run.js selects configurations, freezes inputs and schedules checks. runner_pool.js owns queue admission; runner_process.js owns child execution, deadlines, output logs and process-tree cleanup. binary_checks.js inspects PE files and protected payloads. flow_transport.js contains the CFLOW semantic and bypass-control matrix. These modules keep the same check names, seeds, configurations and failure rules.

source_macros.js extracts complete macro definitions by exact name. Callers explicitly choose the first definition, the last definition or a starting offset so editor fallbacks cannot silently replace the protected implementation.

Compatible correctness fixtures share expensive header compilation. crt_bundle.js combines copy, wide-character, custom-polymorphism and extra CRT checks; vm_semantics.js combines numeric, branch and public VM contracts. Every original case runs in a fresh process with its original assertions and completion marker. Native reference functions remain before the protected header, original source lines are retained, and unexpected macro changes fail generation. The shared translation unit redistributes __COUNTER__ values; explicit variant matrices and every seed/configuration remain enabled. Bundle failures identify the original case and do not suppress the other cases.

A second CRT bundle groups sorting, critical adapters and custom33 in their original native-keyword mode. Focused --only-custom33, poisoned inline fixtures and editor builds stay independent. cflow_primitives.js shares terminal, equivalent-form, compositional primitive and commit oracles; selectors remain separate because their relocation tables approach TCC's limit. Weave mutants still compile independently. dll_hosts.js shares the two compatible protected loader clients, forwarding each client's original arguments in a fresh process. Their DLL builds, export checks, load/unload operations and fixed-seed replay remain separate; EXE/DLL bytes are not assumed interchangeable. Shared host compilation failures are retained for both callers without retries.

asm_matrix.js shares one build for all 704 frame carriers, 155 old/new shift pairs over 1,000 inputs, and 1,240 old/new jump pairs over 36 input pairs per architecture. The three sections execute in separate processes, so a native crash cannot suppress the other sections. Register, flag, stack and caller-canary checks remain. Poisoned-keyword tests, cold initialization, fault/mutation controls, debugger probes, DLL lifetime, callbacks and atexit/input contracts stay isolated where their behavior requires it. No compiler cache replaces fresh mutation or reproducibility builds. Standalone fixture generators remain available for debugging.

node tests/run.js --only-case checks automatic case protection on x86/x64. Mutual macro rescan selects the compact case transfer while keeping ordinary else transport unchanged. Unique ordinary labels retain skipped bytes even after break or return; the wrapper remains one matched statement, preserving labels nested under if. The 10..25-byte transfer varies payload, length, optional inverse LEAs, register and placement. Direct switch dispatch skips it; fallthrough executes one short jump and at most two LEAs, preserving registers, flags and stack. TinyCC's surrounding branch glue is also counted: the isolated matrix permits at most 35 added bytes per label and 2,400 preprocessed characters per site, with one captured fast draw. Harnesses that manually remove automatic keyword interception also undefine case alongside else; their mutual rescan is intentionally coupled. Applications should use OBFH_DISABLE_CONTROL_FLOW to disable automatic control-flow protection. Tests compare native/protected results for fallthrough, adjacent labels, GNU ranges, Duff's device, nested switches, dangling else, break/continue, wide constants and disabled modes; machine-code checks require seed/site diversity and exact fixed-seed replay.

Run node tests/protection_cost.js --tcc-dir=C:\path\to\tcc for opt-in warm-path measurements on x86/x64, three build seeds and normal/advanced protection. Use --header=path/to/obfus.h to measure a baseline and --seeds=1,2 for a shorter run. Each operation is timed in native batches using QueryPerformanceCounter; the report records the median of five batches, compiler time, EXE size, CPU model and a fixed header hash. Generated binaries and reports stay in a temporary directory. Run without concurrent tests/debuggers and compare several seeds; these are local microbenchmarks, not portable timing guarantees or assertions in the correctness suite. The callback baseline is reported separately, and automatic keyword protection is disabled only in the measurement harness after normal header function bodies are compiled. First-use resolution and application startup are not timed.

The base debugger probe caches an encoded API address, not its result: every call observes current debugger status. Failed resolution retains the PEB fallback and retries on the next call. Cold publication uses interlocked operations; warm readiness reads use the same aligned acquire-load primitive as the letter loader. Tests cover simultaneous first use, debugger status changes after publication, failed lookups and real debugger detection. OBFH_BETTER_ANTIDEBUG retains its hardware-register worker and suspend/context/resume behavior.

The VM field decoders use all 24 compile-time block orders and separate optional PHANTOM_NOP sites. There is no runtime order selector; the final block falls through to the shared continuation. vm_fields.js extracts the production macros and checks every order on x86/x64 against an independent bit-position oracle, including emitted label order. The focused --only-vm suite also runs the full interpreter, numeric/branch checks and fault/mutation controls under both CFLOW modes. At most one additional one-byte NOP executes per decoded instruction; this is byte variation, not a new VM algorithm.

Opcode encoding, instruction-word masking and context placement each have four independently selected build variants. Opcode permutations change the order of multiplication and addition/XOR; word masking changes both the mask dependency and its combination with the instruction. Selection happens at preprocessing time, without additional runtime branches. vm_variants.js checks all 64 combinations with independent encoding oracles, all odd byte multipliers, every opcode residue, six byte offsets and context offsets/storage size. The full kernel additionally checks all 31 rotations, modular overflow, all eight instruction programs and fault handling across six seeds. These representations diversify analysis; they are not cryptographic encryption or a guarantee against automated recovery.

The fast-token byte matrix extracts its macro definitions and their dependencies directly from the input header, so each seed does not rebuild unrelated VM/CRT bodies. Two fresh full-header builds separately verify include integration and fixed-seed replay. The isolated matrix still checks all original seeds, site diversity, size budgets, mix/rotation/scan choices, live register/flag preservation and semantic mutants; full-header token, do-entry and scan tests remain enabled. No compiler cache masks mutated headers or repeat-build checks. integration.c repeats all contracts 150 times in the main thread and each of four workers, retaining formatting width classes and the previous final value 299. Junk stress repeats 500 times but still executes every site per pass. Exhaustive character cases, numeric samples, guard pages, configuration/seed matrices and negative controls are unchanged. results.json records total suite duration and compiler invocation count; per-child telemetry also records its start time.

The pool starts long multi-build groups early after source/runner checks, overlapping their serial build chains with independent tests. Priority applies to the whole group: mutable-header and build-result dependencies retain their original FIFO order, and equal-priority groups remain FIFO. Worker and memory limits are unchanged. runner_pool.test.js checks priority, equal-priority ordering, group dependencies and failure cleanup.

