Having fixed several bugs in B::ToXML, I've wobbled back and forth between execution order and tree order. When I realized that I could keep track of op sequence numbers (to reconstruct execution order), I returned to tree form. It works better that way, as children are nested properly.
I'd missed a handful of op types (LOGOP comes to mind), and now support them.
I'm able to splice a generated op tree into the tree of an anonymous subroutine, and it more or less works -- a simple replacement that prints a happy message even deparses (almost) correctly. Splicing is tricky, as it must be careful to lop off 'leavesub' and 'entersub' ops in the right places.
The problem is COPs, or control operations. They're not generated correctly (probably because they're not documented well). A 'nextstate' op somehow turns into a 'lineseq'. I hacked a method into B::Generate to clear the COP label, but that's messy. It also still leaves empty do { } constructs.
On the whole, it's a lot further along than it was a few days ago. I keep learning things, too. It seems just a few tweaks short of success, or at least more reliable segfaults.
The obligatory links are B::ToXML and xmltwigtoperl.pl. (I used XML::Twig because it's easy and Mirod wouldn't like it if I didn't.)