Roadmap

Rough ordering of the major pieces of work. This page is the one-screen view; the design detail and the reasoning live in the RFCs each milestone links to. Everything here is subject to change as we learn.

Milestone 0 — Scaffolding (done)

Model: RFC 0001 — Ownership, borrowing and lifetimes (Accepted).

• Layered library structure (Core / Analysis / Frontend), build, tests, CI, docs.
• End-to-end pipeline with a minimal local ownership checker.
• Annotation header and recognition.
• RFC process and the model RFC.

Milestone 1 — Sound intra-procedural checking (done)

Design: RFC 0002 — Sound intra-procedural checking (Implemented). The items below summarise it; the RFC is authoritative.

• Replace the AST walk with a forward dataflow over clang::CFG (fixpoint for loops, proper handling of switch, goto, short-circuit; diagnostics emitted in a post-fixpoint reporting pass).
• Alias relation so copies of an owned pointer share one resource.
• Model allocation/release functions: malloc, calloc, realloc, strdup, free, plus user-annotated allocators; realloc failure idiom accepted via null-edge reinstatement.
• Drive BorrowState from address-of, array decay and annotated calls; emit conflicting-borrow.
• Drive LifetimeConstraints from scopes; emit lifetime-too-short for escaping pointers to locals.
• Field-sensitive places (s->p, a[i] as a summary place).
• --dump-analysis for debugging inferred facts.

Milestone 2 — Signature inference and annotations

Design: RFC 0003 — Signature inference (Implemented) and RFC 0004 — Unsafe boundaries (Implemented).

• Per-function summaries (effects on parameters, paths and globals; stores into caller-visible memory; return-value provenance) computed bottom-up over the TU call graph, to a fixpoint inside recursive SCCs, and applied at every call site.
• Honour WEAVEC_OWNED / WEAVEC_BORROWED / WEAVEC_MUT on declarations; check definitions against their own annotations (annotation-mismatch).
• Shipped summaries for the C standard library (Builtins.cpp), so strchr, strtol, fopen/fclose, … need no annotations.
• annotation-required on by default at the external boundary (once per unknown callee); with --report-unannotated, exported functions get fix-its that insert the inferred annotation.
• Corpus harness (scripts/corpus.py) with a tracked baseline.
• Raw pointers and unsafe regions (RFC 0004): integer casts and WEAVEC_RAW yield raw pointers; unsafe-operation for raw operations outside WEAVEC_UNSAFE; unsafe regions are analysed with reports suppressed, so ownership flows through them; laundering by assertion.
• Calls through function pointers (RFC 0004): annotations on the function-pointer type, else actual reaching function values (refined by RFC 0014); conservative indirect edges in the call graph.
• Pointer arithmetic and pointer casts preserve identity (RFC 0004).
• --strict-externs makes unchecked calls raw operations (RFC 0004).
• POSIX / common GNU-BSD coverage in the shipped table (<unistd.h>, <fcntl.h>, <dirent.h>, <sys/mman.h>, <netdb.h>, <pthread.h>, <time.h>, <pwd.h>, <regex.h>, <dlfcn.h>, asprintf, getline, …).
• Follow-ups surfaced by the corpus: may-moves for a[*] element places (free(a[i]) in a loop), pointer-equality guards (moved to RFC 0006, Milestone 5).
• Function pointers stored in globals and returned from other TUs (RFC 0005 / RFC 0014: actual targets and contexts cross the program).

Milestone 3 — Compiler driver (done)

Design: RFC 0005 — Whole-program analysis (Implemented), weavec-cc.

• weavec-cc as a drop-in cc: Clang’s driver plans the jobs, each -cc1 runs in-process with WeaveC’s consumer multiplexed beside Clang’s code generation, and a WeaveC error fails the compile.
• -fweavec-strict / -fno-weavec / -fweavec-report-unannotated / -fweavec-dump-analysis / -fno-weavec-link, and warning-group style control over diagnostic identifiers (-Wno-weavec-annotation-required, -Wno-error=weavec-use-after-free, -Werror=weavec).
• Clang plugin packaging so existing builds can add -fplugin=weavec and run weavec --link-check as the link step.

Milestone 4 — Whole-program (in progress)

Design: RFC 0005 — Whole-program analysis (Implemented).

