From f9bae99c0f2b366007e6d53d86952732a131047e Mon Sep 17 00:00:00 2001
From: paul <paul@hammant.org>
Date: Tue, 10 Nov 2026 00:53:16 +0000
Subject: [PATCH 01/11] tests: portable shell tools, so the shell suite runs on
 OpenBSD

OpenBSD's userland differs from GNU/macOS/FreeBSD in ways a test script
must not depend on, and each showed up as a failure that read as a product
bug:

- tests/lib/syslibs.sh: -ldl and -lrt only on Linux (BSDs and macOS have
  dlopen and shm in libc; the linker fails outright on -ldl there).
- tests/lib/portable.sh: head_c (no head -c), sha256_of (no shasum),
  copy_listed (no tar -T), dyn_syms (nm -D/-gU/-g), file_desc (file prints
  "data" for wasm/COFF/Mach-O and "AArch64"), od_uint (od zero-pads -tu).
- 75 `grep "a\|b"` became `grep -E "a|b"`: OpenBSD's grep reads `\|` as a
  literal pipe, so the warnings filter of ~35 tests let warnings into
  compared output and positive matches never matched.
- `\b`, `\s` became POSIX classes; `grep -r --exclude=NAME` became find.
- http_proxy_direct_equivalence compares Content-Length after the port
  rewrite (the echoed body holds the port; OpenBSD's ephemeral range
  includes four-digit ports).

Co-Authored-By: Claude <noreply@anthropic.com>
---
 ...25917Z-changed-openbsd-test-portability.md |  1 +
 tests/compiler/test_msvc_compat.sh            |  2 +-
 .../integration/abi_matrix/test_abi_matrix.sh |  3 +-
 .../integration/abi_policy/test_abi_policy.sh |  1 +
 .../test_actor_ref_field_reject.sh            |  2 +-
 .../test_actor_state_ref_name_not_type.sh     |  4 +-
 .../test_actor_state_typed_declarations.sh    |  2 +-
 .../test_ae_add_binary_package.sh             |  9 +-
 .../test_ae_add_release_artifact.sh           |  5 +-
 tests/integration/ae_help/test_ae_help.sh     |  3 +-
 .../aea_artifacts/test_aea_artifacts.sh       |  3 +-
 .../test_aether_cfn_proc_address.sh           |  3 +-
 .../test_aether_extern_param_annotation.sh    |  3 +-
 .../test_aether_extern_struct.sh              |  3 +-
 .../test_aether_fnptr_call.sh                 |  3 +-
 .../test_array_field_length.sh                |  2 +-
 .../test_assign_to_call_result.sh             |  2 +-
 .../test_binary_import_ownership.sh           |  1 +
 .../test_cache_key_runtime_headers.sh         |  5 +-
 .../test_call_non_closure_reject.sh           |  4 +-
 .../test_canonical_repo_url.sh                | 13 ++-
 .../test_ci_coverage_smoke.sh                 |  3 +-
 .../test_closure_capture_compound_assign.sh   |  2 +-
 .../test_closure_cell_borrowed_string.sh      |  2 +-
 .../test_closure_destructure_rebind_reject.sh |  2 +-
 .../test_closure_param_reassign.sh            |  2 +-
 .../test_closure_param_shadows_local_type.sh  |  2 +-
 .../test_closure_volatile_array_capture.sh    |  4 +-
 .../test_closure_write_through_capture.sh     |  6 +-
 .../test_condition_continuation_pipe.sh       |  2 +-
 .../test_const_dependency_order.sh            |  4 +-
 .../test_contrib_vulkan_portability.sh        |  2 +-
 .../emit_csrc_cross/test_emit_csrc_cross.sh   | 11 +--
 tests/integration/emit_lib/test_emit_lib.sh   |  3 +-
 .../test_emit_lib_accounts.sh                 |  1 +
 .../test_emit_lib_clause_sets.sh              |  3 +-
 .../test_emit_lib_composite.sh                |  3 +-
 .../test_emit_lib_execution_frame.sh          |  1 +
 .../test_emit_lib_keeps_main.sh               | 10 +--
 .../test_emit_lib_kind_safe.sh                |  3 +-
 .../emit_lib_lists/test_emit_lib_lists.sh     |  3 +-
 .../emit_lib_net/test_emit_lib_net.sh         |  3 +-
 .../test_emit_lib_primitives.sh               |  3 +-
 .../test_emit_lib_typed_ptr.sh                |  3 +-
 .../test_emit_lib_unsupported.sh              |  2 +-
 .../test_emit_lib_windows_dll.sh              |  4 +-
 .../test_emit_lib_with_capability.sh          |  2 +-
 .../test_eval_order_left_to_right.sh          |  2 +-
 .../f32_arithmetic/test_f32_arithmetic.sh     |  2 +-
 .../test_fixed_array_capture_and_state.sh     |  2 +-
 tests/integration/fmt_gate/test_fmt_gate.sh   |  3 +-
 .../test_fn_param_call_dispatch.sh            |  2 +-
 .../test_fs_open_binary_mode.sh               |  2 +-
 .../test_function_clause_string_pattern.sh    |  2 +-
 .../test_host_bridge_import_link.sh           |  2 +-
 .../test_host_child_signal_safe.sh            |  3 +-
 .../test_http_h2_concurrent_dispatch.sh       |  3 +-
 .../test_http_proxy_direct_equivalence.sh     | 29 +++++-
 .../test_http_reverse_proxy.sh                |  3 +-
 .../test_http_script_gateway.sh               |  1 +
 .../test_http_server_chunked_request.sh       |  7 +-
 .../test_http_stream_upload.sh                |  7 +-
 .../test_imported_const_expr_type.sh          |  2 +-
 tests/integration/lane_math/test_lane_math.sh |  2 +-
 .../integration/lane_types/test_lane_types.sh |  2 +-
 tests/integration/lane_wide/test_lane_wide.sh |  2 +-
 .../test_lsp_protocol_roundtrip.sh            |  7 +-
 tests/integration/manifest/test_manifest.sh   |  3 +-
 .../test_match_arm_defer_scope.sh             |  2 +-
 .../test_module_struct_name_collision.sh      |  2 +-
 .../namespace_basic/test_namespace_basic.sh   |  3 +-
 .../test_namespace_multifile.sh               |  3 +-
 tests/integration/notify/test_notify.sh       |  3 +-
 .../test_order_effects_scaling.sh             |  2 +-
 .../test_package_staging_cleanup.sh           |  3 +-
 .../test_packed_array_index_view.sh           |  2 +-
 .../test_packed_array_inline_access.sh        |  2 +-
 .../test_postfix_increment_value.sh           |  2 +-
 .../test_ptr_into_string_error.sh             |  2 +-
 .../test_ptr_return_int_zero_inference.sh     |  6 +-
 .../test_release_contrib_c_modules.sh         |  2 +-
 .../test_runtime_headers_strict_c11.sh        |  2 +-
 .../test_sandbox_child_signal_safe.sh         |  3 +-
 .../test_sandbox_dlopen_dlerror.sh            |  3 +-
 .../test_sandbox_dlopen_libc.sh               |  3 +-
 .../test_sandbox_empty_grants.sh              |  3 +-
 .../test_sandbox_grant_overflow.sh            |  3 +-
 .../test_sandbox_grant_transport.sh           |  3 +-
 .../test_sandbox_nested_libraries.sh          |  1 +
 .../test_sandbox_spawn_family.sh              |  1 +
 .../test_sandbox_unique_shm.sh                |  3 +-
 .../test_select_missing_platform.sh           |  2 +-
 tests/integration/size_mode/test_size_mode.sh | 11 +--
 .../test_sized_array_params_eval_order.sh     |  2 +-
 .../test_slice_raw_view_holds_nothing.sh      |  2 +-
 .../test_spawn_signal_mask_reset.sh           |  3 +-
 .../test_spawn_stdio_inherited.sh             |  3 +-
 .../test_sqlite_amalgamation_fetch.sh         |  3 +-
 .../test_sqlite_vendored_native.sh            |  1 +
 tests/integration/step_word/test_step_word.sh |  1 +
 .../test_struct_argument_mismatch.sh          |  2 +-
 .../test_tcp_connect_timeout.sh               |  2 +-
 .../tcp_listen_on/test_tcp_listen_on.sh       |  2 +-
 .../test_try_written_volatile_c.sh            |  4 +-
 .../wasi_panic_link/test_wasi_panic_link.sh   |  7 +-
 .../test_wasm_emit_lib_exports.sh             |  5 +-
 .../test_written_type_sibling_branch.sh       |  2 +-
 tests/lib/portable.sh                         | 89 +++++++++++++++++++
 tests/lib/syslibs.sh                          | 15 ++++
 tests/run_macos_leaks.sh                      |  2 +-
 110 files changed, 320 insertions(+), 145 deletions(-)
 create mode 100644 new_changelogs/20261109T225917Z-changed-openbsd-test-portability.md
 create mode 100644 tests/lib/portable.sh
 create mode 100644 tests/lib/syslibs.sh

diff --git a/new_changelogs/20261109T225917Z-changed-openbsd-test-portability.md b/new_changelogs/20261109T225917Z-changed-openbsd-test-portability.md
new file mode 100644
index 000000000..87cfdedfc
--- /dev/null
+++ b/new_changelogs/20261109T225917Z-changed-openbsd-test-portability.md
@@ -0,0 +1 @@
+- **The shell test suite runs on OpenBSD** (`tests/lib/portable.sh`, `tests/lib/syslibs.sh`, `tests/lib/test_openssl_conf.sh`, and the tests that use them). Hand-written C link lines name `-ldl`/`-lrt` only on Linux (`$AE_DL_LIBS`, `$AE_RT_LIBS`); `head -c`, `sha256sum`/`shasum`, `tar -T`, `nm -D`, `od -tu` (OpenBSD zero-pads it) and `file` (which prints `data` for wasm, COFF and Mach-O, and `AArch64` for `aarch64`) go through `head_c`, `sha256_of`, `copy_listed`, `dyn_syms`, `od_uint` and `file_desc`; the 75 `grep "a\|b"` alternations, which OpenBSD's grep reads as a literal `|` (so a "warning filter" let warnings into compared output), are `grep -E`; `\b` and `\s` are POSIX classes; `grep -r --exclude` is `find` (OpenBSD matches `--exclude` against the whole path). `x509 -req` is told `-sha256`: LibreSSL signs with SHA-1 by default and the pure TLS stack rightly refuses that. Tests whose subject cannot exist on the host skip and say why: `ae version install` where there is no release build, musl targets where zig cannot build musl's libc.a, dual-stack `::` where sockets are IPv6-only, the poisoning allocator where libc has no `malloc_usable_size`, FORTIFY where libc has no `__*_chk`, `spawn_sandboxed` off Linux and FreeBSD, and the checks that need OpenSSL's `ssl_conf`, `s_server -cert_chain`, `s_client -sigalgs` or Ed25519 certificates in TLS.
diff --git a/tests/compiler/test_msvc_compat.sh b/tests/compiler/test_msvc_compat.sh
index 92755a378..bdbd058a1 100755
--- a/tests/compiler/test_msvc_compat.sh
+++ b/tests/compiler/test_msvc_compat.sh
@@ -483,7 +483,7 @@ if [ -n "$use_gcc" ] && [ "${MSVC_COMPAT_SWEEP:-0}" = 1 ]; then
         for b in "$SWEEP_TMP"/bad_*; do
             n="${b#"$SWEEP_TMP"/bad_}"
             echo "    $(cat "$b")"
-            grep -B1 -A2 "braced-groups\|fatal error" "$SWEEP_TMP/$n.log" 2>/dev/null | head -8 | sed 's/^/      /'
+            grep -B1 -A2 -E "braced-groups|fatal error" "$SWEEP_TMP/$n.log" 2>/dev/null | head -8 | sed 's/^/      /'
         done
         echo "  [FAIL] $bad of the sweep's programs have GCC extensions on the non-GCC path"
         exit 1
diff --git a/tests/integration/abi_matrix/test_abi_matrix.sh b/tests/integration/abi_matrix/test_abi_matrix.sh
index a285aadf4..181092c97 100644
--- a/tests/integration/abi_matrix/test_abi_matrix.sh
+++ b/tests/integration/abi_matrix/test_abi_matrix.sh
@@ -41,6 +41,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 AE="$ROOT/build/ae"
 CC="${CC:-cc}"
 export AETHER_STACK_TRACE=0
@@ -269,7 +270,7 @@ preflight: refused, the library was made for Aether runtime "*) ;;
             esac
             if (cd "$TMP/oldsh" && cp "$SCRIPT_DIR/app.ae" . && AETHER_HOME="$ROOT" "$AE" build app.ae -o app > app_build.log 2>&1); then
                 bad "this importer took the $old_version shared-runtime library"
-            elif ! grep -q "host ABI level 0\|was made for the Aether runtime" "$TMP/oldsh/app_build.log"; then
+            elif ! grep -q -E "host ABI level 0|was made for the Aether runtime" "$TMP/oldsh/app_build.log"; then
                 bad "this importer's refusal of the $old_version shared-runtime library says why" "$TMP/oldsh/app_build.log"
                 grep -A2 '^note: .* could not be loaded' "$TMP/oldsh/app_build.log" | sed 's/^/        /'
             fi
diff --git a/tests/integration/abi_policy/test_abi_policy.sh b/tests/integration/abi_policy/test_abi_policy.sh
index c5a2af230..c36a12d5f 100644
--- a/tests/integration/abi_policy/test_abi_policy.sh
+++ b/tests/integration/abi_policy/test_abi_policy.sh
@@ -17,6 +17,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 AE="$ROOT/build/ae"
 AETHERC="$ROOT/build/aetherc"
 CC="${CC:-cc}"
diff --git a/tests/integration/actor_ref_field_reject/test_actor_ref_field_reject.sh b/tests/integration/actor_ref_field_reject/test_actor_ref_field_reject.sh
index b8431e294..c826caaab 100644
--- a/tests/integration/actor_ref_field_reject/test_actor_ref_field_reject.sh
+++ b/tests/integration/actor_ref_field_reject/test_actor_ref_field_reject.sh
@@ -24,7 +24,7 @@ refused() {
         fail "aetherc accepted $1" "$TMPDIR/err.log"
     fi
     grep -q "$2" "$TMPDIR/err.log" || fail "$1: no error containing '$2'" "$TMPDIR/err.log"
-    if grep -q "request for member\|not a structure or union" "$TMPDIR/err.log"; then
+    if grep -q -E "request for member|not a structure or union" "$TMPDIR/err.log"; then
         fail "$1 reached the C compiler" "$TMPDIR/err.log"
     fi
 }
diff --git a/tests/integration/actor_state_ref_name_not_type/test_actor_state_ref_name_not_type.sh b/tests/integration/actor_state_ref_name_not_type/test_actor_state_ref_name_not_type.sh
index dd6fdf7d1..4941dcc04 100644
--- a/tests/integration/actor_state_ref_name_not_type/test_actor_state_ref_name_not_type.sh
+++ b/tests/integration/actor_state_ref_name_not_type/test_actor_state_ref_name_not_type.sh
@@ -69,7 +69,7 @@ AE
 
 want="v 30
 hops 3 3"
-got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 if [ "$got" != "$want" ]; then
     echo "  [FAIL] actor_state_ref_name_not_type: wrong output"
     printf 'got:\n%s\nwant:\n%s\n' "$got" "$want" | sed 's/^/        /'
@@ -172,7 +172,7 @@ main() {
     println("hits ${s.hits} ${t.hits} tally ${m} greeted ${gh} ${hh}")
 }
 AE
-got="$("$AE" run "$tmp/uses.ae" 2>&1 | tr -d '\r' | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+got="$("$AE" run "$tmp/uses.ae" 2>&1 | tr -d '\r' | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 if [ "$got" != "hits 10 2 tally 42 greeted 1 1" ]; then
     echo "  [FAIL] actor_state_ref_name_not_type: a reference field used from outside the actor"
     printf 'got:\n%s\nwant:\nhits 10 2 tally 42 greeted 1 1\n' "$got" | sed 's/^/        /'
diff --git a/tests/integration/actor_state_typed_declarations/test_actor_state_typed_declarations.sh b/tests/integration/actor_state_typed_declarations/test_actor_state_typed_declarations.sh
index 5ff4674d4..7ae76a1f6 100644
--- a/tests/integration/actor_state_typed_declarations/test_actor_state_typed_declarations.sh
+++ b/tests/integration/actor_state_typed_declarations/test_actor_state_typed_declarations.sh
@@ -74,7 +74,7 @@ AE
 want="b8 4 h16 9
 big 50 null 1
 q null"
-got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 if [ "$got" != "$want" ]; then
     echo "  [FAIL] actor_state_typed_declarations: wrong output"
     printf 'got:\n%s\nwant:\n%s\n' "$got" "$want" | sed 's/^/        /'
diff --git a/tests/integration/ae_add_binary_package/test_ae_add_binary_package.sh b/tests/integration/ae_add_binary_package/test_ae_add_binary_package.sh
index a70eceaa3..0fc7eca39 100755
--- a/tests/integration/ae_add_binary_package/test_ae_add_binary_package.sh
+++ b/tests/integration/ae_add_binary_package/test_ae_add_binary_package.sh
@@ -31,6 +31,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 AE="$ROOT/build/ae"
 [ -n "${EXE_EXT:-}" ] && AE="$AE$EXE_EXT"
 
@@ -43,9 +44,7 @@ case "$(uname -s)" in
     *) command -v curl >/dev/null 2>&1 ||
            { echo "  [SKIP] ae_add_binary_package: curl needed for the file:// forge"; exit 0; } ;;
 esac
-if command -v sha256sum >/dev/null 2>&1; then SHA="sha256sum"
-elif command -v shasum >/dev/null 2>&1; then SHA="shasum -a 256"
-else echo "  [SKIP] ae_add_binary_package: no sha256 tool"; exit 0; fi
+SHA=sha256_of
 
 # The binary-package path is per-host-triple; on a host we can't name a triple
 # for, ae_host_triple() returns NULL and everything correctly falls to git.
@@ -107,7 +106,7 @@ mk_binpkg() {
     asset="$STEM-$tag-$TRIPLE$EXT"
     # A small but real binary payload (not a real dlopen target — this test
     # exercises ae add's FETCH + INSTALL, not loading).
-    head -c 4096 /dev/urandom > "$d/$asset"
+    head_c 4096 /dev/urandom > "$d/$asset"
     if [ "$mode" = "badsum" ]; then
         echo "0000000000000000000000000000000000000000000000000000000000000000  $asset" > "$d/$asset.sha256"
     elif [ "$mode" = "nosum" ]; then
@@ -122,7 +121,7 @@ mk_binpkg() {
         *)            FT="linux-x86_64";  FEXT=".so" ;;
     esac
     fasset="$STEM-$tag-$FT$FEXT"
-    head -c 4096 /dev/urandom > "$d/$fasset"
+    head_c 4096 /dev/urandom > "$d/$fasset"
     ( cd "$d" && $SHA "$fasset" | awk -v n="$fasset" '{print $1"  "n}' > "$fasset.sha256" )
 }
 mk_binpkg v1.0.0 ok
diff --git a/tests/integration/ae_add_release_artifact/test_ae_add_release_artifact.sh b/tests/integration/ae_add_release_artifact/test_ae_add_release_artifact.sh
index 3a5cc9759..f828937e3 100755
--- a/tests/integration/ae_add_release_artifact/test_ae_add_release_artifact.sh
+++ b/tests/integration/ae_add_release_artifact/test_ae_add_release_artifact.sh
@@ -25,6 +25,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 . "$ROOT/tests/lib/server_jobs.sh"
 AE="$ROOT/build/ae"
 [ -n "${EXE_EXT:-}" ] && AE="$AE$EXE_EXT"
@@ -32,9 +33,7 @@ AE="$ROOT/build/ae"
 [ -x "$AE" ] || { echo "  [SKIP] ae_add_release_artifact: ae not built"; exit 0; }
 command -v python3 >/dev/null 2>&1 || { echo "  [SKIP] ae_add_release_artifact: python3 needed to serve fixtures"; exit 0; }
 command -v tar >/dev/null 2>&1 || { echo "  [SKIP] ae_add_release_artifact: tar needed"; exit 0; }
-if command -v sha256sum >/dev/null 2>&1; then SHA="sha256sum"
-elif command -v shasum >/dev/null 2>&1; then SHA="shasum -a 256"
-else echo "  [SKIP] ae_add_release_artifact: no sha256 tool"; exit 0; fi
+SHA=sha256_of
 
 # The artifact path is per-host-triple; on a host we publish no assets
 # for, ae_host_triple() returns NULL and everything correctly falls back
diff --git a/tests/integration/ae_help/test_ae_help.sh b/tests/integration/ae_help/test_ae_help.sh
index 714e014f8..1d928e3f8 100755
--- a/tests/integration/ae_help/test_ae_help.sh
+++ b/tests/integration/ae_help/test_ae_help.sh
@@ -6,6 +6,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 AE="$ROOT/build/ae"
 
