From 2e249bff5c28524bc0ea9406e061471b91ba40b4 Mon Sep 17 00:00:00 2001
From: Owen Carey <37121709+owenthcarey@users.noreply.github.com>
Date: Mon, 5 Oct 2026 16:49:19 -0700
Subject: [PATCH 1/6] feat!: inline shadow guards and confirmed errors

Implements RFC 0034 (docs/rfcs/0034-fast-enforcement.md), which amends
RFCs 0032 and 0033: the model (prove, check, guard, record) stays and
each part becomes cheaper.

- Guards are declared calls that LLVM passes canonicalize, merge and
  expand into inline checks against a whole-address-space shadow (one
  byte per 16-byte granule, with exact encodings for stack and global
  objects); range caches and the inline guard bodies are deleted.
- A local is registered only where a guard can reach it; library calls
  whose need no term states go through checked wrappers.
- A definite error fails the build only when a path replay confirms it;
  unconfirmed candidates are warnings.
- The analysis is bounded by a work budget per run and per unit, plus
  memory caps; the transfer-count budgets are gone.
- Term arithmetic is exact over long long, clamped only at its result,
  and stack objects write their shadow a run at a time.

Gates (amendment 16): F1, F3, F4 met; F2 met but for opus's build time;
F5 and F7 carried forward. 725 cases pass in plain, --asan and
--checks verify runs; 48 blind programs added (test/cases/detection-blind).

BREAKING CHANGE: -fweavec-budget and -fweavec-unit-budget now count
analysis work instead of CFG block transfers (defaults 20,000,000 per
run and 400 per site, at least 20,000,000, per unit); a definite error
that its replay does not confirm is a warning; the guard helpers are
declarations the backend lowers, so the prelude and libweavec_chk.a
change with the runtime.
---
 .clang-tidy                                   |    5 +
 AGENTS.md                                     |    8 +-
 README.md                                     |   16 +-
 docs/architecture.md                          |  139 +-
 docs/pages/guides/adoption.md                 |    6 +-
 docs/pages/guides/build-integration.md        |    2 +-
 docs/pages/reference/cli.md                   |   74 +-
 docs/pages/reference/compatibility.md         |    2 +-
 docs/pages/reference/guarantees.md            |   20 +-
 docs/pages/reference/troubleshooting.md       |    8 +-
 docs/rfcs/0034-fast-enforcement.md            | 1063 +++++++++
 docs/rfcs/README.md                           |    1 +
 docs/roadmap.md                               |   38 +-
 include/weavec/Analysis/LedgerAdapter.h       |   15 +
 include/weavec/Core/CheckPlan.h               |   22 +-
 include/weavec/Core/Heap.h                    |   19 +-
 include/weavec/Core/Ledger.h                  |   19 +-
 include/weavec/Core/LibrarySpec.h             |   26 +
 include/weavec/Frontend/CheckEmitter.h        |   29 +-
 include/weavec/Frontend/GuardPasses.h         |   88 +
 include/weavec/Frontend/ObjectRegistration.h  |   14 +-
 lib/Analysis/CheckPlanner.cpp                 |  145 +-
 lib/Analysis/Engine.h                         |   74 +-
 lib/Analysis/EngineCalls.cpp                  |   99 +-
 lib/Analysis/EngineDecide.cpp                 |  122 +-
 lib/Analysis/EngineExpr.cpp                   |   26 +-
 lib/Analysis/EngineLibrary.cpp                |   28 +-
 lib/Analysis/EngineLifetimes.cpp              |   27 +-
 lib/Analysis/EngineRun.cpp                    |  238 +-
 lib/Analysis/EngineSummary.cpp                |  105 +-
 lib/Analysis/EngineUnit.cpp                   |   11 +-
 lib/Analysis/KindInference.cpp                |    4 +
 lib/Analysis/KindInferenceFields.cpp          |    2 +
 lib/Analysis/KindInferenceMustAccess.cpp      |    7 +
 lib/Analysis/LedgerAdapter.cpp                |   56 +-
 lib/Core/CheckPlan.cpp                        |   23 +-
 lib/Core/Heap.cpp                             |   72 +-
 lib/Core/Ledger.cpp                           |   21 +-
 lib/Core/LibrarySpec.cpp                      |   76 +-
 lib/Core/LibrarySpec.txt                      |   33 +-
 lib/Frontend/CMakeLists.txt                   |    3 +
 lib/Frontend/CheckEmitter.cpp                 |  762 +++----
 lib/Frontend/Driver.cpp                       |  116 +-
 lib/Frontend/GuardPasses.cpp                  |  866 ++++++++
 lib/Frontend/ObjectRegistration.cpp           |  125 +-
 lib/Frontend/Prelude.cpp                      |  516 +++--
 lib/Frontend/RecordFacts.cpp                  |   11 +-
 runtime/test/rt_test.c                        |   95 +
 runtime/weavec_alloc.c                        |  106 +-
 runtime/weavec_objects.c                      |  327 ++-
 runtime/weavec_owner.c                        |   50 +-
 runtime/weavec_report.c                       |    2 +-
 runtime/weavec_rt.h                           |  304 ++-
 scripts/check-hygiene.py                      |   19 +-
 scripts/corpus-gate.py                        |  280 ++-
 scripts/run-cases.py                          |  321 ++-
 scripts/test_corpus_gate.py                   |  186 +-
 scripts/test_run_cases.py                     |  123 ++
 test/Analysis/rfc0030-budget.c                |    6 +-
 test/Driver/driver-werror.c                   |   11 +
 test/Driver/rfc0030-print-prelude.c           |   13 +-
 test/Driver/weavec-archive-note.c             |   38 +
 .../rewrite-oracle-len-before-call.expected.c |    2 +-
 ...-oracle-lowered-violation-plain.expected.c |    7 +
 ...ewrite-oracle-lowered-violation.expected.c |    7 +-
 test/Emission/Inputs/rewrite-oracle.py        |   12 +-
 ...runtime-oracle-checked-wrappers.expected.c |   26 +
 .../runtime-oracle-global-objects.expected.c  |    4 +-
 .../runtime-oracle-range-cache.expected.c     |   31 -
 .../runtime-oracle-stack-objects.expected.c   |    6 +-
 test/Emission/checked-wrappers-runtime.c      |   63 +
 test/Emission/guard-passes-call-arguments.c   |   26 +
 test/Emission/guard-passes-global-padding.c   |   33 +
 .../rewrite-oracle-lowered-violation.c        |   17 +-
 .../rfc0030-disjoint-computed-pointer.c       |    5 +-
 .../runtime-oracle-checked-wrappers.c         |   29 +
 test/Emission/runtime-oracle-range-cache.c    |   31 -
 test/Emission/runtime-oracle-stack-objects.c  |    3 +-
 .../stack-objects-callback-argument.c         |   25 +
 test/Prelude/rfc0030-prelude-compile.c        |    3 -
 test/Prelude/rfc0030-prelude-runtime.c        |   41 +-
 test/cases/README.md                          |   66 +-
 .../detection-blind/01_ring_buffer_wrap.c     |   75 +
 .../detection-blind/02_strbuf_terminator.c    |   70 +
 .../detection-blind/03_csv_quoted_field.c     |   77 +
 .../detection-blind/04_matrix_transpose.c     |  101 +
 test/cases/detection-blind/05_lexer_peek.c    |   98 +
 .../detection-blind/06_strncpy_unterminated.c |   52 +
 .../detection-blind/07_hash_table_rounding.c  |  110 +
 .../detection-blind/08_histogram_max_bucket.c |   52 +
 .../detection-blind/09_snprintf_offset.c      |   57 +
 .../detection-blind/10_tlv_record_length.c    |   75 +
 .../detection-blind/11_base64_encode_nul.c    |   69 +
 .../12_strip_slashes_underflow.c              |   42 +
 .../detection-blind/13_missing_sentinel.c     |   81 +
 .../cases/detection-blind/14_utf8_truncated.c |   90 +
 .../15_smallvec_intra_object.c                |   67 +
 .../16_realloc_bytes_not_elems.c              |   67 +
 .../17_letter_count_negative.c                |   44 +
 .../detection-blind/18_erase_memmove_count.c  |   55 +
 .../detection-blind/19_bitmap_round_down.c    |   61 +
 .../detection-blind/20_list_purge_next.c      |   71 +
 .../detection-blind/21_symtab_stale_pointer.c |   97 +
 .../22_label_out_param_stack.c                |   56 +
 .../detection-blind/23_callback_ctx_freed.c   |  105 +
 .../detection-blind/24_lru_evicted_value.c    |  101 +
 .../detection-blind/25_hashmap_iter_rehash.c  |  155 ++
 .../detection-blind/26_arena_reset_stale.c    |  104 +
 .../27_config_reload_dangling.c               |   94 +
 .../28_refcount_borrowed_unref.c              |  100 +
 .../detection-blind/29_global_ctx_stack.c     |   78 +
 .../cases/detection-blind/30_queue_pop_name.c |   86 +
 .../detection-blind/31_bst_delete_successor.c |  103 +
 .../32_timer_cancel_in_callback.c             |   97 +
 .../33_realloc_result_ignored.c               |   75 +
 .../detection-blind/34_block_scope_label.c    |   53 +
 .../35_worklist_push_invalidates.c            |   75 +
 .../36_error_pointer_into_copy.c              |   73 +
 .../37_double_free_error_path.c               |   81 +
 .../detection-blind/38_free_trimmed_value.c   |   91 +
 .../detection-blind/39_free_default_name.c    |   66 +
 .../40_shallow_copy_double_free.c             |   73 +
 .../detection-blind/41_realloc_free_old.c     |   70 +
 .../detection-blind/42_skip_level_null.c      |   53 +
 .../detection-blind/43_shape_parse_null.c     |   80 +
 .../detection-blind/44_uninit_stream_buffer.c |   98 +
 .../detection-blind/45_strchr_null_flag.c     |   61 +
 .../detection-blind/46_uninit_token_text.c    |   84 +
 .../detection-blind/47_thread_stack_arg.c     |   87 +
 .../48_logger_thread_freed_msg.c              |  109 +
 test/cases/detection-blind/README.md          |   98 +
 test/cases/detection-blind/run.sh             |   64 +
 .../cases/detection/01_hof_strcpy_name/prog.c |   59 +
 .../detection/02_hof_offbyone_parse/prog.c    |   52 +
 .../03_hof_read_declared_count/prog.c         |   58 +
 .../03_hof_read_declared_count/stdin.txt      |    1 +
 .../detection/04_hof_sprintf_logger/prog.c    |   36 +
 .../detection/05_hof_strcat_pathjoin/prog.c   |   37 +
 .../detection/06_hof_memcpy_packet/prog.c     |   57 +
 .../detection/07_hof_intoverflow_size/prog.c  |   57 +
 .../07_hof_intoverflow_size/stdin.txt         |    3 +
 .../detection/08_hof_realloc_bytes/prog.c     |   44 +
 test/cases/detection/09_hunder_rtrim/prog.c   |   36 +
 .../detection/10_hunder_undo_stack/prog.c     |   51 +
 .../detection/11_hadj_image_stride/prog.c     |   60 +
 .../cases/detection/12_hadj_matrix_row/prog.c |   54 +
 .../detection/13_stack_strcpy_route/prog.c    |   35 +
 .../detection/14_stack_offbyone_read/prog.c   |   35 +
 .../detection/15_stack_intraobj_admin/prog.c  |   34 +
 .../detection/16_stack_member_index/prog.c    |   33 +
 .../detection/17_stack_callee_cursor/prog.c   |   30 +
 .../detection/18_stack_sprintf_addr/prog.c    |   36 +
 test/cases/detection/19_glob_histogram/prog.c |   35 +
 .../detection/19_glob_histogram/stdin.txt     |    1 +
 .../detection/20_glob_strcpy_progname/prog.c  |   33 +
 .../21_glob_cursor_unterminated/prog.c        |   37 +
 .../detection/22_glob_negative_index/prog.c   |   28 +
 test/cases/detection/23_uaf_list_pop/prog.c   |   59 +
 .../detection/24_uaf_session_alias/prog.c     |   69 +
 .../detection/25_uaf_realloc_elemptr/prog.c   |   52 +
 test/cases/detection/26_uaf_xtu_conn/conn.c   |   32 +
 test/cases/detection/26_uaf_xtu_conn/conn.h   |   14 +
 test/cases/detection/26_uaf_xtu_conn/main.c   |   39 +
 .../detection/27_uaf_callback_ctx/prog.c      |   58 +
 .../detection/28_uaf_strdup_value/prog.c      |   42 +
 .../detection/29_uaf_getline_first/prog.c     |   36 +
 .../detection/29_uaf_getline_first/stdin.txt  |    3 +
 .../detection/30_uaf_table_resize/prog.c      |   67 +
 test/cases/detection/31_df_error_path/prog.c  |   40 +
 test/cases/detection/32_df_xtu_strbuf/main.c  |   40 +
 .../cases/detection/32_df_xtu_strbuf/strbuf.c |   33 +
 .../cases/detection/32_df_xtu_strbuf/strbuf.h |   13 +
 .../cases/detection/33_df_shared_title/prog.c |   67 +
 .../detection/34_if_interior_trim/prog.c      |   40 +
 .../detection/35_if_stack_scratch/prog.c      |   35 +
 .../detection/36_uar_parser_scratch/prog.c    |   58 +
 test/cases/detection/37_uas_block_tmp/prog.c  |   35 +
 .../cases/detection/38_uar_global_opts/prog.c |   57 +
 .../cases/detection/39_uninit_best_ptr/prog.c |   45 +
 .../detection/40_uninit_realloc_slots/prog.c  |   61 +
 .../detection/41_null_failed_malloc/prog.c    |   43 +
 test/cases/detection/42_null_lookup/prog.c    |   56 +
 test/cases/detection/43_null_getenv/prog.c    |   30 +
 .../detection/44_overlap_memcpy_remove/prog.c |   45 +
 .../detection/45_overlap_strcpy_prefix/prog.c |   32 +
 .../detection/46_fmt_unterminated_heap/prog.c |   44 +
 .../detection/47_strlen_filled_stack/prog.c   |   39 +
 .../cases/detection/48_asprintf_append/prog.c |   37 +
 .../detection/49_strdup_strcat_bak/prog.c     |   37 +
 .../detection/50_getline_ptr_array/prog.c     |   41 +
 .../detection/50_getline_ptr_array/stdin.txt  |    6 +
 .../detection/51_tc_shape_factory/prog.c      |   65 +
 .../cases/detection/52_tc_callback_ctx/prog.c |   60 +
 .../cases/detection/53_stack_ptr_array/prog.c |   36 +
 .../detection/54_uaf_global_cache/prog.c      |   46 +
 .../detection/55_hof_realloc_shrink/prog.c    |   59 +
 test/cases/detection/56_hof_xtu_sbuf/main.c   |   23 +
 test/cases/detection/56_hof_xtu_sbuf/sbuf.c   |   34 +
 test/cases/detection/56_hof_xtu_sbuf/sbuf.h   |   13 +
 test/cases/detection/57_arena_internal/prog.c |   53 +
 .../58_fmt_unterminated_struct/prog.c         |   40 +
 .../detection/59_hof_nul_terminator/prog.c    |   39 +
 .../detection/59_hof_nul_terminator/stdin.txt |    1 +
 .../detection/60_uaf_xtu_callee_frees/main.c  |   30 +
 .../detection/60_uaf_xtu_callee_frees/msg.c   |   20 +
 .../detection/60_uaf_xtu_callee_frees/msg.h   |   10 +
 .../detection/61_if_global_default/prog.c     |   39 +
 test/cases/evaluation/vla-known-miss.c        |    2 +-
 test/cases/pairs/fam-bug.c                    |    2 +-
 test/cases/recall/CWE-121/memset_too_much.c   |    2 +-
 test/cases/recall/CWE-121/strcpy_literal.c    |    2 +-
 test/cases/recall/CWE-122/sized_field.c       |    2 +-
 test/cases/recall/CWE-122/strcpy_strlen.c     |    4 +-
 .../recall/CWE-126/strlen_unterminated.c      |    4 +-
 .../recall/CWE-170/strncpy_unterminated.c     |    8 +-
 .../confirm/bounded-element-release.c         |   33 +
 .../confirm/const-shallow-callback-callee.c   |    7 +
 .../confirm/const-shallow-callback.c          |   35 +
 .../confirm/const-shallow-local-callee.c      |    9 +
 .../semantics/confirm/const-shallow-local.c   |   24 +
 .../semantics/confirm/dangling-hint-direct.c  |   34 +
 .../semantics/confirm/disequality-edges.c     |   59 +
 .../semantics/confirm/exclusive-out-params.c  |   54 +
 .../confirm/exclusive-result-or-out-param.c   |   24 +
 .../confirm/exclusive-switch-out-params.c     |   29 +
 .../confirm/loop-exit-release-break.c         |   36 +
 .../confirm/loop-exit-release-search.c        |   36 +
 .../semantics/confirm/loop-exit-release.c     |   36 +
 .../semantics/confirm/munmap-constant-pages.c |   25 +
 .../semantics/confirm/munmap-hint-address.c   |   42 +
 .../semantics/confirm/munmap-partial-range.c  |   38 +
 .../semantics/confirm/munmap-whole-twice.c    |   21 +
 .../confirm/release-by-flag-stream.c          |   34 +
 .../cases/semantics/confirm/release-by-flag.c |   47 +
 .../semantics/confirm/shared-out-params.c     |   34 +
 .../semantics/confirm/sprintf-guard-fmt.c     |    6 +
 test/cases/semantics/confirm/sprintf-guard.c  |   31 +
 .../confirm/unreachable-after-assert.c        |   46 +
 .../detect-probes/62_uaf_focus_alias/prog.c   |   64 +
 .../detect-probes/63_uaf_loop_next/prog.c     |   68 +
 .../64_arena_block_overflow/prog.c            |   48 +
 .../emission/lowered-out-of-bounds.c          |    2 +-
 .../lowered-use-after-free-no-runtime.c       |   13 +-
 .../runtime/format-precision-dangling_bug.c   |   25 +
 .../runtime/format-precision-dangling_ok.c    |   25 +
 .../runtime/libcall-copy-source_bug.c         |   24 +
 .../runtime/libcall-copy-source_ok.c          |   24 +
 .../runtime/parameter-neighbours_ok.c         |   39 +
 .../semantics/runtime/term-signed-sum_bug.c   |   30 +
 .../semantics/runtime/term-signed-sum_ok.c    |   30 +
 .../semantics/runtime/wrapper-stpcpy_bug.c    |   19 +
 .../semantics/runtime/wrapper-stpcpy_ok.c     |   20 +
 .../semantics/runtime/wrapper-strcat_bug.c    |   21 +
 .../semantics/runtime/wrapper-strcat_ok.c     |   22 +
 .../semantics/runtime/wrapper-strcpy_bug.c    |   18 +
 .../semantics/runtime/wrapper-strcpy_ok.c     |   19 +
 .../semantics/runtime/wrapper-vsprintf_bug.c  |   25 +
 .../semantics/runtime/wrapper-vsprintf_ok.c   |   26 +
 .../soundness/07_strcpy_stack_overflow_bug.c  |   16 +-
 test/cases/soundness/19_vla_size_bug.c        |    2 +-
 test/cases/soundness/41d_many_branches_bug.c  |    6 +-
 .../Inputs/escaped-local-unknown-call-impl.c  |    9 +
 .../alias-cursor-several-arrays_bug.c         |   20 +
 .../alias-cursor-several-arrays_ok.c          |   21 +
 .../soundness/escaped-local-unknown-call_ok.c |   22 +
 test/corpus/README.md                         |   43 +
 test/corpus/bench/curl-bench.c                |  207 ++
 test/corpus/bench/janet-bench.janet           |   22 +
 test/corpus/bench/libgit2-bench.c             |  362 ++++
 test/corpus/bench/lmdb-bench.c                |   40 +
 test/corpus/bench/quickjs-bench.js            |   19 +
 test/corpus/expected.json                     |  818 ++++---
 test/corpus/manifest.json                     |  491 ++++-
 test/corpus/support/cmark/cmark_export.h      |   42 +
 test/corpus/support/cmark/cmark_version.h     |    7 +
 test/corpus/support/curl/curl_config.h        |  793 +++++++
 test/corpus/support/flac/config.h             |  232 ++
 test/corpus/support/giflib/run-tests.sh       |   25 +
 test/corpus/support/libgit2/experimental.h    |   11 +
 test/corpus/support/libgit2/git2_features.h   |  103 +
 test/corpus/support/libjpeg-turbo/jconfig.h   |   60 +
 .../corpus/support/libjpeg-turbo/jconfigint.h |   82 +
 test/corpus/support/libjpeg-turbo/jversion.h  |   30 +
 test/corpus/support/lmdb/fixed-seed.h         |    9 +
 test/corpus/support/lmdb/run-tests.sh         |   43 +
 test/corpus/support/opus/config.h             |    1 +
 test/corpus/support/xz/config.h               |   66 +
 test/corpus/support/zlib-ng/gzread_mangle.h   |    7 +
 test/corpus/support/zlib-ng/round-trips.sh    |   26 +
 test/corpus/support/zlib-ng/zconf.h           |  205 ++
 test/corpus/support/zlib-ng/zlib.h            | 1911 +++++++++++++++++
 .../support/zlib-ng/zlib_name_mangling.h      |    8 +
 test/corpus/triage.json                       |  120 ++
 tools/weavec/main.cpp                         |    5 +-
 unittests/Analysis/CheckPlannerTest.cpp       |  109 +-
 unittests/Core/CheckPlanTest.cpp              |   27 +-
 unittests/Core/HeapTest.cpp                   |   77 +
 unittests/Core/LedgerTest.cpp                 |    8 +-
 unittests/Core/LibrarySpecTest.cpp            |   54 +-
 unittests/Frontend/CheckEmitterTest.cpp       |  152 +-
 unittests/Frontend/LedgerWriterTest.cpp       |   16 +-
 unittests/Frontend/PreludeTest.cpp            |   71 +-
 302 files changed, 20162 insertions(+), 1960 deletions(-)
 create mode 100644 docs/rfcs/0034-fast-enforcement.md
 create mode 100644 include/weavec/Frontend/GuardPasses.h
 create mode 100644 lib/Frontend/GuardPasses.cpp
 create mode 100644 test/Driver/driver-werror.c
 create mode 100644 test/Driver/weavec-archive-note.c
 create mode 100644 test/Emission/Inputs/rewrite-oracle-lowered-violation-plain.expected.c
 create mode 100644 test/Emission/Inputs/runtime-oracle-checked-wrappers.expected.c
 delete mode 100644 test/Emission/Inputs/runtime-oracle-range-cache.expected.c
 create mode 100644 test/Emission/checked-wrappers-runtime.c
 create mode 100644 test/Emission/guard-passes-call-arguments.c
 create mode 100644 test/Emission/guard-passes-global-padding.c
 create mode 100644 test/Emission/runtime-oracle-checked-wrappers.c
 delete mode 100644 test/Emission/runtime-oracle-range-cache.c
 create mode 100644 test/Emission/stack-objects-callback-argument.c
 create mode 100644 test/cases/detection-blind/01_ring_buffer_wrap.c
 create mode 100644 test/cases/detection-blind/02_strbuf_terminator.c
 create mode 100644 test/cases/detection-blind/03_csv_quoted_field.c
 create mode 100644 test/cases/detection-blind/04_matrix_transpose.c
 create mode 100644 test/cases/detection-blind/05_lexer_peek.c
 create mode 100644 test/cases/detection-blind/06_strncpy_unterminated.c
 create mode 100644 test/cases/detection-blind/07_hash_table_rounding.c
 create mode 100644 test/cases/detection-blind/08_histogram_max_bucket.c
 create mode 100644 test/cases/detection-blind/09_snprintf_offset.c
 create mode 100644 test/cases/detection-blind/10_tlv_record_length.c
 create mode 100644 test/cases/detection-blind/11_base64_encode_nul.c
 create mode 100644 test/cases/detection-blind/12_strip_slashes_underflow.c
 create mode 100644 test/cases/detection-blind/13_missing_sentinel.c
 create mode 100644 test/cases/detection-blind/14_utf8_truncated.c
 create mode 100644 test/cases/detection-blind/15_smallvec_intra_object.c
 create mode 100644 test/cases/detection-blind/16_realloc_bytes_not_elems.c
 create mode 100644 test/cases/detection-blind/17_letter_count_negative.c
 create mode 100644 test/cases/detection-blind/18_erase_memmove_count.c
 create mode 100644 test/cases/detection-blind/19_bitmap_round_down.c
 create mode 100644 test/cases/detection-blind/20_list_purge_next.c
 create mode 100644 test/cases/detection-blind/21_symtab_stale_pointer.c
 create mode 100644 test/cases/detection-blind/22_label_out_param_stack.c
 create mode 100644 test/cases/detection-blind/23_callback_ctx_freed.c
 create mode 100644 test/cases/detection-blind/24_lru_evicted_value.c
 create mode 100644 test/cases/detection-blind/25_hashmap_iter_rehash.c
 create mode 100644 test/cases/detection-blind/26_arena_reset_stale.c
 create mode 100644 test/cases/detection-blind/27_config_reload_dangling.c
 create mode 100644 test/cases/detection-blind/28_refcount_borrowed_unref.c
 create mode 100644 test/cases/detection-blind/29_global_ctx_stack.c
 create mode 100644 test/cases/detection-blind/30_queue_pop_name.c
 create mode 100644 test/cases/detection-blind/31_bst_delete_successor.c
 create mode 100644 test/cases/detection-blind/32_timer_cancel_in_callback.c
 create mode 100644 test/cases/detection-blind/33_realloc_result_ignored.c
 create mode 100644 test/cases/detection-blind/34_block_scope_label.c
 create mode 100644 test/cases/detection-blind/35_worklist_push_invalidates.c
 create mode 100644 test/cases/detection-blind/36_error_pointer_into_copy.c
 create mode 100644 test/cases/detection-blind/37_double_free_error_path.c
 create mode 100644 test/cases/detection-blind/38_free_trimmed_value.c
 create mode 100644 test/cases/detection-blind/39_free_default_name.c
 create mode 100644 test/cases/detection-blind/40_shallow_copy_double_free.c
 create mode 100644 test/cases/detection-blind/41_realloc_free_old.c
 create mode 100644 test/cases/detection-blind/42_skip_level_null.c
 create mode 100644 test/cases/detection-blind/43_shape_parse_null.c
 create mode 100644 test/cases/detection-blind/44_uninit_stream_buffer.c
 create mode 100644 test/cases/detection-blind/45_strchr_null_flag.c
 create mode 100644 test/cases/detection-blind/46_uninit_token_text.c
 create mode 100644 test/cases/detection-blind/47_thread_stack_arg.c
 create mode 100644 test/cases/detection-blind/48_logger_thread_freed_msg.c
 create mode 100644 test/cases/detection-blind/README.md
 create mode 100755 test/cases/detection-blind/run.sh
 create mode 100644 test/cases/detection/01_hof_strcpy_name/prog.c
 create mode 100644 test/cases/detection/02_hof_offbyone_parse/prog.c
 create mode 100644 test/cases/detection/03_hof_read_declared_count/prog.c
 create mode 100644 test/cases/detection/03_hof_read_declared_count/stdin.txt
 create mode 100644 test/cases/detection/04_hof_sprintf_logger/prog.c
 create mode 100644 test/cases/detection/05_hof_strcat_pathjoin/prog.c
 create mode 100644 test/cases/detection/06_hof_memcpy_packet/prog.c
 create mode 100644 test/cases/detection/07_hof_intoverflow_size/prog.c
 create mode 100644 test/cases/detection/07_hof_intoverflow_size/stdin.txt
 create mode 100644 test/cases/detection/08_hof_realloc_bytes/prog.c
 create mode 100644 test/cases/detection/09_hunder_rtrim/prog.c
 create mode 100644 test/cases/detection/10_hunder_undo_stack/prog.c
 create mode 100644 test/cases/detection/11_hadj_image_stride/prog.c
 create mode 100644 test/cases/detection/12_hadj_matrix_row/prog.c
 create mode 100644 test/cases/detection/13_stack_strcpy_route/prog.c
 create mode 100644 test/cases/detection/14_stack_offbyone_read/prog.c
 create mode 100644 test/cases/detection/15_stack_intraobj_admin/prog.c
 create mode 100644 test/cases/detection/16_stack_member_index/prog.c
 create mode 100644 test/cases/detection/17_stack_callee_cursor/prog.c
 create mode 100644 test/cases/detection/18_stack_sprintf_addr/prog.c
 create mode 100644 test/cases/detection/19_glob_histogram/prog.c
 create mode 100644 test/cases/detection/19_glob_histogram/stdin.txt
 create mode 100644 test/cases/detection/20_glob_strcpy_progname/prog.c
 create mode 100644 test/cases/detection/21_glob_cursor_unterminated/prog.c
 create mode 100644 test/cases/detection/22_glob_negative_index/prog.c
 create mode 100644 test/cases/detection/23_uaf_list_pop/prog.c
 create mode 100644 test/cases/detection/24_uaf_session_alias/prog.c
 create mode 100644 test/cases/detection/25_uaf_realloc_elemptr/prog.c
 create mode 100644 test/cases/detection/26_uaf_xtu_conn/conn.c
 create mode 100644 test/cases/detection/26_uaf_xtu_conn/conn.h
 create mode 100644 test/cases/detection/26_uaf_xtu_conn/main.c
 create mode 100644 test/cases/detection/27_uaf_callback_ctx/prog.c
 create mode 100644 test/cases/detection/28_uaf_strdup_value/prog.c
 create mode 100644 test/cases/detection/29_uaf_getline_first/prog.c
 create mode 100644 test/cases/detection/29_uaf_getline_first/stdin.txt
 create mode 100644 test/cases/detection/30_uaf_table_resize/prog.c
 create mode 100644 test/cases/detection/31_df_error_path/prog.c
 create mode 100644 test/cases/detection/32_df_xtu_strbuf/main.c
 create mode 100644 test/cases/detection/32_df_xtu_strbuf/strbuf.c
 create mode 100644 test/cases/detection/32_df_xtu_strbuf/strbuf.h
 create mode 100644 test/cases/detection/33_df_shared_title/prog.c
 create mode 100644 test/cases/detection/34_if_interior_trim/prog.c
 create mode 100644 test/cases/detection/35_if_stack_scratch/prog.c
 create mode 100644 test/cases/detection/36_uar_parser_scratch/prog.c
 create mode 100644 test/cases/detection/37_uas_block_tmp/prog.c
 create mode 100644 test/cases/detection/38_uar_global_opts/prog.c
 create mode 100644 test/cases/detection/39_uninit_best_ptr/prog.c
 create mode 100644 test/cases/detection/40_uninit_realloc_slots/prog.c
 create mode 100644 test/cases/detection/41_null_failed_malloc/prog.c
 create mode 100644 test/cases/detection/42_null_lookup/prog.c
 create mode 100644 test/cases/detection/43_null_getenv/prog.c
 create mode 100644 test/cases/detection/44_overlap_memcpy_remove/prog.c
 create mode 100644 test/cases/detection/45_overlap_strcpy_prefix/prog.c
 create mode 100644 test/cases/detection/46_fmt_unterminated_heap/prog.c
 create mode 100644 test/cases/detection/47_strlen_filled_stack/prog.c
 create mode 100644 test/cases/detection/48_asprintf_append/prog.c
 create mode 100644 test/cases/detection/49_strdup_strcat_bak/prog.c
 create mode 100644 test/cases/detection/50_getline_ptr_array/prog.c
 create mode 100644 test/cases/detection/50_getline_ptr_array/stdin.txt
 create mode 100644 test/cases/detection/51_tc_shape_factory/prog.c
 create mode 100644 test/cases/detection/52_tc_callback_ctx/prog.c
 create mode 100644 test/cases/detection/53_stack_ptr_array/prog.c
 create mode 100644 test/cases/detection/54_uaf_global_cache/prog.c
 create mode 100644 test/cases/detection/55_hof_realloc_shrink/prog.c
 create mode 100644 test/cases/detection/56_hof_xtu_sbuf/main.c
 create mode 100644 test/cases/detection/56_hof_xtu_sbuf/sbuf.c
 create mode 100644 test/cases/detection/56_hof_xtu_sbuf/sbuf.h
 create mode 100644 test/cases/detection/57_arena_internal/prog.c
 create mode 100644 test/cases/detection/58_fmt_unterminated_struct/prog.c
 create mode 100644 test/cases/detection/59_hof_nul_terminator/prog.c
 create mode 100644 test/cases/detection/59_hof_nul_terminator/stdin.txt
 create mode 100644 test/cases/detection/60_uaf_xtu_callee_frees/main.c
 create mode 100644 test/cases/detection/60_uaf_xtu_callee_frees/msg.c
 create mode 100644 test/cases/detection/60_uaf_xtu_callee_frees/msg.h
 create mode 100644 test/cases/detection/61_if_global_default/prog.c
 create mode 100644 test/cases/semantics/confirm/bounded-element-release.c
 create mode 100644 test/cases/semantics/confirm/const-shallow-callback-callee.c
 create mode 100644 test/cases/semantics/confirm/const-shallow-callback.c
 create mode 100644 test/cases/semantics/confirm/const-shallow-local-callee.c
 create mode 100644 test/cases/semantics/confirm/const-shallow-local.c
 create mode 100644 test/cases/semantics/confirm/dangling-hint-direct.c
 create mode 100644 test/cases/semantics/confirm/disequality-edges.c
 create mode 100644 test/cases/semantics/confirm/exclusive-out-params.c
 create mode 100644 test/cases/semantics/confirm/exclusive-result-or-out-param.c
 create mode 100644 test/cases/semantics/confirm/exclusive-switch-out-params.c
 create mode 100644 test/cases/semantics/confirm/loop-exit-release-break.c
 create mode 100644 test/cases/semantics/confirm/loop-exit-release-search.c
 create mode 100644 test/cases/semantics/confirm/loop-exit-release.c
 create mode 100644 test/cases/semantics/confirm/munmap-constant-pages.c
 create mode 100644 test/cases/semantics/confirm/munmap-hint-address.c
 create mode 100644 test/cases/semantics/confirm/munmap-partial-range.c
 create mode 100644 test/cases/semantics/confirm/munmap-whole-twice.c
 create mode 100644 test/cases/semantics/confirm/release-by-flag-stream.c
 create mode 100644 test/cases/semantics/confirm/release-by-flag.c
 create mode 100644 test/cases/semantics/confirm/shared-out-params.c
 create mode 100644 test/cases/semantics/confirm/sprintf-guard-fmt.c
 create mode 100644 test/cases/semantics/confirm/sprintf-guard.c
 create mode 100644 test/cases/semantics/confirm/unreachable-after-assert.c
 create mode 100644 test/cases/semantics/detect-probes/62_uaf_focus_alias/prog.c
 create mode 100644 test/cases/semantics/detect-probes/63_uaf_loop_next/prog.c
 create mode 100644 test/cases/semantics/detect-probes/64_arena_block_overflow/prog.c
 create mode 100644 test/cases/semantics/runtime/format-precision-dangling_bug.c
 create mode 100644 test/cases/semantics/runtime/format-precision-dangling_ok.c
 create mode 100644 test/cases/semantics/runtime/libcall-copy-source_bug.c
 create mode 100644 test/cases/semantics/runtime/libcall-copy-source_ok.c
 create mode 100644 test/cases/semantics/runtime/parameter-neighbours_ok.c
 create mode 100644 test/cases/semantics/runtime/term-signed-sum_bug.c
 create mode 100644 test/cases/semantics/runtime/term-signed-sum_ok.c
 create mode 100644 test/cases/semantics/runtime/wrapper-stpcpy_bug.c
 create mode 100644 test/cases/semantics/runtime/wrapper-stpcpy_ok.c
 create mode 100644 test/cases/semantics/runtime/wrapper-strcat_bug.c
 create mode 100644 test/cases/semantics/runtime/wrapper-strcat_ok.c
 create mode 100644 test/cases/semantics/runtime/wrapper-strcpy_bug.c
 create mode 100644 test/cases/semantics/runtime/wrapper-strcpy_ok.c
 create mode 100644 test/cases/semantics/runtime/wrapper-vsprintf_bug.c
 create mode 100644 test/cases/semantics/runtime/wrapper-vsprintf_ok.c
 create mode 100644 test/cases/soundness/Inputs/escaped-local-unknown-call-impl.c
 create mode 100644 test/cases/soundness/alias-cursor-several-arrays_bug.c
 create mode 100644 test/cases/soundness/alias-cursor-several-arrays_ok.c
 create mode 100644 test/cases/soundness/escaped-local-unknown-call_ok.c
 create mode 100644 test/corpus/bench/curl-bench.c
 create mode 100644 test/corpus/bench/janet-bench.janet
 create mode 100644 test/corpus/bench/libgit2-bench.c
 create mode 100644 test/corpus/bench/lmdb-bench.c
 create mode 100644 test/corpus/bench/quickjs-bench.js
 create mode 100644 test/corpus/support/cmark/cmark_export.h
 create mode 100644 test/corpus/support/cmark/cmark_version.h
 create mode 100644 test/corpus/support/curl/curl_config.h
 create mode 100644 test/corpus/support/flac/config.h
 create mode 100755 test/corpus/support/giflib/run-tests.sh
 create mode 100644 test/corpus/support/libgit2/experimental.h
 create mode 100644 test/corpus/support/libgit2/git2_features.h
 create mode 100644 test/corpus/support/libjpeg-turbo/jconfig.h
 create mode 100644 test/corpus/support/libjpeg-turbo/jconfigint.h
 create mode 100644 test/corpus/support/libjpeg-turbo/jversion.h
 create mode 100644 test/corpus/support/lmdb/fixed-seed.h
 create mode 100755 test/corpus/support/lmdb/run-tests.sh
 create mode 100644 test/corpus/support/opus/config.h
 create mode 100644 test/corpus/support/xz/config.h
 create mode 100644 test/corpus/support/zlib-ng/gzread_mangle.h
 create mode 100755 test/corpus/support/zlib-ng/round-trips.sh
 create mode 100644 test/corpus/support/zlib-ng/zconf.h
 create mode 100644 test/corpus/support/zlib-ng/zlib.h
 create mode 100644 test/corpus/support/zlib-ng/zlib_name_mangling.h

diff --git a/.clang-tidy b/.clang-tidy
index e940599e..b4cdd845 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -11,6 +11,7 @@ Checks: >
   cert-*,
   -cert-err58-cpp,
   clang-analyzer-*,
+  -clang-analyzer-security.ArrayBound,
   cppcoreguidelines-*,
   -cppcoreguidelines-avoid-magic-numbers,
   -cppcoreguidelines-non-private-member-variables-in-classes,
@@ -55,6 +56,10 @@ Checks: >
 #   llvm-use-ranges: lib/Core must not depend on LLVM ADT.
 #   *-macro-to-enum: configuration macros live in generated headers.
 #   readability-trailing-comma: conflicts with clang-format's bin-packing.
+#   clang-analyzer-security.ArrayBound: reports every operand access of an
+#     LLVM instruction the analyzed function creates as an access before its
+#     region (LLVM keeps a User's operands in front of the object), in the
+#     LLVM headers, where no NOLINT in our code reaches (the guard passes).
 
 WarningsAsErrors: '*'
 HeaderFilterRegex: '(include|lib|tools|unittests)/.*'
diff --git a/AGENTS.md b/AGENTS.md
index de620d48..7c027a47 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -40,7 +40,11 @@ witness rule for definite errors, raw pointers only from `WEAVEC_RAW`, the
 library table's portability rule, guards on the accessed address, the link
 modes (`-fweavec-link=records|analyze|none`), the per-unit budget and unit
 record format 31; its *Implementation amendments* override its body too.
-There is no checked mode.
+Then `0034-fast-enforcement.md`: guards as declared calls the LLVM passes
+lower to inline shadow-memory checks, registration only where a guard can
+reach, definite errors confirmed by a replay, and the work budget; its
+*Implementation amendments* (the shadow encoding as built, among others)
+override its body. There is no checked mode.
 
 ## Before touching the model or the checker
 
@@ -123,7 +127,7 @@ cmake --preset dev && cmake --build --preset dev && ctest --preset dev
 | Change pointer kinds / how annotations become kinds | `lib/Core/PointerKind.cpp`, `lib/Analysis/AttributeReader.cpp`, `lib/Analysis/KindInference*.cpp`; what the engine takes from them: `lib/Analysis/EngineKinds.cpp` |
 | Change which checks are inserted     | `lib/Analysis/CheckPlanner.cpp` (plan), `lib/Frontend/CheckEmitter.cpp` and `Prelude.cpp` (emission) |
 | Change which facets get a guard      | `CheckPlanner::planGuards` in `lib/Analysis/CheckPlanner.cpp` (RFC 0032 §6); the need of a call argument's guard: `objectWitness` in `lib/Analysis/EngineLibrary.cpp`; possible findings dropped on guarded facets: `LedgerAdapter::dropGuardedPossible` |
-| Change the guard helpers / range caches | `lib/Frontend/Prelude.cpp` (`GuardHelpers`, `RuntimeHelpers`, `RuntimeDeclarations`), `lib/Frontend/CheckEmitter.cpp` (`planCache`, `declareCaches`, `isQuietLoop`); oracle tests `test/Emission/runtime-oracle-*.c` |
+| Change the guards' lowering / shadow checks | `lib/Frontend/GuardPasses.cpp` (`GuardCanonicalize`, `GuardMerge`, `GuardExpand`, `GlobalPadding`; RFC 0034 §1), the shadow encoding in `runtime/weavec_rt.h`, the prelude's declarations and stack helpers in `lib/Frontend/Prelude.cpp`; tests `test/Emission/guard-passes-*.c`, `runtime-oracle-*.c` |
 | Change stack / global object registration | `lib/Frontend/ObjectRegistration.cpp` (`planObjects`), `CheckEmitter::registerObjects` |
 | Change the runtime (allocator, object table, guards, reports) | `runtime/weavec_alloc.c`, `weavec_malloc.c`, `weavec_objects.c`, `weavec_report.c`, `weavec_rt.h` (the prelude declares the same entry points); its C test `runtime/test/rt_test.c` (CTest `runtime`); cases in `test/cases/semantics/runtime/` |
 | Change the runtime's link line and fallbacks | `lib/Frontend/Driver.cpp` (`addRuntimeLibraries`, `runtimeObstacle`, `allocatorDefinedBy`, `dropAllocatorIfDefined`); `test/Driver/runtime-*.c` |
diff --git a/README.md b/README.md
index ab617fde..219aa1b2 100644
--- a/README.md
+++ b/README.md
@@ -130,7 +130,7 @@ weavec-cc -c main.c -o main.o
 weavec-cc node.o main.o -o prog        # checks the records against each other, then links
 ```
 
-A bug inside one file is reported when that file is compiled. By default the link step only reads the records: it checks declarations against definitions and the requirements of each exported function at the calls other files make, and analyses no file again. A bug that needs two files, such as a use after free whose `free` is in another file, is caught by its guard at run time; to report it at build time, link with `-fweavec-link=analyze` (which analyses the units again, within a time budget) or run `weavec --whole-program`. Link inputs without a WeaveC record (archives, shared libraries, objects from another compiler) are named in one `unanalyzed-input` warning.
+A bug inside one file is reported when that file is compiled. By default the link step only reads the records: it checks declarations against definitions and the requirements of each exported function at the calls other files make, and analyses no file again. A bug that needs two files, such as a use after free whose `free` is in another file, is caught by its guard at run time; to report it at build time, link with `-fweavec-link=analyze` (which analyses the units again, within a time budget) or run `weavec --whole-program`. Link inputs without a WeaveC record (archives, shared libraries, objects from another compiler) are named in one `unanalyzed-input` warning; an archive whose objects `weavec-cc` built is named in a note instead.
 
 ### Checks
 
@@ -210,7 +210,7 @@ For a translation unit compiled by `weavec-cc` in an enforcing mode (the default
 - **(N) Null.** If its null facet is proven or checked, it does not dereference null, or the program traps first.
 - **(T) Temporal.** If its temporal facet is proven, the object is still alive, and a release releases a live allocation once.
 - **(G) Guards.** If a facet is guarded (the default; not with `-fno-weavec-runtime`) and the bytes it accesses start inside an object the runtime tracks (a heap block from the runtime's allocator, a local whose address escapes, a global), the object is live and the access stays inside it, or the program traps first. A guarded release is of null or the start of a live heap block, or the program traps.
-- **(V) Violations.** A definite violation never reaches the object unguarded: it fails the build, or, if lowered with `-Wno-error`, the site is guarded or checked, and traps unconditionally only where it can be neither.
+- **(V) Violations.** A definite violation, confirmed on a feasible path, fails the build; an unconfirmed one is a warning. If lowered with `-Wno-error`, its site is guarded or checked as a possible finding, so it traps only if it happens; nothing traps unconditionally.
 
 These hold under six assumptions:
 
@@ -230,22 +230,22 @@ If a memory-safety violation happens anyway, then a check trapped first, or the
 (G) is weaker than (S) and (T), which is why the ledger counts guarded facets separately from checked ones:
 
 - **Provenance is the address accessed.** A guard asks which object the bytes an access touches lie in *now*, at a subscript `p[i]` as at a dereference, so arithmetic that carries a pointer out of one tracked object and into another live one passes. (This is what lets a base formed outside a buffer, such as `base = src - start`, index back into it.) Two cases still trap: an index or field offset that reaches forwards from inside a live local or global into another one, since those lie next to each other with no gap, and an index or offset from a pointer into a live object that lands in memory nothing tracks. Between heap blocks there is always a byte that belongs to none, so a walk off a heap block traps at its first step.
-- **Freed memory is recycled.** A freed heap block is caught only while it is in the quarantine (64 MiB by default); once its storage is reused, the guard sees the new object.
+- **Freed memory is recycled.** A freed heap block is caught only while it is in the quarantine (16 MiB by default); once its storage is reused, the guard sees the new object.
 - **Untracked memory passes.** String literals, `alloca` blocks, and memory from other allocators or from code built without the runtime are not tracked; a guard passes on them unless an index carried the pointer there from a live tracked object.
 
 The full statement, including what is and is not caught, is in [the guarantees reference](docs/pages/reference/guarantees.md), [RFC 0030, *Soundness*](docs/rfcs/0030-prove-or-trap.md#soundness), [RFC 0032, *Soundness*](docs/rfcs/0032-runtime-enforcement.md#soundness) and [RFC 0033, *Soundness*](docs/rfcs/0033-drop-in-by-default.md#soundness).
 
 ## Performance
 
-Guards run on every execution of the operations they cover, and the runtime's allocator replaces the system's. Measured on the corpus benchmarks as user CPU time and peak memory, relative to the same program built by the reference Clang ([RFC 0032](docs/rfcs/0032-runtime-enforcement.md#implementation-amendments), amendment 3):
+Guards run on every execution of the operations they cover, and the runtime's allocator replaces the system's. A guard is an inline check of the runtime's shadow memory (one byte per 16 bytes) that the compiler merges and hoists like a load; only what the shadow cannot decide calls the runtime. Measured as user CPU time and peak memory, relative to the same program built by the reference Clang ([RFC 0034](docs/rfcs/0034-fast-enforcement.md#implementation-amendments), amendment 16):
 
 | Benchmark | Default (runtime) | `-fno-weavec-runtime` | Peak memory (default) |
 | --- | ---: | ---: | ---: |
-| cJSON parse/print | 1.66× | 1.14× | 0.59× |
-| zlib minigzip | 1.85× | 1.00× | 1.09× |
-| Lua bench | 5.94× | 1.11× | 1.61× |
+| cJSON parse/print | 1.59× | 1.15× | 0.37× |
+| zlib minigzip | 1.62× | 1.00× | 1.26× |
+| Lua bench | 2.43× | 1.09× | 1.54× |
 
-Interpreters and tight loops over pointers pay the most: Lua's dispatch loop executes roughly one guard for every two instructions of the unguarded program. Code that cannot afford this can build with `-fno-weavec-runtime`; facets that would have been guarded are then `unresolved` and not enforced, and a use of a freed object is not caught at run time.
+On ten more projects nobody tuned WeaveC on (QuickJS, LMDB, Janet, brotli, xz, libdeflate, zlib-ng, curl, cmark, libgit2), the default build runs their workloads at 1.5 to 4.0 times the reference compiler's CPU time, 2.55 on average (geometric mean), and every one of them builds and passes its own test suite. Interpreters and tight loops over pointers pay the most. Code that cannot afford this can build with `-fno-weavec-runtime`; facets that would have been guarded are then `unresolved` and not enforced, and a use of a freed object is not caught at run time.
 
 ## Building
 
diff --git a/docs/architecture.md b/docs/architecture.md
index aab7f27a..f11adc93 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -364,9 +364,25 @@ one raw on some paths is `rawSome`, guarded and never an error); a pointer
 read back from reinterpreted bits is `raw-cast`; a construct the engine does not evaluate yields unknown values
 and `unresolved(unanalysed)` for its sites. `memcpy`, `memmove` and record
 assignments copy leaf by leaf, every source cell read before any is
-written. A body that transfers more blocks than `-fweavec-budget` (or visits
-one block more than 64 times) stops: its facets take the defaults with
-reason `budget`, and its summary is incomplete.
+written. A run whose work (the sizes of the states it transfers and
+joins) exceeds `-fweavec-budget`, whose entry states hold more than
+1,000,000 symbols and objects, whose graph has more than 100,000 blocks, or
+that visits one block more than its limit stops (RFC 0034 §7): its facets
+take the defaults with reason `budget`, and its summary is incomplete.
+
+### Confirmation
+
+A definite finding of the authoritative run is a candidate
+(`FunctionRun::confirmCandidates`, RFC 0034 §6). The function is replayed
+in witness mode: a depth-first search along single paths with no joins
+(at most 256 paths and 20,000 transfers), each block transferred with the
+evidence its fixpoint entry state had, a loop left from its fixpoint state
+after two turns, and an edge that refinement or a symbol's excluded
+constants (`SymInfo::excluded`) empties ending the path. A candidate some
+feasible path reaches, and that every such path decides alike, stays an
+error; otherwise `LedgerAdapter::unconfirm` makes it a warning with the
+note `not confirmed on a feasible path` and plans it as a possible
+finding.
 
 ### Decisions
 
@@ -504,9 +520,9 @@ checks, writes ledgers and unit records, and runs the link step.
 | --- | --- |
 | `FrontendAction.h` | `WeaveCAction`, an `ASTFrontendAction` for libTooling, and `createWeaveCConsumer`, which `weavec-cc` runs at the end of each unit; both run `UnitPipeline`. Every emitted function is analysed, including `static inline` functions from user headers (§5.6). |
 | `DeferredCodeGenConsumer` | Sits in front of CodeGen in every C code-generating action (§10.5). It forwards Sema set-up at once and records every other callback. At the end of the unit it runs the analysis and `CheckEmitter`, then replays the callbacks in order. Without deferral, CodeGen emits external functions before the analysis runs. It overrides every `ASTConsumer` and `SemaConsumer` virtual of LLVM 23, a list on the LLVM-upgrade checklist. |
-| `CheckEmitter` | Applies the `CheckPlan` through Sema (§10.6): `BuildCallExpr` to the helper, `ImpCastExprToType` back to the operand's type so a dereference stays an lvalue, `BuildBinOp` with a comma for a check before a call. User expressions are never evaluated twice. A rewrite Sema rejects leaves the subtree unchanged and fails the compile with an internal error. It also applies the zero-initialisation lowering, gives the guards of a function their range cache (`planCache`, `declareCaches`; see *The runtime*), and registers the unit's stack and global objects (`registerObjects`). |
+| `CheckEmitter` | Applies the `CheckPlan` through Sema (§10.6): `BuildCallExpr` to the helper, `ImpCastExprToType` back to the operand's type so a dereference stays an lvalue, `BuildBinOp` with a comma for a check before a call. User expressions are never evaluated twice. A rewrite Sema rejects leaves the subtree unchanged and fails the compile with an internal error. It also applies the zero-initialisation lowering and registers the unit's stack and global objects (`registerObjects`: a registered local is declared `aligned(16)` and entered inline by `__weavec_stack_enter`). |
 | `ObjectRegistration` | `planObjects` (RFC 0032 §4, §5): which locals and parameters of each emitted function escape and are entered into the runtime's stack list, which calls return twice and are wrapped, and which globals the unit defines and describes. The plan is pure; `CheckEmitter::registerObjects` applies it. |
-| `Prelude` | The helpers the rewrites call, injected into the predefines buffer (§10.2): `static`, `always_inline`, `nodebug` functions for the six templates and their forms, term helpers that saturate toward failure, and the allocation wrappers. With the runtime it also declares the runtime's entry points and the arena descriptor, and defines the guard helpers (`object`, `object_c`, `object_n`, `object_s`, `object_l`, `live`, `live_c`, `release`) and the stack-object helpers. Trap mode calls `__builtin_verbose_trap("weavec", <template>)`, report mode `__weavec_rt_report`, and verify mode adds `__weavec_prv_*` with the category `weavec.proven`. PCH and module builds declare the helpers `extern` instead (§10.9). Each check and guard helper also has a copy that is not inlined, `<helper>_ool`, which a function with more than 4,096 plan entries calls ([RFC 0033](rfcs/0033-drop-in-by-default.md) amendment 12). |
+| `Prelude` | The helpers the rewrites call, injected into the predefines buffer (§10.2): `static`, `always_inline`, `nodebug` functions for the six templates and their forms, term helpers that saturate toward failure, and the allocation wrappers. With the runtime it also declares the runtime's entry points, the arena descriptor and the guards `object` and `live` (without a body: the guard passes lower their calls, and the runtime defines them as a fallback), and defines the call guards (`object_n`, `object_s`, `object_l`, `release`), the checked wrappers and the stack-object helpers. Trap mode calls `__builtin_verbose_trap("weavec", <template>)`, report mode `__weavec_rt_report`, and verify mode adds `__weavec_prv_*` with the category `weavec.proven`. PCH and module builds declare the helpers `extern` instead (§10.9). Each check helper and call guard also has a copy that is not inlined, `<helper>_ool`, which a function with more than 4,096 plan entries calls ([RFC 0033](rfcs/0033-drop-in-by-default.md) amendment 12). |
 | `ZeroInit` | Plans the zero-initialisation of the allocation family (§11): calls to `LibrarySpec` entries with the `zero-init` flag become wrappers that zero the usable region, and `alloca` gets a `memset`. The plan is pure, so the ledger's A5 counts precede any rewrite. A unit that defines an allocator lowers nothing. |
 | `LedgerWriter` | JSON (`weavec-ledger`, version 2: `LedgerSchemaVersion`) and SARIF 2.1.0 renderings of a ledger (§12, RFC 0032 §10), the `weavec-fp/1` fingerprints (a truncated SHA-256 of key, root-relative path, function, normalised message and ordinal), the fingerprint root and atomic writes. |
 | `LedgerOutput` | Completes a unit or program ledger with the producer, root, configuration and the unit's source, object and target; applies the `-W` flags so the ledger counts what was reported; writes it where `-fweavec-ledger` says (a file, or a directory receiving one ledger per unit and per link) through a temporary file renamed into place; and prints the summary line under `-fweavec-summary`, whenever a ledger is written, and always in `weavec`. |
@@ -553,7 +569,7 @@ with the states never allocated, live, free and dead; free lists and the
 quarantine queues live in the metadata, never in freed memory. The object a
 pointer points into, its requested size and whether it is live therefore
 follow from the pointer by arithmetic and one load. Every block is
-zero-filled. A released slot is *dead* and waits in a quarantine (64 MiB by
+zero-filled. A released slot is *dead* and waits in a quarantine (16 MiB by
 default, `WEAVEC_RT_QUARANTINE=<bytes>` in the environment) before it is
 recycled; a reallocation that leaves its size class releases the old block
 the same way. A request no class can hold is mapped on its own as a *huge
@@ -585,13 +601,20 @@ otherwise the pointer is *untracked*, and every guard passes on it
 (assumption A6 of RFC 0032). A pointer into the arena that points to no
 live block is into a dead object.
 
-- **Stack objects** are kept per thread, ordered by frame. An entry is
-  trusted only while its frame can still be live: entering, leaving,
-  rewinding and looking up drop the entries of deeper frames, which is how
-  a `longjmp` that skipped the cleanups is absorbed.
+- **Stack objects** that start on a granule (every registered local, and
+  a parameter passed in registers) are written into the shadow by the
+  prelude's inline `__weavec_stack_enter` and cleared by its cleanup;
+  only those that do not (a parameter passed in memory) are kept in the
+  runtime's per-thread list, ordered by frame. An entry is trusted only
+  while its frame can still be live: entering, leaving, rewinding and
+  looking up drop the entries of deeper frames, and a `setjmp` that
+  returns clears the shadow of the frames below it, which is how a
+  `longjmp` that skipped the cleanups is absorbed.
 - **Global objects** come from descriptors `{address, size}` that each unit
   emits into one section (`__DATA,__weavec_glob` on Mach-O,
-  `weavec_globals` on ELF). A constructor in each image hands its section
+  `weavec_globals` on ELF). The `GlobalPadding` pass pads each registered
+  global to whole granules (one more when it fills its last), so no other
+  data shares its last granule or starts at its one-past address. A constructor in each image hands its section
   to `__weavec_rt_globals_add`; the table is sorted before the next lookup.
 
 ### Guards
@@ -609,33 +632,58 @@ templates exist:
 | `live` | `__weavec_chk_live(p)` | `p` does not point into a dead tracked object |
 | `release` | `__weavec_chk_release(p)` | `p` is null, the start of a live heap object, or untracked |
 
-A guard reaches the runtime in three steps:
-
-1. **Inline arena lookup.** The prelude declares the arena's descriptor
-   (`__weavec_rt_heap`: base, size, metadata base, region shift, class
-   table). For a pointer inside the arena, `object` and `live` compute the
-   region and slot and load the slot word in the helper itself, with no
-   call.
-2. **Range caches** (RFC 0032 *Implementation amendments*, 2). A function
-   that guards a pointer inside a loop gets a local array
-   `__weavec_ranges` of four words per entry, `{lo, len, state, expect}`,
-   cleared on entry, with at most 64 entries. An entry belongs to the local
-   variable the guards read their pointer from, or to one site. The cached
-   helpers `object_c` and `live_c` pass without a lookup when the access
-   lies in `[lo, lo + len)` and the 32-bit word at `state` still reads
-   `expect`: for an arena block `state` is the block's own slot word, for
-   anything else the runtime's epoch `__weavec_rt_epoch`, which changes
-   when a huge block is mapped or unmapped or a table of globals is added.
-   A loop that calls nothing (`isQuietLoop`) checks the state of its
-   entries once on the way in (`__weavec_range_check`), and its guards do
-   not read it. A unit whose helpers are external has no range cache.
-3. **Out-of-line entry points.** Any other pointer, and a cache miss
-   outside the arena, call the runtime: `__weavec_rt_object`,
-   `__weavec_rt_string`, `__weavec_rt_live`, `__weavec_rt_release_ok`, and
-   for a cached guard `__weavec_rt_object_range` and
-   `__weavec_rt_live_range`, which answer the range to remember by value.
-   `__weavec_rt_strlen` reads a string's length inside its own object, for
-   a need that is a string's length.
+A guard reaches the runtime in three steps (RFC 0034 §1–§3):
+
+1. **Declared guards.** The prelude declares `object`, `live` and their
+   report-mode forms (`__weavec_chk_*`, `__weavec_prv_*` where the facet
+   is proven, for `--checks verify`) without a body; the runtime defines
+   them as an out-of-line fallback. `GuardCanonicalize`
+   (`lib/Frontend/GuardPasses.cpp`, at the pipeline's start) rewrites each
+   call into the address arithmetic of its access and a call of
+   `__weavec_rt_guard(from, at, width, kind, site)` that is `nounwind` and
+   reads only inaccessible memory, so the optimizer removes, merges and
+   hoists guards as it does loads. A call argument's guard of a constant
+   need (`object_n`, `object_l`: `memcpy(&v, p, 4)`) becomes the same
+   access guard. `GuardMerge` and `GuardExpand` run last: guards of one
+   base whose bytes overlap become one, and each remaining guard of at
+   most 16 bytes is expanded inline.
+2. **Shadow memory.** One byte per 16-byte granule of the whole address
+   space (`__weavec_rt_heap.shadow`, indexed by `(a >> 4) & mask`;
+   `mask` is 0 until it is reserved). 0 is no live tracked object, 1–16 a
+   live heap granule's bytes, `0xFE` a heap slot after its object, and a
+   registered stack or global object that starts on a granule is encoded
+   exactly: its last granule `0x40 + k`, each earlier one a run byte saying
+   how many granules at least follow it (`0x80 + r` up to 48, then
+   `0x80 + 48 + c` for at least 2^(c + 4)), so two granules are of one
+   object when their distance is at most the earlier one's run, and an
+   object's end or start is a logarithmic number of jumps away. `0xFB`
+   marks the untracked granule one past such an object (not in a frame
+   with an `alloca` or a compound literal), `0xFC` an object
+   that does not start on a granule (the runtime looks it up), `0xFD` a
+   released huge block. The inline check passes a live heap object's
+   bytes (an access crossing into the next granule reads it too),
+   untracked bytes outside the arena reached from untracked memory, and a
+   registered object's bytes reached from inside it; anything else calls
+   `__weavec_rt_guard`. A function with more than 1,024 guards gets a
+   compact form that loads the descriptor at each guard.
+3. **The slow path.** `__weavec_rt_guard` decides any address: the shadow
+   first, then the arena's slot word (constant time), the huge blocks,
+   the stack list (objects off a granule only) and the table of globals.
+   `__weavec_rt_object`, `__weavec_rt_string`, `__weavec_rt_live` and
+   `__weavec_rt_release_ok` serve the call guards and releases;
+   `__weavec_rt_strlen` reads a string's length inside its own object.
+4. **Checked wrappers** (RFC 0034 §5.2). A call of a library row with a
+   `wrapper(…)` clause (`strcpy`, `stpcpy`, `strcat`, `sprintf`,
+   `vsprintf`, `memcpy`, `memmove`) whose destination's or source's need,
+   or overlap, no term can state, or whose guard would check only a format's least output, calls
+   the prelude's `__weavec_chk_<name>` instead (`CheckPlanner::planGuards`
+   plans `Form::Wrapper`, `CheckEmitter` replaces the callee). The wrapper
+   computes the need at run time, checks it against the object
+   (`__weavec_rt_object`) or the operands' overlap, and makes the call;
+   `sprintf` writes through `vsnprintf` bounded by `__weavec_rt_room`, the
+   bytes left in the object its destination points into, and fails when
+   the output did not fit. A fortified call's object size is passed on and
+   checked too.
 
 `__weavec_rt_object` looks up the accessed address, not `p` (RFC 0033 §4).
 In a live heap object the access passes wherever `p` points, so a base
@@ -809,8 +857,9 @@ analysing no unit again; `analyze` adds step 4; `none` runs nothing.
 1. **Collect inputs.** `collectLinkInputs` resolves objects, archives,
    shared libraries and `-l` arguments as the linker does. One
    `unanalyzed-input` warning per link names every non-system input without
-   a valid record. Calls into functions no record defines are then
-   `trusted(external-unit)`.
+   a valid record, except those whose objects name a `__weavec_` symbol
+   (built by `weavec-cc`: an archive), which one note names instead. Calls
+   into functions no record defines are then `trusted(external-unit)`.
 2. **Solve slots** over all records.
 3. **Verify declarations** against the defining units' summaries and kinds.
    A contradiction is an `annotation-mismatch` error.
@@ -1060,8 +1109,9 @@ temporal finding on a facet the build guards is not reported unless
 enforces nothing, reports it. `-Werror`
 in project flags does not promote WeaveC warnings; `-Werror=weavec[-<id>]`
 does. An error can be lowered with `-Wno-error=weavec-<id>` but not
-disabled; a lowered violation is guarded where the runtime can check it,
-and otherwise checked or trapped unconditionally. RFC 0030 removed
+disabled; a lowered violation gets the check or guard its facet would
+have as a possible finding, or none (`unresolved(lowered)`); nothing traps
+unconditionally (RFC 0034 §6.4). RFC 0030 removed
 `analysis-incomplete` (now unresolved rows, with reasons such as
 `unanalysed` and `budget`), `annotation-required` (now
 `unresolved(unknown-callee)` rows with fix-its), `checking-incomplete` and
@@ -1086,8 +1136,9 @@ and otherwise checked or trapped unconditionally. RFC 0030 removed
 - **Lit tests** (`test/Analysis`, `test/Annotations`, `test/Driver`,
   `test/WholeProgram`, `test/Prelude`, `test/Emission`) pin exact messages
   and driver behaviour; `test/Emission` holds the rewrite-oracle pairs,
-  those of the guards, the range cache and the object registrations among
-  them (`runtime-oracle-*.c`), and `test/Driver/runtime-*.c` pins the
+  those of the guards and the object registrations among them
+  (`runtime-oracle-*.c`; the oracle compares IR without the LLVM passes),
+  `guard-passes-*.c` pin the guard passes' lowering, and `test/Driver/runtime-*.c` pins the
   runtime's flags, link line and fallbacks.
 - **`test/cases`** is one tree of executable C cases by feature, with
   expectations as line-comment markers (`BUG`, `TRAP`, `GUARDED`,
diff --git a/docs/pages/guides/adoption.md b/docs/pages/guides/adoption.md
index ef5ec300..a7763419 100644
--- a/docs/pages/guides/adoption.md
+++ b/docs/pages/guides/adoption.md
@@ -18,7 +18,7 @@ See [build integration](/guides/build-integration/) for CMake, Make and compiler
 
 ## 2. Fix the errors, then read the warnings
 
-Errors are definite: the bug happens on every execution that reaches the line. Follow the reported allocation, alias, release or escape and fix the code. Warnings with "may" wording are temporal bugs on some paths only. `weavec` prints all of them. A `weavec-cc` build with the runtime prints only those it cannot guard, such as a finding at a call boundary; the others trap at run time if they happen, and `-Wweavec-possible` prints them at compile time as well. A `weavec-cc` build prints no `leak` warnings unless `-Wweavec-leak` (or `-Wweavec`) asks for them; `weavec` prints them. Read the ones you see: a guard catches a use of a freed block only while the block is in the quarantine. Check inferred behavior with `--dump-analysis` when a helper's effect is surprising.
+Errors are definite: the bug happens on every execution that reaches the line, and the analysis has found a feasible path that reaches it. Follow the reported allocation, alias, release or escape and fix the code. A finding the analysis could not confirm on a feasible path is a warning with the same id and the note `not confirmed on a feasible path`; its site is checked or guarded like any possible finding. Warnings with "may" wording are temporal bugs on some paths only. `weavec` prints all of them. A `weavec-cc` build with the runtime prints only those it cannot guard, such as a finding at a call boundary; the others trap at run time if they happen, and `-Wweavec-possible` prints them at compile time as well. A `weavec-cc` build prints no `leak` warnings unless `-Wweavec-leak` (or `-Wweavec`) asks for them; `weavec` prints them. Read the ones you see: a guard catches a use of a freed block only while the block is in the quarantine. Check inferred behavior with `--dump-analysis` when a helper's effect is surprising.
 
 During migration, you can lower a particular error to a warning:
 
@@ -26,7 +26,7 @@ During migration, you can lower a particular error to a warning:
 weavec-cc -Wno-error=weavec-use-after-free -c src/buffer.c
 ```
 
-This changes only the reporting, and the ledger keeps the site as a violation. A lowered temporal violation, or a lowered violation of a callee's or library function's requirement, is guarded against the runtime: it traps only if the bug happens, so a false error lowered this way does not stop a correct program. A spatial or null violation decided from an exact extent keeps its check, or traps unconditionally, and so does every lowered violation in a build without the runtime. Remove temporary overrides as the component improves.
+This changes only the reporting, and the ledger keeps the site as a violation. A lowered temporal violation, or a lowered violation of a callee's or library function's requirement, is guarded against the runtime: it traps only if the bug happens, so a false error lowered this way does not stop a correct program. A spatial or null violation decided from an exact extent keeps its check. Nothing traps unconditionally: a lowered violation the build can neither check nor guard (a temporal one without the runtime) is left `unresolved(lowered)` in the ledger. Remove temporary overrides as the component improves.
 
 ## 3. Read the ledger
 
@@ -53,7 +53,7 @@ Build and run your test suite with `weavec-cc`. Unproven null and bounds obligat
 
 A check or guard that fails is either a real bug or code that relies on undefined behavior that happens to work: reading one element past an array, reading a word at a time past the end of a string's allocation, or using the slack the system allocator leaves after a block (`malloc_usable_size` now returns the requested size). Fix the code; if it is intentional, isolate it in a small `WEAVEC_UNSAFE` region, where spatial and null facets are trusted and get neither checks nor guards. Locals and standard allocations are zero-initialised in the checking modes, so code that read uninitialised memory now reads zeros.
 
-The program now runs on WeaveC's allocator, which holds freed blocks in a quarantine (64 MiB by default; `WEAVEC_RT_QUARANTINE=<bytes>` in the environment changes it) so that a stale pointer finds a dead block. Measure the cost on your own workload before you ship the default mode. On the project's benchmarks it is 1.66 times the CPU time of a plain Clang build for cJSON, 1.85 for zlib and 5.94 for the Lua interpreter; interpreters and tight loops over pointers pay the most. `WEAVEC_RT_STATS=1` in the environment prints the runtime's counters when the program exits. A component that cannot pay builds with `-fno-weavec-runtime` (1.15, 1.00 and 1.09 times on the same benchmarks): its checks stay, its guardable facets are `unresolved` again, and its uses of freed objects are not caught at run time. Units built with and without the runtime link together.
+The program now runs on WeaveC's allocator, which holds freed blocks in a quarantine (16 MiB by default; `WEAVEC_RT_QUARANTINE=<bytes>` in the environment changes it) so that a stale pointer finds a dead block. Measure the cost on your own workload before you ship the default mode. On the project's benchmarks it is 1.66 times the CPU time of a plain Clang build for cJSON, 1.85 for zlib and 5.94 for the Lua interpreter; interpreters and tight loops over pointers pay the most. `WEAVEC_RT_STATS=1` in the environment prints the runtime's counters when the program exits. A component that cannot pay builds with `-fno-weavec-runtime` (1.15, 1.00 and 1.09 times on the same benchmarks): its checks stay, its guardable facets are `unresolved` again, and its uses of freed objects are not caught at run time. Units built with and without the runtime link together.
 
 ## 5. Tighten a component
 
diff --git a/docs/pages/guides/build-integration.md b/docs/pages/guides/build-integration.md
index 99a873c1..84acacf2 100644
--- a/docs/pages/guides/build-integration.md
+++ b/docs/pages/guides/build-integration.md
@@ -81,7 +81,7 @@ Units compiled with and without the runtime can be linked together; the program
 
 Compiling `buffer.c` produces both `buffer.o` and `buffer.o.weavec`, the unit's WeaveC record. Keep the record beside its object. At link time, WeaveC reads the records, checks each unit's declarations and requirements against the other units and composes the program ledger from their rows, without parsing or analysing any unit again; `-fweavec-link=analyze` also refines the temporal outcomes with the whole program in view (see [whole-program analysis](/guides/whole-program/#analyze-during-linking)). A record says whether its unit was compiled with the runtime.
 
-A link input without a valid record is named in one `unanalyzed-input` warning per link: objects from another compiler, static archives, shared libraries outside the platform's own, and objects whose record is stale (an incompatible record format, or an object that changed after its record was written). Calls into those inputs are trusted, and the ledger lists them. Rebuild objects whose record is stale. Static archives and shared libraries do not carry records yet.
+A link input without a valid record is named in one `unanalyzed-input` warning per link: objects from another compiler, static archives, shared libraries outside the platform's own, and objects whose record is stale (an incompatible record format, or an object that changed after its record was written). Calls into those inputs are trusted, and the ledger lists them. Rebuild objects whose record is stale. Static archives and shared libraries do not carry records yet; an archive whose objects `weavec-cc` built is named in a note rather than the warning, since its code carries its own checks and guards.
 
 ## Add checks to CI
 
diff --git a/docs/pages/reference/cli.md b/docs/pages/reference/cli.md
index b3b38f5e..7d876e81 100644
--- a/docs/pages/reference/cli.md
+++ b/docs/pages/reference/cli.md
@@ -18,24 +18,24 @@ weavec --whole-program [options] -p build
 
 ## weavec-cc
 
-| Flag                                                       | Default                          | Meaning                                                                                                                                                                                                                |
-| ---------------------------------------------------------- | -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `-fweavec` / `-fno-weavec`                                 | on                               | Analyse, check and zero-initialise. Off compiles as plain Clang.                                                                                                                                                       |
-| `-fweavec-checks=trap\|report\|verify\|none`               | `trap`                           | What unproven obligations become; see [modes](#check-modes).                                                                                                                                                           |
-| `-fweavec-zero-init` / `-fno-weavec-zero-init`             | on unless checks are `none`      | Zero-initialise locals (`-ftrivial-auto-var-init=zero`) and the standard allocation calls.                                                                                                                             |
-| `-fweavec-runtime` / `-fno-weavec-runtime`                 | on                               | Guard unresolved facets against the runtime's object table, register stack and global objects, and link the runtime's allocator. Nothing is emitted or linked when checks are `none`; see [the runtime](#the-runtime). |
-| `-fweavec-stack-objects` / `-fno-weavec-stack-objects`     | on                               | Register this unit's locals whose address escapes with the runtime.                                                                                                                                                    |
-| `-fweavec-global-objects` / `-fno-weavec-global-objects`   | on                               | Register this unit's globals with the runtime.                                                                                                                                                                         |
-| `-fweavec-require=none\|guarded\|checked\|proven`          | `none`                           | Make unresolved facets (`guarded`), guarded facets too (`checked`), and checked facets too (`proven`), errors; see [require levels](#require-levels).                                                                  |
-| `-fweavec-ledger=<path>`                                   | unset                            | Write the unit ledger when compiling and the program ledger when linking. A value ending in `/` or naming a directory writes one file per unit and per link.                                                           |
-| `-fweavec-ledger-format=json\|sarif`                       | `json`                           | The ledger's format.                                                                                                                                                                                                   |
-| `-fweavec-summary` / `-fno-weavec-summary`                 | off, on when a ledger is written | Print the one-line summary on stderr.                                                                                                                                                                                  |
-| `-fweavec-budget=<n>`                                      | 50,000 (see [budgets](#budgets)) | Per-function limit on analysed CFG block transfers; `0` means unlimited.                                                                                                                                               |
-| `-fweavec-unit-budget=<n>`                                 | 6 per site, at least 200,000     | Per-unit limit on block transfers over every analysis run of the unit; functions analysed after it is spent take the over-budget defaults. `0` means unlimited; see [budgets](#budgets).                               |
-| `-fweavec-link=records\|analyze\|none`                     | `records`                        | What the link step does before linking; see [the link step](#the-link-step).                                                                                                                                           |
-| `-fweavec-link-budget=<seconds>`                           | 120                              | Wall-clock budget of `-fweavec-link=analyze`; `0` means none.                                                                                                                                                          |
-| `-fweavec-print-prelude`                                   | off                              | Print the check helpers for the current `-fweavec-checks` mode and exit.                                                                                                                                               |
-| `-fweavec-dump-analysis`, `-fweavec-analysis-stats=<path>` | off                              | Debugging output: the inferred facts (unstable format), and work statistics as JSON.                                                                                                                                   |
+| Flag                                                       | Default                              | Meaning                                                                                                                                                                                                                |
+| ---------------------------------------------------------- | ------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `-fweavec` / `-fno-weavec`                                 | on                                   | Analyse, check and zero-initialise. Off compiles as plain Clang.                                                                                                                                                       |
+| `-fweavec-checks=trap\|report\|verify\|none`               | `trap`                               | What unproven obligations become; see [modes](#check-modes).                                                                                                                                                           |
+| `-fweavec-zero-init` / `-fno-weavec-zero-init`             | on unless checks are `none`          | Zero-initialise locals (`-ftrivial-auto-var-init=zero`) and the standard allocation calls.                                                                                                                             |
+| `-fweavec-runtime` / `-fno-weavec-runtime`                 | on                                   | Guard unresolved facets against the runtime's object table, register stack and global objects, and link the runtime's allocator. Nothing is emitted or linked when checks are `none`; see [the runtime](#the-runtime). |
+| `-fweavec-stack-objects` / `-fno-weavec-stack-objects`     | on                                   | Register this unit's locals whose address escapes with the runtime.                                                                                                                                                    |
+| `-fweavec-global-objects` / `-fno-weavec-global-objects`   | on                                   | Register this unit's globals with the runtime.                                                                                                                                                                         |
+| `-fweavec-require=none\|guarded\|checked\|proven`          | `none`                               | Make unresolved facets (`guarded`), guarded facets too (`checked`), and checked facets too (`proven`), errors; see [require levels](#require-levels).                                                                  |
+| `-fweavec-ledger=<path>`                                   | unset                                | Write the unit ledger when compiling and the program ledger when linking. A value ending in `/` or naming a directory writes one file per unit and per link.                                                           |
+| `-fweavec-ledger-format=json\|sarif`                       | `json`                               | The ledger's format.                                                                                                                                                                                                   |
+| `-fweavec-summary` / `-fno-weavec-summary`                 | off, on when a ledger is written     | Print the one-line summary on stderr.                                                                                                                                                                                  |
+| `-fweavec-budget=<n>`                                      | 20,000,000 (see [budgets](#budgets)) | Per-run limit on the analysis's work (the sizes of the states it transfers and joins); `0` means unlimited.                                                                                                            |
+| `-fweavec-unit-budget=<n>`                                 | 400 per site, at least 20,000,000    | Per-unit limit on work over every analysis run of the unit; functions analysed after it is spent take the over-budget defaults. `0` means unlimited; see [budgets](#budgets).                                          |
+| `-fweavec-link=records\|analyze\|none`                     | `records`                            | What the link step does before linking; see [the link step](#the-link-step).                                                                                                                                           |
+| `-fweavec-link-budget=<seconds>`                           | 120                                  | Wall-clock budget of `-fweavec-link=analyze`; `0` means none.                                                                                                                                                          |
+| `-fweavec-print-prelude`                                   | off                                  | Print the check helpers for the current `-fweavec-checks` mode and exit.                                                                                                                                               |
+| `-fweavec-dump-analysis`, `-fweavec-analysis-stats=<path>` | off                                  | Debugging output: the inferred facts (unstable format), and work statistics as JSON.                                                                                                                                   |
 
 An unknown `-fweavec-*` flag is an error. `weavec-cc --version` prints Clang's version block first, then `weavec-cc version <version> (<revision>)`, so a configure script that reads the first line sees Clang. On macOS a link with `-flto` uses the libLTO of the LLVM that WeaveC was built with.
 
@@ -43,11 +43,11 @@ An unknown `-fweavec-*` flag is an error. `weavec-cc --version` prints Clang's v
 
 When `weavec-cc` links, it reads the WeaveC record (`<object>.weavec`) of each input before the link proper. `-fweavec-link=` selects what it does with them ([RFC 0033](/rfcs/0033-drop-in-by-default/) §7):
 
-| Value               | What runs                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `records` (default) | The records alone; no unit is parsed or analysed again. Names the inputs without a record (`unanalyzed-input`), solves the program's function-pointer slots, checks declarations against definitions (`annotation-mismatch`), checks the requirements of exported functions at the calls other units make, and, with `-fweavec-ledger` or `-fweavec-summary`, composes the program ledger from the rows the records carry. |
-| `analyze`           | `records`, then the units analysed again with the whole program in view, so that bugs that span units (a use after free whose `free` is in another unit) are reported, within `-fweavec-link-budget=<seconds>` of wall-clock time (default 120).                                                                                                                                                                           |
-| `none`              | Nothing: the link proceeds as Clang's.                                                                                                                                                                                                                                                                                                                                                                                     |
+| Value               | What runs                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `records` (default) | The records alone; no unit is parsed or analysed again. Names the inputs without a record (`unanalyzed-input`; an archive whose objects `weavec-cc` built is named in a note instead), solves the program's function-pointer slots, checks declarations against definitions (`annotation-mismatch`), checks the requirements of exported functions at the calls other units make, and, with `-fweavec-ledger` or `-fweavec-summary`, composes the program ledger from the rows the records carry. |
+| `analyze`           | `records`, then the units analysed again with the whole program in view, so that bugs that span units (a use after free whose `free` is in another unit) are reported, within `-fweavec-link-budget=<seconds>` of wall-clock time (default 120).                                                                                                                                                                                                                                                  |
+| `none`              | Nothing: the link proceeds as Clang's.                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
 
 Under `analyze`, a unit the budget cut, a unit that cannot be analysed again and a group of units that does not converge keep their compile-time results, and the link prints a note instead of failing:
 
@@ -103,7 +103,7 @@ Every link in the `trap`, `report` and `verify` modes adds `libweavec_rt.a` and
 
 A guard looks up the address it accesses (`p + i * step + offset` for a subscript), not the pointer it starts from, so a base formed outside a buffer and indexed back into it passes. Otherwise a guard passes on memory the runtime does not track.
 
-Fortified calls (`__builtin___memcpy_chk` and the like, which `_FORTIFY_SOURCE` produces) are guarded as their plain forms are. A length the guard cannot repeat at the call, such as `memcpy(d, s, strlen(s))`, is checked where the call evaluates it. Each `%s` argument of a `printf`-family call with a literal format gets an `object` guard for its string, which also covers its liveness; a `%.Ns` argument reads at most N bytes and needs no terminator.
+Fortified calls (`__builtin___memcpy_chk` and the like, which `_FORTIFY_SOURCE` produces) are guarded as their plain forms are. A length the guard cannot repeat at the call, such as `memcpy(d, s, strlen(s))`, is checked where the call evaluates it. Each `%s` argument of a `printf`-family call with a literal format gets an `object` guard for its string, which also covers its liveness; a `%.Ns` argument reads at most N bytes and needs no terminator, so it gets the call's `live` guard only. A call to `strcpy`, `stpcpy`, `strcat`, `sprintf`, `vsprintf`, `memcpy` or `memmove` whose need no term at the call can state goes through a checked wrapper, which computes the need at run time and checks the destination (and a copy's source) against its object before making the call.
 
 | Flag or variable                             | Meaning                                                                                                                                                                                               |
 | -------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -111,12 +111,12 @@ Fortified calls (`__builtin___memcpy_chk` and the like, which `_FORTIFY_SOURCE`
 | `-fno-weavec-stack-objects`                  | Do not register this unit's escaping locals. Guards pass on pointers into them.                                                                                                                       |
 | `-fno-weavec-global-objects`                 | Do not register this unit's globals. Guards pass on pointers into them.                                                                                                                               |
 | `-Wweavec-possible`, `-Wno-weavec-possible`  | Print possible temporal findings even where the facet is guarded. Off by default in enforcing builds with the runtime; otherwise they are always printed.                                             |
-| `WEAVEC_RT_QUARANTINE=<bytes>` (environment) | The quarantine's budget: how many bytes of freed heap blocks are held before the oldest are reused. Default 64 MiB (67108864); `0` reuses blocks at once.                                             |
+| `WEAVEC_RT_QUARANTINE=<bytes>` (environment) | The quarantine's budget: how many bytes of freed heap blocks are held before the oldest are reused. Default 16 MiB (16777216); `0` reuses blocks at once.                                             |
 | `WEAVEC_RT_STATS=1` (environment)            | At exit, print the runtime's counters on stderr, one line each, as `weavec: runtime: <n> <what>`. On Darwin only the runtime that owns the process prints, and its counters count every image's work. |
 | `WEAVEC_RT_ABORT=1` (environment)            | In report mode, abort at the first failed check or guard.                                                                                                                                             |
 | `WEAVEC_RT_REPORT_LOG=<path>` (environment)  | In report mode, append every report line to this file instead of printing it on stderr, so a test that captures stderr sees only the program's own output.                                            |
 
-The counters of `WEAVEC_RT_STATS=1` are allocations, releases, recycled slots, huge blocks, lookups (and of those heap, stack, global and untracked), range requests, ranges kept and stack objects entered. They are not synchronised between threads.
+The counters of `WEAVEC_RT_STATS=1` are allocations, releases, recycled slots, huge blocks, lookups (and of those heap, stack, global and untracked), slow guards (the guards the inline check sent to the runtime) and stack objects entered through the runtime (those not on a 16-byte boundary). They are not synchronised between threads.
 
 `weavec-cc` builds without the runtime, as `-fno-weavec-runtime` does, when neither `-fweavec-runtime` nor `-fno-weavec-runtime` was given and the command line has `-ffreestanding`, `-nostdlib`, `-nodefaultlibs` or `-nolibc`, a sanitizer that replaces the allocator (`-fsanitize=address`, `hwaddress`, `memory`, `thread`, `leak` or `kernel-address`), or a target other than 64-bit Darwin or Linux. The link prints one of:
 
@@ -192,22 +192,22 @@ Every ledger is written to a temporary file and renamed into place. Naming one f
 
 ## Budgets
 
-Each function's analysis counts the CFG blocks it transfers. A function over the budget stops early: its null facets, and spatial facets whose exact extent needs no flow facts, fall back to runtime checks; its other facets are `unresolved(budget)`; callers apply the unknown-callee effects to its arguments; and the summary line and ledger name it. The count is deterministic and independent of timing.
+Each analysis run counts its _work_: over its block transfers and joins, the size of each state it transfers or joins (its symbols and objects), so a run over large states costs what it costs ([RFC 0034](/rfcs/0034-fast-enforcement/) §7). A function over the budget stops early: its null facets, and spatial facets whose exact extent needs no flow facts, fall back to runtime checks; its other facets are guarded or `unresolved(budget)`; callers apply the unknown-callee effects to its arguments; and the summary line and ledger name it. The count is deterministic and independent of timing.
 
-The default is 50,000 block transfers, calibrated by the rule of RFC 0030 §5.5: the smallest multiple of 50,000 that is at least four times the 99.9th percentile of the per-function counts over the corpus (7,208 over 2,874 functions; the largest, Lua's `luaV_execute`, is 25,518), so no corpus function exceeds it.
+The default is 20,000,000 per run (Lua's `luaV_execute` takes about 10,000,000). A run is also over budget when the states it keeps at its blocks' entries hold more than 1,000,000 symbols and objects together, or when its function's graph has more than 100,000 blocks, which bounds the analysis's memory.
 
-A second budget bounds a whole unit, which runs its functions many times (summary rounds, alias contexts, the final run): `-fweavec-unit-budget=<n>` block transfers over every run, by default 6 per site of the unit and at least 200,000 ([RFC 0033](/rfcs/0033-drop-in-by-default/) §9). Each run may take at most eight times its fair share of what is left, and at least 500 transfers, so a few large functions cannot spend what the others need. A function cut short this way is over budget like any other. `0` means unlimited. `weavec` uses the default unit budget.
+A second budget bounds a whole unit, which runs its functions many times (summary rounds, alias contexts, the final run): `-fweavec-unit-budget=<n>` work over every run, by default 400 per site of the unit and at least 20,000,000. Each run may take at most eight times its fair share of what is left, and at least 100,000, so a few large functions cannot spend what the others need. A function cut short this way is over budget like any other. An alias-context run, which only adds diagnostics, is not made for a callee whose own run took more than 200,000. `0` means unlimited. `weavec` uses the default unit budget.
 
 ## Diagnostic controls
 
-| Flag                                        | Behavior                                                                                                                                                                                                                                                                                                  |
-| ------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `-Wno-weavec-<id>`                          | Disable the warnings of `<id>`: always-warning ids and the possible (warning) findings of temporal ids.                                                                                                                                                                                                   |
-| `-Wweavec-<id>`                             | Enable the warnings of `<id>`. `allocation-failure` is off by default, and so is `leak` in `weavec-cc` (not in `weavec`); `-Wweavec-<id>`, `-Werror=weavec-<id>` or `-Wweavec` enables them.                                                                                                              |
-| `-Werror=weavec[-<id>]`                     | Promote WeaveC warnings, or those of one id, to errors.                                                                                                                                                                                                                                                   |
-| `-Wno-error=weavec-<id>`                    | Lower the errors of `<id>` to warnings. A lowered temporal violation, or a violation of a callee's or library function's requirement, is guarded and traps only if it happens; a spatial or null violation keeps its check or an unconditional trap, as does every lowered violation without the runtime. |
-| `-Wweavec`, `-Wno-weavec`                   | Enable or disable every WeaveC warning.                                                                                                                                                                                                                                                                   |
-| `-Wweavec-possible`, `-Wno-weavec-possible` | Not an id but a switch: print, or do not print, possible temporal findings on facets the build guards; see [the runtime](#the-runtime).                                                                                                                                                                   |
+| Flag                                        | Behavior                                                                                                                                                                                                                                                                                                            |
+| ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `-Wno-weavec-<id>`                          | Disable the warnings of `<id>`: always-warning ids and the possible (warning) findings of temporal ids.                                                                                                                                                                                                             |
+| `-Wweavec-<id>`                             | Enable the warnings of `<id>`. `allocation-failure` is off by default, and so is `leak` in `weavec-cc` (not in `weavec`); `-Wweavec-<id>`, `-Werror=weavec-<id>` or `-Wweavec` enables them.                                                                                                                        |
+| `-Werror=weavec[-<id>]`                     | Promote WeaveC warnings, or those of one id, to errors.                                                                                                                                                                                                                                                             |
+| `-Wno-error=weavec-<id>`                    | Lower the errors of `<id>` to warnings. A lowered temporal violation, or a violation of a callee's or library function's requirement, is guarded and traps only if it happens; a spatial or null violation keeps its check; one with neither check nor guard is `unresolved(lowered)`, never an unconditional trap. |
+| `-Wweavec`, `-Wno-weavec`                   | Enable or disable every WeaveC warning.                                                                                                                                                                                                                                                                             |
+| `-Wweavec-possible`, `-Wno-weavec-possible` | Not an id but a switch: print, or do not print, possible temporal findings on facets the build guards; see [the runtime](#the-runtime).                                                                                                                                                                             |
 
 Errors cannot be disabled, only lowered. A flag naming a removed identifier is an error. See the [diagnostic reference](/reference/diagnostics/) for the identifiers and [diagnostic controls](/reference/diagnostic-controls/) for details.
 
diff --git a/docs/pages/reference/compatibility.md b/docs/pages/reference/compatibility.md
index 2f41b6ca..b76c095a 100644
--- a/docs/pages/reference/compatibility.md
+++ b/docs/pages/reference/compatibility.md
@@ -24,7 +24,7 @@ With the default `-fweavec-checks=trap`, `weavec-cc` inserts plain C checks and
 With the runtime, the image's `malloc`, `calloc`, `realloc`, `free`, `reallocarray`, `aligned_alloc`, `posix_memalign`, `valloc`, `free_sized`, `free_aligned_sized` and the platform's `memalign`, `pvalloc`, `malloc_usable_size`, `malloc_size`, `malloc_good_size` and `reallocf` are WeaveC's. What a program can observe:
 
 - Every block is zero-filled, and its usable size is its requested size: `malloc_usable_size` and `malloc_size` return what was asked for, not a rounded-up size.
-- A freed block is not reused until it leaves the quarantine (64 MiB by default; `WEAVEC_RT_QUARANTINE=<bytes>`), so a program that frees and allocates heavily can hold more memory than the same program on the system allocator.
+- A freed block is not reused until it leaves the quarantine (16 MiB by default; `WEAVEC_RT_QUARANTINE=<bytes>`), so a program that frees and allocates heavily can hold more memory than the same program on the system allocator.
 - An invalid `free` or `realloc` (a double free, an interior, stack or global pointer) stops the program, in whichever object of the image it happens.
 - On ELF targets the executable's allocator serves every shared library in the process, the C library included. On Darwin one runtime serves the process (the copy the dynamic loader finds first; the others forward to it), and its malloc zone becomes the default zone, so the system libraries' own allocations (`strdup`, `getline`, `asprintf`) come from it too. Blocks the system allocated before that are handed back to the zone that owns them.
 - Speed, fragmentation and address layout are those of WeaveC's allocator, not the system's. Programs that depend on the system allocator's identity (a `malloc_zone_t` of their own, allocator introspection, `mallopt`) see WeaveC's allocator.
diff --git a/docs/pages/reference/guarantees.md b/docs/pages/reference/guarantees.md
index d6f521b1..57b7705c 100644
--- a/docs/pages/reference/guarantees.md
+++ b/docs/pages/reference/guarantees.md
@@ -30,7 +30,7 @@ Let _U_ be a translation unit compiled by `weavec-cc` in an **enforcing mode**:
 - **(N) Null.** If the null facet of _s_ is proven or checked, _s_ does not dereference a null pointer. For a checked facet, the program instead traps first.
 - **(T) Temporal.** If the temporal facet of _s_ is proven, the object _s_ accesses has not been released and its lifetime has not ended. For a release, the object is released at most once and is the start of a live allocation of the releasing family.
 - **(G) Guards.** For a unit compiled with the runtime (the default). If the spatial facet of _s_ is guarded and the bytes _s_ accesses start inside a tracked object _O_, then _O_ is live and the bytes lie inside _O_, or the program traps at _s_ before the access; if they start inside no tracked object but end inside one, or start in a dead tracked object, the program traps at _s_. The address looked up is the address of the access (`p + i * step + offset` for a subscript), not the pointer it starts from. If the temporal facet of _s_ is guarded and the pointer operand points into a dead tracked object, the program traps at _s_ before the access. A guarded release is of null, of the start of a live heap object (which the release makes dead), or of a pointer to no tracked object; otherwise the program traps.
-- **(V) Violations.** No violation reaches emitted code unguarded. A violation fails the compile; if its error is lowered to a warning with `-Wno-error=weavec-<id>`, the site is checked or guarded, and when the build can do neither, it traps unconditionally. A lowered temporal violation, or a violation of a callee's summary or a library row's requirement, is guarded, so it traps when the violation happens and a false one runs as the program would; a spatial or null violation decided at the access from an exact extent keeps its check, or the unconditional trap. Without the runtime every lowered violation without a check traps unconditionally.
+- **(V) Violations.** A definite finding is an error only once the analysis has confirmed it on a feasible path (it replays the function along single paths, [RFC 0034](/rfcs/0034-fast-enforcement/) §6); an unconfirmed one is a warning with the note `not confirmed on a feasible path`, and its site is planned as a possible finding of its facet. A confirmed violation fails the compile; if its error is lowered to a warning with `-Wno-error=weavec-<id>`, the site gets the check or guard its facet would have as a possible finding, so it traps when the violation happens and a false one runs as the program would. Nothing traps unconditionally: a lowered violation the build can neither check nor guard (without the runtime, a temporal one) is `unresolved(lowered)` in the ledger.
 
 `-fweavec-checks=report` without `WEAVEC_RT_ABORT=1` is a rollout aid, not an enforcing mode: a failed check or guard is reported and the access proceeds, so (S), (N) and (G) do not hold for its checked and guarded facets. Its ledger is the same as in trap mode, because the ledger always describes the enforcing build.
 
@@ -45,26 +45,26 @@ Let _U_ be a translation unit compiled by `weavec-cc` in an **enforcing mode**:
 Every enforcing link carries the runtime: `libweavec_rt.a`, the object table, and `libweavec_alloc.a`, which defines `malloc`, `calloc`, `realloc`, `free` and the other standard allocation functions for the image. Pointer representation and the ABI do not change. A _tracked object_ is one of:
 
 - a **heap object**: a block the image's allocator returned and has not recycled, from its start to its requested size. It is _live_ from its allocation to its release, and _dead_ from its release until the quarantine gives its storage to a new object;
-- a **stack object**: a local variable or a parameter of a function compiled with the runtime whose address is taken or which decays to a pointer, from its declaration to the end of its scope. After its scope ends it is untracked, never dead: the compile-time `lifetime-too-short` rules cover the stack's temporal bugs;
-- a **global object**: a variable of static storage duration defined in a unit compiled with the runtime, other than a thread-local, a string literal or an object with a flexible array member.
+- a **stack object**: a local variable or a parameter of a function compiled with the runtime whose address a guard can reach (it is stored, returned, or passed to a function outside the library table, or to a library call that takes a callback or whose argument is guarded), from its declaration to the end of its scope. After its scope ends it is untracked, never dead: the compile-time `lifetime-too-short` rules cover the stack's temporal bugs;
+- a **global object**: a variable of static storage duration defined in a unit compiled with the runtime, other than a thread-local, a string literal or an object with a flexible array member. It is aligned to 16 bytes and padded, so no other data shares its last 16 bytes or starts one past its end.
 
 Everything else is untracked, and a guard passes on it: string literals, `alloca` blocks, memory from another allocator or another image's allocator, memory created by code built without the runtime, and stack objects in functions that call `setjmp`, in coroutines, on alternate signal stacks and in functions compiled from a precompiled header.
 
-The allocator serves each block from a size class strictly larger than the request, so its extent is exact and one past its end is still inside its slot. It zero-fills every block. Released blocks wait in a first-in, first-out quarantine with a byte budget (64 MiB by default, `WEAVEC_RT_QUARANTINE=<bytes>` in the environment); `malloc_usable_size` and `malloc_size` return the requested size. The allocator itself validates every release in the image, in whichever object the `free` is: a double free, a free of an interior, stack or global pointer, and a `realloc` of a dead block stop the program.
+The allocator serves each block from a size class strictly larger than the request, so its extent is exact and one past its end is still inside its slot. It zero-fills every block. Released blocks wait in a quarantine with a byte budget (16 MiB by default; past it, the oldest released slot of the class being released is reused first, `WEAVEC_RT_QUARANTINE=<bytes>` in the environment); `malloc_usable_size` and `malloc_size` return the requested size. The allocator itself validates every release in the image, in whichever object the `free` is: a double free, a free of an interior, stack or global pointer, and a `realloc` of a dead block stop the program.
 
 On ELF targets the executable's allocator serves every shared library in the process. On Darwin one runtime serves the process: the copy the dynamic loader finds first owns the object table, and the runtimes of the other images built by `weavec-cc` forward to it and share its arena. Its malloc zone is promoted to the process's default zone, so the C library's own allocations (`strdup`, `getline`, `asprintf`, `realpath`) are tracked heap objects too; blocks the system allocated before the promotion are handed back to the zone that owns them.
 
 ### What it costs
 
-Guards run each time the operation they cover runs, and each escaping local is registered and removed on each activation of its function. Measured on the project's benchmarks, as user CPU time and peak memory relative to the same program built by the reference Clang ([RFC 0032](/rfcs/0032-runtime-enforcement/#implementation-amendments), amendment 3):
+Guards run each time the operation they cover runs, and each local a guard can reach is registered and removed on each activation of its function. Measured on the project's benchmarks, as user CPU time and peak memory relative to the same program built by the reference Clang ([RFC 0034](/rfcs/0034-fast-enforcement/#implementation-amendments), amendment 16):
 
 | Benchmark         | Default (runtime) | `-fno-weavec-runtime` | Peak memory (default) |
 | ----------------- | ----------------- | --------------------- | --------------------- |
-| cJSON parse/print | 1.66×             | 1.14×                 | 0.59×                 |
-| zlib minigzip     | 1.85×             | 1.00×                 | 1.09×                 |
-| Lua bench         | 5.94×             | 1.11×                 | 1.61×                 |
+| cJSON parse/print | 1.59×             | 1.15×                 | 0.37×                 |
+| zlib minigzip     | 1.62×             | 1.00×                 | 1.26×                 |
+| Lua bench         | 2.43×             | 1.09×                 | 1.54×                 |
 
-The cost follows the number of guards executed, not the cost of one. Interpreters and tight loops over pointers pay the most: the Lua benchmark executes roughly one guard for every two instructions of the unguarded program. The RFC's own bounds for the default mode (1.5× for zlib, 2.0× for Lua) are not met and remain an open gate; closing it needs guards removed at compile time, which is future work.
+The cost follows the number of guards executed. A guard is an inline read of the runtime's shadow memory (one byte per 16 bytes of memory) that the compiler merges with its neighbours and hoists out of loops; only an address the shadow cannot decide calls the runtime. Interpreters and tight loops over pointers pay the most. RFC 0034's bounds of 1.5× for zlib and cJSON are not met yet and remain an open gate.
 
 For code that cannot pay, `-fno-weavec-runtime` is the way out. It can be applied per unit. In such a unit no guard is emitted and nothing is registered; the facets that would be guarded are `unresolved`; (G) does not apply, so no access of the unit is checked for a freed object at run time; and (S), (N), (T) and (V) hold as before. Releases are still validated as long as the link carries the runtime's allocator. When the link also has `-fno-weavec-runtime`, the system allocator is used and A5 again rests on its usable-size query. Each proof or check that replaces a guard (a declared extent, an ownership annotation, a linked definition) removes that guard's cost without giving anything up.
 
@@ -105,7 +105,7 @@ At compile time, as errors, when they hold on every path:
 - an access past an object of exact extent that is out of bounds for every value the facts allow, including library calls with a known required length, overlapping `memcpy`/`strcpy`-family copies, writes into string literals and format strings that read more arguments than are passed;
 - a contradicted `WEAVEC_ASSUME`, and a declaration whose annotation contradicts its definition, including across translation units at link.
 
-A violation is reported only when facts the program states establish it on every path: an operation whose meaning C defines, an unconditional callee effect, a library row's requirement, or a declared contract; never a default, such as the effect assumed for an unknown callee. A bug that needs two translation units, such as a use after free whose `free` is in another unit, is reported by `weavec --whole-program` and by a link with `-fweavec-link=analyze`; a default link does not analyse again, and the bug is caught by its guard at run time.
+A violation is reported only when facts the program states establish it on every path, and only as an error once the analysis has replayed the function and found a feasible path that reaches it: an operation whose meaning C defines, an unconditional callee effect, a library row's requirement, or a declared contract; never a default, such as the effect assumed for an unknown callee. A bug that needs two translation units, such as a use after free whose `free` is in another unit, is reported by `weavec --whole-program` and by a link with `-fweavec-link=analyze`; a default link does not analyse again, and the bug is caught by its guard at run time.
 
 At run time, by a check that traps at the offending access: every dereference whose null outcome is not proven, and every index, cursor dereference and library-call length whose extent is exact or declared and can be named at the site.
 
diff --git a/docs/pages/reference/troubleshooting.md b/docs/pages/reference/troubleshooting.md
index 3eb67784..9566f352 100644
--- a/docs/pages/reference/troubleshooting.md
+++ b/docs/pages/reference/troubleshooting.md
@@ -83,9 +83,9 @@ The link was given `-fno-weavec-runtime` (or something that implies it, such as
 
 ## The program is much slower or uses more memory
 
-The default mode links a runtime: every guarded operation looks its pointer up, and freed blocks are held in a 64 MiB quarantine before reuse. The measured cost on the project's benchmarks is 1.66 times the CPU time of a plain Clang build for cJSON, 1.85 for zlib and 5.94 for the Lua interpreter; code that spends its time in tight loops over pointers, as an interpreter does, is at the high end.
+The default mode links a runtime: every guarded operation reads the runtime's shadow memory (one byte per 16 bytes) inline and calls the runtime only when that byte does not decide it, and freed blocks are held in a 16 MiB quarantine before reuse. The measured cost on the project's benchmarks is 1.66 times the CPU time of a plain Clang build for cJSON, 1.85 for zlib and 5.94 for the Lua interpreter; code that spends its time in tight loops over pointers, as an interpreter does, is at the high end.
 
-- Run with `WEAVEC_RT_STATS=1` to see how many lookups the program makes.
+- Run with `WEAVEC_RT_STATS=1` to see how many guards reached the runtime (`slow guards`) and how many lookups the program makes.
 - Read `summary.guardedReasons` in the ledger. Each guarded facet that becomes proven or checked loses its guard: declare extents (`WEAVEC_COUNTED_BY`, `WEAVEC_ENDED_BY`, `WEAVEC_STRING`) for `unknown-extent`, and declare ownership for `unknown-callee`.
 - Set `WEAVEC_RT_QUARANTINE=<bytes>` to shrink the quarantine if memory is the problem. A smaller quarantine catches fewer uses of freed blocks; `0` reuses blocks at once.
 - Build the units that cannot pay with `-fno-weavec-runtime`. Their guardable facets become `unresolved` and are not enforced, and their cost returns to that of the checks alone (1.15, 1.00 and 1.09 times on the same benchmarks).
@@ -100,7 +100,7 @@ Read `summary.unresolvedReasons` in the ledger. In a default build a facet the a
 