• Cross-TU summaries: every unit exports the summaries of its external definitions and address-taken functions; a ProgramDatabase sits between a unit’s own inference and the libc table in SummaryStore.
• FunctionSummary text format (Core/SummaryIO.h), the on-disk and debugging form.
• weavec --whole-program over a compilation database: units ordered by SCC, cyclic groups iterated to a fixpoint.
• weavec-cc sidecars (foo.o.weavec) written at compile time and combined at link time; deferred annotation-required decided per program; compile-time reports not repeated at link time.
• Whole-struct copies carry the facts of their pointer fields.
• Summaries for common libraries beyond libc shipped with WeaveC (libz.weavec next to libz.a, read like any sidecar).
• Retain parsed units within link analysis and optionally reuse settled unit checkpoints after input validation (RFC 0020).
• Persist serialized Clang ASTs so warm validation can avoid parsing.
• Incremental link steps (re-analyse only units whose imports changed).

Milestone 5 — Precision (in progress)

Design: RFC 0006 — Precision (Accepted).

• Loans end at the holder’s last use (liveness over the CFG); by default only invalidation (free, move, realloc) of a borrowed object is a conflicting-borrow; Rust’s exclusivity rule behind --exclusive-borrows / -fweavec-exclusive-borrows.
• Condition facts on CFG edges: pointer equality unites/separates aliases (with exact/interior alias edges); tests of a call result select the callee’s outcome classes.
• Element witnesses: free(a[i]) remembers i; a later a[i] is a use of the same element, a[j] or a[i] after i++ is not.
• Outcome-conditional summaries (outcome <class> <path> <flags>), subsuming the realloc null-edge rule; summary format v2, sidecar v2.
• written effects forget the facts below the written object.
• Corpus: clean baseline on the tracked projects; zlib and Lua added.

Milestone 6 — Resource lifecycle (in progress)

Design: RFC 0007 — Resource lifecycle (Accepted).

• ResourceTracker in the state: what this function owns, where it came from, its release family, and whether it escaped.
• leak (warning) where a resource’s last holder goes out of reach, is overwritten, is a discarded allocating call, or is a field dropped with its container.
• mismatched-release (error): families on every allocator and releaser of the shipped table, inferred through wrappers, crossing units (summary format v3, sidecar v3).
• WEAVEC_OWNED on struct fields enforced; inferred owned fields and array elements checked the same way.
• Deepest-first application of consumed summary paths (a soundness fix for callees that free a field together with its object).
• Per-outcome null facts for out-parameter constructors (null <class> <path>): if (mk(&x) != 0) return -1; is clean when mk’s error returns leave *out null or untouched.
• Per-outcome stores (which of several stores holds on which class) (RFC 0010).
• A release family for WEAVEC_OWNED declarations (WEAVEC_OWNED_BY(f)) (RFC 0010).
• Corpus triage of the new leak reports; leak rate as a tracked metric.

Milestone 7 — Pointer validity (in progress)

Design: RFC 0008 — Pointer validity (Accepted).

• Replaced values: consumption of a caller-visible path is recorded as it happens (freed,replaced), so a caller’s copy of a value the callee released and reinitialised is dead (the vec_grow hole).
• Struct-by-value results: the result summary root carries the pointer fields of a returned record to the caller.
• NullTracker in the state; null-dereference (error) for dereferences and for arguments to callees that require non-null; requires{...} and notnull{...} in summaries; nullability of every shipped table entry; WEAVEC_NULLABLE / WEAVEC_NONNULL (summary format v4, sidecar v4).
• use-of-uninitialized (error) for pointer locals and the pointer fields of record locals.
• invalid-release (error) for stack and static objects, string literals and interior pointers.
• Nullness through struct fields across calls (a callee that nulls b->data and a caller that dereferences it) beyond the per-outcome null{...}/notnull{...} facts.
• Integer-correlated tests (if (n > 0) p = xmalloc(n); ... if (n > 0) *p): the null record is guarded by n zero|negative and otherwise non-null, so the second test clears it (RFC 0009). With a plain malloc the report stays and is the unchecked-allocation one.
• Corpus triage of the new reports; null-dereference rate as a tracked metric.
• The consume fan-out at calls (doConsume over a path, its mirrors and their aliases, once per call site) that dominates Lua’s luaV_execute since Replaced values (RFC 0008, Performance).