Custom kernels capture one compile-time draw and use OBFH_CUSTOM_EXIT for branch polarity, OBFH_CUSTOM_PAIR for independent local updates, and optional zero/one-byte NOPs separated by argument capture and cold local setup, plus terminal boundaries. OBFH_CUSTOM_NOP uses the same byte emission as PHANTOM_NOP with distinct bit positions from the captured draw; repeating identical adjacent NOPs would only vary total padding length. The first mixing stage is captured separately so the second stage does not expand it repeatedly. The shared wide-digit helper has no extra NOP because it is called from a character loop. Hot copy/search loops receive no inserted NOPs or runtime selector. Fixed rep movs/stos instructions remain fixed; their surrounding code varies. The memmove backward paths select AL/DL or RAX/RDX and an XMM0..7 register, preserving the selected XMM value and memory access order; independent pointer updates may be reversed. All selection is folded by TCC. Raw byte diversity does not prove resistance to normalized signatures or improved antivirus detection rates.

custom_polymorphism.c checks single evaluation and pointer-result types in the compile-time selectors, independent updates, conditional exits, overlapping moves of lengths 1..255, buffer boundaries, and preservation of all eight XMM registers, including Windows x64 nonvolatile XMM6/7. It runs in the focused --only-custom matrix and full suite; native/editor modes retain their own ABI contracts and skip the stronger custom-only XMM guarantee. Existing custom fixtures continue to check CRT semantics, locale, guard pages, integer limits, callbacks and keyword traps.

node tests/run.js --only-flow-tokens also checks lightweight continue and default interception on x86/x64, both CFLOW modes and several build seeds. fast_tokens.c compares protected code with the same fixture compiled using native keywords: loop increment targets, nested loops/switches, dangling else, do-while continues, direct default dispatch, fallthrough, adjacent labels and ordinary goto entry must agree. Private mutants replace continue with break or default with an unrelated case; both must fail. fast_tokens.js extracts the complete insertion, validates its single short jump over 8..15 skipped bytes and optional inverse LEA pair, full register width, opposite displacements, placement diversity, 10..25-byte size budget and fixed-seed replay. fast_state.c.in executes the extracted bytes in native wrappers and verifies EAX/ECX/EDX or complete RAX/RCX/RDX values and EFLAGS, including x64 high bits and wraparound values. A changed LEA displacement must fail the state oracle. The pair uses no memory operands, stack pointer edits or flag-changing instructions. These removable identities and skipped data establish correctness and byte variation, not a live condition-state dependency or guaranteed decompiler resistance. The full suite includes these checks.

The same fixtures cover lightweight do entry protection: mandatory first iteration, nested do/while and switch targets, break without a condition evaluation, continue with a condition evaluation, empty and unbraced bodies, dangling else and statement macros. do_entry.c instruments the entry guard to count actual iterations; removing do interception must fail. Exported probes verify the five/six-instruction live sequence (ESP read, ADD/XOR, optional ROL, AND, OR, BSF/BSR), a bounded code-size increase, parameter diversity and fixed-seed replay. Unlike skipped inserts, this guard requires local result storage and a comparison/branch. do_scan.c feeds 160 sites with 1,024 uint32 inputs each, including zero, all ones, individual bits and complements, and compares the actual ASM result with an independent C model. Five seeds run on each architecture; the sample must cover both mix operations, scan directions and rotation presence, plus at least 24 bit indices and rotation counts. Reversing scan direction must fail the oracle. The forced anchor makes the source nonzero and defines the scan for every input. Actual Hex-Rays experiments retain the scan and body condition on x86/x64; this observed result is not a universal decompiler-resistance promise.

When an experimental header enables the coupled primitives, the CFLOW coordinate matrix also covers eleven coupled three-instruction compositions made from XOR, ADD and SUB, a direct XCHG for the remaining swap composition, both physical register roles and all captured selector bits. An independent unsigned C oracle checks both complete output values; discarding either coordinate must fail. Each composition preserves equality and has an inverse, without an auxiliary runtime reference. These properties establish correctness, not resistance to full semantic replacement.

node tests/run.js

Requires Node.js 18+ and the Windows TCC distribution containing both tcc.exe and i386-win32-tcc.exe. The runner finds Desktop/tcc/tcc automatically, including a redirected OneDrive desktop. Override with TCC_DIR or node tests/run.js --tcc-dir=C:\path\to\tcc. No Python or npm packages are required.

node tests/run.js --only-custom checks inline string/memory operations and CRT adapters, including integer parsing against the native CRT, allocation failure, argument side effects, guarded bounded lengths, reverse/duplicate operations, locale variation and mixed native/protected tokenization across threads. custom_extra.c supplies the new conversion and string-extension cases. The tokenizer retains CRT-managed state for interoperability. Protected bounded-length adapters are available even where the bundled TCC import library lacks the safe-length exports; OBFH_DISABLE_ANY_OBFUSCATION adds no such exports.

For an experimental header, pass --header=path/to/obfus.h; it is frozen and checked for changes exactly like the default header.

The runner freezes the header and test C sources into its artifact directory before compiling. Ordinary builds use that snapshot; instrumented and mutant builds retain their own private headers. header-sha256.txt identifies the tested header. A final check still reports if the workspace header changed during the run. This keeps automatic formatting from changing a compiler input midway through a build.

Independent CRT/VM/GUI/letter-loader fixtures, return/else matrices, CFLOW seeds and VM/CFLOW mutation controls are scheduled separately. Each mutation owns a private header; tests that intentionally share mutable headers or previous build results remain FIFO within their group. Long serial groups and expensive VM checks start first to reduce the final idle tail. Compiler and execution queues share a total child-process limit; compilation additionally respects available RAM, so waiting builds do not reserve shared process slots. --serial limits both checks and child processes to one. Use --workers=8 to bound parallel child processes explicitly; the RAM limit still applies. Per-process timeouts start when the child is admitted; queue waiting counts toward the overall suite deadline. results.json records compilation counts and peak concurrency for both process pools. No binary cache, automatic retry or reduced seed/configuration matrix is used: reproducibility checks still perform fresh builds. Each child command has a unique sequence ID in its log filename, so reused Windows PIDs cannot overwrite earlier records.

PHANTOM_NOP adds compile-time byte variation: each location emits either no bytes or one 0x90, selected by source position and build seed without consuming __COUNTER__. It becomes a no-op with OBFH_DISABLE_ANY_OBFUSCATION=1. Ordinary helpers and native decoy templates contain a placement outside their prologues; this changes bytes, rather than adding a new barrier to decompilation. The stack-proxy and .pdata checks verify native execution and unwind compatibility after these insertions.

Stack-proxy templates also vary frame setup order, MOV/LEA stack operations, return forms, argument loads and local-store order using their existing captured parameters. These choices assemble only in skipped bodies; guard formulas and variant counts remain unchanged. stack_proxy_native.c directly executes both frameless and framed bodies to check scratch-stack restoration. Ordinary compiler-like prologues remain recognizable, and the live skip guard remains an analysis anchor.

The first ten link layouts use finite graphs with reordered functions, shared helpers and tail continuations. Individual calls optionally get short conditional gates; six channels select presence, condition polarity and tested registers from existing captured parameters. x86 calls use explicit imm32 pushes to keep gate spans exact. Native tests also execute chained, shared, tail and gate-only helpers, including zero/nonzero inputs. These dead-body changes do not conceal the live guard or establish resistance to removal of a whole insertion.

antidebug.c checks statement syntax, normal execution, PEB fallback and remote nonreturning responses in both architectures. Response tests require a timeout after the entry marker and terminate the process tree; returning or crashing fails. Injected positive evidence must reach that response through ANTI_DEBUG. antidebug_host.c also launches the protected child under a real Windows debugger and requires detection followed by a live response without invalid-instruction exceptions. failures.c.in exercises the production probes with failed WinAPI calls, late worker completion, active/reserved debug-register bits and missing module/exports. Focused run: node tests/run.js --only-antidebug.