 ## A compile or link is slow
 
-Each unit's analysis has a budget, `-fweavec-unit-budget=<n>` block transfers over all of its functions (by default 6 per site, at least 200,000); the functions analysed after it is spent get the over-budget defaults (`unresolved(budget)`, guarded where a guard applies). Lower it for faster builds of very large units, or set `0` for no limit. A default link analyses nothing; `-fweavec-link=analyze` does, within `-fweavec-link-budget=<seconds>` (default 120). When it runs out, or a group of units does not converge, the link goes on with a note and those units keep their compile-time results:
+Each unit's analysis has a budget, `-fweavec-unit-budget=<n>` of work over all of its functions (by default 400 per site, at least 20,000,000; see [budgets](/reference/cli/#budgets)); the functions analysed after it is spent get the over-budget defaults (`unresolved(budget)`, guarded where a guard applies). Lower it for faster builds of very large units, or set `0` for no limit. A default link analyses nothing; `-fweavec-link=analyze` does, within `-fweavec-link-budget=<seconds>` (default 120). When it runs out, or a group of units does not converge, the link goes on with a note and those units keep their compile-time results:
 
 ```text
 weavec-cc: note: the whole-program analysis of 'parser.c' stopped at its budget; their compile-time results stand
@@ -108,7 +108,7 @@ weavec-cc: note: the whole-program analysis of 'parser.c' stopped at its budget;
 
 ## The link warns about an unanalyzed input
 
-`unanalyzed-input` names the link inputs that have no valid WeaveC record: objects from another compiler, static archives, shared libraries, and objects whose record is stale. Calls into them are trusted. Rebuild the objects with `weavec-cc`; keep each `.o.weavec` record beside its object. Archives and shared libraries do not carry records yet.
+`unanalyzed-input` names the link inputs that have no valid WeaveC record: objects from another compiler, static archives, shared libraries, and objects whose record is stale. Calls into them are trusted. Rebuild the objects with `weavec-cc`; keep each `.o.weavec` record beside its object. Archives and shared libraries do not carry records yet: an archive whose objects `weavec-cc` built is named in a note instead (`'libfoo.a' was built by weavec-cc without records: checked and guarded, not analysed with the program`), since its code carries its checks and guards.
 
 ## A require level rejects the build
 
diff --git a/docs/rfcs/0034-fast-enforcement.md b/docs/rfcs/0034-fast-enforcement.md
new file mode 100644
index 00000000..e7da0c31
--- /dev/null
+++ b/docs/rfcs/0034-fast-enforcement.md
@@ -0,0 +1,1063 @@
+# RFC 0034: Fast enforcement, confirmed errors and a bounded analysis
+
+- **Status**: Implemented (gates F5 and F7, and F2's build time for opus,
+  not met and carried forward, *Implementation amendments* 16)
+- **Authors**: WeaveC authors
+- **Created**: 2026-10-04
+- **Tracking issue**: TBD
+- **Supersedes / superseded by**: Amends RFC 0032: how a guard is emitted
+  and executed (§3, §7, §13: guards become calls the backend lowers, the
+  object table gains shadow memory for the arena, range caches are
+  removed), when a stack object is registered (§4) and the quarantine's
+  default (§2.4). Amends RFC 0033: (V) and §1 (a definite finding fails
+  the build only once confirmed on a feasible path; a lowered or
+  unconfirmed finding never traps unconditionally), §5 (library calls
+  whose need no term can state are guarded through checked wrappers) and
+  §9 (the per-unit budget counts work, not transfers). Amends RFC 0030
+  §5.5 (budgets) and §10 (the prelude's guard helpers and the `violation`
+  helper).
+
+This RFC was drafted before implementation. On 2026-10-04 the project
+owner accepted the recommendation of the milestone analysis (make the
+default build cost less than AddressSanitizer at equal or better
+detection, make a definite error mean a confirmed one, and bound the
+analysis's cost; measure on projects nobody tuned against; delete what
+that makes obsolete) and authorized drafting this RFC and implementing it
+end to end in one large change, with breaking changes and no
+compatibility layers. Accepted status records that authorization. The
+status becomes Implemented only when every gate in *Acceptance gates*
+passes on the final tree, or an *Implementation amendment* records what
+was measured instead and carries the gate forward.
+
+## Summary
+
+After RFC 0033, WeaveC's run-time guards are correct on every project it
+has been tried on: no false trap in any test suite of ten projects it had
+never seen. Everything else about the default build falls short:
+
+- **It costs more than AddressSanitizer and catches about as much.** On a
+  blind set of 61 bug programs the default build stops 54 before the
+  faulty access and ASan 55. Lua runs at 6.0× the reference compiler's
+  time (ASan 2.4×), QuickJS at 18.5×, curl at 23×, libdeflate at 24.6×.
+- **Six of ten fresh projects do not build.** Each stops at a definite
+  error, five of them false and one true but in a configuration the project
+  documents as never run. Lowered with `-Wno-error`, four of them trap
+  unconditionally in correct programs.
+- **Building costs 2.6 to 21 times Clang's CPU time**, the slowest single
+  files 29 to 84 times its instructions, and one curl test file exhausts
+  9 GB of memory.
+
+This RFC keeps the model (prove, check, guard, record) and changes how
+each part is paid for:
+
+1. **A guard is a call the backend lowers.** The prelude declares the
+   guards instead of defining them; an LLVM pass makes each one a call
+   that LLVM's own redundancy elimination and loop-invariant code motion
+   can remove, merges the guards one access path makes, and expands what
+   is left into an inline check.
+2. **The arena gets shadow memory**, one byte per 16-byte granule, so the
+   inline check of a heap access is an arena range test, one load, a
+   compare and a branch, instead of 28 instructions and seven loads.
+   Everything else (huge blocks, stack and global objects, untracked
+   memory) goes to one out-of-line slow path that rejects untracked
+   memory in constant time. Range caches are deleted.
+3. **A local is registered only where a guard can look it up.**
+4. **Library calls are guarded through the shadow**, and calls whose
+   need no term can state (`strcpy(d, argv[i])`, `sprintf` into a buffer
+   of unknown extent) are guarded through checked wrappers.
+5. **A definite error must be confirmed.** Each candidate is replayed
+   along single paths with path conditions; it fails the build only if a
+   feasible path reaches the site and every feasible path that does has
+   the violation. Unconfirmed candidates are warnings, and their sites are
+   checked or guarded like any other. The engine also stops making the
+   five classes of false definite facts the fresh projects showed.
+6. **No unconditional trap remains.** A lowered or unconfirmed violation
+   gets the check or guard its facet would have had; the `violation`
+   helper is deleted.
+7. **The analysis has a work budget**, measured in the size of the states
+   it transfers and joins rather than in block visits, and a memory budget;
+   runs whose result is discarded are not made.
+
+The measure is the ten fresh projects of the milestone analysis, a sealed
+set of five more built once at the end, the 61-program detection set of
+the analysis, and a new blind detection set written at the end.
+
+## Motivation
+
+Measured on main at `e3fb58c` (RFC 0033), release build, darwin-arm64
+(Apple M3), each project's own build and test commands with
+`CC=weavec-cc`. CPU times were taken on a loaded machine; ratios of
+instruction counts, which do not depend on load, agree with them.
+
+| Project | Default build | Tests (errors lowered) | Build CPU vs Clang | Run time, default | `-fno-weavec-runtime` |
+| --- | --- | --- | --- | --- | --- |
+| QuickJS | fails: 22 `null-dereference` | pass | 15–21× | 18.5× | 1.07× |
+| LMDB | fails: `use-after-free` | pass; an API call traps | 14–21× | 3.5× | 1.01× |
+| Janet | fails: 8 `mismatched-release` | `suite-ev` traps | 9–15× | 3.3× | 1.05× |
+| brotli | builds | pass | 6.1× | 9.1× | 1.01× |
+| xz | builds | pass | 3.6× | 3.3× | 1.03× |
+| libdeflate | fails: `double-free` | `test_checksums` traps | 3.9× | 24.6× | 1.03× |
+| zlib-ng | builds | pass | 2.6× | 5.4× | 1.06× |
+| curl | fails: `double-free`; a test file runs out of memory | pass | 3.9× | 23× | 2.7× |
+| cmark | builds | pass | 3.2× | 5.7× | 1.29× |
+| libgit2 | fails: `double-free`, `use-of-uninitialized` | pass | 5.2× | 11× | 1.11× |
+
+On RFC 0032's benchmarks, against AddressSanitizer (`-O2
+-fsanitize=address`):
+
+| | Lua | zlib minigzip | cJSON |
+| --- | --- | --- | --- |
+| WeaveC default | 5.97× | 1.83× | 1.94× |
+| `-fno-weavec-runtime` | 1.13× | 1.00× | 1.10× |
+| ASan | 2.43× | 1.40× | 2.83× |
+
+### Where the run time goes
+
+Measured by counting every helper call in the emitted IR and by building
+cost-model variants (the same IR with the helpers swapped):
+
+- **The guard itself.** An uncached `object` guard is 31–36 instructions
+  with seven dependent loads (the descriptor, the class table, the slot
+  word); a cached one about 23 with nine (the cache's four words are
+  spilled to the frame). In Lua that is 28 instructions and 3.4 cycles per
+  guard, 4.49 billion guards per run. The same IR with each guard replaced
+  by a four-instruction shadow check runs Lua at 1.95–2.13×, zlib at
+  1.21–1.39×, cJSON at 1.49–1.70×.
+- **Redundancy matters less than cost.** 41% of Lua's dynamic guards are
+  dominated by a guard of the same pointer that covers them, and in zlib
+  57% are `live` guards of one loop-invariant state pointer. Removing
+  them alone takes Lua from 6.0× to 4.6×; with cheap guards they are worth
+  another 0.1–0.2×.
+- **Range caches do not pay.** The 64-entry cap leaves Lua's later opcode
+  handlers without one (1.74 billion uncached guards); caches held in
+  memory instead of registers measured slower than none.
+- **Untracked memory takes the slowest path.** 198 of libdeflate's 215
+  million lookups, and 370 of QuickJS's 481 million, are of memory the
+  runtime does not track (an `mmap`'d input, `alloca` frames): a full
+  lookup through the stack list and the global table, to pass.
+- **Stack registrations.** libdeflate registers 105 million stack objects
+  for 16 MB of input, curl 17 per byte transferred: every local whose
+  address is taken is entered and left with an out-of-line call, though
+  most are only handed to the C library.
+- **Library-call guards** take the out-of-line path every time (Lua's
+  `memcmp` in `internshrstr`: 0.26×), and every runtime entry first makes
+  a non-inlined call to ask whether to forward to another image.
+- **cJSON's allocator cost is the quarantine**: with
+  `WEAVEC_RT_QUARANTINE=0` the allocator alone matches the reference.
+
+### Where the build time goes
+
+- **Joins.** 50–70% of the analysis of the slow units is
+  `combineStates`, which rebuilds every symbol's record (928 bytes) and
+  every object's (680 bytes) at every merge, linearly in the state
+  (1.5–3 µs per symbol or cell).
+- **A few giant functions.** pcre2's `match` takes 97% of its unit's
+  analysis and publishes nothing: it reaches the 2,048-symbol limit after
+  45,600 transfers and peaks at 4.4 GB. Three functions take 88% of expat's
+  `xmlparse.c` for 26% of its proofs.
+- **Runs whose result is discarded**: 50–70% of the time on expat, pcre2,
+  libxml2 and sqlite goes to runs after a function's most expensive one
+  (a recursive component's authoritative pass repeating its last summary
+  round, alias-context runs, runs cut by their share of the unit budget
+  and run again).
+- **Code generation of the inlined helpers**: libxml2's `parser.c` takes
+  150 billion instructions with the helpers inlined and 39 billion with
+  them called out of line.
+
+### False definite errors
+
+Each reduced to a few lines; each builds clean and runs clean under
+`-fsanitize=address,undefined`, and each negative variant (the cause
+removed) builds with WeaveC:
+
+- **A path that cannot run** (QuickJS): `if (t == DIRECT) { assert(never);
+  b = cur->b; } else b = NULL; … if (t == DIRECT) return b->x;`. The zone
+  cannot hold `t != DIRECT`, so the second test's true edge is taken as
+  feasible with `b` null.
+- **Summary rows that disagree** (Janet): `get_ai` returns a `calloc`
+  block or a `getaddrinfo` list, and both rows of its summary are keyed on
+  the non-null outcome; the caller applies the first, so `freeaddrinfo`
+  of the result is a definite `mismatched-release`.
+- **Exclusive stores of one fresh object** (curl): `if (w) *a =
+  strdup(x); else *b = strdup(y);` stores the same fresh object through
+  both out-parameters under exclusive conditions; in the caller both
+  hold it, and releasing one makes freeing the other a definite double
+  free.
+- **A dangling value passed as a value** (LMDB): after `munmap(map)`, the
+  old address is an argument of a function that only passes it to `mmap`
+  as an address hint and compares it.
+- **`munmap` of part of a mapping** (libdeflate): the row releases the
+  whole object, so unmapping the guard page before a buffer and then the
+  one after it is a double free.
+- **`const` taken as deep** (libgit2): a callee given a `const struct *`
+  may write through a pointer stored in the struct; a local whose address
+  is stored there is not uninitialised after the call.
+
+And one true but vacuous error: QuickJS's `quickjs.check.o` is built with
+`CONFIG_CHECK_JSVALUE`, in which `JS_GetOpaque` always returns null; the
+project documents the configuration as compile-only.
+
+### Silent misses
+
+The blind detection set also found one false proof and two gaps:
+
+- **A release in a loop with an early exit is lost from the summary.**
+  `for (j = 0; j < p->n; j++) if (j == x) { free(p->kids[j]); return; }`
+  derives no release, so a caller's copy of `p->kids[0]` keeps a `proven`
+  temporal facet; `verify` mode traps where the default build reads freed
+  memory.
+- **A `sprintf` guard does not bound what is written**: with a heap
+  destination of unknown extent, `sprintf(d, "%s", long)` writes past it
+  and nothing traps until a later read.
+- **`strcpy(t, argv[i])`** is `unresolved(inexpressible)`: no term can
+  name `argv[i]`, so the call is neither checked nor guarded.
+
+## Soundness
+
+### The guarantee
+
+RFC 0030's guarantee, RFC 0032's (G) and RFC 0033's amendments of both
+stand, with these changes.
+
+**(G) is unchanged in what it decides.** A guard asks the same question
+of the same bytes (RFC 0033 §4 and its amendment 4); the shadow memory of
+§2 answers it for an arena address, the slow path for every other
+address, exactly as `__weavec_rt_object` answers it today. What changes
+is that a guard the backend removes is one whose bytes a guard that
+dominates it already checked with nothing in between that can release or
+register an object (§1.4). A guard is never moved to where its access
+would not happen.
+
+**Stack objects.** (G) covers a local only while it is registered. §4
+registers a local whenever a guard can reach it: its address is stored in
+memory, passed to a function that is not in the library table, returned,
+or may be the operand of a guarded site of its own function. A local
+that only the C library and proven or checked sites see is not
+registered; no guard looks it up, so (G) loses nothing.
+
+**(V), definite findings.** RFC 0033's (V) is replaced by: *a definite
+finding fails the build when it is confirmed (§6.1); lowered with
+`-Wno-error`, or unconfirmed, its site gets the check or guard its facet
+would have as a possible finding, and when it has none it is
+`unresolved(lowered)`.* No site traps unconditionally.
+
+**Library calls.** The wrappers of §5.2 guard what RFC 0033 left
+`unresolved(inexpressible)`: the destination of `strcpy`, `stpcpy` and
+`strcat` against the source's length, and of `sprintf` and `vsprintf`
+against the length written.
+
+No proven, checked or violation outcome becomes proven. Facets that the
+work budget (§7) cuts become the over-budget defaults (guarded,
+checked or unresolved), never proven.
+
+### Where this is more sound
+
+- `strcpy`, `stpcpy` and `strcat` into a destination of unknown extent
+  from a source no term can state, and `sprintf` and `vsprintf` into a
+  destination of unknown extent, are guarded.
+- A summary keeps a release made inside a loop that is left early.
+- `memcpy` and `strcpy` with arguments that overlap at run time are
+  checked by their wrappers when no term can state them (§5.2).
+
+### Where this is less sound
+
+- **Fewer compile-time errors.** A true definite finding that the replay
+  of §6.1 cannot confirm within its budget is a warning; its site is
+  guarded or checked, so a guarded use after free still traps when it
+  happens (if the runtime tracks the object), but the build no longer
+  stops. The 61-program detection set measures how many.
+- **Fewer proofs on the largest functions.** The work budget gives up
+  proofs to bound the build (gate F5 records how many); each becomes a
+  check or a guard.
+
+### Bugs caught
+
+Newly caught (each has a case):
+
+```c
+for (j = 0; j < p->n; j++) if (j == x) { free(p->kids[j]); return; }  // caller's copy: live
+sprintf(h->buf, "%s-%d", name, n);        // h->buf of unknown extent: room checked
+strcpy(t, argv[i]);                       // t of unknown extent: room checked
+memcpy(b + i, b + j, n);                  // run-time overlap: disjoint checked
+```
+
+### Bugs deliberately not caught
+
+Unchanged from RFC 0033.
+
+### Accepted false positives and false traps
+
+Unchanged from RFC 0033: none on correct code, measured by gates F1 and
+F2. A definite error that the replay confirms can still be false where
+the engine's abstraction is wrong on every feasible path it explored; F1
+allows none on the fresh projects.
+
+### Assumptions
+
+A1–A6 unchanged. A5 also covers the shadow memory: the program does not
+write the runtime's metadata (a write there is a memory-safety bug the
+guard on that write catches, unless the write is unguarded).
+
+## Detailed design
+
+### 1. Guards are calls the backend lowers
+
+#### 1.1 The prelude declares the guards
+
+The guard templates of RFC 0032 §7 (`object`, `live`, and the call forms
+`object_n`, `object_l`, `object_s`, `release`) are no longer defined in
+the prelude. It declares them, with the signatures they have today and a
+name per mode:
+
+```c
+extern void *__weavec_chk_object(const volatile void *p, long long i,
+    unsigned long long step, unsigned long long off, unsigned long long width);
+extern void *__weavec_chk_live(const volatile void *p);
+/* … and the report forms, `_report` with (file, line, column), and the
+   verify mode's `__weavec_prv_*` forms. */
+```
+
+The emitter, the planner and the plan format are unchanged: a guarded
+access still reads through the helper's result (`*__weavec_chk_object(p,
+i, 4, 0, 4)`), so the access cannot be evaluated before its guard. The
+runtime defines every declared guard (§2.5), so an object compiled without
+the backend pass (an `-O0` build without the pass, an LTO bitcode link of
+an older object) links and is checked, out of line.
+
+#### 1.2 Canonical form
+
+`GuardCanonicalize`, a function pass at `PipelineStartEP` (every
+optimisation level), rewrites each call of a declared guard:
+
+```llvm
+%r = call ptr @__weavec_chk_object(ptr %p, i64 %i, i64 %step, i64 %off, i64 %w)
+; becomes
+%q = getelementptr i8, ptr %p, i64 (%i * %step)     ; what the helper returned
+call void @__weavec.guard(ptr %p, ptr %q + %off, i64 %w, i32 kind, ptr loc)
+; and every use of %r uses %q
+```
+
+`@__weavec.guard` is declared `nounwind memory(inaccessiblemem: read)`
+and is not `willreturn` (it may trap): LLVM may remove a guard that a
+dominating identical guard makes redundant (EarlyCSE, GVN), may hoist it
+out of a loop it is guaranteed to execute in (LICM), and never moves it
+above a condition or a call, or an access above it. Every access now goes
+through a `getelementptr` of the original pointer, so alias analysis sees
+it as it would without WeaveC, which the helper's opaque result
+prevented. The multiplication's overflow, which the helper checked, is
+checked by the guard (`kind` carries a flag when `%i * %step` may
+overflow). `live` becomes the same call with width 0 and the `live`
+kind; `object_n`, `object_l` and `object_s` keep their own forms
+(`@__weavec.guard.n`, `@__weavec.guard.s`), with the same attributes.
+`release` stays a call of the runtime: it precedes a call of `free`
+anyway.
+
+Program stores do not clobber a guard (they do not write the runtime's
+memory, A5); a call of anything that may allocate, release, register or
+unregister an object does, which LLVM already assumes of every call that
+is not known not to touch inaccessible memory.
+
+#### 1.3 Merging
+
+`GuardMerge`, at `OptimizerLastEP`, takes what the optimiser left:
+
+- **Covered guards.** A guard whose pointer is a constant offset from a
+  guarded pointer, whose bytes lie inside bytes the dominating guard
+  checked, with no instruction between them that may write inaccessible
+  memory, is removed. (The standard passes remove only identical calls.)
+- **One block, one base.** Guards in one basic block of the same base
+  pointer at constant offsets, with nothing between them that may write
+  inaccessible memory or leave the block, are replaced by one guard of
+  their hull at the first, when the hull is at most 4,096 bytes. The bytes
+  between them are bytes of one C object when the program is correct
+  (the accesses are through one pointer to one object), so the hull adds
+  no trap to a correct program.
+- **`live` under `object`.** A `live` guard of a pointer whose bytes an
+  `object` guard dominating it checked is removed.
+
+#### 1.4 Expansion
+
+`GuardExpand`, at `OptimizerLastEP` after merging, replaces each
+remaining guard with the inline check of §2.3 and a cold call of the slow
+path (§3). It loads the arena descriptor once per function, in the entry
+block, with `!invariant.load`: a function that started before the arena
+existed sees an empty arena and sends every guard to the slow path, which
+is correct for every address. At `-O0` it runs too, so even an unoptimised
+build has the inline check.
+
+`SplitDispatchEdges` (RFC 0031 §9.2) runs after expansion.
+
+#### 1.5 Deletions
+
+The range caches (`object_c`, `live_c`, `__weavec_range_check`,
+`__weavec_rt_object_range`, `__weavec_rt_live_range`, `planCache`,
+`declareCaches`, `isQuietLoop`, the cache variables and their tests), the
+runtime's epoch, and the inline guard helpers' `_ool` copies are deleted.
+The check helpers (`nonnull`, `index`, `span`, `len`, `disjoint`,
+`assert`) stay inline C: they are a compare and a branch, and the
+optimiser folds them.
+
+### 2. Shadow memory for the arena
+
+#### 2.1 Encoding
+
+The arena reserves, next to its regions and slot words, one shadow byte
+for each 16-byte granule of its data. Slots are multiples of 16 bytes and
+start at multiples of 16, and an object of `n` bytes takes a slot of more
+than `n` bytes (RFC 0032 §2.1), so a granule belongs to one slot. A
+shadow byte holds:
+
+| Value | Meaning |
+| --- | --- |
+| `0` | Not part of a live object: never allocated, free, or in the quarantine. |
+| `1`–`16` | Part of a live object: its first `k` bytes are the object's. |
+| `0xFF` | Part of a live object's slot, after the object's last byte. |
+
+The shadow is mapped readable and writable without reserve, so pages no
+allocation touched read as zero: a pointer into a slot the arena never
+reached reads "not live", as its slot word does.
+
+#### 2.2 Maintenance
+
+The allocator writes the shadow of a slot when it hands it out (`16` for
+each whole granule of the object, `n mod 16` for a partial last one,
+`0xFF` for the rest of the slot), when it resizes a block in place, and
+when it retires a block to the quarantine (all `0`). A recycled slot is
+written when it is handed out again. A slot large enough to give its pages
+back (RFC 0032 §2.4) gives back its shadow's pages too. The slot words
+stay: they are what the slow path, `release` and the usable-size query
+read, and the shadow is derived from them under the class lock.
+
+#### 2.3 The inline check
+
+For bytes `[a, a + w)` with `1 <= w <= 16`, where `base`, `bytes` and
+`shadow` come from the descriptor:
+
+```c
+off = a - base;
+if (off < bytes) {                       /* in the arena */
+  e = (a & 15) + w;                      /* 1 .. 31 */
+  v = (signed char)shadow[off >> 4];
+  if (e <= 16 ? v < e : (v != 16 || (signed char)shadow[(off >> 4) + 1] < e - 16))
+    slow(...);                           /* fails; the slow path reports */
+} else
+  slow(...);                             /* not in the arena */
+```
+
+Every byte of a live object's slot after the object is `0xFF` or the tail
+of a partial granule, so two granules both reading `16` belong to one
+object, and checking the first and last granule of an access of at most
+16 bytes checks all of them. A `live` guard of pointer `a` checks
+`shadow[off >> 4] != 0`. A guard of more than 16 bytes, or of a width the
+compiler does not know, calls the runtime, which scans the shadow.
+
+#### 2.4 What does not change
+
+Huge blocks (requests no class holds) keep their table and are found by
+the slow path. The slot words, the quarantine, the free lists, the Darwin
+zone, and the one-runtime-per-process forwarding of RFC 0033 §6.2 stay;
+the descriptor a forwarding image copies gains the shadow's address.
+
+#### 2.5 The runtime's guard entry points
+
+The runtime defines every guard the prelude declares (§1.1), as the slow
+path does them; the backend's slow-path call is
+
+```c
+void __weavec_rt_guard(const void *from, const void *at, unsigned long long w,
+                       unsigned kind, const struct __weavec_rt_site *site);
+```
+
+which returns when the guard passes and otherwise fails as the mode says:
+it traps (calling `__weavec_rt_trapping` first, RFC 0033 §6.1), or, in
+report mode, prints `weavec: runtime check failed: <kind> at
+<file>:<line>:<column>` and returns. `site` is a constant the backend
+emits per report-mode guard, null otherwise.
+
+### 3. The slow path
+
+`__weavec_rt_guard` answers RFC 0033 §4's question for any address. For
+an address outside the arena it tests, in order, each with no lock and
+in constant time before any search:
+
+1. the huge blocks' address span (two loads) and then their table;
+2. the span of the registered globals (two loads) and then their table;
+3. the calling thread's live stack, from the caller's frame to the stack's
+   top (one thread-local read), and then the stack list;
+
+and an address in none of them is untracked and passes (RFC 0033's rule
+for untracked bytes reached from a tracked object stays). The epoch, which
+only range caches read, is deleted. `weavecRtForward` becomes an inline
+test of a global that the runtime sets once, at start-up, when it forwards.
+
+### 4. Stack objects
+
+A local is registered (RFC 0032 §4) only when a guard can look it up:
+
+- its address, or a pointer derived from it, may be stored in memory, be
+  returned, or be passed to a function that is not in the library table;
+- or the analysis guards a site of its own function whose operand may
+  point into it.
+
+A local whose address is only read through in its own function at sites
+that are proven or checked, or handed to library functions (whose rows
+the call's own checks and guards cover), is not registered. The decision
+uses the engine's points-to facts at the function's guarded sites
+(`ObjectPlan` gains them from the planned ledger), and the escape walk the
+registration plan already makes. A function's loose marker (RFC 0032
+§4.3) is registered only when some local of the function is.
+
+### 5. Library calls
+
+#### 5.1 Through the shadow
+
+The call guards `object_n`, `object_l` and `object_s` check an arena
+range by scanning its shadow (one byte per 16 bytes of the range) inline
+for ranges up to 64 bytes and in the runtime above; `object_s` finds the
+end of its object from the shadow and bounds its terminator search by it.
+
+#### 5.2 Checked wrappers
+
+When a library call's need is one no term can state (RFC 0030 §10.3: the
+argument is not a parameter, a local or a field of one), and the call is
+one of a fixed family, the emitter replaces its callee with a prelude
+wrapper that computes the need at run time and guards it:
+
+| Call | Wrapper's guard |
+| --- | --- |
+| `strcpy(d, s)`, `stpcpy(d, s)` | `strlen(s) + 1` bytes at `d`; `d` and `s` disjoint |
+| `strcat(d, s)` | `strlen(d) + strlen(s) + 1` bytes at `d` |
+| `sprintf(d, f, …)`, `vsprintf(d, f, ap)` | the call becomes `vsnprintf(d, room(d), f, ap)`; a result of `room(d)` or more fails |
+| `memcpy(d, s, n)` | `d` and `s` disjoint (the `disjoint` check, when its terms cannot be stated) |
+
+`room(d)` is the number of bytes from `d` to the end of the tracked
+object it points into, or the maximum when it points into none (the
+call then behaves as `sprintf`). A wrapper is used only for a facet that
+would otherwise be `unresolved(inexpressible)` or guarded on the wrong
+bytes; a call whose need is stated keeps its check.
+
+#### 5.3 The quarantine and zero-initialisation
+
+The quarantine's default budget becomes 16 MiB, held per class in
+proportion to the class's share of recent releases, and a class reuses its
+most recently released slot past the budget first, so a program that frees
+and allocates in a tight loop does not walk cold memory. With the runtime
+linked, zero-initialisation's usable-size query is `__weavec_rt_size`,
+not the C library's (Darwin's `malloc_size` asks every zone).
+
+### 6. Confirmed errors
+
+#### 6.1 Candidates and the replay
+
+What RFC 0030 §3 and RFC 0033 §1 call a definite finding is now a
+*candidate*. After a function's authoritative run, if it published any
+candidate, the engine replays the function in *witness mode*:
+
+- a depth-first search over its CFG from the entry, transferring one
+  state along one path with no joins, with the same transfer functions,
+  summaries and library rows as the authoritative run;
+- each loop is taken at most twice on a path, after which the path is
+  abandoned as inconclusive;
+- each branch edge refines the state as the authoritative run does, plus
+  the disequality facts of §6.2, and an edge the refinement empties ends
+  the path as infeasible;
+- at the site of a candidate, the replay decides the site as the
+  authoritative run would, on this path's state.
+
+A candidate is **confirmed** when at least one feasible path reaches its
+site, every feasible path that reaches it decides it the same definite
+way, and the search finished within its budget (256 paths and 20,000
+block transfers per function, both shared by its candidates). Otherwise it
+is **unconfirmed**: reported as a warning with the same id and the note
+`not confirmed on a feasible path`, and planned as a possible finding of
+the same facet (checked, guarded or unresolved).
+
+The replay runs only for functions with candidates, which are rare in
+code that builds; its cost is part of the work budget (§7).
+
+#### 6.2 Disequalities
+
+A symbol's record gains the small set (at most eight) of constants it is
+known not to equal. The false edge of `x == c` and the true edge of `x !=
+c` add `c`; an edge that requires `x == c` for an excluded `c` is
+infeasible; a join keeps the constants both sides exclude. This holds in
+every run, not only the replay, so the QuickJS path above is infeasible in
+the authoritative run too.
+
+#### 6.3 The engine's false definite facts
+
+Each class the fresh projects showed is fixed where the fact is made, with
+a case:
+
+- **Rows that disagree.** A summary's rows whose outcomes overlap are
+  applied together: a fact the rows give different values (a release
+  family, an extent, nullness) takes their join, and a family two rows
+  disagree on is unknown, which makes no `mismatched-release`.
+- **Exclusive stores of one fresh object.** A fresh object a summary
+  stores through two places under different conditions is instantiated in
+  the caller as a non-singular object unless the caller decides the
+  conditions; releasing a non-singular object makes the other places
+  that may hold it *possibly* released, never definitely.
+- **Values passed as values.** RFC 0033 amendment 1's value-only rule
+  covers a library function's parameter that its row gives no access
+  requirement and no effect (`mmap`'s address hint): passing a dangling
+  pointer there is no use.
+- **Partial unmapping.** `munmap`'s row releases its object only when the
+  unmapped range is the whole object; any other `munmap` of it is a
+  possible release, which makes no definite finding.
+- **Shallow `const`.** An unknown or external callee given a pointer to a
+  `const` object may still write through pointers stored in that object:
+  the objects they point to are havocked as for a non-`const` argument.
+- **A release in a loop left early.** The summary of a function that
+  releases an element inside a loop and then leaves the loop by `return`
+  or `break` records the release on the exits it reaches (the false
+  proof).
+
+#### 6.4 Lowered violations
+
+`-Wno-error=weavec-<id>` lowers a confirmed violation to a warning; its
+site gets the check or guard the facet would have as a possible finding,
+or none (`unresolved(lowered)`). The prelude's `violation` helper and the
+planner's `violationGuard` forms are deleted.
+
+### 7. A bounded analysis
+
+#### 7.1 Work
+
+A run's *work* is the sum, over its block transfers and joins, of the size
+of the state transferred or joined (symbols plus cells). It replaces the
+transfer count as the unit of every budget:
+
+- `-fweavec-budget=<n>`: work per run (default 2,000,000; 0 unlimited);
+- `-fweavec-unit-budget=<n>`: work per unit, shared by its runs as RFC
+  0033 amendment 8 shares transfers (default `max(20,000,000, 400 ×
+  sites)`);
+- a run whose retained entry states hold more than 1,000,000 symbols and
+  cells together, or a unit whose runs hold more than 1 GiB, stops as over
+  budget.
+
+The defaults are calibrated on the fresh and corpus units to keep every
+build within the bound of gate F5; the amendments record the calibration.
+
+#### 7.2 Runs that are not made
+
+- **A component's last round.** When a recursive component's summary
+  round changes no summary, the authoritative pass of each member reuses
+  that round's run if its inputs are the same, instead of running again
+  (each round runs publishing into a buffer that is kept only for the last
+  one).
+- **Alias-context runs** (RFC 0031 §6.6) are skipped for a function whose
+  authoritative run cost more than a tenth of the per-run budget; they
+  only add diagnostics.
+- **A run cut by its share** of the unit's budget is not run again in the
+  same unit pass; its sites take the over-budget defaults.
+- **The heap collection** runs at joins and exits only (RFC 0031 §4.6),
+  not at the end of every block.
+
+### 8. The driver
+
+- A Clang driver diagnostic that a `-Werror=` option promotes
+  (`-Werror=unused-command-line-argument`, which CMake's flag probes use) is
+  an error under `weavec-cc` as under `clang`.
+- A static archive whose members were built by `weavec-cc` (they carry the
+  global-descriptor section) is named in a note, not in the
+  `unanalyzed-input` warning: its records are not read, but its code is
+  checked and guarded.
+
+### 9. Tests and the corpus
+
+- **Fresh configs** (`set: fresh34` in the manifest): QuickJS, LMDB,
+  Janet, brotli, xz, libdeflate, zlib-ng, curl, cmark and libgit2, pinned
+  at the SHAs the milestone measured, each with its own build, its test
+  suite and a run-time workload (`bench`).
+- **Sealed configs** (`set: sealed34`): libjpeg-turbo, opus, flac, giflib
+  and wren, pinned now, built with the reference compiler now and with
+  WeaveC once, at the end.
+- **Detection sets.** The milestone's 61 bug programs and their fixes
+  become `test/cases/detection/` (each a bug and a twin; the runner checks
+  that the bug stops and the twin does not). A second blind set of at
+  least 40 programs is written at the end by someone who has not seen the
+  first, and measured once (gate F6).
+- Every false stop and every miss above is a case under
+  `test/cases/semantics/confirm/` or `test/cases/semantics/runtime/`.
+- The runtime test covers the shadow's encoding through allocation,
+  in-place resizing, release, recycling and decommitting.
+
+### 10. Deletions
+
+The range caches and the epoch (§1.5), the guard helpers' inline bodies
+and `_ool` copies, the `violation` helper and `violationGuard`, the
+transfer-count budgets, and the stack registrations of §4 that no guard
+can reach.
+
+## Annotation surface
+
+None changes.
+
+## Diagnostics
+
+No id is added or removed.
+
+- Every definite id: an unconfirmed candidate is a warning with the note
+  `not confirmed on a feasible path`.
+- `unresolved-operation` (under `-fweavec-require=guarded`): `lowered`
+  becomes a reason.
+- The ledger gains the reason `unconfirmed` for a facet whose candidate
+  was not confirmed, and `lowered` for a lowered violation with no check.
+
+## Implementation plan
+
+The work lands on `rfc0034-fast-enforcement` as stages, squashed into one
+change:
+
+- **S0 Tests first.** The fresh and sealed configs, the detection cases,
+  the confirm cases, and the starting tree measured.
+- **S1 Shadow memory** in the runtime (§2), with the runtime's guard entry
+  points and the slow path (§3); range caches and the epoch deleted.
+- **S2 The backend passes** (§1): declared guards, canonicalisation,
+  merging, expansion.
+- **S3 Stack objects and library calls** (§4, §5).
+- **S4 Confirmed errors** (§6).
+- **S5 The bounded analysis** (§7).
+- **S6 The driver** (§8).
+- **S7 Fresh-project iterations.**
+- **S8 Gates, the sealed run, the blind detection set, documentation.**
+
+## Acceptance gates
+
+Binaries are the `release` preset's on the final tree; the reference
+compiler is `$WEAVEC_LLVM_PREFIX/bin/clang`; darwin-arm64 unless named.
+Ratios are of user CPU time, or of instructions retired where the machine
+is loaded (the amendments say which).
+
+**Drop-in**
+
+- **F1. Fresh projects.** Every `fresh34` config builds with its own
+  build and `CC=weavec-cc` (default flags), and passes its own test suite
+  with no trap in trap mode and no failure in report mode. A build that
+  stops does so only at definite errors triaged true with source evidence
+  (QuickJS's `quickjs.check.o` is expected to be one), which the config
+  lowers.
+- **F2. Sealed projects.** Run once on the final tree and recorded as
+  measured. A sealed config that fails is reduced to cases and fixed, and
+  the amendment records that the set was no longer sealed for it.
+- **F3. No regression.** RFC 0033's D1 and D3 hold on the final tree (the
+  fresh and sealed sets of RFC 0033, the original and held-out configs,
+  the injections, every case in normal, `--asan` and `--checks verify`
+  runs), with the ratchet rewritten where §7 changes proven counts.
+
+**Detection**
+
+- **F4. Detection set.** Of the 61 programs of `test/cases/detection/`,
+  at least 54 stop at or before the faulty access (compile-time error or
+  run-time trap), no fixed twin stops, and no bug runs past a facet whose
+  outcome is `proven` (no `--checks verify` trap goes unnoticed in the
+  default mode).
+- **F6. Blind set.** On the blind set written at the end, the default
+  build stops at least as many bugs as ASan (`-O1 -fsanitize=address`)
+  less two, with no false stop on a twin and no false proof. Recorded as
+  measured.
+
+**Cost**
+
+- **F5. Build.** Each `fresh34` config's build within 5 times the
+  reference compiler's CPU time, and each original, held-out and RFC 0033
+  config within 5 times; `sqlite3.c` within 120 CPU seconds; no
+  compilation above 2 GiB peak memory. The ratchet records how many proofs
+  the budget gave up.
+- **F7. Run.** With the runtime: Lua at most 2.5×, zlib at most 1.5×,
+  cJSON at most 1.5× (RFC 0032's G14 benchmarks); every `fresh34`
+  workload at most 4× and their geometric mean at most 2.5×. Without the
+  runtime, RFC 0033's bounds.
+
+**Hygiene**
+
+- **H1.** `scripts/check-hygiene.py` passes with the line budget this RFC
+  records.
+- **H2.** `npm test && npm run build` in `docs/`; the README, the
+  guarantees and CLI references, `docs/architecture.md` and the roadmap
+  describe the change; this RFC is marked Implemented.
+
+## Implementation amendments
+
+The stages recorded the decisions below as they were implemented. Each
+amends the section it names; where the text above and an amendment
+disagree, the amendment holds.
+
+1. **The shadow covers the address space (§2.1, §2.3).** One shadow byte
+   per 16-byte granule of the whole address space, reserved at start-up
+   without backing (2^44 bytes on 64-bit targets) and indexed by
+   `(address >> 4) & mask`; the descriptor gains `mask`, which is 0 until
+   the reservation succeeds, so a guard before then reads the byte at the
+   shadow's base, 0, and asks the runtime. The encoding as built:
+
+   | Value | Meaning |
+   | --- | --- |
+   | `0` | No live tracked object: untracked memory outside the arena, or a dead, free, quarantined or never-allocated arena slot (`base` and `bytes` tell the two apart). |
+   | `1`–`16` | A live heap object's granule (arena slot or huge block): its first `k` bytes are the object's. |
+   | `0xFE` | A live heap object's slot after the object. |
+   | `0x41`–`0x50` | The last granule of a registered stack or global object that starts on a granule, with `k - 0x40` of its bytes there. |
+   | `0x81`–`0xBF` | An earlier granule of such an object, r granules before its last: `0x80 + r` for r up to 48, and `0x80 + 48 + c` (c from 1 to 15) for r at least 2^(c + 4). Two granules are of one object when their distance is at most the earlier one's least r; an object's end, and its start, are a logarithmic number of jumps away (a capped run made each lookup in http-parser's 80 KiB test buffer walk thousands of granules). |
+   | `0xFB` | The untracked granule after such an object that ends on a granule (for a global, its padding, amendment 2): an address one past it belongs to it. Not written in a frame with unnamed automatic storage (an `alloca`, a compound literal), which may start there; a local that a guard can reach is registered (amendment 3), so no other neighbour is reached through a guard. |
+   | `0xFC` | A granule of a registered object that does not start on a granule (a parameter passed in memory), or the granule after it; the runtime looks it up. It never overwrites an exactly encoded neighbour's bytes, and a granule an exact object shares with a live one stays `0xFC`. |
+   | `0xFD` | A released huge block. |
+
+   So a stack or global object's bytes are checked inline too: the inline
+   check passes heap bytes as §2.3 says, untracked bytes outside the arena
+   reached from untracked memory, and a registered object's bytes reached
+   from inside it (two or more granules after a granule hold a whole next
+   granule, so a crossing access of up to 16 bytes passes too).
+
+2. **Registered objects on granules (§4, RFC 0032 §4, §5).** A registered
+   local is declared `aligned(16)`, a parameter passed in registers too
+   (its spill slot), and is entered inline, exactly, by the prelude's
+   `__weavec_stack_enter`; the runtime's list holds only the objects that
+   do not start on a granule (parameters passed in memory). A registered
+   global is aligned to 16 and padded by the `GlobalPadding` pass to whole
+   granules, and by one more granule when it fills its last, so that
+   nothing the linker places after it (a string literal, an unregistered
+   global) shares its last granule or starts at its one-past address. The
+   loose marker of RFC 0032 §4.3 is deleted.
+
+3. **Which locals are registered (§4).** As built, the decision is the
+   registration walk's: a local whose address reaches anything but a
+   library function that takes no callback, whose returned pointer (which
+   may point into the argument: `strtok`) the program does not keep, and
+   whose call guards none of its arguments. A library call's argument positions the plan guards
+   count (`ObjectPlan` takes the plan); a callback argument is a function
+   name as passed (decayed), not as written. The engine's points-to facts
+   at guarded sites are not used.
+
+4. **Call-argument guards (§5.1).** A call argument's guard of a constant
+   need (`memcpy(&v, p, 4)`, an unaligned load) is canonicalised to the
+   access guard of that many bytes and expanded inline; one of a run-time
+   need calls `__weavec_rt_object`, which scans at most four granules and
+   looks a longer heap range up in its slot (constant time). `object_s` is
+   unchanged.
+
+5. **Compact guards (§1.4).** A function with more than 1,024 guards gets
+   a compact expansion, the arena's bounds loaded at each guard (the
+   shadow's base and mask once, at the entry): the whole-
+   granule test, then one block that passes untracked bytes, a registered
+   object's bytes and a crossing heap access; anything else calls the
+   runtime. Thousands of uses of hoisted descriptor values made the code
+   generator's common-subexpression pass quadratic.
+
+6. **The quarantine (§5.3).** 16 MiB by default (`WEAVEC_RT_QUARANTINE`
+   overrides), one budget for the process; past it, the class of the slot
+   being released recycles its oldest dead slot first.
+
+7. **The replay as built (§6.1).** Each block on a path is replayed with
+   the authoritative run's evidence for it (the facts its entry state had
+   at the fixpoint); a loop is left after two turns from its fixpoint
+   state rather than abandoned; a context finding (RFC 0031 §6.6) is
+   replayed in its context run. The budgets are as §6.1 says (256 paths,
+   20,000 transfers). A spatial or library violation publishes its witness,
+   so that a lowered or unconfirmed one keeps its precise check.
+
+8. **Budgets as calibrated (§7.1).** Work per run 20,000,000 (default:
+   Lua's `luaV_execute` takes about 10,000,000, and cut short it lost a
+   third of `lvm.c`'s proofs, which made Lua without the runtime 1.47 times
+   slower); per unit `max(20,000,000, 400 × sites)` as §7.1 says; a run is over budget when its
+   retained entry states exceed 1,000,000 symbols and objects, or its graph
+   100,000 blocks (curl's generated `lib1521` test has 577,057: the
+   pre-passes alone are quadratic in it); a run's share of the unit's work
+   is eight fair shares, at least 100,000 (at 20,000 a spent unit cut every
+   remaining function, 187 of sqlite3.c's; at 100,000, 84, and the unit
+   takes 63 CPU seconds; with no unit budget it takes 412). No unit-wide memory bound is
+   kept: the per-run bounds and the releases of amendment 10 hold memory
+   down. Of §7.2, only the skipped context runs (a callee whose own run
+   took more than 200,000 work) are implemented; the component round reuse
+   and the no-rerun of share-cut runs are not.
+
+9. **The driver (§8).** A link input without a record is named in a note
+   instead of the `unanalyzed-input` warning when one of its objects names
+   a `__weavec_` symbol (the runtime's, the helpers' or a global
+   descriptor's): the section is not what tells, an object with no global
+   has none.
+
+10. **Compile and link memory (§7.1, gate F5).** The engine keeps no
+    unit-wide parent map (`ASTContext::getParents` builds one for the whole
+    unit); carried-value liveness is sparse; kind inference drops each
+    definition's CFG once done with it; the record's payload is taken when
+    the analysis ends and the plan is released once the checks are
+    emitted, before the code generator runs; a unit record lists at most
+    eight distinct demoting stores per slot; and the link step drops each
+    record's JSON once read.
+
+11. **Unknown callees and escaped locals.** A local that a global reaches
+    escapes, and every escaped local is havocked at a call of unknown
+    code: the code may keep its address when a later call wipes the
+    global (libgit2's `test_online_clone`), which made a false definite
+    `use-of-uninitialized`.
+
+12. **A cursor's span (RFC 0030 §7.4).** A span check needs one object:
+    a pointer that may point into one of several objects of one size gets
+    no span witness (it was checked against the first object's span), and
+    its access is guarded.
+
+13. **Copies the wrapper checks (§5.2).** `memcpy` and `memmove` get a
+    wrapper whose `room` and `source` options check the bytes behind the
+    destination and behind the source when no term states the length
+    (`(*n - i) * sizeof *a`); the library table gains the `source` option.
+    The wrappers' `what` gains bit 4, the source. A wrapper is still used
+    only where the call would otherwise have no check or guard.
+
+14. **`%.Ns` arguments (RFC 0033 §5).** A `%.Ns` argument of a literal
+    format gets a requirement record that states no need (at most N bytes,
+    no terminator), so its spatial facet is unresolved rather than proven,
+    and the call's `live` guard covers it: a dangling one traps.
+
+15. **The rewind after `setjmp` (RFC 0032 §4.3).** A returns-twice call's
+    first return abandoned no frame, so only a second return (after a
+    `longjmp`) clears the shadow below its frame; a large range is cleared
+    by mapping the shadow's whole pages afresh. Janet calls `setjmp` for
+    every VM call, under GNU make's 64 MiB stack limit, and its event-loop
+    test timed out clearing 4 MiB of shadow each time.
+
+16. **Gates as measured (2026-10-05, darwin-arm64, the final tree).**
+    - **F1 met.** All ten `fresh34` configs build with `CC=weavec-cc` and
+      pass their own test suites in trap mode with no trap and in report
+      mode with no report; no definite error stops a build.
+    - **F2 met but for opus's build time, which is carried forward with
+      F5.** The first run of the `sealed34` set found a false trap in flac
+      and a test of opus past its time limit (amendment 18); after their
+      fixes, one run of all five: each builds with the default flags,
+      passes its tests in trap mode with no trap and in report mode with no
+      report, and has no definite error. Build CPU over the reference
+      compiler's: flac 2.79, wren 2.76, libjpeg-turbo 3.22, giflib 3.63,
+      opus 5.78 (4.42 in a run of opus and flac alone on the same tree),
+      most of it in two units (`pitch_analysis_core_FLP.c` 7.5 CPU seconds,
+      `celt_encoder.c` 5.6), the work budget's cost F5 records.
+    - **F3 met for detection and soundness, with the ratchet rewritten.**
+      Every case passes (725, in normal, `--asan` and `--checks verify`
+      runs); G9, G10, G11, G12, G15 (85 of 9,588 functions over budget,
+      0.89%), R4 and RFC 0033's D1 hold; the ratchet was rewritten from the
+      final run, where the work budget moves proofs both ways (sqlite3.c
+      gains, small units' counts shift). Two new warning sites in cJSON's
+      tests were triaged false (the class already triaged there).
+    - **F4 met.** 57 of the 61 programs of `test/cases/detection/` stop
+      (54 required), no fixed twin stops, and the four known misses are
+      marked in their cases.
+    - **F5 not met, carried forward.** Build CPU over the reference
+      compiler's: within 5 times for 34 of the 41 configs measured; over
+      it: pcre2 13.6, sqlite 9.7 (sqlite3.c alone 63 CPU seconds, under
+      120), mujs 7.5, lmdb 7.4, janet 6.0, quickjs 5.8, http-parser 5.6,
+      inih 5.5, expat 5.1. Every compile but curl's `libtests.c` (2,271 MiB
+      at its peak, the reference compiler 1,250 MiB) stays under 2 GiB. The
+      budgets of amendment 8 trade build time for proofs: at a tenth of the
+      unit budget the builds met the bound but 3.1% of the functions ran
+      over budget (G15) and Lua without the runtime ran 1.47 times slower.
+    - **F6 recorded.** On the 48 blind programs of `test/cases/detection-blind/`,
+      written after the first set by an author who had not seen it, the
+      default build stops 41 and ASan (`-O1`) 44, with no false stop on a
+      twin. WeaveC alone stops 2 (an intra-object overflow, a negative index
+      past ASan's red zone); ASan alone 5: three stack uses after return
+      (RFC 0032 leaves a dead frame's objects untracked; ASan sees them only
+      through inlining), a use after free through a borrowed reference at a
+      call boundary whose liveness is not guarded, and a never-set pointer
+      that zero-initialisation makes null (and free(NULL) harmless).
+    - **F7 not met, carried forward.** Run time over the reference
+      compiler's: quickjs 4.00, curl 3.51, brotli 3.27, libdeflate 3.16,
+      libgit2 2.84, cmark 2.69, zlib-ng 2.39, lmdb 1.77, janet 1.62, xz
+      1.54, geometric mean 2.55 (2.5); G14: Lua 2.43 (2.5, met), zlib 1.62
+      and cJSON 1.59 (1.5, not met); without the runtime 1.09, 1.00 and
+      1.15.
+    - **H1 met** with the budget of amendment 17; **H2** with this RFC
+      marked Implemented.
+
+17. **Line budget (gate H1).** The engine's limit is raised to 22,000 lines
+    and the library's to 72,000, for the guard passes, the replay, and the
+    work and memory budgets.
+
+18. **What the sealed run found (gate F2).** Two of the five `sealed34`
+    configs failed their first run, so the set was no longer sealed for
+    them; each was reduced to a case and fixed:
+    - **flac: a false trap from term arithmetic (RFC 0030 §10.2).** A term
+      clamped each signed leaf on its own, so `memset(p, 0, count + 8)`
+      with `count == -5` (FLAC__MD5Final's padding) needed the maximum and
+      trapped; as a have, `n + 5` with `n == -2` was 5. A term inside
+      arithmetic is now exact over `long long` and only its result is
+      clamped (a negative need is the maximum, a negative have 0); a need
+      saturates to `LLONG_MAX` and a have to `LLONG_MIN`, and both stay
+      there, so every direction still fails closed. Division is floor
+      division with the same saturation. Cases:
+      `semantics/runtime/term-signed-sum_{ok,bug}.c`.
+    - **opus: a test past its time limit from stack-object entry (§4).**
+      `test_opus_extensions` enters two 229 KiB arrays 100 million times;
+      the inline enter found each granule's run byte by a search, so a
+      million iterations took 82 seconds (the reference compiler 0.45).
+      The granules of one run byte are now written with one `memset`, and
+      a leave clears a run byte's least run at once (6.3 seconds; most of
+      what remains is the zero-initialisation of the arrays, RFC 0033).
+
+## Drawbacks
+
+- **A pass in the backend.** WeaveC's checks have been C that any Clang
+  compiles; guards now need WeaveC's LLVM pass to be cheap (without it
+  they are correct but out of line). The pass runs in `weavec-cc`, which
+  owns the pipeline; a bitcode link of an object built without it calls the
+  runtime.
+- **More memory for the arena.** The shadow is a sixteenth of the arena's
+  used bytes.
+- **Fewer compile-time errors**, by design (§6). The detection gates
+  measure what is lost; the guards still stop most of those bugs at run
+  time.
+- **Fewer proofs on giant functions**, by design (§7).
+
+## Alternatives
+
+- **Confirm candidates with Clang's static analyzer.** It is silent on
+  all six false errors above, but it also misses five of the seven true
+  compile-time errors of the detection set (it does not tie `strchr`'s
+  result to its argument's block, so `free(copy); use(eq + 1)` is not a
+  use after free to it). The replay confirms with WeaveC's own facts.
+- **Make every definite finding a warning.** Simpler, and no false stop
+  could come from the analysis; it gives up the errors that are true,
+  which the replay keeps.
+- **Whole-address-space shadow memory (ASan's layout)** with red zones
+  around stack and global objects. Faster for stack and global guards, but
+  it needs the frames and data sections laid out again, and stack and
+  global guards are under 1% of the executed guards measured.
+- **Hardware tagging (Arm MTE, Apple MIE).** Not available on the
+  reference machine (`hw.optional.arm.FEAT_MTE` is 0); future work.
+- **Keep the C helpers and only make them cheaper.** The cost model shows
+  most of the gain comes from the shadow alone, but the opaque helper
+  result keeps alias analysis blind, the redundant guards stay, and the
+  inlined bodies keep code generation slow.
+- **Joins that share structure** (persistent states with stable symbol
+  numbers) would cut the analysis's time without giving up proofs. It is
+  a redesign of the domain's symbol numbering (2,000–4,000 lines, high
+  risk) and is left to its own RFC; the work budget bounds the build now.
+
+## Prior art
+
+- **AddressSanitizer**: shadow memory with a partial-granule encoding,
+  instrumentation late in the pipeline, a quarantine.
+- **HWASan and Arm MTE**: tag checks of one load and compare.
+- **Clang's static analyzer** and **Infer's Pulse**: a finding is
+  reported only along a feasible path, and Pulse keeps *latent* issues
+  that need a precondition as warnings.
+- **SafeStack**: separating the locals whose address escapes from the
+  rest; §4 registers only those a guard can reach.
+- **Low-fat pointers** (Duck and Yap): object bounds from size-class
+  regions, which the arena already has.
+
+## Unresolved questions
+
+- **The hull bound of §1.3** (4,096 bytes) and the replay's budget of
+  §6.1 are guesses the fresh projects calibrate.
+- **How many true errors the replay leaves unconfirmed** on real code:
+  gates F4 and F6 measure it on the detection sets.
+- **Whether the work budget's proofs are worth their cost**: the ratchet
+  records what it gives up; joins that share structure are the next step
+  if it is too much.
+
+## Future work
+
+- Joins that share structure (stable symbols across states).
+- Guard hoisting by induction-variable ranges (one guard for a loop's
+  `p[i]`, `0 <= i < n`).
+- Hardware tagging where the processor has it.
+- RFC 0035, adoption: records in object sections (archives, shared
+  libraries, LTO), incremental `analyze`, `weavec.toml`.
diff --git a/docs/rfcs/README.md b/docs/rfcs/README.md
index ec461df3..4b613210 100644
--- a/docs/rfcs/README.md
+++ b/docs/rfcs/README.md
@@ -80,5 +80,6 @@ decision is a new RFC that supersedes the relevant section.
 | [0031](0031-object-engine.md) | The object engine: a sound heap abstraction behind the engine seam | Implemented |
 | [0032](0032-runtime-enforcement.md) | Runtime enforcement: an object table, guarded facets and a temporal backstop | Implemented |
 | [0033](0033-drop-in-by-default.md) | Drop-in by default: no false stops on code WeaveC was never tuned on | Implemented |
+| [0034](0034-fast-enforcement.md) | Fast enforcement, confirmed errors and a bounded analysis | Implemented |
 
 The [roadmap](../roadmap.md) links each milestone to the RFCs that define it.
diff --git a/docs/roadmap.md b/docs/roadmap.md
index a7c521ca..27378f70 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -153,15 +153,35 @@ do not, because the analysis's joins rebuild the whole abstract state at
 every merge. Making joins share what both sides hold is the next step for
 build time.
 
-## Next: RFC 0034 — Guard elimination
-
-Dominated guards, the hull of a block's guards per pointer, loop hoisting
-and guards as optimiser-visible intrinsics, against RFC 0032's carried cost
-gate (Lua at most 2.0× and zlib at most 1.5× the reference compiler). The
-build-cost gate RFC 0033 carries forward (every build within 4× the
-reference compiler) needs joins that keep what both sides of a merge share
-instead of renumbering the whole state; it is either part of this RFC or
-the next.
+## Done: RFC 0034 — Fast enforcement, confirmed errors and a bounded analysis
+
+Design: [RFC 0034](rfcs/0034-fast-enforcement.md) (Implemented, with its
+build-cost and run-time gates carried forward). Guards are declared calls
+that LLVM passes merge, hoist and expand into an inline check of a shadow
+byte per 16 bytes of memory; a local is registered only where a guard can
+reach it, and registered objects are encoded exactly in the shadow; a
+definite error fails the build only once a replay confirms it on a
+feasible path, and nothing traps unconditionally; the analysis is bounded
+by a work budget. The stages landed on `rfc0034-fast-enforcement` and ship
+as one change; the RFC's *Implementation amendments* record the decisions:
+
+- [x] **S0 Tests first**: fresh and sealed configs, detection and confirm cases.
+- [x] **S1 Shadow memory** and the slow path.
+- [x] **S2 The backend passes**: canonical guards, merging, expansion.
+- [x] **S3 Stack objects and library calls.**
+- [x] **S4 Confirmed errors.**
+- [x] **S5 The bounded analysis.**
+- [x] **S6 The driver.**
+- [x] **S7 Fresh-project iterations.**
+- [x] **S8 Gates, the sealed run, the blind detection set, documentation.**
+
+All ten fresh projects (QuickJS, LMDB, Janet, brotli, xz, libdeflate,
+zlib-ng, curl, cmark, libgit2) build with `CC=weavec-cc` and pass their own
+test suites with no trap; six had stopped at definite errors
+before. Run time over Clang's: Lua 2.43× (from 5.94×), zlib 1.62×, cJSON
+1.59×, the fresh projects 1.5–4.0× (2.55 on average). Carried forward: the
+build cost of the heaviest units (pcre2 13.6×, sqlite 9.7×, lmdb and mujs
+7.4×) and the 1.5× run-time bound for zlib and cJSON.
 
 ## Planned: RFC 0035 — Adoption
 
diff --git a/include/weavec/Analysis/LedgerAdapter.h b/include/weavec/Analysis/LedgerAdapter.h
index 8227a31a..ac05e2b7 100644
--- a/include/weavec/Analysis/LedgerAdapter.h
+++ b/include/weavec/Analysis/LedgerAdapter.h
@@ -204,6 +204,10 @@ class LedgerAdapter {
     /// the diagnostics are kept, with their certainty, for the caller to
     /// report at its call.
     Collecting,
+    /// RFC 0034 §6.1: the replay of one function along single paths. The
+    /// unit's sites apply as in the authoritative pass, nothing is
+    /// published, and every decision goes to `observer`.
+    Witness,
   };
 
   LedgerAdapter(clang::ASTContext &ctx, const SiteIndex &siteIndex,
@@ -285,6 +289,17 @@ class LedgerAdapter {
   /// defaults and before the planner.
   void boundaryDecisions(std::vector<BoundaryDecision> decisions);
 
+  /// RFC 0034 §6.1: a definite error of the authoritative pass that the
+  /// replay did not confirm. Its facet's violation becomes
+  /// `unresolved(unconfirmed)`, and each of its diagnostics at the site a
+  /// warning with the note `not confirmed on a feasible path`.
+  void unconfirm(const clang::Stmt &site, core::Facet facet,
+                 std::string_view id);
+  /// Witness mode: called with every decision of a facet of a site.
+  std::function<void(const clang::Stmt &, core::Facet,
+                     const core::FacetDecision &)>
+      observer;
+
   /// Completes the unit's ledger and plans its checks; see the file
   /// comment. Call once, after the engine is done.
   [[nodiscard]] PlannedLedger finish();
diff --git a/include/weavec/Core/CheckPlan.h b/include/weavec/Core/CheckPlan.h
index 407fead7..7df13dab 100644
--- a/include/weavec/Core/CheckPlan.h
+++ b/include/weavec/Core/CheckPlan.h
@@ -141,22 +141,25 @@ struct CheckPlanEntry {
   };
   /// `IfNonZero`: `nonnull` for `null-if-zero` arguments; `Function`:
   /// `nonnull` for the callee operand of an indirect call; `Result`: `len`
-  /// over the `snprintf` lowering of `sprintf`; `Violation`: the
-  /// unconditional trap of a lowered violation, of any template (§3.4).
-  /// RFC 0032 §3: `Need` is `object` for a call argument that must have
-  /// `need` bytes behind it, `String` for one that must be a terminated
-  /// string inside its object.
+  /// over the `snprintf` lowering of `sprintf`. (RFC 0034 §6.4: a lowered
+  /// violation has no unconditional trap.) RFC 0032 §3: `Need` is `object` for
+  /// a call argument that must have `need` bytes behind it, `String` for one
+  /// that must be a terminated string inside its object.
   enum class Form : std::uint8_t {
     Plain,
     IfNonZero,
     Function,
     Result,
-    Violation,
     Need,
     String,
     /// RFC 0033 §5: wraps a call's length argument, which a guard of the
     /// pointer argument (its operand) checks and returns.
-    Length
+    Length,
+    /// RFC 0034 §5.2: the call is replaced by its row's checked wrapper,
+    /// which computes the need at run time (`object`: the destination's
+    /// room; `disjoint`: the row's overlap clause). Every such entry of one
+    /// call is served by the one replacement.
+    Wrapper
   };
   /// §10.4: where the rewrite goes.
   enum class Placement : std::uint8_t {
@@ -216,6 +219,8 @@ toString(CheckPlanEntry::Placement placement) noexcept;
 ///   object    Plain     ReplaceAccess                    step, offset, width
 ///   object    Need      WrapArgument                     need
 ///   object    String    WrapArgument                     -
+///   object    Wrapper   ReplaceCall                      -
+///   disjoint  Wrapper   ReplaceCall                      -
 ///   live      Plain     WrapOperand, WrapArgument        -
 ///   release   Plain     WrapOperand                      -
 ///   any       Violation any                              -
@@ -240,7 +245,8 @@ ledgerTemplate(const CheckPlanEntry &entry) noexcept;
 /// The prelude helper the entry calls (§10.2): `__weavec_chk_<template>`
 /// with the `_n`, `_fn`, `_r` and `_s` suffixes of its form, or
 /// `__weavec_prv_*` for a verify check of a proven facet. Empty for the
-/// `Violation` form, which is an inline `__builtin_verbose_trap`.
+/// `Violation` form, which is an inline `__builtin_verbose_trap`, and for the
+/// `Wrapper` form, whose helper the call's library row names.
 [[nodiscard]] std::string helperName(const CheckPlanEntry &entry);
 
 /// The planned checks of one unit.
diff --git a/include/weavec/Core/Heap.h b/include/weavec/Core/Heap.h
index 7d984a36..dc319d80 100644
--- a/include/weavec/Core/Heap.h
+++ b/include/weavec/Core/Heap.h
@@ -438,6 +438,9 @@ struct NullOrigin {
 
 /// The most entry places a value records it was computed from.
 inline constexpr std::size_t MaxEntryOrigins = 8;
+/// The most constants a value records it is known not to equal (RFC 0034
+/// §6.2).
+inline constexpr std::size_t MaxExcluded = 8;
 
 // (The fields stay in the groups they are documented in.)
 // NOLINTNEXTLINE(clang-analyzer-optin.performance.Padding): documented order
@@ -455,6 +458,11 @@ struct SymInfo {
   Sym pointerBehind = ZeroSym;
   /// Known to be non-zero (a disequality the zone cannot hold).
   bool nonZero = false;
+  /// RFC 0034 §6.2: the constants it is known not to equal besides what
+  /// `nonZero` says (sorted, at most `MaxExcluded`): the false edge of
+  /// `x == c` and the true edge of `x != c` add `c`, and an edge that
+  /// requires `x == c` for one of them is infeasible.
+  std::vector<std::int64_t> excluded = {};
   /// §4.4: the value's interval in its type (RFC 0017), where the zone's
   /// 64-bit bounds cannot hold it (an unsigned 64-bit value above
   /// `INT64_MAX`); none means the type's range, refined by the zone.
@@ -958,9 +966,11 @@ class Heap {
                                   bool equal);
 
   // Releases.
-  /// Releases `pointer`'s value and targets (§5.5 *Effect*).
-  void release(HeapState &state, Sym pointer,
-               const ReleaseRecord &record) const;
+  /// Releases `pointer`'s value and targets (§5.5 *Effect*). `possibly`:
+  /// the call may release them (a range that may not cover the object, RFC
+  /// 0034 §6.3): no target becomes definitely released.
+  void release(HeapState &state, Sym pointer, const ReleaseRecord &record,
+               bool possibly = false) const;
 
   // Lattice.
   /// The join of two states at the entry of block `block` (§4.8). At a
@@ -1009,6 +1019,9 @@ class Heap {
   /// hold `value`.
   void writeSummary(HeapState &state, ObjectId object, CellKey key,
                     Sym value) const;
+  /// `sym` as a value read through a pointer `hint`: an integer or untyped
+  /// value becomes a raw pointer to any object (§4.2).
+  Sym asPointer(HeapState &state, Sym sym, const SymInfo &hint) const;
   /// The value of "some element" at a summary key's position.
   Sym anyElement(HeapState &state, ObjectId object, CellKey key,
                  const SymInfo &hint) const;
diff --git a/include/weavec/Core/Ledger.h b/include/weavec/Core/Ledger.h
index 9044753b..e70e7e97 100644
--- a/include/weavec/Core/Ledger.h
+++ b/include/weavec/Core/Ledger.h
@@ -108,8 +108,12 @@ enum class UnresolvedReason : std::uint8_t {
   DanglingEscape,
   SecondOwner,
   NoZeroInit,
+  /// RFC 0034 §6.1: a definite finding the replay did not confirm.
+  Unconfirmed,
+  /// RFC 0034 §6.4: a lowered violation with no check or guard.
+  Lowered,
 };
-inline constexpr std::size_t UnresolvedReasonCount = 19;
+inline constexpr std::size_t UnresolvedReasonCount = 21;
 
 /// §2.4: the named trust assumption a trusted facet rests on. Closed.
 enum class TrustReason : std::uint8_t {
@@ -147,12 +151,11 @@ enum class CheckTemplate : std::uint8_t {
   Len,
   Disjoint,
   Assert,
-  Violation,
   Object,
   Live,
   Release,
 };
-inline constexpr std::size_t CheckTemplateCount = 10;
+inline constexpr std::size_t CheckTemplateCount = 9;
 
 /// Whether `kind` is a guard of RFC 0032: a check against the runtime's
 /// object table rather than against a bound the code states.
@@ -610,11 +613,9 @@ struct Producer {
   friend bool operator==(const Producer &, const Producer &) = default;
 };
 
-/// The default of `-fweavec-budget` (§5.5): the smallest multiple of 50,000
-/// that is at least four times the 99.9th percentile of per-function block
-/// transfers over the corpus (S3 measured 7,208 over 2,874 functions; the
-/// most, `luaV_execute`, takes 25,518).
-inline constexpr std::uint64_t DefaultBudget = 50000;
+/// The default of `-fweavec-budget` (§5.5, RFC 0034 §7.1): the work of one
+/// function's run, the sizes of the states it transfers and joins summed.
+inline constexpr std::uint64_t DefaultBudget = 20000000;
 
 /// §12.1 `config`.
 struct LedgerConfig {
@@ -626,7 +627,7 @@ struct LedgerConfig {
   RuntimeUse runtime = RuntimeUse::Off;
   bool zeroInit = true;
   RequireLevel require = RequireLevel::None;
-  /// Block transfers per function; 0 means unlimited.
+  /// Work per function's run (RFC 0034 §7.1); 0 means unlimited.
   std::uint64_t budget = DefaultBudget;
 
   friend bool operator==(const LedgerConfig &, const LedgerConfig &) = default;
diff --git a/include/weavec/Core/LibrarySpec.h b/include/weavec/Core/LibrarySpec.h
index a5eab284..f8f2d613 100644
--- a/include/weavec/Core/LibrarySpec.h
+++ b/include/weavec/Core/LibrarySpec.h
@@ -146,6 +146,20 @@ struct LibDisjoint {
   friend bool operator==(const LibDisjoint &, const LibDisjoint &) = default;
 };
 
+/// RFC 0034 §5.2: `wrapper(name, room, source, disjoint)`: the prelude's
+/// checked wrapper `__weavec_chk_<name>` may replace the call. It computes at
+/// run time what the row's terms state but a check could not name at the
+/// site: the bytes argument 0 needs (`room`), the bytes argument 1 needs
+/// (`source`, a copy's), and the row's `disjoint` clause.
+struct LibWrapper {
+  std::string name;
+  bool room = false;
+  bool source = false;
+  bool disjoint = false;
+
+  friend bool operator==(const LibWrapper &, const LibWrapper &) = default;
+};
+
 /// `copies(dst, src, length)`: the call copies the first `length` bytes of
 /// argument `src` to argument `dst` (`memcpy`, `strncpy`).
 struct LibCopy {
@@ -295,6 +309,11 @@ struct LibraryParam {
   /// `out(…)`: the call stores this value through the pointer, which points
   /// to a pointer slot (`getline`, `asprintf`, `strtol`'s end pointer).
   std::optional<LibraryResult> out;
+  /// `range(t)` (Release only, RFC 0034 §6.3): the call releases the `t`
+  /// bytes from the pointer (`munmap`): the object only when they cover it
+  /// from its start; any other release of it is possible, and the pointer
+  /// may point anywhere in it.
+  std::optional<LibTerm> range;
 
   friend bool operator==(const LibraryParam &, const LibraryParam &) = default;
 };
@@ -355,6 +374,8 @@ struct LibraryEntry {
   bool exits = false;
   bool returnsTwice = false;
   std::optional<LibFormat> format;
+  /// RFC 0034 §5.2: the checked wrapper that may replace the call.
+  std::optional<LibWrapper> wrapper;
   /// The line of `LibrarySpec.txt` the row starts on.
   unsigned line = 0;
 
@@ -366,6 +387,11 @@ struct LibraryEntry {
   [[nodiscard]] bool releases() const noexcept;
   /// Some argument carries a callback clause (a §9.4 boundary).
   [[nodiscard]] bool hasCallback() const noexcept;
+  /// RFC 0034 §6.3: the row gives pointer argument `index` no access
+  /// requirement and no effect (`mmap`'s address hint, `none` with neither
+  /// an extent, an effect, a callback nor an out value, and named by no
+  /// clause or callback): the call uses only its value.
+  [[nodiscard]] bool usesValueOnly(unsigned index) const noexcept;
   /// Neither `noreturn` nor `exits` (§7.5 "known to return").
   [[nodiscard]] bool knownToReturn() const noexcept;
   /// Declared by the compiler rather than a header (`__builtin_expect`).
diff --git a/include/weavec/Frontend/CheckEmitter.h b/include/weavec/Frontend/CheckEmitter.h
index 3a70ade0..6faa5c7c 100644
--- a/include/weavec/Frontend/CheckEmitter.h
+++ b/include/weavec/Frontend/CheckEmitter.h
@@ -28,11 +28,11 @@
 //   ReplaceCall    assume   -> __weavec_chk_assert(c)
 //                  sprintf  -> __weavec_chk_len_r(snprintf(d, have, ...), have)
 //
-// On one operand `nonnull` is innermost, then `index`. The unconditional
-// trap of a lowered violation (§3.4) is `__weavec_chk_violation()`, before
-// the operation. In report mode every check helper also receives the site's
-// file, line and column; verify-mode checks of proven facets call the
-// `__weavec_prv_*` family.
+// On one operand `nonnull` is innermost, then `index`. In report mode every
+// check helper also receives the site's file, line and column; verify-mode
+// checks of proven facets call the `__weavec_prv_*` family. The `object` and
+// `live` guards are only declared (RFC 0034 §1.1): the backend expands them
+// (`GuardPasses.h`).
 //
 // Each rewrite runs inside a `Sema::TentativeAnalysisScope`, with an SFINAE
 // trap and a `DiagnosticErrorTrap`. It is rejected when the result is
@@ -86,12 +86,10 @@ struct CheckEmitterOptions {
   /// The helpers are then declared `extern` in the AST and come from
   /// `libweavec_chk.a`, whose report helpers carry a `_report` suffix.
   bool externalHelpers = false;
-  /// RFC 0032 §13: guards of a pointer the function uses more than once, or
-  /// in a loop, remember the range that passed in a cache in its frame.
-  bool rangeCaches = true;
   /// RFC 0033 *Implementation amendments* (build cost): a function with
   /// more plan entries than this calls the prelude's copies of the check
-  /// and guard helpers that are not inlined (`<name>_ool`).
+  /// helpers that are not inlined (`<name>_ool`). The guards the backend
+  /// expands (RFC 0034 §1) have no such copy.
   unsigned inlinedHelperCalls = 4096;
 };
 
@@ -110,14 +108,14 @@ struct HelperSignature {
     ConstCharPointer,
     CharPointerPointer,
     VoidPointerPointer,
-    /// `unsigned long long *`: a guard's range cache (RFC 0032 §13).
-    UnsignedLongLongPointer,
     /// `void (*)(void)`.
     FunctionPointer,
     /// `void *(*)(size_t, size_t)`.
     AlignedAllocator,
     /// `int (*)(void **, size_t, size_t)`.
     PosixMemalignFunction,
+    /// `va_list`.
+    VaList,
   };
   llvm::StringLiteral name;
   Type result = Type::Void;
@@ -126,6 +124,15 @@ struct HelperSignature {
                                 Type::Void, Type::Void, Type::Void};
   /// A check helper: report mode appends (file, line, column).
   bool reports = false;
+  /// RFC 0034 §1.1: a guard the prelude only declares, which the backend
+  /// expands and `libweavec_chk.a` defines; in report mode it is called by
+  /// its `_report` name.
+  bool declared = false;
+  /// RFC 0034 §5.2: a checked wrapper, which replaces a library call; it
+  /// has no copy that is not inlined.
+  bool wrapper = false;
+  /// The parameters are followed by `...` (after report mode's).
+  bool variadic = false;
 };
 
 class CheckEmitter {
diff --git a/include/weavec/Frontend/GuardPasses.h b/include/weavec/Frontend/GuardPasses.h
new file mode 100644
index 00000000..3c09aa4c
--- /dev/null
+++ b/include/weavec/Frontend/GuardPasses.h
@@ -0,0 +1,88 @@
+//===- GuardPasses.h - Guards the backend lowers ----------------*- C++ -*-===//
+//
+// Part of WeaveC, under the Apache License v2.0 with LLVM Exceptions.
+// See LICENSE for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// RFC 0034 §1. The prelude declares the `object` and `live` guards
+// (`__weavec_chk_object`, `__weavec_chk_live`, their `_report` forms and
+// verify mode's `__weavec_prv_*`), and three passes turn each call of one
+// into code:
+//
+//   GuardCanonicalize  (PipelineStartEP) the helper's result becomes the
+//                      address arithmetic it did (a `getelementptr` of the
+//                      operand, which alias analysis sees through), and the
+//                      check becomes a call of the runtime's slow path,
+//                      `__weavec_rt_guard(from, at, width, kind, site)`,
+//                      declared `nounwind memory(inaccessiblemem: read)` and
+//                      not `willreturn`: the optimiser may delete a copy a
+//                      dominating one makes redundant and hoist one out of a
+//                      loop it always runs in, and never moves one above a
+//                      condition or an access above one.
+//   GuardMerge         (OptimizerLastEP) removes a guard whose bytes a
+//                      dominating guard of the same pointer checked with no
+//                      call between them that may release or register an
+//                      object, and merges the guards of one block on one
+//                      pointer into the guard of their hull.
+//   GuardExpand        (OptimizerLastEP) puts the inline check of RFC 0034
+//                      §2.3 in front of each slow-path call: an arena
+//                      address whose shadow byte says its bytes are a live
+//                      object's passes without the call.
+//
+// The runtime defines every declared guard and the slow path, so a call the
+// passes did not rewrite (an object built without them) is checked out of
+// line. `weavec-cc` registers the passes for every unit whose checks it
+// emits, at every optimisation level.
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef WEAVEC_FRONTEND_GUARDPASSES_H
+#define WEAVEC_FRONTEND_GUARDPASSES_H
+
+#include "llvm/IR/PassManager.h"
+
+namespace clang {
+class CodeGenOptions;
+} // namespace clang
+
+namespace weavec::frontend {
+
+/// The runtime's slow path, which the canonical guards call.
+inline constexpr const char *GuardSlowPath = "__weavec_rt_guard";
+
+/// RFC 0034 §4: a registered global owns the granules it starts in.
+struct GlobalPadding : llvm::PassInfoMixin<GlobalPadding> {
+  // NOLINTNEXTLINE(readability-identifier-naming): the pass manager's name
+  llvm::PreservedAnalyses run(llvm::Module &module,
+                              llvm::ModuleAnalysisManager &analyses);
+};
+
+/// RFC 0034 §1.2.
+struct GuardCanonicalize : llvm::PassInfoMixin<GuardCanonicalize> {
+  // NOLINTNEXTLINE(readability-identifier-naming): the pass manager's name
+  llvm::PreservedAnalyses run(llvm::Function &function,
+                              llvm::FunctionAnalysisManager &analyses);
+};
+
+/// RFC 0034 §1.3.
+struct GuardMerge : llvm::PassInfoMixin<GuardMerge> {
+  // NOLINTNEXTLINE(readability-identifier-naming): the pass manager's name
+  llvm::PreservedAnalyses run(llvm::Function &function,
+                              llvm::FunctionAnalysisManager &analyses);
+};
+
+/// RFC 0034 §1.4.
+struct GuardExpand : llvm::PassInfoMixin<GuardExpand> {
+  // NOLINTNEXTLINE(readability-identifier-naming): the pass manager's name
+  llvm::PreservedAnalyses run(llvm::Function &function,
+                              llvm::FunctionAnalysisManager &analyses);
+};
+
+/// Adds the passes to every pipeline `options` configures.
+void registerGuardPasses(clang::CodeGenOptions &options);
+
+} // namespace weavec::frontend
+
+#endif // WEAVEC_FRONTEND_GUARDPASSES_H
diff --git a/include/weavec/Frontend/ObjectRegistration.h b/include/weavec/Frontend/ObjectRegistration.h
index d45e413b..c448095e 100644
--- a/include/weavec/Frontend/ObjectRegistration.h
+++ b/include/weavec/Frontend/ObjectRegistration.h
@@ -25,7 +25,9 @@
 // variables of automatic storage, parameters included, whose address is
 // taken, or which are (or hold) an array that decays to a pointer anywhere
 // but as the base of a subscript. A local that is only read, written and
-// subscripted directly is never looked up and is not registered. A function
+// subscripted directly is never looked up and is not registered, and
+// neither is one whose address is only an argument of library calls that
+// take no callback and guard none of their arguments (RFC 0034 §4). A function
 // that calls a returns-twice function registers none (a `longjmp` skips the
 // cleanups) and has each such call wrapped instead, so that the entries of
 // the frames a `longjmp` abandoned are dropped. A function with automatic
@@ -60,6 +62,7 @@ class SiteIndex;
 
 namespace weavec::core {
 class LibrarySpec;
+struct CheckPlan;
 } // namespace weavec::core
 
 namespace weavec::frontend {
@@ -73,14 +76,13 @@ struct ObjectOptions {
 
 /// One escaping local.
 struct StackObject {
-  /// Null for the marker of a function that has unregistered automatic
-  /// storage and nothing to enter: its guard variable is entered itself.
   const clang::VarDecl *variable = nullptr;
   /// The declaration statement that declares it; null for a parameter,
   /// which is entered at the start of the body.
   const clang::DeclStmt *statement = nullptr;
   const clang::FunctionDecl *function = nullptr;
-  /// The function has automatic objects that are not registered.
+  /// The function has automatic objects that are not registered (an
+  /// `alloca`, a compound literal): one may start at this one's end.
   bool loose = false;
   /// Declared in a nested scope of the function: it may leave scope, and
   /// its storage be reused, while the function runs (RFC 0032 §13).
@@ -108,10 +110,12 @@ struct ObjectPlan {
 
 /// Plans the registrations of the unit: the escaping locals and the
 /// returns-twice calls of the functions `sites` holds (the emitted ones),
-/// and the globals the unit defines.
+/// and the globals the unit defines. `checks` (may be null: every library
+/// argument then counts as guarded) says which calls guard their arguments.
 [[nodiscard]] ObjectPlan planObjects(clang::ASTContext &context,
                                      const analysis::SiteIndex &sites,
                                      const core::LibrarySpec &library,
+                                     const core::CheckPlan *checks,
                                      const ObjectOptions &options = {});
 
 } // namespace weavec::frontend
diff --git a/lib/Analysis/CheckPlanner.cpp b/lib/Analysis/CheckPlanner.cpp
index 57750971..08b3bd71 100644
--- a/lib/Analysis/CheckPlanner.cpp
+++ b/lib/Analysis/CheckPlanner.cpp
@@ -650,23 +650,6 @@ static bool isCallLike(core::SiteKind kind) {
          kind == core::SiteKind::Call;
 }
 
-/// The unconditional trap of a lowered violation (§3.4): before the
-/// operation.
-static Entry violationGuard(const SiteInfo &site, core::Facet facet) {
-  Entry::Template kind = Entry::Template::Assert;
-  if (facet == core::Facet::Null)
-    kind = Entry::Template::Nonnull;
-  else if (facet == core::Facet::Spatial)
-    kind = Entry::Template::Index;
-  Entry::Placement placement = Entry::Placement::WrapOperand;
-  if (site.kind == core::SiteKind::Assume)
-    placement = Entry::Placement::ReplaceCall;
-  else if (isCallLike(site.kind) ||
-           (site.kind == core::SiteKind::Raw && site.library.has_value()))
-    placement = Entry::Placement::BeforeCall;
-  return makeEntry(kind, Entry::Form::Violation, placement);
-}
-
 namespace {
 
 /// Plans the checks of one site.
@@ -1060,6 +1043,7 @@ CheckPlanner::accessBytes(const SiteInfo &site) const {
 static bool guardableReason(core::UnresolvedReason reason) {
   switch (reason) {
   case core::UnresolvedReason::NoZeroInit:
+  case core::UnresolvedReason::Lowered:
   case core::UnresolvedReason::SecondOwner:
   case core::UnresolvedReason::MayConflict:
   case core::UnresolvedReason::MayDangle:
@@ -1100,6 +1084,37 @@ static bool releasesHeap(const SiteInfo &site) {
       });
 }
 
+/// RFC 0034 §5.2: the check the library row's wrapper makes for a spatial
+/// requirement record of a call that is still to be guarded, when the
+/// wrapper computes it and no guard of the record's own (`guarded`) states
+/// it: `object` for the bytes behind argument 0 (also when the only guard
+/// would check a format's least output, a lower bound), `disjoint` for the
+/// row's overlap clause.
+static std::optional<core::CheckPlanEntry::Template>
+wrapperCheck(const SiteInfo &site, const core::Requirement &requirement,
+             const CheckWitness *witness, bool guarded) {
+  using Template = core::CheckPlanEntry::Template;
+  if (site.kind != core::SiteKind::LibCall || !site.library ||
+      site.library->entry == nullptr || !site.library->entry->wrapper ||
+      !requirement.argument)
+    return std::nullopt;
+  const core::LibraryEntry &entry = *site.library->entry;
+  if (witness != nullptr && witness->shape == CheckWitness::Shape::Disjoint)
+    return entry.wrapper->disjoint && !guarded
+               ? std::optional(Template::Disjoint)
+               : std::nullopt;
+  if ((witness != nullptr && witness->string) || (guarded && !entry.format))
+    return std::nullopt;
+  const int destination = site.library->callArgument(0);
+  const int source = site.library->callArgument(1);
+  if ((entry.wrapper->room && destination >= 0 &&
+       std::cmp_equal(*requirement.argument, destination)) ||
+      (entry.wrapper->source && source >= 0 &&
+       std::cmp_equal(*requirement.argument, source)))
+    return Template::Object;
+  return std::nullopt;
+}
+
 void CheckPlanner::planGuards(const SiteInfo &site, core::Site &row,
                               const WitnessTable &witnesses,
                               PlaceHandleTable &handles,
@@ -1278,16 +1293,15 @@ void CheckPlanner::planGuards(const SiteInfo &site, core::Site &row,
             witness = &candidate;
       // A requirement that binds only under a guard term has no guard yet:
       // the helpers take no condition.
-      if ((!isUnresolvedForGuard(requirement.decision) &&
-           !loweredRequirement) ||
-          witness == nullptr || !witness->argument || witness->guard ||
+      const bool guardable =
+          (isUnresolvedForGuard(requirement.decision) || loweredRequirement) &&
+          (witness == nullptr || !witness->guard);
+      std::optional<Entry> entry;
+      if (!guardable || witness == nullptr || !witness->argument ||
           *witness->argument >= call->getNumArgs() ||
           !call->getArg(*witness->argument)->getType()->isPointerType()) {
-        left = true;
-        continue;
-      }
-      std::optional<Entry> entry;
-      if (witness->shape == CheckWitness::Shape::Disjoint) {
+        // Nothing to guard here; the row's wrapper may still compute it.
+      } else if (witness->shape == CheckWitness::Shape::Disjoint) {
         // An overlap check whose length is a string's: the static check
         // had no bound to read it with; the guard reads it inside the
         // string's own object.
@@ -1334,6 +1348,24 @@ void CheckPlanner::planGuards(const SiteInfo &site, core::Site &row,
                               static_cast<std::uint8_t>(*length));
         }
       }
+      // RFC 0034 §5.2: what no guard states, or states only as a lower
+      // bound, the row's checked wrapper computes at run time. A lowered
+      // violation keeps what RFC 0033 (V) gives it.
+      const std::optional<Entry::Template> wrapped =
+          guardable && !loweredRequirement
+              ? wrapperCheck(site, requirement, witness, entry.has_value())
+              : std::nullopt;
+      // (A wrapper's `object` names the row's argument it checks: 0 the
+      // destination's room, 1 a copy's source.)
+      if (wrapped)
+        entry = makeEntry(
+            *wrapped, Entry::Form::Wrapper, Entry::Placement::ReplaceCall, {},
+            static_cast<std::uint8_t>(
+                *wrapped == Entry::Template::Object && requirement.argument &&
+                        std::cmp_equal(*requirement.argument,
+                                       site.library->callArgument(1))
+                    ? 1
+                    : 0));
       if (!entry) {
         left = true;
         continue;
@@ -1345,7 +1377,9 @@ void CheckPlanner::planGuards(const SiteInfo &site, core::Site &row,
         requirement.decision = core::FacetDecision::guardedFor(
             *reason, std::move(requirement.decision.detail));
       }
-      if (witness->shape != CheckWitness::Shape::Disjoint)
+      if (wrapped == Entry::Template::Object)
+        covered.insert({*requirement.argument, false});
+      else if (!wrapped && witness->shape != CheckWitness::Shape::Disjoint)
         covered.insert({*witness->argument, false});
     }
     // The merged facet follows its records once none is left unresolved.
@@ -1449,15 +1483,9 @@ core::CheckPlan CheckPlanner::plan(core::UnitLedger &unit,
       SitePlanner planner(*this, site, handles);
       std::vector<Entry> planned;
       std::set<core::Facet> loweredFacets;
-      // RFC 0033 (V): a lowered violation the analysis decided from the
-      // program's own model of other code (a temporal fact, a callee's or a
-      // library row's requirement at a call) is guarded, so that it traps
-      // when it happens and a false one runs; one decided at the access
-      // from an exact extent traps whenever it is reached, as before.
-      const auto guardsLowered = [&](const SiteInfo &at, core::Facet facet) {
-        return options.runtime &&
-               (facet == core::Facet::Temporal || isCallLike(at.kind));
-      };
+      // RFC 0034 §6.4: a lowered violation gets the check its witness
+      // states, else the guard its facet would have as a possible finding,
+      // else nothing (`unresolved(lowered)`); never an unconditional trap.
 
       // Plans one record; returns false when it became unresolved.
       const auto planRecord = [&](core::Facet facet,
@@ -1499,19 +1527,10 @@ core::CheckPlan CheckPlanner::plan(core::UnitLedger &unit,
         // proven.
         if (verify)
           return true;
-        if (lowered && guardsLowered(site, facet)) {
-          // RFC 0033 (V): the guard pass guards it if it can; what it
-          // cannot traps unconditionally, below.
-          loweredFacets.insert(facet);
-          return true;
-        }
         if (lowered) {
-          Entry guard = violationGuard(site, facet);
-          guard.site = site.id;
-          guard.facet = facet;
-          guard.requirement = index.value_or(0);
-          check = core::facetCheck(guard);
-          planned.push_back(std::move(guard));
+          // The guard pass guards it if it can; below, what it cannot is
+          // unresolved.
+          loweredFacets.insert(facet);
           return true;
         }
         const bool downgraded =
@@ -1548,23 +1567,16 @@ core::CheckPlan CheckPlanner::plan(core::UnitLedger &unit,
         }
         if (worse)
           record->decide(*worse);
-        // §3.4: a violation of the facet itself (a definite error linked to
-        // it) that no requirement check guards still traps when lowered.
+        // A violation of the facet itself (a definite error linked to it)
+        // that no requirement check guards, lowered: the guard pass, below.
         if (record->outcome() == core::SiteOutcome::Violation &&
             options.lowered && options.lowered(site.id, facet) &&
             llvm::none_of(record->requirements,
                           [](const core::Requirement &requirement) {
                             return requirement.check.has_value();
                           })) {
-          if (guardsLowered(site, facet)) {
-            loweredFacets.insert(facet);
-            continue;
-          }
-          Entry guard = violationGuard(site, facet);
-          guard.site = site.id;
-          guard.facet = facet;
-          record->check = core::facetCheck(guard);
-          planned.push_back(std::move(guard));
+          loweredFacets.insert(facet);
+          continue;
         }
         if (record->outcome() == core::SiteOutcome::Checked && !record->check)
           for (const core::Requirement &requirement : record->requirements)
@@ -1579,8 +1591,8 @@ core::CheckPlan CheckPlanner::plan(core::UnitLedger &unit,
       if (options.runtime)
         planGuards(site, *ledgerSite, witnesses, handles, planned,
                    loweredFacets);
-      // §3.4: a lowered violation no check or guard serves traps before the
-      // operation.
+      // RFC 0034 §6.4: a lowered violation no check or guard serves is
+      // unresolved, and nothing is inserted for it.
       for (const core::Facet facet : loweredFacets) {
         core::FacetRecord *record = ledgerSite->facet(facet);
         if (record == nullptr)
@@ -1600,11 +1612,14 @@ core::CheckPlan CheckPlanner::plan(core::UnitLedger &unit,
                           });
         if (!unguardedRequirement && !unguardedFacet)
           continue;
-        Entry guard = violationGuard(site, facet);
-        guard.site = site.id;
-        guard.facet = facet;
-        record->check = core::facetCheck(guard);
-        planned.push_back(std::move(guard));
+        const auto unresolved =
+            core::FacetDecision::unresolvedFor(core::UnresolvedReason::Lowered);
+        for (core::Requirement &requirement : record->requirements)
+          if (requirement.decision.outcome == core::SiteOutcome::Violation &&
+              !requirement.check)
+            requirement.decision = unresolved;
+        // (Assigned: a violation outranks every other decision.)
+        record->decision = unresolved;
       }
 
       // §10.4: a span check traps on null, so it replaces the nonnull check
diff --git a/lib/Analysis/Engine.h b/lib/Analysis/Engine.h
index 5a202867..6ed5a067 100644
--- a/lib/Analysis/Engine.h
+++ b/lib/Analysis/Engine.h
@@ -41,6 +41,7 @@
 #include "llvm/ADT/BitVector.h"
 #include "llvm/ADT/DenseMap.h"
 #include "llvm/ADT/DenseSet.h"
+#include "llvm/ADT/SparseBitVector.h"
 
 #include <cstdint>
 #include <map>
@@ -118,6 +119,8 @@ struct RunResult {
   /// Over the per-function budget, not just the run's share of the unit's.
   bool spentBudget = false;
   std::uint64_t transfers = 0;
+  /// RFC 0034 §7.1.
+  std::uint64_t work = 0;
 };
 
 /// A place where a value is stored or read: every object and offset an
@@ -263,6 +266,8 @@ class FunctionRun final : public core::HeapOracle {
   unsigned contextDepth;
   clang::ASTContext &context;
   LedgerAdapter &out;
+  /// Where the run publishes: `out`, or the replay's witness adapter.
+  LedgerAdapter *publishTo;
   RunMode mode;
   mutable core::ObjectTable objects;
   core::Heap heap;
@@ -308,7 +313,7 @@ class FunctionRun final : public core::HeapOracle {
   /// and the ones some path from each block's entry reads before it
   /// evaluates them again.
   llvm::DenseMap<core::Handle, unsigned> carriedIndex;
-  std::vector<llvm::BitVector> carriedLiveIn;
+  std::vector<llvm::SparseBitVector<>> carriedLiveIn;
   /// Drops from `state`, entering block `block`, the carried expression
   /// values no path from it reads.
   void dropDeadValues(core::HeapState &state, unsigned block) const;
@@ -337,6 +342,9 @@ class FunctionRun final : public core::HeapOracle {
   /// Exit states, for the summary.
   std::vector<core::HeapState> exits;
   std::uint64_t transfers = 0;
+  /// RFC 0034 §7.1: the run's work, and the states it keeps at entries.
+  std::uint64_t work = 0;
+  std::uint64_t retained = 0;
   /// §12 `--analysis-stats`: the joins and materialised cells of the run.
   std::uint64_t joins = 0;
   mutable std::uint64_t materialisations = 0;
@@ -363,6 +371,25 @@ class FunctionRun final : public core::HeapOracle {
       declaredOwner;
   /// Diagnostics already reported, keyed by site and id.
   std::set<std::pair<const clang::Stmt *, std::string>> reported;
+  /// RFC 0034 §6.1: the definite errors of the authoritative pass, and
+  /// what the replay saw of each: a path that reports it (`witnessed`), a
+  /// path that reaches its site and decides it otherwise (`countered`).
+  struct Candidate {
+    const clang::Stmt *site = nullptr;
+    core::Facet facet = core::Facet::Temporal;
+    std::string id;
+    core::SourceLocation where;
+    bool witnessed = false;
+    bool countered = false;
+    /// In the block being replayed: reported definitely, decided otherwise.
+    bool reportedHere = false;
+    bool otherwiseHere = false;
+  };
+  std::vector<Candidate> candidates;
+  bool witnessing = false;
+  /// Replays the function along single paths and unconfirms the
+  /// candidates no path confirms.
+  void confirmCandidates();
   /// §4.1: the symbol an integer operation on two symbols last produced, so
   /// the same operation on the same values finds the same value again
   /// (checked against the state before use, EngineExpr.cpp).
@@ -402,7 +429,7 @@ class FunctionRun final : public core::HeapOracle {
     return fixedLocals;
   }
   [[nodiscard]] RunMode runMode() const noexcept { return mode; }
-  [[nodiscard]] LedgerAdapter &ledger() const noexcept { return out; }
+  [[nodiscard]] LedgerAdapter &ledger() const noexcept { return *publishTo; }
   /// The unit's sites, whatever adapter this run publishes into (a context
   /// run collects into its own, §6.6).
   [[nodiscard]] const SiteIndex &sites() const;
@@ -540,6 +567,8 @@ class FunctionRun final : public core::HeapOracle {
   [[nodiscard]] bool isBypassed(const clang::Expr &operand) const;
   /// RFC 0033 §1: whether `expr`'s value is discarded by a `(void)` cast.
   [[nodiscard]] bool isDiscarded(const clang::Expr &expr) const;
+  /// `stmt`'s parent in the body (the unit's parent map costs too much).
+  [[nodiscard]] const clang::Stmt *parentOf(const clang::Stmt &stmt) const;
   /// RFC 0033 §1: whether the function passes the address of `var` (or of
   /// a member or an element of it) to a call.
   [[nodiscard]] bool isPassedToCall(const clang::VarDecl &var) const;
@@ -933,10 +962,13 @@ class Transfer {
     std::string note;
     core::SourceLocation noteAt = {};
   };
+  /// `anywhere`: the release takes a range (`munmap`, RFC 0034 §6.3), so
+  /// a pointer into a heap object need not point to its start.
   [[nodiscard]] ReleaseCheck releaseCheck(core::Sym pointer,
                                           const std::string &subject,
                                           const clang::Expr &operand,
-                                          const std::string &verb) const;
+                                          const std::string &verb,
+                                          bool anywhere = false) const;
   /// A path below a call's argument as the caller spells it (`b.data` for
   /// `param0->data` with `&b`, `b->data` with `b`), when it can.
   [[nodiscard]] std::optional<std::string>
@@ -1116,6 +1148,11 @@ class UnitRun {
   LedgerAdapter discarding;
   /// Alias contexts already run, per callee (§6.6), and their count.
   std::map<const clang::FunctionDecl *, std::set<AliasContext>> contextsRun;
+  /// RFC 0034 §6.1: what each context run found, for the replay of a
+  /// caller, which does not run a context twice.
+  std::map<std::pair<const clang::FunctionDecl *, AliasContext>,
+           std::vector<core::Diagnostic>>
+      contextFindings;
   /// §6.6 *Amendment (numeric contexts)*: the summaries derived per callee
   /// and context (none: the run was over budget or incomplete).
   std::map<const clang::FunctionDecl *,
@@ -1127,30 +1164,31 @@ class UnitRun {
   /// The block transfers each function's last run took (what a context
   /// run of it may cost).
   std::map<const clang::FunctionDecl *, std::uint64_t> transfersOf;
-  /// RFC 0033 §9: the unit's budget of block transfers (0: unlimited),
-  /// what every run in it has spent, and the definitions whose
+  /// RFC 0034 §7.2: the work each function's last run took.
+  std::map<const clang::FunctionDecl *, std::uint64_t> workOf;
+  /// RFC 0033 §1: `onlyValueUses` by definition, parameter and depth.
+  std::map<std::tuple<const clang::FunctionDecl *, unsigned, unsigned>, bool>
+      valueOnly;
+  /// RFC 0033 §9, RFC 0034 §7.1: the unit's budget of work (0:
+  /// unlimited), what every run in it has spent, and the definitions whose
   /// authoritative run is still to come.
   std::uint64_t unitBudget = 0;
-  std::uint64_t unitTransfers = 0;
+  std::uint64_t unitWork = 0;
   std::uint64_t functionsLeft = 1;
-  /// The block transfers one run may take from what is left: a fair share
-  /// of it, eight times over, so that a few large functions cannot spend
-  /// what the others need; 0 is unlimited.
+  /// A run's share of the work left: eight fair shares (0 unlimited).
   [[nodiscard]] std::uint64_t runShare() const {
-    static constexpr std::uint64_t MinRunShare = 500;
-    if (unitBudget == 0)
-      return 0;
-    const std::uint64_t left =
-        unitBudget > unitTransfers ? unitBudget - unitTransfers : 0;
-    return std::max(MinRunShare,
-                    8 * left / std::max<std::uint64_t>(1, functionsLeft));
+    static constexpr std::uint64_t MinRunShare = 100000;
+    const std::uint64_t left = unitBudget - std::min(unitBudget, unitWork);
+    return unitBudget == 0
+               ? 0
+               : std::max(MinRunShare,
+                          8 * left / std::max<std::uint64_t>(1, functionsLeft));
   }
   /// Summaries of the unit's definitions, by canonical declaration.
   std::map<const clang::FunctionDecl *, core::FunctionEffects> summaries;
   std::set<const clang::FunctionDecl *> incomplete;
   /// Members of a recursive component whose summary round spent the
-  /// per-function budget (RFC 0033 *Implementation amendments*, build
-  /// cost).
+  /// per-function budget (RFC 0033 *Implementation amendments*).
   std::set<const clang::FunctionDecl *> exhausted;
   /// §9.4, §4.5 D2: fields and globals some function releases a value
   /// loaded from.
diff --git a/lib/Analysis/EngineCalls.cpp b/lib/Analysis/EngineCalls.cpp
index 913c9fe4..a4fe17db 100644
--- a/lib/Analysis/EngineCalls.cpp
+++ b/lib/Analysis/EngineCalls.cpp
@@ -233,8 +233,13 @@ class CallApplier {
   core::Sym freshAllocation(const std::string &family,
                             std::optional<core::Term> extent, bool zeroed,
                             bool maybeNull, bool wrapped);
+  /// `possibly`: the call may release it (RFC 0034 §6.3).
   void releaseArgument(unsigned index, const std::string &family,
-                       core::ReleaseRecord::Reason reason);
+                       core::ReleaseRecord::Reason reason,
+                       bool possibly = false);
+  /// RFC 0034 §6.3: a `range(t)` release covers argument `index`'s whole
+  /// object: it points to the start and `t` is at least the extent.
+  bool releasesWhole(unsigned index, const core::LibTerm &range);
   void havocReachable(unsigned index, bool constPointee, bool callback = false);
   /// RFC 0003: a mutable borrow may write what the argument reaches but
   /// releases nothing.
@@ -363,8 +368,23 @@ core::Sym CallApplier::freshAllocation(const std::string &family,
   return heap.fresh(state, info);
 }
 
+bool CallApplier::releasesWhole(unsigned index, const core::LibTerm &range) {
+  const core::SymInfo &info = heap.info(state, args[index]);
+  if (info.top || info.targets.size() != 1)
+    return false;
+  const core::Target &target = info.targets[0];
+  const core::ObjectState *object = heap.findObject(state, target.object);
+  if (object == nullptr || !object->extent ||
+      heap.lessEqual(state, target.offset, core::Term::of(0)) != true ||
+      heap.lessEqual(state, core::Term::of(0), target.offset) != true)
+    return false;
+  core::Term bytes = termOfLibTerm(transfer, range, args, rowCall);
+  return heap.lessEqual(state, object->extent->bytes, bytes) == true;
+}
+
 void CallApplier::releaseArgument(unsigned index, const std::string &family,
-                                  core::ReleaseRecord::Reason reason) {
+                                  core::ReleaseRecord::Reason reason,
+                                  bool possibly) {
   if (index >= args.size())
     return;
   core::Sym pointer = args[index];
@@ -383,7 +403,7 @@ void CallApplier::releaseArgument(unsigned index, const std::string &family,
   record.nonNullLocals = transfer.nonNullLocals();
   // A release after an unknown callee's: the record is replaced (RFC 0030
   // §3.1).
-  heap.release(state, pointer, record);
+  heap.release(state, pointer, record, possibly);
 }
 
 void CallApplier::havocReachable(unsigned index, bool constPointee,
@@ -401,8 +421,10 @@ void Transfer::havocArgument(const CallExpr &call, core::Sym pointer,
   start.reserve(info.targets.size());
   for (const core::Target &target : info.targets)
     start.push_back(target.object);
-  std::vector<core::ObjectId> reached =
-      constPointee ? start : reachableFrom(heap, state, start);
+  // RFC 0034 §6.3: C's `const` is shallow. The callee may still write
+  // through the pointers a `const` object holds, so what they reach is
+  // havocked as for any argument; only the object itself keeps its cells.
+  std::vector<core::ObjectId> reached = reachableFrom(heap, state, start);
   core::ReleaseRecord record;
   record.reason = callback ? core::ReleaseRecord::Reason::Callback
                            : core::ReleaseRecord::Reason::UnknownCallee;
@@ -645,6 +667,21 @@ void Transfer::forgetGlobals(const core::ReleaseRecord &record) {
     if (kind == core::ObjectKind::Global)
       globals.push_back(id);
   }
+  // A local a global reaches escapes (the code may keep its address), and
+  // the code may write every local that escaped.
+  for (core::ObjectId id : reachableFrom(heap, state, globals))
+    if (run.table().info(id).key.kind == core::ObjectKind::Local &&
+        state.objects.contains(id))
+      state.objects.at(id).escaped = true;
+  std::vector<core::ObjectId> escaped;
+  for (const auto &[id, object] : state.objects)
+    if (object.escaped &&
+        run.table().info(id).key.kind == core::ObjectKind::Local)
+      escaped.push_back(id);
+  for (core::ObjectId id : escaped) {
+    heap.forgetCells(state, id, 0, std::nullopt);
+    state.objects.at(id).havocked = true;
+  }
   const SourceManager &sources = run.ast().getSourceManager();
   for (core::ObjectId id : globals) {
     std::vector<core::ObjectId> below = reachableFrom(heap, state, {id});
@@ -1471,10 +1508,14 @@ core::Sym CallApplier::applyLibrary(const core::LibraryMatch &match) {
       break;
     switch (param.effect) {
     case core::LibraryParam::Effect::Release:
+      // RFC 0034 §6.3, RFC 0033 §1's witness rule: a release of part of an
+      // object (`munmap` of a guard page) is no witness of the whole
+      // object's release, so one not known to cover it is possible.
       releaseArgument(row,
                       param.family.empty() ? std::string(core::HeapFamily)
                                            : param.family,
-                      core::ReleaseRecord::Reason::Freed);
+                      core::ReleaseRecord::Reason::Freed,
+                      param.range && !releasesWhole(row, *param.range));
       break;
     case core::LibraryParam::Effect::Realloc:
       realloced = args[row];
@@ -2120,10 +2161,34 @@ void Transfer::checkAliasContext(const CallExpr &call,
     outOfBudget();
     return;
   }
+  // RFC 0034 §7.2: no context run (diagnostics only) of an expensive callee.
+  static constexpr std::uint64_t MaxContextWork = 200000;
+  if (auto cost = run.unitRun().workOf.find(definition->getCanonicalDecl());
+      cost == run.unitRun().workOf.end() || cost->second > MaxContextWork) {
+    outOfBudget();
+    return;
+  }
   std::set<AliasContext> &done =
       run.unitRun().contextsRun[definition->getCanonicalDecl()];
-  if (done.contains(alias))
+  core::SourceLocation at =
+      toCoreLocation(context.getSourceManager(), call.getBeginLoc());
+  const auto reportFindings = [&](std::vector<core::Diagnostic> findings) {
+    for (core::Diagnostic &diagnostic : findings) {
+      core::Certainty certainty = diagnostic.certainty;
+      diagnostic.addNote("called here with related pointer arguments", at);
+      run.report(std::move(diagnostic), certainty, &call,
+                 core::Facet::Temporal);
+    }
+  };
+  if (done.contains(alias)) {
+    // (The replay of this caller sees what the first run of it saw.)
+    if (run.witnessing)
+      if (auto found = run.unitRun().contextFindings.find(
+              {definition->getCanonicalDecl(), alias});
+          found != run.unitRun().contextFindings.end())
+        reportFindings(found->second);
     return;
+  }
   if (done.size() >= MaxContextsPerCallee) {
     outOfBudget();
     return;
@@ -2138,17 +2203,15 @@ void Transfer::checkAliasContext(const CallExpr &call,
   (void)contextRun.run();
   if (contextRun.contextIncomplete)
     outOfBudget();
-  core::SourceLocation at =
-      toCoreLocation(context.getSourceManager(), call.getBeginLoc());
-  for (core::Diagnostic diagnostic : collector.diagnostics()) {
-    if (diagnostic.id != core::diag::UseAfterFree &&
-        diagnostic.id != core::diag::DoubleFree &&
-        diagnostic.id != core::diag::UseAfterMove)
-      continue;
-    core::Certainty certainty = diagnostic.certainty;
-    diagnostic.addNote("called here with related pointer arguments", at);
-    run.report(std::move(diagnostic), certainty, &call, core::Facet::Temporal);
-  }
+  std::vector<core::Diagnostic> findings;
+  for (const core::Diagnostic &diagnostic : collector.diagnostics())
+    if (diagnostic.id == core::diag::UseAfterFree ||
+        diagnostic.id == core::diag::DoubleFree ||
+        diagnostic.id == core::diag::UseAfterMove)
+      findings.push_back(diagnostic);
+  run.unitRun().contextFindings[{definition->getCanonicalDecl(), alias}] =
+      findings;
+  reportFindings(std::move(findings));
 }
 
 /// §6.6 *Amendment (numeric contexts)*: whether what `effects` says of a
diff --git a/lib/Analysis/EngineDecide.cpp b/lib/Analysis/EngineDecide.cpp
index 03f4c7ba..500405c5 100644
--- a/lib/Analysis/EngineDecide.cpp
+++ b/lib/Analysis/EngineDecide.cpp
@@ -18,7 +18,6 @@
 #include "weavec/Analysis/KindTable.h"
 #include "weavec/Analysis/SiteCollector.h"
 
-#include "clang/AST/ParentMapContext.h"
 #include "clang/AST/RecordLayout.h"
 #include "clang/Basic/SourceManager.h"
 
@@ -766,7 +765,12 @@ void Decider::spatialOf(core::Sym pointer, std::int64_t width,
                             .offset = std::move(index),
                             .unmodified = true,
                             .accessesSafe = true};
-    // A cursor: its object's start must have a name.
+    // A cursor: its object's start must have a name, and be the one start
+    // (a pointer into one of several objects of one size has no base).
+    if (std::ranges::any_of(value.targets, [&](const core::Target &each) {
+          return each.object != target.object;
+        }))
+      return std::nullopt;
     std::optional<WitnessTerm> base;
     for (const auto &[sym, info] : state.syms) {
       if (info.type != core::SymInfo::Type::Pointer || info.targets.size() != 1)
@@ -804,9 +808,12 @@ void Decider::spatialOf(core::Sym pointer, std::int64_t width,
     decide(core::Facet::Spatial, core::FacetDecision::proven());
     return;
   case Kind::Violation: {
-    // A lowered violation traps with the `violation` template (RFC 0030
-    // §3.4).
+    // RFC 0034 §6.4: a lowered violation gets the check its witness states,
+    // which traps exactly when the access is out of bounds.
     decide(core::Facet::Spatial, core::FacetDecision::violation());
+    if (std::optional<CheckWitness> witness = witnessFor();
+        witness && run.isPublishing())
+      out.witness(*site.stmt, core::Facet::Spatial, std::move(*witness));
     std::string subject = inQuotes(transfer.spell(*cast<Expr>(site.stmt)));
     // The object: an array member's is the object it is a member of.
     const Expr *objectExpr =
@@ -975,14 +982,11 @@ void Decider::spatialOf(core::Sym pointer, std::int64_t width,
 }
 
 /// Whether the site's lvalue is stored to (`p[0] = c`, `++*p`).
-static bool isWritten(ASTContext &context, const Stmt &lvalue) {
-  DynTypedNodeList parents = context.getParents(lvalue);
-  for (int depth = 0; depth < 4 && !parents.empty(); ++depth) {
-    const Stmt *parent = parents[0].get<Stmt>();
-    if (parent == nullptr)
-      return false;
+static bool isWritten(const FunctionRun &run, const Stmt &lvalue) {
+  const Stmt *parent = run.parentOf(lvalue);
+  for (int depth = 0; depth < 4 && parent != nullptr; ++depth) {
     if (isa<ParenExpr>(parent)) {
-      parents = context.getParents(*parent);
+      parent = run.parentOf(*parent);
       continue;
     }
     if (const auto *binary = dyn_cast<BinaryOperator>(parent))
@@ -1007,7 +1011,7 @@ bool Decider::writesLiteral(core::Sym pointer, const Expr &operand) {
     any = any || literal;
     all = all && literal;
   }
-  if (!any || !isWritten(context, *site.stmt))
+  if (!any || !isWritten(run, *site.stmt))
     return false;
   if (!all) {
     decide(core::Facet::Spatial, core::FacetDecision::unresolvedFor(
@@ -1561,8 +1565,13 @@ void Decider::invalidRelease(core::Sym pointer) {
     return;
   const Expr *operand = site.operand;
   std::string name = transfer.spell(releasedBase(*operand));
+  const bool ranged = site.library.has_value() &&
+                      std::ranges::any_of(site.library->entry->params,
+                                          [](const core::LibraryParam &param) {
+                                            return param.range.has_value();
+                                          });
   Transfer::ReleaseCheck check =
-      transfer.releaseCheck(pointer, name, *operand, "released");
+      transfer.releaseCheck(pointer, name, *operand, "released", ranged);
   switch (check.kind) {
   case Transfer::ReleaseCheck::Kind::Proven:
     decide(core::Facet::Spatial, core::FacetDecision::proven());
@@ -1594,7 +1603,8 @@ void Decider::invalidRelease(core::Sym pointer) {
 Transfer::ReleaseCheck Transfer::releaseCheck(core::Sym pointer,
                                               const std::string &subject,
                                               const Expr &operand,
-                                              const std::string &verb) const {
+                                              const std::string &verb,
+                                              bool anywhere) const {
   ReleaseCheck out;
   const core::SymInfo &value = heap.info(state, pointer);
   if (value.null == core::PointerNull::Null)
@@ -1662,6 +1672,11 @@ Transfer::ReleaseCheck Transfer::releaseCheck(core::Sym pointer,
           kind != nullptr && !kind->hasShape() &&
           !kind->shapeFromSystemHeader())
         cursor = true;
+    // (A release that may take any part of a heap object takes this one.)
+    if (anywhere && heapObject) {
+      allInvalid = false;
+      continue;
+    }
     if (nonHeap) {
       anyInvalid = true;
       if (out.message.empty()) {
@@ -2080,15 +2095,33 @@ bool Transfer::calleeTouches(const CallExpr &call, core::Sym calleeValue,
   return false;
 }
 
+/// RFC 0034 §6.3: a library row gives argument `index` of a call of
+/// `callee` no access requirement and no effect (`mmap`'s address hint).
+static bool libraryUsesValueOnly(const FunctionDecl &callee, unsigned index,
+                                 const core::LibrarySpec &library) {
+  auto match = governingLibraryEntry(callee, library);
+  if (!match)
+    return false;
+  const int row = match->rowArgument(index);
+  return row >= 0 && match->entry->usesValueOnly(static_cast<unsigned>(row));
+}
+
 /// RFC 0033 §1: whether `param` appears in `body` only as a value: an
-/// operand of `==` or `!=`, converted to an integer, a variadic argument of
-/// a call whose literal format reads no string (`%p`), or an argument of a
-/// function of the unit that itself uses it only so (`depth` levels down).
-static bool onlyValueUses(const Stmt &body, const ParmVarDecl &param,
-                          ASTContext &context, unsigned depth) {
-  const auto parentOf = [&](const Stmt &child) -> const Stmt * {
-    const DynTypedNodeList parents = context.getParents(child);
-    return parents.empty() ? nullptr : parents[0].get<Stmt>();
+/// operand of `==` or `!=`, tested for truth, converted to an integer, a
+/// variadic argument of a call whose literal format reads no string (`%p`),
+/// an argument a library row gives no access and no effect (RFC 0034
+/// §6.3), or an argument of a function of the unit that itself uses it only
+/// so (`depth` levels down).
+static bool onlyValueUses(UnitRun &unit, const FunctionDecl &definition,
+                          unsigned index, unsigned depth) {
+  auto [cached, inserted] =
+      unit.valueOnly.try_emplace({&definition, index, depth}, false);
+  if (!inserted)
+    return cached->second;
+  const ParmVarDecl &param = *definition.getParamDecl(index);
+  const ParentMap parents(definition.getBody());
+  const auto parentOf = [&](const Stmt &child) {
+    return parents.getParent(&child);
   };
   // The use of an argument by its callee.
   const auto valueArgument = [&](const CallExpr &call, const Expr &argument) {
@@ -2113,12 +2146,12 @@ static bool onlyValueUses(const Stmt &body, const ParmVarDecl &param,
       return false;
     }
     const FunctionDecl *definition = nullptr;
-    return depth > 0 && callee->hasBody(definition) && definition != nullptr &&
-           !definition->isVariadic() &&
-           onlyValueUses(*definition->getBody(),
-                         *definition->getParamDecl(index), context, depth - 1);
+    if (!callee->hasBody(definition) || definition == nullptr)
+      return libraryUsesValueOnly(*callee, index, unit.library());
+    return depth > 0 && !definition->isVariadic() &&
+           onlyValueUses(unit, *definition, index, depth - 1);
   };
-  std::vector<const Stmt *> work{&body};
+  std::vector<const Stmt *> work{definition.getBody()};
   while (!work.empty()) {
     const Stmt *stmt = work.back();
     work.pop_back();
@@ -2140,12 +2173,29 @@ static bool onlyValueUses(const Stmt &body, const ParmVarDecl &param,
         use = parentOf(*use);
       }
       const auto *binary = dyn_cast_or_null<BinaryOperator>(use);
+      const auto *unary = dyn_cast_or_null<UnaryOperator>(use);
       const auto *cast = dyn_cast_or_null<CastExpr>(use);
       const auto *call = dyn_cast_or_null<CallExpr>(use);
+      // A truth test (`if (p)`, `p && …`, `!p`) is a comparison with null.
+      const auto truthTest = [&] {
+        if (const auto *test = dyn_cast_or_null<IfStmt>(use))
+          return test->getCond() == operand;
+        if (const auto *test = dyn_cast_or_null<WhileStmt>(use))
+          return test->getCond() == operand;
+        if (const auto *test = dyn_cast_or_null<DoStmt>(use))
+          return test->getCond() == operand;
+        if (const auto *test = dyn_cast_or_null<ForStmt>(use))
+          return test->getCond() == operand;
+        if (const auto *test = dyn_cast_or_null<ConditionalOperator>(use))
+          return test->getCond() == operand;
+        return (binary != nullptr && binary->isLogicalOp()) ||
+               (unary != nullptr && unary->getOpcode() == UO_LNot);
+      };
       const bool value =
           isa_and_nonnull<UnaryExprOrTypeTraitExpr>(use) ||
-          (binary != nullptr && binary->isEqualityOp()) ||
-          (cast != nullptr && cast->getCastKind() == CK_PointerToIntegral) ||
+          (binary != nullptr && binary->isEqualityOp()) || truthTest() ||
+          (cast != nullptr && (cast->getCastKind() == CK_PointerToIntegral ||
+                               cast->getCastKind() == CK_PointerToBoolean)) ||
           (call != nullptr && call->getCallee() != operand &&
            valueArgument(*call, *cast_or_null<Expr>(operand)));
       if (!value)
@@ -2155,7 +2205,7 @@ static bool onlyValueUses(const Stmt &body, const ParmVarDecl &param,
     for (const Stmt *child : stmt->children())
       work.push_back(child);
   }
-  return true;
+  return cached->second = true;
 }
 
 bool Transfer::usesValueOnly(const CallExpr &call, core::Sym calleeValue,
@@ -2165,16 +2215,20 @@ bool Transfer::usesValueOnly(const CallExpr &call, core::Sym calleeValue,
       callTargets(call, calleeValue);
   if (targets.empty())
     return false;
+  const core::LibrarySpec &library = run.unitRun().library();
   for (const FunctionDecl *target : targets) {
     const FunctionDecl *definition = nullptr;
-    if (!target->hasBody(definition) || definition == nullptr ||
-        index >= definition->getNumParams() || definition->isVariadic())
+    if (!target->hasBody(definition) || definition == nullptr) {
+      if (libraryUsesValueOnly(*target, index, library))
+        continue;
+      return false;
+    }
+    if (index >= definition->getNumParams() || definition->isVariadic())
       return false;
     const core::FunctionEffects *effects =
         run.unitRun().summaryOf(*target->getCanonicalDecl());
     if (effects == nullptr || effects->incomplete ||
-        !onlyValueUses(*definition->getBody(), *definition->getParamDecl(index),
-                       context, 3))
+        !onlyValueUses(run.unitRun(), *definition, index, 3))
       return false;
   }
   return !calleeReleases(call, calleeValue, args, index, true);
diff --git a/lib/Analysis/EngineExpr.cpp b/lib/Analysis/EngineExpr.cpp
index 11898790..f73aa32e 100644
--- a/lib/Analysis/EngineExpr.cpp
+++ b/lib/Analysis/EngineExpr.cpp
@@ -2639,6 +2639,13 @@ core::Sym Transfer::compare(BinaryOperatorKind kind, core::Sym left,
     condition.left = right;
     condition.rightIsConstant = true;
     condition.constant = 0;
+  } else if (auto k = state.zone.constant(left);
+             k && !operandType->isPointerType() &&
+             (kind == BO_EQ || kind == BO_NE)) {
+    // `DIRECT == t`: swap, so its edges refine `t` (RFC 0034 §6.2).
+    condition.left = right;
+    condition.rightIsConstant = true;
+    condition.constant = *k;
   } else {
     condition.right = right;
   }
@@ -3519,8 +3526,14 @@ bool Transfer::refineCondition(FunctionRun &run, core::HeapState &state,
       if (c != INT64_MIN)
         le(core::ZeroSym, cond.left, -c);
     };
+    // RFC 0034 §6.2: the constants the value is known not to equal, which
+    // the zone's bounds cannot hold (`t != DIRECT` with `t` in [0, 3]).
+    const core::SymInfo &tested = heap.info(state, cond.left);
     switch (op) {
     case Op::Eq:
+      if ((c == 0 && tested.nonZero) ||
+          std::ranges::binary_search(tested.excluded, c))
+        return false;
       le(cond.left, core::ZeroSym, c);
       atLeast();
       break;
@@ -3529,10 +3542,19 @@ bool Transfer::refineCondition(FunctionRun &run, core::HeapState &state,
       auto hi = state.zone.upper(cond.left);
       if (lo && hi && *lo == c && *hi == c)
         return false;
-      if (lo && *lo == c)
+      if (lo && *lo == c) {
         above();
-      else if (hi && *hi == c)
+      } else if (hi && *hi == c) {
         below();
+      } else if ((!lo || *lo < c) && (!hi || *hi > c)) {
+        // (Zero too: `nonZero` stays what a truth test makes, which the
+        // summary's entry tests read.)
+        core::SymInfo &value = heap.infoMut(state, cond.left);
+        auto at = std::ranges::lower_bound(value.excluded, c);
+        if (value.excluded.size() < core::MaxExcluded &&
+            (at == value.excluded.end() || *at != c))
+          value.excluded.insert(at, c);
+      }
       break;
     }
     case Op::Lt:
diff --git a/lib/Analysis/EngineLibrary.cpp b/lib/Analysis/EngineLibrary.cpp
index fafa5df9..a4ecc628 100644
--- a/lib/Analysis/EngineLibrary.cpp
+++ b/lib/Analysis/EngineLibrary.cpp
@@ -486,8 +486,9 @@ void Transfer::decideArguments(const CallExpr &call, const SiteInfo &site,
       }
       if (facts.unterminated && extent &&
           extent->cls == core::ExtentClass::Exact) {
+        // RFC 0034 §6.4: lowered, the string is guarded.
         publish(i, core::FacetDecision::violation(), std::nullopt, haveText,
-                std::nullopt);
+                objectWitness(requirement, std::nullopt));
         core::Diagnostic diagnostic;
         diagnostic.id = core::diag::OutOfBounds;
         diagnostic.severity = core::Severity::Error;
@@ -542,8 +543,21 @@ void Transfer::decideArguments(const CallExpr &call, const SiteInfo &site,
       if (fits && !*fits && atLeast &&
           extent->cls == core::ExtentClass::Exact && requirement.enforced &&
           !requirement.guard) {
+        // RFC 0034 §6.4: lowered, it is checked where the need and the
+        // extent have names, and guarded otherwise; never trapped
+        // unconditionally.
+        std::optional<CheckWitness> lowered;
+        if (haveTerm && needTerm && !requirement.rowOnly)
+          lowered = CheckWitness{.shape = CheckWitness::Shape::Length,
+                                 .extent = *haveTerm,
+                                 .extentClass = extent->cls,
+                                 .need = *needTerm,
+                                 .unmodified = true,
+                                 .accessesSafe = true};
+        else
+          lowered = objectWitness(requirement, needTerm);
         publish(i, core::FacetDecision::violation(), spellTerm(need), haveText,
-                std::nullopt);
+                std::move(lowered));
         run.requirementViolated.insert(&call);
         std::string object = "'" + spell(pointedObject(argument)) + "'";
         std::string least = requirement.bound == ArgRequirement::Bound::AtLeast
@@ -750,6 +764,16 @@ void Transfer::decideLibraryCall(const CallExpr &call, const SiteInfo &site,
       requirement.formatArgument = true;
       requirements.push_back(std::move(requirement));
     }
+    // A `%.Ns` argument: at most N bytes, no terminator needed. Its record
+    // states no need, but names it for the call's liveness guard.
+    for (unsigned argument : format.bounded)
+      if (argument < call.getNumArgs() && argument < args.size() &&
+          call.getArg(argument)->getType()->isPointerType())
+        requirements.push_back(
+            ArgRequirement{.argument = argument,
+                           .bound = ArgRequirement::Bound::AtMost,
+                           .rowOnly = true,
+                           .formatArgument = true});
     if (format.reads && *format.reads > format.passed) {
       core::Diagnostic diagnostic;
       diagnostic.id = core::diag::OutOfBounds;
diff --git a/lib/Analysis/EngineLifetimes.cpp b/lib/Analysis/EngineLifetimes.cpp
index 462d152b..13f9b22c 100644
--- a/lib/Analysis/EngineLifetimes.cpp
+++ b/lib/Analysis/EngineLifetimes.cpp
@@ -947,21 +947,20 @@ bool FunctionRun::inUnsafeRegion(const Stmt &stmt) const {
   for (const FunctionDecl *redecl : function.redecls())
     if (getAnnotations(*redecl).unsafe)
       return true;
-  if (!parentMap)
-    parentMap = std::make_unique<ParentMap>(function.getBody());
-  for (const Stmt *at = &stmt; at != nullptr; at = parentMap->getParent(at))
+  for (const Stmt *at = &stmt; at != nullptr; at = parentOf(*at))
     if (isUnsafeBlock(*at))
       return true;
   return false;
 }
 
-bool FunctionRun::isDiscarded(const Expr &expr) const {
-  if (function.getBody() == nullptr)
-    return false;
-  if (!parentMap)
+const Stmt *FunctionRun::parentOf(const Stmt &stmt) const {
+  if (!parentMap && function.getBody() != nullptr)
     parentMap = std::make_unique<ParentMap>(function.getBody());
-  for (const Stmt *at = parentMap->getParent(&expr); at != nullptr;
-       at = parentMap->getParent(at)) {
+  return parentMap ? parentMap->getParent(&stmt) : nullptr;
+}
+
+bool FunctionRun::isDiscarded(const Expr &expr) const {
+  for (const Stmt *at = parentOf(expr); at != nullptr; at = parentOf(*at)) {
     if (const auto *cast = dyn_cast<CastExpr>(at)) {
       if (cast->getCastKind() == CK_ToVoid)
         return true;
@@ -1009,10 +1008,10 @@ static const VarDecl *addressedLocal(const Expr &argument) {
 bool FunctionRun::isPassedToCall(const VarDecl &var) const {
   if (!passedToCalls) {
     passedToCalls.emplace();
-    std::vector<const Stmt *> work{function.getBody()};
-    while (!work.empty()) {
-      const Stmt *stmt = work.back();
-      work.pop_back();
+    std::vector<const Stmt *> pending{function.getBody()};
+    while (!pending.empty()) {
+      const Stmt *stmt = pending.back();
+      pending.pop_back();
       if (stmt == nullptr)
         continue;
       if (const auto *call = dyn_cast<CallExpr>(stmt))
@@ -1020,7 +1019,7 @@ bool FunctionRun::isPassedToCall(const VarDecl &var) const {
           if (const VarDecl *local = addressedLocal(*argument))
             passedToCalls->insert(local->getCanonicalDecl());
       for (const Stmt *child : stmt->children())
-        work.push_back(child);
+        pending.push_back(child);
     }
   }
   return passedToCalls->contains(var.getCanonicalDecl());
diff --git a/lib/Analysis/EngineRun.cpp b/lib/Analysis/EngineRun.cpp
index a3ac74ae..d2417447 100644
--- a/lib/Analysis/EngineRun.cpp
+++ b/lib/Analysis/EngineRun.cpp
@@ -68,6 +68,10 @@ static constexpr unsigned VisitsPerPredecessor = 2;
 /// as many per edge, so a round of them does not exhaust it.
 static constexpr unsigned MaxJoinsPerBlock = 256;
 static constexpr unsigned JoinsPerPredecessor = 64;
+/// RFC 0034 §7.1: the size of a run's entry states (memory), and of its
+/// graph, over budget.
+static constexpr std::uint64_t MaxRetainedState = 1000000;
+static constexpr unsigned MaxBlocks = 100000;
 /// Symbols a block's joined state may hold before the function is over
 /// budget: every later join pairs them all (sqlite's `sqlite3VdbeExec`
 /// reached 4,677; the next largest in the corpus, under 1,000).
@@ -77,8 +81,8 @@ FunctionRun::FunctionRun(UnitRun &unitRun, const FunctionDecl &fn,
                          LedgerAdapter &adapter, RunMode runMode,
                          const AliasContext *alias, unsigned depth)
     : unit(unitRun), function(fn), aliasContext(alias), contextDepth(depth),
-      context(unitRun.context()), out(adapter), mode(runMode),
-      heap(objects, *this) {}
+      context(unitRun.context()), out(adapter), publishTo(&adapter),
+      mode(runMode), heap(objects, *this) {}
 
 FunctionRun::~FunctionRun() = default;
 
@@ -727,6 +731,12 @@ core::Sym FunctionRun::unwritten(core::HeapState &state, core::ObjectId object,
   if (!objectType.isNull())
     at = fieldAt(context, objectType,
                  key.isSelected() ? key.position().offset : key.offset);
+  // (An element position is kept modulo its stride, so it may name another
+  // member that shares it, `n` for `kids[j]` in `{int n; T *kids[4];}`: the
+  // lvalue's type is the element's then.)
+  if (at && !key.isConcrete() && hint.ctype != 0 &&
+      !ASTContext::hasSameUnqualifiedType(at->type, typeOfHandle(hint.ctype)))
+    at.reset();
   QualType cellType = at ? at->type : QualType();
   if (cellType.isNull() && hint.ctype != 0)
     cellType = typeOfHandle(hint.ctype);
@@ -811,8 +821,8 @@ core::Sym FunctionRun::unwritten(core::HeapState &state, core::ObjectId object,
   }
   case core::ObjectKind::Focus: {
     // Every candidate's value at the cell.
-    std::vector<core::ObjectId> candidates = target.candidates;
-    for (core::ObjectId candidate : candidates) {
+    std::vector<core::ObjectId> focused = target.candidates;
+    for (core::ObjectId candidate : focused) {
       if (!state.objects.contains(candidate))
         continue;
       core::Sym sym = heap.load(state, candidate, key, hint);
@@ -958,7 +968,7 @@ void FunctionRun::dropDeadLocals(core::HeapState &state, unsigned block) const {
 void FunctionRun::dropDeadValues(core::HeapState &state, unsigned block) const {
   if (block >= carriedLiveIn.size() || state.unreachable || state.exprs.empty())
     return;
-  const llvm::BitVector &live = carriedLiveIn[block];
+  const llvm::SparseBitVector<> &live = carriedLiveIn[block];
   state.exprs.eraseIf([&](core::Handle handle, core::Sym) {
     auto index = carriedIndex.find(handle);
     return index != carriedIndex.end() && !live.test(index->second);
@@ -1163,10 +1173,10 @@ bool FunctionRun::blockReaches(unsigned from, unsigned to) const {
   for (const CFGBlock *block : *cfg)
     byId[block->getBlockID()] = block;
   std::vector<bool> seen(byId.size(), false);
-  std::vector<unsigned> work{from};
-  while (!work.empty()) {
-    unsigned id = work.back();
-    work.pop_back();
+  std::vector<unsigned> pending{from};
+  while (!pending.empty()) {
+    unsigned id = pending.back();
+    pending.pop_back();
     if (id >= byId.size() || seen[id] || byId[id] == nullptr)
       continue;
     seen[id] = true;
@@ -1174,7 +1184,7 @@ bool FunctionRun::blockReaches(unsigned from, unsigned to) const {
       if (const CFGBlock *next = succ.getReachableBlock()) {
         if (next->getBlockID() == to)
           return true;
-        work.push_back(next->getBlockID());
+        pending.push_back(next->getBlockID());
       }
   }
   return false;
@@ -1188,13 +1198,135 @@ void FunctionRun::report(core::Diagnostic diagnostic, core::Certainty certainty,
                          const Stmt *site, std::optional<core::Facet> facet) {
   if (!publishing)
     return;
+  // RFC 0034 §6.1: in the replay, a report of a candidate at its location
+  // witnesses it on this path when definite, and counters it when not.
+  if (witnessing) {
+    for (Candidate &candidate : candidates)
+      if (candidate.id == diagnostic.id &&
+          candidate.where == diagnostic.location) {
+        if (certainty == core::Certainty::Definite &&
+            diagnostic.severity == core::Severity::Error)
+          candidate.reportedHere = true;
+        else
+          candidate.otherwiseHere = true;
+      }
+    return;
+  }
   auto key =
       std::make_pair(site, std::string(diagnostic.id) + diagnostic.message);
   if (!reported.insert(key).second)
     return;
+  if (mode == RunMode::Authoritative && site != nullptr && facet &&
+      certainty == core::Certainty::Definite &&
+      diagnostic.severity == core::Severity::Error)
+    candidates.push_back(Candidate{.site = site,
+                                   .facet = *facet,
+                                   .id = std::string(diagnostic.id),
+                                   .where = diagnostic.location});
   out.report(std::move(diagnostic), certainty, site, facet);
 }
 
+/// RFC 0034 §6.1: the replay's bounds.
+static constexpr unsigned ReplayPaths = 256;
+static constexpr unsigned ReplayTransfers = 20000;
+static constexpr unsigned ReplayLoopTurns = 2;
+
+void FunctionRun::confirmCandidates() {
+  if (candidates.empty() || mode != RunMode::Authoritative || !cfg)
+    return;
+  LedgerAdapter witness(context, sites(), {}, LedgerAdapter::Mode::Witness);
+  // A decision of a candidate's facet at its site that is no violation:
+  // this path reaches the site and does not fail it.
+  witness.observer = [this](const Stmt &site, core::Facet facet,
+                            const core::FacetDecision &decision) {
+    if (decision.outcome == core::SiteOutcome::Violation)
+      return;
+    for (Candidate &candidate : candidates)
+      if (candidate.site == &site && candidate.facet == facet)
+        candidate.otherwiseHere = true;
+  };
+  publishTo = &witness;
+  witnessing = true;
+  publishing = true;
+  struct Frame {
+    unsigned block = 0;
+    core::HeapState state;
+    std::vector<std::uint8_t> turns;
+  };
+  std::vector<Frame> stack;
+  const unsigned entry = cfg->getEntry().getBlockID();
+  bool complete = entryStates[entry].has_value();
+  if (complete)
+    stack.push_back(
+        Frame{.block = entry,
+              .state = *entryStates[entry],
+              .turns = std::vector<std::uint8_t>(cfg->getNumBlockIDs(), 0)});
+  unsigned paths = 0;
+  unsigned transfersLeft = ReplayTransfers;
+  std::vector<const CFGBlock *> byId(cfg->getNumBlockIDs(), nullptr);
+  for (const CFGBlock *block : *cfg)
+    byId[block->getBlockID()] = block;
+  while (!stack.empty()) {
+    Frame frame = std::move(stack.back());
+    stack.pop_back();
+    const CFGBlock *block = byId[frame.block];
+    if (block == nullptr)
+      continue;
+    // A loop taken more than twice on one path leaves it from its head's
+    // fixpoint state, by its exits only; anything else repeated stops.
+    bool leaveLoop = false;
+    if (frame.turns[frame.block]++ >= ReplayLoopTurns) {
+      if (!loopHead[frame.block] || !entryStates[frame.block])
+        continue;
+      frame.state = *entryStates[frame.block];
+      leaveLoop = true;
+    }
+    if (transfersLeft-- == 0) {
+      complete = false;
+      break;
+    }
+    // (Each path reports for itself: what makes a finding once per run.)
+    requirementViolated.clear();
+    reportedUninit.clear();
+    std::vector<std::pair<unsigned, core::HeapState>> outs;
+    transferBlock(*block, frame.state, outs);
+    // A definite report in this block witnesses its candidate whatever the
+    // site's own decision says (a trusted facet still reports, and the
+    // authoritative pass links the error to it); anything else counters.
+    for (Candidate &candidate : candidates) {
+      if (candidate.reportedHere)
+        candidate.witnessed = true;
+      else if (candidate.otherwiseHere)
+        candidate.countered = true;
+      candidate.reportedHere = candidate.otherwiseHere = false;
+    }
+    if (outs.empty()) {
+      if (++paths > ReplayPaths) {
+        complete = false;
+        break;
+      }
+      continue;
+    }
+    for (auto &[succ, state] : llvm::reverse(outs)) {
+      if (leaveLoop) {
+        const auto body = loopBody.find(frame.block);
+        if (body != loopBody.end() && body->second.test(succ))
+          continue;
+      }
+      dropDeadLocals(state, succ);
+      dropDeadValues(state, succ);
+      stack.push_back(Frame{
+          .block = succ, .state = std::move(state), .turns = frame.turns});
+    }
+  }
+  witnessing = false;
+  publishing = false;
+  publishTo = &out;
+  for (const Candidate &candidate : candidates)
+    if (!complete || !candidate.witnessed || candidate.countered)
+      out.unconfirm(*candidate.site, candidate.facet, candidate.id);
+}
+
 //===----------------------------------------------------------------------===//
 // The CFG and the fixpoint
 //===----------------------------------------------------------------------===//
@@ -1207,7 +1339,8 @@ void FunctionRun::buildCfg() {
   options.AddScopes = false;
   options.PruneTriviallyFalseEdges = true;
   cfg = CFG::buildCFG(&function, function.getBody(), &context, options);
-  if (!cfg)
+  // RFC 0034 §7.1: no pre-pass (they are quadratic) over a graph too large.
+  if (!cfg || cfg->getNumBlockIDs() > MaxBlocks)
     return;
   entryStates.assign(cfg->getNumBlockIDs(), std::nullopt);
   visits.assign(cfg->getNumBlockIDs(), 0);
@@ -1326,15 +1459,16 @@ void FunctionRun::buildCfg() {
     for (const auto &[arm, op] : arms)
       track(op);
     const unsigned blocks = cfg->getNumBlockIDs();
-    std::vector<llvm::BitVector> use(blocks, llvm::BitVector(index.size()));
-    std::vector<llvm::BitVector> kill(blocks, llvm::BitVector(index.size()));
+    // (Sparse: thousands of blocks carry thousands of short-lived values.)
+    std::vector<llvm::SparseBitVector<>> use(blocks);
+    std::vector<llvm::SparseBitVector<>> kill(blocks);
     for (const CFGBlock *block : *cfg) {
-      llvm::BitVector &reads = use[block->getBlockID()];
-      llvm::BitVector &writes = kill[block->getBlockID()];
-      std::vector<const Stmt *> work;
+      llvm::SparseBitVector<> &reads = use[block->getBlockID()];
+      llvm::SparseBitVector<> &writes = kill[block->getBlockID()];
+      std::vector<const Stmt *> pending;
       for (const CFGElement &element : *block)
         if (auto stmt = element.getAs<CFGStmt>()) {
-          work.push_back(stmt->getStmt());
+          pending.push_back(stmt->getStmt());
           if (const auto *expr = dyn_cast<Expr>(stmt->getStmt())) {
             if (auto it = index.find(expr); it != index.end())
               writes.set(it->second);
@@ -1346,12 +1480,12 @@ void FunctionRun::buildCfg() {
       if (const Stmt *terminator = block->getTerminatorStmt();
           terminator != nullptr && isa<Expr>(terminator) &&
           !isa<AbstractConditionalOperator>(terminator))
-        work.push_back(terminator);
+        pending.push_back(terminator);
       if (const Stmt *condition = block->getTerminatorCondition(false))
-        work.push_back(condition);
-      while (!work.empty()) {
-        const Stmt *stmt = work.back();
-        work.pop_back();
+        pending.push_back(condition);
+      while (!pending.empty()) {
+        const Stmt *stmt = pending.back();
+        pending.pop_back();
         if (const auto *expr = dyn_cast<Expr>(stmt))
           if (auto it = index.find(expr); it != index.end())
             reads.set(it->second);
@@ -1361,10 +1495,10 @@ void FunctionRun::buildCfg() {
           continue;
         if (const auto *opaque = dyn_cast<OpaqueValueExpr>(stmt))
           if (const Expr *source = opaque->getSourceExpr())
-            work.push_back(source);
+            pending.push_back(source);
         for (const Stmt *child : stmt->children())
           if (child != nullptr)
-            work.push_back(child);
+            pending.push_back(child);
       }
       if (const auto *conditional =
               dyn_cast_or_null<AbstractConditionalOperator>(
@@ -1372,17 +1506,17 @@ void FunctionRun::buildCfg() {
         if (auto it = index.find(conditional); it != index.end())
           writes.set(it->second);
     }
-    carriedLiveIn.assign(blocks, llvm::BitVector(index.size()));
+    carriedLiveIn.assign(blocks, llvm::SparseBitVector<>());
     std::vector<const CFGBlock *> postOrder(cfg->begin(), cfg->end());
     for (bool changed = true; changed;) {
       changed = false;
       for (const CFGBlock *block : postOrder) {
         const unsigned id = block->getBlockID();
-        llvm::BitVector live(index.size());
+        llvm::SparseBitVector<> live;
         for (const CFGBlock::AdjacentBlock &succ : block->succs())
           if (const CFGBlock *next = succ.getReachableBlock())
             live |= carriedLiveIn[next->getBlockID()];
-        live.reset(kill[id]);
+        live.intersectWithComplement(kill[id]);
         live |= use[id];
         if (live != carriedLiveIn[id]) {
           carriedLiveIn[id] = std::move(live);
@@ -1614,21 +1748,21 @@ void FunctionRun::buildCfg() {
         loopBody.try_emplace(head, llvm::BitVector(cfg->getNumBlockIDs()));
     llvm::BitVector &body = it->second;
     body.set(head);
-    std::vector<unsigned> work;
+    std::vector<unsigned> pending;
     if (!body.test(source)) {
       body.set(source);
-      work.push_back(source);
+      pending.push_back(source);
     }
-    while (!work.empty()) {
-      const CFGBlock *block = byId[work.back()];
-      work.pop_back();
+    while (!pending.empty()) {
+      const CFGBlock *block = byId[pending.back()];
+      pending.pop_back();
       if (block == nullptr)
         continue;
       for (const CFGBlock::AdjacentBlock &pred : block->preds())
         if (const CFGBlock *from = pred.getReachableBlock();
             from != nullptr && !body.test(from->getBlockID())) {
           body.set(from->getBlockID());
-          work.push_back(from->getBlockID());
+          pending.push_back(from->getBlockID());
         }
     }
   }
@@ -2124,10 +2258,10 @@ RunResult FunctionRun::run() {
   if (mode == RunMode::Authoritative)
     validateAnnotations();
   buildCfg();
-  if (!cfg) {
-    result.effects.incomplete = "the function has no CFG";
-    overBudget = true;
-    result.overBudget = true;
+  if (!cfg || cfg->getNumBlockIDs() > MaxBlocks) {
+    result.effects.incomplete = cfg ? "its graph is over budget" : "no CFG";
+    overBudget = result.overBudget = true;
+    result.spentBudget = spentBudget = cfg != nullptr;
     return result;
   }
   // Reverse post-order for the worklist priority.
@@ -2206,23 +2340,32 @@ RunResult FunctionRun::run() {
     // (Irreducible loops whose bodies hold each other's heads.)
     return worklist.begin();
   };
+  // RFC 0034 §7.1: work is the size of what a transfer or a join handles.
+  const auto sizeOf = [](const core::HeapState &state) -> std::uint64_t {
+    return 1 + state.syms.size() + state.objects.size();
+  };
+  const auto spend = [&](std::uint64_t amount) {
+    work += amount;
+    unit.unitWork += amount;
+  };
+  retained = sizeOf(start);
   while (!worklist.empty()) {
     auto next = nextBlock();
     unsigned id = next->second;
     worklist.erase(next);
     changedByBackEdge[id] = false;
-    ++unit.unitTransfers;
-    if (budget != 0)
-      ++transfers;
-    if ((budget != 0 && transfers > budget) ||
-        (share != 0 && transfers > share)) {
+    ++transfers;
+    if ((budget != 0 && work > budget) || (share != 0 && work > share) ||
+        retained > MaxRetainedState) {
       overBudget = true;
-      spentBudget = budget != 0 && transfers > budget;
+      spentBudget =
+          (budget != 0 && work > budget) || retained > MaxRetainedState;
       break;
     }
     const CFGBlock *block = byId[id];
     if (block == nullptr || !entryStates[id])
       continue;
+    spend(sizeOf(*entryStates[id]));
     std::vector<std::pair<unsigned, core::HeapState>> outs;
     transferBlock(*block, *entryStates[id], outs);
     if (Trace)
@@ -2235,6 +2378,7 @@ RunResult FunctionRun::run() {
                      << (entryStates[succ] ? " join" : " first") << "\n"
                      << heap.dump(state);
       if (!entryStates[succ]) {
+        retained += sizeOf(state);
         entryStates[succ] = std::move(state);
         worklist.emplace(rank[succ], succ);
         continue;
@@ -2248,6 +2392,7 @@ RunResult FunctionRun::run() {
       }
       core::HeapState joined = heap.join(
           *entryStates[succ], state, handleOf(blockById(succ)), loopHead[succ]);
+      spend(sizeOf(joined) + sizeOf(state));
       // Widening starts after a loop head's first joins; its budget counts
       // the joins that changed its state (another back edge of the same
       // round that adds nothing is none), and all its joins.
@@ -2277,6 +2422,8 @@ RunResult FunctionRun::run() {
       if (Trace)
         llvm::errs() << "  joined at B" << succ << "\n" << heap.dump(joined);
       if (changed) {
+        retained += sizeOf(joined);
+        retained -= std::min(retained, sizeOf(*entryStates[succ]));
         entryStates[succ] = std::move(joined);
         worklist.emplace(rank[succ], succ);
         if (backEdges.contains({id, succ}))
@@ -2285,10 +2432,12 @@ RunResult FunctionRun::run() {
     }
   }
   result.transfers = transfers;
+  result.work = work;
   // §12: what the run cost.
   if (core::AnalysisStats *stats = unit.input.options.stats) {
     stats->add("engine_runs");
     stats->add("block_transfers", transfers);
+    stats->add("work", work);
     stats->add("joins", joins);
     stats->add("materialisations", materialisations);
     stats->atLeast("objects_max", objects.size());
@@ -2317,6 +2466,9 @@ RunResult FunctionRun::run() {
       level != nullptr && std::string_view(level) == "3")
     dump(llvm::errs());
   result.effects = deriveEffects();
+  // RFC 0034 §6.1: after the summary, so the replay changes nothing it
+  // derives from.
+  confirmCandidates();
   return result;
 }
 
diff --git a/lib/Analysis/EngineSummary.cpp b/lib/Analysis/EngineSummary.cpp
index 0488540c..1e8a9cd0 100644
--- a/lib/Analysis/EngineSummary.cpp
+++ b/lib/Analysis/EngineSummary.cpp
@@ -1245,6 +1245,7 @@ core::FunctionEffects FunctionRun::deriveEffects() {
     // (Exits that released the value at different offsets: at one the
     // caller cannot tell.)
     bool anyOffset = false;
+    bool mixedFamily = false;
     const ExitEffect *first = nullptr;
     // RFC 0014: the pointer parameter comparisons every such exit's
     // release was made under.
@@ -1266,6 +1267,9 @@ core::FunctionEffects FunctionRun::deriveEffects() {
         });
       if (first == nullptr)
         first = &it->second;
+      // RFC 0034 §6.3: a family two exits disagree on is unknown.
+      if (first->family != it->second.family)
+        mixedFamily = true;
       anyOffset =
           anyOffset || !it->second.offset || it->second.offset != first->offset;
       anyMay = anyMay || it->second.may;
@@ -1274,7 +1278,7 @@ core::FunctionEffects FunctionRun::deriveEffects() {
     core::PathEffect effect;
     effect.kind = kind;
     effect.path = path;
-    effect.family = first->family;
+    effect.family = mixedFamily ? std::string() : first->family;
     effect.anyOffset = anyOffset;
     effect.offset = anyOffset ? 0 : *first->offset;
     effect.may = anyMay;
@@ -2320,6 +2324,85 @@ bool Transfer::lostView(const CallExpr &call,
   return true;
 }
 
+/// RFC 0034 §6.3: the new objects a summary leaves in several places (its
+/// result, cells) on exits a call's arguments do not show to be the same:
+/// each exit numbers its own new objects from #0, so one object of the
+/// call stands for several (`if (w) *a = f(); else *b = f();`) and is not
+/// singular. The result's parameter test only names a test its exits pass;
+/// a store's is the exits it is on.
+static std::set<std::uint32_t>
+scatteredObjects(const core::Heap &heap, const core::HeapState &state,
+                 const core::FunctionEffects &effects,
+                 const std::vector<core::Sym> &args) {
+  using Test = std::optional<std::pair<std::uint32_t, bool>>;
+  // The test the call leaves open, or none; false when it excludes.
+  auto open = [&](Test &test) {
+    if (!test || test->first >= args.size() ||
+        args[test->first] == core::ZeroSym)
+      return true;
+    std::optional<bool> zero = isZeroValue(heap, state, args[test->first]);
+    if (zero && *zero != test->second)
+      return false;
+    if (zero)
+      test.reset();
+    return true;
+  };
+  std::set<core::ResultClass> all;
+  for (const core::ResultEffect &alternative : effects.results)
+    all.insert(alternative.classes.begin(), alternative.classes.end());
+  auto classes = [&](std::vector<core::ResultClass> of) {
+    std::ranges::sort(of);
+    return std::ranges::includes(of, all) ? std::vector<core::ResultClass>{}
+                                          : of;
+  };
+  struct Places {
+    std::vector<core::EffectCase> stores;
+    bool may = false;
+    std::optional<std::vector<core::ResultClass>> result;
+    std::vector<Test> resultTests;
+  };
+  std::map<std::uint32_t, Places> places;
+  for (core::ResultEffect alternative : effects.results)
+    if (alternative.value.kind == core::ValueDesc::Kind::Fresh &&
+        open(alternative.paramZero)) {
+      Places &at = places[alternative.value.object];
+      std::vector<core::ResultClass> with =
+          at.result.value_or(std::vector<core::ResultClass>{});
+      with.insert(with.end(), alternative.classes.begin(),
+                  alternative.classes.end());
+      at.result = classes(with);
+      at.resultTests.push_back(alternative.paramZero);
+    }
+  for (const core::StoreEffect &store : effects.stores) {
+    core::EffectCase when = store.when;
+    if (store.value.kind != core::ValueDesc::Kind::Fresh || store.contents ||
+        store.dest.isResult() || !open(when.paramZero))
+      continue;
+    when.classes = classes(when.classes);
+    Places &at = places[store.value.object];
+    at.stores.push_back(when);
+    at.may = at.may || store.may;
+  }
+  std::set<std::uint32_t> several;
+  for (const auto &[object, at] : places) {
+    if (at.stores.size() + (at.result ? 1 : 0) < 2)
+      continue;
+    bool apart = at.may || std::ranges::any_of(at.stores, [&](const auto &c) {
+                   return !(c == at.stores.front());
+                 });
+    if (at.result) {
+      const core::EffectCase &store = at.stores.front();
+      apart = apart || store.paramsEqual || store.entryZero ||
+              store.classes != *at.result;
+      for (const Test &test : at.resultTests)
+        apart = apart || (store.paramZero && test != store.paramZero);
+    }
+    if (apart)
+      several.insert(object);
+  }
+  return several;
+}
+
 /// The value a `path` description names at the call: the value `at` the
 /// path holds, `offset` bytes on, or null where the description says the
 /// callee may have left null instead (its entry value joined with null).
@@ -2349,15 +2432,31 @@ core::Sym Transfer::instantiate(const CallExpr &call,
   PathResolver resolver(*this, call, args);
   // The callee's new objects by their summary index.
   std::map<std::uint32_t, core::ObjectId> created;
+  std::map<std::uint32_t, const core::ValueDesc *> madeBy;
+  std::set<std::uint32_t> several =
+      scatteredObjects(heap, state, effects, args);
   auto freshObject = [&](const core::ValueDesc &desc, QualType pointee,
                          bool owned) -> core::ObjectId {
-    if (auto it = created.find(desc.object); it != created.end())
+    if (auto it = created.find(desc.object); it != created.end()) {
+      // RFC 0034 §6.3: rows that give one new object different facts are
+      // applied together: their join (an unknown family or extent).
+      const core::ValueDesc &first = *madeBy.at(desc.object);
+      if (state.objects.contains(it->second)) {
+        core::ObjectState &made = state.objects.at(it->second);
+        if (first.family != desc.family)
+          made.family.clear();
+        if (first.extent != desc.extent)
+          made.extent.reset();
+        made.zeroed = made.zeroed && desc.zeroed;
+      }
       return it->second;
+    }
+    madeBy[desc.object] = &desc;
     core::SummaryPath key = core::SummaryPath::result();
     key.index = desc.object;
     core::ObjectId object =
         run.allocationObject(call, pointee, spell(call), key);
-    if (desc.many) {
+    if (desc.many || several.contains(desc.object)) {
       // One object per element (RFC 0015 §5): several runtime objects.
       core::ObjectKey manyKey = run.table().info(object).key;
       manyKey.kind = core::ObjectKind::HeapOld;
diff --git a/lib/Analysis/EngineUnit.cpp b/lib/Analysis/EngineUnit.cpp
index 4e5afcf4..681ac443 100644
--- a/lib/Analysis/EngineUnit.cpp
+++ b/lib/Analysis/EngineUnit.cpp
@@ -95,10 +95,10 @@ namespace engine {
 // UnitRun
 //===----------------------------------------------------------------------===//
 
-/// RFC 0033 §9: the default budget of a unit, in block transfers: a few per
-/// site, so that a unit's analysis costs a bounded multiple of its size.
-static constexpr std::uint64_t MinUnitBudget = 200000;
-static constexpr std::uint64_t UnitBudgetPerSite = 6;
+/// RFC 0033 §9, RFC 0034 §7.1: a unit's default budget of work, a share
+/// per site (its analysis costs a bounded multiple of compiling it).
+static constexpr std::uint64_t MinUnitBudget = 20000000;
+static constexpr std::uint64_t UnitBudgetPerSite = 400;
 
 UnitRun::UnitRun(const EngineInput &engineInput, LedgerAdapter &adapter)
     : input(engineInput), authoritative(adapter),
@@ -652,6 +652,9 @@ void UnitRun::analyzeAll(
       if (functionsLeft > 1)
         --functionsLeft;
       transfersOf[fn->getCanonicalDecl()] = result.transfers;
+      workOf[fn->getCanonicalDecl()] =
+          result.overBudget ? std::numeric_limits<std::uint64_t>::max()
+                            : result.work;
       if (result.overBudget) {
         overBudget.insert(fn->getCanonicalDecl());
         if (report)
diff --git a/lib/Analysis/KindInference.cpp b/lib/Analysis/KindInference.cpp
index ccfdae7a..00744a45 100644
--- a/lib/Analysis/KindInference.cpp
+++ b/lib/Analysis/KindInference.cpp
@@ -1062,6 +1062,10 @@ KindInferenceResult KindInference::infer(KindTable &kinds) {
   result.state =
       std::make_unique<KindInferenceState>(context, library, options, kinds);
   result.state->run();
+  // The CFGs and parent maps of every definition are the run's; the result
+  // outlives it into the object engine's runs, which build their own.
+  result.state->cfgs.clear();
+  result.state->parentMaps.clear();
   return result;
 }
 
diff --git a/lib/Analysis/KindInferenceFields.cpp b/lib/Analysis/KindInferenceFields.cpp
index 93b451cc..5c6f5e6f 100644
--- a/lib/Analysis/KindInferenceFields.cpp
+++ b/lib/Analysis/KindInferenceFields.cpp
@@ -18,6 +18,7 @@
 #include "clang/Basic/SourceManager.h"
 
 #include "llvm/ADT/STLExtras.h"
+#include "llvm/ADT/ScopeExit.h"
 
 #include <cstdint>
 #include <functional>
@@ -283,6 +284,7 @@ void KindInferenceState::collectStoreGroups() {
     }
     if (designators.empty())
       continue;
+    const llvm::scope_exit dropped([&] { cfgs.erase(definition); });
     const FunctionCfg *cfg = cfgOf(*definition);
     if (cfg == nullptr)
       continue;
diff --git a/lib/Analysis/KindInferenceMustAccess.cpp b/lib/Analysis/KindInferenceMustAccess.cpp
index 6a9d39bf..5293b5fd 100644
--- a/lib/Analysis/KindInferenceMustAccess.cpp
+++ b/lib/Analysis/KindInferenceMustAccess.cpp
@@ -26,6 +26,7 @@
 #include "clang/Basic/SourceManager.h"
 
 #include "llvm/ADT/STLExtras.h"
+#include "llvm/ADT/ScopeExit.h"
 #include "llvm/Support/CheckedArithmetic.h"
 
 #include <functional>
@@ -1160,6 +1161,12 @@ void KindInferenceState::inferMustAccess() {
     }
     if (params.empty())
       continue;
+    // (Built for this definition and dropped after it: a unit's every CFG
+    // at once is more than the unit's AST.)
+    const llvm::scope_exit dropped([&] {
+      cfgs.erase(definition);
+      parentMaps.erase(definition);
+    });
     const FunctionCfg *cfg = cfgOf(*definition);
     if (cfg == nullptr)
       continue;
diff --git a/lib/Analysis/LedgerAdapter.cpp b/lib/Analysis/LedgerAdapter.cpp
index 5d4d9229..5cc7059d 100644
--- a/lib/Analysis/LedgerAdapter.cpp
+++ b/lib/Analysis/LedgerAdapter.cpp
@@ -27,7 +27,7 @@ LedgerAdapter::LedgerAdapter(clang::ASTContext &ctx, const SiteIndex &siteIndex,
                              Mode adapterMode)
     : context(ctx), sites(siteIndex), options(std::move(adapterOptions)),
       mode(adapterMode) {
-  if (mode == Mode::Authoritative)
+  if (mode == Mode::Authoritative || mode == Mode::Witness)
     unit.functions = sites.ledgers();
   unit.source = options.source;
   unit.target = options.target;
@@ -100,6 +100,12 @@ void LedgerAdapter::decide(const clang::Stmt &site, core::Facet facet,
                            std::optional<core::UnresolvedReason> unresolved,
                            std::optional<core::TrustReason> trusted,
                            std::string detail) {
+  if (observer)
+    observer(site, facet,
+             core::FacetDecision{.outcome = outcome,
+                                 .unresolved = unresolved,
+                                 .trusted = trusted,
+                                 .detail = detail});
   if (isDiscarding())
     return;
   decideAt(sites.find(site), site, facet,
@@ -113,6 +119,8 @@ void LedgerAdapter::decideAs(const clang::Stmt &site, core::SiteKind kind,
                              std::optional<core::Boundary> boundary,
                              core::Facet facet,
                              const core::FacetDecision &decision) {
+  if (observer)
+    observer(site, facet, decision);
   if (isDiscarding())
     return;
   decideAt(sites.find(site, kind, boundary), site, facet, decision);
@@ -331,7 +339,7 @@ void LedgerAdapter::report(core::Diagnostic diagnostic,
       fresh ? std::nullopt : seen->second;
   if (!fresh && !known)
     return;
-  if (mode == Mode::Collecting) {
+  if (mode == Mode::Collecting || mode == Mode::Witness) {
     emitted.push_back(std::move(diagnostic));
     return;
   }
@@ -364,6 +372,50 @@ void LedgerAdapter::report(core::Diagnostic diagnostic,
   publish(std::move(diagnostic), certainty, id, facet);
 }
 
+void LedgerAdapter::unconfirm(const clang::Stmt &site, core::Facet facet,
+                              std::string_view id) {
+  if (isDiscarding())
+    return;
+  std::optional<core::SiteId> found = sites.find(site);
+  if (!found)
+    found = sites.findExit(site);
+  const auto unresolved =
+      core::FacetDecision::unresolvedFor(core::UnresolvedReason::Unconfirmed);
+  if (found)
+    if (core::FacetRecord *facetRecord = record(*found, facet);
+        facetRecord != nullptr &&
+        facetRecord->outcome() == core::SiteOutcome::Violation) {
+      // (Assigned: a violation outranks every other decision.)
+      facetRecord->decision = unresolved;
+      for (core::Requirement &requirement : facetRecord->requirements)
+        if (requirement.decision.outcome == core::SiteOutcome::Violation)
+          requirement.decision = unresolved;
+    }
+  const clang::SourceManager &sm = context.getSourceManager();
+  const auto inSite = [&](const core::SourceLocation &location) {
+    const clang::SourceLocation at = toClangLocation(location);
+    return at.isValid() &&