 TMPDIR="$(mktemp -d)"
@@ -140,7 +141,7 @@ main() {
 }
 EOF
 out=$("$AE" help "$TMPDIR/json.ae" --json 2>&1)
-first=$(printf '%s' "$out" | head -c 1)
+first=$(printf '%s' "$out" | head_c 1)
 last=$(printf '%s' "$out" | tr -d '\n' | tail -c 1)
 if [ "$first" = "{" ] && [ "$last" = "}" ]; then
     echo "  [PASS] --json emits a single JSON object"
diff --git a/tests/integration/aea_artifacts/test_aea_artifacts.sh b/tests/integration/aea_artifacts/test_aea_artifacts.sh
index 4eadfeb2b..d348060eb 100755
--- a/tests/integration/aea_artifacts/test_aea_artifacts.sh
+++ b/tests/integration/aea_artifacts/test_aea_artifacts.sh
@@ -11,6 +11,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 AETHERC="$ROOT/build/aetherc"
 [ -f "$AETHERC.exe" ] && AETHERC="$AETHERC.exe"
 EXE=""
@@ -187,7 +188,7 @@ if grep -q "not using .*/md2.aea: source changed since the artifact was built" "
 else bad "edited source not detected"; cat "$T/edit_trace.txt"; fi
 
 # 6. A damaged artifact is ignored, not trusted.
-head -c 200 "$MODS/std/cryptography/sha3.aea" > "$T/short.aea"
+head_c 200 "$MODS/std/cryptography/sha3.aea" > "$T/short.aea"
 cp "$T/short.aea" "$MODS/std/cryptography/sha3.aea"
 aec_trace app.ae "$T/damaged.c" 2>"$T/dmg_trace.txt"
 from_source app.ae "$T/damaged_src.c" 2>/dev/null
diff --git a/tests/integration/aether_cfn_proc_address/test_aether_cfn_proc_address.sh b/tests/integration/aether_cfn_proc_address/test_aether_cfn_proc_address.sh
index 6ff91bebd..4e407fac5 100755
--- a/tests/integration/aether_cfn_proc_address/test_aether_cfn_proc_address.sh
+++ b/tests/integration/aether_cfn_proc_address/test_aether_cfn_proc_address.sh
@@ -22,6 +22,7 @@ set -e
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 AETHERC="$ROOT/build/aetherc"
 
 if [ ! -x "$AETHERC" ]; then
@@ -142,7 +143,7 @@ for d in "$ROOT" "$ROOT/runtime" "$ROOT/runtime/actors" "$ROOT/runtime/scheduler
 done
 
 if ! ${CC:-cc} $INCLUDES -o "$tmpdir/app_bin" "$tmpdir/app.gen.c" "$tmpdir/glue.c" \
-        "$ROOT/build/libaether.a" -lpthread -ldl -lm 2>"$tmpdir/cc.err"; then
+        "$ROOT/build/libaether.a" -lpthread $AE_DL_LIBS -lm 2>"$tmpdir/cc.err"; then
     echo "  [FAIL] aether_cfn_proc_address: C compile returned non-zero"
     sed 's/^/    /' "$tmpdir/cc.err"
     exit 1
diff --git a/tests/integration/aether_extern_param_annotation/test_aether_extern_param_annotation.sh b/tests/integration/aether_extern_param_annotation/test_aether_extern_param_annotation.sh
index 1b54a5ee6..51913ed04 100755
--- a/tests/integration/aether_extern_param_annotation/test_aether_extern_param_annotation.sh
+++ b/tests/integration/aether_extern_param_annotation/test_aether_extern_param_annotation.sh
@@ -14,6 +14,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 AETHERC="$ROOT/build/aetherc"
 
 if [ ! -x "$AETHERC" ]; then
@@ -89,7 +90,7 @@ INC=$(find "$PREFIX/include/aether" -type d 2>/dev/null | sed 's|^|-I|' | tr '\n
 ${CC:-cc} -O2 -Wall -Wextra -Werror $INC \
     "$tmpdir/positive.c" "$tmpdir/helper.c" \
     -L"$PREFIX/lib/aether" -laether \
-    -pthread -lm -ldl \
+    -pthread -lm $AE_DL_LIBS \
     -o "$tmpdir/positive" >/dev/null 2>"$tmpdir/link.err" || {
     echo "  [FAIL] positive case link failed"
     head -3 "$tmpdir/link.err"
diff --git a/tests/integration/aether_extern_struct/test_aether_extern_struct.sh b/tests/integration/aether_extern_struct/test_aether_extern_struct.sh
index 932233b69..ca6aa2bad 100755
--- a/tests/integration/aether_extern_struct/test_aether_extern_struct.sh
+++ b/tests/integration/aether_extern_struct/test_aether_extern_struct.sh
@@ -21,6 +21,7 @@ set -e
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 AETHERC="$ROOT/build/aetherc"
 AE="$ROOT/build/ae"
 
@@ -292,7 +293,7 @@ if ! ${CC:-cc} -c -o "$tmpdir/case4_glue.o" "$tmpdir/case4_glue.c" \
     exit 1
 fi
 if ! ${CC:-cc} -o "$tmpdir/case4_bin" "$tmpdir/case4.gen.o" "$tmpdir/case4_glue.o" \
-        "$ROOT/build/libaether.a" -lpthread -ldl -lm 2>"$tmpdir/case4.gcc.err"; then
+        "$ROOT/build/libaether.a" -lpthread $AE_DL_LIBS -lm 2>"$tmpdir/case4.gcc.err"; then
     echo "  [FAIL] case 4: gcc failed linking"
     cat "$tmpdir/case4.gcc.err" | sed 's/^/    /'
     exit 1
diff --git a/tests/integration/aether_fnptr_call/test_aether_fnptr_call.sh b/tests/integration/aether_fnptr_call/test_aether_fnptr_call.sh
index edc240281..29bc18608 100755
--- a/tests/integration/aether_fnptr_call/test_aether_fnptr_call.sh
+++ b/tests/integration/aether_fnptr_call/test_aether_fnptr_call.sh
@@ -18,6 +18,7 @@ set -e
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 AETHERC="$ROOT/build/aetherc"
 
 if [ ! -x "$AETHERC" ]; then
@@ -188,7 +189,7 @@ done
 
 if ! ${CC:-cc} $INCLUDES -o "$tmpdir/case4_bin" \
         "$tmpdir/case4.gen.c" "$tmpdir/case4_glue.c" \
-        "$ROOT/build/libaether.a" -lpthread -ldl -lm 2>"$tmpdir/case4.gcc.err"; then
+        "$ROOT/build/libaether.a" -lpthread $AE_DL_LIBS -lm 2>"$tmpdir/case4.gcc.err"; then
     echo "  [FAIL] case 4: gcc returned non-zero"
     cat "$tmpdir/case4.gcc.err" | sed 's/^/    /'
     exit 1
diff --git a/tests/integration/array_field_length/test_array_field_length.sh b/tests/integration/array_field_length/test_array_field_length.sh
index 5a7379fc8..2eb68582f 100644
--- a/tests/integration/array_field_length/test_array_field_length.sh
+++ b/tests/integration/array_field_length/test_array_field_length.sh
@@ -90,7 +90,7 @@ main() {
     println("${v.xs[3]} ${w.xs[1]} ${w.xs[3]} ${s.names[0]} ${string.length(s.names[2])} ${t.names[2]}")
 }
 AE
-got="$("$AE" run "$tmp/ok.ae" 2>&1 | tr -d '\r' | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+got="$("$AE" run "$tmp/ok.ae" 2>&1 | tr -d '\r' | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 if [ "$got" != "4 6 0 x 0 c" ]; then
     echo "  [FAIL] array_field_length: arrays of the field's length and shorter literals"
     printf 'got:\n%s\nwant:\n4 6 0 x 0 c\n' "$got" | sed 's/^/        /'
diff --git a/tests/integration/assign_to_call_result/test_assign_to_call_result.sh b/tests/integration/assign_to_call_result/test_assign_to_call_result.sh
index 580cd3c03..9186f5875 100644
--- a/tests/integration/assign_to_call_result/test_assign_to_call_result.sh
+++ b/tests/integration/assign_to_call_result/test_assign_to_call_result.sh
@@ -128,7 +128,7 @@ main() {
     println("${q.x} ${q.y} ${g.cells[1]}")
 }
 AE
-got="$("$AE" run good.ae 2>&1 | tr -d '\r' | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+got="$("$AE" run good.ae 2>&1 | tr -d '\r' | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 if [ "$got" != "5 7 20" ]; then
     echo "  [FAIL] assign_to_call_result: an assignment through a returned pointer stopped working"
     printf 'got:\n%s\nwant:\n5 7 20\n' "$got" | sed 's/^/        /'
diff --git a/tests/integration/binary_import_ownership/test_binary_import_ownership.sh b/tests/integration/binary_import_ownership/test_binary_import_ownership.sh
index 5ad24b6e8..5143e6ffe 100644
--- a/tests/integration/binary_import_ownership/test_binary_import_ownership.sh
+++ b/tests/integration/binary_import_ownership/test_binary_import_ownership.sh
@@ -17,6 +17,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 AE="$ROOT/build/ae"
 [ -x "$AE" ] || [ -x "$AE.exe" ] || { echo "  [SKIP] binary_import_ownership: ae not built"; exit 0; }
 CC="${CC:-cc}"
diff --git a/tests/integration/cache_key_runtime_headers/test_cache_key_runtime_headers.sh b/tests/integration/cache_key_runtime_headers/test_cache_key_runtime_headers.sh
index bd50f31d3..fc052ac5b 100644
--- a/tests/integration/cache_key_runtime_headers/test_cache_key_runtime_headers.sh
+++ b/tests/integration/cache_key_runtime_headers/test_cache_key_runtime_headers.sh
@@ -15,6 +15,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 
 fail() { echo "  [FAIL] cache_key_runtime_headers: $1"; exit 1; }
 
@@ -35,8 +36,8 @@ for f in "ae$EXE" "aetherc$EXE" libaether.a aether_manifest.o; do
 done
 # The headers, in one process (each process costs tens of milliseconds on
 # Windows).
-(cd "$ROOT" && find runtime std include -name '*.h' 2>/dev/null | tar cf - -T -) |
-    (cd "$TREE" && tar xf -) || fail "could not copy the headers"
+(cd "$ROOT" && find runtime std include -name '*.h' 2>/dev/null | copy_listed "$TREE") ||
+    fail "could not copy the headers"
 
 AE="$TREE/build/ae$EXE"
 probe="$TREE/runtime/utils/zz_cache_key_probe.h"
diff --git a/tests/integration/call_non_closure_reject/test_call_non_closure_reject.sh b/tests/integration/call_non_closure_reject/test_call_non_closure_reject.sh
index 7c875f9e6..9325e6457 100644
--- a/tests/integration/call_non_closure_reject/test_call_non_closure_reject.sh
+++ b/tests/integration/call_non_closure_reject/test_call_non_closure_reject.sh
@@ -38,7 +38,7 @@ expect_reject() {
     grep -qF "$2" "$1.txt" || fail "$1: missing '$2'" "$1.txt"
     grep -qF -- "--> main.ae:5:10" "$1.txt" || fail "$1: not reported at the argument" "$1.txt"
     grep -qF "$3" "$1.txt" || fail "$1: missing help '$3'" "$1.txt"
-    if grep -q "has no member named\|not a structure or union" "$1.txt"; then
+    if grep -q -E "has no member named|not a structure or union" "$1.txt"; then
         fail "$1: still reported by the C compiler" "$1.txt"
     fi
 }
@@ -105,7 +105,7 @@ main() {
 AE
 want="boxed 4
 2 6 11 6 8"
-got="$("$AE" run main.ae 2>&1 | tr -d '\r' | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+got="$("$AE" run main.ae 2>&1 | tr -d '\r' | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 if [ "$got" != "$want" ]; then
     echo "  [FAIL] call_non_closure_reject: a closure callee stopped working"
     printf 'got:\n%s\nwant:\n%s\n' "$got" "$want" | sed 's/^/        /'
diff --git a/tests/integration/canonical_repo_url/test_canonical_repo_url.sh b/tests/integration/canonical_repo_url/test_canonical_repo_url.sh
index fed56aefb..e288f9a0b 100755
--- a/tests/integration/canonical_repo_url/test_canonical_repo_url.sh
+++ b/tests/integration/canonical_repo_url/test_canonical_repo_url.sh
@@ -33,13 +33,12 @@ STALE_OWNERS="nicolasmd87 aether-lang-${ORG_SUFFIX}"
 hits=""
 for owner in $STALE_OWNERS; do
     stale="$owner/aether"
-    found=$(grep -rn "$stale" \
-            --exclude-dir=.git \
-            --exclude-dir=build \
-            --exclude-dir=target \
-            --exclude=CHANGELOG.md \
-            --exclude=CHANGELOG-archive.md \
-            . 2>/dev/null | grep -Ev '^\.?/?benchmarks/json/corpus/')
+    # find, not `grep -r --exclude`: OpenBSD's grep matches --exclude against
+    # the whole path ("./CHANGELOG.md"), so the changelogs were not excluded.
+    found=$(find . \( -name .git -o -name build -o -name target \) -prune -o \
+            -type f ! -name CHANGELOG.md ! -name CHANGELOG-archive.md \
+            ! -path './benchmarks/json/corpus/*' \
+            -exec grep -n "$stale" /dev/null {} + 2>/dev/null)
     [ -n "$found" ] && hits="${hits}${found}
 "
 done
diff --git a/tests/integration/ci_coverage_smoke/test_ci_coverage_smoke.sh b/tests/integration/ci_coverage_smoke/test_ci_coverage_smoke.sh
index 5b07c6ff5..4da4ad185 100755
--- a/tests/integration/ci_coverage_smoke/test_ci_coverage_smoke.sh
+++ b/tests/integration/ci_coverage_smoke/test_ci_coverage_smoke.sh
@@ -10,6 +10,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 AETHERC="$ROOT/build/aetherc"
 AE="$ROOT/build/ae"
 
@@ -86,7 +87,7 @@ if ! (cd "$tmpdir" && gcc --coverage -O0 -g $INC_FLAGS \
 fi
 if ! (cd "$tmpdir" && gcc --coverage cov_demo.o \
         -L"$PREFIX/lib/aether" -laether \
-        -lpthread -lm -ldl \
+        -lpthread -lm $AE_DL_LIBS \
         -o cov_demo 2>"$tmpdir/link.err"); then
     echo "  [FAIL] ci_coverage_smoke: gcc --coverage link failed"
     head -5 "$tmpdir/link.err"
diff --git a/tests/integration/closure_capture_compound_assign/test_closure_capture_compound_assign.sh b/tests/integration/closure_capture_compound_assign/test_closure_capture_compound_assign.sh
index 9845b0dbc..f21d39acf 100644
--- a/tests/integration/closure_capture_compound_assign/test_closure_capture_compound_assign.sh
+++ b/tests/integration/closure_capture_compound_assign/test_closure_capture_compound_assign.sh
@@ -85,7 +85,7 @@ decl 212
 float 2.5
 count 5
 try 5"
-got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 if [ "$got" != "$want" ]; then
     echo "  [FAIL] closure_capture_compound_assign: wrong values"
     printf 'got:\n%s\nwant:\n%s\n' "$got" "$want" | sed 's/^/        /'
diff --git a/tests/integration/closure_cell_borrowed_string/test_closure_cell_borrowed_string.sh b/tests/integration/closure_cell_borrowed_string/test_closure_cell_borrowed_string.sh
index efbf36586..ef9c89b66 100644
--- a/tests/integration/closure_cell_borrowed_string/test_closure_cell_borrowed_string.sh
+++ b/tests/integration/closure_cell_borrowed_string/test_closure_cell_borrowed_string.sh
@@ -74,7 +74,7 @@ want="3 ab7
 3 ab7
 ab7 ab7? ab7
 ab7/3 ab7"
-got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 if [ "$got" != "$want" ]; then
     echo "  [FAIL] closure_cell_borrowed_string: the caller's string did not survive the closure's store"
     printf 'got:\n%s\nwant:\n%s\n' "$got" "$want" | sed 's/^/        /'
diff --git a/tests/integration/closure_destructure_rebind_reject/test_closure_destructure_rebind_reject.sh b/tests/integration/closure_destructure_rebind_reject/test_closure_destructure_rebind_reject.sh
index 5b1947b1d..07b93ec10 100644
--- a/tests/integration/closure_destructure_rebind_reject/test_closure_destructure_rebind_reject.sh
+++ b/tests/integration/closure_destructure_rebind_reject/test_closure_destructure_rebind_reject.sh
@@ -43,7 +43,7 @@ expect_reject() {
     tr -d '\r' < "$1.log" > "$1.txt"
     grep -qF "$2" "$1.txt" || fail "$1: missing '$2'" "$1.txt"
     grep -qF -- "--> main.ae:$3" "$1.txt" || fail "$1: not reported at the slot ($3)" "$1.txt"
-    if grep -q "makes pointer from integer\|incompatible types" "$1.txt"; then
+    if grep -q -E "makes pointer from integer|incompatible types" "$1.txt"; then
         fail "$1: still reported by the C compiler" "$1.txt"
     fi
 }
diff --git a/tests/integration/closure_param_reassign/test_closure_param_reassign.sh b/tests/integration/closure_param_reassign/test_closure_param_reassign.sh
index 99bd97707..dac0ee228 100644
--- a/tests/integration/closure_param_reassign/test_closure_param_reassign.sh
+++ b/tests/integration/closure_param_reassign/test_closure_param_reassign.sh
@@ -61,7 +61,7 @@ k 12
 in!
 outer
 left 0"
-got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 if [ "$got" != "$want" ]; then
     echo "  [FAIL] closure_param_reassign: wrong output"
     printf 'got:\n%s\nwant:\n%s\n' "$got" "$want" | sed 's/^/        /'
diff --git a/tests/integration/closure_param_shadows_local_type/test_closure_param_shadows_local_type.sh b/tests/integration/closure_param_shadows_local_type/test_closure_param_shadows_local_type.sh
index efd3eceb5..21cd1e569 100644
--- a/tests/integration/closure_param_shadows_local_type/test_closure_param_shadows_local_type.sh
+++ b/tests/integration/closure_param_shadows_local_type/test_closure_param_shadows_local_type.sh
@@ -62,7 +62,7 @@ string-shadow 33
 outer text
 int-shadow 2.5
 outer 7"
-got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 if [ "$got" != "$want" ]; then
     echo "  [FAIL] closure_param_shadows_local_type: wrong output"
     printf 'got:\n%s\nwant:\n%s\n' "$got" "$want" | sed 's/^/        /'
diff --git a/tests/integration/closure_volatile_array_capture/test_closure_volatile_array_capture.sh b/tests/integration/closure_volatile_array_capture/test_closure_volatile_array_capture.sh
index eb35135c4..d4265c45a 100644
--- a/tests/integration/closure_volatile_array_capture/test_closure_volatile_array_capture.sh
+++ b/tests/integration/closure_volatile_array_capture/test_closure_volatile_array_capture.sh
@@ -86,8 +86,8 @@ for src in main.c main_nogcc.c; do
         sed 's/^/    /' "$tmp/cc.log" | head -20
         fail "$src does not compile"
     fi
-    if grep -qi "discards\|volatile" "$tmp/cc.log"; then
-        grep -i "discards\|volatile" "$tmp/cc.log" | sed 's/^/    /' | head -10
+    if grep -qi -E "discards|volatile" "$tmp/cc.log"; then
+        grep -i -E "discards|volatile" "$tmp/cc.log" | sed 's/^/    /' | head -10
         fail "$src: a volatile array is passed where a plain one is expected"
     fi
 done
diff --git a/tests/integration/closure_write_through_capture/test_closure_write_through_capture.sh b/tests/integration/closure_write_through_capture/test_closure_write_through_capture.sh
index 048ac4c33..25471e31a 100644
--- a/tests/integration/closure_write_through_capture/test_closure_write_through_capture.sh
+++ b/tests/integration/closure_write_through_capture/test_closure_write_through_capture.sh
@@ -171,7 +171,7 @@ nested 6 100
 loop 2 2 1 1
 float 4
 string a aab!!"
-got="$("$AE" run "$tmp/arrays.ae" 2>&1 | tr -d '\r' | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+got="$("$AE" run "$tmp/arrays.ae" 2>&1 | tr -d '\r' | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 if [ "$got" != "$want_arrays" ]; then
     echo "  [FAIL] closure_write_through_capture: a write to a captured array did not reach the caller"
     printf 'got:\n%s\nwant:\n%s\n' "$got" "$want_arrays" | sed 's/^/        /'
@@ -212,7 +212,7 @@ main() {
     println("state ${n}")
 }
 AE
-got="$("$AE" run "$tmp/actor.ae" 2>&1 | tr -d '\r' | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+got="$("$AE" run "$tmp/actor.ae" 2>&1 | tr -d '\r' | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 if [ "$got" != "state 704" ]; then
     echo "  [FAIL] closure_write_through_capture: a handler-local array written by a closure"
     printf '%s\n' "$got" | head -5 | sed 's/^/        /'
@@ -252,7 +252,7 @@ field 7 nested 15
 element 9
 rec ab!+ 2
 box n2"
-got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 if [ "$got" != "$want" ]; then
     echo "  [FAIL] closure_write_through_capture: wrong values"
     printf 'got:\n%s\nwant:\n%s\n' "$got" "$want" | sed 's/^/        /'
diff --git a/tests/integration/condition_continuation_pipe/test_condition_continuation_pipe.sh b/tests/integration/condition_continuation_pipe/test_condition_continuation_pipe.sh
index e4ce155e0..963f7cd8a 100755
--- a/tests/integration/condition_continuation_pipe/test_condition_continuation_pipe.sh
+++ b/tests/integration/condition_continuation_pipe/test_condition_continuation_pipe.sh
@@ -26,7 +26,7 @@ log="$tmpdir/cc.log"
 if ! grep -q '^error' "$log"; then
     echo "  [FAIL] leading-|| condition reported no error"
     fail=1
-elif ! grep -qi "closure parameters" "$log" || ! grep -qi "previous line\|parenthesise\|wrapped condition" "$log"; then
+elif ! grep -qi "closure parameters" "$log" || ! grep -Eqi "previous line|parenthesise|wrapped condition" "$log"; then
     echo "  [FAIL] leading-|| error doesn't explain the wrapped-condition cause + fix"
     echo "        got:"; sed 's/^/          /' "$log" | head -4
     fail=1
diff --git a/tests/integration/const_dependency_order/test_const_dependency_order.sh b/tests/integration/const_dependency_order/test_const_dependency_order.sh
index 0a31e3f8a..060c95913 100644
--- a/tests/integration/const_dependency_order/test_const_dependency_order.sh
+++ b/tests/integration/const_dependency_order/test_const_dependency_order.sh
@@ -31,7 +31,7 @@ fail() {
 