OBFH_BETTER_ANTIDEBUG submits fresh hardware-register probes to the Windows thread pool instead of creating a thread per call. Only encoded API addresses are cached. Each request duplicates the calling thread's handle, reads its current debug registers and preserves enabled breakpoints. Caller/callback references protect the request and handles through timeout; a temporary module reference is released by Windows after the callback returns, allowing protected DLLs to unload safely. Missing APIs, failed setup/submission or an unfinished pool request use the original one-shot probe. Completed evidence remains usable even if event signaling fails. antidebug_pool.c.in checks allocation/event/handle/module/queue failures, early and late callbacks, fresh positive/negative evidence and resource balance. Native tests race four callers, enable then disable a real hardware breakpoint, and exercise repeated DLL unloading plus a delayed callback after timeout on x86/x64.

One command builds and runs x86 and x64 binaries across five configurations: no obfuscation, default protection, control flow and anti-debug disabled, advanced protection, and anti-debug disabled. Explicit VM operators are available in every configuration; disabling all obfuscation selects their native fallback. Compilation failures, missing results, crashes and timeouts fail the verdict. Exit code is 0 only when every required check passes. Artifacts, per-process output/timing logs and a machine-readable results.json remain in the printed temporary directory for inspection. Builds have a 45-second deadline, executions 30 seconds, and the suite 60 minutes. Timeout is a failure and terminates the entire child process tree; a deliberately hanging parent/child pair verifies this cleanup. Long-running tests print elapsed time and the latest reported phase. Override with --build-timeout-ms=45000, --test-timeout-ms=30000 or --suite-timeout-ms=3600000.

Coverage replaces the former manual examples:

The VM tests instrument actual calls to Obfh_VirtualMachine, so replacing protected arithmetic with normal C cannot pass just because results agree. The runner also builds a deliberately mutated header with VM_ADD bypassed and requires the test to fail. Branch tests additionally trace interpreter entries and actual instructions, and reject ordinary-C replacements of each of VM_IF, VM_ELSE_IF and VM_ELSE. They cover side effects, fractional/pointer/NaN conditions, short circuiting, unbraced nesting, recursion and concurrent calls. These temporary mutants never modify the real header.

cflow_proxy.c forces every existing proxy guard/layout variant through the linked CFLOW emitter, checks both truth values, unsigned edge/random inputs, live values, unchanged stack pointers and parallel calls. The focused CFLOW run checks both modes and five seeds per architecture. A native-guard removal mutant must fail; this complements stage and keyword bypass controls. Proxy bodies remain skipped. Their live guard output transforms local condition state and influences route selection. Split crossed paths have separate final recoveries; no additional proxy pool or stack-edit form is introduced.

integration.c exercises valid inputs, guard bytes/pages and concurrent protected calls. Deliberate undefined-behavior crash modes have been removed: an expected access violation does not establish a library contract. Fault rejection and negative-control tests remain in the VM, CFLOW and cache suites.

failures.c.in mocks all thread-setup/wait/exit-code branches using the current header's setup block. math.c bridges nan and remquo to UCRT because old msvcrt does not export them; UCRT is required. Old decompiler snapshots are removed: structural binary checks do not claim immunity to every decompiler.

protection.c checks fractional/pointer conditions, loader calls, long console output and embedded NUL characters through a private console buffer.

cflow.c checks automatic conditions and loops in both modes, scalar truth, side effects, recursion and dangling else around for/switch. The for-body probe requires one gate per iteration. Direct transport checks exercise both truth values at 64 constant sites and require single evaluation. An independent unsigned-arithmetic model checks the actual state and reference transformations at every executed stage: two stages in v1, four in v2. Tracing requires both paths of every graph family and both results of all eight finish forms. The runner checks seeds 0, 1, 2, 0xDEADBEEF and 0xFFFFFFFF on x86/x64. Mutants that bypass if/while/for, discard the condition's truth or skip a transformation must fail. Run these focused checks with node tests/run.js --only-flow-tokens; --only-cflow also runs the existing template and randomization checks.

numeric.c compares math and VM results with native operations, including signed zero, subnormals, tiny fractions, extreme finite values, infinities, quiet NaNs and 1,500 random bit patterns. It checks exact identity transport and single evaluation. Focused run: node tests/run.js --only-numeric.

charset.c exercises ANSI/Unicode calls and Unicode filenames. The multi-file tests build EXEs and DLLs across all configurations, call their exports and require a single cow export with no exported internal helpers. Focused run: node tests/run.js --only-platform.

cache.c exercises cold concurrent CRT resolution with eight workers, warm reuse, copied cache names, missing exports and distinct call-site caches. A published entry is immutable: another name at the same site resolves cold without replacing it, and returning to the original name reuses its address. A cache-bypass mutant must fail the reuse check. There is no shared CRT target array. The resolver retains one CRT module reference per translation unit to keep cached addresses valid. Focused run: node tests/run.js --only-cache.

Passing the suite establishes the tested contracts on these compiler builds and this Windows environment, not universal safety of arbitrary programs or third-party protectors.

junk.c executes all 13 BREAK_STACK variants with live integer, pointer, floating-point and memory values in five stress runs, including four concurrent workers. Five build seeds exercise VM dispatch in both control-flow modes. Ordinary templates also contain four separately mixed byte values, a 32-bit junk immediate and a variable-length fill, all inside skipped regions. The binary check verifies the original jump lands at arithmetic transport and that the bytes do not share one fixed affine pattern across the tested seeds. PE export boundaries isolate each site's machine code: all sites must change with a different seed and repeat with the same seed. All 128 CFLOW families use nonserializing arithmetic; the former seven CPU-query forms retain distinct register mixes, rotations and randomized skipped payloads. Primary selection covers every family uniformly; the advanced secondary selection covers all families and differs from its primary. Focused run: node tests/run.js --only-junk.

BREAK_STACK_CFLOW is the single public macro, used without arguments at every library insertion and inside automatic if interception. Its shared pool contains 128 templates: the previous 86 CFLOW combinations, all 13 former numbered variants and 29 paired predicates with additional branch layouts. Each expansion captures a fresh counter and mixes it with OBFH_SEED before compile-time selection. All 128 families use nonserializing arithmetic.

HIDE_STRING emits exactly one CFLOW template before its original expression, including with OBFH_BETTER_CONTROL_FLOW or OBFH_DISABLE_CONTROL_FLOW. Its compound literal remains in the caller scope. Wrapper checks retain several hidden-string pointers across other calls, exercise empty strings and verify independent writable buffers.

choose_random.c checks direct and captured RND expressions against the branches selected by __builtin_choose_expr, on both architectures and two seeds. It also checks that every advanced-mode secondary index differs from its primary and covers all 128 arithmetic families.

constant_data.c checks the original volatile character/string/numeric types and values, including string terminators. Random retained data separates those objects in the binary. The data generator mixes the seed, source line and byte number without consuming __COUNTER__; the test guards that independence. Five seeds on x86/x64 must remove the old alphabet and numeric byte signatures; dumped padding must change by seed and reproduce exactly with a fixed seed. Ordinary probe binaries also reject those signatures without referencing the padding objects. Focused run: node tests/run.js --only-data.

stack_proxy.js generates a fixture that executes the live skip path of all 128 fake-function variants with arbitrary uint32 guard inputs, boundary values, live pointers/floating-point/integer data and stack-pointer checks, plus four concurrent workers. Two hundred fifty-six public-macro sites are compared with an independent selector reference on five seeds and both architectures. Their machine code must vary by seed and repeat exactly with a fixed seed. Binary checks reject the former fixed local-slot pair and, on x64, the argument spill/immediate-reload sequence and two former fixed leaf bodies. The fake bodies are deliberately unreachable and are not executed by this test. stack_proxy_native.c separately calls all twelve leaf-body families in isolation, checking valid randomized instruction encodings and scratch-stack restoration on boundary and random arguments. The flow tests also trace insertion in automatic if. Focused run: node tests/run.js --only-stack-proxy.