+           contains(sm, site.getSourceRange(), sm.getExpansionLoc(at));
+  };
+  for (core::Diagnostic &diagnostic : emitted) {
+    if (diagnostic.id != id || diagnostic.severity != core::Severity::Error ||
+        !inSite(diagnostic.location))
+      continue;
+    diagnostic.severity = core::Severity::Warning;
+    diagnostic.certainty = core::Certainty::Possible;
+    diagnostic.addNote("not confirmed on a feasible path", diagnostic.location);
+    for (core::LedgerDiagnostic &entry : ledgerDiagnostics)
+      if (entry.id == id && entry.location == diagnostic.location &&
+          entry.message == diagnostic.message) {
+        entry.severity = core::Severity::Warning;
+        entry.certainty = core::Certainty::Possible;
+        entry.notes.push_back(
+            core::LedgerNote{.message = "not confirmed on a feasible path",
+                             .location = diagnostic.location});
+      }
+  }
+}
+
 //===----------------------------------------------------------------------===//
 // finish
 //===----------------------------------------------------------------------===//
diff --git a/lib/Core/CheckPlan.cpp b/lib/Core/CheckPlan.cpp
index cbf1c2a3..c2131263 100644
--- a/lib/Core/CheckPlan.cpp
+++ b/lib/Core/CheckPlan.cpp
@@ -214,14 +214,14 @@ std::string_view toString(Form form) noexcept {
     return "function";
   case Form::Result:
     return "result";
-  case Form::Violation:
-    return "violation";
   case Form::Need:
     return "need";
   case Form::String:
     return "string";
   case Form::Length:
     return "length";
+  case Form::Wrapper:
+    return "wrapper";
   }
   return "<invalid>";
 }
@@ -246,8 +246,6 @@ std::string_view toString(Placement placement) noexcept {
 
 std::optional<std::size_t> operandCount(Template kind, Form form,
                                         Placement placement) noexcept {
-  if (form == Form::Violation)
-    return 0;
   switch (kind) {
   case Template::Nonnull:
     if (form == Form::Plain && (placement == Placement::WrapOperand ||
@@ -280,6 +278,8 @@ std::optional<std::size_t> operandCount(Template kind, Form form,
   case Template::Disjoint:
     if (form == Form::Plain && placement == Placement::WrapArgument)
       return 2;
+    if (form == Form::Wrapper && placement == Placement::ReplaceCall)
+      return 0;
     return std::nullopt;
   case Template::Assert:
     if (form == Form::Plain && placement == Placement::ReplaceCall)
@@ -296,6 +296,8 @@ std::optional<std::size_t> operandCount(Template kind, Form form,
       return 0;
     if (form == Form::Length && placement == Placement::WrapArgument)
       return 1;
+    if (form == Form::Wrapper && placement == Placement::ReplaceCall)
+      return 0;
     return std::nullopt;
   case Template::Live:
     if (form == Form::Plain && (placement == Placement::WrapOperand ||
@@ -322,8 +324,6 @@ bool isWellFormed(const CheckPlanEntry &entry) noexcept {
 }
 
 CheckTemplate ledgerTemplate(const CheckPlanEntry &entry) noexcept {
-  if (entry.form == Form::Violation)
-    return CheckTemplate::Violation;
   switch (entry.kind) {
   case Template::Nonnull:
     return CheckTemplate::Nonnull;
@@ -344,13 +344,12 @@ CheckTemplate ledgerTemplate(const CheckPlanEntry &entry) noexcept {
   case Template::Release:
     return CheckTemplate::Release;
   }
-  return CheckTemplate::Violation;
+  return CheckTemplate::Assert;
 }
 
 bool isGuard(const CheckPlanEntry &entry) noexcept {
-  return entry.form != Form::Violation &&
-         (entry.kind == Template::Object || entry.kind == Template::Live ||
-          entry.kind == Template::Release);
+  return entry.kind == Template::Object || entry.kind == Template::Live ||
+         entry.kind == Template::Release;
 }
 
 FacetCheck facetCheck(const CheckPlanEntry &entry) noexcept {
@@ -358,7 +357,7 @@ FacetCheck facetCheck(const CheckPlanEntry &entry) noexcept {
 }
 
 std::string helperName(const CheckPlanEntry &entry) {
-  if (entry.form == Form::Violation)
+  if (entry.form == Form::Wrapper)
     return {};
   std::string name = entry.proven ? "__weavec_prv_" : "__weavec_chk_";
   name += toString(entry.kind);
@@ -382,7 +381,7 @@ std::string helperName(const CheckPlanEntry &entry) {
     name += "_l";
     break;
   case Form::Plain:
-  case Form::Violation:
+  case Form::Wrapper:
     break;
   }
   return name;
diff --git a/lib/Core/Heap.cpp b/lib/Core/Heap.cpp
index 08b8ee97..8fe14420 100644
--- a/lib/Core/Heap.cpp
+++ b/lib/Core/Heap.cpp
@@ -834,14 +834,38 @@ Sym Heap::readElement(HeapState &state, ObjectId object, CellKey key,
       if (cell.isSummary()) {
         ElementIndex element = elementIndex(cell, offset);
         if (!element.at || *element.at)
-          value = mergeWeak(state, value, sym);
+          value = mergeWeak(state, value, asPointer(state, sym, hint));
       }
   }
   for (Sym sym : possible)
-    value = mergePossible(state, value, sym);
+    value = mergePossible(state, value, asPointer(state, sym, hint));
   return value;
 }
 
+Sym Heap::asPointer(HeapState &state, Sym sym, const SymInfo &hint) const {
+  // A cell of another kind that may be the one a pointer is read from (an
+  // integer member that an element's unbounded index may reach, or that a
+  // loop folded into the element ranges) is read through a cast (§4.2):
+  // any object, so the pointer keeps its own targets beside it (RFC 0034
+  // §6.3, a release in a loop left early).
+  const SymInfo &value = info(state, sym);
+  if (hint.type != SymInfo::Type::Pointer ||
+      (value.type != SymInfo::Type::Int &&
+       value.type != SymInfo::Type::Unknown))
+    return sym;
+  ObjectInfo unknown;
+  unknown.singular = false;
+  unknown.name = "an unknown object";
+  ObjectId any = table.intern(ObjectKey{.kind = ObjectKind::Unknown}, unknown);
+  ensure(state, any);
+  SymInfo cast;
+  cast.type = SymInfo::Type::Pointer;
+  cast.targets = {Target{.object = any}};
+  cast.null = PointerNull::Maybe;
+  cast.rawCast = true;
+  return fresh(state, std::move(cast));
+}
+
 Sym Heap::anyElement(HeapState &state, ObjectId object, CellKey key,
                      const SymInfo &hint) const {
   Sym value = oracle.unwritten(state, object, key, hint);
@@ -862,7 +886,7 @@ Sym Heap::anyElement(HeapState &state, ObjectId object, CellKey key,
         members.push_back(segment.value);
   }
   for (Sym sym : members)
-    value = mergeWeak(state, value, sym);
+    value = mergeWeak(state, value, asPointer(state, sym, hint));
   return value;
 }
 
@@ -1837,12 +1861,14 @@ SpatialVerdict Heap::spatialAt(const HeapState &state, Sym pointer,
 // Releases
 //===----------------------------------------------------------------------===//
 
-void Heap::release(HeapState &state, Sym pointer,
-                   const ReleaseRecord &record) const {
+void Heap::release(HeapState &state, Sym pointer, const ReleaseRecord &record,
+                   bool possibly) const {
   SymInfo &value = infoMut(state, pointer);
   value.release = record;
+  if (possibly)
+    value.release->allPaths = false;
   std::vector<Target> targets = value.targets;
-  bool single = targets.size() == 1 && !value.top;
+  bool single = targets.size() == 1 && !value.top && !possibly;
   for (const Target &target : targets) {
     ObjectState &object = state.objects.at(target.object);
     bool strong = single && table.info(target.object).singular;
@@ -2278,6 +2304,37 @@ void Heap::collect(HeapState &state, const std::vector<ObjectId> &roots,
 // Join and widening (§4.8)
 //===----------------------------------------------------------------------===//
 
+/// Whether `sym` (with attributes `info`) is known in `state` not to equal
+/// `c`: an excluded constant, or a zone bound that leaves it out.
+static bool excludes(const HeapState &state, Sym sym, const SymInfo &info,
+                     std::int64_t c) {
+  if ((c == 0 && info.nonZero) || std::ranges::binary_search(info.excluded, c))
+    return true;
+  auto lo = state.zone.lower(sym);
+  auto hi = state.zone.upper(sym);
+  return (lo && *lo > c) || (hi && *hi < c);
+}
+
+/// RFC 0034 §6.2: the constants a joined value is known not to equal are
+/// those both sides exclude (by their own sets or their zone bounds).
+static std::vector<std::int64_t> joinExcluded(const HeapState &left, Sym a,
+                                              const SymInfo &aInfo,
+                                              const HeapState &right, Sym b,
+                                              const SymInfo &bInfo) {
+  std::vector<std::int64_t> out;
+  for (std::int64_t c : aInfo.excluded)
+    if (excludes(right, b, bInfo, c))
+      out.push_back(c);
+  for (std::int64_t c : bInfo.excluded)
+    if (!std::ranges::binary_search(aInfo.excluded, c) &&
+        excludes(left, a, aInfo, c))
+      out.push_back(c);
+  std::ranges::sort(out);
+  if (out.size() > MaxExcluded)
+    out.resize(MaxExcluded);
+  return out;
+}
+
 namespace {
 /// The pairing of two states' symbols into result symbols.
 class Pairing {
@@ -2469,6 +2526,9 @@ class Pairing {
     if (joined.type == SymInfo::Type::Int) {
       joined.intType = a->intType ? a->intType : b->intType;
       joined.nonZero = a->nonZero && b->nonZero;
+      // (Nothing to do, the common case, when neither side excludes one.)
+      if (!a->excluded.empty() || !b->excluded.empty())
+        joined.excluded = joinExcluded(left, p.left, *a, right, p.right, *b);
       joined.ctype = a->ctype == b->ctype ? a->ctype : 0;
       // §4.4: intervals beyond the zone join as their hull; a widening
       // forgets one that grew (the type's range).
diff --git a/lib/Core/Ledger.cpp b/lib/Core/Ledger.cpp
index baedbfff..4725aaa1 100644
--- a/lib/Core/Ledger.cpp
+++ b/lib/Core/Ledger.cpp
@@ -43,7 +43,9 @@ static constexpr std::array<UnresolvedReason, UnresolvedReasonCount>
                          UnresolvedReason::RawCast,
                          UnresolvedReason::DanglingEscape,
                          UnresolvedReason::SecondOwner,
-                         UnresolvedReason::NoZeroInit};
+                         UnresolvedReason::NoZeroInit,
+                         UnresolvedReason::Unconfirmed,
+                         UnresolvedReason::Lowered};
 
 static constexpr std::array<TrustReason, TrustReasonCount> AllTrustReasons{
     TrustReason::Unsafe,         TrustReason::SystemApi,
@@ -169,6 +171,10 @@ std::string_view toString(UnresolvedReason reason) noexcept {
     return "second-owner";
   case UnresolvedReason::NoZeroInit:
     return "no-zero-init";
+  case UnresolvedReason::Unconfirmed:
+    return "unconfirmed";
+  case UnresolvedReason::Lowered:
+    return "lowered";
   }
   return "<invalid>";
 }
@@ -249,8 +255,6 @@ std::string_view toString(CheckTemplate kind) noexcept {
     return "disjoint";
   case CheckTemplate::Assert:
     return "assert";
-  case CheckTemplate::Violation:
-    return "violation";
   case CheckTemplate::Object:
     return "object";
   case CheckTemplate::Live:
@@ -368,8 +372,7 @@ std::optional<CheckTemplate> parseCheckTemplate(std::string_view text) {
       std::array<CheckTemplate, CheckTemplateCount>{
           CheckTemplate::Nonnull, CheckTemplate::Index, CheckTemplate::Span,
           CheckTemplate::Len, CheckTemplate::Disjoint, CheckTemplate::Assert,
-          CheckTemplate::Violation, CheckTemplate::Object, CheckTemplate::Live,
-          CheckTemplate::Release},
+          CheckTemplate::Object, CheckTemplate::Live, CheckTemplate::Release},
       text);
 }
 
@@ -437,6 +440,10 @@ std::string_view phraseTemplate(UnresolvedReason reason) noexcept {
     return "'<a>' and '<b>' may own the same object here";
   case UnresolvedReason::NoZeroInit:
     return "'<p>' may be uninitialised";
+  case UnresolvedReason::Unconfirmed:
+    return "the finding was not confirmed on a feasible path";
+  case UnresolvedReason::Lowered:
+    return "the violation was lowered and nothing checks it";
   }
   return "<invalid>";
 }
@@ -494,6 +501,10 @@ std::string reasonPhrase(UnresolvedReason reason,
            " may own the same object here";
   case UnresolvedReason::NoZeroInit:
     return pointer + " may be uninitialised";
+  case UnresolvedReason::Unconfirmed:
+    return "the finding was not confirmed on a feasible path";
+  case UnresolvedReason::Lowered:
+    return "the violation was lowered and nothing checks it";
   }
   return "<invalid>";
 }
diff --git a/lib/Core/LibrarySpec.cpp b/lib/Core/LibrarySpec.cpp
index 7b03f500..ccd59b07 100644
--- a/lib/Core/LibrarySpec.cpp
+++ b/lib/Core/LibrarySpec.cpp
@@ -248,6 +248,32 @@ bool LibraryEntry::hasCallback() const noexcept {
       params, [](const LibraryParam &p) { return p.callback.has_value(); });
 }
 
+bool LibraryEntry::usesValueOnly(unsigned index) const noexcept {
+  const LibraryParam *p = param(index);
+  if (p == nullptr || p->type != LibraryParam::Type::Pointer ||
+      p->access != LibraryParam::Access::None || p->bytes || p->count ||
+      p->string || p->effect != LibraryParam::Effect::Borrow || p->callback ||
+      p->out)
+    return false;
+  const auto names = [index](unsigned argument) { return argument == index; };
+  for (const LibraryParam &other : params)
+    if (other.callback && std::ranges::any_of(other.callback->arguments, names))
+      return false;
+  return std::ranges::none_of(disjoint,
+                              [&](const LibDisjoint &d) {
+                                return names(d.first) || names(d.second);
+                              }) &&
+         std::ranges::none_of(
+             copies,
+             [&](const LibCopy &c) { return names(c.dst) || names(c.src); }) &&
+         std::ranges::none_of(fills,
+                              [&](const LibFill &f) { return names(f.dst); }) &&
+         std::ranges::none_of(
+             writesString,
+             [&](const LibStringWrite &w) { return names(w.dst); }) &&
+         (!format || !names(format->format));
+}
+
 bool LibraryEntry::knownToReturn() const noexcept {
   return !noreturn && !exits;
 }
@@ -481,6 +507,8 @@ static std::string paramText(const LibraryParam &param) {
   else if (param.null == LibraryParam::Null::AllowedIfZero && param.zeroTerm)
     text += ":null-if-zero(" + param.zeroTerm->str() + ")";
   text += effectText(param);
+  if (param.range)
+    text += ":range(" + param.range->str() + ")";
   if (param.callback)
     text += ":" + callbackText(*param.callback);
   if (param.out)
@@ -520,6 +548,10 @@ std::string LibraryEntry::str() const {
     text += std::to_string(format->format) + "," +
             std::to_string(format->first) + ")";
   }
+  if (wrapper)
+    text += " wrapper(" + wrapper->name + (wrapper->room ? ",room" : "") +
+            (wrapper->source ? ",source" : "") +
+            (wrapper->disjoint ? ",disjoint" : "") + ")";
   for (const LibraryChk &alias : chk) {
     text += " chk(" + alias.name + ":";
     for (std::size_t i = 0; i < alias.argumentOf.size(); ++i)
@@ -1067,6 +1099,11 @@ bool LibrarySpecParser::parseParamFlag(LibraryParam &param,
       return false;
     param.null = LibraryParam::Null::AllowedIfZero;
     param.zeroTerm = std::move(*term);
+  } else if (flag == "range") {
+    auto term = parenthesisedTerm(flag);
+    if (!term)
+      return false;
+    param.range = std::move(*term);
   } else if (flag == "escape") {
     param.effect = Effect::Escape;
   } else if (effect) {
@@ -1319,6 +1356,32 @@ bool LibrarySpecParser::parseClause(LibraryEntry &entry,
                                              : LibFormat::Kind::Scanf,
                   .format = *format,
                   .first = *first};
+  } else if (clause == "wrapper") {
+    if (entry.wrapper)
+      return fail("duplicate clause 'wrapper'");
+    if (!expect('(', "after 'wrapper'"))
+      return false;
+    auto wrapped = name("a wrapper name");
+    if (!wrapped)
+      return false;
+    LibWrapper wrapper{.name = std::move(*wrapped)};
+    while (accept(',')) {
+      const std::string what = word();
+      bool *flag = nullptr;
+      if (what == "room")
+        flag = &wrapper.room;
+      else if (what == "source")
+        flag = &wrapper.source;
+      else if (what == "disjoint")
+        flag = &wrapper.disjoint;
+      if (flag == nullptr || *flag)
+        return fail("expected 'room', 'source' or 'disjoint', once each, in "
+                    "'wrapper(…)'");
+      *flag = true;
+    }
+    if (!expect(')', "after 'wrapper(…'"))
+      return false;
+    entry.wrapper = std::move(wrapper);
   } else if (clause == "chk") {
     if (!expect('(', "after 'chk'"))
       return false;
@@ -1524,9 +1587,12 @@ bool LibrarySpecParser::validateEntry(LibraryEntry &entry) {
   for (std::size_t i = 0; i < count; ++i) {
     const LibraryParam &param = entry.params[i];
     const std::string where = "parameter " + std::to_string(i);
-    for (const auto *term : {&param.bytes, &param.count, &param.zeroTerm})
+    for (const auto *term :
+         {&param.bytes, &param.count, &param.zeroTerm, &param.range})
       if (*term && !validateTerm(entry, **term, where))
         return false;
+    if (param.range && param.effect != LibraryParam::Effect::Release)
+      return fail(where + ": 'range' needs 'release'");
     if (param.string && param.access != LibraryParam::Access::Read &&
         param.access != LibraryParam::Access::ReadWrite)
       return fail(where + ": 'str' needs read access ('r' or 'rw')");
@@ -1545,6 +1611,14 @@ bool LibrarySpecParser::validateEntry(LibraryEntry &entry) {
     return fail("'exits' needs a 'noreturn' result");
   if (entry.returnsTwice && entry.result.kind != LibraryResult::Kind::Int)
     return fail("'returns-twice' needs an 'int' result");
+  if (entry.wrapper && entry.wrapper->disjoint && entry.disjoint.empty())
+    return fail("'wrapper(…, disjoint)' needs a 'disjoint' clause");
+  if (entry.wrapper && entry.wrapper->room &&
+      (!isPointer(0) || !entry.params[0].bytes))
+    return fail("'wrapper(…, room)' needs bytes behind argument 0");
+  if (entry.wrapper && entry.wrapper->source &&
+      (entry.params.size() < 2 || !isPointer(1) || !entry.params[1].bytes))
+    return fail("'wrapper(…, source)' needs bytes behind argument 1");
   for (const LibDisjoint &disjoint : entry.disjoint) {
     if (!isPointer(disjoint.first) || !isPointer(disjoint.second) ||
         disjoint.first == disjoint.second)
diff --git a/lib/Core/LibrarySpec.txt b/lib/Core/LibrarySpec.txt
index ad93f3ca..0e07fd6c 100644
--- a/lib/Core/LibrarySpec.txt
+++ b/lib/Core/LibrarySpec.txt
@@ -39,6 +39,7 @@
 #   access   ::= 'r' | 'w' | 'rw' | 'none'
 #   pflag    ::= 'bytes(' term ')' | 'count(' term ')'+ | 'str' | 'null-ok'
 #              | 'null-if-zero(' term ')' | 'release(' FAMILY ')'
+#              | 'range(' term ')'+
 #              | 'realloc(' FAMILY ')' | 'retain(' STATE ')' | 'escape'
 #              | 'init(' FAMILY ')'+ | 'fini(' FAMILY ')'+
 #              | 'out(' value ')'+ | callback+
@@ -60,6 +61,7 @@
 #              | 'invalidates(' STATE ')' | 'reads(' STATE ')' | 'exits'
 #              | 'returns-twice' | 'printf(' INT ',' INT ')'
 #              | 'scanf(' INT ',' INT ')' | 'chk(' NAME ':' INT { ',' INT } ')'
+#              | 'wrapper(' NAME { ',' ( 'room' | 'source' | 'disjoint' ) } ')'+
 #   term     ::= INT | 'a' N | 'strlen(a' N ')' | 'fmtlen(a' N ')' | MACRO+
 #              | term '*' term | term '+' term | term '-' INT
 #              | term '/' INT+
@@ -79,6 +81,10 @@
 #   null-ok          null is allowed. null-if-zero(t): allowed when t is zero
 #                    (section 8.3). Otherwise null is forbidden.
 #   release(F)       the call releases the pointer, of release family F.
+#   range(t)+        (with release) the call releases the t bytes from the
+#                    pointer (munmap): the object only when they cover it
+#                    from its start, possibly otherwise, and the pointer may
+#                    point anywhere in it (RFC 0034 section 6.3).
 #   realloc(F)       as realloc: released on a non-null result; on a null
 #                    result kept, or released when the result's extent (the
 #                    requested size) is zero; kept when there is no extent.
@@ -166,6 +172,19 @@
 #   printf(f,v), scanf(f,v)
 #                    argument f is the format; v is the first variadic
 #                    argument, or the va_list parameter of a v- function.
+#   wrapper(N, W...)+
+#                    RFC 0034 section 5.2: the prelude's checked wrapper
+#                    __weavec_chk_N may replace the call when a requirement
+#                    it computes has no check or guard of its own (no term
+#                    states it at the site, or a guard would check only a
+#                    lower bound, as for a format's output). It takes the
+#                    row's arguments, then a fortified alias's object size,
+#                    and computes at run time: 'room', the bytes argument 0
+#                    needs, against the room left in the tracked object it
+#                    points into (a format row writes through the bounded
+#                    writer instead and fails when the output did not fit);
+#                    'source', the bytes argument 1 needs (a copy's);
+#                    'disjoint', the row's disjoint clause.
 #   chk(A: i0, i1, ...)
 #                    A is an alias of the entry (a fortified form): its k-th
 #                    argument is the entry's argument i_k, or dropped (-1).
@@ -506,9 +525,10 @@ backtrace_symbols_fd (r:count(a1), int, int) -> void;
 header string.h;
 memcpy (w:bytes(a2):null-if-zero(a2), r:bytes(a2):null-if-zero(a2), int) \
     -> arg(0) disjoint(0,1,a2) copies(0,1,a2) \
+    wrapper(memcpy,room,source,disjoint) \
     chk(__builtin___memcpy_chk: 0,1,2,-1) chk(__memcpy_chk: 0,1,2,-1);
 memmove (w:bytes(a2):null-if-zero(a2), r:bytes(a2):null-if-zero(a2), int) \
-    -> arg(0) copies(0,1,a2) \
+    -> arg(0) copies(0,1,a2) wrapper(memmove,room,source) \
     chk(__builtin___memmove_chk: 0,1,2,-1) chk(__memmove_chk: 0,1,2,-1);
 memset (w:bytes(a2):null-if-zero(a2), int, int) -> arg(0) fills(0,a1,a2) \
     chk(__builtin___memset_chk: 0,1,2,-1) chk(__memset_chk: 0,1,2,-1);
@@ -537,6 +557,7 @@ memccpy (w:bytes(min(a3,strlen(a1)+1)):null-if-zero(a3), \
     chk(__builtin___memccpy_chk: 0,1,2,3,-1);
 strcpy (w:bytes(strlen(a1)+1), r:str) -> arg(0) \
     disjoint(0,1,strlen(a1)+1) writes-str(0,strlen(a1)) \
+    wrapper(strcpy,room,disjoint) \
     chk(__builtin___strcpy_chk: 0,1,-1) chk(__strcpy_chk: 0,1,-1);
 strncpy (w:bytes(a2):null-if-zero(a2), \
     r:bytes(min(a2,strlen(a1)+1)):null-if-zero(a2), int) -> arg(0) \
@@ -545,6 +566,7 @@ strncpy (w:bytes(a2):null-if-zero(a2), \
 stpcpy (w:bytes(strlen(a1)+1), r:str) -> \
     interior(0):offset(strlen(a1)):nonnull \
     disjoint(0,1,strlen(a1)+1) writes-str(0,strlen(a1)) \
+    wrapper(stpcpy,room,disjoint) \
     chk(__builtin___stpcpy_chk: 0,1,-1) chk(__stpcpy_chk: 0,1,-1);
 stpncpy (w:bytes(a2):null-if-zero(a2), \
     r:bytes(min(a2,strlen(a1)+1)):null-if-zero(a2), int) \
@@ -553,7 +575,7 @@ stpncpy (w:bytes(a2):null-if-zero(a2), \
     chk(__builtin___stpncpy_chk: 0,1,2,-1) chk(__stpncpy_chk: 0,1,2,-1);
 strcat (rw:bytes(strlen(a0)+strlen(a1)+1):str, r:str) -> arg(0) \
     disjoint(0,1,strlen(a0)+strlen(a1)+1) \
-    writes-str(0,strlen(a0)+strlen(a1)) \
+    writes-str(0,strlen(a0)+strlen(a1)) wrapper(strcat,room) \
     chk(__builtin___strcat_chk: 0,1,-1) chk(__strcat_chk: 0,1,-1);
 strncat (rw:bytes(strlen(a0)+min(a2,strlen(a1))+1):str, \
     r:bytes(min(a2,strlen(a1)+1)):null-if-zero(a2), int) -> arg(0) \
@@ -689,7 +711,7 @@ fprintf (rw, r:str, ...) -> int printf(1,2) \
     chk(__builtin___fprintf_chk: 0,-1,1,2) chk(__fprintf_chk: 0,-1,1,2);
 dprintf (int, r:str, ...) -> int printf(1,2) chk(__dprintf_chk: 0,-1,1,2);
 sprintf (w:bytes(fmtlen(a1)+1), r:str, ...) -> int:value(fmtlen(a1)) \
-    writes-str(0,fmtlen(a1)) printf(1,2) \
+    writes-str(0,fmtlen(a1)) printf(1,2) wrapper(sprintf,room) \
     chk(__builtin___sprintf_chk: 0,-1,-1,1,2) chk(__sprintf_chk: 0,-1,-1,1,2);
 snprintf (w:bytes(a1):null-if-zero(a1), int, r:str, ...) \
     -> int:value(fmtlen(a2)) writes-str(0,min(a1-1,fmtlen(a2))) printf(2,3) \
@@ -701,7 +723,7 @@ vfprintf (rw, r:str, other) -> int printf(1,2) \
     chk(__builtin___vfprintf_chk: 0,-1,1,2) chk(__vfprintf_chk: 0,-1,1,2);
 vdprintf (int, r:str, other) -> int printf(1,2) chk(__vdprintf_chk: 0,-1,1,2);
 vsprintf (w:bytes(fmtlen(a1)+1), r:str, other) -> int:value(fmtlen(a1)) \
-    writes-str(0,fmtlen(a1)) printf(1,2) \
+    writes-str(0,fmtlen(a1)) printf(1,2) wrapper(vsprintf,room) \
     chk(__builtin___vsprintf_chk: 0,-1,-1,1,2) \
     chk(__vsprintf_chk: 0,-1,-1,1,2);
 vsnprintf (w:bytes(a1):null-if-zero(a1), int, r:str, other) \
@@ -1016,7 +1038,8 @@ header sys/mman.h;
 # mmap fails with MAP_FAILED, not null.
 mmap (none:null-ok, int, int, int, int, int) -> \
     fresh(munmap):extent(a1):nonnull;
-munmap (none:null-ok:release(munmap), int) -> int;
+# munmap may unmap part of a mapping (a guard page): RFC 0034 section 6.3.
+munmap (none:null-ok:release(munmap):range(a1), int) -> int;
 mprotect (none:null-ok, int, int) -> int;
 msync (none:null-ok, int, int) -> int;
 madvise (none:null-ok, int, int) -> int;
diff --git a/lib/Frontend/CMakeLists.txt b/lib/Frontend/CMakeLists.txt
index 46184a6e..03f09c55 100644
--- a/lib/Frontend/CMakeLists.txt
+++ b/lib/Frontend/CMakeLists.txt
@@ -9,6 +9,9 @@ weavec_add_library(
           DispatchEdges.cpp
           Driver.cpp
           FrontendAction.cpp
+          # RFC 0034 §1: the guards the backend canonicalises, merges and
+          # expands.
+          GuardPasses.cpp
           Prelude.cpp
           ProgramAnalysis.cpp
           ResourceDir.cpp
diff --git a/lib/Frontend/CheckEmitter.cpp b/lib/Frontend/CheckEmitter.cpp
index cc4adc0f..b9e807ca 100644
--- a/lib/Frontend/CheckEmitter.cpp
+++ b/lib/Frontend/CheckEmitter.cpp
@@ -65,6 +65,7 @@ static Node *mutableNode(const Node *node) {
 namespace {
 constexpr HelperType V = HelperType::Void;
 constexpr HelperType I = HelperType::Int;
+constexpr HelperType U = HelperType::Unsigned;
 constexpr HelperType LL = HelperType::LongLong;
 constexpr HelperType ULL = HelperType::UnsignedLongLong;
 constexpr HelperType Z = HelperType::Size;
@@ -74,16 +75,16 @@ constexpr HelperType CP = HelperType::CharPointer;
 constexpr HelperType CCP = HelperType::ConstCharPointer;
 constexpr HelperType CPP = HelperType::CharPointerPointer;
 constexpr HelperType VPP = HelperType::VoidPointerPointer;
-constexpr HelperType ULLP = HelperType::UnsignedLongLongPointer;
 constexpr HelperType FP = HelperType::FunctionPointer;
 constexpr HelperType AA = HelperType::AlignedAllocator;
 constexpr HelperType PM = HelperType::PosixMemalignFunction;
+constexpr HelperType VA = HelperType::VaList;
 } // namespace
 
 // The check templates of both families, then the helpers only
 // `__weavec_chk_*` has, the term helpers and the zero-initialisation
 // wrappers. `reports`: report mode appends (file, line, column).
-static constexpr std::array<HelperSignature, 66> Helpers{{
+static constexpr std::array<HelperSignature, 70> Helpers{{
     {.name = "__weavec_chk_nonnull",
      .result = VP,
      .params = {CVP},
@@ -156,15 +157,12 @@ static constexpr std::array<HelperSignature, 66> Helpers{{
      .result = V,
      .params = {I},
      .reports = true},
-    {.name = "__weavec_chk_violation",
-     .result = V,
-     .params = {},
-     .reports = true},
     // RFC 0032 §3: the guards, in both families.
     {.name = "__weavec_chk_object",
      .result = VP,
      .params = {CVP, LL, ULL, ULL, ULL},
-     .reports = true},
+     .reports = true,
+     .declared = true},
     {.name = "__weavec_chk_object_n",
      .result = VP,
      .params = {CVP, ULL},
@@ -181,33 +179,17 @@ static constexpr std::array<HelperSignature, 66> Helpers{{
     {.name = "__weavec_chk_live",
      .result = VP,
      .params = {CVP},
-     .reports = true},
+     .reports = true,
+     .declared = true},
     {.name = "__weavec_chk_release",
      .result = VP,
      .params = {CVP},
      .reports = true},
-    // RFC 0032 §13: the same with a range cache in the caller's frame.
-    {.name = "__weavec_chk_object_c",
-     .result = VP,
-     .params = {CVP, LL, ULL, ULL, ULL, ULLP, I},
-     .reports = true},
-    {.name = "__weavec_chk_live_c",
-     .result = VP,
-     .params = {CVP, ULLP, I},
-     .reports = true},
-    {.name = "__weavec_range_check", .result = V, .params = {ULLP}},
-    {.name = "__weavec_prv_object_c",
-     .result = VP,
-     .params = {CVP, LL, ULL, ULL, ULL, ULLP, I},
-     .reports = true},
-    {.name = "__weavec_prv_live_c",
-     .result = VP,
-     .params = {CVP, ULLP, I},
-     .reports = true},
     {.name = "__weavec_prv_object",
      .result = VP,
      .params = {CVP, LL, ULL, ULL, ULL},
-     .reports = true},
+     .reports = true,
+     .declared = true},
     {.name = "__weavec_prv_object_n",
      .result = VP,
      .params = {CVP, ULL},
@@ -223,11 +205,50 @@ static constexpr std::array<HelperSignature, 66> Helpers{{
     {.name = "__weavec_prv_live",
      .result = VP,
      .params = {CVP},
-     .reports = true},
+     .reports = true,
+     .declared = true},
     {.name = "__weavec_prv_release",
      .result = VP,
      .params = {CVP},
      .reports = true},
+    // RFC 0034 §5.2: the checked wrappers. After the row's arguments, a
+    // fortified alias's object size and the checks planned.
+    {.name = "__weavec_chk_strcpy",
+     .result = CP,
+     .params = {CP, CCP, ULL, U},
+     .reports = true,
+     .wrapper = true},
+    {.name = "__weavec_chk_stpcpy",
+     .result = CP,
+     .params = {CP, CCP, ULL, U},
+     .reports = true,
+     .wrapper = true},
+    {.name = "__weavec_chk_strcat",
+     .result = CP,
+     .params = {CP, CCP, ULL, U},
+     .reports = true,
+     .wrapper = true},
+    {.name = "__weavec_chk_memcpy",
+     .result = VP,
+     .params = {VP, CVP, Z, ULL, U},
+     .reports = true,
+     .wrapper = true},
+    {.name = "__weavec_chk_memmove",
+     .result = VP,
+     .params = {VP, CVP, Z, ULL, U},
+     .reports = true,
+     .wrapper = true},
+    {.name = "__weavec_chk_vsprintf",
+     .result = I,
+     .params = {CP, CCP, VA, ULL, U},
+     .reports = true,
+     .wrapper = true},
+    {.name = "__weavec_chk_sprintf",
+     .result = I,
+     .params = {CP, CCP, ULL, U},
+     .reports = true,
+     .wrapper = true,
+     .variadic = true},
     // RFC 0032 §4.2, §6: the stack-object helpers and a guard's string need.
     {.name = "__weavec_obj_strlen", .result = ULL, .params = {CCP}},
     {.name = "__weavec_stack_enter", .result = VP, .params = {VP, Z, I}},
@@ -239,12 +260,15 @@ static constexpr std::array<HelperSignature, 66> Helpers{{
      .reports = true},
     {.name = "__weavec_need_s", .result = ULL, .params = {LL}},
     {.name = "__weavec_have_s", .result = ULL, .params = {LL}},
-    {.name = "__weavec_need_add", .result = ULL, .params = {ULL, ULL}},
-    {.name = "__weavec_need_sub", .result = ULL, .params = {ULL, ULL}},
-    {.name = "__weavec_need_mul", .result = ULL, .params = {ULL, ULL}},
-    {.name = "__weavec_have_add", .result = ULL, .params = {ULL, ULL}},
-    {.name = "__weavec_have_sub", .result = ULL, .params = {ULL, ULL}},
-    {.name = "__weavec_have_mul", .result = ULL, .params = {ULL, ULL}},
+    {.name = "__weavec_term_u", .result = LL, .params = {ULL}},
+    {.name = "__weavec_need_add", .result = LL, .params = {LL, LL}},
+    {.name = "__weavec_need_sub", .result = LL, .params = {LL, LL}},
+    {.name = "__weavec_need_mul", .result = LL, .params = {LL, LL}},
+    {.name = "__weavec_need_div", .result = LL, .params = {LL, LL}},
+    {.name = "__weavec_have_add", .result = LL, .params = {LL, LL}},
+    {.name = "__weavec_have_sub", .result = LL, .params = {LL, LL}},
+    {.name = "__weavec_have_mul", .result = LL, .params = {LL, LL}},
+    {.name = "__weavec_have_div", .result = LL, .params = {LL, LL}},
     {.name = "__weavec_zero_tail", .result = VP, .params = {VP, Z}},
     {.name = "__weavec_malloc_zero", .result = VP, .params = {Z}},
     {.name = "__weavec_calloc_zero", .result = VP, .params = {Z, Z}},
@@ -285,8 +309,10 @@ const HelperSignature *findHelperSignature(llvm::StringRef name) {
 // NOLINTNEXTLINE(misc-const-correctness)
 static clang::QualType prototype(clang::ASTContext &context,
                                  clang::QualType result,
-                                 llvm::ArrayRef<clang::QualType> params) {
-  const clang::FunctionProtoType::ExtProtoInfo info;
+                                 llvm::ArrayRef<clang::QualType> params,
+                                 bool variadic = false) {
+  clang::FunctionProtoType::ExtProtoInfo info;
+  info.Variadic = variadic;
   return context.getFunctionType(result, params, info);
 }
 
@@ -318,8 +344,6 @@ static clang::QualType typeOf(clang::ASTContext &context, HelperType type) {
     return context.getPointerType(context.getPointerType(context.CharTy));
   case HelperType::VoidPointerPointer:
     return context.getPointerType(context.VoidPtrTy);
-  case HelperType::UnsignedLongLongPointer:
-    return context.getPointerType(context.UnsignedLongLongTy);
   case HelperType::FunctionPointer:
     return context.getPointerType(prototype(context, context.VoidTy, {}));
   case HelperType::AlignedAllocator: {
@@ -333,6 +357,9 @@ static clang::QualType typeOf(clang::ASTContext &context, HelperType type) {
         prototype(context, context.IntTy,
                   {context.getPointerType(context.VoidPtrTy), size, size}));
   }
+  case HelperType::VaList:
+    // As a parameter: an array `va_list` decays.
+    return context.getAdjustedParameterType(context.getBuiltinVaListType());
   }
   return context.VoidTy;
 }
@@ -350,7 +377,8 @@ clang::QualType helperFunctionType(clang::ASTContext &context,
     params.push_back(context.UnsignedIntTy);
     params.push_back(context.UnsignedIntTy);
   }
-  return prototype(context, typeOf(context, helper.result), params);
+  return prototype(context, typeOf(context, helper.result), params,
+                   helper.variadic);
 }
 
 //===----------------------------------------------------------------------===//
@@ -373,13 +401,10 @@ struct SiteContext {
   core::SourceLocation where;
   /// The site's text, for the internal error.
   std::string text;
-  /// RFC 0032 §13: the function's range cache and the site's entry in it;
-  /// null when the site's guards are not cached.
-  clang::VarDecl *cache = nullptr;
-  unsigned cacheEntry = 0;
-  /// The site is in a loop that calls nothing, which validates the entry
-  /// on the way in.
-  bool cacheQuiet = false;
+  /// RFC 0034 §5.2: the checks the call's wrapper makes (1 the room behind
+  /// the destination, 2 disjointness), and whether it replaced the call.
+  unsigned wrapperChecks = 0;
+  bool wrapped = false;
 };
 
 } // namespace
@@ -408,8 +433,6 @@ static int phase(const Entry &entry) {
 }
 
 static int nesting(const Entry &entry) {
-  if (entry.form == Entry::Form::Violation)
-    return 4;
   switch (entry.kind) {
   case Entry::Template::Nonnull:
     return 0;
@@ -510,17 +533,24 @@ class CheckEmitter::Impl {
                        clang::SourceLocation loc);
   clang::Expr *castTo(clang::Expr *expr, clang::QualType type,
                       clang::CastKind kind);
-  /// A call of the helper `name`; `site` adds report mode's location.
+  /// A call of the helper `name`; `site` adds report mode's location, and
+  /// `variadic` follows it.
   clang::ExprResult callHelper(llvm::StringRef name,
                                llvm::MutableArrayRef<clang::Expr *> args,
                                clang::SourceLocation loc,
-                               const SiteContext *site);
+                               const SiteContext *site,
+                               llvm::ArrayRef<clang::Expr *> variadic = {});
   clang::ExprResult comma(clang::Expr *lhs, clang::Expr *rhs,
                           clang::SourceLocation loc);
 
   /// §10.2: an extra operand of a check, as C.
   clang::Expr *term(const core::CheckTerm &term, Direction direction,
                     const SiteContext &site);
+  /// A term inside arithmetic: its exact value as `long long`, which
+  /// saturates only on overflow (to LLONG_MAX as a need, LLONG_MIN as a
+  /// have, and stays there).
+  clang::Expr *exact(const core::CheckTerm &term, Direction direction,
+                     const SiteContext &site);
   clang::Expr *pointerTerm(const core::CheckTerm &term,
                            const SiteContext &site);
   clang::Expr *placeLvalue(const core::CheckTerm &term,
@@ -540,6 +570,8 @@ class CheckEmitter::Impl {
   bool replaceAccess(const Entry &entry, SiteContext &site);
   bool beforeCall(const Entry &entry, SiteContext &site);
   bool replaceCall(const Entry &entry, SiteContext &site);
+  /// RFC 0034 §5.2: the call becomes a call of its row's checked wrapper.
+  bool wrapCall(clang::CallExpr *call, SiteContext &site);
 
   //--- Zero-initialisation ----------------------------------------------------
 
@@ -549,36 +581,6 @@ class CheckEmitter::Impl {
   clang::Expr *rebuild(const clang::Expr *expr, clang::SourceLocation loc,
                        unsigned depth = 0);
 
-  //--- Range caches (RFC 0032 §13) --------------------------------------------
-
-  /// The cache of each function that has one, and the entry of each of its
-  /// guarded sites.
-  struct FunctionCache {
-    clang::VarDecl *variable = nullptr;
-    llvm::DenseMap<const analysis::SiteInfo *, unsigned> entries;
-    /// The sites in a quiet loop, and the entries each such loop (the
-    /// outermost one) validates on the way in.
-    llvm::DenseSet<const analysis::SiteInfo *> quiet;
-    std::vector<std::pair<clang::Stmt *, std::vector<unsigned>>> loops;
-  };
-  /// Whether `loop` calls nothing and is entered only at its top.
-  bool isQuietLoop(const clang::Stmt *loop);
-  llvm::DenseMap<const clang::Stmt *, bool> quietLoops;
-  /// `__weavec_range_check(&cache[4 * entry])` for each of `entries`.
-  clang::Expr *validateEntries(clang::VarDecl *cache,
-                               llvm::ArrayRef<unsigned> entries,
-                               clang::SourceLocation loc);
-  llvm::DenseMap<const clang::FunctionDecl *, FunctionCache> caches;
-
-  /// Gives `function` a range cache when a pointer it guards is guarded in
-  /// a loop.
-  void planCache(const clang::FunctionDecl *function,
-                 llvm::ArrayRef<const analysis::SiteInfo *> guarded);
-  /// `&cache[4 * entry]`.
-  clang::Expr *cacheEntry(const SiteContext &site);
-  /// Declares and clears the caches at the start of their functions.
-  bool declareCaches();
-
   //--- Object registration (RFC 0032 §4, §5) ----------------------------------
 
   unsigned nextObjectId = 0;
@@ -586,6 +588,8 @@ class CheckEmitter::Impl {
   /// `__weavec_frame_<n>`: the variable whose initialiser enters `object`
   /// and whose cleanup leaves it.
   clang::VarDecl *frameGuard(const StackObject &object);
+  /// RFC 0034 §4: aligns a registered object to a 16-byte granule.
+  void alignToGranule(clang::VarDecl &variable);
   bool enterStackObjects(const clang::FunctionDecl *function,
                          llvm::ArrayRef<const StackObject *> objects);
   bool rewindAfter(const ReturnsTwiceCall &rewind);
@@ -612,11 +616,12 @@ clang::FunctionDecl *CheckEmitter::Impl::lookupFunction(llvm::StringRef name) {
 }
 
 clang::FunctionDecl *CheckEmitter::Impl::helper(llvm::StringRef name) {
-  // Out of line, report helpers carry a `_report` suffix (§10.9).
+  // Out of line, report helpers carry a `_report` suffix (§10.9), and so do
+  // the guards the prelude only declares (RFC 0034 §1.1).
   const HelperSignature *signature = findHelperSignature(name);
   std::string spelled = name.str();
-  if (options.externalHelpers && report && signature != nullptr &&
-      signature->reports)
+  if (signature != nullptr && report && signature->reports &&
+      (options.externalHelpers || signature->declared))
     spelled += "_report";
   if (const auto cached = helperDecls.find(spelled);
       cached != helperDecls.end())
@@ -892,13 +897,16 @@ clang::Expr *CheckEmitter::Impl::castTo(clang::Expr *expr, clang::QualType type,
 
 clang::ExprResult CheckEmitter::Impl::callHelper(
     llvm::StringRef name, llvm::MutableArrayRef<clang::Expr *> args,
-    clang::SourceLocation loc, const SiteContext *site) {
+    clang::SourceLocation loc, const SiteContext *site,
+    llvm::ArrayRef<clang::Expr *> variadic) {
   clang::FunctionDecl *function = helper(name);
-  if (function == nullptr || llvm::is_contained(args, nullptr))
+  if (function == nullptr || llvm::is_contained(args, nullptr) ||
+      llvm::is_contained(variadic, nullptr))
     return clang::ExprError();
   llvm::SmallVector<clang::Expr *, 8> all(args.begin(), args.end());
   const HelperSignature *signature = findHelperSignature(name);
   if (site != nullptr && signature != nullptr && signature->reports &&
+      !signature->declared && !signature->wrapper &&
       outOfLine.contains(site->function)) {
     const std::string copy = (name + "_ool").str();
     auto [cached, fresh] = helperDecls.try_emplace(copy, nullptr);
@@ -920,6 +928,7 @@ clang::ExprResult CheckEmitter::Impl::callHelper(
     all.push_back(literal(site != nullptr ? site->where.column : 0,
                           context.UnsignedIntTy, loc));
   }
+  all.append(variadic.begin(), variadic.end());
   clang::Expr *callee = sema.BuildDeclRefExpr(function, function->getType(),
                                               clang::VK_LValue, loc);
   return sema.BuildCallExpr(nullptr, callee, loc, all, loc);
@@ -1049,6 +1058,85 @@ clang::Expr *CheckEmitter::Impl::term(const core::CheckTerm &term,
   }
   case core::CheckTerm::Kind::Add:
   case core::CheckTerm::Kind::Sub:
+  case core::CheckTerm::Kind::Mul:
+  case core::CheckTerm::Kind::Div: {
+    // Computed exactly over `long long`, and only the result enters through
+    // need_s or have_s: `count + 8` with `count == -5` is 3, as the program
+    // computes it, not the maximum.
+    clang::Expr *value = exact(term, direction, site);
+    if (value == nullptr)
+      return nullptr;
+    std::array<clang::Expr *, 1> args = {value};
+    const clang::ExprResult entered = callHelper(
+        need ? "__weavec_need_s" : "__weavec_have_s", args, loc, nullptr);
+    return usable(entered) ? entered.get() : nullptr;
+  }
+  case core::CheckTerm::Kind::StrNLen: {
+    if (term.operands.size() != 2)
+      return nullptr;
+    std::array<clang::Expr *, 2> args = {
+        pointerTerm(term.operands[0], site),
+        this->term(term.operands[1], Direction::Have, site)};
+    const clang::ExprResult result =
+        callHelper("__weavec_strnlen", args, loc, &site);
+    return usable(result) ? result.get() : nullptr;
+  }
+  case core::CheckTerm::Kind::ObjStrLen: {
+    // RFC 0032 §6: read inside the string's own object.
+    if (term.operands.size() != 1)
+      return nullptr;
+    std::array<clang::Expr *, 1> args = {castTo(
+        pointerTerm(term.operands[0], site),
+        typeOf(context, HelperType::ConstCharPointer), clang::CK_BitCast)};
+    const clang::ExprResult result =
+        callHelper("__weavec_obj_strlen", args, loc, nullptr);
+    return usable(result) ? result.get() : nullptr;
+  }
+  }
+  return nullptr;
+}
+
+clang::Expr *CheckEmitter::Impl::exact(const core::CheckTerm &term,
+                                       Direction direction,
+                                       const SiteContext &site) {
+  const clang::SourceLocation loc = site.loc;
+  const bool need = direction == Direction::Need;
+  // A leaf that fits in `long long` enters as itself: the helpers'
+  // parameters convert it. A 64-bit unsigned one enters through term_u.
+  const auto entered = [&](clang::Expr *value) -> clang::Expr * {
+    if (value == nullptr)
+      return nullptr;
+    const clang::QualType type = value->getType();
+    if (type->isSignedIntegerOrEnumerationType() ||
+        context.getTypeSize(type) < context.getTypeSize(context.LongLongTy))
+      return value;
+    std::array<clang::Expr *, 1> args = {value};
+    const clang::ExprResult result =
+        callHelper("__weavec_term_u", args, loc, nullptr);
+    return usable(result) ? result.get() : nullptr;
+  };
+  switch (term.kind) {
+  case core::CheckTerm::Kind::Constant: {
+    const std::uint64_t magnitude =
+        term.constant >= 0 ? static_cast<std::uint64_t>(term.constant)
+                           : 0 - static_cast<std::uint64_t>(term.constant);
+    clang::Expr *value = literal(magnitude, context.LongLongTy, loc);
+    if (term.constant >= 0)
+      return value;
+    const clang::ExprResult negated =
+        sema.CreateBuiltinUnaryOp(loc, clang::UO_Minus, value);
+    return usable(negated) ? negated.get() : nullptr;
+  }
+  case core::CheckTerm::Kind::Place: {
+    clang::Expr *lvalue = placeLvalue(term, site);
+    if (lvalue == nullptr)
+      return nullptr;
+    const clang::ExprResult value =
+        sema.DefaultFunctionArrayLvalueConversion(lvalue);
+    return usable(value) ? entered(value.get()) : nullptr;
+  }
+  case core::CheckTerm::Kind::Add:
+  case core::CheckTerm::Kind::Sub:
   case core::CheckTerm::Kind::Mul: {
     if (term.operands.size() != 2)
       return nullptr;
@@ -1057,8 +1145,8 @@ clang::Expr *CheckEmitter::Impl::term(const core::CheckTerm &term,
                                 ? opposite(direction)
                                 : direction;
     std::array<clang::Expr *, 2> args = {
-        this->term(term.operands[0], direction, site),
-        this->term(term.operands[1], right, site)};
+        exact(term.operands[0], direction, site),
+        exact(term.operands[1], right, site)};
     std::string name = need ? "__weavec_need_" : "__weavec_have_";
     if (term.kind == core::CheckTerm::Kind::Add)
       name += "add";
@@ -1071,46 +1159,28 @@ clang::Expr *CheckEmitter::Impl::term(const core::CheckTerm &term,
   }
   case core::CheckTerm::Kind::Div: {
     // RFC 0030 §10.1 (amended in S3): floor division by a positive
-    // constant; the dividend is never negative there, so C's unsigned
-    // division is exact. As a need (RFC 0033 §3, select's sets) a dividend
-    // that saturated stays larger than any object after the division.
+    // constant. As a need (RFC 0033 §3, select's sets) a dividend that
+    // saturated stays larger than any object after the division.
     if (term.operands.size() != 2)
       return nullptr;
     const core::CheckTerm &divisor = term.operands[1];
     if (divisor.kind != core::CheckTerm::Kind::Constant ||
         divisor.constant <= 0)
       return nullptr;
-    clang::Expr *dividend = this->term(term.operands[0], direction, site);
-    if (dividend == nullptr)
-      return nullptr;
-    clang::Expr *constant =
-        literal(static_cast<std::uint64_t>(divisor.constant),
-                context.UnsignedLongLongTy, loc);
-    const clang::ExprResult quotient =
-        sema.BuildBinOp(nullptr, loc, clang::BO_Div, dividend, constant);
-    return usable(quotient) ? quotient.get() : nullptr;
-  }
-  case core::CheckTerm::Kind::StrNLen: {
-    if (term.operands.size() != 2)
-      return nullptr;
     std::array<clang::Expr *, 2> args = {
-        pointerTerm(term.operands[0], site),
-        this->term(term.operands[1], Direction::Have, site)};
-    const clang::ExprResult result =
-        callHelper("__weavec_strnlen", args, loc, &site);
-    return usable(result) ? result.get() : nullptr;
-  }
-  case core::CheckTerm::Kind::ObjStrLen: {
-    // RFC 0032 §6: read inside the string's own object.
-    if (term.operands.size() != 1)
-      return nullptr;
-    std::array<clang::Expr *, 1> args = {castTo(
-        pointerTerm(term.operands[0], site),
-        typeOf(context, HelperType::ConstCharPointer), clang::CK_BitCast)};
-    const clang::ExprResult result =
-        callHelper("__weavec_obj_strlen", args, loc, nullptr);
+        exact(term.operands[0], direction, site),
+        literal(static_cast<std::uint64_t>(divisor.constant),
+                context.LongLongTy, loc)};
+    const clang::ExprResult result = callHelper(
+        need ? "__weavec_need_div" : "__weavec_have_div", args, loc, nullptr);
     return usable(result) ? result.get() : nullptr;
   }
+  case core::CheckTerm::Kind::SizeOf:
+    // No object's size reaches LLONG_MAX.
+    return this->term(term, direction, site);
+  case core::CheckTerm::Kind::StrNLen:
+  case core::CheckTerm::Kind::ObjStrLen:
+    return entered(this->term(term, direction, site));
   }
   return nullptr;
 }
@@ -1123,8 +1193,6 @@ clang::ExprResult CheckEmitter::Impl::checkCall(const Entry &entry,
                                                 clang::Expr *wrapped,
                                                 SiteContext &site) {
   const clang::SourceLocation loc = site.loc;
-  if (entry.form == Entry::Form::Violation)
-    return callHelper("__weavec_chk_violation", {}, loc, &site);
   const std::string name = core::helperName(entry);
   const auto operand = [&](std::size_t i, Direction direction) {
     return i < entry.operands.size() ? term(entry.operands[i], direction, site)
@@ -1220,24 +1288,11 @@ clang::ExprResult CheckEmitter::Impl::checkCall(const Entry &entry,
         moved, literal(0, context.LongLongTy, loc),
         literal(0, context.UnsignedLongLongTy, loc),
         operand(0, Direction::Need), operand(1, Direction::Need)};
-    if (site.cache != nullptr &&
-        entry.placement == Entry::Placement::WrapOperand) {
-      args.push_back(cacheEntry(site));
-      args.push_back(literal(site.cacheQuiet ? 1 : 0, context.IntTy, loc));
-      return callHelper(name + "_c", args, loc, &site);
-    }
     return callHelper(name, args, loc, &site);
   }
   case Entry::Template::Live: {
     if (moved == nullptr)
       return clang::ExprError();
-    if (site.cache != nullptr &&
-        entry.placement == Entry::Placement::WrapOperand) {
-      std::array<clang::Expr *, 3> args = {
-          moved, cacheEntry(site),
-          literal(site.cacheQuiet ? 1 : 0, context.IntTy, loc)};
-      return callHelper(name + "_c", args, loc, &site);
-    }
     std::array<clang::Expr *, 1> args = {moved};
     return callHelper(name, args, loc, &site);
   }
@@ -1288,10 +1343,9 @@ bool CheckEmitter::Impl::wrapValue(const Entry &entry, clang::Stmt *target,
   if (current == nullptr)
     return false;
   const clang::QualType type = current->getType();
-  const bool returnsOperand =
-      entry.form != Entry::Form::Violation &&
-      (entry.kind == Entry::Template::Nonnull ||
-       entry.kind == Entry::Template::Span || core::isGuard(entry));
+  const bool returnsOperand = entry.kind == Entry::Template::Nonnull ||
+                              entry.kind == Entry::Template::Span ||
+                              core::isGuard(entry);
   const bool wrapsIndex = entry.placement == Entry::Placement::WrapIndex;
   clang::Stmt *wrapper = attempt([&]() -> clang::Stmt * {
     if (wrapsIndex) {
@@ -1379,12 +1433,7 @@ bool CheckEmitter::Impl::replaceAccess(const Entry &entry, SiteContext &site) {
         term(entry.operands[1], guard ? Direction::Need : Direction::Have,
              site),
         term(entry.operands[2], Direction::Need, site)};
-    std::string name = core::helperName(entry);
-    if (guard && site.cache != nullptr) {
-      args.push_back(cacheEntry(site));
-      args.push_back(literal(site.cacheQuiet ? 1 : 0, context.IntTy, site.loc));
-      name += "_c";
-    }
+    const std::string name = core::helperName(entry);
     const clang::ExprResult check = callHelper(name, args, site.loc, &site);
     if (!usable(check))
       return nullptr;
@@ -1485,17 +1534,16 @@ bool CheckEmitter::Impl::replaceCall(const Entry &entry, SiteContext &site) {
     return false;
   const clang::SourceLocation loc = site.loc;
   clang::Stmt *replacement = nullptr;
-  if (entry.form == Entry::Form::Violation ||
-      entry.kind == Entry::Template::Assert) {
-    // `WEAVEC_ASSUME(e)` becomes `__weavec_chk_assert(e)`; a contradicted
-    // one that was lowered, the unconditional trap.
-    if (entry.form != Entry::Form::Violation && call->getNumArgs() != 1)
+  if (entry.form == Entry::Form::Wrapper) {
+    // One replacement serves every check the wrapper makes.
+    return site.wrapped || wrapCall(call, site);
+  }
+  if (entry.kind == Entry::Template::Assert) {
+    // `WEAVEC_ASSUME(e)` becomes `__weavec_chk_assert(e)`.
+    if (call->getNumArgs() != 1)
       return false;
     replacement = attempt([&]() -> clang::Stmt * {
-      const clang::ExprResult check = checkCall(
-          entry,
-          entry.form == Entry::Form::Violation ? nullptr : call->getArg(0),
-          site);
+      const clang::ExprResult check = checkCall(entry, call->getArg(0), site);
       return usable(check) ? check.get() : nullptr;
     });
   } else if (entry.kind == Entry::Template::Len &&
@@ -1551,6 +1599,72 @@ bool CheckEmitter::Impl::replaceCall(const Entry &entry, SiteContext &site) {
   return replacement != nullptr && replaceNode(call, replacement);
 }
 
+bool CheckEmitter::Impl::wrapCall(clang::CallExpr *call, SiteContext &site) {
+  const std::optional<core::LibraryMatch> &match = site.info->library;
+  if (!match || match->entry == nullptr || !match->entry->wrapper)
+    return false;
+  const core::LibraryEntry &row = *match->entry;
+  const std::string name = "__weavec_chk_" + row.wrapper->name;
+  const HelperSignature *signature = findHelperSignature(name);
+  if (signature == nullptr)
+    return false;
+  // The row's arguments in row order; of a fortified alias's own arguments
+  // (a flag, the object size) the last one is the object size.
+  std::vector<clang::Expr *> rowArguments;
+  clang::Expr *objectSize = nullptr;
+  for (unsigned i = 0; i < call->getNumArgs(); ++i) {
+    const int rowArgument = match->rowArgument(i);
+    if (rowArgument < 0) {
+      objectSize = call->getArg(i);
+      continue;
+    }
+    const auto at = static_cast<std::size_t>(rowArgument);
+    if (at >= rowArguments.size())
+      rowArguments.resize(at + 1, nullptr);
+    rowArguments[at] = call->getArg(i);
+  }
+  const std::size_t fixed = row.params.size();
+  if (rowArguments.size() < fixed ||
+      llvm::is_contained(rowArguments, nullptr) ||
+      (!row.variadic && rowArguments.size() != fixed) ||
+      (objectSize != nullptr && !objectSize->getType()->isIntegerType()))
+    return false;
+  const clang::SourceLocation loc = site.loc;
+  clang::Stmt *replacement = attempt([&]() -> clang::Stmt * {
+    llvm::SmallVector<clang::Expr *, 8> args;
+    for (std::size_t i = 0; i < fixed; ++i) {
+      clang::Expr *argument = paren(rowArguments[i], loc);
+      const HelperSignature::Type param = signature->params.at(i);
+      // The wrapper's own parameter types: the row's classes, which the
+      // declaration matched (`unsigned char *` to `char *`, any length).
+      if (param != HelperSignature::Type::VaList) {
+        const clang::QualType type = typeOf(context, param);
+        argument = castTo(argument, type,
+                          type->isIntegerType() ? clang::CK_IntegralCast
+                                                : clang::CK_BitCast);
+      }
+      args.push_back(argument);
+    }
+    args.push_back(
+        objectSize != nullptr
+            ? castTo(paren(objectSize, loc), context.UnsignedLongLongTy,
+                     clang::CK_IntegralCast)
+            : literal(~std::uint64_t{0}, context.UnsignedLongLongTy, loc));
+    args.push_back(literal(site.wrapperChecks, context.UnsignedIntTy, loc));
+    llvm::SmallVector<clang::Expr *, 8> rest;
+    for (std::size_t i = fixed; i < rowArguments.size(); ++i)
+      rest.push_back(paren(rowArguments[i], loc));
+    const clang::ExprResult wrapped = callHelper(name, args, loc, &site, rest);
+    if (!usable(wrapped))
+      return nullptr;
+    return castTo(wrapped.get(), call->getType(),
+                  call->getType()->isIntegerType() ? clang::CK_IntegralCast
+                                                   : clang::CK_BitCast);
+  });
+  site.wrapped = replacement != nullptr && replaceNode(call, replacement);
+  return site.wrapped;
+}
+
 bool CheckEmitter::Impl::apply(const Entry &entry, SiteContext &site) {
   switch (entry.placement) {
   case Entry::Placement::WrapOperand:
@@ -1596,6 +1710,14 @@ static std::string textOf(const clang::Stmt &stmt,
   return core::siteText(std::string_view(text.data(), text.size()));
 }
 
+/// RFC 0034 §5.2: the bit of a checked wrapper's `what` an entry plans: 1
+/// the destination's room, 2 the operands' disjointness, 4 a copy's source.
+static unsigned wrapperBit(const core::CheckPlanEntry &entry) {
+  if (entry.kind == core::CheckPlanEntry::Template::Disjoint)
+    return 2U;
+  return entry.argument == 1 ? 4U : 1U;
+}
+
 bool CheckEmitter::Impl::emit(const core::CheckPlan &plan,
                               const analysis::SiteIndex &sites,
                               const analysis::PlaceHandleTable &handles,
@@ -1603,28 +1725,6 @@ bool CheckEmitter::Impl::emit(const core::CheckPlan &plan,
   std::map<core::SiteId, std::vector<const Entry *>> bySite;
   for (const Entry &entry : plan.entries)
     bySite[entry.site].push_back(&entry);
-  // RFC 0032 §13: which guarded sites of each function share a range cache.
-  if (options.rangeCaches && !options.externalHelpers) {
-    std::map<std::uint32_t, std::vector<const analysis::SiteInfo *>> guarded;
-    for (const auto &[id, entries] : bySite) {
-      const analysis::SiteInfo *info = sites.info(id);
-      if (info == nullptr || info->stmt == nullptr)
-        continue;
-      if (llvm::any_of(entries, [](const Entry *entry) {
-            return (entry->kind == Entry::Template::Object &&
-                    entry->form == Entry::Form::Plain) ||
-                   (entry->kind == Entry::Template::Live &&
-                    entry->placement == Entry::Placement::WrapOperand);
-          }))
-        guarded[id.function].push_back(info);
-    }
-    for (const auto &[index, infos] : guarded)
-      if (index < sites.functions().size() &&
-          sites.functions()[index].decl != nullptr) {
-        mapOwner(sites.functions()[index].decl);
-        planCache(sites.functions()[index].decl, infos);
-      }
-  }
   if (!options.externalHelpers) {
     std::map<std::uint32_t, std::size_t> perFunction;
     for (const auto &[id, entries] : bySite)
@@ -1657,13 +1757,9 @@ bool CheckEmitter::Impl::emit(const core::CheckPlan &plan,
             ? row->location
             : analysis::toCoreLocation(context.getSourceManager(), site.loc);
     site.text = row != nullptr ? row->text : textOf(*info->stmt, context);
-    if (const auto cached = caches.find(function.decl); cached != caches.end())
-      if (const auto slot = cached->second.entries.find(info);
-          slot != cached->second.entries.end()) {
-        site.cache = cached->second.variable;
-        site.cacheEntry = slot->second;
-        site.cacheQuiet = cached->second.quiet.contains(info);
-      }
+    for (const Entry *entry : entries)
+      if (entry->form == Entry::Form::Wrapper)
+        site.wrapperChecks |= wrapperBit(*entry);
     std::ranges::stable_sort(entries, [](const Entry *a, const Entry *b) {
       return std::make_pair(phase(*a), nesting(*a)) <
              std::make_pair(phase(*b), nesting(*b));
@@ -1679,7 +1775,7 @@ bool CheckEmitter::Impl::emit(const core::CheckPlan &plan,
       ++inserted;
     }
   }
-  return declareCaches() && ok;
+  return ok;
 }
 
 //===----------------------------------------------------------------------===//
@@ -1865,295 +1961,13 @@ bool CheckEmitter::Impl::lowerZeroInit(const ZeroInitPlan &plan) {
   return ok;
 }
 
-//===----------------------------------------------------------------------===//
-// Range caches (RFC 0032 §13)
-//===----------------------------------------------------------------------===//
-
-/// The local or parameter a guarded pointer is read from, when it is one:
-/// guards of one variable share a cache entry.
-static const clang::VarDecl *guardedVariable(const analysis::SiteInfo &info) {
-  const clang::Expr *pointer = info.operand;
-  if (pointer == nullptr)
-    if (const auto *subscript =
-            llvm::dyn_cast_or_null<clang::ArraySubscriptExpr>(info.stmt))
-      pointer = subscript->getBase();
-  if (pointer == nullptr)
-    return nullptr;
-  const auto *ref =
-      llvm::dyn_cast<clang::DeclRefExpr>(pointer->IgnoreParenImpCasts());
-  const auto *variable =
-      ref != nullptr ? llvm::dyn_cast<clang::VarDecl>(ref->getDecl()) : nullptr;
-  return variable != nullptr && variable->hasLocalStorage() ? variable
-                                                            : nullptr;
-}
-
-bool CheckEmitter::Impl::isQuietLoop(const clang::Stmt *loop) {
-  if (const auto known = quietLoops.find(loop); known != quietLoops.end())
-    return known->second;
-  // Nothing in the loop can end an object: no call (a release, a `realloc`,
-  // a callee returning) and no variable whose cleanup function runs when its
-  // scope ends. And no jump enters the loop past the statement that checks
-  // its entries: no label, and no `case` of a `switch` outside it.
-  bool quiet = true;
-  llvm::SmallPtrSet<const clang::Stmt *, 4> switches;
-  llvm::SmallVector<const clang::Stmt *, 32> work = {loop};
-  while (quiet && !work.empty()) {
-    const clang::Stmt *stmt = work.pop_back_val();
-    if (const auto *call = llvm::dyn_cast<clang::CallExpr>(stmt)) {
-      // A compiler builtin that is no library function calls nothing.
-      const unsigned id = call->getBuiltinCallee();
-      quiet = id != 0 && !context.BuiltinInfo.isLibFunction(id) &&
-              !context.BuiltinInfo.isPredefinedLibFunction(id);
-    } else if (llvm::isa<clang::LabelStmt, clang::AddrLabelExpr,
-                         clang::BlockExpr, clang::AsmStmt>(stmt)) {
-      quiet = false;
-    } else if (const auto *declaration =
-                   llvm::dyn_cast<clang::DeclStmt>(stmt)) {
-      quiet = llvm::none_of(declaration->decls(), [](const clang::Decl *decl) {
-        return decl->hasAttr<clang::CleanupAttr>();
-      });
-    } else if (llvm::isa<clang::SwitchCase>(stmt)) {
-      // Statements are visited parents first, so a `switch` inside the loop
-      // is known before its cases.
-      bool inside = false;
-      for (const clang::Stmt *at = parents.lookup(mutableNode(stmt));
-           at != nullptr && at != loop && !inside;
-           at = parents.lookup(mutableNode(at)))
-        inside = switches.contains(at);
-      quiet = inside;
-    } else if (llvm::isa<clang::SwitchStmt>(stmt)) {
-      switches.insert(stmt);
-    }
-    for (const clang::Stmt *child : stmt->children())
-      if (child != nullptr)
-        work.push_back(child);
-  }
-  quietLoops[loop] = quiet;
-  return quiet;
-}
-
-void CheckEmitter::Impl::planCache(
-    const clang::FunctionDecl *function,
-    llvm::ArrayRef<const analysis::SiteInfo *> guarded) {
-  // At most this many entries: a frame pays for clearing them at every call.
-  constexpr unsigned MaxEntries = 64;
-  // Whether `stmt` is in a loop, and the outermost quiet loop it is in.
-  const auto loopsOf = [&](const clang::Stmt *stmt) {
-    std::pair<bool, clang::Stmt *> found = {false, nullptr};
-    for (unsigned depth = 0; stmt != nullptr && depth < 4096; ++depth) {
-      if (llvm::isa<clang::ForStmt, clang::WhileStmt, clang::DoStmt>(stmt)) {
-        found.first = true;
-        if (isQuietLoop(stmt))
-          found.second = mutableNode(stmt);
-      }
-      const auto parent = parents.find(mutableNode(stmt));
-      stmt = parent != parents.end() ? parent->second : nullptr;
-    }
-    return found;
-  };
-  // A key is a variable the guards read their pointer from, or else the
-  // site itself. It earns an entry when it is guarded in a loop.
-  struct Key {
-    bool loop = false;
-    std::vector<std::pair<const analysis::SiteInfo *, clang::Stmt *>> sites;
-  };
-  std::vector<Key> keys;
-  llvm::DenseMap<const clang::VarDecl *, std::size_t> byVariable;
-  for (const analysis::SiteInfo *info : guarded) {
-    const auto [loop, quiet] = loopsOf(info->stmt);
-    std::size_t index = keys.size();
-    if (const clang::VarDecl *variable = guardedVariable(*info)) {
-      const auto [it, fresh] = byVariable.try_emplace(variable, index);
-      index = it->second;
-      if (fresh)
-        keys.emplace_back();
-    } else {
-      keys.emplace_back();
-    }
-    Key &key = keys[index];
-    key.loop = key.loop || loop;
-    key.sites.emplace_back(info, quiet);
-  }
-  FunctionCache cache;
-  unsigned count = 0;
-  llvm::DenseMap<clang::Stmt *, std::size_t> loopIndex;
-  for (const Key &key : keys) {
-    if (!key.loop || count == MaxEntries)
-      continue;
-    for (const auto &[info, quiet] : key.sites) {
-      cache.entries[info] = count;
-      if (quiet == nullptr)
-        continue;
-      cache.quiet.insert(info);
-      const auto [it, fresh] = loopIndex.try_emplace(quiet, cache.loops.size());
-      if (fresh)
-        cache.loops.emplace_back(quiet, std::vector<unsigned>());
-      std::vector<unsigned> &validated = cache.loops[it->second].second;
-      if (validated.empty() || validated.back() != count)
-        validated.push_back(count);
-    }
-    ++count;
-  }
-  if (count == 0)
-    return;
-  // `unsigned long long __weavec_ranges[4 * count]`: {lo, len, state,
-  // expect} per entry.
-  auto *owner = mutableNode(function);
-  const clang::SourceLocation loc = function->getBody()->getBeginLoc();
-  const clang::QualType type = context.getConstantArrayType(
-      context.UnsignedLongLongTy, llvm::APInt(64, 4ULL * count), nullptr,
-      clang::ArraySizeModifier::Normal, 0);
-  const clang::IdentifierInfo &name = context.Idents.get("__weavec_ranges");
-  cache.variable = clang::VarDecl::Create(
-      context, owner, loc, loc, &name, type,
-      context.getTrivialTypeSourceInfo(type, loc), clang::SC_None);
-  cache.variable->setImplicit(true);
-  cache.variable->setIsUsed();
-  cache.variable->setReferenced(true);
-  owner->addHiddenDecl(cache.variable);
-  caches[function] = std::move(cache);
-}
-
-clang::Expr *CheckEmitter::Impl::cacheEntry(const SiteContext &site) {
-  clang::Expr *array = clang::DeclRefExpr::Create(
-      context, clang::NestedNameSpecifierLoc(), clang::SourceLocation(),
-      site.cache, /*RefersToEnclosingVariableOrCapture=*/false, site.loc,
-      site.cache->getType(), clang::VK_LValue);
-  const clang::ExprResult decayed =
-      sema.DefaultFunctionArrayLvalueConversion(array);
-  if (!usable(decayed))
-    return nullptr;
-  if (site.cacheEntry == 0)
-    return decayed.get();
-  const clang::ExprResult entry =
-      sema.BuildBinOp(nullptr, site.loc, clang::BO_Add, decayed.get(),
-                      literal(4ULL * site.cacheEntry, context.IntTy, site.loc));
-  return usable(entry) ? entry.get() : nullptr;
-}
-
-clang::Expr *
-CheckEmitter::Impl::validateEntries(clang::VarDecl *cache,
-                                    llvm::ArrayRef<unsigned> entries,
-                                    clang::SourceLocation loc) {
-  SiteContext site;
-  site.cache = cache;
-  site.loc = loc;
-  clang::Expr *all = nullptr;
-  for (const unsigned entry : entries) {
-    site.cacheEntry = entry;
-    clang::Expr *at = cacheEntry(site);
-    if (at == nullptr)
-      return nullptr;
-    std::array<clang::Expr *, 1> args = {at};
-    const clang::ExprResult valid =
-        callHelper("__weavec_range_check", args, loc, nullptr);
-    if (!usable(valid))
-      return nullptr;
-    if (all == nullptr) {
-      all = valid.get();
-      continue;
-    }
-    const clang::ExprResult both = comma(all, valid.get(), loc);
-    if (!usable(both))
-      return nullptr;
-    all = both.get();
-  }
-  return all;
-}
-
-bool CheckEmitter::Impl::declareCaches() {
-  bool ok = true;
-  for (auto &[function, cache] : caches) {
-    if (cache.variable == nullptr)
-      continue;
-    clang::Sema::ContextRAII inFunction(sema, mutableNode(function));
-    // `{ __weavec_range_check(&ranges[4 * e]), ...; loop }` for each quiet
-    // loop.
-    for (const auto &[loop, entries] : cache.loops) {
-      const clang::SourceLocation at = loop->getBeginLoc();
-      clang::Stmt *entered = attempt([&]() -> clang::Stmt * {
-        clang::Expr *empty = validateEntries(cache.variable, entries, at);
-        if (empty == nullptr)
-          return nullptr;
-        const clang::ExprResult discarded =
-            sema.ActOnFinishFullExpr(empty, at, /*DiscardedValue=*/true);
-        if (!usable(discarded))
-          return nullptr;
-        std::array<clang::Stmt *, 2> statements = {discarded.get(), loop};
-        return clang::CompoundStmt::Create(context, statements,
-                                           clang::FPOptionsOverride(), at,
-                                           loop->getEndLoc());
-      });
-      if (entered == nullptr || !place(loop, entered)) {
-        internalError(at, function->getNameAsString() + "'s range cache",
-                      /*zeroInit=*/false);
-        ok = false;
-      }
-    }
-    auto *body =
-        llvm::dyn_cast_or_null<clang::CompoundStmt>(function->getBody());
-    const clang::SourceLocation loc = cache.variable->getLocation();
-    clang::Stmt *clear =
-        body == nullptr ? nullptr : attempt([&]() -> clang::Stmt * {
-          // `__builtin_memset(__weavec_ranges, 0, sizeof __weavec_ranges)`: an
-          // entry whose length is 0 holds nothing.
-          clang::FunctionDecl *memset = builtin("__builtin_memset", loc);
-          if (memset == nullptr)
-            return nullptr;
-          const auto reference = [&] {
-            return clang::DeclRefExpr::Create(
-                context, clang::NestedNameSpecifierLoc(),
-                clang::SourceLocation(), cache.variable,
-                /*RefersToEnclosingVariableOrCapture=*/false, loc,
-                cache.variable->getType(), clang::VK_LValue);
-          };
-          const clang::ExprResult size = sema.CreateUnaryExprOrTypeTraitExpr(
-              reference(), loc, clang::UETT_SizeOf);
-          if (!usable(size))
-            return nullptr;
-          std::array<clang::Expr *, 3> args = {
-              reference(), literal(0, context.IntTy, loc), size.get()};
-          clang::Expr *callee = sema.BuildDeclRefExpr(memset, memset->getType(),
-                                                      clang::VK_LValue, loc);
-          const clang::ExprResult call =
-              sema.BuildCallExpr(nullptr, callee, loc, args, loc);
-          return usable(call) ? call.get() : nullptr;
-        });
-    if (clear == nullptr) {
-      internalError(function->getLocation(),
-                    function->getNameAsString() + "'s range cache",
-                    /*zeroInit=*/false);
-      ok = false;
-      continue;
-    }
-    llvm::SmallVector<clang::Stmt *, 32> statements;
-    statements.push_back(new (context) clang::DeclStmt(
-        clang::DeclGroupRef(cache.variable), loc, loc));
-    statements.push_back(clear);
-    statements.append(body->body_begin(), body->body_end());
-    clang::Stmt *entered = clang::CompoundStmt::Create(
-        context, statements, body->getStoredFPFeaturesOrDefault(),
-        body->getLBracLoc(), body->getRBracLoc());
-    if (!place(body, entered)) {
-      internalError(function->getLocation(),
-                    function->getNameAsString() + "'s range cache",
-                    /*zeroInit=*/false);
-      ok = false;
-    }
-  }
-  caches.clear();
-  return ok;
-}
-
 //===----------------------------------------------------------------------===//
 // Object registration (RFC 0032 §4, §5)
 //===----------------------------------------------------------------------===//
 
 clang::VarDecl *CheckEmitter::Impl::frameGuard(const StackObject &object) {
   auto *function = mutableNode(object.function);
-  const clang::SourceLocation loc = object.variable != nullptr
-                                        ? object.variable->getLocation()
-                                        : function->getBody()->getBeginLoc();
+  const clang::SourceLocation loc = object.variable->getLocation();
   clang::FunctionDecl *leave = helper("__weavec_stack_leave");
   if (leave == nullptr)
     return nullptr;
@@ -2163,9 +1977,11 @@ clang::VarDecl *CheckEmitter::Impl::frameGuard(const StackObject &object) {
       context, function, loc, loc, &name, context.VoidPtrTy,
       context.getTrivialTypeSourceInfo(context.VoidPtrTy, loc), clang::SC_None);
   guard->setImplicit(true);
-  // The marker of a function with nothing to enter is entered itself.
-  auto *variable =
-      object.variable != nullptr ? mutableNode(object.variable) : guard;
+  auto *variable = mutableNode(object.variable);
+  // RFC 0034 §4: a local on a granule is entered inline and exactly. So is
+  // a parameter passed in registers (CodeGen aligns its spill slot); one
+  // passed in memory keeps the alignment the call gives it.
+  alignToGranule(*variable);
   clang::Stmt *init = attempt([&]() -> clang::Stmt * {
     // `__weavec_stack_enter(&v, sizeof v)`; `sizeof` is evaluated at run time
     // for a variable-length array.
@@ -2203,6 +2019,14 @@ clang::VarDecl *CheckEmitter::Impl::frameGuard(const StackObject &object) {
   return guard;
 }
 
+void CheckEmitter::Impl::alignToGranule(clang::VarDecl &variable) {
+  if (context.getDeclAlign(&variable).getQuantity() >= 16)
+    return;
+  clang::Expr *sixteen = literal(16, context.IntTy, variable.getLocation());
+  variable.addAttr(clang::AlignedAttr::CreateImplicit(
+      context, /*IsAlignmentExpr=*/true, sixteen, variable.getSourceRange()));
+}
+
 bool CheckEmitter::Impl::enterStackObjects(
     const clang::FunctionDecl *function,
     llvm::ArrayRef<const StackObject *> objects) {
@@ -2356,6 +2180,8 @@ bool CheckEmitter::Impl::registerObjects(const ObjectPlan &plan) {
       }
   }
   for (const clang::VarDecl *global : plan.globals) {
+    // RFC 0034 §2.1: on a granule, the shadow encodes it exactly.
+    alignToGranule(*mutableNode(global));
     clang::VarDecl *descriptor = globalDescriptor(*global);
     if (descriptor == nullptr) {
       internalError(global->getLocation(), global->getNameAsString(),
diff --git a/lib/Frontend/Driver.cpp b/lib/Frontend/Driver.cpp
index 7a082db9..0591773b 100644
--- a/lib/Frontend/Driver.cpp
+++ b/lib/Frontend/Driver.cpp
@@ -14,6 +14,7 @@
 #include "weavec/Frontend/ClangDiagnosticSink.h"
 #include "weavec/Frontend/DeferredCodeGenConsumer.h"
 #include "weavec/Frontend/DispatchEdges.h"
+#include "weavec/Frontend/GuardPasses.h"
 #include "weavec/Frontend/LedgerOutput.h"
 #include "weavec/Frontend/LinkStep.h"
 #include "weavec/Frontend/ObjectRegistration.h"
@@ -46,6 +47,7 @@
 
 #include "llvm/ADT/IntrusiveRefCntPtr.h"
 #include "llvm/ADT/STLExtras.h"
+#include "llvm/ADT/ScopeExit.h"
 #include "llvm/ADT/SmallString.h"
 #include "llvm/ADT/SmallVector.h"
 #include "llvm/ADT/StringSet.h"
@@ -301,12 +303,12 @@ llvm::StringRef driverFlagsHelp() {
   -fweavec-summary, -fno-weavec-summary
       Print the summary line on stderr (default: when a ledger is written).
   -fweavec-budget=<n>
-      Block transfers per function before its analysis stops (default:
-      50000; 0: unlimited).
+      Work per function before its analysis stops: the sizes of the states
+      it transfers and joins (RFC 0034; default: 20000000; 0: unlimited).
   -fweavec-unit-budget=<n>
-      Block transfers over every analysis run of a unit; functions analysed
-      after it is spent take the over-budget defaults (default: 6 per site,
-      at least 200000; 0: unlimited).
+      Work over every analysis run of a unit; functions analysed after it is
+      spent take the over-budget defaults (default: 400 per site, at least
+      20000000; 0: unlimited).
   -fweavec-link=records|analyze|none
       What the link step does before linking (RFC 0033): check the units'
       records against each other and compose the program ledger (records,
@@ -391,8 +393,11 @@ class WeaveCWrapperAction final : public clang::WrapperFrontendAction {
     // RFC 0031 §9.2: a unit whose checks are emitted keeps its dispatch
     // blocks' predecessors duplicable. Registered before the code generator
     // is made, which reads the callbacks when it runs the pipeline.
-    if (emitsChecks(compiler))
+    if (emitsChecks(compiler)) {
+      // RFC 0034 §1: before the dispatch split, which runs after expansion.
+      registerGuardPasses(compiler.getCodeGenOpts());
       registerDispatchEdgeSplit(compiler.getCodeGenOpts());
+    }
     std::unique_ptr<clang::ASTConsumer> inner =
         WrapperFrontendAction::CreateASTConsumer(compiler, inFile);
     if (!inner)
@@ -411,6 +416,11 @@ class WeaveCWrapperAction final : public clang::WrapperFrontendAction {
                              analysis = std::move(analysis)](
                                 clang::ASTContext &context, clang::Sema &sema) {
             analysis->HandleTranslationUnit(context);
+            // The plan is spent here: the code generator gets its memory.
+            const llvm::scope_exit spent([&] {
+              planned->ledger.reset();
+              planned->zeroInit.reset();
+            });
             // §10.5 step 2: the checks of a unit without errors.
             if (!checks || diagnostics.hasErrorOccurred())
               return;
@@ -424,11 +434,11 @@ class WeaveCWrapperAction final : public clang::WrapperFrontendAction {
             // RFC 0032 §4, §5: the unit's stack and global objects.
             if (options.config.runtime == core::RuntimeUse::On &&
                 planned->ledger && planned->ledger->sites) {
-              emitter.registerObjects(
-                  planObjects(context, *planned->ledger->sites,
-                              core::LibrarySpec::shipped(),
-                              ObjectOptions{.stack = options.stackObjects,
-                                            .globals = options.globalObjects}));
+              emitter.registerObjects(planObjects(
+                  context, *planned->ledger->sites,
+                  core::LibrarySpec::shipped(), &planned->ledger->plan,
+                  ObjectOptions{.stack = options.stackObjects,
+                                .globals = options.globalObjects}));
               for (clang::Decl *added : emitter.newTopLevelDecls())
                 (*self)->HandleTopLevelDecl(clang::DeclGroupRef(added));
             }
@@ -517,7 +527,8 @@ static bool writeUnitRecord(llvm::StringRef path, llvm::StringRef output,
                             llvm::ArrayRef<const char *> cc1Args,
                             const clang::CompilerInstance &compiler,
                             const core::LedgerConfig &config,
-                            const UnitResult &result, std::string *error) {
+                            const record::Payload &payload,
+                            std::string *error) {
   record::UnitRecord unit;
   unit.header.producer = record::currentProducer();
   const auto &inputs = compiler.getFrontendOpts().Inputs;
@@ -538,7 +549,7 @@ static bool writeUnitRecord(llvm::StringRef path, llvm::StringRef output,
   }
   unit.header.object =
       record::RecordObject{.path = output.str(), .digest = *digest};
-  unit.payload = record::toJson(record::payloadOf(result));
+  unit.payload = record::toJson(payload);
   return record::writeRecord(path, unit, error);
 }
 
@@ -630,8 +641,12 @@ static int runCc1Job(llvm::ArrayRef<const char *> argv, const char *argv0,
   FrontendOptions options = weavec.toFrontendOptions();
   options.collectInterface = writesRecord;
   const core::LedgerConfig config = options.config;
-  std::optional<UnitResult> result;
-  options.onResult = [&result](UnitResult r) { result = std::move(r); };
+  // (The record's rows are taken when the analysis ends, so that its
+  // structures are released before the code generator runs.)
+  std::optional<record::Payload> payload;
+  options.onResult = [&payload](const UnitResult &r) {
+    payload = record::payloadOf(r);
+  };
 
   WeaveCWrapperAction action(std::move(inner), std::move(options));
   success = compiler->ExecuteAction(action);
@@ -639,10 +654,10 @@ static int runCc1Job(llvm::ArrayRef<const char *> argv, const char *argv0,
   if (writesRecord) {
     const std::string path = record::recordPathFor(output);
     std::string error;
-    if (!success || !result) {
+    if (!success || !payload) {
       removeQuietly(path);
     } else if (!writeUnitRecord(path, output, cc1Args, *compiler, config,
-                                *result, &error)) {
+                                *payload, &error)) {
       removeQuietly(path);
       llvm::errs() << "weavec-cc: warning: " << error << '\n';
     }
@@ -786,6 +801,9 @@ struct UnanalyzedInput {
   /// Why its record is not valid; empty when it has none.
   // NOLINTNEXTLINE(readability-redundant-member-init): designated-init default
   std::string stale = {};
+  /// RFC 0034 §8: its objects were built by `weavec-cc` (an archive, which
+  /// carries no records): checked and guarded, only not read at the link.
+  bool builtByWeaveC = false;
 };
 
 /// The inputs of one link: those with a valid record, and those without
@@ -895,6 +913,28 @@ resolveLibrary(llvm::StringRef name,
   return std::nullopt;
 }
 
+template <typename Visit>
+static bool anyRelocatableObject(const std::string &path, const Visit &visit);
+
+/// RFC 0034 §8: whether an object or archive without a record was built by
+/// `weavec-cc`: one of its objects names a symbol of the runtime, of the
+/// helpers or of the global descriptors.
+static bool builtByWeaveC(const std::string &path) {
+  return anyRelocatableObject(path, [](const llvm::object::SymbolicFile &file) {
+    for (const llvm::object::BasicSymbolRef symbol : file.symbols()) {
+      llvm::SmallString<64> name;
+      llvm::raw_svector_ostream stream(name);
+      if (llvm::errorToBool(symbol.printName(stream)))
+        continue;
+      llvm::StringRef text = name;
+      text.consume_front("_");
+      if (text.starts_with("__weavec_"))
+        return true;
+    }
+    return false;
+  });
+}
+
 /// Reads the record of every input on the link line, and names every other
 /// input that is not the platform's (§13.2): objects, archives and shared
 /// libraries without a record, records that are stale or unreadable, and
@@ -934,7 +974,8 @@ collectLinkInputs(const clang::driver::Compilation &compilation,
     const std::string path = record::recordPathFor(object);
     if (!llvm::sys::fs::exists(path)) {
       if (!isSystem(object))
-        addUnanalyzed(UnanalyzedInput{.name = name});
+        addUnanalyzed(UnanalyzedInput{.name = name,
+                                      .builtByWeaveC = builtByWeaveC(object)});
       continue;
     }
     // §13.1: a record that is not format 28 with this schema and a valid
@@ -964,6 +1005,8 @@ collectLinkInputs(const clang::driver::Compilation &compilation,
       stale(reason);
       continue;
     }
+    // (The JSON is read: a program of hundreds of units cannot keep it.)
+    unit->payload = {};
     inputs.analysed.push_back(LinkInput{.object = object,
                                         .record = std::move(*unit),
                                         .payload = std::move(*payload)});
@@ -973,7 +1016,8 @@ collectLinkInputs(const clang::driver::Compilation &compilation,
     const std::optional<std::string> library =
         resolveLibrary(arg->getValue(), compilation);
     if (library && !isSystem(*library))
-      addUnanalyzed(UnanalyzedInput{.name = *library});
+      addUnanalyzed(UnanalyzedInput{.name = *library,
+                                    .builtByWeaveC = builtByWeaveC(*library)});
   }
   return inputs;
 }
@@ -1085,9 +1129,24 @@ static bool runLinkStep(const clang::driver::Compilation &compilation,
   LinkDiagnosticPrinter reporter("weavec-cc");
   FilteringSink sink(reporter, weavec.control);
   std::vector<core::Diagnostic> linkDiagnostics;
-  // Step 1.
-  if (const auto unanalyzed =
-          unanalyzedInputDiagnostic(linkInputs.unanalyzed)) {
+  // Step 1. Inputs `weavec-cc` built are named in a note (RFC 0034 §8).
+  std::vector<UnanalyzedInput> foreign;
+  std::vector<std::string> built;
+  for (const UnanalyzedInput &input : linkInputs.unanalyzed)
+    if (input.builtByWeaveC && input.stale.empty())
+      built.push_back(input.name);
+    else
+      foreign.push_back(input);
+  if (!built.empty()) {
+    std::string names;
+    for (const std::string &name : built)
+      names += (names.empty() ? "'" : ", '") + name + "'";
+    llvm::errs() << "weavec-cc: note: " << names
+                 << (built.size() == 1 ? " was" : " were")
+                 << " built by weavec-cc without records: checked and "
+                    "guarded, not analysed with the program\n";
+  }
+  if (const auto unanalyzed = unanalyzedInputDiagnostic(foreign)) {
     sink.report(*unanalyzed);
     linkDiagnostics.push_back(*unanalyzed);
     if (sink.errors() != 0)
@@ -1779,11 +1838,18 @@ int runDriver(llvm::ArrayRef<const char *> argv, void *mainAddress) {
     }
   }
 
-  clang::DiagnosticOptions diagOptions;
-  auto *printer = new clang::TextDiagnosticPrinter(llvm::errs(), diagOptions);
+  // RFC 0034 §8: the driver's own diagnostics obey the -W options as
+  // Clang's do (CMake's flag probes rely on
+  // -Werror=unused-command-line-argument).
+  const std::unique_ptr<clang::DiagnosticOptions> diagOptions =
+      clang::CreateAndPopulateDiagOpts(clangArgs);
+  auto *printer = new clang::TextDiagnosticPrinter(llvm::errs(), *diagOptions);
   printer->setPrefix("weavec-cc");
   clang::DiagnosticsEngine diags(
-      llvm::makeIntrusiveRefCnt<clang::DiagnosticIDs>(), diagOptions, printer);
+      llvm::makeIntrusiveRefCnt<clang::DiagnosticIDs>(), *diagOptions, printer);
+  clang::ProcessWarningOptions(diags, *diagOptions,
+                               *llvm::vfs::getRealFileSystem(),
+                               /*ReportDiags=*/false);
 
   clang::driver::Driver driver(executable, llvm::sys::getDefaultTargetTriple(),
                                diags, "weavec-cc: WeaveC C compiler");
diff --git a/lib/Frontend/GuardPasses.cpp b/lib/Frontend/GuardPasses.cpp
new file mode 100644
index 00000000..10ee326a
--- /dev/null
+++ b/lib/Frontend/GuardPasses.cpp
@@ -0,0 +1,866 @@
+//===- GuardPasses.cpp - Guards the backend lowers ------------------------===//
+//
+// Part of WeaveC, under the Apache License v2.0 with LLVM Exceptions.
+// See LICENSE for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#include "weavec/Frontend/GuardPasses.h"
+
+#include "clang/Basic/CodeGenOptions.h"
+
+#include "llvm/ADT/DenseMap.h"
+#include "llvm/ADT/PostOrderIterator.h"
+#include "llvm/ADT/SetVector.h"
+#include "llvm/ADT/SmallVector.h"
+#include "llvm/Analysis/MemorySSA.h"
+#include "llvm/Analysis/MemorySSAUpdater.h"
+#include "llvm/Analysis/ValueTracking.h"
+#include "llvm/IR/BasicBlock.h"
+#include "llvm/IR/Constants.h"
+#include "llvm/IR/DataLayout.h"
+#include "llvm/IR/DerivedTypes.h"
+#include "llvm/IR/Dominators.h"
+#include "llvm/IR/Function.h"
+#include "llvm/IR/GlobalVariable.h"
+#include "llvm/IR/IRBuilder.h"
+#include "llvm/IR/Instructions.h"
+#include "llvm/IR/Intrinsics.h"
+#include "llvm/IR/MDBuilder.h"
+#include "llvm/IR/Module.h"
+#include "llvm/Passes/OptimizationLevel.h"
+#include "llvm/Passes/PassBuilder.h"
+#include "llvm/Support/KnownBits.h"
+
+#include <array>
+#include <cstdint>
+#include <optional>
+#include <vector>
+
+namespace weavec::frontend {
+
+namespace {
+
+/// The kind bits of `__weavec_rt_guard` (runtime/weavec_rt.h).
+constexpr std::uint64_t KindObject = 0;
+constexpr std::uint64_t KindLive = 1;
+constexpr std::uint64_t KindMask = 3;
+constexpr std::uint64_t KindOverflow = 4;
+constexpr std::uint64_t KindProven = 8;
+
+/// What the name of a declared guard says.
+struct DeclaredGuard {
+  bool live = false;
+  bool proven = false;
+  bool report = false;
+  /// A call argument's (RFC 0032 §3): `object_n(p, need)` returns `p`,
+  /// `object_l(p, need)` returns `need`.
+  bool bytes = false;
+  bool length = false;
+};
+
+/// Guards above which a function loads the descriptor at each guard.
+constexpr std::size_t MaxHoistedGuards = 1024;
+
+/// The offsets of `base`, `bytes`, `shadow` and `mask` in
+/// `__weavec_rt_heap`.
+constexpr unsigned HeapBase = 0;
+constexpr unsigned HeapBytes = 8;
+constexpr unsigned HeapShadow = 16;
+constexpr unsigned HeapMask = 24;
+
+} // namespace
+
+static std::optional<DeclaredGuard> declaredGuard(llvm::StringRef name) {
+  DeclaredGuard guard;
+  if (name.consume_front("__weavec_prv_"))
+    guard.proven = true;
+  else if (!name.consume_front("__weavec_chk_"))
+    return std::nullopt;
+  guard.report = name.consume_back("_report");
+  guard.bytes = name.consume_back("_n");
+  guard.length = !guard.bytes && name.consume_back("_l");
+  if (name == "live" && !guard.bytes && !guard.length)
+    guard.live = true;
+  else if (name != "object")
+    return std::nullopt;
+  return guard;
+}
+
+/// `__weavec_rt_guard`, declared with the attributes of §1.2.
+static llvm::Function *slowPath(llvm::Module &module) {
+  llvm::LLVMContext &context = module.getContext();
+  llvm::Type *ptr = llvm::PointerType::getUnqual(context);
+  auto *type =
+      llvm::FunctionType::get(llvm::Type::getVoidTy(context),
+                              {ptr, ptr, llvm::Type::getInt64Ty(context),
+                               llvm::Type::getInt32Ty(context), ptr},
+                              false);
+  llvm::FunctionCallee callee = module.getOrInsertFunction(GuardSlowPath, type);
+  auto *function = llvm::dyn_cast<llvm::Function>(callee.getCallee());
+  if (function == nullptr || function->getFunctionType() != type)
+    return nullptr;
+  function->setDoesNotThrow();
+  function->setMemoryEffects(
+      llvm::MemoryEffects::inaccessibleMemOnly(llvm::ModRefInfo::Ref));
+  return function;
+}
+
+static bool isSlowPathCall(const llvm::Instruction &instruction) {
+  const auto *call = llvm::dyn_cast<llvm::CallInst>(&instruction);
+  const llvm::Function *callee =
+      call != nullptr ? call->getCalledFunction() : nullptr;
+  return callee != nullptr && callee->getName() == GuardSlowPath &&
+         call->arg_size() == 5;
+}
+
+/// Report mode's site record `{file, line, column}` for constant operands.
+static llvm::Constant *siteRecord(llvm::Module &module, llvm::Value *file,
+                                  llvm::Value *line, llvm::Value *column) {
+  auto *fileConstant = llvm::dyn_cast<llvm::Constant>(file);
+  const auto *lineConstant = llvm::dyn_cast<llvm::ConstantInt>(line);
+  const auto *columnConstant = llvm::dyn_cast<llvm::ConstantInt>(column);
+  if (fileConstant == nullptr || lineConstant == nullptr ||
+      columnConstant == nullptr)
+    return nullptr;
+  llvm::LLVMContext &context = module.getContext();
+  llvm::Type *i32 = llvm::Type::getInt32Ty(context);
+  auto *type = llvm::StructType::get(
+      context, {llvm::PointerType::getUnqual(context), i32, i32});
+  auto *initializer = llvm::ConstantStruct::get(
+      type,
+      {fileConstant, llvm::ConstantInt::get(i32, lineConstant->getZExtValue()),
+       llvm::ConstantInt::get(i32, columnConstant->getZExtValue())});
+  auto *record = new llvm::GlobalVariable(module, type, /*isConstant=*/true,
+                                          llvm::GlobalValue::PrivateLinkage,
+                                          initializer, "__weavec.site");
+  record->setUnnamedAddr(llvm::GlobalValue::UnnamedAddr::Global);
+  return record;
+}
+
+//===----------------------------------------------------------------------===//
+// GuardCanonicalize
+//===----------------------------------------------------------------------===//
+
+// NOLINTBEGIN(readability-convert-member-functions-to-static): the pass
+// manager calls `run` on an instance.
+llvm::PreservedAnalyses
+GuardCanonicalize::run(llvm::Function &function,
+                       llvm::FunctionAnalysisManager & /*analyses*/) {
+  // NOLINTEND(readability-convert-member-functions-to-static)
+  llvm::Module &module = *function.getParent();
+  if (module.getDataLayout().getPointerSizeInBits() != 64)
+    return llvm::PreservedAnalyses::all();
+  std::vector<std::pair<llvm::CallInst *, DeclaredGuard>> calls;
+  for (llvm::BasicBlock &block : function)
+    for (llvm::Instruction &instruction : block)
+      if (auto *call = llvm::dyn_cast<llvm::CallInst>(&instruction))
+        if (const llvm::Function *callee = call->getCalledFunction())
+          if (std::optional<DeclaredGuard> guard =
+                  declaredGuard(callee->getName()))
+            calls.emplace_back(call, *guard);
+  if (calls.empty())
+    return llvm::PreservedAnalyses::all();
+  llvm::Function *slow = slowPath(module);
+  if (slow == nullptr)
+    return llvm::PreservedAnalyses::all();
+  llvm::LLVMContext &context = module.getContext();
+  llvm::Type *i8 = llvm::Type::getInt8Ty(context);
+  llvm::Type *i32 = llvm::Type::getInt32Ty(context);
+  llvm::Type *i64 = llvm::Type::getInt64Ty(context);
+  bool changed = false;
+  for (auto [call, guard] : calls) {
+    const bool argument = guard.bytes || guard.length;
+    unsigned operands = argument ? 2 : 5;
+    if (guard.live)
+      operands = 1;
+    if (call->arg_size() != operands + (guard.report ? 3 : 0) ||
+        !(guard.length ? call->getType()->isIntegerTy(64)
+                       : call->getType()->isPointerTy()))
+      continue;
+    // A call argument's guard of a constant need is the guard of that many
+    // bytes from the pointer; another stays the runtime's call.
+    auto *need = argument
+                     ? llvm::dyn_cast<llvm::ConstantInt>(call->getArgOperand(1))
+                     : nullptr;
+    if (argument && need == nullptr)
+      continue;
+    llvm::Value *site =
+        llvm::ConstantPointerNull::get(llvm::PointerType::getUnqual(context));
+    if (guard.report) {
+      llvm::Constant *record = siteRecord(module, call->getArgOperand(operands),
+                                          call->getArgOperand(operands + 1),
+                                          call->getArgOperand(operands + 2));
+      if (record == nullptr)
+        continue;
+      site = record;
+    }
+    llvm::IRBuilder<> builder(call);
+    llvm::Value *pointer = call->getArgOperand(0);
+    const std::uint64_t bits = guard.proven ? KindProven : 0;
+    if (argument) {
+      if (!need->isZero())
+        builder.CreateCall(
+            slow, {pointer, pointer, need,
+                   llvm::ConstantInt::get(i32, KindObject | bits), site});
+      call->replaceAllUsesWith(guard.length ? need : pointer);
+      call->eraseFromParent();
+      changed = true;
+      continue;
+    }
+    if (guard.live) {
+      builder.CreateCall(slow,
+                         {pointer, pointer, llvm::ConstantInt::get(i64, 0),
+                          llvm::ConstantInt::get(i32, KindLive | bits), site});
+      call->replaceAllUsesWith(pointer);
+      call->eraseFromParent();
+      changed = true;
+      continue;
+    }
+    llvm::Value *index = call->getArgOperand(1);
+    llvm::Value *step = call->getArgOperand(2);
+    llvm::Value *offset = call->getArgOperand(3);
+    llvm::Value *width = call->getArgOperand(4);
+    llvm::Value *delta = nullptr;
+    llvm::Value *kind = llvm::ConstantInt::get(i32, KindObject | bits);
+    const auto *constantIndex = llvm::dyn_cast<llvm::ConstantInt>(index);
+    const auto *constantStep = llvm::dyn_cast<llvm::ConstantInt>(step);
+    if (constantIndex != nullptr && constantStep != nullptr) {
+      bool overflow = false;
+      const llvm::APInt product =
+          constantIndex->getValue().smul_ov(constantStep->getValue(), overflow);
+      // (The helper fails such a guard; leave it to do so.)
+      if (overflow)
+        continue;
+      delta = llvm::ConstantInt::get(i64, product);
+    } else {
+      llvm::Value *product = builder.CreateBinaryIntrinsic(
+          llvm::Intrinsic::smul_with_overflow, index, step);
+      delta = builder.CreateExtractValue(product, 0);
+      llvm::Value *overflowed = builder.CreateExtractValue(product, 1);
+      kind = builder.CreateOr(
+          kind, builder.CreateShl(builder.CreateZExt(overflowed, i32), 2));
+    }
+    llvm::Value *element = builder.CreateGEP(i8, pointer, delta);
+    llvm::Value *at = builder.CreateGEP(i8, element, offset);
+    builder.CreateCall(slow, {pointer, at, width, kind, site});
+    call->replaceAllUsesWith(element);
+    call->eraseFromParent();
+    changed = true;
+  }
+  return changed ? llvm::PreservedAnalyses::none()
+                 : llvm::PreservedAnalyses::all();
+}
+
+//===----------------------------------------------------------------------===//
+// GuardMerge
+//===----------------------------------------------------------------------===//
+
+namespace {
+
+/// A canonical guard with constant width and kind, as bytes of a base.
+struct GuardFacts {
+  llvm::CallInst *call = nullptr;
+  const llvm::Value *from = nullptr;
+  llvm::Value *base = nullptr;
+  std::int64_t offset = 0;
+  std::int64_t width = 0;
+  bool live = false;
+  std::uint64_t kind = 0;
+};
+
+} // namespace
+
+static std::optional<GuardFacts> factsOf(llvm::CallInst &call,
+                                         const llvm::DataLayout &layout) {
+  if (!isSlowPathCall(call))
+    return std::nullopt;
+  const auto *width = llvm::dyn_cast<llvm::ConstantInt>(call.getArgOperand(2));
+  const auto *kind = llvm::dyn_cast<llvm::ConstantInt>(call.getArgOperand(3));
+  if (width == nullptr || kind == nullptr ||
+      (kind->getZExtValue() & KindOverflow) != 0 ||
+      !llvm::isa<llvm::ConstantPointerNull>(call.getArgOperand(4)))
+    return std::nullopt;
+  GuardFacts facts;
+  facts.call = &call;
+  facts.kind = kind->getZExtValue();
+  facts.live = (facts.kind & KindMask) == KindLive;
+  facts.width = static_cast<std::int64_t>(width->getZExtValue());
+  facts.from = call.getArgOperand(0)->stripPointerCasts();
+  llvm::APInt offset(64, 0);
+  facts.base = call.getArgOperand(1)->stripAndAccumulateConstantOffsets(
+      layout, offset, /*AllowNonInbounds=*/true);
+  if (offset.getSignificantBits() > 62 || facts.width < 0 ||
+      facts.width > std::int64_t{1048576})
+    return std::nullopt;
+  facts.offset = offset.getSExtValue();
+  return facts;
+}
+
+/// Whether passing `earlier` means `later` passes (same family).
+static bool covers(const GuardFacts &earlier, const GuardFacts &later) {
+  if (earlier.base != later.base ||
+      (earlier.kind & KindProven) != (later.kind & KindProven))
+    return false;
+  if (later.live) {
+    if (earlier.live)
+      return earlier.offset == later.offset;
+    // The byte at the pointer is a live object's.
+    return earlier.width >= 1 && earlier.offset <= later.offset &&
+           later.offset < earlier.offset + earlier.width;
+  }
+  // The slow path looks at `from` only for stack and global objects; the
+  // same `from` gives the same answer for the same bytes.
+  return !earlier.live && earlier.from == later.from &&
+         earlier.offset <= later.offset &&
+         later.offset + later.width <= earlier.offset + earlier.width;
+}
+
+/// Whether nothing between `earlier` and `later` (which it dominates) may
+/// release or register an object.
+static bool unclobbered(llvm::MemorySSA &memory, const GuardFacts &earlier,
+                        const GuardFacts &later) {
+  llvm::MemoryAccess *laterAccess = memory.getMemoryAccess(later.call);
+  const llvm::MemoryAccess *earlierAccess =
+      memory.getMemoryAccess(earlier.call);
+  if (laterAccess == nullptr || earlierAccess == nullptr)
+    return false;
+  const llvm::MemoryAccess *clobber =
+      memory.getWalker()->getClobberingMemoryAccess(laterAccess);
+  return clobber != nullptr && memory.dominates(clobber, earlierAccess);
+}
+
+/// Whether control always reaches `last` once `first` (in the same block,
+/// before it) returns.
+static bool reachedTogether(const llvm::Instruction &first,
+                            const llvm::Instruction &last) {
+  for (const llvm::Instruction *at = first.getNextNode();
+       at != nullptr && at != &last; at = at->getNextNode())
+    if (!isSlowPathCall(*at) &&
+        !llvm::isGuaranteedToTransferExecutionToSuccessor(at))
+      return false;
+  return true;
+}
+
+// NOLINTBEGIN(readability-convert-member-functions-to-static): the pass
+// manager calls `run` on an instance.
+llvm::PreservedAnalyses
+GuardMerge::run(llvm::Function &function,
+                llvm::FunctionAnalysisManager &analyses) {
+  // NOLINTEND(readability-convert-member-functions-to-static)
+  const llvm::DataLayout &layout = function.getParent()->getDataLayout();
+  std::vector<GuardFacts> guards;
+  for (llvm::BasicBlock &block : function)
+    for (llvm::Instruction &instruction : block)
+      if (auto *call = llvm::dyn_cast<llvm::CallInst>(&instruction))
+        if (std::optional<GuardFacts> facts = factsOf(*call, layout))
+          guards.push_back(*facts);
+  if (guards.size() < 2)
+    return llvm::PreservedAnalyses::all();
+  const auto &tree = analyses.getResult<llvm::DominatorTreeAnalysis>(function);
+  auto &memory =
+      analyses.getResult<llvm::MemorySSAAnalysis>(function).getMSSA();
+
+  // Hulls first: consecutive guards of one block on one base, as one guard
+  // of at most 16 bytes (the inline check's span).
+  bool changed = false;
+  std::vector<bool> erased(guards.size(), false);
+  for (std::size_t i = 0; i < guards.size(); ++i) {
+    if (erased[i] || guards[i].live)
+      continue;
+    for (std::size_t j = i + 1; j < guards.size(); ++j) {
+      if (erased[j] || guards[j].live)
+        continue;
+      GuardFacts &first = guards[i];
+      const GuardFacts &next = guards[j];
+      if (next.call->getParent() != first.call->getParent())
+        break;
+      if (next.base != first.base || next.from != first.from ||
+          next.kind != first.kind)
+        continue;
+      const std::int64_t low = std::min(first.offset, next.offset);
+      const std::int64_t high =
+          std::max(first.offset + first.width, next.offset + next.width);
+      if (high - low > 16 || !reachedTogether(*first.call, *next.call) ||
+          !unclobbered(memory, first, next))
+        continue;
+      if (low != first.offset) {
+        llvm::IRBuilder<> builder(first.call);
+        first.call->setArgOperand(
+            1, builder.CreateGEP(
+                   builder.getInt8Ty(), first.base,
+                   builder.getInt64(static_cast<std::uint64_t>(low))));
+      }
+      first.call->setArgOperand(
+          2, llvm::ConstantInt::get(first.call->getArgOperand(2)->getType(),
+                                    static_cast<std::uint64_t>(high - low)));
+      first.offset = low;
+      first.width = high - low;
+      erased[j] = true;
+      changed = true;
+    }
+  }
+  // Then whatever a dominating guard covers.
+  for (std::size_t j = 0; j < guards.size(); ++j) {
+    if (erased[j])
+      continue;
+    for (std::size_t i = 0; i < guards.size(); ++i) {
+      if (i == j || erased[i] || !covers(guards[i], guards[j]) ||
+          !tree.dominates(guards[i].call, guards[j].call) ||
+          !unclobbered(memory, guards[i], guards[j]))
+        continue;
+      erased[j] = true;
+      changed = true;
+      break;
+    }
+  }
+  for (std::size_t i = 0; i < guards.size(); ++i)
+    if (erased[i]) {
+      if (llvm::MemoryAccess *access = memory.getMemoryAccess(guards[i].call))
+        llvm::MemorySSAUpdater(&memory).removeMemoryAccess(access);
+      guards[i].call->eraseFromParent();
+    }
+  if (!changed)
+    return llvm::PreservedAnalyses::all();
+  llvm::PreservedAnalyses kept;
+  kept.preserveSet<llvm::CFGAnalyses>();
+  kept.preserve<llvm::MemorySSAAnalysis>();
+  return kept;
+}
+
+//===----------------------------------------------------------------------===//
+// GuardExpand
+//===----------------------------------------------------------------------===//
+
+/// The alignment of the access the guard `call` is for: a load or store of
+/// its bytes later in its block, or 1.
+static std::uint64_t accessAlignment(const llvm::CallInst &call,
+                                     const llvm::DataLayout &layout) {
+  llvm::APInt offset(64, 0);
+  const llvm::Value *base =
+      call.getArgOperand(1)->stripAndAccumulateConstantOffsets(
+          layout, offset, /*AllowNonInbounds=*/true);
+  for (const llvm::Instruction *at = call.getNextNode(); at != nullptr;
+       at = at->getNextNode()) {
+    const llvm::Value *pointer = nullptr;
+    llvm::Align align;
+    if (const auto *load = llvm::dyn_cast<llvm::LoadInst>(at)) {
+      pointer = load->getPointerOperand();
+      align = load->getAlign();
+    } else if (const auto *store = llvm::dyn_cast<llvm::StoreInst>(at)) {
+      pointer = store->getPointerOperand();
+      align = store->getAlign();
+    } else if (llvm::isa<llvm::CallBase>(at) && !isSlowPathCall(*at)) {
+      break;
+    }
+    if (pointer == nullptr)
+      continue;
+    llvm::APInt accessOffset(64, 0);
+    if (pointer->stripAndAccumulateConstantOffsets(
+            layout, accessOffset, /*AllowNonInbounds=*/true) == base &&
+        accessOffset == offset)
+      return align.value();
+  }
+  return 1;
+}
+
+// NOLINTBEGIN(readability-convert-member-functions-to-static): the pass
+// manager calls `run` on an instance.
+llvm::PreservedAnalyses
+GuardExpand::run(llvm::Function &function,
+                 llvm::FunctionAnalysisManager & /*analyses*/) {
+  // NOLINTEND(readability-convert-member-functions-to-static)
+  llvm::Module &module = *function.getParent();
+  const llvm::DataLayout &layout = module.getDataLayout();
+  if (layout.getPointerSizeInBits() != 64)
+    return llvm::PreservedAnalyses::all();
+  std::vector<llvm::CallInst *> calls;
+  for (llvm::BasicBlock &block : function)
+    for (llvm::Instruction &instruction : block)
+      if (isSlowPathCall(instruction))
+        calls.push_back(llvm::cast<llvm::CallInst>(&instruction));
+  if (calls.empty())
+    return llvm::PreservedAnalyses::all();
+  llvm::LLVMContext &context = module.getContext();
+  llvm::Type *i8 = llvm::Type::getInt8Ty(context);
+  llvm::Type *i64 = llvm::Type::getInt64Ty(context);
+  llvm::Constant *heap = module.getOrInsertGlobal("__weavec_rt_heap",
+                                                  llvm::ArrayType::get(i64, 4));
+  llvm::MDNode *invariant = llvm::MDNode::get(context, {});
+  llvm::MDBuilder metadata(context);
+  llvm::MDNode *likely = metadata.createLikelyBranchWeights();
+  bool changed = false;
+  // §1.4: the descriptor, loaded once in the entry block (a function that
+  // starts before the runtime does sees an empty arena and a zero mask, and
+  // asks the runtime, which is correct for every address).
+  // A function with thousands of guards loads the arena's bounds at each
+  // guard instead, as plain loads: thousands of uses of them made the code
+  // generator's common-subexpression pass quadratic. The shadow's base and
+  // mask, which every guard reads first, are loaded once at the entry.
+  const bool hoisted = calls.size() <= MaxHoistedGuards;
+  // The descriptor's fields, loaded once at the entry when hoisted.
+  struct Field {
+    unsigned offset;
+    llvm::Value *value;
+  };
+  std::array<Field, 4> descriptor = {
+      Field{.offset = HeapBase, .value = nullptr},
+      Field{.offset = HeapBytes, .value = nullptr},
+      Field{.offset = HeapShadow, .value = nullptr},
+      Field{.offset = HeapMask, .value = nullptr}};
+  {
+    llvm::IRBuilder<> entry(&*function.getEntryBlock().getFirstInsertionPt());
+    for (Field &field : descriptor) {
+      if (!hoisted && field.offset != HeapShadow && field.offset != HeapMask)
+        continue;
+      llvm::LoadInst *load = entry.CreateAlignedLoad(
+          i64, entry.CreateConstGEP1_64(i8, heap, field.offset),
+          llvm::Align(8));
+      load->setMetadata(llvm::LLVMContext::MD_invariant_load, invariant);
+      field.value = load;
+    }
+  }
+  for (llvm::CallInst *call : calls) {
+    const auto *width =
+        llvm::dyn_cast<llvm::ConstantInt>(call->getArgOperand(2));
+    llvm::Value *kind = call->getArgOperand(3);
+    const auto *kindConstant = llvm::dyn_cast<llvm::ConstantInt>(kind);
+    // The kind is constant but for its overflow bit (§1.2).
+    std::uint64_t staticKind = 0;
+    if (kindConstant != nullptr) {
+      staticKind = kindConstant->getZExtValue();
+      if ((staticKind & KindOverflow) != 0)
+        continue;
+    } else {
+      const llvm::KnownBits known = llvm::computeKnownBits(kind, layout);
+      const llvm::APInt fixed = known.Zero | known.One;
+      if ((~fixed).getZExtValue() != KindOverflow)
+        continue;
+      staticKind = known.One.getZExtValue();
+    }
+    const bool live = (staticKind & KindMask) == KindLive;
+    const std::uint64_t bytes = width != nullptr ? width->getZExtValue() : 0;
+    if (!live && (bytes == 0 || bytes > 16))
+      continue;
+    // An access whose alignment is a multiple of its width stays in one
+    // granule.
+    const bool oneGranule =
+        live || bytes == 1 ||
+        (llvm::isPowerOf2_64(bytes) && accessAlignment(*call, layout) >= bytes);
+
+    // head: the shadow byte; check: a partial granule or a crossing access;
+    // slow: the call; after: the rest of the block.
+    llvm::BasicBlock *head = call->getParent();
+    llvm::BasicBlock *slow =
+        head->splitBasicBlock(call->getIterator(), "weavec.guard.slow");
+    llvm::BasicBlock *after = slow->splitBasicBlock(
+        std::next(call->getIterator()), head->getName() + ".guarded");
+    head->getTerminator()->eraseFromParent();
+    llvm::IRBuilder<> builder(head);
+    const auto field = [&](unsigned offset) -> llvm::Value * {
+      for (const Field &each : descriptor)
+        if (each.offset == offset && each.value != nullptr)
+          return each.value;
+      return builder.CreateAlignedLoad(
+          i64, builder.CreateConstGEP1_64(i8, heap, offset), llvm::Align(8));
+    };
+    llvm::Value *address =
+        builder.CreatePtrToInt(call->getArgOperand(live ? 0 : 1), i64);
+    // §2.3: the granule's byte, at shadow + ((a >> 4) & mask).
+    llvm::Value *byteAt = builder.CreateGEP(
+        i8, builder.CreateIntToPtr(field(HeapShadow), builder.getPtrTy()),
+        builder.CreateAnd(builder.CreateLShr(address, 4), field(HeapMask)));
+    llvm::Value *byte = builder.CreateLoad(i8, byteAt);
+    llvm::Value *overflowFree = nullptr;
+    if (kindConstant == nullptr)
+      overflowFree = builder.CreateICmpEQ(
+          builder.CreateAnd(kind, builder.getInt32(KindOverflow)),
+          builder.getInt32(0));
+    const auto withOverflow = [&](llvm::Value *condition) {
+      return overflowFree != nullptr
+                 ? builder.CreateAnd(condition, overflowFree)
+                 : condition;
+    };
+    // An address outside the arena whose byte is 0 is untracked (every
+    // tracked object outside the arena has a non-zero byte).
+    const auto outsideArena = [&] {
+      return builder.CreateICmpUGE(builder.CreateSub(address, field(HeapBase)),
+                                   field(HeapBytes));
+    };
+    // 0x41-0x50: the last granule, with v - 0x40 bytes (r is 0); 0x81-0xBF:
+    // at least r granules follow in the object (`run`). Granules d apart are
+    // of one object when d is at most the earlier one's r. The
+    // bytes at `end` (in the granule's terms) are in one stack or global
+    // object with the byte `from` points to.
+    const auto exactObject = [&](llvm::Value *count, llvm::Value *fromCount,
+                                 llvm::Value *fromAddress, llvm::Value *end) {
+      const auto exact = [&](llvm::Value *value) {
+        return builder.CreateOr(
+            builder.CreateAnd(
+                builder.CreateICmpUGT(value, builder.getInt64(0x40)),
+                builder.CreateICmpULE(value, builder.getInt64(0x50))),
+            builder.CreateAnd(
+                builder.CreateICmpUGT(value, builder.getInt64(0x80)),
+                builder.CreateICmpULE(value, builder.getInt64(0xBF))));
+      };
+      // The least r a run byte says: v - 0x80 up to 0xB0, 2^(v - 0xAC)
+      // above (runtime/weavec_rt.h).
+      const auto run = [&](llvm::Value *value) {
+        return builder.CreateSelect(
+            builder.CreateICmpUGT(value, builder.getInt64(0x80)),
+            builder.CreateSelect(
+                builder.CreateICmpULE(value, builder.getInt64(0xB0)),
+                builder.CreateSub(value, builder.getInt64(0x80)),
+                builder.CreateShl(
+                    builder.getInt64(1),
+                    builder.CreateSub(value, builder.getInt64(0xAC)))),
+            builder.getInt64(0));
+      };
+      // (Two or more granules after it: the next one is whole, and holds
+      // the rest of an access that crosses into it.)
+      llvm::Value *bytesThere = builder.CreateSelect(
+          builder.CreateICmpULE(count, builder.getInt64(0x50)),
+          builder.CreateSub(count, builder.getInt64(0x40)),
+          builder.CreateSelect(
+              builder.CreateICmpUGE(count, builder.getInt64(0x82)),
+              builder.getInt64(32), builder.getInt64(16)));
+      llvm::Value *distance = builder.CreateSub(
+          builder.CreateLShr(address, 4), builder.CreateLShr(fromAddress, 4));
+      llvm::Value *sameObject = builder.CreateSelect(
+          builder.CreateICmpSGE(distance, builder.getInt64(0)),
+          builder.CreateICmpULE(distance, run(fromCount)),
+          builder.CreateICmpULE(builder.CreateNeg(distance), run(count)));
+      return builder.CreateAnd(
+          builder.CreateAnd(exact(count), exact(fromCount)),
+          builder.CreateAnd(sameObject,
+                            builder.CreateICmpULE(end, bytesThere)));
+    };
+    // A function with thousands of guards gets the compact form: two
+    // blocks, the runtime for anything else (the full form's blocks kept
+    // the code generator on such a function for seconds).
+    if (!hoisted) {
+      llvm::Value *inGranule =
+          oneGranule ? builder.getTrue()
+                     : builder.CreateICmpULE(
+                           builder.CreateAdd(
+                               builder.CreateAnd(address, builder.getInt64(15)),
+                               builder.getInt64(bytes)),
+                           builder.getInt64(16));
+      llvm::Value *passes =
+          live
+              ? builder.CreateICmpNE(byte, builder.getInt8(0))
+              : builder.CreateAnd(
+                    builder.CreateICmpEQ(byte, builder.getInt8(16)), inGranule);
+      if (live) {
+        builder.CreateCondBr(withOverflow(passes), after, slow, likely);
+        changed = true;
+        continue;
+      }
+      // Untracked bytes (a byte of 0 outside the arena) reached from
+      // untracked memory pass too, a frame's `alloca` buffers, and so do a
+      // stack or global object's bytes reached from inside it.
+      llvm::BasicBlock *untracked = llvm::BasicBlock::Create(
+          context, "weavec.guard.untracked", &function, slow);
+      builder.CreateCondBr(withOverflow(passes), after, untracked, likely);
+      builder.SetInsertPoint(untracked);
+      llvm::Value *from = call->getArgOperand(0);
+      llvm::Value *fromAddress = builder.CreatePtrToInt(from, i64);
+      llvm::Value *fromByte = byte;
+      if (from->stripPointerCasts() !=
+          call->getArgOperand(1)->stripPointerCasts())
+        fromByte = builder.CreateLoad(
+            i8,
+            builder.CreateGEP(
+                i8,
+                builder.CreateIntToPtr(field(HeapShadow), builder.getPtrTy()),
+                builder.CreateAnd(builder.CreateLShr(fromAddress, 4),
+                                  field(HeapMask))));
+      llvm::Value *passesUntracked = builder.CreateAnd(
+          builder.CreateAnd(builder.CreateICmpEQ(byte, builder.getInt8(0)),
+                            builder.CreateICmpEQ(fromByte, builder.getInt8(0))),
+          builder.CreateAnd(inGranule, outsideArena()));
+      llvm::Value *end =
+          builder.CreateAdd(builder.CreateAnd(address, builder.getInt64(15)),
+                            builder.getInt64(bytes));
+      llvm::Value *count = builder.CreateZExt(byte, i64);
+      llvm::Value *object = exactObject(
+          count, builder.CreateZExt(fromByte, i64), fromAddress, end);
+      // A whole heap granule followed by one that holds the rest.
+      llvm::Value *crossing = builder.getFalse();
+      if (!oneGranule) {
+        llvm::Value *next = builder.CreateZExt(
+            builder.CreateLoad(i8, builder.CreateConstGEP1_64(i8, byteAt, 1)),
+            i64);
+        crossing = builder.CreateAnd(
+            builder.CreateICmpEQ(count, builder.getInt64(16)),
+            builder.CreateAnd(
+                builder.CreateICmpULE(next, builder.getInt64(16)),
+                builder.CreateICmpULE(
+                    builder.CreateSub(end, builder.getInt64(16)), next)));
+      }
+      builder.CreateCondBr(
+          withOverflow(builder.CreateOr(
+              builder.CreateOr(passesUntracked, object), crossing)),
+          after, slow);
+      changed = true;
+      continue;
+    }
+    llvm::BasicBlock *check = llvm::BasicBlock::Create(
+        context, "weavec.guard.check", &function, slow);
+    if (live) {
+      builder.CreateCondBr(
+          withOverflow(builder.CreateICmpNE(byte, builder.getInt8(0))), after,
+          check, likely);
+      builder.SetInsertPoint(check);
+      builder.CreateCondBr(withOverflow(outsideArena()), after, slow);
+      changed = true;
+      continue;
+    }
+    // e = (a & 15) + w: the end of the bytes in the granule's terms. A whole
+    // granule (16) holds an access that stays in it.
+    llvm::Value *end =
+        builder.CreateAdd(builder.CreateAnd(address, builder.getInt64(15)),
+                          builder.getInt64(bytes));
+    llvm::Value *whole = builder.CreateICmpEQ(byte, builder.getInt8(16));
+    if (!oneGranule)
+      whole = builder.CreateAnd(
+          whole, builder.CreateICmpULE(end, builder.getInt64(16)));
+    builder.CreateCondBr(withOverflow(whole), after, check, likely);
+    // A partial granule (1-15) holds the bytes when its count covers e; a
+    // whole granule followed by one that covers e - 16 holds a crossing
+    // access; untracked bytes in one granule pass when they were reached
+    // from no live tracked object.
+    builder.SetInsertPoint(check);
+    llvm::Value *count = builder.CreateZExt(byte, i64);
+    llvm::Value *partial =
+        builder.CreateAnd(builder.CreateICmpULT(count, builder.getInt64(16)),
+                          builder.CreateICmpULE(end, count));
+    llvm::Value *next = builder.CreateZExt(
+        builder.CreateLoad(i8, builder.CreateConstGEP1_64(i8, byteAt, 1)), i64);
+    llvm::Value *crossing = builder.CreateAnd(
+        builder.CreateAnd(builder.CreateICmpUGT(end, builder.getInt64(16)),
+                          builder.CreateICmpEQ(count, builder.getInt64(16))),
+        builder.CreateAnd(
+            builder.CreateICmpULE(next, builder.getInt64(16)),
+            builder.CreateICmpULE(builder.CreateSub(end, builder.getInt64(16)),
+                                  next)));
+    // The byte of the granule `from` points into: untracked bytes pass when
+    // it is 0; a stack or global object's bytes when it is in the same
+    // object (§2.1: the distance between the granules equals the difference
+    // of their r).
+    llvm::Value *from = call->getArgOperand(0);
+    llvm::Value *fromAddress = builder.CreatePtrToInt(from, i64);
+    llvm::Value *fromByte = byte;
+    if (from->stripPointerCasts() !=
+        call->getArgOperand(1)->stripPointerCasts())
+      fromByte = builder.CreateLoad(
+          i8,
+          builder.CreateGEP(
+              i8, builder.CreateIntToPtr(field(HeapShadow), builder.getPtrTy()),
+              builder.CreateAnd(builder.CreateLShr(fromAddress, 4),
+                                field(HeapMask))));
+    llvm::Value *oneGranuleEnd =
+        builder.CreateICmpULE(end, builder.getInt64(16));
+    llvm::Value *untracked = builder.CreateAnd(
+        builder.CreateAnd(builder.CreateICmpEQ(count, builder.getInt64(0)),
+                          oneGranuleEnd),
+        builder.CreateAnd(outsideArena(),
+                          builder.CreateICmpEQ(fromByte, builder.getInt8(0))));
+    llvm::Value *object =
+        exactObject(count, builder.CreateZExt(fromByte, i64), fromAddress, end);
+    builder.CreateCondBr(
+        withOverflow(builder.CreateOr(builder.CreateOr(partial, crossing),
+                                      builder.CreateOr(untracked, object))),
+        after, slow);
+    changed = true;
+  }
+  for (llvm::CallInst *call : calls)
+    call->addFnAttr(llvm::Attribute::Cold);
+  return changed ? llvm::PreservedAnalyses::none()
+                 : llvm::PreservedAnalyses::all();
+}
+
+//===----------------------------------------------------------------------===//
+// GlobalPadding
+//===----------------------------------------------------------------------===//
+
+// NOLINTBEGIN(readability-convert-member-functions-to-static): the pass
+// manager calls `run` on an instance.
+llvm::PreservedAnalyses
+GlobalPadding::run(llvm::Module &module,
+                   llvm::ModuleAnalysisManager & /*analyses*/) {
+  // NOLINTEND(readability-convert-member-functions-to-static)
+  // The globals the unit's descriptors register (`{&g, sizeof g}`).
+  llvm::SetVector<llvm::GlobalVariable *> registered;
+  for (llvm::GlobalVariable &descriptor : module.globals()) {
+    const llvm::StringRef section = descriptor.getSection();
+    const auto *pair =
+        descriptor.hasInitializer()
+            ? llvm::dyn_cast<llvm::ConstantArray>(descriptor.getInitializer())
+            : nullptr;
+    if ((section != "__DATA,__weavec_glob" && section != "weavec_globals") ||
+        pair == nullptr || pair->getNumOperands() != 2)
+      continue;
+    auto *global = llvm::dyn_cast<llvm::GlobalVariable>(
+        pair->getOperand(0)->stripPointerCasts());
+    if (global != nullptr && global->hasInitializer() &&
+        !global->hasCommonLinkage() && !global->hasAvailableExternallyLinkage())
+      registered.insert(global);
+  }
+  // Each is padded to whole granules, and by one more when it fills its
+  // last: the linker may place anything right after it (a string literal in
+  // the bytes its last granule leaves, or at its one-past address), and the
+  // shadow would give those bytes to it.
+  const llvm::DataLayout &layout = module.getDataLayout();
+  llvm::LLVMContext &context = module.getContext();
+  for (llvm::GlobalVariable *global : registered) {
+    llvm::Type *type = global->getValueType();
+    const std::uint64_t bytes = layout.getTypeAllocSize(type);
+    const std::uint64_t padding = 16 - (bytes % 16);
+    llvm::ArrayType *tail =
+        llvm::ArrayType::get(llvm::Type::getInt8Ty(context), padding);
+    llvm::StructType *paddedType =
+        llvm::StructType::get(context, {type, tail}, /*isPacked=*/true);
+    auto *padded = new llvm::GlobalVariable(
+        module, paddedType, global->isConstant(), global->getLinkage(),
+        llvm::ConstantStruct::get(
+            paddedType,
+            {global->getInitializer(), llvm::ConstantAggregateZero::get(tail)}),
+        "", global, global->getThreadLocalMode(), global->getAddressSpace(),
+        global->isExternallyInitialized());
+    padded->copyAttributesFrom(global);
+    padded->setAlignment(
+        std::max(global->getAlign().valueOrOne(), llvm::Align(16)));
+    padded->setComdat(global->getComdat());
+    padded->copyMetadata(global, 0);
+    padded->takeName(global);
+    global->replaceAllUsesWith(padded);
+    global->eraseFromParent();
+  }
+  return registered.empty() ? llvm::PreservedAnalyses::all()
+                            : llvm::PreservedAnalyses::none();
+}
+
+void registerGuardPasses(clang::CodeGenOptions &options) {
+  options.PassBuilderCallbacks.emplace_back([](llvm::PassBuilder &builder) {
+    builder.registerPipelineStartEPCallback(
+        [](llvm::ModulePassManager &passes, llvm::OptimizationLevel /*level*/) {
+          passes.addPass(GlobalPadding());
+          passes.addPass(
+              llvm::createModuleToFunctionPassAdaptor(GuardCanonicalize()));
+        });
+    builder.registerOptimizerLastEPCallback(
+        [](llvm::ModulePassManager &passes, llvm::OptimizationLevel level,
+           llvm::ThinOrFullLTOPhase /*phase*/) {
+          llvm::FunctionPassManager guards;
+          if (level != llvm::OptimizationLevel::O0)
+            guards.addPass(GuardMerge());
+          guards.addPass(GuardExpand());
+          passes.addPass(
+              llvm::createModuleToFunctionPassAdaptor(std::move(guards)));
+        });
+  });
+}
+
+} // namespace weavec::frontend
diff --git a/lib/Frontend/ObjectRegistration.cpp b/lib/Frontend/ObjectRegistration.cpp
index 98a82df1..1f47947c 100644
--- a/lib/Frontend/ObjectRegistration.cpp
+++ b/lib/Frontend/ObjectRegistration.cpp
@@ -9,13 +9,16 @@
 #include "weavec/Frontend/ObjectRegistration.h"
 
 #include "weavec/Analysis/BypassedDeclarations.h"
+#include "weavec/Analysis/KindTable.h"
 #include "weavec/Analysis/SiteCollector.h"
+#include "weavec/Core/CheckPlan.h"
 #include "weavec/Core/LibrarySpec.h"
 
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/Attr.h"
 #include "clang/AST/Decl.h"
 #include "clang/AST/Expr.h"
+#include "clang/AST/ParentMap.h"
 #include "clang/AST/RecursiveASTVisitor.h"
 #include "clang/AST/Stmt.h"
 #include "clang/Basic/Builtins.h"
@@ -26,6 +29,8 @@
 #include "llvm/ADT/SmallVector.h"
 #include "llvm/Support/Casting.h"
 
+#include <algorithm>
+
 namespace weavec::frontend {
 
 /// The local variable an lvalue is, or is part of: through parentheses, `.`
@@ -68,12 +73,20 @@ static bool hasFlexibleArray(clang::QualType type) {
   return record != nullptr && record->hasFlexibleArrayMember();
 }
 
+/// RFC 0034 §4: the arguments of each call that a guard looks up;
+/// `GuardedArgumentAll` when the guard's operand is not one argument.
+constexpr unsigned GuardedArgumentAll = ~0U;
+using GuardedArguments =
+    llvm::DenseMap<const clang::Stmt *, llvm::DenseSet<unsigned>>;
+
 namespace {
 
 /// What one function body says about its locals.
 class LocalWalker : public clang::RecursiveASTVisitor<LocalWalker> {
 public:
-  explicit LocalWalker(const core::LibrarySpec &spec) : library(spec) {}
+  LocalWalker(clang::Stmt &body, const core::LibrarySpec &spec,
+              const GuardedArguments &guarded)
+      : parents(&body), library(spec), guardedArguments(guarded) {}
 
   /// In declaration order.
   llvm::SmallVector<const clang::VarDecl *, 8> declared;
@@ -129,7 +142,8 @@ class LocalWalker : public clang::RecursiveASTVisitor<LocalWalker> {
     if (cast->getCastKind() != clang::CK_ArrayToPointerDecay ||
         directBases.contains(cast))
       return true;
-    if (const clang::VarDecl *variable = rootLocal(cast->getSubExpr()))
+    if (const clang::VarDecl *variable = rootLocal(cast->getSubExpr());
+        variable != nullptr && reachesGuard(*cast))
       escaping.insert(variable);
     return true;
   }
@@ -137,7 +151,8 @@ class LocalWalker : public clang::RecursiveASTVisitor<LocalWalker> {
   bool VisitUnaryOperator(clang::UnaryOperator *op) {
     if (op->getOpcode() != clang::UO_AddrOf)
       return true;
-    if (const clang::VarDecl *variable = rootLocal(op->getSubExpr()))
+    if (const clang::VarDecl *variable = rootLocal(op->getSubExpr());
+        variable != nullptr && reachesGuard(*op))
       escaping.insert(variable);
     return true;
   }
@@ -168,8 +183,84 @@ class LocalWalker : public clang::RecursiveASTVisitor<LocalWalker> {
   // NOLINTEND(readability-identifier-naming,bugprone-derived-method-shadowing-base-method)
 
 private:
+  /// The body's (the unit's parent map costs a large unit too much).
+  clang::ParentMap parents;
   const core::LibrarySpec &library;
+  const GuardedArguments &guardedArguments;
   llvm::DenseSet<const clang::Expr *> directBases;
+
+  /// Whether the value of `call` is used: not a statement of its own (`memcpy`
+  /// as a statement), nor cast to `void`.
+  bool resultUsed(const clang::CallExpr &call) {
+    const clang::Stmt *at = &call;
+    for (const clang::Stmt *parent = parents.getParent(at); parent != nullptr;
+         at = parent, parent = parents.getParent(at)) {
+      if (llvm::isa<clang::ParenExpr>(parent))
+        continue;
+      if (const auto *cast = llvm::dyn_cast<clang::CastExpr>(parent))
+        return !cast->getType()->isVoidType();
+      return llvm::isa<clang::Expr>(parent) ||
+             llvm::isa<clang::DeclStmt>(parent) ||
+             llvm::isa<clang::ReturnStmt>(parent) ||
+             llvm::isa<clang::IfStmt>(parent) ||
+             llvm::isa<clang::WhileStmt>(parent) ||
+             llvm::isa<clang::ForStmt>(parent) ||
+             llvm::isa<clang::DoStmt>(parent) ||
+             llvm::isa<clang::SwitchStmt>(parent);
+    }
+    return false;
+  }
+
+  /// RFC 0034 §4: whether a guard can look up the local whose address
+  /// `address` is. Not when the address is only an argument of a library
+  /// function (no guard runs inside it) that takes no callback (which a
+  /// guard could run in) and whose call guards none of its arguments.
+  bool reachesGuard(const clang::Expr &address) {
+    const clang::Expr *at = &address;
+    for (unsigned depth = 0; depth < 16; ++depth) {
+      const clang::Stmt *parent = parents.getParent(at);
+      if (parent == nullptr)
+        return true;
+      if (const auto *paren = llvm::dyn_cast<clang::ParenExpr>(parent)) {
+        at = paren;
+        continue;
+      }
+      if (const auto *cast = llvm::dyn_cast<clang::CastExpr>(parent);
+          cast != nullptr && cast->getType()->isPointerType() &&
+          (llvm::isa<clang::ImplicitCastExpr>(cast) ||
+           llvm::isa<clang::CStyleCastExpr>(cast))) {
+        at = cast;
+        continue;
+      }
+      const auto *call = llvm::dyn_cast<clang::CallExpr>(parent);
+      if (call == nullptr || call->getCallee() == at)
+        return true;
+      if (const auto guarded = guardedArguments.find(call);
+          guarded != guardedArguments.end()) {
+        unsigned position = 0;
+        while (position < call->getNumArgs() && call->getArg(position) != at)
+          ++position;
+        if (guarded->second.contains(GuardedArgumentAll) ||
+            guarded->second.contains(position))
+          return true;
+      }
+      const clang::FunctionDecl *callee = call->getDirectCallee();
+      if (callee == nullptr ||
+          !analysis::governingLibraryEntry(*callee, library).has_value())
+        return true;
+      // A library function that returns a pointer may return one into its
+      // argument (`strtok`, `strchr`): when the program keeps it.
+      if (call->getType()->isPointerType() && resultUsed(*call))
+        return true;
+      // (The type as passed: a function's name decays to its pointer.)
+      return std::ranges::any_of(
+          call->arguments(), [](const clang::Expr *argument) {
+            const clang::QualType type = argument->getType();
+            return type->isFunctionPointerType() || type->isBlockPointerType();
+          });
+    }
+    return true;
+  }
 };
 
 } // namespace
@@ -227,8 +318,25 @@ static const clang::VarDecl *definitionOf(const clang::VarDecl &variable) {
 ObjectPlan planObjects(clang::ASTContext &context,
                        const analysis::SiteIndex &sites,
                        const core::LibrarySpec &library,
+                       const core::CheckPlan *checks,
                        const ObjectOptions &options) {
   ObjectPlan plan;
+  // RFC 0034 §4: the arguments a guard looks up, per call.
+  GuardedArguments guardedArguments;
+  if (checks != nullptr)
+    for (const core::CheckPlanEntry &entry : checks->entries)
+      if (entry.kind == core::CheckPlanEntry::Template::Object ||
+          entry.kind == core::CheckPlanEntry::Template::Live ||
+          entry.kind == core::CheckPlanEntry::Template::Release)
+        if (const analysis::SiteInfo *info = sites.info(entry.site);
+            info != nullptr && info->stmt != nullptr &&
+            llvm::isa<clang::CallExpr>(info->stmt))
+          guardedArguments[info->stmt].insert(
+              entry.placement ==
+                          core::CheckPlanEntry::Placement::WrapArgument &&
+                      entry.form != core::CheckPlanEntry::Form::Length
+                  ? entry.argument
+                  : GuardedArgumentAll);
   llvm::DenseSet<const clang::VarDecl *> seenGlobals;
   const auto addGlobal = [&](const clang::VarDecl &variable) {
     const clang::VarDecl *definition = definitionOf(variable);
@@ -243,7 +351,7 @@ ObjectPlan planObjects(clang::ASTContext &context,
     if (function.decl == nullptr || !function.decl->hasBody(definition) ||
         definition == nullptr || definition->hasAttr<clang::NakedAttr>())
       continue;
-    LocalWalker walker(library);
+    LocalWalker walker(*definition->getBody(), library, guardedArguments);
     walker.TraverseStmt(definition->getBody());
     for (const clang::VarDecl *variable : walker.statics)
       addGlobal(*variable);
@@ -300,15 +408,6 @@ ObjectPlan planObjects(clang::ASTContext &context,
                                        .loose = loose,
                                        .scoped = scoped});
     }
-    // A function with storage the list does not know and nothing to enter
-    // still says so: once it is inlined, that storage lies in a frame whose
-    // other objects would otherwise be taken to be all there is (§4.3).
-    if (loose && entered.empty())
-      plan.stack.push_back(StackObject{.variable = nullptr,
-                                       .statement = nullptr,
-                                       .function = definition,
-                                       .loose = true,
-                                       .scoped = false});
   }
 
   if (options.globals) {
diff --git a/lib/Frontend/Prelude.cpp b/lib/Frontend/Prelude.cpp
index 71d722a7..61fc8310 100644
--- a/lib/Frontend/Prelude.cpp
+++ b/lib/Frontend/Prelude.cpp
@@ -24,15 +24,21 @@ namespace weavec::frontend {
 //   $N     the family prefix, `__weavec_chk_` or `__weavec_prv_`
 //   $S     the name suffix: `_report` for out-of-line report helpers
 //   $P     report mode's trailing parameters (`, const char *file, ...`)
-//   $V     a parameterless helper's parameter list (`void` or report's)
 //   $F(t)  the failure for template `t`: a trap or a report
 //   $U     the usable-size query
 //   $R     the frame of the function a stack helper is called from
+//   $G     the guard kind bits of the family (RFC 0034 §2.5)
+//   $D     report mode's site record, declared in a guard's body
+//   $L     the site argument of `__weavec_rt_guard`: `&site` or `0`
+//   $B     a variadic wrapper's attributes: `static __attribute__((...)) `
+//          (it cannot be inlined), or nothing out of line
+//   $Q     report mode's trailing arguments (`, file, line, column`)
+//   $W     a variadic wrapper's last named parameter
 //
 // Only block comments: `//` is an error under -std=c89 -pedantic-errors.
 
 /// The check templates; each can fail. The verify family has all but
-/// `violation`, which `CheckHelpersViolation` holds.
+/// `violation`, which `CheckHelpersString` holds.
 static constexpr llvm::StringLiteral CheckHelpers = R"C(
 $A void *$Nnonnull$S(const volatile void *p$P) {
   if (__builtin_expect(p == 0, 0))
@@ -93,13 +99,9 @@ static constexpr llvm::StringLiteral CheckHelpers = R"C(
 }
 )C";
 
-/// The unconditional failure of a lowered violation, and the bounded
-/// string length of `str` requirements: `__weavec_chk_*` only.
-static constexpr llvm::StringLiteral CheckHelpersViolation = R"C(
-/* A lowered violation with no check of its own. */
-$A void $Nviolation$S($V) {
-  $F(violation);
-}
+/// The bounded string length of `str` requirements: `__weavec_chk_*`
+/// only.
+static constexpr llvm::StringLiteral CheckHelpersString = R"C(
 /* Bounded string length for str requirements; fails on null. */
 $A unsigned long long __weavec_strnlen$S(const char *s, unsigned long long max$P) {
   unsigned long long n = 0;
@@ -116,135 +118,101 @@ static constexpr llvm::StringLiteral CheckHelpersViolation = R"C(
 /// Term arithmetic: never C's own, which wraps unsigned values, is
 /// undefined on signed overflow and turns a negative count into a huge one.
 static constexpr llvm::StringLiteral TermHelpers = R"C(
-/* Term arithmetic over 64 bits. A need (a length, an offset, a
- * requirement) is over-approximated: on overflow it saturates to the
- * maximum and stays there. A have (an extent) is under-approximated: on
- * overflow it saturates to 0, and x - k stops at 0. The right operand of a
- * subtraction is computed in the other direction. A signed leaf enters
- * through need_s or have_s: a negative count is the maximum as a need and
- * 0 as a have. Every direction fails closed. */
+/* Term arithmetic. A term inside arithmetic is exact over `long long`, as
+ * the program computes it, and only its result enters through need_s or
+ * have_s: a negative result is the maximum as a need and 0 as a have. A
+ * need (a length, an offset, a requirement) is over-approximated: on
+ * overflow it saturates to LLONG_MAX and stays there. A have (an extent)
+ * is under-approximated: on overflow it saturates to LLONG_MIN and stays
+ * there. The right operand of a subtraction is computed in the other
+ * direction. A 64-bit unsigned leaf enters through term_u. Every direction
+ * fails closed. */
 $A unsigned long long __weavec_need_s(long long v) {
   return v < 0 ? ~(unsigned long long)0 : (unsigned long long)v;
 }
 $A unsigned long long __weavec_have_s(long long v) {
   return v < 0 ? 0 : (unsigned long long)v;
 }
-$A unsigned long long __weavec_need_add(unsigned long long a, unsigned long long b) {
-  unsigned long long r;
-  return __builtin_add_overflow(a, b, &r) ? ~(unsigned long long)0 : r;
-}
-$A unsigned long long __weavec_need_sub(unsigned long long a, unsigned long long b) {
-  return a == ~(unsigned long long)0 || b > a ? ~(unsigned long long)0 : a - b;
-}
-$A unsigned long long __weavec_need_mul(unsigned long long a, unsigned long long b) {
-  unsigned long long r;
-  return __builtin_mul_overflow(a, b, &r) ? ~(unsigned long long)0 : r;
-}
-$A unsigned long long __weavec_have_add(unsigned long long a, unsigned long long b) {
-  unsigned long long r;
-  return __builtin_add_overflow(a, b, &r) ? 0 : r;
-}
-$A unsigned long long __weavec_have_sub(unsigned long long a, unsigned long long b) {
-  return b > a ? 0 : a - b;
-}
-$A unsigned long long __weavec_have_mul(unsigned long long a, unsigned long long b) {
-  unsigned long long r;
-  return __builtin_mul_overflow(a, b, &r) ? 0 : r;
+$A long long __weavec_term_u(unsigned long long v) {
+  const unsigned long long max = ~(unsigned long long)0 >> 1;
+  return (long long)(v > max ? max : v);
+}
+$A long long __weavec_need_add(long long a, long long b) {
+  const long long max = (long long)(~(unsigned long long)0 >> 1);
+  long long r;
+  return a == max || b == max || __builtin_add_overflow(a, b, &r) ? max : r;
+}
+$A long long __weavec_need_sub(long long a, long long b) {
+  const long long max = (long long)(~(unsigned long long)0 >> 1);
+  long long r;
+  return a == max || b == -max - 1 || __builtin_sub_overflow(a, b, &r) ? max
+                                                                       : r;
+}
+$A long long __weavec_need_mul(long long a, long long b) {
+  const long long max = (long long)(~(unsigned long long)0 >> 1);
+  long long r;
+  return a == max || b == max || __builtin_mul_overflow(a, b, &r) ? max : r;
+}
+$A long long __weavec_need_div(long long a, long long k) {
+  const long long max = (long long)(~(unsigned long long)0 >> 1);
+  return a == max ? max : a / k - (a % k < 0);
+}
+$A long long __weavec_have_add(long long a, long long b) {
+  const long long min = -(long long)(~(unsigned long long)0 >> 1) - 1;
+  long long r;
+  return a == min || b == min || __builtin_add_overflow(a, b, &r) ? min : r;
+}
+$A long long __weavec_have_sub(long long a, long long b) {
+  const long long min = -(long long)(~(unsigned long long)0 >> 1) - 1;
+  long long r;
+  return a == min || b == -(min + 1) || __builtin_sub_overflow(a, b, &r) ? min
+                                                                         : r;
+}
+$A long long __weavec_have_mul(long long a, long long b) {
+  const long long min = -(long long)(~(unsigned long long)0 >> 1) - 1;
+  long long r;
+  return a == min || b == min || __builtin_mul_overflow(a, b, &r) ? min : r;
+}
+$A long long __weavec_have_div(long long a, long long k) {
+  const long long min = -(long long)(~(unsigned long long)0 >> 1) - 1;
+  return a == min ? min : a / k - (a % k < 0);
 }
 )C";
 
-/// RFC 0032, section 3: the guards, which ask the runtime's object table.
-/// Both families have them. An arena pointer is looked up inline (section
-/// 2.1's arithmetic and one load); a guard with a range cache (section 13)
-/// first asks the cache in its function's frame.
-static constexpr llvm::StringLiteral GuardHelpers = R"C(
-/* Guards (RFC 0032, section 3; RFC 0033, section 4). The `width` bytes at
- * q = p + off + i * step lie inside the live tracked object q points into: an
- * arena block is looked up here; anything else asks the runtime, which also
- * looks at where p points. */
+/// RFC 0034 §1.1: the guards the backend expands. Only the out-of-line
+/// prelude (`libweavec_chk.a`) defines them, as the slow path does them; the
+/// inline prelude declares them (`GuardDeclarations`).
+static constexpr llvm::StringLiteral GuardBodies = R"C(
+/* Guards (RFC 0032, section 3; RFC 0033, section 4; RFC 0034, section 2.5).
+ * The `width` bytes at q = p + off + i * step lie inside the live tracked
+ * object q points into, as the runtime answers for q and p. */
 $A void *$Nobject$S(const volatile void *p, long long i, unsigned long long step,
                     unsigned long long off, unsigned long long width$P) {
   long long delta = 0;
-  __typeof__(sizeof 0) a;
-  if (__builtin_expect(__builtin_mul_overflow(i, (long long)step, &delta), 0))
-    $F(object);
-  a = (__typeof__(sizeof 0))p + off + (__typeof__(sizeof 0))delta - __weavec_rt_heap.base;
-  if (__builtin_expect(a < __weavec_rt_heap.bytes, 1)) {
-    unsigned shift = __weavec_rt_heap.shift;
-    const struct __weavec_rt_class *c = &__weavec_rt_heap.table[a >> shift];
-    unsigned long long in = a & (((__typeof__(sizeof 0))1 << shift) - 1);
-    unsigned long long slot = in >> c->shift;
-    unsigned long long at;
-    unsigned word;
-    if (c->magic != 0)
-      slot = (slot * c->magic) >> 32;
-    word = ((const unsigned *)(__weavec_rt_heap.meta + ((a >> shift) << (shift - 2))))[slot];
-    at = in - slot * c->size;
-    if (__builtin_expect((word & 3) != 1 || width > (word >> 2) || at > (word >> 2) - width, 0))
-      $F(object);
-  } else if (__builtin_expect(__weavec_rt_object((const void *)p, i, step, off, width), 0))
-    $F(object);
+  unsigned kind = $G;$D
+  if (__builtin_mul_overflow(i, (long long)step, &delta))
+    kind |= 4u;
+  __weavec_rt_guard((const void *)p, (const char *)p + off + delta, width, kind, $L);
   return (char *)p + delta;
 }
-/* object, with a range cache {lo, len, state, expect} in the caller's frame:
- * the bytes of [lo, lo + len) pass while the word at `state` reads `expect`.
- * An arena block passes the bytes inside it whatever p is; any other object
- * also needs p in it (the runtime looked at p to admit it). An empty cache
- * has len 0, so its state is never read. A `quiet` guard is in a loop that
- * calls nothing and that checked the cache's state on the way in: nothing
- * can end an object the cache holds, so its state is not read. */
-$A void *$Nobject_c$S(const volatile void *p, long long i, unsigned long long step,
-                      unsigned long long off, unsigned long long width,
-                      unsigned long long *c, int quiet$P) {
-  long long delta = 0;
-  __typeof__(sizeof 0) a;
-  if (__builtin_expect(__builtin_mul_overflow(i, (long long)step, &delta), 0))
-    $F(object);
-  {
-    unsigned long long d = (unsigned long long)p + off + (unsigned long long)delta - c[0];
-    if (__builtin_expect(d <= c[1] && width <= c[1] - d && width != 0 &&
-                         (c[0] - __weavec_rt_heap.base < __weavec_rt_heap.bytes ||
-                          (unsigned long long)p - c[0] <= c[1]) &&
-                         (quiet || *(const unsigned *)c[2] == (unsigned)c[3]), 1))
-      return (char *)p + delta;
-  }
-  a = (__typeof__(sizeof 0))p + off + (__typeof__(sizeof 0))delta - __weavec_rt_heap.base;
-  if (__builtin_expect(a < __weavec_rt_heap.bytes, 1)) {
-    /* An arena block: looked up here, and remembered. */
-    unsigned shift = __weavec_rt_heap.shift;
-    const struct __weavec_rt_class *k = &__weavec_rt_heap.table[a >> shift];
-    unsigned long long in = a & (((__typeof__(sizeof 0))1 << shift) - 1);
-    unsigned long long slot = in >> k->shift;
-    unsigned long long at;
-    const unsigned *state;
-    unsigned word;
-    if (k->magic != 0)
-      slot = (slot * k->magic) >> 32;
-    state = (const unsigned *)(__weavec_rt_heap.meta + ((a >> shift) << (shift - 2))) + slot;
-    word = *state;
-    at = in - slot * k->size;
-    if (__builtin_expect((word & 3) != 1 || width > (word >> 2) || at > (word >> 2) - width, 0)) {
-      /* Where a failure is only reported, the next guard asks again. */
-      c[1] = 0;
-      $F(object);
-    } else {
-      c[0] = __weavec_rt_heap.base + a - at;
-      c[1] = word >> 2;
-      c[2] = (unsigned long long)state;
-      c[3] = word;
-    }
-  } else {
-    struct __weavec_rt_range r = __weavec_rt_object_range((const void *)p, i, step, off, width,
-                                                         __builtin_frame_address(0));
-    c[0] = r.lo;
-    c[1] = r.len;
-    c[2] = (unsigned long long)r.state;
-    c[3] = r.expect;
-    if (__builtin_expect(r.failed != 0, 0))
-      $F(object);
-  }
-  return (char *)p + delta;
+/* p does not point into a dead tracked object. */
+$A void *$Nlive$S(const volatile void *p$P) {
+  unsigned kind = 1u | $G;$D
+  __weavec_rt_guard((const void *)p, (const void *)p, 0, kind, $L);
+  return (void *)p;
 }
+)C";
+
+/// The same guards' declarations, in the inline prelude.
+static constexpr llvm::StringLiteral GuardDeclarations = R"C(
+extern void *$Nobject$S(const volatile void *, long long, unsigned long long,
+                        unsigned long long, unsigned long long$P);
+extern void *$Nlive$S(const volatile void *$P);
+)C";
+
+/// RFC 0032, section 3: the guards of a call's arguments, and of a release,
+/// which ask the runtime's object table out of line.
+static constexpr llvm::StringLiteral CallGuardHelpers = R"C(
 /* object, for a call's argument: `need` bytes from p; none needs no object. */
 $A void *$Nobject_n$S(const volatile void *p, unsigned long long need$P) {
   if (__builtin_expect(need != 0 && __weavec_rt_object((const void *)p, 0, 0, 0, need), 0))
@@ -264,64 +232,6 @@ static constexpr llvm::StringLiteral GuardHelpers = R"C(
     $F(object);
   return (char *)p;
 }
-/* p does not point into a dead tracked object. */
-$A void *$Nlive$S(const volatile void *p$P) {
-  __typeof__(sizeof 0) a = (__typeof__(sizeof 0))p - __weavec_rt_heap.base;
-  if (__builtin_expect(a < __weavec_rt_heap.bytes, 1)) {
-    unsigned shift = __weavec_rt_heap.shift;
-    const struct __weavec_rt_class *c = &__weavec_rt_heap.table[a >> shift];
-    unsigned long long slot = (a & (((__typeof__(sizeof 0))1 << shift) - 1)) >> c->shift;
-    if (c->magic != 0)
-      slot = (slot * c->magic) >> 32;
-    if (__builtin_expect((((const unsigned *)(__weavec_rt_heap.meta +
-                                              ((a >> shift) << (shift - 2))))[slot] & 3) != 1, 0))
-      $F(live);
-  } else if (__builtin_expect(__weavec_rt_live((const void *)p), 0))
-    $F(live);
-  return (void *)p;
-}
-/* live, with a range cache. */
-$A void *$Nlive_c$S(const volatile void *p, unsigned long long *c, int quiet$P) {
-  if (__builtin_expect((unsigned long long)p - c[0] < c[1] &&
-                       (quiet || *(const unsigned *)c[2] == (unsigned)c[3]), 1))
-    return (void *)p;
-  {
-    __typeof__(sizeof 0) a = (__typeof__(sizeof 0))p - __weavec_rt_heap.base;
-    if (__builtin_expect(a < __weavec_rt_heap.bytes, 1)) {
-      unsigned shift = __weavec_rt_heap.shift;
-      const struct __weavec_rt_class *k = &__weavec_rt_heap.table[a >> shift];
-      unsigned long long in = a & (((__typeof__(sizeof 0))1 << shift) - 1);
-      unsigned long long slot = in >> k->shift;
-      const unsigned *state;
-      unsigned word;
-      if (k->magic != 0)
-        slot = (slot * k->magic) >> 32;
-      state = (const unsigned *)(__weavec_rt_heap.meta + ((a >> shift) << (shift - 2))) + slot;
-      word = *state;
-      if (__builtin_expect((word & 3) != 1, 0)) {
-        c[1] = 0;
-        $F(live);
-      } else {
-        /* The block's own bytes, not its slot's: an `object` guard that
-         * shares the cache takes the length for the object's. A pointer
-         * into the slot's spare bytes is looked up each time. */
-        c[0] = (unsigned long long)p - (in - slot * k->size);
-        c[1] = word >> 2;
-        c[2] = (unsigned long long)state;
-        c[3] = word;
-      }
-    } else {
-      struct __weavec_rt_range r = __weavec_rt_live_range((const void *)p, __builtin_frame_address(0));
-      c[0] = r.lo;
-      c[1] = r.len;
-      c[2] = (unsigned long long)r.state;
-      c[3] = r.expect;
-      if (__builtin_expect(r.failed != 0, 0))
-        $F(live);
-    }
-  }
-  return (void *)p;
-}
 /* p may be released: null, the start of a live heap object, or untracked.
  * Where a failure is only reported, the release is skipped. */
 $A void *$Nrelease$S(const volatile void *p$P) {
@@ -334,6 +244,88 @@ static constexpr llvm::StringLiteral GuardHelpers = R"C(
 }
 )C";
 
+/// RFC 0034, section 5.2: the checked wrappers of the library calls whose
+/// need no term can state. `__weavec_chk_*` only, with the runtime.
+static constexpr llvm::StringLiteral WrapperHelpers = R"C(
+/* Checked wrappers (RFC 0034, section 5.2). A library call whose need no
+ * term states calls its wrapper, which computes the need at run time and
+ * then makes the call. `cap` is a fortified call's object size (the maximum
+ * without one); `what` holds the checks planned: 1 the room behind the
+ * destination, 2 the operands' disjointness, 4 the bytes behind the
+ * source. A copy of n bytes from s to d (n is the maximum for a string
+ * without a terminator in its object): */
+$A void $Ncopy_w$S(const void *d, const void *s, unsigned long long n,
+                   unsigned long long cap, unsigned what$P) {
+  unsigned long long a = (unsigned long long)d, b = (unsigned long long)s;
+  if (__builtin_expect(n > cap || ((what & 1u) != 0 &&
+                                   (n == ~(unsigned long long)0 ||
+                                    __weavec_rt_object(d, 0, 0, 0, n))), 0))
+    $F(object);
+  else if (__builtin_expect((what & 4u) != 0 && n != 0 &&
+                            __weavec_rt_object(s, 0, 0, 0, n), 0))
+    $F(object);
+  else if (__builtin_expect((what & 2u) != 0 && n != 0 && a != b &&
+                            (a < b ? b - a < n : a - b < n), 0))
+    $F(disjoint);
+}
+$A char *$Nstrcpy$S(char *d, const char *s, unsigned long long cap,
+                    unsigned what$P) {
+  unsigned long long n = (what & 1u) != 0 ? __weavec_rt_strlen(s) : __builtin_strlen(s);
+  $Ncopy_w$S(d, s, n == ~(unsigned long long)0 ? n : n + 1, cap, what$Q);
+  return __builtin_strcpy(d, s);
+}
+$A char *$Nstpcpy$S(char *d, const char *s, unsigned long long cap,
+                    unsigned what$P) {
+  unsigned long long n = (what & 1u) != 0 ? __weavec_rt_strlen(s) : __builtin_strlen(s);
+  $Ncopy_w$S(d, s, n == ~(unsigned long long)0 ? n : n + 1, cap, what$Q);
+  return __builtin_stpcpy(d, s);
+}
+/* strcat needs both lengths behind d. */
+$A char *$Nstrcat$S(char *d, const char *s, unsigned long long cap,
+                    unsigned what$P) {
+  unsigned long long n = 0;
+  if (__builtin_add_overflow(__weavec_rt_strlen(d), __weavec_rt_strlen(s), &n) ||
+      __builtin_add_overflow(n, 1u, &n))
+    n = ~(unsigned long long)0;
+  $Ncopy_w$S(d, s, n, cap, what & 1u$Q);
+  return __builtin_strcat(d, s);
+}
+$A void *$Nmemcpy$S(void *d, const volatile void *s, __typeof__(sizeof 0) n,
+                    unsigned long long cap, unsigned what$P) {
+  $Ncopy_w$S(d, (const void *)s, n, cap, what$Q);
+  return __builtin_memcpy(d, (const void *)s, n);
+}
+$A void *$Nmemmove$S(void *d, const volatile void *s, __typeof__(sizeof 0) n,
+                     unsigned long long cap, unsigned what$P) {
+  $Ncopy_w$S(d, (const void *)s, n, cap, what & 5u$Q);
+  return __builtin_memmove(d, (const void *)s, n);
+}
+/* sprintf writes through the bounded writer, as much as the room behind d
+ * holds; an output that did not fit fails. */
+$A int $Nvsprintf$S(char *d, const char *f, __builtin_va_list ap,
+                    unsigned long long cap, unsigned what$P) {
+  unsigned long long room = (what & 1u) != 0 ? __weavec_rt_room(d) : ~(unsigned long long)0;
+  int r;
+  if (room > cap)
+    room = cap;
+  if (room > 0x7fffffff)
+    room = 0x7fffffff;
+  r = __builtin_vsnprintf(d, room, f, ap);
+  if (__builtin_expect(r >= 0 && (unsigned long long)r >= room, 0))
+    $F(object);
+  return r;
+}
+$B int $Nsprintf$S(char *d, const char *f, unsigned long long cap,
+                   unsigned what$P, ...) {
+  __builtin_va_list ap;
+  int r;
+  __builtin_va_start(ap, $W);
+  r = $Nvsprintf$S(d, f, ap, cap, what$Q);
+  __builtin_va_end(ap);
+  return r;
+}
+)C";
+
 /// RFC 0032, sections 4.2 and 6: the stack-object helpers and the string
 /// length a guard's need reads. `__weavec_chk_*` builds only.
 static constexpr llvm::StringLiteral RuntimeHelpers = R"C(
@@ -341,46 +333,89 @@ static constexpr llvm::StringLiteral RuntimeHelpers = R"C(
 $A unsigned long long __weavec_obj_strlen(const char *s) {
   return __weavec_rt_strlen(s);
 }
-/* Stack objects (RFC 0032, section 4.2): a local whose address escapes is
- * entered where it is declared and left where its scope ends. */
+/* Stack objects (RFC 0032, section 4.2; RFC 0034, section 4): a local a guard
+ * can reach is entered where it is declared and left where its scope ends.
+ * One on a granule (the compiler aligns them) is written into the shadow
+ * here: its last granule reads 0x40 + its bytes there, each granule r
+ * before it 0x80 + r up to 48, and 0x80 + 48 + c above, where r is at least
+ * 2^(c + 4); the granules of one c are written at once. Anything else, or
+ * one whose shadow the mask wraps, asks the runtime. */
 $A void *__weavec_stack_enter(void *base, __typeof__(sizeof 0) size, int flags) {
+  unsigned long long a = (unsigned long long)base, mask = __weavec_rt_heap.mask;
+  unsigned long long g = a >> 4, n = ((unsigned long long)size + 15) >> 4;
+  if ((a & 15) == 0 && mask != 0 && size != 0 && ((g + n) & mask) > (g & mask)) {
+    unsigned char *at = (unsigned char *)__weavec_rt_heap.shadow + (g & mask);
+    unsigned long long r = n - 1, c = 15, low;
+    while (r > 48) {
+      while (c > 1 && (1ull << (c + 4)) > r)
+        --c;
+      low = c > 1 ? 1ull << (c + 4) : 49;
+      __builtin_memset(at, (int)(0x80 + 48 + c), r - low + 1);
+      at += r - low + 1;
+      r = low - 1;
+    }
+    for (; r > 0; --r)
+      *at++ = (unsigned char)(0x80 + r);
+    /* A last granule it shares with a live mixed object stays mixed. */
+    if ((size & 15) == 0 || *at != 0xFC)
+      *at = (unsigned char)(0x40 + ((unsigned long long)size - 16 * (n - 1)));
+    /* One past it belongs to it: an untracked granule after it says so,
+     * unless the frame has unnamed storage (flag 1), which may start there. */
+    if ((size & 15) == 0 && (flags & 1) == 0 && at[1] == 0)
+      at[1] = 0xFB;
+    return base;
+  }
   return __weavec_rt_stack_enter(base, size, $R, flags);
 }
 $A void __weavec_stack_leave(void **slot) {
+  unsigned long long a = (unsigned long long)*slot, mask = __weavec_rt_heap.mask;
+  if ((a & 15) == 0 && mask != 0) {
+    unsigned char *shadow = (unsigned char *)__weavec_rt_heap.shadow;
+    unsigned long long g = a >> 4, run;
+    unsigned char v;
+    /* Up to and including its last granule; nothing when it was not
+     * written here. A run byte's least r stays inside the object. */
+    while ((v = shadow[g & mask]) > 0x80 && v <= 0x80 + 63) {
+      run = v <= 0x80 + 48 ? v - 0x80u : 1ull << (v - 0x80 - 48 + 4);
+      if (((g + run) & mask) > (g & mask)) {
+        __builtin_memset(shadow + (g & mask), 0, run);
+        g += run;
+      } else {
+        shadow[g++ & mask] = 0;
+      }
+    }
+    if (v > 0x40 && v <= 0x50) {
+      shadow[g & mask] = 0;
+      if (shadow[(g + 1) & mask] == 0xFB)
+        shadow[(g + 1) & mask] = 0;
+    }
+    return;
+  }
   __weavec_rt_stack_leave(*slot, $R);
 }
-/* On the way into a loop that calls nothing: a range cache the loop's guards
- * use without reading its state holds nothing unless its state stands. */
-$A void __weavec_range_check(unsigned long long *c) {
-  if (c[1] != 0 && *(const unsigned *)c[2] != (unsigned)c[3])
-    c[1] = 0;
-}
 /* After a returns-twice call returns, deeper frames are gone. */
 $A int __weavec_stack_rewind(int result) {
-  __weavec_rt_stack_rewind($R);
+  /* (Its first return abandoned no frame.) */
+  if (result != 0)
+    __weavec_rt_stack_rewind($R);
   return result;
 }
 )C";
 
 /// The runtime entry points the helpers above call.
 static constexpr llvm::StringLiteral RuntimeDeclarations =
-    "struct __weavec_rt_class { unsigned size, magic, shift, capacity; };\n"
-    "struct __weavec_rt_heap_t { __typeof__(sizeof 0) base, bytes, meta; "
-    "unsigned shift, classes; struct __weavec_rt_class table[100]; };\n"
+    "struct __weavec_rt_heap_t { unsigned long long base, bytes, shadow, "
+    "mask; };\n"
     "extern struct __weavec_rt_heap_t __weavec_rt_heap;\n"
-    "struct __weavec_rt_range { unsigned long long lo, len; const unsigned "
-    "*state; unsigned long long expect, failed; };\n"
-    "extern struct __weavec_rt_range __weavec_rt_object_range(const void *, "
-    "long long, unsigned long long, unsigned long long, unsigned long long, "
-    "void *);\n"
-    "extern struct __weavec_rt_range __weavec_rt_live_range(const void *, void "
-    "*);\n"
+    "struct __weavec_rt_site { const char *file; unsigned line, column; };\n"
+    "extern void __weavec_rt_guard(const void *, const void *, unsigned long "
+    "long, unsigned, const struct __weavec_rt_site *);\n"
     "extern int __weavec_rt_object(const void *, long long, unsigned long "
     "long, "
     "unsigned long long, unsigned long long);\n"
     "extern int __weavec_rt_string(const char *);\n"
     "extern unsigned long long __weavec_rt_strlen(const char *);\n"
-    "extern int __weavec_rt_live(const void *);\n"
+    "extern unsigned long long __weavec_rt_room(const void *);\n"
     "extern int __weavec_rt_release_ok(const void *);\n"
     "extern void *__weavec_rt_stack_enter(void *, __typeof__(sizeof 0), void "
     "*, "
@@ -505,6 +540,8 @@ struct Style {
   /// ends the program.
   bool trapping = false;
   llvm::StringRef usable;
+  /// RFC 0034 §2.5: the guard kind bits of the family.
+  llvm::StringRef guardKind = "0u";
 };
 
 } // namespace
@@ -560,12 +597,33 @@ static std::string render(llvm::StringRef text, const Style &style) {
       if (style.report)
         out += (", " + ReportParameters).str();
       break;
-    case 'V':
-      out += style.report ? ReportParameters.str() : std::string("void");
-      break;
     case 'U':
       out += style.usable.str();
       break;
+    case 'G':
+      out += style.guardKind.str();
+      break;
+    case 'D':
+      if (style.report)
+        out += "\n  struct __weavec_rt_site site;\n  site.file = file;\n"
+               "  site.line = line;\n  site.column = column;";
+      break;
+    case 'L':
+      out += style.report ? "&site" : "0";
+      break;
+    case 'B':
+      if (style.outOfLine)
+        text.consume_front(" ");
+      else
+        out += "static __attribute__((unused, nodebug))";
+      break;
+    case 'Q':
+      if (style.report)
+        out += ", file, line, column";
+      break;
+    case 'W':
+      out += style.report ? "column" : "what";
+      break;
     case 'R':
       // Inlined, a helper's frame is its caller's. Out of line it would be
       // the helper's own, so units built with a precompiled header register
@@ -646,10 +704,10 @@ static std::string declarator(HelperSignature::Type type,
     return ("char **" + name).str();
   case Type::VoidPointerPointer:
     return ("void **" + name).str();
-  case Type::UnsignedLongLongPointer:
-    return ("unsigned long long *" + name).str();
   case Type::FunctionPointer:
     return spelled("__weavec_fn_t");
+  case Type::VaList:
+    return spelled("__builtin_va_list");
   case Type::AlignedAllocator:
   case Type::PosixMemalignFunction:
     break;
@@ -667,7 +725,8 @@ static std::string outOfLineCopies(llvm::StringRef prelude, bool report) {
   using Type = HelperSignature::Type;
   std::string out = "typedef void (*__weavec_fn_t)(void);\n";
   for (const HelperSignature &helper : CheckEmitter::helperSignatures()) {
-    if (!helper.reports || !prelude.contains((helper.name + "(").str()))
+    if (!helper.reports || helper.declared || helper.wrapper ||
+        !prelude.contains((helper.name + "(").str()))
       continue;
     std::string parameters;
     std::string arguments;
@@ -710,8 +769,13 @@ std::string buildCheckPrelude(const PreludeOptions &options) {
   check.outOfLine = outOfLine;
   check.verboseTrap = options.verboseTrap;
   check.trapping = options.runtime;
-  check.usable =
-      outOfLine ? "WEAVEC_CHK_USABLE" : usableQueryName(options.usableSize);
+  // RFC 0034 §5.3: with the runtime linked, its own size query, which
