`
+  - 例: `NYASH_LLVM_USE_HARNESS=1 NYASH_NY_LLVM_COMPILER=target/release/ny-llvmc NYASH_EMIT_EXE_NYRT=target/release $NYASH_BIN --backend llvm apps/ny-llvm-smoke/main.nyash`
 
 ### DebugHub かんたんガイド
 - 有効化: `NYASH_DEBUG_ENABLE=1`
@@ -410,7 +410,7 @@ cargo build --release --features cranelift-jit
 
 # 最初のプログラムを実行
 echo 'print("Hello Nyash!")' > hello.nyash
-./target/release/nyash hello.nyash
+$NYASH_BIN hello.nyash
 ```
 
 ### Windows
diff --git a/README.md b/README.md
index b24bc0a6..ba39f14a 100644
--- a/README.md
+++ b/README.md
@@ -25,7 +25,7 @@ Execution Status (Feature Additions Pause)
 
 Quick pointers
 - Emit object with harness: set `NYASH_LLVM_USE_HARNESS=1` and `NYASH_LLVM_OBJ_OUT=<path>` (defaults in tools use `tmp/`).
-- Run PyVM: `NYASH_VM_USE_PY=1 ./target/release/nyash --backend vm apps/APP/main.nyash`.
+- Run PyVM: `NYASH_VM_USE_PY=1 $NYASH_BIN --backend vm apps/APP/main.nyash`.
 
 Dev shortcuts (Operator Boxes & JSON smokes)
 - One‑shot JSON verification (dev, Operator Boxes ON): `./tools/opbox-json.sh`
@@ -100,7 +100,7 @@ Layer guard (one-way deps: origin→observe→rewrite)
 Profiles (quick)
 - `--profile dev` → Macros ON (strict), PyVM dev向け設定を適用（必要に応じて環境で上書き可）
 - `--profile lite` → Macros OFF の軽量実行
-  - 例: `./target/release/nyash --profile dev --backend vm apps/tests/ternary_basic.nyash`
+  - 例: `$NYASH_BIN --profile dev --backend vm apps/tests/ternary_basic.nyash`
 
 Specs & Constraints
 - Invariants (must-hold): `docs/reference/invariants.md`
@@ -118,7 +118,7 @@ Specs & Constraints
 <a id="self-hosting"></a>
 ## 🧪 Self‑Hosting (Dev Focus)
 - Guide: `docs/how-to/self-hosting.md`
-- Minimal E2E: `./target/release/nyash --backend vm apps/selfhost-minimal/main.nyash`
+- Minimal E2E: `$NYASH_BIN --backend vm apps/selfhost-minimal/main.nyash`
 - Smokes: `bash tools/jit_smoke.sh` / `bash tools/selfhost_vm_smoke.sh`
 - JSON (Operator Boxes, dev): `./tools/opbox-json.sh` / `./tools/opbox-quick.sh`
 - Makefile: `make run-minimal`, `make smoke-selfhost`
diff --git a/tools/smokes/v2/profiles/quick/core/bridge/canonicalize_closure_captures_negative_vm.sh b/tools/smokes/v2/profiles/quick/core/bridge/canonicalize_closure_captures_negative_vm.sh
new file mode 100644
index 00000000..abc7c19d
--- /dev/null
+++ b/tools/smokes/v2/profiles/quick/core/bridge/canonicalize_closure_captures_negative_vm.sh
@@ -0,0 +1,45 @@
+#!/bin/bash
+# canonicalize_closure_captures_negative_vm.sh — v1 bridge Closure captures (malformed) should fail
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+if ROOT_GIT=$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null); then
+  ROOT="$ROOT_GIT"
+else
+  ROOT="$(cd "$SCRIPT_DIR/../../../../../../../../.." && pwd)"
+fi
+source "$ROOT/tools/smokes/v2/lib/test_runner.sh"
+require_env || exit 2
+
+# Opt-in with SMOKES_ENABLE_BRIDGE_CLOSURE=1
+if [ "${SMOKES_ENABLE_BRIDGE_CLOSURE:-0}" != "1" ]; then
+  test_skip canonicalize_closure_captures_negative_vm "opt-in (SMOKES_ENABLE_BRIDGE_CLOSURE=1)"
+  exit 0
+fi
+
+# Malformed v1 JSON: Closure.captures with wrong element types (strings)
+json_path="/tmp/ny_v1_closure_caps_bad_$$.json"
+cat >"$json_path" <<'JSON'
+{"schema_version":"1.0","functions":[{"name":"main","blocks":[{"id":0,"instructions":[
+  {"op":"mir_call","dst":3,
+    "callee":{"type":"Closure","func":1,"captures":["a","b"]},
+    "args":[1,2]},
+  {"op":"ret"}
+]}]}]}
+JSON
+
+set +e
+HAKO_NYVM_V1_DOWNCONVERT=1 "$NYASH_BIN" --json-file "$json_path" >/dev/null 2>&1
+rc=$?
+set -e
+rm -f "$json_path"
+
+if [ "$rc" != 0 ]; then
+  echo "[PASS] canonicalize_closure_captures_negative_vm"
+  exit 0
+else
+  echo "[FAIL] canonicalize_closure_captures_negative_vm (unexpected rc=0)" >&2
+  exit 1
+fi
+
diff --git a/tools/smokes/v2/profiles/quick/core/stageb/stageb_bundle_alias_table_bad_vm.sh b/tools/smokes/v2/profiles/quick/core/stageb/stageb_bundle_alias_table_bad_vm.sh
new file mode 100644
index 00000000..06276f24
--- /dev/null
+++ b/tools/smokes/v2/profiles/quick/core/stageb/stageb_bundle_alias_table_bad_vm.sh
@@ -0,0 +1,34 @@
+#!/bin/bash
+# stageb_bundle_alias_table_bad_vm.sh — Stage‑B: malformed alias table should fail (opt‑in)
+
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+if ROOT_GIT=$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null); then
+  ROOT="$ROOT_GIT"
+else
+  ROOT="$(cd "$SCRIPT_DIR/../../../../../../../../.." && pwd)"
+fi
+source "$ROOT/tools/smokes/v2/lib/test_runner.sh"
+source "$ROOT/tools/smokes/v2/lib/stageb_helpers.sh"
+require_env || exit 2
+
+if [ "${SMOKES_ENABLE_STAGEB:-0}" != "1" ]; then
+  echo "[SKIP] stageb_bundle_alias_table_bad_vm (SMOKES_ENABLE_STAGEB=1 to enable)"
+  exit 0
+fi
+
+main='static box Main { method main(args) { return 0 } }'
+
+# Malformed table: missing colon; empty name/code entries
+export HAKO_BUNDLE_ALIAS_TABLE='U1|||BadEntryNoColon|||
+:codeOnly|||NameOnly:'
+
+if json=$(stageb_compile_to_json_with_require "$main" "U1"); then
+  echo "[FAIL] stageb_bundle_alias_table_bad_vm (unexpected success)" >&2
+  test -f "$json" && rm -f "$json"
+  exit 1
+else
+  echo "[PASS] stageb_bundle_alias_table_bad_vm"
+  exit 0
+fi
+