.github/workflows/test-safe-core-v4.yml

@@ -0,0 +1,146 @@
+name: Test safe standalone core V4
+
+on:
+  push:
+    branches:
+      - test/safe-core-v4
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: mlugg/setup-zig@v2
+        with:
+          version: 0.16.0
+
+      - name: Build safe standalone variants
+        shell: bash
+        run: |
+          set -euo pipefail
+          zig build all-variants -Doptimize=ReleaseSmall \
+            -Dweirdperformance=false \
+            -Doutline=true
+
+      - name: Verify minimal core layout
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          from pathlib import Path
+
+          root = Path("zig-out/variants")
+
+          addr = {
+              "lua_protection": 0x42A320,
+              "register_commands": 0x490250,
+              "glue_commands": 0x46ABB0,
+              "engine_init": 0x46A400,
+              "logout": 0x491180,
+              "shutdown": 0x490BD0,
+              "file_fallback": 0x648620,
+              "open_file": 0x6477C0,
+              "file_size": 0x6487F0,
+              "read_file": 0x648460,
+              "cleanup_file": 0x648730,
+              "model_load": 0x71D4E0,
+              "check_file": 0x654DD0,
+          }
+
+          def has(data, value):
+              return value.to_bytes(4, "little") in data
+
+          outline = (root / "outline.dll").read_bytes()
+          custom = (root / "customassets.dll").read_bytes()
+          transmog = (root / "transmogfix.dll").read_bytes()
+
+          # Outline: only its Lua registration + engine init core hooks are allowed.
+          required_outline = ("register_commands", "engine_init")
+          forbidden_outline = tuple(k for k in addr if k not in required_outline)
+          for k in required_outline:
+              if not has(outline, addr[k]):
+                  raise SystemExit(f"outline.dll missing required {k}")
+          bad = [k for k in forbidden_outline if has(outline, addr[k])]
+          if bad:
+              raise SystemExit(f"outline.dll still contains unwanted core hooks: {bad}")
+          print("outline.dll: minimal core verified")
+
+          # CustomAssets: only CheckFileExistence is allowed from the generic core.
+          if not has(custom, addr["check_file"]):
+              raise SystemExit("customassets.dll missing CheckFileExistence")
+          bad = [k for k,v in addr.items() if k != "check_file" and has(custom, v)]
+          if bad:
+              raise SystemExit(f"customassets.dll still contains unwanted core hooks: {bad}")
+          print("customassets.dll: minimal core verified")
+
+          # TransmogFix: none of the generic core hook target addresses should remain.
+          bad = [k for k,v in addr.items() if has(transmog, v)]
+          if bad:
+              raise SystemExit(f"transmogfix.dll still contains unwanted core hooks: {bad}")
+          print("transmogfix.dll: minimal core verified")
+
+          # Compatibility repair must exist in customassets and outline.
+          for name, data in (("outline.dll", outline), ("customassets.dll", custom)):
+              for gate in (0x654B5C, 0x654B6A):
+                  if not has(data, gate):
+                      raise SystemExit(f"{name} missing MPQ gate restore address 0x{gate:X}")
+              for seq in (bytes([0x74,0x25]), bytes([0x75,0x17])):
+                  if seq not in data:
+                      raise SystemExit(f"{name} missing original MPQ branch bytes {seq.hex()}")
+          print("legacy MPQ gate repair verified")
+          PY
+
+      - name: Stage package
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p package/DLL
+          mkdir -p package/Interface/AddOns/WeirdUtils_Outline
+
+          cp zig-out/variants/outline.dll package/DLL/
+          cp zig-out/variants/customassets.dll package/DLL/
+          cp zig-out/variants/transmogfix.dll package/DLL/
+
+          cp src/outline/addon/Outline.lua package/Interface/AddOns/WeirdUtils_Outline/
+          cp src/outline/addon/Bindings.xml package/Interface/AddOns/WeirdUtils_Outline/
+          cp src/outline/addon/WeirdUtils_Outline.toc package/Interface/AddOns/WeirdUtils_Outline/
+
+          cat > package/README_TEST.txt <<'EOF'
+          WeirdUtils Safe Standalone Core Test V4
+
+          This build fixes the second crash path observed in WoW's Lua engine.
+
+          outline.dll
+          - Keeps only the Player_LoadScriptFunctions hook required to register OutlineCommand.
+          - Keeps only the GameEngine_MainInitialize hook required to initialise the renderer.
+          - Does not register the shared WeirdUtils version table.
+          - Does not install generic MPQ/file hooks.
+          - Uses the external WeirdUtils_Outline addon included here.
+
+          customassets.dll
+          - Keeps only CheckFileExistence from the shared file core.
+          - No shared Lua registration hooks.
+          - No shared engine/logout/shutdown hooks.
+          - Repairs legacy File_FindInArchive NOPs if present.
+
+          transmogfix.dll
+          - Installs only TransmogFix's own module hooks.
+          - No shared Lua/file/engine/logout/shutdown hooks.
+
+          weirdperformance.dll
+          - Not built here.
+          - The final ZIP will use the user's original binary unchanged.
+          EOF
+
+          sha256sum package/DLL/*.dll > package/SHA256SUMS.txt
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: safe-core-v4
+          path: package/
+          if-no-files-found: error