Use --arch=x86 or --arch=x64 to select an architecture. For a separate integration pass, use --only-integration --config=vm (or another configuration from run.js); per-build and per-process timeouts still apply.

cflow.c also compares native and protected branches containing unbraced else break; and else if (...) break; else .... Loop, do-while and switch exits must retain their original targets in both CFLOW modes on x86 and x64.

pdata_decoys.js tests the actual header-only TCC x64 pool at default seeds, both count limits and a repeated seed. It verifies native calls and stack integrity, every static PE entry, table ordering, 16 body families, seven unwind states per function (entry, partial prologue, body and epilogue), and preserved nonvolatile integer registers. A maximum-pool run injects a breakpoint into every native entry in a separate process and requires the Windows top-level filter to run. DLL image bases and multiple translation units are checked. x86, OBFH_DISABLE_ANY_OBFUSCATION and OBFH_DISABLE_PDATA_DECOYS omit the pool. Focused run: node tests/run.js --only-pdata. Library code uses .text for this feature to avoid TCC's incorrect custom-section unwind RVAs; binary checks search executable sections for junk and SSE operations, while still checking that the protected data section exists.

VM transport checks in vm.c verify that different nonces change encoded operand bytes without changing decoded values or the integer/floating flag. The instruction tests decode all 256 opcode residues under every odd opcode multiplier, exercise each program and compare its exact executed PC sequence with an independent route reference. Existing numeric probes continue to cover signed zero, subnormals, infinities and NaN payloads.

All 39 local string/memory custom operations now expand as typed statement-expression macros. Arguments are captured once in a typed local aggregate (including compound-literal arguments), labels are local to each expansion, and single-target native exits keep internal scans independent of protected if/while/break/else, including nested calls. Existing entry protection remains per expansion. Compact kernels reuse captured pointers directly; strcmp caches proxied bytes and forms its sign result without two exit arms, while strlen reuses one proxied step for its pointer and count. No shared kernel functions or CRT calls are introduced. Statement expressions add an inner block: pointer results intended to outlive the expression should refer to caller-owned storage rather than expression-local compound literals. GetProcAddress is also a macro front end to the existing export parser. printf remains a macro front end to a variadic ABI adapter: TCC cannot create a va_list for an arbitrary argument list inside a nonvariadic caller.

strchr, strrchr, strcpy, strcat, strncpy, strncat, memcpy, memset, memmove, wcslen, wcscmp, wcsncmp, wcschr and wcsrchr also use inline custom kernels. Copy/fill and forward moves use byte-oriented REP instructions with no alignment requirement; overlapping memmove ranges use a backward word loop below 64 bytes and an unaligned 16-byte SSE2 loop for larger copies, preserving XMM0 and the direction flag. Protected x86 builds therefore require SSE2. Bounded string copies retain CRT padding/termination rules; wide kernels operate on wchar_t code units. custom_copy.c checks differential randomized cases against CRT, both overlap directions, destination canaries, argument side effects and inaccessible guard-page boundaries.

wcscpy, wcscat, wcsncpy, wcsncat, wmemcpy, wmemmove, wmemset, wmemcmp, wmemchr, wcsstr, wcsspn, wcscspn, wcspbrk, strnlen, wcsnlen and bsearch are also inline custom kernels. Wide copies/moves reuse the inline byte engines with counts converted from wchar_t elements; wmemset uses REP STOSW for Windows 16-bit wchar_t. Wide comparison uses element values rather than byte order. bsearch captures its callback once, uses an overflow-safe midpoint and accepts any matching element when duplicates exist. Empty searches never invoke the callback.

custom_wide.c checks 512 randomized CRT comparisons, padding, truncation, bounded unterminated strings, both overlap directions, high wchar_t values, side effects, exact guard-page ends and every short vector tail. Binary search checks all counts 0–64, present/absent keys, duplicates, extreme signed comparator results, logarithmic comparison counts and reentrant callbacks. Keyword traps and return-type/nesting checks cover all 39 inline kernels in custom_inline.c.

custom_inline.c replaces protected keywords with compilation traps and checks every inline kernel, return types, exact strcmp results and nested calls on both architectures. crt_proxies.c compares 2,048 cases with the original CRT, checking result types/values, high bytes, integer-to-byte conversion, zero lengths, empty sets, side effects, nesting and protected page boundaries. Compact set scans have O(string length × set length) worst-case behavior; strstr uses a first-byte-filtered scan with quadratic worst-case behavior.

Character input/output, stream flags/reset, file rename/remove/reopen and perror use CRT proxies; bsearch uses an inline binary search. The perror wrapper preserves caller errno across cold resolution; output is compared with the original CRT. Stream checks cover EOF, write errors, clearing flags and rewind; qsort/bsearch tests exercise callbacks and missing keys.

qsort expands an allocation-free, in-place heapsort with O(n log n) comparisons and O(1) auxiliary storage. It captures all arguments once, keeps callbacks on array elements and uses byte swaps for arbitrary element widths and alignment. Equal elements need not preserve their order, as with CRT qsort. custom_sort.c compares 8,127 deterministic cases with native CRT (counts 0–128, widths 1–63), checks untouched boundary bytes, comparison limits, extreme comparator results, reentrant sorting, argument side effects, void type and a guard-page boundary. custom_inline.c checks expansion under keyword traps. These run in the full suite and --only-custom; the latter also runs all inline keyword checks. The obsolete late #undef bsearch is removed so the public alias actually reaches its existing kernel.

strtoll, strtoull and atoll expand the integer parser with 64-bit unsigned accumulation and signed/unsigned limits on both architectures. Public strtoll, strtoull, _strtoi64, _strtoui64, atoll and _atoi64 aliases use these kernels. Saturation and end-pointer behavior follow the bundled Windows CRT; successful and no-digit 64-bit conversions preserve caller errno. The existing 32-bit parser keeps its separate errno policy and wraparound atoi/atol behavior. Neither path delegates parsing to CRT; native locale whitespace classification remains shared.

stricmp and strnicmp supply local comparison loops for the public names and their underscore aliases. They capture arguments once, compare unsigned bytes, stop at NUL or the bounded length, and transport the result through the existing integer proxy. Case mapping uses native tolower to preserve LC_CTYPE; this is a custom comparison kernel, not an independent locale implementation. No strcmp/stricmp CRT call is used. custom_critical.c compares 64-bit values, end pointers and errno across bases 0 and 2–36, extrema and deterministic long inputs; checks every pair of nonzero byte values and random strings in available locales; and covers side effects, zero lengths and guard-page edges. Keyword traps and result types are checked in custom_inline.c. The focused and full suites include the new fixture.