+  // answers an arena block without asking every zone.
+  check.usable = usableQueryName(options.usableSize);
+  if (options.runtime)
+    check.usable = "__weavec_rt_size";
+  if (outOfLine)
+    check.usable = "WEAVEC_CHK_USABLE";
 
   std::string out = "\n/* WeaveC check prelude (RFC 0030, section 10.2): ";
   out += checkModeName(options.mode).str();
@@ -725,16 +789,31 @@ std::string buildCheckPrelude(const PreludeOptions &options) {
   if (options.runtime)
     out += RuntimeDeclarations.str();
   out += render(CheckHelpers, check).substr(1);
-  out += render(CheckHelpersViolation, check).substr(1);
-  if (options.runtime)
-    out += render(GuardHelpers, check).substr(1);
+  out += render(CheckHelpersString, check).substr(1);
+  // RFC 0034 §1.1: inline, the backend's guards are declared under their
+  // `_report` names in report mode, as `libweavec_chk.a` defines them.
+  const auto guards = [&](const Style &family) {
+    if (outOfLine) {
+      out += render(GuardBodies, family).substr(1);
+    } else {
+      Style declared = family;
+      declared.suffix = report ? "_report" : "";
+      out += render(GuardDeclarations, declared).substr(1);
+    }
+    out += render(CallGuardHelpers, family).substr(1);
+  };
+  if (options.runtime) {
+    guards(check);
+    out += render(WrapperHelpers, check).substr(1);
+  }
   if (options.mode == CheckMode::Verify) {
     Style proven = check;
     proven.prefix = "__weavec_prv_";
     proven.category = "weavec.proven";
+    proven.guardKind = "8u";
     out += render(CheckHelpers, proven).substr(1);
     if (options.runtime)
-      out += render(GuardHelpers, proven).substr(1);
+      guards(proven);
   }
   // Out of line, the report object holds only the report helpers; the rest
   // come from the trap object of the same archive.
@@ -748,7 +827,10 @@ std::string buildCheckPrelude(const PreludeOptions &options) {
       out += "#endif\n";
     } else if (options.zeroInit &&
                options.usableSize != UsableSizeQuery::None) {
-      out += usableQueryDeclaration(options.usableSize).str();
+      out +=
+          options.runtime
+              ? "extern __typeof__(sizeof 0) __weavec_rt_size(const void *);\n"
+              : usableQueryDeclaration(options.usableSize).str();
       out += render(ZeroInitHelpers, check).substr(1);
       out += AddressWrappers.substr(1).str();
     }
@@ -792,9 +874,9 @@ llvm::StringRef checkModeName(CheckMode mode) {
   llvm_unreachable("unknown check mode");
 }
 
-static constexpr std::array<llvm::StringLiteral, 10> Templates{
-    "nonnull", "index",     "span",   "len",  "disjoint",
-    "assert",  "violation", "object", "live", "release"};
+static constexpr std::array<llvm::StringLiteral, 9> Templates{
+    "nonnull", "index",  "span", "len",    "disjoint",
+    "assert",  "object", "live", "release"};
 
 llvm::ArrayRef<llvm::StringLiteral> checkTemplates() {
   return Templates;
diff --git a/lib/Frontend/RecordFacts.cpp b/lib/Frontend/RecordFacts.cpp
index a847e9be..2b0f7168 100644
--- a/lib/Frontend/RecordFacts.cpp
+++ b/lib/Frontend/RecordFacts.cpp
@@ -256,15 +256,22 @@ static std::vector<SlotKindRow> slotKinds(const analysis::KindTable &kinds,
                                           const clang::ASTContext &context,
                                           const std::string &unit) {
   const clang::SourceManager &sm = context.getSourceManager();
+  // (Each place once, and a few: the stores a macro expands are one place,
+  // and a header's every includer records its slots.)
+  static constexpr std::size_t MaxDemotions = 8;
   const auto locations = [&](const analysis::KindEntry &entry) {
     std::vector<core::SourceLocation> stores;
     for (const analysis::KindDemotion &demotion : entry.demotedBy) {
-      if (demotion.store == nullptr)
+      if (demotion.store == nullptr || stores.size() == MaxDemotions)
         continue;
       core::SourceLocation location =
           analysis::toCoreLocation(sm, demotion.store->getBeginLoc());
       location.opaque = 0;
-      stores.push_back(std::move(location));
+      if (std::ranges::none_of(stores, [&](const core::SourceLocation &each) {
+            return each.file == location.file && each.line == location.line &&
+                   each.column == location.column;
+          }))
+        stores.push_back(std::move(location));
     }
     return stores;
   };
diff --git a/runtime/test/rt_test.c b/runtime/test/rt_test.c
index 39681983..9ab89207 100644
--- a/runtime/test/rt_test.c
+++ b/runtime/test/rt_test.c
@@ -423,6 +423,75 @@ static void testStack(void) {
   __weavec_rt_stack_leave(other, frame);
 }
 
+/* RFC 0034, section 4: an object off a granule (a parameter's storage) next
+ * to one on a granule. Neither's shadow may hide the other's. */
+static void testMixedNeighbours(void) {
+  char area[64] __attribute__((aligned(16))) = {0};
+  char *const exact = area + 16;
+  char *const mixed = area + 8;
+  void *frame = __builtin_frame_address(0);
+  unsigned g;
+  /* The exact one first, then the mixed one ending where it starts: the
+   * exact one's first granule stays its own, and its leave clears it. */
+  __weavec_rt_stack_enter(exact, 32, frame, 0);
+  __weavec_rt_stack_enter(mixed, 8, frame, 0);
+  CHECK(guardByte(exact, 0) == 0);
+  CHECK(guardByte(exact, 31) == 0);
+  CHECK(guardByte(mixed, 7) == 0);
+  __weavec_rt_stack_leave(mixed, frame);
+  __weavec_rt_stack_leave(exact, frame);
+  if (weavecRtShadowReady())
+    for (g = 1; g < 4; ++g)
+      CHECK(!weavecRtIsObjectByte(*weavecRtShadowOf((uintptr_t)area + 16 * g)));
+  /* The mixed one first, then an exact one sharing its last granule: the
+   * granule stays mixed, so the mixed one's bytes stay reachable. */
+  __weavec_rt_stack_enter(area + 8, 8, frame, 0);
+  __weavec_rt_stack_enter(area, 8, frame, 0);
+  CHECK(guardByte(area + 8, 0) == 0);
+  CHECK(guardByte(area + 8, 7) == 0);
+  CHECK(guardByte(area, 7) == 0);
+  __weavec_rt_stack_leave(area + 8, frame);
+  __weavec_rt_stack_leave(area, frame);
+}
+
+/* Clearing a large range (a thread's whole stack below a `setjmp`) maps
+ * the shadow's whole pages afresh and writes the ends. */
+static void testShadowClear(void) {
+  static char span[4 << 20] __attribute__((aligned(16)));
+  const uintptr_t low = (uintptr_t)span + 8, high = (uintptr_t)span + sizeof span - 8;
+  uintptr_t a;
+  if (!weavecRtShadowReady())
+    return;
+  for (a = low & ~(uintptr_t)15; a < high; a += 4096)
+    *weavecRtShadowOf(a) = 0x41;
+  *weavecRtShadowOf(low) = 0x41;
+  *weavecRtShadowOf(high - 1) = 0x41;
+  weavecRtShadowClear(low, high);
+  for (a = low & ~(uintptr_t)15; a < high; a += 4096)
+    CHECK(*weavecRtShadowOf(a) == 0);
+  CHECK(*weavecRtShadowOf(low) == 0);
+  CHECK(*weavecRtShadowOf(high - 1) == 0);
+}
+
+/* A large exactly encoded object: its runs are logarithmic, so a lookup
+ * anywhere in it finds its start and end, and a guard from its start to
+ * its far end passes. */
+static void testLargeObject(void) {
+  static char big[(1 << 20) + 24] __attribute__((aligned(16)));
+  struct __weavec_rt_found found;
+  if (!weavecRtShadowReady())
+    return;
+  weavecRtShadowObject((uintptr_t)big, sizeof big, 0);
+  found = __weavec_rt_find(big + 700001);
+  CHECK(found.state == WeavecRtTrackedLive);
+  CHECK(found.base == (uintptr_t)big);
+  CHECK(found.size == sizeof big);
+  CHECK(guardByte(big, 0) == 0);
+  CHECK(guardByte(big, (long long)sizeof big - 1) == 0);
+  CHECK(guardByte(big, (long long)sizeof big) != 0);
+  weavecRtShadowClear((uintptr_t)big, (uintptr_t)big + sizeof big);
+}
+
 static jmp_buf jump;
 
 static __attribute__((noinline)) void jumpsOut(void) {
@@ -507,6 +576,28 @@ static void testStrings(void) {
   CHECK(__weavec_rt_string(p) != 0);
 }
 
+/* RFC 0034, section 5.2: the room a checked sprintf may write. */
+static void testRoom(void) {
+  char *p = (char *)opaque(malloc(24));
+  char buffer[16] = {0};
+  void *frame = __builtin_frame_address(0);
+  int untracked = 0;
+  CHECK(__weavec_rt_room(p) == 24);
+  CHECK(__weavec_rt_room(p + 10) == 14);
+  CHECK(__weavec_rt_room(p + 23) == 1);
+  /* One past the end has no room, whatever lies there. */
+  CHECK(__weavec_rt_room(p + 24) == 0 ||
+        __weavec_rt_find(p + 24).base == (uintptr_t)p + 24);
+  free(p);
+  CHECK(__weavec_rt_room(p) == 0);
+  CHECK(__weavec_rt_room(&untracked) == ~0ULL);
+  CHECK(__weavec_rt_room(NULL) == ~0ULL);
+  __weavec_rt_stack_enter(buffer, sizeof buffer, frame, 0);
+  CHECK(__weavec_rt_room(buffer + 4) == 12);
+  __weavec_rt_stack_leave(buffer, frame);
+  CHECK(__weavec_rt_room(buffer + 4) == ~0ULL);
+}
+
 /*===-- Threads and fork ----------------------------------------------------===*/
 
 static void *worker(void *argument) {
@@ -581,10 +672,14 @@ static const struct {
     {"huge", testHuge},
     {"foreign", testForeign},
     {"stack", testStack},
+    {"mixed-neighbours", testMixedNeighbours},
+    {"shadow-clear", testShadowClear},
+    {"large-object", testLargeObject},
     {"longjmp", testLongjmp},
     {"deep-stack", testDeepStack},
     {"globals", testGlobals},
     {"strings", testStrings},
+    {"room", testRoom},
     {"threads", testThreads},
     {"fork", testFork},
     /* These run in a copy of the program with no quarantine. */
diff --git a/runtime/weavec_alloc.c b/runtime/weavec_alloc.c
index 80f0bccb..8386e20d 100644
--- a/runtime/weavec_alloc.c
+++ b/runtime/weavec_alloc.c
@@ -15,6 +15,11 @@
 |*   slot   = offset in the region / class size   (a multiplication)
 |*   word   = metadata[region][slot]              (size << 2 | state)
 |*
+|* RFC 0034, section 2: a shadow byte per 16-byte granule of the regions says
+|* which bytes are a live object's, so that a guard asks one load (see
+|* weavec_rt.h for the encoding). The allocator writes it whenever a slot
+|* word changes.
+|*
 |* A request takes a slot of the smallest class strictly larger than it, so
 |* at least one byte after every object belongs to no object. Slot words,
 |* the free lists and the quarantine queues live in the metadata, never in
@@ -49,8 +54,16 @@
 #define MAP_NORESERVE 0
 #endif
 
-struct __weavec_rt_heap_t __weavec_rt_heap;
-unsigned __weavec_rt_epoch = 1;
+/* The bytes the guards read for every address until the shadow exists (a
+ * guard of a crossing access reads the second). */
+static const unsigned char deadBytes[2] = {WeavecRtShadowDead,
+                                           WeavecRtShadowDead};
+
+/* Until the shadow exists `mask` is 0, so the guards' index into it is
+ * always 0: a dead byte, and the runtime answers. Until the arena exists
+ * `bytes` is 0, so every pointer is outside it. */
+struct __weavec_rt_heap_t __weavec_rt_heap = {
+    0, 0, (uintptr_t)deadBytes, 0, 0, 0, 0, {{0, 0, 0, 0}}};
 
 /*===-- State ---------------------------------------------------------------===*/
 
@@ -97,7 +110,8 @@ static size_t hugeDeadCount;
 static unsigned long long hugeReleases;
 
 static size_t pageBytes;
-static size_t quarantineBudget = (size_t)64 << 20;
+/* RFC 0034, section 5.3. */
+static size_t quarantineBudget = (size_t)16 << 20;
 static size_t quarantineBytes;
 static unsigned sweepCursor;
 
@@ -166,6 +180,40 @@ static inline uintptr_t regionStart(unsigned region) {
   return __weavec_rt_heap.base + ((uintptr_t)region << __weavec_rt_heap.shift);
 }
 
+/*===-- The shadow (RFC 0034, section 2) -----------------------------------===*/
+
+/* Reserves the shadow of the address space: 2^48 bytes of it where the
+ * system allows, else 2^47, 2^44 (39-bit address spaces are 2^35). Pages no
+ * allocation wrote read 0, which no live arena object's bytes are. */
+static void reserveShadow(void) {
+  static const unsigned Bits[] = {48, 47, 44, 39};
+  unsigned i;
+  for (i = 0; i < sizeof Bits / sizeof Bits[0]; ++i) {
+    const uintptr_t bytes = (uintptr_t)1 << (Bits[i] - 4);
+    void *map = mmap(NULL, bytes + 64, PROT_READ | PROT_WRITE,
+                     MAP_PRIVATE | MAP_ANONYMOUS | MAP_NORESERVE, -1, 0);
+    if (map == MAP_FAILED)
+      continue;
+    __atomic_store_n(&__weavec_rt_heap.shadow, (uintptr_t)map,
+                     __ATOMIC_RELEASE);
+    /* Published last: until then every guard asks the runtime. */
+    __atomic_store_n(&__weavec_rt_heap.mask, bytes - 1, __ATOMIC_RELEASE);
+    return;
+  }
+}
+
+static inline unsigned char *shadowOf(uintptr_t address) {
+  return weavecRtShadowOf(address);
+}
+
+static void shadowLive(uintptr_t base, size_t size) {
+  weavecRtShadowLive(base, size);
+}
+
+static void shadowDead(uintptr_t base, size_t size) {
+  weavecRtShadowFill(base, size, WeavecRtShadowDead);
+}
+
 static inline uint32_t loadWord(const uint32_t *word) {
   return __atomic_load_n(word, __ATOMIC_RELAXED);
 }
@@ -217,20 +265,21 @@ static int reserve(unsigned shift) {
   }
   __weavec_rt_heap.shift = shift;
   __weavec_rt_heap.meta = start + data;
-  __weavec_rt_heap.bytes = data;
-  /* Published last: until then every pointer is outside the arena. */
   __atomic_store_n(&__weavec_rt_heap.base, start, __ATOMIC_RELEASE);
+  /* Published last: until then every pointer is outside the arena. */
+  __atomic_store_n(&__weavec_rt_heap.bytes, data, __ATOMIC_RELEASE);
   return 1;
 }
 
 int weavecRtInitialise(void) {
   int ok = 1;
-  if (__atomic_load_n(&__weavec_rt_heap.base, __ATOMIC_ACQUIRE) != 0)
+  if (__atomic_load_n(&__weavec_rt_heap.bytes, __ATOMIC_ACQUIRE) != 0)
     return 1;
   weavecRtLock(&initLock);
-  if (__weavec_rt_heap.base == 0) {
+  if (__weavec_rt_heap.bytes == 0) {
     const long page = sysconf(_SC_PAGESIZE);
     pageBytes = page > 0 ? (size_t)page : 4096;
+    reserveShadow();
     ok = reserve(32) || reserve(30);
     if (ok) {
 #if defined(__APPLE__)
@@ -366,7 +415,7 @@ static inline int overBudget(void) {
 }
 
 /* Gives the whole pages inside a dead slot back to the system. */
-static void decommit(uintptr_t base, size_t bytes) {
+static void giveBack(uintptr_t base, size_t bytes) {
   const uintptr_t first = (base + pageBytes - 1) & ~(uintptr_t)(pageBytes - 1);
   const uintptr_t last = (base + bytes) & ~(uintptr_t)(pageBytes - 1);
   if (last <= first)
@@ -378,12 +427,21 @@ static void decommit(uintptr_t base, size_t bytes) {
 #endif
 }
 
+/* The pages of a dead slot, and the whole pages of its shadow, which reads
+ * 0 already (`retire` cleared it). */
+static void decommit(uintptr_t base, size_t bytes) {
+  giveBack(base, bytes);
+  if (__weavec_rt_heap.mask != 0)
+    giveBack((uintptr_t)shadowOf(base), bytes >> 4);
+}
+
 /* Makes the live slot `ref` dead and queues it. */
 static void retire(SlotRef ref) {
   const struct __weavec_rt_class *entry = &__weavec_rt_heap.table[ref.region];
   ClassState *state = &classState[ref.region];
   uint32_t *words = slotWords(ref.region);
   /* Before the slot is queued: once it is, another thread may recycle it. */
+  shadowDead(ref.base, loadWord(&words[ref.slot]) >> 2);
   if (entry->size >= WeavecRtDecommitBytes)
     decommit(ref.base, entry->size);
   weavecRtLock(&state->lock);
@@ -486,7 +544,7 @@ static void *hugeAlloc(size_t size, size_t alignment) {
   hugeBlocks[at].mapBytes = mapBytes;
   hugeBlocks[at].dead = 0;
   ++hugeCount;
-  weavecRtBumpEpoch();
+  shadowLive(base, size);
   if (map < __atomic_load_n(&hugeLow, __ATOMIC_RELAXED))
     __atomic_store_n(&hugeLow, map, __ATOMIC_RELAXED);
   if (map + mapBytes > __atomic_load_n(&hugeHigh, __ATOMIC_RELAXED))
@@ -531,7 +589,7 @@ static int hugeFree(uintptr_t address) {
       hugeBlocks[index].dead == 0) {
     HugeBlock *block = &hugeBlocks[index];
     block->dead = ++hugeReleases;
-    weavecRtBumpEpoch();
+    weavecRtShadowFill(block->base, block->size, WeavecRtShadowHugeDead);
     /* The memory goes back; the address range stays this block's. */
     (void)mmap((void *)block->map, block->mapBytes, PROT_NONE,
                MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED | MAP_NORESERVE, -1, 0);
@@ -553,8 +611,10 @@ static int hugeFree(uintptr_t address) {
     }
   }
   weavecRtUnlock(&hugeLock);
-  if (unmap)
+  if (unmap) {
+    weavecRtShadowFill(gone.base, gone.size, WeavecRtShadowDead);
     (void)munmap((void *)gone.map, gone.mapBytes);
+  }
   return ok;
 }
 
@@ -657,6 +717,7 @@ void *__weavec_rt_alloc(size_t size, size_t alignment) {
     if (block != NULL) {
       if (recycled && size != 0)
         memset(block, 0, size);
+      shadowLive((uintptr_t)block, size);
       return block;
     }
   }
@@ -742,6 +803,9 @@ void *__weavec_rt_realloc(void *p, size_t size) {
       /* The block stays; bytes it gains are zero (section 2.3). */
       if (size > old)
         memset((char *)p + old, 0, size - old);
+      if (size < old)
+        shadowDead(address, old);
+      shadowLive(address, size);
       storeWord(word, ((uint32_t)size << 2) | WeavecRtLive);
       return p;
     }
@@ -776,6 +840,21 @@ size_t __weavec_rt_size(const void *p) {
   return nextSize(p);
 }
 
+void weavecRtShadowZero(unsigned char *start, size_t bytes) {
+  const uintptr_t first = ((uintptr_t)start + pageBytes - 1) &
+                          ~(uintptr_t)(pageBytes - 1);
+  const uintptr_t last = ((uintptr_t)start + bytes) & ~(uintptr_t)(pageBytes - 1);
+  if (last <= first ||
+      mmap((void *)first, last - first, PROT_READ | PROT_WRITE,
+           MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED | MAP_NORESERVE, -1,
+           0) == MAP_FAILED) {
+    memset(start, 0, bytes);
+    return;
+  }
+  memset(start, 0, first - (uintptr_t)start);
+  memset((void *)last, 0, (uintptr_t)start + bytes - last);
+}
+
 /*===-- Lookup (section 3) --------------------------------------------------===*/
 
 struct __weavec_rt_found __weavec_rt_find(const void *p) {
@@ -821,11 +900,6 @@ struct __weavec_rt_found __weavec_rt_find(const void *p) {
   return weavecRtFindStackOrGlobal(p);
 }
 
-int weavecRtMayHoldHuge(uintptr_t low, uintptr_t high) {
-  return low < __atomic_load_n(&hugeHigh, __ATOMIC_RELAXED) &&
-         high > __atomic_load_n(&hugeLow, __ATOMIC_RELAXED);
-}
-
 /*===-- fork ----------------------------------------------------------------===*/
 
 static void lockAll(void) {
diff --git a/runtime/weavec_objects.c b/runtime/weavec_objects.c
index d53c0084..aed90ec8 100644
--- a/runtime/weavec_objects.c
+++ b/runtime/weavec_objects.c
@@ -79,6 +79,7 @@ static void readStackBounds(StackList *list) {
   list->entries = list->inlineEntries;
   list->capacity = InlineEntries;
   list->ready = 1;
+  (void)weavecRtInitialise();
 #if defined(__APPLE__)
   {
     const uintptr_t top = (uintptr_t)pthread_get_stackaddr_np(self);
@@ -104,6 +105,11 @@ static void readStackBounds(StackList *list) {
 #else
   (void)self;
 #endif
+  /* RFC 0034, section 2.1: a thread's stack may be an exited thread's,
+   * whose objects a `pthread_exit` or `longjmp` left in the shadow. Below
+   * the calling frame nothing is live yet. */
+  if (list->low != 0)
+    weavecRtShadowClear(list->low, (uintptr_t)__builtin_frame_address(0));
 }
 
 static inline StackList *threadList(void) {
@@ -144,16 +150,28 @@ static int growStackList(StackList *list) {
   return 1;
 }
 
+/* Drops the entries from `count` on, and their shadow tags. */
+static inline void truncateList(StackList *list, size_t count) {
+  while (list->count > count) {
+    const StackEntry *entry = &list->entries[--list->count];
+    weavecRtShadowForget(entry->base, entry->size);
+  }
+}
+
 /* Drops the entries of frames deeper than `frame`: those frames are gone. */
 static inline void dropDeeper(StackList *list, uintptr_t frame) {
-  while (list->count != 0 && list->entries[list->count - 1].frame < frame)
-    --list->count;
+  size_t count = list->count;
+  while (count != 0 && list->entries[count - 1].frame < frame)
+    --count;
+  truncateList(list, count);
 }
 
 void *__weavec_rt_stack_enter(void *base, size_t size, void *framePointer,
                               int flags) {
   WEAVEC_RT_FORWARD(stackEnter, base, size, framePointer, flags);
   StackList *list = threadList();
+  if (__builtin_expect(!weavecRtShadowReady(), 0))
+    (void)weavecRtInitialise();
   const uintptr_t frame = (uintptr_t)framePointer;
   const uintptr_t start = (uintptr_t)base;
   size_t i;
@@ -166,6 +184,7 @@ void *__weavec_rt_stack_enter(void *base, size_t size, void *framePointer,
   for (i = list->count; i-- > 0 && list->entries[i].frame == frame;) {
     const StackEntry *entry = &list->entries[i];
     if (entry->base < start + size && start < entry->base + entry->size) {
+      weavecRtShadowForget(entry->base, entry->size);
       memmove(&list->entries[i], &list->entries[i + 1],
               (list->count - i - 1) * sizeof(StackEntry));
       --list->count;
@@ -179,6 +198,7 @@ void *__weavec_rt_stack_enter(void *base, size_t size, void *framePointer,
   list->entries[list->count].frame = frame;
   list->entries[list->count].flags = flags;
   ++list->count;
+  weavecRtShadowObject(start, size, (flags & WeavecRtLoose) == 0);
   return base;
 }
 
@@ -191,14 +211,22 @@ void __weavec_rt_stack_leave(void *base, void *framePointer) {
   for (i = list->count; i-- > 0 && list->entries[i].frame == frame;)
     if (list->entries[i].base == (uintptr_t)base) {
       /* It and whatever was declared after it in the frame. */
-      list->count = i;
+      truncateList(list, i);
       return;
     }
 }
 
 void __weavec_rt_stack_rewind(void *frame) {
+  StackList *list;
   WEAVEC_RT_FORWARD_VOID(stackRewind, frame);
-  dropDeeper(threadList(), (uintptr_t)frame);
+  list = threadList();
+  dropDeeper(list, (uintptr_t)frame);
+  /* The frames a `longjmp` abandoned lie below `frame`, whose function
+   * registers nothing (it calls setjmp); the objects the compiler entered
+   * inline there are only in the shadow (RFC 0034, section 4). */
+  if (list->low != 0 && (uintptr_t)frame > list->low &&
+      (uintptr_t)frame <= list->high)
+    weavecRtShadowClear(list->low, (uintptr_t)frame);
 }
 
 /* Whether the frame has automatic storage the list does not know: any of
@@ -359,6 +387,8 @@ void __weavec_rt_globals_add(const void *const *begin, const void *const *end) {
   size_t kept = 0;
   if (begin == NULL || pairs == 0)
     return;
+  /* The shadow first: the globals' tags go there (RFC 0034, section 2.1). */
+  (void)weavecRtInitialise();
   weavecRtLock(&globalsLock);
   table = globalTable;
   count = table != NULL ? table->count : 0;
@@ -414,8 +444,9 @@ void __weavec_rt_globals_add(const void *const *begin, const void *const *end) {
     table->entries[kept++] = table->entries[i];
   }
   table->count = kept;
-  if (fresh != 0)
-    weavecRtBumpEpoch();
+  /* RFC 0034, section 2.1. */
+  for (i = 0; i < kept; ++i)
+    weavecRtShadowObject(table->entries[i].base, table->entries[i].size, 1);
   __atomic_store_n(&globalsSequence, globalsSequence + 1, __ATOMIC_RELEASE);
   weavecRtUnlock(&globalsLock);
 }
@@ -490,35 +521,44 @@ static int findGlobal(uintptr_t address, struct __weavec_rt_found *found) {
   return 1;
 }
 
-/* The gap between the global objects around an untracked address. */
-static void globalGap(uintptr_t address, uintptr_t *low, uintptr_t *high) {
-  GlobalEntry below;
-  GlobalEntry above;
-  if (address < __atomic_load_n(&globalsLow, __ATOMIC_RELAXED) ||
-      address >= __atomic_load_n(&globalsHigh, __ATOMIC_RELAXED)) {
-    /* Outside the table: only its near end can cut the range. */
-    const uintptr_t tableLow = __atomic_load_n(&globalsLow, __ATOMIC_RELAXED);
-    const uintptr_t tableHigh = __atomic_load_n(&globalsHigh, __ATOMIC_RELAXED);
-    if (tableLow > address && tableLow < *high)
-      *high = tableLow;
-    if (tableHigh <= address && tableHigh > *low)
-      *low = tableHigh;
-    return;
+/*===-- Lookup --------------------------------------------------------------===*/
+
+/* RFC 0034, section 4: a stack or global object the shadow encodes exactly
+ * (the compiler entered it inline, or a global on a granule). An address
+ * one past its end, where no other object starts, still belongs to it. */
+static int findExact(uintptr_t address, struct __weavec_rt_found *found) {
+  uintptr_t end = weavecRtShadowObjectEnd(address);
+  uintptr_t first;
+  if (end == 0 && address != 0) {
+    end = weavecRtShadowObjectEnd(address - 1);
+    if (end != address)
+      return 0;
+    address -= 1;
   }
-  if (!globalsAround(address, &below, &above)) {
-    /* No range is known to be untracked. */
-    *low = *high = address;
-    return;
+  if (end == 0)
+    return 0;
+  /* Back to its first granule (the slow path only): the granules with its
+   * end are one run, found by doubling steps back and then halving them. */
+  first = address >> 4;
+  {
+    uintptr_t step = 1;
+    while (step <= first &&
+           weavecRtShadowObjectEnd((first - step) << 4) == end) {
+      first -= step;
+      step <<= 1;
+    }
+    for (; step != 0; step >>= 1)
+      if (step <= first &&
+          weavecRtShadowObjectEnd((first - step) << 4) == end)
+        first -= step;
   }
-  /* The address is in neither. */
-  if (below.base != 0 && below.base + below.size > *low)
-    *low = below.base + below.size;
-  if (above.base != 0 && above.base < *high)
-    *high = above.base;
+  found->state = WeavecRtTrackedLive;
+  found->kind = WeavecRtStack;
+  found->base = first << 4;
+  found->size = end - (first << 4);
+  return 1;
 }
 
-/*===-- Lookup --------------------------------------------------------------===*/
-
 struct __weavec_rt_found weavecRtFindStackOrGlobal(const void *p) {
   struct __weavec_rt_found found;
   found.state = WeavecRtUntracked;
@@ -529,37 +569,109 @@ struct __weavec_rt_found weavecRtFindStackOrGlobal(const void *p) {
   found.scoped = 0;
   found.word = NULL;
   found.value = 0;
-  if (findStack((uintptr_t)p, &found))
-    weavecRtCount(WeavecRtStatStackLookups);
-  else if (findGlobal((uintptr_t)p, &found))
+  /* (The globals' table first: decoding a large global's start from the
+   * shadow walks it backwards.) */
+  if (findGlobal((uintptr_t)p, &found))
     weavecRtCount(WeavecRtStatGlobalLookups);
+  else if (findStack((uintptr_t)p, &found) || findExact((uintptr_t)p, &found))
+    weavecRtCount(WeavecRtStatStackLookups);
   else
     weavecRtCount(WeavecRtStatUntrackedLookups);
   return found;
 }
 
-int weavecRtUntrackedRange(uintptr_t address, uintptr_t *low, uintptr_t *high) {
-  const StackList *list = threadList();
-  enum { Page = 4096 };
-  /* Stack objects come and go without changing the epoch. */
-  if (address >= list->low && address < list->high)
-    return 0;
-  *low = address & ~(uintptr_t)(Page - 1);
-  *high = *low + Page;
-  if (*low < list->high && *high > list->low)
-    return 0;
-  globalGap(address, low, high);
-  return address >= *low && address < *high;
-}
-
 int weavecRtIsStackOrGlobal(const void *p) {
   const StackList *list = threadList();
   const uintptr_t address = (uintptr_t)p;
   struct __weavec_rt_found found;
+  if (findGlobal(address, &found))
+    return 1;
   /* Anything in the live part of the calling thread's stack. */
   if (address >= (uintptr_t)__builtin_frame_address(0) && address < list->high)
     return 1;
-  return findGlobal(address, &found);
+  return findExact(address, &found);
+}
+
+/*===-- What the shadow answers (RFC 0034, section 2.5) ---------------------===*/
+
+static inline int inArena(uintptr_t address) {
+  return address - __weavec_rt_heap.base < __weavec_rt_heap.bytes;
+}
+
+static inline int isHeapLive(unsigned char v) {
+  return (v >= 1 && v <= WeavecRtShadowWhole) || v == WeavecRtShadowTail;
+}
+
+/* 1 when the shadow shows that `address` is in no live tracked object and
+ * that no lookup is needed to say so: untracked (outside the arena, where
+ * every tracked object has a non-zero byte) or a dead arena slot. */
+static inline int shadowNotLive(uintptr_t address) {
+  return *weavecRtShadowOf(address) == WeavecRtShadowDead;
+}
+
+/* Whether the shadow alone shows that the `width` bytes at `at`, reached
+ * from `from`, pass RFC 0033 section 4's rule: 1 pass, 0 fail, -1 ask the
+ * lookup. */
+static int shadowObject(uintptr_t from, uintptr_t at, unsigned long long width) {
+  uintptr_t last;
+  uintptr_t g;
+  unsigned char first;
+  if (!weavecRtShadowReady() || width == 0 ||
+      __builtin_add_overflow(at, (uintptr_t)(width - 1), &last))
+    return -1;
+  first = *weavecRtShadowOf(at);
+  if (isHeapLive(first)) {
+    /* Bytes inside one live heap object pass wherever `from` is. Beyond a
+     * few granules the slot's lookup (constant time) is cheaper than the
+     * walk (a `memcmp` of a long run that stops at its first byte). */
+    if ((last >> 4) - (at >> 4) > 3)
+      return -1;
+    for (g = at >> 4; g <= last >> 4; ++g) {
+      const unsigned char v = *weavecRtShadowOf(g << 4);
+      const unsigned need = g == (last >> 4) ? (unsigned)(last & 15) + 1 : 16;
+      if (v < 1 || v > WeavecRtShadowWhole || v < need)
+        return -1;
+    }
+    return 1;
+  }
+  if (weavecRtIsObjectByte(first)) {
+    /* One stack or global object's bytes, reached from inside it or from
+     * no stack or global object; an access past its end fails. */
+    const unsigned char origin = *weavecRtShadowOf(from);
+    const uintptr_t end = weavecRtShadowObjectEnd(at);
+    if (end == 0)
+      return -1;
+    if (at + width > end || at + width < at)
+      return 0;
+    if ((weavecRtIsObjectByte(origin) && weavecRtShadowObjectEnd(from) == end &&
+         from < end) ||
+        isHeapLive(origin) || origin == WeavecRtShadowDead)
+      return 1;
+    /* From inside another one: forwards fails, backwards passes. */
+    if (weavecRtIsObjectByte(origin))
+      return at > from ? 0 : 1;
+    return -1;
+  }
+  if (first == WeavecRtShadowDead && !inArena(at)) {
+    /* Untracked bytes, reached from no live tracked object. */
+    for (g = at >> 4; g <= last >> 4; ++g)
+      if (*weavecRtShadowOf(g << 4) != WeavecRtShadowDead || inArena(g << 4))
+        return -1;
+    return from == at || shadowNotLive(from) ? 1 : -1;
+  }
+  return -1;
+}
+
+/* The same for a `live` guard of `p`. */
+static int shadowLive(uintptr_t p) {
+  unsigned char v;
+  if (!weavecRtShadowReady())
+    return -1;
+  v = *weavecRtShadowOf(p);
+  if (isHeapLive(v) || weavecRtIsObjectByte(v) ||
+      (v == WeavecRtShadowDead && !inArena(p)))
+    return 1;
+  return -1;
 }
 
 /*===-- Guards (section 3) --------------------------------------------------===*/
@@ -624,6 +736,11 @@ int __weavec_rt_object(const void *p, long long index, unsigned long long step,
   struct __weavec_rt_found found;
   if (!accessAddress(p, index, step, offset, &address))
     return 1;
+  {
+    const int answer = shadowObject((uintptr_t)p, address, width);
+    if (answer >= 0)
+      return !answer;
+  }
   found = __weavec_rt_find((const void *)address);
   return accessFails(&found, address, width, p);
 }
@@ -658,86 +775,60 @@ unsigned long long __weavec_rt_strlen(const char *p) {
   return end != NULL ? (unsigned long long)(end - p) : ~0ULL;
 }
 
+unsigned long long __weavec_rt_room(const void *p) {
+  WEAVEC_RT_FORWARD(room, p);
+  const struct __weavec_rt_found found = __weavec_rt_find(p);
+  uintptr_t at;
+  if (found.state == WeavecRtUntracked)
+    return ~0ULL;
+  if (found.state == WeavecRtTrackedDead)
+    return 0;
+  at = (uintptr_t)p - found.base;
+  return at < found.size ? found.size - at : 0;
+}
+
 int __weavec_rt_live(const void *p) {
   WEAVEC_RT_FORWARD(live, p);
   return __weavec_rt_find(p).state == WeavecRtTrackedDead;
 }
 
-/* For a guard that passed, the range around `address` that will keep
- * passing while the epoch stands (see `__weavec_rt_object_range`). */
-static void remember(const struct __weavec_rt_found *found, uintptr_t address,
-                     unsigned epoch, struct __weavec_rt_range *range,
-                     void *frame) {
-  uintptr_t low;
-  uintptr_t high;
-  if (found->state == WeavecRtTrackedLive) {
-    /* An object of a deeper frame is not live; one the guarding function
-     * declared in a nested scope may leave it under the cache. */
-    if (found->kind == WeavecRtStack &&
-        (found->frame < (uintptr_t)frame ||
-         (found->frame == (uintptr_t)frame && found->scoped)))
+/* RFC 0034, section 2.5. */
+static const char *guardName(unsigned kind) {
+  return (kind & WeavecRtGuardKindMask) == WeavecRtGuardLive ? "live"
+                                                             : "object";
+}
+
+void __weavec_rt_guard(const void *from, const void *at,
+                       unsigned long long width, unsigned kind,
+                       const struct __weavec_rt_site *site) {
+  WEAVEC_RT_FORWARD_VOID(guard, from, at, width, kind, site);
+  int failed;
+  weavecRtCount(WeavecRtStatSlowGuards);
+  if ((kind & WeavecRtGuardOverflow) != 0) {
+    failed = 1;
+  } else if ((kind & WeavecRtGuardKindMask) == WeavecRtGuardLive) {
+    if (shadowLive((uintptr_t)from) == 1)
       return;
-    low = found->base;
-    high = found->base + found->size;
+    failed = __weavec_rt_find(from).state == WeavecRtTrackedDead;
   } else {
-    if (!weavecRtUntrackedRange(address, &low, &high) ||
-        weavecRtMayHoldHuge(low, high) ||
-        (low < __weavec_rt_heap.base + __weavec_rt_heap.bytes &&
-         high > __weavec_rt_heap.base))
+    const int answer = shadowObject((uintptr_t)from, (uintptr_t)at, width);
+    if (answer == 1)
       return;
+    if (answer == 0) {
+      failed = 1;
+    } else {
+      const struct __weavec_rt_found found = __weavec_rt_find(at);
+      failed = accessFails(&found, (uintptr_t)at, width, from);
+    }
   }
-  if (high <= low)
+  if (__builtin_expect(!failed, 1))
+    return;
+  if (site != NULL) {
+    __weavec_rt_report(guardName(kind), site->file, site->line, site->column);
     return;
-  weavecRtCount(WeavecRtStatRangesKept);
-  range->lo = low;
-  range->len = high - low;
-  if (found->word != NULL) {
-    /* An arena block is this block while its slot word says so. */
-    range->state = found->word;
-    range->expect = found->value;
-  } else {
-    range->state = &__weavec_rt_epoch;
-    range->expect = epoch;
   }
-}
-
-struct __weavec_rt_range
-__weavec_rt_object_range(const void *p, long long index,
-                         unsigned long long step, unsigned long long offset,
-                         unsigned long long width, void *frame) {
-  WEAVEC_RT_FORWARD(objectRange, p, index, step, offset, width, frame);
-  /* Read before the lookup: a change in between leaves the range stale by
-   * its own epoch. */
-  const unsigned epoch = __atomic_load_n(&__weavec_rt_epoch, __ATOMIC_RELAXED);
-  struct __weavec_rt_range range = {0, 0, &__weavec_rt_epoch, 0, 1};
-  struct __weavec_rt_found found;
-  uintptr_t address;
-  weavecRtCount(WeavecRtStatRanges);
-  if (!accessAddress(p, index, step, offset, &address))
-    return range;
-  found = __weavec_rt_find((const void *)address);
-  if (accessFails(&found, address, width, p))
-    return range;
-  range.failed = 0;
-  /* (Untracked bytes reached from another pointer passed because of where
-   * that pointer is, which a range of the bytes cannot remember.) */
-  if (found.state == WeavecRtUntracked && address != (uintptr_t)p)
-    return range;
-  remember(&found, address, epoch, &range, frame);
-  return range;
-}
-
-struct __weavec_rt_range __weavec_rt_live_range(const void *p, void *frame) {
-  WEAVEC_RT_FORWARD(liveRange, p, frame);
-  const unsigned epoch = __atomic_load_n(&__weavec_rt_epoch, __ATOMIC_RELAXED);
-  const struct __weavec_rt_found found = __weavec_rt_find(p);
-  struct __weavec_rt_range range = {0, 0, &__weavec_rt_epoch, 0, 1};
-  weavecRtCount(WeavecRtStatRanges);
-  if (found.state == WeavecRtTrackedDead)
-    return range;
-  range.failed = 0;
-  remember(&found, (uintptr_t)p, epoch, &range, frame);
-  return range;
+  __weavec_rt_trapping();
+  __builtin_trap();
 }
 
 int __weavec_rt_release_ok(const void *p) {
diff --git a/runtime/weavec_owner.c b/runtime/weavec_owner.c
index 2f259c32..72c58c3d 100644
--- a/runtime/weavec_owner.c
+++ b/runtime/weavec_owner.c
@@ -20,7 +20,7 @@
 
 #include <string.h>
 
-enum { WeavecRtDispatchMagic = 0x52435657, WeavecRtDispatchVersion = 1 };
+enum { WeavecRtDispatchMagic = 0x52435657, WeavecRtDispatchVersion = 2 };
 
 const struct __weavec_rt_dispatch __weavec_rt_dispatch = {
     WeavecRtDispatchMagic,      WeavecRtDispatchVersion,
@@ -30,10 +30,11 @@ const struct __weavec_rt_dispatch __weavec_rt_dispatch = {
     __weavec_rt_find,           __weavec_rt_object,
     __weavec_rt_string,         __weavec_rt_strlen,
     __weavec_rt_live,           __weavec_rt_release_ok,
-    __weavec_rt_object_range,   __weavec_rt_live_range,
+    __weavec_rt_guard,
     __weavec_rt_stack_enter,    __weavec_rt_stack_leave,
     __weavec_rt_stack_rewind,   __weavec_rt_globals_add,
-    __weavec_rt_report,         __weavec_rt_fatal};
+    __weavec_rt_report,         __weavec_rt_fatal,
+    __weavec_rt_room};
 
 #if defined(__APPLE__)
 
@@ -41,28 +42,28 @@ const struct __weavec_rt_dispatch __weavec_rt_dispatch = {
 #include <pthread.h>
 #include <sched.h>
 
-enum { Unresolved = 0, Resolving = 1, Resolved = 2 };
+enum { Unresolved = 0, Resolving = 1, Resolved = WeavecRtOwnerResolved };
 
-static const struct __weavec_rt_dispatch *owner;
-static unsigned ownerState = Unresolved;
+const struct __weavec_rt_dispatch *weavecRtOwner;
+unsigned weavecRtOwnerState = Unresolved;
 /* The thread finding the owner: what it calls meanwhile (dlsym may
  * allocate) is served here. Not a thread-local variable: Darwin allocates
  * those on first use, through malloc. */
 static pthread_t resolver;
 
-const struct __weavec_rt_dispatch *weavecRtForward(void) {
-  unsigned state = __atomic_load_n(&ownerState, __ATOMIC_ACQUIRE);
+const struct __weavec_rt_dispatch *weavecRtResolveOwner(void) {
+  unsigned state = __atomic_load_n(&weavecRtOwnerState, __ATOMIC_ACQUIRE);
   unsigned expected = Unresolved;
   const struct __weavec_rt_dispatch *found;
-  if (__builtin_expect(state == Resolved, 1))
-    return owner;
+  if (state == Resolved)
+    return weavecRtOwner;
   if (state == Resolving && pthread_equal(resolver, pthread_self()))
     return 0;
-  if (!__atomic_compare_exchange_n(&ownerState, &expected, Resolving, 0,
-                                   __ATOMIC_ACQ_REL, __ATOMIC_ACQUIRE)) {
-    while (__atomic_load_n(&ownerState, __ATOMIC_ACQUIRE) != Resolved)
+  if (!__atomic_compare_exchange_n(&weavecRtOwnerState, &expected, Resolving,
+                                   0, __ATOMIC_ACQ_REL, __ATOMIC_ACQUIRE)) {
+    while (__atomic_load_n(&weavecRtOwnerState, __ATOMIC_ACQUIRE) != Resolved)
       sched_yield();
-    return owner;
+    return weavecRtOwner;
   }
   resolver = pthread_self();
   found = (const struct __weavec_rt_dispatch *)dlsym(RTLD_DEFAULT,
@@ -70,18 +71,23 @@ const struct __weavec_rt_dispatch *weavecRtForward(void) {
   if (found != 0 && found != &__weavec_rt_dispatch &&
       found->magic == WeavecRtDispatchMagic &&
       found->version == WeavecRtDispatchVersion && found->initialise()) {
-    /* The owner's arena is fixed once reserved: its descriptor serves this
-     * image's inline guards; its base, published last, opens it. */
-    const uintptr_t base = found->heap->base;
+    /* The owner's arena and shadow are fixed once reserved: its descriptor
+     * serves this image's inline guards. `mask` and `bytes`, published
+     * last, open them; until then every guard asks the runtime, which
+     * forwards. */
     struct __weavec_rt_heap_t copy;
     memcpy(&copy, found->heap, sizeof copy);
-    copy.base = 0;
+    copy.mask = 0;
+    copy.bytes = 0;
     memcpy(&__weavec_rt_heap, &copy, sizeof copy);
-    __atomic_store_n(&__weavec_rt_heap.base, base, __ATOMIC_RELEASE);
-    owner = found;
+    __atomic_store_n(&__weavec_rt_heap.bytes, found->heap->bytes,
+                     __ATOMIC_RELEASE);
+    __atomic_store_n(&__weavec_rt_heap.mask, found->heap->mask,
+                     __ATOMIC_RELEASE);
+    weavecRtOwner = found;
   }
-  __atomic_store_n(&ownerState, Resolved, __ATOMIC_RELEASE);
-  return owner;
+  __atomic_store_n(&weavecRtOwnerState, Resolved, __ATOMIC_RELEASE);
+  return weavecRtOwner;
 }
 
 /* Before this image's own code runs, as far as an initialiser can be. The
diff --git a/runtime/weavec_report.c b/runtime/weavec_report.c
index fbac14c2..2e3201d3 100644
--- a/runtime/weavec_report.c
+++ b/runtime/weavec_report.c
@@ -188,7 +188,7 @@ __attribute__((destructor)) static void printStats(void) {
       "allocations",      "releases",      "recycled slots",
       "huge blocks",      "lookups",       "heap lookups",
       "stack lookups",    "global lookups", "untracked lookups",
-      "range requests",   "ranges kept",   "stack objects entered"};
+      "slow guards",      "stack objects entered"};
   const char *value = getenv("WEAVEC_RT_STATS");
   int i;
   /* (The owner's counters count every image's work.) */
diff --git a/runtime/weavec_rt.h b/runtime/weavec_rt.h
index d60f4a99..c2f1fee5 100644
--- a/runtime/weavec_rt.h
+++ b/runtime/weavec_rt.h
@@ -19,6 +19,7 @@
 
 #include <stddef.h>
 #include <stdint.h>
+#include <string.h>
 
 /* Every entry point has default visibility: on ELF the first definition the
  * dynamic linker finds then serves every image (RFC 0032, section 2.5). */
@@ -44,15 +45,24 @@ struct __weavec_rt_class {
   uint32_t capacity;
 };
 
-/* What a lookup of an arena pointer needs; `base` is 0 until the arena
- * exists, so every pointer is outside it. The check prelude declares the
- * same two structures (RFC 0032 section 7): its guards look an arena
- * pointer up inline. The slot words of a region are readable as soon as the
- * arena exists; a slot the region has not reached reads as never allocated. */
+/* What a lookup of an arena pointer needs; `bytes` is 0 until the arena
+ * exists, so every pointer is outside it. The guards the backend expands
+ * (RFC 0034, section 1.4) read `shadow` and `mask` at fixed offsets. The
+ * slot words of a region are readable as soon as the arena exists; a slot
+ * the region has not reached reads as never allocated. */
 struct __weavec_rt_heap_t {
   uintptr_t base;
   /* classes << shift. */
   uintptr_t bytes;
+  /* RFC 0034, section 2.1: one byte per 16-byte granule of the address
+   * space, at shadow + ((address >> 4) & mask). 0: no live arena object's
+   * (outside the arena, never allocated, free, quarantined); 1-16: the
+   * first k bytes are a live arena object's; 0xFE: a live object's slot
+   * after the object. `mask` is 0 when the shadow could not be reserved,
+   * and until it is: every guard then reads the byte at `shadow`, which is
+   * 0, and asks the runtime. */
+  uintptr_t shadow;
+  uintptr_t mask;
   /* Region r's slot words start at meta + (r << (shift - 2)). */
   uintptr_t meta;
   uint32_t shift;
@@ -70,6 +80,202 @@ enum {
   WeavecRtDead = 3
 };
 
+/* Shadow bytes (RFC 0034, section 2.1, as amended). A granule's byte is
+ * 0 when no live tracked object has bytes in it (an untracked address, or
+ * a dead or never-allocated arena slot: `base` and `bytes` tell them
+ * apart); 1-16 when the first k bytes are a live heap object's (arena or
+ * huge block); `Tail` after a live heap object's last byte, in its slot.
+ * A stack or global object that starts on a granule (the compiler aligns
+ * the ones it registers) is encoded exactly: its last granule reads
+ * `ObjectLast + k` (k, 1-16, of its bytes are there), each granule r before
+ * it a run byte: `ObjectRun + r` for r up to 48, and above it
+ * `ObjectRun + 48 + c`, which says r is at least 2^(c + 4) (c from 1 to 15,
+ * the largest r below 2^20 granules). A granule d before another is of the
+ * same object when d is at most the earlier one's least r; the end of an
+ * object is a logarithmic number of such jumps away. An object that does not start on a granule makes its granules, and
+ * the one after it, `Mixed`, which the runtime looks up. `HugeDead` marks a
+ * released huge block. */
+enum {
+  WeavecRtShadowDead = 0x00,
+  WeavecRtShadowWhole = 0x10,
+  WeavecRtShadowObjectLast = 0x40,
+  WeavecRtShadowObjectRun = 0x80,
+  WeavecRtShadowRunLimit = 63,
+  /* The untracked granule after an exactly encoded object that ends on a
+   * granule: an address one past an object belongs to it. */
+  WeavecRtShadowOnePast = 0xFB,
+  WeavecRtShadowMixed = 0xFC,
+  WeavecRtShadowHugeDead = 0xFD,
+  WeavecRtShadowTail = 0xFE
+};
+
+/*===-- The shadow (RFC 0034, section 2) -----------------------------------===*/
+
+static inline unsigned char *weavecRtShadowOf(uintptr_t address) {
+  return (unsigned char *)(__weavec_rt_heap.shadow +
+                           ((address >> 4) & __weavec_rt_heap.mask));
+}
+
+static inline int weavecRtShadowReady(void) {
+  return __atomic_load_n(&__weavec_rt_heap.mask, __ATOMIC_ACQUIRE) != 0;
+}
+
+/* Whether `v` is a stack or global object's exact encoding, and its r. */
+static inline int weavecRtIsObjectByte(unsigned char v) {
+  return (v > WeavecRtShadowObjectLast && v <= WeavecRtShadowObjectLast + 16) ||
+         (v > WeavecRtShadowObjectRun &&
+          v <= WeavecRtShadowObjectRun + WeavecRtShadowRunLimit);
+}
+/* The least r a run byte says (0 for a last granule). */
+static inline uintptr_t weavecRtObjectRun(unsigned char v) {
+  if (v <= WeavecRtShadowObjectRun)
+    return 0;
+  if (v <= WeavecRtShadowObjectRun + 48)
+    return v - WeavecRtShadowObjectRun;
+  return (uintptr_t)1 << (v - WeavecRtShadowObjectRun - 48 + 4);
+}
+/* The run byte of a granule r granules before its object's last. */
+static inline unsigned char weavecRtRunByte(uintptr_t r) {
+  unsigned c = 1;
+  if (r <= 48)
+    return (unsigned char)(WeavecRtShadowObjectRun + r);
+  while (c < 15 && ((uintptr_t)1 << (c + 5)) <= r)
+    ++c;
+  return (unsigned char)(WeavecRtShadowObjectRun + 48 + c);
+}
+
+/* A live heap object of `size` bytes at `base` (16-aligned): its whole
+ * granules, then the granule its end falls in, which is a partial granule
+ * or the slot's tail. */
+static inline void weavecRtShadowLive(uintptr_t base, size_t size) {
+  unsigned char *shadow = weavecRtShadowOf(base);
+  const size_t whole = size >> 4;
+  const unsigned rest = (unsigned)(size & 15);
+  if (!weavecRtShadowReady())
+    return;
+  if (whole != 0)
+    memset(shadow, WeavecRtShadowWhole, whole);
+  shadow[whole] = rest != 0 ? (unsigned char)rest : WeavecRtShadowTail;
+}
+
+/* Sets what `weavecRtShadowLive(base, size)` marked to `value`. */
+static inline void weavecRtShadowFill(uintptr_t base, size_t size,
+                                      unsigned char value) {
+  if (weavecRtShadowReady())
+    memset(weavecRtShadowOf(base), value, (size >> 4) + 1);
+}
+
+/* A live stack or global object of `size` bytes at `base`: exactly when it
+ * starts on a granule, else `Mixed` over its granules and the next. An
+ * untracked granule after it (`onePast`: a global's padding, or the next
+ * granule of a frame with no unnamed storage) says that an address one
+ * past it belongs to it. The
+ * granule after it may start a live exactly encoded neighbour, whose bytes
+ * stay (its leave walks them); one past the end of this one then reads as
+ * the neighbour's, as with two exact objects. */
+static inline void weavecRtShadowObject(uintptr_t base, size_t size,
+                                        int onePast) {
+  uintptr_t g;
+  if (!weavecRtShadowReady() || size == 0)
+    return;
+  if ((base & 15) == 0) {
+    const uintptr_t n = (size + 15) >> 4;
+    /* (A range the mask does not wrap is contiguous in the shadow: the
+     * granules of one run byte are written at once.) */
+    if (weavecRtShadowOf(base + ((n - 1) << 4)) >= weavecRtShadowOf(base)) {
+      unsigned char *at = weavecRtShadowOf(base);
+      uintptr_t r = n - 1;
+      while (r > 48) {
+        const unsigned char v = weavecRtRunByte(r);
+        const uintptr_t low = v == weavecRtRunByte(49) ? 49 : weavecRtObjectRun(v);
+        memset(at, v, r - low + 1);
+        at += r - low + 1;
+        r = low - 1;
+      }
+      for (; r > 0; --r)
+        *at++ = weavecRtRunByte(r);
+    } else {
+      for (g = 0; g + 1 < n; ++g)
+        *weavecRtShadowOf(base + (g << 4)) = weavecRtRunByte(n - 1 - g);
+    }
+    /* A last granule it shares with a live mixed object stays mixed. */
+    if ((size & 15) == 0 ||
+        *weavecRtShadowOf(base + ((n - 1) << 4)) != WeavecRtShadowMixed)
+      *weavecRtShadowOf(base + ((n - 1) << 4)) =
+          (unsigned char)(WeavecRtShadowObjectLast + (size - ((n - 1) << 4)));
+    if (onePast && (size & 15) == 0 && *weavecRtShadowOf(base + (n << 4)) == 0)
+      *weavecRtShadowOf(base + (n << 4)) = WeavecRtShadowOnePast;
+    return;
+  }
+  for (g = base >> 4; g <= (base + size) >> 4; ++g) {
+    unsigned char *byte = weavecRtShadowOf(g << 4);
+    if (g << 4 < base + size || !weavecRtIsObjectByte(*byte))
+      *byte = WeavecRtShadowMixed;
+  }
+}
+
+/* The object at `base` is gone: an exactly encoded one reads untracked; of
+ * a mixed one, the granules it had to itself (the runtime looks the others
+ * up). */
+static inline void weavecRtShadowForget(uintptr_t base, size_t size) {
+  if (!weavecRtShadowReady() || size == 0)
+    return;
+  if ((base & 15) != 0) {
+    uintptr_t g;
+    for (g = (base + 15) >> 4; (g + 1) << 4 <= base + size; ++g)
+      *weavecRtShadowOf(g << 4) = WeavecRtShadowDead;
+    return;
+  }
+  memset(weavecRtShadowOf(base), WeavecRtShadowDead, size >> 4);
+  if ((size & 15) != 0 &&
+      *weavecRtShadowOf(base + ((size >> 4) << 4)) != WeavecRtShadowMixed)
+    *weavecRtShadowOf(base + ((size >> 4) << 4)) = WeavecRtShadowDead;
+  if (*weavecRtShadowOf(base + (((size + 15) >> 4) << 4)) ==
+      WeavecRtShadowOnePast)
+    *weavecRtShadowOf(base + (((size + 15) >> 4) << 4)) = WeavecRtShadowDead;
+}
+
+/* Zeroes `bytes` of the shadow at `start`: whole pages by mapping them
+ * afresh, so that a thread's 64 MiB stack costs pages, not bytes. */
+void weavecRtShadowZero(unsigned char *start, size_t bytes);
+
+/* Clears the shadow of [low, high) (16-aligned outward). */
+static inline void weavecRtShadowClear(uintptr_t low, uintptr_t high) {
+  uintptr_t g;
+  if (!weavecRtShadowReady() || high <= low)
+    return;
+  /* (A range the mask does not wrap is contiguous in the shadow.) */
+  if (((high + 15) >> 4) - (low >> 4) > 65536 &&
+      weavecRtShadowOf(high - 1) > weavecRtShadowOf(low)) {
+    weavecRtShadowZero(weavecRtShadowOf(low),
+                       (size_t)(((high + 15) >> 4) - (low >> 4)));
+    return;
+  }
+  for (g = low >> 4; g < (high + 15) >> 4; ++g)
+    *weavecRtShadowOf(g << 4) = WeavecRtShadowDead;
+}
+
+/* The end (one past the last byte) of the exactly encoded stack or global
+ * object whose granule holds `address`, found by jumping forward: 0 when
+ * the granule is not one. A run of r below 63 ends r granules on; one of
+ * 63 at least 63 on. */
+static inline uintptr_t weavecRtShadowObjectEnd(uintptr_t address) {
+  uintptr_t g = address >> 4;
+  unsigned char v;
+  if (!weavecRtShadowReady())
+    return 0;
+  v = *weavecRtShadowOf(g << 4);
+  while (v > WeavecRtShadowObjectLast + 16) {
+    if (!weavecRtIsObjectByte(v))
+      return 0;
+    g += weavecRtObjectRun(v);
+    v = *weavecRtShadowOf(g << 4);
+  }
+  if (!weavecRtIsObjectByte(v))
+    return 0;
+  return (g << 4) + (v - WeavecRtShadowObjectLast);
+}
+
 /*===-- The allocator (sections 2.3 to 2.6) -------------------------------===*/
 
 WEAVEC_RT_API void *__weavec_rt_alloc(size_t size, size_t alignment);
@@ -103,11 +309,6 @@ struct __weavec_rt_found {
 /* The tracked object `p` points into. */
 WEAVEC_RT_API struct __weavec_rt_found __weavec_rt_find(const void *p);
 
-/* Bumped whenever a range a guard may have remembered, other than an arena
- * block, stops being valid: a huge block mapped or unmapped, a table of
- * globals added. (An arena block's validity is its own slot word.) */
-WEAVEC_RT_API extern unsigned __weavec_rt_epoch;
-
 /* Guards: 0 when the guard passes, non-zero when it fails. */
 WEAVEC_RT_API int __weavec_rt_object(const void *p, long long index,
                                      unsigned long long step,
@@ -117,33 +318,31 @@ WEAVEC_RT_API int __weavec_rt_string(const char *p);
 /* The length of the string at `p`, read inside its own object: the maximum
  * when the object is dead or holds no terminator. */
 WEAVEC_RT_API unsigned long long __weavec_rt_strlen(const char *p);
+/* RFC 0034, section 5.2: the bytes from `p` to the end of the live tracked
+ * object it points into; 0 in a dead one, the maximum in none. */
+WEAVEC_RT_API unsigned long long __weavec_rt_room(const void *p);
 WEAVEC_RT_API int __weavec_rt_live(const void *p);
-/* As `__weavec_rt_object` and `__weavec_rt_live`, for a guard with a
- * *range cache* (section 13): four words {lo, len, state, expect} in the
- * guarding function's frame. The answer says whether the guard failed and,
- * when it passed, the range around the pointer that keeps passing while the
- * 32-bit word at `state` reads `expect`: an arena block's bytes, valid while
- * its slot word is unchanged (the block is live and keeps its size); any
- * other object's bytes, or for an untracked pointer the part of its page no
- * tracked object can be in, valid while the epoch stands. `len` is 0, which
- * holds nothing, when there is no such range. A stack object of the
- * guarding function itself (whose frame is `frame`) is remembered only when
- * it lives as long as the frame: one declared in a nested scope may leave
- * it while the cache lives. The answer is returned by value, so the cache
- * never has its address taken and the compiler keeps it in registers. */
-struct __weavec_rt_range {
-  unsigned long long lo;
-  unsigned long long len;
-  const unsigned *state;
-  unsigned long long expect;
-  unsigned long long failed;
+/* RFC 0034, section 2.5: the slow path of a guard the backend expanded,
+ * and of every guard an object built without the backend pass calls. `kind`
+ * is a WeavecRtGuard value, with WeavecRtGuardOverflow when the access's
+ * address overflowed and WeavecRtGuardProven for verify mode's monitors of
+ * proven facets. Returns when the guard passes; otherwise traps, or, with a
+ * `site` (report mode), reports it and returns. */
+enum {
+  WeavecRtGuardObject = 0,
+  WeavecRtGuardLive = 1,
+  WeavecRtGuardKindMask = 3,
+  WeavecRtGuardOverflow = 4,
+  WeavecRtGuardProven = 8
 };
-WEAVEC_RT_API struct __weavec_rt_range
-__weavec_rt_object_range(const void *p, long long index,
-                         unsigned long long step, unsigned long long offset,
-                         unsigned long long width, void *frame);
-WEAVEC_RT_API struct __weavec_rt_range __weavec_rt_live_range(const void *p,
-                                                              void *frame);
+struct __weavec_rt_site {
+  const char *file;
+  unsigned line;
+  unsigned column;
+};
+WEAVEC_RT_API void __weavec_rt_guard(const void *from, const void *at,
+                                     unsigned long long width, unsigned kind,
+                                     const struct __weavec_rt_site *site);
 WEAVEC_RT_API int __weavec_rt_release_ok(const void *p);
 
 /* Stack objects (section 4). `flags`: the function has automatic objects
@@ -197,24 +396,33 @@ struct __weavec_rt_dispatch {
   unsigned long long (*strlen)(const char *);
   int (*live)(const void *);
   int (*releaseOk)(const void *);
-  struct __weavec_rt_range (*objectRange)(const void *, long long,
-                                          unsigned long long,
-                                          unsigned long long,
-                                          unsigned long long, void *);
-  struct __weavec_rt_range (*liveRange)(const void *, void *);
+  void (*guard)(const void *, const void *, unsigned long long, unsigned,
+                const struct __weavec_rt_site *);
   void *(*stackEnter)(void *, size_t, void *, int);
   void (*stackLeave)(void *, void *);
   void (*stackRewind)(void *);
   void (*globalsAdd)(const void *const *, const void *const *);
   void (*report)(const char *, const char *, unsigned, unsigned);
   void (*fatal)(const char *, const void *, const char *);
+  unsigned long long (*room)(const void *);
 };
 WEAVEC_RT_API extern const struct __weavec_rt_dispatch __weavec_rt_dispatch;
 
 #if defined(__APPLE__)
 /* The owner's table when this copy forwards to it; null when this copy is
- * the owner (or while it is finding out, on the thread doing so). */
-const struct __weavec_rt_dispatch *weavecRtForward(void);
+ * the owner (or while it is finding out, on the thread doing so). The state
+ * is resolved once, so every later entry point tests one global inline. */
+enum { WeavecRtOwnerResolved = 2 };
+extern unsigned weavecRtOwnerState;
+extern const struct __weavec_rt_dispatch *weavecRtOwner;
+const struct __weavec_rt_dispatch *weavecRtResolveOwner(void);
+static inline const struct __weavec_rt_dispatch *weavecRtForward(void) {
+  if (__builtin_expect(__atomic_load_n(&weavecRtOwnerState, __ATOMIC_ACQUIRE) ==
+                           WeavecRtOwnerResolved,
+                       1))
+    return weavecRtOwner;
+  return weavecRtResolveOwner();
+}
 #else
 #define weavecRtForward() ((const struct __weavec_rt_dispatch *)0)
 #endif
@@ -243,11 +451,6 @@ int weavecRtInitialise(void);
 int weavecRtIsStackOrGlobal(const void *p);
 /* The stack and global parts of a lookup. */
 struct __weavec_rt_found weavecRtFindStackOrGlobal(const void *p);
-/* A range around an address no stack or global object is in, inside its
- * page; false when none can be given (the calling thread's stack). */
-int weavecRtUntrackedRange(uintptr_t address, uintptr_t *low, uintptr_t *high);
-/* Whether a huge block was ever mapped in [low, high). */
-int weavecRtMayHoldHuge(uintptr_t low, uintptr_t high);
 
 /* WEAVEC_RT_STATS=1: what the runtime did, printed when the program exits. */
 enum {
@@ -260,18 +463,13 @@ enum {
   WeavecRtStatStackLookups,
   WeavecRtStatGlobalLookups,
   WeavecRtStatUntrackedLookups,
-  WeavecRtStatRanges,
-  WeavecRtStatRangesKept,
+  WeavecRtStatSlowGuards,
   WeavecRtStatStackEnters,
   WeavecRtStatCount
 };
 extern unsigned long long weavecRtStats[WeavecRtStatCount];
 static inline void weavecRtCount(int stat) { ++weavecRtStats[stat]; }
 
-static inline void weavecRtBumpEpoch(void) {
-  (void)__atomic_add_fetch(&__weavec_rt_epoch, 1, __ATOMIC_RELAXED);
-}
-
 /* A lock that needs no initialisation and nothing from the C library. */
 typedef struct {
   volatile int held;
diff --git a/scripts/check-hygiene.py b/scripts/check-hygiene.py
index 1e305ba7..3871af84 100755
--- a/scripts/check-hygiene.py
+++ b/scripts/check-hygiene.py
@@ -43,7 +43,7 @@
                      string literals ignored. A missing lib/Analysis/Engine.h
                      is a violation.
   engine-lines       lib/Analysis/Engine*.h and lib/Analysis/Engine*.cpp
-                     (EngineIntegers.h included) total at most 21,500 lines.
+                     (EngineIntegers.h included) total at most 22,000 lines.
   library-lines      the code under lib/, include/ and tools/ totals at most
                      70,000 lines. lib/Core/LibrarySpec.txt does not count:
                      it is a declarative table, and its growth is coverage,
@@ -59,7 +59,10 @@
                      RFC 0033 (gate H1, Implementation amendments) raised
                      them to 21,500 and 70,000 for the witness rule, the
                      length guards, the link modes and the unit budget
-                     (21,078 and 69,980 lines measured).
+                     (21,078 and 69,980 lines measured). RFC 0034 (gate
+                     H1, Implementation amendments) raised them to 22,000
+                     and 72,000 for the shadow guards' passes, confirmation
+                     by replay and the work and memory budgets.
   runtime-lines      the C runtime (runtime/, its tests under runtime/test/
                      excluded) totals at most 4,000 lines (RFC 0032 gate H1).
                      It is counted apart from the libraries: it is linked
@@ -117,10 +120,10 @@
 # Gate H2 (RFC 0030, Acceptance gates, Hygiene; RFC 0031, section 2)
 # ---------------------------------------------------------------------------
 
-# Recorded by RFC 0031 stage S7 and RFC 0032 and 0033 gate H1 (see the
+# Recorded by RFC 0031 stage S7 and RFC 0032, 0033 and 0034 gate H1 (see the
 # module docstring).
-ENGINE_LINE_LIMIT = 21_500
-LIBRARY_LINE_LIMIT = 70_000
+ENGINE_LINE_LIMIT = 22_000
+LIBRARY_LINE_LIMIT = 72_000
 RUNTIME_LINE_LIMIT = 4_000
 
 # retired-name
@@ -144,7 +147,11 @@
 # fresh and sealed projects)
 CORPUS_WORDS = ("cJSON", "jansson", "linenoise", "jsmn", "zlib", "lua", "Lua", "sds", "minigzip",
                 "zstd", "libuv", "oniguruma", "redis", "expat", "pcre2", "libevent", "libsodium",
-                "libxml2", "libpng", "mbedtls", "msgpack", "yyjson")
+                "libxml2", "libpng", "mbedtls", "msgpack", "yyjson",
+                # RFC 0034, section 9.
+                "quickjs", "QuickJS", "lmdb", "LMDB", "janet", "Janet", "brotli", "xz",
+                "libdeflate", "zlib-ng", "curl", "cmark", "libgit2", "libjpeg", "opus",
+                "flac", "giflib", "wren")
 CORPUS_WORD_DIRS = ("lib",)
 # engine-include (RFC 0030 sections 1 and 14, RFC 0031 section 2)
 NEW_COMPONENTS = ("SiteCollector", "AttributeReader", "KindInference", "SlotCollector",
diff --git a/scripts/corpus-gate.py b/scripts/corpus-gate.py
index 03bc3e4c..aa99094f 100755
--- a/scripts/corpus-gate.py
+++ b/scripts/corpus-gate.py
@@ -9,8 +9,10 @@
 miniz, mujs, sqlite, tinyexpr, utf8proc). Per RFC 0033 section 11, configs
 marked heldOut may also name a "set": the 8 "fresh" configs (zstd, libuv,
 oniguruma, redis, expat, pcre2, libevent, libsodium) and the 5 "sealed" ones
-(libxml2, libpng, mbedtls, msgpack-c, yyjson). test/corpus/README.md
-documents the files.
+(libxml2, libpng, mbedtls, msgpack-c, yyjson). Per RFC 0034 section 9, two
+more sets: the 10 "fresh34" configs (QuickJS, LMDB, Janet, brotli, xz,
+libdeflate, zlib-ng, curl, cmark, libgit2), each with a run-time workload,
+and the 5 "sealed34" ones. test/corpus/README.md documents the files.
 
 Modes (combine freely; at least one, or --update-from):
 
@@ -66,6 +68,22 @@
                     config otherwise runs only when --only names it. Their
                     D1 and D5 values are reported in a section of their own
                     (rfc0033.sealed.*) and failures fail the run.
+  --set SET         run the configs of SET alone (repeatable): one of
+                    original, heldOut, fresh, sealed, fresh34, sealed34;
+                    --only overrides it. RFC 0034, section 9: the fresh34
+                    configs also run with the held-out ones (--full,
+                    --held-out); the sealed34 ones only with --set sealed34
+                    or --only (gate F2, once, on the final tree; before it
+                    with --reference-only alone). RFC 0034's gates
+                    (manifest gates.rfc0034): F1 over fresh34 (as D1), F2
+                    over sealed34 (F1 and F5's build ratio), F5 (with --full
+                    each config's build CPU ratio over the reference
+                    compiler's, every config but sealed34; the named
+                    single-unit compiles' CPU seconds; each compilation's
+                    peak memory, from --quick's per-file compiles and the
+                    trap build's compiler processes) and F7 (with --bench
+                    each fresh34 workload's run-time ratio, their geometric
+                    mean, and the G14 benchmarks' tighter limits).
 
 Examples:
 
@@ -74,6 +92,8 @@
       --weavec-cc build/release/bin/weavec-cc --only jansson --json out.json
   scripts/corpus-gate.py --full --reference-only --cc "$(brew --prefix llvm)/bin/clang"
   scripts/corpus-gate.py --full --sealed --reference-only --cc "$(brew --prefix llvm)/bin/clang"
+  scripts/corpus-gate.py --full --set fresh34 --json fresh34.json
+  scripts/corpus-gate.py --full --set sealed34 --reference-only --cc "$(brew --prefix llvm)/bin/clang"
   scripts/corpus-gate.py --inject --legacy --update
 
 Exit status: 0 when every check passes, 1 when a check fails, 2 on a usage
@@ -91,6 +111,7 @@
 import glob
 import hashlib
 import json
+import math
 import os
 import platform
 import re
@@ -501,15 +522,23 @@ def original(self) -> list[Config]:
 # (RFC 0033). A manifest names the last two in a config's `set`, which needs
 # `heldOut: true`; without `set` a config is original, or heldOut when it is
 # marked heldOut.
-SETS = ("original", "heldOut", "fresh", "sealed")
-NAMED_SETS = ("fresh", "sealed")
+SETS = ("original", "heldOut", "fresh", "sealed", "fresh34", "sealed34")
+NAMED_SETS = ("fresh", "sealed", "fresh34", "sealed34")
+# The sets that run only when asked for (--set, --sealed, --only): RFC 0033's
+# and RFC 0034's sealed sets.
+SEALED_SETS = ("sealed", "sealed34")
+# RFC 0034, section 9: the fresh34 configs carry a run-time workload (gate F7).
+BENCH_SETS = ("fresh34",)
 SET_TITLES = {
     "heldOut": "held-out configs (RFC 0031, section 11.2)",
     "fresh": "fresh configs (RFC 0033, section 11; gates D1 and D5)",
     "sealed": "sealed configs (RFC 0033, section 11; gate D2)",
+    "fresh34": "fresh34 configs (RFC 0034, section 9; gates F1, F5 and F7)",
+    "sealed34": "sealed34 configs (RFC 0034, section 9; gate F2)",
 }
 # What a finding's message calls a config of each set.
-SET_LABELS = {"original": "", "heldOut": "held-out ", "fresh": "fresh ", "sealed": "sealed "}
+SET_LABELS = {"original": "", "heldOut": "held-out ", "fresh": "fresh ", "sealed": "sealed ",
+              "fresh34": "fresh34 ", "sealed34": "sealed34 "}
 
 SHA_RE = re.compile(r"[0-9a-f]{40}")
 LOWERED_RE = re.compile(r"-Wno-error=weavec-(?P<id>[a-z-]+)")
@@ -555,17 +584,19 @@ def load_manifest(path: Path, support_root: Path) -> Manifest:
             held_out = c.get("heldOut", False)
             if not isinstance(held_out, bool):
                 problems.append(f"config {cname}: heldOut must be true or false")
-            elif held_out and bench is not None:
-                problems.append(f"config {cname}: a held-out config has no bench (RFC 0031, section 11.2)")
             corpus_set = "heldOut" if held_out is True else "original"
             if "set" in c:
                 if c["set"] not in NAMED_SETS:
-                    problems.append(f"config {cname}: set must be \"fresh\" or \"sealed\" (got {c['set']!r}); "
+                    problems.append(f"config {cname}: set must be one of "
+                                    f"{', '.join(repr(s) for s in NAMED_SETS)} (got {c['set']!r}); "
                                     f"without it a config is original, or heldOut when marked heldOut")
                 elif held_out is not True:
                     problems.append(f"config {cname}: set {c['set']!r} needs heldOut true (RFC 0033, section 11)")
                 else:
                     corpus_set = c["set"]
+            if held_out is True and bench is not None and corpus_set not in BENCH_SETS:
+                problems.append(f"config {cname}: a held-out config has no bench (RFC 0031, section 11.2), "
+                                f"unless its set is {' or '.join(BENCH_SETS)} (RFC 0034, section 9)")
             config = Config(
                 name=cname, project=project, files=list(compile_.get("files", [])),
                 args=list(compile_.get("args", [])), whole_program=bool(c.get("wholeProgram", False)),
@@ -636,14 +667,17 @@ def with_held_out(args: argparse.Namespace) -> bool:
 
 
 def select_configs(manifest: Manifest, only: list[str], held_out: bool = True,
-                   sealed: bool = False) -> list[Config]:
-    """The configs named by --only; else the sealed set alone when `sealed`
-    (--sealed, RFC 0033 section 11); else every config but the sealed ones,
-    the held-out and fresh ones only when `held_out`."""
+                   sealed: bool = False, sets: Iterable[str] = ()) -> list[Config]:
+    """The configs named by --only; else the configs of the sets named by
+    --set (RFC 0034 section 9), with RFC 0033's sealed set when `sealed`
+    (--sealed, RFC 0033 section 11), alone; else every config but those of
+    the sealed sets (SEALED_SETS), the held-out, fresh and fresh34 ones only
+    when `held_out`."""
     if not only:
-        if sealed:
-            return [c for c in manifest.configs if c.set == "sealed"]
-        return [c for c in manifest.configs if c.set != "sealed" and (held_out or not c.held_out)]
+        wanted = set(sets) | ({"sealed"} if sealed else set())
+        if wanted:
+            return [c for c in manifest.configs if c.set in wanted]
+        return [c for c in manifest.configs if c.set not in SEALED_SETS and (held_out or not c.held_out)]
     known = {c.name for c in manifest.configs}
     unknown = sorted(set(only) - known)
     if unknown:
@@ -1529,10 +1563,16 @@ class BuildRun:
     trap_deaths: list[str] = dataclasses.field(default_factory=list)
     reports: list[dict] = dataclasses.field(default_factory=list)
     failures: list[str] = dataclasses.field(default_factory=list)
+    # RFC 0034 F5: compiler processes the wrapper logged, and the largest peak
+    # resident size among them (bytes), when the wrapper ran them under time(1).
+    compiles: int | None = None
+    compile_max_rss: int | None = None
 
     def to_json(self) -> dict:
         return {"config": self.config, "mode": self.mode, "compiler": self.compiler,
                 "built": self.built, "testsPassed": self.tests_passed,
+                "compiles": self.compiles,
+                "compileMaxRssMiB": round(self.compile_max_rss / 2 ** 20, 1) if self.compile_max_rss else None,
                 "steps": [s.to_json() for s in self.steps], "tests": [s.to_json() for s in self.tests],
                 "diagnostics": [d.to_json() for d in self.diagnostics],
                 "ledger": self.program.to_json() if self.program else None,
@@ -1557,14 +1597,36 @@ def sanitizer_symbolizer(cc: str) -> dict:
     return {}
 
 
-def write_wrapper(path: Path, compiler: str, flags: list[str]) -> str:
+# RFC 0034 gate F5: the peak memory of each compilation of a build. The
+# wrapper runs the compiler under time(1), which appends the child's rusage to
+# a log: `-l` on BSD and Darwin ("<bytes>  maximum resident set size"), `-v`
+# with GNU time ("Maximum resident set size (kbytes): <n>").
+TIME_BINARY = "/usr/bin/time"
+RUSAGE_RSS_RE = re.compile(r"^\s*(?P<bytes>\d+)\s+maximum resident set size\s*$"
+                           r"|^\s*Maximum resident set size \(kbytes\):\s*(?P<kib>\d+)\s*$", re.MULTILINE)
+
+
+def write_wrapper(path: Path, compiler: str, flags: list[str], rusage_log: Path | None = None) -> str:
     path.parent.mkdir(parents=True, exist_ok=True)
     words = " ".join(shlex.quote(w) for w in [compiler, *flags])
+    if rusage_log is not None and os.access(TIME_BINARY, os.X_OK):
+        verbose = "-l" if sys.platform == "darwin" or "bsd" in sys.platform else "-v"
+        words = f"{TIME_BINARY} -a -o {shlex.quote(str(rusage_log))} {verbose} {words}"
     path.write_text(f"#!/bin/sh\n# written by scripts/corpus-gate.py\nexec {words} \"$@\"\n")
     path.chmod(0o755)
     return str(path)
 
 
+def compile_peaks(rusage_log: Path) -> list[int]:
+    """The peak resident size, in bytes, of each compiler process a wrapper logged."""
+    try:
+        text = rusage_log.read_text(errors="replace")
+    except OSError:
+        return []
+    return [int(m.group("bytes")) if m.group("bytes") else int(m.group("kib")) * 1024
+            for m in RUSAGE_RSS_RE.finditer(text)]
+
+
 def base_env(config: Config, cc: str, src: Path, support_root: Path, bench_dir: Path, jobs: int,
              extra: dict | None = None) -> dict:
     env = dict(os.environ)
@@ -1659,13 +1721,16 @@ def run_build(config: Config, mode: str, compiler: str, flags: list[str], checko
         if applied:
             run.failures.append(applied)
             return run
+    logs = work / "logs"
+    logs.mkdir(parents=True, exist_ok=True)
+    rusage_log = None
     if with_ledger:
         ledger_dir.mkdir(parents=True, exist_ok=True)
         flags = [*flags, f"-fweavec-ledger={ledger_dir}/"]
-    cc = write_wrapper(work / "bin" / "cc", compiler, flags) if flags else compiler
+        # RFC 0034 F5: each compilation's peak memory.
+        rusage_log = logs / "compile-rusage.log"
+    cc = write_wrapper(work / "bin" / "cc", compiler, flags, rusage_log) if flags else compiler
     env = base_env(config, cc, src, support_root, bench_dir, jobs, extra_env)
-    logs = work / "logs"
-    logs.mkdir(parents=True, exist_ok=True)
     output = []
     run.built = True
     for index, command in enumerate(config.build):
@@ -1712,6 +1777,10 @@ def run_build(config: Config, mode: str, compiler: str, flags: list[str], checko
         run.reports = parse_reports("\n".join(test_output), src)
         for report in run.reports:
             report["file"] = normalise_report_file(report["file"])
+    if rusage_log is not None:
+        peaks = compile_peaks(rusage_log)
+        run.compiles = len(peaks)
+        run.compile_max_rss = max(peaks) if peaks else None
     if not keep:
         remove_tree(src)
     return run
@@ -1913,7 +1982,7 @@ def __init__(self, args: argparse.Namespace):
         self.support_root = args.support_dir
         self.bench_dir = args.bench_dir
         self.manifest = load_manifest(args.manifest, self.support_root)
-        self.configs = select_configs(self.manifest, args.only, with_held_out(args), args.sealed)
+        self.configs = select_configs(self.manifest, args.only, with_held_out(args), args.sealed, args.set)
         # Every selected config outside the original set: RFC 0030's gates
         # (G9, G10, G11) and the ratchet's records leave them out.
         self.held_out = {c.name for c in self.configs if c.held_out}
@@ -2217,8 +2286,9 @@ def run_builds(self) -> None:
             entry = self.config_entry(config)
             runs = {}
             config_modes = list(modes)
-            if config.held_out and modes != ["reference"] and modes != ["legacy"] and self.binaries.reference_cc:
-                # RFC 0031 G12 and RFC 0033 D5: the build's CPU time against the
+            if modes != ["reference"] and modes != ["legacy"] and self.binaries.reference_cc:
+                # RFC 0031 G12, RFC 0033 D5 and RFC 0034 F5 (which counts the
+                # original configs too): the build's CPU time against the
                 # reference compiler's.
                 config_modes.append("reference")
             cache = self.args.workdir / ".cache" / config.project.name
@@ -2227,8 +2297,7 @@ def run_builds(self) -> None:
                 compiler, flags = self.wrapper_flags(mode, config)
                 with_ledger = mode in ("trap", "verify")
                 log(f"[{config.name}] {mode} build with {compiler}")
-                # The reference build of a held-out, fresh or sealed config only
-                # times the build.
+                # The reference build next to a WeaveC build only times the build.
                 no_tests = [] if mode == "reference" and mode not in modes else None
                 build = run_build(config, mode, compiler, flags, checkout, self.run_dir / "builds" / config.name,
                                   self.support_root, self.bench_dir, self.jobs, self.args.build_timeout,
@@ -2716,9 +2785,10 @@ def evaluate_new_semantics(self) -> None:
                       all(t == 0 for t in traps.values()) if traps else None, traps)
         if self.sets["heldOut"]:
             self.evaluate_held_out()
-        for corpus_set in NAMED_SETS:
+        for corpus_set in ("fresh", "sealed"):
             if self.sets[corpus_set]:
                 self.evaluate_rfc0033(corpus_set)
+        self.evaluate_rfc0034()
 
     def evaluate_findings_and_analyses(self) -> None:
         # RFC 0030's gates (G9, G10) count the original configs; the held-out
@@ -2853,7 +2923,7 @@ def evaluate_unresolved_shares(self, all_original: bool) -> None:
         complete = {"original": all_original,
                     "heldOut": bool(self.sets["heldOut"]) and all(c.name in selected for c in self.manifest.configs
                                                                   if c.set == "heldOut"),
-                    "fresh": False, "sealed": False}
+                    **{s: False for s in NAMED_SETS}}
         detail: dict = {}
         ok = True
         gated = False
@@ -2894,12 +2964,7 @@ def held_out_rows(self, corpus_set: str = "heldOut") -> dict[str, dict]:
             facets = (shares.get("facets") or {}).get("temporal") or {}
             builds = entry.get("builds") or {}
             checked = builds.get(self.args.checks) or builds.get("reference") or {}
-            reference = builds.get("reference") or {}
-            ratio = None
-            weavec_cpu = sum(s["cpu"] for s in checked.get("steps", [])) if checked is not reference else None
-            reference_cpu = sum(s["cpu"] for s in reference.get("steps", []))
-            if weavec_cpu is not None and reference_cpu > 0 and checked.get("built") and reference.get("built"):
-                ratio = round(weavec_cpu / reference_cpu, 2)
+            ratio = build_cpu_ratio(builds, self.args.checks)
             rows[config.name] = {
                 "errors": units.get("errors"), "warnings": units.get("warnings"),
                 "temporalUnresolved": facets.get("unresolved"), "temporalTotal": sum(facets.values()) if facets else None,
@@ -2919,6 +2984,7 @@ def held_out_rows(self, corpus_set: str = "heldOut") -> dict[str, dict]:
                 "reportTestsPassed": (builds.get("report") or {}).get("testsPassed"),
                 "traps": entry.get("traps"),
                 "buildCpuRatio": ratio,
+                "compileMaxRssMiB": checked.get("compileMaxRssMiB"),
                 "unitCosts": units.get("unitCosts") or {},
             }
         return rows
@@ -3014,6 +3080,130 @@ def evaluate_rfc0033(self, corpus_set: str) -> None:
                 ok5 &= row["buildCpuRatio"] <= limit5
         self.gate(f"{prefix}.D5", ok5 if detail5 and limit5 is not None else None, detail5)
 
+    # ---- fresh34 and sealed34 configs (RFC 0034, section 9) ----
+
+    def drop_in_ok(self, row: dict, spec: dict) -> bool:
+        """RFC 0033 D1, as RFC 0034 F1 and F2 restate it for their sets: no
+        definite error triaged false; with --full the build passes (or stops
+        only at definite errors all triaged true) and the test suite passes,
+        in trap mode with no trap (or only at triaged-true sites) and in
+        report mode with no failure."""
+        ok = row["falseDefiniteErrors"] <= spec.get("maxFalseDefiniteErrors", 0)
+        if self.args.full:
+            stopped_by_true_errors = (row["built"] is False and row["definiteErrors"] > 0
+                                      and not row["falseDefiniteErrors"] and not row["untriagedDefiniteErrors"])
+            ok &= row["built"] is not False or stopped_by_true_errors
+            ok &= row["testsPassed"] is not False or row["trueTrapsOnly"]
+            ok &= row["reportTestsPassed"] is not False
+            ok &= (row["traps"] or 0) <= spec.get("maxTraps", 0)
+        return ok
+
+    def evaluate_rfc0034(self) -> None:
+        """RFC 0034's gates (manifest gates.rfc0034).
+
+        F1: every fresh34 config builds with the default flags and passes its
+        test suite, in trap mode with no trap and in report mode with no
+        failure; a build may stop only at definite errors triaged true.
+        F2: the same over the sealed34 configs, with F5's build ratio (the one
+        sealed run, recorded as measured; a failure fails the run).
+        F5: each selected config's weavec-cc build CPU time at most
+        maxBuildRatio times the reference compiler's (--full; the reference
+        compiler builds every config once more for it); the named single-unit
+        compiles (sqlite3.c) within their CPU seconds; and no compilation
+        above maxCompileRssMiB, from the per-file compiles of --quick and,
+        with --full, from every compiler process of the trap-mode builds.
+        F7: the run-time ratios of --bench (the default build, with the
+        runtime, over the reference): each fresh34 workload at most
+        maxOverhead and their geometric mean at most maxGeometricMean, and
+        RFC 0032's G14 benchmarks (lua, zlib, cJSON) at their own limits.
+        """
+        spec = self.manifest.gates.get("rfc0034")
+        if not spec:
+            return
+        selected = {c.name for c in self.configs}
+        for corpus_set, name in (("fresh34", "F1"), ("sealed34", "F2")):
+            if not self.sets[corpus_set]:
+                continue
+            rows = self.held_out_rows(corpus_set)
+            self.results.setdefault(corpus_set, {})["configs"] = rows
+            limits = spec.get(name, {})
+            detail = {}
+            ok = True
+            for config, row in rows.items():
+                detail[config] = {k: row[k] for k in (
+                    "definiteErrors", "falseDefiniteErrors", "untriagedDefiniteErrors", "built", "testsPassed",
+                    "trueTrapsOnly", "reportTestsPassed", "traps")}
+                ok &= self.drop_in_ok(row, limits)
+                if corpus_set == "sealed34" and row["buildCpuRatio"] is not None:
+                    limit = spec.get("F5", {}).get("maxBuildRatio")
+                    detail[config]["buildCpuRatio"] = {"ratio": row["buildCpuRatio"], "limit": limit}
+                    if limit is not None:
+                        ok &= row["buildCpuRatio"] <= limit
+            self.gate(f"rfc0034.{name}", ok if rows else None, detail)
+        # F5: build ratios, named unit costs, and every compilation's memory.
+        f5 = spec.get("F5", {})
+        detail5: dict = {}
+        ok5 = True
+        limit_ratio = f5.get("maxBuildRatio")
+        limit_rss = f5.get("maxCompileRssMiB")
+        for config in self.configs:
+            if config.set == "sealed34":
+                continue  # F2 records the sealed run
+            entry = self.results["configs"].get(config.name, {})
+            ratio = build_cpu_ratio(entry.get("builds") or {}, self.args.checks)
+            units = ((entry.get("analyses") or {}).get("units") or {}).get("unitCosts") or {}
+            peaks = [c["maxRssMiB"] for c in units.values() if c.get("maxRssMiB") is not None]
+            build_peak = ((entry.get("builds") or {}).get(self.args.checks) or {}).get("compileMaxRssMiB")
+            if build_peak is not None:
+                peaks.append(build_peak)
+            row: dict = {}
+            if ratio is not None:
+                row["buildCpuRatio"] = {"ratio": ratio, "limit": limit_ratio}
+                if limit_ratio is not None:
+                    ok5 &= ratio <= limit_ratio
+            if peaks:
+                row["compileMaxRssMiB"] = {"value": max(peaks), "limit": limit_rss}
+                if limit_rss is not None:
+                    ok5 &= max(peaks) <= limit_rss
+            if row:
+                detail5[config.name] = row
+        for name, limits in (f5.get("maxUnitCpuSeconds") or {}).items():
+            if name not in selected:
+                continue
+            entry = self.results["configs"].get(name, {})
+            cost = (((entry.get("analyses") or {}).get("units") or {}).get("unitCosts") or {}).get(limits["file"])
+            if not cost:
+                continue
+            detail5[f"{name}.{limits['file']}"] = {"cpuSeconds": cost["cpuSeconds"], "limit": limits["cpuSeconds"]}
+            ok5 &= cost["cpuSeconds"] <= limits["cpuSeconds"]
+        self.gate("rfc0034.F5", ok5 if detail5 else None, detail5)
+        # F7: run time with the runtime.
+        f7 = spec.get("F7", {})
+        detail7: dict = {}
+        ok7 = True
+        fresh = {}
+        for config in self.sets["fresh34"]:
+            ratio = self.measured.get(config.name, {}).get("overhead")
+            if ratio is not None:
+                fresh[config.name] = ratio
+                detail7[config.name] = {"overhead": ratio, "limit": f7.get("maxOverhead")}
+                if f7.get("maxOverhead") is not None:
+                    ok7 &= ratio <= f7["maxOverhead"]
+        mean = geometric_mean(list(fresh.values()))
+        if mean is not None:
+            detail7["geometricMean"] = {"value": mean, "limit": f7.get("maxGeometricMean"),
+                                        "configs": len(fresh),
+                                        "complete": all(c.name in fresh for c in self.manifest.configs
+                                                        if c.set == "fresh34")}
+            if f7.get("maxGeometricMean") is not None:
+                ok7 &= mean <= f7["maxGeometricMean"]
+        for name, limit in (f7.get("maxOverheadG14") or {}).items():
+            ratio = self.measured.get(name, {}).get("overhead")
+            if name in selected and ratio is not None:
+                detail7[name] = {"overhead": ratio, "limit": limit}
+                ok7 &= ratio <= limit
+        self.gate("rfc0034.F7", ok7 if detail7 else None, detail7)
+
     def must_report(self, entries: list[dict]) -> list[dict] | None:
         if not self.args.full:
             return None
@@ -3182,6 +3372,24 @@ def run(self) -> int:
 # -- reporting ----------------------------------------------------------------
 
 
+def build_cpu_ratio(builds: dict, checks: str) -> float | None:
+    """A config's WeaveC build CPU time over the reference compiler's, both built."""
+    checked = builds.get(checks) or {}
+    reference = builds.get("reference") or {}
+    if not checked or not reference or not checked.get("built") or not reference.get("built"):
+        return None
+    reference_cpu = sum(s["cpu"] for s in reference.get("steps", []))
+    if reference_cpu <= 0:
+        return None
+    return round(sum(s["cpu"] for s in checked.get("steps", [])) / reference_cpu, 2)
+
+
+def geometric_mean(values: list[float]) -> float | None:
+    if not values or any(v <= 0 for v in values):
+        return None
+    return round(math.exp(sum(math.log(v) for v in values) / len(values)), 4)
+
+
 def print_legacy_table(configs: list[Config], tallies: dict[str, dict], totals: dict) -> None:
     ids = sorted(totals["byId"])
     name_w = max(len("config"), *(len(c.name) for c in configs))
@@ -3206,6 +3414,8 @@ def print_legacy_table(configs: list[Config], tallies: dict[str, dict], totals:
     "heldOut": ("rfc0031.G5", "rfc0031.G6", "rfc0031.G12"),
     "fresh": ("rfc0033.D1", "rfc0033.D5"),
     "sealed": ("rfc0033.sealed.D1", "rfc0033.sealed.D5"),
+    "fresh34": ("rfc0034.F1", "rfc0034.F5", "rfc0034.F7"),
+    "sealed34": ("rfc0034.F2",),
 }
 
 
@@ -3299,6 +3509,10 @@ def parse_args(argv: list[str]) -> argparse.Namespace:
     sel.add_argument("--sealed", action="store_true",
                      help="run the sealed configs of RFC 0033, section 11 (gate D2), alone unless --only names "
                           "configs; otherwise they run only when --only names them")
+    sel.add_argument("--set", action="append", default=[], choices=SETS, metavar="SET",
+                     help="run the configs of this set alone (repeatable; one of " + ", ".join(SETS)
+                          + "): --set fresh34 for RFC 0034's gates F1, F5 and F7, --set sealed34 for "
+                            "its gate F2; --only overrides it")
     sel.add_argument("--injection", action="append", default=[], metavar="ID", help="run only this injection")
     sel.add_argument("--jobs", type=int, default=os.cpu_count() or 4, help="parallel processes (default: CPUs)")
     sel.add_argument("--timeout", type=float, default=1800, help="seconds per analysis process (default 1800)")
@@ -3328,6 +3542,8 @@ def parse_args(argv: list[str]) -> argparse.Namespace:
         ap.error("--held-out has no --legacy form: v0.10.0 was never measured on the held-out configs")
     if args.legacy and args.sealed:
         ap.error("--sealed has no --legacy form: v0.10.0 was never measured on the sealed configs")
+    if args.legacy and set(args.set) - {"original"}:
+        ap.error("--set has no --legacy form but for the original set: v0.10.0 was measured on it alone")
     if args.reference_only and (args.quick or args.compare_golden or args.legacy):
         ap.error("--reference-only runs builds, tests, benchmarks and injection checks only")
     if args.update and (args.compare_golden and not (args.quick or args.full or args.inject or args.bench)):
diff --git a/scripts/run-cases.py b/scripts/run-cases.py
index 884b49b6..1e093e47 100755
--- a/scripts/run-cases.py
+++ b/scripts/run-cases.py
@@ -16,6 +16,12 @@
 5. runs the ASan oracle (`--asan` or an ASAN marker);
 6. with `--checks verify`, fails any case that hits a `weavec.proven` trap.
 
+A DETECT case (RFC 0034 section 9, gate F4) is judged instead by whether its
+bug stops at or before a STOP line, at compile time or by a trap, and whether
+its fixed twin builds and runs clean; `--min-stops N` gates the count. An
+XFAIL case is expected to fail today (XFAIL), and is reported when it passes
+(XPASS); neither fails the run.
+
 `--legacy` applies the same markers with v0.10.0 semantics: diagnostics
 only, from the `weavec` tool of WEAVEC_GOLDEN_DIR, and additionally
 classifies every bug case as CAUGHT, SILENT, SIGNAL, MISLABEL or LEAK-ONLY.
@@ -69,7 +75,7 @@
     "unknown-extent", "unknown-index", "inexpressible", "may-released", "may-moved",
     "may-alias-released", "may-invalid-release", "may-mismatched-release", "may-dangle",
     "may-conflict", "unknown-callee", "callback", "setjmp", "budget", "unanalysed",
-    "raw-cast", "dangling-escape", "second-owner", "no-zero-init",
+    "raw-cast", "dangling-escape", "second-owner", "no-zero-init", "unconfirmed", "lowered",
 )
 TRUST_REASONS = (
     "unsafe", "system-api", "library-spec", "extern-contract", "caller-contract",
@@ -116,11 +122,17 @@
                                "checking-incomplete", "checking-failed"))
 
 FILE_MARKERS = frozenset(("CLEAN", "ALLOW", "RUN-INPUT", "EXPECT-LEDGER", "FLAGS", "UNITS",
-                          "ASAN", "TOOL"))
+                          "ASAN", "TOOL",
+                          # RFC 0034 section 9: detection cases, and expected failures.
+                          "DETECT", "XFAIL"))
 LINE_MARKERS = frozenset(("BUG", "TRAP", "UNRESOLVED", "TRUSTED", "NOT-PROVEN", "GUARDED",
-                          "NEUTRALISED", "MISS"))
+                          "NEUTRALISED", "MISS", "STOP"))
 MARKERS = FILE_MARKERS | LINE_MARKERS
-NO_ARGUMENT_MARKERS = frozenset(("CLEAN", "ASAN", "TOOL"))
+NO_ARGUMENT_MARKERS = frozenset(("CLEAN", "ASAN", "TOOL", "STOP"))
+# Markers a detection case (DETECT) cannot have: it is judged by whether its
+# bug stops, not by what is reported where.
+NOT_IN_DETECTION = frozenset(("CLEAN", "ALLOW", "TOOL", "BUG", "TRAP", "UNRESOLVED", "TRUSTED",
+                              "NOT-PROVEN", "GUARDED", "NEUTRALISED", "EXPECT-LEDGER"))
 EXPECTATION_MARKERS = frozenset(("CLEAN", "EXPECT-LEDGER")) | LINE_MARKERS
 COMPARISONS = ("==", "!=", "<=", ">=", "<", ">")
 
@@ -336,6 +348,14 @@ def parse_argument(kind: str, argument: str, directory: Path) -> Any:
             raise ValueError(f"FLAGS: {error}") from None
     if kind == "UNITS":
         return tuple(argument.split())
+    if kind == "DETECT":
+        try:
+            flags = tuple(shlex.split(argument))
+        except ValueError as error:
+            raise ValueError(f"DETECT: {error}") from None
+        if not all(flag.startswith("-") for flag in flags):
+            raise ValueError("DETECT takes the flags that select the fixed twin, e.g. '-DFIX'")
+        return flags
     return argument
 
 
@@ -408,6 +428,10 @@ class Case:
     markers: list[Marker]  # line markers of every unit
     has_main: bool
     errors: list[str]
+    # RFC 0034 section 9: a detection case's twin flags (DETECT), and the reason
+    # a case is expected to fail today (XFAIL).
+    detect: tuple[str, ...] | None = None
+    xfail: str | None = None
 
     def line_markers(self, kind: str) -> list[Marker]:
         return [m for m in self.markers if m.kind == kind]
@@ -494,8 +518,27 @@ def markers_of(file: Path) -> SourceMarkers:
         tool=bool(file_markers["TOOL"]), asan=bool(file_markers["ASAN"]),
         run_inputs=[marker.value for marker in file_markers["RUN-INPUT"]],
         expectations=[marker.value for marker in file_markers["EXPECT-LEDGER"]],
-        markers=markers, has_main=any(defines_main(t) for t in texts.values()), errors=errors)
+        markers=markers, has_main=any(defines_main(t) for t in texts.values()), errors=errors,
+        detect=file_markers["DETECT"][0].value if file_markers["DETECT"] else None,
+        xfail="; ".join(m.value for m in file_markers["XFAIL"]) or None)
     kinds = {m.kind for m in main.file_markers} | {m.kind for m in markers}
+    if len(file_markers["DETECT"]) > 1:
+        errors.append(f"{path.name}: DETECT is given more than once")
+    if case.detect is not None:
+        clash = sorted(kinds & NOT_IN_DETECTION)
+        if clash:
+            errors.append(f"{path.name}: a DETECT case has no {', '.join(clash)} markers (its bug lines are STOP)")
+        if not case.has_main:
+            errors.append(f"{path.name}: DETECT needs a unit that defines main")
+        stops = {(m.file, m.line) for m in markers if m.kind == "STOP"}
+        if not stops:
+            errors.append(f"{path.name}: a DETECT case needs a STOP line (where the bug must stop)")
+        for marker in markers:
+            if marker.kind == "MISS" and (marker.file, marker.line) not in stops:
+                errors.append(f"{marker.file.name}:{marker.line}: in a DETECT case MISS marks a STOP line "
+                              f"as a known miss")
+    elif "STOP" in kinds:
+        errors.append(f"{path.name}: STOP needs a DETECT file marker")
     if not kinds & EXPECTATION_MARKERS:
         errors.append(f"{path.name}: no expectation (CLEAN, EXPECT-LEDGER or a line marker)")
     if case.clean and {"BUG", "MISS", "NEUTRALISED", "TRAP"} & kinds:
@@ -1423,7 +1466,7 @@ def cc_flags(case: Case, cfg: Config, checks: str | None, unit: Path | None) ->
 
 
 def build(case: Case, cfg: Config, ev: Evidence, directory: Path, checks: str | None,
-          ledger: Path | None, extra: list[str], record: bool) -> Path | None:
+          ledger: Path | None, extra: list[str], record: bool, analyze_link: bool = True) -> Path | None:
     """Compile every unit and link them when one defines main; return the executable."""
     directory.mkdir(parents=True, exist_ok=True)
     objects = unit_objects(case, directory)
@@ -1449,7 +1492,8 @@ def build(case: Case, cfg: Config, ev: Evidence, directory: Path, checks: str |
     command = [str(cfg.weavec_cc), *extra, *cc_flags(case, cfg, checks, None)]
     # RFC 0033 §7: the default link reads records only; the cases pin what
     # the analysis reports across units, so their links analyse again.
-    if len(case.units) > 1 and not any(f.startswith("-fweavec-link") for f in case.flags):
+    # A detection case measures the default build, whose link reads records.
+    if analyze_link and len(case.units) > 1 and not any(f.startswith("-fweavec-link") for f in case.flags):
         command.append("-fweavec-link=analyze")
     if ledger is not None:
         command.append(f"-fweavec-ledger={ledger}{os.sep}")
@@ -1546,9 +1590,29 @@ def only_expected_errors(case: Case, ev: Evidence) -> bool:
     return bool(errors) and all((located(d.file, d.line), d.id) in expected for d in errors)
 
 
+def apply_xfail(case: Case, result: dict) -> dict:
+    """XFAIL: a failing case is an expected failure; a passing one is
+    reported so that its marker is removed (neither fails the run)."""
+    if not case.xfail or result["status"] not in ("pass", "fail"):
+        return result
+    if result["status"] == "fail":
+        result["status"] = "xfail"
+        result["notes"].insert(0, f"expected failure: {case.xfail}")
+    else:
+        result["status"] = "xpass"
+        result["notes"].insert(0, f"XFAIL case passes now: remove its XFAIL marker ({case.xfail})")
+    return result
+
+
 def run_case(case: Case, cfg: Config) -> dict:
     if case.errors:
         return evaluate(case, Evidence("legacy" if cfg.legacy else cfg.checks))
+    if case.detect is not None:
+        return apply_xfail(case, run_detection_case(case, cfg))
+    return apply_xfail(case, run_case_markers(case, cfg))
+
+
+def run_case_markers(case: Case, cfg: Config) -> dict:
     if cfg.legacy:
         return evaluate(case, run_legacy(case, cfg.weavec, cfg))
     start = time.perf_counter()
@@ -1677,6 +1741,162 @@ def run_asan(case: Case, cfg: Config, ev: Evidence, directory: Path) -> None:
             ev.asan = report
 
 
+# ---------------------------------------------------------------------------
+# Detection cases (RFC 0034 section 9, gate F4)
+# ---------------------------------------------------------------------------
+
+# The report-mode builds of a detection case leave the C library's own
+# fortification out, so that the first failure they report is WeaveC's.
+NO_FORTIFY = ["-D_FORTIFY_SOURCE=0"]
+
+
+def detection_runs(case: Case, cfg: Config, ev: Evidence, directory: Path, extra: list[str],
+                   ledger: Path | None = None) -> None:
+    """Build the case (bug, or twin with `extra`) as the default build does,
+    run it, and rebuild it in report mode to name each failed check."""
+    exe = build(case, cfg, ev, directory / "build", cfg.checks, ledger, extra, record=True, analyze_link=False)
+    if ledger is not None:
+        load_ledgers(ev, ledger)
+    ev.built = exe is not None
+    ev.diagnostics = sorted(set(ev.diagnostics))
+    if exe is None:
+        return
+    env = run_environment()
+    ev.runs = run_executable(exe, case, cfg, directory, env, cfg.run_timeout)
+    report_exe = build(case, cfg, ev, directory / "report", "report", None, [*extra, *NO_FORTIFY], record=False,
+                       analyze_link=False)
+    if report_exe is None:
+        ev.tool_failures.append("the report-mode build failed")
+        return
+    ev.ran = True
+    report_runs = run_executable(report_exe, case, cfg, directory, env, cfg.run_timeout)
+    ev.report_runs = [parse_reports(run.stderr, directory) for run in report_runs]
+    ev.run_reported = [bool(reports) for reports in ev.report_runs]
+    for reports in ev.report_runs:
+        for report in reports:
+            if report not in ev.reports:
+                ev.reports.append(report)
+    if cfg.checks == "verify":
+        # F4: no bug runs past a proven facet. A verify-mode trap where the
+        # report-mode run (which has no proven checks) names no failure is a
+        # `weavec.proven` one, unless the build planned no verify check or the
+        # report-mode run traps the same way (the program's own trap).
+        for run, report_run, reports in zip(ev.runs, report_runs, ev.report_runs):
+            if run.trapped and not reports and not report_run.trapped and verify_checks(ev) != 0:
+                ev.proven_traps.append(f"run {shlex.join(run.args) or '(no arguments)'}: weavec.proven trap "
+                                       f"(the verify build trapped where no unproven check failed)")
+
+
+def run_detection_case(case: Case, cfg: Config) -> dict:
+    """A detection case: the bug build must stop at or before a STOP line (a
+    WeaveC error stops the build, or the run traps and the report-mode run's
+    first failure is on a STOP line), and the twin (built with the DETECT
+    flags) must build and run with no error, trap or failed check."""
+    bug, twin = Evidence(cfg.checks), Evidence(cfg.checks)
+    skip = ("--legacy" if cfg.legacy else "--no-run" if cfg.no_run else "--no-emission" if cfg.no_emission
+            else "--require" if cfg.require else None)
+    if skip:
+        result = evaluate_detection(case, bug, twin)
+        result.update(status="skip", failures=[], notes=[f"a detection case needs the default build and its run "
+                                                         f"(not {skip})"])
+        return result
+    start = time.perf_counter()
+    temp = Path(tempfile.mkdtemp(prefix="weavec-case-", dir=cfg.work))
+    try:
+        ledger = None
+        if cfg.checks == "verify":
+            # verify_checks reads the bug build's ledgers: did it plan a verify check?
+            ledger = temp / "ledger"
+            ledger.mkdir()
+        detection_runs(case, cfg, bug, temp / "bug", ["-g"] if cfg.checks == "verify" else [], ledger)
+        detection_runs(case, cfg, twin, temp / "twin", list(case.detect or ()))
+        if cfg.asan or case.asan:
+            run_asan(case, cfg, bug, temp / "asan")
+    finally:
+        if cfg.keep:
+            bug.notes.append(f"kept {temp}")
+        else:
+            shutil.rmtree(temp, ignore_errors=True)
+    bug.seconds = time.perf_counter() - start
+    return evaluate_detection(case, bug, twin)
+
+
+def evaluate_detection(case: Case, bug: Evidence, twin: Evidence) -> dict:
+    """Judge a detection case (pure): did the bug stop, and is the twin clean?"""
+    failures: list[str] = list(case.errors)
+    notes = list(bug.notes)
+    stops = {located(m.file, m.line) for m in case.markers if m.kind == "STOP"}
+    known_miss = [m for m in case.markers if m.kind == "MISS"]
+    failures.extend(bug.tool_failures)
+    failures.extend(f"compiler error: {e}" for e in bug.clang_errors)
+    stop = where = None
+    errors = [d for d in bug.diagnostics if d.severity == "error"]
+    if errors:
+        stop, where = "compile", errors[0].text()
+        if not any((d.file, d.line) in stops for d in errors):
+            notes.append(f"the build stopped at an error on no STOP line: {where}")
+    why_not = "no executable was built" if not bug.built else "the report-mode build was not run"
+    if stop is None and bug.ran:
+        why_not = "the run did not trap"
+        for number, run in enumerate(bug.runs):
+            reports = bug.report_runs[number] if number < len(bug.report_runs) else []
+            first = reports[0] if reports else None
+            if first is not None and (first.file, first.line) in stops and run.trapped:
+                stop = "run"
+                where = f"{first.template} at {relative(first.file)}:{first.line}:{first.column}"
+                break
+            if run.timed_out:
+                why_not = "the run timed out"
+            elif run.trapped and first is None:
+                why_not = f"the run was {run.describe()}, but the report-mode run names no failed check"
+            elif first is not None:
+                where_first = f"{first.template} at {relative(first.file)}:{first.line}"
+                why_not = (f"the first failed check is {where_first}, on no STOP line" if run.trapped
+                           else f"the report-mode run fails {where_first}, but the trap-mode run was "
+                                f"{run.describe()}")
+            else:
+                why_not = f"the run did not trap ({run.describe()})"
+    flip = False
+    if stop is None and not known_miss:
+        failures.append(f"the bug did not stop: {why_not}")
+    elif stop is not None and known_miss:
+        flip = True
+        notes.append(f"known miss now stops ({stop}: {where}): remove its MISS marker")
+    elif stop is None:
+        notes.append(f"known miss ({'; '.join(m.value for m in known_miss)}): {why_not}")
+    failures.extend(bug.proven_traps)
+    # The twin: no error, no trap or other death, no failed check.
+    twin_failures = list(twin.tool_failures) + [f"compiler error: {e}" for e in twin.clang_errors]
+    twin_failures += [f"error: {d.text()}" for d in twin.diagnostics if d.severity == "error"]
+    for number, run in enumerate(twin.runs):
+        if run.timed_out or run.signal is not None:
+            twin_failures.append(f"run {shlex.join(run.args) or '(no arguments)'}: {run.describe()}")
+    for report in twin.reports:
+        twin_failures.append(f"failed check {report.template} at {relative(report.file)}:{report.line}:"
+                             f"{report.column}")
+    if twin.built is False and not twin_failures and case.detect is not None and (bug.built or bug.diagnostics):
+        twin_failures.append("no executable was built")
+    failures.extend(f"the fixed twin ({' '.join(case.detect or ())}) stops: {f}" for f in twin_failures)
+    asan = None
+    if bug.asan_ran:
+        asan = bug.asan.kind if bug.asan else False
+    return {
+        "case": case.rel, "suite": case.suite,
+        "status": "error" if case.errors else "fail" if failures else "pass",
+        "failures": failures, "notes": notes, "kind": "detection",
+        "class": stop or "miss", "bugs": [],
+        "detection": {"stop": stop, "where": where, "knownMiss": bool(known_miss), "flip": flip,
+                      "twinClean": not twin_failures, "asan": asan},
+        "diagnostics": [d.text() for d in bug.diagnostics],
+        "runs": [{"args": list(r.args), "result": r.describe()} for r in bug.runs],
+        "reports": [f"{r.template} at {relative(r.file)}:{r.line}:{r.column}" for r in bug.reports],
+        "twin": {"diagnostics": [d.text() for d in twin.diagnostics],
+                 "runs": [{"args": list(r.args), "result": r.describe()} for r in twin.runs]},
+        "asan": {"report": asan} if bug.asan_ran else None,
+        "commands": bug.commands + twin.commands, "seconds": round(bug.seconds, 3),
+    }
+
+
 # ---------------------------------------------------------------------------
 # --compare-golden
 # ---------------------------------------------------------------------------
@@ -1734,17 +1954,45 @@ def format_key(key: tuple) -> str:
 # ---------------------------------------------------------------------------
 
 
+STATUS_COUNTS = {"pass": "passed", "fail": "failed", "error": "errors", "skip": "skipped", "xfail": "xfailed",
+                 "xpass": "xpassed"}
+STATUS_LABELS = {"pass": "PASS", "fail": "FAIL", "error": "ERROR", "skip": "SKIP", "xfail": "XFAIL",
+                 "xpass": "XPASS"}
+# Statuses that do not fail the run: an expected failure, and an XFAIL case
+# that passes now (reported, so that its marker is removed).
+PASSING_STATUSES = ("pass", "skip", "xfail", "xpass")
+
+
 def summarize(results: list[dict]) -> dict:
     suites: dict[str, dict] = {}
     for result in results:
         suite = suites.setdefault(result["suite"], {
-            "cases": 0, "passed": 0, "failed": 0, "errors": 0, "skipped": 0,
+            "cases": 0, "passed": 0, "failed": 0, "errors": 0, "skipped": 0, "xfailed": 0, "xpassed": 0,
             "bugCases": 0, "bugCasesPassed": 0, "classes": {c: 0 for c in CLASSES},
             "pins": 0, "pinsSatisfied": 0, "pinsReported": 0,
             "cleanCases": 0, "cleanPassed": 0, "cleanBuilds": 0})
         suite["cases"] += 1
         status = result["status"]
-        suite[{"pass": "passed", "fail": "failed", "error": "errors", "skip": "skipped"}[status]] += 1
+        suite[STATUS_COUNTS[status]] += 1
+        if result["kind"] == "detection" and status != "skip" and status != "error":
+            # RFC 0034 gate F4: how many bugs stop, and no twin stops.
+            detection = suite.setdefault("detection", {
+                "cases": 0, "stops": 0, "compileStops": 0, "runStops": 0, "knownMisses": 0,
+                "knownMissesStopping": [], "misses": [], "twinsClean": 0, "asanRan": 0, "asanDetected": 0})
+            d = result["detection"]
+            detection["cases"] += 1
+            detection["stops"] += d["stop"] is not None
+            detection["compileStops"] += d["stop"] == "compile"
+            detection["runStops"] += d["stop"] == "run"
+            detection["knownMisses"] += d["knownMiss"]
+            if d["flip"]:
+                detection["knownMissesStopping"].append(result["case"])
+            if d["stop"] is None:
+                detection["misses"].append(result["case"])
+            detection["twinsClean"] += d["twinClean"]
+            if d["asan"] is not None:
+                detection["asanRan"] += 1
+                detection["asanDetected"] += bool(d["asan"])
         if result["kind"] == "bug":
             suite["bugCases"] += 1
             suite["bugCasesPassed"] += status == "pass"
@@ -1764,23 +2012,34 @@ def summarize(results: list[dict]) -> dict:
             suite["pinsSatisfied"] += bug["satisfiedBy"] is not None
             suite["pinsReported"] += bool(bug["reported"])
     total = {k: sum(s[k] for s in suites.values()) for k in
-             ("cases", "passed", "failed", "errors", "skipped")}
+             ("cases", "passed", "failed", "errors", "skipped", "xfailed", "xpassed")}
+    stops = [s["detection"] for s in suites.values() if "detection" in s]
+    if stops:
+        total["detectionCases"] = sum(d["cases"] for d in stops)
+        total["detectionStops"] = sum(d["stops"] for d in stops)
     return {"total": total, "suites": suites}
 
 
 def print_result(result: dict, verbose: bool) -> None:
-    label = {"pass": "PASS", "fail": "FAIL", "error": "ERROR", "skip": "SKIP"}[result["status"]]
+    label = STATUS_LABELS[result["status"]]
     extra = []
     if result.get("legacyClass"):
         extra.append(result["legacyClass"])
     elif result.get("class"):
         extra.append(result["class"])
     print(f"{label:5} {result['case']}" + (f"  [{', '.join(extra)}]" if extra else ""), flush=True)
-    for failure in result["failures"]:
-        print(f"      {failure}")
+    if result["status"] != "xfail" or verbose:
+        for failure in result["failures"]:
+            print(f"      {failure}")
+    if verbose:
+        notes = result["notes"]
+    elif result["status"] in ("xfail", "xpass"):
+        notes = result["notes"][:1]  # the XFAIL reason, or that the marker can go
+    else:
+        notes = [n for n in result["notes"] if n.startswith("known miss now stops")]
+    for note in notes:
+        print(f"      note: {note}")
     if verbose:
-        for note in result["notes"]:
-            print(f"      note: {note}")
         for command in result.get("commands", []):
             print(f"      $ {command}")
 
@@ -1795,6 +2054,8 @@ def print_summary(summary: dict, legacy: bool, compared: bool = False) -> None:
                          f"{suite['errors']} marker errors")
         if suite["skipped"]:
             parts.append(f"{suite['skipped']} {'excluded' if compared else 'skipped'}")
+        if suite["xfailed"] or suite["xpassed"]:
+            parts.append(f"{suite['xfailed']} expected failures, {suite['xpassed']} XFAIL cases passing now")
         if suite["bugCases"] and not compared:
             parts.append(f"bug cases {suite['bugCasesPassed']}/{suite['bugCases']}")
             parts.append(f"pins {suite['pinsSatisfied']}/{suite['pins']} satisfied, "
@@ -1802,6 +2063,17 @@ def print_summary(summary: dict, legacy: bool, compared: bool = False) -> None:
         if suite["cleanCases"] and not compared:
             parts.append(f"clean {suite['cleanPassed']}/{suite['cleanCases']}")
         print(f"{name}: " + "; ".join(parts))
+        if "detection" in suite:
+            d = suite["detection"]
+            line = (f"  detection: {d['stops']}/{d['cases']} bugs stop ({d['compileStops']} at compile time, "
+                    f"{d['runStops']} at run time); {d['knownMisses']} known misses, "
+                    f"{len(d['knownMissesStopping'])} of them stopping now; "
+                    f"{d['twinsClean']}/{d['cases']} fixed twins clean")
+            if d["asanRan"]:
+                line += f"; ASan reports {d['asanDetected']}/{d['asanRan']}"
+            print(line)
+            for case in d["knownMissesStopping"]:
+                print(f"    now stops (remove its MISS marker): {case}")
         if suite["bugCases"]:
             if legacy and "legacyClasses" in suite:
                 print("  v0.10.0 classes: " + ", ".join(
@@ -1811,7 +2083,9 @@ def print_summary(summary: dict, legacy: bool, compared: bool = False) -> None:
                                                 if suite["classes"][c]))
     total = summary["total"]
     print(f"total: {total['passed']}/{total['cases']} cases {verdict}, {total['failed']} "
-          f"{'differ' if compared else 'failed'}, {total['errors']} marker errors, {total['skipped']} skipped")
+          f"{'differ' if compared else 'failed'}, {total['errors']} marker errors, {total['skipped']} skipped"
+          + (f", {total['xfailed']} expected failures, {total['xpassed']} XFAIL cases passing now"
+             if total["xfailed"] or total["xpassed"] else ""))
 
 
 def default_build_dir() -> Path:
@@ -1855,6 +2129,9 @@ def main(argv: list[str] | None = None) -> int:
     parser.add_argument("--lldb", action="store_true",
                         help="with --checks verify, ask lldb for the category of a trap that the "
                              "report-mode run also attributes to an unproven check")
+    parser.add_argument("--min-stops", type=int, metavar="N",
+                        help="fail unless at least N of the selected detection cases stop (RFC 0034 gate F4: "
+                             "--filter 'detection/**' --min-stops 54)")
     parser.add_argument("--verbose", "-v", action="store_true", help="print notes too")
     args = parser.parse_args(argv)
 
@@ -1926,7 +2203,8 @@ def main(argv: list[str] | None = None) -> int:
                     if args.verbose or result["status"] == "skip":
                         for note in result["notes"]:
                             print(f"      note: {note}")
-                elif result["status"] != "pass" or args.verbose:
+                elif result["status"] != "pass" or args.verbose or \
+                        (result.get("detection") or {}).get("flip"):
                     print_result(result, args.verbose)
     finally:
         shutil.rmtree(scratch, ignore_errors=True)
@@ -1952,7 +2230,14 @@ def main(argv: list[str] | None = None) -> int:
         }
         args.json.parent.mkdir(parents=True, exist_ok=True)
         args.json.write_text(json.dumps(document, indent=2) + "\n")
-    return 0 if all(r["status"] in ("pass", "skip") for r in results) else 1
+    ok = all(r["status"] in PASSING_STATUSES for r in results)
+    if args.min_stops is not None:
+        stops = summary["total"].get("detectionStops", 0)
+        cases = summary["total"].get("detectionCases", 0)
+        verdict = "pass" if stops >= args.min_stops else "FAIL"
+        print(f"detection stops: {stops}/{cases} (at least {args.min_stops} wanted): {verdict}")
+        ok = ok and stops >= args.min_stops
+    return 0 if ok else 1
 
 
 if __name__ == "__main__":
diff --git a/scripts/test_corpus_gate.py b/scripts/test_corpus_gate.py
index 8fc0806a..8e4164ec 100644
--- a/scripts/test_corpus_gate.py
+++ b/scripts/test_corpus_gate.py
@@ -117,6 +117,36 @@ def test_report_lines_and_trap_signs(self):
         self.assertFalse(gate.trap_evidence(proc(1, stdout="1 test failed")))
         self.assertFalse(gate.trap_evidence(proc(-11)))
 
+    def test_compile_peaks_and_ratios(self):
+        """RFC 0034 F5: the rusage log of the compiler wrapper, BSD and GNU time(1)."""
+        with tempfile.TemporaryDirectory() as directory:
+            log = Path(directory) / "rusage.log"
+            log.write_text("        0.10 real         0.05 user         0.01 sys\n"
+                           "             2080768  maximum resident set size\n"
+                           "                   0  average shared memory size\n"
+                           "\tCommand being timed: \"cc -c a.c\"\n"
+                           "\tMaximum resident set size (kbytes): 3000\n"
+                           "time: command terminated abnormally\n"
+                           "          1073741824  maximum resident set size\n")
+            self.assertEqual(gate.compile_peaks(log), [2080768, 3000 * 1024, 1 << 30])
+            self.assertEqual(gate.compile_peaks(Path(directory) / "missing.log"), [])
+            wrapper = gate.write_wrapper(Path(directory) / "bin" / "cc", "weavec-cc", ["-fweavec-checks=trap"], log)
+            text = Path(wrapper).read_text()
+            if os.access(gate.TIME_BINARY, os.X_OK):
+                self.assertIn(f"{gate.TIME_BINARY} -a -o {log}", text)
+            self.assertIn("weavec-cc -fweavec-checks=trap \"$@\"", text)
+            self.assertNotIn("time", Path(gate.write_wrapper(Path(directory) / "cc2", "cc", ["-O2"])).read_text()
+                             .split("\n", 2)[2])
+        step = lambda cpu: {"cpu": cpu}
+        builds = {"trap": {"built": True, "steps": [step(3.0), step(1.0)]},
+                  "reference": {"built": True, "steps": [step(1.0), step(1.0)]}}
+        self.assertEqual(gate.build_cpu_ratio(builds, "trap"), 2.0)
+        self.assertIsNone(gate.build_cpu_ratio(builds, "verify"))
+        self.assertIsNone(gate.build_cpu_ratio({**builds, "trap": {"built": False, "steps": []}}, "trap"))
+        self.assertEqual(gate.geometric_mean([2.0, 8.0]), 4.0)
+        self.assertIsNone(gate.geometric_mean([]))
+        self.assertIsNone(gate.geometric_mean([1.0, 0.0]))
+
     def test_multiset_difference(self):
         self.assertEqual(gate.diff_sorted(["a", "b", "b"], ["b", "c"]), ["- a", "- b", "+ c"])
         self.assertEqual(gate.diff_sorted(["a"], ["a"]), [])
@@ -154,6 +184,10 @@ class ManifestTest(unittest.TestCase):
     # RFC 0033, section 11.
     FRESH = ["zstd", "libuv", "oniguruma", "redis", "expat", "pcre2", "libevent", "libsodium"]
     SEALED = ["libxml2", "libpng", "mbedtls", "msgpack-c", "yyjson"]
+    # RFC 0034, section 9.
+    FRESH34 = ["quickjs", "lmdb", "janet", "brotli", "xz", "libdeflate", "zlib-ng", "curl", "cmark",
+               "libgit2"]
+    SEALED34 = ["libjpeg-turbo", "opus", "flac", "giflib", "wren"]
 
     def write(self, directory: Path, data: dict) -> Path:
         path = directory / "manifest.json"
@@ -170,7 +204,8 @@ def test_repository_manifest(self):
         manifest = gate.load_manifest(CORPUS / "manifest.json", CORPUS / "support")
         self.assertEqual(sorted(c.name for c in manifest.original), sorted(self.CONFIGS))
         self.assertEqual(sorted(c.name for c in manifest.configs),
-                         sorted(self.CONFIGS + self.HELD_OUT + self.FRESH + self.SEALED))
+                         sorted(self.CONFIGS + self.HELD_OUT + self.FRESH + self.SEALED +
+                                self.FRESH34 + self.SEALED34))
         for project in manifest.projects:
             self.assertRegex(project.sha, r"^[0-9a-f]{40}$")
         whole = {c.name for c in manifest.original if c.whole_program}
@@ -178,7 +213,7 @@ def test_repository_manifest(self):
         with_tests = {c.name for c in manifest.configs if c.test}
         self.assertTrue({"sds", "cJSON", "jsmn", "zlib", "lua", "jansson"} <= with_tests)
         benches = {c.name: c.bench.name for c in manifest.configs if c.bench}
-        self.assertEqual(set(benches), {"lua", "zlib", "cJSON"})
+        self.assertEqual(set(benches), {"lua", "zlib", "cJSON"} | set(self.FRESH34))
         self.assertIn("make -j8", manifest.config("zlib").build)
         # Section 17.5: a build config may lower a definite error to reach a
         # successful build only next to a triage entry whose verdict is true.
@@ -243,12 +278,29 @@ def test_repository_fresh_and_sealed_configs(self):
         # run only with --sealed or when --only names them.
         full = {c.name for c in gate.select_configs(manifest, [], True)}
         self.assertTrue(set(self.FRESH) | set(self.HELD_OUT) <= full)
-        self.assertFalse(set(self.SEALED) & full)
+        self.assertFalse((set(self.SEALED) | set(self.SEALED34)) & full)
         self.assertEqual(sorted(c.name for c in gate.select_configs(manifest, [], True, sealed=True)),
                          sorted(self.SEALED))
         quick = {c.name for c in gate.select_configs(manifest, [], False)}
         self.assertEqual(quick, set(self.CONFIGS))
 
+    def test_repository_fresh34_and_sealed34_configs(self):
+        """RFC 0034, section 9: ten fresh projects with workloads, and five sealed ones."""
+        manifest = gate.load_manifest(CORPUS / "manifest.json", CORPUS / "support")
+        for corpus_set, names in (("fresh34", self.FRESH34), ("sealed34", self.SEALED34)):
+            configs = {c.name: c for c in manifest.configs if c.set == corpus_set}
+            self.assertEqual(sorted(configs), sorted(names))
+            for name, config in configs.items():
+                self.assertEqual(config.project.name, name)
+                self.assertTrue(config.held_out)
+                self.assertTrue(config.build and config.test, f"{name}: built and tested (F1, F2)")
+                self.assertEqual(config.bench is not None, corpus_set == "fresh34",
+                                 f"{name}: a fresh34 config has a workload (F7), a sealed34 one none")
+                self.assertTrue(config.notes)
+        self.assertEqual(sorted(c.name for c in gate.select_configs(manifest, [], False,
+                                                                    sets=["sealed34"])),
+                         sorted(self.SEALED34))
+
     def test_set_field(self):
         with tempfile.TemporaryDirectory() as directory:
             d = Path(directory)
@@ -263,9 +315,22 @@ def test_set_field(self):
             with self.assertRaisesRegex(gate.GateError, "set 'sealed' needs heldOut true"):
                 load(heldOut=False, set="sealed")
             # Without `set` a config is original or heldOut: neither is spelled out.
-            for value in ("heldOut", "original", "Fresh", ""):
-                with self.assertRaisesRegex(gate.GateError, "set must be \"fresh\" or \"sealed\""):
+            for value in ("heldOut", "original", "Fresh", "", "fresh35"):
+                with self.assertRaisesRegex(gate.GateError, "set must be one of 'fresh', 'sealed', "
+                                                            "'fresh34', 'sealed34'"):
                     load(heldOut=True, set=value)
+            # RFC 0034, section 9: two more sets, and fresh34 configs carry a bench.
+            bench = {"name": "b", "build": ["true"], "command": "true"}
+            self.assertEqual(load(heldOut=True, set="fresh34", bench=bench).bench.name, "b")
+            self.assertEqual(load(heldOut=True, set="sealed34").set, "sealed34")
+            with self.assertRaisesRegex(gate.GateError, "set 'fresh34' needs heldOut true"):
+                load(set="fresh34")
+            for corpus_set in ("fresh", "sealed", "sealed34"):
+                with self.assertRaisesRegex(gate.GateError, "a held-out config has no bench"):
+                    load(heldOut=True, set=corpus_set, bench=bench)
+            with self.assertRaisesRegex(gate.GateError, "a held-out config has no bench"):
+                load(heldOut=True, bench=bench)
+            self.assertEqual(load(bench=bench).bench.name, "b")  # an original config may have one
 
     def test_set_selection(self):
         with tempfile.TemporaryDirectory() as directory:
@@ -274,23 +339,39 @@ def test_set_selection(self):
             data["projects"][0]["configs"] += [
                 {"name": "h", "heldOut": True, "compile": {"files": ["a.c"]}},
                 {"name": "f", "heldOut": True, "set": "fresh", "compile": {"files": ["a.c"]}},
-                {"name": "s", "heldOut": True, "set": "sealed", "compile": {"files": ["a.c"]}}]
+                {"name": "s", "heldOut": True, "set": "sealed", "compile": {"files": ["a.c"]}},
+                {"name": "f34", "heldOut": True, "set": "fresh34", "compile": {"files": ["a.c"]}},
+                {"name": "s34", "heldOut": True, "set": "sealed34", "compile": {"files": ["a.c"]}}]
             manifest = gate.load_manifest(self.write(d, data), d)
             self.assertEqual([c.name for c in manifest.original], ["p"])
             names = lambda *a, **kw: [c.name for c in gate.select_configs(manifest, *a, **kw)]
             self.assertEqual(names([], False), ["p"])
-            self.assertEqual(names([], True), ["p", "h", "f"])  # --full: not the sealed set
+            self.assertEqual(names([], True), ["p", "h", "f", "f34"])  # --full: not the sealed sets
             self.assertEqual(names([], True, sealed=True), ["s"])  # --sealed: the sealed set alone
             self.assertEqual(names([], False, sealed=True), ["s"])
             # --only names any config, sealed or not, with or without --sealed.
             self.assertEqual(names(["s"], False), ["s"])
             self.assertEqual(names(["f", "s"], True, sealed=True), ["f", "s"])
+            # RFC 0034: --set selects whole sets alone; --only still overrides.
+            self.assertEqual(names([], True, sets=["fresh34"]), ["f34"])
+            self.assertEqual(names([], False, sets=["sealed34"]), ["s34"])
+            self.assertEqual(names([], False, sets=["fresh34", "sealed34"]), ["f34", "s34"])
+            self.assertEqual(names([], False, True, sets=["sealed34"]), ["s", "s34"])
+            self.assertEqual(names([], False, sets=["original", "heldOut"]), ["p", "h"])
+            self.assertEqual(names(["p"], False, sets=["fresh34"]), ["p"])
 
         args = gate.parse_args(["--full", "--sealed"])
         self.assertTrue(args.sealed)
         self.assertFalse(gate.parse_args(["--full"]).sealed)
         with contextlib.redirect_stderr(io.StringIO()), self.assertRaises(SystemExit):
             gate.parse_args(["--quick", "--legacy", "--sealed"])
+        self.assertEqual(gate.parse_args(["--full", "--set", "fresh34", "--set", "sealed34"]).set,
+                         ["fresh34", "sealed34"])
+        self.assertEqual(gate.parse_args(["--full"]).set, [])
+        with contextlib.redirect_stderr(io.StringIO()), self.assertRaises(SystemExit):
+            gate.parse_args(["--full", "--set", "fresh35"])
+        with contextlib.redirect_stderr(io.StringIO()), self.assertRaises(SystemExit):
+            gate.parse_args(["--quick", "--legacy", "--set", "fresh34"])
 
     def test_held_out_field(self):
         with tempfile.TemporaryDirectory() as directory:
@@ -1182,6 +1263,97 @@ def test_sealed_config_runs_only_when_asked(self):
         self.assertEqual(results["gates"]["rfc0033.sealed.D5"]["status"], "fail")
         self.assertNotIn("rfc0033.D1", results["gates"])
 
+    def set_config34(self, corpus_set: str, **gates34) -> None:
+        manifest = json.loads(self.manifest.read_text())
+        config = manifest["projects"][0]["configs"][0]
+        config.update({"heldOut": True, "set": corpus_set})
+        if corpus_set == "fresh34":
+            # A workload with some user time of its own, so the ratio is defined.
+            config["bench"] = {"name": "loop", "build": ['"$CC" -c a.c -o a.o', '"$CC" prog.c a.o -o prog'],
+                               "command": "./prog && i=0 && while [ $i -lt 30000 ]; do i=$((i+1)); done",
+                               "repeat": 1}
+        spec = {"F1": {"maxFalseDefiniteErrors": 0, "maxTraps": 0},
+                "F2": {"maxFalseDefiniteErrors": 0, "maxTraps": 0},
+                "F5": {"maxBuildRatio": 1000, "maxCompileRssMiB": 1 << 20},
+                "F7": {"maxOverhead": 1000, "maxGeometricMean": 1000, "maxOverheadG14": {"lua": 2.5}}}
+        for key, value in gates34.items():
+            spec[key].update(value)
+        manifest["gates"]["rfc0034"] = spec
+        self.manifest.write_text(json.dumps(manifest))
+
+    def test_fresh34_config_gates(self):
+        """RFC 0034 F1, F5 and F7 over a fresh34 config: run with the held-out ones and by --set."""
+        self.set_config34("fresh34")
+        self.triage_entries()
+        status, output = self.run_gate("--full", "--json", str(self.root / "r.json"))
+        self.assertEqual(status, 0, output)
+        self.assertIn("fresh34 configs (RFC 0034, section 9; gates F1, F5 and F7):", output)
+        results = json.loads((self.root / "r.json").read_text())
+        self.assertEqual(sorted(results["configs"]["built"]["builds"]), ["reference", "report", "trap"])
+        gates = results["gates"]
+        self.assertEqual(gates["rfc0034.F1"]["status"], "pass")
+        self.assertEqual(gates["rfc0034.F1"]["detail"]["built"]["reportTestsPassed"], True)
+        self.assertEqual(gates["rfc0034.F5"]["status"], "pass")
+        self.assertEqual(gates["rfc0034.F5"]["detail"]["built"]["buildCpuRatio"]["limit"], 1000)
+        self.assertIn("compileMaxRssMiB", gates["rfc0034.F5"]["detail"]["built"])
+        if os.access(gate.TIME_BINARY, os.X_OK):
+            # Two compiles in the build, two more when the test suite runs nothing new.
+            self.assertGreaterEqual(results["configs"]["built"]["builds"]["trap"]["compiles"], 2)
+        self.assertEqual(gates["rfc0034.F7"]["status"], "pass")
+        self.assertEqual(gates["rfc0034.F7"]["detail"]["geometricMean"]["configs"], 1)
+        self.assertNotIn("rfc0033.D1", gates)
+        self.assertEqual(results["configs"]["built"]["bench"]["name"], "loop")
+        # --set fresh34 selects it alone; each limit fails the run.
+        for gates34, failing in (({"F5": {"maxBuildRatio": 1e-9}}, "rfc0034.F5"),
+                                 ({"F5": {"maxCompileRssMiB": 1e-9}}, "rfc0034.F5"),
+                                 ({"F7": {"maxOverhead": 1e-9}}, "rfc0034.F7"),
+                                 ({"F7": {"maxGeometricMean": 1e-9}}, "rfc0034.F7")):
+            self.set_config34("fresh34", **gates34)
+            status, output = self.run_gate("--full", "--set", "fresh34", "--json", str(self.root / "r.json"))
+            self.assertEqual(status, 1, output)
+            self.assertEqual(json.loads((self.root / "r.json").read_text())["gates"][failing]["status"], "fail",
+                             gates34)
+        # A trap in a fresh34 test suite fails F1.
+        self.set_config34("fresh34")
+        status, output = self.run_gate("--full", "--json", str(self.root / "r.json"), trap=True)
+        self.assertEqual(status, 1, output)
+        self.assertEqual(json.loads((self.root / "r.json").read_text())["gates"]["rfc0034.F1"]["status"], "fail")
+
+    def test_sealed34_config_runs_only_when_asked(self):
+        self.set_config34("sealed34", F5={"maxBuildRatio": 1e-9})
+        self.triage_entries()
+        status, output = self.run_gate("--full", "--json", str(self.root / "r.json"))
+        self.assertEqual(status, 0, output)
+        self.assertEqual(json.loads((self.root / "r.json").read_text())["configs"], {})
+        status, output = self.run_gate("--full", "--sealed", "--json", str(self.root / "r.json"))
+        self.assertEqual(json.loads((self.root / "r.json").read_text())["configs"], {})  # RFC 0033's set only
+        # --set sealed34 runs it and F2 fails on F5's build ratio; F5 itself leaves it to F2.
+        status, output = self.run_gate("--full", "--set", "sealed34", "--json", str(self.root / "r.json"))
+        self.assertEqual(status, 1, output)
+        self.assertIn("sealed34 configs (RFC 0034, section 9; gate F2):", output)
+        results = json.loads((self.root / "r.json").read_text())
+        self.assertEqual(results["gates"]["rfc0034.F2"]["status"], "fail")
+        self.assertEqual(results["gates"]["rfc0034.F2"]["detail"]["built"]["buildCpuRatio"]["limit"], 1e-9)
+        self.assertNotIn("built", results["gates"]["rfc0034.F5"]["detail"])
+        self.assertNotIn("rfc0034.F1", results["gates"])
+
+    def test_original_config_counts_for_f5(self):
+        """RFC 0034 F5 counts the original configs' builds too: each gets a reference build."""
+        self.set_config34("fresh34")
+        manifest = json.loads(self.manifest.read_text())
+        config = manifest["projects"][0]["configs"][0]
+        for key in ("heldOut", "set", "bench"):
+            config.pop(key)
+        self.manifest.write_text(json.dumps(manifest))
+        self.triage_entries()
+        status, output = self.run_gate("--full", "--update", "--json", str(self.root / "r.json"))
+        self.assertEqual(status, 0, output)
+        results = json.loads((self.root / "r.json").read_text())
+        self.assertEqual(sorted(results["configs"]["built"]["builds"]), ["reference", "report", "trap"])
+        self.assertEqual(results["gates"]["rfc0034.F5"]["status"], "pass")
+        self.assertIn("buildCpuRatio", results["gates"]["rfc0034.F5"]["detail"]["built"])
+        self.assertNotIn("rfc0034.F1", results["gates"])
+
     def test_reference_only(self):
         # The synthetic trap injection only prints a report line; ASan has nothing to find in it.
         data = json.loads(self.injections.read_text())
diff --git a/scripts/test_run_cases.py b/scripts/test_run_cases.py
index 8c33dc53..49b227e0 100755
--- a/scripts/test_run_cases.py
+++ b/scripts/test_run_cases.py
@@ -550,6 +550,129 @@ def test_marker_errors_make_an_error_status_and_summary(self):
         self.assertEqual((suite["pins"], suite["pinsSatisfied"], suite["classes"]["error"]), (1, 1, 1))
 
 
+class DetectionTest(Workspace):
+    """RFC 0034 section 9: DETECT cases (gate F4) and XFAIL."""
+
+    def detect_case(self, stop_line="return p[n]; // STOP", file_markers="// DETECT: -DFIX"):
+        return self.case("detection/d/prog.c", f"""
+            // A heap overflow and its fixed twin.
+            {file_markers}
+            // RUN-INPUT: 4
+            #include <stdlib.h>
+            int main(int argc, char **argv) {{
+              int n = atoi(argv[1]);
+              char *p = malloc(4);
+              {stop_line}
+            }}
+            """)
+
+    def evidence(self, **kwargs):
+        ev = rc.Evidence("trap")
+        for key, value in kwargs.items():
+            setattr(ev, key, value)
+        return ev
+
+    def report(self, path, line, template="object"):
+        return rc.CheckReport(template, str(path), line, 10)
+
+    def ran(self, path, line=None, trapped=True, template="object"):
+        reports = [self.report(path, line, template)] if line else []
+        return dict(built=True, ran=True, runs=[rc.Run(("4",), -5 if trapped else 0)],
+                    report_runs=[reports], reports=list(reports))
+
+    def test_grammar(self):
+        case = self.detect_case()
+        self.assertEqual(case.errors, [])
+        self.assertEqual(case.detect, ("-DFIX",))
+        self.assertEqual([m.line for m in case.line_markers("STOP")], [8])
+        both = self.detect_case("return p[n]; // STOP // MISS: not caught yet")
+        self.assertEqual(both.errors, [])
+        cases = [
+            ("return p[n]; // STOP: here", "", "marker 'STOP' takes no argument"),
+            ("return p[n]; // STOP", "// DETECT: FIX", "DETECT takes the flags"),
+            ("return p[n]; // STOP", "// DETECT: -DFIX\n// CLEAN", "a DETECT case has no CLEAN markers"),
+            ("return p[n]; // BUG: out-of-bounds", "// DETECT: -DFIX", "a DETECT case has no BUG markers"),
+            ("return p[n]; // MISS: x", "// DETECT: -DFIX", "needs a STOP line"),
+            ("return p[n]; // STOP", "// RFC 0034.", "STOP needs a DETECT file marker"),
+            ("return p[n]; // STOP", "// DETECT: -DFIX\n// DETECT: -DFIX", "DETECT is given more than once"),
+        ]
+        for line, markers, message in cases:
+            broken = self.detect_case(line, markers)
+            self.assertTrue(any(message in e for e in broken.errors), (line, markers, broken.errors))
+        no_main = self.case("detection/e/x.c", "// DETECT: -DFIX\nint f(int *p) { return *p; } // STOP\n")
+        self.assertTrue(any("needs a unit that defines main" in e for e in no_main.errors))
+
+    def test_stops(self):
+        case = self.detect_case()
+        clean_twin = self.evidence(built=True, ran=True, runs=[rc.Run(("4",), 0)], report_runs=[[]])
+        # A trap whose report-mode check is on the STOP line stops the bug.
+        result = rc.evaluate_detection(case, self.evidence(**self.ran(case.path, 8)), clean_twin)
+        self.assertEqual((result["status"], result["class"]), ("pass", "run"))
+        self.assertEqual(result["detection"]["where"], "object at " + rc.relative(case.path) + ":8:10")
+        # A WeaveC error stops it at compile time, wherever it is (noted when not on a STOP line).
+        error = rc.evaluate_detection(case, self.evidence(diagnostics=[self.diag(case.path, 7, "out-of-bounds")]),
+                                      clean_twin)
+        self.assertEqual((error["status"], error["class"]), ("pass", "compile"))
+        self.assertTrue(any("on no STOP line" in n for n in error["notes"]))
+        # Not stops: a check after the bug, a trap the report-mode run does not
+        # attribute (the C library's own), a run that does not trap.
+        for evidence, why in ((self.ran(case.path, 9), "on no STOP line"),
+                              (self.ran(case.path, None), "names no failed check"),
+                              (self.ran(case.path, 8, trapped=False), "but the trap-mode run was exit 0")):
+            missed = rc.evaluate_detection(case, self.evidence(**evidence), clean_twin)
+            self.assertEqual((missed["status"], missed["class"]), ("fail", "miss"))
+            self.assertTrue(any(why in f for f in missed["failures"]), missed["failures"])
+        # A known miss passes silent, and is flagged when it stops.
+        known = self.detect_case("return p[n]; // STOP // MISS: not caught yet")
+        silent = rc.evaluate_detection(known, self.evidence(**self.ran(known.path, None, trapped=False)), clean_twin)
+        self.assertEqual((silent["status"], silent["detection"]["knownMiss"]), ("pass", True))
+        flipped = rc.evaluate_detection(known, self.evidence(**self.ran(known.path, 8)), clean_twin)
+        self.assertEqual((flipped["status"], flipped["detection"]["flip"]), ("pass", True))
+        self.assertTrue(any("remove its MISS marker" in n for n in flipped["notes"]))
+        # The verify build's proven traps fail it (F4: no bug runs past a proven facet).
+        proven = self.evidence(**self.ran(case.path, 8))
+        proven.proven_traps = ["run 4: weavec.proven trap"]
+        self.assertEqual(rc.evaluate_detection(case, proven, clean_twin)["status"], "fail")
+
+    def test_twin_must_not_stop(self):
+        case = self.detect_case()
+        bug = self.evidence(**self.ran(case.path, 8))
+        for twin, why in ((self.evidence(built=False, diagnostics=[self.diag(case.path, 8, "out-of-bounds")]),
+                           "error:"),
+                          (self.evidence(built=True, ran=True, runs=[rc.Run(("4",), -5)], report_runs=[[]]),
+                           "killed by"),
+                          (self.evidence(**self.ran(case.path, 8, trapped=False)), "failed check object"),
+                          (self.evidence(built=False), "no executable was built")):
+            result = rc.evaluate_detection(case, bug, twin)
+            self.assertEqual(result["status"], "fail", why)
+            self.assertFalse(result["detection"]["twinClean"])
+            self.assertTrue(any(f.startswith("the fixed twin (-DFIX) stops") and why in f
+                                for f in result["failures"]), result["failures"])
+
+    def test_summary_and_xfail(self):
+        case = self.detect_case()
+        clean_twin = self.evidence(built=True, ran=True, runs=[rc.Run(("4",), 0)], report_runs=[[]])
+        stop = rc.evaluate_detection(case, self.evidence(**self.ran(case.path, 8)), clean_twin)
+        known = self.detect_case("return p[n]; // STOP // MISS: later")
+        miss = rc.evaluate_detection(known, self.evidence(**self.ran(known.path, None, trapped=False)), clean_twin)
+        summary = rc.summarize([stop, miss])
+        detection = summary["suites"]["detection"]["detection"]
+        self.assertEqual((detection["cases"], detection["stops"], detection["runStops"], detection["knownMisses"],
+                          detection["twinsClean"]), (2, 1, 1, 1, 2))
+        self.assertEqual((summary["total"]["detectionCases"], summary["total"]["detectionStops"]), (2, 1))
+        xfail = self.case("s/x.c", "// CLEAN\n// XFAIL: a false error today\nint main(void) { return 0; }\n")
+        self.assertEqual(xfail.xfail, "a false error today")
+        failing = rc.apply_xfail(xfail, rc.evaluate(xfail, rc.Evidence("trap", diagnostics=[
+            self.diag(xfail.path, 3, "double-free")])))
+        self.assertEqual(failing["status"], "xfail")
+        self.assertEqual(failing["notes"][0], "expected failure: a false error today")
+        passing = rc.apply_xfail(xfail, rc.evaluate(xfail, rc.Evidence("trap")))
+        self.assertEqual(passing["status"], "xpass")
+        counts = rc.summarize([failing, passing])["suites"]["s"]
+        self.assertEqual((counts["xfailed"], counts["xpassed"], counts["failed"]), (1, 1, 0))
+        self.assertTrue(all(r["status"] in rc.PASSING_STATUSES for r in (failing, passing)))
+
+
 FAKE_CC = r'''#!{python}
 """A stand-in weavec-cc driven by <source>.fake.json next to each case file."""
 import json, os, signal, sys
diff --git a/test/Analysis/rfc0030-budget.c b/test/Analysis/rfc0030-budget.c
index 5a572476..6c99484f 100644
--- a/test/Analysis/rfc0030-budget.c
+++ b/test/Analysis/rfc0030-budget.c
@@ -1,8 +1,8 @@
-// RFC 0030 §5.5: a function whose analysis would take more block transfers
-// than its budget stops; its operations take the §2.6 defaults with reason
+// RFC 0030 §5.5, RFC 0034 §7.1: a function whose analysis would take more
+// work (the sizes of the states it transfers and joins) than its budget stops; its operations take the §2.6 defaults with reason
 // `budget`, the summary line and the ledger list it, and its callers apply
 // the unknown-callee default at its calls.
-// RUN: %weavec --no-runtime --budget=12 --ledger=%t.json %s -- 2>&1 | FileCheck %s
+// RUN: %weavec --no-runtime --budget=100 --ledger=%t.json %s -- 2>&1 | FileCheck %s
 // RUN: FileCheck --check-prefix=LEDGER %s < %t.json
 // RUN: %weavec --no-runtime --budget=0 --ledger=%t.full.json %s -- 2>&1 | FileCheck --check-prefix=FULL %s
 #include <stdlib.h>
diff --git a/test/Driver/driver-werror.c b/test/Driver/driver-werror.c
new file mode 100644
index 00000000..12141642
--- /dev/null
+++ b/test/Driver/driver-werror.c
@@ -0,0 +1,11 @@
+// RFC 0034 §8: the driver's own diagnostics obey the -W options as Clang's
+// do. CMake's check_c_compiler_flag adds -Werror=unused-command-line-argument
+// and reads the exit status, so an unused argument must fail the compile.
+//
+// RUN: not %weavec_cc -Werror=unused-command-line-argument -Wl,-unused -c %s -o %t.o 2>&1 | FileCheck --check-prefix=ERROR %s
+// RUN: %weavec_cc -Wl,-unused -c %s -o %t.o 2>&1 | FileCheck --check-prefix=WARN %s
+// RUN: %weavec_cc -w -Wl,-unused -c %s -o %t.o 2>&1 | count 0
+//
+// ERROR: weavec-cc: error: -Wl,-unused: 'linker' input unused [-Werror,-Wunused-command-line-argument]
+// WARN: weavec-cc: warning: -Wl,-unused: 'linker' input unused [-Wunused-command-line-argument]
+int f(void) { return 0; }
diff --git a/test/Driver/rfc0030-print-prelude.c b/test/Driver/rfc0030-print-prelude.c
index c58f3612..05f02427 100644
--- a/test/Driver/rfc0030-print-prelude.c
+++ b/test/Driver/rfc0030-print-prelude.c
@@ -1,6 +1,7 @@
 // RFC 0030 §10.9, §16: `weavec-cc -fweavec-print-prelude` prints the check
 // prelude of the -fweavec-checks mode, zero-initialisation helpers included
-// unless -fno-weavec-zero-init, with the usable-size query of the target,
+// unless -fno-weavec-zero-init, with the usable-size query of the target
+// (the runtime's when it is linked),
 // and exits without compiling anything. `=out-of-line` prints the external
 // definitions libweavec_chk.a is built from.
 //
@@ -10,9 +11,10 @@
 // RUN: %weavec_cc -fweavec-print-prelude -fweavec-checks=verify | FileCheck --check-prefix=VERIFY %s
 // RUN: %weavec_cc -fweavec-print-prelude -fweavec-checks=none | count 0
 // RUN: %weavec_cc -fweavec-print-prelude -fno-weavec-zero-init | FileCheck --check-prefix=NOZERO %s
-// RUN: %weavec_cc -fweavec-print-prelude --target=x86_64-unknown-linux-gnu | FileCheck --check-prefix=GLIBC %s
-// RUN: %weavec_cc -fweavec-print-prelude -target aarch64-unknown-linux-android34 | FileCheck --check-prefix=BIONIC %s
-// RUN: %weavec_cc -fweavec-print-prelude --target=arm64-apple-macosx14.0 | FileCheck --check-prefix=DARWIN %s
+// RUN: %weavec_cc -fweavec-print-prelude -fno-weavec-runtime --target=x86_64-unknown-linux-gnu | FileCheck --check-prefix=GLIBC %s
+// RUN: %weavec_cc -fweavec-print-prelude -fno-weavec-runtime -target aarch64-unknown-linux-android34 | FileCheck --check-prefix=BIONIC %s
+// RUN: %weavec_cc -fweavec-print-prelude -fno-weavec-runtime --target=arm64-apple-macosx14.0 | FileCheck --check-prefix=DARWIN %s
+// RUN: %weavec_cc -fweavec-print-prelude --target=arm64-apple-macosx14.0 | FileCheck --check-prefix=RUNTIME %s
 // RUN: %weavec_cc -fweavec-print-prelude --target=x86_64-pc-windows-msvc | FileCheck --check-prefix=NOQUERY %s
 // RUN: %weavec_cc -fweavec-print-prelude=out-of-line -fweavec-checks=verify | FileCheck --check-prefix=OUTOFLINE %s
 // RUN: rm -f %t.h && %weavec_cc -fweavec-print-prelude -o %t.h && FileCheck --check-prefix=TRAP %s < %t.h
@@ -39,6 +41,9 @@
 // BIONIC: extern __typeof__(sizeof 0) malloc_usable_size(const void *);
 // DARWIN: extern __typeof__(sizeof 0) malloc_size(const void *);
 //
+// RFC 0034 §5.3: with the runtime, zero-initialisation asks the runtime.
+// RUNTIME: extern __typeof__(sizeof 0) __weavec_rt_size(const void *);
+//
 // NOQUERY: __weavec_chk_nonnull
 // NOQUERY-NOT: __weavec_malloc_zero
 //
diff --git a/test/Driver/weavec-archive-note.c b/test/Driver/weavec-archive-note.c
new file mode 100644
index 00000000..7763724b
--- /dev/null
+++ b/test/Driver/weavec-archive-note.c
@@ -0,0 +1,38 @@
+// RFC 0034 §8: a link input without a record whose objects `weavec-cc`
+// built (an archive: `ar` keeps no records) is checked and guarded, only not
+// analysed with the program. It is named in a note, not in the
+// `unanalyzed-input` warning, which still names the inputs the compiler did
+// not build.
+//
+// RUN: rm -rf %t && mkdir -p %t
+// RUN: %weavec_cc -c %s -o %t/main.o
+// RUN: %weavec_cc -c %s -DUNIT_B -o %t/b.o
+// RUN: %clang -c %s -DUNIT_C -o %t/c.o
+// RUN: llvm-ar rcs %t/libbuilt.a %t/b.o
+// RUN: llvm-ar rcs %t/libforeign.a %t/c.o
+//
+// RUN: %weavec_cc -fweavec-link=analyze %t/main.o %t/libbuilt.a %t/libforeign.a -o %t/prog 2>&1 | FileCheck %s
+// RUN: %t/prog
+// RUN: %weavec_cc -fweavec-link=analyze %t/main.o %t/libbuilt.a %t/c.o -o %t/prog 2>&1 | FileCheck --check-prefix=OBJECT %s
+
+// CHECK: weavec-cc: note: '{{.*}}libbuilt.a' was built by weavec-cc without records: checked and guarded, not analysed with the program
+// CHECK-NEXT: weavec-cc: warning: link input '{{.*}}libforeign.a' has no WeaveC record; calls into it are trusted [weavec::unanalyzed-input]
+// CHECK-NOT: libbuilt
+
+// OBJECT: weavec-cc: note: '{{.*}}libbuilt.a' was built by weavec-cc
+// OBJECT-NEXT: weavec-cc: warning: link input '{{.*}}c.o' has no WeaveC record
+
+#if defined(UNIT_B)
+int table[4];
+int pick(int *p, int i) { return p[i] + table[i & 3]; }
+#elif defined(UNIT_C)
+int other(void) { return 7; }
+#else
+int pick(int *p, int i);
+int other(void);
+
+int main(void) {
+  int values[2] = {1, 0};
+  return pick(values, 1) + other() - 7;
+}
+#endif
diff --git a/test/Emission/Inputs/rewrite-oracle-len-before-call.expected.c b/test/Emission/Inputs/rewrite-oracle-len-before-call.expected.c
index 27df7451..37c6cd26 100644
--- a/test/Emission/Inputs/rewrite-oracle-len-before-call.expected.c
+++ b/test/Emission/Inputs/rewrite-oracle-len-before-call.expected.c
@@ -3,6 +3,6 @@ void *memcpy(void *, const void *, unsigned long);
 void copy(unsigned long n) {
   char b[32] = {0};
   char *s = b + 8;
-  (__weavec_chk_len(n, __weavec_have_sub(sizeof(char[32]), 8)),
+  (__weavec_chk_len(n, __weavec_have_s(__weavec_have_sub(sizeof(char[32]), 8))),
    (__weavec_chk_len(n, sizeof(char[32])), memcpy(__weavec_chk_disjoint(b, s, n), s, n)));
 }
diff --git a/test/Emission/Inputs/rewrite-oracle-lowered-violation-plain.expected.c b/test/Emission/Inputs/rewrite-oracle-lowered-violation-plain.expected.c
new file mode 100644
index 00000000..7fb95b78
--- /dev/null
+++ b/test/Emission/Inputs/rewrite-oracle-lowered-violation-plain.expected.c
@@ -0,0 +1,7 @@
+/* rewrite-oracle-lowered-violation.c as the check emitter rewrites it,
+ * without the runtime: nothing. */
+void free(void *);
+void twice(int *p) {
+  free(p);
+  free(p);
+}
diff --git a/test/Emission/Inputs/rewrite-oracle-lowered-violation.expected.c b/test/Emission/Inputs/rewrite-oracle-lowered-violation.expected.c
index 7f83aa88..e31a76c5 100644
--- a/test/Emission/Inputs/rewrite-oracle-lowered-violation.expected.c
+++ b/test/Emission/Inputs/rewrite-oracle-lowered-violation.expected.c
@@ -1,6 +1,7 @@
-/* rewrite-oracle-lowered-violation.c as the check emitter rewrites it. */
+/* rewrite-oracle-lowered-violation.c as the check emitter rewrites it, with
+ * the runtime. */
 void free(void *);
 void twice(int *p) {
-  free(p);
-  (__weavec_chk_violation(), free(p));
+  free(__weavec_chk_release(p));
+  free(__weavec_chk_release(p));
 }
diff --git a/test/Emission/Inputs/rewrite-oracle.py b/test/Emission/Inputs/rewrite-oracle.py
index 7ffcc266..8d7be774 100644
--- a/test/Emission/Inputs/rewrite-oracle.py
+++ b/test/Emission/Inputs/rewrite-oracle.py
@@ -7,7 +7,8 @@
 Compiles SOURCE with `weavec-cc`, which inserts the checks, and EXPECTED, a
 hand-written file that calls the same prelude helpers explicitly, with the
 reference Clang and `-include` of the prelude `weavec-cc
--fweavec-print-prelude` prints. Both go to LLVM IR at -O0, lose their debug
+-fweavec-print-prelude` prints. Both go to LLVM IR at -O0 without the LLVM
+passes (the guard passes' lowering is not the rewrite), lose their debug
 information (`opt -S --strip-debug`) and the lines that name the source file,
 and must then be equal; otherwise the script prints a diff and fails.
 
@@ -79,12 +80,15 @@ def main():
 
     run([args.weavec_cc, "-fweavec-print-prelude"] + weavec_flags +
         ["-o", prelude])
-    run([args.weavec_cc] + sysroot + ["-O0", "-S", "-emit-llvm",
-                                      "-fno-color-diagnostics"] +
+    # (The rewrite is the oracle's: neither side runs the LLVM passes, so
+    # the guard passes' lowering, RFC 0034 section 1, is not compared.)
+    passes = ["-Xclang", "-disable-llvm-passes"]
+    run([args.weavec_cc] + sysroot + passes + ["-O0", "-S", "-emit-llvm",
+                                               "-fno-color-diagnostics"] +
         weavec_flags + common + [args.source, "-o", instrumented])
     zero = ("-fno-weavec-zero-init" not in weavec_flags and
             "-fweavec-checks=none" not in weavec_flags)
-    reference = [args.clang] + sysroot + [
+    reference = [args.clang] + sysroot + passes + [
         "-O0", "-S", "-emit-llvm", "-include", prelude, "-isystem",
         args.resource_dir, "-D__WEAVEC__=1",
         '-DORACLE_FILE="%s"' % args.source]
diff --git a/test/Emission/Inputs/runtime-oracle-checked-wrappers.expected.c b/test/Emission/Inputs/runtime-oracle-checked-wrappers.expected.c
new file mode 100644
index 00000000..eaa05d09
--- /dev/null
+++ b/test/Emission/Inputs/runtime-oracle-checked-wrappers.expected.c
@@ -0,0 +1,26 @@
+/* runtime-oracle-checked-wrappers.c as the check emitter rewrites it. */
+extern char *strcpy(char *, const char *);
+extern void *memcpy(void *, const void *, unsigned long);
+extern int sprintf(char *, const char *, ...);
+extern int vsprintf(char *, const char *, __builtin_va_list);
+extern const char *name(void);
+
+int show(char *out, int port) {
+  return __weavec_chk_sprintf((char *)__weavec_chk_nonnull(out), "%d", 0xffffffffffffffffULL, 1u, port);
+}
+void copy(char *d) {
+  __weavec_chk_strcpy((char *)__weavec_chk_nonnull(d), (const char *)__weavec_chk_object_s(__weavec_chk_nonnull(name())), 0xffffffffffffffffULL, 3u);
+}
+void shift(char *p) {
+  __weavec_chk_strcpy((char *)__weavec_chk_nonnull(p), (const char *)__weavec_chk_object_s(p + 2), 0xffffffffffffffffULL, 3u);
+}
+void slide(char *a, unsigned long n) {
+  __weavec_chk_memcpy(__weavec_chk_object_n(__weavec_chk_nonnull_n(a, n), n), __weavec_chk_object_n(a + 1, n), n, 0xffffffffffffffffULL, 2u);
+}
+int vshow(char *out, __builtin_va_list ap) {
+  return __weavec_chk_vsprintf((char *)__weavec_chk_nonnull(out), "%d", ap, 0xffffffffffffffffULL, 1u);
+}
+void fortified(char *d, int port) {
+  __weavec_chk_strcpy((char *)__weavec_chk_nonnull(d), (const char *)__weavec_chk_object_s(__weavec_chk_nonnull(name())), __builtin_object_size(d, 1), 3u);
+  __weavec_chk_sprintf((char *)__weavec_chk_nonnull(d), "%d", __builtin_object_size(d, 1), 1u, port);
+}
diff --git a/test/Emission/Inputs/runtime-oracle-global-objects.expected.c b/test/Emission/Inputs/runtime-oracle-global-objects.expected.c
index 69144952..2af3057c 100644
--- a/test/Emission/Inputs/runtime-oracle-global-objects.expected.c
+++ b/test/Emission/Inputs/runtime-oracle-global-objects.expected.c
@@ -6,8 +6,8 @@
 #endif
 
 extern int Elsewhere[4];
-int Table[8];
-static char Name[5] = "name";
+int Table[8] __attribute__((aligned(16)));
+static char Name[5] __attribute__((aligned(16))) = "name";
 
 char *name(void) { return Name; }
 int *table(void) { return Table; }
diff --git a/test/Emission/Inputs/runtime-oracle-range-cache.expected.c b/test/Emission/Inputs/runtime-oracle-range-cache.expected.c
deleted file mode 100644
index 35f976eb..00000000
--- a/test/Emission/Inputs/runtime-oracle-range-cache.expected.c
+++ /dev/null
@@ -1,31 +0,0 @@
-/* runtime-oracle-range-cache.c as the check emitter rewrites it. */
-struct vec {
-  int *data;
-  unsigned long n;
-};
-extern void unknown(void);
-
-int quiet(struct vec *v) {
-  unsigned long long __weavec_ranges[4];
-  __builtin_memset(__weavec_ranges, 0, sizeof __weavec_ranges);
-  int s = 0;
-  {
-    __weavec_range_check(__weavec_ranges);
-    for (unsigned long i = 0; i < ((struct vec *)__weavec_chk_nonnull(v))->n; i++)
-      s += *(int *)__weavec_chk_object_c((int *)__weavec_chk_nonnull(v->data), (i), 4ULL, 0ULL,
-                                         4ULL, __weavec_ranges, 1);
-  }
-  return s;
-}
-
-int calls(struct vec *v) {
-  unsigned long long __weavec_ranges[4];
-  __builtin_memset(__weavec_ranges, 0, sizeof __weavec_ranges);
-  int s = 0;
-  for (unsigned long i = 0; i < ((struct vec *)__weavec_chk_nonnull(v))->n; i++) {
-    s += *(int *)__weavec_chk_object_c((int *)__weavec_chk_nonnull(v->data), (i), 4ULL, 0ULL,
-                                       4ULL, __weavec_ranges, 0);
-    unknown();
-  }
-  return s;
-}
diff --git a/test/Emission/Inputs/runtime-oracle-stack-objects.expected.c b/test/Emission/Inputs/runtime-oracle-stack-objects.expected.c
index 02d57c19..641b32bc 100644
--- a/test/Emission/Inputs/runtime-oracle-stack-objects.expected.c
+++ b/test/Emission/Inputs/runtime-oracle-stack-objects.expected.c
@@ -3,7 +3,7 @@ extern void fill(char *p, unsigned long n);
 extern void take(int *p);
 
 int outer(void) {
-  char buffer[16];
+  char buffer[16] __attribute__((aligned(16)));
   void *__weavec_frame_1 __attribute__((cleanup(__weavec_stack_leave), unused)) =
       __weavec_stack_enter((void *)&buffer, sizeof buffer, 0);
   int kept[4];
@@ -15,7 +15,7 @@ int outer(void) {
 int nested(int n) {
   int total = 0;
   if (n > 0) {
-    int value = n;
+    int value __attribute__((aligned(16))) = n;
     void *__weavec_frame_2 __attribute__((cleanup(__weavec_stack_leave), unused)) =
         __weavec_stack_enter((void *)&value, sizeof value, 2);
     take(&value);
@@ -24,7 +24,7 @@ int nested(int n) {
   return total;
 }
 
-int parameter(int n) {
+int parameter(int n __attribute__((aligned(16)))) {
   void *__weavec_frame_3 __attribute__((cleanup(__weavec_stack_leave), unused)) =
       __weavec_stack_enter((void *)&n, sizeof n, 0);
   take(&n);
diff --git a/test/Emission/checked-wrappers-runtime.c b/test/Emission/checked-wrappers-runtime.c
new file mode 100644
index 00000000..7f639f1b
--- /dev/null
+++ b/test/Emission/checked-wrappers-runtime.c
@@ -0,0 +1,63 @@
+// RFC 0034, section 5.2: the checked wrappers fail as the other guards do.
+// In trap mode the first failure traps; in report mode each failing site is
+// reported once and the call goes on (a sprintf writes only the room it
+// has, and returns the length it would have written); in verify mode they
+// trap as in trap mode. A correct run fails nothing.
+//
+// RUN: rm -rf %t && mkdir -p %t
+// RUN: %weavec_cc -O1 %s -o %t/trap
+// RUN: %t/trap 012 | FileCheck --check-prefix=CLEAN %s
+// RUN: not --crash %t/trap 0123456789 2>&1 | FileCheck --check-prefix=TRAP %s
+// RUN: %weavec_cc -O1 -fweavec-checks=report %s -o %t/report
+// RUN: %t/report 0123456789 overlap 2>&1 | FileCheck --check-prefix=REPORT %s
+// RUN: %weavec_cc -O1 -fweavec-checks=verify %s -o %t/verify
+// RUN: %t/verify 012 | FileCheck --check-prefix=CLEAN %s
+// RUN: not --crash %t/verify 012 overlap 2>&1 | FileCheck --check-prefix=TRAP %s
+//
+// CLEAN: sprintf 5 <012>
+// CLEAN: done
+// TRAP-NOT: done
+// REPORT: weavec: runtime check failed: object at {{.*}}checked-wrappers-runtime.c:[[@LINE+13]]:3
+// REPORT: weavec: runtime check failed: object at {{.*}}checked-wrappers-runtime.c:[[@LINE+15]]:10
+// REPORT: sprintf 12 <012345
+// REPORT: weavec: runtime check failed: disjoint at {{.*}}checked-wrappers-runtime.c:[[@LINE+16]]:3
+// REPORT: shifted
+// REPORT: done
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+/* No term names words[1], and the destination's extent is not known here. */
+__attribute__((noinline)) static void put(char *dst, char **words) {
+  strcpy(dst, words[1]);
+}
+__attribute__((noinline)) static int show(char *dst, char **words) {
+  return sprintf(dst, "<%s>", words[1]);
+}
+__attribute__((noinline)) static void shift(char *p) {
+  strcpy(p, p + 2);
+}
+
+int main(int argc, char **argv) {
+  char *dst = malloc(8);
+  if (dst == NULL || argc < 2)
+    return 1;
+  setvbuf(stdout, NULL, _IONBF, 0);
+  /* Report mode goes on after the overflow; nothing reads dst until
+   * sprintf has written it again. */
+  put(dst, argv);
+  int n = show(dst, argv);
+  printf("sprintf %d %s\n", n, dst);
+  if (argc > 2) {
+    char *p = strdup("././x");
+    if (p == NULL)
+      return 1;
+    shift(p);
+    printf("shifted %s\n", p);
+    free(p);
+  }
+  free(dst);
+  printf("done\n");
+  return 0;
+}
diff --git a/test/Emission/guard-passes-call-arguments.c b/test/Emission/guard-passes-call-arguments.c
new file mode 100644
index 00000000..206d989b
--- /dev/null
+++ b/test/Emission/guard-passes-call-arguments.c
@@ -0,0 +1,26 @@
+// RFC 0034 §1.2: the guard of a library call's argument whose need is a
+// constant (`memcpy(&v, p, 4)`, the idiom of an unaligned load) is lowered
+// like an access's guard: expanded inline by the backend, not a call of the
+// runtime's out-of-line `__weavec_rt_object`. A need known only at run time
+// keeps the call.
+//
+// RUN: %weavec_cc -O2 -S -emit-llvm %s -o - | FileCheck %s
+
+#include <string.h>
+
+// CHECK-LABEL: define {{.*}}i32 @load32(
+// CHECK-NOT: __weavec_rt_object
+// CHECK: load i8
+// CHECK: ret i32
+unsigned load32(const unsigned char *p) {
+  unsigned v;
+  memcpy(&v, p, sizeof v);
+  return v;
+}
+
+// CHECK-LABEL: define {{.*}}i32 @same(
+// CHECK: call {{.*}}@__weavec_rt_object
+// CHECK: ret i32
+int same(const unsigned char *a, const unsigned char *b, unsigned long n) {
+  return memcmp(a, b, n) == 0;
+}
diff --git a/test/Emission/guard-passes-global-padding.c b/test/Emission/guard-passes-global-padding.c
new file mode 100644
index 00000000..851ed9f3
--- /dev/null
+++ b/test/Emission/guard-passes-global-padding.c
@@ -0,0 +1,33 @@
+// RFC 0034 §4: a registered global owns the granules it starts in. The
+// guard passes pad it to whole granules, and by one more when it fills its
+// last, so that nothing the linker places after it (a string literal, an
+// unregistered global) shares its last granule or starts at its one-past
+// address, where the shadow would give those bytes to it.
+//
+// RUN: %weavec_cc -O0 -S -emit-llvm %s -o - | FileCheck %s
+// RUN: %weavec_cc -O2 -S -emit-llvm %s -o - | FileCheck %s
+
+// CHECK-DAG: @eight = internal global <{ [8 x i8], [8 x i8] }> <{ [8 x i8] c"\03{{.*}}", [8 x i8] zeroinitializer }>, align 16
+// CHECK-DAG: @whole = {{(dso_local )?}}constant <{ [64 x i8], [16 x i8] }> {{.*}}, align 16
+// CHECK-DAG: @odd = {{(dso_local )?}}global <{ [3 x i32], [4 x i8] }> {{.*}}, align 16
+// The descriptors still register the object's own size.
+// CHECK-DAG: ptr @eight, ptr inttoptr (i64 8 to ptr)
+// CHECK-DAG: ptr @whole, ptr inttoptr (i64 64 to ptr)
+// CHECK-DAG: ptr @odd, ptr inttoptr (i64 12 to ptr)
+
+static char eight[8] = {3};
+const char whole[64] = "0123456789abcdef0123456789abcdef0123456789abcdef012345678";
+int odd[3] = {1, 2, 3};
+
+__attribute__((noinline)) static int sum(const char *p, int n) {
+  int s = 0;
+  for (int i = 0; i < n; i++)
+    s += p[i];
+  return s;
+}
+
+int main(int argc, char **argv) {
+  (void)argv;
+  eight[argc & 7] = 1;
+  return sum(eight, 8) + sum(whole, 64) + odd[argc % 3];
+}
diff --git a/test/Emission/rewrite-oracle-lowered-violation.c b/test/Emission/rewrite-oracle-lowered-violation.c
index a8ab9010..a42ae742 100644
--- a/test/Emission/rewrite-oracle-lowered-violation.c
+++ b/test/Emission/rewrite-oracle-lowered-violation.c
@@ -1,11 +1,14 @@
-// RFC 0030, sections 3.4 and 10.6, gate G8: a definite violation whose
-// error -Wno-error lowers to a warning still traps. A temporal violation has
-// no check of its own, so the second `free` is preceded by the unconditional
-// trap: `(__weavec_chk_violation(), free(p))`.
-// The -O0 IR equals that of Inputs/rewrite-oracle-lowered-violation.expected.c
-// compiled by the reference Clang with the printed prelude.
+// RFC 0034 §6.4, gate G8: a definite violation whose error -Wno-error lowers
+// to a warning gets the check or guard its facet would have as a possible
+// finding, never an unconditional trap. With the runtime, the second `free`
+// is guarded like any release (`__weavec_chk_release`), which traps only
+// when the block is not live; without it, nothing is inserted and the facet
+// is `unresolved(lowered)`.