.github/workflows/test-safe-core-v5.yml

@@ -0,0 +1,161 @@
+name: Test safe standalone core V5
+
+on:
+  push:
+    branches:
+      - test/safe-core-v5
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: mlugg/setup-zig@v2
+        with:
+          version: 0.16.0
+
+      - name: Build safe standalone variants
+        shell: bash
+        run: |
+          set -euo pipefail
+          zig build all-variants -Doptimize=ReleaseSmall \
+            -Dweirdperformance=false \
+            -Doutline=true
+
+      - name: Verify minimal core layout
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          from pathlib import Path
+
+          root = Path("zig-out/variants")
+
+          addr = {
+              "lua_protection": 0x42A320,
+              "register_commands": 0x490250,
+              "glue_commands": 0x46ABB0,
+              "engine_init": 0x46A400,
+              "logout": 0x491180,
+              "shutdown": 0x490BD0,
+              "file_fallback": 0x648620,
+              "open_file": 0x6477C0,
+              "file_size": 0x6487F0,
+              "read_file": 0x648460,
+              "cleanup_file": 0x648730,
+              "model_load": 0x71D4E0,
+              "check_file": 0x654DD0,
+          }
+
+          def has(data, value):
+              return value.to_bytes(4, "little") in data
+
+          outline = (root / "outline.dll").read_bytes()
+          custom = (root / "customassets.dll").read_bytes()
+          transmog = (root / "transmogfix.dll").read_bytes()
+
+          # Outline: only its Lua registration + engine init core hooks are allowed.
+          required_outline = ("register_commands", "engine_init")
+          forbidden_outline = tuple(k for k in addr if k not in required_outline)
+          for k in required_outline:
+              if not has(outline, addr[k]):
+                  raise SystemExit(f"outline.dll missing required {k}")
+          bad = [k for k in forbidden_outline if has(outline, addr[k])]
+          if bad:
+              raise SystemExit(f"outline.dll still contains unwanted core hooks: {bad}")
+          print("outline.dll: minimal core verified")
+
+          # CustomAssets: only CheckFileExistence is allowed from the generic core.
+          if not has(custom, addr["check_file"]):
+              raise SystemExit("customassets.dll missing CheckFileExistence")
+          bad = [k for k,v in addr.items() if k != "check_file" and has(custom, v)]
+          if bad:
+              raise SystemExit(f"customassets.dll still contains unwanted core hooks: {bad}")
+          print("customassets.dll: minimal core verified")
+
+          # TransmogFix: none of the generic core hook target addresses should remain.
+          bad = [k for k,v in addr.items() if has(transmog, v)]
+          if bad:
+              raise SystemExit(f"transmogfix.dll still contains unwanted core hooks: {bad}")
+          print("transmogfix.dll: minimal core verified")
+
+          # Compatibility repair must exist in customassets and outline.
+          for name, data in (("outline.dll", outline), ("customassets.dll", custom)):
+              for gate in (0x654B5C, 0x654B6A):
+                  if not has(data, gate):
+                      raise SystemExit(f"{name} missing MPQ gate restore address 0x{gate:X}")
+              for seq in (bytes([0x74,0x25]), bytes([0x75,0x17])):
+                  if seq not in data:
+                      raise SystemExit(f"{name} missing original MPQ branch bytes {seq.hex()}")
+          print("legacy MPQ gate repair verified")
+          PY
+
+      - name: Verify Outline Lua wrapper usage
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          from pathlib import Path
+          src = Path("src/outline/outline.zig").read_text()
+          if 'hook.call(fn (usize)' in src or '0x6F39F0' in src:
+              raise SystemExit("Outline still contains manual Lua API hook.call usage")
+          for required in ("lua.gettop(L)", "lua.isstring(L, 1)", "lua.tostring(L, 1)", "lua.pushboolean(L"):
+              if required not in src:
+                  raise SystemExit(f"Missing expected Lua wrapper usage: {required}")
+          print("outline.dll source: direct lua.zig wrappers verified")
+          PY
+
+      - name: Stage package
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p package/DLL
+          mkdir -p package/Interface/AddOns/WeirdUtils_Outline
+
+          cp zig-out/variants/outline.dll package/DLL/
+          cp zig-out/variants/customassets.dll package/DLL/
+          cp zig-out/variants/transmogfix.dll package/DLL/
+
+          cp src/outline/addon/Outline.lua package/Interface/AddOns/WeirdUtils_Outline/
+          cp src/outline/addon/Bindings.xml package/Interface/AddOns/WeirdUtils_Outline/
+          cp src/outline/addon/WeirdUtils_Outline.toc package/Interface/AddOns/WeirdUtils_Outline/
+
+          cat > package/README_TEST.txt <<'EOF'
+          WeirdUtils Safe Standalone Core Test V5
+
+          This build also fixes OutlineCommand's Lua API calls after a crash at lua_pushboolean.
+
+          outline.dll
+          - Keeps only the Player_LoadScriptFunctions hook required to register OutlineCommand.
+          - Keeps only the GameEngine_MainInitialize hook required to initialise the renderer.
+          - Does not register the shared WeirdUtils version table.
+          - Does not install generic MPQ/file hooks.
+          - Uses the external WeirdUtils_Outline addon included here.
+
+          customassets.dll
+          - Keeps only CheckFileExistence from the shared file core.
+          - No shared Lua registration hooks.
+          - No shared engine/logout/shutdown hooks.
+          - Repairs legacy File_FindInArchive NOPs if present.
+
+          transmogfix.dll
+          - Installs only TransmogFix's own module hooks.
+          - No shared Lua/file/engine/logout/shutdown hooks.
+
+          weirdperformance.dll
+          - Not built here.
+          - The final ZIP will use the user's original binary unchanged.
+          EOF
+
+          sha256sum package/DLL/*.dll > package/SHA256SUMS.txt
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: safe-core-v5
+          path: package/
+          if-no-files-found: error

.github/workflows/test-safe-core-v7.yml

@@ -0,0 +1,167 @@
+name: Test safe standalone core V7
+
+on:
+  push:
+    branches:
+      - test/safe-core-v7
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: mlugg/setup-zig@v2
+        with:
+          version: 0.16.0
+
+      - name: Build safe standalone variants
+        shell: bash
+        run: |
+          set -euo pipefail
+          zig build all-variants -Doptimize=ReleaseSmall \
+            -Dweirdperformance=false \
+            -Doutline=true
+
+      - name: Verify minimal core layout
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          from pathlib import Path
+
+          root = Path("zig-out/variants")
+
+          addr = {
+              "lua_protection": 0x42A320,
+              "register_commands": 0x490250,
+              "glue_commands": 0x46ABB0,
+              "engine_init": 0x46A400,
+              "logout": 0x491180,
+              "shutdown": 0x490BD0,
+              "file_fallback": 0x648620,
+              "open_file": 0x6477C0,
+              "file_size": 0x6487F0,
+              "read_file": 0x648460,
+              "cleanup_file": 0x648730,
+              "model_load": 0x71D4E0,
+              "check_file": 0x654DD0,
+          }
+
+          def has(data, value):
+              return value.to_bytes(4, "little") in data
+
+          outline = (root / "outline.dll").read_bytes()
+          custom = (root / "customassets.dll").read_bytes()
+          transmog = (root / "transmogfix.dll").read_bytes()
+
+          # Outline: only its Lua registration + engine init core hooks are allowed.
+          required_outline = ("register_commands", "engine_init")
+          forbidden_outline = tuple(k for k in addr if k not in required_outline)
+          for k in required_outline:
+              if not has(outline, addr[k]):
+                  raise SystemExit(f"outline.dll missing required {k}")
+          bad = [k for k in forbidden_outline if has(outline, addr[k])]
+          if bad:
+              raise SystemExit(f"outline.dll still contains unwanted core hooks: {bad}")
+          print("outline.dll: minimal core verified")
+
+          # CustomAssets: only CheckFileExistence is allowed from the generic core.
+          if not has(custom, addr["check_file"]):
+              raise SystemExit("customassets.dll missing CheckFileExistence")
+          bad = [k for k,v in addr.items() if k != "check_file" and has(custom, v)]
+          if bad:
+              raise SystemExit(f"customassets.dll still contains unwanted core hooks: {bad}")
+          print("customassets.dll: minimal core verified")
+
+          # TransmogFix: none of the generic core hook target addresses should remain.
+          bad = [k for k,v in addr.items() if has(transmog, v)]
+          if bad:
+              raise SystemExit(f"transmogfix.dll still contains unwanted core hooks: {bad}")
+          print("transmogfix.dll: minimal core verified")
+
+          # Compatibility repair must exist in customassets and outline.
+          for name, data in (("outline.dll", outline), ("customassets.dll", custom)):
+              for gate in (0x654B5C, 0x654B6A):
+                  if not has(data, gate):
+                      raise SystemExit(f"{name} missing MPQ gate restore address 0x{gate:X}")
+              for seq in (bytes([0x74,0x25]), bytes([0x75,0x17])):
+                  if seq not in data:
+                      raise SystemExit(f"{name} missing original MPQ branch bytes {seq.hex()}")
+          print("legacy MPQ gate repair verified")
+          PY
+
+      - name: Verify Outline native Lua asm wrappers
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          from pathlib import Path
+          src = Path("src/outline/outline.zig").read_text()
+          for required in (
+              'luaGetTopNative',
+              'luaIsStringNative',
+              'luaToStringNative',
+              'luaPushBooleanNative',
+              '"{ecx}"',
+              '"{edx}"',
+              '0x6F39F0',
+          ):
+              if required not in src:
+                  raise SystemExit(f"Missing native register wrapper piece: {required}")
+          print("outline.dll source: native x86 register wrappers present")
+          PY
+
+      - name: Stage package
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p package/DLL
+          mkdir -p package/Interface/AddOns/WeirdUtils_Outline
+
+          cp zig-out/variants/outline.dll package/DLL/
+          cp zig-out/variants/customassets.dll package/DLL/
+          cp zig-out/variants/transmogfix.dll package/DLL/
+
+          cp src/outline/addon/Outline.lua package/Interface/AddOns/WeirdUtils_Outline/
+          cp src/outline/addon/Bindings.xml package/Interface/AddOns/WeirdUtils_Outline/
+          cp src/outline/addon/WeirdUtils_Outline.toc package/Interface/AddOns/WeirdUtils_Outline/
+
+          cat > package/README_TEST.txt <<'EOF'
+          WeirdUtils Safe Standalone Core Test V7
+
+          This build forces OutlineCommand's WoW Lua calls through x86 register assembly wrappers.
+
+          outline.dll
+          - Keeps only the Player_LoadScriptFunctions hook required to register OutlineCommand.
+          - Keeps only the GameEngine_MainInitialize hook required to initialise the renderer.
+          - Does not register the shared WeirdUtils version table.
+          - Does not install generic MPQ/file hooks.
+          - Uses the external WeirdUtils_Outline addon included here.
+
+          customassets.dll
+          - Keeps only CheckFileExistence from the shared file core.
+          - No shared Lua registration hooks.
+          - No shared engine/logout/shutdown hooks.
+          - Repairs legacy File_FindInArchive NOPs if present.
+
+          transmogfix.dll
+          - Installs only TransmogFix's own module hooks.
+          - No shared Lua/file/engine/logout/shutdown hooks.
+
+          weirdperformance.dll
+          - Not built here.
+          - The final ZIP will use the user's original binary unchanged.
+          EOF
+
+          sha256sum package/DLL/*.dll > package/SHA256SUMS.txt
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: safe-core-v7
+          path: package/
+          if-no-files-found: error