 # run <file> <want>
 run() {
-    got="$("$AE" run "$1" 2>&1 | tr -d '\r' | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+    got="$("$AE" run "$1" 2>&1 | tr -d '\r' | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
     if [ "$got" != "$2" ]; then
         printf '  [FAIL] const_dependency_order: %s\ngot:\n%s\nwant:\n%s\n' \
             "$1" "$got" "$2" | sed '2,$s/^/        /'
@@ -89,7 +89,7 @@ expect_cycle() {
     tr -d '\r' < "$1.log" > "$1.txt"
     grep -qF -- "--> $2" "$1.txt" || fail "$1: not reported at $2" "$1.txt"
     grep -qF "$3" "$1.txt" || fail "$1: missing '$3'" "$1.txt"
-    if grep -q "undeclared\|initializer element is not constant" "$1.txt"; then
+    if grep -q -E "undeclared|initializer element is not constant" "$1.txt"; then
         fail "$1: still reported by the C compiler" "$1.txt"
     fi
 }
diff --git a/tests/integration/contrib_vulkan_portability/test_contrib_vulkan_portability.sh b/tests/integration/contrib_vulkan_portability/test_contrib_vulkan_portability.sh
index 060f8241e..c516dd1f7 100755
--- a/tests/integration/contrib_vulkan_portability/test_contrib_vulkan_portability.sh
+++ b/tests/integration/contrib_vulkan_portability/test_contrib_vulkan_portability.sh
@@ -92,7 +92,7 @@ if ! "$NM_WIN" -u "$TMP/win.o" | grep -q 'LoadLibraryA'; then
     echo "        the _WIN32 arm was compiled out"
     exit 1
 fi
-if "$NM_WIN" -u "$TMP/win.o" | grep -q '\bdlopen\b'; then
+if "$NM_WIN" -u "$TMP/win.o" | grep -qE '(^|[^A-Za-z0-9_])dlopen([^A-Za-z0-9_]|$)'; then
     echo "  [FAIL] contrib_vulkan_portability: the Windows object references dlopen"
     exit 1
 fi
diff --git a/tests/integration/emit_csrc_cross/test_emit_csrc_cross.sh b/tests/integration/emit_csrc_cross/test_emit_csrc_cross.sh
index 3f5cebbdf..6777e0868 100755
--- a/tests/integration/emit_csrc_cross/test_emit_csrc_cross.sh
+++ b/tests/integration/emit_csrc_cross/test_emit_csrc_cross.sh
@@ -21,6 +21,7 @@ set -e
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 AE="$ROOT/build/ae"
 SRC="$SCRIPT_DIR/mylib.ae"
 
@@ -86,7 +87,7 @@ if command -v zig >/dev/null 2>&1; then
             fail "--target=$t --emit=obj was rejected"
         fi
         [ -s "$TMP/o_$t.o" ] || fail "no object emitted for $t"
-        desc="$(file "$TMP/o_$t.o")"
+        desc="$(file_desc "$TMP/o_$t.o")"
         case "$desc" in
             *"$want"*) ;;
             *) fail "$t object is not $want format: $desc" ;;
@@ -121,9 +122,9 @@ if command -v zig >/dev/null 2>&1; then
         || fail "wasm32-wasi csrc differs; csrc is meant to be target-neutral"
 
     "$AE" build --target=wasm32-wasi --emit=obj "$SRC" -o "$TMP/wasi.o"         >"$TMP/wasiobj" 2>&1 || { cat "$TMP/wasiobj"; fail "wasm32-wasi --emit=obj was rejected"; }
-    case "$(file "$TMP/wasi.o")" in
+    case "$(file_desc "$TMP/wasi.o")" in
         *WebAssembly*) ;;
-        *) fail "wasm32-wasi object is not a wasm module: $(file "$TMP/wasi.o")" ;;
+        *) fail "wasm32-wasi object is not a wasm module: $(file_desc "$TMP/wasi.o")" ;;
     esac
 
     # A full executable link now WORKS for wasm32-wasi (#1655). It was rejected
@@ -135,9 +136,9 @@ if command -v zig >/dev/null 2>&1; then
         cat "$TMP/wasiexe"
         fail "wasm32-wasi executable link failed"
     fi
-    case "$(file "$TMP/app.wasm")" in
+    case "$(file_desc "$TMP/app.wasm")" in
         *WebAssembly*) ;;
-        *) fail "wasi exe is not a wasm module: $(file "$TMP/app.wasm")" ;;
+        *) fail "wasi exe is not a wasm module: $(file_desc "$TMP/app.wasm")" ;;
     esac
 
     # An ACTOR program must link too. This is the case that caught the real
diff --git a/tests/integration/emit_lib/test_emit_lib.sh b/tests/integration/emit_lib/test_emit_lib.sh
index e85f5927a..cc95023b2 100755
--- a/tests/integration/emit_lib/test_emit_lib.sh
+++ b/tests/integration/emit_lib/test_emit_lib.sh
@@ -5,12 +5,13 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 
 pass=0
 fail=0
 
 # Platform: Linux uses .so, macOS .dylib, Windows .dll (which needs no -ldl)
-LDL="-ldl"
+LDL="$AE_DL_LIBS"
 case "$(uname -s 2>/dev/null)" in
     Darwin) LIB_EXT=".dylib" ;;
     MINGW*|MSYS*|CYGWIN*|Windows_NT) LIB_EXT=".dll"; LDL="" ;;
diff --git a/tests/integration/emit_lib_accounts/test_emit_lib_accounts.sh b/tests/integration/emit_lib_accounts/test_emit_lib_accounts.sh
index cbd4e4fe2..c93ea5d0a 100644
--- a/tests/integration/emit_lib_accounts/test_emit_lib_accounts.sh
+++ b/tests/integration/emit_lib_accounts/test_emit_lib_accounts.sh
@@ -20,6 +20,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 AE="$ROOT/build/ae"
 AETHERC="$ROOT/build/aetherc"
 CC="${CC:-cc}"
diff --git a/tests/integration/emit_lib_clause_sets/test_emit_lib_clause_sets.sh b/tests/integration/emit_lib_clause_sets/test_emit_lib_clause_sets.sh
index 121c6f326..d6d85b044 100644
--- a/tests/integration/emit_lib_clause_sets/test_emit_lib_clause_sets.sh
+++ b/tests/integration/emit_lib_clause_sets/test_emit_lib_clause_sets.sh
@@ -27,6 +27,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 AE="$ROOT/build/ae"
 
 if [ ! -x "$AE" ] && [ ! -x "$AE.exe" ]; then
@@ -34,7 +35,7 @@ if [ ! -x "$AE" ] && [ ! -x "$AE.exe" ]; then
     exit 0
 fi
 
-LDL="-ldl"
+LDL="$AE_DL_LIBS"
 case "$(uname -s 2>/dev/null)" in
     Darwin) LIB_EXT=".dylib" ;;
     MINGW*|MSYS*|CYGWIN*|Windows_NT) LIB_EXT=".dll"; LDL="" ;;
diff --git a/tests/integration/emit_lib_composite/test_emit_lib_composite.sh b/tests/integration/emit_lib_composite/test_emit_lib_composite.sh
index 6c3815060..6774b7083 100755
--- a/tests/integration/emit_lib_composite/test_emit_lib_composite.sh
+++ b/tests/integration/emit_lib_composite/test_emit_lib_composite.sh
@@ -9,6 +9,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 
 LINK_FLAGS=""
 case "$(uname -s 2>/dev/null)" in
@@ -51,7 +52,7 @@ fi
 # Windows the DLL is found beside the consumer; elsewhere through the rpath.
 case "$LIB_EXT" in
     .dll) ;;
-    *)    LINK_FLAGS="-Wl,-rpath,$TMPDIR -ldl" ;;
+    *)    LINK_FLAGS="-Wl,-rpath,$TMPDIR $AE_DL_LIBS" ;;
 esac
 # shellcheck disable=SC2086
 if ! ${CC:-cc} \
diff --git a/tests/integration/emit_lib_execution_frame/test_emit_lib_execution_frame.sh b/tests/integration/emit_lib_execution_frame/test_emit_lib_execution_frame.sh
index 36d21ef2e..d371b5585 100644
--- a/tests/integration/emit_lib_execution_frame/test_emit_lib_execution_frame.sh
+++ b/tests/integration/emit_lib_execution_frame/test_emit_lib_execution_frame.sh
@@ -19,6 +19,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 AE="$ROOT/build/ae"
 AETHERC="$ROOT/build/aetherc"
 CC="${CC:-cc}"
diff --git a/tests/integration/emit_lib_keeps_main/test_emit_lib_keeps_main.sh b/tests/integration/emit_lib_keeps_main/test_emit_lib_keeps_main.sh
index 65bff3abe..e76a7206d 100755
--- a/tests/integration/emit_lib_keeps_main/test_emit_lib_keeps_main.sh
+++ b/tests/integration/emit_lib_keeps_main/test_emit_lib_keeps_main.sh
@@ -44,6 +44,8 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
+. "$ROOT/tests/lib/syslibs.sh"
 AE="$ROOT/build/ae"
 AETHERC="$ROOT/build/aetherc"
 
@@ -60,17 +62,15 @@ pass=0; fail=0
 ok()  { echo "  [PASS] $1"; pass=$((pass + 1)); }
 bad() { echo "  [FAIL] $1"; fail=$((fail + 1)); }
 
-# Dynamic symbols, portably: a DLL's export table (objdump -p), GNU nm -D,
-# else macOS nm -gU (leading '_').
+# Dynamic symbols, portably: a DLL's export table (objdump -p), else
+# dyn_syms (tests/lib/portable.sh: GNU nm -D, macOS nm -gU, OpenBSD nm -g).
 syms() {
     case "$1" in
         *.dll)
             objdump -p "$1" 2>/dev/null | sed -n '/\[Ordinal\/Name Pointer\] Table/,/^$/p'
             return ;;
     esac
-    s="$(nm -D --defined-only "$1" 2>/dev/null || true)"
-    [ -n "$s" ] || s="$(nm -gU "$1" 2>/dev/null || true)"
-    printf '%s\n' "$s"
+    dyn_syms "$1"
 }
 exports() {  # exports <lib> <symbol>
     syms "$1" | grep -E "[[:space:]]_?$2\$" >/dev/null
diff --git a/tests/integration/emit_lib_kind_safe/test_emit_lib_kind_safe.sh b/tests/integration/emit_lib_kind_safe/test_emit_lib_kind_safe.sh
index 8d89279fa..a8e1fada2 100755
--- a/tests/integration/emit_lib_kind_safe/test_emit_lib_kind_safe.sh
+++ b/tests/integration/emit_lib_kind_safe/test_emit_lib_kind_safe.sh
@@ -20,6 +20,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 
 # The host loads the library by path (dlopen, LoadLibrary on Windows) and
 # links it for the aether_value_* accessors. Windows finds the DLL beside
@@ -33,7 +34,7 @@ esac
 TMPDIR="$(mktemp -d)"
 trap 'rm -rf "$TMPDIR"' EXIT
 LINK_FLAGS=""
-[ "$LIB_EXT" = .dll ] || LINK_FLAGS="-Wl,-rpath,$TMPDIR -ldl"
+[ "$LIB_EXT" = .dll ] || LINK_FLAGS="-Wl,-rpath,$TMPDIR $AE_DL_LIBS"
 
 pass=0
 fail=0
diff --git a/tests/integration/emit_lib_lists/test_emit_lib_lists.sh b/tests/integration/emit_lib_lists/test_emit_lib_lists.sh
index 8b3edd340..4ec666be4 100755
--- a/tests/integration/emit_lib_lists/test_emit_lib_lists.sh
+++ b/tests/integration/emit_lib_lists/test_emit_lib_lists.sh
@@ -2,6 +2,7 @@
 # List-return test for --emit=lib.
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 
 # The host loads the library by path (dlopen, LoadLibrary on Windows) and
 # links it; Windows finds the DLL beside the host, with no rpath or -ldl.
@@ -13,7 +14,7 @@ esac
 
 TMPDIR="$(mktemp -d)"; trap 'rm -rf "$TMPDIR"' EXIT
 LINK_FLAGS=""
-[ "$LIB_EXT" = .dll ] || LINK_FLAGS="-Wl,-rpath,$TMPDIR -ldl"
+[ "$LIB_EXT" = .dll ] || LINK_FLAGS="-Wl,-rpath,$TMPDIR $AE_DL_LIBS"
 pass=0; fail=0
 
 cd "$SCRIPT_DIR"
diff --git a/tests/integration/emit_lib_net/test_emit_lib_net.sh b/tests/integration/emit_lib_net/test_emit_lib_net.sh
index 9bf280054..939d0a309 100755
--- a/tests/integration/emit_lib_net/test_emit_lib_net.sh
+++ b/tests/integration/emit_lib_net/test_emit_lib_net.sh
@@ -7,6 +7,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 
 # The driver loads the library by path: dlopen (-ldl on Linux), or
 # LoadLibrary on Windows.
@@ -14,7 +15,7 @@ LDL=""
 case "$(uname -s 2>/dev/null)" in
     MINGW*|MSYS*|CYGWIN*|Windows_NT) LIB_EXT=".dll" ;;
     Darwin) LIB_EXT=".dylib" ;;
-    *)      LIB_EXT=".so"; LDL="-ldl" ;;
+    *)      LIB_EXT=".so"; LDL="$AE_DL_LIBS" ;;
 esac
 
 TMPDIR="$(mktemp -d)"
diff --git a/tests/integration/emit_lib_primitives/test_emit_lib_primitives.sh b/tests/integration/emit_lib_primitives/test_emit_lib_primitives.sh
index a1854d8bc..6f5eeaad3 100755
--- a/tests/integration/emit_lib_primitives/test_emit_lib_primitives.sh
+++ b/tests/integration/emit_lib_primitives/test_emit_lib_primitives.sh
@@ -2,6 +2,7 @@
 # int64/bool/float primitive round-trip for --emit=lib.
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 
 # The host loads the library by path (dlopen, LoadLibrary on Windows) and
 # links it; Windows finds the DLL beside the host, with no rpath or -ldl.
@@ -13,7 +14,7 @@ esac
 
 TMPDIR="$(mktemp -d)"; trap 'rm -rf "$TMPDIR"' EXIT
 LINK_FLAGS=""
-[ "$LIB_EXT" = .dll ] || LINK_FLAGS="-Wl,-rpath,$TMPDIR -ldl"
+[ "$LIB_EXT" = .dll ] || LINK_FLAGS="-Wl,-rpath,$TMPDIR $AE_DL_LIBS"
 pass=0; fail=0
 
 cd "$SCRIPT_DIR"
diff --git a/tests/integration/emit_lib_typed_ptr/test_emit_lib_typed_ptr.sh b/tests/integration/emit_lib_typed_ptr/test_emit_lib_typed_ptr.sh
index 4f42a5694..22b04b27e 100755
--- a/tests/integration/emit_lib_typed_ptr/test_emit_lib_typed_ptr.sh
+++ b/tests/integration/emit_lib_typed_ptr/test_emit_lib_typed_ptr.sh
@@ -8,6 +8,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 
 # The host loads the library by path: dlopen (-ldl on Linux), or
 # LoadLibrary on Windows.
@@ -15,7 +16,7 @@ LDL=""
 case "$(uname -s 2>/dev/null)" in
     MINGW*|MSYS*|CYGWIN*|Windows_NT) LIB_EXT=".dll" ;;
     Darwin) LIB_EXT=".dylib" ;;
-    *)      LIB_EXT=".so"; LDL="-ldl" ;;
+    *)      LIB_EXT=".so"; LDL="$AE_DL_LIBS" ;;
 esac
 
 TMPDIR="$(mktemp -d)"
diff --git a/tests/integration/emit_lib_unsupported/test_emit_lib_unsupported.sh b/tests/integration/emit_lib_unsupported/test_emit_lib_unsupported.sh
index 15b17c2f3..d0de2cd4a 100755
--- a/tests/integration/emit_lib_unsupported/test_emit_lib_unsupported.sh
+++ b/tests/integration/emit_lib_unsupported/test_emit_lib_unsupported.sh
@@ -42,7 +42,7 @@ else
 
     # Check (c) — a warning mentions the skipped function.
     if grep -q "takes_optional" "$TMPDIR/stderr.log" && \
-       grep -q "skipping alias stub\|representable in the" "$TMPDIR/stderr.log"; then
+       grep -q -E "skipping alias stub|representable in the" "$TMPDIR/stderr.log"; then
         echo "  [PASS] warning emitted for unsupported param type"
         pass=$((pass + 1))
     else
diff --git a/tests/integration/emit_lib_windows_dll/test_emit_lib_windows_dll.sh b/tests/integration/emit_lib_windows_dll/test_emit_lib_windows_dll.sh
index ba7adcbc9..dff79da50 100644
--- a/tests/integration/emit_lib_windows_dll/test_emit_lib_windows_dll.sh
+++ b/tests/integration/emit_lib_windows_dll/test_emit_lib_windows_dll.sh
@@ -38,7 +38,7 @@ AE
 #    <root>/build, so name it)
 if ! (cd "$tmp" && "$AE" build --emit=lib mathlib.ae -o "$tmp/libmathlib.dll" > "$tmp/build.log" 2>&1); then
     echo "  [FAIL] emit_lib_windows_dll: ae build --emit=lib failed"
-    grep -i "undefined\|error" "$tmp/build.log" | head -3 | sed 's/^/        /'
+    grep -i -E "undefined|error" "$tmp/build.log" | head -3 | sed 's/^/        /'
     exit 1
 fi
 dll="$(find "$tmp" -name 'libmathlib.dll' | head -1)"
@@ -101,7 +101,7 @@ mkdir -p "$tmp/ns"
 cp "$ROOT/tests/integration/namespace_basic/manifest.ae" "$ROOT/tests/integration/namespace_basic/hello.ae" "$tmp/ns/"
 if ! (cd "$tmp/ns" && AETHER_HOME="$ROOT" "$AE" build --namespace . > "$tmp/ns.log" 2>&1); then
     echo "  [FAIL] emit_lib_windows_dll: ae build --namespace . failed"
-    grep -iv "^\s*$" "$tmp/ns.log" | head -4 | sed 's/^/        /'
+    grep -iv "^[[:space:]]*$" "$tmp/ns.log" | head -4 | sed 's/^/        /'
     fail=1
 elif [ ! -f "$tmp/ns/libgreet.dll" ]; then
     echo "  [FAIL] emit_lib_windows_dll: --namespace did not produce libgreet.dll (named from the manifest)"
diff --git a/tests/integration/emit_lib_with_capability/test_emit_lib_with_capability.sh b/tests/integration/emit_lib_with_capability/test_emit_lib_with_capability.sh
index 5aedf3ddd..1a6ea6836 100755
--- a/tests/integration/emit_lib_with_capability/test_emit_lib_with_capability.sh
+++ b/tests/integration/emit_lib_with_capability/test_emit_lib_with_capability.sh
@@ -40,7 +40,7 @@ run_case() {
             fail=$((fail + 1))
         fi
     else
-        if [ "$rc" -ne 0 ] && grep -q "capability-empty\|--with=" "$TMPDIR/stderr"; then
+        if [ "$rc" -ne 0 ] && grep -q -E "capability-empty|--with=" "$TMPDIR/stderr"; then
             echo "  [PASS] $label"; pass=$((pass + 1))
         else
             echo "  [FAIL] $label — expected reject (rc=$rc, stderr:)"
diff --git a/tests/integration/eval_order_left_to_right/test_eval_order_left_to_right.sh b/tests/integration/eval_order_left_to_right/test_eval_order_left_to_right.sh
index 4f485359d..537108d64 100644
--- a/tests/integration/eval_order_left_to_right/test_eval_order_left_to_right.sh
+++ b/tests/integration/eval_order_left_to_right/test_eval_order_left_to_right.sh
@@ -129,7 +129,7 @@ global 11 23
 closure 55
 pointer 22
 message 12 2"
-got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 if [ "$got" != "$want" ]; then
     echo "  [FAIL] eval_order_left_to_right: operands not evaluated left to right"
     printf 'got:\n%s\nwant:\n%s\n' "$got" "$want" | sed 's/^/        /'
diff --git a/tests/integration/f32_arithmetic/test_f32_arithmetic.sh b/tests/integration/f32_arithmetic/test_f32_arithmetic.sh
index 0fa160e97..ac0e1b490 100644
--- a/tests/integration/f32_arithmetic/test_f32_arithmetic.sh
+++ b/tests/integration/f32_arithmetic/test_f32_arithmetic.sh
@@ -52,7 +52,7 @@ main() {
 }
 AE
 