Milestone 8 — Value-conditional behaviour (in progress)

Design: RFC 0009 — Value-conditional behaviour (Accepted).

• ScalarTracker in the state: the class (zero, positive, negative) and known constant of integer places, refined by condition edges and switch cases, joined at merges.
• Guards on moves, held resources and null records: each carries the facts of the path that created it and a later test that contradicts them drops it: if (c) free(p); ... if (!c) use(p); is clean.
• Argument-conditional summaries: when guards on consumes, stores and return alternatives, translated to the arguments at the call and pruned against the caller’s facts (summary format v5, sidecar v5).
• Inferred never-returns for functions whose exit is unreachable, transitively through wrappers and across units; a call to one ends the path like a declared noreturn.
• Argument-conditional termination (never-returns when ...).
• Corpus: the noreturn group of Lua reports removed; time regression bounded.

Milestone 9 — Shared ownership (in progress)

Design: RFC 0010 — Shared ownership (Accepted).

• Shares on resource records: a count increment (o->rc++, the atomic builtins, a callee’s increment path) retains its object; copies of a place with surplus shares carry one away (sameShare alias edges).
• Share releases: a decrement whose zero test guards the free is a freed,share effect; the released name is dead (use-after-free, double-free with reference wording), siblings live on; count paths and the count-field registry for leak on retained shares.
• Per-outcome integer facts (fact <class> <path> <fact>) so dec_and_test helpers compose with the release rule.
• Per-outcome stores (stored <class> <path>): a store the callee did not perform on the selected class is retracted in the caller (summary format v6, sidecar v6).
• WEAVEC_RETAINS, WEAVEC_RELEASES, WEAVEC_REFCOUNT, WEAVEC_OWNED_BY(f) (closes the RFC 0007 item above).
• Whole-program fixpoint re-runs a cyclic group’s member only when its imports changed.
• Corpus: a reference-counting project (jansson) added to the tracked set; the Lua whole-program run time as a tracked metric.

Milestone 10 — Spatial safety (in progress)

Design: RFC 0011 — Spatial safety (Accepted).

• Derived pointers: an offset (core::PointerOffset) on alias edges, resources, summary effects and returned copies replaces the boolean interior flag; container_of round trips; != separates derived pointers; a field pointer kept across a free is a use-after-free.
• lifetime-too-short decided at the pointee’s death rather than at the store (the L->fs = &fs; ... L->fs = fs.prev idiom is clean).
• Whole-program fixpoint widening after a fixed number of rounds, so cyclic groups converge on every input.
• Extents (core::SpatialTracker, core::Affine) from allocations, wrappers (return fresh extent=n), declared sizes, string literals and WEAVEC_SIZED_BY; relations between integer places (core::RelationTracker) from condition edges.
• out-of-bounds (error) for subscripts, pointer dereferences and the buffer/length pairs of the shipped table; requires-extent in summaries, checked at every call and across units (summary format v7, sidecar v7).
• Recall check: Juliet-style cases under test/recall/CWE-*, run by scripts/recall.py in ctest and CI.
• Extents through struct fields (b->len as the extent of b->data): RFC 0012’s sized fields, below.
• Constant extents across stores (a callee that sets *out and *len), plus stable allocation-time size identities (RFC 0013).
• Requirements that depend on two parameters (min(n, cap)), and requirements on WEAVEC_SIZED_BY parameters re-exported to callers.
• Corpus: out-of-bounds rate as a tracked metric; the Juliet test suite proper (CWE-121/122/124/126/127) as a recall baseline.

Milestone 11 — Spatial safety II: strings and fields (in progress)

Design: RFC 0012 — Spatial safety II (Accepted).