Numeric parsing, free, srand, and basic stream output/input/positioning use typed calls through the same CRT resolver. Each name-builder function is followed by its public macro. All CRT name builders and local export names, including formatting/allocation and math paths, share OBFH_NAME_ORDER. Builders select forward or reverse name-store order from a captured compile-time draw; no runtime order branch or additional per-call junk layer is added. crt_proxies.c checks these calls, pointer/void/floating results, parsing end pointers, bounded copies, unsigned comparisons, side effects and stream EOF. Direct checks cover the active CRT and bootstrap name builders, terminators/canaries and the bounded CRT module name.

puts resolves the real CRT function through the existing cache, without an extra helper or formatting buffer. crt_proxies.c checks single evaluation and literal percent signs, empty strings and newline handling, alongside protected allocation/reallocation, memory fill, working directory, environment lookup, character conversion, variadic formatting, the CRT command-processor availability query, exit callbacks and bounded test input through gets. Return-value transport chooses reversible integer operations and fresh pointer-width masks per expansion; numeric tests also cover values passing through this transport. TCC's existing vsnprintf adapter is retained to preserve its formatting behavior.

vm_kernel.c and vm_kernel.js exercise every instruction program and operation kind on both CFLOW modes and eleven seeds per architecture. They check exact live routes, one arithmetic instruction per operation, flags-only BOOLEAN, uint32 control encoding, NaN/infinity/signed-zero behavior, and malformed-program cases in child processes. Instructions have seeded physical field layouts. Compound LOAD_PAIR and COPY_RETURN instructions reduce dispatch steps; explicit probes exercise each layout, and faults reject overlapping pair destinations and uninitialized copy-return sources. Mutants skip either kind of load, corrupt flags or field decoding, bypass virtual jumps or use a wrong result register and must fail. Public VM type contracts and argument evaluation are checked with default protection and with all obfuscation disabled. A standard-math fixture also links against an instrumented header with an unresolved VM-only call, verifying that unused VM code is not emitted. Focused run: node tests/run.js --only-vm. The private instruction ABI is not a supported user interface.

gui_calls.c checks all 65 covered USER32/GDI32 export addresses (including forwarded DefWindowProc exports), eight-thread first-use races, LastError preservation during resolution, A/W and UNICODE aliases, one evaluation of arguments, HWND/LRESULT/handle ABI and callback reentry. Per-thread native GUI initialization precedes LastError comparisons because the OS may initialize thread GUI state on its first API call. Hidden owned windows exercise text, positioning, messages, fonts and menus. gui_inline.c rejects protected keyword expansion inside warm-call macros and checks result types and nested calls. Covered function-like calls use lazy encoded targets and six local decode forms; taking an API address remains a normal import. Each call site owns an aligned local cache with seeded layout and target encoding; logical API identifiers do not index a shared target array. Resolution runs once per call site. The module cache retains one reference per translation unit. api_site_cache.c checks distinct caches for repeated API names, stable warm reuse and concurrent first use at one shared site. It also executes all six three-instruction decode orders on boundary pointer values and checks all cold encoder forms against an independent inverse. These tests run with the integration configurations.

Address references read trusted OS export tables directly: AppHelp may redirect native GetProcAddress for several GUI APIs on x86. Behavioral comparisons use real hidden windows. Loader-bound external RVAs are accepted only from loader-owned modules with executable MEM_IMAGE targets.

kernel_calls.c checks the 22 cached KERNEL32 APIs: raw export targets, LastError cold/warm/nested calls, A/W and generic aliases, module reference balancing, VirtualQuery, startup/command-line ABI, invalid console handles, zeroed movable memory with lock/unlock/free, MulDiv rounding/overflow/zero division and one evaluation of arguments. A separate child checks ExitProcess's actual status. The late macro definitions leave loader/export-parser/error bootstrap calls native; the cache has no recursive dependency on itself.

api_calls.c checks 49 additional raw export targets and real file write/seek/read/size, VirtualAlloc/VirtualProtect/VirtualFree, heap reallocation, A/W paths and environment, events/thread completion, A/W DLL loading, a uniquely named volatile HKCU key that the test deletes, off-screen bitmap/text/BitBlt rendering and BeginPaint/EndPaint on a hidden owned window. It uses the shared typed API front end; internal bootstrap calls remain before public interception. TCC's trimmed headers lack the NLS header, so the fixture declares the native MultiByteToWideChar ABI explicitly for test path conversion.

The protected public names of 57 existing kernels now expand their implementations directly. Undocumented _custom aliases have been removed from both the runtime and editor interfaces. Shared typed kernels and the internal variadic obfh_printf_variadic adapter remain where required.

custom33.c covers 33 additional interfaces: four wide integer parsers; _wcsicmp, _wcsnicmp, _memicmp; four narrow/wide case conversions; four string filling functions; labs, llabs, _abs64, div, ldiv, lldiv; ten 32/64-bit narrow/wide integer formatters; and the Microsoft three-argument strtok_s/wcstok_s. It compares results with native Windows CRT, including return types, buffer canaries, argument evaluation, errno/end pointers, every BMP input code unit for wide decimal digits, all valid numeric bases, boundary integers, changing delimiter sets, mixed native/protected tokenizer contexts, and guard-page ends. Undefined native inputs such as division by zero, overflowing signed division, and undersized formatting buffers are outside the contract.

Wide parsing follows the legacy Windows CRT's decimal digit repertoire, not every Unicode decimal block. Integer formatting supports bases 2–36 and keeps the original 32/64-bit width for nondecimal negative values. Tokenizers use explicit caller state, not the four-argument C11 Annex K interface. The bundled import library lacks these tokenizers and lldiv; the native test controls resolve the actual exports explicitly. OBFH_DISABLE_ANY_OBFUSCATION does not add these missing imports.

Locale mapping remains native. Narrow case conversion uses a byte loop in single-byte locales; multibyte locales use temporary buffers and Windows NLS conversion to preserve complete encoded characters. Wide case conversion also uses NLS outside the C locale. These locale-dependent paths allocate and can fail; they are not allocation-free kernels. Tests exercise C, Western European, Japanese and Chinese locales when available. Comparison and filling remain local scans; parsing and formatting do not delegate their whole operation to CRT.

custom33_inline.c checks all 33 APIs under keyword compilation traps, including return types, nesting and public aliases. Run node tests/run.js --only-custom33 for the isolated x86/x64 matrix with plain, default, virtualized and advanced builds, multiple seeds and editor checks. Both fixtures also run in the full suite.

Nested compile-time mixes use enum fields for return transport, stack-proxy selection, false-else tags, fast transfers, do guards and GUI call-site constants. GUI decode layouts share captured key words, bias and rotation; the runtime cold encoder applies the matching inverse order for each site. Unsigned casts preserve zero extension of high-bit key words on x64. random_constants.c checks these fields against an independent uint32 mixing model, the original GUI key formula, boundary inputs and unchanged counter consumption. These captures add no runtime cache or shared mutable state.

editor_view.c checks the lightweight IntelliSense interface and verifies that defining __INTELLISENSE__ on an actual TCC build cannot select it. random_constants.c checks the counter/line/seed formula at different source positions and ranges, single counter capture, and complete byte-range coverage at a fixed source position, for all five seeds. The full runner includes both checks on x86/x64.

ASM fragments are maintained directly in the header, without a generated expansion cache or regeneration step. Their execution, distribution, native-body and reproducibility tests remain required.