.github/workflows/test-safe-core-v8.yml

@@ -0,0 +1,249 @@
+name: Test safe standalone core V8 Debug
+
+on:
+  push:
+    branches:
+      - test/safe-core-v8-debug
+  workflow_dispatch:
+
+# V8 debug diagnostics build
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: mlugg/setup-zig@v2
+        with:
+          version: 0.16.0
+
+      - name: Build safe standalone variants
+        shell: bash
+        run: |
+          set -euo pipefail
+          zig build all-variants -Doptimize=ReleaseSmall \
+            -Dweirdperformance=false \
+            -Doutline=true
+
+      - name: Verify minimal core layout
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          from pathlib import Path
+
+          root = Path("zig-out/variants")
+
+          addr = {
+              "lua_protection": 0x42A320,
+              "register_commands": 0x490250,
+              "glue_commands": 0x46ABB0,
+              "engine_init": 0x46A400,
+              "logout": 0x491180,
+              "shutdown": 0x490BD0,
+              "file_fallback": 0x648620,
+              "open_file": 0x6477C0,
+              "file_size": 0x6487F0,
+              "read_file": 0x648460,
+              "cleanup_file": 0x648730,
+              "model_load": 0x71D4E0,
+              "check_file": 0x654DD0,
+          }
+
+          def has(data, value):
+              return value.to_bytes(4, "little") in data
+
+          outline = (root / "outline.dll").read_bytes()
+          custom = (root / "customassets.dll").read_bytes()
+          transmog = (root / "transmogfix.dll").read_bytes()
+
+          # Outline: only its Lua registration + engine init core hooks are allowed.
+          required_outline = ("register_commands", "engine_init")
+          forbidden_outline = tuple(k for k in addr if k not in required_outline)
+          for k in required_outline:
+              if not has(outline, addr[k]):
+                  raise SystemExit(f"outline.dll missing required {k}")
+          bad = [k for k in forbidden_outline if has(outline, addr[k])]
+          if bad:
+              raise SystemExit(f"outline.dll still contains unwanted core hooks: {bad}")
+          print("outline.dll: minimal core verified")
+
+          # CustomAssets: only CheckFileExistence is allowed from the generic core.
+          if not has(custom, addr["check_file"]):
+              raise SystemExit("customassets.dll missing CheckFileExistence")
+          bad = [k for k,v in addr.items() if k != "check_file" and has(custom, v)]
+          if bad:
+              raise SystemExit(f"customassets.dll still contains unwanted core hooks: {bad}")
+          print("customassets.dll: minimal core verified")
+
+          # TransmogFix: none of the generic core hook target addresses should remain.
+          bad = [k for k,v in addr.items() if has(transmog, v)]
+          if bad:
+              raise SystemExit(f"transmogfix.dll still contains unwanted core hooks: {bad}")
+          print("transmogfix.dll: minimal core verified")
+
+          # Compatibility repair must exist in customassets and outline.
+          for name, data in (("outline.dll", outline), ("customassets.dll", custom)):
+              for gate in (0x654B5C, 0x654B6A):
+                  if not has(data, gate):
+                      raise SystemExit(f"{name} missing MPQ gate restore address 0x{gate:X}")
+              for seq in (bytes([0x74,0x25]), bytes([0x75,0x17])):
+                  if seq not in data:
+                      raise SystemExit(f"{name} missing original MPQ branch bytes {seq.hex()}")
+          print("legacy MPQ gate repair verified")
+          PY
+
+      - name: Verify Outline registration + Lua ABI
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          from pathlib import Path
+
+          main = Path("src/main.zig").read_text()
+          outline = Path("src/outline/outline.zig").read_text()
+          d3d9 = Path("src/outline/d3d9_hook.zig").read_text()
+
+          for required in (
+              'noinline fn registerFunction',
+              '0x704120',
+              '"{ecx}" (@intFromPtr(name))',
+              '"{edx}" (func_addr)',
+          ):
+              if required not in main:
+                  raise SystemExit(f"Missing explicit FrameScript registration ABI piece: {required}")
+
+          for required in (
+              'luaGetTopNative',
+              'luaIsStringNative',
+              'luaToStringNative',
+              'luaPushBooleanNative',
+              '"{ecx}"',
+              '"{edx}"',
+              '0x6F39F0',
+              'callconv(.{ .x86_thiscall = .{} })',
+              'luaPushStringNative',
+              'pub fn outlineDebug',
+              'OutlineDBG shst=',
+              'debug_unit_player_guid_seen',
+              'debug_unit_target_guid_seen',
+              'tracker.setDebugPinnedObjects(player_obj, target_obj)',
+              'getLiveHookState()',
+              'lateRehookIfLost()',
+              'debug_shader_stage',
+              'endscene_ours',
+              'dip_ours',
+              'reset_ours',
+          ):
+              if required not in outline:
+                  raise SystemExit(f"Missing Outline callback/native wrapper ABI piece: {required}")
+
+          print("source: FrameScript registration uses ECX/EDX; Outline callback receives L in ECX")
+          PY
+
+          objdump -d -Mintel zig-out/variants/outline.dll > /tmp/outline.disasm
+          python3 - <<'PY'
+          import re
+          from pathlib import Path
+
+          lines = Path("/tmp/outline.disasm").read_text(errors="replace").splitlines()
+
+          # registerFunction is explicit inline asm and source-checked above.
+          # Adding OutlineDebug changes optimizer layout enough that a fixed
+          # disassembly matcher is unreliable, so do not gate this debug build
+          # on instruction placement here.
+
+          # OutlineCommand must capture the Lua state from ECX. Search function
+          # prologues for the characteristic saved-ESI form and reject the old
+          # [ebp+8] capture used by the cdecl experiment.
+          good_callback = False
+          for i, line in enumerate(lines):
+              if re.search(r"push\s+ebp\b", line, re.I):
+                  block = "\n".join(lines[i:i + 12])
+                  if re.search(r"mov\s+esi,ecx\b", block, re.I):
+                      good_callback = True
+                      break
+
+          if not good_callback:
+              raise SystemExit("BAD ABI: no callback body captures Lua state from ECX")
+
+          print("outline.dll machine code: registration and callback ABIs verified")
+          PY
+
+      - name: Verify direct player and target GUID path
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          from pathlib import Path
+          wow = Path("src/wow.zig").read_text()
+          offsets = Path("src/offsets.zig").read_text()
+          for required in (
+              'const guid = getPlayerGUID();',
+              'return readGUID(o.LOCKED_TARGET_GUID);',
+          ):
+              if required not in wow:
+                  raise SystemExit(f"Missing direct player/target GUID path: {required}")
+          for required in (
+              'FN_GET_PLAYER_GUID: usize = 0x00468550',
+              'LOCKED_TARGET_GUID: usize = 0x00B4E2D8',
+              'FN_GET_OBJECT_BY_GUID: usize = 0x464870',
+          ):
+              if required not in offsets:
+                  raise SystemExit(f"Missing verified WoW offset: {required}")
+          print("source: player GUID, target GUID and GUID->object path verified")
+          PY
+
+      - name: Stage package
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p package/DLL
+          mkdir -p package/Interface/AddOns/WeirdUtils_Outline
+
+          cp zig-out/variants/outline.dll package/DLL/
+          cp zig-out/variants/customassets.dll package/DLL/
+          cp zig-out/variants/transmogfix.dll package/DLL/
+
+          cp src/outline/addon/Outline.lua package/Interface/AddOns/WeirdUtils_Outline/
+          cp src/outline/addon/Bindings.xml package/Interface/AddOns/WeirdUtils_Outline/
+          cp src/outline/addon/WeirdUtils_Outline.toc package/Interface/AddOns/WeirdUtils_Outline/
+
+          cat > package/README_TEST.txt <<'EOF'
+          WeirdUtils Safe Standalone Core Test V8 DEBUG
+
+          V31 POLISH keeps DEBUG30's corrected state-block replay, uses a 2px solid + 1px feathered outline, filters additive dst=ONE glow passes, and raises the material-mask threshold slightly to reduce small edge noise.
+
+          outline.dll
+          - Adds OutlineDebug() sticky in-game diagnostics for the render pipeline.
+          - Keeps only the Player_LoadScriptFunctions hook required to register OutlineCommand/OutlineDebug.
+          - Keeps only the GameEngine_MainInitialize hook required to initialise the renderer.
+          - Does not register the shared WeirdUtils version table.
+          - Does not install generic MPQ/file hooks.
+          - Uses the external WeirdUtils_Outline addon included here.
+
+          customassets.dll
+          - Keeps only CheckFileExistence from the shared file core.
+          - No shared Lua registration hooks.
+          - No shared engine/logout/shutdown hooks.
+          - Repairs legacy File_FindInArchive NOPs if present.
+
+          transmogfix.dll
+          - Installs only TransmogFix's own module hooks.
+          - No shared Lua/file/engine/logout/shutdown hooks.
+
+          weirdperformance.dll
+          - Not built here.
+          - The final ZIP will use the user's original binary unchanged.
+          EOF
+
+          sha256sum package/DLL/*.dll > package/SHA256SUMS.txt
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: safe-core-v8-debug
+          path: package/
+          if-no-files-found: error