-got="$("$AE" run "$tmp/main.ae" 2>&1 | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$" | tr '\n' ' ')"
+got="$("$AE" run "$tmp/main.ae" 2>&1 | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$" | tr '\n' ' ')"
 if [ "$got" != "float-exact true 14 1 0.05 0.2 2.15 0.4 0.05 -0.05 0.05 -0.05 true " ]; then
     echo "  [FAIL] f32_arithmetic: program output (got '$got')"
     fail=1
diff --git a/tests/integration/fixed_array_capture_and_state/test_fixed_array_capture_and_state.sh b/tests/integration/fixed_array_capture_and_state/test_fixed_array_capture_and_state.sh
index 2c1c43b1c..3beff01e7 100644
--- a/tests/integration/fixed_array_capture_and_state/test_fixed_array_capture_and_state.sh
+++ b/tests/integration/fixed_array_capture_and_state/test_fixed_array_capture_and_state.sh
@@ -72,7 +72,7 @@ h 4
 pick bo
 outer 1
 state 970"
-got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 if [ "$got" != "$want" ]; then
     echo "  [FAIL] fixed_array_capture_and_state: wrong output"
     printf 'got:\n%s\nwant:\n%s\n' "$got" "$want" | sed 's/^/        /'
diff --git a/tests/integration/fmt_gate/test_fmt_gate.sh b/tests/integration/fmt_gate/test_fmt_gate.sh
index 706e9aa27..fba666ee6 100755
--- a/tests/integration/fmt_gate/test_fmt_gate.sh
+++ b/tests/integration/fmt_gate/test_fmt_gate.sh
@@ -28,6 +28,7 @@
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
 . "$ROOT/tests/lib/same_bytes.sh"
+. "$ROOT/tests/lib/portable.sh"
 AE="$ROOT/build/ae"
 AETHERC="$ROOT/build/aetherc"
 
@@ -157,7 +158,7 @@ find examples tests -name '*.ae' -type f 2>/dev/null | LC_ALL=C sort | \
 # custom_lib_dir/.mylib; and what --check lists is then the sample's path.
 mkdir "$TMPDIR/idem"
 TOTAL=$(awk 'END { print NR }' "$TMPDIR/sample.txt")
-if ! tar cf - -T "$TMPDIR/sample.txt" | (cd "$TMPDIR/idem" && tar xf -) ||
+if ! copy_listed "$TMPDIR/idem" < "$TMPDIR/sample.txt" ||
    [ "$(find "$TMPDIR/idem" -type f | wc -l | tr -d ' ')" != "$TOTAL" ]; then
     echo "  [FAIL] fmt_gate: could not copy the $TOTAL sampled files for the idempotence tier"
     exit 1
diff --git a/tests/integration/fn_param_call_dispatch/test_fn_param_call_dispatch.sh b/tests/integration/fn_param_call_dispatch/test_fn_param_call_dispatch.sh
index 8b046ca03..e0b955a6c 100644
--- a/tests/integration/fn_param_call_dispatch/test_fn_param_call_dispatch.sh
+++ b/tests/integration/fn_param_call_dispatch/test_fn_param_call_dispatch.sh
@@ -63,7 +63,7 @@ twice 3
 twice h 14
 maker's f 5
 k 7"
-got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 if [ "$got" != "$want" ]; then
     echo "  [FAIL] fn_param_call_dispatch: a call on an fn parameter did not go through its value"
     printf 'got:\n%s\nwant:\n%s\n' "$got" "$want" | sed 's/^/        /'
diff --git a/tests/integration/fs_open_binary_mode/test_fs_open_binary_mode.sh b/tests/integration/fs_open_binary_mode/test_fs_open_binary_mode.sh
index bf976449c..e72a2bb62 100644
--- a/tests/integration/fs_open_binary_mode/test_fs_open_binary_mode.sh
+++ b/tests/integration/fs_open_binary_mode/test_fs_open_binary_mode.sh
@@ -72,7 +72,7 @@ pread 6 true
 crlf 6 true
 append  size 8
 wt true '
-got="$(AETHER_HOME="$ROOT" "$AE" run "$tmp/main.ae" -- "$tmp" 2>&1 | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+got="$(AETHER_HOME="$ROOT" "$AE" run "$tmp/main.ae" -- "$tmp" 2>&1 | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 if [ "$got" != "$want" ]; then
     echo "  [FAIL] fs_open_binary_mode: output differs"
     printf '%s\n' "$got" | head -8 | sed 's/^/        /'
diff --git a/tests/integration/function_clause_string_pattern/test_function_clause_string_pattern.sh b/tests/integration/function_clause_string_pattern/test_function_clause_string_pattern.sh
index 6759415a4..85026805c 100644
--- a/tests/integration/function_clause_string_pattern/test_function_clause_string_pattern.sh
+++ b/tests/integration/function_clause_string_pattern/test_function_clause_string_pattern.sh
@@ -45,7 +45,7 @@ hello amy
 quoted
 hi bob!
 1 2 3'
-got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 if [ "$got" != "$want" ]; then
     echo "  [FAIL] function_clause_string_pattern: wrong output"
     printf 'got:\n%s\nwant:\n%s\n' "$got" "$want" | sed 's/^/        /'
diff --git a/tests/integration/host_bridge_import_link/test_host_bridge_import_link.sh b/tests/integration/host_bridge_import_link/test_host_bridge_import_link.sh
index adb91d092..cd1afd657 100755
--- a/tests/integration/host_bridge_import_link/test_host_bridge_import_link.sh
+++ b/tests/integration/host_bridge_import_link/test_host_bridge_import_link.sh
@@ -103,7 +103,7 @@ elif ! grep -q "libaether_host_definitelynothere.a" "$tmpdir/c.log"; then
     echo "  [FAIL] host_bridge_import_link C: error did not name the missing .a"
     sed 's/^/    /' "$tmpdir/c.log" | head -5
     fail=1
-elif ! grep -q "make contrib\|install-contrib" "$tmpdir/c.log"; then
+elif ! grep -q -E "make contrib|install-contrib" "$tmpdir/c.log"; then
     echo "  [FAIL] host_bridge_import_link C: error did not point at remediation"
     sed 's/^/    /' "$tmpdir/c.log" | head -5
     fail=1
diff --git a/tests/integration/host_child_signal_safe/test_host_child_signal_safe.sh b/tests/integration/host_child_signal_safe/test_host_child_signal_safe.sh
index 028d9a632..e60fb39f3 100755
--- a/tests/integration/host_child_signal_safe/test_host_child_signal_safe.sh
+++ b/tests/integration/host_child_signal_safe/test_host_child_signal_safe.sh
@@ -9,6 +9,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 
 case "$(uname -s 2>/dev/null)" in
     Linux) ;;
@@ -42,7 +43,7 @@ if ! ${CC:-cc} $INC -I"$ROOT/contrib/host/aether" \
     # shellcheck disable=SC2086
     if ! ${CC:-cc} $INC -I"$ROOT/contrib/host/aether" \
             -o "$TMP/harness" $SRC "$ROOT/build/libaether.a" \
-            -lpthread -ldl -lm -lrt -lz -lssl -lcrypto 2>"$TMP/cc.err"; then
+            -lpthread $AE_DL_LIBS -lm $AE_RT_LIBS -lz -lssl -lcrypto 2>"$TMP/cc.err"; then
         echo "  [FAIL] could not link the harness against the host and libaether.a"
         sed 's/^/          /' "$TMP/cc.err" | head -8
         exit 1
diff --git a/tests/integration/http_h2_concurrent_dispatch/test_http_h2_concurrent_dispatch.sh b/tests/integration/http_h2_concurrent_dispatch/test_http_h2_concurrent_dispatch.sh
index c4e8c2644..d8429fcec 100755
--- a/tests/integration/http_h2_concurrent_dispatch/test_http_h2_concurrent_dispatch.sh
+++ b/tests/integration/http_h2_concurrent_dispatch/test_http_h2_concurrent_dispatch.sh
@@ -35,6 +35,7 @@ set -e
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 . "$ROOT/tests/lib/wait_port.sh"
 . "$ROOT/tests/lib/server_jobs.sh"
 AE="$ROOT/build/ae"
@@ -147,7 +148,7 @@ run_parallel() {
     while [ $j -lt "$n" ]; do
         if ! grep -q "^slow:s=$j\$" "$PAR_DIR/n$j" 2>/dev/null; then
             echo "  [WARN] parallel x$n stream $j body mismatch on attempt $label:" >&2
-            head -c 200 "$PAR_DIR/n$j" >&2
+            head_c 200 "$PAR_DIR/n$j" >&2
             echo >&2
             return 1
         fi
diff --git a/tests/integration/http_proxy_direct_equivalence/test_http_proxy_direct_equivalence.sh b/tests/integration/http_proxy_direct_equivalence/test_http_proxy_direct_equivalence.sh
index ac2292653..df5b407a0 100755
--- a/tests/integration/http_proxy_direct_equivalence/test_http_proxy_direct_equivalence.sh
+++ b/tests/integration/http_proxy_direct_equivalence/test_http_proxy_direct_equivalence.sh
@@ -14,6 +14,7 @@ set -e
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 AE="$ROOT/build/ae"
 SRC="$ROOT/tests/integration/http_reverse_proxy/server.ae"
 
@@ -35,7 +36,7 @@ if ! AETHER_HOME="$ROOT" "$AE" build "$SRC" -o "$TMPDIR/server" >"$TMPDIR/build.
     echo "  [FAIL] build:"; head -20 "$TMPDIR/build.log"; exit 1
 fi
 
-head -c 2048 /dev/urandom > "$TMPDIR/post.in" 2>/dev/null || \
+head_c 2048 /dev/urandom > "$TMPDIR/post.in" 2>/dev/null || \
     { i=0; while [ $i -lt 64 ]; do printf 'payload-0123456789abcdef'; i=$((i+1)); done > "$TMPDIR/post.in"; }
 
 wait_ready() {
@@ -57,6 +58,14 @@ UP_PID=$!
 wait_ready "$UP_PID" "$TMPDIR/up.log" upstream
 UP_PORT=$(read_ready_port "$TMPDIR/up.log") || exit 1
 
+# fix_length <header-file> <delta>: add delta to the file's Content-Length.
+fix_length() {
+    LC_ALL=C awk -v d="$2" '
+        tolower(substr($0, 1, 15)) == "content-length:" {
+            printf "%s %d\r\n", substr($0, 1, 15), substr($0, 16) + d; next }
+        { print }' "$1" > "$1.norm" && mv "$1.norm" "$1"
+}
+
 # capture <label> — run the proxy and record every response shape.
 capture() {
     label="$1"
@@ -86,10 +95,26 @@ capture() {
     # client dialled. That one number is the only byte that may legitimately
     # differ, so it is replaced in both captures and everything else is still
     # compared exactly.
-    for f in "$TMPDIR/$label".*.h "$TMPDIR/$label".*.b; do
+    #
+    # The echoed body holds that port, so its Content-Length does too: 117
+    # bytes for a five-digit port and 116 for a four-digit one, and a kernel
+    # whose ephemeral range starts below 10000 (OpenBSD's: 1024) hands out
+    # both. The header is corrected by what replacing the port did to the
+    # body, so the length is still compared, to the byte, against the body.
+    for f in "$TMPDIR/$label".*.b; do
         [ -f "$f" ] || continue
         # LC_ALL=C: two of the captured bodies are binary, and BSD sed
         # refuses a byte sequence that is not valid in the ambient locale.
+        old=$(wc -c < "$f" | tr -d ' ')
+        LC_ALL=C sed "s/:$PX_PORT/:PROXY_PORT/g" "$f" > "$f.norm" && mv "$f.norm" "$f"
+        new=$(wc -c < "$f" | tr -d ' ')
+        h="${f%.b}.h"
+        if [ "$new" != "$old" ] && [ -f "$h" ]; then
+            fix_length "$h" $((new - old))
+        fi
+    done
+    for f in "$TMPDIR/$label".*.h; do
+        [ -f "$f" ] || continue
         LC_ALL=C sed "s/:$PX_PORT/:PROXY_PORT/g" "$f" > "$f.norm" && mv "$f.norm" "$f"
     done
 }
diff --git a/tests/integration/http_reverse_proxy/test_http_reverse_proxy.sh b/tests/integration/http_reverse_proxy/test_http_reverse_proxy.sh
index 386789d4e..f9c8f8846 100755
--- a/tests/integration/http_reverse_proxy/test_http_reverse_proxy.sh
+++ b/tests/integration/http_reverse_proxy/test_http_reverse_proxy.sh
@@ -27,6 +27,7 @@ set -e
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 AE="$ROOT/build/ae"
 
 if ! command -v curl >/dev/null 2>&1; then
@@ -201,7 +202,7 @@ fi
 # Test 7 — POST body round-trip.
 BODY_IN="$TMPDIR/post.in"
 BODY_OUT="$TMPDIR/post.out"
-yes 'binary-payload-1234567890' 2>/dev/null | head -c 1024 > "$BODY_IN"
+yes 'binary-payload-1234567890' 2>/dev/null | head_c 1024 > "$BODY_IN"
 curl --silent --show-error --max-time 5 \
      -X POST -H 'Content-Type: application/octet-stream' \
      --data-binary "@$BODY_IN" \
diff --git a/tests/integration/http_script_gateway/test_http_script_gateway.sh b/tests/integration/http_script_gateway/test_http_script_gateway.sh
index da1468750..ae5ba331d 100755
--- a/tests/integration/http_script_gateway/test_http_script_gateway.sh
+++ b/tests/integration/http_script_gateway/test_http_script_gateway.sh
@@ -38,6 +38,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 . "$ROOT/tests/lib/server_jobs.sh"
 AE="$ROOT/build/ae"
 AETHERC="$ROOT/build/aetherc"
diff --git a/tests/integration/http_server_chunked_request/test_http_server_chunked_request.sh b/tests/integration/http_server_chunked_request/test_http_server_chunked_request.sh
index ae6ac8055..2eb557af9 100755
--- a/tests/integration/http_server_chunked_request/test_http_server_chunked_request.sh
+++ b/tests/integration/http_server_chunked_request/test_http_server_chunked_request.sh
@@ -14,6 +14,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 . "$ROOT/tests/lib/server_jobs.sh"
 AE="$ROOT/build/ae"
 PORT=18407
@@ -149,7 +150,7 @@ expect_400 "a Content-Length that is not a number" \
 # into a 256 byte buffer and parsed what fit, so 300 zeros and a 5 read as an
 # empty body here and as five bytes to anything reading the whole value. More
 # digits than any length this server takes is refused, padding or not.
-ZEROS=$(head -c 300 /dev/zero | tr '\0' '0')
+ZEROS=$(head_c 300 /dev/zero | tr '\0' '0')
 expect_400 "a Content-Length of 300 zeros and a 5" \
     "POST /upload HTTP/1.1\r\nHost: x\r\nContent-Length: ${ZEROS}5\r\nConnection: close\r\n\r\nhello"
 
@@ -198,13 +199,13 @@ expect_400 "an obs-fold continuation line" \
 # over-long one used to be copied in anyway, off the end of the stack frame,
 # which any client could reach with a long URL or a long header value. The
 # assertion is as much that the server is still answering afterwards.
-LONG_PATH=$(head -c 5000 /dev/zero | tr '\0' 'A')
+LONG_PATH=$(head_c 5000 /dev/zero | tr '\0' 'A')
 printf 'GET /%s HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n' "$LONG_PATH" > "$TMPDIR/longline.req"
 send "$TMPDIR/longline.req" "$TMPDIR/longline.out"
 grep -q "^HTTP/1.1 414" "$TMPDIR/longline.out" \
     || { head -2 "$TMPDIR/longline.out"; fail "an over-long request line was not answered 414"; }
 
-LONG_HDR=$(head -c 3000 /dev/zero | tr '\0' 'B')
+LONG_HDR=$(head_c 3000 /dev/zero | tr '\0' 'B')
 printf 'GET /upload HTTP/1.1\r\nHost: x\r\nX-Long: %s\r\nConnection: close\r\n\r\n' "$LONG_HDR" > "$TMPDIR/longhdr.req"
 send "$TMPDIR/longhdr.req" "$TMPDIR/longhdr.out"
 grep -q "^HTTP/1.1 431" "$TMPDIR/longhdr.out" \
diff --git a/tests/integration/http_stream_upload/test_http_stream_upload.sh b/tests/integration/http_stream_upload/test_http_stream_upload.sh
index 2cb816297..ea92f590d 100755
--- a/tests/integration/http_stream_upload/test_http_stream_upload.sh
+++ b/tests/integration/http_stream_upload/test_http_stream_upload.sh
@@ -20,12 +20,13 @@
 set -e
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 . "$ROOT/tests/lib/wait_port.sh"
 . "$ROOT/tests/lib/server_jobs.sh"
 AE="$ROOT/build/ae"
 
 command -v curl >/dev/null 2>&1 || { echo "  [SKIP] curl not on PATH"; exit 0; }
-command -v sha256sum >/dev/null 2>&1 && SHA=sha256sum || SHA="shasum -a 256"
+SHA=sha256_of
 
 TMPDIR="$(mktemp -d)"
 SRV_PID=""
@@ -38,7 +39,7 @@ trap cleanup EXIT
 # 3 MiB of random bytes — ~192 streaming windows at 64 KiB each, and far
 # beyond anything that fits in the 16 KiB connection buffer.
 PAYLOAD="$TMPDIR/payload.bin"
-head -c 3145728 /dev/urandom > "$PAYLOAD"
+head_c 3145728 /dev/urandom > "$PAYLOAD"
 WANT_SHA=$($SHA "$PAYLOAD" | awk '{print $1}')
 WANT_LEN=$(wc -c < "$PAYLOAD" | tr -d ' ')
 
@@ -146,7 +147,7 @@ fi
 
 # Small (buffered, < 16 KiB) body: complete at entry by construction.
 SMALL="$TMPDIR/small.bin"
-head -c 512 /dev/urandom > "$SMALL"
+head_c 512 /dev/urandom > "$SMALL"
 SMALL_LEN=$(wc -c < "$SMALL" | tr -d ' ')
 RESP3=$(curl --silent --show-error --max-time 10 \
             --data-binary "@$SMALL" \
diff --git a/tests/integration/imported_const_expr_type/test_imported_const_expr_type.sh b/tests/integration/imported_const_expr_type/test_imported_const_expr_type.sh
index a3065f463..cb3c860d9 100644
--- a/tests/integration/imported_const_expr_type/test_imported_const_expr_type.sh
+++ b/tests/integration/imported_const_expr_type/test_imported_const_expr_type.sh
@@ -117,7 +117,7 @@ run() {
     if grep -q "unresolved type in codegen" "$1.txt"; then
         fail "$1: still warns 'unresolved type in codegen'" "$1.txt"
     fi
-    got="$(grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$" "$1.txt")"
+    got="$(grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$" "$1.txt")"
     if [ "$got" != "$2" ]; then
         printf '  [FAIL] imported_const_expr_type: %s\ngot:\n%s\nwant:\n%s\n' \
             "$1" "$got" "$2" | sed '2,$s/^/        /'
diff --git a/tests/integration/lane_math/test_lane_math.sh b/tests/integration/lane_math/test_lane_math.sh
index b89aa6521..45a083484 100644
--- a/tests/integration/lane_math/test_lane_math.sh
+++ b/tests/integration/lane_math/test_lane_math.sh
@@ -61,7 +61,7 @@ main() {
 }
 AE
 