+// The -O0 IR equals that of the Inputs/rewrite-oracle-lowered-violation*.expected.c
+// files compiled by the reference Clang with the printed prelude.
 //
-// RUN: %rewrite_oracle %s %S/Inputs/rewrite-oracle-lowered-violation.expected.c %t -- -Wno-error=weavec-double-free
+// RUN: %rewrite_oracle %s %S/Inputs/rewrite-oracle-lowered-violation.expected.c %t -- -Wno-error=weavec-double-free -fweavec-runtime
+// RUN: %rewrite_oracle %s %S/Inputs/rewrite-oracle-lowered-violation-plain.expected.c %t.plain -- -Wno-error=weavec-double-free -fno-weavec-runtime
 
 void free(void *);
 void twice(int *p) {
diff --git a/test/Emission/rfc0030-disjoint-computed-pointer.c b/test/Emission/rfc0030-disjoint-computed-pointer.c
index a5778a35..56ec07cf 100644
--- a/test/Emission/rfc0030-disjoint-computed-pointer.c
+++ b/test/Emission/rfc0030-disjoint-computed-pointer.c
@@ -1,7 +1,8 @@
 // RFC 0030 §10.3 rule 1 and §10.6: the overlap check of a copy whose source
 // is computed (`s + 1`) has no expressible second pointer. The planner marks
-// the requirement unresolved(inexpressible); it must never reach the emitter
-// and fail the compile with an internal error.
+// the requirement unresolved(inexpressible), and with the runtime memcpy's
+// checked wrapper guards it (RFC 0034 §5.2); the check must never reach the
+// emitter and fail the compile with an internal error.
 //
 // RUN: %weavec_cc -c %s -o %t.o 2>&1 | FileCheck --allow-empty %s
 // RUN: %weavec_cc -O2 -c %s -o %t.o 2>&1 | FileCheck --allow-empty %s
diff --git a/test/Emission/runtime-oracle-checked-wrappers.c b/test/Emission/runtime-oracle-checked-wrappers.c
new file mode 100644
index 00000000..807e8bf0
--- /dev/null
+++ b/test/Emission/runtime-oracle-checked-wrappers.c
@@ -0,0 +1,29 @@
+// RFC 0034, section 5.2: a library call whose need no term can state calls
+// its row's checked wrapper instead, which computes the need at run time:
+// sprintf's output against the room behind its destination, a string copy's
+// length against the room behind the destination and its operands'
+// disjointness, a memcpy's disjointness. After the row's arguments the
+// wrapper takes the object size of a fortified call (the maximum here) and
+// the checks planned (1 room, 2 disjoint); a check the plan states keeps
+// its own guard.
+// The -O0 IR equals that of Inputs/runtime-oracle-checked-wrappers.expected.c
+// compiled by the reference Clang with the printed prelude.
+//
+// RUN: %rewrite_oracle %s %S/Inputs/runtime-oracle-checked-wrappers.expected.c %t -- -fweavec-runtime -fno-weavec-global-objects -Wno-weavec
+
+extern char *strcpy(char *, const char *);
+extern void *memcpy(void *, const void *, unsigned long);
+extern int sprintf(char *, const char *, ...);
+extern int vsprintf(char *, const char *, __builtin_va_list);
+extern const char *name(void);
+
+int show(char *out, int port) { return sprintf(out, "%d", port); }
+void copy(char *d) { strcpy(d, name()); }
+void shift(char *p) { strcpy(p, p + 2); }
+void slide(char *a, unsigned long n) { memcpy(a, a + 1, n); }
+int vshow(char *out, __builtin_va_list ap) { return vsprintf(out, "%d", ap); }
+// A fortified call passes its object size, and drops its flag.
+void fortified(char *d, int port) {
+  __builtin___strcpy_chk(d, name(), __builtin_object_size(d, 1));
+  __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 1), "%d", port);
+}
diff --git a/test/Emission/runtime-oracle-range-cache.c b/test/Emission/runtime-oracle-range-cache.c
deleted file mode 100644
index 86f0d761..00000000
--- a/test/Emission/runtime-oracle-range-cache.c
+++ /dev/null
@@ -1,31 +0,0 @@
-// RFC 0032, section 13: a guard in a loop gets a range cache in its function's frame, four
-// words that are cleared on entry, and compares its pointer with the cache before it asks
-// the runtime. A loop that calls nothing checks the cache's state once on the way in, and
-// its guards do not read it (their last argument is 1); a loop with a call reads the state
-// at every guard.
-// The -O0 IR equals that of Inputs/runtime-oracle-range-cache.expected.c
-// compiled by the reference Clang with the printed prelude.
-//
-// RUN: %rewrite_oracle %s %S/Inputs/runtime-oracle-range-cache.expected.c %t -- -fweavec-runtime -fno-weavec-global-objects -Wno-weavec
-
-struct vec {
-  int *data;
-  unsigned long n;
-};
-extern void unknown(void);
-
-int quiet(struct vec *v) {
-  int s = 0;
-  for (unsigned long i = 0; i < v->n; i++)
-    s += v->data[i];
-  return s;
-}
-
-int calls(struct vec *v) {
-  int s = 0;
-  for (unsigned long i = 0; i < v->n; i++) {
-    s += v->data[i];
-    unknown();
-  }
-  return s;
-}
diff --git a/test/Emission/runtime-oracle-stack-objects.c b/test/Emission/runtime-oracle-stack-objects.c
index e371ee4f..6b6b7121 100644
--- a/test/Emission/runtime-oracle-stack-objects.c
+++ b/test/Emission/runtime-oracle-stack-objects.c
@@ -2,7 +2,8 @@
 // thread's object list where it is declared, by the initialiser of a variable declared right
 // after it, and left by that variable's cleanup when its scope ends. An object declared in a
 // nested scope is entered with flag 2; a parameter is entered when the body starts; a local
-// whose address stays (a subscript, a member) is not entered.
+// whose address stays (a subscript, a member) is not entered. RFC 0034 §4: a registered
+// local (not a parameter) is aligned to a 16-byte granule, so the shadow encodes it exactly.
 // The -O0 IR equals that of Inputs/runtime-oracle-stack-objects.expected.c
 // compiled by the reference Clang with the printed prelude.
 //
diff --git a/test/Emission/stack-objects-callback-argument.c b/test/Emission/stack-objects-callback-argument.c
new file mode 100644
index 00000000..9c219b3c
--- /dev/null
+++ b/test/Emission/stack-objects-callback-argument.c
@@ -0,0 +1,25 @@
+// RFC 0034 §4: a local is registered when a guard can reach its address.
+// Handed to a library function that takes a callback (`pthread_create`'s
+// argument, which the thread receives), it can: the callback may access it,
+// or return it to code that does. The callback is named by a function, whose
+// name decays to the pointer the parameter takes.
+//
+// RUN: %weavec_cc -O0 -Xclang -disable-llvm-passes -S -emit-llvm %s -o - | FileCheck %s
+
+#include <pthread.h>
+
+static void *echo(void *arg) { return arg; }
+
+// CHECK-LABEL: define {{.*}}i32 @spawn(
+// CHECK: %[[DATA:[0-9]+]] = alloca [8 x i32], align 16
+// CHECK: call ptr @__weavec_stack_enter(ptr noundef %[[DATA]], i64 noundef 32
+int spawn(void) {
+  int data[8];
+  pthread_t t;
+  data[3] = 3;
+  if (pthread_create(&t, 0, echo, &data[3]) != 0)
+    return -1;
+  void *result;
+  pthread_join(t, &result);
+  return *(int *)result;
+}
diff --git a/test/Prelude/rfc0030-prelude-compile.c b/test/Prelude/rfc0030-prelude-compile.c
index 83f1a9f3..eb8e9655 100644
--- a/test/Prelude/rfc0030-prelude-compile.c
+++ b/test/Prelude/rfc0030-prelude-compile.c
@@ -54,8 +54,6 @@
  * TRAP: #pragma clang diagnostic ignored "-Weverything"
  * TRAP: static __inline__ __attribute__((always_inline, nodebug, unused)) void *__weavec_chk_nonnull(const volatile void *p) {
  * TRAP: (__weavec_rt_trapping(), __builtin_verbose_trap("weavec", "nonnull"));
- * TRAP: __weavec_chk_violation(void)
- * TRAP: (__weavec_rt_trapping(), __builtin_verbose_trap("weavec", "violation"));
  * TRAP: __weavec_need_add
  * TRAP: __weavec_malloc_zero
  * TRAP: #pragma clang diagnostic pop
@@ -63,7 +61,6 @@
  * REPORT: extern void __weavec_rt_report(const char *, const char *, unsigned, unsigned);
  * REPORT: __weavec_chk_nonnull(const volatile void *p, const char *file, unsigned line, unsigned column)
  * REPORT: __weavec_rt_report("nonnull", file, line, column);
- * REPORT: __weavec_chk_violation(const char *file, unsigned line, unsigned column)
  * REPORT-NOT: __builtin_verbose_trap
  *
  * VERIFY: __weavec_chk_index
diff --git a/test/Prelude/rfc0030-prelude-runtime.c b/test/Prelude/rfc0030-prelude-runtime.c
index 44f35c61..0fbb39ca 100644
--- a/test/Prelude/rfc0030-prelude-runtime.c
+++ b/test/Prelude/rfc0030-prelude-runtime.c
@@ -17,7 +17,6 @@
 //
 // RUN: %t/trap0 nonnull 2>&1 | FileCheck --check-prefix=TRAPPED %s
 // RUN: %t/trap0 span 2>&1 | FileCheck --check-prefix=TRAPPED %s
-// RUN: %t/trap0 violation 2>&1 | FileCheck --check-prefix=TRAPPED %s
 // RUN: %t/trap2 nonnull 2>&1 | FileCheck --check-prefix=TRAPPED %s
 // RUN: %t/trap2 nonnull_n 2>&1 | FileCheck --check-prefix=TRAPPED %s
 // RUN: %t/trap2 nonnull_fn 2>&1 | FileCheck --check-prefix=TRAPPED %s
@@ -30,7 +29,6 @@
 // RUN: %t/trap2 len_r 2>&1 | FileCheck --check-prefix=TRAPPED %s
 // RUN: %t/trap2 disjoint 2>&1 | FileCheck --check-prefix=TRAPPED %s
 // RUN: %t/trap2 assert 2>&1 | FileCheck --check-prefix=TRAPPED %s
-// RUN: %t/trap2 violation 2>&1 | FileCheck --check-prefix=TRAPPED %s
 // RUN: %t/trap2 strnlen 2>&1 | FileCheck --check-prefix=TRAPPED %s
 // RUN: %t/trap2 prv_nonnull 2>&1 | FileCheck --check-prefix=TRAPPED %s
 // RUN: %t/trap2 prv_index 2>&1 | FileCheck --check-prefix=TRAPPED %s
@@ -183,24 +181,39 @@ static void passes(void) {
   __weavec_prv_assert(1);
 #endif
 
-  // Term arithmetic saturates toward failure.
+  // Term arithmetic is exact over long long and saturates toward failure;
+  // only the result is clamped.
+  const long long top = (long long)(max >> 1);
   EXPECT(__weavec_need_s(opaque(-1)) == max);
   EXPECT(__weavec_need_s(5) == 5);
   EXPECT(__weavec_have_s(opaque(-1)) == 0);
   EXPECT(__weavec_have_s(5) == 5);
-  EXPECT(__weavec_need_add(max, 1) == max);
+  EXPECT(__weavec_term_u(max) == top);
+  EXPECT(__weavec_term_u(7) == 7);
+  EXPECT(__weavec_need_add(opaque(-5), 8) == 3);
+  EXPECT(__weavec_need_add(top, opaque(-1)) == top);
+  EXPECT(__weavec_need_add(top - 1, 2) == top);
   EXPECT(__weavec_need_add(2, 3) == 5);
-  EXPECT(__weavec_need_sub(1, 2) == max);
-  EXPECT(__weavec_need_sub(max, 5) == max);
+  EXPECT(__weavec_need_s(__weavec_need_sub(1, 2)) == max);
+  EXPECT(__weavec_need_sub(top, 5) == top);
+  EXPECT(__weavec_need_sub(5, -top - 1) == top);
   EXPECT(__weavec_need_sub(5, 2) == 3);
-  EXPECT(__weavec_need_mul(1ULL << 40, 1ULL << 40) == max);
+  EXPECT(__weavec_need_mul(1LL << 40, 1LL << 40) == top);
   EXPECT(__weavec_need_mul(6, 7) == 42);
-  EXPECT(__weavec_have_add(max, 1) == 0);
+  EXPECT(__weavec_need_div(opaque(-3), 4) == -1);
+  EXPECT(__weavec_need_div(top, 4) == top);
+  EXPECT(__weavec_need_div(9, 4) == 2);
+  EXPECT(__weavec_have_add(opaque(-2), 5) == 3);
+  EXPECT(__weavec_have_add(-top - 1, 5) == -top - 1);
+  EXPECT(__weavec_have_s(__weavec_have_add(top, 1)) == 0);
   EXPECT(__weavec_have_add(2, 3) == 5);
-  EXPECT(__weavec_have_sub(1, 2) == 0);
+  EXPECT(__weavec_have_s(__weavec_have_sub(1, 2)) == 0);
+  EXPECT(__weavec_have_sub(9, top) == -top - 1);
   EXPECT(__weavec_have_sub(5, 2) == 3);
-  EXPECT(__weavec_have_mul(1ULL << 40, 1ULL << 40) == 0);
+  EXPECT(__weavec_have_s(__weavec_have_mul(1LL << 40, 1LL << 40)) == 0);
   EXPECT(__weavec_have_mul(6, 7) == 42);
+  EXPECT(__weavec_have_div(opaque(-3), 4) == -1);
+  EXPECT(__weavec_have_div(9, 4) == 2);
 
   // Zero-initialisation: every usable byte is zero or written.
   unsigned char *p = __weavec_malloc_zero(10);
@@ -293,9 +306,6 @@ static void fails(const char *which) {
   if (want(which, "assert"))
     // REPORT-NEXT: failed: assert at {{.*}}.c:[[#@LINE+1]]:7
     __weavec_chk_assert((int)opaque(0) AT);
-  if (want(which, "violation"))
-    // REPORT-NEXT: failed: violation at {{.*}}.c:[[#@LINE+1]]:7
-    __weavec_chk_violation(AT0);
   if (want(which, "strnlen"))
     // REPORT-NEXT: failed: nonnull at {{.*}}.c:[[#@LINE+1]]:7
     sink(__weavec_strnlen(opaquePointer(0), 4 AT));
@@ -343,8 +353,7 @@ unsigned long long __weavec_chk_index_report(unsigned long long i,
                                              unsigned long long n,
                                              const char *file, unsigned line,
                                              unsigned column);
-unsigned long long __weavec_need_mul(unsigned long long a,
-                                     unsigned long long b);
+long long __weavec_need_mul(long long a, long long b);
 void *__weavec_malloc_zero(size_t n);
 void *__weavec_realloc_zero(void *p, size_t n);
 
@@ -360,7 +369,7 @@ int main(int argc, char **argv) {
   int a[4];
   EXPECT(__weavec_chk_nonnull(a) == a);
   EXPECT(__weavec_chk_index(3, 8) == 3);
-  EXPECT(__weavec_need_mul(1ULL << 40, 1ULL << 40) == ~0ULL);
+  EXPECT(__weavec_need_mul(1LL << 40, 1LL << 40) == (long long)(~0ULL >> 1));
   unsigned char *p = __weavec_malloc_zero(10);
   EXPECT(p && zeroFrom(p, 0));
   fill(p, 0xab);
diff --git a/test/cases/README.md b/test/cases/README.md
index 49437c6a..26d95547 100644
--- a/test/cases/README.md
+++ b/test/cases/README.md
@@ -16,7 +16,8 @@ must be reported, checked or left unproven.
 | `soundness/` | the 113 soundness probes (85 bug, 28 correct) and their extra units, and 28 alias probes (`alias-*`: 14 bug, 14 correct): RFC 0031's 22 and RFC 0032's 6 (`alias-global-element-*`, `alias-record-element_*`); see its README |
 | `repros/` | the 12 root-cause false-positive repros, with their intended RFC 0030 expectations, and RFC 0031's 8 held-out repros (`ooc-*`) |
 | `proofs/` | salvaged cases that once caught a false proof (`SOURCES.md` gives their origin) |
-| `semantics/<feature>/` | new cases per RFC 0030 feature; `semantics/objects/` is RFC 0031's object domain (§11.1); `semantics/runtime/` is RFC 0032's runtime enforcement (43 cases: 19 bugs that must trap or stay unenforced without the runtime, 24 correct programs that must not trap) |
+| `semantics/<feature>/` | new cases per RFC 0030 feature; `semantics/objects/` is RFC 0031's object domain (§11.1); `semantics/runtime/` is RFC 0032's runtime enforcement (43 cases: 19 bugs that must trap or stay unenforced without the runtime, 24 correct programs that must not trap); `semantics/confirm/` is RFC 0034's false stops and silent misses (§9), `semantics/detect-probes/` the three probes written after its detection set |
+| `detection/` | RFC 0034's detection set (gate F4): the 61 blind bug programs of its milestone, each with its fixed twin, one directory per program ([Detection cases](#detection-cases)) |
 
 `GOLDEN.md` describes the golden v0.10.0 binaries and `KNOWN-DIFFERENCES.md`
 lists the engine pins the RFC 0030 build no longer reproduces.
@@ -89,6 +90,9 @@ separated by `//`:
 | `UNITS: <file.c> [<file.c> ...]` | file | further translation units linked with this one, relative to the case |
 | `ASAN` | file | also run the ASan oracle, and require it to report the bug |
 | `TOOL` | file | analyse with `weavec --ledger` (no build, no run) |
+| `DETECT: <flags>` | file | a detection case (below): `<flags>` (e.g. `-DFIX`) select the fixed twin |
+| `STOP` | line | in a `DETECT` case, a line the bug must stop at or before; `STOP // MISS: <reason>` is a known miss |
+| `XFAIL: <reason>` | file | the case is expected to fail today: a failure is `XFAIL`, a pass is `XPASS` (remove the marker); neither fails the run |
 
 Facets are `spatial`, `null`, `temporal` and `assertion`; reasons are the
 spellings of RFC 0030 §2.3–2.4. `UNRESOLVED` does not tell an unresolved
@@ -119,6 +123,66 @@ Rules the grammar leaves implicit, as the runner enforces them:
   needs `CLEAN`; `ASAN` and `RUN-INPUT` need a unit that defines `main`;
   `TOOL` excludes both.
 
+## Detection cases
+
+A `DETECT` case (RFC 0034 §9, gate F4) is judged by whether its bug
+*stops*, not by what is reported where. It has `STOP` lines (the faulty
+operation; there may be several) and none of `CLEAN`, `ALLOW`, `TOOL`,
+`BUG`, `TRAP`, `NEUTRALISED`, `EXPECT-LEDGER` or the ledger markers; a
+unit must define `main`. The runner builds it twice as the default build
+does (trap mode, the runtime on, its `FLAGS`, the link reading records
+rather than analysing again), once as is (the bug) and once with the
+`DETECT` flags added to every compile and link (the twin), runs each
+build once per `RUN-INPUT`, and rebuilds each in report mode with
+`-D_FORTIFY_SOURCE=0` (so that the first failure reported is WeaveC's,
+not the C library's) to name each failed check.
+
+- **The bug stops** when its build stops at a WeaveC error (anywhere;
+  one on no `STOP` line is noted), or when a run traps (`SIGTRAP` or
+  `SIGILL`) and the first failed check of the same input's report-mode run
+  is on a `STOP` line. A trap whose report-mode run names no check (the C
+  library's own) or names one on another line (a later read) is not a
+  stop. A bug that does not stop fails the case, unless its `STOP` line
+  carries `MISS: <reason>`: a known miss passes silently, and when it
+  stops it is printed as `now stops (remove its MISS marker)`.
+- **The twin must not stop**: no error, no clang error, no run that dies
+  by a signal or times out, and no failed check in its report-mode run.
+  This holds for known misses too.
+- **`--checks verify`** builds both in verify mode: a verify-mode trap of
+  the bug where the report-mode run names no failed check is a
+  `weavec.proven` trap (a bug ran past a proven facet), and fails the case
+  whatever its markers, as F4 asks.
+- **`--asan`** also builds the bug with ASan and counts its reports (gate
+  F6 compares the stops with them).
+- Detection cases are skipped under `--legacy`, `--no-run`,
+  `--no-emission` and `--require`, which do not build or run the default
+  build.
+
+Each suite's summary has a `detection:` line, `54/61 bugs stop (7 at
+compile time, 47 at run time); 7 known misses, 0 of them stopping now;
+61/61 fixed twins clean`, and `--min-stops N` fails the run unless at
+least N of the selected detection cases stop:
+
+```sh
+scripts/run-cases.py --filter 'detection/**' --min-stops 54   # gate F4
+scripts/run-cases.py --filter 'detection/**' --checks verify  # F4: no bug past a proven facet
+```
+
+`detection/NN_<class>_<name>/` holds one program (its `prog.c` or
+`main.c`, any further units named by `UNITS`, its headers and its
+`stdin.txt`) converted from the milestone's `detect/cases/<name>/`: its
+`/* BUG */` comments became `STOP` markers, `args` and `stdin` became
+`RUN-INPUT`, and each case is built with `FLAGS: -O2`, as the milestone
+measured. Five are known misses today (11, 24, 36, 38 and 57, each with
+its reason); `semantics/detect-probes/` holds the three probes (62 is a
+known miss).
+
+`XFAIL` marks a case written for behaviour a later stage brings (RFC 0034's
+`semantics/confirm/` cases, against a tree before §5 and §6): it runs as
+usual, and its result is reported as `XFAIL` while it fails and as `XPASS`
+once it passes, when the marker should go. A marker error is still an
+error.
+
 ## How a case is judged
 
 1. **Build.** Each unit is compiled with
diff --git a/test/cases/detection-blind/01_ring_buffer_wrap.c b/test/cases/detection-blind/01_ring_buffer_wrap.c
new file mode 100644
index 00000000..08c83b45
--- /dev/null
+++ b/test/cases/detection-blind/01_ring_buffer_wrap.c
@@ -0,0 +1,75 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Ring buffer of trace records. The wrap test after a push uses `>` instead
+ * of `>=`, so the write index reaches cap and one record is stored past the
+ * end of the slot array before the index wraps.
+ * Category: spatial (heap buffer overflow by one 16-byte element).
+ * Why it may be missed: the wrap looks like an ordinary bounds check, and the
+ * overflow only happens on the cap-th push, after the buffer looked healthy.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+
+struct record {
+    unsigned seq;
+    char tag[12];
+};
+
+struct ring {
+    struct record *slots;
+    size_t cap;
+    size_t head;
+    size_t count;
+};
+
+static int ring_init(struct ring *rb, size_t cap)
+{
+    rb->slots = malloc(cap * sizeof *rb->slots);
+    rb->cap = cap;
+    rb->head = 0;
+    rb->count = 0;
+    return rb->slots ? 0 : -1;
+}
+
+static void ring_push(struct ring *rb, unsigned seq, const char *tag)
+{
+    struct record *r = &rb->slots[rb->head];
+    r->seq = seq; // STOP
+    snprintf(r->tag, sizeof r->tag, "%s", tag);
+    rb->head++;
+#ifdef FIX
+    if (rb->head >= rb->cap)
+#else
+    if (rb->head > rb->cap)
+#endif
+        rb->head = 0;
+    if (rb->count < rb->cap)
+        rb->count++;
+}
+
+static unsigned ring_checksum(const struct ring *rb)
+{
+    unsigned sum = 0;
+    for (size_t i = 0; i < rb->count; i++)
+        if (rb->slots[i].tag[0] != '\0')
+            sum += rb->slots[i].seq;
+    return sum;
+}
+
+int main(void)
+{
+    static const char *const tags[] = {"open", "read", "write", "close"};
+    struct ring rb;
+    if (ring_init(&rb, 8) != 0)
+        return 1;
+    for (unsigned i = 0; i < 20; i++)
+        ring_push(&rb, i, tags[i % 4]);
+    unsigned sum = ring_checksum(&rb);
+    free(rb.slots);
+    /* The last 8 records are 12..19. */
+    return sum == 124 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/02_strbuf_terminator.c b/test/cases/detection-blind/02_strbuf_terminator.c
new file mode 100644
index 00000000..1bf9ca10
--- /dev/null
+++ b/test/cases/detection-blind/02_strbuf_terminator.c
@@ -0,0 +1,70 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * String builder: sb_reserve() makes room for `extra` characters but not for
+ * the terminating NUL that sb_append() copies along with them. When the text
+ * exactly fills the capacity the NUL lands one byte past the heap block.
+ * Category: spatial (heap buffer overflow by 1 byte).
+ * Why it may be missed: the off-by-one only shows when a string ends exactly
+ * on a power-of-two boundary; most appends leave slack in the buffer.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct strbuf {
+    char *data;
+    size_t len;
+    size_t cap;
+};
+
+static int sb_reserve(struct strbuf *b, size_t extra)
+{
+    size_t need = b->len + extra;
+#ifdef FIX
+    need += 1; /* room for the terminator */
+#endif
+    if (need <= b->cap)
+        return 0;
+    size_t ncap = b->cap ? b->cap : 16;
+    while (ncap < need)
+        ncap *= 2;
+    char *p = realloc(b->data, ncap);
+    if (!p)
+        return -1;
+    b->data = p;
+    b->cap = ncap;
+    return 0;
+}
+
+static int sb_append(struct strbuf *b, const char *s)
+{
+    size_t n = strlen(s);
+    if (sb_reserve(b, n) != 0)
+        return -1;
+    memcpy(b->data + b->len, s, n + 1); // STOP
+    b->len += n;
+    return 0;
+}
+
+int main(void)
+{
+    static const char *const parts[] = {"usr", "local", "share", "doc"};
+    struct strbuf b = {NULL, 0, 0};
+    int ok = 1;
+    for (size_t i = 0; i < sizeof parts / sizeof parts[0]; i++) {
+        if (sb_append(&b, "/") != 0 || sb_append(&b, parts[i]) != 0) {
+            ok = 0;
+            break;
+        }
+    }
+    if (ok) {
+        printf("%s\n", b.data);
+        ok = strcmp(b.data, "/usr/local/share/doc") == 0;
+    }
+    free(b.data);
+    return ok ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/03_csv_quoted_field.c b/test/cases/detection-blind/03_csv_quoted_field.c
new file mode 100644
index 00000000..2f74b9e5
--- /dev/null
+++ b/test/cases/detection-blind/03_csv_quoted_field.c
@@ -0,0 +1,77 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * CSV reader that unquotes each field into a fixed 16-byte stack buffer. The
+ * copy loop keeps at most FIELD_MAX characters, but the terminator is then
+ * stored at out[FIELD_MAX], one byte past the buffer, for a long field.
+ * Category: spatial (stack buffer overflow by 1 byte).
+ * Why it may be missed: the loop bound looks right; the overflow is in the
+ * terminator store after the loop and needs a field of 16+ characters.
+ */
+#include <stdio.h>
+#include <string.h>
+
+#define FIELD_MAX 16
+
+/* Copies the field starting at *pos into out (FIELD_MAX bytes), undoing CSV
+   quoting, and advances *pos past the field and its comma. */
+static void read_field(const char *line, size_t *pos, char *out)
+{
+    size_t i = *pos, o = 0;
+    int quoted = line[i] == '"';
+    if (quoted)
+        i++;
+    while (line[i] != '\0') {
+        char c = line[i];
+        if (quoted && c == '"') {
+            if (line[i + 1] != '"') { /* closing quote */
+                quoted = 0;
+                i++;
+                continue;
+            }
+            i++; /* "" is an escaped quote */
+        } else if (!quoted && c == ',') {
+            break;
+        }
+#ifdef FIX
+        if (o < FIELD_MAX - 1)
+#else
+        if (o < FIELD_MAX)
+#endif
+            out[o++] = c;
+        i++;
+    }
+    out[o] = '\0'; // STOP
+    if (line[i] == ',')
+        i++;
+    *pos = i;
+}
+
+int main(void)
+{
+    static const char *const rows[] = {
+        "17,bolt,0.25",
+        "42,\"Widget \"\"Pro\"\" Max Edition\",19.99",
+        "43,\"nut, hex\",0.10",
+    };
+    unsigned fields = 0;
+    size_t chars = 0;
+    for (size_t r = 0; r < sizeof rows / sizeof rows[0]; r++) {
+        size_t pos = 0;
+        unsigned col = 0;
+        while (rows[r][pos] != '\0') {
+            char field[FIELD_MAX];
+            read_field(rows[r], &pos, field);
+            chars += strlen(field);
+            if (col == 1)
+                printf("name: %s\n", field);
+            col++;
+            fields++;
+        }
+    }
+    printf("%u fields, %zu characters\n", fields, chars);
+    return fields == 9 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/04_matrix_transpose.c b/test/cases/detection-blind/04_matrix_transpose.c
new file mode 100644
index 00000000..0455fd9c
--- /dev/null
+++ b/test/cases/detection-blind/04_matrix_transpose.c
@@ -0,0 +1,101 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Matrix transpose of a 3x5 matrix into a 5x3 one. The destination index
+ * uses the source's column count as the row stride, so for a non-square
+ * matrix the writes run past the end of the transposed matrix's data.
+ * Category: spatial (heap buffer overflow, index computed from the shape).
+ * Why it may be missed: `m->cols` and `t->cols` look alike, and square test
+ * matrices (the usual unit test) never expose the wrong stride.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+
+struct mat {
+    size_t rows, cols;
+    double *data;
+};
+
+static struct mat *mat_new(size_t rows, size_t cols)
+{
+    struct mat *m = malloc(sizeof *m);
+    if (!m)
+        return NULL;
+    m->data = calloc(rows * cols, sizeof *m->data);
+    if (!m->data) {
+        free(m);
+        return NULL;
+    }
+    m->rows = rows;
+    m->cols = cols;
+    return m;
+}
+
+static void mat_free(struct mat *m)
+{
+    if (m) {
+        free(m->data);
+        free(m);
+    }
+}
+
+static struct mat *mat_transpose(const struct mat *m)
+{
+    struct mat *t = mat_new(m->cols, m->rows);
+    if (!t)
+        return NULL;
+    for (size_t i = 0; i < m->rows; i++)
+        for (size_t j = 0; j < m->cols; j++)
+#ifdef FIX
+            t->data[j * t->cols + i] = m->data[i * m->cols + j];
+#else
+            t->data[j * m->cols + i] = m->data[i * m->cols + j]; // STOP
+#endif
+    return t;
+}
+
+static struct mat *mat_mul(const struct mat *a, const struct mat *b)
+{
+    if (a->cols != b->rows)
+        return NULL;
+    struct mat *p = mat_new(a->rows, b->cols);
+    if (!p)
+        return NULL;
+    for (size_t i = 0; i < a->rows; i++)
+        for (size_t j = 0; j < b->cols; j++) {
+            double s = 0;
+            for (size_t k = 0; k < a->cols; k++)
+                s += a->data[i * a->cols + k] * b->data[k * b->cols + j];
+            p->data[i * p->cols + j] = s;
+        }
+    return p;
+}
+
+int main(void)
+{
+    struct mat *a = mat_new(3, 5);
+    if (!a)
+        return 1;
+    double sumsq = 0;
+    for (size_t i = 0; i < a->rows; i++)
+        for (size_t j = 0; j < a->cols; j++) {
+            double v = (double)(i * 2 + j);
+            a->data[i * a->cols + j] = v;
+            sumsq += v * v;
+        }
+    struct mat *t = mat_transpose(a);
+    struct mat *g = t ? mat_mul(a, t) : NULL; /* Gram matrix A * A^T */
+    double trace = 0;
+    if (g)
+        for (size_t i = 0; i < g->rows; i++)
+            trace += g->data[i * g->cols + i];
+    printf("trace %.1f, sum of squares %.1f\n", trace, sumsq);
+    int ok = g != NULL && trace == sumsq;
+    mat_free(g);
+    mat_free(t);
+    mat_free(a);
+    return ok ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/05_lexer_peek.c b/test/cases/detection-blind/05_lexer_peek.c
new file mode 100644
index 00000000..81d9911d
--- /dev/null
+++ b/test/cases/detection-blind/05_lexer_peek.c
@@ -0,0 +1,98 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Lexer over a source buffer that, like a file read with fread(), has an
+ * explicit length and no terminator. peek_is() looks at the next character
+ * for two-character operators without checking the length, so a source that
+ * ends in '=' or '<' reads one byte past the heap buffer.
+ * Category: spatial (heap buffer over-read by 1 byte).
+ * Why it may be missed: the code was written for NUL-terminated strings,
+ * where src[len] is always readable; only the buffer's origin changed.
+ */
+#include <ctype.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct lexer {
+    const char *src;
+    size_t len;
+    size_t pos;
+};
+
+enum tok { T_EOF, T_IDENT, T_NUM, T_ASSIGN, T_EQ, T_LT, T_LE, T_SEMI, T_ERR };
+
+static int peek_is(const struct lexer *lx, char want)
+{
+#ifdef FIX
+    if (lx->pos >= lx->len)
+        return 0;
+#endif
+    return lx->src[lx->pos] == want; // STOP
+}
+
+static int is_ident(char c)
+{
+    return isalnum((unsigned char)c) || c == '_';
+}
+
+static enum tok next_token(struct lexer *lx)
+{
+    while (lx->pos < lx->len && isspace((unsigned char)lx->src[lx->pos]))
+        lx->pos++;
+    if (lx->pos >= lx->len)
+        return T_EOF;
+    char c = lx->src[lx->pos++];
+    if (isalpha((unsigned char)c) || c == '_') {
+        while (lx->pos < lx->len && is_ident(lx->src[lx->pos]))
+            lx->pos++;
+        return T_IDENT;
+    }
+    if (isdigit((unsigned char)c)) {
+        while (lx->pos < lx->len && isdigit((unsigned char)lx->src[lx->pos]))
+            lx->pos++;
+        return T_NUM;
+    }
+    switch (c) {
+    case '=':
+        if (peek_is(lx, '=')) {
+            lx->pos++;
+            return T_EQ;
+        }
+        return T_ASSIGN;
+    case '<':
+        if (peek_is(lx, '=')) {
+            lx->pos++;
+            return T_LE;
+        }
+        return T_LT;
+    case ';':
+        return T_SEMI;
+    default:
+        return T_ERR;
+    }
+}
+
+int main(void)
+{
+    static const char text[] = "x = 1; y = x <= 2; done =";
+    size_t len = strlen(text);
+    char *src = malloc(len);
+    if (!src)
+        return 1;
+    memcpy(src, text, len); /* as if read from a file: no terminator */
+    struct lexer lx = {src, len, 0};
+    unsigned counts[T_ERR + 1] = {0};
+    unsigned ntok = 0;
+    enum tok t;
+    while ((t = next_token(&lx)) != T_EOF) {
+        counts[t]++;
+        ntok++;
+    }
+    free(src);
+    printf("%u tokens, %u comparisons\n", ntok, counts[T_LE] + counts[T_EQ]);
+    return ntok == 12 && counts[T_ERR] == 0 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/06_strncpy_unterminated.c b/test/cases/detection-blind/06_strncpy_unterminated.c
new file mode 100644
index 00000000..e2924431
--- /dev/null
+++ b/test/cases/detection-blind/06_strncpy_unterminated.c
@@ -0,0 +1,52 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Formats user names for an 8-column report. strncpy() into an 8-byte stack
+ * buffer does not terminate the copy when the login has 8 or more
+ * characters, and the strlen() that follows runs off the end of the buffer.
+ * Category: spatial (stack buffer over-read via strlen of an unterminated
+ * buffer).
+ * Why it may be missed: strncpy() with sizeof looks like the "safe" idiom;
+ * short logins (the common case) are terminated by its zero padding.
+ */
+#include <stdio.h>
+#include <string.h>
+
+/* Formats "name(uid)" with the login cut to fit an 8-character column and
+   returns the width of the name part. */
+static size_t format_user(const char *login, unsigned uid, char *out, size_t outsz)
+{
+    char shortname[8];
+    strncpy(shortname, login, sizeof shortname);
+#ifdef FIX
+    shortname[sizeof shortname - 1] = '\0';
+#endif
+    size_t n = strlen(shortname); // STOP
+    snprintf(out, outsz, "%s(%u)", shortname, uid);
+    return n;
+}
+
+int main(void)
+{
+    static const struct {
+        const char *login;
+        unsigned uid;
+    } users[] = {
+        {"root", 0},
+        {"daemon", 1},
+        {"postmaster", 25},
+        {"www", 33},
+    };
+    char line[32];
+    size_t width = 0;
+    for (size_t i = 0; i < sizeof users / sizeof users[0]; i++) {
+        size_t n = format_user(users[i].login, users[i].uid, line, sizeof line);
+        if (n > width)
+            width = n;
+        puts(line);
+    }
+    return width <= 7 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/07_hash_table_rounding.c b/test/cases/detection-blind/07_hash_table_rounding.c
new file mode 100644
index 00000000..be2b1632
--- /dev/null
+++ b/test/cases/detection-blind/07_hash_table_rounding.c
@@ -0,0 +1,110 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Word counter on an open-addressing hash table. table_init() rounds the
+ * requested size up to a power of two for the probe mask, but allocates only
+ * the requested number of slots, so any hash that lands in [want, cap)
+ * indexes past the slot array.
+ * Category: spatial (heap buffer overflow, index computed from a hash).
+ * Why it may be missed: mask and cap agree with each other; only calloc()
+ * uses the size before rounding, far from where the slots are indexed.
+ */
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct entry {
+    const char *key;
+    unsigned count;
+};
+
+struct table {
+    struct entry *slots;
+    size_t cap;
+    size_t mask;
+    size_t used;
+};
+
+static size_t round_pow2(size_t n)
+{
+    size_t p = 1;
+    while (p < n)
+        p <<= 1;
+    return p;
+}
+
+static int table_init(struct table *t, size_t want)
+{
+    size_t cap = round_pow2(want);
+#ifdef FIX
+    t->slots = calloc(cap, sizeof *t->slots);
+#else
+    t->slots = calloc(want, sizeof *t->slots);
+#endif
+    t->cap = cap;
+    t->mask = cap - 1;
+    t->used = 0;
+    return t->slots ? 0 : -1;
+}
+
+static uint32_t hash_str(const char *s)
+{
+    uint32_t h = 2166136261u;
+    while (*s) {
+        h ^= (unsigned char)*s++;
+        h *= 16777619u;
+    }
+    return h;
+}
+
+static struct entry *table_slot(struct table *t, const char *key)
+{
+    size_t i = hash_str(key) & t->mask;
+    for (;;) {
+        struct entry *e = &t->slots[i];
+        if (!e->key || strcmp(e->key, key) == 0) // STOP
+            return e;
+        i = (i + 1) & t->mask;
+    }
+}
+
+static int count_word(struct table *t, const char *word)
+{
+    struct entry *e = table_slot(t, word);
+    if (!e->key) {
+        if (t->used + 1 > t->cap / 2)
+            return -1; /* no resizing in this tool */
+        e->key = word;
+        t->used++;
+    }
+    e->count++;
+    return 0;
+}
+
+int main(void)
+{
+    char text[] = "the cat and the dog and the bird saw a cat chase a dog";
+    struct table t;
+    if (table_init(&t, 20) != 0)
+        return 1;
+    unsigned words = 0;
+    for (char *w = strtok(text, " "); w; w = strtok(NULL, " ")) {
+        if (count_word(&t, w) != 0)
+            break;
+        words++;
+    }
+    unsigned total = 0, distinct = 0;
+    for (size_t i = 0; i < t.cap; i++) {
+        if (t.slots[i].key) {
+            total += t.slots[i].count;
+            distinct++;
+        }
+    }
+    free(t.slots);
+    printf("%u words, %u distinct\n", words, distinct);
+    return words == 14 && total == 14 && distinct == 8 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/08_histogram_max_bucket.c b/test/cases/detection-blind/08_histogram_max_bucket.c
new file mode 100644
index 00000000..9b0d0900
--- /dev/null
+++ b/test/cases/detection-blind/08_histogram_max_bucket.c
@@ -0,0 +1,52 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Latency histogram with NBUCKETS equal-width buckets between the observed
+ * minimum and maximum. The bucket of a value is (v - lo) * NBUCKETS / span,
+ * which is NBUCKETS for the maximum itself, one past the global array.
+ * Category: spatial (global buffer overflow, index computed from the data).
+ * Why it may be missed: every value but the maximum lands in range, and the
+ * index is a computation over data rather than a visible loop bound.
+ */
+#include <stdio.h>
+
+#define NBUCKETS 8
+
+static unsigned hist[NBUCKETS];
+
+static void build_histogram(const unsigned *v, size_t n)
+{
+    unsigned lo = v[0], hi = v[0];
+    for (size_t i = 1; i < n; i++) {
+        if (v[i] < lo)
+            lo = v[i];
+        if (v[i] > hi)
+            hi = v[i];
+    }
+    unsigned span = hi > lo ? hi - lo : 1;
+    for (size_t i = 0; i < n; i++) {
+        size_t b = (size_t)(v[i] - lo) * NBUCKETS / span;
+#ifdef FIX
+        if (b >= NBUCKETS)
+            b = NBUCKETS - 1; /* the maximum belongs to the last bucket */
+#endif
+        hist[b]++; // STOP
+    }
+}
+
+int main(void)
+{
+    static const unsigned latency_us[] = {120, 340, 95, 410, 220, 180,
+                                          760, 130, 300, 255, 98, 615};
+    size_t n = sizeof latency_us / sizeof latency_us[0];
+    build_histogram(latency_us, n);
+    unsigned total = 0;
+    for (size_t b = 0; b < NBUCKETS; b++) {
+        printf("bucket %zu: %u\n", b, hist[b]);
+        total += hist[b];
+    }
+    return total == n ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/09_snprintf_offset.c b/test/cases/detection-blind/09_snprintf_offset.c
new file mode 100644
index 00000000..ff3dba46
--- /dev/null
+++ b/test/cases/detection-blind/09_snprintf_offset.c
@@ -0,0 +1,57 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Renders "key=value" pairs into a 48-byte stack line with successive
+ * snprintf() calls at an advancing offset. Each call passes the size of the
+ * whole buffer instead of what is left after the offset, so the pair that
+ * crosses the end is written past the buffer instead of being truncated.
+ * Category: spatial (stack buffer overflow, wrong length to snprintf).
+ * Why it may be missed: snprintf() with sizeof reads as bounded; the size is
+ * correct for the first call and only wrong once off > 0.
+ */
+#include <stdio.h>
+#include <string.h>
+
+struct kv {
+    const char *key;
+    const char *val;
+};
+
+/* Prints the pairs on one line, truncated to the line width, and returns the
+   number of characters printed. */
+static size_t render(const struct kv *kvs, size_t n)
+{
+    char line[48];
+    size_t off = 0;
+    line[0] = '\0';
+    for (size_t i = 0; i < n; i++) {
+        const char *sep = i ? " " : "";
+#ifdef FIX
+        if (off >= sizeof line)
+            break;
+        int w = snprintf(line + off, sizeof line - off, "%s%s=%s", sep, kvs[i].key, kvs[i].val);
+#else
+        int w = snprintf(line + off, sizeof line, "%s%s=%s", sep, kvs[i].key, kvs[i].val); // STOP
+#endif
+        if (w < 0)
+            return 0;
+        off += (size_t)w;
+    }
+    printf("%s\n", line);
+    return strlen(line);
+}
+
+int main(void)
+{
+    static const struct kv conf[] = {
+        {"host", "example.org"},
+        {"port", "8080"},
+        {"user", "deploy"},
+        {"path", "/srv/app/releases/current"},
+    };
+    size_t shown = render(conf, sizeof conf / sizeof conf[0]);
+    return shown == 47 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/10_tlv_record_length.c b/test/cases/detection-blind/10_tlv_record_length.c
new file mode 100644
index 00000000..a716c03d
--- /dev/null
+++ b/test/cases/detection-blind/10_tlv_record_length.c
@@ -0,0 +1,75 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Type-length-value stream parser. parse_stream() checks that each record's
+ * 16-bit length fits in the input, but handle_record() then copies that many
+ * bytes into a 32-byte stack payload buffer; a 36-byte record overflows it
+ * by 4 bytes.
+ * Category: spatial (stack buffer overflow, length taken from the input).
+ * Why it may be missed: there is a length check, just against the wrong
+ * bound (the input, not the destination), one function away from the copy.
+ */
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+
+#define PAYLOAD_MAX 32
+
+static uint32_t handle_record(uint8_t type, const uint8_t *body, size_t len)
+{
+    uint8_t payload[PAYLOAD_MAX];
+#ifdef FIX
+    if (len > sizeof payload)
+        return 0; /* oversized record: ignored */
+#endif
+    memcpy(payload, body, len); // STOP
+    uint32_t h = type;
+    for (size_t i = 0; i < len; i++)
+        h = h * 31u + payload[i];
+    return h;
+}
+
+static int parse_stream(const uint8_t *buf, size_t n, uint32_t *digest, unsigned *records)
+{
+    size_t pos = 0;
+    while (pos < n) {
+        if (n - pos < 3)
+            return -1;
+        uint8_t type = buf[pos];
+        size_t len = ((size_t)buf[pos + 1] << 8) | buf[pos + 2];
+        pos += 3;
+        if (len > n - pos)
+            return -1; /* truncated record */
+        *digest ^= handle_record(type, buf + pos, len);
+        (*records)++;
+        pos += len;
+    }
+    return 0;
+}
+
+static size_t put_record(uint8_t *out, uint8_t type, const char *body, size_t len)
+{
+    out[0] = type;
+    out[1] = (uint8_t)(len >> 8);
+    out[2] = (uint8_t)(len & 0xff);
+    memcpy(out + 3, body, len);
+    return len + 3;
+}
+
+int main(void)
+{
+    uint8_t wire[128];
+    size_t n = 0;
+    n += put_record(wire + n, 1, "hello", 5);
+    n += put_record(wire + n, 2, "0123456789abcdef0123456789abcdefWXYZ", 36);
+    n += put_record(wire + n, 3, "", 0);
+    uint32_t digest = 0;
+    unsigned records = 0;
+    if (parse_stream(wire, n, &digest, &records) != 0)
+        return 1;
+    printf("%u records, digest %08x\n", records, (unsigned)digest);
+    return records == 3 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/11_base64_encode_nul.c b/test/cases/detection-blind/11_base64_encode_nul.c
new file mode 100644
index 00000000..954456a3
--- /dev/null
+++ b/test/cases/detection-blind/11_base64_encode_nul.c
@@ -0,0 +1,69 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Base64 encoder. The output buffer is sized with the textbook formula
+ * (n + 2) / 3 * 4, which counts the encoded characters but not the NUL that
+ * the encoder appends, so the terminator is written one byte past the block.
+ * Category: spatial (heap buffer overflow by 1 byte).
+ * Why it may be missed: the size formula is the familiar, correct one for
+ * the encoded length; the missing +1 is easy to read past.
+ */
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+static char *b64_encode(const unsigned char *in, size_t n)
+{
+    static const char tbl[] =
+        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+    size_t olen = (n + 2) / 3 * 4;
+#ifdef FIX
+    char *out = malloc(olen + 1);
+#else
+    char *out = malloc(olen);
+#endif
+    if (!out)
+        return NULL;
+    size_t o = 0;
+    for (size_t i = 0; i < n; i += 3) {
+        uint32_t v = (uint32_t)in[i] << 16;
+        if (i + 1 < n)
+            v |= (uint32_t)in[i + 1] << 8;
+        if (i + 2 < n)
+            v |= in[i + 2];
+        out[o++] = tbl[(v >> 18) & 63];
+        out[o++] = tbl[(v >> 12) & 63];
+        out[o++] = i + 1 < n ? tbl[(v >> 6) & 63] : '=';
+        out[o++] = i + 2 < n ? tbl[v & 63] : '=';
+    }
+    out[o] = '\0'; // STOP
+    return out;
+}
+
+int main(void)
+{
+    static const struct {
+        const char *plain;
+        const char *encoded;
+    } cases[] = {
+        {"hello, world", "aGVsbG8sIHdvcmxk"},
+        {"ab", "YWI="},
+        {"user:secret", "dXNlcjpzZWNyZXQ="},
+    };
+    int ok = 1;
+    for (size_t i = 0; i < sizeof cases / sizeof cases[0]; i++) {
+        const char *p = cases[i].plain;
+        char *e = b64_encode((const unsigned char *)p, strlen(p));
+        if (!e)
+            return 1;
+        printf("%s -> %s\n", p, e);
+        if (strcmp(e, cases[i].encoded) != 0)
+            ok = 0;
+        free(e);
+    }
+    return ok ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/12_strip_slashes_underflow.c b/test/cases/detection-blind/12_strip_slashes_underflow.c
new file mode 100644
index 00000000..10414968
--- /dev/null
+++ b/test/cases/detection-blind/12_strip_slashes_underflow.c
@@ -0,0 +1,42 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Path normaliser that strips trailing slashes by walking an end pointer
+ * backwards. For the root path "/" the loop removes the only character and
+ * then inspects end[-1], the byte before the start of the stack buffer.
+ * Category: spatial (stack buffer underflow, read of path[-1]).
+ * Why it may be missed: the loop is correct for every path but the root, and
+ * the underflowing read happens in the loop condition.
+ */
+#include <stdio.h>
+#include <string.h>
+
+static void strip_trailing_slashes(char *path)
+{
+    char *end = path + strlen(path);
+#ifdef FIX
+    while (end > path + 1 && end[-1] == '/')
+#else
+    while (end[-1] == '/') // STOP
+#endif
+        *--end = '\0';
+}
+
+int main(void)
+{
+    static const char *const in[] = {"/var/log/", "/tmp//", "relative/dir/", "/"};
+    static const char *const want[] = {"/var/log", "/tmp", "relative/dir", "/"};
+    int ok = 1;
+    for (size_t i = 0; i < sizeof in / sizeof in[0]; i++) {
+        char buf[64];
+        snprintf(buf, sizeof buf, "%s", in[i]);
+        strip_trailing_slashes(buf);
+        printf("%s -> %s\n", in[i], buf);
+        if (strcmp(buf, want[i]) != 0)
+            ok = 0;
+    }
+    return ok ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/13_missing_sentinel.c b/test/cases/detection-blind/13_missing_sentinel.c
new file mode 100644
index 00000000..bb458915
--- /dev/null
+++ b/test/cases/detection-blind/13_missing_sentinel.c
@@ -0,0 +1,81 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Command dispatcher. build_table() fills a heap table with one entry per
+ * command, but lookup() walks the table until it finds an entry whose name
+ * is NULL, and no such sentinel was allocated. Looking up an unknown command
+ * reads past the end of the table.
+ * Category: spatial (heap buffer over-read, missing sentinel).
+ * Why it may be missed: every lookup of a known command stops early; only a
+ * miss walks to the (absent) terminator.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+typedef int (*cmd_fn)(int);
+
+struct command {
+    const char *name;
+    cmd_fn run;
+};
+
+static int cmd_double(int x) { return 2 * x; }
+static int cmd_negate(int x) { return -x; }
+static int cmd_square(int x) { return x * x; }
+
+/* Builds the dispatch table; lookups stop at the entry whose name is NULL. */
+static struct command *build_table(const char *const *names, const cmd_fn *fns, size_t n)
+{
+#ifdef FIX
+    struct command *t = malloc((n + 1) * sizeof *t);
+#else
+    struct command *t = malloc(n * sizeof *t);
+#endif
+    if (!t)
+        return NULL;
+    for (size_t i = 0; i < n; i++) {
+        t[i].name = names[i];
+        t[i].run = fns[i];
+    }
+#ifdef FIX
+    t[n].name = NULL;
+    t[n].run = NULL;
+#endif
+    return t;
+}
+
+static const struct command *lookup(const struct command *t, const char *name)
+{
+    for (const struct command *c = t; c->name != NULL; c++) // STOP
+        if (strcmp(c->name, name) == 0)
+            return c;
+    return NULL;
+}
+
+int main(void)
+{
+    static const char *const names[] = {"double", "negate", "square"};
+    static const cmd_fn fns[] = {cmd_double, cmd_negate, cmd_square};
+    static const char *const script[] = {"double", "square", "half", "negate"};
+    struct command *table = build_table(names, fns, 3);
+    if (!table)
+        return 1;
+    int x = 3;
+    unsigned unknown = 0;
+    for (size_t i = 0; i < sizeof script / sizeof script[0]; i++) {
+        const struct command *c = lookup(table, script[i]);
+        if (!c) {
+            fprintf(stderr, "unknown command '%s'\n", script[i]);
+            unknown++;
+            continue;
+        }
+        x = c->run(x);
+    }
+    free(table);
+    printf("result %d\n", x);
+    return x == -36 && unknown == 1 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/14_utf8_truncated.c b/test/cases/detection-blind/14_utf8_truncated.c
new file mode 100644
index 00000000..3819b2d7
--- /dev/null
+++ b/test/cases/detection-blind/14_utf8_truncated.c
@@ -0,0 +1,90 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * UTF-8 decoder for network chunks. The sequence length comes from the lead
+ * byte, and the continuation bytes are read without checking that the chunk
+ * still holds them, so a chunk cut in the middle of a character reads past
+ * the end of its exactly-sized heap buffer.
+ * Category: spatial (heap buffer over-read, length computed from the data).
+ * Why it may be missed: the decoder validates every continuation byte, which
+ * looks thorough, and well-formed test strings never end mid-sequence.
+ */
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+static size_t seq_len(unsigned char lead)
+{
+    if (lead < 0x80)
+        return 1;
+    if ((lead & 0xE0) == 0xC0)
+        return 2;
+    if ((lead & 0xF0) == 0xE0)
+        return 3;
+    if ((lead & 0xF8) == 0xF0)
+        return 4;
+    return 0;
+}
+
+/* Decodes s[0..n) and returns the number of code points, or -1. */
+static long utf8_decode(const unsigned char *s, size_t n, uint32_t *out, size_t outcap)
+{
+    size_t i = 0, k = 0;
+    while (i < n) {
+        size_t len = seq_len(s[i]);
+        if (len == 0)
+            return -1;
+#ifdef FIX
+        if (len > n - i)
+            return -1; /* truncated sequence */
+#endif
+        uint32_t cp = len == 1 ? s[i] : s[i] & (0x7Fu >> len);
+        for (size_t j = 1; j < len; j++) {
+            unsigned char c = s[i + j]; // STOP
+            if ((c & 0xC0) != 0x80)
+                return -1;
+            cp = (cp << 6) | (c & 0x3Fu);
+        }
+        if (k < outcap)
+            out[k] = cp;
+        k++;
+        i += len;
+    }
+    return (long)k;
+}
+
+static unsigned char *load(const char *bytes, size_t n)
+{
+    unsigned char *b = malloc(n ? n : 1);
+    if (b)
+        memcpy(b, bytes, n);
+    return b;
+}
+
+int main(void)
+{
+    /* The second chunk was cut in the middle of a 3-byte sequence. */
+    static const char *const chunks[] = {
+        "na\xc3\xafve caf\xc3\xa9",
+        "price \xe2\x82\xac" "5 \xe6\x97",
+    };
+    static const long expected[] = {10, -1};
+    uint32_t cps[32];
+    int ok = 1;
+    for (size_t i = 0; i < 2; i++) {
+        size_t n = strlen(chunks[i]);
+        unsigned char *buf = load(chunks[i], n);
+        if (!buf)
+            return 1;
+        long k = utf8_decode(buf, n, cps, 32);
+        printf("chunk %zu: %ld code points\n", i, k);
+        if (k != expected[i])
+            ok = 0;
+        free(buf);
+    }
+    return ok ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/15_smallvec_intra_object.c b/test/cases/detection-blind/15_smallvec_intra_object.c
new file mode 100644
index 00000000..3027ec21
--- /dev/null
+++ b/test/cases/detection-blind/15_smallvec_intra_object.c
@@ -0,0 +1,67 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Fixed-capacity vector embedded in a struct, followed by a running checksum.
+ * sv_push() rejects a push only when len > SV_CAP, so the ninth push writes
+ * items[8], which is the checksum field, and the checksum is then corrupted.
+ * Category: spatial (intra-object overflow by 4 bytes into the next field).
+ * Why it may be missed: the bad store stays inside the heap object, so
+ * allocator-level tools see nothing; the symptom is a wrong checksum later.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+
+#define SV_CAP 8
+
+struct smallvec {
+    int len;
+    int items[SV_CAP];
+    int checksum; /* sum of items, maintained on every push */
+};
+
+static int sv_push(struct smallvec *v, int x)
+{
+#ifdef FIX
+    if (v->len >= SV_CAP)
+#else
+    if (v->len > SV_CAP)
+#endif
+        return -1;
+    v->items[v->len++] = x; // STOP
+    v->checksum += x;
+    return 0;
+}
+
+static int sv_verify(const struct smallvec *v)
+{
+    int s = 0;
+    for (int i = 0; i < v->len; i++)
+        s += v->items[i];
+    return s == v->checksum;
+}
+
+int main(void)
+{
+    const char *input = "3 1 4 1 5 9 2 6 5";
+    struct smallvec *v = calloc(1, sizeof *v);
+    if (!v)
+        return 1;
+    unsigned dropped = 0;
+    const char *p = input;
+    while (*p) {
+        int x = 0;
+        while (*p == ' ')
+            p++;
+        while (*p >= '0' && *p <= '9')
+            x = x * 10 + (*p++ - '0');
+        if (sv_push(v, x) != 0)
+            dropped++;
+    }
+    int ok = sv_verify(v);
+    printf("%d readings kept, %u dropped, checksum %s\n", v->len, dropped, ok ? "ok" : "BAD");
+    free(v);
+    return ok ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/16_realloc_bytes_not_elems.c b/test/cases/detection-blind/16_realloc_bytes_not_elems.c
new file mode 100644
index 00000000..790e2e60
--- /dev/null
+++ b/test/cases/detection-blind/16_realloc_bytes_not_elems.c
@@ -0,0 +1,67 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Growable series of samples. When the series is full it grows with
+ * realloc(s->v, ncap): ncap is an element count but realloc() takes bytes,
+ * so the block holds ncap bytes instead of ncap doubles and the very first
+ * store writes 4 bytes past it.
+ * Category: spatial (heap buffer overflow, wrong allocation size).
+ * Why it may be missed: the capacity bookkeeping is consistent with itself;
+ * only the missing `* sizeof *s->v` in the realloc() call is wrong.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+
+struct series {
+    double *v;
+    size_t len;
+    size_t cap;
+};
+
+static int series_push(struct series *s, double x)
+{
+    if (s->len == s->cap) {
+        size_t ncap = s->cap ? s->cap * 2 : 4;
+#ifdef FIX
+        double *p = realloc(s->v, ncap * sizeof *s->v);
+#else
+        double *p = realloc(s->v, ncap);
+#endif
+        if (!p)
+            return -1;
+        s->v = p;
+        s->cap = ncap;
+    }
+    s->v[s->len++] = x; // STOP
+    return 0;
+}
+
+static double moving_average(const struct series *s, size_t window)
+{
+    if (window > s->len)
+        window = s->len;
+    if (window == 0)
+        return 0;
+    double sum = 0;
+    for (size_t i = s->len - window; i < s->len; i++)
+        sum += s->v[i];
+    return sum / (double)window;
+}
+
+int main(void)
+{
+    struct series s = {NULL, 0, 0};
+    for (int i = 1; i <= 10; i++) {
+        if (series_push(&s, (double)i) != 0) {
+            free(s.v);
+            return 1;
+        }
+    }
+    double avg = moving_average(&s, 4);
+    printf("moving average of the last 4: %.2f\n", avg);
+    free(s.v);
+    return avg == 8.5 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/17_letter_count_negative.c b/test/cases/detection-blind/17_letter_count_negative.c
new file mode 100644
index 00000000..72bbcbbb
--- /dev/null
+++ b/test/cases/detection-blind/17_letter_count_negative.c
@@ -0,0 +1,44 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Letter frequency counter. Letters are counted with counts[c - 'a'] after an
+ * isalpha() test, but upper-case letters are not folded first, so 'S' gives
+ * the index -14 and the increment lands before the stack array.
+ * Category: spatial (stack buffer underflow, negative index from the data).
+ * Why it may be missed: the isalpha() guard looks like the range check, and
+ * all-lower-case test sentences never produce a negative index.
+ */
+#include <ctype.h>
+#include <stdio.h>
+
+static void count_letters(const char *text, unsigned *counts)
+{
+    for (const char *p = text; *p != '\0'; p++) {
+        int c = (unsigned char)*p;
+        if (!isalpha(c))
+            continue;
+#ifdef FIX
+        c = tolower(c);
+#endif
+        counts[c - 'a']++; // STOP
+    }
+}
+
+int main(void)
+{
+    unsigned counts[26] = {0};
+    const char *text = "Sphinx of black quartz, judge my vow";
+    count_letters(text, counts);
+    int best = 0;
+    unsigned total = 0;
+    for (int i = 0; i < 26; i++) {
+        total += counts[i];
+        if (counts[i] > counts[best])
+            best = i;
+    }
+    printf("%u letters, most frequent '%c' (%u)\n", total, 'a' + best, counts[best]);
+    return total == 29 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/18_erase_memmove_count.c b/test/cases/detection-blind/18_erase_memmove_count.c
new file mode 100644
index 00000000..ae14fc98
--- /dev/null
+++ b/test/cases/detection-blind/18_erase_memmove_count.c
@@ -0,0 +1,55 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Removes negative readings from an exactly-sized heap array by shifting the
+ * tail down with memmove(). The element count passed is n - i instead of
+ * n - i - 1, so every erase reads one element past the end of the array.
+ * Category: spatial (heap buffer over-read by 4 bytes, wrong memmove length).
+ * Why it may be missed: the extra element is copied into the slot that is
+ * about to be dropped from the count, so the visible result is correct.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+static void erase_at(int *a, size_t *n, size_t i)
+{
+#ifdef FIX
+    memmove(&a[i], &a[i + 1], (*n - i - 1) * sizeof *a);
+#else
+    memmove(&a[i], &a[i + 1], (*n - i) * sizeof *a); // STOP
+#endif
+    (*n)--;
+}
+
+static size_t remove_negatives(int *a, size_t n)
+{
+    size_t i = 0;
+    while (i < n) {
+        if (a[i] < 0)
+            erase_at(a, &n, i);
+        else
+            i++;
+    }
+    return n;
+}
+
+int main(void)
+{
+    static const int input[] = {4, -1, 7, -3, -8, 2, 9, -5};
+    static const int want[] = {4, 7, 2, 9};
+    int *a = malloc(sizeof input);
+    if (!a)
+        return 1;
+    memcpy(a, input, sizeof input);
+    size_t n = remove_negatives(a, sizeof input / sizeof input[0]);
+    int ok = n == 4 && memcmp(a, want, sizeof want) == 0;
+    for (size_t i = 0; i < n; i++)
+        printf("%d ", a[i]);
+    printf("\n");
+    free(a);
+    return ok ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/19_bitmap_round_down.c b/test/cases/detection-blind/19_bitmap_round_down.c
new file mode 100644
index 00000000..da3497c6
--- /dev/null
+++ b/test/cases/detection-blind/19_bitmap_round_down.c
@@ -0,0 +1,61 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Sieve of Eratosthenes over a heap bitmap. bm_init() allocates nbits / 8
+ * bytes, which rounds down: for 100 bits it allocates 12 bytes, and marking
+ * any of bits 96..99 writes the 13th byte, one past the block.
+ * Category: spatial (heap buffer overflow by 1 byte).
+ * Why it may be missed: the bitmap works for every multiple of 8 bits, and
+ * bm_set() checks its index against nbits, which looks like a full guard.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+
+struct bitmap {
+    unsigned char *bits;
+    size_t nbits;
+};
+
+static int bm_init(struct bitmap *b, size_t nbits)
+{
+#ifdef FIX
+    b->bits = calloc((nbits + 7) / 8, 1);
+#else
+    b->bits = calloc(nbits / 8, 1);
+#endif
+    b->nbits = nbits;
+    return b->bits ? 0 : -1;
+}
+
+static void bm_set(struct bitmap *b, size_t i)
+{
+    if (i < b->nbits)
+        b->bits[i / 8] |= (unsigned char)(1u << (i % 8)); // STOP
+}
+
+static int bm_test(const struct bitmap *b, size_t i)
+{
+    return i < b->nbits && ((b->bits[i / 8] >> (i % 8)) & 1);
+}
+
+int main(void)
+{
+    enum { N = 100 };
+    struct bitmap composite;
+    if (bm_init(&composite, N) != 0)
+        return 1;
+    for (size_t p = 2; p * p < N; p++)
+        if (!bm_test(&composite, p))
+            for (size_t m = p * p; m < N; m += p)
+                bm_set(&composite, m);
+    unsigned primes = 0;
+    for (size_t i = 2; i < N; i++)
+        if (!bm_test(&composite, i))
+            primes++;
+    free(composite.bits);
+    printf("%u primes below %d\n", primes, N);
+    return primes == 25 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/20_list_purge_next.c b/test/cases/detection-blind/20_list_purge_next.c
new file mode 100644
index 00000000..3444746c
--- /dev/null
+++ b/test/cases/detection-blind/20_list_purge_next.c
@@ -0,0 +1,71 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Purges idle sessions from a singly linked list. The loop frees a node in
+ * its body and then the for-loop increment reads s->next from the node it
+ * has just freed.
+ * Category: temporal (heap use-after-free).
+ * Why it may be missed: the read of the freed node hides in the for-header
+ * increment, and the unlinking in the body is otherwise correct.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+
+struct session {
+    int id;
+    unsigned last_seen;
+    struct session *next;
+};
+
+static struct session *session_add(struct session *head, int id, unsigned last_seen)
+{
+    struct session *s = malloc(sizeof *s);
+    if (!s)
+        return head;
+    s->id = id;
+    s->last_seen = last_seen;
+    s->next = head;
+    return s;
+}
+
+static unsigned purge_idle(struct session **head, unsigned now, unsigned timeout)
+{
+    struct session **link = head;
+    unsigned purged = 0;
+#ifdef FIX
+    for (struct session *s = *head, *next; s; s = next) {
+        next = s->next;
+#else
+    for (struct session *s = *head; s; s = s->next) { // STOP
+#endif
+        if (now - s->last_seen > timeout) {
+            *link = s->next;
+            free(s);
+            purged++;
+        } else {
+            link = &s->next;
+        }
+    }
+    return purged;
+}
+
+int main(void)
+{
+    static const unsigned seen[] = {99, 10, 95, 20, 100};
+    struct session *head = NULL;
+    for (int i = 0; i < 5; i++)
+        head = session_add(head, i, seen[i]);
+    unsigned purged = purge_idle(&head, 100, 30);
+    unsigned left = 0;
+    while (head) {
+        struct session *next = head->next;
+        printf("session %d active\n", head->id);
+        free(head);
+        head = next;
+        left++;
+    }
+    return purged == 2 && left == 3 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/21_symtab_stale_pointer.c b/test/cases/detection-blind/21_symtab_stale_pointer.c
new file mode 100644
index 00000000..63b3e99b
--- /dev/null
+++ b/test/cases/detection-blind/21_symtab_stale_pointer.c
@@ -0,0 +1,97 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Symbol table stored in a growable array, with references that point
+ * directly at table entries. Interning a new symbol may realloc() the array,
+ * which leaves the earlier references pointing into the freed old block;
+ * the use count is then bumped through them.
+ * Category: temporal (heap use-after-free via pointers into a reallocated
+ * container).
+ * Why it may be missed: the pointers are taken and used in different loops,
+ * and the realloc() is inside intern(), out of sight of both.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct symbol {
+    char name[16];
+    int value;
+    unsigned uses;
+};
+
+struct symtab {
+    struct symbol *syms;
+    size_t len;
+    size_t cap;
+};
+
+/* Returns the index of name, adding it if needed; (size_t)-1 on failure. */
+static size_t intern(struct symtab *t, const char *name)
+{
+    for (size_t i = 0; i < t->len; i++)
+        if (strcmp(t->syms[i].name, name) == 0)
+            return i;
+    if (t->len == t->cap) {
+        size_t ncap = t->cap ? t->cap * 2 : 2;
+        struct symbol *p = realloc(t->syms, ncap * sizeof *p);
+        if (!p)
+            return (size_t)-1;
+        t->syms = p;
+        t->cap = ncap;
+    }
+    struct symbol *s = &t->syms[t->len];
+    snprintf(s->name, sizeof s->name, "%s", name);
+    s->value = 0;
+    s->uses = 0;
+    return t->len++;
+}
+
+struct ref {
+#ifdef FIX
+    size_t sym; /* index: stays valid when the table grows */
+#else
+    struct symbol *sym; /* direct pointer for fast access */
+#endif
+};
+
+int main(void)
+{
+    /* Statements "dst = src", as name pairs. */
+    static const char *const stmts[][2] = {
+        {"a", "b"}, {"c", "a"}, {"d", "c"}, {"e", "b"}, {"f", "e"},
+    };
+    struct symtab t = {NULL, 0, 0};
+    struct ref refs[10];
+    size_t nrefs = 0;
+    for (size_t i = 0; i < 5; i++) {
+        for (size_t k = 0; k < 2; k++) {
+            size_t idx = intern(&t, stmts[i][k]);
+            if (idx == (size_t)-1) {
+                free(t.syms);
+                return 1;
+            }
+#ifdef FIX
+            refs[nrefs++].sym = idx;
+#else
+            refs[nrefs++].sym = &t.syms[idx];
+#endif
+        }
+    }
+    for (size_t k = 0; k < nrefs; k++)
+#ifdef FIX
+        t.syms[refs[k].sym].uses++;
+#else
+        refs[k].sym->uses++; // STOP
+#endif
+    unsigned total = 0;
+    for (size_t i = 0; i < t.len; i++) {
+        printf("%s: %u uses\n", t.syms[i].name, t.syms[i].uses);
+        total += t.syms[i].uses;
+    }
+    free(t.syms);
+    return total == nrefs && t.len == 6 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/22_label_out_param_stack.c b/test/cases/detection-blind/22_label_out_param_stack.c
new file mode 100644
index 00000000..7e18c7e6
--- /dev/null
+++ b/test/cases/detection-blind/22_label_out_param_stack.c
@@ -0,0 +1,56 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * make_label() formats a label into a local buffer and stores a pointer to
+ * that buffer in the caller's struct. Once make_label() returns, the label
+ * points into a dead stack frame, which the next call reuses.
+ * Category: temporal (stack use after return, through an out-parameter).
+ * Why it may be missed: compilers warn about `return buf;` but not about
+ * storing &buf through a pointer parameter, and the code reads naturally.
+ */
+#include <stdio.h>
+#include <string.h>
+
+struct label {
+    const char *text;
+    int width;
+#ifdef FIX
+    char storage[32];
+#endif
+};
+
+static void make_label(struct label *l, const char *prefix, unsigned id)
+{
+#ifdef FIX
+    char *buf = l->storage;
+    size_t cap = sizeof l->storage;
+#else
+    char tmp[32];
+    char *buf = tmp;
+    size_t cap = sizeof tmp;
+#endif
+    int w = snprintf(buf, cap, "%s-%04u", prefix, id);
+    l->text = buf;
+    l->width = w < 0 ? 0 : w;
+}
+
+int main(void)
+{
+    static const char *const want[] = {"disk-0007", "net-0042", "cpu-0003"};
+    struct label labels[3];
+    make_label(&labels[0], "disk", 7);
+    make_label(&labels[1], "net", 42);
+    make_label(&labels[2], "cpu", 3);
+    size_t total = 0;
+    int ok = 1;
+    for (int i = 0; i < 3; i++) {
+        total += strlen(labels[i].text); // STOP // MISS: a stack object is untracked once its scope ends (RFC 0032 §4): use after return
+        if (strcmp(labels[i].text, want[i]) != 0)
+            ok = 0;
+    }
+    printf("%zu label characters\n", total);
+    return ok && total == 25 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/23_callback_ctx_freed.c b/test/cases/detection-blind/23_callback_ctx_freed.c
new file mode 100644
index 00000000..7f9eabb9
--- /dev/null
+++ b/test/cases/detection-blind/23_callback_ctx_freed.c
@@ -0,0 +1,105 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Message bus with a callback registry. Each session subscribes a callback
+ * with itself as the context. session_close() frees the session but leaves
+ * its subscription in place, so the next broadcast calls the callback with
+ * a dangling context, which updates the freed session.
+ * Category: temporal (heap use-after-free through a callback context).
+ * Why it may be missed: the free and the use are in unrelated functions, and
+ * the only link between them is a void * stored in a global table.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+typedef void (*handler_fn)(void *ctx, const char *msg);
+
+struct listener {
+    handler_fn fn;
+    void *ctx;
+    int active;
+};
+
+#define MAX_LISTENERS 8
+static struct listener listeners[MAX_LISTENERS];
+
+static int subscribe(handler_fn fn, void *ctx)
+{
+    for (int i = 0; i < MAX_LISTENERS; i++) {
+        if (!listeners[i].active) {
+            listeners[i].fn = fn;
+            listeners[i].ctx = ctx;
+            listeners[i].active = 1;
+            return i;
+        }
+    }
+    return -1;
+}
+
+static void unsubscribe(int id)
+{
+    if (id >= 0 && id < MAX_LISTENERS)
+        listeners[id].active = 0;
+}
+
+static void publish(const char *msg)
+{
+    for (int i = 0; i < MAX_LISTENERS; i++)
+        if (listeners[i].active)
+            listeners[i].fn(listeners[i].ctx, msg);
+}
+
+struct session {
+    char user[16];
+    size_t bytes_seen;
+    int sub;
+};
+
+static void on_broadcast(void *ctx, const char *msg)
+{
+    struct session *s = ctx;
+    s->bytes_seen += strlen(msg); // STOP
+}
+
+static struct session *session_open(const char *user)
+{
+    struct session *s = calloc(1, sizeof *s);
+    if (!s)
+        return NULL;
+    snprintf(s->user, sizeof s->user, "%s", user);
+    s->sub = subscribe(on_broadcast, s);
+    if (s->sub < 0) {
+        free(s);
+        return NULL;
+    }
+    return s;
+}
+
+static void session_close(struct session *s)
+{
+#ifdef FIX
+    unsubscribe(s->sub);
+#endif
+    free(s);
+}
+
+int main(void)
+{
+    struct session *a = session_open("alice");
+    struct session *b = session_open("bob");
+    if (!a || !b)
+        return 1;
+    publish("server restarting");
+    session_close(a);
+    publish("back online");
+    size_t seen = b->bytes_seen;
+    printf("%s saw %zu bytes\n", b->user, seen);
+    session_close(b);
+    for (int i = 0; i < MAX_LISTENERS; i++) /* tear down the bus */
+        unsubscribe(i);
+    return seen == 28 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/24_lru_evicted_value.c b/test/cases/detection-blind/24_lru_evicted_value.c
new file mode 100644
index 00000000..0ce969fc
--- /dev/null
+++ b/test/cases/detection-blind/24_lru_evicted_value.c
@@ -0,0 +1,101 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Two-entry LRU cache whose get() returns a pointer into the cache entry.
+ * The caller keeps two such pointers and then inserts a third key, which
+ * evicts (frees) the least recently used entry; formatting the response then
+ * reads the evicted entry's value.
+ * Category: temporal (heap use-after-free through a borrowed pointer into a
+ * container).
+ * Why it may be missed: the eviction is a side effect of put(), and which
+ * entry it frees depends on the access order a few lines earlier.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct entry {
+    int key;
+    char value[24];
+    struct entry *prev, *next;
+};
+
+struct cache {
+    struct entry *head, *tail; /* head = most recently used */
+    size_t len, cap;
+};
+
+static void unlink_entry(struct cache *c, struct entry *e)
+{
+    if (e->prev) e->prev->next = e->next; else c->head = e->next;
+    if (e->next) e->next->prev = e->prev; else c->tail = e->prev;
+    e->prev = e->next = NULL;
+}
+
+static void push_front(struct cache *c, struct entry *e)
+{
+    e->prev = NULL;
+    e->next = c->head;
+    if (c->head) c->head->prev = e; else c->tail = e;
+    c->head = e;
+}
+
+/* Returns the cached value; valid while the entry stays in the cache. */
+static const char *cache_get(struct cache *c, int key)
+{
+    for (struct entry *e = c->head; e; e = e->next) {
+        if (e->key == key) {
+            unlink_entry(c, e);
+            push_front(c, e);
+            return e->value;
+        }
+    }
+    return NULL;
+}
+
+static int cache_put(struct cache *c, int key, const char *value)
+{
+    if (c->len == c->cap) {
+        struct entry *old = c->tail;
+        unlink_entry(c, old);
+        free(old);
+        c->len--;
+    }
+    struct entry *e = malloc(sizeof *e);
+    if (!e)
+        return -1;
+    e->key = key;
+    snprintf(e->value, sizeof e->value, "%s", value);
+    push_front(c, e);
+    c->len++;
+    return 0;
+}
+
+int main(void)
+{
+    struct cache c = {NULL, NULL, 0, 2};
+    if (cache_put(&c, 1, "alpha") != 0 || cache_put(&c, 2, "beta") != 0)
+        return 1;
+#ifdef FIX
+    char first[24], second[24];
+    snprintf(first, sizeof first, "%s", cache_get(&c, 1));
+    snprintf(second, sizeof second, "%s", cache_get(&c, 2));
+#else
+    const char *first = cache_get(&c, 1);
+    const char *second = cache_get(&c, 2);
+#endif
+    if (cache_put(&c, 3, "gamma") != 0) /* fill the miss for key 3 */
+        return 1;
+    char line[64];
+    snprintf(line, sizeof line, "%s,%s", first, second); // STOP
+    printf("%s\n", line);
+    while (c.head) {
+        struct entry *e = c.head;
+        unlink_entry(&c, e);
+        free(e);
+    }
+    return strcmp(line, "alpha,beta") == 0 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/25_hashmap_iter_rehash.c b/test/cases/detection-blind/25_hashmap_iter_rehash.c
new file mode 100644
index 00000000..0a332f06
--- /dev/null
+++ b/test/cases/detection-blind/25_hashmap_iter_rehash.c
@@ -0,0 +1,155 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Chained hash map with an iterator that caches the bucket array. Adding a
+ * backup entry for every key while iterating grows the map, which frees the
+ * old bucket array; the iterator then reads its next bucket from it.
+ * Category: temporal (heap use-after-free, iterator invalidation).
+ * Why it may be missed: the nodes themselves survive the rehash, so the
+ * iteration appears to work until the iterator moves to its next bucket.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct node {
+    char key[16];
+    int val;
+    struct node *next;
+};
+
+struct map {
+    struct node **buckets;
+    size_t nb;
+    size_t len;
+};
+
+struct iter {
+    struct node **buckets;
+    size_t nb;
+    size_t idx;
+    struct node *cur;
+};
+
+static size_t hash(const char *s)
+{
+    size_t h = 5381;
+    while (*s)
+        h = h * 33u + (unsigned char)*s++;
+    return h;
+}
+
+static int map_resize(struct map *m)
+{
+    size_t nb = m->nb * 2;
+    struct node **nbk = calloc(nb, sizeof *nbk);
+    if (!nbk)
+        return -1;
+    for (size_t i = 0; i < m->nb; i++) {
+        for (struct node *n = m->buckets[i], *next; n; n = next) {
+            next = n->next;
+            size_t b = hash(n->key) % nb;
+            n->next = nbk[b];
+            nbk[b] = n;
+        }
+    }
+    free(m->buckets);
+    m->buckets = nbk;
+    m->nb = nb;
+    return 0;
+}
+
+static int map_put(struct map *m, const char *key, int val)
+{
+    size_t b = hash(key) % m->nb;
+    for (struct node *n = m->buckets[b]; n; n = n->next)
+        if (strcmp(n->key, key) == 0) {
+            n->val = val;
+            return 0;
+        }
+    if (m->len + 1 > m->nb) {
+        if (map_resize(m) != 0)
+            return -1;
+        b = hash(key) % m->nb;
+    }
+    struct node *n = malloc(sizeof *n);
+    if (!n)
+        return -1;
+    snprintf(n->key, sizeof n->key, "%s", key);
+    n->val = val;
+    n->next = m->buckets[b];
+    m->buckets[b] = n;
+    m->len++;
+    return 0;
+}
+
+static void iter_init(struct iter *it, const struct map *m)
+{
+    *it = (struct iter){m->buckets, m->nb, 0, NULL};
+}
+
+static struct node *iter_next(struct iter *it)
+{
+    if (it->cur)
+        it->cur = it->cur->next;
+    while (!it->cur && it->idx < it->nb)
+        it->cur = it->buckets[it->idx++]; // STOP
+    return it->cur;
+}
+
+static int is_backup(const char *key)
+{
+    size_t n = strlen(key);
+    return n >= 4 && strcmp(key + n - 4, "_bak") == 0;
+}
+
+int main(void)
+{
+    static const char *const names[] = {"alpha", "beta", "gamma", "delta", "eps", "zeta"};
+    struct map m = {calloc(8, sizeof(struct node *)), 8, 0};
+    if (!m.buckets)
+        return 1;
+    for (int i = 0; i < 6; i++)
+        if (map_put(&m, names[i], i) != 0)
+            return 1;
+    struct iter it;
+    char bak[16];
+#ifdef FIX
+    char keys[16][16];
+    int vals[16];
+    size_t nk = 0;
+    iter_init(&it, &m);
+    for (struct node *n = iter_next(&it); n && nk < 16; n = iter_next(&it)) {
+        if (is_backup(n->key))
+            continue;
+        snprintf(keys[nk], sizeof keys[nk], "%s", n->key);
+        vals[nk++] = n->val;
+    }
+    for (size_t k = 0; k < nk; k++) {
+        snprintf(bak, sizeof bak, "%s_bak", keys[k]);
+        if (map_put(&m, bak, vals[k]) != 0)
+            return 1;
+    }
+#else
+    iter_init(&it, &m);
+    for (struct node *n = iter_next(&it); n; n = iter_next(&it)) {
+        if (is_backup(n->key))
+            continue;
+        snprintf(bak, sizeof bak, "%s_bak", n->key);
+        if (map_put(&m, bak, n->val) != 0)
+            return 1;
+    }
+#endif
+    size_t len = m.len;
+    for (size_t i = 0; i < m.nb; i++)
+        for (struct node *n = m.buckets[i], *next; n; n = next) {
+            next = n->next;
+            free(n);
+        }
+    free(m.buckets);
+    printf("%zu entries\n", len);
+    return len == 12 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/26_arena_reset_stale.c b/test/cases/detection-blind/26_arena_reset_stale.c
new file mode 100644
index 00000000..2e5724e4
--- /dev/null
+++ b/test/cases/detection-blind/26_arena_reset_stale.c
@@ -0,0 +1,104 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * HTTP-ish request handler whose strings live in a per-request arena that is
+ * reset between requests. The connection remembers the Host of its first
+ * request by keeping the arena pointer, so from the second request on it
+ * compares against memory that the arena has handed out again.
+ * Category: temporal (use of a stale pointer into a recycled arena block).
+ * Why it may be missed: the arena's backing block is never freed, so the
+ * pointer stays "valid" to the allocator; only the arena's reset ends it.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct arena {
+    char *base;
+    size_t size;
+    size_t used;
+};
+
+static void *arena_alloc(struct arena *a, size_t n)
+{
+    n = (n + 7) & ~(size_t)7;
+    if (n > a->size - a->used)
+        return NULL;
+    void *p = a->base + a->used;
+    a->used += n;
+    return p;
+}
+
+static void arena_reset(struct arena *a) { a->used = 0; }
+
+static char *arena_strndup(struct arena *a, const char *s, size_t n)
+{
+    char *p = arena_alloc(a, n + 1);
+    if (p) {
+        memcpy(p, s, n);
+        p[n] = '\0';
+    }
+    return p;
+}
+
+struct conn {
+    const char *host; /* Host of the first request; later ones must match */
+#ifdef FIX
+    char host_buf[64];
+#endif
+    unsigned served;
+};
+
+/* Parses "METHOD PATH\nHost: name\n"; all strings go into the arena. */
+static int handle_request(struct arena *a, struct conn *c, const char *raw)
+{
+    const char *nl = strchr(raw, '\n');
+    if (!nl)
+        return -1;
+    char *reqline = arena_strndup(a, raw, (size_t)(nl - raw));
+    const char *h = strstr(nl + 1, "Host: ");
+    if (!reqline || !h)
+        return -1;
+    h += 6;
+    char *host = arena_strndup(a, h, strcspn(h, "\n"));
+    if (!host)
+        return -1;
+    if (!c->host) {
+#ifdef FIX
+        snprintf(c->host_buf, sizeof c->host_buf, "%s", host);
+        c->host = c->host_buf;
+#else
+        c->host = host;
+#endif
+    } else if (strcmp(c->host, host) != 0) { // STOP // MISS: the application's arena keeps its block allocated, so a stale pointer into it reads live memory
+        fprintf(stderr, "host mismatch on '%s'\n", reqline);
+        return -1;
+    }
+    c->served++;
+    return 0;
+}
+
+int main(void)
+{
+    static const char *const reqs[] = {
+        "GET /index.html\nHost: example.org\n",
+        "GET /assets/style.css\nHost: example.org\n",
+        "GET /logo.png\nHost: example.org\n",
+    };
+    struct arena a = {malloc(256), 256, 0};
+    struct conn c = {0};
+    if (!a.base)
+        return 1;
+    int failed = 0;
+    for (size_t i = 0; i < 3; i++) {
+        arena_reset(&a);
+        if (handle_request(&a, &c, reqs[i]) != 0)
+            failed++;
+    }
+    printf("served %u requests\n", c.served);
+    free(a.base);
+    return failed == 0 && c.served == 3 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/27_config_reload_dangling.c b/test/cases/detection-blind/27_config_reload_dangling.c
new file mode 100644
index 00000000..d7099bdb
--- /dev/null
+++ b/test/cases/detection-blind/27_config_reload_dangling.c
@@ -0,0 +1,94 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Configuration reload. config_reload() clears the old configuration (which
+ * frees its strings) before parsing the new text; when parsing fails, the
+ * error message reports the old host through the pointer it just freed.
+ * Category: temporal (heap use-after-free across a helper function).
+ * Why it may be missed: config_clear() reads as a harmless reset, and the
+ * free happens inside it, two calls away from the use on the error path.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct config {
+    char *host;
+    char *user;
+    unsigned port;
+};
+
+static char *dupstr(const char *s)
+{
+    size_t n = strlen(s) + 1;
+    char *p = malloc(n);
+    if (p)
+        memcpy(p, s, n);
+    return p;
+}
+
+static void config_clear(struct config *c)
+{
+    free(c->host);
+    free(c->user);
+    c->port = 0;
+}
+
+/* Parses "host user port"; leaves c untouched on error. */
+static int config_parse(struct config *c, const char *text)
+{
+    char host[64], user[32];
+    unsigned port;
+    if (sscanf(text, "%63s %31s %u", host, user, &port) != 3 || port == 0 || port > 65535)
+        return -1;
+    char *h = dupstr(host), *u = dupstr(user);
+    if (!h || !u) {
+        free(h);
+        free(u);
+        return -1;
+    }
+    c->host = h;
+    c->user = u;
+    c->port = port;
+    return 0;
+}
+
+static int config_reload(struct config *c, const char *text)
+{
+#ifdef FIX
+    struct config fresh = {NULL, NULL, 0};
+    if (config_parse(&fresh, text) != 0) {
+        fprintf(stderr, "reload failed, keeping %s\n", c->host);
+        return -1;
+    }
+    config_clear(c);
+    *c = fresh;
+    return 0;
+#else
+    config_clear(c);
+    if (config_parse(c, text) != 0) {
+        fprintf(stderr, "reload failed, keeping %s\n", c->host); // STOP
+        return -1;
+    }
+    return 0;
+#endif
+}
+
+int main(void)
+{
+    struct config c = {NULL, NULL, 0};
+    if (config_parse(&c, "db.internal admin 5432") != 0)
+        return 1;
+    int failures = 0;
+    if (config_reload(&c, "db2.internal admin") != 0) /* port missing */
+        failures++;
+    if (config_reload(&c, "db3.internal ops 6432") != 0)
+        failures++;
+    printf("%s@%s:%u\n", c.user, c.host, c.port);
+    int ok = failures == 1 && strcmp(c.host, "db3.internal") == 0 && c.port == 6432;
+    config_clear(&c);
+    return ok ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/28_refcount_borrowed_unref.c b/test/cases/detection-blind/28_refcount_borrowed_unref.c
new file mode 100644
index 00000000..120a87b2
--- /dev/null
+++ b/test/cases/detection-blind/28_refcount_borrowed_unref.c
@@ -0,0 +1,100 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Reference-counted message buffers. audit() only borrows the buffer, but it
+ * ends with buf_unref() as if it owned a reference. For audited messages the
+ * count drops to zero and the buffer is freed; the caller then hands it to
+ * the output queue, whose buf_ref() touches the freed buffer.
+ * Category: temporal (heap use-after-free through a reference-count error).
+ * Why it may be missed: each function looks balanced on its own; the extra
+ * unref only matters for the messages that audit() is called on.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct buf {
+    int refs;
+    size_t len;
+    char data[48];
+};
+
+static struct buf *buf_new(const char *s)
+{
+    struct buf *b = malloc(sizeof *b);
+    if (!b)
+        return NULL;
+    b->refs = 1;
+    snprintf(b->data, sizeof b->data, "%s", s);
+    b->len = strlen(b->data);
+    return b;
+}
+
+static void buf_ref(struct buf *b)
+{
+    b->refs++; // STOP // MISS: a callee's parameter is assumed live (A1); the liveness of the caller's argument at the call is not guarded
+}
+
+static void buf_unref(struct buf *b)
+{
+    if (--b->refs == 0)
+        free(b);
+}
+
+struct outq {
+    struct buf *items[8];
+    size_t len;
+};
+
+static int outq_push(struct outq *q, struct buf *b)
+{
+    if (q->len == 8)
+        return -1;
+    buf_ref(b);
+    q->items[q->len++] = b;
+    return 0;
+}
+
+static size_t outq_drain(struct outq *q)
+{
+    size_t total = 0;
+    for (size_t i = 0; i < q->len; i++) {
+        total += q->items[i]->len;
+        buf_unref(q->items[i]);
+    }
+    q->len = 0;
+    return total;
+}
+
+static size_t audited_bytes;
+
+/* Records a message in the audit log. Borrows b. */
+static void audit(struct buf *b)
+{
+    audited_bytes += b->len;
+#ifndef FIX
+    buf_unref(b); /* done with it */
+#endif
+}
+
+int main(void)
+{
+    static const char *const msgs[] = {"HELO relay", "MAIL FROM:<ops@example.org>", "QUIT"};
+    struct outq q = {{NULL}, 0};
+    for (size_t i = 0; i < 3; i++) {
+        struct buf *b = buf_new(msgs[i]);
+        if (!b)
+            return 1;
+        if (strncmp(b->data, "MAIL", 4) == 0)
+            audit(b);
+        if (outq_push(&q, b) != 0)
+            return 1;
+        buf_unref(b);
+    }
+    size_t sent = outq_drain(&q);
+    printf("sent %zu bytes, audited %zu\n", sent, audited_bytes);
+    return sent == 41 && audited_bytes == 27 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/29_global_ctx_stack.c b/test/cases/detection-blind/29_global_ctx_stack.c
new file mode 100644
index 00000000..4ec07973
--- /dev/null
+++ b/test/cases/detection-blind/29_global_ctx_stack.c
@@ -0,0 +1,78 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Parser that publishes its stack-allocated context in a global so that deep
+ * helpers can prefix warnings with file and line. parse_buffer() returns
+ * without clearing the global, and a later validation warning reads the
+ * context of the dead frame.
+ * Category: temporal (stack use after return, through a global pointer).
+ * Why it may be missed: warn() checks the global for NULL, which looks like
+ * proper lifetime handling; the dangling case is a non-NULL stale pointer.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct parse_ctx {
+    const char *file;
+    unsigned line;
+};
+
+static struct parse_ctx *g_ctx; /* set while a parse is running */
+static unsigned g_warnings;
+
+static void warn(const char *msg)
+{
+    g_warnings++;
+    if (g_ctx)
+        fprintf(stderr, "%s:%u: warning: %s\n", g_ctx->file, g_ctx->line, msg); // STOP // MISS: a stack object is untracked once its scope ends (RFC 0032 §4): use after return
+    else
+        fprintf(stderr, "warning: %s\n", msg);
+}
+
+struct totals {
+    unsigned records;
+    unsigned empty;
+    long sum;
+};
+
+static void parse_buffer(const char *name, const char *text, struct totals *t)
+{
+    struct parse_ctx ctx = {name, 1};
+    g_ctx = &ctx;
+    const char *p = text;
+    while (*p) {
+        const char *nl = strchr(p, '\n');
+        size_t n = nl ? (size_t)(nl - p) : strlen(p);
+        if (n == 0) {
+            t->empty++;
+            warn("empty record");
+        } else {
+            t->records++;
+            t->sum += strtol(p, NULL, 10);
+        }
+        p += n + (nl ? 1 : 0);
+        ctx.line++;
+    }
+#ifdef FIX
+    g_ctx = NULL;
+#endif
+}
+
+static void check_totals(const struct totals *t)
+{
+    if (t->empty > 0)
+        warn("input contained empty records");
+}
+
+int main(void)
+{
+    struct totals t = {0, 0, 0};
+    parse_buffer("data.txt", "10\n20\n\n30\n", &t);
+    check_totals(&t);
+    printf("%u records, sum %ld, %u warnings\n", t.records, t.sum, g_warnings);
+    return t.records == 3 && t.sum == 60 && g_warnings == 2 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/30_queue_pop_name.c b/test/cases/detection-blind/30_queue_pop_name.c
new file mode 100644
index 00000000..e1c97b30
--- /dev/null
+++ b/test/cases/detection-blind/30_queue_pop_name.c
@@ -0,0 +1,86 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Job queue whose pop() returns the job's name, documented as valid until
+ * the next pop. The implementation frees the node right away, so the name
+ * the caller receives points into freed memory from the start.
+ * Category: temporal (heap use-after-free, pointer into a freed node
+ * returned across a function boundary).
+ * Why it may be missed: pop() itself never reads the node after free(); it
+ * only computes the address, and the read happens in the caller.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct job {
+    char name[24];
+    int prio;
+    struct job *next;
+};
+
+struct jobq {
+    struct job *head, *tail;
+#ifdef FIX
+    struct job *last; /* node of the last pop, kept until the next one */
+#endif
+};
+
+static int jobq_push(struct jobq *q, const char *name, int prio)
+{
+    struct job *j = malloc(sizeof *j);
+    if (!j)
+        return -1;
+    snprintf(j->name, sizeof j->name, "%s", name);
+    j->prio = prio;
+    j->next = NULL;
+    if (q->tail)
+        q->tail->next = j;
+    else
+        q->head = j;
+    q->tail = j;
+    return 0;
+}
+
+/* Returns the next job's name; it stays valid until the next call. */
+static const char *jobq_pop(struct jobq *q)
+{
+    struct job *j = q->head;
+    if (!j)
+        return NULL;
+    q->head = j->next;
+    if (!q->head)
+        q->tail = NULL;
+#ifdef FIX
+    free(q->last);
+    q->last = j;
+#else
+    free(j);
+#endif
+    return j->name;
+}
+
+int main(void)
+{
+    static const char *const jobs[] = {"compile", "link", "test", "package"};
+    struct jobq q = {0};
+    for (int i = 0; i < 4; i++)
+        if (jobq_push(&q, jobs[i], i) != 0)
+            return 1;
+    size_t total = 0;
+    unsigned tests = 0;
+    const char *name;
+    while ((name = jobq_pop(&q)) != NULL) {
+        total += strlen(name); // STOP
+        if (strcmp(name, "test") == 0)
+            tests++;
+    }
+#ifdef FIX
+    free(q.last);
+#endif
+    printf("%zu characters, %u test jobs\n", total, tests);
+    return total == 22 && tests == 1 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/31_bst_delete_successor.c b/test/cases/detection-blind/31_bst_delete_successor.c
new file mode 100644
index 00000000..d6a59ad0
--- /dev/null
+++ b/test/cases/detection-blind/31_bst_delete_successor.c
@@ -0,0 +1,103 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Binary search tree deletion. For a node with two children it finds the
+ * in-order successor, deletes the successor from the right subtree (which
+ * frees it), and only then copies the successor's key into the node.
+ * Category: temporal (heap use-after-free, statement order).
+ * Why it may be missed: the two statements are each correct; swapping them
+ * is the whole fix, and the recursive call hides that it frees succ.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+
+struct node {
+    int key;
+    struct node *left, *right;
+};
+
+static struct node *bst_insert(struct node *root, int key)
+{
+    if (!root) {
+        struct node *n = malloc(sizeof *n);
+        if (n) {
+            n->key = key;
+            n->left = n->right = NULL;
+        }
+        return n;
+    }
+    if (key < root->key)
+        root->left = bst_insert(root->left, key);
+    else if (key > root->key)
+        root->right = bst_insert(root->right, key);
+    return root;
+}
+
+static struct node *bst_delete(struct node *root, int key)
+{
+    if (!root)
+        return NULL;
+    if (key < root->key) {
+        root->left = bst_delete(root->left, key);
+    } else if (key > root->key) {
+        root->right = bst_delete(root->right, key);
+    } else if (!root->left || !root->right) {
+        struct node *child = root->left ? root->left : root->right;
+        free(root);
+        return child;
+    } else {
+        struct node *succ = root->right;
+        while (succ->left)
+            succ = succ->left;
+#ifdef FIX
+        root->key = succ->key;
+        root->right = bst_delete(root->right, succ->key);
+#else
+        root->right = bst_delete(root->right, succ->key);
+        root->key = succ->key; // STOP
+#endif
+    }
+    return root;
+}
+
+static size_t inorder(const struct node *n, int *out, size_t k)
+{
+    if (!n)
+        return k;
+    k = inorder(n->left, out, k);
+    out[k++] = n->key;
+    return inorder(n->right, out, k);
+}
+
+static void bst_free(struct node *n)
+{
+    if (n) {
+        bst_free(n->left);
+        bst_free(n->right);
+        free(n);
+    }
+}
+
+int main(void)
+{
+    static const int keys[] = {50, 30, 70, 20, 40, 60, 80};
+    static const int want[] = {30, 40, 60, 70, 80};
+    struct node *root = NULL;
+    for (size_t i = 0; i < 7; i++)
+        root = bst_insert(root, keys[i]);
+    root = bst_delete(root, 20); /* leaf */
+    root = bst_delete(root, 50); /* two children */
+    int out[8];
+    size_t n = inorder(root, out, 0);
+    int ok = n == 5;
+    for (size_t i = 0; ok && i < n; i++)
+        ok = out[i] == want[i];
+    for (size_t i = 0; i < n; i++)
+        printf("%d ", out[i]);
+    printf("\n");
+    bst_free(root);
+    return ok ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/32_timer_cancel_in_callback.c b/test/cases/detection-blind/32_timer_cancel_in_callback.c
new file mode 100644
index 00000000..643b5685
--- /dev/null
+++ b/test/cases/detection-blind/32_timer_cancel_in_callback.c
@@ -0,0 +1,97 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Event loop with a list of timers. A one-shot timeout callback cancels its
+ * own timer, which unlinks and frees it; when the callback returns, the loop
+ * advances with t->next read from the freed timer.
+ * Category: temporal (heap use-after-free, free inside a callback).
+ * Why it may be missed: run_due() never frees anything itself; the free is
+ * in a callback reached through a function pointer.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+
+struct loop;
+
+struct timer {
+    unsigned due;
+    unsigned period;
+    void (*fire)(struct loop *, struct timer *);
+    struct timer *next;
+};
+
+struct loop {
+    struct timer *timers;
+    unsigned now;
+    unsigned ticks;
+};
+
+static struct timer *timer_add(struct loop *l, unsigned due, unsigned period,
+                               void (*fire)(struct loop *, struct timer *))
+{
+    struct timer *t = malloc(sizeof *t);
+    if (!t)
+        return NULL;
+    t->due = due;
+    t->period = period;
+    t->fire = fire;
+    t->next = l->timers;
+    l->timers = t;
+    return t;
+}
+
+static void timer_cancel(struct loop *l, struct timer *t)
+{
+    for (struct timer **p = &l->timers; *p; p = &(*p)->next) {
+        if (*p == t) {
+            *p = t->next;
+            free(t);
+            return;
+        }
+    }
+}
+
+static void on_heartbeat(struct loop *l, struct timer *t)
+{
+    l->ticks++;
+    t->due += t->period;
+}
+
+static void on_timeout(struct loop *l, struct timer *t)
+{
+    l->ticks += 10;
+    timer_cancel(l, t); /* one-shot */
+}
+
+static void run_due(struct loop *l)
+{
+    struct timer *t = l->timers;
+    while (t) {
+#ifdef FIX
+        struct timer *next = t->next;
+#endif
+        if (t->due <= l->now)
+            t->fire(l, t);
+#ifdef FIX
+        t = next;
+#else
+        t = t->next; // STOP
+#endif
+    }
+}
+
+int main(void)
+{
+    struct loop l = {NULL, 0, 0};
+    if (!timer_add(&l, 1, 1, on_heartbeat) || !timer_add(&l, 3, 0, on_timeout))
+        return 1;
+    for (l.now = 1; l.now <= 5; l.now++)
+        run_due(&l);
+    while (l.timers)
+        timer_cancel(&l, l.timers);
+    printf("%u ticks\n", l.ticks);
+    return l.ticks == 15 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/33_realloc_result_ignored.c b/test/cases/detection-blind/33_realloc_result_ignored.c
new file mode 100644
index 00000000..d473b681
--- /dev/null
+++ b/test/cases/detection-blind/33_realloc_result_ignored.c
@@ -0,0 +1,75 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Report builder whose append_line() works like realloc(): it returns the
+ * possibly moved buffer. Every call site assigns the result except the one
+ * that appends the footer; that append grows the buffer, the caller keeps
+ * the old pointer, and the final strlen() reads the freed block.
+ * Category: temporal (heap use after realloc moved the block).
+ * Why it may be missed: the footer line looks like all the others, and it
+ * only moves the buffer when the report happens to be near its capacity.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+/* Appends text and a newline; returns the (possibly moved) buffer, or NULL
+   after freeing it on allocation failure. */
+static char *append_line(char *buf, size_t *len, size_t *cap, const char *text)
+{
+    size_t n = strlen(text);
+    if (*len + n + 2 > *cap) {
+        size_t ncap = *cap * 2 + n + 2;
+        char *p = realloc(buf, ncap);
+        if (!p) {
+            free(buf);
+            return NULL;
+        }
+        buf = p;
+        *cap = ncap;
+    }
+    memcpy(buf + *len, text, n);
+    buf[*len + n] = '\n';
+    buf[*len + n + 1] = '\0';
+    *len += n + 1;
+    return buf;
+}
+
+int main(void)
+{
+    static const struct {
+        const char *name;
+        unsigned mb;
+    } vols[] = {{"root", 1024}, {"home", 210}};
+    size_t len = 0, cap = 64;
+    char *report = malloc(cap);
+    if (!report)
+        return 1;
+    report[0] = '\0';
+    report = append_line(report, &len, &cap, "== disk usage ==");
+    unsigned total = 0;
+    for (size_t i = 0; report && i < 2; i++) {
+        char line[32];
+        snprintf(line, sizeof line, "%-8s %5u MB", vols[i].name, vols[i].mb);
+        report = append_line(report, &len, &cap, line);
+        total += vols[i].mb;
+    }
+    if (!report)
+        return 1;
+    char footer[48];
+    snprintf(footer, sizeof footer, "total: %u MB in %zu volumes", total, sizeof vols / sizeof vols[0]);
+#ifdef FIX
+    report = append_line(report, &len, &cap, footer);
+#else
+    append_line(report, &len, &cap, footer);
+#endif
+    if (!report)
+        return 1;
+    size_t shown = strlen(report); // STOP
+    fputs(report, stdout);
+    free(report);
+    return shown == len ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/34_block_scope_label.c b/test/cases/detection-blind/34_block_scope_label.c
new file mode 100644
index 00000000..f8b38692
--- /dev/null
+++ b/test/cases/detection-blind/34_block_scope_label.c
@@ -0,0 +1,53 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Item description formatter. The label for a numbered item is formatted
+ * into a buffer declared inside the else-block, and the pointer to it is
+ * used after the block has ended, when the buffer's lifetime is over.
+ * Category: temporal (stack use after scope).
+ * Why it may be missed: the buffer is in the same function and usually still
+ * holds the right bytes, so the output looks correct in testing.
+ */
+#include <stdio.h>
+#include <string.h>
+
+struct item {
+    int id; /* -1 when not yet assigned */
+    unsigned stock;
+};
+
+static int describe(const struct item *it, char *out, size_t cap)
+{
+    const char *label;
+#ifdef FIX
+    char tmp[16];
+#endif
+    if (it->id < 0) {
+        label = "unassigned";
+    } else {
+#ifndef FIX
+        char tmp[16];
+#endif
+        snprintf(tmp, sizeof tmp, "item-%d", it->id);
+        label = tmp;
+    }
+    return snprintf(out, cap, "%s (%u in stock)", label, it->stock); // STOP
+}
+
+int main(void)
+{
+    static const struct item items[] = {{7, 3}, {-1, 0}, {12, 40}};
+    char line[64];
+    int ok = 1;
+    for (size_t i = 0; i < 3; i++) {
+        if (describe(&items[i], line, sizeof line) < 0)
+            return 1;
+        puts(line);
+        if (i == 0 && strcmp(line, "item-7 (3 in stock)") != 0)
+            ok = 0;
+    }
+    return ok ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/35_worklist_push_invalidates.c b/test/cases/detection-blind/35_worklist_push_invalidates.c
new file mode 100644
index 00000000..ecbbbc25
--- /dev/null
+++ b/test/cases/detection-blind/35_worklist_push_invalidates.c
@@ -0,0 +1,75 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Breadth-first expansion over a growable worklist. The loop takes a pointer
+ * to the current task, pushes its children (which may realloc the array),
+ * and then marks the task visited through the pointer taken before the push.
+ * Category: temporal (heap use after realloc moved the block, iterator
+ * invalidation).
+ * Why it may be missed: the loop uses an index, which is safe, so the stale
+ * pointer `t` looks like a harmless shorthand for w.items[i].
+ */
+#include <stdio.h>
+#include <stdlib.h>
+
+struct task {
+    unsigned id;
+    unsigned depth;
+    int visited;
+};
+
+struct worklist {
+    struct task *items;
+    size_t len;
+    size_t cap;
+};
+
+static int wl_push(struct worklist *w, unsigned id, unsigned depth)
+{
+    if (w->len == w->cap) {
+        size_t ncap = w->cap ? w->cap * 2 : 4;
+        struct task *p = realloc(w->items, ncap * sizeof *p);
+        if (!p)
+            return -1;
+        w->items = p;
+        w->cap = ncap;
+    }
+    w->items[w->len].id = id;
+    w->items[w->len].depth = depth;
+    w->items[w->len].visited = 0;
+    w->len++;
+    return 0;
+}
+
+int main(void)
+{
+    struct worklist w = {NULL, 0, 0};
+    if (wl_push(&w, 1, 0) != 0)
+        return 1;
+    unsigned long idsum = 0;
+    for (size_t i = 0; i < w.len; i++) {
+        struct task *t = &w.items[i];
+        unsigned id = t->id, depth = t->depth;
+        if (depth < 3) {
+            if (wl_push(&w, id * 2, depth + 1) != 0 || wl_push(&w, id * 2 + 1, depth + 1) != 0) {
+                free(w.items);
+                return 1;
+            }
+#ifdef FIX
+            t = &w.items[i]; /* the pushes may have moved the array */
+#endif
+        }
+        t->visited = 1; // STOP
+        idsum += id;
+    }
+    size_t visited = 0;
+    for (size_t i = 0; i < w.len; i++)
+        visited += w.items[i].visited != 0;
+    printf("%zu tasks, %zu visited, id sum %lu\n", w.len, visited, idsum);
+    int ok = w.len == 15 && visited == 15 && idsum == 120;
+    free(w.items);
+    return ok ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/36_error_pointer_into_copy.c b/test/cases/detection-blind/36_error_pointer_into_copy.c
new file mode 100644
index 00000000..22d2a8e9
--- /dev/null
+++ b/test/cases/detection-blind/36_error_pointer_into_copy.c
@@ -0,0 +1,73 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Parser of comma-separated "key=value" pairs that works on a private copy
+ * of its input (strtok() modifies it). On a syntax error it reports the
+ * offending token through an out-parameter that points into the copy, and
+ * then frees the copy; the caller prints the token from freed memory.
+ * Category: temporal (heap use-after-free across a function boundary, on an
+ * error path).
+ * Why it may be missed: error paths are rarely tested, and *err looks like
+ * it points at the caller's own string.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+static char *dupstr(const char *s)
+{
+    size_t n = strlen(s) + 1;
+    char *p = malloc(n);
+    if (p)
+        memcpy(p, s, n);
+    return p;
+}
+
+/* Sums the values of the pairs; returns the number of pairs, or -1 with *err
+   pointing at the offending text. */
+static int sum_pairs(const char *text, long *sum, const char **err)
+{
+    char *copy = dupstr(text);
+    int n = 0;
+    *err = text;
+    if (!copy)
+        return -1;
+    for (char *tok = strtok(copy, ","); tok; tok = strtok(NULL, ",")) {
+        char *eq = strchr(tok, '=');
+        if (!eq || eq == tok) {
+#ifdef FIX
+            *err = text + (tok - copy);
+#else
+            *err = tok;
+#endif
+            n = -1;
+            break;
+        }
+        *sum += strtol(eq + 1, NULL, 10);
+        n++;
+    }
+    free(copy);
+    return n;
+}
+
+int main(void)
+{
+    static const char *const inputs[] = {"a=1,b=2,c=3", "width=10,height,depth=4"};
+    long total = 0;
+    unsigned errors = 0;
+    for (size_t i = 0; i < 2; i++) {
+        long sum = 0;
+        const char *err;
+        if (sum_pairs(inputs[i], &sum, &err) < 0) {
+            fprintf(stderr, "syntax error near '%.6s'\n", err); // STOP
+            errors++;
+        } else {
+            total += sum;
+        }
+    }
+    printf("total %ld, %u errors\n", total, errors);
+    return total == 6 && errors == 1 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/37_double_free_error_path.c b/test/cases/detection-blind/37_double_free_error_path.c
new file mode 100644
index 00000000..344d9186
--- /dev/null
+++ b/test/cases/detection-blind/37_double_free_error_path.c
@@ -0,0 +1,81 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Wire message decoder. When the body fails validation, msg_decode() frees
+ * the body it allocated but leaves m->body pointing at it; the caller then
+ * cleans up with msg_clear(), as it does for every message, and frees the
+ * body a second time.
+ * Category: release (double free across functions, on an error path).
+ * Why it may be missed: both functions "clean up after themselves", and the
+ * failing path is taken only for a body with a non-printable character.
+ */
+#include <ctype.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct msg {
+    int type;
+    size_t len;
+    char *body;
+};
+
+/* Decodes "<type>:<len>:<body>". */
+static int msg_decode(struct msg *m, const char *wire)
+{
+    char *end;
+    long type = strtol(wire, &end, 10);
+    if (*end != ':' || type < 0 || type > 255)
+        return -1;
+    unsigned long len = strtoul(end + 1, &end, 10);
+    if (*end != ':')
+        return -1;
+    const char *body = end + 1;
+    if (strlen(body) != len)
+        return -1;
+    m->type = (int)type;
+    m->len = len;
+    m->body = malloc(len + 1);
+    if (!m->body)
+        return -1;
+    memcpy(m->body, body, len + 1);
+    for (size_t i = 0; i < len; i++) {
+        if (!isprint((unsigned char)m->body[i])) {
+            free(m->body);
+#ifdef FIX
+            m->body = NULL;
+#endif
+            return -1;
+        }
+    }
+    return 0;
+}
+
+static void msg_clear(struct msg *m)
+{
+    free(m->body); // STOP
+    m->body = NULL;
+    m->len = 0;
+}
+
+int main(void)
+{
+    static const char *const wire[] = {"1:5:hello", "2:4:ab\tc", "3:3:bye"};
+    unsigned accepted = 0, rejected = 0;
+    size_t bytes = 0;
+    for (size_t i = 0; i < 3; i++) {
+        struct msg m = {0, 0, NULL};
+        if (msg_decode(&m, wire[i]) == 0) {
+            accepted++;
+            bytes += m.len;
+        } else {
+            rejected++;
+        }
+        msg_clear(&m);
+    }
+    printf("%u accepted (%zu bytes), %u rejected\n", accepted, bytes, rejected);
+    return accepted == 2 && rejected == 1 && bytes == 8 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/38_free_trimmed_value.c b/test/cases/detection-blind/38_free_trimmed_value.c
new file mode 100644
index 00000000..cd5120ac
--- /dev/null
+++ b/test/cases/detection-blind/38_free_trimmed_value.c
@@ -0,0 +1,91 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * HTTP header parser. The value is duplicated and then trimmed with trim(),
+ * which returns a pointer past any leading blanks; the struct keeps only the
+ * trimmed pointer, and header_free() later passes that interior pointer to
+ * free() for a value that had a leading space.
+ * Category: release (free of an interior pointer).
+ * Why it may be missed: dupstr() and trim() are composed on one line, and
+ * values without leading blanks free the right pointer.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+static char *dupstr(const char *s)
+{
+    size_t n = strlen(s) + 1;
+    char *p = malloc(n);
+    if (p)
+        memcpy(p, s, n);
+    return p;
+}
+
+/* Removes leading and trailing blanks. */
+static char *trim(char *s)
+{
+    char *start = s;
+    while (*start == ' ' || *start == '\t')
+        start++;
+    size_t n = strlen(start);
+    while (n > 0 && (start[n - 1] == ' ' || start[n - 1] == '\t'))
+        n--;
+    start[n] = '\0';
+#ifdef FIX
+    memmove(s, start, n + 1);
+    return s;
+#else
+    return start;
+#endif
+}
+
+struct header {
+    char *name;
+    char *value;
+};
+
+static int header_parse(struct header *h, const char *line)
+{
+    const char *colon = strchr(line, ':');
+    if (!colon)
+        return -1;
+    size_t n = (size_t)(colon - line);
+    h->name = malloc(n + 1);
+    if (!h->name)
+        return -1;
+    memcpy(h->name, line, n);
+    h->name[n] = '\0';
+    char *v = dupstr(colon + 1);
+    if (!v) {
+        free(h->name);
+        return -1;
+    }
+    h->value = trim(v);
+    return 0;
+}
+
+static void header_free(struct header *h)
+{
+    free(h->name);
+    free(h->value); // STOP
+}
+
+int main(void)
+{
+    static const char *const lines[] = {"Host:example.org", "Content-Type: text/html ",
+                                        "Accept:\t*/*"};
+    size_t chars = 0;
+    for (size_t i = 0; i < 3; i++) {
+        struct header h;
+        if (header_parse(&h, lines[i]) != 0)
+            return 1;
+        printf("[%s] = [%s]\n", h.name, h.value);
+        chars += strlen(h.value);
+        header_free(&h);
+    }
+    return chars == 23 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/39_free_default_name.c b/test/cases/detection-blind/39_free_default_name.c
new file mode 100644
index 00000000..d652b2a0
--- /dev/null
+++ b/test/cases/detection-blind/39_free_default_name.c
@@ -0,0 +1,66 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * display_name() returns a heap string for users with a name, but falls back
+ * to a static default buffer for users without one. Callers free() the
+ * result, which for the fallback is a global array.
+ * Category: release (free of a non-heap pointer, a global).
+ * Why it may be missed: the function's contract is "caller frees", which
+ * holds on every path but the rare fallback.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct user {
+    const char *first;
+    const char *last;
+};
+
+static char default_name[] = "anonymous";
+
+static char *dupstr(const char *s)
+{
+    size_t n = strlen(s) + 1;
+    char *p = malloc(n);
+    if (p)
+        memcpy(p, s, n);
+    return p;
+}
+
+/* Returns the user's display name; the caller frees it. */
+static char *display_name(const struct user *u)
+{
+    if (u->first && u->last) {
+        size_t n = strlen(u->first) + strlen(u->last) + 2;
+        char *s = malloc(n);
+        if (s)
+            snprintf(s, n, "%s %s", u->first, u->last);
+        return s;
+    }
+    if (u->first)
+        return dupstr(u->first);
+#ifdef FIX
+    return dupstr(default_name);
+#else
+    return default_name;
+#endif
+}
+
+int main(void)
+{
+    static const struct user users[] = {{"Grace", "Hopper"}, {"Linus", NULL}, {NULL, NULL}};
+    size_t total = 0;
+    for (size_t i = 0; i < 3; i++) {
+        char *name = display_name(&users[i]);
+        if (!name)
+            return 1;
+        puts(name);
+        total += strlen(name);
+        free(name); // STOP
+    }
+    return total == 26 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/40_shallow_copy_double_free.c b/test/cases/detection-blind/40_shallow_copy_double_free.c
new file mode 100644
index 00000000..a98cb7cb
--- /dev/null
+++ b/test/cases/detection-blind/40_shallow_copy_double_free.c
@@ -0,0 +1,73 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Image flip into a second image. image_flip() initialises the output with a
+ * struct assignment from the source "to copy the dimensions", which also
+ * copies the pixel pointer; both images then own the same buffer and the
+ * second image_free() frees it again.
+ * Category: release (double free through a shallow struct copy).
+ * Why it may be missed: `*out = *src` reads as copying the header, and the
+ * flip result is only subtly wrong because it works in place.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+
+struct image {
+    unsigned w, h;
+    unsigned char *px;
+};
+
+static int image_init(struct image *im, unsigned w, unsigned h)
+{
+    im->w = w;
+    im->h = h;
+    im->px = calloc((size_t)w * h, 1);
+    return im->px ? 0 : -1;
+}
+
+static void image_free(struct image *im)
+{
+    free(im->px); // STOP
+    im->px = NULL;
+}
+
+/* Writes a vertically flipped copy of src into out. */
+static int image_flip(const struct image *src, struct image *out)
+{
+#ifdef FIX
+    if (image_init(out, src->w, src->h) != 0)
+        return -1;
+#else
+    *out = *src; /* same dimensions */
+#endif
+    for (unsigned y = 0; y < src->h; y++)
+        for (unsigned x = 0; x < src->w; x++)
+            out->px[(size_t)y * src->w + x] = src->px[(size_t)(src->h - 1 - y) * src->w + x];
+    return 0;
+}
+
+int main(void)
+{
+    struct image img, flipped;
+    if (image_init(&img, 4, 3) != 0)
+        return 1;
+    for (unsigned y = 0; y < 3; y++)
+        for (unsigned x = 0; x < 4; x++)
+            img.px[y * 4 + x] = (unsigned char)(y * 16 + x);
+    if (image_flip(&img, &flipped) != 0) {
+        image_free(&img);
+        return 1;
+    }
+    int ok = 1;
+    for (unsigned y = 0; y < 3; y++)
+        for (unsigned x = 0; x < 4; x++)
+            if (flipped.px[y * 4 + x] != (2 - y) * 16 + x)
+                ok = 0;
+    printf("flip %s\n", ok ? "ok" : "wrong");
+    image_free(&flipped);
+    image_free(&img);
+    return ok ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/41_realloc_free_old.c b/test/cases/detection-blind/41_realloc_free_old.c
new file mode 100644
index 00000000..527e3e6f
--- /dev/null
+++ b/test/cases/detection-blind/41_realloc_free_old.c
@@ -0,0 +1,70 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Growable byte blob. blob_reserve() assumes that when realloc() moves the
+ * block it leaves the old one for the caller to release, and frees the old
+ * pointer itself; realloc() has already freed it, so this is a double free
+ * whenever the block moves.
+ * Category: release (double free after realloc).
+ * Why it may be missed: the first reserve passes NULL (free(NULL) is fine),
+ * and small growths are often done in place, so the free is rarely reached.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct blob {
+    unsigned char *data;
+    size_t len;
+    size_t cap;
+};
+
+static int blob_reserve(struct blob *b, size_t need)
+{
+    if (need <= b->cap)
+        return 0;
+    size_t ncap = b->cap ? b->cap : 256;
+    while (ncap < need)
+        ncap *= 2;
+    unsigned char *p = realloc(b->data, ncap);
+    if (!p)
+        return -1;
+#ifndef FIX
+    if (p != b->data)
+        free(b->data); // STOP
+#endif
+    b->data = p;
+    b->cap = ncap;
+    return 0;
+}
+
+static int blob_append(struct blob *b, const void *src, size_t n)
+{
+    if (blob_reserve(b, b->len + n) != 0)
+        return -1;
+    memcpy(b->data + b->len, src, n);
+    b->len += n;
+    return 0;
+}
+
+int main(void)
+{
+    struct blob b = {NULL, 0, 0};
+    static const unsigned char header[16] = "BLOB\x01\x00\x00\x00";
+    unsigned char chunk[1500];
+    for (size_t i = 0; i < sizeof chunk; i++)
+        chunk[i] = (unsigned char)(i * 7u);
+    if (blob_append(&b, header, sizeof header) != 0 || blob_append(&b, chunk, sizeof chunk) != 0) {
+        free(b.data);
+        return 1;
+    }
+    unsigned sum = 0;
+    for (size_t i = 0; i < b.len; i++)
+        sum += b.data[i];
+    printf("%zu bytes in a %zu-byte blob, sum %u\n", b.len, b.cap, sum);
+    free(b.data);
+    return b.len == 1516 && b.cap == 2048 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/42_skip_level_null.c b/test/cases/detection-blind/42_skip_level_null.c
new file mode 100644
index 00000000..c6146b35
--- /dev/null
+++ b/test/cases/detection-blind/42_skip_level_null.c
@@ -0,0 +1,53 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Org chart report that prints each employee's skip-level manager (the
+ * manager's manager). skip_level() checks that the employee has a manager
+ * but not that the manager has one, so for a direct report of the CEO it
+ * dereferences a NULL manager pointer.
+ * Category: null (NULL dereference on a data-dependent path).
+ * Why it may be missed: there is a NULL check right above the dereference,
+ * just one level short; most employees are two levels below the top.
+ */
+#include <stdio.h>
+
+struct employee {
+    const char *name;
+    struct employee *manager; /* NULL for the CEO */
+};
+
+static const char *skip_level(const struct employee *e)
+{
+    if (!e->manager)
+        return NULL;
+#ifdef FIX
+    if (!e->manager->manager)
+        return NULL;
+#endif
+    return e->manager->manager->name; // STOP
+}
+
+int main(void)
+{
+    static const struct {
+        const char *name;
+        int manager; /* index into the roster, -1 for none */
+    } roster[] = {{"Ada", -1}, {"Brian", 0}, {"Chen", 1}, {"Dana", 1}, {"Eve", 2}};
+    enum { N = sizeof roster / sizeof roster[0] };
+    struct employee staff[N];
+    for (int i = 0; i < N; i++) {
+        staff[i].name = roster[i].name;
+        staff[i].manager = roster[i].manager >= 0 ? &staff[roster[i].manager] : NULL;
+    }
+    unsigned with_skip = 0;
+    for (int i = N - 1; i >= 0; i--) {
+        const char *s = skip_level(&staff[i]);
+        printf("%-6s skip-level: %s\n", staff[i].name, s ? s : "-");
+        if (s)
+            with_skip++;
+    }
+    return with_skip == 3 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/43_shape_parse_null.c b/test/cases/detection-blind/43_shape_parse_null.c
new file mode 100644
index 00000000..6ef1bad0
--- /dev/null
+++ b/test/cases/detection-blind/43_shape_parse_null.c
@@ -0,0 +1,80 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+// (The second STOP, at the call, is where the null reaches a callee that
+// dereferences it unconditionally: a stop there is before the access.)
+/*
+ * Shape list parser. shape_parse() returns NULL for a shape kind it does not
+ * know (an expected error path, not an allocation failure), and the caller
+ * passes the result straight to area(), which dereferences it.
+ * Category: null (NULL returned on an error path, dereferenced by a callee).
+ * Why it may be missed: NULL returns look like out-of-memory handling that
+ * "never happens"; the unknown-kind path is easy to forget.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+enum kind { CIRCLE, RECT };
+
+struct shape {
+    enum kind kind;
+    double a, b;
+};
+
+static struct shape *shape_parse(const char *spec)
+{
+    char kind[16];
+    double a = 0, b = 0;
+    int n = sscanf(spec, "%15s %lf %lf", kind, &a, &b);
+    if (n < 2)
+        return NULL;
+    struct shape *s = malloc(sizeof *s);
+    if (!s)
+        return NULL;
+    if (strcmp(kind, "circle") == 0) {
+        s->kind = CIRCLE;
+    } else if (strcmp(kind, "rect") == 0 && n == 3) {
+        s->kind = RECT;
+    } else {
+        free(s); /* unknown kind */
+        return NULL;
+    }
+    s->a = a;
+    s->b = b;
+    return s;
+}
+
+static double area(const struct shape *s)
+{
+    switch (s->kind) { // STOP
+    case CIRCLE:
+        return 3.25 * s->a * s->a;
+    case RECT:
+        return s->a * s->b;
+    }
+    return 0;
+}
+
+int main(void)
+{
+    static const char *const specs[] = {"circle 2", "rect 2 3", "triangle 3 4", "rect 1 1"};
+    double total = 0;
+    unsigned shapes = 0;
+    for (size_t i = 0; i < 4; i++) {
+        struct shape *s = shape_parse(specs[i]);
+#ifdef FIX
+        if (!s) {
+            fprintf(stderr, "skipping '%s'\n", specs[i]);
+            continue;
+        }
+#endif
+        total += area(s); // STOP
+        shapes++;
+        free(s);
+    }
+    printf("%u shapes, total area %.2f\n", shapes, total);
+    return shapes == 3 && total == 20.0 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/44_uninit_stream_buffer.c b/test/cases/detection-blind/44_uninit_stream_buffer.c
new file mode 100644
index 00000000..36fd541a
--- /dev/null
+++ b/test/cases/detection-blind/44_uninit_stream_buffer.c
@@ -0,0 +1,98 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Output streams allocated with malloc(). stream_open() sets up the buffer
+ * pointer only for buffered streams; for an unbuffered stream s->buf is left
+ * uninitialised, and stream_close() passes it to free() unconditionally.
+ * Category: uninitialized (use of an uninitialised heap pointer, here freed).
+ * Why it may be missed: the write path checks s->buffered before touching
+ * buf, so only close uses the field, and fresh heap memory is often zero.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct stream {
+    const char *name;
+    int buffered;
+    char *buf;
+    size_t cap;
+    size_t len;
+    size_t written;
+};
+
+static struct stream *stream_open(const char *name, int buffered)
+{
+    struct stream *s = malloc(sizeof *s);
+    if (!s)
+        return NULL;
+    s->name = name;
+    s->buffered = buffered;
+    s->len = 0;
+    s->written = 0;
+    if (buffered) {
+        s->cap = 64;
+        s->buf = malloc(s->cap);
+        if (!s->buf) {
+            free(s);
+            return NULL;
+        }
+    }
+#ifdef FIX
+    else {
+        s->cap = 0;
+        s->buf = NULL;
+    }
+#endif
+    return s;
+}
+
+static void stream_flush(struct stream *s)
+{
+    s->written += s->len;
+    s->len = 0;
+}
+
+static void stream_write(struct stream *s, const char *data)
+{
+    size_t n = strlen(data);
+    if (!s->buffered) {
+        s->written += n;
+        return;
+    }
+    if (s->len + n > s->cap)
+        stream_flush(s);
+    if (n > s->cap) {
+        s->written += n;
+        return;
+    }
+    memcpy(s->buf + s->len, data, n);
+    s->len += n;
+}
+
+static size_t stream_close(struct stream *s)
+{
+    stream_flush(s);
+    size_t w = s->written;
+    free(s->buf); // STOP // MISS: zero-initialisation makes the never-set pointer null, and free(NULL) is defined (neutralised)
+    free(s);
+    return w;
+}
+
+int main(void)
+{
+    struct stream *out = stream_open("stdout", 1);
+    struct stream *err = stream_open("stderr", 0);
+    if (!out || !err)
+        return 1;
+    stream_write(out, "result: 42\n");
+    stream_write(err, "warning: cache cold\n");
+    stream_write(out, "done\n");
+    size_t a = stream_close(out);
+    size_t b = stream_close(err);
+    printf("%zu + %zu bytes written\n", a, b);
+    return a == 16 && b == 20 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/45_strchr_null_flag.c b/test/cases/detection-blind/45_strchr_null_flag.c
new file mode 100644
index 00000000..5f2dc9c3
--- /dev/null
+++ b/test/cases/detection-blind/45_strchr_null_flag.c
@@ -0,0 +1,61 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Key=value configuration reader. parse_line() splits each line at the '='
+ * found by strchr(), without handling the case where there is none; a bare
+ * flag line such as "verbose" makes it write through a NULL pointer.
+ * Category: null (unchecked NULL from a library function).
+ * Why it may be missed: blank and comment lines are filtered out before the
+ * call, which makes the input look validated.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct kv {
+    const char *key;
+    const char *val;
+};
+
+static int parse_line(char *line, struct kv *out)
+{
+    char *eq = strchr(line, '=');
+#ifdef FIX
+    if (!eq) { /* bare flag */
+        out->key = line;
+        out->val = "true";
+        return 0;
+    }
+#endif
+    *eq = '\0'; // STOP
+    out->key = line;
+    out->val = eq + 1;
+    return 0;
+}
+
+int main(void)
+{
+    static const char *const lines[] = {"# server settings", "name=demo", "port=8080",
+                                        "", "verbose", "root=/srv"};
+    enum { N = sizeof lines / sizeof lines[0] };
+    char store[N][64];
+    struct kv kvs[N];
+    size_t n = 0;
+    for (size_t i = 0; i < N; i++) {
+        if (lines[i][0] == '\0' || lines[i][0] == '#')
+            continue;
+        snprintf(store[n], sizeof store[n], "%s", lines[i]);
+        if (parse_line(store[n], &kvs[n]) == 0)
+            n++;
+    }
+    long port = 0;
+    for (size_t i = 0; i < n; i++) {
+        printf("%s -> %s\n", kvs[i].key, kvs[i].val);
+        if (strcmp(kvs[i].key, "port") == 0)
+            port = strtol(kvs[i].val, NULL, 10);
+    }
+    return n == 4 && port == 8080 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/46_uninit_token_text.c b/test/cases/detection-blind/46_uninit_token_text.c
new file mode 100644
index 00000000..0b989ad4
--- /dev/null
+++ b/test/cases/detection-blind/46_uninit_token_text.c
@@ -0,0 +1,84 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Tiny calculator that echoes its tokens. lex() fills in text and len for
+ * words, but for numbers it sets only num and len; the echo then copies
+ * tok.text, which for a leading number was never initialised.
+ * Category: uninitialized (read through an uninitialised pointer field of a
+ * stack struct).
+ * Why it may be missed: compilers do not track struct fields filled through
+ * a pointer, and after the first word token the field holds a stale but
+ * valid pointer, so only a leading number shows the bug.
+ */
+#include <ctype.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+enum kind { TK_END, TK_NUM, TK_WORD };
+
+struct token {
+    enum kind kind;
+    long num;
+    const char *text;
+    size_t len;
+};
+
+static const char *lex(const char *p, struct token *t)
+{
+    while (*p == ' ')
+        p++;
+    if (*p == '\0') {
+        t->kind = TK_END;
+        t->len = 0;
+        return p;
+    }
+    if (isdigit((unsigned char)*p)) {
+        char *end;
+        t->kind = TK_NUM;
+        t->num = strtol(p, &end, 10);
+#ifdef FIX
+        t->text = p;
+#endif
+        t->len = (size_t)(end - p);
+        return end;
+    }
+    size_t n = 0;
+    while (p[n] != '\0' && p[n] != ' ')
+        n++;
+    t->kind = TK_WORD;
+    t->text = p;
+    t->len = n;
+    return p + n;
+}
+
+int main(void)
+{
+    const char *src = "12 plus 30 minus 2";
+    char echo[64];
+    size_t eo = 0;
+    long acc = 0;
+    int sign = 1;
+    struct token tok;
+    const char *p = src;
+    for (;;) {
+        p = lex(p, &tok);
+        if (tok.kind == TK_END)
+            break;
+        if (eo + tok.len + 1 < sizeof echo) {
+            memcpy(echo + eo, tok.text, tok.len); // STOP // MISS: zero-initialisation makes the never-set pointer null; memcpy's null check is inexpressible (the token is a local whose address is taken)
+            eo += tok.len;
+            echo[eo++] = ' ';
+        }
+        if (tok.kind == TK_NUM)
+            acc += sign * tok.num;
+        else
+            sign = tok.len == 5 && strncmp(tok.text, "minus", 5) == 0 ? -1 : 1;
+    }
+    echo[eo ? eo - 1 : 0] = '\0';
+    printf("%s = %ld\n", echo, acc);
+    return acc == 40 && strcmp(echo, src) == 0 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/47_thread_stack_arg.c b/test/cases/detection-blind/47_thread_stack_arg.c
new file mode 100644
index 00000000..028ce69c
--- /dev/null
+++ b/test/cases/detection-blind/47_thread_stack_arg.c
@@ -0,0 +1,87 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Worker threads started by a helper that passes each thread a pointer to a
+ * job struct on the helper's own stack. The workers wait for a start signal
+ * that main gives only after all of them are started, so by the time a
+ * worker reads its job the helper's frame is long dead.
+ * Category: threading / temporal (stack use after return from another
+ * thread).
+ * Why it may be missed: pthread_create() with &local is a common pattern
+ * that is fine when the creator joins before returning; here it does not.
+ */
+#include <pthread.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+#define NWORKERS 4
+
+struct job {
+    int id;
+    int input;
+};
+
+static pthread_mutex_t mu = PTHREAD_MUTEX_INITIALIZER;
+static pthread_cond_t cv = PTHREAD_COND_INITIALIZER;
+static int released;
+static int results[NWORKERS];
+
+static void *worker(void *arg)
+{
+    pthread_mutex_lock(&mu);
+    while (!released)
+        pthread_cond_wait(&cv, &mu);
+    pthread_mutex_unlock(&mu);
+    const struct job *j = arg;
+    int id = j->id; // STOP // MISS: a stack object is untracked once its scope ends (RFC 0032 §4): use after return
+    int input = j->input;
+#ifdef FIX
+    free(arg);
+#endif
+    if (id >= 0 && id < NWORKERS)
+        results[id] = input * input;
+    return NULL;
+}
+
+static int start_worker(pthread_t *t, int id, int input)
+{
+#ifdef FIX
+    struct job *j = malloc(sizeof *j);
+    if (!j)
+        return -1;
+    j->id = id;
+    j->input = input;
+    if (pthread_create(t, NULL, worker, j) != 0) {
+        free(j);
+        return -1;
+    }
+    return 0;
+#else
+    struct job j = {id, input};
+    return pthread_create(t, NULL, worker, &j);
+#endif
+}
+
+int main(void)
+{
+    pthread_t th[NWORKERS];
+    for (int i = 0; i < NWORKERS; i++)
+        if (start_worker(&th[i], i, i + 2) != 0)
+            return 1;
+    pthread_mutex_lock(&mu);
+    released = 1;
+    pthread_cond_broadcast(&cv);
+    pthread_mutex_unlock(&mu);
+    for (int i = 0; i < NWORKERS; i++)
+        pthread_join(th[i], NULL);
+    int ok = 1;
+    for (int i = 0; i < NWORKERS; i++) {
+        printf("worker %d: %d\n", i, results[i]);
+        if (results[i] != (i + 2) * (i + 2))
+            ok = 0;
+    }
+    return ok ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/48_logger_thread_freed_msg.c b/test/cases/detection-blind/48_logger_thread_freed_msg.c
new file mode 100644
index 00000000..6c99acd9
--- /dev/null
+++ b/test/cases/detection-blind/48_logger_thread_freed_msg.c
@@ -0,0 +1,109 @@
+// RFC 0034 gate F6: blind detection set (written after the first set, by an author who
+// had not seen it). -DFIX selects the fixed twin.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT:
+/*
+ * Batched background logger. log_post() queues the caller's string pointer
+ * without copying it, and the caller frees its message right after posting;
+ * the writer thread reads the queued strings only on log_flush(), after
+ * they have all been freed.
+ * Category: threading / temporal (heap use-after-free across threads).
+ * Why it may be missed: the API looks like it takes the message (as most
+ * loggers copy), and the free and the read happen on different threads.
+ */
+#include <pthread.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define QCAP 16
+
+static pthread_mutex_t mu = PTHREAD_MUTEX_INITIALIZER;
+static pthread_cond_t wake = PTHREAD_COND_INITIALIZER;
+static pthread_cond_t flushed = PTHREAD_COND_INITIALIZER;
+static const char *queue[QCAP];
+static size_t qlen;
+static int flush_requested, stopping;
+static size_t bytes_written, lines_written;
+
+static int log_post(const char *msg)
+{
+    int rc = -1;
+    pthread_mutex_lock(&mu);
+    if (qlen < QCAP) {
+#ifdef FIX
+        size_t n = strlen(msg) + 1;
+        char *copy = malloc(n);
+        if (copy) {
+            memcpy(copy, msg, n);
+            queue[qlen++] = copy;
+            rc = 0;
+        }
+#else
+        queue[qlen++] = msg;
+        rc = 0;
+#endif
+    }
+    pthread_mutex_unlock(&mu);
+    return rc;
+}
+
+static void *writer(void *arg)
+{
+    (void)arg;
+    pthread_mutex_lock(&mu);
+    for (;;) {
+        while (!flush_requested && !stopping)
+            pthread_cond_wait(&wake, &mu);
+        if (flush_requested) {
+            for (size_t i = 0; i < qlen; i++) {
+                bytes_written += strlen(queue[i]); // STOP
+                lines_written++;
+#ifdef FIX
+                free((void *)queue[i]);
+#endif
+            }
+            qlen = 0;
+            flush_requested = 0;
+            pthread_cond_broadcast(&flushed);
+        }
+        if (stopping)
+            break;
+    }
+    pthread_mutex_unlock(&mu);
+    return NULL;
+}
+
+static void log_flush(void)
+{
+    pthread_mutex_lock(&mu);
+    flush_requested = 1;
+    pthread_cond_signal(&wake);
+    while (flush_requested)
+        pthread_cond_wait(&flushed, &mu);
+    pthread_mutex_unlock(&mu);
+}
+
+int main(void)
+{
+    pthread_t th;
+    if (pthread_create(&th, NULL, writer, NULL) != 0)
+        return 1;
+    for (int i = 0; i < 4; i++) {
+        char *msg = malloc(32);
+        if (!msg)
+            return 1;
+        snprintf(msg, 32, "request %d handled", i);
+        log_post(msg);
+        free(msg);
+    }
+    log_flush();
+    pthread_mutex_lock(&mu);
+    stopping = 1;
+    pthread_cond_signal(&wake);
+    pthread_mutex_unlock(&mu);
+    pthread_join(th, NULL);
+    printf("%zu lines, %zu bytes\n", lines_written, bytes_written);
+    return lines_written == 4 && bytes_written == 68 ? 0 : 1;
+}
diff --git a/test/cases/detection-blind/README.md b/test/cases/detection-blind/README.md
new file mode 100644
index 00000000..01b44506
--- /dev/null
+++ b/test/cases/detection-blind/README.md
@@ -0,0 +1,98 @@
+# Blind memory-safety detection set
+
+48 single-file C11 programs. Each one has one real memory-safety bug that
+`./prog` (no arguments) triggers deterministically. Each has a fixed twin
+built with `-DFIX`. The line where the first invalid access or invalid free
+happens carries a trailing `// STOP` comment, and each file's header comment
+says what the bug is, its category, and why a reviewer might miss it. The
+programs were written without looking at any other bug collection in this
+repository.
+
+Every program has been checked with Apple clang 21 (arm64 macOS):
+
+- `clang -std=c11 -O1 -g -DFIX -fsanitize=address,undefined` exits 0 with no
+  sanitizer report.
+- `clang -std=c11 -O2 -Wall -Wextra` gives no warnings for either variant.
+- `clang -std=c11 -O1 -g -fsanitize=address` (the bug variant) gives the
+  result in the ASan column below.
+
+Run the whole set with any compiler:
+
+```sh
+CC=clang CFLAGS='-O1 -g -fsanitize=address' ./run.sh        # all programs
+CC=clang ./run.sh 2                                         # names containing "2"
+```
+
+`run.sh` prints `NN_name bug:<status> fix:<status>`. A status is the exit
+code, `SIG<NAME>` for a signal (`SIGALRM` means the 10-second limit was hit),
+or `build-failed`. Binaries and logs go to `$OUT`, or to a temporary
+directory if `$OUT` is not set.
+
+Categories: spatial 19, temporal 17, release 5, null 3, uninitialized 2,
+threading 2.
+
+ASan column (`-O1`):
+
+- **yes**: ASan reports the bug itself.
+- **SEGV**: ASan reports only a deadly signal at the faulting line, not a
+  memory-safety diagnosis.
+- **no**: ASan reports nothing.
+
+| File | Category | Bug | ASan (-O1) |
+| --- | --- | --- | --- |
+| 01_ring_buffer_wrap.c | spatial | Ring buffer wrap test `head > cap` writes one record past the slot array | yes |
+| 02_strbuf_terminator.c | spatial | String builder reserves no room for the NUL; 1-byte heap overflow at an exact power-of-two fill | yes |
+| 03_csv_quoted_field.c | spatial | CSV unquoting caps characters at 16 but stores the terminator at `out[16]` (stack, 1 byte) | yes |
+| 04_matrix_transpose.c | spatial | Transpose uses the source's column count as the destination stride (heap overflow) | yes |
+| 05_lexer_peek.c | spatial | Lexer peeks one character past an unterminated, exactly-sized source buffer | yes |
+| 06_strncpy_unterminated.c | spatial | `strncpy` into 8 bytes leaves no terminator; `strlen` over-reads the stack buffer | yes |
+| 07_hash_table_rounding.c | spatial | Mask uses the rounded-up capacity but `calloc` uses the requested size; a hash-derived index overflows | yes |
+| 08_histogram_max_bucket.c | spatial | Histogram maximum maps to bucket `NBUCKETS`, one past a global array | yes |
+| 09_snprintf_offset.c | spatial | `snprintf(buf + off, sizeof buf, ...)` passes the full size at an offset (stack overflow) | yes |
+| 10_tlv_record_length.c | spatial | Record length is checked against the input but copied into a 32-byte stack buffer (4 bytes over) | yes |
+| 11_base64_encode_nul.c | spatial | Base64 output sized `(n+2)/3*4` without the NUL; 1-byte heap overflow | yes |
+| 12_strip_slashes_underflow.c | spatial | Stripping trailing slashes from "/" reads `path[-1]` (stack underflow) | yes |
+| 13_missing_sentinel.c | spatial | Lookup walks to a NULL sentinel that the heap table never got | yes |
+| 14_utf8_truncated.c | spatial | UTF-8 decoder trusts the lead byte's length on a truncated chunk (heap over-read) | yes |
+| 15_smallvec_intra_object.c | spatial | Embedded vector's push check `len > CAP` lets item 9 overwrite the next field (intra-object) | no |
+| 16_realloc_bytes_not_elems.c | spatial | `realloc(v, ncap)` with an element count instead of bytes; first store overflows | yes |
+| 17_letter_count_negative.c | spatial | `counts[c - 'a']` for an upper-case letter gives a negative index into a stack array | no (lands beyond the redzone) |
+| 18_erase_memmove_count.c | spatial | Erase uses `memmove` count `n - i` instead of `n - i - 1`; heap over-read by one element | yes |
+| 19_bitmap_round_down.c | spatial | Bitmap allocates `nbits / 8` bytes (rounds down); setting bit 96..99 overflows by 1 byte | yes |
+| 20_list_purge_next.c | temporal | List purge frees a node, then the for-increment reads `s->next` from it | yes |
+| 21_symtab_stale_pointer.c | temporal | References keep pointers into a symbol array that `realloc` later moves | yes |
+| 22_label_out_param_stack.c | temporal | Label text points to a callee's local buffer stored through an out-parameter (stack use after return) | yes (as use-after-scope, after inlining) |
+| 23_callback_ctx_freed.c | temporal | Closed session stays subscribed; next broadcast's callback updates the freed context | yes |
+| 24_lru_evicted_value.c | temporal | Pointer returned by an LRU `get` is used after a `put` evicts and frees that entry | yes |
+| 25_hashmap_iter_rehash.c | temporal | Inserting while iterating rehashes the map; the iterator reads the freed bucket array | yes |
+| 26_arena_reset_stale.c | temporal | Connection keeps a Host pointer into a per-request arena that is reset and reused | no (arena block stays allocated) |
+| 27_config_reload_dangling.c | temporal | Reload clears (frees) the old config before parsing; the error path prints the freed host | yes |
+| 28_refcount_borrowed_unref.c | temporal | Borrowing helper drops a reference it never owned; the queue's `buf_ref` touches freed memory | yes |
+| 29_global_ctx_stack.c | temporal | Stack parse context published in a global outlives its frame; a later warning reads it | yes (as use-after-scope, after inlining) |
+| 30_queue_pop_name.c | temporal | `pop` frees the node and returns a pointer to its embedded name | yes |
+| 31_bst_delete_successor.c | temporal | BST delete removes (frees) the successor before copying its key | yes |
+| 32_timer_cancel_in_callback.c | temporal | Timer callback cancels (frees) its own timer; the loop then reads `t->next` | yes |
+| 33_realloc_result_ignored.c | temporal | One call site ignores the moved buffer returned by a realloc-style append | yes |
+| 34_block_scope_label.c | temporal | Pointer to a block-scoped buffer is used after the block ends | yes |
+| 35_worklist_push_invalidates.c | temporal | Pointer to the current worklist item goes stale when pushing children reallocates | yes |
+| 36_error_pointer_into_copy.c | temporal | Error out-parameter points into a private copy that is freed before the caller prints it | yes |
+| 37_double_free_error_path.c | release | Decoder frees the body on a validation error without nulling it; the caller's cleanup frees it again | yes |
+| 38_free_trimmed_value.c | release | `trim()` returns an interior pointer that is later passed to `free` | yes |
+| 39_free_default_name.c | release | "Caller frees" function returns a global default buffer on one path | crash inside ASan's `free` (BUS), no diagnosis |
+| 40_shallow_copy_double_free.c | release | Struct assignment copies the pixel pointer; both images free it | yes |
+| 41_realloc_free_old.c | release | Frees the old pointer after `realloc` moved the block (already freed by `realloc`) | yes |
+| 42_skip_level_null.c | null | Skip-level manager lookup checks one level for NULL but dereferences two | SEGV |
+| 43_shape_parse_null.c | null | Parser returns NULL for an unknown shape kind; the caller passes it to `area()` | SEGV |
+| 44_uninit_stream_buffer.c | uninitialized | Unbuffered stream's `buf` field is never set (`malloc`), then freed on close | SEGV (on the 0xbe fill) |
+| 45_strchr_null_flag.c | null | `strchr(line, '=')` returns NULL for a bare flag line, which is then written through | SEGV |
+| 46_uninit_token_text.c | uninitialized | Lexer leaves `text` unset for number tokens; the echo copies from the garbage pointer | SEGV (depends on stack contents) |
+| 47_thread_stack_arg.c | threading | Worker threads read job structs from a helper's dead stack frame | yes (as use-after-scope, after inlining) |
+| 48_logger_thread_freed_msg.c | threading | Logger queues caller pointers without copying; the writer thread reads them after they are freed | yes |
+
+ASan diagnoses 39 of the 48 bugs. It ends 5 more with a SEGV report and 1
+with a crash inside its own `free`. It reports nothing for 3: an
+intra-object overflow (15), a negative index far below the array (17), and a
+stale pointer into a recycled arena (26). For 22, 29 and 47, the bug is a use
+after return, but at `-O1` the callee is inlined. ASan then reports it as
+stack-use-after-scope. Without inlining it needs
+`ASAN_OPTIONS=detect_stack_use_after_return=1`.
diff --git a/test/cases/detection-blind/run.sh b/test/cases/detection-blind/run.sh
new file mode 100755
index 00000000..0a8931bc
--- /dev/null
+++ b/test/cases/detection-blind/run.sh
@@ -0,0 +1,64 @@
+#!/bin/sh
+# Builds every NN_name.c in this directory twice, as the bug and as its fixed
+# twin (-DFIX), runs both with a 10-second limit, and prints one line each:
+#
+#   NN_name bug:<status> fix:<status>
+#
+# where <status> is the exit status, SIG<NAME> if a signal ended the program
+# (SIGALRM means it hit the time limit), or build-failed.
+#
+#   CC      compiler command (default: clang)
+#   CFLAGS  extra flags for both builds (default: none)
+#   OUT     directory for binaries and logs (default: a fresh temp directory)
+#
+# An optional argument selects the programs whose name contains it, e.g.
+#   CC=clang CFLAGS='-O1 -fsanitize=address' ./run.sh 0
+# Programs that include <pthread.h> are built with -pthread.
+
+CC=${CC:-clang}
+CFLAGS=${CFLAGS:-}
+dir=$(cd "$(dirname "$0")" && pwd)
+out=${OUT:-$(mktemp -d "${TMPDIR:-/tmp}/detection-blind.XXXXXX")}
+mkdir -p "$out" || exit 1
+filter=${1:-}
+
+# run BINARY: runs it with a 10-second alarm and prints its status.
+run() {
+    perl -e 'alarm 10; exec @ARGV or exit 127' "$1" >"$1.log" 2>&1
+    rc=$?
+    if [ "$rc" -gt 128 ]; then
+        name=$(kill -l $((rc - 128)) 2>/dev/null) || name=$((rc - 128))
+        echo "SIG$name"
+    else
+        echo "$rc"
+    fi
+}
+
+# build SRC BIN [FLAGS...]: compiles SRC into BIN, then runs it.
+build_and_run() {
+    src=$1
+    bin=$2
+    shift 2
+    # $CC and $CFLAGS are split into words on purpose.
+    if $CC -std=c11 $CFLAGS "$@" "$src" -o "$bin" >"$bin.build.log" 2>&1; then
+        run "$bin"
+    else
+        echo build-failed
+    fi
+}
+
+for src in "$dir"/[0-9][0-9]_*.c; do
+    name=$(basename "$src" .c)
+    case $name in
+    *"$filter"*) ;;
+    *) continue ;;
+    esac
+    threads=
+    if grep -q '<pthread.h>' "$src"; then
+        threads=-pthread
+    fi
+    bug=$(build_and_run "$src" "$out/$name.bug" $threads)
+    fix=$(build_and_run "$src" "$out/$name.fix" -DFIX $threads)
+    echo "$name bug:$bug fix:$fix"
+done
+echo "binaries and logs: $out" >&2
diff --git a/test/cases/detection/01_hof_strcpy_name/prog.c b/test/cases/detection/01_hof_strcpy_name/prog.c
new file mode 100644
index 00000000..b7541082
--- /dev/null
+++ b/test/cases/detection/01_hof_strcpy_name/prog.c
@@ -0,0 +1,59 @@
+// RFC 0034 detection set, case 01 (heap overflow): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: alice 30 bob 41 carolina 27
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct person {
+  char *name;
+  int age;
+  struct person *next;
+};
+
+static struct person *person_new(const char *name, int age) {
+  struct person *p = malloc(sizeof *p);
+  if (!p)
+    return NULL;
+#ifdef FIX
+  p->name = malloc(strlen(name) + 1);
+#else
+  p->name = malloc(strlen(name)); /* forgot the terminator */
+#endif
+  if (!p->name) {
+    free(p);
+    return NULL;
+  }
+  strcpy(p->name, name); // STOP
+  p->age = age;
+  p->next = NULL;
+  return p;
+}
+
+static void people_free(struct person *p) {
+  while (p) {
+    struct person *n = p->next;
+    free(p->name);
+    free(p);
+    p = n;
+  }
+}
+
+int main(int argc, char **argv) {
+  struct person *head = NULL;
+  for (int i = 1; i + 1 < argc; i += 2) {
+    struct person *p = person_new(argv[i], atoi(argv[i + 1]));
+    if (!p)
+      return 1;
+    p->next = head;
+    head = p;
+  }
+  for (struct person *p = head; p; p = p->next)
+    printf("%s is %d\n", p->name, p->age);
+  people_free(head);
+  return 0;
+}
diff --git a/test/cases/detection/02_hof_offbyone_parse/prog.c b/test/cases/detection/02_hof_offbyone_parse/prog.c
new file mode 100644
index 00000000..5b5133b7
--- /dev/null
+++ b/test/cases/detection/02_hof_offbyone_parse/prog.c
@@ -0,0 +1,52 @@
+// RFC 0034 detection set, case 02 (heap overflow): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 3,1,4,1,5
+#include <stdio.h>
+#include <stdlib.h>
+
+struct series {
+  int *vals;
+  size_t n;
+};
+
+static int series_parse(struct series *s, const char *csv) {
+  size_t n = 1;
+  for (const char *p = csv; *p; p++)
+    if (*p == ',')
+      n++;
+  s->vals = malloc(n * sizeof *s->vals);
+  if (!s->vals)
+    return -1;
+  s->n = n;
+  const char *p = csv;
+#ifdef FIX
+  for (size_t i = 0; i < n; i++) {
+#else
+  for (size_t i = 0; i <= n; i++) {
+#endif
+    char *end;
+    s->vals[i] = (int)strtol(p, &end, 10); // STOP
+    p = end;
+    if (*p == ',')
+      p++;
+  }
+  return 0;
+}
+
+int main(int argc, char **argv) {
+  if (argc < 2)
+    return 2;
+  struct series s;
+  if (series_parse(&s, argv[1]) != 0)
+    return 1;
+  long sum = 0;
+  for (size_t i = 0; i < s.n; i++)
+    sum += s.vals[i];
+  printf("n=%zu mean=%.2f\n", s.n, (double)sum / (double)s.n);
+  free(s.vals);
+  return 0;
+}
diff --git a/test/cases/detection/03_hof_read_declared_count/prog.c b/test/cases/detection/03_hof_read_declared_count/prog.c
new file mode 100644
index 00000000..977eb353
--- /dev/null
+++ b/test/cases/detection/03_hof_read_declared_count/prog.c
@@ -0,0 +1,58 @@
+// RFC 0034 detection set, case 03 (heap overflow): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: < stdin.txt
+#include <stdio.h>
+#include <stdlib.h>
+
+#define MAX_ITEMS 8
+
+struct msg {
+  unsigned declared; /* count from the header */
+  size_t got;        /* items actually present */
+  unsigned short *items;
+};
+
+static struct msg *msg_read(FILE *f) {
+  unsigned declared;
+  if (fscanf(f, "%u", &declared) != 1)
+    return NULL;
+  struct msg *m = calloc(1, sizeof *m);
+  if (!m)
+    return NULL;
+  m->items = malloc(MAX_ITEMS * sizeof *m->items);
+  if (!m->items) {
+    free(m);
+    return NULL;
+  }
+  unsigned v;
+  while (m->got < MAX_ITEMS && fscanf(f, "%u", &v) == 1)
+    m->items[m->got++] = (unsigned short)v;
+  m->declared = declared;
+  return m;
+}
+
+static unsigned msg_checksum(const struct msg *m) {
+  unsigned sum = 0;
+#ifdef FIX
+  size_t n = m->declared < m->got ? m->declared : m->got;
+#else
+  size_t n = m->declared; /* trusts the header */
+#endif
+  for (size_t i = 0; i < n; i++)
+    sum = sum * 31 + m->items[i]; // STOP
+  return sum;
+}
+
+int main(void) {
+  struct msg *m = msg_read(stdin);
+  if (!m)
+    return 1;
+  printf("items=%zu checksum=%u\n", m->got, msg_checksum(m));
+  free(m->items);
+  free(m);
+  return 0;
+}
diff --git a/test/cases/detection/03_hof_read_declared_count/stdin.txt b/test/cases/detection/03_hof_read_declared_count/stdin.txt
new file mode 100644
index 00000000..6736548e
--- /dev/null
+++ b/test/cases/detection/03_hof_read_declared_count/stdin.txt
@@ -0,0 +1 @@
+14 1 2 3 4 5 6 7 8
diff --git a/test/cases/detection/04_hof_sprintf_logger/prog.c b/test/cases/detection/04_hof_sprintf_logger/prog.c
new file mode 100644
index 00000000..346f102e
--- /dev/null
+++ b/test/cases/detection/04_hof_sprintf_logger/prog.c
@@ -0,0 +1,36 @@
+// RFC 0034 detection set, case 04 (heap overflow): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: bob alexander_the_great_of_macedon
+#include <stdio.h>
+#include <stdlib.h>
+
+struct logger {
+  char *line;
+  size_t cap;
+  unsigned seq;
+};
+
+static void log_user(struct logger *lg, const char *user, int id) {
+#ifdef FIX
+  snprintf(lg->line, lg->cap, "user=%s id=%d", user, id);
+#else
+  sprintf(lg->line, "user=%s id=%d", user, id); // STOP
+#endif
+  printf("[%u] %s\n", lg->seq++, lg->line);
+}
+
+int main(int argc, char **argv) {
+  struct logger lg = {0};
+  lg.cap = 24;
+  lg.line = malloc(lg.cap);
+  if (!lg.line)
+    return 1;
+  for (int i = 1; i < argc; i++)
+    log_user(&lg, argv[i], 1000 + i);
+  free(lg.line);
+  return 0;
+}
diff --git a/test/cases/detection/05_hof_strcat_pathjoin/prog.c b/test/cases/detection/05_hof_strcat_pathjoin/prog.c
new file mode 100644
index 00000000..6c01ee90
--- /dev/null
+++ b/test/cases/detection/05_hof_strcat_pathjoin/prog.c
@@ -0,0 +1,37 @@
+// RFC 0034 detection set, case 05 (heap overflow): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: /usr/local include share
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+static char *path_join(const char *dir, const char *file) {
+#ifdef FIX
+  char *out = malloc(strlen(dir) + strlen(file) + 2);
+#else
+  char *out = malloc(strlen(dir) + strlen(file) + 1); /* no room for '/' */
+#endif
+  if (!out)
+    return NULL;
+  strcpy(out, dir);
+  strcat(out, "/");
+  strcat(out, file); // STOP
+  return out;
+}
+
+int main(int argc, char **argv) {
+  if (argc < 3)
+    return 2;
+  for (int i = 2; i < argc; i++) {
+    char *p = path_join(argv[1], argv[i]);
+    if (!p)
+      return 1;
+    printf("%s (%zu)\n", p, strlen(p));
+    free(p);
+  }
+  return 0;
+}
diff --git a/test/cases/detection/06_hof_memcpy_packet/prog.c b/test/cases/detection/06_hof_memcpy_packet/prog.c
new file mode 100644
index 00000000..acfea986
--- /dev/null
+++ b/test/cases/detection/06_hof_memcpy_packet/prog.c
@@ -0,0 +1,57 @@
+// RFC 0034 detection set, case 06 (heap overflow): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 4 HELLO_WORLD_PAYLOAD
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct packet {
+  unsigned char type;
+  size_t len;
+  unsigned char *payload;
+};
+
+static struct packet *packet_parse(const unsigned char *raw, size_t rawlen) {
+  if (rawlen < 2)
+    return NULL;
+  struct packet *p = malloc(sizeof *p);
+  if (!p)
+    return NULL;
+  p->type = raw[0];
+  p->len = raw[1]; /* declared payload length */
+  p->payload = calloc(1, p->len ? p->len : 1);
+  if (!p->payload) {
+    free(p);
+    return NULL;
+  }
+#ifdef FIX
+  size_t n = rawlen - 2 < p->len ? rawlen - 2 : p->len;
+#else
+  size_t n = rawlen - 2; /* copies what arrived, not what was declared */
+#endif
+  memcpy(p->payload, raw + 2, n); // STOP
+  return p;
+}
+
+int main(int argc, char **argv) {
+  if (argc < 3)
+    return 2;
+  unsigned char raw[256];
+  size_t body = strlen(argv[2]);
+  if (body > sizeof raw - 2)
+    body = sizeof raw - 2;
+  raw[0] = 'T';
+  raw[1] = (unsigned char)atoi(argv[1]);
+  memcpy(raw + 2, argv[2], body);
+  struct packet *p = packet_parse(raw, body + 2);
+  if (!p)
+    return 1;
+  printf("type=%c len=%zu first=%c\n", p->type, p->len, p->len ? p->payload[0] : '-');
+  free(p->payload);
+  free(p);
+  return 0;
+}
diff --git a/test/cases/detection/07_hof_intoverflow_size/prog.c b/test/cases/detection/07_hof_intoverflow_size/prog.c
new file mode 100644
index 00000000..2f585ed2
--- /dev/null
+++ b/test/cases/detection/07_hof_intoverflow_size/prog.c
@@ -0,0 +1,57 @@
+// RFC 0034 detection set, case 07 (heap overflow): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 268435457 < stdin.txt
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+struct item {
+  uint32_t id;
+  uint32_t qty;
+  uint64_t price;
+};
+
+#define MAX_ITEMS 1024u
+
+static struct item *items_alloc(uint32_t n) {
+#ifdef FIX
+  if (n > MAX_ITEMS)
+    n = MAX_ITEMS;
+  return calloc(n ? n : 1, sizeof(struct item));
+#else
+  uint32_t bytes = n * (uint32_t)sizeof(struct item); /* wraps for large n */
+  return malloc(bytes);
+#endif
+}
+
+int main(int argc, char **argv) {
+  if (argc < 2)
+    return 2;
+  uint32_t n = (uint32_t)strtoul(argv[1], NULL, 10);
+  struct item *items = items_alloc(n);
+  if (!items)
+    return 1;
+#ifdef FIX
+  if (n > MAX_ITEMS)
+    n = MAX_ITEMS;
+#endif
+  uint32_t k = 0;
+  unsigned id, qty;
+  unsigned long long price;
+  while (k < n && scanf("%u %u %llu", &id, &qty, &price) == 3) {
+    items[k].id = id; // STOP
+    items[k].qty = qty;
+    items[k].price = price;
+    k++;
+  }
+  uint64_t total = 0;
+  for (uint32_t i = 0; i < k; i++)
+    total += items[i].qty * items[i].price;
+  printf("%u items, total %llu\n", k, (unsigned long long)total);
+  free(items);
+  return 0;
+}
diff --git a/test/cases/detection/07_hof_intoverflow_size/stdin.txt b/test/cases/detection/07_hof_intoverflow_size/stdin.txt
new file mode 100644
index 00000000..d6e3e1a4
--- /dev/null
+++ b/test/cases/detection/07_hof_intoverflow_size/stdin.txt
@@ -0,0 +1,3 @@
+1 2 300
+4 5 600
+7 8 900
diff --git a/test/cases/detection/08_hof_realloc_bytes/prog.c b/test/cases/detection/08_hof_realloc_bytes/prog.c
new file mode 100644
index 00000000..0eb3484c
--- /dev/null
+++ b/test/cases/detection/08_hof_realloc_bytes/prog.c
@@ -0,0 +1,44 @@
+// RFC 0034 detection set, case 08 (heap overflow): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 5 6 7 8 9 10
+#include <stdio.h>
+#include <stdlib.h>
+
+struct intvec {
+  int *data;
+  size_t len, cap;
+};
+
+static int vec_push(struct intvec *v, int x) {
+  if (v->len == v->cap) {
+    size_t ncap = v->cap ? v->cap * 2 : 4;
+#ifdef FIX
+    int *nd = realloc(v->data, ncap * sizeof *nd);
+#else
+    int *nd = realloc(v->data, ncap); /* bytes, not elements */
+#endif
+    if (!nd)
+      return -1;
+    v->data = nd;
+    v->cap = ncap;
+  }
+  v->data[v->len++] = x; // STOP
+  return 0;
+}
+
+int main(int argc, char **argv) {
+  struct intvec v = {0};
+  for (int i = 1; i < argc; i++)
+    if (vec_push(&v, atoi(argv[i])) != 0)
+      return 1;
+  long sum = 0;
+  for (size_t i = 0; i < v.len; i++)
+    sum += v.data[i];
+  printf("len=%zu sum=%ld\n", v.len, sum);
+  free(v.data);
+  return 0;
+}
diff --git a/test/cases/detection/09_hunder_rtrim/prog.c b/test/cases/detection/09_hunder_rtrim/prog.c
new file mode 100644
index 00000000..9fddfb68
--- /dev/null
+++ b/test/cases/detection/09_hunder_rtrim/prog.c
@@ -0,0 +1,36 @@
+// RFC 0034 detection set, case 09 (heap underflow): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 'abc  ' '        '
+#include <ctype.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+static char *rtrim(char *s) {
+  size_t len = strlen(s);
+#ifdef FIX
+  while (len > 0 && isspace((unsigned char)s[len - 1]))
+    len--;
+#else
+  while (isspace((unsigned char)s[len - 1])) // STOP
+    len--;
+#endif
+  s[len] = '\0';
+  return s;
+}
+
+int main(int argc, char **argv) {
+  for (int i = 1; i < argc; i++) {
+    char *copy = malloc(strlen(argv[i]) + 1);
+    if (!copy)
+      return 1;
+    strcpy(copy, argv[i]);
+    printf("[%s]\n", rtrim(copy));
+    free(copy);
+  }
+  return 0;
+}
diff --git a/test/cases/detection/10_hunder_undo_stack/prog.c b/test/cases/detection/10_hunder_undo_stack/prog.c
new file mode 100644
index 00000000..a4d32dcc
--- /dev/null
+++ b/test/cases/detection/10_hunder_undo_stack/prog.c
@@ -0,0 +1,51 @@
+// RFC 0034 detection set, case 10 (heap underflow): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 5 6 u u u
+#include <stdio.h>
+#include <stdlib.h>
+
+struct history {
+  int *slots;
+  int cap;
+  int top;
+};
+
+static int hist_init(struct history *h, int cap) {
+  h->slots = calloc((size_t)cap, sizeof *h->slots);
+  h->cap = cap;
+  h->top = 0;
+  return h->slots ? 0 : -1;
+}
+
+static void hist_push(struct history *h, int v) {
+  if (h->top < h->cap)
+    h->slots[h->top++] = v;
+}
+
+static void hist_undo(struct history *h) {
+#ifdef FIX
+  if (h->top == 0)
+    return;
+#endif
+  h->top--;
+  h->slots[h->top] = 0; // STOP
+}
+
+int main(int argc, char **argv) {
+  struct history h;
+  if (hist_init(&h, 4) != 0)
+    return 1;
+  for (int i = 1; i < argc; i++) {
+    if (argv[i][0] == 'u')
+      hist_undo(&h);
+    else
+      hist_push(&h, atoi(argv[i]));
+  }
+  printf("depth=%d\n", h.top);
+  free(h.slots);
+  return 0;
+}
diff --git a/test/cases/detection/11_hadj_image_stride/prog.c b/test/cases/detection/11_hadj_image_stride/prog.c
new file mode 100644
index 00000000..2dcf91ea
--- /dev/null
+++ b/test/cases/detection/11_hadj_image_stride/prog.c
@@ -0,0 +1,60 @@
+// RFC 0034 detection set, case 11 (heap stride into a neighbour): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 64 4 10 6
+#include <stdio.h>
+#include <stdlib.h>
+
+struct image {
+  int w, h;
+  unsigned char *px;
+};
+
+static struct image *image_new(int w, int h) {
+  struct image *im = malloc(sizeof *im);
+  if (!im)
+    return NULL;
+  im->w = w;
+  im->h = h;
+  im->px = calloc((size_t)w * (size_t)h, 1);
+  if (!im->px) {
+    free(im);
+    return NULL;
+  }
+  return im;
+}
+
+static void image_set(struct image *im, int x, int y, unsigned char v) {
+#ifdef FIX
+  if (x < 0 || y < 0 || x >= im->w || y >= im->h)
+    return;
+#endif
+  im->px[(size_t)y * (size_t)im->w + (size_t)x] = v; // STOP // MISS: the stride lands in the neighbouring live block, and the guard checks the accessed address
+}
+
+static unsigned image_sum(const struct image *im) {
+  unsigned s = 0;
+  for (int i = 0; i < im->w * im->h; i++)
+    s += im->px[i];
+  return s;
+}
+
+int main(int argc, char **argv) {
+  if (argc < 5)
+    return 2;
+  int w = atoi(argv[1]), h = atoi(argv[2]);
+  struct image *a = image_new(w, h);
+  struct image *b = image_new(w, h);
+  if (!a || !b)
+    return 1;
+  image_set(a, atoi(argv[3]), atoi(argv[4]), 200);
+  printf("a=%u b=%u\n", image_sum(a), image_sum(b));
+  free(a->px);
+  free(a);
+  free(b->px);
+  free(b);
+  return 0;
+}
diff --git a/test/cases/detection/12_hadj_matrix_row/prog.c b/test/cases/detection/12_hadj_matrix_row/prog.c
new file mode 100644
index 00000000..c2f0ab6a
--- /dev/null
+++ b/test/cases/detection/12_hadj_matrix_row/prog.c
@@ -0,0 +1,54 @@
+// RFC 0034 detection set, case 12 (heap stride into a neighbour): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 8 32 1 9
+#include <stdio.h>
+#include <stdlib.h>
+
+struct matrix {
+  size_t rows, cols;
+  double *cells;
+};
+
+static int matrix_init(struct matrix *m, size_t rows, size_t cols) {
+  m->rows = rows;
+  m->cols = cols;
+  m->cells = calloc(rows * cols, sizeof *m->cells);
+  return m->cells ? 0 : -1;
+}
+
+static double *matrix_row(struct matrix *m, size_t r) { return m->cells + r * m->cols; }
+
+/* rows are numbered from 1 in the input format */
+static void matrix_add_row(struct matrix *m, size_t row1, double v) {
+#ifdef FIX
+  if (row1 == 0 || row1 > m->rows)
+    return;
+  double *row = matrix_row(m, row1 - 1);
+#else
+  double *row = matrix_row(m, row1); /* forgot the -1 */
+#endif
+  for (size_t c = 0; c < m->cols; c++)
+    row[c] += v; // STOP
+}
+
+int main(int argc, char **argv) {
+  if (argc < 4)
+    return 2;
+  struct matrix weights, bias;
+  size_t rows = strtoul(argv[1], NULL, 10), cols = strtoul(argv[2], NULL, 10);
+  if (matrix_init(&weights, rows, cols) || matrix_init(&bias, rows, cols))
+    return 1;
+  for (int i = 3; i < argc; i++)
+    matrix_add_row(&weights, strtoul(argv[i], NULL, 10), 1.5);
+  double s = 0;
+  for (size_t i = 0; i < rows * cols; i++)
+    s += weights.cells[i] - bias.cells[i];
+  printf("sum=%.1f bias0=%.1f\n", s, bias.cells[0]);
+  free(weights.cells);
+  free(bias.cells);
+  return 0;
+}
diff --git a/test/cases/detection/13_stack_strcpy_route/prog.c b/test/cases/detection/13_stack_strcpy_route/prog.c
new file mode 100644
index 00000000..313a8826
--- /dev/null
+++ b/test/cases/detection/13_stack_strcpy_route/prog.c
@@ -0,0 +1,35 @@
+// RFC 0034 detection set, case 13 (stack overflow): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: GET /api/v1/users/12345/profile/settings
+#include <stdio.h>
+#include <string.h>
+
+struct request {
+  const char *method;
+  const char *path;
+};
+
+static void handle(const struct request *r) {
+  char route[16];
+#ifdef FIX
+  snprintf(route, sizeof route, "%s", r->path);
+#else
+  strcpy(route, r->path); // STOP
+#endif
+  for (char *p = route; *p; p++)
+    if (*p == '/')
+      *p = '_';
+  printf("%s -> handler%s\n", r->method, route);
+}
+
+int main(int argc, char **argv) {
+  if (argc < 3)
+    return 2;
+  struct request r = {argv[1], argv[2]};
+  handle(&r);
+  return 0;
+}
diff --git a/test/cases/detection/14_stack_offbyone_read/prog.c b/test/cases/detection/14_stack_offbyone_read/prog.c
new file mode 100644
index 00000000..47588685
--- /dev/null
+++ b/test/cases/detection/14_stack_offbyone_read/prog.c
@@ -0,0 +1,35 @@
+// RFC 0034 detection set, case 14 (stack overflow): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 3 9 2 7 4 8 1 6
+#include <stdio.h>
+#include <stdlib.h>
+
+#define NSAMPLES 8
+
+static int peak(const int *s, int n) {
+  int best = s[0];
+#ifdef FIX
+  for (int i = 1; i < n; i++)
+#else
+  for (int i = 1; i <= n; i++)
+#endif
+    if (s[i] > best) // STOP
+      best = s[i];
+  return best;
+}
+
+int main(int argc, char **argv) {
+  int samples[NSAMPLES];
+  int n = 0;
+  for (int i = 1; i < argc && n < NSAMPLES; i++)
+    samples[n++] = atoi(argv[i]);
+  if (n == 0)
+    return 2;
+  int guard_val = argc * 1000;
+  printf("peak=%d (%d)\n", peak(samples, n), guard_val); // STOP // (requirement of peak())
+  return 0;
+}
diff --git a/test/cases/detection/15_stack_intraobj_admin/prog.c b/test/cases/detection/15_stack_intraobj_admin/prog.c
new file mode 100644
index 00000000..0648c8f0
--- /dev/null
+++ b/test/cases/detection/15_stack_intraobj_admin/prog.c
@@ -0,0 +1,34 @@
+// RFC 0034 detection set, case 15 (stack overflow): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: administrat
+#include <stdio.h>
+#include <string.h>
+
+struct account {
+  char user[8];
+  int is_admin;
+  int balance;
+};
+