• String facts on spatial records (core::StringFact: the length as an Affine, or unterminated), on the object and every exact alias of it; strlen(s) as a length place; sources: literals and initialisers, strcpy/stpcpy/strcat/sprintf/strdup, strncpy/memset/memcpy that leave no terminator, NUL stores, fgets/snprintf; every other write drops them.
• out-of-bounds for strcpy, stpcpy, strcat and sprintf against the destination’s extent (malloc(strlen(s)) is one short), and for terminator-seeking reads (strlen, strcpy source, puts, %s) of an object with no terminator.
• WEAVEC_SIZED_BY(g) on pointer fields: loads get the count’s extent, stores are checked (annotation-mismatch); malformed annotations are invalid-annotation.
• Inferred sized fields: witnesses and refutations from every store in the program, confirmed when the program agrees; a second pass in the unit and a cross-unit pass in the whole-program driver report what the confirmation decides (sidecar v8: sized-field, unsized-field, loads-field).
• Offset relations (i <= n - 1, j = i + 1) and constant lower bounds (i >= 8) in core::RelationTracker; boundsVerdict decides through them.
• WEAVEC_ASSUME(expr): the condition holds from the call on. weavec.h 0.7.
• Known lengths through returned pointers, stored pointers and reachable fields, including constructors other than strdup (RFC 0013).
• String postconditions for in-place writes to an incoming buffer when no pointer value is stored or returned.
• Sized fields with a byte count on a non-char pointer, and counts one field-hop away (b->hdr.len).
• Corpus: the CWE-170 shape (strncpy without a terminator) as a tracked recall class; false-positive review of the string checks on the tracked projects.

Milestone 12 — Interprocedural heap state and value identity

Design: RFC 0013.

• Final heap postconditions through pointer and record returns, out-parameters, local aliases and whole-program summaries.
• Child ownership, release families, argument aliases, shared children, self-links, null/raw values, bounds and known string facts.
• Entry pointer identity separated from replacement output values, including failed replacement retaining the incoming value.
• Allocation-time constant folding and bounded symbolic size snapshots.
• Bounded graph projection with explicit incomplete coverage in dumps; summary and sidecar format 9.
• A fixed good/bad evaluation matrix with known misses and independent execution-failure accounting, beside the existing recall regression set.

Richer arithmetic, arbitrary element identities and a verification mode that rejects incomplete coverage need separate designs. Callback target precision is addressed by the following milestone. This milestone does not make Lua’s GC or stack-rebasing invariants inferable.

Milestone 13 — Pointer identity and precise call effects

Design: RFC 0014.

• Actual function-value target sets, preserving unknown and null alternatives.
• Bounded callback helper specialization, including userdata associations, local forwarding and requests across translation units.
• Equality/inequality guards on ownership effects and entry pointer snapshots.
• Complete pointer and compatible record copies through memcpy/memmove.
• Record-view validation for summary paths and explicit incomplete coverage.
• Version 10 summaries and sidecars, callback dependencies and diagnostic controls.
• Regression and evaluation pairs, strict C fixture validation, and pinned corpus tooling with process-failure and optional memory accounting.

Arbitrary byte fragments, unrestricted element identities, general callback relational reasoning and GC/region invariants remain outside this milestone. Recursive callback contexts that cannot be resolved within the bounds report incomplete coverage. Runtime enforcement and verification mode remain separate.

Milestone 14 — Array and container ownership

Design: RFC 0015.

• Independent selected cells, nested arrays and scalar index snapshots.
• Per-cell ownership, initialization, nullness, callbacks and heap state.
• Simultaneous complete pointer/record array copies and overlapping moves.
• Sparse symbolic range snapshots and final helper/returned-container summaries.
• Proved contiguous fill/cleanup loops and reallocation child preservation.
• Format 11 summaries/sidecars, bounded import validation and global remapping.
• Unit, integration and fixed evaluation pairs, including compiler link tests.
• Pinned before/after corpus counts, location-level triage and measured performance in the validation report.

Unknown overlap can still produce conservative temporal reports. Arbitrary strides, partial pointer representations, compositions that require retaining unbounded range history and general loop invariants remain incomplete boundaries. This milestone does not introduce verification mode or a tracing collector model.

Milestone 15 — Compositional call checking

Design: RFC 0016.

• Bounded caller contexts for aliases, storage identity, relative offsets, reference shares, distinct objects and scalar/null entry facts.
• Reuse the callee CFG to preserve statement order, guards, replacement and saved incoming values under those relationships.
• Combined callback and data contexts, with diagnostic call notes and unsafe-reporting state preserved through nested requests.
• Cross-unit request/result convergence, strict global remapping and format 12 sidecars; compiler replay includes locally complete definers.
• Inline/helper/cross-file evaluation pairs, compiler link tests, malformed-context and resource-limit regression coverage.
• Published validation and pinned corpus changes, including precision limits and analysis cost in the report.