Basic CFLOW forms 0..85 select their original input, polynomial predicate, test, branch layout and payload as consecutive immediate-only ASM fragments. Their selection indices, register roles, predicate masks and branch polarities remain unchanged; no runtime helper or dispatch table is added. The fragments rely on the same TCC ordering contract as stack-proxy emission: do not insert runtime C evaluation between a predicate, its flag test and its branches.

cflow_basic.js compares all 86 factored forms with an independent contiguous reference emitter on x86/x64. Four parameter sets cover salt 1/127/128/32767, short and word-sized padding, zero/high byte values and basic-key boundaries; both length and every byte must match. Mutations of a predicate mask, branch polarity or second-predicate mapping must fail this oracle. Whole-header tests continue to execute all 128 CFLOW forms and the live condition/state dependency checks.

Named CFLOW forms 99..127 share their input prefix, predicate selection and payload tails in source, retaining both original predicate stages and all four branch layouts. Forward Jcc and SETcc use the original native condition codes; backward branches retain the assembler's short/near selection. Labels 51..54 are defined unconditionally once per emission so discarded compile-time branches cannot resolve a live forward reference prematurely. No runtime helper, dispatch table or generated cache is involved.

cflow_named.js compares all 29 forms against frozen contiguous predicates and layouts on x86/x64. Its 48 parameter sets cover all 16 input parameter combinations, rotates 1/2/31, salt boundaries, all seven padding lengths and zero/high byte and key values. The reference independently spells seeded MOV directions, ADD/SHL doubling, independent instruction order and matched SETcc/branch inversion; both length and every byte must match. Mutations of carry polarity, second-predicate mapping, payload mapping and the backward target must fail the oracle; the whole-header pool tests also execute these forms.

Proxy spelling constants are prepared once with the existing assembly parameters. Flag-dead ADD/SUB substitutions and complementary rotate directions retain the original values and do not add native instructions; the ADD feeding ADC in core N remains unchanged. brick_forms.js compares EAX/EDX results and checks that instruction spans do not grow against nine frozen pre-change cores. It covers every rotate count, both spelling choices, signed-immediate boundaries (including -128) and 256 edge/random input pairs per case on x86/x64. Whole-header tests retain the live state/cookie and proxy bypass negative controls.

Leaf ALU payloads reuse captured keys; leaf frame sizes, slots and ALU/shift encodings are defined once per insertion. These assembler constants emit no bytes and do not replace native bodies with shared runtime code. Mnemonic key operands remain literal so TCC retains its original short-immediate choices, including zero on x86. Standalone fragment fixtures initialize the aliases from their independent inputs; shift encodings and defined flags remain checked against explicit instructions.

sf_immediates.js compares the complete leaf frame, scratch access, ALU and shift bytes with frozen literal encodings. Its 575 cases per architecture cover all captured frame sizes and scratch slots (including zero), every rotate count and shift opcode, all five ALU-A and seven ALU-B choices and signed-immediate boundaries. It skips the inspected bodies; whole-header pool tests separately check their execution.

Basic CFLOW loads/tests encode the selected register directly instead of expanding separate EAX/ECX/EDX branches. They preserve TCC's accumulator imm32 spelling, ECX/EDX imm8 for salts 1..127, and the original two-/three-byte TEST forms. The contiguous cflow_basic.js reference still checks every native byte and length.

Basic predicates select seven shared instruction sequences for the same 16 families. Register fields, multiply counts, final ALU operations, x64 address-size prefixes and accumulator imm32 encodings retain their original bytes. Payload prefixes share one padding suffix; forward conditional branches emit the original near encoding directly. The byte oracle covers all 86 basic forms across 12 configurations per architecture, including every payload register field and both optional-prefix states: 2,064 byte-span comparisons in total.

Forms 86..98 reuse the payload captured by the enclosing insertion; mnemonic tail operands and volatile reads stay in place. cflow_other.js checks all 13 forms against frozen original operand lists and instruction bodies across 24 configurations on both architectures. The two x64 RIP-relative reads are checked against the exact _0 target because separate carriers have different PCs; every other byte must match. Terminal tests also compare all 24 exit/zero-form encodings with independent instruction sequences before checking their results.

Named CFLOW templates share immediate-only assembler constants set by their local capture. These .set directives emit no instructions or data. Every capture must precede its selected template; nested or subsequent insertions must establish their own constants. Standalone predicate and input-encoding probes initialize the same assembler constants from independent test inputs.

Stack-proxy recipes select guards, layout fragments and bodies independently, avoiding repeated expansion of every complete combination. Bodies remain inside their original frames and physical layout; selection adds no body trampolines. Each layout has one readable callback definition, with no generated cache. Invariant recipes are enum constants derived from their source specs, and each insertion defines its assembler constants once before selecting a guard. Each body receives only the immediate operands it references; this reduces compiler input without removing instructions or forms. Frame sizes, call arguments and padding parameters are captured as assembler constants once per pool; standalone frame fixtures initialize their corresponding aliases explicitly. stack_proxy_pool.c executes all 128 native entries, checks stack restoration and caller canaries, and compares results against a contiguous assembly emitter on both architectures and two seeds. The test also rejects assembler alias names in the resulting PE.

Slot roles are packed into three-bit fields in ordinary enum constants derived directly from those layout callbacks. A pool selects its role word once, then extracts each slot's role without repeating the layout-selection tree. These constants emit no data or lookup code; the contiguous reference layouts remain independent of the packed-role selector.

Frame opcode words, widths and allocation displacements are captured once per pool for its four frame sizes. OBFH_SF_FRAME_CONSTANTS retains the original frame algebra; emitters read the captured fields at the original instruction positions. Standalone frame and short-jump probes capture their own fields explicitly. The independent frame oracle checks all 11 sizes, 16 selector combinations and four prologue/epilogue combinations on each architecture: 1,408 byte-and-stack checks.

Link gates emit their existing TEST and conditional rel8 jump as one four-byte field. Each channel captures its TEST/Jcc bytes once; each call supplies its original displacement. sf_links.js compares independent literal bytes for all six channels, enable/register/condition choices and both call spans on x86 and x64: 192 byte-span checks, including disabled gates that must emit zero bytes.

The fragment emitter relies on consecutive TCC ASM blocks: FLOW START supplies EAX and FLOW END captures it after the guard's destination label. Intermediate blocks have immediate operands only; inserting runtime C evaluation between them would violate that contract. Layout labels are isolated from body labels and discarded compile-time alternatives. Keep the native-reference, nested-condition and flow-state mutation tests when changing this structure.

Framed bodies emit their shared argument loading and local stores once around the selected core; leaf bodies share argument loading while retaining their individual exits. The contiguous reference emitter still assembles complete bodies, so the native-entry comparison also checks these fragment boundaries.

sf_live_guards.c/js checks the actual ASM outputs of guard families 8, 10 and 13 against independent arithmetic references on both architectures. These guards retain an input-derived intermediate instead of overwriting it with the constant used to prove their branch. The matrix covers all six instruction orders of guard 8, MOV/CMP forms, boundary keys and 264 boundary/random inputs per case. Guard 13's degenerate keys are tested explicitly. Three negative controls restore each former constant result and must fail the oracle. These checks establish live value dependence, not resistance to general symbolic simplification. The ordinary FLOW proxy and mutation tests separately verify that these values still participate in state/tag/cookie updates.