+static void login(struct account *a, const char *user) {
+  a->is_admin = 0;
+  a->balance = 100;
+#ifdef FIX
+  snprintf(a->user, sizeof a->user, "%s", user);
+#else
+  strcpy(a->user, user); // STOP
+#endif
+}
+
+int main(int argc, char **argv) {
+  if (argc < 2)
+    return 2;
+  struct account acct;
+  login(&acct, argv[1]);
+  printf("user=%.8s admin=%s\n", acct.user, acct.is_admin ? "yes" : "no");
+  return 0;
+}
diff --git a/test/cases/detection/16_stack_member_index/prog.c b/test/cases/detection/16_stack_member_index/prog.c
new file mode 100644
index 00000000..4129c8e1
--- /dev/null
+++ b/test/cases/detection/16_stack_member_index/prog.c
@@ -0,0 +1,33 @@
+// RFC 0034 detection set, case 16 (stack overflow): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 0 80 1 443 5 9999
+#include <stdio.h>
+#include <stdlib.h>
+
+struct config {
+  int ports[4];
+  int nports;
+  int timeout;
+};
+
+static void set_port(struct config *cfg, int idx, int port) {
+#ifdef FIX
+  if (idx < 0 || idx >= 4)
+    return;
+#endif
+  cfg->ports[idx] = port; // STOP
+  if (idx >= cfg->nports)
+    cfg->nports = idx + 1;
+}
+
+int main(int argc, char **argv) {
+  struct config cfg = {{0}, 0, 30};
+  for (int i = 1; i + 1 < argc; i += 2)
+    set_port(&cfg, atoi(argv[i]), atoi(argv[i + 1]));
+  printf("nports=%d timeout=%d\n", cfg.nports, cfg.timeout);
+  return 0;
+}
diff --git a/test/cases/detection/17_stack_callee_cursor/prog.c b/test/cases/detection/17_stack_callee_cursor/prog.c
new file mode 100644
index 00000000..7f864ecd
--- /dev/null
+++ b/test/cases/detection/17_stack_callee_cursor/prog.c
@@ -0,0 +1,30 @@
+// RFC 0034 detection set, case 17 (stack overflow): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 'supercalifragilistic expialidocious'
+#include <stdio.h>
+
+static void copy_word(char *dst, const char *src) {
+#ifdef FIX
+  char *end = dst + 7;
+  while (*src && *src != ' ' && dst < end)
+    *dst++ = *src++;
+#else
+  while (*src && *src != ' ')
+    *dst++ = *src++; // STOP
+#endif
+  *dst = '\0';
+}
+
+int main(int argc, char **argv) {
+  if (argc < 2)
+    return 2;
+  char word[8];
+  int count = argc;
+  copy_word(word, argv[1]);
+  printf("first word: %s (%d)\n", word, count);
+  return 0;
+}
diff --git a/test/cases/detection/18_stack_sprintf_addr/prog.c b/test/cases/detection/18_stack_sprintf_addr/prog.c
new file mode 100644
index 00000000..4cb000ba
--- /dev/null
+++ b/test/cases/detection/18_stack_sprintf_addr/prog.c
@@ -0,0 +1,36 @@
+// RFC 0034 detection set, case 18 (stack overflow): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: very.long.hostname.example.com 8080
+#include <stdio.h>
+#include <stdlib.h>
+
+#ifdef FIX
+static void format_addr(char *out, size_t cap, const char *host, int port) {
+  snprintf(out, cap, "%s:%d", host, port);
+}
+#else
+static void format_addr(char *out, const char *host, int port) {
+  sprintf(out, "%s:%d", host, port); // STOP
+}
+#endif
+
+static int connect_to(const char *host, int port) {
+  char addr[24];
+#ifdef FIX
+  format_addr(addr, sizeof addr, host, port);
+#else
+  format_addr(addr, host, port);
+#endif
+  printf("connecting to %s\n", addr);
+  return 0;
+}
+
+int main(int argc, char **argv) {
+  if (argc < 3)
+    return 2;
+  return connect_to(argv[1], atoi(argv[2]));
+}
diff --git a/test/cases/detection/19_glob_histogram/prog.c b/test/cases/detection/19_glob_histogram/prog.c
new file mode 100644
index 00000000..7271e25f
--- /dev/null
+++ b/test/cases/detection/19_glob_histogram/prog.c
@@ -0,0 +1,35 @@
+// RFC 0034 detection set, case 19 (global overflow): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: < stdin.txt
+#include <stdio.h>
+
+#define NBUCKETS 10
+
+static unsigned histogram[NBUCKETS];
+static unsigned total;
+
+static void record(int score) {
+#ifdef FIX
+  int bucket = score >= 100 ? NBUCKETS - 1 : score / 10;
+#else
+  int bucket = score / 10; /* 100 maps to bucket 10 */
+#endif
+  if (bucket < 0)
+    return;
+  histogram[bucket]++; // STOP
+  total++;
+}
+
+int main(void) {
+  int s;
+  while (scanf("%d", &s) == 1)
+    record(s);
+  for (int i = 0; i < NBUCKETS; i++)
+    printf("%3d-%3d: %u\n", i * 10, i * 10 + 9, histogram[i]);
+  printf("total %u\n", total);
+  return 0;
+}
diff --git a/test/cases/detection/19_glob_histogram/stdin.txt b/test/cases/detection/19_glob_histogram/stdin.txt
new file mode 100644
index 00000000..52d9eff2
--- /dev/null
+++ b/test/cases/detection/19_glob_histogram/stdin.txt
@@ -0,0 +1 @@
+5 17 100 42 99 100
diff --git a/test/cases/detection/20_glob_strcpy_progname/prog.c b/test/cases/detection/20_glob_strcpy_progname/prog.c
new file mode 100644
index 00000000..95258546
--- /dev/null
+++ b/test/cases/detection/20_glob_strcpy_progname/prog.c
@@ -0,0 +1,33 @@
+// RFC 0034 detection set, case 20 (global overflow): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: /opt/tools/bin/my-very-long-program-name
+#include <stdio.h>
+#include <string.h>
+
+static char g_progname[16];
+static int g_verbose;
+
+static void set_progname(const char *path) {
+  const char *s = strrchr(path, '/');
+  s = s ? s + 1 : path;
+#ifdef FIX
+  snprintf(g_progname, sizeof g_progname, "%s", s);
+#else
+  strcpy(g_progname, s); // STOP
+#endif
+}
+
+static void warn(const char *msg) { fprintf(stdout, "%s: %s (verbose=%d)\n", g_progname, msg, g_verbose); }
+
+int main(int argc, char **argv) {
+  if (argc < 2)
+    return 2;
+  set_progname(argv[1]);
+  g_verbose = argc > 2;
+  warn("starting");
+  return 0;
+}
diff --git a/test/cases/detection/21_glob_cursor_unterminated/prog.c b/test/cases/detection/21_glob_cursor_unterminated/prog.c
new file mode 100644
index 00000000..75578d6d
--- /dev/null
+++ b/test/cases/detection/21_glob_cursor_unterminated/prog.c
@@ -0,0 +1,37 @@
+// RFC 0034 detection set, case 21 (global overflow): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: ABCDEFGHIJ
+#include <stdio.h>
+#include <string.h>
+
+static char g_tag[8];
+static char g_motd[32] = "welcome to the system";
+
+static void set_tag(const char *s) {
+#ifdef FIX
+  strncpy(g_tag, s, sizeof g_tag - 1);
+  g_tag[sizeof g_tag - 1] = '\0';
+#else
+  strncpy(g_tag, s, sizeof g_tag); /* no terminator when s is long */
+#endif
+}
+
+static size_t tag_len(void) {
+  size_t n = 0;
+  const char *p = g_tag;
+  while (*p++) // STOP
+    n++;
+  return n;
+}
+
+int main(int argc, char **argv) {
+  if (argc < 2)
+    return 2;
+  set_tag(argv[1]);
+  printf("tag length %zu; %s\n", tag_len(), g_motd);
+  return 0;
+}
diff --git a/test/cases/detection/22_glob_negative_index/prog.c b/test/cases/detection/22_glob_negative_index/prog.c
new file mode 100644
index 00000000..0872ca4c
--- /dev/null
+++ b/test/cases/detection/22_glob_negative_index/prog.c
@@ -0,0 +1,28 @@
+// RFC 0034 detection set, case 22 (global overflow): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 2 0
+#include <stdio.h>
+#include <stdlib.h>
+
+static int g_retry_limit[4] = {1, 3, 5, 10};
+static int g_backoff_ms[4] = {10, 100, 1000, 5000};
+
+/* levels are 1-based in the config file */
+static int retries_for(int level) {
+#ifdef FIX
+  if (level < 1 || level > 4)
+    return 0;
+#endif
+  return g_backoff_ms[level - 1] / 10; // STOP
+}
+
+int main(int argc, char **argv) {
+  for (int i = 1; i < argc; i++)
+    printf("level %s -> %d\n", argv[i], retries_for(atoi(argv[i])));
+  g_retry_limit[0] = argc;
+  return g_retry_limit[0] == 0;
+}
diff --git a/test/cases/detection/23_uaf_list_pop/prog.c b/test/cases/detection/23_uaf_list_pop/prog.c
new file mode 100644
index 00000000..894f1ac9
--- /dev/null
+++ b/test/cases/detection/23_uaf_list_pop/prog.c
@@ -0,0 +1,59 @@
+// RFC 0034 detection set, case 23 (use after free): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 1 2 3 4
+#include <stdio.h>
+#include <stdlib.h>
+
+struct node {
+  int val;
+  struct node *next;
+};
+
+struct list {
+  struct node *head;
+  size_t len;
+};
+
+static int list_push(struct list *l, int v) {
+  struct node *n = malloc(sizeof *n);
+  if (!n)
+    return -1;
+  n->val = v;
+  n->next = l->head;
+  l->head = n;
+  l->len++;
+  return 0;
+}
+
+static void list_pop(struct list *l) {
+  struct node *n = l->head;
+  if (!n)
+    return;
+  l->head = n->next;
+  l->len--;
+  free(n);
+}
+
+int main(int argc, char **argv) {
+  struct list l = {0};
+  for (int i = 1; i < argc; i++)
+    if (list_push(&l, atoi(argv[i])))
+      return 1;
+  while (l.len > 1) {
+    struct node *top = l.head;
+#ifdef FIX
+    int v = top->val;
+    list_pop(&l);
+    printf("popped %d\n", v);
+#else
+    list_pop(&l);
+    printf("popped %d\n", top->val); // STOP
+#endif
+  }
+  list_pop(&l);
+  return 0;
+}
diff --git a/test/cases/detection/24_uaf_session_alias/prog.c b/test/cases/detection/24_uaf_session_alias/prog.c
new file mode 100644
index 00000000..1f599d91
--- /dev/null
+++ b/test/cases/detection/24_uaf_session_alias/prog.c
@@ -0,0 +1,69 @@
+// RFC 0034 detection set, case 24 (use after free): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 103 alice bob carol
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct user {
+  char name[32];
+  int id;
+};
+
+struct session {
+  struct user *user;
+  int token;
+};
+
+struct registry {
+  struct user *users[8];
+  int n;
+};
+
+static struct user *registry_add(struct registry *r, const char *name, int id) {
+  if (r->n == 8)
+    return NULL;
+  struct user *u = calloc(1, sizeof *u);
+  if (!u)
+    return NULL;
+  snprintf(u->name, sizeof u->name, "%s", name);
+  u->id = id;
+  r->users[r->n++] = u;
+  return u;
+}
+
+static void registry_remove(struct registry *r, int id) {
+  for (int i = 0; i < r->n; i++) {
+    if (r->users[i]->id == id) {
+      free(r->users[i]);
+      r->users[i] = r->users[--r->n];
+      return;
+    }
+  }
+}
+
+int main(int argc, char **argv) {
+  if (argc < 3)
+    return 2;
+  struct registry reg = {0};
+  for (int i = 2; i < argc; i++)
+    registry_add(&reg, argv[i], 100 + i);
+  struct session s = {reg.users[1], 4242};
+  int victim = atoi(argv[1]);
+#ifdef FIX
+  if (s.user && s.user->id == victim)
+    s.user = NULL; /* invalidate the session before the user goes */
+#endif
+  registry_remove(&reg, victim);
+#ifdef FIX
+  if (s.user)
+#endif
+    printf("session %d belongs to %s\n", s.token, s.user->name); // STOP
+  for (int i = 0; i < reg.n; i++)
+    free(reg.users[i]);
+  return 0;
+}
diff --git a/test/cases/detection/25_uaf_realloc_elemptr/prog.c b/test/cases/detection/25_uaf_realloc_elemptr/prog.c
new file mode 100644
index 00000000..7943b2c7
--- /dev/null
+++ b/test/cases/detection/25_uaf_realloc_elemptr/prog.c
@@ -0,0 +1,52 @@
+// RFC 0034 detection set, case 25 (use after free): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 7 8 9 10 11 12
+#include <stdio.h>
+#include <stdlib.h>
+
+struct vec {
+  int *data;
+  size_t len, cap;
+};
+
+static int vec_push(struct vec *v, int x) {
+  if (v->len == v->cap) {
+    size_t ncap = v->cap ? v->cap * 2 : 2;
+    int *nd = realloc(v->data, ncap * sizeof *nd);
+    if (!nd)
+      return -1;
+    v->data = nd;
+    v->cap = ncap;
+  }
+  v->data[v->len++] = x;
+  return 0;
+}
+
+int main(int argc, char **argv) {
+  if (argc < 2)
+    return 2;
+  struct vec v = {0};
+  if (vec_push(&v, atoi(argv[1])))
+    return 1;
+#ifdef FIX
+  size_t first = 0;
+#else
+  int *first = &v.data[0]; /* pointer into the buffer */
+#endif
+  for (int i = 2; i < argc; i++)
+    if (vec_push(&v, atoi(argv[i])))
+      return 1;
+#ifdef FIX
+  v.data[first] += 1000;
+  printf("first=%d len=%zu\n", v.data[first], v.len);
+#else
+  *first += 1000; // STOP
+  printf("first=%d len=%zu\n", *first, v.len);
+#endif
+  free(v.data);
+  return 0;
+}
diff --git a/test/cases/detection/26_uaf_xtu_conn/conn.c b/test/cases/detection/26_uaf_xtu_conn/conn.c
new file mode 100644
index 00000000..a1e89e3f
--- /dev/null
+++ b/test/cases/detection/26_uaf_xtu_conn/conn.c
@@ -0,0 +1,32 @@
+#include "conn.h"
+#include <stdlib.h>
+#include <string.h>
+
+struct conn *conn_open(int fd, size_t cap) {
+  struct conn *c = calloc(1, sizeof *c);
+  if (!c)
+    return NULL;
+  c->rbuf = calloc(1, cap);
+  if (!c->rbuf) {
+    free(c);
+    return NULL;
+  }
+  c->fd = fd;
+  c->rcap = cap;
+  return c;
+}
+
+size_t conn_feed(struct conn *c, const char *data) {
+  size_t n = strlen(data);
+  if (n > c->rcap - c->rlen - 1)
+    n = c->rcap - c->rlen - 1;
+  memcpy(c->rbuf + c->rlen, data, n);
+  c->rlen += n;
+  c->rbuf[c->rlen] = '\0';
+  return n;
+}
+
+void conn_close(struct conn *c) {
+  free(c->rbuf);
+  free(c);
+}
diff --git a/test/cases/detection/26_uaf_xtu_conn/conn.h b/test/cases/detection/26_uaf_xtu_conn/conn.h
new file mode 100644
index 00000000..938e63b0
--- /dev/null
+++ b/test/cases/detection/26_uaf_xtu_conn/conn.h
@@ -0,0 +1,14 @@
+#ifndef CONN_H
+#define CONN_H
+#include <stddef.h>
+
+struct conn {
+  int fd;
+  char *rbuf;
+  size_t rlen, rcap;
+};
+
+struct conn *conn_open(int fd, size_t cap);
+size_t conn_feed(struct conn *c, const char *data);
+void conn_close(struct conn *c);
+#endif
diff --git a/test/cases/detection/26_uaf_xtu_conn/main.c b/test/cases/detection/26_uaf_xtu_conn/main.c
new file mode 100644
index 00000000..43fa4601
--- /dev/null
+++ b/test/cases/detection/26_uaf_xtu_conn/main.c
@@ -0,0 +1,39 @@
+// RFC 0034 detection set, case 26 (use after free): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// UNITS: conn.c
+// RUN-INPUT: HELO MAIL QUIT
+#include "conn.h"
+#include <stdio.h>
+#include <string.h>
+
+static int handle_line(struct conn *c, const char *line) {
+  if (strcmp(line, "QUIT") == 0) {
+    conn_close(c);
+    return 1;
+  }
+  conn_feed(c, line);
+  conn_feed(c, ";");
+  return 0;
+}
+
+int main(int argc, char **argv) {
+  struct conn *c = conn_open(3, 64);
+  if (!c)
+    return 1;
+  int closed = 0;
+  for (int i = 1; i < argc && !closed; i++)
+    closed = handle_line(c, argv[i]);
+#ifdef FIX
+  if (!closed)
+#endif
+    printf("fd %d: %zu bytes buffered: %s\n", c->fd, c->rlen, c->rbuf); // STOP
+#ifdef FIX
+  if (!closed)
+    conn_close(c);
+#endif
+  return 0;
+}
diff --git a/test/cases/detection/27_uaf_callback_ctx/prog.c b/test/cases/detection/27_uaf_callback_ctx/prog.c
new file mode 100644
index 00000000..8f7579c6
--- /dev/null
+++ b/test/cases/detection/27_uaf_callback_ctx/prog.c
@@ -0,0 +1,58 @@
+// RFC 0034 detection set, case 27 (use after free): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: tick tick done
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+typedef int (*handler_fn)(void *ctx, const char *ev);
+
+struct listener {
+  handler_fn fn;
+  void *ctx;
+};
+
+struct job {
+  char name[16];
+  int runs;
+};
+
+static int on_event(void *ctx, const char *ev) {
+  struct job *j = ctx;
+  j->runs++;
+  if (strcmp(ev, "done") == 0) {
+    free(j); /* the job owns itself once it is done */
+    return 1;
+  }
+  return 0;
+}
+
+static void dispatch(struct listener *l, const char *ev) {
+  int finished = l->fn(l->ctx, ev);
+#ifdef FIX
+  if (finished) {
+    printf("job finished\n");
+    l->ctx = NULL;
+    return;
+  }
+#else
+  (void)finished;
+#endif
+  struct job *j = l->ctx;
+  printf("%s: %s after %d runs\n", j->name, ev, j->runs); // STOP
+}
+
+int main(int argc, char **argv) {
+  struct job *j = calloc(1, sizeof *j);
+  if (!j)
+    return 1;
+  snprintf(j->name, sizeof j->name, "backup");
+  struct listener l = {on_event, j};
+  for (int i = 1; i < argc && l.ctx; i++)
+    dispatch(&l, argv[i]);
+  return 0;
+}
diff --git a/test/cases/detection/28_uaf_strdup_value/prog.c b/test/cases/detection/28_uaf_strdup_value/prog.c
new file mode 100644
index 00000000..d1f6980d
--- /dev/null
+++ b/test/cases/detection/28_uaf_strdup_value/prog.c
@@ -0,0 +1,42 @@
+// RFC 0034 detection set, case 28 (use after free): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: name=weavec level=3
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+/* returns the value of a "key=value" line, or NULL */
+static char *config_value(const char *line) {
+  char *copy = strdup(line);
+  if (!copy)
+    return NULL;
+  char *eq = strchr(copy, '=');
+  if (!eq) {
+    free(copy);
+    return NULL;
+  }
+#ifdef FIX
+  char *v = strdup(eq + 1);
+#else
+  char *v = eq + 1;
+#endif
+  free(copy);
+  return v;
+}
+
+int main(int argc, char **argv) {
+  for (int i = 1; i < argc; i++) {
+    char *v = config_value(argv[i]);
+    if (!v)
+      continue;
+    printf("value=%s len=%zu\n", v, strlen(v)); // STOP
+#ifdef FIX
+    free(v);
+#endif
+  }
+  return 0;
+}
diff --git a/test/cases/detection/29_uaf_getline_first/prog.c b/test/cases/detection/29_uaf_getline_first/prog.c
new file mode 100644
index 00000000..64c97b5b
--- /dev/null
+++ b/test/cases/detection/29_uaf_getline_first/prog.c
@@ -0,0 +1,36 @@
+// RFC 0034 detection set, case 29 (use after free): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: < stdin.txt
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+int main(void) {
+  char *line = NULL;
+  size_t cap = 0;
+  ssize_t n;
+  char *first = NULL;
+  size_t count = 0, bytes = 0;
+  while ((n = getline(&line, &cap, stdin)) > 0) {
+    if (!first) {
+#ifdef FIX
+      first = strdup(line);
+#else
+      first = line; /* keeps getline's buffer, not a copy */
+#endif
+    }
+    count++;
+    bytes += (size_t)n;
+  }
+  free(line);
+  if (first)
+    printf("%zu lines, %zu bytes, first: %s", count, bytes, first); // STOP
+#ifdef FIX
+  free(first);
+#endif
+  return 0;
+}
diff --git a/test/cases/detection/29_uaf_getline_first/stdin.txt b/test/cases/detection/29_uaf_getline_first/stdin.txt
new file mode 100644
index 00000000..3b81ba28
--- /dev/null
+++ b/test/cases/detection/29_uaf_getline_first/stdin.txt
@@ -0,0 +1,3 @@
+first line here
+second
+third line
diff --git a/test/cases/detection/30_uaf_table_resize/prog.c b/test/cases/detection/30_uaf_table_resize/prog.c
new file mode 100644
index 00000000..29563bc2
--- /dev/null
+++ b/test/cases/detection/30_uaf_table_resize/prog.c
@@ -0,0 +1,67 @@
+// RFC 0034 detection set, case 30 (use after free): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: the cat sat on the mat
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct entry {
+  char word[16];
+  int count;
+  int followers;
+};
+
+struct table {
+  struct entry *e;
+  size_t n, cap;
+};
+
+static struct entry *table_get(struct table *t, const char *w) {
+  for (size_t i = 0; i < t->n; i++)
+    if (strcmp(t->e[i].word, w) == 0)
+      return &t->e[i];
+  if (t->n == t->cap) {
+    size_t ncap = t->cap ? t->cap * 2 : 2;
+    struct entry *ne = realloc(t->e, ncap * sizeof *ne);
+    if (!ne)
+      return NULL;
+    t->e = ne;
+    t->cap = ncap;
+  }
+  struct entry *e = &t->e[t->n++];
+  memset(e, 0, sizeof *e);
+  snprintf(e->word, sizeof e->word, "%s", w);
+  return e;
+}
+
+int main(int argc, char **argv) {
+  struct table t = {0};
+#ifdef FIX
+  long last = -1;
+#else
+  struct entry *last = NULL;
+#endif
+  for (int i = 1; i < argc; i++) {
+    struct entry *e = table_get(&t, argv[i]);
+    if (!e)
+      return 1;
+    e->count++;
+#ifdef FIX
+    if (last >= 0)
+      t.e[last].followers++;
+    last = e - t.e;
+#else
+    if (last)
+      last->followers++; // STOP
+    last = e;
+#endif
+  }
+  for (size_t i = 0; i < t.n; i++)
+    printf("%s %d %d\n", t.e[i].word, t.e[i].count, t.e[i].followers);
+  free(t.e);
+  return 0;
+}
diff --git a/test/cases/detection/31_df_error_path/prog.c b/test/cases/detection/31_df_error_path/prog.c
new file mode 100644
index 00000000..a93cf6c4
--- /dev/null
+++ b/test/cases/detection/31_df_error_path/prog.c
@@ -0,0 +1,40 @@
+// RFC 0034 detection set, case 31 (double free): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: short 0123456789012345678901234567890123456789012345678901234567890123456789
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define REC_MAX 64
+
+static int load_record(const char *src, char **out) {
+  char *buf = malloc(REC_MAX);
+  if (!buf)
+    return -1;
+  *out = buf;
+  if (strlen(src) >= REC_MAX) {
+    free(buf);
+#ifdef FIX
+    *out = NULL;
+#endif
+    return -1;
+  }
+  strcpy(buf, src);
+  return 0;
+}
+
+int main(int argc, char **argv) {
+  for (int i = 1; i < argc; i++) {
+    char *rec = NULL;
+    if (load_record(argv[i], &rec) != 0)
+      fprintf(stdout, "record %d too long\n", i);
+    else
+      printf("record %d: %s\n", i, rec);
+    free(rec); // STOP
+  }
+  return 0;
+}
diff --git a/test/cases/detection/32_df_xtu_strbuf/main.c b/test/cases/detection/32_df_xtu_strbuf/main.c
new file mode 100644
index 00000000..2c197ee3
--- /dev/null
+++ b/test/cases/detection/32_df_xtu_strbuf/main.c
@@ -0,0 +1,40 @@
+// RFC 0034 detection set, case 32 (double free): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// UNITS: strbuf.c
+// RUN-INPUT: one two three --flush four
+#include "strbuf.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct report {
+  struct strbuf body;
+  int lines;
+};
+
+static void report_cleanup(struct report *r) {
+  free(r->body.data); // STOP
+  r->lines = 0;
+}
+
+int main(int argc, char **argv) {
+  struct report r = {0};
+  if (strbuf_init(&r.body, 8))
+    return 1;
+  for (int i = 1; i < argc; i++) {
+    if (strcmp(argv[i], "--flush") == 0) {
+      printf("%s\n", r.body.data ? r.body.data : "");
+      strbuf_release(&r.body);
+      break;
+    }
+    strbuf_add(&r.body, argv[i]);
+    strbuf_add(&r.body, " ");
+    r.lines++;
+  }
+  report_cleanup(&r);
+  return 0;
+}
diff --git a/test/cases/detection/32_df_xtu_strbuf/strbuf.c b/test/cases/detection/32_df_xtu_strbuf/strbuf.c
new file mode 100644
index 00000000..ac9ed0de
--- /dev/null
+++ b/test/cases/detection/32_df_xtu_strbuf/strbuf.c
@@ -0,0 +1,33 @@
+#include "strbuf.h"
+#include <stdlib.h>
+#include <string.h>
+
+int strbuf_init(struct strbuf *sb, size_t cap) {
+  sb->data = calloc(1, cap);
+  sb->len = 0;
+  sb->cap = sb->data ? cap : 0;
+  return sb->data ? 0 : -1;
+}
+
+int strbuf_add(struct strbuf *sb, const char *s) {
+  size_t n = strlen(s);
+  if (sb->len + n + 1 > sb->cap) {
+    size_t ncap = (sb->len + n + 1) * 2;
+    char *nd = realloc(sb->data, ncap);
+    if (!nd)
+      return -1;
+    sb->data = nd;
+    sb->cap = ncap;
+  }
+  memcpy(sb->data + sb->len, s, n + 1);
+  sb->len += n;
+  return 0;
+}
+
+void strbuf_release(struct strbuf *sb) {
+  free(sb->data);
+#ifdef FIX
+  sb->data = NULL;
+#endif
+  sb->len = sb->cap = 0;
+}
diff --git a/test/cases/detection/32_df_xtu_strbuf/strbuf.h b/test/cases/detection/32_df_xtu_strbuf/strbuf.h
new file mode 100644
index 00000000..e500b7fb
--- /dev/null
+++ b/test/cases/detection/32_df_xtu_strbuf/strbuf.h
@@ -0,0 +1,13 @@
+#ifndef STRBUF_H
+#define STRBUF_H
+#include <stddef.h>
+
+struct strbuf {
+  char *data;
+  size_t len, cap;
+};
+
+int strbuf_init(struct strbuf *sb, size_t cap);
+int strbuf_add(struct strbuf *sb, const char *s);
+void strbuf_release(struct strbuf *sb);
+#endif
diff --git a/test/cases/detection/33_df_shared_title/prog.c b/test/cases/detection/33_df_shared_title/prog.c
new file mode 100644
index 00000000..cca89227
--- /dev/null
+++ b/test/cases/detection/33_df_shared_title/prog.c
@@ -0,0 +1,67 @@
+// RFC 0034 detection set, case 33 (double free): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: Annual_Report 42
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct doc {
+  char *title;
+  int pages;
+};
+
+struct view {
+  char *title;
+  int width;
+};
+
+static struct doc *doc_new(const char *title, int pages) {
+  struct doc *d = malloc(sizeof *d);
+  if (!d)
+    return NULL;
+  d->title = strdup(title);
+  d->pages = pages;
+  return d;
+}
+
+static void doc_free(struct doc *d) {
+  free(d->title);
+  free(d);
+}
+
+static struct view *view_for(const struct doc *d, int width) {
+  struct view *v = malloc(sizeof *v);
+  if (!v)
+    return NULL;
+#ifdef FIX
+  v->title = strdup(d->title);
+#else
+  v->title = d->title; /* shares the doc's string */
+#endif
+  v->width = width;
+  return v;
+}
+
+static void view_free(struct view *v) {
+  free(v->title); // STOP
+  free(v);
+}
+
+int main(int argc, char **argv) {
+  if (argc < 3)
+    return 2;
+  struct doc *d = doc_new(argv[1], atoi(argv[2]));
+  if (!d)
+    return 1;
+  struct view *v = view_for(d, 80);
+  if (!v)
+    return 1;
+  printf("%.*s (%d pages)\n", v->width, v->title, d->pages);
+  doc_free(d);
+  view_free(v);
+  return 0;
+}
diff --git a/test/cases/detection/34_if_interior_trim/prog.c b/test/cases/detection/34_if_interior_trim/prog.c
new file mode 100644
index 00000000..a725d5b9
--- /dev/null
+++ b/test/cases/detection/34_if_interior_trim/prog.c
@@ -0,0 +1,40 @@
+// RFC 0034 detection set, case 34 (invalid free): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: '   indented' plain
+#include <ctype.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+static char *read_name(const char *src) {
+  char *s = malloc(strlen(src) + 1);
+  if (!s)
+    return NULL;
+  strcpy(s, src);
+  return s;
+}
+
+int main(int argc, char **argv) {
+  for (int i = 1; i < argc; i++) {
+    char *name = read_name(argv[i]);
+    if (!name)
+      return 1;
+#ifdef FIX
+    char *start = name;
+    while (isspace((unsigned char)*start))
+      start++;
+    printf("name: '%s'\n", start);
+    free(name);
+#else
+    while (isspace((unsigned char)*name))
+      name++; /* skips leading blanks in place */
+    printf("name: '%s'\n", name);
+    free(name); // STOP
+#endif
+  }
+  return 0;
+}
diff --git a/test/cases/detection/35_if_stack_scratch/prog.c b/test/cases/detection/35_if_stack_scratch/prog.c
new file mode 100644
index 00000000..540a81cb
--- /dev/null
+++ b/test/cases/detection/35_if_stack_scratch/prog.c
@@ -0,0 +1,35 @@
+// RFC 0034 detection set, case 35 (invalid free): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: bob a_much_longer_name_that_needs_the_heap
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+/* formats into the caller's scratch buffer when it fits, else allocates */
+static char *render(const char *name, char *scratch, size_t scratch_len) {
+  size_t need = strlen(name) + sizeof "Hello, !";
+  char *out = need <= scratch_len ? scratch : malloc(need);
+  if (!out)
+    return NULL;
+  snprintf(out, need, "Hello, %s!", name);
+  return out;
+}
+
+int main(int argc, char **argv) {
+  char small[32];
+  for (int i = 1; i < argc; i++) {
+    char *msg = render(argv[i], small, sizeof small);
+    if (!msg)
+      return 1;
+    puts(msg);
+#ifdef FIX
+    if (msg != small)
+#endif
+      free(msg); // STOP
+  }
+  return 0;
+}
diff --git a/test/cases/detection/36_uar_parser_scratch/prog.c b/test/cases/detection/36_uar_parser_scratch/prog.c
new file mode 100644
index 00000000..eee80321
--- /dev/null
+++ b/test/cases/detection/36_uar_parser_scratch/prog.c
@@ -0,0 +1,58 @@
+// RFC 0034 detection set, case 36 (use after return): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 'alpha beta gamma'
+#include <stdio.h>
+#include <stdlib.h>
+
+struct parser {
+  const char *input;
+  size_t pos;
+  char *scratch;
+#ifdef FIX
+  char store[64];
+#endif
+};
+
+static void parser_init(struct parser *p, const char *in) {
+#ifdef FIX
+  p->scratch = p->store;
+#else
+  char buf[64];
+  p->scratch = buf; /* outlives this call */
+#endif
+  p->input = in;
+  p->pos = 0;
+}
+
+static const char *parser_next(struct parser *p) {
+  size_t i = 0;
+  while (p->input[p->pos] == ' ')
+    p->pos++;
+  while (p->input[p->pos] && p->input[p->pos] != ' ' && i < 63)
+    p->scratch[i++] = p->input[p->pos++]; // STOP // MISS: a use after return: a dead stack object is untracked (RFC 0032 limit); the trap here was incidental, and the program now traps at the printf of the token
+  p->scratch[i] = '\0';
+  return i ? p->scratch : NULL;
+}
+
+static void noise(int n) {
+  volatile char pad[256];
+  for (int i = 0; i < 256; i++)
+    pad[i] = (char)(n + i);
+  (void)pad[n & 255];
+}
+
+int main(int argc, char **argv) {
+  if (argc < 2)
+    return 2;
+  struct parser p;
+  parser_init(&p, argv[1]);
+  noise(argc);
+  const char *tok;
+  while ((tok = parser_next(&p)))
+    printf("token: %s\n", tok);
+  return 0;
+}
diff --git a/test/cases/detection/37_uas_block_tmp/prog.c b/test/cases/detection/37_uas_block_tmp/prog.c
new file mode 100644
index 00000000..25a69c63
--- /dev/null
+++ b/test/cases/detection/37_uas_block_tmp/prog.c
@@ -0,0 +1,35 @@
+// RFC 0034 detection set, case 37 (use after scope): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 5 2
+#include <stdio.h>
+#include <stdlib.h>
+
+static int consume(const int *v, int idx) { return v ? v[idx] : -1; }
+
+int main(int argc, char **argv) {
+  if (argc < 3)
+    return 2;
+  int n = atoi(argv[1]);
+  int idx = atoi(argv[2]) & 3;
+  const int *weights = NULL;
+#ifdef FIX
+  int tmp[4];
+#endif
+  if (n > 0) {
+#ifndef FIX
+    int tmp[4];
+#endif
+    for (int i = 0; i < 4; i++)
+      tmp[i] = n * (i + 1);
+    weights = tmp;
+  }
+  int other[16];
+  for (int i = 0; i < 16; i++)
+    other[i] = -i;
+  printf("weight=%d other=%d\n", consume(weights, idx), other[idx]); // STOP
+  return 0;
+}
diff --git a/test/cases/detection/38_uar_global_opts/prog.c b/test/cases/detection/38_uar_global_opts/prog.c
new file mode 100644
index 00000000..f6cae23d
--- /dev/null
+++ b/test/cases/detection/38_uar_global_opts/prog.c
@@ -0,0 +1,57 @@
+// RFC 0034 detection set, case 38 (use after return): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: -v 3
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct options {
+  int verbose;
+  int level;
+  char name[16];
+};
+
+static struct options *g_opts;
+#ifdef FIX
+static struct options g_store;
+#endif
+
+static void configure(int argc, char **argv) {
+#ifdef FIX
+  struct options *o = &g_store;
+#else
+  struct options local;
+  struct options *o = &local;
+#endif
+  memset(o, 0, sizeof *o);
+  for (int i = 1; i < argc; i++) {
+    if (strcmp(argv[i], "-v") == 0)
+      o->verbose = 1;
+    else
+      o->level = atoi(argv[i]);
+  }
+  snprintf(o->name, sizeof o->name, "cfg%d", o->level);
+  g_opts = o; /* published for the rest of the program */
+}
+
+static int churn(int seed) {
+  volatile char junk[128];
+  for (int i = 0; i < 128; i++)
+    junk[i] = (char)(seed + i);
+  return junk[seed & 127];
+}
+
+static void report(void) {
+  printf("%s: level=%d verbose=%d\n", g_opts->name, g_opts->level, g_opts->verbose); // STOP // MISS: the dead frame's bytes are a live frame again when the guard looks, so it passes
+}
+
+int main(int argc, char **argv) {
+  configure(argc, argv);
+  int c = churn(argc);
+  report();
+  return c == 1000;
+}
diff --git a/test/cases/detection/39_uninit_best_ptr/prog.c b/test/cases/detection/39_uninit_best_ptr/prog.c
new file mode 100644
index 00000000..77cf85a1
--- /dev/null
+++ b/test/cases/detection/39_uninit_best_ptr/prog.c
@@ -0,0 +1,45 @@
+// RFC 0034 detection set, case 39 (uninitialised pointer): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 50
+#include <stdio.h>
+#include <stdlib.h>
+
+struct cand {
+  const char *name;
+  int score;
+};
+
+static const struct cand *pick(const struct cand *c, int n, int threshold) {
+#ifdef FIX
+  const struct cand *best = NULL;
+#else
+  const struct cand *best;
+#endif
+  int best_score = threshold;
+  for (int i = 0; i < n; i++) {
+    if (c[i].score > best_score) {
+      best = &c[i];
+      best_score = c[i].score;
+    }
+  }
+  return best;
+}
+
+int main(int argc, char **argv) {
+  if (argc < 2)
+    return 2;
+  struct cand cands[3] = {{"ann", 10}, {"ben", 25}, {"cal", 17}};
+  const struct cand *b = pick(cands, 3, atoi(argv[1]));
+#ifdef FIX
+  if (!b) {
+    printf("nobody above threshold\n");
+    return 0;
+  }
+#endif
+  printf("winner %s with %d\n", b->name, b->score); // STOP
+  return 0;
+}
diff --git a/test/cases/detection/40_uninit_realloc_slots/prog.c b/test/cases/detection/40_uninit_realloc_slots/prog.c
new file mode 100644
index 00000000..0a682d97
--- /dev/null
+++ b/test/cases/detection/40_uninit_realloc_slots/prog.c
@@ -0,0 +1,61 @@
+// RFC 0034 detection set, case 40 (uninitialised pointer): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: apple pear plum fig kiwi
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct item {
+  char label[12];
+  int weight;
+};
+
+struct bag {
+  struct item **slots;
+  size_t len, cap;
+};
+
+static int bag_add(struct bag *b, const char *label, int w) {
+  if (b->len == b->cap) {
+    size_t ncap = b->cap ? b->cap * 2 : 4;
+    struct item **ns = realloc(b->slots, ncap * sizeof *ns);
+    if (!ns)
+      return -1;
+    b->slots = ns;
+    b->cap = ncap;
+  }
+  struct item *it = malloc(sizeof *it);
+  if (!it)
+    return -1;
+  snprintf(it->label, sizeof it->label, "%s", label);
+  it->weight = w;
+  b->slots[b->len++] = it;
+  return 0;
+}
+
+static int bag_weight(const struct bag *b) {
+  int total = 0;
+#ifdef FIX
+  for (size_t i = 0; i < b->len; i++)
+#else
+  for (size_t i = 0; i < b->cap; i++) /* walks the unused slots too */
+#endif
+    total += b->slots[i]->weight; // STOP
+  return total;
+}
+
+int main(int argc, char **argv) {
+  struct bag b = {0};
+  for (int i = 1; i < argc; i++)
+    if (bag_add(&b, argv[i], (int)strlen(argv[i])))
+      return 1;
+  printf("%zu items weigh %d\n", b.len, bag_weight(&b));
+  for (size_t i = 0; i < b.len; i++)
+    free(b.slots[i]);
+  free(b.slots);
+  return 0;
+}
diff --git a/test/cases/detection/41_null_failed_malloc/prog.c b/test/cases/detection/41_null_failed_malloc/prog.c
new file mode 100644
index 00000000..99f96b0c
--- /dev/null
+++ b/test/cases/detection/41_null_failed_malloc/prog.c
@@ -0,0 +1,43 @@
+// RFC 0034 detection set, case 41 (null dereference): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 2000000000 2000000000
+#include <stdio.h>
+#include <stdlib.h>
+
+struct canvas {
+  size_t w, h;
+  unsigned char *px;
+};
+
+static int canvas_init(struct canvas *c, size_t w, size_t h) {
+  c->w = w;
+  c->h = h;
+  c->px = malloc(w * h);
+#ifdef FIX
+  if (!c->px)
+    return -1;
+#endif
+  return 0;
+}
+
+static void canvas_plot(struct canvas *c, size_t x, size_t y) {
+  c->px[y * c->w + x] = 255; // STOP
+}
+
+int main(int argc, char **argv) {
+  if (argc < 3)
+    return 2;
+  struct canvas c;
+  if (canvas_init(&c, strtoull(argv[1], NULL, 10), strtoull(argv[2], NULL, 10))) {
+    printf("canvas too large\n");
+    return 0;
+  }
+  canvas_plot(&c, 1, 0);
+  printf("plotted\n");
+  free(c.px);
+  return 0;
+}
diff --git a/test/cases/detection/42_null_lookup/prog.c b/test/cases/detection/42_null_lookup/prog.c
new file mode 100644
index 00000000..ffc123c4
--- /dev/null
+++ b/test/cases/detection/42_null_lookup/prog.c
@@ -0,0 +1,56 @@
+// RFC 0034 detection set, case 42 (null dereference): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: zz a=1 b=2
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct kv {
+  char key[16];
+  int val;
+  struct kv *next;
+};
+
+static struct kv *kv_put(struct kv *head, const char *spec) {
+  const char *eq = strchr(spec, '=');
+  if (!eq)
+    return head;
+  struct kv *e = calloc(1, sizeof *e);
+  if (!e)
+    return head;
+  size_t klen = (size_t)(eq - spec);
+  if (klen >= sizeof e->key)
+    klen = sizeof e->key - 1;
+  memcpy(e->key, spec, klen);
+  e->val = atoi(eq + 1);
+  e->next = head;
+  return e;
+}
+
+static struct kv *kv_find(struct kv *head, const char *key) {
+  for (struct kv *e = head; e; e = e->next)
+    if (strcmp(e->key, key) == 0)
+      return e;
+  return NULL;
+}
+
+int main(int argc, char **argv) {
+  if (argc < 2)
+    return 2;
+  struct kv *head = NULL;
+  for (int i = 2; i < argc; i++)
+    head = kv_put(head, argv[i]);
+  struct kv *e = kv_find(head, argv[1]);
+#ifdef FIX
+  if (!e) {
+    printf("%s not set\n", argv[1]);
+    return 0;
+  }
+#endif
+  printf("%s = %d\n", argv[1], e->val); // STOP
+  return 0;
+}
diff --git a/test/cases/detection/43_null_getenv/prog.c b/test/cases/detection/43_null_getenv/prog.c
new file mode 100644
index 00000000..3287368e
--- /dev/null
+++ b/test/cases/detection/43_null_getenv/prog.c
@@ -0,0 +1,30 @@
+// RFC 0034 detection set, case 43 (null dereference): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: WEAVEC_EVAL_UNSET_VARIABLE
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+static size_t path_depth(const char *var) {
+  const char *dir = getenv(var);
+#ifdef FIX
+  if (!dir)
+    return 0;
+#endif
+  size_t depth = 0;
+  size_t n = strlen(dir); // STOP
+  for (size_t i = 0; i < n; i++)
+    if (dir[i] == '/')
+      depth++;
+  return depth;
+}
+
+int main(int argc, char **argv) {
+  for (int i = 1; i < argc; i++)
+    printf("%s has depth %zu\n", argv[i], path_depth(argv[i]));
+  return 0;
+}
diff --git a/test/cases/detection/44_overlap_memcpy_remove/prog.c b/test/cases/detection/44_overlap_memcpy_remove/prog.c
new file mode 100644
index 00000000..103e117e
--- /dev/null
+++ b/test/cases/detection/44_overlap_memcpy_remove/prog.c
@@ -0,0 +1,45 @@
+// RFC 0034 detection set, case 44 (overlapping copy): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 64 3
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct queue {
+  int *items;
+  size_t n;
+};
+
+static void queue_remove(struct queue *q, size_t idx) {
+  if (idx >= q->n)
+    return;
+#ifdef FIX
+  memmove(&q->items[idx], &q->items[idx + 1], (q->n - idx - 1) * sizeof *q->items);
+#else
+  memcpy(&q->items[idx], &q->items[idx + 1], (q->n - idx - 1) * sizeof *q->items); // STOP
+#endif
+  q->n--;
+}
+
+int main(int argc, char **argv) {
+  if (argc < 3)
+    return 2;
+  struct queue q;
+  q.n = (size_t)atoi(argv[1]);
+  q.items = malloc(q.n * sizeof *q.items);
+  if (!q.items)
+    return 1;
+  for (size_t i = 0; i < q.n; i++)
+    q.items[i] = (int)i * 10;
+  queue_remove(&q, (size_t)atoi(argv[2]));
+  long s = 0;
+  for (size_t i = 0; i < q.n; i++)
+    s += q.items[i] * (long)(i + 1);
+  printf("n=%zu weighted=%ld\n", q.n, s);
+  free(q.items);
+  return 0;
+}
diff --git a/test/cases/detection/45_overlap_strcpy_prefix/prog.c b/test/cases/detection/45_overlap_strcpy_prefix/prog.c
new file mode 100644
index 00000000..042315c5
--- /dev/null
+++ b/test/cases/detection/45_overlap_strcpy_prefix/prog.c
@@ -0,0 +1,32 @@
+// RFC 0034 detection set, case 45 (overlapping copy): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: ./././src/lib/module/file.c
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+static void strip_dot_slash(char *path) {
+  while (path[0] == '.' && path[1] == '/') {
+#ifdef FIX
+    memmove(path, path + 2, strlen(path + 2) + 1);
+#else
+    strcpy(path, path + 2); // STOP
+#endif
+  }
+}
+
+int main(int argc, char **argv) {
+  for (int i = 1; i < argc; i++) {
+    char *p = strdup(argv[i]);
+    if (!p)
+      return 1;
+    strip_dot_slash(p);
+    printf("%s\n", p);
+    free(p);
+  }
+  return 0;
+}
diff --git a/test/cases/detection/46_fmt_unterminated_heap/prog.c b/test/cases/detection/46_fmt_unterminated_heap/prog.c
new file mode 100644
index 00000000..b73d5221
--- /dev/null
+++ b/test/cases/detection/46_fmt_unterminated_heap/prog.c
@@ -0,0 +1,44 @@
+// RFC 0034 detection set, case 46 (unterminated string): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: content-type:text/html host:example.org
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct field {
+  char *name;
+  size_t len;
+};
+
+/* splits "name:value"; the name is copied out of the input */
+static int field_parse(struct field *f, const char *spec) {
+  const char *colon = strchr(spec, ':');
+  f->len = colon ? (size_t)(colon - spec) : strlen(spec);
+#ifdef FIX
+  f->name = malloc(f->len + 1);
+#else
+  f->name = malloc(f->len);
+#endif
+  if (!f->name)
+    return -1;
+  memcpy(f->name, spec, f->len);
+#ifdef FIX
+  f->name[f->len] = '\0';
+#endif
+  return 0;
+}
+
+int main(int argc, char **argv) {
+  for (int i = 1; i < argc; i++) {
+    struct field f;
+    if (field_parse(&f, argv[i]))
+      return 1;
+    printf("field: %s\n", f.name); // STOP
+    free(f.name);
+  }
+  return 0;
+}
diff --git a/test/cases/detection/47_strlen_filled_stack/prog.c b/test/cases/detection/47_strlen_filled_stack/prog.c
new file mode 100644
index 00000000..5572aa2a
--- /dev/null
+++ b/test/cases/detection/47_strlen_filled_stack/prog.c
@@ -0,0 +1,39 @@
+// RFC 0034 detection set, case 47 (unterminated string): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: SECTIONHEADER
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+static char *normalize_tag(const char *in) {
+  char tag[8];
+#ifdef FIX
+  strncpy(tag, in, sizeof tag - 1);
+  tag[sizeof tag - 1] = '\0';
+#else
+  strncpy(tag, in, sizeof tag);
+#endif
+  size_t n = strlen(tag); // STOP
+  char *out = malloc(n + 1);
+  if (!out)
+    return NULL;
+  for (size_t i = 0; i < n; i++)
+    out[i] = (char)(tag[i] | 0x20);
+  out[n] = '\0';
+  return out;
+}
+
+int main(int argc, char **argv) {
+  for (int i = 1; i < argc; i++) {
+    char *t = normalize_tag(argv[i]);
+    if (!t)
+      return 1;
+    printf("tag=%s\n", t);
+    free(t);
+  }
+  return 0;
+}
diff --git a/test/cases/detection/48_asprintf_append/prog.c b/test/cases/detection/48_asprintf_append/prog.c
new file mode 100644
index 00000000..f07d8633
--- /dev/null
+++ b/test/cases/detection/48_asprintf_append/prog.c
@@ -0,0 +1,37 @@
+// RFC 0034 detection set, case 48 (libc-allocated misuse): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: libnetworking_core_networking_core_networking_core_networking_core_networking_core_networking_core_networking_core_mmmmmmmm 12
+#define _GNU_SOURCE
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+static char *object_name(const char *base, int version) {
+  char *s = NULL;
+#ifdef FIX
+  int n = asprintf(&s, "%s-v%d.o", base, version);
+  if (n < 0)
+    return NULL;
+#else
+  int n = asprintf(&s, "%s-v%d", base, version);
+  if (n < 0)
+    return NULL;
+  memcpy(s + n, ".o", 3); // STOP
+#endif
+  return s;
+}
+
+int main(int argc, char **argv) {
+  if (argc < 3)
+    return 2;
+  char *name = object_name(argv[1], atoi(argv[2]));
+  if (!name)
+    return 1;
+  printf("%s\n", name);
+  free(name);
+  return 0;
+}
diff --git a/test/cases/detection/49_strdup_strcat_bak/prog.c b/test/cases/detection/49_strdup_strcat_bak/prog.c
new file mode 100644
index 00000000..d3e09e9d
--- /dev/null
+++ b/test/cases/detection/49_strdup_strcat_bak/prog.c
@@ -0,0 +1,37 @@
+// RFC 0034 detection set, case 49 (libc-allocated misuse): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: config.ini /etc/hosts
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+static char *backup_name(const char *path) {
+#ifdef FIX
+  size_t n = strlen(path);
+  char *d = malloc(n + sizeof ".bak");
+  if (!d)
+    return NULL;
+  memcpy(d, path, n + 1);
+#else
+  char *d = strdup(path);
+  if (!d)
+    return NULL;
+#endif
+  strcat(d, ".bak"); // STOP
+  return d;
+}
+
+int main(int argc, char **argv) {
+  for (int i = 1; i < argc; i++) {
+    char *b = backup_name(argv[i]);
+    if (!b)
+      return 1;
+    printf("%s -> %s\n", argv[i], b);
+    free(b);
+  }
+  return 0;
+}
diff --git a/test/cases/detection/50_getline_ptr_array/prog.c b/test/cases/detection/50_getline_ptr_array/prog.c
new file mode 100644
index 00000000..7fb60599
--- /dev/null
+++ b/test/cases/detection/50_getline_ptr_array/prog.c
@@ -0,0 +1,41 @@
+// RFC 0034 detection set, case 50 (libc-allocated misuse): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: < stdin.txt
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+int main(void) {
+  size_t cap = 4, n = 0;
+  char **lines = malloc(cap * sizeof *lines);
+  if (!lines)
+    return 1;
+  char *line = NULL;
+  size_t lcap = 0;
+  ssize_t len;
+  while ((len = getline(&line, &lcap, stdin)) > 0) {
+    if (line[len - 1] == '\n')
+      line[len - 1] = '\0';
+#ifdef FIX
+    if (n == cap) {
+      char **nl = realloc(lines, cap * 2 * sizeof *nl);
+      if (!nl)
+        return 1;
+      lines = nl;
+      cap *= 2;
+    }
+#endif
+    lines[n++] = strdup(line); // STOP
+  }
+  free(line);
+  for (size_t i = n; i > 0; i--)
+    printf("%zu: %s\n", i, lines[i - 1]);
+  for (size_t i = 0; i < n; i++)
+    free(lines[i]);
+  free(lines);
+  return 0;
+}
diff --git a/test/cases/detection/50_getline_ptr_array/stdin.txt b/test/cases/detection/50_getline_ptr_array/stdin.txt
new file mode 100644
index 00000000..b5660615
--- /dev/null
+++ b/test/cases/detection/50_getline_ptr_array/stdin.txt
@@ -0,0 +1,6 @@
+one
+two
+three
+four
+five
+six
diff --git a/test/cases/detection/51_tc_shape_factory/prog.c b/test/cases/detection/51_tc_shape_factory/prog.c
new file mode 100644
index 00000000..ba3022b2
--- /dev/null
+++ b/test/cases/detection/51_tc_shape_factory/prog.c
@@ -0,0 +1,65 @@
+// RFC 0034 detection set, case 51 (type confusion): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: rect 3 4
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+enum kind { CIRCLE, RECT };
+
+struct shape {
+  enum kind k;
+};
+struct circle {
+  enum kind k;
+  double r;
+};
+struct rect {
+  enum kind k;
+  double w, h, x, y;
+};
+
+static void *shape_new(enum kind k) {
+#ifdef FIX
+  size_t sz = k == CIRCLE ? sizeof(struct circle) : sizeof(struct rect);
+#else
+  size_t sz = sizeof(struct circle); /* every shape was a circle once */
+#endif
+  struct shape *s = calloc(1, sz);
+  if (s)
+    s->k = k;
+  return s;
+}
+
+static double area(const struct shape *s) {
+  if (s->k == CIRCLE) {
+    const struct circle *c = (const struct circle *)s;
+    return 3.14159 * c->r * c->r;
+  }
+  const struct rect *r = (const struct rect *)s;
+  return r->w * r->h;
+}
+
+int main(int argc, char **argv) {
+  if (argc < 3)
+    return 2;
+  enum kind k = strcmp(argv[1], "rect") == 0 ? RECT : CIRCLE;
+  struct shape *s = shape_new(k);
+  if (!s)
+    return 1;
+  if (k == RECT) {
+    struct rect *r = (struct rect *)s;
+    r->w = atof(argv[2]);
+    r->h = argc > 3 ? atof(argv[3]) : 1.0; // STOP
+    r->x = r->y = 0;
+  } else {
+    ((struct circle *)s)->r = atof(argv[2]);
+  }
+  printf("area %.2f\n", area(s));
+  free(s);
+  return 0;
+}
diff --git a/test/cases/detection/52_tc_callback_ctx/prog.c b/test/cases/detection/52_tc_callback_ctx/prog.c
new file mode 100644
index 00000000..7afa060d
--- /dev/null
+++ b/test/cases/detection/52_tc_callback_ctx/prog.c
@@ -0,0 +1,60 @@
+// RFC 0034 detection set, case 52 (type confusion): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: -d red green blue
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+typedef void (*visit_fn)(void *ctx, const char *item);
+
+struct counter {
+  int count;
+};
+
+struct summary {
+  int count;
+  char longest[24];
+  long total;
+};
+
+static void count_only(void *ctx, const char *item) {
+  (void)item;
+  ((struct counter *)ctx)->count++;
+}
+
+static void summarize(void *ctx, const char *item) {
+  struct summary *s = ctx;
+  s->count++;
+  s->total += (long)strlen(item); // STOP
+  if (strlen(item) > strlen(s->longest))
+    snprintf(s->longest, sizeof s->longest, "%s", item);
+}
+
+static void walk(char **items, int n, visit_fn fn, void *ctx) {
+  for (int i = 0; i < n; i++)
+    fn(ctx, items[i]);
+}
+
+int main(int argc, char **argv) {
+  int detailed = argc > 1 && strcmp(argv[1], "-d") == 0;
+#ifdef FIX
+  void *ctx = detailed ? calloc(1, sizeof(struct summary)) : calloc(1, sizeof(struct counter));
+#else
+  void *ctx = calloc(1, sizeof(struct counter)); /* sized for the simple visitor */
+#endif
+  if (!ctx)
+    return 1;
+  walk(argv + 1 + detailed, argc - 1 - detailed, detailed ? summarize : count_only, ctx);
+  if (detailed) {
+    struct summary *s = ctx;
+    printf("%d items, %ld chars, longest %s\n", s->count, s->total, s->longest);
+  } else {
+    printf("%d items\n", ((struct counter *)ctx)->count);
+  }
+  free(ctx);
+  return 0;
+}
diff --git a/test/cases/detection/53_stack_ptr_array/prog.c b/test/cases/detection/53_stack_ptr_array/prog.c
new file mode 100644
index 00000000..09a4ee44
--- /dev/null
+++ b/test/cases/detection/53_stack_ptr_array/prog.c
@@ -0,0 +1,36 @@
+// RFC 0034 detection set, case 53 (stack overflow): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: -v a.c b.c c.c d.c e.c f.c
+#include <stdio.h>
+
+#define MAX_FILES 4
+
+static int process(const char **files, int n, int verbose) {
+  for (int i = 0; i < n; i++)
+    printf("%s%s\n", verbose ? "processing " : "", files[i]);
+  return n;
+}
+
+int main(int argc, char **argv) {
+  const char *files[MAX_FILES];
+  int nfiles = 0;
+  int verbose = 0;
+  for (int i = 1; i < argc; i++) {
+    if (argv[i][0] == '-') {
+      verbose = 1;
+      continue;
+    }
+#ifdef FIX
+    if (nfiles == MAX_FILES) {
+      fprintf(stderr, "too many files, ignoring %s\n", argv[i]);
+      continue;
+    }
+#endif
+    files[nfiles++] = argv[i]; // STOP
+  }
+  return process(files, nfiles, verbose) == 0;
+}
diff --git a/test/cases/detection/54_uaf_global_cache/prog.c b/test/cases/detection/54_uaf_global_cache/prog.c
new file mode 100644
index 00000000..595b5cd7
--- /dev/null
+++ b/test/cases/detection/54_uaf_global_cache/prog.c
@@ -0,0 +1,46 @@
+// RFC 0034 detection set, case 54 (use after free): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: alpha beta reset gamma
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct cache {
+  int hits;
+  char last[32];
+};
+
+static struct cache *g_cache;
+
+static void cache_reset(void) {
+  free(g_cache);
+#ifdef FIX
+  g_cache = NULL;
+#endif
+}
+
+static void cache_touch(const char *key) {
+  if (!g_cache) {
+    g_cache = calloc(1, sizeof *g_cache);
+    if (!g_cache)
+      exit(1);
+  }
+  g_cache->hits++; // STOP
+  snprintf(g_cache->last, sizeof g_cache->last, "%s", key);
+}
+
+int main(int argc, char **argv) {
+  for (int i = 1; i < argc; i++) {
+    if (strcmp(argv[i], "reset") == 0)
+      cache_reset();
+    else
+      cache_touch(argv[i]);
+  }
+  if (g_cache)
+    printf("hits=%d last=%s\n", g_cache->hits, g_cache->last);
+  return 0;
+}
diff --git a/test/cases/detection/55_hof_realloc_shrink/prog.c b/test/cases/detection/55_hof_realloc_shrink/prog.c
new file mode 100644
index 00000000..61ccdc97
--- /dev/null
+++ b/test/cases/detection/55_hof_realloc_shrink/prog.c
@@ -0,0 +1,59 @@
+// RFC 0034 detection set, case 55 (heap overflow): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: secret token value
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct sbuf {
+  char *data;
+  size_t len, cap;
+};
+
+static int sb_init(struct sbuf *b, size_t cap) {
+  b->data = calloc(1, cap);
+  b->len = 0;
+  b->cap = cap;
+  return b->data ? 0 : -1;
+}
+
+static void sb_append(struct sbuf *b, const char *s) {
+  size_t n = strlen(s);
+  if (b->len + n + 1 > b->cap)
+    n = b->cap - b->len - 1;
+  memcpy(b->data + b->len, s, n);
+  b->len += n;
+  b->data[b->len] = '\0';
+}
+
+static void sb_compact(struct sbuf *b) {
+  char *nd = realloc(b->data, b->len + 1);
+  if (!nd)
+    return;
+  b->data = nd;
+#ifdef FIX
+  b->cap = b->len + 1;
+#endif
+}
+
+static void sb_wipe(struct sbuf *b) {
+  memset(b->data, 0, b->cap); // STOP
+  b->len = 0;
+}
+
+int main(int argc, char **argv) {
+  struct sbuf b;
+  if (sb_init(&b, 256))
+    return 1;
+  for (int i = 1; i < argc; i++)
+    sb_append(&b, argv[i]);
+  sb_compact(&b);
+  printf("%s (%zu)\n", b.data, b.len);
+  sb_wipe(&b);
+  free(b.data);
+  return 0;
+}
diff --git a/test/cases/detection/56_hof_xtu_sbuf/main.c b/test/cases/detection/56_hof_xtu_sbuf/main.c
new file mode 100644
index 00000000..c8aee966
--- /dev/null
+++ b/test/cases/detection/56_hof_xtu_sbuf/main.c
@@ -0,0 +1,23 @@
+// RFC 0034 detection set, case 56 (heap overflow): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// UNITS: sbuf.c
+// RUN-INPUT: alpha beta gamma delta epsilon
+#include "sbuf.h"
+#include <stdio.h>
+
+int main(int argc, char **argv) {
+  struct sbuf out;
+  if (sbuf_init(&out, 16))
+    return 1;
+  for (int i = 1; i < argc; i++) {
+    if (sbuf_append(&out, argv[i]) || sbuf_append(&out, ","))
+      return 1;
+  }
+  printf("%s\n", out.data);
+  sbuf_free(&out);
+  return 0;
+}
diff --git a/test/cases/detection/56_hof_xtu_sbuf/sbuf.c b/test/cases/detection/56_hof_xtu_sbuf/sbuf.c
new file mode 100644
index 00000000..e58e7565
--- /dev/null
+++ b/test/cases/detection/56_hof_xtu_sbuf/sbuf.c
@@ -0,0 +1,34 @@
+#include "sbuf.h"
+#include <stdlib.h>
+#include <string.h>
+
+int sbuf_init(struct sbuf *b, size_t cap) {
+  b->data = malloc(cap);
+  b->len = 0;
+  b->cap = b->data ? cap : 0;
+  if (b->data)
+    b->data[0] = '\0';
+  return b->data ? 0 : -1;
+}
+
+int sbuf_append(struct sbuf *b, const char *s) {
+  size_t n = strlen(s);
+#ifdef FIX
+  if (b->len + n + 1 > b->cap) {
+    size_t ncap = (b->len + n + 1) * 2;
+    char *nd = realloc(b->data, ncap);
+    if (!nd)
+      return -1;
+    b->data = nd;
+    b->cap = ncap;
+  }
+#endif
+  memcpy(b->data + b->len, s, n + 1); // STOP
+  b->len += n;
+  return 0;
+}
+
+void sbuf_free(struct sbuf *b) {
+  free(b->data);
+  b->data = NULL;
+}
diff --git a/test/cases/detection/56_hof_xtu_sbuf/sbuf.h b/test/cases/detection/56_hof_xtu_sbuf/sbuf.h
new file mode 100644
index 00000000..356424bf
--- /dev/null
+++ b/test/cases/detection/56_hof_xtu_sbuf/sbuf.h
@@ -0,0 +1,13 @@
+#ifndef SBUF_H
+#define SBUF_H
+#include <stddef.h>
+
+struct sbuf {
+  char *data;
+  size_t len, cap;
+};
+
+int sbuf_init(struct sbuf *b, size_t cap);
+int sbuf_append(struct sbuf *b, const char *s);
+void sbuf_free(struct sbuf *b);
+#endif
diff --git a/test/cases/detection/57_arena_internal/prog.c b/test/cases/detection/57_arena_internal/prog.c
new file mode 100644
index 00000000..64d400ac
--- /dev/null
+++ b/test/cases/detection/57_arena_internal/prog.c
@@ -0,0 +1,53 @@
+// RFC 0034 detection set, case 57 (arena sub-allocation): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: let x 42 in x
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct arena {
+  char *base;
+  size_t used, cap;
+};
+
+static void *arena_alloc(struct arena *a, size_t n) {
+  if (a->used + n > a->cap)
+    return NULL;
+  void *p = a->base + a->used;
+  a->used += n;
+  return p;
+}
+
+struct token {
+  char *text;
+  int kind;
+};
+
+int main(int argc, char **argv) {
+  struct arena a = {malloc(4096), 0, 4096};
+  if (!a.base)
+    return 1;
+  struct token toks[16];
+  int nt = 0;
+  for (int i = 1; i < argc && nt < 16; i++) {
+#ifdef FIX
+    char *t = arena_alloc(&a, strlen(argv[i]) + 1);
+#else
+    char *t = arena_alloc(&a, strlen(argv[i])); /* no room for the NUL */
+#endif
+    if (!t)
+      break;
+    strcpy(t, argv[i]); // STOP // MISS: the strcpy's checked wrapper (RFC 0034 section 5.2) checks the room left in the tracked object, the arena's one heap block; the missing byte is inside it
+    toks[nt].text = t;
+    toks[nt].kind = argv[i][0] >= '0' && argv[i][0] <= '9';
+    nt++;
+  }
+  for (int i = 0; i < nt; i++)
+    printf("%d:%s\n", toks[i].kind, toks[i].text);
+  free(a.base);
+  return 0;
+}
diff --git a/test/cases/detection/58_fmt_unterminated_struct/prog.c b/test/cases/detection/58_fmt_unterminated_struct/prog.c
new file mode 100644
index 00000000..4cece9db
--- /dev/null
+++ b/test/cases/detection/58_fmt_unterminated_struct/prog.c
@@ -0,0 +1,40 @@
+// RFC 0034 detection set, case 58 (unterminated string): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: AB CDEF
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct record {
+  char code[4];
+};
+
+static struct record *records_load(char **src, int n) {
+  struct record *r = malloc((size_t)n * sizeof *r);
+  if (!r)
+    return NULL;
+  for (int i = 0; i < n; i++) {
+#ifdef FIX
+    snprintf(r[i].code, sizeof r[i].code, "%s", src[i]);
+#else
+    strncpy(r[i].code, src[i], sizeof r[i].code); /* "ABCD" leaves no NUL */
+#endif
+  }
+  return r;
+}
+
+int main(int argc, char **argv) {
+  int n = argc - 1;
+  if (n < 1)
+    return 2;
+  struct record *r = records_load(argv + 1, n);
+  if (!r)
+    return 1;
+  printf("last code: %s\n", r[n - 1].code); // STOP
+  free(r);
+  return 0;
+}
diff --git a/test/cases/detection/59_hof_nul_terminator/prog.c b/test/cases/detection/59_hof_nul_terminator/prog.c
new file mode 100644
index 00000000..66a40bd0
--- /dev/null
+++ b/test/cases/detection/59_hof_nul_terminator/prog.c
@@ -0,0 +1,39 @@
+// RFC 0034 detection set, case 59 (heap overflow): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 16 < stdin.txt
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct blob {
+  char *data;
+  size_t len;
+};
+
+static int blob_read(struct blob *b, FILE *f, size_t want) {
+#ifdef FIX
+  b->data = malloc(want + 1);
+#else
+  b->data = malloc(want);
+#endif
+  if (!b->data)
+    return -1;
+  b->len = fread(b->data, 1, want, f);
+  b->data[b->len] = '\0'; // STOP
+  return 0;
+}
+
+int main(int argc, char **argv) {
+  if (argc < 2)
+    return 2;
+  struct blob b;
+  if (blob_read(&b, stdin, strtoul(argv[1], NULL, 10)) != 0)
+    return 1;
+  printf("read %zu bytes, %zu chars before NUL\n", b.len, strlen(b.data));
+  free(b.data);
+  return 0;
+}
diff --git a/test/cases/detection/59_hof_nul_terminator/stdin.txt b/test/cases/detection/59_hof_nul_terminator/stdin.txt
new file mode 100644
index 00000000..b0883f38
--- /dev/null
+++ b/test/cases/detection/59_hof_nul_terminator/stdin.txt
@@ -0,0 +1 @@
+abcdefghijklmnopqrstuvwxyz
diff --git a/test/cases/detection/60_uaf_xtu_callee_frees/main.c b/test/cases/detection/60_uaf_xtu_callee_frees/main.c
new file mode 100644
index 00000000..d378db9a
--- /dev/null
+++ b/test/cases/detection/60_uaf_xtu_callee_frees/main.c
@@ -0,0 +1,30 @@
+// RFC 0034 detection set, case 60 (use after free): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// UNITS: msg.c
+// RUN-INPUT: 5 hello 9
+#include "msg.h"
+#include <stdio.h>
+#include <stdlib.h>
+
+int main(int argc, char **argv) {
+  for (int i = 1; i < argc; i++) {
+    struct msg *m = msg_new(argv[i], atoi(argv[i]) > 0 ? 1 : 0);
+    if (!m)
+      return 1;
+#ifdef FIX
+    int prio = m->prio;
+    int ok = msg_send(m);
+    if (ok && prio > 0)
+      printf("urgent message sent\n");
+#else
+    int ok = msg_send(m);
+    if (ok && m->prio > 0) // STOP
+      printf("urgent message sent\n");
+#endif
+  }
+  return 0;
+}
diff --git a/test/cases/detection/60_uaf_xtu_callee_frees/msg.c b/test/cases/detection/60_uaf_xtu_callee_frees/msg.c
new file mode 100644
index 00000000..a0193a2b
--- /dev/null
+++ b/test/cases/detection/60_uaf_xtu_callee_frees/msg.c
@@ -0,0 +1,20 @@
+#include "msg.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct msg *msg_new(const char *body, int prio) {
+  struct msg *m = malloc(sizeof *m);
+  if (!m)
+    return NULL;
+  m->body = strdup(body);
+  m->prio = prio;
+  return m;
+}
+
+int msg_send(struct msg *m) {
+  int ok = printf("send[%d] %s\n", m->prio, m->body) > 0;
+  free(m->body);
+  free(m);
+  return ok;
+}
diff --git a/test/cases/detection/60_uaf_xtu_callee_frees/msg.h b/test/cases/detection/60_uaf_xtu_callee_frees/msg.h
new file mode 100644
index 00000000..56966f1e
--- /dev/null
+++ b/test/cases/detection/60_uaf_xtu_callee_frees/msg.h
@@ -0,0 +1,10 @@
+#ifndef MSG_H
+#define MSG_H
+struct msg {
+  char *body;
+  int prio;
+};
+struct msg *msg_new(const char *body, int prio);
+/* sends the message; takes ownership of it */
+int msg_send(struct msg *m);
+#endif
diff --git a/test/cases/detection/61_if_global_default/prog.c b/test/cases/detection/61_if_global_default/prog.c
new file mode 100644
index 00000000..77c6bae3
--- /dev/null
+++ b/test/cases/detection/61_if_global_default/prog.c
@@ -0,0 +1,39 @@
+// RFC 0034 detection set, case 61 (invalid free): one of the 61 blind bug programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 501
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+static char g_anonymous[] = "anonymous";
+
+struct user {
+  char *name;
+  int uid;
+};
+
+static void user_init(struct user *u, const char *name, int uid) {
+#ifdef FIX
+  u->name = strdup(name && *name ? name : g_anonymous);
+#else
+  u->name = name && *name ? strdup(name) : g_anonymous;
+#endif
+  u->uid = uid;
+}
+
+static void user_destroy(struct user *u) {
+  free(u->name); // STOP
+  u->name = NULL;
+}
+
+int main(int argc, char **argv) {
+  struct user u;
+  user_init(&u, argc > 2 ? argv[2] : "", atoi(argv[1]));
+  printf("uid %d is %s\n", u.uid, u.name);
+  user_destroy(&u);
+  return 0;
+}
diff --git a/test/cases/evaluation/vla-known-miss.c b/test/cases/evaluation/vla-known-miss.c
index 175aa22b..19c56e66 100644
--- a/test/cases/evaluation/vla-known-miss.c
+++ b/test/cases/evaluation/vla-known-miss.c
@@ -4,7 +4,7 @@
 void run(size_t n) {
   if (!n) return;
   char local[n];
-  local[n] = 0; // BUG: out-of-bounds // TRAP: index
+  local[n] = 0; // BUG: out-of-bounds // TRAP: object
 }
 // Driver (RFC 0030 section 17.2): executes the defect so the runtime oracle can observe the check.
 int main(void) { run(4); return 0; }
diff --git a/test/cases/pairs/fam-bug.c b/test/cases/pairs/fam-bug.c
index f6aa8f29..5052d177 100644
--- a/test/cases/pairs/fam-bug.c
+++ b/test/cases/pairs/fam-bug.c
@@ -8,7 +8,7 @@ void run(void) {
   if (!p) return;
   p->claimed = 10;
   int *tail = p->data;
-  tail[2] = 0; // BUG: out-of-bounds // TRAP: index
+  tail[2] = 0; // BUG: out-of-bounds // TRAP: span
   free(p);
 }
 // Driver (RFC 0030 section 17.2): executes the defect so the runtime oracle can observe the check.
diff --git a/test/cases/recall/CWE-121/memset_too_much.c b/test/cases/recall/CWE-121/memset_too_much.c
index 419d8d5b..2d9c68d0 100644
--- a/test/cases/recall/CWE-121/memset_too_much.c
+++ b/test/cases/recall/CWE-121/memset_too_much.c
@@ -29,6 +29,6 @@ int main(int argc, char **argv) {
   int which = argc > 1 ? argv[1][0] - '0' : 0;
   struct record r;
   if (which == 1) bad();
-  if (which == 2) bad_member(&r); // BUG: out-of-bounds // TRAP: violation
+  if (which == 2) bad_member(&r); // BUG: out-of-bounds // TRAP: len
   return 0;
 }
diff --git a/test/cases/recall/CWE-121/strcpy_literal.c b/test/cases/recall/CWE-121/strcpy_literal.c
index 3a855881..48d25ce5 100644
--- a/test/cases/recall/CWE-121/strcpy_literal.c
+++ b/test/cases/recall/CWE-121/strcpy_literal.c
@@ -20,7 +20,7 @@ void bad_strcat(void) {
 
 void bad_sprintf(int x) {
   char buf[4];
-  sprintf(buf, "%d!!!", x); // BUG: out-of-bounds // TRAP: len
+  sprintf(buf, "%d!!!", x); // BUG: out-of-bounds // TRAP: object
   print_line(buf);
 }
 
diff --git a/test/cases/recall/CWE-122/sized_field.c b/test/cases/recall/CWE-122/sized_field.c
index 68caf2dc..9f87b68c 100644
--- a/test/cases/recall/CWE-122/sized_field.c
+++ b/test/cases/recall/CWE-122/sized_field.c
@@ -27,7 +27,7 @@ void vec_init(struct vec *v, size_t cap) {
 }
 
 int bad_inferred(struct vec *v) {
-  return v->items[v->cap]; // BUG: out-of-bounds // TRAP: index
+  return v->items[v->cap]; // BUG: out-of-bounds // TRAP: object
 }
 
 void good(struct buf *b, struct vec *v) {
diff --git a/test/cases/recall/CWE-122/strcpy_strlen.c b/test/cases/recall/CWE-122/strcpy_strlen.c
index d0ee85d3..a97cf826 100644
--- a/test/cases/recall/CWE-122/strcpy_strlen.c
+++ b/test/cases/recall/CWE-122/strcpy_strlen.c
@@ -9,7 +9,7 @@ void bad(const char *s) {
   char *d = malloc(strlen(s));
   if (!d)
     return;
-  strcpy(d, s); // BUG: out-of-bounds // TRAP: len
+  strcpy(d, s); // BUG: out-of-bounds // TRAP: object
   print_line(d);
   free(d);
 }
@@ -28,7 +28,7 @@ void bad_strdup_index(const char *s) {
   char *d = strdup(s);
   if (!d)
     return;
-  d[strlen(s) + 1] = 0; // BUG: out-of-bounds // TRAP: index
+  d[strlen(s) + 1] = 0; // BUG: out-of-bounds // TRAP: object
   print_line(d);
   free(d);
 }
diff --git a/test/cases/recall/CWE-126/strlen_unterminated.c b/test/cases/recall/CWE-126/strlen_unterminated.c
index c95ed9c8..fa0fd1c9 100644
--- a/test/cases/recall/CWE-126/strlen_unterminated.c
+++ b/test/cases/recall/CWE-126/strlen_unterminated.c
@@ -6,13 +6,13 @@
 
 int bad(void) {
   char data[4] = {'a', 'b', 'c', 'd'};
-  return (int)strlen(data); // BUG: out-of-bounds // TRAP: len
+  return (int)strlen(data); // BUG: out-of-bounds // TRAP: object
 }
 
 void bad_copy(void) {
   char data[4] = {'a', 'b', 'c', 'd'};
   char out[16];
-  strcpy(out, data); // BUG: out-of-bounds // TRAP: len
+  strcpy(out, data); // BUG: out-of-bounds // TRAP: object
   print_line(out);
 }
 
diff --git a/test/cases/recall/CWE-170/strncpy_unterminated.c b/test/cases/recall/CWE-170/strncpy_unterminated.c
index 444fdeac..54b8e0b6 100644
--- a/test/cases/recall/CWE-170/strncpy_unterminated.c
+++ b/test/cases/recall/CWE-170/strncpy_unterminated.c
@@ -9,24 +9,24 @@
 void bad(void) {
   char name[8];
   strncpy(name, "0123456789", sizeof name);
-  print_int((int)strlen(name)); // BUG: out-of-bounds // TRAP: len
+  print_int((int)strlen(name)); // BUG: out-of-bounds // TRAP: object
 }
 
 void bad_puts(void) {
   char name[8];
   strncpy(name, "0123456789", sizeof name);
-  puts(name); // BUG: out-of-bounds // TRAP: len
+  puts(name); // BUG: out-of-bounds // TRAP: object
 }
 
 void bad_initialiser(void) {
   char name[4] = "abcd";
-  printf("%s\n", name); // BUG: out-of-bounds // TRAP: len
+  printf("%s\n", name); // BUG: out-of-bounds // TRAP: object
 }
 
 void bad_memset(void) {
   char name[8];
   memset(name, 'x', sizeof name);
-  print_int((int)strlen(name)); // BUG: out-of-bounds // TRAP: len
+  print_int((int)strlen(name)); // BUG: out-of-bounds // TRAP: object
 }
 
 void good(void) {
diff --git a/test/cases/semantics/confirm/bounded-element-release.c b/test/cases/semantics/confirm/bounded-element-release.c
new file mode 100644
index 00000000..5c49cfa0
--- /dev/null
+++ b/test/cases/semantics/confirm/bounded-element-release.c
@@ -0,0 +1,33 @@
+// RFC 0034, Silent misses (a release in a loop left early), the
+// straight-line form: closer() frees the element its argument selects
+// after testing it against the count field, so the index is bounded by
+// that field only. Its summary must keep the release; the default build
+// must stop at the caller's read. -DFIX reads an element closer() does
+// not free.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 0
+#include <stdio.h>
+#include <stdlib.h>
+struct w { int x; };
+struct panel { struct w *kids[4]; int n; };
+static void closer(struct panel *p, int j) {
+  if (j >= 0 && j < p->n)
+    free(p->kids[j]);
+}
+int main(int argc, char **argv) {
+  struct panel p = {{0}, 0};
+  for (int i = 0; i < 4; i++) {
+    p.kids[i] = calloc(1, sizeof(struct w));
+    if (!p.kids[i]) return 1;
+    p.n++;
+  }
+#ifdef FIX
+  struct w *f = p.kids[3];
+#else
+  struct w *f = p.kids[0];
+#endif
+  closer(&p, atoi(argv[1]));
+  printf("%d\n", f->x); // STOP
+  return argc > 5;
+}
diff --git a/test/cases/semantics/confirm/const-shallow-callback-callee.c b/test/cases/semantics/confirm/const-shallow-callback-callee.c
new file mode 100644
index 00000000..14f4931d
--- /dev/null
+++ b/test/cases/semantics/confirm/const-shallow-callback-callee.c
@@ -0,0 +1,7 @@
+// The callee of const-shallow-callback.c, in its own unit.
+struct callbacks { int (*cred)(void *payload); void *payload; };
+struct options { struct callbacks cb; int other; };
+
+int run_with_callbacks(const struct options *opts) {
+  return opts->cb.cred(opts->cb.payload);
+}
diff --git a/test/cases/semantics/confirm/const-shallow-callback.c b/test/cases/semantics/confirm/const-shallow-callback.c
new file mode 100644
index 00000000..fa71b2af
--- /dev/null
+++ b/test/cases/semantics/confirm/const-shallow-callback.c
@@ -0,0 +1,35 @@
+// RFC 0034 section 6.3: a false definite use of an uninitialised value the
+// milestone found in libgit2's tests/libgit2/online/clone.c
+// (build/eval-2026-10-04/repros/libgit2-2.c): run_with_callbacks takes a
+// pointer to a const struct, but C's const is shallow, and the callback it
+// calls writes given_url through the payload pointer stored in the struct.
+// The callee is in another unit. An unconfirmed candidate may remain a
+// warning (RFC 0034, Diagnostics).
+// CLEAN
+// ALLOW: use-of-uninitialized
+// UNITS: const-shallow-callback-callee.c
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+struct callbacks { int (*cred)(void *payload); void *payload; };
+struct options { struct callbacks cb; int other; };
+
+static struct options g_options;
+int run_with_callbacks(const struct options *opts); /* in another unit */
+
+static int cred(void *payload) {
+  *(char **)payload = strdup("http://example.com/");
+  return 0;
+}
+
+int main(void) {
+  char *given_url;
+  g_options.cb.cred = cred;
+  g_options.cb.payload = &given_url;
+  if (run_with_callbacks(&g_options) != 0)
+    return 1;
+  printf("%s\n", given_url);
+  free(given_url);
+  return 0;
+}
diff --git a/test/cases/semantics/confirm/const-shallow-local-callee.c b/test/cases/semantics/confirm/const-shallow-local-callee.c
new file mode 100644
index 00000000..e8053654
--- /dev/null
+++ b/test/cases/semantics/confirm/const-shallow-local-callee.c
@@ -0,0 +1,9 @@
+// The callee of const-shallow-local.c, in its own unit.
+struct out { int *count; const char **name; };
+struct request { struct out *out; int id; };
+
+int fill(const struct request *req) {
+  *req->out->count = req->id;
+  *req->out->name = "seven";
+  return 0;
+}
diff --git a/test/cases/semantics/confirm/const-shallow-local.c b/test/cases/semantics/confirm/const-shallow-local.c
new file mode 100644
index 00000000..9c9c70f6
--- /dev/null
+++ b/test/cases/semantics/confirm/const-shallow-local.c
@@ -0,0 +1,24 @@
+// RFC 0034 section 6.3 (shallow const): a variant of const-shallow-callback.c
+// with the request in a local and the out-pointer two levels below it. The
+// callee, in another unit, gets a pointer to a const request, but const is
+// shallow: it writes the result through the pointers the request holds, so
+// neither 'n' nor 'name' is uninitialised after the call.
+// CLEAN
+// UNITS: const-shallow-local-callee.c
+#include <stdio.h>
+
+struct out { int *count; const char **name; };
+struct request { struct out *out; int id; };
+
+int fill(const struct request *req); /* in another unit */
+
+int main(void) {
+  int n;
+  const char *name;
+  struct out out = {&n, &name};
+  struct request req = {&out, 7};
+  if (fill(&req) != 0)
+    return 1;
+  printf("%d %s\n", n, name);
+  return 0;
+}
diff --git a/test/cases/semantics/confirm/dangling-hint-direct.c b/test/cases/semantics/confirm/dangling-hint-direct.c
new file mode 100644
index 00000000..a590b288
--- /dev/null
+++ b/test/cases/semantics/confirm/dangling-hint-direct.c
@@ -0,0 +1,34 @@
+// RFC 0034 section 6.3 (values passed as values): a variant of
+// munmap-hint-address.c. The old address of an unmapped region is passed
+// straight to mmap as its address hint, to madvise (a range, not an object;
+// it fails with ENOMEM), and to a unit function that only tests it for truth;
+// none of them accesses the released object, so none is a use after free.
+// CLEAN
+#include <stdio.h>
+#include <sys/mman.h>
+
+static int remembered(const void *hint) {
+  if (!hint)
+    return 0;
+  return hint ? 1 : 0;
+}
+
+int main(void) {
+  size_t len = 1 << 16;
+  char *map = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON,
+                   -1, 0);
+  if (map == MAP_FAILED)
+    return 1;
+  map[0] = 'x';
+  munmap(map, len);
+  int seen = remembered(map);
+  (void)madvise(map, len, MADV_DONTNEED);
+  char *again = mmap(map, len, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON,
+                     -1, 0);
+  if (again == MAP_FAILED)
+    return 1;
+  again[1] = 'y';
+  printf("ok %c %d\n", again[1], seen);
+  munmap(again, len);
+  return 0;
+}
diff --git a/test/cases/semantics/confirm/disequality-edges.c b/test/cases/semantics/confirm/disequality-edges.c
new file mode 100644
index 00000000..a76135e5
--- /dev/null
+++ b/test/cases/semantics/confirm/disequality-edges.c
@@ -0,0 +1,59 @@
+// RFC 0034 section 6.2 (disequalities): variants of unreachable-after-assert.c.
+// Each function leaves a test's true edge for one constant early, so the null
+// dereference under the same test later is on no path: a switch's default
+// edge excludes its labels, a constant on the left of `==` refines the value
+// on the right, and a join keeps the constants both sides exclude. The zone
+// cannot hold any of these (`t` is in [0, 7] throughout).
+// CLEAN
+#include <stdio.h>
+
+typedef struct B { int allowed; } B;
+
+static int bySwitch(int flags, B *cur) {
+  int t = flags & 7;
+  B *b = NULL;
+  switch (t) {
+  case 1:
+  case 2:
+    return cur->allowed;
+  default:
+    break;
+  }
+  printf("switch %d\n", t);
+  if (t == 2)
+    return b->allowed;
+  return 0;
+}
+
+static int byConstantLeft(int flags, B *cur) {
+  int t = flags & 7;
+  if (3 == t)
+    return cur->allowed;
+  B *b = NULL;
+  printf("left %d\n", t);
+  if (t == 3)
+    return b->allowed;
+  return 0;
+}
+
+static int acrossAJoin(int flags, B *cur, int w) {
+  int t = flags & 7;
+  if (t != 5) {
+    B *b = NULL;
+    if (w)
+      puts("w");
+    else
+      puts("not w");
+    if (t == 5)
+      return b->allowed;
+    return 0;
+  }
+  return cur->allowed;
+}
+
+int main(int argc, char **argv) {
+  (void)argv;
+  B one = {1};
+  return bySwitch(argc - 1, &one) + byConstantLeft(argc - 1, &one) +
+         acrossAJoin(argc - 1, &one, argc);
+}
diff --git a/test/cases/semantics/confirm/exclusive-out-params.c b/test/cases/semantics/confirm/exclusive-out-params.c
new file mode 100644
index 00000000..0e4c6bff
--- /dev/null
+++ b/test/cases/semantics/confirm/exclusive-out-params.c
@@ -0,0 +1,54 @@
+// RFC 0034 section 6.3 (exclusive stores of one fresh object): a false
+// definite double free the milestone found in curl's lib/setopt.c
+// (build/eval-2026-10-04/repros/curl-1.c): parse() stores a fresh
+// allocation through *a on one path and through *b on the other, so a and b
+// never hold the same object. Each argument count takes another path. An
+// unconfirmed candidate may remain a warning (RFC 0034, Diagnostics).
+// CLEAN
+// ALLOW: double-free
+// RUN-INPUT:
+// RUN-INPUT: x
+// RUN-INPUT: x y
+/* WeaveC false positive: error "'b' is freed twice [weavec::double-free]".
+ * Reduced from curl lib/setopt.c:180 (setstropt_interface), reported only in
+ * the curlu unity build where Curl_parse_interface's body (cf-socket.c) is in
+ * the same TU. parse() writes a fresh allocation to *a on one path and to *b
+ * on the other; the derived summary appears to give both out-params the same
+ * abstract object, so take(a) freeing a "frees" b too. a and b never alias.
+ * Correct C: clean under clang -fsanitize=address,undefined for argc 1, 2, 3.
+ * Negatives (each removes the error): parse() writes both *a and *b
+ * unconditionally; strdup inlined into main; take() never frees; adding
+ * `if (a == b) return 9;` after parse(); parse() only declared (body in
+ * another unit). */
+#include <stdlib.h>
+#include <string.h>
+
+static char *slot;
+
+/* Takes ownership of str: stores it, or frees it on failure. */
+static int take(char *str, int fail) {
+  if (fail) { free(str); return 1; }
+  free(slot);
+  slot = str;
+  return 0;
+}
+
+static void parse(int which, char **a, char **b) {
+  if (which) *a = strdup("a");
+  else       *b = strdup("b");
+}
+
+int main(int argc, char **argv) {
+  char *a = NULL, *b = NULL;
+  int r;
+  (void)argv;
+  parse(argc > 1, &a, &b);
+  r = take(a, argc > 2);   /* a: stored or freed */
+  if (!r) {
+    r = take(b, 0);
+    b = NULL;
+  }
+  free(b);                 /* b still owned here only if take(a) failed */
+  free(slot);
+  return 0;
+}
diff --git a/test/cases/semantics/confirm/exclusive-result-or-out-param.c b/test/cases/semantics/confirm/exclusive-result-or-out-param.c
new file mode 100644
index 00000000..144d468b
--- /dev/null
+++ b/test/cases/semantics/confirm/exclusive-result-or-out-param.c
@@ -0,0 +1,24 @@
+// RFC 0034 section 6.3 (exclusive stores of one fresh object), a variant of
+// exclusive-out-params.c: pick() stores a fresh string through *a on one
+// path and returns another on the other, so the result and *a never hold
+// the same object. Freeing both is correct for every argument count.
+// CLEAN
+// ALLOW: double-free
+// RUN-INPUT:
+// RUN-INPUT: x
+#include <stdlib.h>
+#include <string.h>
+
+static char *pick(int w, char **a) {
+  if (w) { *a = strdup("a"); return NULL; }
+  return strdup("b");
+}
+
+int main(int argc, char **argv) {
+  char *a = NULL;
+  (void)argv;
+  char *r = pick(argc > 1, &a);
+  free(a);
+  free(r);
+  return 0;
+}
diff --git a/test/cases/semantics/confirm/exclusive-switch-out-params.c b/test/cases/semantics/confirm/exclusive-switch-out-params.c
new file mode 100644
index 00000000..c8e853c4
--- /dev/null
+++ b/test/cases/semantics/confirm/exclusive-switch-out-params.c
@@ -0,0 +1,29 @@
+// RFC 0034 section 6.3 (exclusive stores of one fresh object), a variant of
+// exclusive-out-params.c with three exits: each case of the switch stores
+// its own fresh string through one of three out-parameters (the summary
+// keeps them as possible stores), so no two of a, b and c hold one object.
+// CLEAN
+// ALLOW: double-free
+// RUN-INPUT:
+// RUN-INPUT: x
+// RUN-INPUT: x y
+#include <stdlib.h>
+#include <string.h>
+
+static void three(int w, char **a, char **b, char **c) {
+  switch (w) {
+  case 0: *a = strdup("a"); break;
+  case 1: *b = strdup("b"); break;
+  default: *c = strdup("c"); break;
+  }
+}
+
+int main(int argc, char **argv) {
+  char *a = NULL, *b = NULL, *c = NULL;
+  (void)argv;
+  three(argc - 1, &a, &b, &c);
+  free(a);
+  free(b);
+  free(c);
+  return 0;
+}
diff --git a/test/cases/semantics/confirm/loop-exit-release-break.c b/test/cases/semantics/confirm/loop-exit-release-break.c
new file mode 100644
index 00000000..e44317f9
--- /dev/null
+++ b/test/cases/semantics/confirm/loop-exit-release-break.c
@@ -0,0 +1,36 @@
+// RFC 0034, Silent misses (a release in a loop left early), a variant of
+// loop-exit-release.c: the count comes before the array in the record and
+// the loop is left by `break`. The element read `p->kids[j]` shares its
+// position (offset modulo the element size) with `n`, and its index is
+// bounded only by `n`; the read must stay a pointer so that closer()'s
+// summary keeps the release. The default build must stop at the read;
+// -DFIX reads an element closer() does not free.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 0
+#include <stdio.h>
+#include <stdlib.h>
+struct w { int x; };
+struct panel { int n; struct w *kids[4]; };
+static void add(struct panel *p, int x) {
+  struct w *w = calloc(1, sizeof *w);
+  if (!w) exit(1);
+  w->x = x;
+  p->kids[p->n++] = w;
+}
+static void closer(struct panel *p, int x) {
+  for (int j = 0; j < p->n; j++)
+    if (j == x) { free(p->kids[j]); break; }
+}
+int main(int argc, char **argv) {
+  struct panel p = {0, {0}};
+  for (int i = 0; i < 4; i++) add(&p, i);
+#ifdef FIX
+  struct w *f = p.kids[3];
+#else
+  struct w *f = p.kids[0];
+#endif
+  closer(&p, atoi(argv[1]));
+  printf("%d\n", f->x); // STOP
+  return argc > 5;
+}
diff --git a/test/cases/semantics/confirm/loop-exit-release-search.c b/test/cases/semantics/confirm/loop-exit-release-search.c
new file mode 100644
index 00000000..292950a6
--- /dev/null
+++ b/test/cases/semantics/confirm/loop-exit-release-search.c
@@ -0,0 +1,36 @@
+// RFC 0034, Silent misses (a release in a loop left early), reduced from
+// detection case 24 and probe 62: closer() searches the elements by a
+// field of what each points to, frees the match and returns. The loop's
+// test reads the count `n`, which the loop head folds into the element
+// ranges beside `kids`, so every later read of `p->kids[i]` may be that
+// integer; the read must stay a pointer for the summary to keep the
+// release. The default build must stop at the caller's read; -DFIX reads
+// an element closer() does not free.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 0
+#include <stdio.h>
+#include <stdlib.h>
+struct w { int id; };
+struct panel { struct w *kids[8]; int n; };
+static void closer(struct panel *p, int id) {
+  for (int i = 0; i < p->n; i++)
+    if (p->kids[i]->id == id) { free(p->kids[i]); return; }
+}
+int main(int argc, char **argv) {
+  struct panel p = {{0}, 0};
+  for (int i = 0; i < 4; i++) {
+    p.kids[i] = calloc(1, sizeof(struct w));
+    if (!p.kids[i]) return 1;
+    p.kids[i]->id = i;
+    p.n++;
+  }
+#ifdef FIX
+  struct w *f = p.kids[3];
+#else
+  struct w *f = p.kids[0];
+#endif
+  closer(&p, atoi(argv[1]));
+  printf("%d\n", f->id); // STOP
+  return argc > 5;
+}
diff --git a/test/cases/semantics/confirm/loop-exit-release.c b/test/cases/semantics/confirm/loop-exit-release.c
new file mode 100644
index 00000000..002236b9
--- /dev/null
+++ b/test/cases/semantics/confirm/loop-exit-release.c
@@ -0,0 +1,36 @@
+// RFC 0034, Silent misses: the false proof of the milestone's blind detection
+// set (build/eval-2026-10-04/detect/findings/false_proof_loop_exit_release.c,
+// found from detection cases 24 and 62). closer() frees an element inside a
+// loop bounded by a field and leaves the loop early, and its summary lost the
+// release, so main's alias f kept a proven temporal facet and the default
+// build read freed memory (only verify mode trapped). The default build must
+// stop at the read; -DFIX reads an element closer() does not free.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 0
+#include <stdio.h>
+#include <stdlib.h>
+struct w { int x; };
+struct panel { struct w *kids[4]; int n; };
+static void add(struct panel *p, int x) {
+  struct w *w = calloc(1, sizeof *w);
+  if (!w) exit(1);
+  w->x = x;
+  p->kids[p->n++] = w;
+}
+static void closer(struct panel *p, int x) {
+  for (int j = 0; j < p->n; j++)
+    if (j == x) { free(p->kids[j]); return; } /* `break` loses it too */
+}
+int main(int argc, char **argv) {
+  struct panel p = {{0}, 0};
+  for (int i = 0; i < 4; i++) add(&p, i);
+#ifdef FIX
+  struct w *f = p.kids[3];
+#else
+  struct w *f = p.kids[0];
+#endif
+  closer(&p, atoi(argv[1]));
+  printf("%d\n", f->x); // STOP
+  return argc > 5;
+}
diff --git a/test/cases/semantics/confirm/munmap-constant-pages.c b/test/cases/semantics/confirm/munmap-constant-pages.c
new file mode 100644
index 00000000..309816fe
--- /dev/null
+++ b/test/cases/semantics/confirm/munmap-constant-pages.c
@@ -0,0 +1,25 @@
+// RFC 0034 section 6.3 (partial unmapping): a variant of
+// munmap-partial-range.c with constant offsets. Unmapping the trailing and
+// leading 64 KiB of a 192 KiB mapping (a multiple of every supported page
+// size) releases neither the mapping nor anything definitely, munmap takes a
+// pointer anywhere in the mapping, and the middle stays usable. What remains
+// are possible findings, hence the ALLOW.
+// CLEAN
+// ALLOW: double-free use-after-free
+#include <stdio.h>
+#include <sys/mman.h>
+
+enum { Chunk = 1 << 16 };
+
+int main(void) {
+  unsigned char *base = mmap(NULL, 3 * Chunk, PROT_READ | PROT_WRITE,
+                             MAP_PRIVATE | MAP_ANON, -1, 0);
+  if (base == MAP_FAILED)
+    return 1;
+  munmap(base + 2 * Chunk, Chunk);
+  munmap(base, Chunk);
+  base[Chunk] = 42;
+  printf("%d\n", base[Chunk]);
+  munmap(base + Chunk, Chunk);
+  return 0;
+}
diff --git a/test/cases/semantics/confirm/munmap-hint-address.c b/test/cases/semantics/confirm/munmap-hint-address.c
new file mode 100644
index 00000000..3ba033e4
--- /dev/null
+++ b/test/cases/semantics/confirm/munmap-hint-address.c
@@ -0,0 +1,42 @@
+// RFC 0034 section 6.3: a false definite use after free the milestone found
+// in LMDB's mdb_env_set_mapsize (build/eval-2026-10-04/repros/lmdb-1.c): the
+// address of an unmapped region is passed to mmap as a hint and only
+// compared, never dereferenced. An unconfirmed candidate may remain a
+// warning (RFC 0034, Diagnostics); and the leak report the runner asks for
+// (-Wweavec-leak) takes map_at's MAP_FAILED return for a mapping.
+// CLEAN
+// ALLOW: use-after-free leak
+/* LMDB mdb_env_set_mapsize: after munmap, the old base address is passed
+ * as an address hint to mmap (never dereferenced). weavec-cc reports
+ * use-after-free and fails the build. */
+#include <stdio.h>
+#include <sys/mman.h>
+
+static char *map_at(void *hint, size_t len) {
+  char *p = mmap(hint, len, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
+  if (p == MAP_FAILED) return NULL;
+  if (hint && p != hint) puts("moved"); /* only compares the address */
+  return p;
+}
+
+int main(void) {
+  size_t len = 1 << 16;
+  char *map = map_at(NULL, len);
+  if (!map) return 1;
+  map[0] = 'x';
+  void *old;
+#ifndef NEGATIVE
+  munmap(map, len);
+  old = map;           /* dangling, used only as an address */
+#else
+  old = map;           /* negative: same hint, no munmap before it */
+  munmap(map, len);
+  old = NULL;
+#endif
+  map = map_at(old, len);
+  if (!map) return 1;
+  map[1] = 'y';
+  printf("ok %c\n", map[1]);
+  munmap(map, len);
+  return 0;
+}
diff --git a/test/cases/semantics/confirm/munmap-partial-range.c b/test/cases/semantics/confirm/munmap-partial-range.c
new file mode 100644
index 00000000..05e71dde
--- /dev/null
+++ b/test/cases/semantics/confirm/munmap-partial-range.c
@@ -0,0 +1,38 @@
+// RFC 0034 section 6.3: false definite errors the milestone found in
+// libdeflate's programs/test_util.c (build/eval-2026-10-04/repros/libdeflate-1.c):
+// munmap of part of a mapping is not a release of the whole mapping, so
+// unmapping the two guard pages is no double free and the middle page is
+// still mapped. Unconfirmed candidates may remain warnings (RFC 0034,
+// Diagnostics), and so may the possible invalid release of a range that does
+// not start a mapping (munmap takes any page-aligned range).
+// CLEAN
+// ALLOW: double-free use-after-free invalid-release
+/* libdeflate programs/test_util.c alloc_guarded_buffer: munmap of part of a
+ * mapping is modelled as a release of the whole mapping, so unmapping the two
+ * guard pages is a "double free" and the middle page is "used after free".
+ * -DNEGATIVE: unmap only the whole mapping, once, at the end -> builds, runs. */
+#include <stdio.h>
+#include <sys/mman.h>
+#include <unistd.h>
+
+int main(void) {
+	size_t pg = (size_t)getpagesize();
+	unsigned char *base = mmap(NULL, 3 * pg, PROT_READ | PROT_WRITE,
+				   MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+	if (base == MAP_FAILED)
+		return 1;
+	unsigned char *start = base + pg;
+	unsigned char *end = start + pg;
+#ifndef NEGATIVE
+	munmap(base, pg);   /* leading guard page only */
+	munmap(end, pg);    /* trailing guard page: a different range */
+#endif
+	start[0] = 42;      /* middle page is still mapped */
+	printf("%d\n", start[0]);
+#ifndef NEGATIVE
+	munmap(start, pg);
+#else
+	munmap(base, 3 * pg);
+#endif
+	return 0;
+}
diff --git a/test/cases/semantics/confirm/munmap-whole-twice.c b/test/cases/semantics/confirm/munmap-whole-twice.c
new file mode 100644
index 00000000..037b9a60
--- /dev/null
+++ b/test/cases/semantics/confirm/munmap-whole-twice.c
@@ -0,0 +1,21 @@
+// RFC 0034 section 6.3 (partial unmapping): the other side of
+// munmap-partial-range.c. A munmap whose range covers the whole mapping from
+// its start still releases it, so unmapping it again, or using it after, is
+// a definite error. (A failed mmap returns MAP_FAILED, whose munmap fails
+// with EINVAL.)
+#include <stddef.h>
+#include <sys/mman.h>
+
+void twice(size_t len) {
+  char *map = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON,
+                   -1, 0);
+  munmap(map, len);
+  munmap(map, len); // BUG: double-free definite
+}
+
+int after(void) {
+  char *map = mmap(NULL, 4096 * 4, PROT_READ | PROT_WRITE,
+                   MAP_PRIVATE | MAP_ANON, -1, 0);
+  munmap(map, 4096 * 4);
+  return map[0]; // BUG: use-after-free definite
+}
diff --git a/test/cases/semantics/confirm/release-by-flag-stream.c b/test/cases/semantics/confirm/release-by-flag-stream.c
new file mode 100644
index 00000000..026810ae
--- /dev/null
+++ b/test/cases/semantics/confirm/release-by-flag-stream.c
@@ -0,0 +1,34 @@
+// RFC 0034 section 6.3 (rows that disagree), a variant of release-by-flag.c:
+// open_it() returns a malloc'd buffer or a FILE stream and says which by a
+// flag, so its two result rows are one new object with two release families.
+// Applied together, the family is unknown: neither free() nor fclose() of the
+// result is a definite mismatched release.
+// CLEAN
+// ALLOW: mismatched-release
+// RUN-INPUT:
+// RUN-INPUT: mem
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+static void *open_it(const char *name, int *is_mem) {
+  if (strcmp(name, "mem") == 0) {
+    char *b = malloc(16);
+    if (!b) abort();
+    *is_mem = 1;
+    return b;
+  }
+  FILE *f = fopen(name, "r");
+  if (!f) abort();
+  *is_mem = 0;
+  return f;
+}
+
+int main(int argc, char **argv) {
+  int is_mem = 0;
+  void *h = open_it(argc > 1 ? argv[1] : "/dev/null", &is_mem);
+  if (is_mem) { free(h); puts("mem"); return 0; }
+  fclose(h);
+  puts("file");
+  return 0;
+}
diff --git a/test/cases/semantics/confirm/release-by-flag.c b/test/cases/semantics/confirm/release-by-flag.c
new file mode 100644
index 00000000..c2c1a57c
--- /dev/null
+++ b/test/cases/semantics/confirm/release-by-flag.c
@@ -0,0 +1,47 @@
+// RFC 0034 section 6.3: a false definite mismatched release the milestone
+// found in Janet's net.c (build/eval-2026-10-04/repros/janet-1.c): the
+// function returns either calloc'd memory (*is_unix = 1) or a getaddrinfo
+// list, and the caller releases each with its own releaser by the flag. An
+// unconfirmed candidate may remain a warning (RFC 0034, Diagnostics).
+// CLEAN
+// ALLOW: mismatched-release
+// RUN-INPUT:
+// RUN-INPUT: unix
+/* Janet net.c: janet_get_addrinfo returns either a calloc'd sockaddr_un
+ * (and sets *is_unix = 1) or a getaddrinfo list (*is_unix = 0). Callers
+ * call freeaddrinfo only when !is_unix. weavec-cc reports a definite
+ * mismatched-release error and fails the build. */
+#include <netdb.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+
+static struct addrinfo *get_ai(const char *host, int *is_unix) {
+#ifndef NEGATIVE
+  if (strcmp(host, "unix") == 0) {
+    struct sockaddr_un *sa = calloc(1, sizeof *sa);
+    if (!sa) abort();
+    sa->sun_family = AF_UNIX;
+    *is_unix = 1;
+    return (struct addrinfo *)sa;
+  }
+#endif
+  struct addrinfo hints, *ai = NULL;
+  memset(&hints, 0, sizeof hints);
+  hints.ai_family = AF_UNSPEC;
+  hints.ai_flags = AI_NUMERICHOST | AI_NUMERICSERV;
+  if (getaddrinfo(host, "80", &hints, &ai)) abort();
+  *is_unix = 0;
+  return ai;
+}
+
+int main(int argc, char **argv) {
+  int is_unix = 0;
+  struct addrinfo *ai = get_ai(argc > 1 ? argv[1] : "127.0.0.1", &is_unix);
+  if (is_unix) { free(ai); puts("unix"); return 0; }
+  printf("family %d\n", ai->ai_family);
+  freeaddrinfo(ai);
+  return 0;
+}
diff --git a/test/cases/semantics/confirm/shared-out-params.c b/test/cases/semantics/confirm/shared-out-params.c
new file mode 100644
index 00000000..39ab752f
--- /dev/null
+++ b/test/cases/semantics/confirm/shared-out-params.c
@@ -0,0 +1,34 @@
+// RFC 0034 section 6.3 (exclusive stores of one fresh object), the
+// counterpart of exclusive-out-params.c: share() stores one fresh object
+// through both out-parameters on every path, so a and b hold the same
+// object and freeing both is a definite double free. So is a call whose
+// argument decides parse()'s exclusive stores.
+#include <stdlib.h>
+#include <string.h>
+
+static void share(char **a, char **b) {
+  char *p = malloc(4);
+  *a = p;
+  *b = p;
+}
+
+static void parse(int which, char **a, char **b) {
+  if (which) *a = strdup("a");
+  else       *b = strdup("b");
+}
+
+int shared(void) {
+  char *a = NULL, *b = NULL;
+  share(&a, &b);
+  free(a);
+  free(b); // BUG: double-free definite
+  return 0;
+}
+
+int decided(void) {
+  char *a = NULL, *b = NULL;
+  parse(1, &a, &b);
+  char *c = a;
+  free(a);
+  return *c; // BUG: use-after-free definite
+}
diff --git a/test/cases/semantics/confirm/sprintf-guard-fmt.c b/test/cases/semantics/confirm/sprintf-guard-fmt.c
new file mode 100644
index 00000000..e8a66169
--- /dev/null
+++ b/test/cases/semantics/confirm/sprintf-guard-fmt.c
@@ -0,0 +1,6 @@
+// The formatting unit of sprintf-guard.c: the destination's extent is not
+// visible here.
+#include <string.h>
+#include <stdio.h>
+void fmt(char *out, const char *host, int port) { sprintf(out, "%s:%d", host, port); } // STOP
+void fmt2(char *out, const char *host) { strcpy(out, host); }
diff --git a/test/cases/semantics/confirm/sprintf-guard.c b/test/cases/semantics/confirm/sprintf-guard.c
new file mode 100644
index 00000000..294a9446
--- /dev/null
+++ b/test/cases/semantics/confirm/sprintf-guard.c
@@ -0,0 +1,31 @@
+// RFC 0034 section 5.2 (checked wrappers) and Silent misses: the sprintf
+// guard gap of the milestone's blind detection set
+// (build/eval-2026-10-04/detect/findings/sprintf_guard_gap). fmt() writes
+// 37 bytes into a 16-byte heap block whose extent its unit cannot see, and
+// nothing reads the block afterwards. A guard of the format's least output
+// did not bound what sprintf writes; its checked wrapper writes through
+// vsnprintf with the room left in the block. The default build must trap at
+// the sprintf; -DFIX allocates enough.
+// DETECT: -DFIX
+// FLAGS: -O2
+// UNITS: sprintf-guard-fmt.c
+// RUN-INPUT: s averyveryverylonghostname.example
+#include <stdio.h>
+#include <stdlib.h>
+void fmt(char *out, const char *host, int port);
+void fmt2(char *out, const char *host);
+int main(int argc, char **argv) {
+  if (argc < 3)
+    return 2;
+#ifdef FIX
+  char *heap = malloc(64);
+#else
+  char *heap = malloc(16);
+#endif
+  if (!heap)
+    return 1;
+  if (argv[1][0] == 's') fmt(heap, argv[2], 80); else fmt2(heap, argv[2]);
+  printf("done %d\n", argc);   /* no read of heap afterwards */
+  free(heap);
+  return 0;
+}
diff --git a/test/cases/semantics/confirm/unreachable-after-assert.c b/test/cases/semantics/confirm/unreachable-after-assert.c
new file mode 100644
index 00000000..5ca5f846
--- /dev/null
+++ b/test/cases/semantics/confirm/unreachable-after-assert.c
@@ -0,0 +1,46 @@
+// RFC 0034 section 6 (confirmed errors): a false definite null dereference
+// the milestone found in QuickJS's quickjs.check.o build
+// (build/eval-2026-10-04/repros/quickjs-2.c). The DIRECT branch ends in an
+// assert that cannot hold, so b->allowed is unreachable: the else edge
+// excludes DIRECT from eval_type (section 6.2), so the second test's true
+// edge is infeasible in every run, the replay's too. An unconfirmed
+// candidate may remain a warning (RFC 0034, Diagnostics), hence the ALLOW.
+// CLEAN
+// ALLOW: null-dereference
+/* QuickJS __JS_EvalInternal (quickjs.c:37449-37484) in CONFIG_CHECK_JSVALUE
+ * mode: the DIRECT branch ends in an assert that can never hold there, so
+ * only the else branch (b = NULL, eval_type != DIRECT) survives; the later
+ * `if (eval_type == DIRECT) ... b->x` is then unreachable, but weavec-cc
+ * reports a definite null-dereference of 'b' (it does not keep
+ * eval_type != DIRECT on the surviving path). */
+#include <assert.h>
+#include <stdint.h>
+#include <stdio.h>
+typedef struct B { int allowed; } B;
+typedef struct F { B *bc; uintptr_t val; } F;
+#define DIRECT 1
+#ifndef NEGATIVE
+#define TAG_OK(v) (((v) & 0xf) == (uintptr_t)-1) /* never true */
+#else
+#define TAG_OK(v) (((v) & 0xf) == 0xf)           /* negative: can hold */
+#endif
+
+int eval(int flags, F *cur) {
+  int eval_type = flags & 3;
+  B *b;
+  if (eval_type == DIRECT) {
+    assert(TAG_OK(cur->val));
+    b = cur->bc;
+  } else {
+    b = NULL;
+  }
+  printf("eval %d\n", eval_type);
+  if (eval_type == DIRECT)
+    return b->allowed;
+  return 0;
+}
+
+int main(void) {
+  F f = {0, 0};
+  return eval(0, &f); /* eval_type 0: never takes the DIRECT path */
+}
diff --git a/test/cases/semantics/detect-probes/62_uaf_focus_alias/prog.c b/test/cases/semantics/detect-probes/62_uaf_focus_alias/prog.c
new file mode 100644
index 00000000..a8389af4
--- /dev/null
+++ b/test/cases/semantics/detect-probes/62_uaf_focus_alias/prog.c
@@ -0,0 +1,64 @@
+// RFC 0034 detection probe, case 62 (use after free): a probe written after the 61 blind programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: ok ok cancel help
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+/* follow-up probe written after case 24 missed: alias kept in a local */
+struct widget {
+  int x, y;
+  char label[16];
+};
+
+struct panel {
+  struct widget *kids[8];
+  int n;
+};
+
+static void panel_add(struct panel *p, const char *label, int x) {
+  if (p->n == 8)
+    return;
+  struct widget *w = calloc(1, sizeof *w);
+  if (!w)
+    exit(1);
+  w->x = x;
+  snprintf(w->label, sizeof w->label, "%s", label);
+  p->kids[p->n++] = w;
+}
+
+static void panel_close(struct panel *p, const char *label) {
+  for (int i = 0; i < p->n; i++) {
+    if (strcmp(p->kids[i]->label, label) == 0) {
+      free(p->kids[i]);
+      p->kids[i] = p->kids[--p->n];
+      return;
+    }
+  }
+}
+
+int main(int argc, char **argv) {
+  if (argc < 3)
+    return 2;
+  struct panel p = {{0}, 0};
+  for (int i = 2; i < argc; i++)
+    panel_add(&p, argv[i], i * 10);
+  struct widget *focused = p.kids[0];
+#ifdef FIX
+  int focused_closed = strcmp(focused->label, argv[1]) == 0;
+#endif
+  panel_close(&p, argv[1]);
+#ifdef FIX
+  if (focused_closed)
+    focused = p.n ? p.kids[0] : NULL;
+  if (focused)
+#endif
+    printf("focus at x=%d\n", focused->x); // STOP
+  for (int i = 0; i < p.n; i++)
+    free(p.kids[i]);
+  return 0;
+}
diff --git a/test/cases/semantics/detect-probes/63_uaf_loop_next/prog.c b/test/cases/semantics/detect-probes/63_uaf_loop_next/prog.c
new file mode 100644
index 00000000..e63fa07c
--- /dev/null
+++ b/test/cases/semantics/detect-probes/63_uaf_loop_next/prog.c
@@ -0,0 +1,68 @@
+// RFC 0034 detection probe, case 63 (use after free): a probe written after the 61 blind programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: 4 -2 7 -1 3
+#include <stdio.h>
+#include <stdlib.h>
+
+struct node {
+  int val;
+  struct node *next;
+};
+
+static struct node *build(int argc, char **argv) {
+  struct node *head = NULL, **tail = &head;
+  for (int i = 1; i < argc; i++) {
+    struct node *n = calloc(1, sizeof *n);
+    if (!n)
+      exit(1);
+    n->val = atoi(argv[i]);
+    *tail = n;
+    tail = &n->next;
+  }
+  return head;
+}
+
+/* drops every negative value */
+static struct node *drop_negative(struct node *head) {
+  struct node **link = &head;
+#ifdef FIX
+  struct node *n = head;
+  while (n) {
+    struct node *next = n->next;
+    if (n->val < 0) {
+      *link = next;
+      free(n);
+    } else {
+      link = &n->next;
+    }
+    n = next;
+  }
+#else
+  for (struct node *n = head; n; n = n->next) { // STOP
+    if (n->val < 0) {
+      *link = n->next;
+      free(n);
+    } else {
+      link = &n->next;
+    }
+  }
+#endif
+  return head;
+}
+
+int main(int argc, char **argv) {
+  struct node *h = drop_negative(build(argc, argv));
+  int sum = 0;
+  while (h) {
+    struct node *n = h->next;
+    sum += h->val;
+    free(h);
+    h = n;
+  }
+  printf("sum=%d\n", sum);
+  return 0;
+}
diff --git a/test/cases/semantics/detect-probes/64_arena_block_overflow/prog.c b/test/cases/semantics/detect-probes/64_arena_block_overflow/prog.c
new file mode 100644
index 00000000..cc667048
--- /dev/null
+++ b/test/cases/semantics/detect-probes/64_arena_block_overflow/prog.c
@@ -0,0 +1,48 @@
+// RFC 0034 detection probe, case 64 (arena sub-allocation): a probe written after the 61 blind programs
+// of the RFC 0034 milestone (build/eval-2026-10-04/detect). The default build must stop
+// the bug at or before its STOP line (a WeaveC error, or a trap whose report-mode check
+// is on that line); -DFIX selects the fixed twin, which must build and run clean.
+// DETECT: -DFIX
+// FLAGS: -O2
+// RUN-INPUT: the quick brown fox jumps over the lazy dog
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+/* follow-up probe written after case 57: the overflow leaves the arena's block */
+struct arena {
+  char *base;
+  size_t used, cap;
+};
+
+static void *arena_alloc(struct arena *a, size_t n) {
+#ifdef FIX
+  if (a->used + n > a->cap)
+#else
+  if (a->used > a->cap) /* checks the start, not the end */
+#endif
+    return NULL;
+  void *p = a->base + a->used;
+  a->used += n;
+  return p;
+}
+
+int main(int argc, char **argv) {
+  struct arena a = {malloc(32), 0, 32};
+  if (!a.base)
+    return 1;
+  char *words[16];
+  int nw = 0;
+  for (int i = 1; i < argc && nw < 16; i++) {
+    char *t = arena_alloc(&a, strlen(argv[i]) + 1);
+    if (!t)
+      break;
+    strcpy(t, argv[i]); // STOP
+    words[nw++] = t;
+  }
+  for (int i = 0; i < nw; i++)
+    printf("%s ", words[i]);
+  printf("(%zu bytes)\n", a.used);
+  free(a.base);
+  return 0;
+}
diff --git a/test/cases/semantics/emission/lowered-out-of-bounds.c b/test/cases/semantics/emission/lowered-out-of-bounds.c
index 176b1a41..23e53c04 100644
--- a/test/cases/semantics/emission/lowered-out-of-bounds.c
+++ b/test/cases/semantics/emission/lowered-out-of-bounds.c
@@ -13,7 +13,7 @@
 int main(void) {
   char *p = malloc(4);
   if (!p) return 1;
-  p[4] = 0; // BUG: out-of-bounds possible // TRAP: violation
+  p[4] = 0; // BUG: out-of-bounds possible // TRAP: index
   free(p);
   return 0;
 }
diff --git a/test/cases/semantics/emission/lowered-use-after-free-no-runtime.c b/test/cases/semantics/emission/lowered-use-after-free-no-runtime.c
index e134957b..28ecd460 100644
--- a/test/cases/semantics/emission/lowered-use-after-free-no-runtime.c
+++ b/test/cases/semantics/emission/lowered-use-after-free-no-runtime.c
@@ -1,18 +1,15 @@
-// RFC 0030 §3.4, as amended by RFC 0033 (V): without the runtime a lowered temporal violation
-// traps unconditionally.
+// RFC 0034 §6.4: a lowered violation gets the check or guard its facet would have as a possible
+// finding, never an unconditional trap. A temporal facet has no static check, and without the
+// runtime no guard, so a definite use-after-free whose error is lowered to a warning inserts
+// nothing and the facet is unresolved(lowered).
 // STAGE: S5
-// Temporal facets have no static check, and without the runtime no guard, so a definite
-// use-after-free whose error is lowered to a warning gets
-// __builtin_verbose_trap("weavec", "violation") before the operation.
 // FLAGS: -Wno-error=weavec-use-after-free -fno-weavec-runtime
-// RUN-INPUT:
-// ASAN
 #include <stdlib.h>
 
 int main(void) {
   char *p = malloc(8);
   if (!p) return 1;
   free(p);
-  p[0] = 1; // BUG: use-after-free possible // TRAP: violation
+  p[0] = 1; // BUG: use-after-free possible // UNRESOLVED: temporal:lowered
   return 0;
 }
diff --git a/test/cases/semantics/runtime/format-precision-dangling_bug.c b/test/cases/semantics/runtime/format-precision-dangling_bug.c
new file mode 100644
index 00000000..7470881a
--- /dev/null
+++ b/test/cases/semantics/runtime/format-precision-dangling_bug.c
@@ -0,0 +1,25 @@
+// RFC 0033 §5, RFC 0034 amendments: a `%.Ns` argument is read for at most N
+// bytes and needs no terminator, so it states no spatial need; it is still
+// read, so the call's liveness guard covers it. Here it points into a copy
+// the callee freed.
+// RUN-INPUT:
+// ASAN
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+static void find(const char *text, const char **err) {
+  char *copy = strdup(text);
+  *err = text;
+  for (char *tok = strtok(copy, ","); tok; tok = strtok(NULL, ","))
+    if (tok[0] == 'x') {
+      *err = tok;
+      break;
+    }
+  free(copy);
+}
+int main(void) {
+  const char *err;
+  find("a,b,xyz", &err);
+  printf("%.3s\n", err); // BUG: use-after-free // TRAP: live
+  return 0;
+}
diff --git a/test/cases/semantics/runtime/format-precision-dangling_ok.c b/test/cases/semantics/runtime/format-precision-dangling_ok.c
new file mode 100644
index 00000000..391eb2af
--- /dev/null
+++ b/test/cases/semantics/runtime/format-precision-dangling_ok.c
@@ -0,0 +1,25 @@
+// RFC 0033 §5, RFC 0034 amendments: a `%.Ns` argument is read for at most N
+// bytes and needs no terminator, so it states no spatial need; it is still
+// read, so the call's liveness guard covers it. The twin of
+// format-precision-dangling_bug.c: the error points into the caller's text.
+// CLEAN
+// RUN-INPUT:
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+static void find(const char *text, const char **err) {
+  char *copy = strdup(text);
+  *err = text;
+  for (char *tok = strtok(copy, ","); tok; tok = strtok(NULL, ","))
+    if (tok[0] == 'x') {
+      *err = text + (tok - copy);
+      break;
+    }
+  free(copy);
+}
+int main(void) {
+  const char *err;
+  find("a,b,xyz", &err);
+  printf("%.3s\n", err); 
+  return 0;
+}
diff --git a/test/cases/semantics/runtime/libcall-copy-source_bug.c b/test/cases/semantics/runtime/libcall-copy-source_bug.c
new file mode 100644
index 00000000..029547ae
--- /dev/null
+++ b/test/cases/semantics/runtime/libcall-copy-source_bug.c
@@ -0,0 +1,24 @@
+// RFC 0034 §5.2 and amendments: a copy whose length no term can state
+// (`*n` behind a parameter, here) calls the checked wrapper, which checks the
+// bytes behind the source as well as the room behind the destination. The
+// erase moves one element too many, reading past the array.
+// RUN-INPUT:
+// ASAN
+#include <stdlib.h>
+#include <string.h>
+static void erase(int *a, size_t *n, size_t i) {
+  memmove(&a[i], &a[i + 1], (*n - i) * sizeof *a); // BUG: out-of-bounds // TRAP: object
+  --*n;
+}
+int main(void) {
+  size_t n = 5;
+  int *a = malloc(5 * sizeof *a);
+  if (!a)
+    return 1;
+  for (int i = 0; i < 5; i++)
+    a[i] = i;
+  erase(a, &n, 1);
+  int r = a[1];
+  free(a);
+  return r == 2 ? 0 : 1;
+}
diff --git a/test/cases/semantics/runtime/libcall-copy-source_ok.c b/test/cases/semantics/runtime/libcall-copy-source_ok.c
new file mode 100644
index 00000000..75f96755
--- /dev/null
+++ b/test/cases/semantics/runtime/libcall-copy-source_ok.c
@@ -0,0 +1,24 @@
+// RFC 0034 §5.2 and amendments: a copy whose length no term can state
+// (`*n` behind a parameter, here) calls the checked wrapper, which checks the
+// bytes behind the source as well as the room behind the destination. The
+// twin of libcall-copy-source_bug.c moves the right count.
+// CLEAN
+// RUN-INPUT:
+#include <stdlib.h>
+#include <string.h>
+static void erase(int *a, size_t *n, size_t i) {
+  memmove(&a[i], &a[i + 1], (*n - i - 1) * sizeof *a);
+  --*n;
+}
+int main(void) {
+  size_t n = 5;
+  int *a = malloc(5 * sizeof *a);
+  if (!a)
+    return 1;
+  for (int i = 0; i < 5; i++)
+    a[i] = i;
+  erase(a, &n, 1);
+  int r = a[1];
+  free(a);
+  return r == 2 ? 0 : 1;
+}
diff --git a/test/cases/semantics/runtime/parameter-neighbours_ok.c b/test/cases/semantics/runtime/parameter-neighbours_ok.c
new file mode 100644
index 00000000..601333ef
--- /dev/null
+++ b/test/cases/semantics/runtime/parameter-neighbours_ok.c
@@ -0,0 +1,39 @@
+// RFC 0034 §4: parameters whose addresses escape are registered like locals,
+// on a granule, so two of them side by side keep their own shadow: a write
+// through either pointer stays inside its parameter, and leaving one does
+// not leave the other's bytes behind for a later frame (an alloca'd buffer
+// below) to trip over.
+// STAGE: S4
+// CLEAN
+// RUN-INPUT:
+// ASAN
+#include <alloca.h>
+#include <string.h>
+typedef struct { long v; } Value;
+static __attribute__((noinline)) int step(Value *x, Value *y, int i) {
+  x->v += i;
+  y->v += i;
+  return i < 3;
+}
+static __attribute__((noinline)) long compare(Value x, Value y) {
+  int i = 0;
+  while (step(&x, &y, i))
+    ++i;
+  return x.v + y.v;
+}
+static __attribute__((noinline)) long scratch(int n) {
+  long *buffer = alloca(sizeof(long) * (size_t)n);
+  long sum = 0;
+  for (int i = 0; i < n; i++)
+    buffer[i] = i;
+  for (int i = 0; i < n; i++)
+    sum += buffer[i];
+  return sum;
+}
+int main(void) {
+  Value a = {1}, b = {2};
+  long total = 0;
+  for (int round = 0; round < 3; round++)
+    total += compare(a, b) + scratch(24);
+  return total == 3 * (15 + 276) ? 0 : 1;
+}
diff --git a/test/cases/semantics/runtime/term-signed-sum_bug.c b/test/cases/semantics/runtime/term-signed-sum_bug.c
new file mode 100644
index 00000000..745289b0
--- /dev/null
+++ b/test/cases/semantics/runtime/term-signed-sum_bug.c
@@ -0,0 +1,30 @@
+// RFC 0030 §10.2, term arithmetic: a length the program computes in `int`
+// is checked at the value the program computes. The twin of
+// term-signed-sum_ok.c pads one byte too many: `count + 9` is 4 bytes from
+// the 61st, one past the end of the 64-byte block, found at the call.
+// RUN-INPUT:
+// ASAN
+#include <stdlib.h>
+#include <string.h>
+static void pad(unsigned char *in, unsigned used) {
+  int count = (int)(used & 0x3f);
+  unsigned char *p = in + count;
+  *p++ = 0x80;
+  count = 56 - 1 - count;
+  if (count < 0) {
+    memset(p, 0, count + 9);
+    p = in;
+    count = 56;
+  }
+  memset(p, 0, count);
+}
+int main(void) {
+  volatile unsigned used = 60;
+  unsigned char *in = malloc(64);
+  if (!in)
+    return 1;
+  pad(in, used); // BUG: out-of-bounds
+  int last = in[63];
+  free(in);
+  return last;
+}
diff --git a/test/cases/semantics/runtime/term-signed-sum_ok.c b/test/cases/semantics/runtime/term-signed-sum_ok.c
new file mode 100644
index 00000000..2b4a54c3
--- /dev/null
+++ b/test/cases/semantics/runtime/term-signed-sum_ok.c
@@ -0,0 +1,30 @@
+// RFC 0030 §10.2, term arithmetic: a length the program computes in `int`
+// is checked at the value the program computes. `count + 8` with
+// `count == -5` is 3; a negative leaf inside a sum is not a huge length
+// (FLAC__MD5Final's padding, which trapped).
+// CLEAN
+// RUN-INPUT:
+#include <stdlib.h>
+#include <string.h>
+static void pad(unsigned char *in, unsigned used) {
+  int count = (int)(used & 0x3f);
+  unsigned char *p = in + count;
+  *p++ = 0x80;
+  count = 56 - 1 - count;
+  if (count < 0) {
+    memset(p, 0, count + 8);
+    p = in;
+    count = 56;
+  }
+  memset(p, 0, count);
+}
+int main(void) {
+  volatile unsigned used = 60;
+  unsigned char *in = malloc(64);
+  if (!in)
+    return 1;
+  pad(in, used);
+  int last = in[63];
+  free(in);
+  return last;
+}
diff --git a/test/cases/semantics/runtime/wrapper-stpcpy_bug.c b/test/cases/semantics/runtime/wrapper-stpcpy_bug.c
new file mode 100644
index 00000000..ea767df5
--- /dev/null
+++ b/test/cases/semantics/runtime/wrapper-stpcpy_bug.c
@@ -0,0 +1,19 @@
+// RFC 0034 §5.2: stpcpy copies an element of an array it was passed (no term names it) into a block whose extent its function cannot see: its checked wrapper checks strlen + 1 bytes against the room left in the block.
+// RUN-INPUT: 0123456789abcdef
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+static void put(char *dst, char **words, int i) {
+  char *end = stpcpy(dst, words[i]); // TRAP: object // GUARDED: spatial
+  end[0] = 0;
+}
+
+int main(int argc, char **argv) {
+  char *dst = malloc(8);
+  if (!dst || argc < 2)
+    return 1;
+  put(dst, argv, 1);
+  printf("%s\n", dst);
+  free(dst);
+  return 0;
+}
diff --git a/test/cases/semantics/runtime/wrapper-stpcpy_ok.c b/test/cases/semantics/runtime/wrapper-stpcpy_ok.c
new file mode 100644
index 00000000..9b3d14d1
--- /dev/null
+++ b/test/cases/semantics/runtime/wrapper-stpcpy_ok.c
@@ -0,0 +1,20 @@
+// RFC 0034 §5.2: the correct twin of wrapper-stpcpy_bug.c: seven characters and their terminator fit the block.
+// CLEAN
+// RUN-INPUT: 0123456
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+static void put(char *dst, char **words, int i) {
+  char *end = stpcpy(dst, words[i]); // GUARDED: spatial
+  end[0] = 0;
+}
+
+int main(int argc, char **argv) {
+  char *dst = malloc(8);
+  if (!dst || argc < 2)
+    return 1;
+  put(dst, argv, 1);
+  printf("%s\n", dst);
+  free(dst);
+  return 0;
+}
diff --git a/test/cases/semantics/runtime/wrapper-strcat_bug.c b/test/cases/semantics/runtime/wrapper-strcat_bug.c
new file mode 100644
index 00000000..6620b80b
--- /dev/null
+++ b/test/cases/semantics/runtime/wrapper-strcat_bug.c
@@ -0,0 +1,21 @@
+// RFC 0034 §5.2: strcat appends an element of an array it was passed (no term names it) to a string in a block whose extent its function cannot see: its checked wrapper checks both lengths and the terminator against the room left in the block.
+// RUN-INPUT: 012345
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+static void put(char *dst, char **words, int i) {
+  dst[0] = '>';
+  dst[1] = ' ';
+  dst[2] = 0;
+  strcat(dst, words[i]); // TRAP: object // GUARDED: spatial
+}
+
+int main(int argc, char **argv) {
+  char *dst = malloc(8);
+  if (!dst || argc < 2)
+    return 1;
+  put(dst, argv, 1);
+  printf("%s\n", dst);
+  free(dst);
+  return 0;
+}
diff --git a/test/cases/semantics/runtime/wrapper-strcat_ok.c b/test/cases/semantics/runtime/wrapper-strcat_ok.c
new file mode 100644
index 00000000..ab0b5074
--- /dev/null
+++ b/test/cases/semantics/runtime/wrapper-strcat_ok.c
@@ -0,0 +1,22 @@
+// RFC 0034 §5.2: the correct twin of wrapper-strcat_bug.c: two characters, five more and the terminator fit the block.
+// CLEAN
+// RUN-INPUT: 01234
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+static void put(char *dst, char **words, int i) {
+  dst[0] = '>';
+  dst[1] = ' ';
+  dst[2] = 0;
+  strcat(dst, words[i]); // GUARDED: spatial
+}
+
+int main(int argc, char **argv) {
+  char *dst = malloc(8);
+  if (!dst || argc < 2)
+    return 1;
+  put(dst, argv, 1);
+  printf("%s\n", dst);
+  free(dst);
+  return 0;
+}
diff --git a/test/cases/semantics/runtime/wrapper-strcpy_bug.c b/test/cases/semantics/runtime/wrapper-strcpy_bug.c
new file mode 100644
index 00000000..5a94b1f0
--- /dev/null
+++ b/test/cases/semantics/runtime/wrapper-strcpy_bug.c
@@ -0,0 +1,18 @@
+// RFC 0034 §5.2: strcpy copies an element of an array it was passed (no term names it) into a block whose extent its function cannot see: its checked wrapper checks strlen + 1 bytes against the room left in the block.
+// RUN-INPUT: 0123456789abcdef
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+static void put(char *dst, char **words, int i) {
+  strcpy(dst, words[i]); // TRAP: object // GUARDED: spatial
+}
+
+int main(int argc, char **argv) {
+  char *dst = malloc(8);
+  if (!dst || argc < 2)
+    return 1;
+  put(dst, argv, 1);
+  printf("%s\n", dst);
+  free(dst);
+  return 0;
+}
diff --git a/test/cases/semantics/runtime/wrapper-strcpy_ok.c b/test/cases/semantics/runtime/wrapper-strcpy_ok.c
new file mode 100644
index 00000000..6ce1fd0a
--- /dev/null
+++ b/test/cases/semantics/runtime/wrapper-strcpy_ok.c
@@ -0,0 +1,19 @@
+// RFC 0034 §5.2: the correct twin of wrapper-strcpy_bug.c: seven characters and their terminator fit the block.
+// CLEAN
+// RUN-INPUT: 0123456
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+static void put(char *dst, char **words, int i) {
+  strcpy(dst, words[i]); // GUARDED: spatial
+}
+
+int main(int argc, char **argv) {
+  char *dst = malloc(8);
+  if (!dst || argc < 2)
+    return 1;
+  put(dst, argv, 1);
+  printf("%s\n", dst);
+  free(dst);
+  return 0;
+}
diff --git a/test/cases/semantics/runtime/wrapper-vsprintf_bug.c b/test/cases/semantics/runtime/wrapper-vsprintf_bug.c
new file mode 100644
index 00000000..76a2f24e
--- /dev/null
+++ b/test/cases/semantics/runtime/wrapper-vsprintf_bug.c
@@ -0,0 +1,25 @@
+// RFC 0034 §5.2: vsprintf formats into a block whose extent its function cannot see: its checked wrapper writes through vsnprintf with the room left in the block, and fails when the output did not fit.
+// RUN-INPUT: 0123
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+static int say(char *out, const char *format, ...) {
+  va_list ap;
+  int written;
+  va_start(ap, format);
+  written = vsprintf(out, format, ap); // TRAP: object // GUARDED: spatial
+  va_end(ap);
+  return written;
+}
+static void put(char *dst, char **words, int i) { say(dst, "[%s]:%d", words[i], i); }
+
+int main(int argc, char **argv) {
+  char *dst = malloc(8);
+  if (!dst || argc < 2)
+    return 1;
+  put(dst, argv, 1);
+  printf("%s\n", dst);
+  free(dst);
+  return 0;
+}
diff --git a/test/cases/semantics/runtime/wrapper-vsprintf_ok.c b/test/cases/semantics/runtime/wrapper-vsprintf_ok.c
new file mode 100644
index 00000000..4a396318
--- /dev/null
+++ b/test/cases/semantics/runtime/wrapper-vsprintf_ok.c
@@ -0,0 +1,26 @@
+// RFC 0034 §5.2: the correct twin of wrapper-vsprintf_bug.c: the output and its terminator fit the block.
+// CLEAN
+// RUN-INPUT: 012
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+static int say(char *out, const char *format, ...) {
+  va_list ap;
+  int written;
+  va_start(ap, format);
+  written = vsprintf(out, format, ap); // GUARDED: spatial
+  va_end(ap);
+  return written;
+}
+static void put(char *dst, char **words, int i) { say(dst, "[%s]:%d", words[i], i); }
+
+int main(int argc, char **argv) {
+  char *dst = malloc(8);
+  if (!dst || argc < 2)
+    return 1;
+  put(dst, argv, 1);
+  printf("%s\n", dst);
+  free(dst);
+  return 0;
+}
diff --git a/test/cases/soundness/07_strcpy_stack_overflow_bug.c b/test/cases/soundness/07_strcpy_stack_overflow_bug.c
index c9e40962..bf685e25 100644
--- a/test/cases/soundness/07_strcpy_stack_overflow_bug.c
+++ b/test/cases/soundness/07_strcpy_stack_overflow_bug.c
@@ -3,14 +3,12 @@
 // of 'buf', which is checkable only as __weavec_strnlen(argv[1], 8) + 1 — and
 // §10.3 rule 1 lets a check term name a constant, a `sizeof`, a parameter, a
 // local, or a field reached from one through `.` and `->`, never a subscript,
-// so 'argv[1]' has no spelling the term language holds. The site therefore
-// stays unresolved(inexpressible) and no `len` check is planned. Hoisting the
-// source into a temporary (`char *s = argv[1];`) is checked and traps, so the
-// gap is the term language, not the length check; widening rule 1 needs an
-// amendment to RFC 0030. ASan sees the real overflow, and the spatial facet
-// of the call is unresolved, so nothing is proven of it. The trap-mode run
-// still dies, on macOS by _FORTIFY_SOURCE's own check, which the runner notes
-// as the program's own trap.
+// so 'argv[1]' has no spelling the term language holds, and no `len` check
+// is planned. RFC 0034 section 5.2: the call becomes strcpy's checked
+// wrapper, which computes strlen(argv[1]) + 1 at run time and checks it
+// against the object 'buf' (registered, since a guard reaches it), so the
+// facet is guarded and the copy traps before it writes. ASan sees the same
+// overflow.
 // RUN-INPUT: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
 // ASAN
 #include <stdio.h>
@@ -18,6 +16,6 @@
 int main(int argc, char **argv) {
   char buf[8];
   if (argc < 2) return 0;
-  strcpy(buf, argv[1]); // MISS: the length term would name argv[1], which §10.3 rule 1 has no spelling for
+  strcpy(buf, argv[1]); // TRAP: object // GUARDED: spatial
   return buf[0];
 }
diff --git a/test/cases/soundness/19_vla_size_bug.c b/test/cases/soundness/19_vla_size_bug.c
index 975f19a0..de92d6a7 100644
--- a/test/cases/soundness/19_vla_size_bug.c
+++ b/test/cases/soundness/19_vla_size_bug.c
@@ -6,6 +6,6 @@ int main(int argc, char **argv) {
   if (argc < 2) return 0;
   int n = atoi(argv[1]);
   char vla[n];
-  vla[n] = 0; // BUG: out-of-bounds // TRAP: span
+  vla[n] = 0; // BUG: out-of-bounds // TRAP: object
   return vla[0];
 }
diff --git a/test/cases/soundness/41d_many_branches_bug.c b/test/cases/soundness/41d_many_branches_bug.c
index 715c1d05..325fe013 100644
--- a/test/cases/soundness/41d_many_branches_bug.c
+++ b/test/cases/soundness/41d_many_branches_bug.c
@@ -1,4 +1,6 @@
-// Many independent branches before a real UAF (path/state explosion).
+// Many independent branches before a real UAF (path/state explosion). RFC 0034 §6.1: the
+// replay cannot visit 2^30 paths within its budget, so the definite error is unconfirmed, a
+// warning, and the use is guarded, which traps when it happens.
 // ASAN
 #include <stdlib.h>
 int main(int argc, char **argv) {
@@ -11,5 +13,5 @@ int main(int argc, char **argv) {
   B(0) B(1) B(2) B(3) B(4) B(5) B(6) B(7) B(8) B(9) B(10) B(11) B(12) B(13) B(14) B(15)
   B(16) B(17) B(18) B(19) B(20) B(21) B(22) B(23) B(24) B(25) B(26) B(27) B(28) B(29)
   free(p);
-  return x + p[argc & 1]; // BUG: use-after-free
+  return x + p[argc & 1]; // BUG: use-after-free // TRAP: live
 }
diff --git a/test/cases/soundness/Inputs/escaped-local-unknown-call-impl.c b/test/cases/soundness/Inputs/escaped-local-unknown-call-impl.c
new file mode 100644
index 00000000..648763b3
--- /dev/null
+++ b/test/cases/soundness/Inputs/escaped-local-unknown-call-impl.c
@@ -0,0 +1,9 @@
+struct callbacks { void *payload; };
+struct options { int version; struct callbacks callbacks; };
+static void *kept;
+void clear_errors(void) {}
+int clone_with(const struct options *options) {
+  kept = options->callbacks.payload;
+  *(const char **)kept = "redirected";
+  return 0;
+}
diff --git a/test/cases/soundness/alias-cursor-several-arrays_bug.c b/test/cases/soundness/alias-cursor-several-arrays_bug.c
new file mode 100644
index 00000000..a0dbcaac
--- /dev/null
+++ b/test/cases/soundness/alias-cursor-several-arrays_bug.c
@@ -0,0 +1,20 @@
+// RFC 0030 §7.4: the twin of alias-cursor-several-arrays_ok.c whose cursor
+// walks one element past the second array. The guard on the access stops it
+// (in the array's own last granule: 24 bytes of a 16-byte-aligned local).
+// RUN-INPUT:
+// ASAN
+#include <string.h>
+int main(void) {
+  const char *first[] = {"1", "2", "3"};
+  const char *second[] = {"a", "b", "c"};
+  const char **all[] = {first, second};
+  int total = 0;
+  for (unsigned s = 0; s < 2; ++s) {
+    const char **cursor = all[s];
+    for (unsigned i = 0; i < 3 + s; ++i) {
+      total += (int)strlen(*cursor); // BUG: out-of-bounds // TRAP: object
+      cursor++;
+    }
+  }
+  return total;
+}
diff --git a/test/cases/soundness/alias-cursor-several-arrays_ok.c b/test/cases/soundness/alias-cursor-several-arrays_ok.c
new file mode 100644
index 00000000..3e9d1974
--- /dev/null
+++ b/test/cases/soundness/alias-cursor-several-arrays_ok.c
@@ -0,0 +1,21 @@
+// RFC 0030 §7.4 (a cursor's span check): a pointer that may point into one
+// of several arrays of one size has no single base to check a span against.
+// Checking the cursor against the first array's span traps when it walks the
+// second; the access is guarded instead.
+// CLEAN
+// RUN-INPUT:
+#include <string.h>
+int main(void) {
+  const char *first[] = {"1", "2", "3"};
+  const char *second[] = {"a", "b", "c"};
+  const char **all[] = {first, second};
+  int total = 0;
+  for (unsigned s = 0; s < 2; ++s) {
+    const char **cursor = all[s];
+    for (unsigned i = 0; i < 3; ++i) {
+      total += (int)strlen(*cursor);
+      cursor++;
+    }
+  }
+  return total == 6 ? 0 : 1;
+}
diff --git a/test/cases/soundness/escaped-local-unknown-call_ok.c b/test/cases/soundness/escaped-local-unknown-call_ok.c
new file mode 100644
index 00000000..4476b245
--- /dev/null
+++ b/test/cases/soundness/escaped-local-unknown-call_ok.c
@@ -0,0 +1,22 @@
+// RFC 0031 §5 (unknown callees), RFC 0033 §2 (the witness rule): a local
+// whose address is stored in a global has escaped. Code the analysis does not
+// see may keep that address when an unrelated call wipes the global, and
+// write the local through it later, so a read after any unknown call is no
+// use of an uninitialised value.
+// UNITS: Inputs/escaped-local-unknown-call-impl.c
+// CLEAN
+// RUN-INPUT:
+#include <string.h>
+struct callbacks { void *payload; };
+struct options { int version; struct callbacks callbacks; };
+struct options g_options;
+void clear_errors(void);
+int clone_with(const struct options *options);
+int main(void) {
+  const char *given;
+  g_options.callbacks.payload = &given;
+  clear_errors();
+  if (clone_with(&g_options) != 0)
+    return 1;
+  return strcmp(given, "redirected") == 0 ? 0 : 1;
+}
diff --git a/test/corpus/README.md b/test/corpus/README.md
index b9a90d00..e2ec9d76 100644
--- a/test/corpus/README.md
+++ b/test/corpus/README.md
@@ -144,6 +144,49 @@ Each config's `notes` say why its build and test are what they are.
   needs a verdict, and a config without an `expected.json` record is a note
   until `--update` records it.
 
+## The RFC 0034 sets (`fresh34`, `sealed34`; RFC 0034, section 9)
+
+Fifteen more projects nobody tuned WeaveC on, pinned by SHA with their own
+build, test and (for `fresh34`) a run-time workload (`bench`), marked
+`"heldOut": true` and `"set": "fresh34"` or `"sealed34"`. `--set SET`
+runs one set alone; `sealed34` runs only with `--set sealed34` (before the
+final tree only with `--reference-only`, to write its commands).
+
+| Config | Set | Files | Test | Workload (`bench`) |
+| --- | --- | --- | --- | --- |
+| quickjs | fresh34 | 6 | `make test`, the examples | `qjs` over `bench/quickjs-bench.js` |
+| lmdb | fresh34 | 8 | `support/lmdb/run-tests.sh` | `bench/lmdb-bench.c` (put, get) |
+| janet | fresh34 | 2 | `make test` (its socket suite is timing-dependent) | `bench/janet-bench.janet` |
+| brotli | fresh34 | 3 | CTest, round trips | `brotli -q 7` and back, 64 MiB |
+| xz | fresh34 | 45 | CTest, round trips | `xz -6 -T1` and back, 64 MiB |
+| libdeflate | fresh34 | 2 | CTest, round trips | `libdeflate-gzip -1/-6/-9` and back, 64 MiB |
+| zlib-ng | fresh34 | 38 | CTest, `support/zlib-ng/round-trips.sh` | `minigzip -1/-6/-9` and back, 64 MiB |
+| curl | fresh34 | 45 | `runtests.pl` (1–999, 1300–1399, 1500–1699, not flaky or timing-dependent) | `bench/curl-bench.c` (URL and cookie parsing) |
+| cmark | fresh34 | 1 | CTest | the spec rendered in five formats |
+| libgit2 | fresh34 | 45 | `util_tests`, offline suites of `libgit2_tests` | `bench/libgit2-bench.c` (history walk) |
+| libjpeg-turbo | sealed34 | 45 | CTest | — |
+| opus | sealed34 | 45 | CTest (`SEED=1`) | — |
+| flac | sealed34 | 42 | CTest, the test streams at level 0 | — |
+| giflib | sealed34 | 1 | `support/giflib/run-tests.sh` | — |
+| wren | sealed34 | 4 | `util/test.py` | — |
+
+- **Gates** (`gates.rfc0034` in the manifest): `rfc0034.F1` over `fresh34`
+  (every build passes with the default flags, or stops only at definite
+  errors triaged true, and every test suite passes in trap mode with no trap
+  and in report mode with no failure); `rfc0034.F2`, the same over
+  `sealed34` from its one run; `rfc0034.F5` (each config's build CPU time
+  at most 5 times the reference compiler's, `sqlite3.c` within 120 CPU
+  seconds, no compiler process above 2,048 MiB of peak memory) and
+  `rfc0034.F7` (with `--bench`, each `fresh34` workload at most 4 times the
+  reference compiler's user CPU time and their geometric mean at most 2.5;
+  RFC 0032's G14 benchmarks: Lua 2.5, zlib 1.5, cJSON 1.5).
+- **Benchmarks.** A config's `bench` builds the workload three times (the
+  default build, one with `-fno-weavec-runtime`, and the reference
+  compiler's), runs `command` `repeat` times and takes the minimum user CPU time; `check`
+  verifies the output, `input` makes a deterministic input. Run nothing
+  else heavy on the machine during `--full`: the workloads and janet's
+  socket suite are timing-sensitive.
+
 ## Running it
 
 Checkouts live in `build/corpus/<project>` (`--workdir`). A missing one is
diff --git a/test/corpus/bench/curl-bench.c b/test/corpus/bench/curl-bench.c
new file mode 100644
index 00000000..c18848ff
--- /dev/null
+++ b/test/corpus/bench/curl-bench.c
@@ -0,0 +1,207 @@
+/*
+ * The curl workload of the corpus gate's overhead benchmark (RFC 0034,
+ * stage S0): libcurl's own parsers without any transfer, so no socket,
+ * file or kernel time.
+ *
+ *   curl-bench [rounds]      (default 10)
+ *
+ * Each round parses 20,000 generated URLs with the URL API (curl_url_set,
+ * every part read back URL-decoded, a relative reference resolved against
+ * it, a query appended), escapes and unescapes a path, parses a date with
+ * curl_getdate for each, and feeds 5,000 cookie-file lines to one easy handle's
+ * cookie engine (CURLOPT_COOKIELIST), whose cookie list is read back and
+ * cleared at the end of the round. Everything is generated from a fixed
+ * seed; the program prints one checksum line over every string libcurl
+ * returned, which the gate compares between the reference and the WeaveC
+ * build. The gate builds it against the static libcurl of the pinned
+ * checkout (see test/corpus/manifest.json, config curl).
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <curl/curl.h>
+
+#define URLS_PER_ROUND 20000
+#define COOKIES_PER_ROUND 5000
+
+static unsigned long nextRandom(unsigned long *state) {
+  *state = *state * 1103515245UL + 12345UL;
+  return (*state >> 8) & 0xffffffUL;
+}
+
+static unsigned long long checksum = 1469598103934665603ULL;
+
+static void mix(const char *text) {
+  if(!text) {
+    checksum = (checksum ^ 0xffu) * 1099511628211ULL;
+    return;
+  }
+  while(*text) {
+    checksum = (checksum ^ (unsigned char)*text++) * 1099511628211ULL;
+  }
+  checksum = (checksum ^ 0u) * 1099511628211ULL;
+}
+
+static void mixNumber(long long value) {
+  char text[32];
+  snprintf(text, sizeof(text), "%lld", value);
+  mix(text);
+}
+
+static const char *const schemes[] = {"http", "https", "ftp", "ws",
+                                      "imap", "smtp", "gopher", "rtsp"};
+static const char *const months[] = {"Jan", "Feb", "Mar", "Apr", "May", "Jun",
+                                     "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"};
+static const char *const days[] = {"Mon", "Tue", "Wed", "Thu", "Fri", "Sat",
+                                   "Sun"};
+
+static void makeHost(char *host, size_t size, unsigned long *state) {
+  unsigned long kind = nextRandom(state) % 4;
+  if(kind == 0)
+    snprintf(host, size, "10.%lu.%lu.%lu", nextRandom(state) % 256,
+             nextRandom(state) % 256, nextRandom(state) % 256);
+  else if(kind == 1)
+    snprintf(host, size, "[2001:db8:%lx::%lx]", nextRandom(state) % 65536,
+             nextRandom(state) % 65536);
+  else
+    snprintf(host, size, "Host%lu.Sub-%lu.example%lu.ORG", nextRandom(state) % 5000,
+             nextRandom(state) % 40, nextRandom(state) % 30);
+}
+
+static void parseUrl(CURLU *url, unsigned long *state) {
+  static const CURLUPart parts[] = {
+      CURLUPART_SCHEME, CURLUPART_USER,  CURLUPART_PASSWORD,
+      CURLUPART_HOST,   CURLUPART_PORT,  CURLUPART_PATH,
+      CURLUPART_QUERY,  CURLUPART_FRAGMENT, CURLUPART_ZONEID};
+  char host[64];
+  char text[512];
+  char relative[128];
+  char *value;
+  size_t i;
+  CURLUcode rc;
+
+  makeHost(host, sizeof(host), state);
+  snprintf(text, sizeof(text),
+           "%s://user%lu:p%%40ss%%3Aw%lu@%s:%lu/a/./b%lu/../c%lu/%%7euser/"
+           "d%%20e/f.html?q=%lu&name=a%%2Bb&lang=en#frag%lu",
+           schemes[nextRandom(state) % 8], nextRandom(state) % 1000,
+           nextRandom(state) % 1000, host, 1 + nextRandom(state) % 65535,
+           nextRandom(state) % 100, nextRandom(state) % 100,
+           nextRandom(state), nextRandom(state) % 50);
+  rc = curl_url_set(url, CURLUPART_URL, text, CURLU_NON_SUPPORT_SCHEME);
+  mixNumber(rc);
+  if(rc)
+    return;
+  for(i = 0; i < sizeof(parts) / sizeof(parts[0]); i++) {
+    value = NULL;
+    mixNumber(curl_url_get(url, parts[i], &value, CURLU_URLDECODE));
+    mix(value);
+    curl_free(value);
+  }
+  value = NULL;
+  mixNumber(curl_url_get(url, CURLUPART_URL, &value, CURLU_PUNY2IDN));
+  mix(value);
+  curl_free(value);
+  snprintf(relative, sizeof(relative), "../g%lu/./h i%lu?x=%lu#y",
+           nextRandom(state) % 100, nextRandom(state) % 100,
+           nextRandom(state) % 1000);
+  mixNumber(curl_url_set(url, CURLUPART_URL, relative, CURLU_URLENCODE));
+  value = NULL;
+  mixNumber(curl_url_get(url, CURLUPART_URL, &value, 0));
+  mix(value);
+  curl_free(value);
+  mixNumber(curl_url_set(url, CURLUPART_QUERY, "added=yes please",
+                         CURLU_APPENDQUERY | CURLU_URLENCODE));
+  value = NULL;
+  mixNumber(curl_url_get(url, CURLUPART_QUERY, &value, 0));
+  mix(value);
+  curl_free(value);
+}
+
+static void escapeText(CURL *easy, unsigned long *state) {
+  char text[128];
+  char *escaped;
+  char *unescaped;
+  int length = 0;
+
+  snprintf(text, sizeof(text), "/path %lu/with spaces & symbols=%lu?#[]@!$'()*+,;%%%lu",
+           nextRandom(state), nextRandom(state) % 100, nextRandom(state) % 10);
+  escaped = curl_easy_escape(easy, text, 0);
+  mix(escaped);
+  unescaped = escaped ? curl_easy_unescape(easy, escaped, 0, &length) : NULL;
+  mix(unescaped);
+  mixNumber(length);
+  curl_free(unescaped);
+  curl_free(escaped);
+}
+
+static void parseDate(unsigned long *state) {
+  char text[96];
+  unsigned long day = nextRandom(state);
+  snprintf(text, sizeof(text), "%s, %02lu %s %lu %02lu:%02lu:%02lu GMT",
+           days[day % 7], 1 + nextRandom(state) % 28,
+           months[nextRandom(state) % 12], 1990 + nextRandom(state) % 100,
+           nextRandom(state) % 24, nextRandom(state) % 60,
+           nextRandom(state) % 60);
+  mixNumber((long long)curl_getdate(text, NULL));
+}
+
+static void addCookie(CURL *easy, unsigned long index, unsigned long *state) {
+  char text[384];
+  /* Netscape cookie-file lines: Set-Cookie: lines would stop at libcurl's
+     limit of 50 per transfer. The expiry is fixed (2100-01-01). */
+  snprintf(text, sizeof(text),
+           "%s.host%lu.example%lu.org\tTRUE\t/p%lu/q%lu\t%s\t4102444800\t"
+           "c%lu\tv%lx-%lx",
+           (nextRandom(state) & 1) ? "#HttpOnly_" : "",
+           nextRandom(state) % 300, nextRandom(state) % 4,
+           nextRandom(state) % 6, nextRandom(state) % 3,
+           (nextRandom(state) & 1) ? "TRUE" : "FALSE", index % 2000,
+           nextRandom(state), nextRandom(state));
+  mixNumber(curl_easy_setopt(easy, CURLOPT_COOKIELIST, text));
+}
+
+static void readCookies(CURL *easy) {
+  struct curl_slist *cookies = NULL;
+  struct curl_slist *each;
+  long count = 0;
+
+  mixNumber(curl_easy_getinfo(easy, CURLINFO_COOKIELIST, &cookies));
+  for(each = cookies; each; each = each->next)
+    count++;
+  mixNumber(count);
+  curl_slist_free_all(cookies);
+}
+
+int main(int argc, char **argv) {
+  int rounds = argc > 1 ? atoi(argv[1]) : 10;
+  unsigned long state = 1;
+  int round;
+  unsigned long i;
+  CURL *easy;
+  CURLU *url;
+
+  if(curl_global_init(CURL_GLOBAL_DEFAULT))
+    return 1;
+  easy = curl_easy_init();
+  url = curl_url();
+  if(!easy || !url)
+    return 1;
+  for(round = 0; round < rounds; round++) {
+    for(i = 0; i < URLS_PER_ROUND; i++) {
+      parseUrl(url, &state);
+      escapeText(easy, &state);
+      parseDate(&state);
+    }
+    for(i = 0; i < COOKIES_PER_ROUND; i++)
+      addCookie(easy, i, &state);
+    readCookies(easy);
+    mixNumber(curl_easy_setopt(easy, CURLOPT_COOKIELIST, "ALL"));
+  }
+  curl_url_cleanup(url);
+  curl_easy_cleanup(easy);
+  curl_global_cleanup();
+  printf("curl-bench %d rounds checksum %016llx\n", rounds, checksum);
+  return 0;
+}
diff --git a/test/corpus/bench/janet-bench.janet b/test/corpus/bench/janet-bench.janet
new file mode 100644
index 00000000..e32f585f
--- /dev/null
+++ b/test/corpus/bench/janet-bench.janet
@@ -0,0 +1,22 @@
+# Janet benchmark for scripts/corpus-gate.py (test/corpus/manifest.json,
+# config janet; RFC 0034, gate F7): calls, tables, arrays and sorting,
+# buffers, strings and PEG matching, a few rounds of each.
+# Deterministic; prints a checksum only.
+(defn fib [n] (if (< n 2) n (+ (fib (- n 1)) (fib (- n 2)))))
+(def words (peg/compile ~(any (+ (group (* (capture :a+) (constant :w))) (capture :d+) 1))))
+(var sum 0)
+(for round 0 6
+  (def t @{})
+  (for i 0 200000 (put t (string "k" (% i (+ 5000 round))) i))
+  (def arr @[])
+  (for i 0 200000 (array/push arr (% (+ round (* i 7919)) 100003)))
+  (sort arr)
+  (var s 0)
+  (each x arr (+= s x))
+  (def b @"")
+  (for i 0 100000 (buffer/push-string b (string i) (if (= 0 (% i 7)) " abc " "")))
+  (def m (peg/match words b))
+  (def st @{})
+  (for i 0 50000 (put st [(% i 101) (% i 7)] (struct :a i :b (% i 13))))
+  (+= sum (fib 25) (length t) (% s 1000003) (length b) (length m) (length st)))
+(print sum)
diff --git a/test/corpus/bench/libgit2-bench.c b/test/corpus/bench/libgit2-bench.c
new file mode 100644
index 00000000..d876b2ac
--- /dev/null
+++ b/test/corpus/bench/libgit2-bench.c
@@ -0,0 +1,362 @@
+/*
+ * The libgit2 workload of the corpus gate's overhead benchmark (RFC 0034,
+ * stage S0): a history built and read back in memory, with no file system
+ * or network.
+ *
+ *   libgit2-bench [commits]      (default 1500)
+ *
+ * A repository wraps an object database with only the in-memory mempack
+ * backend and an empty configuration (so no user or system configuration
+ * is read). Eight generated text files of 400 lines evolve over the
+ * commits: each commit edits two of them (replaced, inserted and deleted
+ * lines), writes their blobs (SHA-1 with collision detection), a tree and a
+ * commit, renders the patch of each edit with git_patch_from_buffers
+ * (xdiff), and merges each edit three-way with an unrelated edit of the
+ * same file (git_merge_file, xmerge). Then a revision walk visits the whole
+ * history and diffs every commit's tree against its parent's, with stats.
+ * Everything is generated from a fixed seed with fixed signature times; the
+ * program prints one checksum line over the object ids, patches, merge
+ * results and stats, which the gate compares between the reference and the
+ * WeaveC build. The gate builds it against the static libgit2 of the
+ * pinned checkout (see test/corpus/manifest.json, config libgit2).
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <git2.h>
+#include <git2/sys/mempack.h>
+#include <git2/sys/repository.h>
+
+#define FILES 8
+#define LINES 400
+#define LINE_SIZE 72
+
+struct document {
+  char **lines;
+  size_t count;
+  size_t capacity;
+};
+
+static unsigned long nextRandom(unsigned long *state) {
+  *state = *state * 1103515245UL + 12345UL;
+  return (*state >> 8) & 0xffffffUL;
+}
+
+static unsigned long long checksum = 1469598103934665603ULL;
+
+static void mixBytes(const char *data, size_t size) {
+  size_t i;
+  for(i = 0; i < size; i++)
+    checksum = (checksum ^ (unsigned char)data[i]) * 1099511628211ULL;
+  checksum = (checksum ^ 0u) * 1099511628211ULL;
+}
+
+static void mixNumber(long long value) {
+  char text[32];
+  snprintf(text, sizeof(text), "%lld", value);
+  mixBytes(text, strlen(text));
+}
+
+static void mixOid(const git_oid *oid) {
+  char text[GIT_OID_MAX_HEXSIZE + 1];
+  git_oid_tostr(text, sizeof(text), oid);
+  mixBytes(text, strlen(text));
+}
+
+static void fail(const char *what) {
+  const git_error *error = git_error_last();
+  fprintf(stderr, "libgit2-bench: %s: %s\n", what,
+          error && error->message ? error->message : "failed");
+  exit(1);
+}
+
+static char *makeLine(unsigned long *state) {
+  static const char *const words[] = {
+      "alpha", "beta",  "gamma", "delta", "object", "tree", "blob",
+      "index", "merge", "patch", "hunk",  "commit", "ref",  "pack"};
+  char *line = malloc(LINE_SIZE);
+  int length = 0;
+  if(!line)
+    fail("malloc");
+  length = snprintf(line, LINE_SIZE, "%06lu", nextRandom(state) % 1000000);
+  while(length < LINE_SIZE - 12) {
+    const char *word = words[nextRandom(state) % 14];
+    length += snprintf(line + length, (size_t)(LINE_SIZE - length), " %s", word);
+  }
+  return line;
+}
+
+static void insertLine(struct document *doc, size_t at, char *line) {
+  if(doc->count == doc->capacity) {
+    size_t capacity = doc->capacity ? doc->capacity * 2 : 64;
+    char **lines = realloc(doc->lines, capacity * sizeof(char *));
+    if(!lines)
+      fail("realloc");
+    doc->lines = lines;
+    doc->capacity = capacity;
+  }
+  memmove(doc->lines + at + 1, doc->lines + at,
+          (doc->count - at) * sizeof(char *));
+  doc->lines[at] = line;
+  doc->count++;
+}
+
+static void deleteLine(struct document *doc, size_t at) {
+  free(doc->lines[at]);
+  memmove(doc->lines + at, doc->lines + at + 1,
+          (doc->count - at - 1) * sizeof(char *));
+  doc->count--;
+}
+
+static void editDocument(struct document *doc, int edits, unsigned long *state) {
+  int i;
+  for(i = 0; i < edits; i++) {
+    unsigned long kind = nextRandom(state) % 3;
+    size_t at = doc->count ? nextRandom(state) % doc->count : 0;
+    if(kind == 0 && doc->count) {
+      free(doc->lines[at]);
+      doc->lines[at] = makeLine(state);
+    } else if(kind == 1 || doc->count < LINES / 2) {
+      insertLine(doc, at, makeLine(state));
+    } else {
+      deleteLine(doc, at);
+    }
+  }
+}
+
+static char *render(const struct document *doc, size_t *size) {
+  size_t total = 0;
+  size_t i;
+  char *text;
+  char *out;
+  for(i = 0; i < doc->count; i++)
+    total += strlen(doc->lines[i]) + 1;
+  text = malloc(total + 1);
+  if(!text)
+    fail("malloc");
+  out = text;
+  for(i = 0; i < doc->count; i++) {
+    size_t length = strlen(doc->lines[i]);
+    memcpy(out, doc->lines[i], length);
+    out[length] = '\n';
+    out += length + 1;
+  }
+  *out = '\0';
+  *size = total;
+  return text;
+}
+
+static void patchAndMerge(const char *before, size_t beforeSize,
+                          const char *after, size_t afterSize,
+                          const char *theirs, size_t theirsSize,
+                          const char *path) {
+  git_patch *patch = NULL;
+  git_buf text = GIT_BUF_INIT;
+  git_merge_file_input ancestor, ours, other;
+  git_merge_file_result result;
+
+  if(git_patch_from_buffers(&patch, before, beforeSize, path, after, afterSize,
+                            path, NULL) < 0 ||
+     git_patch_to_buf(&text, patch) < 0)
+    fail("patch");
+  mixBytes(text.ptr, text.size);
+  git_buf_dispose(&text);
+  git_patch_free(patch);
+
+  git_merge_file_input_init(&ancestor, GIT_MERGE_FILE_INPUT_VERSION);
+  git_merge_file_input_init(&ours, GIT_MERGE_FILE_INPUT_VERSION);
+  git_merge_file_input_init(&other, GIT_MERGE_FILE_INPUT_VERSION);
+  ancestor.ptr = before;
+  ancestor.size = beforeSize;
+  ancestor.path = path;
+  ours.ptr = after;
+  ours.size = afterSize;
+  ours.path = path;
+  other.ptr = theirs;
+  other.size = theirsSize;
+  other.path = path;
+  memset(&result, 0, sizeof(result));
+  if(git_merge_file(&result, &ancestor, &ours, &other, NULL) < 0)
+    fail("merge_file");
+  mixNumber(result.automergeable);
+  mixBytes(result.ptr, result.len);
+  git_merge_file_result_free(&result);
+}
+
+static void walkHistory(git_repository *repo, const git_oid *head) {
+  git_revwalk *walk = NULL;
+  git_oid id;
+  long commits = 0;
+
+  if(git_revwalk_new(&walk, repo) < 0 ||
+     git_revwalk_sorting(walk, GIT_SORT_TOPOLOGICAL | GIT_SORT_TIME) < 0 ||
+     git_revwalk_push(walk, head) < 0)
+    fail("revwalk");
+  while(git_revwalk_next(&id, walk) == 0) {
+    git_commit *commit = NULL;
+    git_commit *parent = NULL;
+    git_tree *tree = NULL;
+    git_tree *parentTree = NULL;
+    git_diff *diff = NULL;
+    git_diff_stats *stats = NULL;
+
+    if(git_commit_lookup(&commit, repo, &id) < 0 ||
+       git_commit_tree(&tree, commit) < 0)
+      fail("commit");
+    mixBytes(git_commit_message(commit), strlen(git_commit_message(commit)));
+    mixNumber((long long)git_commit_time(commit));
+    if(git_commit_parentcount(commit) > 0) {
+      if(git_commit_parent(&parent, commit, 0) < 0 ||
+         git_commit_tree(&parentTree, parent) < 0)
+        fail("parent");
+    }
+    if(git_diff_tree_to_tree(&diff, repo, parentTree, tree, NULL) < 0 ||
+       git_diff_get_stats(&stats, diff) < 0)
+      fail("diff");
+    mixNumber((long long)git_diff_stats_files_changed(stats));
+    mixNumber((long long)git_diff_stats_insertions(stats));
+    mixNumber((long long)git_diff_stats_deletions(stats));
+    git_diff_stats_free(stats);
+    git_diff_free(diff);
+    git_tree_free(parentTree);
+    git_tree_free(tree);
+    git_commit_free(parent);
+    git_commit_free(commit);
+    commits++;
+  }
+  mixNumber(commits);
+  git_revwalk_free(walk);
+}
+
+int main(int argc, char **argv) {
+  int commits = argc > 1 ? atoi(argv[1]) : 1500;
+  unsigned long state = 1;
+  struct document docs[FILES];
+  git_oid blobs[FILES];
+  git_oid head;
+  git_odb *odb = NULL;
+  git_odb_backend *mempack = NULL;
+  git_repository *repo = NULL;
+  git_config *config = NULL;
+  int hasHead = 0;
+  int n;
+  int f;
+
+  if(git_libgit2_init() < 0)
+    fail("init");
+  if(git_odb_new(&odb) < 0 || git_mempack_new(&mempack) < 0 ||
+     git_odb_add_backend(odb, mempack, 1) < 0 ||
+     git_repository_wrap_odb(&repo, odb) < 0 || git_config_new(&config) < 0 ||
+     git_repository_set_config(repo, config) < 0)
+    fail("repository");
+
+  memset(docs, 0, sizeof(docs));
+  for(f = 0; f < FILES; f++) {
+    int i;
+    for(i = 0; i < LINES; i++)
+      insertLine(&docs[f], docs[f].count, makeLine(&state));
+  }
+  for(f = 0; f < FILES; f++) {
+    size_t size;
+    char *text = render(&docs[f], &size);
+    if(git_blob_create_from_buffer(&blobs[f], repo, text, size) < 0)
+      fail("blob");
+    free(text);
+  }
+
+  for(n = 0; n < commits; n++) {
+    git_treebuilder *builder = NULL;
+    git_signature *signature = NULL;
+    git_tree *tree = NULL;
+    git_commit *parent = NULL;
+    const git_commit *parents[1];
+    git_oid treeId;
+    char message[96];
+    int edit;
+
+    for(edit = 0; edit < 2; edit++) {
+      char path[32];
+      size_t beforeSize, afterSize, theirsSize;
+      char *before, *after, *theirs;
+      struct document other;
+      size_t i;
+
+      f = (int)(nextRandom(&state) % FILES);
+      snprintf(path, sizeof(path), "src/file%d.txt", f);
+      before = render(&docs[f], &beforeSize);
+      /* An unrelated edit: the last few lines replaced. */
+      memset(&other, 0, sizeof(other));
+      for(i = 0; i < docs[f].count; i++) {
+        char *copy = malloc(LINE_SIZE);
+        if(!copy)
+          fail("malloc");
+        if(i + 3 < docs[f].count)
+          memcpy(copy, docs[f].lines[i], strlen(docs[f].lines[i]) + 1);
+        else
+          snprintf(copy, LINE_SIZE, "tail %d %lu", n, nextRandom(&state));
+        insertLine(&other, other.count, copy);
+      }
+      theirs = render(&other, &theirsSize);
+      while(other.count)
+        deleteLine(&other, other.count - 1);
+      free(other.lines);
+
+      editDocument(&docs[f], 6, &state);
+      after = render(&docs[f], &afterSize);
+      if(git_blob_create_from_buffer(&blobs[f], repo, after, afterSize) < 0)
+        fail("blob");
+      mixOid(&blobs[f]);
+      patchAndMerge(before, beforeSize, after, afterSize, theirs, theirsSize,
+                    path);
+      free(before);
+      free(after);
+      free(theirs);
+    }
+
+    if(git_treebuilder_new(&builder, repo, NULL) < 0)
+      fail("treebuilder");
+    for(f = 0; f < FILES; f++) {
+      char name[32];
+      snprintf(name, sizeof(name), "file%d.txt", f);
+      if(git_treebuilder_insert(NULL, builder, name, &blobs[f],
+                                GIT_FILEMODE_BLOB) < 0)
+        fail("treebuilder_insert");
+    }
+    if(git_treebuilder_write(&treeId, builder) < 0 ||
+       git_tree_lookup(&tree, repo, &treeId) < 0)
+      fail("tree");
+    git_treebuilder_free(builder);
+
+    if(git_signature_new(&signature, "WeaveC Bench", "bench@example.org",
+                         (git_time_t)1700000000 + (git_time_t)n * 60, 0) < 0)
+      fail("signature");
+    if(hasHead && git_commit_lookup(&parent, repo, &head) < 0)
+      fail("parent");
+    parents[0] = parent;
+    snprintf(message, sizeof(message), "Commit %d\n\nTwo files edited.\n", n);
+    if(git_commit_create(&head, repo, NULL, signature, signature, NULL, message,
+                         tree, hasHead ? 1 : 0, parents) < 0)
+      fail("commit");
+    mixOid(&head);
+    hasHead = 1;
+    git_commit_free(parent);
+    git_signature_free(signature);
+    git_tree_free(tree);
+  }
+
+  if(hasHead)
+    walkHistory(repo, &head);
+
+  for(f = 0; f < FILES; f++) {
+    while(docs[f].count)
+      deleteLine(&docs[f], docs[f].count - 1);
+    free(docs[f].lines);
+  }
+  git_config_free(config);
+  git_repository_free(repo);
+  git_odb_free(odb);
+  git_libgit2_shutdown();
+  printf("libgit2-bench %d commits checksum %016llx\n", commits, checksum);
+  return 0;
+}
diff --git a/test/corpus/bench/lmdb-bench.c b/test/corpus/bench/lmdb-bench.c
new file mode 100644
index 00000000..8cbcd483
--- /dev/null
+++ b/test/corpus/bench/lmdb-bench.c
@@ -0,0 +1,40 @@
+/* LMDB benchmark for scripts/corpus-gate.py (test/corpus/manifest.json,
+ * config lmdb; RFC 0034, gate F7): three rounds of 300000 puts in one write
+ * transaction, a cursor scan and 300000 gets, in the database directory
+ * named by the argument (created if missing; the gate's command removes it
+ * first). Deterministic; prints a checksum only. */
+#include <stdio.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <stdlib.h>
+#include "lmdb.h"
+#define N 300000
+#define E(x) do { int rc_ = (x); if (rc_) { fprintf(stderr, "%s: %s\n", #x, mdb_strerror(rc_)); exit(1); } } while (0)
+int main(int argc, char **argv) {
+  MDB_env *env; MDB_txn *txn; MDB_dbi dbi; MDB_val k, v; MDB_cursor *cur;
+  char kb[32], vb[64]; long sum = 0; const char *dir = argc > 1 ? argv[1] : "benchdb";
+  mkdir(dir, 0755);
+  E(mdb_env_create(&env)); E(mdb_env_set_mapsize(env, 1UL << 30));
+  E(mdb_env_open(env, dir, MDB_NOSYNC, 0664));
+  for (int round = 0; round < 3; round++) {
+    E(mdb_txn_begin(env, NULL, 0, &txn)); E(mdb_dbi_open(txn, NULL, 0, &dbi));
+    for (int i = 0; i < N; i++) {
+      unsigned h = (unsigned)i * 2654435761u;
+      k.mv_size = snprintf(kb, sizeof kb, "%08x%d", h, round); k.mv_data = kb;
+      v.mv_size = snprintf(vb, sizeof vb, "value-%d-%d-padpadpadpad", i, round); v.mv_data = vb;
+      E(mdb_put(txn, dbi, &k, &v, 0));
+    }
+    E(mdb_txn_commit(txn));
+    E(mdb_txn_begin(env, NULL, MDB_RDONLY, &txn)); E(mdb_cursor_open(txn, dbi, &cur));
+    while (mdb_cursor_get(cur, &k, &v, MDB_NEXT) == 0) sum += ((char *)v.mv_data)[6] + (long)v.mv_size;
+    for (int i = 0; i < N; i++) {
+      unsigned h = (unsigned)i * 2654435761u;
+      k.mv_size = snprintf(kb, sizeof kb, "%08x%d", h, round); k.mv_data = kb;
+      E(mdb_get(txn, dbi, &k, &v)); sum += v.mv_size;
+    }
+    mdb_cursor_close(cur); mdb_txn_abort(txn);
+  }
+  mdb_env_close(env);
+  printf("%ld\n", sum);
+  return 0;
+}
diff --git a/test/corpus/bench/quickjs-bench.js b/test/corpus/bench/quickjs-bench.js
new file mode 100644
index 00000000..554af2c5
--- /dev/null
+++ b/test/corpus/bench/quickjs-bench.js
@@ -0,0 +1,19 @@
+// QuickJS benchmark for the corpus gate (RFC 0034, gate F7): calls, object
+// allocation and sorting, Map and string building, regular expressions.
+// Deterministic; prints a checksum only.
+function fib(n) { return n < 2 ? n : fib(n - 1) + fib(n - 2); }
+var sum = 0;
+for (var round = 0; round < 3; round++) {
+  var a = [];
+  for (var i = 0; i < 300000; i++) a.push({ k: (i * 7919 + round) % 100003, s: "x" + i });
+  a.sort(function (x, y) { return x.k - y.k; });
+  var m = new Map();
+  for (var i = 0; i < 200000; i++) m.set("k" + (i % (5000 + round)), i);
+  var str = "";
+  for (var i = 0; i < 20000; i++) str += String.fromCharCode(97 + (i + round) % 26);
+  var cnt = 0;
+  for (var i = 0; i < 200; i++) cnt += str.replace(/[aeiou]/g, "").length;
+  var o = JSON.parse(JSON.stringify(a.slice(0, 50000)));
+  sum += fib(27) + a[1000].k + m.size + cnt + o[49999].k + o[123].s.length;
+}
+print(sum);
diff --git a/test/corpus/expected.json b/test/corpus/expected.json
index f2692528..8448ab5e 100644
--- a/test/corpus/expected.json
+++ b/test/corpus/expected.json
@@ -16,29 +16,58 @@
   "platforms": {
     "darwin-arm64": {
       "machine": "darwin-arm64 Apple M3 x8",
-      "producer": "weavec-cc version 0.13.0-dev (fb888263bf8c-dirty)",
-      "updated": "2026-10-04",
+      "producer": "weavec-cc version 0.13.0-dev (6522842e8935-dirty)",
+      "updated": "2026-10-05",
       "configs": {
+        "brotli": {
+          "units": {
+            "errors": 0,
+            "warnings": 0,
+            "ledger": {
+              "sites": 27618,
+              "proven": 44365,
+              "checked": 3789,
+              "guarded": 7322,
+              "violation": 0,
+              "unresolved": 2510,
+              "trusted": 9
+            },
+            "unresolvedShare": {
+              "spatialNull": 0.0208,
+              "temporal": 0.0755
+            },
+            "cpuSeconds": 20.17,
+            "workCounters": {
+              "blockTransfers": 157146,
+              "functions": 3036,
+              "sites": 27618
+            }
+          },
+          "traps": 0,
+          "overhead": 3.2709,
+          "overheadNoRuntime": 1.159,
+          "rssRatio": 0.3714
+        },
         "bzip2": {
           "units": {
             "errors": 0,
             "warnings": 1,
             "ledger": {
               "sites": 5230,
-              "proven": 7321,
-              "checked": 959,
-              "guarded": 3587,
+              "proven": 7361,
+              "checked": 919,
+              "guarded": 3589,
               "violation": 0,
-              "unresolved": 435,
+              "unresolved": 433,
               "trusted": 31
             },
             "unresolvedShare": {
-              "spatialNull": 0.0139,
+              "spatialNull": 0.0137,
               "temporal": 0.0724
             },
-            "cpuSeconds": 7.11,
+            "cpuSeconds": 6.73,
             "workCounters": {
-              "blockTransfers": 32245,
+              "blockTransfers": 35014,
               "functions": 108,
               "sites": 5230
             }
@@ -48,20 +77,20 @@
             "warnings": 9,
             "ledger": {
               "sites": 5230,
-              "proven": 9547,
-              "checked": 899,
-              "guarded": 1596,
+              "proven": 9587,
+              "checked": 859,
+              "guarded": 1598,
               "violation": 0,
-              "unresolved": 280,
+              "unresolved": 278,
               "trusted": 19
             },
             "unresolvedShare": {
-              "spatialNull": 0.0156,
+              "spatialNull": 0.0153,
               "temporal": 0.0351
             },
-            "cpuSeconds": 14.76,
+            "cpuSeconds": 20.48,
             "workCounters": {
-              "blockTransfers": 107893,
+              "blockTransfers": 107073,
               "functions": 108,
               "sites": 5230
             }
@@ -76,26 +105,26 @@
               "sites": 1221,
               "proven": 2123,
               "checked": 68,
-              "guarded": 377,
+              "guarded": 378,
               "violation": 0,
-              "unresolved": 78,
+              "unresolved": 77,
               "trusted": 20
             },
             "unresolvedShare": {
-              "spatialNull": 0.0167,
+              "spatialNull": 0.016,
               "temporal": 0.0454
             },
-            "cpuSeconds": 0.57,
+            "cpuSeconds": 0.51,
             "workCounters": {
-              "blockTransfers": 6808,
+              "blockTransfers": 7132,
               "functions": 113,
               "sites": 1221
             }
           },
           "traps": 0,
-          "overhead": 1.8856,
-          "overheadNoRuntime": 1.1514,
-          "rssRatio": 0.6478
+          "overhead": 1.5933,
+          "overheadNoRuntime": 1.1511,
+          "rssRatio": 0.3696
         },
         "cJSON-program": {
           "units": {
@@ -105,18 +134,18 @@
               "sites": 1745,
               "proven": 2632,
               "checked": 123,
-              "guarded": 659,
+              "guarded": 660,
               "violation": 0,
-              "unresolved": 235,
+              "unresolved": 234,
               "trusted": 20
             },
             "unresolvedShare": {
-              "spatialNull": 0.0136,
+              "spatialNull": 0.0131,
               "temporal": 0.1239
             },
-            "cpuSeconds": 1.38,
+            "cpuSeconds": 1.17,
             "workCounters": {
-              "blockTransfers": 12914,
+              "blockTransfers": 13393,
               "functions": 151,
               "sites": 1745
             }
@@ -128,16 +157,16 @@
               "sites": 1745,
               "proven": 2699,
               "checked": 115,
-              "guarded": 672,
+              "guarded": 673,
               "violation": 0,
-              "unresolved": 167,
+              "unresolved": 166,
               "trusted": 20
             },
             "unresolvedShare": {
-              "spatialNull": 0.0155,
+              "spatialNull": 0.015,
               "temporal": 0.081
             },
-            "cpuSeconds": 3.16,
+            "cpuSeconds": 3.51,
             "workCounters": {
               "blockTransfers": 25237,
               "functions": 151,
@@ -145,26 +174,84 @@
             }
           }
         },
+        "cmark": {
+          "units": {
+            "errors": 0,
+            "warnings": 0,
+            "ledger": {
+              "sites": 4742,
+              "proven": 6756,
+              "checked": 754,
+              "guarded": 2269,
+              "violation": 0,
+              "unresolved": 1056,
+              "trusted": 3
+            },
+            "unresolvedShare": {
+              "spatialNull": 0.0136,
+              "temporal": 0.2174
+            },
+            "cpuSeconds": 5.56,
+            "workCounters": {
+              "blockTransfers": 46423,
+              "functions": 284,
+              "sites": 4742
+            }
+          },
+          "traps": 0,
+          "overhead": 2.6914,
+          "overheadNoRuntime": 1.1531,
+          "rssRatio": 1.6859
+        },
+        "curl": {
+          "units": {
+            "errors": 0,
+            "warnings": 0,
+            "ledger": {
+              "sites": 21060,
+              "proven": 26210,
+              "checked": 2973,
+              "guarded": 10253,
+              "violation": 0,
+              "unresolved": 5442,
+              "trusted": 52
+            },
+            "unresolvedShare": {
+              "spatialNull": 0.0195,
+              "temporal": 0.2541
+            },
+            "cpuSeconds": 13.76,
+            "workCounters": {
+              "blockTransfers": 93249,
+              "functions": 1303,
+              "sites": 21060
+            }
+          },
+          "traps": 0,
+          "overhead": 3.5103,
+          "overheadNoRuntime": 1.2024,
+          "rssRatio": 3.2201
+        },
         "expat": {
           "units": {
             "errors": 0,
             "warnings": 3,
             "ledger": {
               "sites": 10111,
-              "proven": 13735,
-              "checked": 2159,
-              "guarded": 5187,
+              "proven": 11884,
+              "checked": 3329,
+              "guarded": 5676,
               "violation": 0,
-              "unresolved": 868,
-              "trusted": 81
+              "unresolved": 1065,
+              "trusted": 76
             },
             "unresolvedShare": {
-              "spatialNull": 0.0104,
-              "temporal": 0.0794
+              "spatialNull": 0.0136,
+              "temporal": 0.0963
             },
-            "cpuSeconds": 17.06,
+            "cpuSeconds": 9.93,
             "workCounters": {
-              "blockTransfers": 74443,
+              "blockTransfers": 56649,
               "functions": 362,
               "sites": 10111
             }
@@ -177,43 +264,43 @@
             "warnings": 0,
             "ledger": {
               "sites": 5700,
-              "proven": 6172,
-              "checked": 753,
-              "guarded": 2414,
+              "proven": 6166,
+              "checked": 751,
+              "guarded": 2427,
               "violation": 0,
-              "unresolved": 1178,
+              "unresolved": 1173,
               "trusted": 46
             },
             "unresolvedShare": {
-              "spatialNull": 0.0273,
+              "spatialNull": 0.0264,
               "temporal": 0.2166
             },
-            "cpuSeconds": 3.04,
+            "cpuSeconds": 2.97,
             "workCounters": {
-              "blockTransfers": 16538,
+              "blockTransfers": 19217,
               "functions": 396,
               "sites": 5700
             }
           },
           "program": {
             "errors": 0,
-            "warnings": 146,
+            "warnings": 129,
             "ledger": {
               "sites": 5700,
-              "proven": 6797,
-              "checked": 678,
-              "guarded": 2181,
+              "proven": 6723,
+              "checked": 668,
+              "guarded": 2260,
               "violation": 0,
-              "unresolved": 975,
+              "unresolved": 980,
               "trusted": 35
             },
             "unresolvedShare": {
-              "spatialNull": 0.0375,
-              "temporal": 0.1598
+              "spatialNull": 0.0372,
+              "temporal": 0.1613
             },
-            "cpuSeconds": 10.27,
+            "cpuSeconds": 14.31,
             "workCounters": {
-              "blockTransfers": 108758,
+              "blockTransfers": 114694,
               "functions": 396,
               "sites": 5700
             }
@@ -226,20 +313,20 @@
             "warnings": 0,
             "ledger": {
               "sites": 2202,
-              "proven": 2556,
+              "proven": 2555,
               "checked": 273,
-              "guarded": 763,
+              "guarded": 768,
               "violation": 0,
-              "unresolved": 193,
+              "unresolved": 189,
               "trusted": 1
             },
             "unresolvedShare": {
-              "spatialNull": 0.0084,
+              "spatialNull": 0.0065,
               "temporal": 0.1068
             },
-            "cpuSeconds": 2.98,
+            "cpuSeconds": 1.98,
             "workCounters": {
-              "blockTransfers": 17927,
+              "blockTransfers": 13359,
               "functions": 95,
               "sites": 2202
             }
@@ -249,20 +336,20 @@
             "warnings": 0,
             "ledger": {
               "sites": 2202,
-              "proven": 2591,
-              "checked": 278,
-              "guarded": 772,
+              "proven": 2524,
+              "checked": 283,
+              "guarded": 780,
               "violation": 0,
-              "unresolved": 144,
+              "unresolved": 198,
               "trusted": 2
             },
             "unresolvedShare": {
-              "spatialNull": 0.0098,
-              "temporal": 0.075
+              "spatialNull": 0.0172,
+              "temporal": 0.0982
             },
-            "cpuSeconds": 9.48,
+            "cpuSeconds": 10.25,
             "workCounters": {