Calls with no established interacting relationship retain generic checking. An absent alias edge does not prove disjointness. Enumerating arbitrary input alias partitions, unrestricted heap invariants and enforcing complete coverage belong to a separate verification milestone. The existing machine-width and non-affine size-analysis gaps also remain.

Milestone 16 — C integer semantics and spatial checking

Design: RFC 0017.

• Target-width conversions, unsigned wrap, guarded arithmetic and checked products in spatial requirements and helper contracts.
• Numeric outputs, format 13 summaries/sidecars and fixed regression pairs.
• Published validation with preserved evaluations.

Milestone 17 — Compositional safety contracts and checked code

Design: RFC 0018.

• Opt-in function/module selection and per-operation proof accounting.
• Sufficient bounds, validity, writable-storage, initialization, release and separation requirements, plus complete initialization postconditions.
• Caller discharge, counted-loop requirements and explicit trust provenance.
• Deterministic JSON reports and checked failure independent of warning controls.
• Format 14 summaries/sidecars, input/object binding and deferred link checks.
• Frozen checked cases and compiler integration alongside unchanged ordinary evaluations.
• Final ordinary-mode performance signoff; see the validation report for the completed correctness checks, coverage results and pending quiet measurement window.

The checked-code guide describes the supported conditional source guarantee. Unsupported semantics remain incomplete; general recursive heap invariants, archive packaging and runtime enforcement remain future work.

Milestone 19 — Scalable checked analysis (complete)

Design: RFC 0020.

• Invocation work counts and timings with atomic explicit output.
• Context dependency tracking and revision-based invalidation.
• Retained translation units and immutable function preparation.
• Shared obligation storage and separate semantic/explanation equality.
• Compact report version 3 with a version 2 decoder.
• Optional validated translation-unit checkpoints and diagnostic replay.
• Sidecar format 16 preprocessing bindings for checked object validation.
• Complete the frozen evaluation and publish measured cold/warm corpus gates (validation, results).

Milestone 20 — Practical C traversal (complete)

Design: RFC 0021 (Implemented).

• Same-array cursor arithmetic, ordering and target-width differences.
• Bounded inductive loop facts, initialized prefixes and direct local gotos.
• Terminated-prefix witnesses, cursor positions and paired progress across helpers, source units, compiler objects and persistent checkpoints.
• All five unchanged Jansson UTF definitions and four cJSON minifier definitions, with proven closed callers and adversarial counterexamples.
• Preserve every baseline-complete selected function, increasing the total from 99 to 120, and validate all 51 warm unit hits without function analyses.
• Pass full Debug/sanitizer suites and ordinary runtime/memory gates; publish validation, measured results and diagnostic changes.

Milestone 21 — Checked C interfaces (complete)

Design: RFC 0022 (Implemented).

• Compatible opaque pointer recovery with independent object type, alignment, initialization, bounds and lifetime obligations.
• Checked synchronous callback forwarding and conservative mixed-target requirements and outputs, including modeled library functions.
• Configurable allocator hooks, private callback cells and nullable output initialization across source units and compiler objects.
• Version 17 summaries, version 18 sidecars and checked encoding 4, with strict context remapping and persistent reuse regression cases.
• Pass correctness, real-source and measured performance gates; retain 119/120 baseline-complete identities, reject one demonstrated false proof, and gain five complete contracts. Publish the validation, measured results and exact diagnostic changes.

Generic callback interfaces may remain incomplete until their actual bindings are known. General recursive heaps, arbitrary type punning, asynchronous callback protocols and unavailable-callback contract languages remain separate work.

Milestone 22 — Inductive linked containers

Design: RFC 0023.

• Finite chain predicates with initialized node fields, read/write/release capabilities and independently owned payloads.
• Runtime construction, traversal, reversal, concatenation, head detachment and cleanup through inferred helper contracts.
• Conservative alias invalidation, including native payload pointers and every returning resolved callback target.
• Version 18 summaries, version 19 sidecars and checked encoding 5, with strict descriptor validation and cache invalidation cases.
• Frozen closed callers, unchanged cJSON traversal clients, independent graph/release oracles, and complete Debug/ASan/UBSan suites.
• Exact corpus preservation, canonical cache equivalence and ordinary runtime/memory gates, with published validation and measured results.

Derived outputs describe subsets of their input chains. RFC 0027 adds separate whole-footprint conservation for supported transformations and finite recursive forests. Arbitrary graphs and cyclic ownership remain separate work.