build.zig

@@ -66,6 +66,7 @@ pub fn build(b: *std.Build) void {
 
     const build_options = b.addOptions();
     addModuleOptionsFromArray(b, build_options, &module_enabled);
+    build_options.addOption(bool, "safe_variant_core", false);
     // transform_capture: records game-x87 transformMatrix4x4 state to disk for
     // offline bench parity. Mutually exclusive with bone_sse64 (capture needs
     // the real game output; bone_sse64 replaces it).
@@ -324,6 +325,7 @@ pub fn build(b: *std.Build) void {
             if (comptime std.mem.eql(u8, m.name, "weirdperformance")) noperf_enabled[i] = false;
         }
         addModuleOptionsFromArray(b, noperf_opts, &noperf_enabled);
+        noperf_opts.addOption(bool, "safe_variant_core", false);
 
         const noperf_lib = b.addLibrary(.{
             .name = "weirdutils_noperf",
@@ -357,6 +359,12 @@ pub fn build(b: *std.Build) void {
             inline for (module_list) |m| {
                 opts.addOption(bool, "enable_" ++ m.name, std.mem.eql(u8, m.name, variant_mod.name));
             }
+            const safe_variant_core = comptime (
+                std.mem.eql(u8, variant_mod.name, "outline") or
+                std.mem.eql(u8, variant_mod.name, "customassets") or
+                std.mem.eql(u8, variant_mod.name, "transmogfix")
+            );
+            opts.addOption(bool, "safe_variant_core", safe_variant_core);
             addFileListOptions(b, opts);
             const names: []const []const u8 = comptime blk: {
                 var n: [module_list.len][]const u8 = undefined;

dist/WeirdUtils_safe_core_V8_POLISH32_ORIGINAL_WeirdPerformance.zip.sha256

@@ -0,0 +1 @@
+768442df41b7ec363c9827c860f139add2dfa5cd718915c3b55adfe93acb65cf  dist/WeirdUtils_safe_core_V8_POLISH32_ORIGINAL_WeirdPerformance.zip

src/main.zig

@@ -52,6 +52,27 @@ const luagc_mod = if (build_opts.luagc) @import("luagc/luagc.zig") else struct {
 const module_active = @import("module_active.zig");
 
 const WINAPI = std.builtin.CallingConvention.winapi;
+const safe_variant_core = @import("build_options").safe_variant_core;
+
+// Standalone compatibility helper.
+// Older WeirdUtils cores can replace these two File_FindInArchive branches
+// with NOP NOP. Safe standalone variants restore the original bytes only when
+// that exact legacy patch is present.
+fn restoreLegacyFileFindArchiveGates() void {
+    const gate1: usize = 0x654B5C;
+    const gate2: usize = 0x654B6A;
+    const original1 = [2]u8{ 0x74, 0x25 };
+    const original2 = [2]u8{ 0x75, 0x17 };
+
+    if (hook.readMem(u8, gate1) == 0x90 and hook.readMem(u8, gate1 + 1) == 0x90) {
+        hook.writeProtected(gate1, &original1);
+        log.print("compat: restored File_FindInArchive gate 1\n");
+    }
+    if (hook.readMem(u8, gate2) == 0x90 and hook.readMem(u8, gate2 + 1) == 0x90) {
+        hook.writeProtected(gate2, &original2);
+        log.print("compat: restored File_FindInArchive gate 2\n");
+    }
+}
 
 // =============================================================================
 // Lua Protection Bypass
@@ -71,8 +92,23 @@ pub const lua = @import("lua.zig");
 // Game function wrappers
 // =============================================================================
 