-              "blockTransfers": 67454,
+              "blockTransfers": 56693,
               "functions": 95,
               "sites": 2202
             }
@@ -286,9 +373,9 @@
               "spatialNull": 0.019,
               "temporal": 0.1717
             },
-            "cpuSeconds": 0.25,
+            "cpuSeconds": 0.33,
             "workCounters": {
-              "blockTransfers": 1580,
+              "blockTransfers": 2228,
               "functions": 13,
               "sites": 116
             }
@@ -309,7 +396,7 @@
               "spatialNull": 0.0283,
               "temporal": 0.1313
             },
-            "cpuSeconds": 0.5,
+            "cpuSeconds": 0.76,
             "workCounters": {
               "blockTransfers": 3271,
               "functions": 13,
@@ -318,6 +405,35 @@
           },
           "traps": 0
         },
+        "janet": {
+          "units": {
+            "errors": 0,
+            "warnings": 0,
+            "ledger": {
+              "sites": 23550,
+              "proven": 17482,
+              "checked": 4693,
+              "guarded": 12192,
+              "violation": 0,
+              "unresolved": 8808,
+              "trusted": 200
+            },
+            "unresolvedShare": {
+              "spatialNull": 0.0182,
+              "temporal": 0.3754
+            },
+            "cpuSeconds": 23.24,
+            "workCounters": {
+              "blockTransfers": 158083,
+              "functions": 1616,
+              "sites": 23550
+            }
+          },
+          "traps": 0,
+          "overhead": 1.618,
+          "overheadNoRuntime": 1.1139,
+          "rssRatio": 2.0538
+        },
         "jansson": {
           "units": {
             "errors": 0,
@@ -326,41 +442,41 @@
               "sites": 2391,
               "proven": 2739,
               "checked": 233,
-              "guarded": 683,
+              "guarded": 684,
               "violation": 0,
-              "unresolved": 706,
+              "unresolved": 705,
               "trusted": 20
             },
             "unresolvedShare": {
-              "spatialNull": 0.0425,
+              "spatialNull": 0.042,
               "temporal": 0.2824
             },
-            "cpuSeconds": 1.93,
+            "cpuSeconds": 2.53,
             "workCounters": {
-              "blockTransfers": 13387,
+              "blockTransfers": 17275,
               "functions": 236,
               "sites": 2391
             }
           },
           "program": {
             "errors": 0,
-            "warnings": 38,
+            "warnings": 33,
             "ledger": {
               "sites": 2391,
               "proven": 3012,
               "checked": 240,
-              "guarded": 607,
+              "guarded": 608,
               "violation": 0,
-              "unresolved": 562,
+              "unresolved": 561,
               "trusted": 16
             },
             "unresolvedShare": {
-              "spatialNull": 0.0626,
+              "spatialNull": 0.0621,
               "temporal": 0.1938
             },
-            "cpuSeconds": 5.94,
+            "cpuSeconds": 8.03,
             "workCounters": {
-              "blockTransfers": 58399,
+              "blockTransfers": 57647,
               "functions": 236,
               "sites": 2391
             }
@@ -373,72 +489,130 @@
             "warnings": 3,
             "ledger": {
               "sites": 384,
-              "proven": 772,
+              "proven": 765,
               "checked": 36,
               "guarded": 103,
               "violation": 0,
-              "unresolved": 20,
+              "unresolved": 27,
               "trusted": 2
             },
             "unresolvedShare": {
-              "spatialNull": 0.0189,
+              "spatialNull": 0.031,
               "temporal": 0.0256
             },
-            "cpuSeconds": 0.34,
+            "cpuSeconds": 0.3,
             "workCounters": {
-              "blockTransfers": 2745,
+              "blockTransfers": 3393,
               "functions": 17,
               "sites": 384
             }
           },
           "traps": 0
         },
+        "libdeflate": {
+          "units": {
+            "errors": 0,
+            "warnings": 0,
+            "ledger": {
+              "sites": 3282,
+              "proven": 3099,
+              "checked": 718,
+              "guarded": 1318,
+              "violation": 0,
+              "unresolved": 274,
+              "trusted": 208
+            },
+            "unresolvedShare": {
+              "spatialNull": 0.0047,
+              "temporal": 0.0979
+            },
+            "cpuSeconds": 2.9,
+            "workCounters": {
+              "blockTransfers": 24527,
+              "functions": 334,
+              "sites": 3282
+            }
+          },
+          "traps": 0,
+          "overhead": 3.158,
+          "overheadNoRuntime": 0.9798,
+          "rssRatio": 1.088
+        },
         "libevent": {
           "units": {
             "errors": 0,
             "warnings": 2,
             "ledger": {
               "sites": 18276,
-              "proven": 20543,
-              "checked": 2724,
-              "guarded": 9674,
+              "proven": 20523,
+              "checked": 2731,
+              "guarded": 9704,
               "violation": 0,
-              "unresolved": 4533,
+              "unresolved": 4516,
               "trusted": 131
             },
             "unresolvedShare": {
-              "spatialNull": 0.036,
-              "temporal": 0.2358
+              "spatialNull": 0.0351,
+              "temporal": 0.2359
             },
-            "cpuSeconds": 9.25,
+            "cpuSeconds": 9.67,
             "workCounters": {
-              "blockTransfers": 66744,
+              "blockTransfers": 74169,
               "functions": 1123,
               "sites": 18276
             }
           },
           "traps": 0
         },
+        "libgit2": {
+          "units": {
+            "errors": 0,
+            "warnings": 0,
+            "ledger": {
+              "sites": 36499,
+              "proven": 46617,
+              "checked": 3873,
+              "guarded": 16315,
+              "violation": 0,
+              "unresolved": 8248,
+              "trusted": 123
+            },
+            "unresolvedShare": {
+              "spatialNull": 0.0154,
+              "temporal": 0.2252
+            },
+            "cpuSeconds": 25.67,
+            "workCounters": {
+              "blockTransfers": 179777,
+              "functions": 2533,
+              "sites": 36499
+            }
+          },
+          "traps": 0,
+          "overhead": 2.844,
+          "overheadNoRuntime": 1.0415,
+          "rssRatio": 1.2698
+        },
         "libsodium": {
           "units": {
             "errors": 0,
             "warnings": 0,
             "ledger": {
               "sites": 10255,
-              "proven": 13116,
+              "proven": 13118,
               "checked": 304,
-              "guarded": 1025,
+              "guarded": 1032,
               "violation": 0,
-              "unresolved": 683,
+              "unresolved": 674,
               "trusted": 141
             },
             "unresolvedShare": {
-              "spatialNull": 0.0093,
-              "temporal": 0.1012
+              "spatialNull": 0.0085,
+              "temporal": 0.1009
             },
-            "cpuSeconds": 7.81,
+            "cpuSeconds": 11.12,
             "workCounters": {
-              "blockTransfers": 30229,
+              "blockTransfers": 44485,
               "functions": 558,
               "sites": 10255
             }
@@ -451,20 +625,20 @@
             "warnings": 16,
             "ledger": {
               "sites": 10684,
-              "proven": 13901,
-              "checked": 1343,
-              "guarded": 3659,
+              "proven": 13902,
+              "checked": 1344,
+              "guarded": 3668,
               "violation": 0,
-              "unresolved": 1594,
+              "unresolved": 1583,
               "trusted": 301
             },
             "unresolvedShare": {
-              "spatialNull": 0.0206,
+              "spatialNull": 0.0196,
               "temporal": 0.151
             },
-            "cpuSeconds": 6.73,
+            "cpuSeconds": 9.43,
             "workCounters": {
-              "blockTransfers": 42377,
+              "blockTransfers": 54363,
               "functions": 818,
               "sites": 10684
             }
@@ -474,46 +648,46 @@
         "libyaml": {
           "units": {
             "errors": 0,
-            "warnings": 6,
+            "warnings": 10,
             "ledger": {
               "sites": 9316,
-              "proven": 13968,
-              "checked": 706,
-              "guarded": 8226,
+              "proven": 13964,
+              "checked": 707,
+              "guarded": 8231,
               "violation": 0,
-              "unresolved": 778,
+              "unresolved": 776,
               "trusted": 0
             },
             "unresolvedShare": {
-              "spatialNull": 0.0058,
-              "temporal": 0.0787
+              "spatialNull": 0.0056,
+              "temporal": 0.0788
             },
-            "cpuSeconds": 8.85,
+            "cpuSeconds": 6.93,
             "workCounters": {
-              "blockTransfers": 41141,
+              "blockTransfers": 43623,
               "functions": 196,
               "sites": 9316
             }
           },
           "program": {
             "errors": 0,
-            "warnings": 74,
+            "warnings": 82,
             "ledger": {
               "sites": 9316,
-              "proven": 16072,
+              "proven": 16070,
               "checked": 664,
-              "guarded": 6426,
+              "guarded": 6429,
               "violation": 0,
-              "unresolved": 557,
+              "unresolved": 556,
               "trusted": 3
             },
             "unresolvedShare": {
-              "spatialNull": 0.0096,
-              "temporal": 0.0471
+              "spatialNull": 0.0094,
+              "temporal": 0.0473
             },
-            "cpuSeconds": 32.29,
+            "cpuSeconds": 36.87,
             "workCounters": {
-              "blockTransfers": 182493,
+              "blockTransfers": 177247,
               "functions": 196,
               "sites": 9316
             }
@@ -528,18 +702,18 @@
               "sites": 1121,
               "proven": 1762,
               "checked": 123,
-              "guarded": 289,
+              "guarded": 291,
               "violation": 0,
-              "unresolved": 92,
+              "unresolved": 90,
               "trusted": 11
             },
             "unresolvedShare": {
-              "spatialNull": 0.0114,
+              "spatialNull": 0.0099,
               "temporal": 0.0804
             },
-            "cpuSeconds": 0.31,
+            "cpuSeconds": 0.27,
             "workCounters": {
-              "blockTransfers": 3336,
+              "blockTransfers": 3650,
               "functions": 85,
               "sites": 1121
             }
@@ -553,18 +727,18 @@
               "sites": 1181,
               "proven": 1807,
               "checked": 133,
-              "guarded": 314,
+              "guarded": 316,
               "violation": 0,
-              "unresolved": 115,
+              "unresolved": 113,
               "trusted": 12
             },
             "unresolvedShare": {
-              "spatialNull": 0.0139,
+              "spatialNull": 0.0124,
               "temporal": 0.095
             },
-            "cpuSeconds": 0.41,
+            "cpuSeconds": 0.4,
             "workCounters": {
-              "blockTransfers": 4010,
+              "blockTransfers": 4648,
               "functions": 88,
               "sites": 1181
             }
@@ -576,24 +750,53 @@
               "sites": 1181,
               "proven": 1826,
               "checked": 134,
-              "guarded": 310,
+              "guarded": 312,
               "violation": 0,
-              "unresolved": 104,
+              "unresolved": 102,
               "trusted": 12
             },
             "unresolvedShare": {
-              "spatialNull": 0.0175,
+              "spatialNull": 0.016,
               "temporal": 0.0791
             },
-            "cpuSeconds": 0.92,
+            "cpuSeconds": 0.96,
             "workCounters": {
-              "blockTransfers": 12523,
+              "blockTransfers": 12483,
               "functions": 88,
               "sites": 1181
             }
           },
           "traps": 0
         },
+        "lmdb": {
+          "units": {
+            "errors": 0,
+            "warnings": 1,
+            "ledger": {
+              "sites": 7448,
+              "proven": 9341,
+              "checked": 1736,
+              "guarded": 5351,
+              "violation": 0,
+              "unresolved": 829,
+              "trusted": 46
+            },
+            "unresolvedShare": {
+              "spatialNull": 0.0234,
+              "temporal": 0.0908
+            },
+            "cpuSeconds": 6.83,
+            "workCounters": {
+              "blockTransfers": 57980,
+              "functions": 219,
+              "sites": 7448
+            }
+          },
+          "traps": 0,
+          "overhead": 1.771,
+          "overheadNoRuntime": 1.0201,
+          "rssRatio": 1.1637
+        },
         "log.c": {
           "units": {
             "errors": 0,
@@ -611,9 +814,9 @@
               "spatialNull": 0.0215,
               "temporal": 0.0656
             },
-            "cpuSeconds": 0.08,
+            "cpuSeconds": 0.09,
             "workCounters": {
-              "blockTransfers": 500,
+              "blockTransfers": 824,
               "functions": 12,
               "sites": 74
             }
@@ -625,51 +828,51 @@
             "warnings": 1,
             "ledger": {
               "sites": 14578,
-              "proven": 16693,
-              "checked": 2120,
-              "guarded": 7167,
+              "proven": 16698,
+              "checked": 2118,
+              "guarded": 7174,
               "violation": 0,
-              "unresolved": 3897,
+              "unresolved": 3887,
               "trusted": 16
             },
             "unresolvedShare": {
-              "spatialNull": 0.0125,
+              "spatialNull": 0.0119,
               "temporal": 0.2796
             },
-            "cpuSeconds": 11.48,
+            "cpuSeconds": 20.05,
             "workCounters": {
-              "blockTransfers": 58040,
+              "blockTransfers": 71266,
               "functions": 1157,
               "sites": 14578
             }
           },
           "program": {
             "errors": 0,
-            "warnings": 80,
+            "warnings": 79,
             "ledger": {
               "sites": 14578,
-              "proven": 18587,
-              "checked": 2065,
-              "guarded": 6396,
+              "proven": 18593,
+              "checked": 2063,
+              "guarded": 6401,
               "violation": 0,
-              "unresolved": 3162,
+              "unresolved": 3153,
               "trusted": 19
             },
             "unresolvedShare": {
-              "spatialNull": 0.0295,
-              "temporal": 0.2016
+              "spatialNull": 0.029,
+              "temporal": 0.2015
             },
-            "cpuSeconds": 126.36,
+            "cpuSeconds": 158.45,
             "workCounters": {
-              "blockTransfers": 555035,
+              "blockTransfers": 584019,
               "functions": 1157,
               "sites": 14578
             }
           },
           "traps": 0,
-          "overhead": 6.2492,
-          "overheadNoRuntime": 1.1204,
-          "rssRatio": 1.6145
+          "overhead": 2.4272,
+          "overheadNoRuntime": 1.0934,
+          "rssRatio": 1.5393
         },
         "lz4": {
           "units": {
@@ -677,20 +880,20 @@
             "warnings": 0,
             "ledger": {
               "sites": 2925,
-              "proven": 4355,
-              "checked": 295,
-              "guarded": 740,
+              "proven": 4354,
+              "checked": 294,
+              "guarded": 761,
               "violation": 0,
-              "unresolved": 265,
+              "unresolved": 246,
               "trusted": 0
             },
             "unresolvedShare": {
-              "spatialNull": 0.019,
-              "temporal": 0.0773
+              "spatialNull": 0.0119,
+              "temporal": 0.0781
             },
-            "cpuSeconds": 3.56,
+            "cpuSeconds": 2.65,
             "workCounters": {
-              "blockTransfers": 15055,
+              "blockTransfers": 15557,
               "functions": 295,
               "sites": 2925
             }
@@ -703,20 +906,20 @@
             "warnings": 0,
             "ledger": {
               "sites": 4695,
-              "proven": 7777,
-              "checked": 437,
-              "guarded": 1572,
+              "proven": 7765,
+              "checked": 436,
+              "guarded": 1590,
               "violation": 0,
-              "unresolved": 481,
+              "unresolved": 476,
               "trusted": 46
             },
             "unresolvedShare": {
-              "spatialNull": 0.0124,
-              "temporal": 0.0973
+              "spatialNull": 0.0109,
+              "temporal": 0.0983
             },
-            "cpuSeconds": 4.82,
+            "cpuSeconds": 3.83,
             "workCounters": {
-              "blockTransfers": 27466,
+              "blockTransfers": 22657,
               "functions": 176,
               "sites": 4695
             }
@@ -726,23 +929,23 @@
         "mujs": {
           "units": {
             "errors": 0,
-            "warnings": 7,
+            "warnings": 2,
             "ledger": {
               "sites": 10905,
-              "proven": 12061,
-              "checked": 1638,
-              "guarded": 3316,
+              "proven": 11924,
+              "checked": 1696,
+              "guarded": 3381,
               "violation": 0,
-              "unresolved": 4044,
+              "unresolved": 4058,
               "trusted": 76
             },
             "unresolvedShare": {
-              "spatialNull": 0.0792,
-              "temporal": 0.3059
+              "spatialNull": 0.0786,
+              "temporal": 0.3079
             },
-            "cpuSeconds": 14.82,
+            "cpuSeconds": 11.63,
             "workCounters": {
-              "blockTransfers": 67434,
+              "blockTransfers": 65102,
               "functions": 746,
               "sites": 10905
             }
@@ -755,20 +958,20 @@
             "warnings": 5,
             "ledger": {
               "sites": 13137,
-              "proven": 17774,
-              "checked": 2901,
-              "guarded": 6510,
+              "proven": 17787,
+              "checked": 2895,
+              "guarded": 6504,
               "violation": 0,
-              "unresolved": 2172,
+              "unresolved": 2171,
               "trusted": 34
             },
             "unresolvedShare": {
-              "spatialNull": 0.0267,
+              "spatialNull": 0.0266,
               "temporal": 0.1443
             },
-            "cpuSeconds": 37.04,
+            "cpuSeconds": 24.15,
             "workCounters": {
-              "blockTransfers": 146383,
+              "blockTransfers": 100091,
               "functions": 764,
               "sites": 13137
             }
@@ -781,20 +984,20 @@
             "warnings": 0,
             "ledger": {
               "sites": 15650,
-              "proven": 8549,
-              "checked": 9589,
-              "guarded": 21056,
+              "proven": 6637,
+              "checked": 10853,
+              "guarded": 21603,
               "violation": 0,
-              "unresolved": 856,
+              "unresolved": 957,
               "trusted": 10
             },
             "unresolvedShare": {
-              "spatialNull": 0.0036,
-              "temporal": 0.0543
+              "spatialNull": 0.0052,
+              "temporal": 0.0586
             },
-            "cpuSeconds": 129.73,
+            "cpuSeconds": 57.75,
             "workCounters": {
-              "blockTransfers": 262073,
+              "blockTransfers": 157460,
               "functions": 187,
               "sites": 15650
             }
@@ -818,34 +1021,63 @@
               "spatialNull": 0.0301,
               "temporal": 0.3071
             },
-            "cpuSeconds": 0.29,
+            "cpuSeconds": 0.26,
             "workCounters": {
-              "blockTransfers": 3859,
+              "blockTransfers": 4183,
               "functions": 20,
               "sites": 148
             }
           }
         },
+        "quickjs": {
+          "units": {
+            "errors": 0,
+            "warnings": 17,
+            "ledger": {
+              "sites": 36058,
+              "proven": 32840,
+              "checked": 6901,
+              "guarded": 18668,
+              "violation": 0,
+              "unresolved": 11693,
+              "trusted": 174
+            },
+            "unresolvedShare": {
+              "spatialNull": 0.0614,
+              "temporal": 0.284
+            },
+            "cpuSeconds": 32.06,
+            "workCounters": {
+              "blockTransfers": 296895,
+              "functions": 2038,
+              "sites": 36058
+            }
+          },
+          "traps": 0,
+          "overhead": 3.9978,
+          "overheadNoRuntime": 1.0506,
+          "rssRatio": 1.8494
+        },
         "redis": {
           "units": {
             "errors": 0,
             "warnings": 0,
             "ledger": {
               "sites": 40105,
-              "proven": 40515,
-              "checked": 5496,
-              "guarded": 18168,
+              "proven": 40533,
+              "checked": 5465,
+              "guarded": 18229,
               "violation": 0,
-              "unresolved": 11538,
+              "unresolved": 11490,
               "trusted": 449
             },
             "unresolvedShare": {
-              "spatialNull": 0.0315,
-              "temporal": 0.2847
+              "spatialNull": 0.0304,
+              "temporal": 0.2846
             },
-            "cpuSeconds": 16.72,
+            "cpuSeconds": 25.54,
             "workCounters": {
-              "blockTransfers": 135297,
+              "blockTransfers": 147674,
               "functions": 2248,
               "sites": 40105
             }
@@ -869,9 +1101,9 @@
               "spatialNull": 0.0718,
               "temporal": 0.1341
             },
-            "cpuSeconds": 0.26,
+            "cpuSeconds": 0.29,
             "workCounters": {
-              "blockTransfers": 2414,
+              "blockTransfers": 2738,
               "functions": 49,
               "sites": 464
             }
@@ -881,23 +1113,23 @@
         "sqlite": {
           "units": {
             "errors": 0,
-            "warnings": 98,
+            "warnings": 71,
             "ledger": {
               "sites": 51972,
-              "proven": 52822,
-              "checked": 14429,
-              "guarded": 39511,
+              "proven": 47593,
+              "checked": 17504,
+              "guarded": 40713,
               "violation": 0,
-              "unresolved": 15502,
+              "unresolved": 16454,
               "trusted": 208
             },
             "unresolvedShare": {
-              "spatialNull": 0.0669,
-              "temporal": 0.2181
+              "spatialNull": 0.0747,
+              "temporal": 0.2257
             },
-            "cpuSeconds": 149.95,
+            "cpuSeconds": 68.79,
             "workCounters": {
-              "blockTransfers": 543301,
+              "blockTransfers": 402561,
               "functions": 2693,
               "sites": 51972
             }
@@ -910,20 +1142,20 @@
             "warnings": 0,
             "ledger": {
               "sites": 1259,
-              "proven": 1449,
+              "proven": 1451,
               "checked": 32,
-              "guarded": 193,
+              "guarded": 192,
               "violation": 0,
-              "unresolved": 321,
+              "unresolved": 320,
               "trusted": 2
             },
             "unresolvedShare": {
               "spatialNull": 0.0914,
-              "temporal": 0.2466
+              "temporal": 0.2455
             },
-            "cpuSeconds": 0.48,
+            "cpuSeconds": 0.56,
             "workCounters": {
-              "blockTransfers": 8466,
+              "blockTransfers": 9114,
               "functions": 76,
               "sites": 1259
             }
@@ -933,20 +1165,20 @@
             "warnings": 0,
             "ledger": {
               "sites": 1259,
-              "proven": 1477,
+              "proven": 1479,
               "checked": 32,
-              "guarded": 193,
+              "guarded": 192,
               "violation": 0,
-              "unresolved": 300,
+              "unresolved": 299,
               "trusted": 2
             },
             "unresolvedShare": {
               "spatialNull": 0.0971,
-              "temporal": 0.2152
+              "temporal": 0.2141
             },
-            "cpuSeconds": 1.48,
+            "cpuSeconds": 2.1,
             "workCounters": {
-              "blockTransfers": 22323,
+              "blockTransfers": 22557,
               "functions": 76,
               "sites": 1259
             }
@@ -970,35 +1202,64 @@
               "spatialNull": 0.0264,
               "temporal": 0.041
             },
-            "cpuSeconds": 0.39,
+            "cpuSeconds": 0.36,
             "workCounters": {
-              "blockTransfers": 2749,
+              "blockTransfers": 3073,
               "functions": 38,
               "sites": 300
             }
           },
           "traps": 0
         },
+        "xz": {
+          "units": {
+            "errors": 0,
+            "warnings": 0,
+            "ledger": {
+              "sites": 11917,
+              "proven": 14682,
+              "checked": 1394,
+              "guarded": 5372,
+              "violation": 0,
+              "unresolved": 985,
+              "trusted": 29
+            },
+            "unresolvedShare": {
+              "spatialNull": 0.0094,
+              "temporal": 0.0964
+            },
+            "cpuSeconds": 11.02,
+            "workCounters": {
+              "blockTransfers": 78420,
+              "functions": 814,
+              "sites": 11917
+            }
+          },
+          "traps": 0,
+          "overhead": 1.5375,
+          "overheadNoRuntime": 1.0148,
+          "rssRatio": 1.076
+        },
         "zlib": {
           "units": {
             "errors": 0,
             "warnings": 0,
             "ledger": {
               "sites": 4880,
-              "proven": 7155,
-              "checked": 550,
-              "guarded": 4337,
+              "proven": 7219,
+              "checked": 486,
+              "guarded": 4354,
               "violation": 0,
-              "unresolved": 325,
+              "unresolved": 308,
               "trusted": 15
             },
             "unresolvedShare": {
-              "spatialNull": 0.0098,
+              "spatialNull": 0.0076,
               "temporal": 0.0547
             },
-            "cpuSeconds": 5.43,
+            "cpuSeconds": 4.45,
             "workCounters": {
-              "blockTransfers": 25673,
+              "blockTransfers": 30815,
               "functions": 156,
               "sites": 4880
             }
@@ -1008,28 +1269,57 @@
             "warnings": 6,
             "ledger": {
               "sites": 4880,
-              "proven": 8969,
-              "checked": 536,
-              "guarded": 2642,
+              "proven": 9023,
+              "checked": 482,
+              "guarded": 2658,
               "violation": 0,
-              "unresolved": 291,
+              "unresolved": 275,
               "trusted": 33
             },
             "unresolvedShare": {
-              "spatialNull": 0.0203,
+              "spatialNull": 0.0183,
               "temporal": 0.0287
             },
-            "cpuSeconds": 6.82,
+            "cpuSeconds": 9.57,
             "workCounters": {
-              "blockTransfers": 49734,
+              "blockTransfers": 50266,
               "functions": 156,
               "sites": 4880
             }
           },
           "traps": 0,
-          "overhead": 1.8939,
-          "overheadNoRuntime": 1.0002,
-          "rssRatio": 1.1594
+          "overhead": 1.6152,
+          "overheadNoRuntime": 0.9982,
+          "rssRatio": 1.259
+        },
+        "zlib-ng": {
+          "units": {
+            "errors": 0,
+            "warnings": 0,
+            "ledger": {
+              "sites": 6196,
+              "proven": 8236,
+              "checked": 811,
+              "guarded": 3865,
+              "violation": 0,
+              "unresolved": 421,
+              "trusted": 250
+            },
+            "unresolvedShare": {
+              "spatialNull": 0.0058,
+              "temporal": 0.0676
+            },
+            "cpuSeconds": 9.07,
+            "workCounters": {
+              "blockTransfers": 54899,
+              "functions": 486,
+              "sites": 6196
+            }
+          },
+          "traps": 0,
+          "overhead": 2.3853,
+          "overheadNoRuntime": 1.0331,
+          "rssRatio": 1.3194
         },
         "zstd": {
           "units": {
@@ -1037,20 +1327,20 @@
             "warnings": 0,
             "ledger": {
               "sites": 22169,
-              "proven": 31574,
+              "proven": 31558,
               "checked": 2485,
-              "guarded": 5225,
+              "guarded": 5262,
               "violation": 0,
-              "unresolved": 2643,
+              "unresolved": 2622,
               "trusted": 48
             },
             "unresolvedShare": {
-              "spatialNull": 0.009,
+              "spatialNull": 0.008,
               "temporal": 0.1209
             },
-            "cpuSeconds": 15.95,
+            "cpuSeconds": 23.72,
             "workCounters": {
-              "blockTransfers": 113907,
+              "blockTransfers": 123854,
               "functions": 2868,
               "sites": 22169
             }
diff --git a/test/corpus/manifest.json b/test/corpus/manifest.json
index 5dbe6171..ff7224c3 100644
--- a/test/corpus/manifest.json
+++ b/test/corpus/manifest.json
@@ -17,7 +17,10 @@
     "projects, run by --full and by --held-out). RFC 0033, section 11: a config marked heldOut may",
     "name a `set`, `fresh` (its eight projects, run by --full and by --held-out, gated by D1 and D5",
     "under `gates.rfc0033`) or `sealed` (five projects, run only by --sealed or --only, built with",
-    "the reference compiler alone until gate D2)."
+    "the reference compiler alone until gate D2). RFC 0034, section 9: two more sets, `fresh34`",
+    "(ten projects, run by --full, --held-out and --set fresh34, gated by F1, F5 and F7 under",
+    "`gates.rfc0034`; the only held-out configs with a `bench`) and `sealed34` (five projects, run",
+    "only by --set sealed34 or --only, built with the reference compiler alone until gate F2)."
   ],
   "gates": {
     "referenceMachine": "darwin-arm64 Apple M3 x8",
@@ -66,6 +69,21 @@
       "_comment": "RFC 0033's gates over the configs of set fresh (section 11), which G9, G10, G11 and RFC 0031's held-out gates do not count: D1 (no definite error triaged false; with --full every build and test suite passes, in trap mode with no trap and in report mode with no failure) and D5 (with --full the weavec-cc build's CPU time over the reference compiler's, per config). The sealed configs get the same values under rfc0033.sealed.*, from the one --sealed run of gate D2.",
       "D1": {"maxFalseDefiniteErrors": 0, "maxTraps": 0},
       "D5": {"maxBuildRatio": 4.0}
+    },
+    "rfc0034": {
+      "_comment": "RFC 0034's gates (Acceptance gates). F1 over the configs of set fresh34 (section 9): every build passes with the default flags (or stops only at definite errors triaged true) and every test suite passes, in trap mode with no trap and in report mode with no failure. F2: the same over set sealed34, with F5's build ratio, from the one --set sealed34 run. F5: with --full each config's weavec-cc build CPU time at most maxBuildRatio times the reference compiler's (every config but sealed34 ones; the reference compiler builds each once more); the single-unit compiles of maxUnitCpuSeconds within their CPU seconds; no compilation above maxCompileRssMiB (the per-file compiles of --quick, and every compiler process of a --full trap-mode build). F7: with --bench the default build's run time (with the runtime) over the reference compiler's: each fresh34 workload at most maxOverhead and their geometric mean at most maxGeometricMean; RFC 0032's G14 benchmarks at maxOverheadG14.",
+      "F1": {"maxFalseDefiniteErrors": 0, "maxTraps": 0},
+      "F2": {"maxFalseDefiniteErrors": 0, "maxTraps": 0},
+      "F5": {
+        "maxBuildRatio": 5.0,
+        "maxUnitCpuSeconds": {"sqlite": {"file": "sqlite3.c", "cpuSeconds": 120}},
+        "maxCompileRssMiB": 2048
+      },
+      "F7": {
+        "maxOverhead": 4.0,
+        "maxGeometricMean": 2.5,
+        "maxOverheadG14": {"lua": 2.5, "zlib": 1.5, "cJSON": 1.5}
+      }
     }
   },
   "projects": [
@@ -823,6 +841,477 @@
           "test": ["ctest --test-dir out --output-on-failure -j \"$JOBS\""]
         }
       ]
+    },
+    {
+      "name": "quickjs",
+      "url": "https://github.com/bellard/quickjs.git",
+      "sha": "535a7c250ff4a577ec36c3e103daab6dadeea650",
+      "support": [],
+      "configs": [
+        {
+          "name": "quickjs",
+          "heldOut": true,
+          "set": "fresh34",
+          "notes": "A JavaScript engine: reference-counted JSValues (tagged structs) over objects with shapes and property arrays, a cycle-collecting GC over intrusive list.h lists (container_of), atoms, strings and ropes, a bytecode compiler and interpreter with its own value stack, a regexp engine and Unicode tables (libregexp, libunicode), dtoa, allocation through JSMallocFunctions, and quickjs-libc's std/os modules with workers (threads). The build is the project's Makefile (-O2) with explicit targets: qjs, qjsc, run-test262, libquickjs.a and the three examples (hello, test_fib, hello_module, which qjsc compiles with $CC). quickjs.check.o (the Makefile's CONFIG_CHECK_JSVALUE build, compile-only by the project's own account; JS_GetOpaque always returns null in it) is left out of the build: WeaveC's definite null dereferences there are true but vacuous (RFC 0034, gate F1), and lowering them would need one triage entry per finding and would lower null-dereference errors across the whole build. The default target `all` builds it (and qjs.check.o), so the build names the targets; `make test` depends only on qjs on Darwin (the bjson and point shared-library tests are off there), so it builds no check object. The test is `make test` (tests/test_*.js: closures, language, builtins, loops, BigInt, cyclic imports, a worker, std/os, rw handlers) and the three examples against their expected output; run-test262 is built but not run (test262 is a separate checkout of the conformance suite). The per-file compiles are the six library sources with the Makefile's defines (-D_GNU_SOURCE, CONFIG_VERSION from VERSION) and its -funsigned-char -fwrapv.",
+          "compile": {
+            "files": ["quickjs.c", "libregexp.c", "libunicode.c", "cutils.c", "dtoa.c", "quickjs-libc.c"],
+            "args": ["-D_GNU_SOURCE", "-DCONFIG_VERSION=\"2026-06-04\"", "-funsigned-char", "-fwrapv"]
+          },
+          "build": ["make -j\"$JOBS\" CC=\"$CC\" qjs qjsc run-test262 libquickjs.a examples/hello examples/test_fib examples/hello_module"],
+          "test": [
+            "make test CC=\"$CC\"",
+            "test \"$(./examples/hello)\" = \"Hello World\" && ./examples/test_fib | grep -qx 'fib(10)= 55' && ./examples/hello_module | grep -q '^msg= '"
+          ],
+          "testTimeout": 1800,
+          "bench": {
+            "name": "quickjs-qjs",
+            "build": ["make -j\"$JOBS\" CC=\"$CC\" qjs"],
+            "command": "./qjs \"$BENCH/quickjs-bench.js\" > bench.out && cat bench.out",
+            "check": "grep -qx 10347472 bench.out",
+            "repeat": 7
+          }
+        }
+      ]
+    },
+    {
+      "name": "lmdb",
+      "url": "https://github.com/LMDB/lmdb.git",
+      "sha": "700e10f91a65fae69520301926fb9819f16d292f",
+      "support": ["lmdb/run-tests.sh", "lmdb/fixed-seed.h"],
+      "configs": [
+        {
+          "name": "lmdb",
+          "heldOut": true,
+          "set": "fresh34",
+          "notes": "The Lightning memory-mapped database (libraries/liblmdb): a copy-on-write B+tree whose pages are read through pointers into a memory-mapped file (page headers, node offsets and overflow pages by pointer arithmetic), dirty pages in malloc'd buffers, free-page ID lists (midl), cursors with page stacks, a reader table in a shared lock file, nested transactions, and a crypto/checksum module hook (module.c). The build is liblmdb's Makefile (-O2 -g -pthread): the static and shared library and the five tools, with VERSION_OPT=-Wl,-current_version,1.0 (the Makefile's Mac OS X value; its default -soname is a GNU ld option), then mtest..mtest5 with support/lmdb/fixed-seed.h forced in (mtest, mtest2, mtest3 and mtest5 seed rand() with time(NULL); the header fixes the seed so the tests are deterministic). The test is support/lmdb/run-tests.sh: each mtest against a fresh testdb (what `make test` does for mtest), and over mtest's database mdb_stat, an mdb_dump / mdb_load round trip and mdb_copy (plain and compacting), compared record by record. mtest6, mtest_remap and mtest_enc* are not built: none is among the Makefile's default programs (its rall target, for MDB_VL32 / MDB_RPAGE_CACHE builds, adds the remap and two encryption tests). The per-file compiles are the library (mdb.c, midl.c, module.c) and the five tools.",
+          "compile": {
+            "files": ["libraries/liblmdb/mdb.c", "libraries/liblmdb/midl.c", "libraries/liblmdb/module.c", "libraries/liblmdb/mdb_stat.c", "libraries/liblmdb/mdb_copy.c", "libraries/liblmdb/mdb_dump.c", "libraries/liblmdb/mdb_load.c", "libraries/liblmdb/mdb_drop.c"],
+            "args": ["-Ilibraries/liblmdb"]
+          },
+          "build": [
+            "cd libraries/liblmdb && make -j\"$JOBS\" CC=\"$CC\" VERSION_OPT=-Wl,-current_version,1.0 liblmdb.a liblmdb.so.1.0 mdb_stat mdb_copy mdb_dump mdb_load mdb_drop",
+            "cd libraries/liblmdb && make -j\"$JOBS\" CC=\"$CC\" XCFLAGS=\"-include $SUPPORT/fixed-seed.h\" mtest mtest2 mtest3 mtest4 mtest5"
+          ],
+          "test": ["sh \"$SUPPORT/run-tests.sh\""],
+          "testTimeout": 1800,
+          "bench": {
+            "name": "lmdb-put-get",
+            "build": [
+              "cd libraries/liblmdb && make -j\"$JOBS\" CC=\"$CC\" liblmdb.a",
+              "cd libraries/liblmdb && \"$CC\" -O2 -pthread -I. -c \"$BENCH/lmdb-bench.c\" -o lmdb-bench.o && \"$CC\" -pthread -o lmdb-bench lmdb-bench.o liblmdb.a"
+            ],
+            "command": "rm -rf bench-db && libraries/liblmdb/lmdb-bench bench-db > bench.out && cat bench.out",
+            "check": "grep -qx 163099980 bench.out",
+            "repeat": 7
+          }
+        }
+      ]
+    },
+    {
+      "name": "janet",
+      "url": "https://github.com/janet-lang/janet.git",
+      "sha": "0e5fdd5309699c1c6c3168c4cff71cf202e37cfb",
+      "support": [],
+      "configs": [
+        {
+          "name": "janet",
+          "heldOut": true,
+          "set": "fresh34",
+          "notes": "A Lisp-like language and its bytecode VM: NaN-boxed values, a mark-and-sweep GC with a header in front of every object (janet_gcalloc), fibers with their own growable stacks, buffers, arrays, tables and interned strings and structs, abstract types with vtables, setjmp/longjmp panics, a PEG engine, marshalling, an event loop with threads and sockets, and an FFI. The build is the project's Makefile (`make`, CFLAGS default -O2 -g), which bootstraps: it compiles src/core/*.c and src/boot/*.c with -DJANET_BOOTSTRAP -O0 into build/janet_boot, runs janet_boot to generate the amalgamated build/c/janet.c (the core sources plus the compiled boot image), compiles that with -O2 into build/janet, libjanet.a and libjanet.dylib, and runs build/janet to write build/janet.h; so the build runs code the compiler built. The test is `make test`: every test/suite*.janet (stopping at the first failure) and every example compiled with -k; suite-ev opens sockets on localhost port 8761 (JANET_TEST_PORT). The per-file compiles are the 40 core sources and the shell (src/mainclient/shell.c) without -DJANET_BOOTSTRAP, as the amalgamated janet.c compiles them.",
+          "compile": {
+            "files": ["src/core/*.c", "src/mainclient/shell.c"],
+            "args": ["-std=c99", "-Isrc/include", "-Isrc/conf"]
+          },
+          "build": ["make -j\"$JOBS\" CC=\"$CC\""],
+          "test": ["make test CC=\"$CC\""],
+          "testTimeout": 1800,
+          "bench": {
+            "name": "janet-vm",
+            "build": ["make -j\"$JOBS\" CC=\"$CC\" build/janet"],
+            "command": "build/janet \"$BENCH/janet-bench.janet\" > bench.out && cat bench.out",
+            "check": "grep -qx 4235397 bench.out",
+            "repeat": 7
+          }
+        }
+      ]
+    },
+    {
+      "name": "brotli",
+      "url": "https://github.com/google/brotli",
+      "sha": "42a2ed4355bc6287da6bb6319f090b499cba4550",
+      "support": [],
+      "configs": [
+        {
+          "name": "brotli",
+          "heldOut": true,
+          "set": "fresh34",
+          "notes": "Brotli: encoder state and ring buffer, hashers and block splitters carved out of BrotliAllocate'd arenas through allocator hooks (memory.c), Huffman tables and a decoder state machine over caller buffers, the static dictionary and transforms. The build is the project's CMake build, static (BUILD_SHARED_LIBS=OFF), with the CLI; the test is its CTest suite (73 round-trip and compatibility tests over tests/testdata), then round trips with the CLI of seven test files (text, binary, random, empty, one byte, a source file) at qualities 0-11 and windows 10/16/24, a large-window (--large_window=26) round trip of bb.binast, and a raw-dictionary (-D) round trip. Bench: the CLI compressing the 64 MiB zlib-input.py text at -q 7 and decompressing it.",
+          "compile": {
+            "files": ["c/common/*.c", "c/dec/*.c", "c/enc/*.c"],
+            "args": ["-Ic/include"]
+          },
+          "build": [
+            "cmake -S . -B out -DCMAKE_C_COMPILER=\"$CC\" -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=OFF",
+            "cmake --build out -j \"$JOBS\""
+          ],
+          "test": [
+            "ctest --test-dir out --output-on-failure -j \"$JOBS\"",
+            "mkdir -p gate-rt && for f in tests/testdata/alice29.txt tests/testdata/mapsdatazrh tests/testdata/random_org_10k.bin tests/testdata/zerosukkanooa tests/testdata/empty tests/testdata/x c/enc/encode.c; do for q in 0 1 2 3 5 7 9 10 11; do for w in 10 16 24; do out/brotli -q $q --lgwin=$w -c \"$f\" > gate-rt/c.br && out/brotli -d -c gate-rt/c.br > gate-rt/d && cmp gate-rt/d \"$f\" || { echo \"FAIL q$q w$w $f\"; exit 1; }; done; done; done",
+            "mkdir -p gate-rt && out/brotli -q 9 --large_window=26 -c tests/testdata/bb.binast > gate-rt/l.br && out/brotli -d --large_window=26 -c gate-rt/l.br | cmp - tests/testdata/bb.binast && out/brotli -q 6 -D tests/testdata/alice29.txt -c tests/testdata/asyoulik.txt > gate-rt/dict.br && out/brotli -d -D tests/testdata/alice29.txt -c gate-rt/dict.br | cmp - tests/testdata/asyoulik.txt && out/brotli -t --large_window=26 gate-rt/l.br"
+          ],
+          "testTimeout": 1800,
+          "bench": {
+            "name": "brotli-cli",
+            "build": [
+              "cmake -S . -B out -DCMAKE_C_COMPILER=\"$CC\" -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=OFF -DBROTLI_DISABLE_TESTS=ON",
+              "cmake --build out -j \"$JOBS\" --target brotli"
+            ],
+            "input": "python3 \"$BENCH/zlib-input.py\" \"$INPUT\" --mib 64 --sha256 022ae1f8b846add8965f30fb7e5f150e1f4861b740423dad57bf4cc7ec4e8a20",
+            "command": "./out/brotli -q 7 -c \"$INPUT\" > bench.br && ./out/brotli -d -c bench.br > /dev/null",
+            "check": "./out/brotli -d -c bench.br | cmp - \"$INPUT\"",
+            "repeat": 7
+          }
+        }
+      ]
+    },
+    {
+      "name": "xz",
+      "url": "https://github.com/tukaani-project/xz",
+      "sha": "3b1efb04d17c3a9ef7f473d73af13f1531428ffe",
+      "support": ["xz/config.h"],
+      "configs": [
+        {
+          "name": "xz",
+          "heldOut": true,
+          "set": "fresh34",
+          "notes": "XZ Utils' liblzma: coder chains of lzma_next_coder structs allocated through lzma_allocator hooks and freed through end callbacks, the LZ match finders' hash chains and binary trees over a sliding window, the range coder, BCJ and delta filters in place over caller buffers, the multithreaded encoder and decoder (worker threads, an output queue), index trees. The build is the project's CMake build (liblzma static, the xz, xzdec, lzmadec and lzmainfo tools, the tests) with XZ_NLS=OFF (no gettext, so nothing links Homebrew's libintl); the test is its CTest suite (22 tests: the liblzma unit tests, test_compress on generated files, test_files.sh over tests/files, test_scripts.sh, test_suffix.sh), then round trips with the CLI of liblzma's concatenated sources, an empty file and doc/faq.txt at presets -0 to -9e, multithreaded with small blocks, through the x86, arm64 and delta filters, in the .lzma format, through xzdec and lzmadec, raw LZMA1, plus xz -t and xz -l -vv. Bench: xz -6 -T1 compressing the 8 MiB zlib-input.py text and decompressing it. The per-file compiles use support/xz/config.h, the definitions CMake passes to liblzma written as a header (sysdefs.h includes it under HAVE_CONFIG_H); 45 of liblzma's 77 sources: the check, LZ, LZMA, range-coder and delta sources, the simple-filter core with x86 and arm64, and the block, index, stream (single and multithreaded), filter, alone, lzip and string-conversion sources of common/.",
+          "compile": {
+            "files": ["src/liblzma/check/check.c", "src/liblzma/check/crc32_fast.c", "src/liblzma/check/crc64_fast.c", "src/liblzma/check/sha256.c", "src/liblzma/lz/lz_decoder.c", "src/liblzma/lz/lz_encoder.c", "src/liblzma/lz/lz_encoder_mf.c", "src/liblzma/lzma/fastpos_table.c", "src/liblzma/lzma/lzma2_decoder.c", "src/liblzma/lzma/lzma2_encoder.c", "src/liblzma/lzma/lzma_decoder.c", "src/liblzma/lzma/lzma_encoder.c", "src/liblzma/lzma/lzma_encoder_optimum_fast.c", "src/liblzma/lzma/lzma_encoder_optimum_normal.c", "src/liblzma/lzma/lzma_encoder_presets.c", "src/liblzma/rangecoder/price_table.c", "src/liblzma/delta/delta_common.c", "src/liblzma/delta/delta_decoder.c", "src/liblzma/delta/delta_encoder.c", "src/liblzma/simple/simple_coder.c", "src/liblzma/simple/simple_decoder.c", "src/liblzma/simple/simple_encoder.c", "src/liblzma/simple/x86.c", "src/liblzma/simple/arm64.c", "src/liblzma/common/common.c", "src/liblzma/common/block_decoder.c", "src/liblzma/common/block_encoder.c", "src/liblzma/common/block_header_decoder.c", "src/liblzma/common/block_util.c", "src/liblzma/common/index.c", "src/liblzma/common/index_decoder.c", "src/liblzma/common/index_encoder.c", "src/liblzma/common/index_hash.c", "src/liblzma/common/stream_decoder.c", "src/liblzma/common/stream_encoder.c", "src/liblzma/common/stream_decoder_mt.c", "src/liblzma/common/stream_encoder_mt.c", "src/liblzma/common/outqueue.c", "src/liblzma/common/filter_common.c", "src/liblzma/common/filter_decoder.c", "src/liblzma/common/filter_encoder.c", "src/liblzma/common/alone_decoder.c", "src/liblzma/common/lzip_decoder.c", "src/liblzma/common/string_conversion.c", "src/liblzma/common/file_info.c"],
+            "args": ["-std=gnu11", "-DHAVE_CONFIG_H", "-I{support}", "-Isrc/liblzma/api", "-Isrc/liblzma/common", "-Isrc/liblzma/check", "-Isrc/liblzma/lz", "-Isrc/liblzma/rangecoder", "-Isrc/liblzma/lzma", "-Isrc/liblzma/delta", "-Isrc/liblzma/simple", "-Isrc/common"]
+          },
+          "build": [
+            "cmake -S . -B out -DCMAKE_C_COMPILER=\"$CC\" -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=OFF -DXZ_NLS=OFF",
+            "cmake --build out -j \"$JOBS\""
+          ],
+          "test": [
+            "ctest --test-dir out --output-on-failure -j \"$JOBS\"",
+            "mkdir -p gate-rt && cat src/liblzma/*/*.c > gate-rt/src && : > gate-rt/empty && X=out/xz && for f in gate-rt/src gate-rt/empty doc/faq.txt; do for o in -0 -1 -3 -6 -9e \"-6 -T4 --block-size=64KiB\" \"--x86 --lzma2=preset=6\" \"--arm64 --lzma2\" \"--delta=dist=4 --lzma2=preset=1 --check=sha256\" \"--format=lzma\"; do $X $o -c \"$f\" > gate-rt/c && $X -d -c gate-rt/c | cmp - \"$f\" || { echo \"FAIL $o $f\"; exit 1; }; done; $X -c \"$f\" > gate-rt/c.xz && out/xzdec gate-rt/c.xz | cmp - \"$f\" && $X -t gate-rt/c.xz && $X -l -vv gate-rt/c.xz > /dev/null && $X --format=lzma -c \"$f\" | out/lzmadec | cmp - \"$f\" && $X --format=raw --lzma1=preset=2 -c \"$f\" | $X --format=raw --lzma1 -d -c | cmp - \"$f\" || { echo \"FAIL tools $f\"; exit 1; }; done"
+          ],
+          "testTimeout": 1800,
+          "bench": {
+            "name": "xz-cli",
+            "build": [
+              "cmake -S . -B out -DCMAKE_C_COMPILER=\"$CC\" -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=OFF -DXZ_NLS=OFF -DBUILD_TESTING=OFF",
+              "cmake --build out -j \"$JOBS\" --target xz"
+            ],
+            "input": "python3 \"$BENCH/zlib-input.py\" \"$INPUT\" --mib 8 --sha256 528778d9eac25c011d0d49a722ed6e8497f5f7ff507cbecd86b18ce3930925c2",
+            "command": "./out/xz -6 -T1 -c \"$INPUT\" > bench.xz && ./out/xz -d -c bench.xz > /dev/null",
+            "check": "./out/xz -d -c bench.xz | cmp - \"$INPUT\"",
+            "repeat": 7
+          }
+        }
+      ]
+    },
+    {
+      "name": "libdeflate",
+      "url": "https://github.com/ebiggers/libdeflate",
+      "sha": "92e6a0db9fa848d742f9eb286c92afc60f2c3dda",
+      "support": [],
+      "configs": [
+        {
+          "name": "libdeflate",
+          "heldOut": true,
+          "set": "fresh34",
+          "notes": "libdeflate: whole-buffer DEFLATE, zlib and gzip compression and decompression; compressors with hash-chain, binary-tree and hash-table match finders in one large allocation (custom allocator hooks, libdeflate_set_memory_allocator), decompression tables in the decompressor struct, word-at-a-time copies near buffer ends, Adler-32 and CRC-32 with arm64 NEON/PMULL paths chosen at run time. The build is the project's CMake build with LIBDEFLATE_BUILD_TESTS=ON (static and shared libraries; the programs link the static one; the tests use the SDK's zlib for comparisons); the test is CTest (8 test programs), then scripts/exec_tests.sh (each test program again and the benchmark program in deflate, gzip and zlib formats, at levels 0-12, checked against zlib with -Y/-Z) and scripts/gzip_tests.sh (libdeflate-gzip against itself, as scripts/run_tests.sh --quick does) over a 1,000,000-byte TESTDATA made from the project's sources in sorted order (run_tests.sh uses find's unsorted order). Bench: libdeflate-gzip compressing the 64 MiB zlib-input.py text at -1, -6 and -9 and decompressing each. The per-file compiles are the library's sources and the arm64 cpu_features.c (x86/cpu_features.c compiles to nothing on arm64).",
+          "compile": {
+            "files": ["lib/*.c", "lib/arm/cpu_features.c"],
+            "args": ["-std=gnu11", "-I."]
+          },
+          "build": [
+            "cmake -S . -B out -DCMAKE_C_COMPILER=\"$CC\" -DCMAKE_BUILD_TYPE=Release -DLIBDEFLATE_BUILD_TESTS=ON",
+            "cmake --build out -j \"$JOBS\""
+          ],
+          "test": [
+            "ctest --test-dir out --output-on-failure -j \"$JOBS\"",
+            "cat lib/*.c lib/*.h lib/*/*.h programs/*.c programs/*.h scripts/*.sh | head -c 1000000 > gate-testdata && WRAPPER= TESTDATA=\"$PWD/gate-testdata\" sh ./scripts/exec_tests.sh out/programs > /dev/null",
+            "cat lib/*.c lib/*.h lib/*/*.h programs/*.c programs/*.h scripts/*.sh | head -c 1000000 > gate-testdata && GZIP=\"$PWD/out/programs/libdeflate-gzip\" GUNZIP=\"$PWD/out/programs/libdeflate-gzip -d\" TESTDATA=\"$PWD/gate-testdata\" bash ./scripts/gzip_tests.sh"
+          ],
+          "testTimeout": 1800,
+          "bench": {
+            "name": "libdeflate-gzip",
+            "build": [
+              "cmake -S . -B out -DCMAKE_C_COMPILER=\"$CC\" -DCMAKE_BUILD_TYPE=Release -DLIBDEFLATE_BUILD_SHARED_LIB=OFF",
+              "cmake --build out -j \"$JOBS\" --target libdeflate-gzip"
+            ],
+            "input": "python3 \"$BENCH/zlib-input.py\" \"$INPUT\" --mib 64 --sha256 022ae1f8b846add8965f30fb7e5f150e1f4861b740423dad57bf4cc7ec4e8a20",
+            "command": "for l in 1 6 9; do ./out/programs/libdeflate-gzip -$l -c \"$INPUT\" > bench.gz && ./out/programs/libdeflate-gzip -d -c bench.gz > /dev/null || exit 1; done",
+            "check": "./out/programs/libdeflate-gzip -d -c bench.gz | cmp - \"$INPUT\"",
+            "repeat": 7
+          }
+        }
+      ]
+    },
+    {
+      "name": "zlib-ng",
+      "url": "https://github.com/zlib-ng/zlib-ng",
+      "sha": "72aceeac37bdd0704df14aac1823b4f80f4a5cf3",
+      "support": ["zlib-ng/round-trips.sh", "zlib-ng/zconf.h", "zlib-ng/zlib.h", "zlib-ng/zlib_name_mangling.h", "zlib-ng/gzread_mangle.h"],
+      "configs": [
+        {
+          "name": "zlib-ng",
+          "heldOut": true,
+          "set": "fresh34",
+          "notes": "zlib-ng, built zlib-compatible (ZLIB_COMPAT=ON): the deflate and inflate state, window and pending buffer allocated in one aligned block through zalloc/zfree hooks, deflate strategies (quick, fast, medium, slow, rle, huff, stored) over the window, chunked copies and a function table of arm64 NEON/CRC/PMULL implementations chosen at run time, gz* file wrappers. The build is the project's CMake build with ZLIB_COMPAT=ON and WITH_GTEST=OFF: its GoogleTest suite is C++ and fetches googletest from the network, so it is off (WITH_FUZZERS also stays off, since it enables C++ in the project); the test is CTest's C tests (69: example, infcover, the CVE and GitHub-issue regressions, minigzip and minideflate over test/data at every level and strategy, makefixed/maketrees/makecrct), then support/zlib-ng/round-trips.sh: minigzip round trips of the library's concatenated sources, an empty file and test/data's JPEG and text at levels 0-9 and strategies -h/-R/-F/-f/-T, and minideflate round trips at levels 1/6/9 and windows 9/12/15. Bench: minigzip compressing the 64 MiB zlib-input.py text at -1, -6 and -9 and decompressing each. The per-file compiles are the 38 sources of the arm64 build (generic and arm, with CMake's definitions; the NEON, dotprod and PMULL files compile without their -march flags) and use the headers CMake generates, copied into support/zlib-ng/.",
+          "compile": {
+            "files": ["adler32.c", "arch/arm/adler32_neon.c", "arch/arm/adler32_neon_dotprod.c", "arch/arm/arm_features.c", "arch/arm/chunkset_neon.c", "arch/arm/compare256_neon.c", "arch/arm/crc32_armv8.c", "arch/arm/crc32_armv8_pmull_eor3.c", "arch/arm/slide_hash_neon.c", "arch/generic/adler32_c.c", "arch/generic/chunkset_c.c", "arch/generic/compare256_c.c", "arch/generic/crc32_braid_c.c", "arch/generic/crc32_chorba_c.c", "arch/generic/slide_hash_c.c", "compress.c", "cpu_features.c", "crc32.c", "crc32_braid_comb.c", "deflate.c", "deflate_fast.c", "deflate_huff.c", "deflate_medium.c", "deflate_quick.c", "deflate_rle.c", "deflate_slow.c", "deflate_stored.c", "functable.c", "gzlib.c", "gzread.c", "gzwrite.c", "infback.c", "inflate.c", "inftrees.c", "insert_string.c", "trees.c", "uncompr.c", "zutil.c"],
+            "args": ["-std=c11", "-I{support}", "-I.", "-DARM_CRC32", "-DARM_CRC32_INTRIN", "-DARM_FEATURES", "-DARM_NEON", "-DARM_NEON_DOTPROD", "-DARM_NEON_HASLD4", "-DARM_PMULL_EOR3", "-DHAVE_ARM_ACLE_H", "-DHAVE_ATTRIBUTE_ALIGNED", "-DHAVE_BUILTIN_ASSUME_ALIGNED", "-DHAVE_SYS_SDT_H", "-DHAVE_VISIBILITY_HIDDEN", "-DHAVE_VISIBILITY_INTERNAL", "-DWITH_GZFILEOP", "-DWITH_OPTIM", "-DZLIB_COMPAT"]
+          },
+          "build": [
+            "cmake -S . -B out -DCMAKE_C_COMPILER=\"$CC\" -DCMAKE_BUILD_TYPE=Release -DZLIB_COMPAT=ON -DWITH_GTEST=OFF",
+            "cmake --build out -j \"$JOBS\""
+          ],
+          "test": [
+            "ctest --test-dir out --output-on-failure -j \"$JOBS\"",
+            "sh \"$SUPPORT/round-trips.sh\""
+          ],
+          "testTimeout": 1800,
+          "bench": {
+            "name": "zlib-ng-minigzip",
+            "build": [
+              "cmake -S . -B out -DCMAKE_C_COMPILER=\"$CC\" -DCMAKE_BUILD_TYPE=Release -DZLIB_COMPAT=ON -DWITH_GTEST=OFF",
+              "cmake --build out -j \"$JOBS\" --target minigzip"
+            ],
+            "input": "python3 \"$BENCH/zlib-input.py\" \"$INPUT\" --mib 64 --sha256 022ae1f8b846add8965f30fb7e5f150e1f4861b740423dad57bf4cc7ec4e8a20",
+            "command": "for l in 1 6 9; do ./out/minigzip -$l < \"$INPUT\" > bench.gz && ./out/minigzip -d < bench.gz > /dev/null || exit 1; done",
+            "check": "./out/minigzip -d < bench.gz | cmp - \"$INPUT\"",
+            "repeat": 7
+          }
+        }
+      ]
+    },
+    {
+      "name": "curl",
+      "url": "https://github.com/curl/curl.git",
+      "sha": "6d013631195b1c349e5f783ac8b58ad376c0bdde",
+      "support": ["curl/curl_config.h"],
+      "configs": [
+        {
+          "name": "curl",
+          "heldOut": true,
+          "set": "fresh34",
+          "notes": "libcurl and the curl tool: transfer and connection state machines over intrusive linked lists, hash tables, splay trees and uint tables, dynbuf and bufq buffers, connection filters chained through function pointers, a multi handle owning easy handles, its own printf (mprintf), the URL API and the cookie, header, chunked and FTP-listing parsers. The build is the project's CMake build with the milestone evaluation's options (no TLS, IDN, PSL, SSH, zstd, brotli, nghttp2 or LDAP; zlib is the SDK's): the library, the tool, the examples and the test programs (target testdeps: libtests, units, tunits, the test servers). The test is runtests.pl run from out/tests over a fixed selection: tests 1-999 (HTTP, FTP, file://, cookies, proxies, globbing, the libtests 500-699), 1300-1399 (unit tests, more HTTP and FTP) and 1500-1699 (multi-interface libtests, the URL API test 1560, unit tests 1600-1699): 1015 tests at the reference, about 70 s with 4 jobs on an idle machine. Tests keyworded flaky or timing-dependent are disabled ('!', not the milestone's '~', so none runs with its result ignored); -a goes on after a failure and the exit status is then 1; --min=1000 fails the run when test servers do not start, since runtests.pl only skips a test whose server fails. The tests needing a Unix-socket server (1435, 1436, 1467, 1468, 1470) are outside the selection: under the gate's directory their socket paths exceed Darwin's 104 bytes, and they would be skipped after a 30 s wait each. A few selected tests skip for features this build lacks (SSL, crypto, NTLM, PSL, debug) or because 'ip6-localhost' does not resolve. The bench (test/corpus/bench/curl-bench.c) links the static libcurl, built alone, and for 10 rounds parses 20,000 generated URLs with the URL API (every part read back, a relative reference resolved, a query appended), escapes, unescapes and parses a date for each, and loads 5,000 cookie lines through CURLOPT_COOKIELIST, read back with CURLINFO_COOKIELIST: libcurl's own parsing, allocation and list code with no transfer, so no socket or kernel time (file:// transfers spend most of their time in the kernel, --trace in libc's stdio); it prints one checksum line. The per-file compiles are 45 library sources with support/curl/curl_config.h, which CMake generates.",
+          "compile": {
+            "files": ["lib/altsvc.c", "lib/bufq.c", "lib/bufref.c", "lib/cfilters.c", "lib/conncache.c", "lib/connect.c", "lib/content_encoding.c", "lib/cookie.c", "lib/curl_fnmatch.c", "lib/curl_get_line.c", "lib/cw-out.c", "lib/dynhds.c", "lib/easy.c", "lib/escape.c", "lib/file.c", "lib/formdata.c", "lib/ftp.c", "lib/ftplistparser.c", "lib/getinfo.c", "lib/hash.c", "lib/headers.c", "lib/http.c", "lib/http1.c", "lib/http_chunks.c", "lib/llist.c", "lib/mime.c", "lib/mprintf.c", "lib/multi.c", "lib/netrc.c", "lib/parsedate.c", "lib/pingpong.c", "lib/request.c", "lib/sendf.c", "lib/setopt.c", "lib/slist.c", "lib/splay.c", "lib/transfer.c", "lib/uint-table.c", "lib/url.c", "lib/urlapi.c", "lib/ws.c", "lib/curlx/base64.c", "lib/curlx/dynbuf.c", "lib/curlx/strparse.c", "lib/vauth/digest.c"],
+            "args": ["-Iinclude", "-Ilib", "-I{support}", "-DHAVE_CONFIG_H", "-DBUILDING_LIBCURL"]
+          },
+          "build": [
+            "cmake -S . -B out -DCMAKE_C_COMPILER=\"$CC\" -DCMAKE_BUILD_TYPE=Release -DCURL_ENABLE_SSL=OFF -DCURL_USE_OPENSSL=OFF -DUSE_LIBIDN2=OFF -DUSE_APPLE_IDN=OFF -DCURL_USE_LIBPSL=OFF -DCURL_USE_LIBSSH2=OFF -DCURL_ZSTD=OFF -DCURL_BROTLI=OFF -DUSE_NGHTTP2=OFF -DCURL_DISABLE_LDAP=ON -DBUILD_TESTING=ON",
+            "cmake --build out -j \"$JOBS\" --target all testdeps"
+          ],
+          "test": ["cd out/tests && perl ../../tests/runtests.pl -a -p -j\"$JOBS\" --min=1000 '!flaky' '!timing-dependent' 1 to 999 1300 to 1399 1500 to 1699"],
+          "testTimeout": 1800,
+          "bench": {
+            "name": "curl-url-cookies",
+            "build": [
+              "cmake -S . -B bench-out -DCMAKE_C_COMPILER=\"$CC\" -DCMAKE_BUILD_TYPE=Release -DCURL_ENABLE_SSL=OFF -DCURL_USE_OPENSSL=OFF -DUSE_LIBIDN2=OFF -DUSE_APPLE_IDN=OFF -DCURL_USE_LIBPSL=OFF -DCURL_USE_LIBSSH2=OFF -DCURL_ZSTD=OFF -DCURL_BROTLI=OFF -DUSE_NGHTTP2=OFF -DCURL_DISABLE_LDAP=ON -DBUILD_TESTING=OFF -DBUILD_SHARED_LIBS=OFF -DBUILD_STATIC_LIBS=ON -DBUILD_CURL_EXE=OFF -DBUILD_EXAMPLES=OFF -DBUILD_LIBCURL_DOCS=OFF -DBUILD_MISC_DOCS=OFF -DENABLE_CURL_MANUAL=OFF",
+              "cmake --build bench-out -j \"$JOBS\" --target libcurl_static",
+              "\"$CC\" -O2 -DCURL_STATICLIB -Iinclude \"$BENCH/curl-bench.c\" bench-out/lib/libcurl.a $(sed -n 's/^Libs.private: //p' bench-out/libcurl.pc) -o curl-bench"
+            ],
+            "command": "./curl-bench 10",
+            "repeat": 7
+          }
+        }
+      ]
+    },
+    {
+      "name": "cmark",
+      "url": "https://github.com/commonmark/cmark.git",
+      "sha": "6566d91bdb25898bd910f8bed2a3f18f4a05cf91",
+      "support": ["cmark/cmark_export.h", "cmark/cmark_version.h"],
+      "configs": [
+        {
+          "name": "cmark",
+          "heldOut": true,
+          "set": "fresh34",
+          "notes": "The CommonMark reference implementation: a tree of malloc'd nodes linked by parent, child and sibling pointers and freed iteratively, allocation through a cmark_mem table of function pointers, growable cmark_strbuf buffers, chunks pointing into the input, a re2c scanner, the inline parser's delimiter stack and bracket list, a reference map, an iterator and five renderers. The build is the project's CMake Release build (static library, the cmark executable and api_test, which has one C++ file built by CMake's default C++ compiler); the test is CTest: api_test, html_normalization and the spec, smart-punctuation and regression tests through the executable (5 tests; the spec tests need python3). The library tests (spectest_library, pathological, roundtrip, entity) exist only with BUILD_SHARED_LIBS, which is off by default on this platform, as in the milestone evaluation. The bench concatenates test/spec.txt 160 times (33 MB, in bench.build, from the pinned checkout) and renders it with --smart to HTML, XML, LaTeX, man and CommonMark into /dev/null (no output); its check compares the SHA-256 of the five renderings with a pinned value. The per-file compiles are the 20 src/*.c with support/cmark/cmark_export.h and cmark_version.h, which CMake generates, in C23 as CMake 3.21 and later build them.",
+          "compile": {
+            "files": ["src/*.c"],
+            "args": ["-std=c23", "-Isrc", "-I{support}", "-DCMARK_STATIC_DEFINE"]
+          },
+          "build": [
+            "cmake -S . -B out -DCMAKE_C_COMPILER=\"$CC\" -DCMAKE_BUILD_TYPE=Release",
+            "cmake --build out -j \"$JOBS\""
+          ],
+          "test": ["ctest --test-dir out --output-on-failure -j \"$JOBS\""],
+          "testTimeout": 1800,
+          "bench": {
+            "name": "cmark-spec-render",
+            "build": [
+              "cmake -S . -B bench-out -DCMAKE_C_COMPILER=\"$CC\" -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=OFF",
+              "cmake --build bench-out -j \"$JOBS\" --target cmark_exe",
+              "i=0; while [ $i -lt 160 ]; do cat test/spec.txt; i=$((i+1)); done > bench.md"
+            ],
+            "command": "for t in html xml latex man commonmark; do bench-out/src/cmark --smart -t $t bench.md > /dev/null || exit 1; done",
+            "check": "test \"$(for t in html xml latex man commonmark; do bench-out/src/cmark --smart -t $t bench.md; done | shasum -a 256 | cut -c1-64)\" = 9e0efde0132b65579bea7e2a0d4a3fae8f2f99dced288443eff65e866232e7c1",
+            "repeat": 7
+          }
+        }
+      ]
+    },
+    {
+      "name": "libgit2",
+      "url": "https://github.com/libgit2/libgit2.git",
+      "sha": "0551dfd4ad989b6a3d5683c0d4cf326c6efef929",
+      "support": ["libgit2/git2_features.h", "libgit2/experimental.h"],
+      "configs": [
+        {
+          "name": "libgit2",
+          "heldOut": true,
+          "set": "fresh34",
+          "notes": "The Git library: reference-counted objects in a cache, an object database with loose and pack backends reading packs through mmap'd windows, delta application, the index, tree and diff iterators, the refdb, diff and merge over xdiff, a utility layer of git_str buffers, vectors, pools and hash maps, allocation through a table of function pointers (git__malloc). Bundled code in this build: SHA-1 with collision detection, SHA-256, llhttp and xdiff; zlib is the system's (the SDK's) and regular expressions use the system's regcomp_l (the zlib and PCRE under deps/ are not built). The build is the project's CMake build with the milestone evaluation's options (no HTTPS, SSH, GSSAPI or NTLM; tests on): the library, the git2 CLI and the two clar runners. The test is util_tests (the utility layer, every test) and libgit2_tests over 38 suites selected with -s: core, date, delta, message, patch, path, object, odb, refs, index, diff, status, config, revwalk, pack, merge, apply, blame, commit, describe, email, filter, graph, ignore, iterator, mailmap, notes, rebase, reset, revert, cherrypick, stash, attr, repo, grafts, fetchhead, remote and threads (about 2,500 tests, 70-90 s at the reference, most of it in the kernel copying fixtures); clar exits non-zero on any failure. Left out: online (the network); checkout, whose checkout::icase::overwrites_links_for_folders_when_forced fails with the reference compiler too (macOS's case-insensitive file system); clone (76 s, mostly waiting), network, submodule and worktree (slow and file-system bound); stress and perf (60 s and 5 s of load tests); and the empty or Windows-only win32, trace, stream, transport and transports. The bench (test/corpus/bench/libgit2-bench.c) links the static library, built without tests or CLI, and builds a 1,500-commit history in memory (a mempack-only object database and an empty configuration, so no file system and no user configuration): each commit edits two of eight generated files, writes blobs, a tree and a commit, renders each edit's patch (git_patch_from_buffers) and merges it three-way with an unrelated edit (git_merge_file); then a revision walk diffs every commit against its parent with stats. Its time is mostly xdiff and SHA-1; it prints one checksum line. The per-file compiles are 45 sources of src/util, src/libgit2, deps/xdiff and deps/llhttp with support/libgit2/git2_features.h and experimental.h, which CMake generates, in C90 as the build compiles them.",
+          "compile": {
+            "files": ["src/util/alloc.c", "src/util/date.c", "src/util/errors.c", "src/util/filebuf.c", "src/util/fs_path.c", "src/util/futils.c", "src/util/pool.c", "src/util/pqueue.c", "src/util/str.c", "src/util/strlist.c", "src/util/tsort.c", "src/util/utf8.c", "src/util/varint.c", "src/util/vector.c", "src/util/zstream.c", "src/libgit2/buf.c", "src/libgit2/cache.c", "src/libgit2/commit.c", "src/libgit2/commit_list.c", "src/libgit2/config.c", "src/libgit2/config_file.c", "src/libgit2/config_parse.c", "src/libgit2/delta.c", "src/libgit2/diff.c", "src/libgit2/diff_generate.c", "src/libgit2/diff_tform.c", "src/libgit2/index.c", "src/libgit2/index_map.c", "src/libgit2/iterator.c", "src/libgit2/merge.c", "src/libgit2/mwindow.c", "src/libgit2/object.c", "src/libgit2/odb.c", "src/libgit2/odb_loose.c", "src/libgit2/odb_pack.c", "src/libgit2/oid.c", "src/libgit2/pack.c", "src/libgit2/refdb_fs.c", "src/libgit2/refs.c", "src/libgit2/revwalk.c", "src/libgit2/status.c", "src/libgit2/tree.c", "deps/xdiff/xdiffi.c", "deps/xdiff/xprepare.c", "deps/llhttp/llhttp.c"],
+            "args": ["-std=c90", "-D_GNU_SOURCE", "-D_FILE_OFFSET_BITS=64", "-Isrc/libgit2", "-Isrc/util", "-Iinclude", "-I{support}", "-Ideps/llhttp", "-Ideps/xdiff", "-Ideps/reftable"]
+          },
+          "build": [
+            "cmake -S . -B out -DCMAKE_C_COMPILER=\"$CC\" -DCMAKE_BUILD_TYPE=Release -DUSE_HTTPS=OFF -DUSE_SSH=OFF -DUSE_GSSAPI=OFF -DUSE_NTLMCLIENT=OFF -DBUILD_TESTS=ON",
+            "cmake --build out -j \"$JOBS\""
+          ],
+          "test": [
+            "out/util_tests",
+            "out/libgit2_tests -score -sdate -sdelta -smessage -spatch -spath -sobject -sodb -srefs -sindex -sdiff -sstatus -sconfig -srevwalk -spack -smerge -sapply -sblame -scommit -sdescribe -semail -sfilter -sgraph -signore -siterator -smailmap -snotes -srebase -sreset -srevert -scherrypick -sstash -sattr -srepo -sgrafts -sfetchhead -sremote -sthreads"
+          ],
+          "testTimeout": 1800,
+          "bench": {
+            "name": "libgit2-history",
+            "build": [
+              "cmake -S . -B bench-out -DCMAKE_C_COMPILER=\"$CC\" -DCMAKE_BUILD_TYPE=Release -DUSE_HTTPS=OFF -DUSE_SSH=OFF -DUSE_GSSAPI=OFF -DUSE_NTLMCLIENT=OFF -DBUILD_TESTS=OFF -DBUILD_CLI=OFF -DBUILD_EXAMPLES=OFF -DBUILD_SHARED_LIBS=OFF",
+              "cmake --build bench-out -j \"$JOBS\"",
+              "\"$CC\" -O2 -Ibench-out/include \"$BENCH/libgit2-bench.c\" bench-out/libgit2.a $(sed -n 's/^Libs.private: //p' bench-out/libgit2.pc) -o libgit2-bench"
+            ],
+            "command": "./libgit2-bench 1500",
+            "repeat": 7
+          }
+        }
+      ]
+    },
+    {
+      "name": "libjpeg-turbo",
+      "url": "https://github.com/libjpeg-turbo/libjpeg-turbo.git",
+      "sha": "da20b14ff0db8785a0cabb2b8a71b5dc033d4006",
+      "support": ["libjpeg-turbo/jconfig.h", "libjpeg-turbo/jconfigint.h", "libjpeg-turbo/jversion.h"],
+      "configs": [
+        {
+          "name": "libjpeg-turbo",
+          "heldOut": true,
+          "set": "sealed34",
+          "notes": "SEALED (RFC 0034, section 9): built with the reference compiler only until gate F2. The JPEG codec behind libjpeg and the TurboJPEG API: a pool allocator (jmemmgr) handing out small objects and 2-D sample arrays (row pointer tables over one large block), method tables of function pointers in every module, virtual sample arrays, 8/12/16-bit sample code compiled three times from the same sources through src/wrapper/*-N.c, Huffman bit buffers over caller buffers, longjmp error recovery in TurboJPEG, NEON SIMD on arm64. The build is the project's CMake build in Release with its defaults: static and shared libraries (the tests run both), TurboJPEG, the tools and the tests, and the SIMD extensions on (on arm64 they are NEON intrinsics and GAS assembly, which the compiler builds without nasm). The test is CTest (664 tests: the cjpeg/djpeg/jpegtran MD5 comparisons over testimages/, tjunittest, the examples). The per-file compiles use the three headers CMake generates (jconfig.h, jconfigint.h, jversion.h) from support/libjpeg-turbo; they cover the format-independent sources and the 8-bit wrappers of the rest.",
+          "compile": {
+            "files": ["src/jcapimin.c", "src/jchuff.c", "src/jcicc.c", "src/jcinit.c", "src/jclhuff.c", "src/jcmarker.c", "src/jcmaster.c", "src/jcomapi.c", "src/jcparam.c", "src/jcphuff.c", "src/jctrans.c", "src/jdapimin.c", "src/jdatadst.c", "src/jdatasrc.c", "src/jdhuff.c", "src/jdicc.c", "src/jdinput.c", "src/jdlhuff.c", "src/jdmarker.c", "src/jdmaster.c", "src/jdphuff.c", "src/jdtrans.c", "src/jerror.c", "src/jfdctflt.c", "src/jmemmgr.c", "src/jmemnobs.c", "src/jpeg_nbits.c", "src/jaricom.c", "src/jcarith.c", "src/jdarith.c", "src/turbojpeg.c", "src/transupp.c", "src/wrapper/jccolor-8.c", "src/wrapper/jcsample-8.c", "src/wrapper/jdcolor-8.c", "src/wrapper/jdsample-8.c", "src/wrapper/jdmerge-8.c", "src/wrapper/jidctint-8.c", "src/wrapper/jfdctint-8.c", "src/wrapper/jquant1-8.c", "src/wrapper/jquant2-8.c", "src/wrapper/jdcoefct-8.c", "src/wrapper/jccoefct-8.c", "src/wrapper/jdmainct-8.c", "src/wrapper/jutils-8.c"],
+            "args": ["-Isrc", "-I{support}"]
+          },
+          "build": [
+            "cmake -S . -B out -DCMAKE_C_COMPILER=\"$CC\" -DCMAKE_BUILD_TYPE=Release -DENABLE_SHARED=ON -DENABLE_STATIC=ON -DWITH_TESTS=ON",
+            "cmake --build out -j \"$JOBS\""
+          ],
+          "test": ["ctest --test-dir out --output-on-failure -j \"$JOBS\""],
+          "testTimeout": 1800
+        }
+      ]
+    },
+    {
+      "name": "opus",
+      "url": "https://github.com/xiph/opus.git",
+      "sha": "503d81b138d76621aae4b12786e90de48aa8db3a",
+      "support": ["opus/config.h"],
+      "configs": [
+        {
+          "name": "opus",
+          "heldOut": true,
+          "set": "sealed34",
+          "notes": "SEALED (RFC 0034, section 9): built with the reference compiler only until gate F2. The Opus audio codec (SILK + CELT): encoder and decoder states laid out as one allocation with the sub-codec states at computed offsets (opus_decoder_get_size, align()), variable-length stack arrays (VAR_ARRAYS) and a range coder over caller buffers, multistream and projection wrappers carving several codec states out of one block, packet parsing and repacketizing with extension padding, float and fixed-point DSP with NEON intrinsics on arm64. The build is the project's CMake build in Release with OPUS_BUILD_TESTING (static library, the five test programs); the deep-learning features (DRED, OSCE, which need downloaded model weights) are off, as they are by default, and so are the programs, which no test uses. The test is CTest (test_opus_api, _decode, _encode, _padding, _extensions) with SEED=1: left alone the decode, encode and extensions tests take their random seed from the time. The per-file compiles use the definitions of the CMake build and its config.h (support/opus, only PACKAGE_VERSION).",
+          "compile": {
+            "files": ["src/opus.c", "src/opus_decoder.c", "src/opus_encoder.c", "src/extensions.c", "src/opus_multistream.c", "src/opus_multistream_decoder.c", "src/opus_multistream_encoder.c", "src/opus_projection_decoder.c", "src/opus_projection_encoder.c", "src/mapping_matrix.c", "src/repacketizer.c", "src/analysis.c", "src/mlp.c", "celt/bands.c", "celt/celt.c", "celt/celt_decoder.c", "celt/celt_encoder.c", "celt/celt_lpc.c", "celt/cwrs.c", "celt/entdec.c", "celt/entenc.c", "celt/kiss_fft.c", "celt/laplace.c", "celt/mathops.c", "celt/mdct.c", "celt/modes.c", "celt/pitch.c", "celt/quant_bands.c", "celt/rate.c", "celt/vq.c", "silk/dec_API.c", "silk/enc_API.c", "silk/NSQ.c", "silk/NSQ_del_dec.c", "silk/PLC.c", "silk/decode_frame.c", "silk/resampler.c", "silk/resampler_private_IIR_FIR.c", "silk/VAD.c", "silk/NLSF_encode.c", "silk/NLSF_del_dec_quant.c", "silk/stereo_LR_to_MS.c", "silk/float/encode_frame_FLP.c", "silk/float/pitch_analysis_core_FLP.c", "silk/float/noise_shape_analysis_FLP.c"],
+            "args": ["-std=gnu99", "-I{support}", "-Iinclude", "-I.", "-Icelt", "-Isilk", "-Isilk/float", "-Idnn", "-DHAVE_CONFIG_H", "-DOPUS_BUILD", "-DVAR_ARRAYS", "-DHAVE_LRINT", "-DHAVE_LRINTF", "-DHAVE_ALLOCA_H", "-DENABLE_HARDENING", "-DDISABLE_DEBUG_FLOAT", "-DOPUS_ARM_MAY_HAVE_NEON", "-DOPUS_ARM_MAY_HAVE_NEON_INTR", "-DOPUS_WILL_BE_SLOW"]
+          },
+          "build": [
+            "cmake -S . -B out -DCMAKE_C_COMPILER=\"$CC\" -DCMAKE_BUILD_TYPE=Release -DOPUS_BUILD_TESTING=ON -DOPUS_BUILD_PROGRAMS=OFF -DOPUS_DRED=OFF -DOPUS_OSCE=OFF",
+            "cmake --build out -j \"$JOBS\""
+          ],
+          "test": ["SEED=1 ctest --test-dir out --output-on-failure -j \"$JOBS\""],
+          "testTimeout": 1800
+        }
+      ]
+    },
+    {
+      "name": "flac",
+      "url": "https://github.com/xiph/flac.git",
+      "sha": "e94ff9f68b8e7dbd3e9f8b1ac18a8eca1914f181",
+      "support": ["flac/config.h"],
+      "configs": [
+        {
+          "name": "flac",
+          "heldOut": true,
+          "set": "sealed34",
+          "notes": "SEALED (RFC 0034, section 9): built with the reference compiler only until gate F2. The Free Lossless Audio Codec: a bit reader and writer over growable word buffers, encoder and decoder objects with private structs behind opaque handles and per-channel buffers allocated with padding for the LPC and residual code, metadata blocks as owned trees (Vorbis comments, cue sheets, pictures, seek tables) copied, resized and freed by metadata_object.c, a metadata chain editor over files, multithreaded encoding, NEON LPC on arm64. The build is the project's CMake build in Release without Ogg, the C++ libraries, the docs and the man pages, with the tests, the programs (flac, metaflac) and the examples. The first step pins the random seeds of the two test programs that seed random() from gettimeofday (test_streams, which generates the noise streams, and test_seeking, which picks random seek targets) to 1, in the copy only, so that every run sees the same data. The test is CTest without its streams test (libFLAC, grabbag, generate_streams, flac, metaflac, replaygain, seeking, compression), then the streams script run directly at FLAC__TEST_LEVEL=0 (about 1200 encode, decode and compare round trips): CTest sets level 1, at which it alone takes 300 s with the reference compiler. The per-file compiles use the CMake build's config.h (support/flac).",
+          "compile": {
+            "files": ["src/libFLAC/bitmath.c", "src/libFLAC/bitreader.c", "src/libFLAC/bitwriter.c", "src/libFLAC/cpu.c", "src/libFLAC/crc.c", "src/libFLAC/fixed.c", "src/libFLAC/float.c", "src/libFLAC/format.c", "src/libFLAC/lpc.c", "src/libFLAC/lpc_intrin_neon.c", "src/libFLAC/md5.c", "src/libFLAC/memory.c", "src/libFLAC/metadata_iterators.c", "src/libFLAC/metadata_object.c", "src/libFLAC/stream_decoder.c", "src/libFLAC/stream_encoder.c", "src/libFLAC/stream_encoder_framing.c", "src/libFLAC/window.c", "src/flac/analyze.c", "src/flac/decode.c", "src/flac/encode.c", "src/flac/foreign_metadata.c", "src/flac/iffscan.c", "src/flac/utils.c", "src/flac/vorbiscomment.c", "src/metaflac/operations.c", "src/metaflac/operations_shorthand_cuesheet.c", "src/metaflac/operations_shorthand_picture.c", "src/metaflac/operations_shorthand_seektable.c", "src/metaflac/operations_shorthand_vorbiscomment.c", "src/metaflac/options.c", "src/metaflac/utils.c", "src/share/grabbag/alloc.c", "src/share/grabbag/cuesheet.c", "src/share/grabbag/file.c", "src/share/grabbag/picture.c", "src/share/grabbag/replaygain.c", "src/share/grabbag/seektable.c", "src/share/replaygain_analysis/replaygain_analysis.c", "src/share/replaygain_synthesis/replaygain_synthesis.c", "src/share/utf8/utf8.c", "src/share/utf8/charset.c"],
+            "args": ["-I{support}", "-Iinclude", "-Isrc/libFLAC/include", "-DHAVE_CONFIG_H", "-DFLAC__NO_DLL", "-D_DARWIN_C_SOURCE"]
+          },
+          "build": [
+            "perl -pi -e 's/srandom\\(tv\\.tv_usec\\)/srandom(1)/' src/test_streams/main.c src/test_seeking/main.c && grep -q 'srandom(1)' src/test_streams/main.c && grep -q 'srandom(1)' src/test_seeking/main.c",
+            "cmake -S . -B out -DCMAKE_C_COMPILER=\"$CC\" -DCMAKE_BUILD_TYPE=Release -DWITH_OGG=OFF -DBUILD_CXXLIBS=OFF -DBUILD_DOCS=OFF -DINSTALL_MANPAGES=OFF -DBUILD_TESTING=ON",
+            "cmake --build out -j \"$JOBS\""
+          ],
+          "test": [
+            "ctest --test-dir out --output-on-failure -j \"$JOBS\" -E '^streams$'",
+            "cd out/test && FLAC__TEST_LEVEL=0 ECHO_C='\\c' ../../test/test_streams.sh"
+          ],
+          "testTimeout": 1800
+        }
+      ]
+    },
+    {
+      "name": "giflib",
+      "url": "https://git.code.sf.net/p/giflib/code",
+      "sha": "a8e3114a81f0987a61d06a41c99fd7cc2d58232c",
+      "support": ["giflib/run-tests.sh"],
+      "configs": [
+        {
+          "name": "giflib",
+          "heldOut": true,
+          "set": "sealed34",
+          "notes": "SEALED (RFC 0034, section 9): built with the reference compiler only until gate F2. GIFLIB, the GIF reader and writer: decoder and encoder state behind a GifFileType handle with a private struct, an LZW decoder and encoder with a hash table and a prefix stack, saved images as arrays of structs with owned color maps, extension blocks and raster buffers grown with reallocarray, I/O through read and write callbacks, color quantization; the utilities copy, filter, dump and build GIFs. The checkout is the canonical SourceForge repository. The build is the top-level Makefile's static library and its 14 utilities: its default target also builds libutil.dylib, which does not link on Darwin (qprintf.o needs GifErrorString from libgif) with the reference compiler, and nothing uses the shared libraries. The test is support/giflib/run-tests.sh: tests/makefile's regression targets (51 TAP checks of the utilities against recorded dumps, colormaps and RGB files) through tapview, as `make check` does, with giffix-regress run by the script itself with a portable `head -c`, because the makefile uses GNU head's `--bytes=-20`, which BSD head rejects. The per-file compiles cover every C file of the top directory (library, getarg/qprintf and the utilities).",
+          "compile": {
+            "files": ["*.c"],
+            "args": ["-std=gnu99", "-I."]
+          },
+          "build": ["make -j\"$JOBS\" CC=\"$CC\" static-lib gifbuild giffix giftext giftool gifclrmp gifbg gifcolor gifecho giffilter gifhisto gifinto gifsponge gifwedge gif2rgb"],
+          "test": ["sh \"$SUPPORT/run-tests.sh\""],
+          "testTimeout": 1800
+        }
+      ]
+    },
+    {
+      "name": "wren",
+      "url": "https://github.com/wren-lang/wren.git",
+      "sha": "99d2f0b8fc2686134b32b18166e037639f7e9f2c",
+      "support": [],
+      "configs": [
+        {
+          "name": "wren",
+          "heldOut": true,
+          "set": "sealed34",
+          "notes": "SEALED (RFC 0034, section 9): built with the reference compiler only until gate F2. Wren, a small class-based scripting language: a single-pass compiler emitting bytecode into growable buffers, a stack VM over NaN-tagged values (doubles and object pointers packed in 64 bits), fibers with their own growable stacks and call frames (pointers into the stack rebased when it moves), a mark-and-sweep collector over an intrusive object list with a gray stack, strings, lists, maps (open addressing) and ranges as flexible objects, foreign objects with user data, and the embedding API's slots and handles. The build is projects/make.mac's release_64bit configuration (libwren.a and .dylib, bin/wren_test); the test is util/test.py, which runs bin/wren_test over test/ (866 scripts with their expected output, errors and exit codes, the API tests in C included) and exits non-zero on any failure. The per-file compiles cover the VM, the optional modules and the test host.",
+          "compile": {
+            "files": ["src/vm/*.c", "src/optional/*.c", "test/*.c", "test/api/*.c"],
+            "args": ["-std=c99", "-DNDEBUG", "-Isrc/include", "-Isrc/vm", "-Isrc/optional"]
+          },
+          "build": ["make -C projects/make.mac -j\"$JOBS\" CC=\"$CC\" config=release_64bit"],
+          "test": ["python3 util/test.py"],
+          "testTimeout": 1800
+        }
+      ]
     }
   ]
 }
diff --git a/test/corpus/support/cmark/cmark_export.h b/test/corpus/support/cmark/cmark_export.h
new file mode 100644
index 00000000..87b3f33a
--- /dev/null
+++ b/test/corpus/support/cmark/cmark_export.h
@@ -0,0 +1,42 @@
+
+#ifndef CMARK_EXPORT_H
+#define CMARK_EXPORT_H
+
+#ifdef CMARK_STATIC_DEFINE
+#  define CMARK_EXPORT
+#  define CMARK_NO_EXPORT
+#else
+#  ifndef CMARK_EXPORT
+#    ifdef cmark_EXPORTS
+        /* We are building this library */
+#      define CMARK_EXPORT 
+#    else
+        /* We are using this library */
+#      define CMARK_EXPORT 
+#    endif
+#  endif
+
+#  ifndef CMARK_NO_EXPORT
+#    define CMARK_NO_EXPORT 
+#  endif
+#endif
+
+#ifndef CMARK_DEPRECATED
+#  define CMARK_DEPRECATED __attribute__ ((__deprecated__))
+#endif
+
+#ifndef CMARK_DEPRECATED_EXPORT
+#  define CMARK_DEPRECATED_EXPORT CMARK_EXPORT CMARK_DEPRECATED
+#endif
+
+#ifndef CMARK_DEPRECATED_NO_EXPORT
+#  define CMARK_DEPRECATED_NO_EXPORT CMARK_NO_EXPORT CMARK_DEPRECATED
+#endif
+
+#if 0 /* DEFINE_NO_DEPRECATED */
+#  ifndef CMARK_NO_DEPRECATED
+#    define CMARK_NO_DEPRECATED
+#  endif
+#endif
+
+#endif /* CMARK_EXPORT_H */
diff --git a/test/corpus/support/cmark/cmark_version.h b/test/corpus/support/cmark/cmark_version.h
new file mode 100644
index 00000000..ddb895ad
--- /dev/null
+++ b/test/corpus/support/cmark/cmark_version.h
@@ -0,0 +1,7 @@
+#ifndef CMARK_VERSION_H
+#define CMARK_VERSION_H
+
+#define CMARK_VERSION ((0 << 16) | (31 << 8)  | 2)
+#define CMARK_VERSION_STRING "0.31.2"
+
+#endif
diff --git a/test/corpus/support/curl/curl_config.h b/test/corpus/support/curl/curl_config.h
new file mode 100644
index 00000000..3154bb8a
--- /dev/null
+++ b/test/corpus/support/curl/curl_config.h
@@ -0,0 +1,793 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+/* Location of default CA bundle */
+/* #undef CURL_CA_BUNDLE */
+
+/* define "1" to use built-in CA store of TLS backend */
+/* #undef CURL_CA_FALLBACK */
+
+/* Location of default CA path */
+/* #undef CURL_CA_PATH */
+
+/* Default SSL backend */
+/* #undef CURL_DEFAULT_SSL_BACKEND */
+
+/* Use native CA store */
+/* #undef CURL_CA_NATIVE */
+
+/* disables alt-svc */
+/* #undef CURL_DISABLE_ALTSVC */
+
+/* disables cookies support */
+/* #undef CURL_DISABLE_COOKIES */
+
+/* disables Basic authentication */
+/* #undef CURL_DISABLE_BASIC_AUTH */
+
+/* disables Bearer authentication */
+/* #undef CURL_DISABLE_BEARER_AUTH */
+
+/* disables Digest authentication */
+/* #undef CURL_DISABLE_DIGEST_AUTH */
+
+/* disables Kerberos authentication */
+/* #undef CURL_DISABLE_KERBEROS_AUTH */
+
+/* disables negotiate authentication */
+/* #undef CURL_DISABLE_NEGOTIATE_AUTH */
+
+/* disables aws-sigv4 */
+/* #undef CURL_DISABLE_AWS */
+
+/* disables HTTP Message Signatures (RFC 9421) */
+#define CURL_DISABLE_HTTPSIG 1
+
+/* disables DICT */
+/* #undef CURL_DISABLE_DICT */
+
+/* disables DNS-over-HTTPS */
+/* #undef CURL_DISABLE_DOH */
+
+/* disables FILE */
+/* #undef CURL_DISABLE_FILE */
+
+/* disables form api */
+/* #undef CURL_DISABLE_FORM_API */
+
+/* disables FTP */
+/* #undef CURL_DISABLE_FTP */
+
+/* disables curl_easy_options API for existing options to curl_easy_setopt */
+/* #undef CURL_DISABLE_GETOPTIONS */
+
+/* disables GOPHER */
+/* #undef CURL_DISABLE_GOPHER */
+
+/* disables headers-api support */
+/* #undef CURL_DISABLE_HEADERS_API */
+
+/* disables HSTS support */
+#define CURL_DISABLE_HSTS 1
+
+/* disables HTTP */
+/* #undef CURL_DISABLE_HTTP */
+
+/* disabled all HTTP authentication methods */
+/* #undef CURL_DISABLE_HTTP_AUTH */
+
+/* disables IMAP */
+/* #undef CURL_DISABLE_IMAP */
+
+/* disables LDAP */
+#define CURL_DISABLE_LDAP 1
+
+/* disables LDAPS */
+#define CURL_DISABLE_LDAPS 1
+
+/* disables --libcurl option from the curl tool */
+/* #undef CURL_DISABLE_LIBCURL_OPTION */
+
+/* disables MIME support */
+/* #undef CURL_DISABLE_MIME */
+
+/* disables local binding support */
+/* #undef CURL_DISABLE_BINDLOCAL */
+
+/* disables MQTT */
+/* #undef CURL_DISABLE_MQTT */
+
+/* disables netrc parser */
+/* #undef CURL_DISABLE_NETRC */
+
+/* enables NTLM support */
+/* #undef CURL_ENABLE_NTLM */
+
+/* disables date parsing */
+/* #undef CURL_DISABLE_PARSEDATE */
+
+/* disables POP3 */
+/* #undef CURL_DISABLE_POP3 */
+
+/* disables built-in progress meter */
+/* #undef CURL_DISABLE_PROGRESS_METER */
+
+/* disables proxies */
+/* #undef CURL_DISABLE_PROXY */
+
+/* disables IPFS from the curl tool */
+/* #undef CURL_DISABLE_IPFS */
+
+/* disables RTSP */
+/* #undef CURL_DISABLE_RTSP */
+
+/* disables SHA-512/256 hash algorithm */
+/* #undef CURL_DISABLE_SHA512_256 */
+
+/* disabled shuffle DNS feature */
+/* #undef CURL_DISABLE_SHUFFLE_DNS */
+
+/* disables SMTP */
+/* #undef CURL_DISABLE_SMTP */
+
+/* disabled WebSocket */
+/* #undef CURL_DISABLE_WEBSOCKETS */
+
+/* disables use of socketpair for curl_multi_poll() */
+/* #undef CURL_DISABLE_SOCKETPAIR */
+
+/* disables TELNET */
+/* #undef CURL_DISABLE_TELNET */
+
+/* disables TFTP */
+/* #undef CURL_DISABLE_TFTP */
+
+/* disables verbose strings */
+/* #undef CURL_DISABLE_VERBOSE_STRINGS */
+
+/* disables unsafe CA bundle search on Windows from the curl tool */
+/* #undef CURL_DISABLE_CA_SEARCH */
+
+/* safe CA bundle search (within the curl tool directory) on Windows */
+/* #undef CURL_CA_SEARCH_SAFE */
+
+/* to make a symbol visible */
+#define CURL_EXTERN_SYMBOL __attribute__((__visibility__("default")))
+/* Ensure using CURL_EXTERN_SYMBOL is possible */
+#ifndef CURL_EXTERN_SYMBOL
+#define CURL_EXTERN_SYMBOL
+#endif
+
+/* Allow SMB to work on Windows */
+/* #undef USE_WIN32_CRYPTO */
+
+/* Use Windows LDAP implementation */
+/* #undef USE_WIN32_LDAP */
+
+/* Define if you want to enable IPv6 support */
+#define USE_IPV6 1
+
+/* Define to 1 if you have the alarm function. */
+#define HAVE_ALARM 1
+
+/* Define to 1 if you have the arc4random function. */
+#define HAVE_ARC4RANDOM 1
+
+/* Define to 1 if you have the <arpa/inet.h> header file. */
+#define HAVE_ARPA_INET_H 1
+
+/* Define to 1 if you have _Atomic support. */
+#define HAVE_ATOMIC 1
+
+/* Define to 1 if you have the `accept4' function. */
+/* #undef HAVE_ACCEPT4 */
+
+/* Define to 1 if you have the `fchmod' function. */
+#define HAVE_FCHMOD 1
+
+/* Define to 1 if you have the `fnmatch' function. */
+#define HAVE_FNMATCH 1
+
+/* Define to 1 if you have the `basename' function. */
+#define HAVE_BASENAME 1
+
+/* Define to 1 if bool is an available type. */
+#define HAVE_BOOL_T 1
+
+/* Define to 1 if you have the __builtin_available function. */
+#define HAVE_BUILTIN_AVAILABLE 1
+
+/* Define to 1 if you have the clock_gettime function and monotonic timer. */
+#define HAVE_CLOCK_GETTIME_MONOTONIC 1
+
+/* Define to 1 if you have the clock_gettime function and raw monotonic timer.
+   */
+#define HAVE_CLOCK_GETTIME_MONOTONIC_RAW 1
+
+/* Define to 1 if you have the `closesocket' function. */
+/* #undef HAVE_CLOSESOCKET */
+
+/* Define to 1 if you have the `CloseSocket' function. */
+/* #undef HAVE_CLOSESOCKET_CAMEL */
+
+/* Define to 1 if you have the <dirent.h> header file. */
+#define HAVE_DIRENT_H 1
+
+/* Define to 1 if you have the `opendir' function. */
+#define HAVE_OPENDIR 1
+
+/* Define to 1 if you have the memset_explicit (C23) function. */
+/* #undef HAVE_MEMSET_EXPLICIT */
+
+/* Define to 1 if you have the memset_s (C11) function. */
+#define HAVE_MEMSET_S 1
+
+/* Define to 1 if you have the fcntl function. */
+#define HAVE_FCNTL 1
+
+/* Define to 1 if you have the <fcntl.h> header file. */
+#define HAVE_FCNTL_H 1
+
+/* Define to 1 if you have a working fcntl O_NONBLOCK function. */
+#define HAVE_FCNTL_O_NONBLOCK 1
+
+/* Define to 1 if you have the freeaddrinfo function. */
+#define HAVE_FREEADDRINFO 1
+
+/* Define to 1 if you have the fseeko function. */
+#define HAVE_FSEEKO 1
+
+/* Define to 1 if you have the fseeko declaration. */
+#define HAVE_DECL_FSEEKO 1
+
+/* Define to 1 if you have a working getaddrinfo function. */
+#define HAVE_GETADDRINFO 1
+
+/* Define to 1 if the getaddrinfo function is thread-safe. */
+#define HAVE_GETADDRINFO_THREADSAFE 1
+
+/* Define to 1 if you have the `geteuid' function. */
+#define HAVE_GETEUID 1
+
+/* Define to 1 if you have the `getppid' function. */
+#define HAVE_GETPPID 1
+
+/* Define to 1 if you have the gethostbyname_r function. */
+/* #undef HAVE_GETHOSTBYNAME_R */
+
+/* gethostbyname_r() takes 3 args */
+/* #undef HAVE_GETHOSTBYNAME_R_3 */
+
+/* gethostbyname_r() takes 5 args */
+/* #undef HAVE_GETHOSTBYNAME_R_5 */
+
+/* gethostbyname_r() takes 6 args */
+/* #undef HAVE_GETHOSTBYNAME_R_6 */
+
+/* Define to 1 if you have the gethostname function. */
+#define HAVE_GETHOSTNAME 1
+
+/* Define to 1 if you have a working getifaddrs function. */
+#define HAVE_GETIFADDRS 1
+
+/* Define to 1 if you have the `getpass_r' function. */
+/* #undef HAVE_GETPASS_R */
+
+/* Define to 1 if you have the `getpeername' function. */
+#define HAVE_GETPEERNAME 1
+
+/* Define to 1 if you have the `getsockname' function. */
+#define HAVE_GETSOCKNAME 1
+
+/* Define to 1 if you have the `if_nametoindex' function. */
+#define HAVE_IF_NAMETOINDEX 1
+
+/* Define to 1 if you have the `getpwuid' function. */
+#define HAVE_GETPWUID 1
+
+/* Define to 1 if you have the `getpwuid_r' function. */
+#define HAVE_GETPWUID_R 1
+
+/* Define to 1 if you have the `getrlimit' function. */
+#define HAVE_GETRLIMIT 1
+
+/* Define to 1 if you have the `gettimeofday' function. */
+#define HAVE_GETTIMEOFDAY 1
+
+/* Define to 1 if you have a working glibc-style strerror_r function. */
+/* #undef HAVE_GLIBC_STRERROR_R */
+
+/* Define to 1 if you have a working gmtime_r function. */
+#define HAVE_GMTIME_R 1
+
+/* if you have the gssapi libraries */
+/* #undef HAVE_GSSAPI */
+
+/* if you have Apple GSS */
+/* #undef HAVE_GSSAPPLE */
+
+/* if you have the GNU gssapi libraries */
+/* #undef HAVE_GSSGNU */
+
+/* if you have gss_set_neg_mechs */
+/* #undef HAVE_GSS_SET_NEG_MECHS */
+
+/* MIT Kerberos version */
+/* #undef CURL_KRB5_VERSION */
+
+/* BoringSSL version */
+/* #undef CURL_BORINGSSL_VERSION */
+
+/* Patch stamp */
+/* #undef CURL_PATCHSTAMP */
+
+/* Define to 1 if you have the <ifaddrs.h> header file. */
+#define HAVE_IFADDRS_H 1
+
+/* Define to 1 if symbol `sa_family_t' exists */
+#define HAVE_SA_FAMILY_T 1
+
+/* Define to 1 if you have the ioctlsocket function. */
+/* #undef HAVE_IOCTLSOCKET */
+
+/* Define to 1 if you have the IoctlSocket camel case function. */
+/* #undef HAVE_IOCTLSOCKET_CAMEL */
+
+/* Define to 1 if you have a working IoctlSocket camel case FIONBIO function.
+ */
+/* #undef HAVE_IOCTLSOCKET_CAMEL_FIONBIO */
+
+/* Define to 1 if you have a working ioctlsocket FIONBIO function. */
+/* #undef HAVE_IOCTLSOCKET_FIONBIO */
+
+/* Define to 1 if you have a working ioctl FIONBIO function. */
+#define HAVE_IOCTL_FIONBIO 1
+
+/* Define to 1 if you have a working ioctl SIOCGIFADDR function. */
+#define HAVE_IOCTL_SIOCGIFADDR 1
+
+/* Define to 1 if you have the <io.h> header file. */
+/* #undef HAVE_IO_H */
+
+/* Define to 1 if you have the lber.h header file. */
+/* #undef HAVE_LBER_H */
+
+/* Use LDAPS implementation */
+/* #undef HAVE_LDAP_SSL */
+
+/* Define to 1 if you have the ldap_ssl.h header file. */
+/* #undef HAVE_LDAP_SSL_H */
+
+/* Define to 1 if you have the `ldap_url_parse' function. */
+/* #undef HAVE_LDAP_URL_PARSE */
+
+/* Define to 1 if you have the <libgen.h> header file. */
+#define HAVE_LIBGEN_H 1
+
+/* Define to 1 if you have the `idn2' library (-lidn2). */
+/* #undef HAVE_LIBIDN2 */
+
+/* Define to 1 if you have the idn2.h header file. */
+/* #undef HAVE_IDN2_H */
+
+/* if zlib is available */
+#define HAVE_LIBZ 1
+
+/* if brotli is available */
+/* #undef HAVE_BROTLI */
+
+/* if zstd is available */
+/* #undef HAVE_ZSTD */
+
+/* Define to 1 if you have the <locale.h> header file. */
+#define HAVE_LOCALE_H 1
+
+/* Define to 1 if you have a working localtime_r function. */
+#define HAVE_LOCALTIME_R 1
+
+/* Define to 1 if you have the 'suseconds_t' data type. */
+#define HAVE_SUSECONDS_T 1
+
+/* Define to 1 if you have the <netdb.h> header file. */
+#define HAVE_NETDB_H 1
+
+/* Define to 1 if you have the <netinet/in.h> header file. */
+#define HAVE_NETINET_IN_H 1
+
+/* Define to 1 if you have the <netinet/in6.h> header file. */
+/* #undef HAVE_NETINET_IN6_H */
+
+/* Define to 1 if you have the <netinet/tcp.h> header file. */
+#define HAVE_NETINET_TCP_H 1
+
+/* Define to 1 if you have the <netinet/udp.h> header file. */
+#define HAVE_NETINET_UDP_H 1
+
+/* Define to 1 if you have the <netinet/ip.h> header file. */
+#define HAVE_NETINET_IP_H 1
+
+/* Define to 1 if you have the <linux/tcp.h> header file. */
+/* #undef HAVE_LINUX_TCP_H */
+
+/* Define to 1 if you have the <net/if.h> header file. */
+#define HAVE_NET_IF_H 1
+
+/* Define to 1 if you have the `pipe' function. */
+#define HAVE_PIPE 1
+
+/* Define to 1 if you have the `pipe2' function. */
+/* #undef HAVE_PIPE2 */
+
+/* Define to 1 if you have the `eventfd' function. */
+/* #undef HAVE_EVENTFD */
+
+/* If you have poll */
+#define HAVE_POLL 1
+
+/* If you have realpath */
+#define HAVE_REALPATH 1
+
+/* Define to 1 if you have the <poll.h> header file. */
+#define HAVE_POLL_H 1
+
+/* Define to 1 if you have a working POSIX-style strerror_r function. */
+#define HAVE_POSIX_STRERROR_R 1
+
+/* Define to 1 if you have the <pwd.h> header file. */
+#define HAVE_PWD_H 1
+
+/* Define to 1 if OpenSSL has the `SSL_set0_wbio` function. */
+/* #undef HAVE_SSL_SET0_WBIO */
+
+/* Define to 1 if you have the recv function. */
+#define HAVE_RECV 1
+
+/* Define to 1 if you have the sched_yield function. */
+#define HAVE_SCHED_YIELD 1
+
+/* Define to 1 if you have the send function. */
+#define HAVE_SEND 1
+
+/* Define to 1 if you have the sendmsg function. */
+#define HAVE_SENDMSG 1
+
+/* Define to 1 if you have the sendmmsg function. */
+/* #undef HAVE_SENDMMSG */
+
+/* Define to 1 if you have the 'fsetxattr' function. */
+#define HAVE_FSETXATTR 1
+
+/* fsetxattr() takes 5 args */
+/* #undef HAVE_FSETXATTR_5 */
+
+/* fsetxattr() takes 6 args */
+#define HAVE_FSETXATTR_6 1
+
+/* Define to 1 if you have the `setlocale' function. */
+#define HAVE_SETLOCALE 1
+
+/* Define to 1 if you have the `setrlimit' function. */
+#define HAVE_SETRLIMIT 1
+
+/* Define to 1 if you have a working setsockopt SO_NONBLOCK function. */
+/* #undef HAVE_SETSOCKOPT_SO_NONBLOCK */
+
+/* Define to 1 if you have the sigaction function. */
+#define HAVE_SIGACTION 1
+
+/* Define to 1 if you have the siginterrupt function. */
+#define HAVE_SIGINTERRUPT 1
+
+/* Define to 1 if you have the signal function. */
+#define HAVE_SIGNAL 1
+
+/* Define to 1 if you have the sigsetjmp function or macro. */
+#define HAVE_SIGSETJMP 1
+
+/* Define to 1 if struct sockaddr_in6 has the sin6_scope_id member */
+#define HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID 1
+
+/* Define to 1 if you have the `socket' function. */
+#define HAVE_SOCKET 1
+
+/* Define to 1 if you have the <proto/bsdsocket.h> header file. */
+/* #undef HAVE_PROTO_BSDSOCKET_H */
+
+/* Define to 1 if you have the socketpair function. */
+#define HAVE_SOCKETPAIR 1
+
+/* Define to 1 if you have the <stdatomic.h> header file. */
+#define HAVE_STDATOMIC_H 1
+
+/* Define to 1 if you have the <stdbool.h> header file. */
+#define HAVE_STDBOOL_H 1
+
+/* Define to 1 if you have the strcasecmp function. */
+#define HAVE_STRCASECMP 1
+
+/* Define to 1 if you have the strcmpi function. */
+/* #undef HAVE_STRCMPI */
+
+/* Define to 1 if you have the strerror_r function. */
+#define HAVE_STRERROR_R 1
+
+/* Define to 1 if you have the stricmp function. */
+/* #undef HAVE_STRICMP */
+
+/* Define to 1 if you have the <strings.h> header file. */
+#define HAVE_STRINGS_H 1
+
+/* Define to 1 if you have the <stropts.h> header file. */
+/* #undef HAVE_STROPTS_H */
+
+/* Define to 1 if you have the memrchr function. */
+/* #undef HAVE_MEMRCHR */
+
+/* if struct sockaddr_storage is defined */
+#define HAVE_STRUCT_SOCKADDR_STORAGE 1
+
+/* Define to 1 if you have the timeval struct. */
+#define HAVE_STRUCT_TIMEVAL 1
+
+/* Define to 1 if you have the <sys/eventfd.h> header file. */
+/* #undef HAVE_SYS_EVENTFD_H */
+
+/* Define to 1 if you have the <sys/filio.h> header file. */
+#define HAVE_SYS_FILIO_H 1
+
+/* Define to 1 if you have the <sys/ioctl.h> header file. */
+#define HAVE_SYS_IOCTL_H 1
+
+/* Define to 1 if you have the <sys/param.h> header file. */
+#define HAVE_SYS_PARAM_H 1
+
+/* Define to 1 if you have the <sys/poll.h> header file. */
+#define HAVE_SYS_POLL_H 1
+
+/* Define to 1 if you have the <sys/resource.h> header file. */
+#define HAVE_SYS_RESOURCE_H 1
+
+/* Define to 1 if you have the <sys/select.h> header file. */
+#define HAVE_SYS_SELECT_H 1
+
+/* Define to 1 if you have the <sys/sockio.h> header file. */
+#define HAVE_SYS_SOCKIO_H 1
+
+/* Define to 1 if you have the <sys/types.h> header file. */
+#define HAVE_SYS_TYPES_H 1
+
+/* Define to 1 if you have the <sys/un.h> header file. */
+#define HAVE_SYS_UN_H 1
+
+/* Define to 1 if you have the <sys/utime.h> header file. */
+/* #undef HAVE_SYS_UTIME_H */
+
+/* Define to 1 if you have the <termios.h> header file. */
+#define HAVE_TERMIOS_H 1
+
+/* Define to 1 if you have the <termio.h> header file. */
+/* #undef HAVE_TERMIO_H */
+
+/* Define to 1 if you have the <unistd.h> header file. */
+#define HAVE_UNISTD_H 1
+
+/* Define to 1 if you have the `utime' function. */
+#define HAVE_UTIME 1
+
+/* Define to 1 if you have the `utimes' function. */
+#define HAVE_UTIMES 1
+
+/* Define to 1 if you have the <utime.h> header file. */
+#define HAVE_UTIME_H 1
+
+/* Define this symbol if your OS supports changing the contents of argv */
+#define HAVE_WRITABLE_ARGV 1
+
+/* Define this if time_t is unsigned */
+/* #undef HAVE_TIME_T_UNSIGNED */
+
+/* Define to 1 if _REENTRANT preprocessor symbol must be defined. */
+/* #undef NEED_REENTRANT */
+
+/* cpu-machine-OS */
+#define CURL_OS "Darwin"
+
+/* Note: SIZEOF_* variables are fetched with CMake through check_type_size().
+   As per CMake documentation on CheckTypeSize, C preprocessor code is
+   generated by CMake into SIZEOF_*_CODE. This is what we use in the
+   following statements.
+   Ref: https://cmake.org/cmake/help/latest/module/CheckTypeSize.html
+ */
+
+/* The size of `int', as computed by sizeof. */
+#define SIZEOF_INT 4
+
+/* The size of `long', as computed by sizeof. */
+#define SIZEOF_LONG 8
+
+/* The size of `off_t', as computed by sizeof. */
+#define SIZEOF_OFF_T 8
+
+/* The size of `curl_off_t', as computed by sizeof. */
+#define SIZEOF_CURL_OFF_T 8
+
+/* The size of `curl_socket_t', as computed by sizeof. */
+#define SIZEOF_CURL_SOCKET_T 4
+
+/* The size of `size_t', as computed by sizeof. */
+#define SIZEOF_SIZE_T 8
+
+/* The size of `time_t', as computed by sizeof. */
+#define SIZEOF_TIME_T 8
+
+/* Define if you have POSIX pthreads */
+#define HAVE_THREADS_POSIX 1
+
+/* Define if you want to enable c-ares support */
+/* #undef USE_ARES */
+
+/* Define if you want to enable c-ares DNS lookup */
+/* #undef USE_RESOLV_ARES */
+
+/* Define if you want to enable threaded DNS lookup */
+#define USE_RESOLV_THREADED 1
+
+/* if GnuTLS is enabled */
+/* #undef USE_GNUTLS */
+
+/* if SSL session export support is available */
+/* #undef USE_SSLS_EXPORT */
+
+/* if mbedTLS is enabled */
+/* #undef USE_MBEDTLS */
+
+/* if mbedTLS <4 has the mbedtls_des_crypt_ecb function. */
+/* #undef HAVE_MBEDTLS_DES_CRYPT_ECB */
+
+/* if Rustls is enabled */
+/* #undef USE_RUSTLS */
+
+/* if wolfSSL is enabled */
+/* #undef USE_WOLFSSL */
+
+/* if wolfSSL has the wolfSSL_get_peer_certificate function. */
+/* #undef HAVE_WOLFSSL_GET_PEER_CERTIFICATE */
+
+/* if wolfSSL has the wolfSSL_UseALPN function. */
+/* #undef HAVE_WOLFSSL_USEALPN */
+
+/* if wolfSSL has the wolfSSL_BIO_new function. */
+/* #undef HAVE_WOLFSSL_BIO_NEW */
+
+/* if wolfSSL has the wolfSSL_BIO_set_shutdown function. */
+/* #undef HAVE_WOLFSSL_BIO_SET_SHUTDOWN */
+
+/* if wolfSSL has the wc_Des_EcbEncrypt function. */
+/* #undef HAVE_WC_DES_ECBENCRYPT */
+
+/* if libssh is in use */
+/* #undef USE_LIBSSH */
+
+/* if libssh2 is in use */
+/* #undef USE_LIBSSH2 */
+
+/* if libpsl is in use */
+/* #undef USE_LIBPSL */
+
+/* if you want to use OpenLDAP code instead of legacy ldap implementation */
+/* #undef USE_OPENLDAP */
+
+/* if OpenSSL is in use */
+/* #undef USE_OPENSSL */
+
+/* if AmiSSL is in use */
+/* #undef USE_AMISSL */
+
+/* if GSASL is in use */
+/* #undef USE_GSASL */
+
+/* if libuv is in use */
+/* #undef USE_LIBUV */
+
+/* if HTTP/3 proxy support is available */
+/* #undef USE_PROXY_HTTP3 */
+
+/* Define to 1 if you have the <uv.h> header file. */
+/* #undef HAVE_UV_H */
+
+/* if libbacktrace is in use */
+/* #undef USE_BACKTRACE */
+
+/* Define to 1 if you do not want the OpenSSL configuration to be loaded
+   automatically */
+/* #undef CURL_DISABLE_OPENSSL_AUTO_LOAD_CONFIG */
+
+/* to enable NGHTTP2 */
+/* #undef USE_NGHTTP2 */
+
+/* to enable NGTCP2 */
+/* #undef USE_NGTCP2 */
+
+/* to enable NGHTTP3 */
+/* #undef USE_NGHTTP3 */
+
+/* to enable quiche */
+/* #undef USE_QUICHE */
+
+/* to enable openssl + ngtcp2 + nghttp3 */
+/* #undef OPENSSL_QUIC_API2 */
+
+/* Define to 1 if you have the quiche_conn_set_qlog_fd function. */
+/* #undef HAVE_QUICHE_CONN_SET_QLOG_FD */
+
+/* if Unix domain sockets are enabled */
+#define USE_UNIX_SOCKETS 1
+
+/* to enable SSPI support */
+/* #undef USE_WINDOWS_SSPI */
+
+/* to enable Windows SSL */
+/* #undef USE_SCHANNEL */
+
+/* if Watt-32 is in use */
+/* #undef USE_WATT32 */
+
+/* enable multiple SSL backends */
+/* #undef CURL_WITH_MULTI_SSL */
+
+/* Number of bits in a file offset, on hosts where this is settable. */
+#define _FILE_OFFSET_BITS 64
+
+/* the signed version of size_t */
+/* #undef ssize_t */
+
+/* Define to 1 if you have the mach_absolute_time function. */
+#define HAVE_MACH_ABSOLUTE_TIME 1
+
+/* to enable Windows IDN */
+/* #undef USE_WIN32_IDN */
+
+/* to enable Apple IDN */
+/* #undef USE_APPLE_IDN */
+
+/* to enable Apple OS-native certificate verification */
+/* #undef USE_APPLE_SECTRUST */
+
+/* to use Apple fast UDP (SYS_recvmsg_x, SYS_sendmsg_x) */
+/* #undef USE_APPLE_FAST_UDP */
+
+/* Define to 1 to query for HTTPSRR when using DoH */
+/* #undef USE_HTTPSRR */
+
+/* if ECH support is available */
+/* #undef USE_ECH */
+
+/* Define to 1 if you have the wolfSSL_CTX_GenerateEchConfig function. */
+/* #undef HAVE_WOLFSSL_CTX_GENERATEECHCONFIG */
+
+/* Define to 1 if you have the SSL_set1_ech_config_list function. */
+/* #undef HAVE_SSL_SET1_ECH_CONFIG_LIST */
+
+/* Define to 1 if OpenSSL has the DES_ecb_encrypt function. */
+/* #undef HAVE_DES_ECB_ENCRYPT */
diff --git a/test/corpus/support/flac/config.h b/test/corpus/support/flac/config.h
new file mode 100644
index 00000000..b21d58e3
--- /dev/null
+++ b/test/corpus/support/flac/config.h
@@ -0,0 +1,232 @@
+/* config.h.in.  Generated from configure.ac by autoheader.  */
+
+/* Define if building universal (internal helper macro) */
+/* #undef AC_APPLE_UNIVERSAL_BUILD */
+
+/* Target processor is big endian. */
+#define CPU_IS_BIG_ENDIAN 0
+
+/* Target processor ARM64 */
+#define FLAC__CPU_ARM64
+
+/* Set FLAC__BYTES_PER_WORD to 8 (4 is the default) */
+#define ENABLE_64_BIT_WORDS 1
+
+/* define to align allocated memory on 32-byte boundaries */
+/* #undef FLAC__ALIGN_MALLOC_DATA */
+
+/* define if you have docbook-to-man or docbook2man */
+/* #undef FLAC__HAS_DOCBOOK_TO_MAN */
+
+/* define if you have the ogg library */
+#define OGG_FOUND 0
+#define FLAC__HAS_OGG OGG_FOUND
+
+/* Set to 1 if <x86intrin.h> is available. */
+#define FLAC__HAS_X86INTRIN 0
+
+/* Set to 1 if <arm_neon.h> is available. */
+#define FLAC__HAS_NEONINTRIN 1
+
+/* Set to 1 if <arm_neon.h> contains A64 intrinsics */
+#define FLAC__HAS_A64NEONINTRIN 1
+
+/* define if building for Darwin / MacOS X */
+/* #undef FLAC__SYS_DARWIN */
+
+/* define if building for Linux */
+/* #undef FLAC__SYS_LINUX */
+
+/* define to enable use of AVX instructions */
+/* #undef WITH_AVX */
+#ifdef WITH_AVX
+  #define FLAC__USE_AVX
+#endif
+
+/* Define to the commit date of the current git HEAD */
+#define GIT_COMMIT_DATE "20260719"
+
+/* Define to the short hash of the current git HEAD */
+#define GIT_COMMIT_HASH "e94ff9f6"
+
+/* Define to the tag of the current git HEAD */
+/* #undef GIT_COMMIT_TAG */
+
+/* Compiler has the __builtin_bswap16 intrinsic */
+#define HAVE_BSWAP16
+
+/* Compiler has the __builtin_bswap32 intrinsic */
+#define HAVE_BSWAP32
+
+/* Define to 1 if you have the <byteswap.h> header file. */
+/* #undef HAVE_BYTESWAP_H */
+
+/* Define if multithreading is enable and <threads.h> is available */
+/* #undef HAVE_C11THREADS */
+
+/* define if you have clock_gettime */
+/* #undef HAVE_CLOCK_GETTIME */
+
+/* Define to 1 if you have the <cpuid.h> header file. */
+/* #undef HAVE_CPUID_H */
+
+/* Define to 1 if fseeko (and presumably ftello) exists and is declared. */
+#define HAVE_FSEEKO
+
+/* Define to 1 if you have the `getopt_long' function. */
+/* #undef HAVE_GETOPT_LONG */
+
+/* Define if you have the iconv() function and it works. */
+#define HAVE_ICONV
+
+/* Define to 1 if you have the <inttypes.h> header file. */
+#define HAVE_INTTYPES_H
+
+/* Define if you have <langinfo.h> and nl_langinfo(CODESET). */
+#define HAVE_LANGINFO_CODESET
+
+/* lround support */
+#define HAVE_LROUND 1
+
+/* Define to 1 if you have the <memory.h> header file. */
+/* #undef HAVE_MEMORY_H */
+
+/* Define if multithreading is enable and pthread is available */
+#define HAVE_PTHREAD 1
+
+/* Define to 1 if you have the <stdint.h> header file. */
+#define HAVE_STDINT_H
+
+/* Define to 1 if you have the <stdlib.h> header file. */
+/* #undef HAVE_STDLIB_H */
+
+/* Define to 1 if you have the <string.h> header file. */
+#define HAVE_STRING_H
+
+/* Define to 1 if you have the <sys/ioctl.h> header file. */
+#define HAVE_SYS_IOCTL_H
+
+/* Define to 1 if you have the <sys/param.h> header file. */
+#define HAVE_SYS_PARAM_H
+
+/* Define to 1 if you have the <sys/stat.h> header file. */
+/* #undef HAVE_SYS_STAT_H */
+
+/* Define to 1 if you have the <sys/time.h> header file. */
+#define HAVE_SYS_TIME_H
+
+/* Define to 1 if you have the <sys/types.h> header file. */
+/* #undef HAVE_SYS_TYPES_H */
+
+/* Define to 1 if you have the <termios.h> header file. */
+#define HAVE_TERMIOS_H
+
+/* Define to 1 if typeof works with your compiler. */
+/* #undef HAVE_TYPEOF */
+
+/* Define to 1 if you have the <unistd.h> header file. */
+/* #undef HAVE_UNISTD_H */
+
+/* Define to 1 if you have the <x86intrin.h> header file. */
+/* #undef HAVE_X86INTRIN_H */
+
+/* Define as const if the declaration of iconv() needs const. */
+/* #undef ICONV_CONST */
+
+/* Define if debugging is disabled */
+/* #undef NDEBUG */
+
+/* Name of package */
+/* #undef PACKAGE */
+
+/* Define to the address where bug reports for this package should be sent. */
+/* #undef PACKAGE_BUGREPORT */
+
+/* Define to the full name of this package. */
+/* #undef PACKAGE_NAME */
+
+/* Define to the full name and version of this package. */
+/* #undef PACKAGE_STRING */
+
+/* Define to the one symbol short name of this package. */
+/* #undef PACKAGE_TARNAME */
+
+/* Define to the home page for this package. */
+/* #undef PACKAGE_URL */
+
+/* Define to the version of this package. */
+#define PACKAGE_VERSION "1.5.0"
+
+/* The size of `off_t', as computed by sizeof. */
+/* #undef SIZEOF_OFF_T */
+
+/* The size of `void*', as computed by sizeof. */
+/* #undef SIZEOF_VOIDP */
+
+/* Enable extensions on AIX 3, Interix.  */
+#ifndef _ALL_SOURCE
+#define _ALL_SOURCE
+#endif
+
+/* Enable GNU extensions on systems that have them.  */
+#ifndef _GNU_SOURCE
+#define _GNU_SOURCE
+#endif
+
+#ifndef _XOPEN_SOURCE
+/* #undef DODEFINE_XOPEN_SOURCE */
+#ifdef DODEFINE_XOPEN_SOURCE
+#define _XOPEN_SOURCE DODEFINE_XOPEN_SOURCE
+#endif
+#endif
+
+/* Enable threading extensions on Solaris.  */
+#ifndef _POSIX_PTHREAD_SEMANTICS
+/* #undef _POSIX_PTHREAD_SEMANTICS */
+#endif
+/* Enable extensions on HP NonStop.  */
+#ifndef _TANDEM_SOURCE
+/* #undef _TANDEM_SOURCE */
+#endif
+/* Enable general extensions on Solaris.  */
+#ifndef __EXTENSIONS__
+#define DODEFINE_EXTENSIONS
+#ifdef DODEFINE_EXTENSIONS
+#define __EXTENSIONS__ DODEFINE_EXTENSIONS
+#endif
+#endif
+
+
+/* Target processor is big endian. */
+#define WORDS_BIGENDIAN CPU_IS_BIG_ENDIAN
+
+/* Enable large inode numbers on Mac OS X 10.5.  */
+#ifndef _DARWIN_USE_64_BIT_INODE
+# define _DARWIN_USE_64_BIT_INODE 1
+#endif
+
+/* Number of bits in a file offset, on hosts where this is settable. */
+#ifndef _FILE_OFFSET_BITS
+# define _FILE_OFFSET_BITS 64
+#endif
+
+/* Define to 1 to make fseeko visible on some hosts (e.g. glibc 2.2). */
+#ifndef _LARGEFILE_SOURCE
+# define _LARGEFILE_SOURCE
+#endif
+
+/* Define for large files, on AIX-style hosts. */
+/* #undef _LARGE_FILES */
+
+/* Define to 1 if on MINIX. */
+/* #undef _MINIX */
+
+/* Define to 2 if the system does not provide POSIX.1 features except with
+   this defined. */
+/* #undef _POSIX_1_SOURCE */
+
+/* Define to 1 if you need to in order for `stat' and other things to work. */
+/* #undef _POSIX_SOURCE */
+
+/* Define to __typeof__ if your compiler spells it that way. */
+/* #undef typeof */
diff --git a/test/corpus/support/giflib/run-tests.sh b/test/corpus/support/giflib/run-tests.sh
new file mode 100755
index 00000000..a4c809dd
--- /dev/null
+++ b/test/corpus/support/giflib/run-tests.sh
@@ -0,0 +1,25 @@
+#!/bin/sh
+# Runs GIFLIB's regression suite (tests/makefile) for the corpus gate, from
+# the checkout root, after the library and the utilities are built.
+#
+# It is tests/makefile's `test` target (every *-regress target's TAP output,
+# a plan line, ./tapview) with one change: giffix-regress uses GNU head's
+# `--bytes=-20`, which BSD head on macOS rejects, so the same check (the
+# last 20 bytes of pic/treescap.gif cut off, repaired by giffix, dumped by
+# gifbuild and compared with tests/giffixed.ico) is run here with a
+# portable `head -c`. Exits non-zero when any test fails.
+set -u
+cd tests || exit 1
+targets="render-regress gif2rgb-regress gifbuild-regress gifclrmp-regress gifecho-regress \
+giffilter-regress gifinto-regress gifsponge-regress giftext-regress giftool-regress gifwedge-regress"
+log=gate-tap.log
+{
+	# shellcheck disable=SC2086
+	make --quiet $targets || echo "not ok - make $targets"
+	n=$(wc -c <../pic/treescap.gif)
+	head -c $((n - 20)) <../pic/treescap.gif | ../giffix 2>/dev/null | ../gifbuild -d |
+		./tapdiffer "giffix: Testing giffix behavior" giffixed.ico
+} >"$log"
+count=$(grep -c '^\(not \)\{0,1\}ok' "$log")
+[ "$count" -gt 0 ] || { echo "no test ran" >&2; exit 1; }
+{ cat "$log"; echo "1..$count"; } | ./tapview
diff --git a/test/corpus/support/libgit2/experimental.h b/test/corpus/support/libgit2/experimental.h
new file mode 100644
index 00000000..c6fd4fc0
--- /dev/null
+++ b/test/corpus/support/libgit2/experimental.h
@@ -0,0 +1,11 @@
+/*
+ * Copyright (C) the libgit2 contributors. All rights reserved.
+ *
+ * This file is part of libgit2, distributed under the GNU GPL v2 with
+ * a Linking Exception. For full terms see the included COPYING file.
+ */
+
+#ifndef INCLUDE_experimental_h__
+#define INCLUDE_experimental_h__
+
+#endif
diff --git a/test/corpus/support/libgit2/git2_features.h b/test/corpus/support/libgit2/git2_features.h
new file mode 100644
index 00000000..b272d363
--- /dev/null
+++ b/test/corpus/support/libgit2/git2_features.h
@@ -0,0 +1,103 @@
+#ifndef INCLUDE_features_h__
+#define INCLUDE_features_h__
+
+/* Debugging options */
+
+/* #undef GIT_DEBUG_POOL */
+/* #undef GIT_DEBUG_STRICT_ALLOC */
+/* #undef GIT_DEBUG_STRICT_OPEN */
+/* #undef GIT_DEBUG_LEAKCHECK_WIN32 */
+
+/* Feature enablement and provider / backend selection */
+
+#define GIT_THREADS 1
+#define GIT_THREADS_PTHREADS 1
+/* #undef GIT_THREADS_WIN32 */
+
+#define GIT_SHA1_BUILTIN 1
+/* #undef GIT_SHA1_OPENSSL */
+/* #undef GIT_SHA1_OPENSSL_FIPS */
+/* #undef GIT_SHA1_OPENSSL_DYNAMIC */
+/* #undef GIT_SHA1_MBEDTLS */
+/* #undef GIT_SHA1_COMMON_CRYPTO */
+/* #undef GIT_SHA1_WIN32 */
+
+#define GIT_SHA256_BUILTIN 1
+/* #undef GIT_SHA256_WIN32 */
+/* #undef GIT_SHA256_COMMON_CRYPTO */
+/* #undef GIT_SHA256_OPENSSL */
+/* #undef GIT_SHA256_OPENSSL_FIPS */
+/* #undef GIT_SHA256_OPENSSL_DYNAMIC */
+/* #undef GIT_SHA256_MBEDTLS */
+
+/* #undef GIT_COMPRESSION_BUILTIN */
+#define GIT_COMPRESSION_ZLIB 1
+
+#define GIT_NSEC 1
+/* #undef GIT_NSEC_MTIM */
+#define GIT_NSEC_MTIMESPEC 1
+/* #undef GIT_NSEC_MTIME_NSEC */
+/* #undef GIT_NSEC_WIN32 */
+
+#define GIT_I18N 1
+#define GIT_I18N_ICONV 1
+
+#define GIT_REGEX_REGCOMP_L 1
+/* #undef GIT_REGEX_REGCOMP */
+/* #undef GIT_REGEX_PCRE */
+/* #undef GIT_REGEX_PCRE2 */
+/* #undef GIT_REGEX_BUILTIN */
+
+/* #undef GIT_SSH */
+/* #undef GIT_SSH_EXEC */
+/* #undef GIT_SSH_LIBSSH2 */
+/* #undef GIT_SSH_LIBSSH2_MEMORY_CREDENTIALS */
+
+#define GIT_HTTP 1
+
+/* #undef GIT_HTTPS */
+/* #undef GIT_HTTPS_OPENSSL */
+/* #undef GIT_HTTPS_OPENSSL_DYNAMIC */
+/* #undef GIT_HTTPS_SECURETRANSPORT */
+/* #undef GIT_HTTPS_MBEDTLS */
+/* #undef GIT_HTTPS_SCHANNEL */
+/* #undef GIT_HTTPS_WINHTTP */
+
+/* #undef GIT_HTTPPARSER_HTTPPARSER */
+/* #undef GIT_HTTPPARSER_LLHTTP */
+#define GIT_HTTPPARSER_BUILTIN 1
+
+/* #undef GIT_AUTH_NTLM */
+/* #undef GIT_AUTH_NTLM_BUILTIN */
+/* #undef GIT_AUTH_NTLM_SSPI */
+
+/* #undef GIT_AUTH_NEGOTIATE */
+/* #undef GIT_AUTH_NEGOTIATE_GSSFRAMEWORK */
+/* #undef GIT_AUTH_NEGOTIATE_GSSAPI */
+/* #undef GIT_AUTH_NEGOTIATE_SSPI */
+
+/* Platform details */
+
+#define GIT_ARCH_64 1
+/* #undef GIT_ARCH_32 */
+
+#define GIT_QSORT_BSD 1
+/* #undef GIT_QSORT_GNU */
+/* #undef GIT_QSORT_C11 */
+/* #undef GIT_QSORT_MSC */
+
+#define GIT_FUTIMENS 1
+
+/* #undef GIT_RAND_GETENTROPY */
+#define GIT_RAND_GETLOADAVG 1
+
+#define GIT_IO_POLL 1
+/* #undef GIT_IO_WSAPOLL */
+#define GIT_IO_SELECT 1
+
+/* Compile-time information */
+
+#define GIT_BUILD_CPU "arm64"
+#define GIT_BUILD_COMMIT "0551dfd4ad989b6a3d5683c0d4cf326c6efef929"
+
+#endif
diff --git a/test/corpus/support/libjpeg-turbo/jconfig.h b/test/corpus/support/libjpeg-turbo/jconfig.h
new file mode 100644
index 00000000..7672bac3
--- /dev/null
+++ b/test/corpus/support/libjpeg-turbo/jconfig.h
@@ -0,0 +1,60 @@
+/* Version ID for the JPEG library.
+ * Might be useful for tests like "#if JPEG_LIB_VERSION >= 60".
+ */
+#define JPEG_LIB_VERSION  62
+
+/* libjpeg-turbo version */
+#define LIBJPEG_TURBO_VERSION  3.2.1
+
+/* libjpeg-turbo version in integer form */
+#define LIBJPEG_TURBO_VERSION_NUMBER  3002001
+
+/* Support arithmetic encoding when using 8-bit samples */
+#define C_ARITH_CODING_SUPPORTED 1
+
+/* Support arithmetic decoding when using 8-bit samples */
+#define D_ARITH_CODING_SUPPORTED 1
+
+/* Support in-memory source/destination managers */
+#define MEM_SRCDST_SUPPORTED  1
+
+/* Use accelerated SIMD routines when using 8-bit samples */
+#define WITH_SIMD 1
+
+/* This version of libjpeg-turbo supports run-time selection of data precision,
+ * so BITS_IN_JSAMPLE is no longer used to specify the data precision at build
+ * time.  However, some downstream software expects the macro to be defined.
+ * Since 12-bit data precision is an opt-in feature that requires explicitly
+ * calling 12-bit-specific libjpeg API functions and using 12-bit-specific data
+ * types, the unmodified portion of the libjpeg API still behaves as if it were
+ * built for 8-bit precision, and JSAMPLE is still literally an 8-bit data
+ * type.  Thus, it is correct to define BITS_IN_JSAMPLE to 8 here.
+ */
+#ifndef BITS_IN_JSAMPLE
+#define BITS_IN_JSAMPLE  8
+#endif
+
+#ifdef _WIN32
+
+#undef RIGHT_SHIFT_IS_UNSIGNED
+
+/* Define "boolean" as unsigned char, not int, per Windows custom */
+#ifndef __RPCNDR_H__            /* don't conflict if rpcndr.h already read */
+typedef unsigned char boolean;
+#endif
+#define HAVE_BOOLEAN            /* prevent jmorecfg.h from redefining it */
+
+/* Define "INT32" as int, not long, per Windows custom */
+#if !(defined(_BASETSD_H_) || defined(_BASETSD_H))   /* don't conflict if basetsd.h already read */
+typedef short INT16;
+typedef signed int INT32;
+#endif
+#define XMD_H                   /* prevent jmorecfg.h from redefining it */
+
+#else
+
+/* Define if your (broken) compiler shifts signed values as if they were
+   unsigned. */
+/* #undef RIGHT_SHIFT_IS_UNSIGNED */
+
+#endif
diff --git a/test/corpus/support/libjpeg-turbo/jconfigint.h b/test/corpus/support/libjpeg-turbo/jconfigint.h
new file mode 100644
index 00000000..317ff452
--- /dev/null
+++ b/test/corpus/support/libjpeg-turbo/jconfigint.h
@@ -0,0 +1,82 @@
+/* libjpeg-turbo build number */
+#define BUILD  "20261004"
+
+/* How to hide global symbols. */
+#define HIDDEN  __attribute__((visibility("hidden")))
+
+/* Compiler's inline keyword */
+#undef inline
+
+/* How to obtain function inlining. */
+#define INLINE  __inline__ __attribute__((always_inline))
+
+/* How to obtain thread-local storage */
+#define THREAD_LOCAL  __thread
+
+/* Define to the full name of this package. */
+#define PACKAGE_NAME  "libjpeg-turbo"
+
+/* Version number of package */
+#define VERSION  "3.2.1"
+
+/* The size of `size_t', as computed by sizeof. */
+#define SIZEOF_SIZE_T  8
+
+/* Define if your compiler has __builtin_ctzl() and sizeof(unsigned long) == sizeof(size_t). */
+#define HAVE_BUILTIN_CTZL
+
+/* Define to 1 if you have the <intrin.h> header file. */
+/* #undef HAVE_INTRIN_H */
+
+#if defined(_MSC_VER) && defined(HAVE_INTRIN_H)
+#if (SIZEOF_SIZE_T == 8)
+#define HAVE_BITSCANFORWARD64
+#elif (SIZEOF_SIZE_T == 4)
+#define HAVE_BITSCANFORWARD
+#endif
+#endif
+
+#if defined(__has_attribute)
+#if __has_attribute(fallthrough)
+#define FALLTHROUGH  __attribute__((fallthrough));
+#else
+#define FALLTHROUGH
+#endif
+#else
+#define FALLTHROUGH
+#endif
+
+/*
+ * Define BITS_IN_JSAMPLE as either
+ *   8   for 8-bit sample values (the usual setting)
+ *   12  for 12-bit sample values
+ * Only 8 and 12 are legal data precisions for lossy JPEG according to the
+ * JPEG standard, and the IJG code does not support anything else!
+ */
+
+#ifndef BITS_IN_JSAMPLE
+#define BITS_IN_JSAMPLE  8      /* use 8 or 12 */
+#endif
+
+#undef C_ARITH_CODING_SUPPORTED
+#undef D_ARITH_CODING_SUPPORTED
+#undef WITH_SIMD
+
+#if BITS_IN_JSAMPLE == 8
+
+/* Support arithmetic encoding */
+#define C_ARITH_CODING_SUPPORTED 1
+
+/* Support arithmetic decoding */
+#define D_ARITH_CODING_SUPPORTED 1
+
+/* Use accelerated SIMD routines. */
+#define WITH_SIMD 1
+
+#define SIMD_ARCHITECTURE  ARM64
+
+/* #undef WITH_SIMDE */
+
+#endif
+
+/* #undef WITH_PROFILE */
diff --git a/test/corpus/support/libjpeg-turbo/jversion.h b/test/corpus/support/libjpeg-turbo/jversion.h
new file mode 100644
index 00000000..94dc3918
--- /dev/null
+++ b/test/corpus/support/libjpeg-turbo/jversion.h
@@ -0,0 +1,30 @@
+/*
+ * jversion.h
+ *
+ * This file was part of the Independent JPEG Group's software:
+ * Copyright (C) 1991-2020, Thomas G. Lane, Guido Vollbeding.
+ * libjpeg-turbo Modifications:
+ * Copyright (C) 2010, 2012-2026, D. R. Commander.
+ * For conditions of distribution and use, see the accompanying README.ijg
+ * file.
+ *
+ * This file contains software version identification.
+ */
+
+
+#if JPEG_LIB_VERSION >= 80
+
+#define JVERSION        "8d  15-Jan-2012"
+
+#elif JPEG_LIB_VERSION >= 70
+
+#define JVERSION        "7  27-Jun-2009"
+
+#else
+
+#define JVERSION        "6b  27-Mar-1998"
+
+#endif
+
+#define JCOPYRIGHT \
+  "Copyright (C) 1991-2026 The libjpeg-turbo Project and many others"
diff --git a/test/corpus/support/lmdb/fixed-seed.h b/test/corpus/support/lmdb/fixed-seed.h
new file mode 100644
index 00000000..ffdac5b6
--- /dev/null
+++ b/test/corpus/support/lmdb/fixed-seed.h
@@ -0,0 +1,9 @@
+/* Forced into LMDB's mtest programs (-include) by scripts/corpus-gate.py
+ * (test/corpus/manifest.json, config lmdb): mtest, mtest2, mtest3 and mtest5
+ * seed rand() with time(NULL), which makes their key counts and values
+ * differ from run to run. The gate's tests must be deterministic, so the
+ * seed is fixed. The headers are included first so that the macro does not
+ * rename their declaration of srand. */
+#include <stdlib.h>
+#include <time.h>
+#define srand(seed) srand(1)
diff --git a/test/corpus/support/lmdb/run-tests.sh b/test/corpus/support/lmdb/run-tests.sh
new file mode 100755
index 00000000..caef355f
--- /dev/null
+++ b/test/corpus/support/lmdb/run-tests.sh
@@ -0,0 +1,43 @@
+#!/bin/sh
+# LMDB's test programs for scripts/corpus-gate.py (test/corpus/manifest.json,
+# config lmdb), run from the checkout's root after the build: mtest, mtest2,
+# mtest3, mtest4 and mtest5, each against a fresh libraries/liblmdb/testdb
+# (what `make test` does for mtest). After mtest, the tools over its
+# database: mdb_stat, an mdb_dump / mdb_load round trip and mdb_copy (plain and
+# compacting), each dumped and compared with the original dump's records.
+# Everything is written under libraries/liblmdb. Exits non-zero on the first
+# failure.
+set -u
+cd libraries/liblmdb || exit 1
+fail() { echo "FAILED: $*"; exit 1; }
+# A dump's records, without its header (which records the map address).
+records() { sed '1,/^HEADER=END$/d' "$1"; }
+for t in mtest mtest2 mtest3 mtest4 mtest5; do
+  rm -rf testdb && mkdir testdb || exit 1
+  echo "== $t"
+  ./$t > "$t.out" 2>&1
+  rc=$?
+  if [ $rc -ne 0 ]; then
+    tail -20 "$t.out"
+    fail "$t (exit $rc)"
+  fi
+  if [ $t = mtest ]; then
+    echo "== mdb_stat, mdb_dump, mdb_load, mdb_copy over mtest's database"
+    ./mdb_stat testdb || fail "mdb_stat"
+    ./mdb_stat -a -e -f testdb > /dev/null || fail "mdb_stat -a -e -f"
+    ./mdb_dump testdb > testdb.dump || fail "mdb_dump"
+    rm -rf testdb-load && mkdir testdb-load || exit 1
+    ./mdb_load testdb-load < testdb.dump || fail "mdb_load"
+    ./mdb_dump testdb-load > testdb-load.dump || fail "mdb_dump of the loaded database"
+    records testdb.dump > testdb.rec && records testdb-load.dump | cmp testdb.rec - || fail "dump / load round trip differs"
+    for c in "" -c; do
+      rm -rf testdb-copy && mkdir testdb-copy || exit 1
+      ./mdb_copy $c testdb testdb-copy || fail "mdb_copy $c"
+      ./mdb_dump testdb-copy > testdb-copy.dump || fail "mdb_dump of the copy ($c)"
+      records testdb-copy.dump | cmp testdb.rec - || fail "mdb_copy $c differs"
+    done
+    rm -rf testdb-load testdb-copy testdb.dump testdb-load.dump testdb-copy.dump testdb.rec
+  fi
+done
+rm -rf testdb
+echo "lmdb tests passed"
diff --git a/test/corpus/support/opus/config.h b/test/corpus/support/opus/config.h
new file mode 100644
index 00000000..e0ac5355
--- /dev/null
+++ b/test/corpus/support/opus/config.h
@@ -0,0 +1 @@
+#define PACKAGE_VERSION "1.6.1-68-g503d81b1"
diff --git a/test/corpus/support/xz/config.h b/test/corpus/support/xz/config.h
new file mode 100644
index 00000000..6c5a94ab
--- /dev/null
+++ b/test/corpus/support/xz/config.h
@@ -0,0 +1,66 @@
+/* config.h for the corpus gate's per-file compiles of liblzma: the definitions
+ * xz's CMake build (Release, -DXZ_NLS=OFF) passes to liblzma on darwin-arm64,
+ * written as a header (sysdefs.h includes it under HAVE_CONFIG_H). */
+
+#define HAVE_ARM64_CRC32 1
+#define HAVE_CHECK_CRC32 1
+#define HAVE_CHECK_CRC64 1
+#define HAVE_CHECK_SHA256 1
+#define HAVE_CLOCK_GETTIME 1
+#define HAVE_CLOCK_MONOTONIC 1
+#define HAVE_DECODERS 1
+#define HAVE_DECODER_ARM 1
+#define HAVE_DECODER_ARM64 1
+#define HAVE_DECODER_ARMTHUMB 1
+#define HAVE_DECODER_DELTA 1
+#define HAVE_DECODER_IA64 1
+#define HAVE_DECODER_LZMA1 1
+#define HAVE_DECODER_LZMA2 1
+#define HAVE_DECODER_POWERPC 1
+#define HAVE_DECODER_RISCV 1
+#define HAVE_DECODER_SPARC 1
+#define HAVE_DECODER_X86 1
+#define HAVE_ENCODERS 1
+#define HAVE_ENCODER_ARM 1
+#define HAVE_ENCODER_ARM64 1
+#define HAVE_ENCODER_ARMTHUMB 1
+#define HAVE_ENCODER_DELTA 1
+#define HAVE_ENCODER_IA64 1
+#define HAVE_ENCODER_LZMA1 1
+#define HAVE_ENCODER_LZMA2 1
+#define HAVE_ENCODER_POWERPC 1
+#define HAVE_ENCODER_RISCV 1
+#define HAVE_ENCODER_SPARC 1
+#define HAVE_ENCODER_X86 1
+#define HAVE_FUNC_ATTRIBUTE_CONSTRUCTOR 1
+#define HAVE_INTTYPES_H 1
+#define HAVE_LZIP_DECODER 1
+#define HAVE_MF_BT2 1
+#define HAVE_MF_BT3 1
+#define HAVE_MF_BT4 1
+#define HAVE_MF_HC3 1
+#define HAVE_MF_HC4 1
+#define HAVE_STDBOOL_H 1
+#define HAVE_STDINT_H 1
+#define HAVE_SYSCTLBYNAME 1
+#define HAVE_SYS_PARAM_H 1
+#define HAVE_VISIBILITY 0
+#define HAVE__BOOL 1
+#define HAVE___BUILTIN_ASSUME_ALIGNED 1
+#define HAVE___BUILTIN_BSWAPXX 1
+#define MYTHREAD_POSIX 1
+#define PACKAGE_BUGREPORT "xz@tukaani.org"
+#define PACKAGE_NAME "XZ Utils"
+#define PACKAGE_URL "https://tukaani.org/xz/"
+#define TUKLIB_CPUCORES_SYSCTL 1
+#define TUKLIB_FAST_UNALIGNED_ACCESS 1
+#define TUKLIB_PHYSMEM_SYSCONF 1
+#define TUKLIB_SYMBOL_PREFIX lzma_
+#define _ALL_SOURCE 1
+#define _DARWIN_C_SOURCE 1
+#define _GNU_SOURCE 1
+#define _NETBSD_SOURCE 1
+#define _OPENBSD_SOURCE 1
+#define _POSIX_PTHREAD_SEMANTICS 1
+#define _TANDEM_SOURCE 1
+#define __EXTENSIONS__ 1
diff --git a/test/corpus/support/zlib-ng/gzread_mangle.h b/test/corpus/support/zlib-ng/gzread_mangle.h
new file mode 100644
index 00000000..fa021cad
--- /dev/null
+++ b/test/corpus/support/zlib-ng/gzread_mangle.h
@@ -0,0 +1,7 @@
+/* gzread_mangle.h.in -- gzgetc name mangling helper
+ * This file undefines the macro from zlib.h/zlib-ng.h to allow the real
+ * function to be defined in gzread.c. This is tricky because the prefix
+ * is not known ahead of time, thus the need for sed or similar.
+ */
+#undef gzgetc
+#undef zng_gzgetc
diff --git a/test/corpus/support/zlib-ng/round-trips.sh b/test/corpus/support/zlib-ng/round-trips.sh
new file mode 100755
index 00000000..7f24028d
--- /dev/null
+++ b/test/corpus/support/zlib-ng/round-trips.sh
@@ -0,0 +1,26 @@
+#!/bin/sh
+# Round trips for the corpus gate's zlib-ng config, run from the checkout root
+# after the CMake build into out/: minigzip at every level and strategy, and
+# minideflate at three levels and window sizes (its -w option is the window,
+# kept in this script because the gate's flag check forbids -w in commands).
+set -u
+mkdir -p gate-rt
+cat ./*.c arch/generic/*.c > gate-rt/src
+: > gate-rt/empty
+for f in gate-rt/src gate-rt/empty test/data/fireworks.jpg test/data/lcet10.txt; do
+    for o in -0 -1 -2 -3 -4 -5 -6 -7 -8 -9 "-6 -h" "-6 -R" "-6 -F" "-6 -f" "-6 -T"; do
+        # shellcheck disable=SC2086
+        out/minigzip $o < "$f" > gate-rt/c &&
+            out/minigzip -d < gate-rt/c > gate-rt/d &&
+            cmp gate-rt/d "$f" || { echo "FAIL minigzip $o $f"; exit 1; }
+    done
+    for l in 1 6 9; do
+        for w in 9 12 15; do
+            cp "$f" gate-rt/m &&
+                out/minideflate -c -k -$l -w $w -m 8 -s 2 gate-rt/m > gate-rt/m.z &&
+                out/minideflate -c -d -k -w $w gate-rt/m.z > gate-rt/m.out &&
+                cmp gate-rt/m.out "$f" || { echo "FAIL minideflate -$l -w $w $f"; exit 1; }
+        done
+    done
+done
+echo "round trips passed"
diff --git a/test/corpus/support/zlib-ng/zconf.h b/test/corpus/support/zlib-ng/zconf.h
new file mode 100644
index 00000000..0458ca65
--- /dev/null
+++ b/test/corpus/support/zlib-ng/zconf.h
@@ -0,0 +1,205 @@
+/* zconf.h -- configuration of the zlib compression library
+ * Copyright (C) 1995-2026 Jean-loup Gailly, Mark Adler
+ * For conditions of distribution and use, see copyright notice in zlib.h
+ */
+
+#ifndef ZCONF_H
+#define ZCONF_H
+
+#include "zlib_name_mangling.h"
+
+#if !defined(_WIN32) && defined(__WIN32__)
+#  define _WIN32
+#endif
+
+/* Clang macro for detecting declspec support
+ * https://clang.llvm.org/docs/LanguageExtensions.html#has-declspec-attribute
+ */
+#ifndef __has_declspec_attribute
+#  define __has_declspec_attribute(x) 0
+#endif
+
+/* Only for use on API-visible variables. */
+#ifndef z_const
+#  ifdef ZLIB_CONST
+#    define z_const const
+#  else
+#    define z_const
+#  endif
+#endif
+
+/* Maximum value for memLevel in deflateInit2 */
+#ifndef MAX_MEM_LEVEL
+#  define MAX_MEM_LEVEL 9
+#endif
+
+/* Maximum value for windowBits in deflateInit2 and inflateInit2.
+ * WARNING: reducing MAX_WBITS makes minigzip unable to extract .gz files
+ * created by gzip. (Files created by minigzip can still be extracted by
+ * gzip.)
+ */
+#ifndef MIN_WBITS
+#  define MIN_WBITS   8  /* 256 LZ77 window */
+#endif
+#ifndef MAX_WBITS
+#  define MAX_WBITS   15 /* 32K LZ77 window */
+#endif
+
+/* The memory requirements for deflate are (in bytes):
+            (1 << (windowBits+2)) +  (1 << (memLevel+9))
+ that is: 128K for windowBits=15  +  128K for memLevel = 8  (default values)
+ plus a few kilobytes for small objects. For example, if you want to reduce
+ the default memory requirements from 256K to 128K, compile with
+     make CFLAGS="-O -DMAX_WBITS=14 -DMAX_MEM_LEVEL=7"
+ Of course this will generally degrade compression (there's no free lunch).
+
+   The memory requirements for inflate are (in bytes) 1 << windowBits
+ that is, 32K for windowBits=15 (default value) plus about 7 kilobytes
+ for small objects.
+*/
+
+/* Type declarations */
+
+
+#ifndef OF /* function prototypes */
+#  define OF(args)  args
+#endif
+
+#ifdef ZLIB_INTERNAL
+#  define Z_INTERNAL ZLIB_INTERNAL
+#endif
+
+/* If building or using zlib as a DLL, define ZLIB_DLL.
+ * This is not mandatory, but it offers a little performance increase.
+ */
+#if defined(ZLIB_DLL) && (defined(_WIN32) || (__has_declspec_attribute(dllexport) && __has_declspec_attribute(dllimport)))
+#  ifdef Z_INTERNAL
+#    define Z_EXTERN extern __declspec(dllexport)
+#  else
+#    define Z_EXTERN extern __declspec(dllimport)
+#  endif
+#endif
+
+/* If building or using zlib with the WINAPI/WINAPIV calling convention,
+ * define ZLIB_WINAPI.
+ * Caution: the standard ZLIB1.DLL is NOT compiled using ZLIB_WINAPI.
+ */
+#if defined(ZLIB_WINAPI) && defined(_WIN32)
+#  ifndef WIN32_LEAN_AND_MEAN
+#    define WIN32_LEAN_AND_MEAN
+#  endif
+#  include <windows.h>
+   /* No need for _export, use ZLIB.DEF instead. */
+   /* For complete Windows compatibility, use WINAPI, not __stdcall. */
+#  define Z_EXPORT WINAPI
+#  define Z_EXPORTVA WINAPIV
+#endif
+
+#ifndef Z_EXTERN
+#  define Z_EXTERN extern
+#endif
+#ifndef Z_EXPORT
+#  define Z_EXPORT
+#endif
+#ifndef Z_EXPORTVA
+#  define Z_EXPORTVA
+#endif
+
+/* Conditional exports */
+#define ZNG_CONDEXPORT Z_INTERNAL
+
+/* For backwards compatibility */
+
+#ifndef ZEXTERN
+#  define ZEXTERN Z_EXTERN
+#endif
+#ifndef ZEXPORT
+#  define ZEXPORT Z_EXPORT
+#endif
+#ifndef ZEXPORTVA
+#  define ZEXPORTVA Z_EXPORTVA
+#endif
+#ifndef FAR
+#  define FAR
+#endif
+
+/* Legacy zlib typedefs for backwards compatibility. Don't assume stdint.h is defined. */
+typedef unsigned char Byte;
+typedef Byte Bytef;
+
+typedef unsigned int   uInt;  /* 16 bits or more */
+typedef unsigned long  uLong; /* 32 bits or more */
+
+typedef char  charf;
+typedef int   intf;
+typedef uInt  uIntf;
+typedef uLong uLongf;
+
+typedef void const *voidpc;
+typedef void       *voidpf;
+typedef void       *voidp;
+
+typedef unsigned int z_crc_t;
+
+#if 1    /* was set to #if 1 by configure/cmake/etc */
+#  define Z_HAVE_UNISTD_H
+#endif
+
+#include <sys/types.h>      /* for off_t */
+
+#include <stddef.h>         /* for wchar_t and NULL */
+
+/* a little trick to accommodate both "#define _LARGEFILE64_SOURCE" and
+ * "#define _LARGEFILE64_SOURCE 1" as requesting 64-bit operations, (even
+ * though the former does not conform to the LFS document), but considering
+ * both "#undef _LARGEFILE64_SOURCE" and "#define _LARGEFILE64_SOURCE 0" as
+ * equivalently requesting no 64-bit operations
+ */
+#if defined(_LARGEFILE64_SOURCE) && -_LARGEFILE64_SOURCE - -1 == 1
+#  undef _LARGEFILE64_SOURCE
+#endif
+
+#if defined(Z_HAVE_UNISTD_H)
+#  include <unistd.h>         /* for SEEK_*, off_t, and _LFS64_LARGEFILE */
+#  ifndef z_off_t
+#    define z_off_t off_t
+#  endif
+#endif
+
+#if defined(_LFS64_LARGEFILE) && _LFS64_LARGEFILE-0
+#  define Z_LFS64
+#endif
+
+#if defined(_LARGEFILE64_SOURCE) && defined(Z_LFS64)
+#  define Z_LARGE64
+#endif
+
+#if defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS-0 == 64 && defined(Z_LFS64)
+#  define Z_WANT64
+#endif
+
+#if !defined(SEEK_SET)
+#  define SEEK_SET        0       /* Seek from beginning of file.  */
+#  define SEEK_CUR        1       /* Seek from current position.  */
+#  define SEEK_END        2       /* Set file pointer to EOF plus "offset" */
+#endif
+
+#ifndef z_off_t
+#  define z_off_t long
+#endif
+
+#if !defined(_WIN32) && defined(Z_LARGE64)
+#  define z_off64_t off64_t
+#else
+#  if defined(__MSYS__)
+#    define z_off64_t _off64_t
+#  elif defined(_WIN32) && !defined(__GNUC__)
+#    define z_off64_t __int64
+#  else
+#    define z_off64_t z_off_t
+#  endif
+#endif
+
+typedef size_t z_size_t;
+
+#endif /* ZCONF_H */
diff --git a/test/corpus/support/zlib-ng/zlib.h b/test/corpus/support/zlib-ng/zlib.h
new file mode 100644
index 00000000..53c12015
--- /dev/null
+++ b/test/corpus/support/zlib-ng/zlib.h
@@ -0,0 +1,1911 @@
+#ifndef ZLIB_H_
+#define ZLIB_H_
+/* zlib.h -- interface of the 'zlib-ng' compression library
+   Forked from and compatible with zlib 1.3.2
+
+  Copyright (C) 1995-2026 Jean-loup Gailly and Mark Adler
+
+  This software is provided 'as-is', without any express or implied
+  warranty.  In no event will the authors be held liable for any damages
+  arising from the use of this software.
+
+  Permission is granted to anyone to use this software for any purpose,
+  including commercial applications, and to alter it and redistribute it
+  freely, subject to the following restrictions:
+
+  1. The origin of this software must not be misrepresented; you must not
+     claim that you wrote the original software. If you use this software
+     in a product, an acknowledgment in the product documentation would be
+     appreciated but is not required.
+  2. Altered source versions must be plainly marked as such, and must not be
+     misrepresented as being the original software.
+  3. This notice may not be removed or altered from any source distribution.
+
+  Jean-loup Gailly        Mark Adler
+  jloup@gzip.org          madler@alumni.caltech.edu
+
+
+  The data format used by the zlib library is described by RFCs (Request for
+  Comments) 1950 to 1952 at https://datatracker.ietf.org/doc/html/rfc1950
+  (zlib format), rfc1951 (deflate format) and rfc1952 (gzip format).
+*/
+
+#ifdef ZNGLIB_H_
+#  error Include zlib-ng.h for zlib-ng API or zlib.h for zlib-compat API but not both
+#endif
+
+#ifndef RC_INVOKED
+#include <stdint.h>
+#include <stdarg.h>
+
+#include "zconf.h"
+
+#ifndef ZCONF_H
+#  error Missing zconf.h add binary output directory to include directories
+#endif
+#endif  /* RC_INVOKED */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define ZLIBNG_VERSION "2.3.90"
+#define ZLIBNG_VERNUM 0x02039000L   /* MMNNRRSM: major minor revision status modified */
+#define ZLIBNG_VER_MAJOR 2
+#define ZLIBNG_VER_MINOR 3
+#define ZLIBNG_VER_REVISION 90
+#define ZLIBNG_VER_STATUS 0         /* 0=devel, 1-E=beta, F=Release (DEPRECATED) */
+#define ZLIBNG_VER_STATUSH 0x0      /* Hex values: 0=devel, 1-9=beta, A-E=Release Candidate, F=Release */
+#define ZLIBNG_VER_MODIFIED 0       /* non-zero if modified externally from zlib-ng */
+
+#define ZLIB_VERSION "1.3.2.zlib-ng"
+#define ZLIB_VERNUM 0x132f
+#define ZLIB_VER_MAJOR 1
+#define ZLIB_VER_MINOR 3
+#define ZLIB_VER_REVISION 2
+#define ZLIB_VER_SUBREVISION 15    /* 15=fork (0xf) */
+
+/*
+    The 'zlib' compression library provides in-memory compression and
+  decompression functions, including integrity checks of the uncompressed data.
+  This version of the library supports only one compression method (deflation)
+  but other algorithms will be added later and will have the same stream
+  interface.
+
+    Compression can be done in a single step if the buffers are large enough,
+  or can be done by repeated calls of the compression function.  In the latter
+  case, the application must provide more input and/or consume the output
+  (providing more output space) before each call.
+
+    The compressed data format used by default by the in-memory functions is
+  the zlib format, which is a zlib wrapper documented in RFC 1950, wrapped
+  around a deflate stream, which is itself documented in RFC 1951.
+
+    The library also supports reading and writing files in gzip (.gz) format
+  with an interface similar to that of stdio using the functions that start
+  with "gz".  The gzip format is different from the zlib format.  gzip is a
+  gzip wrapper, documented in RFC 1952, wrapped around a deflate stream.
+
+    This library can optionally read and write gzip and raw deflate streams in
+  memory as well.
+
+    The zlib format was designed to be compact and fast for use in memory
+  and on communications channels.  The gzip format was designed for single-
+  file compression on file systems, has a larger header than zlib to maintain
+  directory information, and uses a different, slower check method than zlib.
+
+    The library does not install any signal handler.  The decoder checks
+  the consistency of the compressed data, so the library should never crash
+  even in the case of corrupted input.
+*/
+
+typedef void *(*alloc_func) (void *opaque, unsigned int items, unsigned int size);
+typedef void  (*free_func)  (void *opaque, void *address);
+
+struct internal_state;
+
+typedef struct z_stream_s {
+    z_const unsigned char *next_in;   /* next input byte */
+    uint32_t              avail_in;   /* number of bytes available at next_in */
+    unsigned long         total_in;   /* total number of input bytes read so far */
+
+    unsigned char         *next_out;  /* next output byte will go here */
+    uint32_t              avail_out;  /* remaining free space at next_out */
+    unsigned long         total_out;  /* total number of bytes output so far */
+
+    z_const char          *msg;       /* last error message, NULL if no error */
+    struct internal_state *state;     /* not visible by applications */
+
+    alloc_func            zalloc;     /* used to allocate the internal state */
+    free_func             zfree;      /* used to free the internal state */
+    void                  *opaque;    /* private data object passed to zalloc and zfree */
+
+    int                   data_type;  /* best guess about the data type: binary or text
+                                         for deflate, or the decoding state for inflate */
+    unsigned long         adler;      /* Adler-32 or CRC-32 value of the uncompressed data */
+    unsigned long         reserved;   /* reserved for future use */
+} z_stream;
+
+typedef z_stream *z_streamp;  /* Obsolete type, retained for compatibility only */
+
+/*
+    gzip header information passed to and from zlib routines.  See RFC 1952
+  for more details on the meanings of these fields.
+*/
+typedef struct gz_header_s {
+    int             text;       /* true if compressed data believed to be text */
+    unsigned long   time;       /* modification time */
+    int             xflags;     /* extra flags (not used when writing a gzip file) */
+    int             os;         /* operating system */
+    unsigned char   *extra;     /* pointer to extra field or NULL if none */
+    unsigned int    extra_len;  /* extra field length (valid if extra != NULL) */
+    unsigned int    extra_max;  /* space at extra (only when reading header) */
+    unsigned char   *name;      /* pointer to zero-terminated file name or NULL */
+    unsigned int    name_max;   /* space at name (only when reading header) */
+    unsigned char   *comment;   /* pointer to zero-terminated comment or NULL */
+    unsigned int    comm_max;   /* space at comment (only when reading header) */
+    int             hcrc;       /* true if there was or will be a header crc */
+    int             done;       /* true when done reading gzip header (not used when writing a gzip file) */
+} gz_header;
+
+typedef gz_header *gz_headerp;
+
+/*
+     The application must update next_in and avail_in when avail_in has dropped
+   to zero.  It must update next_out and avail_out when avail_out has dropped
+   to zero.  The application must initialize zalloc, zfree and opaque before
+   calling the init function.  All other fields are set by the compression
+   library and must not be updated by the application.
+
+     The opaque value provided by the application will be passed as the first
+   parameter for calls of zalloc and zfree.  This can be useful for custom
+   memory management.  The compression library attaches no meaning to the
+   opaque value.
+
+     zalloc must return NULL if there is not enough memory for the object.
+   If zlib is used in a multi-threaded application, zalloc and zfree must be
+   thread safe.  In that case, zlib is thread-safe.  When zalloc and zfree are
+   Z_NULL on entry to the initialization function, they are set to internal
+   routines that use the standard library functions malloc() and free().
+
+     The fields total_in and total_out can be used for statistics or progress
+   reports.  After compression, total_in holds the total size of the
+   uncompressed data and may be saved for use by the decompressor (particularly
+   if the decompressor wants to decompress everything in a single step).
+*/
+
+                        /* constants */
+
+#define Z_NO_FLUSH      0
+#define Z_PARTIAL_FLUSH 1
+#define Z_SYNC_FLUSH    2
+#define Z_FULL_FLUSH    3
+#define Z_FINISH        4
+#define Z_BLOCK         5
+#define Z_TREES         6
+/* Allowed flush values; see deflate() and inflate() below for details */
+
+#define Z_OK            0
+#define Z_STREAM_END    1
+#define Z_NEED_DICT     2
+#define Z_ERRNO        (-1)
+#define Z_STREAM_ERROR (-2)
+#define Z_DATA_ERROR   (-3)
+#define Z_MEM_ERROR    (-4)
+#define Z_BUF_ERROR    (-5)
+#define Z_VERSION_ERROR (-6)
+/* Return codes for the compression/decompression functions. Negative values
+ * are errors, positive values are used for special but normal events.
+ */
+
+#define Z_NO_COMPRESSION         0
+#define Z_BEST_SPEED             1
+#define Z_BEST_COMPRESSION       9
+#define Z_DEFAULT_COMPRESSION  (-1)
+/* compression levels */
+
+#define Z_FILTERED            1
+#define Z_HUFFMAN_ONLY        2
+#define Z_RLE                 3
+#define Z_FIXED               4
+#define Z_DEFAULT_STRATEGY    0
+/* compression strategy; see deflateInit2() below for details */
+
+#define Z_BINARY   0
+#define Z_TEXT     1
+#define Z_ASCII    Z_TEXT   /* for compatibility with 1.2.2 and earlier */
+#define Z_UNKNOWN  2
+/* Possible values of the data_type field for deflate() */
+
+#define Z_DEFLATED   8
+/* The deflate compression method (the only one supported in this version) */
+
+#define Z_NULL  0  /* for compatibility with zlib, was for initializing zalloc, zfree, opaque */
+
+#define zlib_version zlibVersion()
+/* for compatibility with versions < 1.0.2 */
+
+
+                        /* basic functions */
+
+Z_EXTERN const char * Z_EXPORT zlibVersion(void);
+/* The application can compare zlibVersion and ZLIB_VERSION for consistency.
+   If the first character differs, the library code actually used is not
+   compatible with the zlib.h header file used by the application.  This check
+   is automatically made by deflateInit and inflateInit.
+ */
+
+/*
+Z_EXTERN int Z_EXPORT deflateInit (z_stream *strm, int level);
+
+     Initializes the internal stream state for compression.  The fields
+   zalloc, zfree and opaque must be initialized before by the caller.  If
+   zalloc and zfree are set to Z_NULL, deflateInit updates them to use default
+   allocation functions.  total_in, total_out, adler, and msg are initialized.
+
+     The compression level must be Z_DEFAULT_COMPRESSION, or between 0 and 9:
+   1 gives best speed, 9 gives best compression, 0 gives no compression at all
+   (the input data is simply copied a block at a time).  Z_DEFAULT_COMPRESSION
+   requests a default compromise between speed and compression (currently
+   equivalent to level 6).
+
+     deflateInit returns Z_OK if success, Z_MEM_ERROR if there was not enough
+   memory, Z_STREAM_ERROR if level is not a valid compression level, or
+   Z_VERSION_ERROR if the zlib library version (zlib_version) is incompatible
+   with the version assumed by the caller (ZLIB_VERSION).  msg is set to null
+   if there is no error message.  deflateInit does not perform any compression:
+   this will be done by deflate().
+*/
+
+
+Z_EXTERN int Z_EXPORT deflate(z_stream *strm, int flush);
+/*
+    deflate compresses as much data as possible, and stops when the input
+  buffer becomes empty or the output buffer becomes full.  It may introduce
+  some output latency (reading input without producing any output) except when
+  forced to flush.
+
+    The detailed semantics are as follows.  deflate performs one or both of the
+  following actions:
+
+  - Compress more input starting at next_in and update next_in and avail_in
+    accordingly.  If not all input can be processed (because there is not
+    enough room in the output buffer), next_in and avail_in are updated and
+    processing will resume at this point for the next call of deflate().
+
+  - Generate more output starting at next_out and update next_out and avail_out
+    accordingly.  This action is forced if the parameter flush is non zero.
+    Forcing flush frequently degrades the compression ratio, so this parameter
+    should be set only when necessary.  Some output may be provided even if
+    flush is zero.
+
+    Before the call of deflate(), the application should ensure that at least
+  one of the actions is possible, by providing more input and/or consuming more
+  output, and updating avail_in or avail_out accordingly; avail_out should
+  never be zero before the call.  The application can consume the compressed
+  output when it wants, for example when the output buffer is full (avail_out
+  == 0), or after each call of deflate().  If deflate returns Z_OK and with
+  zero avail_out, it must be called again after making room in the output
+  buffer because there might be more output pending. See deflatePending(),
+  which can be used if desired to determine whether or not there is more output
+  in that case.
+
+    Normally the parameter flush is set to Z_NO_FLUSH, which allows deflate to
+  decide how much data to accumulate before producing output, in order to
+  maximize compression.
+
+    If the parameter flush is set to Z_SYNC_FLUSH, all pending output is
+  flushed to the output buffer and the output is aligned on a byte boundary, so
+  that the decompressor can get all input data available so far.  (In
+  particular avail_in is zero after the call if enough output space has been
+  provided before the call.) Flushing may degrade compression for some
+  compression algorithms and so it should be used only when necessary.  This
+  completes the current deflate block and follows it with an empty stored block
+  that is three bits plus filler bits to the next byte, followed by four bytes
+  (00 00 ff ff).
+
+    If flush is set to Z_PARTIAL_FLUSH, all pending output is flushed to the
+  output buffer, but the output is not aligned to a byte boundary.  All of the
+  input data so far will be available to the decompressor, as for Z_SYNC_FLUSH.
+  This completes the current deflate block and follows it with an empty fixed
+  codes block that is 10 bits long.  This assures that enough bytes are output
+  in order for the decompressor to finish the block before the empty fixed
+  codes block.
+
+    If flush is set to Z_BLOCK, a deflate block is completed and emitted, as
+  for Z_SYNC_FLUSH, but the output is not aligned on a byte boundary, and up to
+  seven bits of the current block are held to be written as the next byte after
+  the next deflate block is completed.  In this case, the decompressor may not
+  be provided enough bits at this point in order to complete decompression of
+  the data provided so far to the compressor.  It may need to wait for the next
+  block to be emitted.  This is for advanced applications that need to control
+  the emission of deflate blocks.
+
+    If flush is set to Z_FULL_FLUSH, all output is flushed as with
+  Z_SYNC_FLUSH, and the compression state is reset so that decompression can
+  restart from this point if previous compressed data has been damaged or if
+  random access is desired.  Using Z_FULL_FLUSH too often can seriously degrade
+  compression.
+
+    If deflate returns with avail_out == 0, this function must be called again
+  with the same value of the flush parameter and more output space (updated
+  avail_out), until the flush is complete (deflate returns with non-zero
+  avail_out).  In the case of a Z_FULL_FLUSH or Z_SYNC_FLUSH, make sure that
+  avail_out is greater than six when the flush marker begins, in order to avoid
+  repeated flush markers upon calling deflate() again when avail_out == 0.
+
+    If the parameter flush is set to Z_FINISH, pending input is processed,
+  pending output is flushed and deflate returns with Z_STREAM_END if there was
+  enough output space.  If deflate returns with Z_OK or Z_BUF_ERROR, this
+  function must be called again with Z_FINISH and more output space (updated
+  avail_out) but no more input data, until it returns with Z_STREAM_END or an
+  error.  After deflate has returned Z_STREAM_END, the only possible operations
+  on the stream are deflateReset or deflateEnd.
+
+    Z_FINISH can be used in the first deflate call after deflateInit if all the
+  compression is to be done in a single step.  In order to complete in one
+  call, avail_out must be at least the value returned by deflateBound (see
+  below).  Then deflate is guaranteed to return Z_STREAM_END.  If not enough
+  output space is provided, deflate will not return Z_STREAM_END, and it must
+  be called again as described above.
+
+    deflate() sets strm->adler to the Adler-32 checksum of all input read
+  so far (that is, total_in bytes).  If a gzip stream is being generated, then
+  strm->adler will be the CRC-32 checksum of the input read so far.  (See
+  deflateInit2 below.)
+
+    deflate() may update strm->data_type if it can make a good guess about
+  the input data type (Z_BINARY or Z_TEXT).  If in doubt, the data is
+  considered binary.  This field is only for information purposes and does not
+  affect the compression algorithm in any manner.
+
+    deflate() returns Z_OK if some progress has been made (more input
+  processed or more output produced), Z_STREAM_END if all input has been
+  consumed and all output has been produced (only when flush is set to
+  Z_FINISH), Z_STREAM_ERROR if the stream state was inconsistent (for example
+  if next_in or next_out was NULL) or the state was inadvertently written over
+  by the application), or Z_BUF_ERROR if no progress is possible (for example
+  avail_in or avail_out was zero).  Note that Z_BUF_ERROR is not fatal, and
+  deflate() can be called again with more input and more output space to
+  continue compressing.
+*/
+
+
+Z_EXTERN int Z_EXPORT deflateEnd(z_stream *strm);
+/*
+     All dynamically allocated data structures for this stream are freed.
+   This function discards any unprocessed input and does not flush any pending
+   output.
+
+     deflateEnd returns Z_OK if success, Z_STREAM_ERROR if the
+   stream state was inconsistent, Z_DATA_ERROR if the stream was freed
+   prematurely (some input or output was discarded).  In the error case, msg
+   may be set but then points to a static string (which must not be
+   deallocated).
+*/
+
+
+/*
+Z_EXTERN int Z_EXPORT inflateInit (z_stream *strm);
+
+     Initializes the internal stream state for decompression.  The fields
+   next_in, avail_in, zalloc, zfree and opaque must be initialized before by
+   the caller.  In the current version of inflate, the provided input is not
+   read or consumed.  The allocation of a sliding window will be deferred to
+   the first call of inflate (if the decompression does not complete on the
+   first call).  If zalloc and zfree are set to Z_NULL, inflateInit updates
+   them to use default allocation functions.  total_in, total_out, adler, and
+   msg are initialized.
+
+     inflateInit returns Z_OK if success, Z_MEM_ERROR if there was not enough
+   memory, Z_VERSION_ERROR if the zlib library version is incompatible with the
+   version assumed by the caller, or Z_STREAM_ERROR if the parameters are
+   invalid, such as a null pointer to the structure.  msg is set to null if
+   there is no error message.  inflateInit does not perform any decompression.
+   Actual decompression will be done by inflate().  So next_in, and avail_in,
+   next_out, and avail_out are unused and unchanged.  The current
+   implementation of inflateInit() does not process any header information --
+   that is deferred until inflate() is called.
+*/
+
+
+Z_EXTERN int Z_EXPORT inflate(z_stream *strm, int flush);
+/*
+    inflate decompresses as much data as possible, and stops when the input
+  buffer becomes empty or the output buffer becomes full.  It may introduce
+  some output latency (reading input without producing any output) except when
+  forced to flush.
+
+  The detailed semantics are as follows.  inflate performs one or both of the
+  following actions:
+
+  - Decompress more input starting at next_in and update next_in and avail_in
+    accordingly.  If not all input can be processed (because there is not
+    enough room in the output buffer), then next_in and avail_in are updated
+    accordingly, and processing will resume at this point for the next call of
+    inflate().
+
+  - Generate more output starting at next_out and update next_out and avail_out
+    accordingly.  inflate() provides as much output as possible, until there is
+    no more input data or no more space in the output buffer (see below about
+    the flush parameter).
+
+    Before the call of inflate(), the application should ensure that at least
+  one of the actions is possible, by providing more input and/or consuming more
+  output, and updating the next_* and avail_* values accordingly.  If the
+  caller of inflate() does not provide both available input and available
+  output space, it is possible that there will be no progress made.  The
+  application can consume the uncompressed output when it wants, for example
+  when the output buffer is full (avail_out == 0), or after each call of
+  inflate().  If inflate returns Z_OK and with zero avail_out, it must be
+  called again after making room in the output buffer because there might be
+  more output pending.
+
+    The flush parameter of inflate() can be Z_NO_FLUSH, Z_SYNC_FLUSH, Z_FINISH,
+  Z_BLOCK, or Z_TREES.  Z_SYNC_FLUSH requests that inflate() flush as much
+  output as possible to the output buffer.  Z_BLOCK requests that inflate()
+  stop if and when it gets to the next deflate block boundary.  When decoding
+  the zlib or gzip format, this will cause inflate() to return immediately
+  after the header and before the first block.  When doing a raw inflate,
+  inflate() will go ahead and process the first block, and will return when it
+  gets to the end of that block, or when it runs out of data.
+
+    The Z_BLOCK option assists in appending to or combining deflate streams.
+  To assist in this, on return inflate() always sets strm->data_type to the
+  number of unused bits in the input taken from strm->next_in, plus 64 if
+  inflate() is currently decoding the last block in the deflate stream, plus
+  128 if inflate() returned immediately after decoding an end-of-block code or
+  decoding the complete header up to just before the first byte of the deflate
+  stream.  The end-of-block will not be indicated until all of the uncompressed
+  data from that block has been written to strm->next_out.  The number of
+  unused bits may in general be greater than seven, except when bit 7 of
+  data_type is set, in which case the number of unused bits will be less than
+  eight.  data_type is set as noted here every time inflate() returns for all
+  flush options, and so can be used to determine the amount of currently
+  consumed input in bits.
+
+    The Z_TREES option behaves as Z_BLOCK does, but it also returns when the
+  end of each deflate block header is reached, before any actual data in that
+  block is decoded.  This allows the caller to determine the length of the
+  deflate block header for later use in random access within a deflate block.
+  256 is added to the value of strm->data_type when inflate() returns
+  immediately after reaching the end of the deflate block header.
+
+    inflate() should normally be called until it returns Z_STREAM_END or an
+  error.  However if all decompression is to be performed in a single step (a
+  single call of inflate), the parameter flush should be set to Z_FINISH.  In
+  this case all pending input is processed and all pending output is flushed;
+  avail_out must be large enough to hold all of the uncompressed data for the
+  operation to complete.  (The size of the uncompressed data may have been
+  saved by the compressor for this purpose.)  The use of Z_FINISH is not
+  required to perform an inflation in one step.  However it may be used to
+  inform inflate that a faster approach can be used for the single inflate()
+  call.  Z_FINISH also informs inflate to not maintain a sliding window if the
+  stream completes, which reduces inflate's memory footprint.  If the stream
+  does not complete, either because not all of the stream is provided or not
+  enough output space is provided, then a sliding window will be allocated and
+  inflate() can be called again to continue the operation as if Z_NO_FLUSH had
+  been used.
+
+     In this implementation, inflate() always flushes as much output as
+  possible to the output buffer, and always uses the faster approach on the