Optional Windows memory profiling uses Node.js without npm packages. It automatically builds an embedded WinAPI monitor with the measured TCC in an owned temporary directory; that bootstrap build is outside the measurement. Python is not required:

node tests/compiler_memory.js --stdout expanded.i --json memory.json --limit-mib 512 -- C:\path\to\tcc.exe -w -E project.c

The limit applies only to the launched compiler through a Windows job, assigned before its suspended main thread resumes. It does not change system RAM/pagefile settings. The report separates committed memory from resident working set; expanded C bytes are a disk-size measurement, not a RAM measurement. Profile direct compilation as well as -E, run builds sequentially, and use identical source/compiler/settings for comparisons. A successful capped compiler run does not measure the total RAM of an editor or promise that every project fits that limit. Scripts can import profile from compiler_memory.js and await profile(command, stdoutPath, limitMib); when measuring another executable, pass { compiler: tccPath } as the fourth argument.

tests/tcc_nan.c is a standalone toolchain diagnostic and includes no protection. TCC 0.9.27 x64 incorrectly lowers some negated ordered comparisons with quiet NaN in ternary/comma contexts. The diagnostic exits nonzero on that compiler and zero on the tested x86 build. CFLOW now permutes encoded tags instead of injecting logical negation into the user expression. cflow.c checks eight ordered NaN comparisons with comma/side effects in both operand orders under both CFLOW modes and five seeds; numeric.c also covers the original failure. User-authored negated expressions can still expose the standalone compiler defect. The diagnostic is separate from the default suite, not a passing substitute for its numeric check.

winapi_extended.c checks the additional process, file, window, timing, text and resource APIs against raw Windows exports. It exercises A/W calls, pointer-sized window data, cold-resolution LastError preservation, file copy/move/enumeration, hidden-window timers and messages, and UTF-8 conversion. The integration runner includes it in every configuration; OBFH_DISABLE_ANY_OBFUSCATION controls use local native function pointers for APIs omitted by the bundled TCC declarations or import libraries.

VM bitwise coverage includes AND/OR/XOR/NOT and logical shifts: all instruction-program variants, full-width unsigned values, shift-count normalization, result types, single argument evaluation, nesting, and interpreter-call/opcode tracing. Existing arithmetic, floating-point and invalid-program checks remain in the same suite.

Internal DLL and probe names use the same forward/reverse store selector as CRT export names, with independently reordered adjacent byte stores. The loader name uses the local packed-word transport. Public HIDE_STRING is unchanged. OBFH_CRT_TARGET supplies the shared typed cast and OBFH_CRT_INVOKE supplies one call adapter with explicit compact/protected entry policies. Existing wrapper noise and result transport are preserved. Early console/module calls are explicitly bootstrap helpers; they cannot depend on their own lazy API cache. Obsolete name builders and the unused memset resolver are removed; custom kernels remain inline. Native math and vsnprintf adapters remain where an equivalent msvcrt export is not guaranteed.

api_names.c checks every available local API-name builder against its expected export name, its reported length, and guards after the padded word stores, on both architectures and five seeds. API names are assembled on the cold path; the shared resolver receives a bounded plaintext name rather than an encoded byte array and an index-derived XOR key. This removes the former shared decoding rule, but does not make names secret from symbolic execution or dynamic observation.

Use --only-configs to run configuration fixtures without repeating the exhaustive helper matrices. --config also accepts a comma-separated list, for example node tests/run.js --only-configs --arch=x86 --config=advanced,no-antidebug. This supports scoped follow-up runs after a suite-wide timeout; retain the original log and report the timeout separately.

The full runner schedules independent checks automatically using CPU capacity and available RAM. Checks that share a modified header or compare earlier builds run in order; VM seed checks use separate headers. Each check has its own working directory, and all sources are frozen for the run. Compilation and execution timeouts start when the child process starts, not while its check waits in the queue. No configuration is required. Use --serial for a sequential diagnostic run with the same checks.

The combined-build full run passed 699/699 reported checks with 923 fresh compilations, down from 965 in the preceding consolidation and 1,077 before consolidation. Fewer reported checks reflect grouped verdicts, not removed input cases, seeds or configurations. On the 32-logical-CPU Windows development machine this run took about 2 minutes 58 seconds, compared with 3 minutes 5 seconds previously. This is a single-run observation; timings depend on the host and load, rather than being a fixed runtime guarantee. Focused --only-custom passed 41/41 with 124 compilations, 48 fewer than its previous build layout.

cflow_chain.c and cflow_chain.js verify the x64 live proxy ladder: independent arithmetic references, all native nodes and return routes, condition-state equivalence, recursion, parallel calls, and mutations that remove a call or corrupt a transform. Existing unwind checks cover the native entries and exceptions in nested calls. Disabled modes and x86 retain their previous transport. Run this focused matrix with node tests/run.js --only-chain.

cflow_primitives.js and cflow_selectors.js check the live transport primitives and branch selectors on both architectures. cflow_single_lane.js instruments the current state pipeline for the full-value reference and bypass checks. The obsolete two-coordinate pipeline and its separate oracle have been removed; no generated CFLOW cache is required.

cflow_packing.js independently encodes 94 instruction cases and compares their bytes and lengths with the production emitter on x86/x64. Coverage includes every rotate count, complement/negation, LEA scales and all immediate forms with high-bit and all-one keys. Packed compile-time descriptors retain the original instruction in bits 0..23, its length in bits 24..25 and its immediate flag in bit 26; they are not runtime bytecode. Swapping the length bits must fail the byte oracle even if an arithmetic test would miss the changed encoding.

OBFH_FLOW_CONDITION captures the promoted scalar value once before encoding it. The original expression appears only in its unevaluated type query and this assignment; the integer/pointer and floating input paths reuse the value. cflow.c compares native and protected float/double/long-double arithmetic conditions on signed zeros, tiny and maximal finite values, infinities and NaNs. Volatile bit fields, byte values, high-only 64-bit values, pointers, short-circuit expressions and statement expressions also check exact side-effect counts.

CFLOW basic templates and MASK/TABLE selectors also capture shared immediate parameters before choosing their assembly form. These .set directives emit no instructions or runtime tables; register constraints and memory clobbers remain on the consuming assembly. Signed-32 normalization is omitted only for proven nonnegative values below bit 31 (basic keys, bytes, input tails, selector counts/bits and small numeric literals); full-width keys and high-bit instruction words retain it.

cflow_selectors.js checks address representation, ADD/SUB versus LEA decoding, bit extraction, index direction, comparison polarity and register-copy encoding at all selector positions. MASK, TABLE/CMOV and TABLE/SETcc routes use an independent rule, equal and unequal unsigned boundary values, and four address keys including zero and the largest supported key. cflow_forms.js checks packed XOR/ADD/SUB and rotate/BSWAP input families against unsigned C arithmetic for all nonzero rotate counts, instruction orders and directions, boundary/random values, and equality and inequality.

Selector coverage also checks XOR versus arithmetic candidate blending, CMOV versus a short conditional copy, and BT/SBB versus ROR/SBB mask construction. It requires all eight combinations of these choices at each position and tests cookies with unrelated bits set, rather than only a single isolated bit. The carry-mask rotations use the four internal selector positions (0 through 3).