Milestone 23 — Checked C runtime contracts

Design: RFC 0024.

• Validated comparison/search, scalar math, stream and descriptor I/O contracts, with initialized inputs and result-qualified output prefixes.
• Bounded narrow-format parsing, promoted argument types, capacity and overlap checks, and explicit rejection of unsupported conversions.
• Independent variadic cursors, required cleanup, conservative mutation invalidation and inferred forwarding requirements across helpers.
• Version 19 summaries, version 20 sidecars and checked encoding 6, with separate-source, compiler-object and cache regression populations.
• Full Debug/ASan/UBSan suites and unchanged-source clients; retain the cJSON string-comparison client as a visible incomplete case.
• Publish exact corpus preservation, cache equivalence and measured runtime/memory gates in the validation record.

Direct variadic extraction, record-embedded or escaping argument lists, positional/wide formats, %n, scanning and unbound dynamic formats remain separate work. A complete conditional runtime contract retains its entry requirements and does not certify an entire library.

Milestone 24 — Input cases and discriminated objects

Design: RFC 0025.

• Recheck incomplete helpers under established scalar, tag and nullness inputs, including read-only and forwarded callback cases.
• Keep generic definitions independently selected and preserve their complete contracts when a bounded case would lose inductive outputs.
• Track named scalar and pointer union members separately from pointer validity, lifetime, bounds and initialized pointee bytes.
• Invalidate overlapping member facts; preserve complete compatible copies, guarded joins, helper requirements and output-member guarantees.
• Transport complete proof cases through version 20 summaries, version 21 sidecars and checked encoding 7, including compact reports and caches.
• Complete the frozen source, object, upstream and adversarial populations, full Debug/ASan/UBSan suites, corpus preservation and cost validation; publish the validation record.

Aggregate union members, representation punning, anonymous member promotion, volatile/atomic union storage and unrestricted symbolic execution remain separate work. A tag chooses a branch; an actual write establishes its payload.

Milestone 25 — Growable buffers and vectors

Design: RFC 0026.

• Infer related length, capacity, allocation, initialization and ownership contracts through reserve, append, resize, truncate, clear and steal.
• Preserve failure outcomes and distinguish pointer-element ownership from initialization; transport proofs through sources, objects and checkpoints.
• Validate the fixed and unchanged Jansson populations, corpus preservation and cost gates; publish the validation record.

Milestone 26 — Recursive object ownership

Design: RFC 0027.

• Infer finite recursive ownership forests with multiple children, separately owned payloads, initialized ownership flags and borrowed backlinks.
• Prove complete allocation preservation, partition, combination and consumption independently of structural validity.
• Verify direct recursive cleanup through proper-child induction and compose construction, traversal, attachment, detachment and supported relinking.
• Transport contracts through sources, compiler objects and validated caches; check unchanged cJSON lifecycle clients and an independent heap oracle.
• Complete all preservation and performance gates and publish the final validation record and machine-readable evidence.

General graphs, shared recursive ownership, mutual recursive cleanup and full parser/printer verification remain separate work.

Milestone 27 — Opaque objects and private library state

Design: RFC 0028.

• Preserve inferred object representation, borrowing, initialization and ownership contracts through public headers with incomplete record types.
• Transport private static records, nested callbacks, scalar configuration and fixed arrays with stable identities and validated storage descriptions.
• Infer wrapper release guarantees for individual allocations while retaining independent whole-container cleanup and allocation-footprint obligations.
• Replace the callback-only private proxy; use summary format 23, sidecar format 24 and checkpoint format 3, requiring older artifacts to rebuild.
• Validate frozen clients, independent counterexamples and unchanged cJSON public-header clients through source units and separate compiler objects; complete Debug/ASan/UBSan, strict lint and fixed-evaluation checks.
• Complete corpus preservation, cache replay and isolated cost gates; publish the final validation record and machine-readable evidence.

Unsupported private types, richer conditional release forwarding, reassigned entry-parameter projection and arbitrary shared graphs remain incomplete. Selected cJSON lifecycle clients do not certify its parser, printer or every generic library function.

Ongoing

• Corpus testing against real C projects (scripts/corpus.py; false-positive rate as a tracked metric, scripts/corpus/baseline.json).
• Fuzzing the analyzer with generated C.
• Windows support once the analysis stabilises.