+  first call.  So the effects of the flush parameter in this implementation are
+  on the return value of inflate() as noted below, when inflate() returns early
+  when Z_BLOCK or Z_TREES is used, and when inflate() avoids the allocation of
+  memory for a sliding window when Z_FINISH is used.
+
+     If a preset dictionary is needed after this call (see inflateSetDictionary
+  below), inflate sets strm->adler to the Adler-32 checksum of the dictionary
+  chosen by the compressor and returns Z_NEED_DICT; otherwise it sets
+  strm->adler to the Adler-32 checksum of all output produced so far (that is,
+  total_out bytes) and returns Z_OK, Z_STREAM_END or an error code as described
+  below.  At the end of the stream, inflate() checks that its computed Adler-32
+  checksum is equal to that saved by the compressor and returns Z_STREAM_END
+  only if the checksum is correct.
+
+    inflate() can decompress and check either zlib-wrapped or gzip-wrapped
+  deflate data.  The header type is detected automatically, if requested when
+  initializing with inflateInit2().  Any information contained in the gzip
+  header is not retained unless inflateGetHeader() is used.  When processing
+  gzip-wrapped deflate data, strm->adler32 is set to the CRC-32 of the output
+  produced so far.  The CRC-32 is checked against the gzip trailer, as is the
+  uncompressed length, modulo 2^32.
+
+    inflate() returns Z_OK if some progress has been made (more input processed
+  or more output produced), Z_STREAM_END if the end of the compressed data has
+  been reached and all uncompressed output has been produced, Z_NEED_DICT if a
+  preset dictionary is needed at this point, Z_DATA_ERROR if the input data was
+  corrupted (input stream not conforming to the zlib format or incorrect check
+  value, in which case strm->msg points to a string with a more specific
+  error), Z_STREAM_ERROR if the stream structure was inconsistent (for example
+  next_in or next_out was NULL, or the state was inadvertently written over
+  by the application), Z_MEM_ERROR if there was not enough memory, Z_BUF_ERROR
+  if no progress is possible or if there was not enough room in the output
+  buffer when Z_FINISH is used.  Note that Z_BUF_ERROR is not fatal, and
+  inflate() can be called again with more input and more output space to
+  continue decompressing.  If Z_DATA_ERROR is returned, the application may
+  then call inflateSync() to look for a good compression block if a partial
+  recovery of the data is to be attempted.
+*/
+
+
+Z_EXTERN int Z_EXPORT inflateEnd(z_stream *strm);
+/*
+     All dynamically allocated data structures for this stream are freed.
+   This function discards any unprocessed input and does not flush any pending
+   output.
+
+     inflateEnd returns Z_OK if success, or Z_STREAM_ERROR if the stream state
+   was inconsistent.
+*/
+
+
+                        /* Advanced functions */
+
+/*
+    The following functions are needed only in some special applications.
+*/
+
+/*
+Z_EXTERN int Z_EXPORT deflateInit2 (z_stream *strm,
+                                     int  level,
+                                     int  method,
+                                     int  windowBits,
+                                     int  memLevel,
+                                     int  strategy);
+
+     This is another version of deflateInit with more compression options.  The
+   fields zalloc, zfree and opaque must be initialized before by the caller.
+
+     The method parameter is the compression method.  It must be Z_DEFLATED in
+   this version of the library.
+
+     The windowBits parameter is the base two logarithm of the window size
+   (the size of the history buffer).  It should be in the range 8..15 for this
+   version of the library.  Larger values of this parameter result in better
+   compression at the expense of memory usage.  The default value is 15 if
+   deflateInit is used instead.
+
+     For the current implementation of deflate(), a windowBits value of 8 (a
+   window size of 256 bytes) is not supported.  As a result, a request for 8
+   will result in 9 (a 512-byte window).  In that case, providing 8 to
+   inflateInit2() will result in an error when the zlib header with 9 is
+   checked against the initialization of inflate().  The remedy is to not use 8
+   with deflateInit2() with this initialization, or at least in that case use 9
+   with inflateInit2().
+
+     windowBits can also be -8..-15 for raw deflate.  In this case, -windowBits
+   determines the window size.  deflate() will then generate raw deflate data
+   with no zlib header or trailer, and will not compute a check value.
+
+     windowBits can also be greater than 15 for optional gzip encoding.  Add
+   16 to windowBits to write a simple gzip header and trailer around the
+   compressed data instead of a zlib wrapper.  The gzip header will have no
+   file name, no extra data, no comment, no modification time (set to zero), no
+   header crc, and the operating system will be set to the appropriate value,
+   if the operating system was determined at compile time.  If a gzip stream is
+   being written, strm->adler is a CRC-32 instead of an Adler-32.
+
+     For raw deflate or gzip encoding, a request for a 256-byte window is
+   rejected as invalid, since only the zlib header provides a means of
+   transmitting the window size to the decompressor.
+
+     The memLevel parameter specifies how much memory should be allocated
+   for the internal compression state.  memLevel=1 uses minimum memory but is
+   slow and reduces compression ratio; memLevel=9 uses maximum memory for
+   optimal speed.  The default value is 8.  See zconf.h for total memory usage
+   as a function of windowBits and memLevel.
+
+     The strategy parameter is used to tune the compression algorithm.  Use the
+   value Z_DEFAULT_STRATEGY for normal data, Z_FILTERED for data produced by a
+   filter (or predictor), Z_RLE to limit match distances to one (run-length
+   encoding), or Z_HUFFMAN_ONLY to force Huffman encoding only (no string
+   matching).  Filtered data consists mostly of small values with a somewhat
+   random distribution, as produced by the PNG filters.  In this case, the
+   compression algorithm is tuned to compress them better.  The effect of
+   Z_FILTERED is to force more Huffman coding and less string matching than the
+   default; it is intermediate between Z_DEFAULT_STRATEGY and Z_HUFFMAN_ONLY.
+   Z_RLE is almost as fast as Z_HUFFMAN_ONLY, but should give better
+   compression for PNG image data than Huffman only.  The degree of string
+   matching from most to none is: Z_DEFAULT_STRATEGY, Z_FILTERED, Z_RLE, then
+   Z_HUFFMAN_ONLY. The strategy parameter affects the compression ratio but
+   never the correctness of the compressed output, even if it is not set
+   optimally for the given data.  Z_FIXED uses the default string matching, but
+   prevents the use of dynamic Huffman codes, allowing for a simpler decoder
+   for special applications.
+
+     deflateInit2 returns Z_OK if success, Z_MEM_ERROR if there was not enough
+   memory, Z_STREAM_ERROR if any parameter is invalid (such as an invalid
+   method), or Z_VERSION_ERROR if the zlib library version (zlib_version) is
+   incompatible with the version assumed by the caller (ZLIB_VERSION).  msg is
+   set to null if there is no error message.  deflateInit2 does not perform any
+   compression: this will be done by deflate().
+*/
+
+Z_EXTERN int Z_EXPORT deflateSetDictionary(z_stream *strm,
+                                             const unsigned char *dictionary,
+                                             unsigned int dictLength);
+/*
+     Initializes the compression dictionary from the given byte sequence
+   without producing any compressed output.  When using the zlib format, this
+   function must be called immediately after deflateInit, deflateInit2 or
+   deflateReset, and before any call of deflate.  When doing raw deflate, this
+   function must be called either before any call of deflate, or immediately
+   after the completion of a deflate block, i.e. after all input has been
+   consumed and all output has been delivered when using any of the flush
+   options Z_BLOCK, Z_PARTIAL_FLUSH, Z_SYNC_FLUSH, or Z_FULL_FLUSH.  The
+   compressor and decompressor must use exactly the same dictionary (see
+   inflateSetDictionary).
+
+     The dictionary should consist of strings (byte sequences) that are likely
+   to be encountered later in the data to be compressed, with the most commonly
+   used strings preferably put towards the end of the dictionary.  Using a
+   dictionary is most useful when the data to be compressed is short and can be
+   predicted with good accuracy; the data can then be compressed better than
+   with the default empty dictionary.
+
+     Depending on the size of the compression data structures selected by
+   deflateInit or deflateInit2, a part of the dictionary may in effect be
+   discarded, for example if the dictionary is larger than the window size
+   provided in deflateInit or deflateInit2.  Thus the strings most likely to be
+   useful should be put at the end of the dictionary, not at the front.  In
+   addition, the current implementation of deflate will use at most the window
+   size minus 262 bytes of the provided dictionary.
+
+     Upon return of this function, strm->adler is set to the Adler-32 value
+   of the dictionary; the decompressor may later use this value to determine
+   which dictionary has been used by the compressor.  (The Adler-32 value
+   applies to the whole dictionary even if only a subset of the dictionary is
+   actually used by the compressor.) If a raw deflate was requested, then the
+   Adler-32 value is not computed and strm->adler is not set.
+
+     deflateSetDictionary returns Z_OK if success, or Z_STREAM_ERROR if a
+   parameter is invalid (e.g.  dictionary being NULL) or the stream state is
+   inconsistent (for example if deflate has already been called for this stream
+   or if not at a block boundary for raw deflate).  deflateSetDictionary does
+   not perform any compression: this will be done by deflate().
+*/
+
+Z_EXTERN int Z_EXPORT deflateGetDictionary (z_stream *strm, unsigned char *dictionary, unsigned int *dictLength);
+/*
+     Returns the sliding dictionary being maintained by deflate.  dictLength is
+   set to the number of bytes in the dictionary, and that many bytes are copied
+   to dictionary.  dictionary must have enough space, where 32768 bytes is
+   always enough.  If deflateGetDictionary() is called with dictionary equal to
+   Z_NULL, then only the dictionary length is returned, and nothing is copied.
+   Similarly, if dictLength is Z_NULL, then it is not set.
+
+     deflateGetDictionary() may return a length less than the window size, even
+   when more than the window size in input has been provided. It may return up
+   to 258 bytes less in that case, due to how zlib's implementation of deflate
+   manages the sliding window and lookahead for matches, where matches can be
+   up to 258 bytes long. If the application needs the last window-size bytes of
+   input, then that would need to be saved by the application outside of zlib.
+
+     deflateGetDictionary returns Z_OK on success, or Z_STREAM_ERROR if the
+   stream state is inconsistent.
+*/
+
+Z_EXTERN int Z_EXPORT deflateCopy(z_stream *dest, z_stream *source);
+/*
+     Sets the destination stream as a complete copy of the source stream.
+
+     This function can be useful when several compression strategies will be
+   tried, for example when there are several ways of pre-processing the input
+   data with a filter.  The streams that will be discarded should then be freed
+   by calling deflateEnd.  Note that deflateCopy duplicates the internal
+   compression state which can be quite large, so this strategy is slow and can
+   consume lots of memory.
+
+     deflateCopy returns Z_OK if success, Z_MEM_ERROR if there was not
+   enough memory, Z_STREAM_ERROR if the source stream state was inconsistent
+   (such as zalloc being NULL).  msg is left unchanged in both source and
+   destination.
+*/
+
+Z_EXTERN int Z_EXPORT deflateReset(z_stream *strm);
+/*
+     This function is equivalent to deflateEnd followed by deflateInit, but
+   does not free and reallocate the internal compression state.  The stream
+   will leave the compression level and any other attributes that may have been
+   set unchanged.  total_in, total_out, adler, and msg are initialized.
+
+     deflateReset returns Z_OK if success, or Z_STREAM_ERROR if the source
+   stream state was inconsistent (such as zalloc or state being NULL).
+*/
+
+Z_EXTERN int Z_EXPORT deflateParams(z_stream *strm, int level, int strategy);
+/*
+     Dynamically update the compression level and compression strategy.  The
+   interpretation of level and strategy is as in deflateInit2().  This can be
+   used to switch between compression and straight copy of the input data, or
+   to switch to a different kind of input data requiring a different strategy.
+   If the compression approach (which is a function of the level) or the
+   strategy is changed, and if there have been any deflate() calls since the
+   state was initialized or reset, then the input available so far is
+   compressed with the old level and strategy using deflate(strm, Z_BLOCK).
+   There are three approaches for the compression levels 0, 1..3, and 4..9
+   respectively.  The new level and strategy will take effect at the next call
+   of deflate().
+
+     If a deflate(strm, Z_BLOCK) is performed by deflateParams(), and it does
+   not have enough output space to complete, then the parameter change will not
+   take effect.  In this case, deflateParams() can be called again with the
+   same parameters and more output space to try again.
+
+     In order to assure a change in the parameters on the first try, the
+   deflate stream should be flushed using deflate() with Z_BLOCK or other flush
+   request until strm.avail_out is not zero, before calling deflateParams().
+   Then no more input data should be provided before the deflateParams() call.
+   If this is done, the old level and strategy will be applied to the data
+   compressed before deflateParams(), and the new level and strategy will be
+   applied to the data compressed after deflateParams().
+
+     deflateParams returns Z_OK on success, Z_STREAM_ERROR if the source stream
+   state was inconsistent or if a parameter was invalid, or Z_BUF_ERROR if
+   there was not enough output space to complete the compression of the
+   available input data before a change in the strategy or approach.  Note that
+   in the case of a Z_BUF_ERROR, the parameters are not changed.  A return
+   value of Z_BUF_ERROR is not fatal, in which case deflateParams() can be
+   retried with more output space.
+*/
+
+Z_EXTERN int Z_EXPORT deflateTune(z_stream *strm, int good_length, int max_lazy, int nice_length, int max_chain);
+/*
+     Fine tune deflate's internal compression parameters.  This should only be
+   used by someone who understands the algorithm used by zlib's deflate for
+   searching for the best matching string, and even then only by the most
+   fanatic optimizer trying to squeeze out the last compressed bit for their
+   specific input data.  Read the deflate.c source code for the meaning of the
+   max_lazy, good_length, nice_length, and max_chain parameters.
+
+     deflateTune() can be called after deflateInit() or deflateInit2(), and
+   returns Z_OK on success, or Z_STREAM_ERROR for an invalid deflate stream.
+ */
+
+Z_EXTERN unsigned long Z_EXPORT deflateBound(z_stream *strm, unsigned long sourceLen);
+Z_EXTERN z_size_t Z_EXPORT deflateBound_z(z_stream *strm, z_size_t sourceLen);
+/*
+     deflateBound() returns an upper bound on the compressed size after
+   deflation of sourceLen bytes.  It must be called after deflateInit() or
+   deflateInit2(), and after deflateSetHeader(), if used.  This would be used
+   to allocate an output buffer for deflation in a single pass, and so would be
+   called before deflate().  If that first deflate() call is provided the
+   sourceLen input bytes, an output buffer allocated to the size returned by
+   deflateBound(), and the flush value Z_FINISH, then deflate() is guaranteed
+   to return Z_STREAM_END.  Note that it is possible for the compressed size to
+   be larger than the value returned by deflateBound() if flush options other
+   than Z_FINISH or Z_NO_FLUSH are used.
+
+     deflateBound_z() is the same, but takes and returns a size_t length.  Note
+   that a long is 32 bits on Windows.
+*/
+
+Z_EXTERN int Z_EXPORT deflatePending(z_stream *strm, uint32_t *pending, int *bits);
+/*
+     deflatePending() returns the number of bytes and bits of output that have
+   been generated, but not yet provided in the available output.  The bytes not
+   provided would be due to the available output space having being consumed.
+   The number of bits of output not provided are between 0 and 7, where they
+   await more bits to join them in order to fill out a full byte.  If pending
+   or bits are NULL, then those values are not set.
+
+     deflatePending returns Z_OK if success, or Z_STREAM_ERROR if the source
+   stream state was inconsistent.
+ */
+
+Z_EXTERN int Z_EXPORT deflateUsed(z_stream *strm, int *bits);
+/*
+     deflateUsed() returns in *bits the most recent number of deflate bits used
+   in the last byte when flushing to a byte boundary. The result is in 1..8, or
+   0 if there has not yet been a flush. This helps determine the location of
+   the last bit of a deflate stream.
+
+     deflateUsed returns Z_OK if success, or Z_STREAM_ERROR if the source
+   stream state was inconsistent.
+ */
+
+Z_EXTERN int Z_EXPORT deflatePrime(z_stream *strm, int bits, int value);
+/*
+     deflatePrime() inserts bits in the deflate output stream.  The intent
+   is that this function is used to start off the deflate output with the bits
+   leftover from a previous deflate stream when appending to it.  As such, this
+   function can only be used for raw deflate, and must be used before the first
+   deflate() call after a deflateInit2() or deflateReset().  bits must be less
+   than or equal to 16, and that many of the least significant bits of value
+   will be inserted in the output.
+
+     deflatePrime returns Z_OK if success, Z_BUF_ERROR if there was not enough
+   room in the internal buffer to insert the bits, or Z_STREAM_ERROR if the
+   source stream state was inconsistent.
+*/
+
+Z_EXTERN int Z_EXPORT deflateSetHeader(z_stream *strm, gz_headerp head);
+/*
+     deflateSetHeader() provides gzip header information for when a gzip
+   stream is requested by deflateInit2().  deflateSetHeader() may be called
+   after deflateInit2() or deflateReset() and before the first call of
+   deflate().  The text, time, os, extra field, name, and comment information
+   in the provided gz_header structure are written to the gzip header (xflag is
+   ignored -- the extra flags are set according to the compression level).  The
+   caller must assure that, if not NULL, name and comment are terminated with
+   a zero byte, and that if extra is not NULL, that extra_len bytes are
+   available there.  If hcrc is true, a gzip header crc is included.  Note that
+   the current versions of the command-line version of gzip (up through version
+   1.3.x) do not support header crc's, and will report that it is a "multi-part
+   gzip file" and give up.
+
+     If deflateSetHeader is not used, the default gzip header has text false,
+   the time set to zero, and os set to the current operating system, with no
+   extra, name, or comment fields.  The gzip header is returned to the default
+   state by deflateReset().
+
+     deflateSetHeader returns Z_OK if success, or Z_STREAM_ERROR if the source
+   stream state was inconsistent.
+*/
+
+/*
+Z_EXTERN int Z_EXPORT inflateInit2(z_stream *strm, int  windowBits);
+
+     This is another version of inflateInit with an extra parameter.  The
+   fields next_in, avail_in, zalloc, zfree and opaque must be initialized
+   before by the caller.
+
+     The windowBits parameter is the base two logarithm of the maximum window
+   size (the size of the history buffer).  It should be in the range 8..15 for
+   this version of the library.  The default value is 15 if inflateInit is used
+   instead.  windowBits must be greater than or equal to the windowBits value
+   provided to deflateInit2() while compressing, or it must be equal to 15 if
+   deflateInit2() was not used.  If a compressed stream with a larger window
+   size is given as input, inflate() will return with the error code
+   Z_DATA_ERROR instead of trying to allocate a larger window.
+
+     windowBits can also be zero to request that inflate use the window size in
+   the zlib header of the compressed stream.
+
+     windowBits can also be -8..-15 for raw inflate.  In this case, -windowBits
+   determines the window size.  inflate() will then process raw deflate data,
+   not looking for a zlib or gzip header, not generating a check value, and not
+   looking for any check values for comparison at the end of the stream.  This
+   is for use with other formats that use the deflate compressed data format
+   such as zip.  Those formats provide their own check values.  If a custom
+   format is developed using the raw deflate format for compressed data, it is
+   recommended that a check value such as an Adler-32 or a CRC-32 be applied to
+   the uncompressed data as is done in the zlib, gzip, and zip formats.  For
+   most applications, the zlib format should be used as is.  Note that comments
+   above on the use in deflateInit2() applies to the magnitude of windowBits.
+
+     windowBits can also be greater than 15 for optional gzip decoding.  Add
+   32 to windowBits to enable zlib and gzip decoding with automatic header
+   detection, or add 16 to decode only the gzip format (the zlib format will
+   return a Z_DATA_ERROR).  If a gzip stream is being decoded, strm->adler is a
+   CRC-32 instead of an Adler-32.  Unlike the gunzip utility and gzread() (see
+   below), inflate() will *not* automatically decode concatenated gzip members.
+   inflate() will return Z_STREAM_END at the end of the gzip member.  The state
+   would need to be reset to continue decoding a subsequent gzip member.  This
+   *must* be done if there is more data after a gzip member, in order for the
+   decompression to be compliant with the gzip standard (RFC 1952).
+
+     inflateInit2 returns Z_OK if success, Z_MEM_ERROR if there was not enough
+   memory, Z_VERSION_ERROR if the zlib library version is incompatible with the
+   version assumed by the caller, or Z_STREAM_ERROR if the parameters are
+   invalid, such as a null pointer to the structure.  msg is set to null if
+   there is no error message.  inflateInit2 does not perform any decompression
+   apart from possibly reading the zlib header if present: actual decompression
+   will be done by inflate().  (So next_in and avail_in may be modified, but
+   next_out and avail_out are unused and unchanged.) The current implementation
+   of inflateInit2() does not process any header information -- that is
+   deferred until inflate() is called.
+*/
+
+Z_EXTERN int Z_EXPORT inflateSetDictionary(z_stream *strm, const unsigned char *dictionary, unsigned int dictLength);
+/*
+     Initializes the decompression dictionary from the given uncompressed byte
+   sequence.  This function must be called immediately after a call of inflate,
+   if that call returned Z_NEED_DICT.  The dictionary chosen by the compressor
+   can be determined from the Adler-32 value returned by that call of inflate.
+   The compressor and decompressor must use exactly the same dictionary (see
+   deflateSetDictionary).  For raw inflate, this function can be called at any
+   time to set the dictionary.  If the provided dictionary is smaller than the
+   window and there is already data in the window, then the provided dictionary
+   will amend what's there.  The application must ensure that the dictionary
+   that was used for compression is provided.
+
+     inflateSetDictionary returns Z_OK if success, Z_STREAM_ERROR if a
+   parameter is invalid (e.g.  dictionary being NULL) or the stream state is
+   inconsistent, Z_DATA_ERROR if the given dictionary doesn't match the
+   expected one (incorrect Adler-32 value).  inflateSetDictionary does not
+   perform any decompression: this will be done by subsequent calls of
+   inflate().
+*/
+
+Z_EXTERN int Z_EXPORT inflateGetDictionary(z_stream *strm, unsigned char *dictionary, unsigned int *dictLength);
+/*
+     Returns the sliding dictionary being maintained by inflate.  dictLength is
+   set to the number of bytes in the dictionary, and that many bytes are copied
+   to dictionary.  dictionary must have enough space, where 32768 bytes is
+   always enough.  If inflateGetDictionary() is called with dictionary equal to
+   NULL, then only the dictionary length is returned, and nothing is copied.
+   Similarly, if dictLength is NULL, then it is not set.
+
+     inflateGetDictionary returns Z_OK on success, or Z_STREAM_ERROR if the
+   stream state is inconsistent.
+*/
+
+Z_EXTERN int Z_EXPORT inflateSync(z_stream *strm);
+/*
+     Skips invalid compressed data until a possible full flush point (see above
+   for the description of deflate with Z_FULL_FLUSH) can be found, or until all
+   available input is skipped.  No output is provided.
+
+     inflateSync searches for a 00 00 FF FF pattern in the compressed data.
+   All full flush points have this pattern, but not all occurrences of this
+   pattern are full flush points.
+
+     inflateSync returns Z_OK if a possible full flush point has been found,
+   Z_BUF_ERROR if no more input was provided, Z_DATA_ERROR if no flush point
+   has been found, or Z_STREAM_ERROR if the stream structure was inconsistent.
+   In the success case, the application may save the current value of
+   total_in which indicates where valid compressed data was found.  In the
+   error case, the application may repeatedly call inflateSync, providing more
+   input each time, until success or end of the input data.
+*/
+
+Z_EXTERN int Z_EXPORT inflateCopy(z_stream *dest, z_stream *source);
+/*
+     Sets the destination stream as a complete copy of the source stream.
+
+     This function can be useful when randomly accessing a large stream.  The
+   first pass through the stream can periodically record the inflate state,
+   allowing restarting inflate at those points when randomly accessing the
+   stream.
+
+     inflateCopy returns Z_OK if success, Z_MEM_ERROR if there was not
+   enough memory, Z_STREAM_ERROR if the source stream state was inconsistent
+   (such as zalloc being NULL).  msg is left unchanged in both source and
+   destination.
+*/
+
+Z_EXTERN int Z_EXPORT inflateReset(z_stream *strm);
+/*
+     This function is equivalent to inflateEnd followed by inflateInit,
+   but does not free and reallocate the internal decompression state.  The
+   stream will keep attributes that may have been set by inflateInit2.
+   total_in, total_out, adler, and msg are initialized.
+
+     inflateReset returns Z_OK if success, or Z_STREAM_ERROR if the source
+   stream state was inconsistent (such as zalloc or state being NULL).
+*/
+
+Z_EXTERN int Z_EXPORT inflateReset2(z_stream *strm, int windowBits);
+/*
+     This function is the same as inflateReset, but it also permits changing
+   the wrap and window size requests.  The windowBits parameter is interpreted
+   the same as it is for inflateInit2.  If the window size is changed, then the
+   memory allocated for the window is freed, and the window will be reallocated
+   by inflate() if needed.
+
+     inflateReset2 returns Z_OK if success, or Z_STREAM_ERROR if the source
+   stream state was inconsistent (such as zalloc or state being NULL), or if
+   the windowBits parameter is invalid.
+*/
+
+Z_EXTERN int Z_EXPORT inflatePrime(z_stream *strm, int bits, int value);
+/*
+     This function inserts bits in the inflate input stream.  The intent is to
+   use inflatePrime() to start inflating at a bit position in the middle of a
+   byte.  The provided bits will be used before any bytes are used from
+   next_in.  This function should be used with raw inflate, before the first
+   inflate() call, after inflateInit2() or inflateReset().  It can also be used
+   after an inflate() return indicates the end of a deflate block or header
+   when using Z_BLOCK.  bits must be less than or equal to 16, and that many of
+   the least significant bits of value will be inserted in the input.  The
+   other bits in value can be non-zero, and will be ignored.
+
+     If bits is negative, then the input stream bit buffer is emptied.  Then
+   inflatePrime() can be called again to put bits in the buffer.  This is used
+   to clear out bits leftover after feeding inflate a block description prior
+   to feeding inflate codes.
+
+     inflatePrime returns Z_OK if success, or Z_STREAM_ERROR if the source
+   stream state was inconsistent, or if bits is out of range.  If inflate was
+   in the middle of processing a header, trailer, or stored block lengths, then
+   it is possible for there to be only eight bits available in the bit buffer.
+   In that case, bits > 8 is considered out of range.  However, when used as
+   outlined above, there will always be 16 bits available in the buffer for
+   insertion.  As noted in its documentation above, inflate records the number
+   of bits in the bit buffer on return in data_type. 32 minus that is the
+   number of bits available for insertion.  inflatePrime does not update
+   data_type with the new number of bits in buffer.
+*/
+
+Z_EXTERN long Z_EXPORT inflateMark(z_stream *strm);
+/*
+     This function returns two values, one in the lower 16 bits of the return
+   value, and the other in the remaining upper bits, obtained by shifting the
+   return value down 16 bits.  If the upper value is -1 and the lower value is
+   zero, then inflate() is currently decoding information outside of a block.
+   If the upper value is -1 and the lower value is non-zero, then inflate is in
+   the middle of a stored block, with the lower value equaling the number of
+   bytes from the input remaining to copy.  If the upper value is not -1, then
+   it is the number of bits back from the current bit position in the input of
+   the code (literal or length/distance pair) currently being processed.  In
+   that case the lower value is the number of bytes already emitted for that
+   code.
+
+     A code is being processed if inflate is waiting for more input to complete
+   decoding of the code, or if it has completed decoding but is waiting for
+   more output space to write the literal or match data.
+
+     inflateMark() is used to mark locations in the input data for random
+   access, which may be at bit positions, and to note those cases where the
+   output of a code may span boundaries of random access blocks.  The current
+   location in the input stream can be determined from avail_in and data_type
+   as noted in the description for the Z_BLOCK flush parameter for inflate.
+
+     inflateMark returns the value noted above, or -65536 if the provided
+   source stream state was inconsistent.
+*/
+
+Z_EXTERN int Z_EXPORT inflateGetHeader(z_stream *strm, gz_headerp head);
+/*
+     inflateGetHeader() requests that gzip header information be stored in the
+   provided gz_header structure.  inflateGetHeader() may be called after
+   inflateInit2() or inflateReset(), and before the first call of inflate().
+   As inflate() processes the gzip stream, head->done is zero until the header
+   is completed, at which time head->done is set to one.  If a zlib stream is
+   being decoded, then head->done is set to -1 to indicate that there will be
+   no gzip header information forthcoming.  Note that Z_BLOCK or Z_TREES can be
+   used to force inflate() to return immediately after header processing is
+   complete and before any actual data is decompressed.
+
+     The text, time, xflags, and os fields are filled in with the gzip header
+   contents.  hcrc is set to true if there is a header CRC.  (The header CRC
+   was valid if done is set to one.)  The extra, name, and comment pointers
+   must each be either NULL or point to space to store that information from
+   the header.  If extra is not NULL, then extra_max contains the maximum
+   number of bytes that can be written to extra.  Once done is true, extra_len
+   contains the actual extra field length, and extra contains the extra field,
+   or that field truncated if extra_max is less than extra_len.  If name is not
+   NULL, then up to name_max characters, including the terminating zero, are
+   written there.  If comment is not NULL, then up to comm_max characters,
+   including the terminating zero, are written there.  The application can tell
+   that the name or comment did not fit in the provided space by the absence of
+   a terminating zero.  If any of extra, name, or comment are not present in
+   the header, then that field's pointer is set to NULL.  This allows the use
+   of deflateSetHeader() with the returned structure to duplicate the header.
+   Note that if those fields initially pointed to allocated memory, then the
+   application will need to save them elsewhere so that they can be eventually
+   freed.
+
+     If inflateGetHeader is not used, then the header information is simply
+   discarded.  The header is always checked for validity, including the header
+   CRC if present.  inflateReset() will reset the process to discard the header
+   information.  The application would need to call inflateGetHeader() again to
+   retrieve the header from the next gzip stream.
+
+     inflateGetHeader returns Z_OK if success, or Z_STREAM_ERROR if the source
+   stream state was inconsistent.
+*/
+
+/*
+Z_EXTERN int Z_EXPORT inflateBackInit (z_stream *strm, int windowBits, unsigned char *window);
+
+     Initialize the internal stream state for decompression using inflateBack()
+   calls.  The fields zalloc, zfree and opaque in strm must be initialized
+   before the call.  If zalloc and zfree are NULL, then the default library-
+   derived memory allocation routines are used.  windowBits is the base two
+   logarithm of the window size, in the range 8..15.  window is a caller
+   supplied buffer of that size.  Except for special applications where it is
+   assured that deflate was used with small window sizes, windowBits must be 15
+   and a 32K byte window must be supplied to be able to decompress general
+   deflate streams.
+
+     See inflateBack() for the usage of these routines.
+
+     inflateBackInit will return Z_OK on success, Z_STREAM_ERROR if any of
+   the parameters are invalid, Z_MEM_ERROR if the internal state could not be
+   allocated, or Z_VERSION_ERROR if the version of the library does not match
+   the version of the header file.
+*/
+
+typedef uint32_t (*in_func) (void *, z_const unsigned char * *);
+typedef int (*out_func) (void *, unsigned char *, uint32_t);
+
+Z_EXTERN int Z_EXPORT inflateBack(z_stream *strm, in_func in, void *in_desc, out_func out, void *out_desc);
+/*
+     inflateBack() does a raw inflate with a single call using a call-back
+   interface for input and output.  This is potentially more efficient than
+   inflate() for file i/o applications, in that it avoids copying between the
+   output and the sliding window by simply making the window itself the output
+   buffer.  inflate() can be faster on modern CPUs when used with large
+   buffers.  inflateBack() trusts the application to not change the output
+   buffer passed by the output function, at least until inflateBack() returns.
+
+     inflateBackInit() must be called first to allocate the internal state
+   and to initialize the state with the user-provided window buffer.
+   inflateBack() may then be used multiple times to inflate a complete, raw
+   deflate stream with each call.  inflateBackEnd() is then called to free the
+   allocated state.
+
+     A raw deflate stream is one with no zlib or gzip header or trailer.
+   This routine would normally be used in a utility that reads zip or gzip
+   files and writes out uncompressed files.  The utility would decode the
+   header and process the trailer on its own, hence this routine expects only
+   the raw deflate stream to decompress.  This is different from the default
+   behavior of inflate(), which expects a zlib header and trailer around the
+   deflate stream.
+
+     inflateBack() uses two subroutines supplied by the caller that are then
+   called by inflateBack() for input and output.  inflateBack() calls those
+   routines until it reads a complete deflate stream and writes out all of the
+   uncompressed data, or until it encounters an error.  The function's
+   parameters and return types are defined above in the in_func and out_func
+   typedefs.  inflateBack() will call in(in_desc, &buf) which should return the
+   number of bytes of provided input, and a pointer to that input in buf.  If
+   there is no input available, in() must return zero -- buf is ignored in that
+   case -- and inflateBack() will return a buffer error.  inflateBack() will
+   call out(out_desc, buf, len) to write the uncompressed data buf[0..len-1].
+   out() should return zero on success, or non-zero on failure.  If out()
+   returns non-zero, inflateBack() will return with an error.  Neither in() nor
+   out() are permitted to change the contents of the window provided to
+   inflateBackInit(), which is also the buffer that out() uses to write from.
+   The length written by out() will be at most the window size.  Any non-zero
+   amount of input may be provided by in().
+
+     For convenience, inflateBack() can be provided input on the first call by
+   setting strm->next_in and strm->avail_in.  If that input is exhausted, then
+   in() will be called.  Therefore strm->next_in must be initialized before
+   calling inflateBack().  If strm->next_in is NULL, then in() will be called
+   immediately for input.  If strm->next_in is not NULL, then strm->avail_in
+   must also be initialized, and then if strm->avail_in is not zero, input will
+   initially be taken from strm->next_in[0 ..  strm->avail_in - 1].
+
+     The in_desc and out_desc parameters of inflateBack() is passed as the
+   first parameter of in() and out() respectively when they are called.  These
+   descriptors can be optionally used to pass any information that the caller-
+   supplied in() and out() functions need to do their job.
+
+     On return, inflateBack() will set strm->next_in and strm->avail_in to
+   pass back any unused input that was provided by the last in() call.  The
+   return values of inflateBack() can be Z_STREAM_END on success, Z_BUF_ERROR
+   if in() or out() returned an error, Z_DATA_ERROR if there was a format error
+   in the deflate stream (in which case strm->msg is set to indicate the nature
+   of the error), or Z_STREAM_ERROR if the stream was not properly initialized.
+   In the case of Z_BUF_ERROR, an input or output error can be distinguished
+   using strm->next_in which will be NULL only if in() returned an error.  If
+   strm->next_in is not NULL, then the Z_BUF_ERROR was due to out() returning
+   non-zero.  (in() will always be called before out(), so strm->next_in is
+   assured to be defined if out() returns non-zero.)  Note that inflateBack()
+   cannot return Z_OK.
+*/
+
+Z_EXTERN int Z_EXPORT inflateBackEnd(z_stream *strm);
+/*
+     All memory allocated by inflateBackInit() is freed.
+
+     inflateBackEnd() returns Z_OK on success, or Z_STREAM_ERROR if the stream
+   state was inconsistent.
+*/
+
+Z_EXTERN unsigned long Z_EXPORT zlibCompileFlags(void);
+/* Return flags indicating compile-time options.
+
+    Type sizes, two bits each, 00 = 16 bits, 01 = 32, 10 = 64, 11 = other:
+     1.0: size of unsigned int
+     3.2: size of unsigned long
+     5.4: size of void * (pointer)
+     7.6: size of z_off_t
+
+    Compiler, assembler, and debug options:
+     8: ZLIB_DEBUG
+     9: ASMV or ASMINF -- use ASM code
+     10: ZLIB_WINAPI -- exported functions use the WINAPI calling convention
+     11: 0 (reserved)
+
+    One-time table building (smaller code, but not thread-safe if true):
+     12: BUILDFIXED -- build static block decoding tables when needed (not supported by zlib-ng)
+     13: DYNAMIC_CRC_TABLE -- build CRC calculation tables when needed
+     14,15: 0 (reserved)
+
+    Library content (indicates missing functionality):
+     16: NO_GZCOMPRESS -- gz* functions cannot compress (to avoid linking
+                          deflate code when not needed)
+     17: NO_GZIP -- deflate can't write gzip streams, and inflate can't detect
+                    and decode gzip streams (to avoid linking crc code)
+     18-19: 0 (reserved)
+
+    Operation variations (changes in library functionality):
+     20: PKZIP_BUG_WORKAROUND -- slightly more permissive inflate
+     21: FASTEST -- deflate algorithm with only one, lowest compression level
+     22,23: 0 (reserved)
+
+    The sprintf variant used by gzprintf (zero is best):
+     24: 0 = vs*, 1 = s* -- 1 means limited to 20 arguments after the format
+     25: 0 = *nprintf, 1 = *printf -- 1 means gzprintf() not secure!
+     26: 0 = returns value, 1 = void -- 1 means inferred string length returned
+
+    Remainder:
+     27-31: 0 (reserved)
+ */
+
+
+#ifndef Z_SOLO
+
+                        /* utility functions */
+
+/*
+     The following utility functions are implemented on top of the basic
+   stream-oriented functions.  To simplify the interface, some default options
+   are assumed (compression level and memory usage, standard memory allocation
+   functions).  The source code of these utility functions can be modified if
+   you need special options.  The _z versions of the functions use the size_t
+   type for lengths.  Note that a long is 32 bits on Windows.
+*/
+
+Z_EXTERN int Z_EXPORT compress(unsigned char *dest, unsigned long *destLen, const unsigned char *source, unsigned long sourceLen);
+Z_EXTERN int Z_EXPORT compress_z(unsigned char *dest, z_size_t *destLen, const unsigned char *source, z_size_t sourceLen);
+/*
+     Compresses the source buffer into the destination buffer.  sourceLen is
+   the byte length of the source buffer.  Upon entry, destLen is the total size
+   of the destination buffer, which must be at least the value returned by
+   compressBound(sourceLen).  Upon exit, destLen is the actual size of the
+   compressed data.  compress() is equivalent to compress2() with a level
+   parameter of Z_DEFAULT_COMPRESSION.
+
+     compress returns Z_OK if success, Z_MEM_ERROR if there was not
+   enough memory, Z_BUF_ERROR if there was not enough room in the output
+   buffer.
+*/
+
+Z_EXTERN int Z_EXPORT compress2(unsigned char *dest, unsigned long *destLen, const unsigned char *source,
+                              unsigned long sourceLen, int level);
+Z_EXTERN int Z_EXPORT compress2_z(unsigned char *dest, z_size_t *destLen, const unsigned char *source,
+                                  z_size_t sourceLen, int level);
+/*
+     Compresses the source buffer into the destination buffer.  The level
+   parameter has the same meaning as in deflateInit.  sourceLen is the byte
+   length of the source buffer.  Upon entry, destLen is the total size of the
+   destination buffer, which must be at least the value returned by
+   compressBound(sourceLen).  Upon exit, destLen is the actual size of the
+   compressed data.
+
+     compress2 returns Z_OK if success, Z_MEM_ERROR if there was not enough
+   memory, Z_BUF_ERROR if there was not enough room in the output buffer,
+   Z_STREAM_ERROR if the level parameter is invalid.
+*/
+
+Z_EXTERN unsigned long Z_EXPORT compressBound(unsigned long sourceLen);
+Z_EXTERN z_size_t Z_EXPORT compressBound_z(z_size_t sourceLen);
+/*
+     compressBound() returns an upper bound on the compressed size after
+   compress() or compress2() on sourceLen bytes.  It would be used before a
+   compress() or compress2() call to allocate the destination buffer.
+
+     compressBound_z() is the same, but takes and returns a size_t length.
+   Note that a long is 32 bits on Windows.
+*/
+
+Z_EXTERN int Z_EXPORT uncompress(unsigned char *dest, unsigned long *destLen, const unsigned char *source, unsigned long sourceLen);
+Z_EXTERN int Z_EXPORT uncompress_z(unsigned char *dest, z_size_t *destLen, const unsigned char *source, z_size_t sourceLen);
+/*
+     Decompresses the source buffer into the destination buffer.  sourceLen is
+   the byte length of the source buffer.  Upon entry, destLen is the total size
+   of the destination buffer, which must be large enough to hold the entire
+   uncompressed data.  (The size of the uncompressed data must have been saved
+   previously by the compressor and transmitted to the decompressor by some
+   mechanism outside the scope of this compression library.) Upon exit, destLen
+   is the actual size of the uncompressed data.
+
+     uncompress returns Z_OK if success, Z_MEM_ERROR if there was not
+   enough memory, Z_BUF_ERROR if there was not enough room in the output
+   buffer, or Z_DATA_ERROR if the input data was corrupted or incomplete.  In
+   the case where there is not enough room, uncompress() will fill the output
+   buffer with the uncompressed data up to that point.
+*/
+
+
+Z_EXTERN int Z_EXPORT uncompress2(unsigned char *dest, unsigned long *destLen,
+                                  const unsigned char *source, unsigned long *sourceLen);
+Z_EXTERN int Z_EXPORT uncompress2_z(unsigned char *dest, z_size_t *destLen,
+                                    const unsigned char *source, z_size_t *sourceLen);
+/*
+     Same as uncompress, except that sourceLen is a pointer, where the
+   length of the source is *sourceLen.  On return, *sourceLen is the number of
+   source bytes consumed.
+*/
+
+
+                        /* gzip file access functions */
+
+/*
+     This library supports reading and writing files in gzip (.gz) format with
+   an interface similar to that of stdio, using the functions that start with
+   "gz".  The gzip format is different from the zlib format.  gzip is a gzip
+   wrapper, documented in RFC 1952, wrapped around a deflate stream.
+*/
+
+typedef struct gzFile_s *gzFile;    /* semi-opaque gzip file descriptor */
+
+/*
+Z_EXTERN gzFile Z_EXPORT gzopen(const char *path, const char *mode);
+
+     Open the gzip (.gz) file at path for reading and decompressing, or
+   compressing and writing.  The mode parameter is as in fopen ("rb" or "wb")
+   but can also include a compression level ("wb9") or a strategy: 'f' for
+   filtered data as in "wb6f", 'h' for Huffman-only compression as in "wb1h",
+   'R' for run-length encoding as in "wb1R", or 'F' for fixed code compression
+   as in "wb9F".  (See the description of deflateInit2 for more information
+   about the strategy parameter.)  'T' will request transparent writing or
+   appending with no compression and not using the gzip format. 'T' cannot be
+   used to force transparent reading. Transparent reading is automatically
+   performed if there is no gzip header at the start. Transparent reading can
+   be disabled with the 'G' option, which will instead return an error if there
+   is no gzip header.
+
+     "a" can be used instead of "w" to request that the gzip stream that will
+   be written be appended to the file.  "+" will result in an error, since
+   reading and writing to the same gzip file is not supported.  The addition of
+   "x" when writing will create the file exclusively, which fails if the file
+   already exists.  On systems that support it, the addition of "e" when
+   reading or writing will set the flag to close the file on an execve() call.
+
+     These functions, as well as gzip, will read and decode a sequence of gzip
+   streams in a file.  The append function of gzopen() can be used to create
+   such a file.  (Also see gzflush() for another way to do this.)  When
+   appending, gzopen does not test whether the file begins with a gzip stream,
+   nor does it look for the end of the gzip streams to begin appending.  gzopen
+   will simply append a gzip stream to the existing file.
+
+     gzopen can be used to read a file which is not in gzip format; in this
+   case gzread will directly read from the file without decompression.  When
+   reading, this will be detected automatically by looking for the magic two-
+   byte gzip header.
+
+     gzopen returns NULL if the file could not be opened, if there was
+   insufficient memory to allocate the gzFile state, or if an invalid mode was
+   specified (an 'r', 'w', or 'a' was not provided, or '+' was provided).
+   errno can be checked to determine if the reason gzopen failed was that the
+   file could not be opened.
+*/
+
+Z_EXTERN gzFile Z_EXPORT gzdopen(int fd, const char *mode);
+/*
+     Associate a gzFile with the file descriptor fd.  File descriptors are
+   obtained from calls like open, dup, creat, pipe or fileno (if the file has
+   been previously opened with fopen).  The mode parameter is as in gzopen.
+
+     The next call of gzclose on the returned gzFile will also close the file
+   descriptor fd, just like fclose(fdopen(fd, mode)) closes the file descriptor
+   fd.  If you want to keep fd open, use fd = dup(fd_keep); gz = gzdopen(fd,
+   mode);.  The duplicated descriptor should be saved to avoid a leak, since
+   gzdopen does not close fd if it fails.  If you are using fileno() to get the
+   file descriptor from a FILE *, then you will have to use dup() to avoid
+   double-close()ing the file descriptor.  Both gzclose() and fclose() will
+   close the associated file descriptor, so they need to have different file
+   descriptors.
+
+     gzdopen returns NULL if there was insufficient memory to allocate the
+   gzFile state, if an invalid mode was specified (an 'r', 'w', or 'a' was not
+   provided, or '+' was provided), or if fd is -1.  The file descriptor is not
+   used until the next gz* read, write, seek, or close operation, so gzdopen
+   will not detect if fd is invalid (unless fd is -1).
+*/
+
+Z_EXTERN int Z_EXPORT gzbuffer(gzFile file, unsigned size);
+/*
+     Set the internal buffer size used by this library's functions for file to
+   size.  The default buffer size is 8192 bytes.  This function must be called
+   after gzopen() or gzdopen(), and before any other calls that read or write
+   the file.  The buffer memory allocation is always deferred to the first read
+   or write.  Three times that size in buffer space is allocated.  A larger
+   buffer size of, for example, 64K or 128K bytes will noticeably increase the
+   speed of decompression (reading).
+
+     The new buffer size also affects the maximum length for gzprintf().
+
+     gzbuffer() returns 0 on success, or -1 on failure, such as being called
+   too late.
+*/
+
+Z_EXTERN int Z_EXPORT gzsetparams(gzFile file, int level, int strategy);
+/*
+     Dynamically update the compression level and strategy for file.  See the
+   description of deflateInit2 for the meaning of these parameters. Previously
+   provided data is flushed before applying the parameter changes.
+
+     gzsetparams returns Z_OK if success, Z_STREAM_ERROR if the file was not
+   opened for writing, Z_ERRNO if there is an error writing the flushed data,
+   or Z_MEM_ERROR if there is a memory allocation error.
+*/
+
+Z_EXTERN int Z_EXPORT gzread(gzFile file, void *buf, unsigned len);
+/*
+     Read and decompress up to len uncompressed bytes from file into buf.  If
+   the input file is not in gzip format, gzread copies the given number of
+   bytes into the buffer directly from the file.
+
+     After reaching the end of a gzip stream in the input, gzread will continue
+   to read, looking for another gzip stream.  Any number of gzip streams may be
+   concatenated in the input file, and will all be decompressed by gzread().
+   If something other than a gzip stream is encountered after a gzip stream,
+   that remaining trailing garbage is ignored (and no error is returned).
+
+     gzread can be used to read a gzip file that is being concurrently written.
+   Upon reaching the end of the input, gzread will return with the available
+   data.  If the error code returned by gzerror is Z_OK or Z_BUF_ERROR, then
+   gzclearerr can be used to clear the end of file indicator in order to permit
+   gzread to be tried again.  Z_OK indicates that a gzip stream was completed
+   on the last gzread.  Z_BUF_ERROR indicates that the input file ended in the
+   middle of a gzip stream.  Note that gzread does not return -1 in the event
+   of an incomplete gzip stream.  This error is deferred until gzclose(), which
+   will return Z_BUF_ERROR if the last gzread ended in the middle of a gzip
+   stream.  Alternatively, gzerror can be used before gzclose to detect this
+   case.
+
+     gzread returns the number of uncompressed bytes actually read, less than
+   len for end of file, or -1 for error.  If len is too large to fit in an int,
+   then nothing is read, -1 is returned, and the error state is set to
+   Z_STREAM_ERROR.
+*/
+
+Z_EXTERN size_t Z_EXPORT gzfread (void *buf, size_t size, size_t nitems, gzFile file);
+/*
+     Read and decompress up to nitems items of size size from file into buf,
+   otherwise operating as gzread() does.  This duplicates the interface of
+   stdio's fread(), with size_t request and return types.  If the library
+   defines size_t, then z_size_t is identical to size_t.  If not, then z_size_t
+   is an unsigned integer type that can contain a pointer.
+
+     gzfread() returns the number of full items read of size size, or zero if
+   the end of the file was reached and a full item could not be read, or if
+   there was an error.  gzerror() must be consulted if zero is returned in
+   order to determine if there was an error.  If the multiplication of size and
+   nitems overflows, i.e. the product does not fit in a size_t, then nothing
+   is read, zero is returned, and the error state is set to Z_STREAM_ERROR.
+
+     In the event that the end of file is reached and only a partial item is
+   available at the end, i.e. the remaining uncompressed data length is not a
+   multiple of size, then the final partial item is nevertheless read into buf
+   and the end-of-file flag is set.  The length of the partial item read is not
+   provided, but could be inferred from the result of gztell().  This behavior
+   is the same as the behavior of fread() implementations in common libraries,
+   but it prevents the direct use of gzfread() to read a concurrently written
+   file, resetting and retrying on end-of-file, when size is not 1.
+*/
+
+Z_EXTERN int Z_EXPORT gzwrite(gzFile file, void const *buf, unsigned len);
+/*
+     Compress and write the len uncompressed bytes at buf to file. gzwrite
+   returns the number of uncompressed bytes written or 0 in case of error.
+*/
+
+Z_EXTERN size_t Z_EXPORT gzfwrite(void const *buf, size_t size, size_t nitems, gzFile file);
+/*
+     Compress and write nitems items of size size from buf to file, duplicating
+   the interface of stdio's fwrite(), with size_t request and return types.
+
+     gzfwrite() returns the number of full items written of size size, or zero
+   if there was an error.  If the multiplication of size and nitems overflows,
+   i.e. the product does not fit in a size_t, then nothing is written, zero
+   is returned, and the error state is set to Z_STREAM_ERROR.
+*/
+
+Z_EXTERN int Z_EXPORTVA gzprintf(gzFile file, const char *format, ...);
+/*
+     Convert, format, compress, and write the arguments (...) to file under
+   control of the string format, as in fprintf.  gzprintf returns the number of
+   uncompressed bytes actually written, or a negative zlib error code in case
+   of error.  The number of uncompressed bytes written is limited to 8191, or
+   one less than the buffer size given to gzbuffer().  The caller should assure
+   that this limit is not exceeded.  If it is exceeded, then gzprintf() will
+   return an error (0) with nothing written.  In this case, there may also be a
+   buffer overflow with unpredictable consequences, which is possible only if
+   zlib was compiled with the insecure functions sprintf() or vsprintf(),
+   because the secure snprintf() or vsnprintf() functions were not available.
+   This can be determined using zlibCompileFlags().
+*/
+
+Z_EXTERN int Z_EXPORT gzputs(gzFile file, const char *s);
+/*
+     Compress and write the given null-terminated string s to file, excluding
+   the terminating null character.
+
+     gzputs returns the number of characters written, or -1 in case of error.
+*/
+
+Z_EXTERN char * Z_EXPORT gzgets(gzFile file, char *buf, int len);
+/*
+     Read and decompress bytes from file into buf, until len-1 characters are
+   read, or until a newline character is read and transferred to buf, or an
+   end-of-file condition is encountered.  If any characters are read or if len
+   is one, the string is terminated with a null character.  If no characters
+   are read due to an end-of-file or len is less than one, then the buffer is
+   left untouched.
+
+     gzgets returns buf which is a null-terminated string, or it returns NULL
+   for end-of-file or in case of error.  If there was an error, the contents at
+   buf are indeterminate.
+*/
+
+Z_EXTERN int Z_EXPORT gzputc(gzFile file, int c);
+/*
+     Compress and write c, converted to an unsigned char, into file.  gzputc
+   returns the value that was written, or -1 in case of error.
+*/
+
+Z_EXTERN int Z_EXPORT gzgetc(gzFile file);
+/*
+     Read and decompress one byte from file.  gzgetc returns this byte or -1
+   in case of end of file or error.  This is implemented as a macro for speed.
+   As such, it does not do all of the checking the other functions do.  I.e.
+   it does not check to see if file is NULL, nor whether the structure file
+   points to has been clobbered or not.
+*/
+
+Z_EXTERN int Z_EXPORT gzungetc(int c, gzFile file);
+/*
+     Push c back onto the stream for file to be read as the first character on
+   the next read.  At least one character of push-back is always allowed.
+   gzungetc() returns the character pushed, or -1 on failure.  gzungetc() will
+   fail if c is -1, and may fail if a character has been pushed but not read
+   yet.  If gzungetc is used immediately after gzopen or gzdopen, at least the
+   output buffer size of pushed characters is allowed.  (See gzbuffer above.)
+   The pushed character will be discarded if the stream is repositioned with
+   gzseek() or gzrewind().
+
+     gzungetc(-1, file) will force any pending seek to execute. Then gztell()
+   will report the position, even if the requested seek reached end of file.
+   This can be used to determine the number of uncompressed bytes in a gzip
+   file without having to read it into a buffer.
+*/
+
+Z_EXTERN int Z_EXPORT gzflush(gzFile file, int flush);
+/*
+     Flush all pending output to file.  The parameter flush is as in the
+   deflate() function.  The return value is the zlib error number (see function
+   gzerror below).  gzflush is only permitted when writing.
+
+     If the flush parameter is Z_FINISH, the remaining data is written and the
+   gzip stream is completed in the output.  If gzwrite() is called again, a new
+   gzip stream will be started in the output.  gzread() is able to read such
+   concatenated gzip streams.
+
+     gzflush should be called only when strictly necessary because it will
+   degrade compression if called too often.
+*/
+
+/*
+Z_EXTERN z_off_t Z_EXPORT gzseek (gzFile file, z_off_t offset, int whence);
+
+     Set the starting position to offset relative to whence for the next gzread
+   or gzwrite on file.  The offset represents a number of bytes in the
+   uncompressed data stream.  The whence parameter is defined as in lseek(2);
+   the value SEEK_END is not supported.
+
+     If the file is opened for reading, this function is emulated but can be
+   extremely slow.  If the file is opened for writing, only forward seeks are
+   supported; gzseek then compresses a sequence of zeroes up to the new
+   starting position. For reading or writing, any actual seeking is deferred
+   until the next read or write operation, or close operation when writing.
+
+     gzseek returns the resulting offset location as measured in bytes from
+   the beginning of the uncompressed stream, or -1 in case of error, in
+   particular if the file is opened for writing and the new starting position
+   would be before the current position.
+*/
+
+Z_EXTERN int Z_EXPORT gzrewind(gzFile file);
+/*
+     Rewind file. This function is supported only for reading.
+
+     gzrewind(file) is equivalent to (int)gzseek(file, 0L, SEEK_SET).
+*/
+
+/*
+Z_EXTERN z_off_t Z_EXPORT gztell(gzFile file);
+
+     Return the starting position for the next gzread or gzwrite on file.
+   This position represents a number of bytes in the uncompressed data stream,
+   and is zero when starting, even if appending or reading a gzip stream from
+   the middle of a file using gzdopen().
+
+     gztell(file) is equivalent to gzseek(file, 0L, SEEK_CUR)
+*/
+
+/*
+Z_EXTERN z_off_t Z_EXPORT gzoffset(gzFile file);
+
+     Return the current compressed (actual) read or write offset of file.  This
+   offset includes the count of bytes that precede the gzip stream, for example
+   when appending or when using gzdopen() for reading.  When reading, the
+   offset does not include as yet unused buffered input.  This information can
+   be used for a progress indicator.  On error, gzoffset() returns -1.
+*/
+
+Z_EXTERN int Z_EXPORT gzeof(gzFile file);
+/*
+     Return true (1) if the end-of-file indicator for file has been set while
+   reading, false (0) otherwise.  Note that the end-of-file indicator is set
+   only if the read tried to go past the end of the input, but came up short.
+   Therefore, just like feof(), gzeof() may return false even if there is no
+   more data to read, in the event that the last read request was for the exact
+   number of bytes remaining in the input file.  This will happen if the input
+   file size is an exact multiple of the buffer size.
+
+     If gzeof() returns true, then the read functions will return no more data,
+   unless the end-of-file indicator is reset by gzclearerr() and the input file
+   has grown since the previous end of file was detected.
+*/
+
+Z_EXTERN int Z_EXPORT gzdirect(gzFile file);
+/*
+     Return true (1) if file is being copied directly while reading, or false
+   (0) if file is a gzip stream being decompressed.
+
+     If the input file is empty, gzdirect() will return true, since the input
+   does not contain a gzip stream.
+
+     If gzdirect() is used immediately after gzopen() or gzdopen() it will
+   cause buffers to be allocated to allow reading the file to determine if it
+   is a gzip file.  Therefore if gzbuffer() is used, it should be called before
+   gzdirect().
+
+     When writing, gzdirect() returns true (1) if transparent writing was
+   requested ("wT" for the gzopen() mode), or false (0) otherwise.  (Note:
+   gzdirect() is not needed when writing.  Transparent writing must be
+   explicitly requested, so the application already knows the answer.  When
+   linking statically, using gzdirect() will include all of the zlib code for
+   gzip file reading and decompression, which may not be desired.)
+*/
+
+Z_EXTERN int Z_EXPORT gzclose(gzFile file);
+/*
+     Flush all pending output for file, if necessary, close file and
+   deallocate the (de)compression state.  Note that once file is closed, you
+   cannot call gzerror with file, since its structures have been deallocated.
+   gzclose must not be called more than once on the same file, just as free
+   must not be called more than once on the same allocation.
+
+     gzclose will return Z_STREAM_ERROR if file is not valid, Z_ERRNO on a
+   file operation error, Z_MEM_ERROR if out of memory, Z_BUF_ERROR if the
+   last read ended in the middle of a gzip stream, or Z_OK on success.
+*/
+
+Z_EXTERN int Z_EXPORT gzclose_r(gzFile file);
+Z_EXTERN int Z_EXPORT gzclose_w(gzFile file);
+/*
+     Same as gzclose(), but gzclose_r() is only for use when reading, and
+   gzclose_w() is only for use when writing or appending.  The advantage to
+   using these instead of gzclose() is that they avoid linking in zlib
+   compression or decompression code that is not used when only reading or only
+   writing respectively.  If gzclose() is used, then both compression and
+   decompression code will be included the application when linking to a static
+   zlib library.
+*/
+
+Z_EXTERN const char * Z_EXPORT gzerror(gzFile file, int *errnum);
+/*
+     Return the error message for the last error which occurred on file.
+   If errnum is not NULL, *errnum is set to zlib error number.  If an error
+   occurred in the file system and not in the compression library, *errnum is
+   set to Z_ERRNO and the application may consult errno to get the exact error
+   code.
+
+     The application must not modify the returned string.  Future calls to
+   this function may invalidate the previously returned string.  If file is
+   closed, then the string previously returned by gzerror will no longer be
+   available.
+
+     gzerror() should be used to distinguish errors from end-of-file for those
+   functions above that do not distinguish those cases in their return values.
+*/
+
+Z_EXTERN void Z_EXPORT gzclearerr(gzFile file);
+/*
+     Clear the error and end-of-file flags for file.  This is analogous to the
+   clearerr() function in stdio.  This is useful for continuing to read a gzip
+   file that is being written concurrently.
+*/
+
+#endif
+
+                        /* checksum functions */
+
+/*
+     These functions are not related to compression but are exported
+   anyway because they might be useful in applications using the compression
+   library.
+*/
+
+Z_EXTERN unsigned long Z_EXPORT adler32(unsigned long adler, const unsigned char *buf, unsigned int len);
+/*
+     Update a running Adler-32 checksum with the bytes buf[0..len-1] and
+   return the updated checksum. An Adler-32 value is in the range of a 32-bit
+   unsigned integer. If buf is Z_NULL, this function returns the required
+   initial value for the checksum.
+
+     An Adler-32 checksum is almost as reliable as a CRC-32 but can be computed
+   much faster.
+
+   Usage example:
+
+     uint32_t adler = adler32(0L, NULL, 0);
+
+     while (read_buffer(buffer, length) != EOF) {
+       adler = adler32(adler, buffer, length);
+     }
+     if (adler != original_adler) error();
+*/
+
+Z_EXTERN unsigned long Z_EXPORT adler32_z(unsigned long adler, const unsigned char *buf, size_t len);
+/*
+     Same as adler32(), but with a size_t length.
+*/
+
+/*
+Z_EXTERN unsigned long Z_EXPORT adler32_combine(unsigned long adler1, unsigned long adler2, z_off_t len2);
+
+     Combine two Adler-32 checksums into one.  For two sequences of bytes, seq1
+   and seq2 with lengths len1 and len2, Adler-32 checksums were calculated for
+   each, adler1 and adler2.  adler32_combine() returns the Adler-32 checksum of
+   seq1 and seq2 concatenated, requiring only adler1, adler2, and len2.  Note
+   that the z_off_t type (like off_t) is a signed integer.  If len2 is
+   negative, the result has no meaning or utility.
+*/
+
+Z_EXTERN unsigned long Z_EXPORT crc32(unsigned long crc, const unsigned char *buf, unsigned int len);
+/*
+     Update a running CRC-32 with the bytes buf[0..len-1] and return the
+   updated CRC-32. A CRC-32 value is in the range of a 32-bit unsigned integer.
+   If buf is Z_NULL, this function returns the required initial value for the
+   crc. Pre- and post-conditioning (one's complement) is performed within this
+   function so it shouldn't be done by the application.
+
+   Usage example:
+
+     uint32_t crc = crc32(0L, NULL, 0);
+
+     while (read_buffer(buffer, length) != EOF) {
+       crc = crc32(crc, buffer, length);
+     }
+     if (crc != original_crc) error();
+*/
+
+Z_EXTERN unsigned long Z_EXPORT crc32_z(unsigned long crc, const unsigned char *buf, size_t len);
+/*
+     Same as crc32(), but with a size_t length.
+*/
+
+/*
+Z_EXTERN unsigned long Z_EXPORT crc32_combine(unsigned long crc1, unsigned long crc2, z_off64_t len2);
+
+     Combine two CRC-32 check values into one.  For two sequences of bytes,
+   seq1 and seq2 with lengths len1 and len2, CRC-32 check values were
+   calculated for each, crc1 and crc2.  crc32_combine() returns the CRC-32
+   check value of seq1 and seq2 concatenated, requiring only crc1, crc2, and
+   len2. len2 must be non-negative.
+*/
+
+/*
+Z_EXTERN unsigned long Z_EXPORT crc32_combine_gen(z_off_t len2);
+
+     Return the operator corresponding to length len2, to be used with
+   crc32_combine_op(). len2 must be non-negative.
+*/
+
+Z_EXTERN unsigned long Z_EXPORT crc32_combine_op(unsigned long crc1, unsigned long crc2,
+                                                 const unsigned long op);
+/*
+     Give the same result as crc32_combine(), using op in place of len2. op is
+   is generated from len2 by crc32_combine_gen(). This will be faster than
+   crc32_combine() if the generated op is used more than once.
+*/
+
+
+                        /* various hacks, don't look :) */
+
+/* deflateInit and inflateInit are macros to allow checking the zlib version
+ * and the compiler's view of z_stream:
+ */
+Z_EXTERN int Z_EXPORT deflateInit_(z_stream *strm, int level, const char *version, int stream_size);
+Z_EXTERN int Z_EXPORT inflateInit_(z_stream *strm, const char *version, int stream_size);
+Z_EXTERN int Z_EXPORT deflateInit2_(z_stream *strm, int  level, int  method, int windowBits, int memLevel,
+                                   int strategy, const char *version, int stream_size);
+Z_EXTERN int Z_EXPORT inflateInit2_(z_stream *strm, int  windowBits, const char *version, int stream_size);
+Z_EXTERN int Z_EXPORT inflateBackInit_(z_stream *strm, int windowBits, unsigned char *window,
+                                      const char *version, int stream_size);
+#define deflateInit(strm, level) deflateInit_((strm), (level), ZLIB_VERSION, (int)sizeof(z_stream))
+#define inflateInit(strm) inflateInit_((strm), ZLIB_VERSION, (int)sizeof(z_stream))
+#define deflateInit2(strm, level, method, windowBits, memLevel, strategy) \
+        deflateInit2_((strm), (level), (method), (windowBits), (memLevel), \
+                     (strategy), ZLIB_VERSION, (int)sizeof(z_stream))
+#define inflateInit2(strm, windowBits) inflateInit2_((strm), (windowBits), ZLIB_VERSION, (int)sizeof(z_stream))
+#define inflateBackInit(strm, windowBits, window) \
+                        inflateBackInit_((strm), (windowBits), (window), ZLIB_VERSION, (int)sizeof(z_stream))
+
+
+#ifndef Z_SOLO
+/* gzgetc() macro and its supporting function and exposed data structure.  Note
+ * that the real internal state is much larger than the exposed structure.
+ * This abbreviated structure exposes just enough for the gzgetc() macro.  The
+ * user should not mess with these exposed elements, since their names or
+ * behavior could change in the future, perhaps even capriciously.  They can
+ * only be used by the gzgetc() macro.  You have been warned.
+ */
+struct gzFile_s {
+    unsigned have;
+    unsigned char *next;
+    z_off64_t pos;
+};
+Z_EXTERN int Z_EXPORT gzgetc_(gzFile file);  /* backward compatibility */
+#  define gzgetc(g) ((g)->have ? ((g)->have--, (g)->pos++, *((g)->next)++) : (gzgetc)(g))
+
+/* provide 64-bit offset functions if _LARGEFILE64_SOURCE defined, and/or
+ * change the regular functions to 64 bits if _FILE_OFFSET_BITS is 64 (if
+ * both are true, the application gets the *64 functions, and the regular
+ * functions are changed to 64 bits) -- in case these are set on systems
+ * without large file support, _LFS64_LARGEFILE must also be true
+ */
+#ifdef Z_LARGE64
+   Z_EXTERN gzFile Z_EXPORT gzopen64(const char *, const char *);
+   Z_EXTERN z_off64_t Z_EXPORT gzseek64(gzFile, z_off64_t, int);
+   Z_EXTERN z_off64_t Z_EXPORT gztell64(gzFile);
+   Z_EXTERN z_off64_t Z_EXPORT gzoffset64(gzFile);
+   Z_EXTERN unsigned long Z_EXPORT adler32_combine64(unsigned long, unsigned long, z_off64_t);
+   Z_EXTERN unsigned long Z_EXPORT crc32_combine64(unsigned long, unsigned long, z_off64_t);
+   Z_EXTERN unsigned long Z_EXPORT crc32_combine_gen64(z_off64_t);
+#endif
+#endif
+
+#if !defined(Z_SOLO) && !defined(Z_INTERNAL) && defined(Z_WANT64)
+#    define gzopen gzopen64
+#    define gzseek gzseek64
+#    define gztell gztell64
+#    define gzoffset gzoffset64
+#    define adler32_combine adler32_combine64
+#    define crc32_combine crc32_combine64
+#    define crc32_combine_gen crc32_combine_gen64
+#  ifndef Z_LARGE64
+     Z_EXTERN gzFile Z_EXPORT gzopen64(const char *, const char *);
+     Z_EXTERN z_off_t Z_EXPORT gzseek64(gzFile, z_off_t, int);
+     Z_EXTERN z_off_t Z_EXPORT gztell64(gzFile);
+     Z_EXTERN z_off_t Z_EXPORT gzoffset64(gzFile);
+     Z_EXTERN unsigned long Z_EXPORT adler32_combine64(unsigned long, unsigned long, z_off_t);
+     Z_EXTERN unsigned long Z_EXPORT crc32_combine64(unsigned long, unsigned long, z_off_t);
+     Z_EXTERN unsigned long Z_EXPORT crc32_combine_gen64(z_off64_t);
+#  endif
+#else
+#  ifndef Z_SOLO
+   Z_EXTERN gzFile Z_EXPORT gzopen(const char *, const char *);
+   Z_EXTERN z_off_t Z_EXPORT gzseek(gzFile, z_off_t, int);
+   Z_EXTERN z_off_t Z_EXPORT gztell(gzFile);
+   Z_EXTERN z_off_t Z_EXPORT gzoffset(gzFile);
+#  endif
+   Z_EXTERN unsigned long Z_EXPORT adler32_combine(unsigned long, unsigned long, z_off_t);
+   Z_EXTERN unsigned long Z_EXPORT crc32_combine(unsigned long, unsigned long, z_off_t);
+   Z_EXTERN unsigned long Z_EXPORT crc32_combine_gen(z_off_t);
+#endif
+
+/* undocumented functions */
+Z_EXTERN const char     * Z_EXPORT zError           (int);
+Z_EXTERN int              Z_EXPORT inflateSyncPoint (z_stream *);
+Z_EXTERN const uint32_t * Z_EXPORT get_crc_table    (void);
+Z_EXTERN int              Z_EXPORT inflateUndermine (z_stream *, int);
+Z_EXTERN int              Z_EXPORT inflateValidate  (z_stream *, int);
+Z_EXTERN unsigned long    Z_EXPORT inflateCodesUsed (z_stream *);
+Z_EXTERN int              Z_EXPORT inflateResetKeep (z_stream *);
+Z_EXTERN int              Z_EXPORT deflateResetKeep (z_stream *);
+
+#ifndef Z_SOLO
+#if defined(_WIN32)
+    Z_EXTERN gzFile Z_EXPORT gzopen_w(const wchar_t *path, const char *mode);
+#endif
+Z_EXTERN int Z_EXPORTVA gzvprintf(gzFile file, const char *format, va_list va);
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* ZLIB_H_ */
diff --git a/test/corpus/support/zlib-ng/zlib_name_mangling.h b/test/corpus/support/zlib-ng/zlib_name_mangling.h
new file mode 100644
index 00000000..b24cb834
--- /dev/null
+++ b/test/corpus/support/zlib-ng/zlib_name_mangling.h
@@ -0,0 +1,8 @@
+/* zlib_name_mangling.h has been automatically generated from
+ * zlib_name_mangling.h.empty because ZLIB_SYMBOL_PREFIX was NOT set.
+ */
+
+#ifndef ZLIB_NAME_MANGLING_H
+#define ZLIB_NAME_MANGLING_H
+
+#endif /* ZLIB_NAME_MANGLING_H */
diff --git a/test/corpus/triage.json b/test/corpus/triage.json
index a061f0b5..b890ff1c 100644
--- a/test/corpus/triage.json
+++ b/test/corpus/triage.json
@@ -781,6 +781,126 @@
       "line": 168,
       "verdict": "true",
       "note": "TRUE POSITIVE, deliberate. metatest's double_free (framework/tests/programs/metatest.c:161) frees `p` twice (comment: 'Undefined behavior (double free)'), to check that sanitizers catch it."
+    },
+    {
+      "fingerprint": "8aca700b1e3a6293f2cad8b0504a4423",
+      "config": "cJSON",
+      "id": "double-free",
+      "certainty": "possible",
+      "file": "tests/misc_tests.c",
+      "line": 466,
+      "verdict": "false",
+      "note": "FALSE POSITIVE, correlated conditions (RFC 0030 Soundness: 'Possible temporal warnings can be false'). `cjson_functions_should_not_crash_with_null_pointers` passes NULL to every entry point; each callee tests its arguments and returns false without deleting anything (the test asserts exactly that), so `item` is released once, by `cJSON_Delete(item)` at tests/misc_tests.c:489. The engine cannot relate the callee's NULL test to the argument it was given."
+    },
+    {
+      "fingerprint": "4ebbd131b9f82b4ec6cd650195dfb51b",
+      "config": "cJSON",
+      "id": "use-after-free",
+      "certainty": "possible",
+      "file": "tests/misc_tests.c",
+      "line": 468,
+      "verdict": "false",
+      "note": "FALSE POSITIVE, correlated conditions (RFC 0030 Soundness: 'Possible temporal warnings can be false'). `cjson_functions_should_not_crash_with_null_pointers` passes NULL to every entry point; each callee tests its arguments and returns false without deleting anything (the test asserts exactly that), so `item` is released once, by `cJSON_Delete(item)` at tests/misc_tests.c:489. The engine cannot relate the callee's NULL test to the argument it was given."
+    },
+    {
+      "fingerprint": "79c866e37712041e8c08f83acb922027",
+      "config": "cJSON",
+      "id": "use-after-free",
+      "certainty": "possible",
+      "file": "tests/misc_tests.c",
+      "line": 469,
+      "verdict": "false",
+      "note": "FALSE POSITIVE, correlated conditions (RFC 0030 Soundness: 'Possible temporal warnings can be false'). `cjson_functions_should_not_crash_with_null_pointers` passes NULL to every entry point; each callee tests its arguments and returns false without deleting anything (the test asserts exactly that), so `item` is released once, by `cJSON_Delete(item)` at tests/misc_tests.c:489. The engine cannot relate the callee's NULL test to the argument it was given."
+    },
+    {
+      "fingerprint": "5078587cdf762871f2a6bcc253e6ac1a",
+      "config": "cJSON",
+      "id": "use-after-free",
+      "certainty": "possible",
+      "file": "tests/misc_tests.c",
+      "line": 470,
+      "verdict": "false",
+      "note": "FALSE POSITIVE, correlated conditions (RFC 0030 Soundness: 'Possible temporal warnings can be false'). `cjson_functions_should_not_crash_with_null_pointers` passes NULL to every entry point; each callee tests its arguments and returns false without deleting anything (the test asserts exactly that), so `item` is released once, by `cJSON_Delete(item)` at tests/misc_tests.c:489. The engine cannot relate the callee's NULL test to the argument it was given."
+    },
+    {
+      "fingerprint": "523eb47bbb4a9dd717ca78af8144eb5b",
+      "config": "cJSON",
+      "id": "use-after-free",
+      "certainty": "possible",
+      "file": "tests/misc_tests.c",
+      "line": 471,
+      "verdict": "false",
+      "note": "FALSE POSITIVE, correlated conditions (RFC 0030 Soundness: 'Possible temporal warnings can be false'). `cjson_functions_should_not_crash_with_null_pointers` passes NULL to every entry point; each callee tests its arguments and returns false without deleting anything (the test asserts exactly that), so `item` is released once, by `cJSON_Delete(item)` at tests/misc_tests.c:489. The engine cannot relate the callee's NULL test to the argument it was given."
+    },
+    {
+      "fingerprint": "a98d558ad06d328cc8ac0172dc61684a",
+      "config": "cJSON",
+      "id": "use-after-free",
+      "certainty": "possible",
+      "file": "tests/misc_tests.c",
+      "line": 472,
+      "verdict": "false",
+      "note": "FALSE POSITIVE, correlated conditions (RFC 0030 Soundness: 'Possible temporal warnings can be false'). `cjson_functions_should_not_crash_with_null_pointers` passes NULL to every entry point; each callee tests its arguments and returns false without deleting anything (the test asserts exactly that), so `item` is released once, by `cJSON_Delete(item)` at tests/misc_tests.c:489. The engine cannot relate the callee's NULL test to the argument it was given."
+    },
+    {
+      "fingerprint": "9964befe67b6e70d9c79abc00b51f677",
+      "config": "cJSON",
+      "id": "use-after-free",
+      "certainty": "possible",
+      "file": "tests/misc_tests.c",
+      "line": 473,
+      "verdict": "false",
+      "note": "FALSE POSITIVE, correlated conditions (RFC 0030 Soundness: 'Possible temporal warnings can be false'). `cjson_functions_should_not_crash_with_null_pointers` passes NULL to every entry point; each callee tests its arguments and returns false without deleting anything (the test asserts exactly that), so `item` is released once, by `cJSON_Delete(item)` at tests/misc_tests.c:489. The engine cannot relate the callee's NULL test to the argument it was given."
+    },
+    {
+      "fingerprint": "fa457b6ec27f0914aa06a07f37dd5d82",
+      "config": "cJSON",
+      "id": "use-after-free",
+      "certainty": "possible",
+      "file": "tests/misc_tests.c",
+      "line": 474,
+      "verdict": "false",
+      "note": "FALSE POSITIVE, correlated conditions (RFC 0030 Soundness: 'Possible temporal warnings can be false'). `cjson_functions_should_not_crash_with_null_pointers` passes NULL to every entry point; each callee tests its arguments and returns false without deleting anything (the test asserts exactly that), so `item` is released once, by `cJSON_Delete(item)` at tests/misc_tests.c:489. The engine cannot relate the callee's NULL test to the argument it was given."
+    },
+    {
+      "fingerprint": "97636e8f5683ad107f9496c5777ac627",
+      "config": "cJSON",
+      "id": "use-after-free",
+      "certainty": "possible",
+      "file": "tests/misc_tests.c",
+      "line": 476,
+      "verdict": "false",
+      "note": "FALSE POSITIVE, correlated conditions (RFC 0030 Soundness: 'Possible temporal warnings can be false'). `cjson_functions_should_not_crash_with_null_pointers` passes NULL to every entry point; each callee tests its arguments and returns false without deleting anything (the test asserts exactly that), so `item` is released once, by `cJSON_Delete(item)` at tests/misc_tests.c:489. The engine cannot relate the callee's NULL test to the argument it was given."
+    },
+    {
+      "fingerprint": "724a353f2fc50b5c59b4277f513e555c",
+      "config": "cJSON",
+      "id": "use-after-free",
+      "certainty": "possible",
+      "file": "tests/misc_tests.c",
+      "line": 477,
+      "verdict": "false",
+      "note": "FALSE POSITIVE, correlated conditions (RFC 0030 Soundness: 'Possible temporal warnings can be false'). `cjson_functions_should_not_crash_with_null_pointers` passes NULL to every entry point; each callee tests its arguments and returns false without deleting anything (the test asserts exactly that), so `item` is released once, by `cJSON_Delete(item)` at tests/misc_tests.c:489. The engine cannot relate the callee's NULL test to the argument it was given."
+    },
+    {
+      "fingerprint": "7d7a2495a2bb210065a7e3f7129573a6",
+      "config": "cJSON",
+      "id": "use-after-free",
+      "certainty": "possible",
+      "file": "tests/misc_tests.c",
+      "line": 480,
+      "verdict": "false",
+      "note": "FALSE POSITIVE, correlated conditions (RFC 0030 Soundness: 'Possible temporal warnings can be false'). `cjson_functions_should_not_crash_with_null_pointers` passes NULL to every entry point; each callee tests its arguments and returns false without deleting anything (the test asserts exactly that), so `item` is released once, by `cJSON_Delete(item)` at tests/misc_tests.c:489. The engine cannot relate the callee's NULL test to the argument it was given."
+    },
+    {
+      "fingerprint": "63c2892d00cff4efb8409a328c3576eb",
+      "config": "cJSON",
+      "id": "double-free",
+      "certainty": "possible",
+      "file": "tests/misc_tests.c",
+      "line": 489,
+      "verdict": "false",
+      "note": "FALSE POSITIVE, correlated conditions (RFC 0030 Soundness: 'Possible temporal warnings can be false'). `cjson_functions_should_not_crash_with_null_pointers` passes NULL to every entry point; each callee tests its arguments and returns false without deleting anything (the test asserts exactly that), so `item` is released once, by `cJSON_Delete(item)` at tests/misc_tests.c:489. The engine cannot relate the callee's NULL test to the argument it was given."
     }
   ]
 }
diff --git a/tools/weavec/main.cpp b/tools/weavec/main.cpp
index 1b3ee3aa..e1784331 100644
--- a/tools/weavec/main.cpp
+++ b/tools/weavec/main.cpp
@@ -110,8 +110,9 @@ cl::opt<weavec::core::RequireLevel> requireLevel(
 
 cl::opt<std::uint64_t>
     budget("budget",
-           cl::desc("Block transfers per function before its analysis stops "
-                    "(default: 50000; 0: unlimited)"),
+           cl::desc("Work per function before its analysis stops: the sizes "
+                    "of the states it transfers and joins (default: 20000000; "
+                    "0: unlimited)"),
            cl::init(weavec::core::DefaultBudget), cl::cat(weavecCategory));
 
 cl::opt<bool> noRuntime("no-runtime",
diff --git a/unittests/Analysis/CheckPlannerTest.cpp b/unittests/Analysis/CheckPlannerTest.cpp
index c4267daf..cc51dc4c 100644
--- a/unittests/Analysis/CheckPlannerTest.cpp
+++ b/unittests/Analysis/CheckPlannerTest.cpp
@@ -280,7 +280,8 @@ int f(int *p, int *q, int *r, int *t) {
                    .width = WitnessTerm::sizeOf(unit.context().IntTy),
                    .unmodified = true,
                    .accessesSafe = true});
-  // *r: lowered violations are guarded (§3.4).
+  // *r: lowered violations are checked or guarded, never trapped (RFC 0034
+  // §6.4).
   facet(r, core::Facet::Null)->decide(core::FacetDecision::violation());
   facet(r, core::Facet::Temporal)->decide(core::FacetDecision::violation());
   // *t: verify mode checks proven facets that have witnesses (§10.7).
@@ -308,14 +309,16 @@ int f(int *p, int *q, int *r, int *t) {
             (std::vector<std::string>{
                 "*q spatial span/plain/replace-access " + base + " 16 " + width,
                 "*r null nonnull/plain/wrap-operand",
-                "*r temporal assert/violation/wrap-operand",
                 "*t spatial index/plain/wrap-operand 1 proven"}));
   EXPECT_EQ(facet(p, core::Facet::Spatial)->decision.detail,
             "its extent is only a lower bound");
   EXPECT_EQ(facet(q, core::Facet::Null)->check->kind,
             core::CheckTemplate::Span);
-  EXPECT_EQ(facet(r, core::Facet::Temporal)->check->kind,
-            core::CheckTemplate::Violation);
+  // RFC 0034 §6.4: no unconditional trap; with no runtime to guard it, the
+  // lowered temporal violation is unresolved.
+  EXPECT_FALSE(facet(r, core::Facet::Temporal)->check.has_value());
+  EXPECT_EQ(facet(r, core::Facet::Temporal)->decision.unresolved,
+            core::UnresolvedReason::Lowered);
   EXPECT_TRUE(facet(t, core::Facet::Spatial)->check->proven);
   EXPECT_EQ(facet(t, core::Facet::Spatial)->outcome(),
             core::SiteOutcome::Proven);
@@ -461,6 +464,104 @@ void f(char *d, const char *s, unsigned long n) { memcpy(d, s, n); }
       (core::FacetCheck{.kind = core::CheckTemplate::Len, .proven = false}));
 }
 
+TEST(CheckPlanner, CheckedWrappersComputeWhatNoTermStates) {
+  // RFC 0034 §5.2: a requirement no guard states, or states only as a
+  // format's least output, is computed by the row's checked wrapper; one a
+  // guard states keeps its guard, and a row without the check has none.
+  const auto unit = collectUnit(R"c(
+char *strcpy(char *, const char *);
+char *strcat(char *, const char *);
+void *memcpy(void *, const void *, unsigned long);
+int sprintf(char *, const char *, ...);
+void f(char *d, char *const *v, int i, int n) {
+  strcpy(d, v[i]);
+  memcpy(d, d + n, 4);
+  strcat(d, v[i]);
+  sprintf(d, "%d", i);
+}
+)c");
+  const SiteInfo *copy =
+      siteNamed(unit, "f", "strcpy(d,v[i])", core::SiteKind::LibCall);
+  const SiteInfo *move =
+      siteNamed(unit, "f", "memcpy(d,d+n,4)", core::SiteKind::LibCall);
+  const SiteInfo *append =
+      siteNamed(unit, "f", "strcat(d,v[i])", core::SiteKind::LibCall);
+  const SiteInfo *format =
+      siteNamed(unit, "f", "sprintf(d,\"%d\",i)", core::SiteKind::LibCall);
+  ASSERT_TRUE(copy && move && append && format);
+  const auto planWith = [&](bool runtime, core::UnitLedger &ledger) {
+    ledger.functions = unit.sites.ledgers();
+    core::FunctionLedger &row =
+        ledger.functions[unit.sites.function(*unit.function("f"))->index];
+    decideAll(row, core::FacetDecision::proven());
+    WitnessTable witnesses;
+    const auto require = [&](const SiteInfo *site, core::UnresolvedReason why,
+                             std::optional<CheckWitness> witness) {
+      core::FacetRecord *spatial =
+          row.sites[site->id.ordinal].facet(core::Facet::Spatial);
+      const auto index =
+          static_cast<std::uint16_t>(spatial->requirements.size());
+      spatial->addRequirement(core::Requirement{
+          .argument = 0, .decision = core::FacetDecision::unresolvedFor(why)});
+      if (witness) {
+        witness->requirement = index;
+        witness->argument = 0;
+        witnesses.add(site->id, core::Facet::Spatial, *witness);
+      }
+    };
+    const auto bytes = [](std::int64_t need) {
+      return CheckWitness{.shape = CheckWitness::Shape::Object,
+                          .need = WitnessTerm::ofConstant(need),
+                          .unmodified = true,
+                          .accessesSafe = true};
+    };
+    const auto overlap = [&](const clang::Expr &other) {
+      return CheckWitness{.shape = CheckWitness::Shape::Disjoint,
+                          .need = WitnessTerm::ofConstant(4),
+                          .other = WitnessTerm::ofExpr(other),
+                          .unmodified = true,
+                          .accessesSafe = true};
+    };
+    const auto *strcpyCall = llvm::cast<clang::CallExpr>(copy->stmt);
+    const auto *memcpyCall = llvm::cast<clang::CallExpr>(move->stmt);
+    require(copy, core::UnresolvedReason::UnknownExtent, std::nullopt);
+    require(copy, core::UnresolvedReason::Inexpressible,
+            overlap(*strcpyCall->getArg(1)));
+    require(move, core::UnresolvedReason::UnknownExtent, bytes(4));
+    require(move, core::UnresolvedReason::Inexpressible,
+            overlap(*memcpyCall->getArg(1)));
+    require(append, core::UnresolvedReason::UnknownExtent, bytes(4));
+    require(format, core::UnresolvedReason::UnknownExtent, bytes(2));
+    PlaceHandleTable handles;
+    return CheckPlanner(unit.context(), unit.sites, {.runtime = runtime})
+        .plan(ledger, witnesses, handles);
+  };
+
+  core::UnitLedger ledger;
+  const core::CheckPlan plan = planWith(true, ledger);
+  const std::vector<std::string> entries = spell(plan, ledger);
+  EXPECT_EQ(entries,
+            (std::vector<std::string>{
+                "strcpy(d,v[i]) spatial object/wrapper/replace-call",
+                "strcpy(d,v[i]) spatial disjoint/wrapper/replace-call",
+                "memcpy(d,d+n,4) spatial object/need/wrap-argument#0 4",
+                "memcpy(d,d+n,4) spatial disjoint/wrapper/replace-call",
+                "strcat(d,v[i]) spatial object/need/wrap-argument#0 4",
+                "sprintf(d,\"%d\",i) spatial object/wrapper/replace-call"}));
+  const core::FunctionLedger &row =
+      ledger.functions[unit.sites.function(*unit.function("f"))->index];
+  const core::FacetRecord &copied =
+      *row.sites[copy->id.ordinal].facet(core::Facet::Spatial);
+  EXPECT_EQ(copied.decision.compact(), "guarded/unknown-extent");
+  EXPECT_EQ(copied.requirements[1].decision.compact(), "guarded/inexpressible");
+  EXPECT_EQ(copied.requirements[1].check,
+            (core::FacetCheck{.kind = core::CheckTemplate::Disjoint,
+                              .proven = false}));
+
+  core::UnitLedger plainLedger;
+  EXPECT_TRUE(planWith(false, plainLedger).entries.empty());
+}
+
 TEST(PlaceHandleTable, ResolvesHandles) {
   const auto unit = collectUnit("int f(int *p, int n) { return p[n]; }\n");
   PlaceHandleTable handles;
diff --git a/unittests/Core/CheckPlanTest.cpp b/unittests/Core/CheckPlanTest.cpp
index 9ad94ae6..72884149 100644
--- a/unittests/Core/CheckPlanTest.cpp
+++ b/unittests/Core/CheckPlanTest.cpp
@@ -86,7 +86,6 @@ TEST(CheckPlan, Spellings) {
   EXPECT_EQ(toString(Template::Nonnull), "nonnull");
   EXPECT_EQ(toString(Template::Disjoint), "disjoint");
   EXPECT_EQ(toString(Form::IfNonZero), "if-non-zero");
-  EXPECT_EQ(toString(Form::Violation), "violation");
   EXPECT_EQ(toString(Placement::ReplaceAccess), "replace-access");
   EXPECT_EQ(toString(Placement::BeforeCall), "before-call");
 }
@@ -115,9 +114,6 @@ TEST(CheckPlan, OperandCountsFollowTheTemplates) {
       2U);
   EXPECT_EQ(operandCount(Template::Assert, Form::Plain, Placement::ReplaceCall),
             0U);
-  EXPECT_EQ(
-      operandCount(Template::Index, Form::Violation, Placement::BeforeCall),
-      0U);
   // Combinations §10.2–§10.4 give no meaning.
   EXPECT_FALSE(
       operandCount(Template::Assert, Form::Plain, Placement::WrapOperand));
@@ -129,6 +125,17 @@ TEST(CheckPlan, OperandCountsFollowTheTemplates) {
       operandCount(Template::Nonnull, Form::Function, Placement::WrapArgument));
   EXPECT_FALSE(
       operandCount(Template::Span, Form::Result, Placement::ReplaceAccess));
+  // RFC 0034 §5.2: a checked wrapper replaces the call and takes no term.
+  EXPECT_EQ(
+      operandCount(Template::Object, Form::Wrapper, Placement::ReplaceCall),
+      0U);
+  EXPECT_EQ(
+      operandCount(Template::Disjoint, Form::Wrapper, Placement::ReplaceCall),
+      0U);
+  EXPECT_FALSE(
+      operandCount(Template::Object, Form::Wrapper, Placement::WrapArgument));
+  EXPECT_FALSE(
+      operandCount(Template::Len, Form::Wrapper, Placement::ReplaceCall));
 }
 
 /// `char dst[16]; memcpy(dst, src, n);`: `len(n, 16)` before the call.
@@ -161,9 +168,6 @@ TEST(CheckPlan, LedgerTemplatesAndHelpers) {
   CheckPlanEntry entry = memcpyLen();
   EXPECT_EQ(ledgerTemplate(entry), CheckTemplate::Len);
   EXPECT_EQ(helperName(entry), "__weavec_chk_len");
-  entry.form = Form::Violation;
-  EXPECT_EQ(ledgerTemplate(entry), CheckTemplate::Violation);
-  EXPECT_EQ(helperName(entry), "");
 
   CheckPlanEntry nonnull{.kind = Template::Nonnull,
                          .form = Form::IfNonZero,
@@ -181,6 +185,15 @@ TEST(CheckPlan, LedgerTemplatesAndHelpers) {
   EXPECT_EQ(helperName(verify), "__weavec_prv_index");
   EXPECT_EQ(facetCheck(verify),
             (FacetCheck{.kind = CheckTemplate::Index, .proven = true}));
+  // RFC 0034 §5.2: the row names a wrapper's helper; the ledger keeps the
+  // template it checks.
+  CheckPlanEntry wrapper{.kind = Template::Disjoint,
+                         .form = Form::Wrapper,
+                         .placement = Placement::ReplaceCall};
+  EXPECT_TRUE(isWellFormed(wrapper));
+  EXPECT_EQ(helperName(wrapper), "");
+  EXPECT_EQ(ledgerTemplate(wrapper), CheckTemplate::Disjoint);
+  EXPECT_EQ(toString(Form::Wrapper), "wrapper");
 }
 
 TEST(CheckPlan, SortingIsCanonical) {
diff --git a/unittests/Core/HeapTest.cpp b/unittests/Core/HeapTest.cpp
index ad6db4f9..17131cbb 100644
--- a/unittests/Core/HeapTest.cpp
+++ b/unittests/Core/HeapTest.cpp
@@ -19,6 +19,8 @@
 
 #include <gtest/gtest.h>
 
+#include <algorithm>
+
 namespace weavec::core {
 
 //===----------------------------------------------------------------------===//
@@ -445,6 +447,19 @@ TEST_F(HeapTest, I3_ReleaseOnBothPathsStaysDefinite) {
             TemporalVerdict::Kind::Violation);
 }
 
+TEST_F(HeapTest, APossibleReleaseIsNeverDefinite) {
+  // RFC 0034 §6.3: `munmap` of a range that may not cover the object.
+  HeapState state;
+  ObjectId holder = local(1);
+  ObjectId block = allocation(2);
+  Sym p = pointsTo(state, block);
+  set(state, holder, p);
+  heap.release(state, p, freed(), /*possibly=*/true);
+  EXPECT_EQ(heap.temporal(state, get(state, holder)).kind,
+            TemporalVerdict::Kind::MayReleased);
+  EXPECT_EQ(state.objects.at(block).life, Life::MayReleased);
+}
+
 //===----------------------------------------------------------------------===//
 // I4: weak cells hold every value
 //===----------------------------------------------------------------------===//
@@ -692,6 +707,47 @@ TEST_F(HeapTest, ElementsAtDistinctIndicesAreApart) {
   EXPECT_EQ(heap.load(state, array, elementAt(same), hint), atI);
 }
 
+TEST_F(HeapTest, AnIntegerCellAnElementMayBeKeepsItsPointerTargets) {
+  // struct { T *kids[4]; int n; }: kids[j] with j bounded only by n may be
+  // n's cell (offset 32). The read stays a pointer to what kids[0] holds
+  // and to any object (RFC 0034 §6.3, a release in a loop left early), so
+  // `free(p->kids[j])` still releases, possibly, what the elements hold.
+  HeapState state;
+  ObjectId panel = allocation(1);
+  heap.ensure(state, panel);
+  ObjectId block = allocation(2);
+  heap.write(state, panel, CellKey{.offset = 0}, pointsTo(state, block), false);
+  Sym count = heap.fresh(state, SymInfo{.type = SymInfo::Type::Int});
+  heap.write(state, panel, CellKey{.offset = 32}, count, false);
+  Sym j = heap.fresh(state, SymInfo{.type = SymInfo::Type::Int});
+  ASSERT_TRUE(state.zone.addRange(j, 0, std::nullopt));
+  Sym kid = heap.load(state, panel, elementAt(j),
+                      SymInfo{.type = SymInfo::Type::Pointer});
+  const SymInfo &value = heap.info(state, kid);
+  ASSERT_EQ(value.type, SymInfo::Type::Pointer);
+  EXPECT_TRUE(value.rawCast);
+  EXPECT_TRUE(std::ranges::any_of(value.targets, [&](const Target &target) {
+    return target.object == block;
+  }));
+  heap.release(state, kid, freed());
+  EXPECT_EQ(state.objects.at(block).life, Life::MayReleased);
+}
+
+TEST_F(HeapTest, AnIntegerInTheSummaryCellLeavesAnElementReadAPointer) {
+  // A loop folded the count `n` into the element position (`kids[*]`): a
+  // pointer read of some element is still a pointer, raw on that side.
+  HeapState state;
+  ObjectId panel = allocation(1);
+  heap.ensure(state, panel);
+  Sym count = heap.fresh(state, SymInfo{.type = SymInfo::Type::Int});
+  heap.write(state, panel, CellKey{.offset = 0, .stride = 8}, count, true);
+  Sym j = heap.fresh(state, SymInfo{.type = SymInfo::Type::Int});
+  Sym kid = heap.load(state, panel, elementAt(j),
+                      SymInfo{.type = SymInfo::Type::Pointer});
+  EXPECT_EQ(heap.info(state, kid).type, SymInfo::Type::Pointer);
+  EXPECT_TRUE(heap.info(state, kid).rawCast);
+}
+
 TEST_F(HeapTest, ReleasedRangeDecidesTheElementsInIt) {
   // drop(a, 3): every element of [0, 3) released.
   HeapState state;
@@ -1069,6 +1125,27 @@ TEST_F(HeapTest, AnOperationBothPathsComputeSurvivesTheJoin) {
   EXPECT_EQ(value.defined->constant, 4);
 }
 
+TEST_F(HeapTest, AJoinKeepsTheConstantsBothSidesExclude) {
+  // RFC 0034 §6.2: `t` is not 1 on either side, and not 3 on the left; on
+  // the right its bounds leave 5 out, which the left excludes.
+  ObjectId holder = local(1, "t");
+  HeapState before;
+  Sym t = heap.fresh(before, SymInfo{.type = SymInfo::Type::Int});
+  set(before, holder, t);
+  HeapState left = before;
+  HeapState right = before;
+  heap.infoMut(left, t).excluded = {1, 3, 5};
+  heap.infoMut(right, t).excluded = {1};
+  ASSERT_TRUE(right.zone.addRange(t, 0, 4));
+  HeapState joined = heap.join(left, right, 9);
+  EXPECT_EQ(heap.info(joined, get(joined, holder)).excluded,
+            (std::vector<std::int64_t>{1, 5}));
+  // A side that excludes nothing keeps nothing.
+  HeapState joinedAgain = heap.join(joined, before, 9);
+  EXPECT_TRUE(
+      heap.info(joinedAgain, get(joinedAgain, holder)).excluded.empty());
+}
+
 } // namespace weavec::core
 
 namespace weavec::core {
diff --git a/unittests/Core/LedgerTest.cpp b/unittests/Core/LedgerTest.cpp
index 6f87579c..16267e0c 100644
--- a/unittests/Core/LedgerTest.cpp
+++ b/unittests/Core/LedgerTest.cpp
@@ -68,7 +68,9 @@ TEST(Ledger, UnresolvedReasonsAreTheClosedListInOrder) {
                                                "raw-cast",
                                                "dangling-escape",
                                                "second-owner",
-                                               "no-zero-init"};
+                                               "no-zero-init",
+                                               "unconfirmed",
+                                               "lowered"};
   const auto all = allUnresolvedReasons();
   ASSERT_EQ(all.size(), UnresolvedReasonCount);
   ASSERT_EQ(expected.size(), UnresolvedReasonCount);
@@ -139,9 +141,11 @@ TEST(Ledger, AuxiliarySpellingsRoundTrip) {
   EXPECT_EQ(toString(LedgerScope::Program), "program");
   EXPECT_EQ(parseLedgerScope("unit"), LedgerScope::Unit);
   for (const std::string_view name :
-       {"nonnull", "index", "span", "len", "disjoint", "assert", "violation"})
+       {"nonnull", "index", "span", "len", "disjoint", "assert", "object"})
     EXPECT_EQ(toString(*parseCheckTemplate(name)), name);
   EXPECT_FALSE(parseCheckTemplate("strnlen"));
+  // RFC 0034 §6.4: no lowered violation traps unconditionally.
+  EXPECT_FALSE(parseCheckTemplate("violation"));
   EXPECT_FALSE(parseCertainty("maybe"));
 }
 
diff --git a/unittests/Core/LibrarySpecTest.cpp b/unittests/Core/LibrarySpecTest.cpp
index 01ac4ed2..aaa84fc1 100644
--- a/unittests/Core/LibrarySpecTest.cpp
+++ b/unittests/Core/LibrarySpecTest.cpp
@@ -173,6 +173,8 @@ static std::string renderParam(const LibraryParam &param) {
     text += " finis=" + param.family;
     break;
   }
+  if (param.range)
+    text += " range=" + param.range->str();
   if (param.callback)
     text += " " + renderCallback(*param.callback);
   if (param.out)
@@ -219,6 +221,11 @@ static std::string renderClauses(const LibraryEntry &entry) {
                                       : "scanf=") +
                       std::to_string(entry.format->format) + "/" +
                       std::to_string(entry.format->first));
+  if (entry.wrapper)
+    clauses.push_back("wrapper=" + entry.wrapper->name +
+                      (entry.wrapper->room ? "/room" : "") +
+                      (entry.wrapper->source ? "/source" : "") +
+                      (entry.wrapper->disjoint ? "/disjoint" : ""));
   for (const LibraryChk &alias : entry.chk) {
     std::string text = "chk=" + alias.name + ":";
     for (std::size_t i = 0; i < alias.argumentOf.size(); ++i)
@@ -394,6 +401,8 @@ TEST(LibrarySpecTest, ParserErrorsNameTheLineAndTheProblem) {
        "LibrarySpec.txt:2: 'f': unknown parameter flag 'bytez'"},
       {"header a.h;\nf (r:null-ok:null-if-zero(a1), int) -> int;",
        "conflicting null flags ('null-if-zero')"},
+      {"header a.h;\nf (none:range(a1), int) -> int;",
+       "parameter 0: 'range' needs 'release'"},
       {"header a.h;\nf (w:bytes(a3), int) -> int;",
        "'a3' in parameter 0 names a missing parameter"},
       {"header a.h;\nf (w:bytes(fmtlen(a1)), r:str, ...) -> int;",
@@ -405,6 +414,17 @@ TEST(LibrarySpecTest, ParserErrorsNameTheLineAndTheProblem) {
       {"header a.h;\nf () -> int exits;", "'exits' needs a 'noreturn' result"},
       {"header a.h;\nf () -> void returns-twice;",
        "'returns-twice' needs an 'int' result"},
+      // RFC 0034 §5.2: a wrapper computes what the row states.
+      {"header a.h;\nf (w:bytes(a1), int) -> void wrapper(f,disjoint);",
+       "'wrapper(…, disjoint)' needs a 'disjoint' clause"},
+      {"header a.h;\nf (int, r:str) -> void wrapper(f,room);",
+       "'wrapper(…, room)' needs bytes behind argument 0"},
+      {"header a.h;\nf (w:bytes(a1), int) -> void wrapper(f,room,room);",
+       "expected 'room', 'source' or 'disjoint', once each"},
+      {"header a.h;\nf (w:bytes(a2), int, int) -> void wrapper(f,source);",
+       "'wrapper(…, source)' needs bytes behind argument 1"},
+      {"header a.h;\nf (w:bytes(a1), int) -> void wrapper(f) wrapper(f);",
+       "duplicate clause 'wrapper'"},
       {"header a.h;\nf () -> int", "expected ';' at the end of the entry"},
       {"header a.h;\nf () -> int; g () -> int;",
        "unexpected text after ';' (one entry per line)"},
@@ -741,6 +761,17 @@ TEST(LibrarySpecTest, AccessorsDescribeTheRow) {
   EXPECT_FALSE(row("exit").knownToReturn());
   EXPECT_FALSE(row("longjmp").knownToReturn());
   EXPECT_TRUE(row("strlen").knownToReturn());
+  // RFC 0034 §6.3: a `none` argument without an effect is used as a value.
+  EXPECT_TRUE(row("mmap").usesValueOnly(0));
+  EXPECT_TRUE(row("mprotect").usesValueOnly(0));
+  EXPECT_FALSE(row("mmap").usesValueOnly(1));
+  EXPECT_FALSE(row("munmap").usesValueOnly(0));
+  EXPECT_FALSE(row("free").usesValueOnly(0));
+  EXPECT_FALSE(row("memcpy").usesValueOnly(0));
+  EXPECT_FALSE(row("pthread_create").usesValueOnly(3));
+  EXPECT_FALSE(row("tfind").usesValueOnly(0));
+  EXPECT_TRUE(row("munmap").params[0].range.has_value());
+  EXPECT_FALSE(row("free").params[0].range.has_value());
   EXPECT_TRUE(row("getenv").trustsLibrarySpec());
   EXPECT_TRUE(row("strtok").trustsLibrarySpec());
   EXPECT_TRUE(row("tmpnam").trustsLibrarySpec());
@@ -767,7 +798,8 @@ TEST(LibrarySpecTest, AccessorsDescribeTheRow) {
 // BSD and macOS manuals, in the notation of `renderParam`, `renderValue` and
 // `renderClauses`: parameters are `int`, `other`, `fn[?]` or an access (`none`,
 // `R`, `W`, `RW`) with `str`, `bytes=`, `count=`, `nullable[-if=]`, an effect
-// (`releases=`, `reallocs=`, `retains=`, `escapes`, `inits=`, `finis=`), a
+// (`releases=` [`range=`], `reallocs=`, `retains=`, `escapes`, `inits=`,
+// `finis=`), a
 // callback (`sync=`, `entry=`, `atexit`) and `out=(…)`; results name their
 // kind and always their nullability.
 
@@ -841,11 +873,13 @@ static constexpr auto HeapExpectations = std::to_array<Expectation>({
 static constexpr auto StringExpectations = std::to_array<Expectation>({
     {"memcpy", "W bytes=a2 nullable-if=a2, R bytes=a2 nullable-if=a2, int",
      "arg=0 nonnull",
-     "disjoint=0/1/a2 copies=0/1/a2 chk=__builtin___memcpy_chk:0/1/2/-1 "
+     "disjoint=0/1/a2 copies=0/1/a2 wrapper=memcpy/room/source/disjoint "
+     "chk=__builtin___memcpy_chk:0/1/2/-1 "
      "chk=__memcpy_chk:0/1/2/-1"},
     {"memmove", "W bytes=a2 nullable-if=a2, R bytes=a2 nullable-if=a2, int",
      "arg=0 nonnull",
-     "copies=0/1/a2 chk=__builtin___memmove_chk:0/1/2/-1 "
+     "copies=0/1/a2 wrapper=memmove/room/source "
+     "chk=__builtin___memmove_chk:0/1/2/-1 "
      "chk=__memmove_chk:0/1/2/-1"},
     {"memset", "W bytes=a2 nullable-if=a2, int, int", "arg=0 nonnull",
      "fills=0/a1/a2 chk=__builtin___memset_chk:0/1/2/-1 "
@@ -873,7 +907,8 @@ static constexpr auto StringExpectations = std::to_array<Expectation>({
      "chk=__builtin___memccpy_chk:0/1/2/3/-1"},
     {"strcpy", "W bytes=strlen(a1)+1, R str", "arg=0 nonnull",
      "disjoint=0/1/strlen(a1)+1 writes-str=0/strlen(a1) "
-     "chk=__builtin___strcpy_chk:0/1/-1 chk=__strcpy_chk:0/1/-1"},
+     "wrapper=strcpy/room/disjoint chk=__builtin___strcpy_chk:0/1/-1 "
+     "chk=__strcpy_chk:0/1/-1"},
     {"strncpy",
      "W bytes=a2 nullable-if=a2, R bytes=min(a2,strlen(a1)+1) "
      "nullable-if=a2, int",
@@ -883,7 +918,8 @@ static constexpr auto StringExpectations = std::to_array<Expectation>({
     {"stpcpy", "W bytes=strlen(a1)+1, R str",
      "interior=0 nonnull offset=strlen(a1)",
      "disjoint=0/1/strlen(a1)+1 writes-str=0/strlen(a1) "
-     "chk=__builtin___stpcpy_chk:0/1/-1 chk=__stpcpy_chk:0/1/-1"},
+     "wrapper=stpcpy/room/disjoint chk=__builtin___stpcpy_chk:0/1/-1 "
+     "chk=__stpcpy_chk:0/1/-1"},
     {"stpncpy",
      "W bytes=a2 nullable-if=a2, R bytes=min(a2,strlen(a1)+1) nullable-if=a2, "
      "int",
@@ -892,7 +928,7 @@ static constexpr auto StringExpectations = std::to_array<Expectation>({
      "chk=__builtin___stpncpy_chk:0/1/2/-1 chk=__stpncpy_chk:0/1/2/-1"},
     {"strcat", "RW str bytes=strlen(a0)+strlen(a1)+1, R str", "arg=0 nonnull",
      "disjoint=0/1/strlen(a0)+strlen(a1)+1 "
-     "writes-str=0/strlen(a0)+strlen(a1) "
+     "writes-str=0/strlen(a0)+strlen(a1) wrapper=strcat/room "
      "chk=__builtin___strcat_chk:0/1/-1 chk=__strcat_chk:0/1/-1"},
     {"strncat",
      "RW str bytes=strlen(a0)+min(a2,strlen(a1))+1, "
@@ -1036,7 +1072,7 @@ static constexpr auto StdioExpectations = std::to_array<Expectation>({
     {"dprintf", "int, R str, ...", "int",
      "printf=1/2 chk=__dprintf_chk:0/-1/1/2"},
     {"sprintf", "W bytes=fmtlen(a1)+1, R str, ...", "int value=fmtlen(a1)",
-     "writes-str=0/fmtlen(a1) printf=1/2 "
+     "writes-str=0/fmtlen(a1) printf=1/2 wrapper=sprintf/room "
      "chk=__builtin___sprintf_chk:0/-1/-1/1/2 "
      "chk=__sprintf_chk:0/-1/-1/1/2"},
     {"snprintf", "W bytes=a1 nullable-if=a1, int, R str, ...",
@@ -1052,7 +1088,7 @@ static constexpr auto StdioExpectations = std::to_array<Expectation>({
     {"vdprintf", "int, R str, other", "int",
      "printf=1/2 chk=__vdprintf_chk:0/-1/1/2"},
     {"vsprintf", "W bytes=fmtlen(a1)+1, R str, other", "int value=fmtlen(a1)",
-     "writes-str=0/fmtlen(a1) printf=1/2 "
+     "writes-str=0/fmtlen(a1) printf=1/2 wrapper=vsprintf/room "
      "chk=__builtin___vsprintf_chk:0/-1/-1/1/2 "
      "chk=__vsprintf_chk:0/-1/-1/1/2"},
     {"vsnprintf", "W bytes=a1 nullable-if=a1, int, R str, other",
@@ -1349,7 +1385,7 @@ static constexpr auto SystemExpectations = std::to_array<Expectation>({
     {"timer_delete", "none nullable", "int", ""},
     {"mmap", "none nullable, int, int, int, int, int",
      "fresh=munmap nonnull extent=a1", ""},
-    {"munmap", "none nullable releases=munmap, int", "int", ""},
+    {"munmap", "none nullable releases=munmap range=a1, int", "int", ""},
     {"mprotect", "none nullable, int, int", "int", ""},
     {"msync", "none nullable, int, int", "int", ""},
     {"madvise", "none nullable, int, int", "int", ""},
diff --git a/unittests/Frontend/CheckEmitterTest.cpp b/unittests/Frontend/CheckEmitterTest.cpp
index 3fed00d4..88287e5c 100644
--- a/unittests/Frontend/CheckEmitterTest.cpp
+++ b/unittests/Frontend/CheckEmitterTest.cpp
@@ -309,17 +309,6 @@ Emitted compile(llvm::StringRef code, const EmitOptions *setup,
   return out;
 }
 
-/// The IR without the lines that name the source.
-std::string comparable(const std::string &ir) {
-  std::string out;
-  llvm::SmallVector<llvm::StringRef, 128> lines;
-  llvm::StringRef(ir).split(lines, '\n');
-  for (const llvm::StringRef line : lines)
-    if (!line.starts_with("; ModuleID") && !line.starts_with("source_filename"))
-      out += line.str() + "\n";
-  return out;
-}
-
 std::size_t count(llvm::StringRef text, llvm::StringRef needle) {
   std::size_t found = 0;
   for (std::size_t at = text.find(needle); at != llvm::StringRef::npos;
@@ -445,7 +434,10 @@ TEST(CheckEmitterTest, HelperSignaturesMatchThePrelude) {
     std::size_t matched = 0;
     for (const HelperSignature &helper : CheckEmitter::helperSignatures()) {
       std::string name = helper.name.str();
-      if (form.form == PreludeForm::OutOfLine && form.report && helper.reports)
+      // Out of line every report helper has the `_report` name, and inline
+      // the guards the backend expands do (RFC 0034 §1.1).
+      if ((form.form == PreludeForm::OutOfLine || helper.declared) &&
+          form.report && helper.reports)
         name += "_report";
       const auto found = context.getTranslationUnitDecl()->lookup(
           clang::DeclarationName(&context.Idents.get(name)));
@@ -462,7 +454,8 @@ TEST(CheckEmitterTest, HelperSignaturesMatchThePrelude) {
       // not inlined has the helper's type.
       const auto copy = context.getTranslationUnitDecl()->lookup(
           clang::DeclarationName(&context.Idents.get(name + "_ool")));
-      if (form.form == PreludeForm::Inline && helper.reports) {
+      if (form.form == PreludeForm::Inline && helper.reports &&
+          !helper.declared && !helper.wrapper) {
         ASSERT_FALSE(copy.empty()) << name;
         const auto *copied = llvm::dyn_cast<clang::FunctionDecl>(copy.front());
         ASSERT_NE(copied, nullptr) << name;
@@ -477,6 +470,26 @@ TEST(CheckEmitterTest, HelperSignaturesMatchThePrelude) {
   }
   EXPECT_EQ(findHelperSignature("__weavec_chk_span")->params[4],
             HelperSignature::Type::UnsignedLongLong);
+  // RFC 0034 §5.2: the checked wrappers take the row's arguments, a
+  // fortified call's object size and the checks planned; sprintf's are
+  // variadic.
+  const HelperSignature *sprintfWrapper =
+      findHelperSignature("__weavec_chk_sprintf");
+  ASSERT_NE(sprintfWrapper, nullptr);
+  EXPECT_TRUE(sprintfWrapper->wrapper);
+  EXPECT_TRUE(sprintfWrapper->variadic);
+  EXPECT_EQ(sprintfWrapper->params[2], HelperSignature::Type::UnsignedLongLong);
+  EXPECT_EQ(sprintfWrapper->params[3], HelperSignature::Type::Unsigned);
+  EXPECT_EQ(findHelperSignature("__weavec_chk_vsprintf")->params[2],
+            HelperSignature::Type::VaList);
+  for (const llvm::StringRef name :
+       {"__weavec_chk_strcpy", "__weavec_chk_stpcpy", "__weavec_chk_strcat",
+        "__weavec_chk_memcpy", "__weavec_chk_vsprintf"}) {
+    const HelperSignature *wrapper = findHelperSignature(name);
+    ASSERT_NE(wrapper, nullptr) << name.str();
+    EXPECT_TRUE(wrapper->wrapper && wrapper->reports && !wrapper->variadic)
+        << name.str();
+  }
   EXPECT_EQ(findHelperSignature("__weavec_chk_bogus"), nullptr);
 }
 
@@ -680,17 +693,18 @@ int f(int *p, int *q, int k, const char *t, struct buf *s, unsigned long n,
                       "sizeof(int))"),
             std::string::npos)
       << text;
-  EXPECT_NE(text.find("__weavec_have_sub(__weavec_have_s(k), 2ULL) ? "
-                      "__weavec_chk_len(__weavec_need_add(__weavec_need_s(k), "
-                      "1ULL), __weavec_strnlen(t, 16ULL)) : 0"),
+  // Term arithmetic is exact; only its result is clamped.
+  EXPECT_NE(text.find("__weavec_have_s(__weavec_have_sub(k, 2LL)) ? "
+                      "__weavec_chk_len(__weavec_need_s(__weavec_need_add(k, "
+                      "1LL)), __weavec_strnlen(t, 16ULL)) : 0"),
             std::string::npos)
       << text;
-  EXPECT_NE(text.find("memset(q, 0, __weavec_chk_len((n), __weavec_have_sub("
-                      "__weavec_have_s(*s.len), 1ULL)))"),
+  EXPECT_NE(text.find("memset(q, 0, __weavec_chk_len((n), __weavec_have_s("
+                      "__weavec_have_sub(*s.len, 1LL))))"),
             std::string::npos)
       << text;
   EXPECT_NE(text.find("memcpy(__weavec_chk_disjoint((q), arr, "
-                      "__weavec_need_mul(__weavec_need_s(k), sizeof(int))), "
+                      "__weavec_need_s(__weavec_need_mul(k, sizeof(int)))), "
                       "__weavec_chk_span((arr), 0LL, arr, sizeof(int[4]), "
                       "sizeof(int)), n)"),
             std::string::npos)
@@ -703,106 +717,6 @@ int f(int *p, int *q, int k, const char *t, struct buf *s, unsigned long n,
   EXPECT_NE(compiled.ir.find("define"), std::string::npos);
 }
 
-// §3.4: the unconditional trap of a lowered violation, before the operation,
-// in each placement the planner gives it.
-TEST(CheckEmitterTest, LoweredViolationForms) {
-  EmitOptions setup;
-  setup.edit = [](analysis::PlannedLedger &planned,
-                  clang::ASTContext &context) {
-    const auto violation = [](Entry::Placement placement) {
-      Entry made =
-          entry(Entry::Template::Assert, Entry::Form::Violation, placement);
-      made.facet = core::Facet::Temporal;
-      return made;
-    };
-    const auto *deref = siteAt(planned, context, "*p", core::SiteKind::Deref);
-    const auto *call = siteAt(planned, context, "g(p)", core::SiteKind::Call);
-    const auto *assume =
-        siteAt(planned, context, "weavec_assume_", core::SiteKind::Assume);
-    ASSERT_TRUE(deref && call && assume);
-    replaceChecks(planned, *deref, {violation(Entry::Placement::WrapOperand)});
-    replaceChecks(planned, *call, {violation(Entry::Placement::BeforeCall)});
-    replaceChecks(planned, *assume, {violation(Entry::Placement::ReplaceCall)});
-    // The exits: a `return;` and the end of a body.
-    for (const auto &function : planned.sites->functions())
-      for (const analysis::SiteInfo &site : function.sites)
-        if (site.kind == core::SiteKind::Call &&
-            site.boundary == core::Boundary::Exit &&
-            function.decl->getName() == "early")
-          replaceChecks(planned, site,
-                        {violation(Entry::Placement::BeforeCall)});
-  };
-  const char *code = R"C(
-__attribute__((annotate("weavec.assume"))) static inline void
-weavec_assume_(int c) { (void)c; }
-void g(int *p);
-int f(int *p, int n) { weavec_assume_(n > 0); g(p); return *p; }
-void early(int c) { if (c) return; g(0); }
-)C";
-  const Emitted out = rewrite(code, setup);
-  EXPECT_TRUE(out.ok);
-  EXPECT_TRUE(out.errors.empty()) << out.errors.front();
-  const std::string &text = out.bodies;
-  EXPECT_NE(text.find("__weavec_chk_violation();"), std::string::npos) << text;
-  EXPECT_NE(text.find("__weavec_chk_violation() , (g(p));"), std::string::npos)
-      << text;
-  EXPECT_NE(text.find("return *__weavec_chk_violation() , (p);"),
-            std::string::npos)
-      << text;
-  EXPECT_NE(text.find("if (c) { __weavec_chk_violation(); return; }"),
-            std::string::npos)
-      << text;
-  EXPECT_NE(text.find("g(0); __weavec_chk_violation(); }"), std::string::npos)
-      << text;
-  const Emitted compiled = compile(code, &setup);
-  EXPECT_TRUE(compiled.errors.empty()) << compiled.errors.front();
-}
-
-// G8 for a lowered violation, in process: the engine of this stage does not
-// publish violations, so the plan carries the planner's guard by hand; the
-// IR must equal that of the hand-written rewrite.
-TEST(CheckEmitterTest, LoweredViolationOracle) {
-  EmitOptions setup;
-  setup.edit = [](analysis::PlannedLedger &planned,
-                  clang::ASTContext &context) {
-    const auto *deref = siteAt(planned, context, "*p", core::SiteKind::Deref);
-    const auto *release =
-        siteAt(planned, context, "free", core::SiteKind::Release);
-    ASSERT_TRUE(deref && release);
-    Entry temporal = entry(Entry::Template::Assert, Entry::Form::Violation,
-                           Entry::Placement::WrapOperand);
-    temporal.facet = core::Facet::Temporal;
-    Entry nonnull = entry(Entry::Template::Nonnull, Entry::Form::Plain,
-                          Entry::Placement::WrapOperand);
-    nonnull.facet = core::Facet::Null;
-    replaceChecks(planned, *deref, {nonnull, temporal});
-    Entry twice = entry(Entry::Template::Assert, Entry::Form::Violation,
-                        Entry::Placement::BeforeCall);
-    twice.facet = core::Facet::Temporal;
-    replaceChecks(planned, *release, {twice});
-  };
-  const Emitted instrumented = compile(R"C(
-void free(void *);
-int f(int *p) {
-  free(p);
-  return *p;
-}
-)C",
-                                       &setup);
-  const Emitted expected = compile(R"C(
-void free(void *);
-int f(int *p) {
-  (__weavec_chk_violation(), free(p));
-  return *(__weavec_chk_violation(), (int *)__weavec_chk_nonnull(p));
-}
-)C",
-                                   nullptr, setup);
-  EXPECT_TRUE(instrumented.errors.empty()) << instrumented.errors.front();
-  EXPECT_TRUE(expected.errors.empty()) << expected.errors.front();
-  ASSERT_FALSE(instrumented.ir.empty());
-  EXPECT_EQ(comparable(instrumented.ir), comparable(expected.ir));
-}
-
 //===----------------------------------------------------------------------===//
 // Failure
 //===----------------------------------------------------------------------===//
diff --git a/unittests/Frontend/LedgerWriterTest.cpp b/unittests/Frontend/LedgerWriterTest.cpp
index e2fbe073..c72a711c 100644
--- a/unittests/Frontend/LedgerWriterTest.cpp
+++ b/unittests/Frontend/LedgerWriterTest.cpp
@@ -113,12 +113,12 @@ TEST(LedgerWriter, GoldenUnitLedger) {
       R"("may-released":0,"may-moved":0,"may-alias-released":0,"may-invalid-release":0,)"
       R"("may-mismatched-release":0,"may-dangle":0,"may-conflict":0,"unknown-callee":1,)"
       R"("callback":0,"setjmp":0,"budget":0,"unanalysed":0,"raw-cast":0,)"
-      R"("dangling-escape":0,"second-owner":0,"no-zero-init":0},)"
+      R"("dangling-escape":0,"second-owner":0,"no-zero-init":0,"unconfirmed":0,"lowered":0},)"
       R"("guardedReasons":{"unknown-extent":0,"unknown-index":0,"inexpressible":0,)"
       R"("may-released":0,"may-moved":0,"may-alias-released":0,"may-invalid-release":0,)"
       R"("may-mismatched-release":0,"may-dangle":0,"may-conflict":0,"unknown-callee":0,)"
       R"("callback":0,"setjmp":0,"budget":0,"unanalysed":0,"raw-cast":0,)"
-      R"("dangling-escape":0,"second-owner":0,"no-zero-init":0},)"
+      R"("dangling-escape":0,"second-owner":0,"no-zero-init":0,"unconfirmed":0,"lowered":0},)"
       R"("trustedReasons":{"unsafe":0,"system-api":0,"library-spec":0,)"
       R"("extern-contract":0,"caller-contract":0,"external-unit":0,"concurrency":0},)"
       R"("unresolvedShare":{"spatialNull":0,"spatial":0,"null":0,"temporal":1},)"
@@ -128,7 +128,7 @@ TEST(LedgerWriter, GoldenUnitLedger) {
       R"({"schema":"weavec-ledger","version":2,)"
       R"("producer":{"name":"weavec","version":"0.11.0","revision":"abc1234"},)"
       R"("scope":"unit","root":"/proj",)"
-      R"("config":{"checks":"trap","runtime":false,"zeroInit":true,"require":"none","budget":50000},)"
+      R"("config":{"checks":"trap","runtime":false,"zeroInit":true,"require":"none","budget":20000000},)"
       R"("summary":{)" +
       counts +
       R"(},"units":[{"source":"src/cJSON.c","object":"build/cJSON.o",)"
@@ -336,7 +336,7 @@ TEST(LedgerWriter, ProgramLedgerSnippets) {
   expectSnippet(R"("scope":"program")");
   expectSnippet(
       R"("config":{"checks":"verify","runtime":false,"zeroInit":true,)"
-      R"("require":"none","budget":50000})");
+      R"("require":"none","budget":20000000})");
   expectSnippet(
       R"("assumptions":{"A1":{"exportedRequirements":14,"verified":11,)"
       R"("reliesOnSingle":40,"unverifiedCallers":3},"A3":{)"
@@ -409,14 +409,14 @@ TEST(LedgerWriter, SarifStructure) {
   EXPECT_EQ(driver.getString("name"), "weavec");
   EXPECT_EQ(driver.getString("semanticVersion"), "0.11.0");
   const llvm::json::Array &rules = *driver.getArray("rules");
-  // Two diagnostic ids, 19 unresolved reasons, the same 19 for guarded
+  // Two diagnostic ids, 21 unresolved reasons, the same 21 for guarded
   // facets (RFC 0032) and 7 trusted reasons.
-  ASSERT_EQ(rules.size(), 2U + 19U + 19U + 7U);
+  ASSERT_EQ(rules.size(), 2U + 21U + 21U + 7U);
   EXPECT_EQ(objectAt(rules[0]).getString("id"), "invalid-annotation");
   EXPECT_EQ(objectAt(rules[1]).getString("id"), "use-after-free");
   EXPECT_EQ(objectAt(rules[2]).getString("id"), "unresolved/unknown-extent");
-  EXPECT_EQ(objectAt(rules[21]).getString("id"), "guarded/unknown-extent");
-  EXPECT_EQ(objectAt(rules[40]).getString("id"), "trusted/unsafe");
+  EXPECT_EQ(objectAt(rules[23]).getString("id"), "guarded/unknown-extent");
+  EXPECT_EQ(objectAt(rules[44]).getString("id"), "trusted/unsafe");
   EXPECT_EQ(run.getObject("originalUriBaseIds")
                 ->getObject("SRCROOT")
                 ->getString("uri"),
diff --git a/unittests/Frontend/PreludeTest.cpp b/unittests/Frontend/PreludeTest.cpp
index 3decbe4d..09308082 100644
--- a/unittests/Frontend/PreludeTest.cpp
+++ b/unittests/Frontend/PreludeTest.cpp
@@ -60,17 +60,47 @@ TEST(PreludeTest, ModeNoneHasNoPrelude) {
 
 TEST(PreludeTest, TrapModeTrapsWithEveryTemplate) {
   const std::string text = prelude(CheckMode::Trap);
+  // RFC 0034 §1.1: `live` is only declared; the backend and the runtime
+  // check it.
+  EXPECT_NE(text.find("extern void *__weavec_chk_live(const volatile void *);"),
+            std::string::npos);
+  EXPECT_NE(text.find("extern void *__weavec_chk_object(const volatile void "
+                      "*, long long, unsigned long long,"),
+            std::string::npos);
   for (const llvm::StringLiteral name : checkTemplates())
-    EXPECT_NE(
-        text.find("__builtin_verbose_trap(\"weavec\", \"" + name.str() + "\")"),
-        std::string::npos)
-        << name.str();
+    if (name != "live")
+      EXPECT_NE(text.find("__builtin_verbose_trap(\"weavec\", \"" + name.str() +
+                          "\")"),
+                std::string::npos)
+          << name.str();
   EXPECT_NE(text.find("static __inline__ __attribute__((always_inline, "
                       "nodebug, unused)) void *__weavec_chk_nonnull("),
             std::string::npos);
   EXPECT_EQ(text.find("__weavec_prv_"), std::string::npos);
   EXPECT_EQ(text.find("__weavec_rt_report"), std::string::npos);
-  EXPECT_NE(text.find("extern __typeof__(sizeof 0) malloc_size(const void *);"),
+  // RFC 0034 §5.2: the checked wrappers, which compute the need at run
+  // time; sprintf's forwards to vsprintf's, through the bounded writer.
+  EXPECT_NE(text.find("extern unsigned long long __weavec_rt_room(const void "
+                      "*);"),
+            std::string::npos);
+  EXPECT_NE(text.find("char *__weavec_chk_strcpy(char *d, const char *s, "
+                      "unsigned long long cap,\n                    unsigned "
+                      "what) {"),
+            std::string::npos);
+  EXPECT_NE(text.find("static __attribute__((unused, nodebug)) int "
+                      "__weavec_chk_sprintf(char *d, const char *f, unsigned "
+                      "long long cap,\n                   unsigned what, ...) "
+                      "{"),
+            std::string::npos);
+  EXPECT_NE(text.find("__builtin_va_start(ap, what);"), std::string::npos);
+  EXPECT_NE(text.find("r = __builtin_vsnprintf(d, room, f, ap);"),
+            std::string::npos);
+  EXPECT_NE(text.find("__builtin_verbose_trap(\"weavec\", \"disjoint\"))"),
+            std::string::npos);
+  // RFC 0034 §5.3: with the runtime, zero-initialisation asks the runtime
+  // for a block's size.
+  EXPECT_NE(text.find("extern __typeof__(sizeof 0) __weavec_rt_size(const void "
+                      "*);"),
             std::string::npos);
 }
 
@@ -84,7 +114,9 @@ TEST(PreludeTest, UsesNoMacrosNorLineComments) {
     EXPECT_EQ(text.find("//"), std::string::npos);
     EXPECT_EQ(text.find('$'), std::string::npos) << "an unexpanded marker";
     // Every helper is a static always-inline function, but for the static
-    // non-inline wrappers whose address a program takes (section 11).
+    // non-inline wrappers whose address a program takes (section 11) and
+    // the variadic checked wrapper (RFC 0034 section 5.2), which cannot be
+    // inlined.
     llvm::SmallVector<llvm::StringRef, 256> lines;
     llvm::StringRef(text).split(lines, '\n');
     for (const llvm::StringRef line : lines)
@@ -93,7 +125,8 @@ TEST(PreludeTest, UsesNoMacrosNorLineComments) {
         EXPECT_TRUE(line.starts_with("static __inline__ __attribute__") ||
                     (line.starts_with("static __attribute__((unused, "
                                       "nodebug))") &&
-                     line.contains("_zero_fn(")))
+                     (line.contains("_zero_fn(") ||
+                      line.contains("__weavec_chk_sprintf("))))
             << line.str();
   }
 }
@@ -107,13 +140,20 @@ TEST(PreludeTest, ReportModeTakesTheSiteAndCallsTheRuntime) {
                       "long n, const char *file, unsigned line, unsigned "
                       "column)"),
             std::string::npos);
-  EXPECT_NE(text.find("__weavec_chk_violation(const char *file, unsigned "
-                      "line, unsigned column)"),
-            std::string::npos);
+  // RFC 0034 §6.4: no unconditional trap.
+  EXPECT_EQ(text.find("__weavec_chk_violation"), std::string::npos);
   EXPECT_NE(text.find("__weavec_rt_report(\"span\", file, line, column);"),
             std::string::npos);
   EXPECT_EQ(text.find("__builtin_verbose_trap"), std::string::npos);
   EXPECT_EQ(text.find("__builtin_trap"), std::string::npos);
+  // RFC 0034 §5.2: a variadic wrapper takes the site before its `...`.
+  EXPECT_NE(text.find("unsigned what, const char *file, unsigned line, "
+                      "unsigned column, ...) {"),
+            std::string::npos);
+  EXPECT_NE(text.find("__builtin_va_start(ap, column);"), std::string::npos);
+  EXPECT_NE(text.find("r = __weavec_chk_vsprintf(d, f, ap, cap, what, file, "
+                      "line, column);"),
+            std::string::npos);
 }
 
 TEST(PreludeTest, VerifyModeAddsTheProvenFamily) {
@@ -138,8 +178,15 @@ TEST(PreludeTest, ZeroInitNeedsTheSwitchAndAQuery) {
             std::string::npos);
   options.usableSize = UsableSizeQuery::MallocUsableSize;
   EXPECT_NE(buildCheckPrelude(options).find(
-                "extern __typeof__(sizeof 0) malloc_usable_size(void *);"),
+                "extern __typeof__(sizeof 0) __weavec_rt_size(const void *);"),
             std::string::npos);
+  {
+    PreludeOptions plain = options;
+    plain.runtime = false;
+    EXPECT_NE(buildCheckPrelude(plain).find(
+                  "extern __typeof__(sizeof 0) malloc_usable_size(void *);"),
+              std::string::npos);
+  }
   options.verboseTrap = false;
   // RFC 0033 §6.1: with the runtime a trap first makes sure it ends the
   // program.
@@ -172,6 +219,8 @@ TEST(PreludeTest, OutOfLineFormDefinesExternalHelpers) {
                         "const char *file"),
             std::string::npos);
   EXPECT_NE(report.find("__weavec_strnlen_report("), std::string::npos);
+  EXPECT_NE(report.find("\nint __weavec_chk_sprintf_report(char *d"),
+            std::string::npos);
   EXPECT_EQ(report.find("__weavec_need_add"), std::string::npos);
 }
 

From 5453faf7ce539a7f74d5fe0e681c61d58a89bb52 Mon Sep 17 00:00:00 2001
From: Owen Carey <37121709+owenthcarey@users.noreply.github.com>
Date: Mon, 5 Oct 2026 17:08:10 -0700
Subject: [PATCH 2/6] fix: pass optional witness terms through; hygiene test's
 engine budget

---
 lib/Analysis/EngineLibrary.cpp | 4 ++--
 scripts/test_check_hygiene.py  | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/Analysis/EngineLibrary.cpp b/lib/Analysis/EngineLibrary.cpp
index a4ecc628..34fbbb6c 100644
--- a/lib/Analysis/EngineLibrary.cpp
+++ b/lib/Analysis/EngineLibrary.cpp
@@ -549,9 +549,9 @@ void Transfer::decideArguments(const CallExpr &call, const SiteInfo &site,
         std::optional<CheckWitness> lowered;
         if (haveTerm && needTerm && !requirement.rowOnly)
           lowered = CheckWitness{.shape = CheckWitness::Shape::Length,
-                                 .extent = *haveTerm,
+                                 .extent = haveTerm,
                                  .extentClass = extent->cls,
-                                 .need = *needTerm,
+                                 .need = needTerm,
                                  .unmodified = true,
                                  .accessesSafe = true};
         else
diff --git a/scripts/test_check_hygiene.py b/scripts/test_check_hygiene.py
index a1de232f..c7479850 100755
--- a/scripts/test_check_hygiene.py
+++ b/scripts/test_check_hygiene.py
@@ -565,7 +565,7 @@ def test_output_json_and_exit_code(self):
         self.assertRegex(output, r"\n  files: +14 from a directory walk \(not a git work tree\); "
                                  r"skipped 0 binary, 0 unreadable\n")
         self.assertRegex(output, r"\n  LibrarySpec: +5 entries, 3 chk aliases, and their __builtin_ spellings\n")
-        self.assertRegex(output, r"\n  engine lines: +24 / 21,500 \(2 lib/Analysis/Engine\*\.\{h,cpp\} files\)\n")
+        self.assertRegex(output, r"\n  engine lines: +24 / 22,000 \(2 lib/Analysis/Engine\*\.\{h,cpp\} files\)\n")
         self.assertRegex(output, r"\n  library lines: +\d+ / 10 \(10 code files under lib/, include/ and "
                                  r"tools/, lib/Core/LibrarySpec\.txt excluded\)\n")
         self.assertRegex(output, r"\n  retired-name +1  checked-mode or old-engine names")

From 9d618c9cf0990377453bde477cce22aa6be770b8 Mon Sep 17 00:00:00 2001
From: Owen Carey <37121709+owenthcarey@users.noreply.github.com>
Date: Mon, 5 Oct 2026 18:42:43 -0700
Subject: [PATCH 3/6] fix(runtime): end trapping programs where core dumps are
 on

The shadow and the arena's reservations are excluded from core dumps
(MADV_DONTDUMP) and each committed part of the arena is included again:
on Linux a trapping program dumped 17.6 TB of zeros into apport and every
bug case timed out. A function that calls an inlinable loose function
enters its objects loose, and a loose object has the whole of a partial
last granule: an inlined callee's compound literal shared one on
linux-arm64. RFC 0034 amendment 19.
---
 docs/rfcs/0034-fast-enforcement.md            | 24 +++++++++++++
 include/weavec/Frontend/ObjectRegistration.h  |  4 ++-
 lib/Frontend/ObjectRegistration.cpp           | 34 ++++++++++++++++++-
 lib/Frontend/Prelude.cpp                      |  6 ++--
 runtime/test/rt_test.c                        | 23 ++++++++++++-
 runtime/weavec_alloc.c                        | 18 ++++++++++
 runtime/weavec_rt.h                           | 17 ++++++----
 test/Emission/stack-objects-inlined-unnamed.c | 28 +++++++++++++++
 8 files changed, 142 insertions(+), 12 deletions(-)
 create mode 100644 test/Emission/stack-objects-inlined-unnamed.c

diff --git a/docs/rfcs/0034-fast-enforcement.md b/docs/rfcs/0034-fast-enforcement.md
index e7da0c31..5d02bf54 100644
--- a/docs/rfcs/0034-fast-enforcement.md
+++ b/docs/rfcs/0034-fast-enforcement.md
@@ -991,6 +991,30 @@ disagree, the amendment holds.
       a leave clears a run byte's least run at once (6.3 seconds; most of
       what remains is the zero-initialisation of the arrays, RFC 0033).
 
+19. **What Linux found (§2, §4).** The gates were measured on darwin-arm64;
+    the first Linux CI run found two more faults:
+    - **A trapping program did not end where core dumps are on.** The
+      shadow (2^44 bytes) and the arena's reservations are anonymous
+      mappings a dump walks page by page, and a dump piped to a crash
+      handler (Ubuntu's apport) writes them out as zeros: every bug case
+      timed out. The runtime marks the shadow, the arena's reservation and
+      the shadow it remaps excluded from core dumps (`MADV_DONTDUMP` where
+      the system has it) and includes again each part of the arena it
+      commits, so a dump keeps the heap. A trapping case's dump on Linux
+      went from 17.6 TB (sparse; 100 seconds) to 8 MB (3 milliseconds).
+    - **Unnamed storage an inlined callee lays in its caller's frame.** On
+      linux-arm64 a compound literal of an inlined callee shared the last
+      granule of an 8-byte local, whose exact encoding then made the
+      literal's read trap (`semantics/runtime/stack-inlined-literal_ok.c`).
+      A function now enters its objects loose when it calls, directly or
+      through others, a function of the unit that may be inlined (not
+      `noinline`) and is loose itself or registers nothing for a
+      returns-twice call; and a loose object has the whole of a last
+      granule it fills only in part (`0x40 + 16`), so storage sharing it
+      reads as inside the object and lookups from the shadow still find
+      the object's end. An overflow into the rest of that granule is not
+      caught in such a frame.
+
 ## Drawbacks
 
 - **A pass in the backend.** WeaveC's checks have been C that any Clang
diff --git a/include/weavec/Frontend/ObjectRegistration.h b/include/weavec/Frontend/ObjectRegistration.h
index c448095e..b077f314 100644
--- a/include/weavec/Frontend/ObjectRegistration.h
+++ b/include/weavec/Frontend/ObjectRegistration.h
@@ -33,7 +33,9 @@
 // the frames a `longjmp` abandoned are dropped. A function with automatic
 // objects the plan does not register (compound literals, `alloca`) enters
 // its objects *loose*: the address one past such an object may be the start
-// of an unknown one.
+// of an unknown one. So does a function that calls such a function directly
+// (or through others) unless it is `noinline`: once inlined, the callee's
+// storage lies in the caller's frame.
 //
 // Global objects are the variables of static storage duration the unit
 // defines (file-scope and static locals, tentative definitions included),
diff --git a/lib/Frontend/ObjectRegistration.cpp b/lib/Frontend/ObjectRegistration.cpp
index 1f47947c..04a6ceb4 100644
--- a/lib/Frontend/ObjectRegistration.cpp
+++ b/lib/Frontend/ObjectRegistration.cpp
@@ -96,6 +96,8 @@ class LocalWalker : public clang::RecursiveASTVisitor<LocalWalker> {
   llvm::SmallVector<const clang::VarDecl *, 4> statics;
   /// A compound literal or an `alloca`: automatic storage with no name.
   bool unnamedStorage = false;
+  /// The functions called directly that may be inlined here.
+  llvm::SmallVector<const clang::FunctionDecl *, 8> inlinable;
   /// A label: a backward `goto` can run a declaration again.
   bool labels = false;
 
@@ -178,6 +180,8 @@ class LocalWalker : public clang::RecursiveASTVisitor<LocalWalker> {
     if (const clang::FunctionDecl *callee = call->getDirectCallee();
         callee != nullptr && analysis::isReturnsTwice(*callee, library))
       returnsTwice.push_back(call);
+    else if (callee != nullptr && !callee->hasAttr<clang::NoInlineAttr>())
+      inlinable.push_back(callee->getCanonicalDecl());
     return true;
   }
   // NOLINTEND(readability-identifier-naming,bugprone-derived-method-shadowing-base-method)
@@ -346,6 +350,12 @@ ObjectPlan planObjects(clang::ASTContext &context,
       plan.globals.push_back(definition);
   };
 
+  // Functions with automatic storage the plan does not enter, and the
+  // functions each one calls that may be inlined into it.
+  llvm::DenseSet<const clang::FunctionDecl *> looseFunctions;
+  llvm::DenseMap<const clang::FunctionDecl *,
+                 llvm::SmallVector<const clang::FunctionDecl *, 8>>
+      inlinableCallees;
   for (const analysis::SiteIndex::FunctionSites &function : sites.functions()) {
     const clang::FunctionDecl *definition = nullptr;
     if (function.decl == nullptr || !function.decl->hasBody(definition) ||
@@ -357,13 +367,17 @@ ObjectPlan planObjects(clang::ASTContext &context,
       addGlobal(*variable);
     if (!options.stack)
       continue;
+    const clang::FunctionDecl *canonical = definition->getCanonicalDecl();
+    inlinableCallees[canonical] = std::move(walker.inlinable);
     for (const clang::CallExpr *call : walker.returnsTwice)
       plan.rewinds.push_back(
           ReturnsTwiceCall{.call = call, .function = definition});
     // A `longjmp` back into this function skips the cleanups of the scopes
     // it leaves, so nothing here is entered (§4.3).
-    if (!walker.returnsTwice.empty() || function.callsSetjmp)
+    if (!walker.returnsTwice.empty() || function.callsSetjmp) {
+      looseFunctions.insert(canonical);
       continue;
+    }
     bool loose = walker.unnamedStorage;
     // A declaration a jump bypasses does not run its registration either:
     // the local is automatic storage the list does not know.
@@ -408,7 +422,25 @@ ObjectPlan planObjects(clang::ASTContext &context,
                                        .loose = loose,
                                        .scoped = scoped});
     }
+    if (loose)
+      looseFunctions.insert(canonical);
+  }
+  // Inlined, a callee's storage lies in its caller's frame: a function that
+  // calls a loose one, directly or through others, enters its objects loose.
+  for (bool grew = true; grew;) {
+    grew = false;
+    for (const auto &[caller, callees] : inlinableCallees)
+      if (!looseFunctions.contains(caller) &&
+          llvm::any_of(callees, [&](const clang::FunctionDecl *callee) {
+            return looseFunctions.contains(callee);
+          })) {
+        looseFunctions.insert(caller);
+        grew = true;
+      }
   }
+  for (StackObject &object : plan.stack)
+    object.loose = object.loose ||
+                   looseFunctions.contains(object.function->getCanonicalDecl());
 
   if (options.globals) {
     const clang::SourceManager &sm = context.getSourceManager();
diff --git a/lib/Frontend/Prelude.cpp b/lib/Frontend/Prelude.cpp
index 61fc8310..379f896d 100644
--- a/lib/Frontend/Prelude.cpp
+++ b/lib/Frontend/Prelude.cpp
@@ -356,9 +356,11 @@ static constexpr llvm::StringLiteral RuntimeHelpers = R"C(
     }
     for (; r > 0; --r)
       *at++ = (unsigned char)(0x80 + r);
-    /* A last granule it shares with a live mixed object stays mixed. */
+    /* A last granule it shares with a live mixed object stays mixed; in a
+     * frame with unnamed storage (flag 1), which may share a last granule
+     * it fills in part, it has the whole granule. */
     if ((size & 15) == 0 || *at != 0xFC)
-      *at = (unsigned char)(0x40 + ((unsigned long long)size - 16 * (n - 1)));
+      *at = (unsigned char)(0x40 + ((flags & 1) != 0 ? 16 : (unsigned long long)size - 16 * (n - 1)));
     /* One past it belongs to it: an untracked granule after it says so,
      * unless the frame has unnamed storage (flag 1), which may start there. */
     if ((size & 15) == 0 && (flags & 1) == 0 && at[1] == 0)
diff --git a/runtime/test/rt_test.c b/runtime/test/rt_test.c
index 9ab89207..5b8418f4 100644
--- a/runtime/test/rt_test.c
+++ b/runtime/test/rt_test.c
@@ -481,7 +481,7 @@ static void testLargeObject(void) {
   struct __weavec_rt_found found;
   if (!weavecRtShadowReady())
     return;
-  weavecRtShadowObject((uintptr_t)big, sizeof big, 0);
+  weavecRtShadowObject((uintptr_t)big, sizeof big, 1);
   found = __weavec_rt_find(big + 700001);
   CHECK(found.state == WeavecRtTrackedLive);
   CHECK(found.base == (uintptr_t)big);
@@ -492,6 +492,26 @@ static void testLargeObject(void) {
   weavecRtShadowClear((uintptr_t)big, (uintptr_t)big + sizeof big);
 }
 
+/* An object whose last granule unknown storage may share (a frame with
+ * unnamed storage) has the whole granule, and is still found from its
+ * middle; one that nothing shares has it exact. */
+static void testLoosePartial(void) {
+  static char shared[24] __attribute__((aligned(16)));
+  if (!weavecRtShadowReady())
+    return;
+  weavecRtShadowObject((uintptr_t)shared, sizeof shared, 0);
+  CHECK(*weavecRtShadowOf((uintptr_t)shared) == WeavecRtShadowObjectRun + 1);
+  CHECK(*weavecRtShadowOf((uintptr_t)shared + 16) ==
+        WeavecRtShadowObjectLast + 16);
+  CHECK(__weavec_rt_find(shared + 20).base == (uintptr_t)shared);
+  CHECK(guardByte(shared, 31) == 0);
+  weavecRtShadowClear((uintptr_t)shared, (uintptr_t)shared + sizeof shared);
+  weavecRtShadowObject((uintptr_t)shared, sizeof shared, 1);
+  CHECK(*weavecRtShadowOf((uintptr_t)shared + 16) ==
+        WeavecRtShadowObjectLast + 8);
+  weavecRtShadowClear((uintptr_t)shared, (uintptr_t)shared + sizeof shared);
+}
+
 static jmp_buf jump;
 
 static __attribute__((noinline)) void jumpsOut(void) {
@@ -675,6 +695,7 @@ static const struct {
     {"mixed-neighbours", testMixedNeighbours},
     {"shadow-clear", testShadowClear},
     {"large-object", testLargeObject},
+    {"loose-partial", testLoosePartial},
     {"longjmp", testLongjmp},
     {"deep-stack", testDeepStack},
     {"globals", testGlobals},
diff --git a/runtime/weavec_alloc.c b/runtime/weavec_alloc.c
index 8386e20d..556ac248 100644
--- a/runtime/weavec_alloc.c
+++ b/runtime/weavec_alloc.c
@@ -182,6 +182,20 @@ static inline uintptr_t regionStart(unsigned region) {
 
 /*===-- The shadow (RFC 0034, section 2) -----------------------------------===*/
 
+/* Whether a core dump includes [p, p + bytes). The shadow and the arena's
+ * reservations are terabytes a dump would otherwise walk page by page (and,
+ * piped to a crash handler, write out as zeros): a trapping program would
+ * not end. What the arena has committed is dumped. */
+static void dumpable(void *p, size_t bytes, int dump) {
+#if defined(MADV_DONTDUMP)
+  (void)madvise(p, bytes, dump ? MADV_DODUMP : MADV_DONTDUMP);
+#else
+  (void)p;
+  (void)bytes;
+  (void)dump;
+#endif
+}
+
 /* Reserves the shadow of the address space: 2^48 bytes of it where the
  * system allows, else 2^47, 2^44 (39-bit address spaces are 2^35). Pages no
  * allocation wrote read 0, which no live arena object's bytes are. */
@@ -194,6 +208,7 @@ static void reserveShadow(void) {
                      MAP_PRIVATE | MAP_ANONYMOUS | MAP_NORESERVE, -1, 0);
     if (map == MAP_FAILED)
       continue;
+    dumpable(map, bytes + 64, 0);
     __atomic_store_n(&__weavec_rt_heap.shadow, (uintptr_t)map,
                      __ATOMIC_RELEASE);
     /* Published last: until then every guard asks the runtime. */
@@ -253,6 +268,7 @@ static int reserve(unsigned shift) {
              MAP_PRIVATE | MAP_ANONYMOUS | MAP_NORESERVE, -1, 0);
   if (map == MAP_FAILED)
     return 0;
+  dumpable(map, total, 0);
   /* Regions start at multiples of their size, so that the slots of a
    * power-of-two class are aligned to it. */
   start = ((uintptr_t)map + align - 1) & ~(align - 1);
@@ -312,6 +328,7 @@ static int commit(uintptr_t start, uintptr_t *committed, uintptr_t end,
   if (mprotect((void *)(start + *committed), target - *committed,
                PROT_READ | PROT_WRITE) != 0)
     return 0;
+  dumpable((void *)(start + *committed), target - *committed, 1);
   *committed = target;
   return 1;
 }
@@ -851,6 +868,7 @@ void weavecRtShadowZero(unsigned char *start, size_t bytes) {
     memset(start, 0, bytes);
     return;
   }
+  dumpable((void *)first, last - first, 0);
   memset(start, 0, first - (uintptr_t)start);
   memset((void *)last, 0, (uintptr_t)start + bytes - last);
 }
diff --git a/runtime/weavec_rt.h b/runtime/weavec_rt.h
index c2f1fee5..95f7be70 100644
--- a/runtime/weavec_rt.h
+++ b/runtime/weavec_rt.h
@@ -166,15 +166,17 @@ static inline void weavecRtShadowFill(uintptr_t base, size_t size,
 }
 
 /* A live stack or global object of `size` bytes at `base`: exactly when it
- * starts on a granule, else `Mixed` over its granules and the next. An
- * untracked granule after it (`onePast`: a global's padding, or the next
- * granule of a frame with no unnamed storage) says that an address one
- * past it belongs to it. The
+ * starts on a granule, else `Mixed` over its granules and the next. When no
+ * storage the runtime does not know can follow it (`known`: a global's
+ * padding, a frame with no unnamed storage), an untracked granule after it
+ * says that an address one past it belongs to it; otherwise it has the
+ * whole of a last granule it fills only in part, since unknown storage may
+ * share it. The
  * granule after it may start a live exactly encoded neighbour, whose bytes
  * stay (its leave walks them); one past the end of this one then reads as
  * the neighbour's, as with two exact objects. */
 static inline void weavecRtShadowObject(uintptr_t base, size_t size,
-                                        int onePast) {
+                                        int known) {
   uintptr_t g;
   if (!weavecRtShadowReady() || size == 0)
     return;
@@ -202,8 +204,9 @@ static inline void weavecRtShadowObject(uintptr_t base, size_t size,
     if ((size & 15) == 0 ||
         *weavecRtShadowOf(base + ((n - 1) << 4)) != WeavecRtShadowMixed)
       *weavecRtShadowOf(base + ((n - 1) << 4)) =
-          (unsigned char)(WeavecRtShadowObjectLast + (size - ((n - 1) << 4)));
-    if (onePast && (size & 15) == 0 && *weavecRtShadowOf(base + (n << 4)) == 0)
+          (unsigned char)(WeavecRtShadowObjectLast +
+                          (known ? size - ((n - 1) << 4) : 16));
+    if (known && (size & 15) == 0 && *weavecRtShadowOf(base + (n << 4)) == 0)
       *weavecRtShadowOf(base + (n << 4)) = WeavecRtShadowOnePast;
     return;
   }
diff --git a/test/Emission/stack-objects-inlined-unnamed.c b/test/Emission/stack-objects-inlined-unnamed.c
new file mode 100644
index 00000000..76b2590d
--- /dev/null
+++ b/test/Emission/stack-objects-inlined-unnamed.c
@@ -0,0 +1,28 @@
+// RFC 0034 §4 (amendment 19): a function enters its objects loose (flag 1)
+// when a function it calls may be inlined into it and has automatic storage
+// the plan does not enter: inlined, that storage lies in the caller's frame,
+// possibly in the last granule of one of its objects. A `noinline` callee's
+// storage stays in its own frame.
+//
+// RUN: %weavec_cc -O0 -Xclang -disable-llvm-passes -S -emit-llvm %s -o - | FileCheck %s
+
+static __attribute__((noinline)) long rd(const void *p) {
+  return *(const long *)p;
+}
+static long literal(long v) { return rd((long[1]){v}); }
+static long middle(long v) { return literal(v); }
+static __attribute__((noinline)) long apart(long v) { return rd((long[1]){v}); }
+
+// CHECK-LABEL: define {{.*}}i64 @inlines(
+// CHECK: call ptr @__weavec_stack_enter(ptr noundef %{{[a-z0-9.]+}}, i64 noundef 8, i32 noundef 1)
+long inlines(long v) {
+  long a = v;
+  return middle(v) + rd(&a);
+}
+
+// CHECK-LABEL: define {{.*}}i64 @calls_apart(
+// CHECK: call ptr @__weavec_stack_enter(ptr noundef %{{[a-z0-9.]+}}, i64 noundef 8, i32 noundef 0)
+long calls_apart(long v) {
+  long a = v;
+  return apart(v) + rd(&a);
+}

From 8bccd332edbe51505d1dff1527588dd6ee69efc3 Mon Sep 17 00:00:00 2001
From: Owen Carey <37121709+owenthcarey@users.noreply.github.com>
Date: Mon, 5 Oct 2026 19:05:50 -0700
Subject: [PATCH 4/6] fix(runtime): ELF builds by weavec-cc and foreign usable
 sizes

An archive weavec-cc built is recognised on ELF too (Mach-O's extra
underscore was stripped from every name); the runtime asks the C
library for a foreign block's usable size unless libweavec_alloc.a is
linked, so zero-initialisation reaches the whole block on Linux; the
loose-partial runtime test owns both granules it checks.
---
 lib/Frontend/Driver.cpp |  6 +++---
 runtime/test/rt_test.c  | 16 +++++++++++-----
 runtime/weavec_alloc.c  |  9 ++++++---
 runtime/weavec_malloc.c |  4 ++++
 4 files changed, 24 insertions(+), 11 deletions(-)

diff --git a/lib/Frontend/Driver.cpp b/lib/Frontend/Driver.cpp
index 0591773b..e8470688 100644
--- a/lib/Frontend/Driver.cpp
+++ b/lib/Frontend/Driver.cpp
@@ -926,9 +926,9 @@ static bool builtByWeaveC(const std::string &path) {
       llvm::raw_svector_ostream stream(name);
       if (llvm::errorToBool(symbol.printName(stream)))
         continue;
-      llvm::StringRef text = name;
-      text.consume_front("_");
-      if (text.starts_with("__weavec_"))
+      // (Mach-O spells C names with one more leading underscore.)
+      const llvm::StringRef text = name;
+      if (text.starts_with("__weavec_") || text.starts_with("___weavec_"))
         return true;
     }
     return false;
diff --git a/runtime/test/rt_test.c b/runtime/test/rt_test.c
index 5b8418f4..1ac4c491 100644
--- a/runtime/test/rt_test.c
+++ b/runtime/test/rt_test.c
@@ -496,20 +496,26 @@ static void testLargeObject(void) {
  * unnamed storage) has the whole granule, and is still found from its
  * middle; one that nothing shares has it exact. */
 static void testLoosePartial(void) {
-  static char shared[24] __attribute__((aligned(16)));
+  /* Two whole granules of its own, whatever the linker puts after it. */
+  static struct {
+    char object[24];
+    char rest[8];
+  } block __attribute__((aligned(16)));
+  char *const shared = block.object;
   if (!weavecRtShadowReady())
     return;
-  weavecRtShadowObject((uintptr_t)shared, sizeof shared, 0);
+  weavecRtShadowClear((uintptr_t)&block, (uintptr_t)&block + sizeof block);
+  weavecRtShadowObject((uintptr_t)shared, sizeof block.object, 0);
   CHECK(*weavecRtShadowOf((uintptr_t)shared) == WeavecRtShadowObjectRun + 1);
   CHECK(*weavecRtShadowOf((uintptr_t)shared + 16) ==
         WeavecRtShadowObjectLast + 16);
   CHECK(__weavec_rt_find(shared + 20).base == (uintptr_t)shared);
   CHECK(guardByte(shared, 31) == 0);
-  weavecRtShadowClear((uintptr_t)shared, (uintptr_t)shared + sizeof shared);
-  weavecRtShadowObject((uintptr_t)shared, sizeof shared, 1);
+  weavecRtShadowClear((uintptr_t)&block, (uintptr_t)&block + sizeof block);
+  weavecRtShadowObject((uintptr_t)shared, sizeof block.object, 1);
   CHECK(*weavecRtShadowOf((uintptr_t)shared + 16) ==
         WeavecRtShadowObjectLast + 8);
-  weavecRtShadowClear((uintptr_t)shared, (uintptr_t)shared + sizeof shared);
+  weavecRtShadowClear((uintptr_t)&block, (uintptr_t)&block + sizeof block);
 }
 
 static jmp_buf jump;
diff --git a/runtime/weavec_alloc.c b/runtime/weavec_alloc.c
index 556ac248..87029292 100644
--- a/runtime/weavec_alloc.c
+++ b/runtime/weavec_alloc.c
@@ -693,10 +693,13 @@ static void *nextRealloc(void *p, size_t size) {
 
 static size_t nextSize(const void *p) {
   size_t (*usable)(void *) = (size_t (*)(void *))nextSymbol("malloc_usable_size");
-  /* The runtime's own definition is the first in lookup order when it
-   * interposes, and it would ask again. */
+  /* With libweavec_alloc.a linked, the runtime's own definition may be the
+   * first in lookup order, and it would ask again; without it, the first is
+   * the C library's, which answers. */
   extern size_t malloc_usable_size(void *) __attribute__((weak));
-  if (usable == NULL || usable == malloc_usable_size)
+  extern const char __weavec_alloc_linked __attribute__((weak));
+  if (usable == NULL ||
+      (&__weavec_alloc_linked != NULL && usable == malloc_usable_size))
     return 0;
   return usable((void *)(uintptr_t)p);
 }
diff --git a/runtime/weavec_malloc.c b/runtime/weavec_malloc.c
index d9363dd2..088c5e5c 100644
--- a/runtime/weavec_malloc.c
+++ b/runtime/weavec_malloc.c
@@ -148,4 +148,8 @@ void *pvalloc(size_t size) {
 
 size_t malloc_usable_size(void *p) { return __weavec_rt_size(p); }
 
+/* Tells the runtime that the `malloc_usable_size` first in lookup order may
+ * be the one above, which would ask it again. */
+WEAVEC_RT_API const char __weavec_alloc_linked = 1;
+
 #endif

From 7feaa66fc52a59561c66d0e84018e6c862e2b676 Mon Sep 17 00:00:00 2001
From: Owen Carey <37121709+owenthcarey@users.noreply.github.com>
Date: Mon, 5 Oct 2026 19:18:46 -0700
Subject: [PATCH 5/6] test(cases): mark the blind use-after-scope case a known
 miss
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A stack object is untracked once its scope ends (RFC 0032 §4): case 34
stopped on arm64 only because the dead buffer lay one past a live array.
On linux-x86-64 it does not; amendment 16's F6 count is 40, not 41.
---
 docs/rfcs/0034-fast-enforcement.md             | 18 +++++++++++-------
 .../detection-blind/34_block_scope_label.c     |  2 +-
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/docs/rfcs/0034-fast-enforcement.md b/docs/rfcs/0034-fast-enforcement.md
index 5d02bf54..c917cb18 100644
--- a/docs/rfcs/0034-fast-enforcement.md
+++ b/docs/rfcs/0034-fast-enforcement.md
@@ -950,13 +950,17 @@ disagree, the amendment holds.
       over budget (G15) and Lua without the runtime ran 1.47 times slower.
     - **F6 recorded.** On the 48 blind programs of `test/cases/detection-blind/`,
       written after the first set by an author who had not seen it, the
-      default build stops 41 and ASan (`-O1`) 44, with no false stop on a
-      twin. WeaveC alone stops 2 (an intra-object overflow, a negative index
-      past ASan's red zone); ASan alone 5: three stack uses after return
-      (RFC 0032 leaves a dead frame's objects untracked; ASan sees them only
-      through inlining), a use after free through a borrowed reference at a
-      call boundary whose liveness is not guarded, and a never-set pointer
-      that zero-initialisation makes null (and free(NULL) harmless).
+      default build stops 40 and ASan (`-O1`) 44, with no false stop on a
+      twin. WeaveC alone stops 2 (an intra-object overflow, a negative
+      index past ASan's red zone); ASan alone 6: three stack uses after
+      return and one after scope (RFC 0032 leaves an object untracked once
+      its scope ends; ASan sees the first three only through inlining), a
+      use after free through a borrowed reference at a call boundary whose
+      liveness is not guarded, and a never-set pointer that
+      zero-initialisation makes null (and free(NULL) harmless). The use
+      after scope stops on darwin-arm64 and linux-arm64 only because the
+      dead buffer lies one past a live array there; it is marked a known
+      miss.
     - **F7 not met, carried forward.** Run time over the reference
       compiler's: quickjs 4.00, curl 3.51, brotli 3.27, libdeflate 3.16,
       libgit2 2.84, cmark 2.69, zlib-ng 2.39, lmdb 1.77, janet 1.62, xz
diff --git a/test/cases/detection-blind/34_block_scope_label.c b/test/cases/detection-blind/34_block_scope_label.c
index f8b38692..d70a0d22 100644
--- a/test/cases/detection-blind/34_block_scope_label.c
+++ b/test/cases/detection-blind/34_block_scope_label.c
@@ -34,7 +34,7 @@ static int describe(const struct item *it, char *out, size_t cap)
         snprintf(tmp, sizeof tmp, "item-%d", it->id);
         label = tmp;
     }
-    return snprintf(out, cap, "%s (%u in stock)", label, it->stock); // STOP
+    return snprintf(out, cap, "%s (%u in stock)", label, it->stock); // STOP // MISS: a stack object is untracked once its scope ends (RFC 0032 §4); it stops only where the frame puts the buffer one past a live object (darwin-arm64, linux-arm64)
 }
 
 int main(void)

From bcaf9959e37b4b2d27ef5234fdde10750c37e8a5 Mon Sep 17 00:00:00 2001
From: Owen Carey <37121709+owenthcarey@users.noreply.github.com>
Date: Mon, 5 Oct 2026 19:33:26 -0700
Subject: [PATCH 6/6] test(corpus): record the linux-x86_64 ratchet from CI's
 quick gate

---
 test/corpus/expected.json | 66 +++++++++++++++++++--------------------
 1 file changed, 33 insertions(+), 33 deletions(-)

diff --git a/test/corpus/expected.json b/test/corpus/expected.json
index 8448ab5e..67752007 100644
--- a/test/corpus/expected.json
+++ b/test/corpus/expected.json
@@ -1351,8 +1351,8 @@
     },
     "linux-x86_64": {
       "machine": "linux-x86_64 AMD EPYC 7763 64-Core Processor x4",
-      "producer": "weavec-cc version 0.13.0-dev (7fa8250197ab)",
-      "updated": "2026-10-04",
+      "producer": "weavec-cc version 0.14.0-dev (a8e5c2350f90)",
+      "updated": "2026-10-05",
       "configs": {
         "cJSON-program": {
           "units": {
@@ -1362,18 +1362,18 @@
               "sites": 1709,
               "proven": 2630,
               "checked": 119,
-              "guarded": 659,
+              "guarded": 664,
               "violation": 0,
-              "unresolved": 235,
+              "unresolved": 230,
               "trusted": 18
             },
             "unresolvedShare": {
-              "spatialNull": 0.0156,
+              "spatialNull": 0.0131,
               "temporal": 0.1219
             },
-            "cpuSeconds": 3.74,
+            "cpuSeconds": 3.8,
             "workCounters": {
-              "blockTransfers": 12886,
+              "blockTransfers": 13153,
               "functions": 151,
               "sites": 1709
             }
@@ -1385,16 +1385,16 @@
               "sites": 1709,
               "proven": 2697,
               "checked": 111,
-              "guarded": 670,
+              "guarded": 677,
               "violation": 0,
-              "unresolved": 169,
+              "unresolved": 162,
               "trusted": 18
             },
             "unresolvedShare": {
-              "spatialNull": 0.0186,
+              "spatialNull": 0.0151,
               "temporal": 0.0789
             },
-            "cpuSeconds": 6.48,
+            "cpuSeconds": 8.51,
             "workCounters": {
               "blockTransfers": 25181,
               "functions": 151,
@@ -1410,41 +1410,41 @@
               "sites": 2337,
               "proven": 2800,
               "checked": 199,
-              "guarded": 628,
+              "guarded": 629,
               "violation": 0,
-              "unresolved": 694,
+              "unresolved": 693,
               "trusted": 16
             },
             "unresolvedShare": {
-              "spatialNull": 0.0428,
+              "spatialNull": 0.0423,
               "temporal": 0.2802
             },
-            "cpuSeconds": 3.46,
+            "cpuSeconds": 3.48,
             "workCounters": {
-              "blockTransfers": 13536,
+              "blockTransfers": 16152,
               "functions": 236,
               "sites": 2337
             }
           },
           "program": {
             "errors": 0,
-            "warnings": 38,
+            "warnings": 33,
             "ledger": {
               "sites": 2337,
               "proven": 3071,
               "checked": 206,
-              "guarded": 555,
+              "guarded": 556,
               "violation": 0,
-              "unresolved": 549,
+              "unresolved": 548,
               "trusted": 12
             },
             "unresolvedShare": {
-              "spatialNull": 0.0631,
+              "spatialNull": 0.0626,
               "temporal": 0.1901
             },
-            "cpuSeconds": 11.51,
+            "cpuSeconds": 16.09,
             "workCounters": {
-              "blockTransfers": 59075,
+              "blockTransfers": 58323,
               "functions": 236,
               "sites": 2337
             }
@@ -1458,18 +1458,18 @@
               "sites": 1146,
               "proven": 1869,
               "checked": 134,
-              "guarded": 288,
+              "guarded": 290,
               "violation": 0,
-              "unresolved": 85,
+              "unresolved": 83,
               "trusted": 13
             },
             "unresolvedShare": {
-              "spatialNull": 0.0138,
+              "spatialNull": 0.0124,
               "temporal": 0.0652
             },
-            "cpuSeconds": 0.99,
+            "cpuSeconds": 0.92,
             "workCounters": {
-              "blockTransfers": 4083,
+              "blockTransfers": 4509,
               "functions": 88,
               "sites": 1146
             }
@@ -1481,18 +1481,18 @@
               "sites": 1146,
               "proven": 1888,
               "checked": 135,
-              "guarded": 284,
+              "guarded": 286,
               "violation": 0,
-              "unresolved": 74,
+              "unresolved": 72,
               "trusted": 13
             },
             "unresolvedShare": {
-              "spatialNull": 0.0174,
+              "spatialNull": 0.0159,
               "temporal": 0.0494
             },
-            "cpuSeconds": 2.45,
+            "cpuSeconds": 2.59,
             "workCounters": {
-              "blockTransfers": 12759,
+              "blockTransfers": 12719,
               "functions": 88,
               "sites": 1146
             }
@@ -1517,7 +1517,7 @@
             },
             "cpuSeconds": 0.12,
             "workCounters": {
-              "blockTransfers": 500,
+              "blockTransfers": 718,
               "functions": 12,
               "sites": 74
             }