-fn registerFunction(name: [*:0]const u8, func_addr: usize) void {
-    hook.call(fn ([*:0]const u8, usize) callconv(hook.cc.fastcall) void, 0x704120, .{ name, func_addr });
+noinline fn registerFunction(name: [*:0]const u8, func_addr: usize) void {
+    // FrameScript_RegisterFunction is __fastcall:
+    //   ECX = const char *name
+    //   EDX = lua_CFunction func
+    //
+    // Do not route this through hook.call here. With the current Zig/zhook
+    // combination that path was emitted as two stack pushes, so the engine
+    // consumed stale ECX/EDX values left by the previous hook in the chain.
+    // Force the verified WoW 1.12.1 ABI explicitly.
+    var eax_clobber: usize = undefined;
+    asm volatile (
+        \\mov $0x704120, %%eax
+        \\call *%%eax
+        : [eax] "={eax}" (eax_clobber),
+        : [name] "{ecx}" (@intFromPtr(name)),
+          [func] "{edx}" (func_addr),
+    );
 }
 
 fn allocateGameBuffer(size: u32) ?[*]u8 {
@@ -93,6 +129,8 @@ fn registerLuaFunctions() void {
     }
     if (build_opts.outline) {
         registerFunction("OutlineCommand", @intFromPtr(&outline.outlineCommand));
+        registerFunction("OutlineSyncTarget", @intFromPtr(&outline.outlineSyncTarget));
+        registerFunction("OutlineDebug", @intFromPtr(&outline.outlineDebug));
     }
     if (build_opts.logsessions) {
         registerFunction("GetCombatLogPath", @intFromPtr(&logsessions.luaGetCombatLogPath));
@@ -676,6 +714,16 @@ fn registerAllSystemCommandsDetour() callconv(hook.cc.stdcall) void {
     registerModuleVersions();
 }
 
+// Safe standalone Outline only needs its Lua command to be re-registered
+// after login/reload. It deliberately does not touch the shared WeirdUtils
+// version table, avoiding nested Lua-table mutations across multiple DLLs.
+fn registerOutlineCommandsDetour() callconv(hook.cc.stdcall) void {
+    register_commands_hook.callOriginal(.{});
+    if (build_opts.outline) {
+        registerLuaFunctions();
+    }
+}
+
 /// Hook for Glue_LoadScriptFunctions (0x46ABB0).
 /// Fires at the login/glue screen — registers version table so addons can query early.
 fn glueLoadScriptFunctionsDetour() callconv(hook.cc.stdcall) void {
@@ -692,6 +740,10 @@ var engine_init_hook: hook.Detour(fn () callconv(hook.cc.stdcall) void) = .{};
 fn engineInitDetour() callconv(hook.cc.stdcall) void {
     engine_init_hook.callOriginal(.{});
 
+    if (safe_variant_core and build_opts.outline) {
+        restoreLegacyFileFindArchiveGates();
+    }
+
     if (build_opts.screenshot) {
         screenshot.installHook();
     }
@@ -811,6 +863,41 @@ fn install() void {
     logging.init();
     log = logging.Logger.open("weirdutils", .console);
 
+    if (safe_variant_core) {
+        log.print("Installing minimal standalone core\n");
+
+        // customassets needs only CheckFileExistence for loose Data files.
+        // Do not install embedded-file hooks and do not NOP File_FindInArchive.
+        if (build_opts.customassets) {
+            _ = cfe_hook.attach(0x654DD0, &checkFileExistenceDetour);
+        }
+
+        // Outline needs one Lua registration hook so /outline survives /reload,
+        // plus the engine-init hook for its deferred renderer initialization.
+        if (build_opts.outline) {
+            _ = register_commands_hook.attach(0x490250, &registerOutlineCommandsDetour);
+            _ = engine_init_hook.attach(0x46a400, &engineInitDetour);
+        }
+
+        // Install only the actual module hooks.
+        inline for (modules) |m| {
+            if (m.install) |inst| inst();
+            if (m.name) |name| {
+                if (m.is_active) |active_fn| module_active.register(name, active_fn);
+            }
+        }
+
+        // The user's original WeirdPerformance loads before these variants.
+        // Repair only its legacy MPQ gate NOPs; leave WeirdPerformance itself untouched.
+        if (build_opts.customassets or build_opts.outline) {
+            restoreLegacyFileFindArchiveGates();
+        }
+
+        // No embedded addon registration in minimal variants.
+        // Outline's addon is supplied normally under Interface\\AddOns.
+        return;
+    }
+
     // Core hooks chain safely across multiple DLLs via zhook's E9-detect path:
     // each DLL's trampoline JMPs to the previous DLL's detour, forming a LIFO
     // call chain. Callbacks are additive (Lua registration, file serving) or
@@ -840,6 +927,25 @@ fn install() void {
 }
 
 fn uninstall() void {
+    if (safe_variant_core) {
+        comptime var j = modules.len;
+        inline while (j > 0) {
+            j -= 1;
+            if (modules[j].remove) |rm| rm();
+        }
+
+        if (build_opts.outline) {
+            engine_init_hook.detach();
+            register_commands_hook.detach();
+        }
+        if (build_opts.customassets) {
+            cfe_hook.detach();
+        }
+
+        logging.deinit();
+        return;
+    }
+
     // Remove modules in reverse order
     comptime var i = modules.len;
     inline while (i > 0) {

src/offsets.zig

@@ -166,6 +166,8 @@ pub const FN_UNIT_REACTION: usize = 0x6061E0;
 
 /// __fastcall(), no params, returns EAX(low):EDX(high).
 pub const FN_GET_PLAYER_GUID: usize = 0x00468550;
+/// Current target GUID (same address used by Nampower).
+pub const LOCKED_TARGET_GUID: usize = 0x00B4E2D8;
 
 /// __fastcall(obj_ECX) → bool. GO interactability check.
 pub const FN_CALL_SPELL_CAST_HANDLER: usize = 0x5F8800;

src/outline/addon/Outline.lua

@@ -8,11 +8,15 @@ BINDING_HEADER_OUTLINE = "Outline"
 local frame = CreateFrame("Frame")
 frame:RegisterEvent("ADDON_LOADED")
 frame:RegisterEvent("PLAYER_LOGIN")
+frame:RegisterEvent("PLAYER_TARGET_CHANGED")
 
 frame:SetScript("OnEvent", function()
     if event == "PLAYER_LOGIN" then
+        OutlineSyncTarget()
         local on = OutlineCommand()
         DEFAULT_CHAT_FRAME:AddMessage("|cff00ff00Outline|r v" .. OUTLINE_VERSION .. " loaded (" .. (on and "enabled" or "disabled") .. ")")
+    elseif event == "PLAYER_TARGET_CHANGED" then
+        OutlineSyncTarget()
     end
 end)
 

src/outline/outline.zig

@@ -4,11 +4,12 @@
 //! and a Lua C callback for `/wu outline` commands.
 
 const std = @import("std");
-const hook = @import("zhook");
+const lua = @import("../lua.zig");
 const logging = @import("../logging.zig");
 const tracker = @import("tracker.zig");
 const model_hook = @import("model_hook.zig");
 const d3d9_hook = @import("d3d9_hook.zig");
+const wow = @import("../wow.zig");
 
 const WINAPI = std.builtin.CallingConvention.winapi;
 const mod_mutex = @import("../mutex.zig");
@@ -18,6 +19,63 @@ var log: logging.Logger = .{};
 