-out="$("$AE" run "$tmp/main.ae" 2>&1 | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+out="$("$AE" run "$tmp/main.ae" 2>&1 | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 expected="sqrt4 3 4 5 1.5
 abs4 3.5 0 14.25
 sqrt2 9 2.5
diff --git a/tests/integration/lane_types/test_lane_types.sh b/tests/integration/lane_types/test_lane_types.sh
index aa2cf1a93..cbd774809 100644
--- a/tests/integration/lane_types/test_lane_types.sh
+++ b/tests/integration/lane_types/test_lane_types.sh
@@ -100,7 +100,7 @@ masks -1 0 true
 splat 0 -1 true
 f64mask 0 -1 true false 4.5
 unary -1 0 -1 -4 -8'
-got="$("$AE" run "$tmp/main.ae" 2>&1 | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+got="$("$AE" run "$tmp/main.ae" 2>&1 | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 if [ "$got" != "$want" ]; then
     echo "  [FAIL] lane_types: program output differs"
     printf '%s\n' "$got" | head -10 | sed 's/^/        /'
diff --git a/tests/integration/lane_wide/test_lane_wide.sh b/tests/integration/lane_wide/test_lane_wide.sh
index 1220ac819..d961a5ee4 100644
--- a/tests/integration/lane_wide/test_lane_wide.sh
+++ b/tests/integration/lane_wide/test_lane_wide.sh
@@ -156,7 +156,7 @@ heap 72 24
 slice 0 1 8 36
 bounds true"
 
-filter() { grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$"; }
+filter() { grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$"; }
 
 out="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | filter)"
 if [ "$out" != "$expected" ]; then
diff --git a/tests/integration/lsp_protocol_roundtrip/test_lsp_protocol_roundtrip.sh b/tests/integration/lsp_protocol_roundtrip/test_lsp_protocol_roundtrip.sh
index 88ac0b16c..f24750cf6 100644
--- a/tests/integration/lsp_protocol_roundtrip/test_lsp_protocol_roundtrip.sh
+++ b/tests/integration/lsp_protocol_roundtrip/test_lsp_protocol_roundtrip.sh
@@ -13,6 +13,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 LSP="$ROOT/build/aether-lsp"
 [ -x "$LSP" ] || LSP="$ROOT/build/aether-lsp.exe"
 if [ ! -x "$LSP" ]; then
@@ -60,18 +61,18 @@ fi
 # what makes the declared length exact.
 first_len="$(tr -d '\r' < "$tmp/out.bin" | sed -n '1s/^Content-Length: \([0-9]*\)$/\1/p')"
 line3="$(tr -d '\r' < "$tmp/out.bin" | sed -n '3p')"
-first_body="$(printf '%s' "$line3" | head -c "${first_len:-0}")"
+first_body="$(printf '%s' "$line3" | head_c "${first_len:-0}")"
 rest="$(printf '%s' "$line3" | tail -c +"$((${first_len:-0} + 1))")"
 case "$rest" in
     ""|Content-Length:*) ;;
     *) echo "  [FAIL] lsp_protocol_roundtrip: the first message's Content-Length ($first_len) does not match its body"
-       printf '%s\n' "$rest" | head -c 80 | sed 's/^/        /'; echo
+       printf '%s\n' "$rest" | head_c 80 | sed 's/^/        /'; echo
        fail=1 ;;
 esac
 
 if ! printf '%s' "$first_body" | grep -q '"id":1,"result":{"capabilities"'; then
     echo "  [FAIL] lsp_protocol_roundtrip: initialize was not answered with capabilities"
-    printf '%s\n' "$first_body" | head -c 200 | sed 's/^/        /'; echo
+    printf '%s\n' "$first_body" | head_c 200 | sed 's/^/        /'; echo
     fail=1
 fi
 if ! grep -q 'textDocument/publishDiagnostics' "$tmp/out.bin"; then
diff --git a/tests/integration/manifest/test_manifest.sh b/tests/integration/manifest/test_manifest.sh
index 133c0379d..c0abb5273 100755
--- a/tests/integration/manifest/test_manifest.sh
+++ b/tests/integration/manifest/test_manifest.sh
@@ -2,6 +2,7 @@
 # Manifest grammar in std.host — namespace(), input, event, bindings.
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 
 # The host loads the library by path (dlopen, LoadLibrary on Windows) and
 # links it; Windows finds the DLL beside the host, with no rpath or -ldl.
@@ -13,7 +14,7 @@ esac
 
 TMPDIR="$(mktemp -d)"; trap 'rm -rf "$TMPDIR"' EXIT
 LINK_FLAGS=""
-[ "$LIB_EXT" = .dll ] || LINK_FLAGS="-Wl,-rpath,$TMPDIR -ldl"
+[ "$LIB_EXT" = .dll ] || LINK_FLAGS="-Wl,-rpath,$TMPDIR $AE_DL_LIBS"
 pass=0; fail=0
 
 cd "$SCRIPT_DIR"
diff --git a/tests/integration/match_arm_defer_scope/test_match_arm_defer_scope.sh b/tests/integration/match_arm_defer_scope/test_match_arm_defer_scope.sh
index 108ba0516..78c361b2d 100644
--- a/tests/integration/match_arm_defer_scope/test_match_arm_defer_scope.sh
+++ b/tests/integration/match_arm_defer_scope/test_match_arm_defer_scope.sh
@@ -93,7 +93,7 @@ ret-defer
 early 1
 early other
 early 0"
-got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 if [ "$got" != "$want" ]; then
     echo "  [FAIL] match_arm_defer_scope: wrong output"
     printf 'got:\n%s\nwant:\n%s\n' "$got" "$want" | sed 's/^/        /'
diff --git a/tests/integration/module_struct_name_collision/test_module_struct_name_collision.sh b/tests/integration/module_struct_name_collision/test_module_struct_name_collision.sh
index 109e39fb1..5ff83ea79 100644
--- a/tests/integration/module_struct_name_collision/test_module_struct_name_collision.sh
+++ b/tests/integration/module_struct_name_collision/test_module_struct_name_collision.sh
@@ -86,7 +86,7 @@ fi
 # declares may be an unprefixed name. Checked against the header, so a name
 # added later is caught before it reaches anyone's program.
 hdr="$ROOT/std/collections/aether_arr_inline.h"
-bad="$(grep -E '^(struct|typedef struct|typedef)' "$hdr" | grep -vE '\bAether[A-Za-z0-9_]+' || true)"
+bad="$(grep -E '^(struct|typedef struct|typedef)' "$hdr" | grep -vE '(^|[^A-Za-z0-9_])Aether[A-Za-z0-9_]+' || true)"
 if [ -n "$bad" ]; then
     echo "  [FAIL] module_struct_name_collision: the injected header declares an unprefixed type"
     printf '%s\n' "$bad" | sed 's/^/        /'
diff --git a/tests/integration/namespace_basic/test_namespace_basic.sh b/tests/integration/namespace_basic/test_namespace_basic.sh
index d0d0bfaf5..0d4d16748 100755
--- a/tests/integration/namespace_basic/test_namespace_basic.sh
+++ b/tests/integration/namespace_basic/test_namespace_basic.sh
@@ -2,6 +2,7 @@
 # Minimal namespace round-trip — manifest + one script.
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 
 case "$(uname -s 2>/dev/null)" in
     Darwin) LIB_EXT=".dylib" ;;
@@ -15,7 +16,7 @@ pass=0; fail=0
 # consume.c loads the library with dlopen, or LoadLibrary on Windows, where
 # the DLL is found beside the consumer and so needs no rpath and no -ldl.
 LINK_FLAGS=""
-[ "$LIB_EXT" = .dll ] || LINK_FLAGS="-Wl,-rpath,$TMPDIR -ldl"
+[ "$LIB_EXT" = .dll ] || LINK_FLAGS="-Wl,-rpath,$TMPDIR $AE_DL_LIBS"
 
 # Copy the manifest+script into TMPDIR so the build artifact lands there
 # and doesn't pollute the source tree.
diff --git a/tests/integration/namespace_multifile/test_namespace_multifile.sh b/tests/integration/namespace_multifile/test_namespace_multifile.sh
index 7e9b7c927..e65463158 100755
--- a/tests/integration/namespace_multifile/test_namespace_multifile.sh
+++ b/tests/integration/namespace_multifile/test_namespace_multifile.sh
@@ -2,6 +2,7 @@
 # Multi-script namespace — three siblings share one manifest.
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 
 case "$(uname -s 2>/dev/null)" in
     Darwin) LIB_EXT=".dylib" ;;
@@ -15,7 +16,7 @@ pass=0; fail=0
 # consume.c loads the library with dlopen, or LoadLibrary on Windows, where
 # the DLL is found beside the consumer and so needs no rpath and no -ldl.
 LINK_FLAGS=""
-[ "$LIB_EXT" = .dll ] || LINK_FLAGS="-Wl,-rpath,$TMPDIR -ldl"
+[ "$LIB_EXT" = .dll ] || LINK_FLAGS="-Wl,-rpath,$TMPDIR $AE_DL_LIBS"
 
 cp "$SCRIPT_DIR"/manifest.ae "$SCRIPT_DIR"/add.ae "$SCRIPT_DIR"/multiply.ae "$SCRIPT_DIR"/subtract.ae "$TMPDIR/"
 
diff --git a/tests/integration/notify/test_notify.sh b/tests/integration/notify/test_notify.sh
index 50c29bf57..18eefb448 100755
--- a/tests/integration/notify/test_notify.sh
+++ b/tests/integration/notify/test_notify.sh
@@ -2,6 +2,7 @@
 # notify() claim-check primitive — Aether script emits, C host receives.
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 
 case "$(uname -s 2>/dev/null)" in
     Darwin) LIB_EXT=".dylib" ;;
@@ -15,7 +16,7 @@ pass=0; fail=0
 # consume.c loads the library with dlopen, or LoadLibrary on Windows, where
 # the DLL is found beside the consumer and so needs no rpath and no -ldl.
 LINK_FLAGS=""
-[ "$LIB_EXT" = .dll ] || LINK_FLAGS="-Wl,-rpath,$TMPDIR -ldl"
+[ "$LIB_EXT" = .dll ] || LINK_FLAGS="-Wl,-rpath,$TMPDIR $AE_DL_LIBS"
 
 cd "$SCRIPT_DIR"
 if ! AETHER_HOME="" "$ROOT/build/ae" build --emit=lib config.ae -o "$TMPDIR/libnotify" >"$TMPDIR/build.log" 2>&1; then
diff --git a/tests/integration/order_effects_scaling/test_order_effects_scaling.sh b/tests/integration/order_effects_scaling/test_order_effects_scaling.sh
index b064fab81..e639ba377 100755
--- a/tests/integration/order_effects_scaling/test_order_effects_scaling.sh
+++ b/tests/integration/order_effects_scaling/test_order_effects_scaling.sh
@@ -117,7 +117,7 @@ if [ "$large" -ge $(( small * 24 )) ]; then
     exit 1
 fi
 # The read of q.n comes first, ahead of the call that writes it.
-if ! grep -q "_eo[0-9]* = \|_AE_SEQ_LET" "$TMPDIR/chain16000.c"; then
+if ! grep -q -E "_eo[0-9]* = |_AE_SEQ_LET" "$TMPDIR/chain16000.c"; then
     echo "  [FAIL] order_effects_scaling: q.n is not evaluated ahead of f0(p, 3)"
     exit 1
 fi
diff --git a/tests/integration/package_staging_cleanup/test_package_staging_cleanup.sh b/tests/integration/package_staging_cleanup/test_package_staging_cleanup.sh
index 2c52b68bb..a6a5fa006 100755
--- a/tests/integration/package_staging_cleanup/test_package_staging_cleanup.sh
+++ b/tests/integration/package_staging_cleanup/test_package_staging_cleanup.sh
@@ -11,6 +11,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 AE="$ROOT/build/ae"
 
 if [ ! -x "$AE" ]; then
@@ -104,7 +105,7 @@ case "$(uname -s)" in
             seg=$((room - 1))
             [ "$seg" -gt 200 ] && seg=200
             [ $((room - seg - 1)) -eq 1 ] && seg=$((seg - 1))
-            long="$long/$(head -c "$seg" /dev/zero | tr '\0' d)"
+            long="$long/$(head_c "$seg" /dev/zero | tr '\0' d)"
         done
         if [ ${#long} -ne 1023 ] || ! mkdir -p "$long" 2>/dev/null; then
             echo "  [SKIP] long temp path: cannot make a 1023-byte directory here"
diff --git a/tests/integration/packed_array_index_view/test_packed_array_index_view.sh b/tests/integration/packed_array_index_view/test_packed_array_index_view.sh
index a39fae8b9..1d12a24b0 100644
--- a/tests/integration/packed_array_index_view/test_packed_array_index_view.sh
+++ b/tests/integration/packed_array_index_view/test_packed_array_index_view.sh
@@ -69,7 +69,7 @@ main() {
 }
 AE
 
-out="$("$AE" run "$tmp/main.ae" 2>&1 | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+out="$("$AE" run "$tmp/main.ae" 2>&1 | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 expected="int 42 84 84
 both 7
 float 2 1.5
diff --git a/tests/integration/packed_array_inline_access/test_packed_array_inline_access.sh b/tests/integration/packed_array_inline_access/test_packed_array_inline_access.sh
index 8bbf928b3..ff388e18e 100644
--- a/tests/integration/packed_array_inline_access/test_packed_array_inline_access.sh
+++ b/tests/integration/packed_array_inline_access/test_packed_array_inline_access.sh
@@ -140,7 +140,7 @@ main() {
 }
 AE
 
-out="$("$AE" run "$tmp/main.ae" 2>&1 | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+out="$("$AE" run "$tmp/main.ae" 2>&1 | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 for want in "same true" "int 42"; do
     if ! printf '%s\n' "$out" | grep -q "^$want$"; then
         echo "  [FAIL] packed_array_inline_access: expected '$want'"
diff --git a/tests/integration/postfix_increment_value/test_postfix_increment_value.sh b/tests/integration/postfix_increment_value/test_postfix_increment_value.sh
index 160ddc800..05f7afd26 100644
--- a/tests/integration/postfix_increment_value/test_postfix_increment_value.sh
+++ b/tests/integration/postfix_increment_value/test_postfix_increment_value.sh
@@ -119,7 +119,7 @@ neg -6 i 7
 old 0
 old 1
 count 2"
-got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+got="$("$AE" run "$tmp/main.ae" 2>&1 | tr -d '\r' | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 if [ "$got" != "$want" ]; then
     echo "  [FAIL] postfix_increment_value: wrong values"
     printf 'got:\n%s\nwant:\n%s\n' "$got" "$want" | sed 's/^/        /'
diff --git a/tests/integration/ptr_into_string_error/test_ptr_into_string_error.sh b/tests/integration/ptr_into_string_error/test_ptr_into_string_error.sh
index 051418ce9..6dcd5d6f3 100755
--- a/tests/integration/ptr_into_string_error/test_ptr_into_string_error.sh
+++ b/tests/integration/ptr_into_string_error/test_ptr_into_string_error.sh
@@ -163,7 +163,7 @@ fi
 compiles_and_runs() {
     name="$1"; want="$2"
     out=$(cd "$TMP" && "$AE" check "$name.ae" 2>&1)
-    if [ $? -ne 0 ] || printf '%s' "$out" | grep -q "E0202\|W1005"; then
+    if [ $? -ne 0 ] || printf '%s' "$out" | grep -q -E "E0202|W1005"; then
         echo "  [FAIL] $name: refused, or reported E0202/W1005"
         echo "$out" | sed 's/^/        /'
         fails=$((fails + 1)); return
diff --git a/tests/integration/ptr_return_int_zero_inference/test_ptr_return_int_zero_inference.sh b/tests/integration/ptr_return_int_zero_inference/test_ptr_return_int_zero_inference.sh
index 6e97325b6..ab68b9519 100755
--- a/tests/integration/ptr_return_int_zero_inference/test_ptr_return_int_zero_inference.sh
+++ b/tests/integration/ptr_return_int_zero_inference/test_ptr_return_int_zero_inference.sh
@@ -24,11 +24,11 @@ fi
 
 body="$(awk '/^void\* maybe_alloc\(int flag\) {/,/^}/' "$out_c")"
 
-if echo "$body" | grep -qE '^int out\b'; then
+if echo "$body" | grep -qE '^int out([^A-Za-z0-9_]|$)'; then
     echo "  [FAIL] ptr_return_int_zero_inference: out still emitted as int (pointer truncation bug)"
     echo "$body" | sed 's/^/          /'
     fail=1
-elif ! echo "$body" | grep -qE '^void\* out\b'; then
+elif ! echo "$body" | grep -qE '^void\* out([^A-Za-z0-9_]|$)'; then
     echo "  [FAIL] ptr_return_int_zero_inference: out not emitted as void* (unexpected shape)"
     echo "$body" | sed 's/^/          /'
     fail=1
@@ -46,7 +46,7 @@ if ! "$AETHERC" "$SCRIPT_DIR/compute_int.ae" "$out_c2" >"$tmpdir/cc2.log" 2>&1;
 fi
 
 body2="$(awk '/^int compute\(int n\) {/,/^}/' "$out_c2")"
-if ! echo "$body2" | grep -qE '^int out\b'; then
+if ! echo "$body2" | grep -qE '^int out([^A-Za-z0-9_]|$)'; then
     echo "  [FAIL] ptr_return_int_zero_inference: int-returning fn lost int out (overzealous widening)"
     echo "$body2" | sed 's/^/          /'
     fail=1
diff --git a/tests/integration/release_contrib_c_modules/test_release_contrib_c_modules.sh b/tests/integration/release_contrib_c_modules/test_release_contrib_c_modules.sh
index 6cc62b6fd..92b817699 100755
--- a/tests/integration/release_contrib_c_modules/test_release_contrib_c_modules.sh
+++ b/tests/integration/release_contrib_c_modules/test_release_contrib_c_modules.sh
@@ -34,7 +34,7 @@ trap 'rm -rf "$TMP" || true' EXIT
 rel="$TMP/release"
 
 if ! sh "$ROOT/scripts/stage-release.sh" "$ROOT/build" "$rel" --contrib-archives > "$TMP/stage.log" 2>&1; then
-    if grep -q "fetch-\(sqlite\|quickjs\)" "$TMP/stage.log"; then
+    if grep -q -E "fetch-(sqlite|quickjs)" "$TMP/stage.log"; then
         echo "  [SKIP] $NAME: the amalgamations could not be fetched (offline?)"
         exit 0
     fi
diff --git a/tests/integration/runtime_headers_strict_c11/test_runtime_headers_strict_c11.sh b/tests/integration/runtime_headers_strict_c11/test_runtime_headers_strict_c11.sh
index a0fd3a332..cce12ee72 100755
--- a/tests/integration/runtime_headers_strict_c11/test_runtime_headers_strict_c11.sh
+++ b/tests/integration/runtime_headers_strict_c11/test_runtime_headers_strict_c11.sh
@@ -46,7 +46,7 @@ for h in $HEADERS; do
             "$TMP/$name.c" > "$TMP/$name.log" 2>&1; then
         echo "  [PASS] $h compiles under -std=c11 -pedantic -Werror"
     else
-        grep -v "In file included\|^ *from " "$TMP/$name.log" | sed 's/^/          /' | head -10
+        grep -v -E "In file included|^ *from " "$TMP/$name.log" | sed 's/^/          /' | head -10
         echo "  [FAIL] $h does not compile under -std=c11 -pedantic -Werror"
         fail=1
     fi
diff --git a/tests/integration/sandbox_child_signal_safe/test_sandbox_child_signal_safe.sh b/tests/integration/sandbox_child_signal_safe/test_sandbox_child_signal_safe.sh
index 0aaa813c6..3cac35780 100755
--- a/tests/integration/sandbox_child_signal_safe/test_sandbox_child_signal_safe.sh
+++ b/tests/integration/sandbox_child_signal_safe/test_sandbox_child_signal_safe.sh
@@ -5,6 +5,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 
 case "$(uname -s 2>/dev/null)" in
     Linux|FreeBSD) ;;
@@ -28,7 +29,7 @@ if ! ${CC:-cc} -o "$TMP/harness" "$SCRIPT_DIR/harness.c" \
         "$ROOT/build/libaether.a" -lpthread -lm 2>"$TMP/cc.err"; then
     # The runtime links more libraries on some platforms; try the full set.
     if ! ${CC:-cc} -o "$TMP/harness" "$SCRIPT_DIR/harness.c" \
-            "$ROOT/build/libaether.a" -lpthread -ldl -lm -lrt -lz -lssl -lcrypto 2>"$TMP/cc.err"; then
+            "$ROOT/build/libaether.a" -lpthread $AE_DL_LIBS -lm $AE_RT_LIBS -lz -lssl -lcrypto 2>"$TMP/cc.err"; then
         echo "  [FAIL] could not link the harness against libaether.a"
         sed 's/^/          /' "$TMP/cc.err" | head -8
         exit 1
diff --git a/tests/integration/sandbox_dlopen_dlerror/test_sandbox_dlopen_dlerror.sh b/tests/integration/sandbox_dlopen_dlerror/test_sandbox_dlopen_dlerror.sh
index 90a4d01d6..fca4f8bf2 100755
--- a/tests/integration/sandbox_dlopen_dlerror/test_sandbox_dlopen_dlerror.sh
+++ b/tests/integration/sandbox_dlopen_dlerror/test_sandbox_dlopen_dlerror.sh
@@ -20,6 +20,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 LIB="$ROOT/build/libaether_sandbox.so"
 