The short-form matrix checks XOR, SUB and immediate-MOV zeroing for EAX/ECX/EDX on boundary and deterministic random inputs. This primitive requires dead incoming flags; its CFLOW use precedes a fresh comparison. Flag-preserving copies and equality-only comparison variants retain their separate contracts.

cflow_terminal.js verifies the fused terminal emitter: all eight completion families and three zeroing forms, with boundary values and deterministic equal/unequal input pairs on both architectures. The last coordinate permutation and completion share one ASM block; release builds do not spill the coordinates between them. Trace builds save the transformed coordinates explicitly for the existing independent stage oracle. A literal macro selects ordinary versus terminal stages without expanding the unused body. The separate completion helper remains for the live else guard. This reduces redundant transport and is not proof of increased reverse-engineering difficulty.

cflow_commit.js checks both schedules of the shared live-proxy commit against an independent unsigned C reference: coordinate updates, finalization of the expected value, and preservation of the upper cookie word on x64. It covers boundary tuples and 100,000 deterministic tuples per schedule. cflow_proxy.c explicitly invokes the commit after each standalone layout; normal inserts commit once outside the layout selection. Selector coverage retains all address, carry, register-order and index forms, including maximum keys. Their masks are consumed in the selector ASM and table bases reuse a register after index selection; ordinary compiler-controlled computed gotos and unwind contracts remain in place. Removing particular instruction windows is not evidence that every static signature or semantic replacement is prevented.

The custom PE resolver uses an overflow-safe binary search of the sorted export-name table. Each visited name is range checked and bounded before comparison; ordinals, forwarders and loader-bound exports retain their checks. export_lookup.c compares named exports and ordinals of several system DLLs with the native loader or the direct PE entry when Windows compatibility shims override that loader. Context-dependent API-set forwarders remain outside this native-address comparison; that is an existing resolver limitation. Malformed names at an inaccessible page boundary, missing names, first/middle/last entries and invalid ordinals are checked. Focused run: node tests/run.js --only-exports.

Internal loader, name-builder and CRT/API-adapter branches use a compact live condition transport: four reversible arithmetic forms, left/right rotations, three rotation positions and seeded keys. Public keyword protection and anti-debugging branches retain their full guards. helper_conditions.js checks all 1488 combinations of arithmetic form, rotation direction, rotation position, nonzero rotation count and condition polarity without duplicate cases, boolean boundary inputs, single evaluation and rejection after deleting the live mix. helper_loader.c checks concurrent cold resolution, reference balancing, missing-library errors and single argument evaluation with protected, virtualized and disabled builds on both architectures. Focused run: node tests/run.js --only-helpers.

The loader has a core and one forwarding proxy; its argument and result retain full-width polymorphic pointer transport. Skipped CFLOW padding is bounded to 1–7 bytes, and the dead immediate-move and fake-stack payloads use shorter encodings. All 128 CFLOW families, live transitions, stack-proxy bodies, fake-sign sections and unwind decoys are retained.

Stack-proxy frame allocation uses signed-byte operands when the captured frame size permits, retaining the same SUB/LEA choices, frame sizes, instructions, function boundaries and call graph. Larger frames retain full-width operands. stack_frames.js directly executes 704 frame/prologue/epilogue combinations per architecture, including the 112/128-byte encoding boundary, and checks the return value, stack pointer and caller canary. An independent byte encoder also verifies the exact prologue/epilogue selected by the phantom bits, so swapping equivalent instruction forms cannot silently reduce or remap variation. This matrix runs with --only-stack-proxy and the full suite.

Single-bit shifts/rotations in leaf bodies, do guards and CFLOW bit selectors use the implicit-count encoding. Other counts retain their original instruction, direction and operand. The x86 table selector uses the one-byte INC spelling; x64 retains its two-byte spelling. No random draws or operation families are removed. short_encodings.js compares the production leaf emitter with explicit-count instructions for all five operations and counts 1–31, checking results and defined flags on boundary and deterministic inputs. Selector and do-scan matrices cover the live emitters.

Four bounded forward jumps inside BODY_K and LEAF_C/J/L use rel8 instead of TCC's unrelaxed rel32 encoding. Their skipped instruction windows remain intact; LEAF_C accounts for the two/three-byte shift spelling. short_jumps.js compares these production bodies with rel32 references across all 31 counts, five shift operations, both argument/epilogue selectors and signed/unsigned boundary pairs. It checks the actual calls, return values, stack restoration and caller canary on x86/x64. This matrix is included in --only-stack-proxy.

vm_variants.js checks all three per-site math address transports and all four reversible VM state maps against independent arithmetic models. The state maps retain three xorshifts; math transport still uses one selected operation in each direction.

vm_packing.js compares every word of all eight VM programs with an independent canonical-word reference across opcode encodings, field permutations, packing layouts, word masks, operations and keys. Direct packed-field construction changes compile-time work while retaining the encoded instruction words.

Public conditions share integer input storage with the 32-bit transport words on little-endian x86/x64. Wide values still OR both halves; floating-point truth evaluation remains separate. cflow.c covers signed and unsigned widths, high-only values, narrow signed inputs, long-double truth, side effects, short-circuit evaluation and nested protected conditions.

CFLOW forms 95�98 share the skipped payload after their selected predicate fragment. The fragments stay adjacent, with the original branch targets and instruction bytes. The miscellaneous-form byte oracle (cflow_other.js) exercises this shared emitter against the frozen independent forms, including immediate-width boundaries on x86/x64. Forms with EBX clobbers remain single ASM blocks because splitting them changes TCC register saves.

The x64 stack-proxy call skeleton captures the two MOV-immediate opcodes and argument order once per pool. sf_calls.js checks all ten emitted bytes against independently constructed references for both orders and 16 argument pairs; x86 retains its original PUSH sequence. Whole-binary replay checks retain every native CFLOW and proxy form.

Named CFLOW predicates share their second EDX input between selected head and suffix fragments. The complete tail aliases remain available for direct predicate probes. cflow_named.js compares all 29 composite forms against frozen references across 48 input-spelling/rotation configurations on x86/x64.

Six scratch-stack leaf bodies share entry/store and exit emission around the selected inner body. Only fragments that reference the phantom immediate receive it as an ASM operand; frame-local stores receive their two displacement operands. sf_bodies.js compares all 32 framed/leaf body emitters byte-for-byte with frozen complete-core references over eight boundary configurations on each architecture. Its source check also verifies that every recipe stays within the reachable body sets of the specialized slot selectors. Early slots share the 16 framed cores they can reach; the full selector retains all 20. short_jumps.js preserves the entire renamed reference-helper graph so CORE/INNER wrappers cannot resolve back to production short-jump definitions.

Guard fragments receive six immediate guard fields; their shared input prefix receives the three input-spelling operands. Frame/body-only fields remain available to their consumers. Pool skeletons read the already-captured phantom alias and need no input operands. Short opcode words omit signed32 normalization only where register/count bounds keep them below bit 31; terminal words use their fixed signed half-range. Arbitrary 32-bit data and frame displacements retain normalization. Primitive byte/flag oracles and whole-binary replay cover these source-only changes.

Stack-proxy epilogues and argument loads select the original word and width in one fill. Local stores pack each two-byte opcode with its signed disp8 into a positive 24-bit word, retaining both store orders. The body oracle freezes argument/local-store composition independently and varies all supported local offsets; the frame oracle retains independent MOV/LEA/LEAVE epilogue byte expectations.

Fixed-register CFLOW helpers fold constant ModRM arithmetic while retaining the original direction bits; the named-form oracle keeps its generic encoders as independent references. Stack-proxy input spelling is emitted once before guard selection, with adjacent immediate-only guard fragments. The pool emitter accepts an optional prefix so custom test entries retain their original behavior; arbitrary-input tests inject their operand into the prefix that consumes it.