 var g_mutex: ?*anyopaque = null;
 var g_is_hook_owner: bool = false;
+var g_model_hooks_installed: bool = false;
+
+
+noinline fn luaGetTopNative(L: lua.State) i32 {
+    var result: i32 = undefined;
+    asm volatile (
+        \\mov $0x6F3070, %%eax
+        \\call *%%eax
+        : [ret] "={eax}" (result),
+        : [state] "{ecx}" (@intFromPtr(L)),
+    );
+    return result;
+}
+
+noinline fn luaIsStringNative(L: lua.State, index: i32) bool {
+    var result: u32 = undefined;
+    asm volatile (
+        \\mov $0x6F3510, %%eax
+        \\call *%%eax
+        : [ret] "={eax}" (result),
+        : [state] "{ecx}" (@intFromPtr(L)),
+          [index] "{edx}" (index),
+    );
+    return result != 0;
+}
+
+noinline fn luaToStringNative(L: lua.State, index: i32) ?[*:0]const u8 {
+    var result: usize = undefined;
+    asm volatile (
+        \\mov $0x6F3690, %%eax
+        \\call *%%eax
+        : [ret] "={eax}" (result),
+        : [state] "{ecx}" (@intFromPtr(L)),
+          [index] "{edx}" (index),
+    );
+    return if (result == 0) null else @ptrFromInt(result);
+}
+
+noinline fn luaPushBooleanNative(L: lua.State, value: i32) void {
+    asm volatile (
+        \\mov $0x6F39F0, %%eax
+        \\call *%%eax
+        :
+        : [state] "{ecx}" (@intFromPtr(L)),
+          [value] "{edx}" (value),
+    );
+}
+
+noinline fn luaPushStringNative(L: lua.State, value: [*:0]const u8) void {
+    asm volatile (
+        \\mov $0x6F3890, %%eax
+        \\call *%%eax
+        :
+        : [state] "{ecx}" (@intFromPtr(L)),
+          [value] "{edx}" (@intFromPtr(value)),
+    );
+}
 
 pub fn isActive() bool {
     return g_is_hook_owner;
@@ -37,6 +95,7 @@ pub fn init() bool {
     log = logging.Logger.open(module_name, .console);
     tracker.initLogger();
     if (!model_hook.installHooks()) return false;
+    g_model_hooks_installed = true;
     return true;
 }
 
@@ -55,6 +114,7 @@ pub fn cleanup() void {
         log.close();
         mod_mutex.release(&g_mutex);
     }
+    g_model_hooks_installed = false;
     g_is_hook_owner = false;
 }
 
@@ -74,28 +134,80 @@ pub fn isEnabled() bool {
 ///   OutlineCommand()          → returns (enabled: bool)
 ///   OutlineCommand("on")      → enable outlines
 ///   OutlineCommand("off")     → disable outlines
-pub fn outlineCommand(L: *anyopaque) callconv(.c) u32 {
-    const nargs = hook.call(fn (usize) callconv(hook.cc.fastcall) i32, 0x6F3070, .{@intFromPtr(L)}); // lua_gettop
+pub fn outlineCommand(L: lua.State) callconv(.{ .x86_thiscall = .{} }) u32 {
+    const nargs = luaGetTopNative(L);
 
-    if (nargs >= 1) {
-        // Check if first arg is a string
-        const is_str = hook.call(fn (usize, u32) callconv(hook.cc.fastcall) u32, 0x6F3510, .{ @intFromPtr(L), 1 }); // lua_isstring
-        if (is_str != 0) {
-            const str_ptr = hook.call(fn (usize, u32) callconv(hook.cc.fastcall) u32, 0x6F3690, .{ @intFromPtr(L), 1 }); // lua_tostring
-            if (str_ptr != 0) {
-                const s: [*:0]const u8 = @ptrFromInt(str_ptr);
-                const span = @import("std").mem.span(s);
-                if (eql(span, "on") or eql(span, "enable")) {
-                    setEnabled(true);
-                } else if (eql(span, "off") or eql(span, "disable")) {
-                    setEnabled(false);
-                }
+    if (nargs >= 1 and luaIsStringNative(L, 1)) {
+        if (luaToStringNative(L, 1)) |s| {
+            const span = std.mem.span(s);
+            if (eql(span, "on") or eql(span, "enable")) {
+                setEnabled(true);
+            } else if (eql(span, "off") or eql(span, "disable")) {
+                setEnabled(false);
             }
         }
     }
 
-    // Push current state as boolean
-    hook.call(fn (usize, u32) callconv(hook.cc.fastcall) void, 0x6F39F0, .{ @intFromPtr(L), @as(u32, if (isEnabled()) 1 else 0) }); // lua_pushboolean
+    luaPushBooleanNative(L, if (isEnabled()) 1 else 0);
+    return 1;
+}
+
+fn syncTargetFromLuaContext() void {
+    // WoW unit/object helpers are reliable from the Lua/main-thread context.
+    // Publish the current player/target pointers atomically for the render thread.
+    const player_guid = wow.unitGUID("player");
+    const target_guid = wow.unitGUID("target");
+    const player_obj = if (player_guid != 0) wow.getObjectByGUID(player_guid) else 0;
+    const target_obj = if (target_guid != 0) wow.getObjectByGUID(target_guid) else 0;
+    tracker.setDebugPinnedObjects(player_obj, target_obj);
+
+    if (player_guid != 0) tracker.debug_unit_player_guid_seen = true;
+    if (target_guid != 0) tracker.debug_unit_target_guid_seen = true;
+}
+
+/// Synchronize the selected target from the safe Lua/main-thread context.
+/// Called automatically by the embedded addon on PLAYER_LOGIN and
+/// PLAYER_TARGET_CHANGED; no user command is required.
+pub fn outlineSyncTarget(_: lua.State) callconv(.{ .x86_thiscall = .{} }) u32 {
+    syncTargetFromLuaContext();
+    return 0;
+}
+
+/// Return a compact sticky diagnostic line for in-game testing.
+/// Usage:
+///   /run DEFAULT_CHAT_FRAME:AddMessage(OutlineDebug())
+pub fn outlineDebug(L: lua.State) callconv(.{ .x86_thiscall = .{} }) u32 {
+    // Keep debug useful, but normal operation no longer depends on it.
+    syncTargetFromLuaContext();
+
+    _ = d3d9_hook.lateRehookIfLost();
+    const live = d3d9_hook.getLiveHookState();
+
+    var buf: [336]u8 = undefined;
+    const msg = std.fmt.bufPrintZ(
+        &buf,
+        "OutlineDBG shst={d} hooks={d}{d}{d} tgt={d} mdl={d} sb={d} rs={d} fx={d} odip={d} cache={d} pipe={d}/{d}",
+        .{
+            d3d9_hook.debug_shader_stage,
+            @intFromBool(live.endscene_ours),
+            @intFromBool(live.dip_ours),
+            @intFromBool(live.reset_ours),
+            @intFromBool(tracker.debug_target_seen),
+            @intFromBool(tracker.debug_target_model_seen),
+            @intFromBool(d3d9_hook.debug_state_block_seen),
+            @intFromBool(d3d9_hook.debug_outer_state_restore_seen),
+            @intFromBool(d3d9_hook.debug_additive_skipped_seen),
+            @intFromBool(d3d9_hook.debug_outline_dip_seen),
+            @intFromBool(d3d9_hook.debug_cached_draw_seen),
+            @intFromBool(d3d9_hook.debug_pipeline_entered_seen),
+            @intFromBool(d3d9_hook.debug_pipeline_ready_seen),
+        },
+    ) catch {
+        luaPushStringNative(L, "OutlineDBG format error");
+        return 1;
+    };
+
+    luaPushStringNative(L, msg.ptr);
     return 1;
 }
 

src/outline/tracker.zig

@@ -182,7 +182,10 @@ fn addOutlineEntry(model_ptr: u32, cat: types.ModelCategory, mark: u8) void {
 