 case "$(uname -s 2>/dev/null)" in
@@ -36,7 +37,7 @@ fi
 TMP="$(cd "$(mktemp -d)" && pwd -P)"
 trap 'rm -rf "$TMP"' EXIT
 if ! ${CC:-cc} -std=c11 -Wall -Wextra -Werror \
-        "$SCRIPT_DIR/probe.c" -o "$TMP/probe" -ldl -pthread; then
+        "$SCRIPT_DIR/probe.c" -o "$TMP/probe" $AE_DL_LIBS -pthread; then
     echo "  [FAIL] sandbox_dlopen_dlerror: probe did not compile"
     exit 1
 fi
diff --git a/tests/integration/sandbox_dlopen_libc/test_sandbox_dlopen_libc.sh b/tests/integration/sandbox_dlopen_libc/test_sandbox_dlopen_libc.sh
index e73103dc7..5a64eabd8 100755
--- a/tests/integration/sandbox_dlopen_libc/test_sandbox_dlopen_libc.sh
+++ b/tests/integration/sandbox_dlopen_libc/test_sandbox_dlopen_libc.sh
@@ -13,6 +13,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 LIB="$ROOT/build/libaether_sandbox.so"
 
 case "$(uname -s 2>/dev/null)" in
@@ -29,7 +30,7 @@ fi
 TMP="$(cd "$(mktemp -d)" && pwd -P)"
 trap 'rm -rf "$TMP"' EXIT
 if ! ${CC:-cc} -std=c11 -Wall -Wextra -Werror \
-        "$SCRIPT_DIR/probe.c" -o "$TMP/probe" -ldl; then
+        "$SCRIPT_DIR/probe.c" -o "$TMP/probe" $AE_DL_LIBS; then
     echo "  [FAIL] sandbox_dlopen_libc: probe did not compile"
     exit 1
 fi
diff --git a/tests/integration/sandbox_empty_grants/test_sandbox_empty_grants.sh b/tests/integration/sandbox_empty_grants/test_sandbox_empty_grants.sh
index c0dd2e07b..1b79c5007 100755
--- a/tests/integration/sandbox_empty_grants/test_sandbox_empty_grants.sh
+++ b/tests/integration/sandbox_empty_grants/test_sandbox_empty_grants.sh
@@ -6,6 +6,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 
 case "$(uname -s 2>/dev/null)" in
     Linux|FreeBSD) ;;
@@ -34,7 +35,7 @@ if ! ${CC:-cc} -std=c11 -Wall -Wextra -Werror \
     if ! ${CC:-cc} -std=c11 -Wall -Wextra -Werror \
             -o "$TMP/harness" "$SCRIPT_DIR/harness.c" \
             "$ROOT/build/libaether.a" \
-            -lpthread -ldl -lm -lrt -lz -lssl -lcrypto 2>"$TMP/cc.err"; then
+            -lpthread $AE_DL_LIBS -lm $AE_RT_LIBS -lz -lssl -lcrypto 2>"$TMP/cc.err"; then
         echo "  [FAIL] sandbox_empty_grants: harness did not link"
         sed 's/^/          /' "$TMP/cc.err" | head -8
         exit 1
diff --git a/tests/integration/sandbox_grant_overflow/test_sandbox_grant_overflow.sh b/tests/integration/sandbox_grant_overflow/test_sandbox_grant_overflow.sh
index d46361744..0e6939ee5 100755
--- a/tests/integration/sandbox_grant_overflow/test_sandbox_grant_overflow.sh
+++ b/tests/integration/sandbox_grant_overflow/test_sandbox_grant_overflow.sh
@@ -4,6 +4,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 
 case "$(uname -s 2>/dev/null)" in
     Linux|FreeBSD) ;;
@@ -21,7 +22,7 @@ trap 'rm -rf "$TMP"' EXIT
 
 built=0
 for san in "-fsanitize=address" ""; do
-    for libs in "-lpthread -lm" "-lpthread -ldl -lm -lrt -lz -lssl -lcrypto"; do
+    for libs in "-lpthread -lm" "-lpthread $AE_DL_LIBS -lm $AE_RT_LIBS -lz -lssl -lcrypto"; do
         # shellcheck disable=SC2086
         if ${CC:-cc} $san -o "$TMP/harness" "$SCRIPT_DIR/harness.c" \
                 "$ROOT/build/libaether.a" $libs 2>"$TMP/cc.err"; then
diff --git a/tests/integration/sandbox_grant_transport/test_sandbox_grant_transport.sh b/tests/integration/sandbox_grant_transport/test_sandbox_grant_transport.sh
index 51f96d438..3ce8aedf7 100755
--- a/tests/integration/sandbox_grant_transport/test_sandbox_grant_transport.sh
+++ b/tests/integration/sandbox_grant_transport/test_sandbox_grant_transport.sh
@@ -4,6 +4,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 
 case "$(uname -s 2>/dev/null)" in
     Linux|FreeBSD) ;;
@@ -26,7 +27,7 @@ if ! ${CC:-cc} -std=c11 -Wall -Wextra -Werror \
     if ! ${CC:-cc} -std=c11 -Wall -Wextra -Werror \
             -o "$TMP/harness" "$SCRIPT_DIR/harness.c" \
             "$ROOT/build/libaether.a" \
-            -lpthread -ldl -lm -lrt -lz -lssl -lcrypto 2>"$TMP/cc.err"; then
+            -lpthread $AE_DL_LIBS -lm $AE_RT_LIBS -lz -lssl -lcrypto 2>"$TMP/cc.err"; then
         echo "  [FAIL] sandbox_grant_transport: harness did not link"
         sed 's/^/          /' "$TMP/cc.err" | head -8
         exit 1
diff --git a/tests/integration/sandbox_nested_libraries/test_sandbox_nested_libraries.sh b/tests/integration/sandbox_nested_libraries/test_sandbox_nested_libraries.sh
index e73cf2454..69256fc34 100644
--- a/tests/integration/sandbox_nested_libraries/test_sandbox_nested_libraries.sh
+++ b/tests/integration/sandbox_nested_libraries/test_sandbox_nested_libraries.sh
@@ -25,6 +25,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 AE="$ROOT/build/ae"
 AETHERC="$ROOT/build/aetherc"
 CC="${CC:-cc}"
diff --git a/tests/integration/sandbox_spawn_family/test_sandbox_spawn_family.sh b/tests/integration/sandbox_spawn_family/test_sandbox_spawn_family.sh
index 434ab2155..262399d20 100644
--- a/tests/integration/sandbox_spawn_family/test_sandbox_spawn_family.sh
+++ b/tests/integration/sandbox_spawn_family/test_sandbox_spawn_family.sh
@@ -30,6 +30,7 @@
 set -e
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 case "$(uname -s 2>/dev/null)" in
     Linux|FreeBSD) ;;
     *)
diff --git a/tests/integration/sandbox_unique_shm/test_sandbox_unique_shm.sh b/tests/integration/sandbox_unique_shm/test_sandbox_unique_shm.sh
index 76e5528be..ca744a043 100755
--- a/tests/integration/sandbox_unique_shm/test_sandbox_unique_shm.sh
+++ b/tests/integration/sandbox_unique_shm/test_sandbox_unique_shm.sh
@@ -5,6 +5,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 
 case "$(uname -s 2>/dev/null)" in
     Linux|FreeBSD) ;;
@@ -29,7 +30,7 @@ if ! ${CC:-cc} -o "$TMP/harness" "$SCRIPT_DIR/harness.c" \
         -lpthread -lm 2>"$TMP/cc.err"; then
     if ! ${CC:-cc} -o "$TMP/harness" "$SCRIPT_DIR/harness.c" \
             "$ROOT/build/libaether.a" -Wl,--wrap=aether_fork \
-            -lpthread -ldl -lm -lrt -lz -lssl -lcrypto 2>"$TMP/cc.err"; then
+            -lpthread $AE_DL_LIBS -lm $AE_RT_LIBS -lz -lssl -lcrypto 2>"$TMP/cc.err"; then
         echo "  [FAIL] could not link the concurrent spawn harness"
         sed 's/^/          /' "$TMP/cc.err" | head -8
         exit 1
diff --git a/tests/integration/select_missing_platform/test_select_missing_platform.sh b/tests/integration/select_missing_platform/test_select_missing_platform.sh
index 812b634b5..c00fdf630 100755
--- a/tests/integration/select_missing_platform/test_select_missing_platform.sh
+++ b/tests/integration/select_missing_platform/test_select_missing_platform.sh
@@ -36,7 +36,7 @@ if [ $rc -eq 0 ]; then
 elif [ "$first" != "$want" ] || [ "$at" != "2:12" ]; then
     echo "  [FAIL] missing: expected '$want' at 2:12, got '$first' at $at"
     fail=1
-elif printf '%s\n' "$out" | grep -a -q '#error\|^error: select'; then
+elif printf '%s\n' "$out" | grep -a -q -E '#error|^error: select'; then
     echo "  [FAIL] missing: the build went on to C:"
     printf '%s\n' "$out" | sed 's/^/        /' | head -8
     fail=1
diff --git a/tests/integration/size_mode/test_size_mode.sh b/tests/integration/size_mode/test_size_mode.sh
index 5ac7fc17b..5d455b2f7 100755
--- a/tests/integration/size_mode/test_size_mode.sh
+++ b/tests/integration/size_mode/test_size_mode.sh
@@ -23,6 +23,7 @@ set -e
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 AE="$ROOT/build/ae"
 
 if [ ! -x "$AE" ]; then
@@ -68,11 +69,7 @@ OUT=$("$TMPDIR_T/app" 2>&1) || { echo "  [FAIL] size_mode: --size binary did not
 # if neither form works -- an inconclusive probe must not masquerade as a
 # regression.
 if "$AE" build --emit=lib --size "$LIB" -o "$TMPDIR_T/lib.so" >/dev/null 2>&1; then
-    SYMS=""
-    case "$(uname -s 2>/dev/null)" in
-        Darwin) SYMS=$(nm -gU "$TMPDIR_T/lib.so" 2>/dev/null || true) ;;
-        *)      SYMS=$(nm -D --defined-only "$TMPDIR_T/lib.so" 2>/dev/null || true) ;;
-    esac
+    SYMS=$(dyn_syms "$TMPDIR_T/lib.so")
     if [ -n "$SYMS" ]; then
         if ! printf '%s' "$SYMS" | grep -q 'safe'; then
             echo "  [FAIL] size_mode: --emit=lib --size dropped the exported symbols"
@@ -124,11 +121,11 @@ if [ "$SIZED_SZ" -ge $((BASE_SZ / 4)) ]; then
 fi
 
 # Smaller is worthless if it is no longer a wasm module.
-case "$(file -b "$SIZED" 2>/dev/null)" in
+case "$(file_desc "$SIZED" 2>/dev/null)" in
     *WebAssembly*) ;;
     *)
         echo "  [FAIL] size_mode: --size output is not a wasm module:"
-        echo "         $(file -b "$SIZED" 2>/dev/null)"
+        echo "         $(file_desc "$SIZED" 2>/dev/null)"
         exit 1
         ;;
 esac
diff --git a/tests/integration/sized_array_params_eval_order/test_sized_array_params_eval_order.sh b/tests/integration/sized_array_params_eval_order/test_sized_array_params_eval_order.sh
index 3871a94f1..144831300 100644
--- a/tests/integration/sized_array_params_eval_order/test_sized_array_params_eval_order.sh
+++ b/tests/integration/sized_array_params_eval_order/test_sized_array_params_eval_order.sh
@@ -30,7 +30,7 @@ export AETHER_HOME="$ROOT"
 fail=0
 
 run_want() {  # file, want, label
-    got="$("$AE" run "$1" 2>&1 | tr -d '\r' | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+    got="$("$AE" run "$1" 2>&1 | tr -d '\r' | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
     if [ "$got" != "$2" ]; then
         echo "  [FAIL] sized_array_params_eval_order: $3"
         printf 'got:\n%s\nwant:\n%s\n' "$got" "$2" | sed 's/^/        /'
diff --git a/tests/integration/slice_raw_view_holds_nothing/test_slice_raw_view_holds_nothing.sh b/tests/integration/slice_raw_view_holds_nothing/test_slice_raw_view_holds_nothing.sh
index 12e365226..e8ed2e379 100644
--- a/tests/integration/slice_raw_view_holds_nothing/test_slice_raw_view_holds_nothing.sh
+++ b/tests/integration/slice_raw_view_holds_nothing/test_slice_raw_view_holds_nothing.sh
@@ -112,7 +112,7 @@ holds_none() {
     case "$b" in
         *aether_unwind_track*|*aether_slice_release*|*aether_slice_set*)
             echo "  [FAIL] $1: a local of views of uncounted memory holds a reference"
-            echo "$b" | grep -n "aether_unwind_track\|aether_slice_release\|aether_slice_set" |
+            echo "$b" | grep -n -E "aether_unwind_track|aether_slice_release|aether_slice_set" |
                 sed 's/^/        /'
             fails=$((fails + 1)) ;;
     esac
diff --git a/tests/integration/spawn_signal_mask_reset/test_spawn_signal_mask_reset.sh b/tests/integration/spawn_signal_mask_reset/test_spawn_signal_mask_reset.sh
index 7c55265f8..1b882ffbd 100755
--- a/tests/integration/spawn_signal_mask_reset/test_spawn_signal_mask_reset.sh
+++ b/tests/integration/spawn_signal_mask_reset/test_spawn_signal_mask_reset.sh
@@ -13,6 +13,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 
 # /proc/self/status is Linux-specific, and the fix is a POSIX fork/exec path;
 # skip cleanly elsewhere (Windows has no fork; other Unixes lack /proc SigBlk).
@@ -30,7 +31,7 @@ tmpdir="$(mktemp -d)"
 trap 'rm -rf "$tmpdir"' EXIT
 
 if ! ${CC:-cc} -o "$tmpdir/harness" "$SCRIPT_DIR/harness.c" \
-        "$ROOT/build/libaether.a" -lpthread -ldl -lm 2>"$tmpdir/gcc.err"; then
+        "$ROOT/build/libaether.a" -lpthread $AE_DL_LIBS -lm 2>"$tmpdir/gcc.err"; then
     echo "  [FAIL] could not link the harness against libaether.a"
     sed 's/^/          /' "$tmpdir/gcc.err" | head -8
     exit 1
diff --git a/tests/integration/spawn_stdio_inherited/test_spawn_stdio_inherited.sh b/tests/integration/spawn_stdio_inherited/test_spawn_stdio_inherited.sh
index 234a76144..4d2e14061 100755
--- a/tests/integration/spawn_stdio_inherited/test_spawn_stdio_inherited.sh
+++ b/tests/integration/spawn_stdio_inherited/test_spawn_stdio_inherited.sh
@@ -9,6 +9,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 
 case "$(uname -s)" in
     MINGW*|MSYS*|CYGWIN*|Windows_NT)
@@ -27,7 +28,7 @@ if ! ${CC:-cc} -o "$tmpdir/harness" "$SCRIPT_DIR/harness.c" \
         "$ROOT/build/libaether.a" -lpthread -lm 2>"$tmpdir/cc.err"; then
     # The runtime links more libraries on some platforms; try the full set.
     if ! ${CC:-cc} -o "$tmpdir/harness" "$SCRIPT_DIR/harness.c" \
-            "$ROOT/build/libaether.a" -lpthread -ldl -lm -lz -lssl -lcrypto 2>"$tmpdir/cc.err"; then
+            "$ROOT/build/libaether.a" -lpthread $AE_DL_LIBS -lm -lz -lssl -lcrypto 2>"$tmpdir/cc.err"; then
         echo "  [FAIL] could not link the harness against libaether.a"
         sed 's/^/          /' "$tmpdir/cc.err" | head -8
         exit 1
diff --git a/tests/integration/sqlite_amalgamation_fetch/test_sqlite_amalgamation_fetch.sh b/tests/integration/sqlite_amalgamation_fetch/test_sqlite_amalgamation_fetch.sh
index 9ca9f9547..216f09192 100644
--- a/tests/integration/sqlite_amalgamation_fetch/test_sqlite_amalgamation_fetch.sh
+++ b/tests/integration/sqlite_amalgamation_fetch/test_sqlite_amalgamation_fetch.sh
@@ -16,6 +16,7 @@
 set -e
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 FETCH="$ROOT/scripts/fetch-sqlite-amalgamation.sh"
 
 command -v curl >/dev/null 2>&1 || { echo "  [SKIP] sqlite_amalgamation_fetch: needs curl for file:// URLs"; exit 0; }
@@ -40,7 +41,7 @@ with zipfile.ZipFile(sys.argv[1], "w") as z:
         z.writestr("sqlite-amalgamation-9990000/" + name, "/* fixture " + name + " */\n")
 PY
 }
-sha() { if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | cut -d' ' -f1; else shasum -a 256 "$1" | cut -d' ' -f1; fi; }
+sha() { sha256_of "$1"; }
 lock() {  # lock URL SHA
     printf 'SQLITE_VERSION=9.99.0\nSQLITE_URL=%s\nSQLITE_SHA256=%s\nSQLITE_CFLAGS="-DX"\n' "$1" "$2" > "$T/lock"
 }
diff --git a/tests/integration/sqlite_vendored_native/test_sqlite_vendored_native.sh b/tests/integration/sqlite_vendored_native/test_sqlite_vendored_native.sh
index 599b166e9..e35ba70da 100644
--- a/tests/integration/sqlite_vendored_native/test_sqlite_vendored_native.sh
+++ b/tests/integration/sqlite_vendored_native/test_sqlite_vendored_native.sh
@@ -14,6 +14,7 @@
 set -e
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 AE="$ROOT/build/ae"
 [ -x "$AE" ] || { echo "  [SKIP] sqlite_vendored_native: ae not built"; exit 0; }
 if [ ! -f "$ROOT/build/contrib/libsqlite3.a" ] || [ ! -f "$ROOT/build/contrib/libaether_sqlite.a" ]; then
diff --git a/tests/integration/step_word/test_step_word.sh b/tests/integration/step_word/test_step_word.sh
index e453af170..0f999c821 100644
--- a/tests/integration/step_word/test_step_word.sh
+++ b/tests/integration/step_word/test_step_word.sh
@@ -13,6 +13,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 AE="$ROOT/build/ae"
 CC="${CC:-cc}"
 export AETHER_HOME="$ROOT"
diff --git a/tests/integration/struct_argument_mismatch/test_struct_argument_mismatch.sh b/tests/integration/struct_argument_mismatch/test_struct_argument_mismatch.sh
index 76773dc2a..81783f7da 100644
--- a/tests/integration/struct_argument_mismatch/test_struct_argument_mismatch.sh
+++ b/tests/integration/struct_argument_mismatch/test_struct_argument_mismatch.sh
@@ -150,7 +150,7 @@ want="14
 2 4 6
 3 12
 7 10 1"
-got="$("$AE" run good.ae 2>&1 | tr -d '\r' | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+got="$("$AE" run good.ae 2>&1 | tr -d '\r' | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 if [ "$got" != "$want" ]; then
     echo "  [FAIL] struct_argument_mismatch: a valid struct argument stopped working"
     printf 'got:\n%s\nwant:\n%s\n' "$got" "$want" | sed 's/^/        /'
diff --git a/tests/integration/tcp_connect_timeout/test_tcp_connect_timeout.sh b/tests/integration/tcp_connect_timeout/test_tcp_connect_timeout.sh
index 660ebd2a8..e8f96961e 100755
--- a/tests/integration/tcp_connect_timeout/test_tcp_connect_timeout.sh
+++ b/tests/integration/tcp_connect_timeout/test_tcp_connect_timeout.sh
@@ -91,7 +91,7 @@ main() {
     println("zero ${z == null} ${zerr}")
 }
 AE
-got="$(AETHER_HOME="$ROOT" "$AE" run "$tmp/main.ae" 2>&1 | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+got="$(AETHER_HOME="$ROOT" "$AE" run "$tmp/main.ae" 2>&1 | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 printf '%s\n' "$got" | grep '^refused' | sed 's/^/    note: /'
 refused_want='refused true connection failed fast true bounded true'
 case "$(uname -s)" in
diff --git a/tests/integration/tcp_listen_on/test_tcp_listen_on.sh b/tests/integration/tcp_listen_on/test_tcp_listen_on.sh
index 3e8355323..5631e1ad6 100644
--- a/tests/integration/tcp_listen_on/test_tcp_listen_on.sh
+++ b/tests/integration/tcp_listen_on/test_tcp_listen_on.sh
@@ -75,7 +75,7 @@ idle 0
 echo:hi|nodelay=true
 bad true listen failed
 nullport -1 nullpoll -1'
-got="$(AETHER_HOME="$ROOT" "$AE" run "$tmp/main.ae" 2>&1 | grep -v "^warning\|^ *-->\|^ *[0-9]* |\|^ *|\|^Type checking\|^$")"
+got="$(AETHER_HOME="$ROOT" "$AE" run "$tmp/main.ae" 2>&1 | grep -v -E "^warning|^ *-->|^ *[0-9]* [|]|^ *[|]|^Type checking|^$")"
 if [ "$got" != "$want" ]; then
     echo "  [FAIL] tcp_listen_on: output differs"
     printf '%s\n' "$got" | head -8 | sed 's/^/        /'
diff --git a/tests/integration/try_written_volatile_c/test_try_written_volatile_c.sh b/tests/integration/try_written_volatile_c/test_try_written_volatile_c.sh
index e031e930a..be7fde4ee 100644
--- a/tests/integration/try_written_volatile_c/test_try_written_volatile_c.sh
+++ b/tests/integration/try_written_volatile_c/test_try_written_volatile_c.sh
@@ -62,8 +62,8 @@ for name in test_try_written_param test_try_written_struct_local test_catch_bind
                 sed 's/^/    /' "$tmp/cc.log" | head -20
                 fail "$c does not compile at $opt"
             fi
-            if grep -qi "discards\|volatile\|qualifier" "$tmp/cc.log"; then
-                grep -i "discards\|volatile\|qualifier" "$tmp/cc.log" | sed 's/^/    /' | head -10
+            if grep -qi -E "discards|volatile|qualifier" "$tmp/cc.log"; then
+                grep -i -E "discards|volatile|qualifier" "$tmp/cc.log" | sed 's/^/    /' | head -10
                 fail "$c at $opt: a volatile value is passed where a plain one is expected"
             fi
         done
diff --git a/tests/integration/wasi_panic_link/test_wasi_panic_link.sh b/tests/integration/wasi_panic_link/test_wasi_panic_link.sh
index de0ce0756..d53e4c172 100755
--- a/tests/integration/wasi_panic_link/test_wasi_panic_link.sh
+++ b/tests/integration/wasi_panic_link/test_wasi_panic_link.sh
@@ -28,6 +28,7 @@ set -e
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 AE="$ROOT/build/ae"
 
 if [ ! -x "$AE" ]; then
@@ -50,7 +51,7 @@ if ! "$AE" build --target=wasm32-wasi --emit=lib \
         "$SCRIPT_DIR/paniclib.ae" -o "$OUT" >"$BUILD_LOG" 2>&1; then
     echo "  [FAIL] wasi_panic_link: cross build failed"
     # The regression's signature, surfaced directly when it recurs.
-    if grep -q '_longjmp\|_setjmp' "$BUILD_LOG"; then
+    if grep -q -E '_longjmp|_setjmp' "$BUILD_LOG"; then
         echo "         setjmp selection regressed: aether_panic.h's macro"
         echo "         arms must special-case __wasi__ (see the header)."
     fi
@@ -61,11 +62,11 @@ fi
 [ -f "$OUT" ] || { echo "  [FAIL] wasi_panic_link: no output at $OUT"; exit 1; }
 
 # A real wasm module, not an empty file or a host artifact.
-case "$(file -b "$OUT" 2>/dev/null)" in
+case "$(file_desc "$OUT" 2>/dev/null)" in
     *WebAssembly*) ;;
     *)
         echo "  [FAIL] wasi_panic_link: not a wasm module:"
-        echo "         $(file -b "$OUT" 2>/dev/null)"
+        echo "         $(file_desc "$OUT" 2>/dev/null)"
         exit 1
         ;;
 esac
diff --git a/tests/integration/wasm_emit_lib_exports/test_wasm_emit_lib_exports.sh b/tests/integration/wasm_emit_lib_exports/test_wasm_emit_lib_exports.sh
index 5d1d3d2c1..627df0b8a 100755
--- a/tests/integration/wasm_emit_lib_exports/test_wasm_emit_lib_exports.sh
+++ b/tests/integration/wasm_emit_lib_exports/test_wasm_emit_lib_exports.sh
@@ -28,6 +28,7 @@ set -e
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 AE="$ROOT/build/ae"
 SRC="$SCRIPT_DIR/mylib.ae"
 READ="$SCRIPT_DIR/read_exports.py"
@@ -60,9 +61,9 @@ if ! "$AE" build --target=wasm32-wasi --emit=lib "$SRC" -o "$TMP/all.wasm" \
     cat "$TMP/log"
     fail "--target=wasm32-wasi --emit=lib was rejected"
 fi
-case "$(file "$TMP/all.wasm")" in
+case "$(file_desc "$TMP/all.wasm")" in
     *WebAssembly*) ;;
-    *) fail "output is not a wasm module: $(file "$TMP/all.wasm")" ;;
+    *) fail "output is not a wasm module: $(file_desc "$TMP/all.wasm")" ;;
 esac
 
 python3 "$READ" "$TMP/all.wasm" > "$TMP/all.txt" || fail "could not read the export section"
diff --git a/tests/integration/written_type_sibling_branch/test_written_type_sibling_branch.sh b/tests/integration/written_type_sibling_branch/test_written_type_sibling_branch.sh
index 1cac4ade5..44e0abf1d 100644
--- a/tests/integration/written_type_sibling_branch/test_written_type_sibling_branch.sh
+++ b/tests/integration/written_type_sibling_branch/test_written_type_sibling_branch.sh
@@ -126,7 +126,7 @@ main() {
 }
 AE
 want="5 18446744073709551615 5000000000 -3 5 250"
-got="$("$AE" run main.ae 2>&1 | tr -d '\r' | grep -v "^warning\|^hint\|^ *-->\|^ *[0-9]* |\|^ *|\|^$")"
+got="$("$AE" run main.ae 2>&1 | tr -d '\r' | grep -v -E "^warning|^hint|^ *-->|^ *[0-9]* [|]|^ *[|]|^$")"
 if [ "$got" != "$want" ]; then
     echo "  [FAIL] written_type_sibling_branch: a value the written type holds"
     printf 'got:\n%s\nwant:\n%s\n' "$got" "$want" | sed 's/^/        /'
diff --git a/tests/lib/portable.sh b/tests/lib/portable.sh
new file mode 100644
index 000000000..a0a255b4d
--- /dev/null
+++ b/tests/lib/portable.sh
@@ -0,0 +1,89 @@
+# Small POSIX stand-ins for tools that are not the same everywhere.
+#
+# A test script that reaches for `head -c`, `shasum` or `sha256sum` runs
+# fine on Linux and macOS and dies on OpenBSD (`head: unknown option -- c`,
+# no `shasum`), and the failure reads as a product bug. Source this file and
+# call the function; each one prefers the real tool and only falls back when
+# the platform lacks it.
+
+# head_c N [FILE]: the first N bytes of FILE, or of stdin.
+if printf 'ab' | head -c 1 >/dev/null 2>&1; then
+    head_c() { if [ -n "$2" ]; then head -c "$1" "$2"; else head -c "$1"; fi; }
+else
+    # dd with bs=1 reads exactly N bytes from a pipe or a device, where a
+    # larger block size would take whatever one short read returned.
+    head_c() {
+        if [ -n "$2" ]; then dd if="$2" bs=1 count="$1" 2>/dev/null
+        else dd bs=1 count="$1" 2>/dev/null; fi
+    }
+fi
+
+# sha256_of FILE: the lowercase hex SHA-256 of FILE, nothing else.
+sha256_of() {
+    if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | cut -d' ' -f1
+    elif command -v shasum >/dev/null 2>&1; then shasum -a 256 "$1" | cut -d' ' -f1
+    elif command -v sha256 >/dev/null 2>&1; then sha256 -q "$1"
+    else openssl dgst -sha256 "$1" | sed 's/^.*= *//'; fi
+}
+
+# copy_listed DESTDIR: copy the files named on stdin (one path per line,
+# relative to the current directory) into DESTDIR under the same relative
+# paths. One tar process where tar can take a list (GNU, libarchive), and a
+# per-file mkdir+cp where it cannot: OpenBSD's tar has no -T.
+if tar cf /dev/null -T /dev/null >/dev/null 2>&1; then
+    copy_listed() { tar cf - -T - | (cd "$1" && tar xf -); }
+else
+    copy_listed() {
+        while IFS= read -r _cl_f; do
+            [ -n "$_cl_f" ] || continue
+            mkdir -p "$1/$(dirname "$_cl_f")" && cp -p "$_cl_f" "$1/$_cl_f" || return 1
+        done
+    }
+fi
+
+# file_desc FILE: what `file -b` says about FILE, plus the words a test greps
+# for when this platform's `file` does not know the format. OpenBSD's file
+# prints "data" for a wasm module and a COFF object, and spells the machine
+# "AArch64" where others print "aarch64". Appended words only add to what
+# file said, so a platform whose file is complete sees no difference to a
+# `case "$(file_desc f)" in *wasm*)` match.
+file_desc() {
+    _fd_d="$(file -b "$1" 2>/dev/null)"
+    _fd_m="$(od -An -tx1 -N4 "$1" 2>/dev/null | tr -d ' \n')"
+    case "$_fd_m" in
+        0061736d) case "$_fd_d" in *WebAssembly*) ;; *) _fd_d="$_fd_d WebAssembly (wasm) binary module" ;; esac ;;
+        cffaedfe) case "$_fd_d" in *Mach-O*) ;; *) _fd_d="$_fd_d Mach-O 64-bit object" ;; esac ;;
+        6486*)    case "$_fd_d" in *COFF*) ;; *) _fd_d="$_fd_d COFF object file, x86-64" ;; esac ;;
+    esac
+    case "$_fd_d" in *AArch64*) _fd_d="$_fd_d aarch64" ;; esac
+    printf '%s\n' "$_fd_d"
+}
+
+# dyn_syms FILE: the symbols a shared library defines and exports, one per
+# line, with whichever nm this platform has. GNU nm spells it `nm -D
+# --defined-only`; macOS `nm -gU`; OpenBSD's nm has neither, and takes `-g`
+# (external symbols), undefined ones included, so those are filtered out.
+# An unsupported option makes nm exit non-zero with nothing on stdout, which
+# must not be read as "the symbols are gone", hence the fall-through.
+dyn_syms() {
+    _ds_s="$(nm -D --defined-only "$1" 2>/dev/null || true)"
+    [ -n "$_ds_s" ] || _ds_s="$(nm -gU "$1" 2>/dev/null || true)"
+    [ -n "$_ds_s" ] || _ds_s="$(nm -g "$1" 2>/dev/null | grep -Ev '^[[:space:]]+[Uwv] |[[:space:]][Uwv][[:space:]]' || true)"
+    # A reader that stops early (grep -q) closes the pipe: not an error here.
+    { printf '%s\n' "$_ds_s"; } 2>/dev/null
+}
+
+# od_uint FILE OFFSET SIZE: the SIZE-byte (1, 2 or 4) unsigned integer at
+# byte OFFSET of FILE, host byte order, as a plain decimal. OpenBSD's od
+# zero-pads `-tu` fields ("0000000120"), which a shell reads as octal in
+# `$(( ))` and as a different string in `[ "$x" = 2 ]`.
+od_uint() { od -An -tu"$3" -j "$2" -N "$3" "$1" | awk 'NF { print $1 + 0; exit }'; }
+
+# zig_musl_unavailable LOG: succeeds when LOG shows that zig could not build
+# its own musl libc.a, which every `--target=*-linux-musl` link needs. That is
+# the toolchain failing on this host, before any Aether code is involved:
+# zig 0.16 on OpenBSD runs out of descriptors spawning its compiles
+# (ProcessFdQuotaExceeded), or finds its cache half-written. A test whose
+# point is something else (the module's header, a C source, an ELF check)
+# reports a skip with this reason rather than a failure it did not cause.
+zig_musl_unavailable() { grep -q "sub-compilation of musl libc.a failed" "$1" 2>/dev/null; }
diff --git a/tests/lib/syslibs.sh b/tests/lib/syslibs.sh
new file mode 100644
index 000000000..dc131b89f
--- /dev/null
+++ b/tests/lib/syslibs.sh
@@ -0,0 +1,15 @@
+# System libraries a hand-written C link line needs, by platform.
+#
+# glibc keeps dlopen/dlsym in libdl and shm_open/clock_* in librt. The BSDs
+# (FreeBSD, NetBSD, OpenBSD) and macOS have them in libc, and the linker
+# there fails outright on `-ldl` / `-lrt` ("unable to find library -ldl").
+# A test that links against build/libaether.a by hand uses these instead of
+# spelling the Linux libraries.
+#
+#   cc ... build/libaether.a -lpthread $AE_DL_LIBS -lm $AE_RT_LIBS ...
+#
+# Unquoted on purpose: empty means no word at all.
+case "$(uname -s)" in
+    Linux) AE_DL_LIBS="-ldl"; AE_RT_LIBS="-lrt" ;;
+    *)     AE_DL_LIBS="";     AE_RT_LIBS="" ;;
+esac
diff --git a/tests/run_macos_leaks.sh b/tests/run_macos_leaks.sh
index 4bdd82734..b27395aec 100755
--- a/tests/run_macos_leaks.sh
+++ b/tests/run_macos_leaks.sh
@@ -237,7 +237,7 @@ jobs="${LEAKS_JOBS:-$(sysctl -n hw.ncpu 2>/dev/null || echo 2)}"
 echo "$(printf '%s\n' $TESTS | wc -l | tr -d ' ') programs, $jobs at a time"
 printf '%s\n' $TESTS | xargs -P "$jobs" -I{} sh "$0" --one {} "$tmpdir"
 
-covered=$(ls "$tmpdir" | grep -c '^pass_\|^fail_')
+covered=$(ls "$tmpdir" | grep -c -E '^pass_|^fail_')
 excluded=$(ls "$tmpdir" | grep -c '^skip_')
 fails=$(ls "$tmpdir" | grep -c '^fail_')
 

From 842e5fe3fbec035a45a548dda2237519883690ba Mon Sep 17 00:00:00 2001
From: paul <paul@hammant.org>
Date: Tue, 10 Nov 2026 00:53:16 +0000
Subject: [PATCH 02/11] OpenBSD: std.audio links without -ldl, checksec reads
 RETGUARD, spawn stdio slot, LibreSSL SSL_CERT_FILE

Four gaps the test suite exposed (see the changelog fragment):

- ae: the -ldl codegen's link table names for std.audio is dropped on
  OpenBSD (dlopen is in libc; no libdl exists).
- ae checksec: __retguard_* / __stack_smash_handler count as the stack
  canary; OpenBSD's clang emits no __stack_chk_fail for a plain array.
- std.os: on OpenBSD/NetBSD a pipe's stat is dev 0/ino 0 and its time is a
  10 ms clock, so a spawn pipe that took a closed stdout's number within a
  tick of process start passed for the stream and was handed to the child.
  A stream that was not close-on-exec at start no longer matches one that is.
- std.http client: LibreSSL ignores SSL_CERT_FILE/SSL_CERT_DIR in
  SSL_CTX_set_default_verify_paths; name them explicitly, as OpenSSL and the
  pure-Aether client do.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 ...9T225917Z-fixed-openbsd-harness-product.md |  1 +
 std/net/aether_http.c                         | 19 +++++++++++++
 std/os/aether_os.c                            | 28 ++++++++++++++-----
 tools/ae.c                                    |  6 ++++
 tools/ae_checksec.c                           | 12 +++++++-
 5 files changed, 58 insertions(+), 8 deletions(-)
 create mode 100644 new_changelogs/20261109T225917Z-fixed-openbsd-harness-product.md

diff --git a/new_changelogs/20261109T225917Z-fixed-openbsd-harness-product.md b/new_changelogs/20261109T225917Z-fixed-openbsd-harness-product.md
new file mode 100644
index 000000000..aeca55792
--- /dev/null
+++ b/new_changelogs/20261109T225917Z-fixed-openbsd-harness-product.md
@@ -0,0 +1 @@
+- **OpenBSD: four toolchain and runtime gaps the test suite exposed** (`tools/ae.c`, `tools/ae_checksec.c`, `std/os/aether_os.c`, `std/net/aether_http.c`). A program importing `std.audio` no longer fails to link with "unable to find library -ldl": OpenBSD keeps `dlopen` in libc, and `ae` now leaves the `-ldl` that codegen's link table names for `std.audio` off the link line there (as it already does on MinGW). `ae checksec` reads OpenBSD's RETGUARD return-address cookies (`__retguard_*`, and `__stack_smash_handler`) as the stack canary; it reported `canary no` for every OpenBSD binary because that clang does not emit `__stack_chk_fail` for a plain stack array. A spawned child no longer keeps a close-on-exec pipe that took a closed stdout's number as its stdout on OpenBSD and NetBSD: their pipes all report device 0, inode 0, and the pipe time that told them apart is the kernel's coarse clock (10 ms), so a spawn pipe made within a tick of the process start was taken for the stream itself; a stream that was not close-on-exec at start can no longer match a close-on-exec one (`os_spawn_stdio_slot` failed there). The OpenSSL-backed HTTPS client now honours `SSL_CERT_FILE` and `SSL_CERT_DIR` when built against LibreSSL, which ignores both in `SSL_CTX_set_default_verify_paths` (the pure-Aether client and OpenSSL already did).
diff --git a/std/net/aether_http.c b/std/net/aether_http.c
index d01211ecf..ffb420d4f 100644
--- a/std/net/aether_http.c
+++ b/std/net/aether_http.c
@@ -539,7 +539,26 @@ static SSL_CTX* get_ssl_ctx(void) {
 #else
     // Linux/macOS: the system trust store lives at the path OpenSSL was
     // compiled with — /etc/ssl/certs and the macOS keychain bridge.
+#ifdef LIBRESSL_VERSION_NUMBER
+    // LibreSSL (OpenBSD's libcrypto) does not read SSL_CERT_FILE or
+    // SSL_CERT_DIR in SSL_CTX_set_default_verify_paths, where OpenSSL does and
+    // the pure-Aether client does. Name them here, with the same rule: when
+    // either is set it is the whole store, and one that cannot be loaded
+    // leaves no anchors, so the handshake fails closed.
+    const char* env_file = getenv("SSL_CERT_FILE");
+    const char* env_dir = getenv("SSL_CERT_DIR");
+    if (env_file && !env_file[0]) env_file = NULL;
+    if (env_dir && !env_dir[0]) env_dir = NULL;
+    if (env_file || env_dir) {
+        if (env_file) SSL_CTX_load_verify_locations(ctx, env_file, NULL);
+        if (env_dir) SSL_CTX_load_verify_locations(ctx, NULL, env_dir);
+        ERR_clear_error();
+    } else {
+        SSL_CTX_set_default_verify_paths(ctx);
+    }
+#else
     SSL_CTX_set_default_verify_paths(ctx);
+#endif
 #endif
 
     SSL_CTX* expected = NULL;
diff --git a/std/os/aether_os.c b/std/os/aether_os.c
index 692a3d01f..7090152f6 100644
--- a/std/os/aether_os.c
+++ b/std/os/aether_os.c
@@ -1551,18 +1551,31 @@ static struct {
     int open; dev_t dev; ino_t ino;
 #ifdef AETHER_STD_STREAM_MADE
     struct timespec made;
+    int cloexec;   /* close-on-exec when the process started */
 #endif
 } aether_std_stream[3];
 