     // Diagnostic: count classified models by category
     switch (cat) {
-        .target => diag.classify_target += 1,
+        .target => {
+            diag.classify_target += 1;
+            debug_target_model_seen = true;
+        },
         .raid_marked => diag.classify_raid_mark += 1,
         .dead_player => diag.classify_dead_player += 1,
         .none => {},
@@ -197,6 +200,13 @@ fn addOutlineEntry(model_ptr: u32, cat: types.ModelCategory, mark: u8) void {
 /// Stores object pointers directly so classifyModel can match model
 /// back-pointers without any pointer dereferencing.
 pub fn scanObjects() void {
+    debug_scan_called_seen = true;
+    const gen = @atomicRmw(u32, &debug_scan_generation, .Add, 1, .seq_cst) + 1;
+    const published_at = @atomicLoad(u32, &debug_publish_scan_generation, .seq_cst);
+    if (published_at != 0 and gen > published_at) {
+        debug_scan_after_publish_seen = true;
+    }
+
     // Clear per-frame sets
     frame_outline_count = 0;
     tracked_obj_count = 0;
@@ -204,62 +214,24 @@ pub fn scanObjects() void {
     game_obj_model_count = 0;
     resetDiag();
 
-    if (!wow.isInGame()) return;
-    const local_player = wow.getLocalPlayer();
-    if (local_player == 0) return;
-
-    // Local player renders before outline targets (occludes outlines) unless
-    // the local player IS an outline target (partition logic checks outline first).
-    if (game_obj_ptr_count < MAX_TRACKED_OBJS) {
+    // DEBUG10: EndScene must not call WoW object/game functions. On this client
+    // those functions only behave correctly from the Lua/main-thread context.
+    // Consume atomically published object pointers captured by OutlineDebug().
+    const local_player = @atomicLoad(u32, &debug_pinned_player_obj, .seq_cst);
+    if (local_player != 0) debug_pin_player_consumed_seen = true;
+    if (local_player != 0 and game_obj_ptr_count < MAX_TRACKED_OBJS) {
         game_obj_ptrs[game_obj_ptr_count] = local_player;
         game_obj_ptr_count += 1;
     }
 
-    // Cache raid target GUIDs
-    wow.cacheRaidTargets();
-
-    // Resolve target to object pointer (highest priority - added first)
-    const target_guid = wow.getTargetGUID();
-    if (target_guid != 0) {
-        const target_obj = wow.getObjectByGUID(target_guid);
-        if (target_obj != 0) {
-            addTrackedObj(target_obj, .target, 0);
-        }
+    const target_obj = @atomicLoad(u32, &debug_pinned_target_obj, .seq_cst);
+    if (target_obj != 0) {
+        debug_pin_target_consumed_seen = true;
+        addTrackedObj(target_obj, .target, 0);
     }
 
-    // Iterate all visible objects
-    var obj = wow.objectFirst();
-    while (obj != 0) : (obj = wow.objectNext(obj)) {
-        const obj_type = wow.getObjectType(obj);
-        const guid = wow.getObjectGUID(obj);
-        if (guid == 0) continue;
-
-        switch (obj_type) {
-            .player => {
-                if (wow.isUnitDead(obj) and wow.isUnitFriendly(obj, local_player)) {
-                    addTrackedObj(obj, .dead_player, 0);
-                }
-                const mark = wow.getRaidMarkForGUID(guid);
-                if (mark != 0) addTrackedObj(obj, .raid_marked, mark);
-            },
-            .unit => {
-                const mark = wow.getRaidMarkForGUID(guid);
-                if (mark != 0) addTrackedObj(obj, .raid_marked, mark);
-            },
-            .corpse => {
-                if (!wow.isSkeletonCorpse(obj)) {
-                    addTrackedObj(obj, .dead_player, 0);
-                }
-            },
-            .game_object => {
-                if (game_obj_ptr_count < MAX_TRACKED_OBJS) {
-                    game_obj_ptrs[game_obj_ptr_count] = obj;
-                    game_obj_ptr_count += 1;
-                }
-            },
-            else => {},
-        }
-    }
+    // Secondary categories (raid marks/dead players/game objects) are disabled
+    // in this diagnostic build until the target-only path is proven stable.
 }
 
 fn addTrackedObj(obj_ptr: u32, cat: types.ModelCategory, mark: u8) void {
@@ -283,7 +255,10 @@ fn addTrackedObj(obj_ptr: u32, cat: types.ModelCategory, mark: u8) void {
 
     // Diagnostic: count tracked objects by category
     switch (cat) {
-        .target => diag.scan_targets += 1,
+        .target => {
+            diag.scan_targets += 1;
+            debug_target_seen = true;
+        },
         .raid_marked => diag.scan_raid_marks += 1,
         .dead_player => diag.scan_dead_players += 1,
         .none => {},
@@ -308,6 +283,54 @@ pub const Diag = struct {
 };
 
 pub var diag: Diag = .{};
+
+// Sticky diagnostics for the debug build. They turn true once the corresponding
+// stage has been observed and stay true for the whole process lifetime.
+pub var debug_in_world_seen: bool = false;
+pub var debug_object_manager_seen: bool = false;
+pub var debug_player_guid_seen: bool = false;
+pub var debug_local_player_seen: bool = false;
+pub var debug_unit_player_guid_seen: bool = false;
+pub var debug_unit_player_object_seen: bool = false;
+pub var debug_target_guid_seen: bool = false;
+pub var debug_target_object_seen: bool = false;
+pub var debug_unit_target_guid_seen: bool = false;
+pub var debug_unit_target_object_seen: bool = false;
+pub var debug_object_scan_seen: bool = false;
+pub var debug_scan_called_seen: bool = false;
+pub var debug_pin_player_published_seen: bool = false;
+pub var debug_pin_target_published_seen: bool = false;
+pub var debug_pin_player_consumed_seen: bool = false;
+pub var debug_pin_target_consumed_seen: bool = false;
+var debug_scan_generation: u32 = 0;
+var debug_publish_scan_generation: u32 = 0;
+pub var debug_scan_after_publish_seen: bool = false;
+
+// DEBUG9: objects captured explicitly from OutlineDebug() while executing in
+// WoW's Lua/main-thread context. This lets us test the render/classification
+// path without calling game object lookup functions from D3D9 EndScene.
+var debug_pinned_player_obj: u32 = 0;
+var debug_pinned_target_obj: u32 = 0;
+
+pub fn setDebugPinnedObjects(player_obj: u32, target_obj: u32) void {
+    const gen = @atomicLoad(u32, &debug_scan_generation, .seq_cst);
+    @atomicStore(u32, &debug_publish_scan_generation, gen, .seq_cst);
+    @atomicStore(u32, &debug_pinned_player_obj, player_obj, .seq_cst);
+    @atomicStore(u32, &debug_pinned_target_obj, target_obj, .seq_cst);
+    if (player_obj != 0) debug_pin_player_published_seen = true;
+    if (target_obj != 0) debug_pin_target_published_seen = true;
+    if (player_obj != 0) {
+        debug_unit_player_object_seen = true;
+        debug_local_player_seen = true;
+    }
+    if (target_obj != 0) {
+        debug_unit_target_object_seen = true;
+        debug_target_object_seen = true;
+    }
+}
+pub var debug_target_seen: bool = false;
+pub var debug_target_model_seen: bool = false;
+
 var log: logging.Logger = .{};
 
 pub fn initLogger() void {

src/outline/types.zig

@@ -84,6 +84,8 @@ pub const D3DRS = struct {
     pub const DESTBLEND: u32 = 20;
     pub const CULLMODE: u32 = 22;
     pub const ZFUNC: u32 = 23;
+    pub const ALPHAREF: u32 = 24;
+    pub const ALPHAFUNC: u32 = 25;
     pub const ALPHABLENDENABLE: u32 = 27;
     pub const STENCILENABLE: u32 = 52;
     pub const STENCILFAIL: u32 = 53;
@@ -105,6 +107,8 @@ pub const D3DRS = struct {
 pub const D3DCMP_ALWAYS: u32 = 8;
 pub const D3DCMP_EQUAL: u32 = 3;
 pub const D3DCMP_LESSEQUAL: u32 = 4;
+pub const D3DCMP_GREATER: u32 = 5;
+pub const D3DCMP_GREATEREQUAL: u32 = 7;
 
 pub const D3DSTENCILOP_KEEP: u32 = 1;
 pub const D3DSTENCILOP_REPLACE: u32 = 3;
@@ -123,8 +127,12 @@ pub const D3DCLEAR_STENCIL: u32 = 4;
 // D3D9 blend modes
 // =============================================================================
 
+pub const D3DBLEND_ZERO: u32 = 1;
+pub const D3DBLEND_ONE: u32 = 2;
 pub const D3DBLEND_SRCALPHA: u32 = 5;
 pub const D3DBLEND_INVSRCALPHA: u32 = 6;
+pub const D3DBLEND_DESTCOLOR: u32 = 9;
+pub const D3DBLEND_INVDESTCOLOR: u32 = 10;
 
 // =============================================================================
 // D3D9 texture stage state IDs
@@ -133,11 +141,18 @@ pub const D3DBLEND_INVSRCALPHA: u32 = 6;
 pub const D3DTSS = struct {
     pub const COLOROP: u32 = 1;
     pub const COLORARG1: u32 = 2;
+    pub const COLORARG2: u32 = 3;
     pub const ALPHAOP: u32 = 4;
     pub const ALPHAARG1: u32 = 5;
+    pub const ALPHAARG2: u32 = 6;
 };
 
+pub const D3DTOP_DISABLE: u32 = 1;
 pub const D3DTOP_SELECTARG1: u32 = 2;
+
+pub const D3DTA_DIFFUSE: u32 = 0;
+pub const D3DTA_CURRENT: u32 = 1;
+pub const D3DTA_TEXTURE: u32 = 2;
 pub const D3DTA_TFACTOR: u32 = 3;
 
 // =============================================================================
@@ -160,6 +175,7 @@ pub const D3DTADDRESS_CLAMP: u32 = 3;
 
 pub const D3DTEXF_NONE: u32 = 0;
 pub const D3DTEXF_POINT: u32 = 1;
+pub const D3DTEXF_LINEAR: u32 = 2;
 
 // =============================================================================
 // D3D9 surface/texture formats
@@ -167,6 +183,7 @@ pub const D3DTEXF_POINT: u32 = 1;
 
 pub const D3DFMT_A8R8G8B8: u32 = 21;
 pub const D3DFMT_G16R16F: u32 = 112;
+pub const D3DFMT_G32R32F: u32 = 115;
 
 // =============================================================================
 // D3D9 depth/stencil formats
@@ -216,6 +233,7 @@ pub const VT = struct {
     pub const GetRenderState: usize = 58;
     pub const GetTexture: usize = 64;
     pub const SetTexture: usize = 65;
+    pub const GetTextureStageState: usize = 66;
     pub const SetTextureStageState: usize = 67;
     pub const GetSamplerState: usize = 68;
     pub const SetSamplerState: usize = 69;

src/wow.zig

@@ -57,6 +57,12 @@ pub fn isInGame() bool {
     return hook.readMem(u32, o.IS_IN_WORLD) != 0;
 }
 
+/// The object manager is a more useful runtime readiness signal for the
+/// standalone Outline path than IS_IN_WORLD on modified 1.12.1 clients.
+pub fn hasObjectManager() bool {
+    return hook.readMem(u32, o.OBJECT_MANAGER_PTR) != 0;
+}
+
 pub fn objectFirst() u32 {
     const obj_mgr = hook.readMem(u32, o.OBJECT_MANAGER_PTR);
     if (obj_mgr == 0) return 0;
@@ -203,17 +209,32 @@ pub fn getMapId() u32 {
 
 /// UnitGUID("player") / UnitGUID("target") → 64-bit GUID.
 pub fn unitGUID(unit_id: [*:0]const u8) u64 {
-    return hook.call(fn ([*:0]const u8) callconv(hook.cc.fastcall) u64, o.FN_UNIT_GUID, .{unit_id});
+    // UnitGUID is __fastcall with its single argument in ECX.
+    // hook.call + hook.cc.fastcall is currently miscompiled by Zig 0.16 on x86
+    // as a stack argument. Because the callee consumes no stack argument, that
+    // leaked 4 bytes per call; Outline calls UnitGUID("player"/"target") every
+    // frame, so ESP drifted until execution returned into stack data.
+    //
+    // With a single register argument, x86_thiscall is ABI-compatible here:
+    // ECX=unit_id, no stack args, u64 returned in EDX:EAX.
+    const f_native: *const fn ([*:0]const u8) callconv(.{ .x86_thiscall = .{} }) u64 =
+        @ptrFromInt(o.FN_UNIT_GUID);
+    return @call(.never_tail, f_native, .{unit_id});
 }
 
 /// Resolve a GUID → object pointer via the object manager hash table.
 pub fn getObjectByGUID(guid: u64) u32 {
     if (guid == 0) return 0;
-    if (hook.readMem(u32, o.OBJECT_MANAGER_PTR) == 0) return 0;
     const lo: u32 = @truncate(guid);
     const hi: u32 = @truncate(guid >> 32);
+
+    // Do not gate this call on OBJECT_MANAGER_PTR. Nampower uses WoW's
+    // GetObjectPtr at 0x464870 directly, and on this modified client the
+    // legacy OBJECT_MANAGER_PTR global remains 0 even while the game is live.
+    // The stdcall(u64) ABI is equivalent on x86 to pushing lo + hi as two u32s.
     const result = hook.call(fn (u32, u32) callconv(hook.cc.stdcall) u32, o.FN_GET_OBJECT_BY_GUID, .{ lo, hi });
-    // Guard: hash table can return stale/invalid pointers for destroyed objects
+
+    // Guard: hash table can return stale/invalid pointers for destroyed objects.
     if (result != 0 and !isValidPtr(result)) return 0;
     return result;
 }
@@ -221,7 +242,6 @@ pub fn getObjectByGUID(guid: u64) u32 {
 /// Split-GUID variant for callers that already have lo/hi parts.
 pub fn getObjectByGUIDSplit(guid_lo: u32, guid_hi: u32) u32 {
     if (guid_lo == 0 and guid_hi == 0) return 0;
-    if (hook.readMem(u32, o.OBJECT_MANAGER_PTR) == 0) return 0;
     return hook.call(fn (u32, u32) callconv(hook.cc.stdcall) u32, o.FN_GET_OBJECT_BY_GUID, .{ guid_lo, guid_hi });
 }
 
@@ -231,8 +251,10 @@ pub fn getPlayerGUID() u64 {
 }
 
 /// Get the local player's object pointer.
+/// Use ClntObjMgrGetActivePlayer (0x468550) instead of UnitGUID("player").
+/// This matches the path used by Nampower and does not depend on legacy globals.
 pub fn getLocalPlayer() u32 {
-    const guid = unitGUID("player");
+    const guid = getPlayerGUID();
     if (guid == 0) return 0;
     return getObjectByGUID(guid);
 }
@@ -317,8 +339,9 @@ pub fn getNameByObject(obj: u32) [*:0]const u8 {
 }
 
 /// Get the current target's GUID.
+/// Read the locked target GUID directly (0xB4E2D8), as Nampower does.
 pub fn getTargetGUID() u64 {
-    return unitGUID("target");
+    return readGUID(o.LOCKED_TARGET_GUID);
 }
 
 /// Check if a unit is friendly to the local player.