-/* Whether `st` is the file stream `fd` was at the start. */
-static int aether_std_stream_same(int fd, const struct stat* st) {
+/* Whether `st` is the file stream `fd` was at the start. `fl` is the
+ * descriptor's flags now, and the caller only asks about a close-on-exec one. */
+static int aether_std_stream_same(int fd, const struct stat* st, int fl) {
+    (void)fl;
     if (st->st_dev != aether_std_stream[fd].dev || st->st_ino != aether_std_stream[fd].ino)
         return 0;
 #ifdef AETHER_STD_STREAM_MADE
-    if (st->st_dev == 0 && st->st_ino == 0 &&
-        (AETHER_STD_STREAM_MADE(st).tv_sec != aether_std_stream[fd].made.tv_sec ||
-         AETHER_STD_STREAM_MADE(st).tv_nsec != aether_std_stream[fd].made.tv_nsec))
-        return 0;
+    if (st->st_dev == 0 && st->st_ino == 0) {
+        if (AETHER_STD_STREAM_MADE(st).tv_sec != aether_std_stream[fd].made.tv_sec ||
+            AETHER_STD_STREAM_MADE(st).tv_nsec != aether_std_stream[fd].made.tv_nsec)
+            return 0;
+        /* The pipe's time is the kernel's coarse clock (10 ms on OpenBSD),
+         * so two pipes made within a tick report the same one: a spawn pipe
+         * that took the number of a closed stdout a few milliseconds after
+         * the process started looked like the stream itself. Of the two
+         * that cannot be told apart, only one is close-on-exec if the
+         * stream was not when the process started: the parent that marks its
+         * streams (Node) has done so before this library loads. */
+        if ((fl & FD_CLOEXEC) && !aether_std_stream[fd].cloexec)
+            return 0;
+    }
 #endif
     return 1;
 }
@@ -1577,6 +1590,7 @@ static void aether_record_std_streams(void) {
         aether_std_stream[fd].ino = st.st_ino;
 #ifdef AETHER_STD_STREAM_MADE
         aether_std_stream[fd].made = AETHER_STD_STREAM_MADE(&st);
+        aether_std_stream[fd].cloexec = (fcntl(fd, F_GETFD) & FD_CLOEXEC) != 0;
 #endif
     }
 }
@@ -1587,7 +1601,7 @@ static void aether_child_keep_stdio(void) {
         int fl = fcntl(fd, F_GETFD);
         if (fl < 0 || !(fl & FD_CLOEXEC) || !aether_std_stream[fd].open) continue;
         struct stat st;
-        if (fstat(fd, &st) != 0 || !aether_std_stream_same(fd, &st))
+        if (fstat(fd, &st) != 0 || !aether_std_stream_same(fd, &st, fl))
             continue;
         fcntl(fd, F_SETFD, fl & ~FD_CLOEXEC);
     }
diff --git a/tools/ae.c b/tools/ae.c
index 35b1f0d36..41694cc1b 100644
--- a/tools/ae.c
+++ b/tools/ae.c
@@ -3410,6 +3410,12 @@ static const char* get_aether_link_flags(const char* c_file, unsigned* required)
                 /* MinGW has libm but no libdl, and its threads are linked
                  * by the toolchain; only -lm can need re-placing there. */
                 if (tlen != 3 || strncmp(p + start, "-lm", 3) != 0) continue;
+#endif
+#ifdef __OpenBSD__
+                /* OpenBSD keeps dlopen in libc and ships no libdl: the link
+                 * fails with "unable to find library -ldl" (std.audio's row
+                 * in codegen's link table names it for every host). */
+                if (tlen == 4 && strncmp(p + start, "-ldl", 4) == 0) continue;
 #endif
                 if (tlen < sizeof(platform[0]) && nplatform < 3) {
                     memcpy(platform[nplatform], p + start, tlen);
diff --git a/tools/ae_checksec.c b/tools/ae_checksec.c
index ad6af36d5..75dba7ca7 100644
--- a/tools/ae_checksec.c
+++ b/tools/ae_checksec.c
@@ -174,7 +174,17 @@ static int inspect_elf(const unsigned char* b, size_t len, Checksec* out) {
         if (e_type == 3 && !saw_interp) out->pie = PROP_YES;
     }
     out->relro = saw_relro ? (bind_now ? PROP_YES : PROP_PARTIAL) : PROP_NO;
-    out->canary  = has_name(b, len, "__stack_chk_fail") ? PROP_YES : PROP_NO;
+    /* OpenBSD's clang does not emit the __stack_chk_fail canary for a plain
+     * stack array: it guards every return with RETGUARD, a per-function
+     * random cookie (the __retguard_N symbols) xored into the return address
+     * and checked before ret. That is its answer to the same attack, and it
+     * is what -fstack-protector builds there carry. Where the SSP check is
+     * emitted instead, its failure handler is __stack_smash_handler. A
+     * binary stripped of .symtab loses the cookies' names but keeps the
+     * handler in .dynsym. */
+    out->canary  = has_name(b, len, "__stack_chk_fail") ||
+                   has_name(b, len, "__stack_smash_handler") ||
+                   has_name(b, len, "__retguard_") ? PROP_YES : PROP_NO;
     out->fortify = has_fortified_call(b, len) ? PROP_YES : PROP_NO;
     /* .symtab is dropped by strip; .dynsym survives, so the presence of the
      * section-header string ".symtab" is the readable signal. */

From eb41cffe51de7e963fc88ce4f1180f2fa60b9668 Mon Sep 17 00:00:00 2001
From: paul <paul@hammant.org>
Date: Tue, 10 Nov 2026 00:53:16 +0000
Subject: [PATCH 03/11] tests: TLS tests against LibreSSL's openssl

- x509 -req signs with SHA-1 under LibreSSL, which the pure TLS stack
  rightly refuses ("does not chain to a trusted anchor"): pass -sha256.
- s_client's LibreSSL output names the version "TLSv1/SSLv3" on success and
  "(NONE)" on failure: https_tls_backend_select reads that.
- openssl_is_libressl / openssl_has_option (tests/lib/test_openssl_conf.sh):
  skip, naming the reason, what needs ssl_conf (https_openssl_policy),
  s_server -cert_chain (https_partial_chain), s_client -sigalgs
  (crypto_tls13_signature_check and a case of https_pure_server_keys) or
  Ed25519 certificates in TLS (a case of https_pure_server_keys).

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../test_tls13_mtls_signature.sh              | 10 ++++----
 .../crypto_tls13_resume/test_tls13_resume.sh  |  2 +-
 .../test_tls13_signature_check.sh             | 13 ++++++----
 .../test_tls13_socket_verify_mtls.sh          |  4 ++--
 .../test_http_client_custom_ca.sh             |  2 +-
 .../test_http_reverse_proxy_tls.sh            |  3 ++-
 .../http_server_h2/test_http_server_h2.sh     | 13 +++++-----
 .../test_http_server_h2_middleware.sh         |  5 ++--
 .../test_https_client_pure_tls.sh             |  2 +-
 .../test_https_openssl_policy.sh              | 10 ++++++--
 .../test_https_partial_chain.sh               |  5 ++++
 .../test_https_pure_server_keys.sh            | 24 ++++++++++++-------
 .../test_https_server_tls_pem.sh              |  6 ++---
 .../test_https_tls_backend_select.sh          | 10 ++++----
 .../https_tls_reload/test_https_tls_reload.sh |  2 +-
 .../test_https_windows_trust.sh               |  2 +-
 tests/lib/test_openssl_conf.sh                | 10 ++++++++
 17 files changed, 80 insertions(+), 43 deletions(-)

diff --git a/tests/integration/crypto_tls13_mtls_signature/test_tls13_mtls_signature.sh b/tests/integration/crypto_tls13_mtls_signature/test_tls13_mtls_signature.sh
index d78579972..a58c1883b 100644
--- a/tests/integration/crypto_tls13_mtls_signature/test_tls13_mtls_signature.sh
+++ b/tests/integration/crypto_tls13_mtls_signature/test_tls13_mtls_signature.sh
@@ -53,7 +53,7 @@ ssl env MSYS2_ARG_CONV_EXCL='/CN=' openssl req -x509 -new -key "$TMP/root.key" -
 for k in srv cli; do
     ssl env MSYS2_ARG_CONV_EXCL='/CN=' openssl req -new -key "$TMP/$k.key" -out "$TMP/$k.csr" -subj "/CN=$k"
     ssl openssl x509 -req -in "$TMP/$k.csr" -CA "$TMP/root.pem" -CAkey "$TMP/root.key" -CAcreateserial \
-        -days 2 -extfile "$TMP/$k.ext" -out "$TMP/$k.pem"
+        -days 2 -sha256 -extfile "$TMP/$k.ext" -out "$TMP/$k.pem"
 done
 
 "$AE" build "$SCRIPT_DIR/mtls.ae" -o "$TMP/mtls" >"$TMP/b_mtls.log" 2>&1 \
@@ -90,21 +90,21 @@ for round in 1 2; do
     serve "$TMP/cli.key"
     case "$got" in
         *"GOT HTTP/1.0 200 ok"*) echo "    ok: its own key, round $round: the server took the signature and answered" ;;
-        *) echo "    FAIL: its own key, round $round: client [$got], server [$(grep -i 'error\|alert\|verify' "$TMP/s.log" | tr '\n' '|')]"; fails=$((fails + 1)) ;;
+        *) echo "    FAIL: its own key, round $round: client [$got], server [$(grep -i -E 'error|alert|verify' "$TMP/s.log" | tr '\n' '|')]"; fails=$((fails + 1)) ;;
     esac
 done
 
 serve "$TMP/other.key"
 case "$got" in
     *"REFUSED: "*"not sent"*)
-        if grep -qi "internal error\|alert number 80" "$TMP/s.log"; then
+        if grep -qi -E "internal error|alert number 80" "$TMP/s.log"; then
             echo "    ok: another key: the client did not send the signature, and the server got internal_error"
         else
-            echo "    FAIL: another key: the server's log has no internal_error: [$(grep -i 'error\|alert' "$TMP/s.log" | tr '\n' '|')]"
+            echo "    FAIL: another key: the server's log has no internal_error: [$(grep -i -E 'error|alert' "$TMP/s.log" | tr '\n' '|')]"
             fails=$((fails + 1))
         fi
         ;;
-    *) echo "    FAIL: another key: client [$got], server [$(grep -i 'error\|alert\|verify' "$TMP/s.log" | tr '\n' '|')]"; fails=$((fails + 1)) ;;
+    *) echo "    FAIL: another key: client [$got], server [$(grep -i -E 'error|alert|verify' "$TMP/s.log" | tr '\n' '|')]"; fails=$((fails + 1)) ;;
 esac
 
 [ "$fails" = 0 ] || fail "$fails case(s)"
diff --git a/tests/integration/crypto_tls13_resume/test_tls13_resume.sh b/tests/integration/crypto_tls13_resume/test_tls13_resume.sh
index a337c77f9..d8d469e28 100644
--- a/tests/integration/crypto_tls13_resume/test_tls13_resume.sh
+++ b/tests/integration/crypto_tls13_resume/test_tls13_resume.sh
@@ -246,7 +246,7 @@ if command -v openssl >/dev/null 2>&1 && openssl s_server -help 2>&1 | grep -q -
            grep -q ACCEPTED "$TMP/server.out"; then
             echo "    ok: $sc_name"
         else
-            echo "    FAIL: $sc_name: server said [$(tr '\n' '|' <"$TMP/server.out")], s_client [$(grep -i 'peer sig\|temp key\|alert\|error' "$TMP/c.log" | tr '\n' '|')]"
+            echo "    FAIL: $sc_name: server said [$(tr '\n' '|' <"$TMP/server.out")], s_client [$(grep -i -E 'peer sig|temp key|alert|error' "$TMP/c.log" | tr '\n' '|')]"
             fails=$((fails + 1))
         fi
     }
diff --git a/tests/integration/crypto_tls13_signature_check/test_tls13_signature_check.sh b/tests/integration/crypto_tls13_signature_check/test_tls13_signature_check.sh
index 53b134805..e21de650c 100644
--- a/tests/integration/crypto_tls13_signature_check/test_tls13_signature_check.sh
+++ b/tests/integration/crypto_tls13_signature_check/test_tls13_signature_check.sh
@@ -36,6 +36,9 @@ NAME=crypto_tls13_signature_check
 [ -x "$AE" ] || { echo "  [SKIP] $NAME: ae not built"; exit 0; }
 command -v openssl >/dev/null 2>&1 || { echo "  [SKIP] $NAME: no openssl"; exit 0; }
 unset SSL_CERT_FILE SSL_CERT_DIR || :
+. "$ROOT/tests/lib/test_openssl_conf.sh"
+openssl_has_option s_client -sigalgs || {
+    echo "  [SKIP] $NAME: $(openssl version) s_client has no -sigalgs to pin one scheme"; exit 0; }
 
 TMP="$(mktemp -d)"
 . "$ROOT/tests/lib/test_openssl_conf.sh"
@@ -105,14 +108,14 @@ check() {
     if signed_with "$2" "$3" "$4" && grep -q ACCEPTED "$TMP/server.out"; then
         echo "    ok: $2: its own key's signature is sent"
     else
-        echo "    FAIL: $2, its own key: server [$(tr '\n' '|' <"$TMP/server.out")], s_client [$(grep -i 'signature type\|signing digest\|alert\|error' "$TMP/c.log" | tr '\n' '|')]"
+        echo "    FAIL: $2, its own key: server [$(tr '\n' '|' <"$TMP/server.out")], s_client [$(grep -i -E 'signature type|signing digest|alert|error' "$TMP/c.log" | tr '\n' '|')]"
         fails=$((fails + 1))
     fi
     serve "$TMP/$1.pem" "$TMP/$1.other.key" "$2"
-    if grep -q "REFUSED: .*not sent" "$TMP/server.out" && grep -qi "alert internal error\|alert number 80" "$TMP/c.log"; then
+    if grep -q "REFUSED: .*not sent" "$TMP/server.out" && grep -qi -E "alert internal error|alert number 80" "$TMP/c.log"; then
         echo "    ok: $2: a signature that does not verify is not sent (internal_error)"
     else
-        echo "    FAIL: $2, another key: server [$(tr '\n' '|' <"$TMP/server.out")], s_client [$(grep -i 'alert\|error' "$TMP/c.log" | tr '\n' '|')]"
+        echo "    FAIL: $2, another key: server [$(tr '\n' '|' <"$TMP/server.out")], s_client [$(grep -i -E 'alert|error' "$TMP/c.log" | tr '\n' '|')]"
         fails=$((fails + 1))
     fi
 }
@@ -135,10 +138,10 @@ for c in "p256 ecdsa_secp256r1_sha256" "ed25519 ed25519" "rsa rsa_pss_rsae_sha25
     export SERVER_CORRUPT_KEY=1
     serve "$TMP/$1.pem" "$TMP/$1.key" "$2"
     unset SERVER_CORRUPT_KEY
-    if grep -q "REFUSED: .*changed in memory" "$TMP/server.out" && grep -qi "alert internal error\|alert number 80" "$TMP/c.log"; then
+    if grep -q "REFUSED: .*changed in memory" "$TMP/server.out" && grep -qi -E "alert internal error|alert number 80" "$TMP/c.log"; then
         echo "    ok: $1: a shielded key with a bit changed is not used (internal_error)"
     else
-        echo "    FAIL: $1, corrupted shield: server [$(tr '\n' '|' <"$TMP/server.out")], s_client [$(grep -i 'alert\|error' "$TMP/c.log" | tr '\n' '|')]"
+        echo "    FAIL: $1, corrupted shield: server [$(tr '\n' '|' <"$TMP/server.out")], s_client [$(grep -i -E 'alert|error' "$TMP/c.log" | tr '\n' '|')]"
         fails=$((fails + 1))
     fi
 done
diff --git a/tests/integration/crypto_tls13_socket_verify_mtls/test_tls13_socket_verify_mtls.sh b/tests/integration/crypto_tls13_socket_verify_mtls/test_tls13_socket_verify_mtls.sh
index 2182a39ae..208c50d7d 100755
--- a/tests/integration/crypto_tls13_socket_verify_mtls/test_tls13_socket_verify_mtls.sh
+++ b/tests/integration/crypto_tls13_socket_verify_mtls/test_tls13_socket_verify_mtls.sh
@@ -57,7 +57,7 @@ ssl env MSYS2_ARG_CONV_EXCL='/CN=' openssl req -x509 -new -key "$TMP/root.key" -
 for k in srv cli; do
     ssl env MSYS2_ARG_CONV_EXCL='/CN=' openssl req -new -key "$TMP/$k.key" -out "$TMP/$k.csr" -subj "/CN=$k"
     ssl openssl x509 -req -in "$TMP/$k.csr" -CA "$TMP/root.pem" -CAkey "$TMP/root.key" -CAcreateserial \
-        -days 2 -extfile "$TMP/$k.ext" -out "$TMP/$k.pem"
+        -days 2 -sha256 -extfile "$TMP/$k.ext" -out "$TMP/$k.pem"
 done
 # A self-signed localhost certificate nothing trusts.
 ssl env MSYS2_ARG_CONV_EXCL='/CN=' openssl req -x509 -new -key "$TMP/self.key" -out "$TMP/self.pem" -days 2 \
@@ -103,7 +103,7 @@ expect() {
     label=$1; pat=$2
     case "$got" in
         $pat) echo "    ok: $label" ;;
-        *) echo "    FAIL: $label: client [$got], server [$(grep -i 'error\|alert\|verify' "$TMP/s.log" | tr '\n' '|')]"; fails=$((fails + 1)) ;;
+        *) echo "    FAIL: $label: client [$got], server [$(grep -i -E 'error|alert|verify' "$TMP/s.log" | tr '\n' '|')]"; fails=$((fails + 1)) ;;
     esac
 }
 
diff --git a/tests/integration/http_client_custom_ca/test_http_client_custom_ca.sh b/tests/integration/http_client_custom_ca/test_http_client_custom_ca.sh
index 0fc233876..ca4f13cd6 100755
--- a/tests/integration/http_client_custom_ca/test_http_client_custom_ca.sh
+++ b/tests/integration/http_client_custom_ca/test_http_client_custom_ca.sh
@@ -63,7 +63,7 @@ if ! openssl req -newkey rsa:2048 -keyout "$KEY" -out "$TMPDIR/leaf.csr" \
         -nodes -subj "/CN=127.0.0.1" 2>"$TMPDIR/o2.err" \
    || ! printf 'subjectAltName=IP:127.0.0.1\n' > "$TMPDIR/ext.cnf" \
    || ! openssl x509 -req -in "$TMPDIR/leaf.csr" -CA "$CA" -CAkey "$CAKEY" \
-        -CAcreateserial -out "$CERT" -days 1 -extfile "$TMPDIR/ext.cnf" \
+        -CAcreateserial -out "$CERT" -days 1 -sha256 -extfile "$TMPDIR/ext.cnf" \
         2>"$TMPDIR/o3.err"; then
     echo "  [SKIP] openssl (sign leaf) failed:"; head -5 "$TMPDIR/o3.err"; exit 0
 fi
diff --git a/tests/integration/http_reverse_proxy_tls/test_http_reverse_proxy_tls.sh b/tests/integration/http_reverse_proxy_tls/test_http_reverse_proxy_tls.sh
index 55f249561..29b67f951 100755
--- a/tests/integration/http_reverse_proxy_tls/test_http_reverse_proxy_tls.sh
+++ b/tests/integration/http_reverse_proxy_tls/test_http_reverse_proxy_tls.sh
@@ -13,6 +13,7 @@ set -e
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 AE="$ROOT/build/ae"
 UPSTREAM_SRC="$ROOT/tests/integration/http_reverse_proxy/server.ae"
 PROXY_SRC="$SCRIPT_DIR/tls_proxy.ae"
@@ -91,7 +92,7 @@ case "$HDRS" in
 esac
 
 # 3 — a POST body survives the TLS leg byte for byte.
-yes 'tls-payload-0123456789' 2>/dev/null | head -c 4096 > "$TMPDIR/post.in"
+yes 'tls-payload-0123456789' 2>/dev/null | head_c 4096 > "$TMPDIR/post.in"
 curl -sk --max-time 5 -X POST --data-binary "@$TMPDIR/post.in" \
      -o "$TMPDIR/post.out" "https://127.0.0.1:$PROXY_PORT/echo" 2>/dev/null || {
     echo "  [FAIL] T3 POST failed"; exit 1; }
diff --git a/tests/integration/http_server_h2/test_http_server_h2.sh b/tests/integration/http_server_h2/test_http_server_h2.sh
index 9e8ef18ca..c6ced4d10 100755
--- a/tests/integration/http_server_h2/test_http_server_h2.sh
+++ b/tests/integration/http_server_h2/test_http_server_h2.sh
@@ -45,6 +45,7 @@ set -e
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 . "$ROOT/tests/lib/wait_port.sh"
 . "$ROOT/tests/lib/server_jobs.sh"
 . "$ROOT/tests/lib/same_bytes.sh"
@@ -203,8 +204,8 @@ if [ "$ACTUAL_SIZE" != "$EXPECTED_SIZE" ]; then
     exit 1
 fi
 # Spot-check the content pattern.
-head -c 64 "$BIG" | grep -q '^0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef$' || {
-    echo "  [FAIL] /big content prefix mismatch"; head -c 64 "$BIG"; echo; exit 1
+head_c 64 "$BIG" | grep -q '^0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef$' || {
+    echo "  [FAIL] /big content prefix mismatch"; head_c 64 "$BIG"; echo; exit 1
 }
 
 # ----------------------------------------------------------------
@@ -215,7 +216,7 @@ head -c 64 "$BIG" | grep -q '^0123456789abcdef0123456789abcdef0123456789abcdef01
 POST_BODY="$TMPDIR/post.in"
 POST_RESP="$TMPDIR/post.out"
 # Generate a 1 MiB payload deterministically for byte-equality check.
-yes 'large-body-segment-1234567890' 2>/dev/null | head -c 1048576 >"$POST_BODY"
+yes 'large-body-segment-1234567890' 2>/dev/null | head_c 1048576 >"$POST_BODY"
 curl --silent --show-error --max-time 30 \
      --http2-prior-knowledge \
      -X POST \
@@ -314,7 +315,7 @@ while [ $i -lt 50 ]; do
 done
 if [ "$mismatches" -gt 0 ]; then
     echo "  [FAIL] $mismatches stress streams returned wrong body"
-    head -c 200 "$STRESS_DIR/n0" 2>/dev/null
+    head_c 200 "$STRESS_DIR/n0" 2>/dev/null
     exit 1
 fi
 
@@ -376,9 +377,9 @@ PY
         cat "$TMPDIR/upgrade.err"
         exit 1
     fi
-    if ! head -c 64 "$UPGRADE_OUT" | grep -q '^HTTP/1.1 101'; then
+    if ! head_c 64 "$UPGRADE_OUT" | grep -q '^HTTP/1.1 101'; then
         echo "  [FAIL] h2c upgrade did not get 101 reply:"
-        head -c 200 "$UPGRADE_OUT"; echo
+        head_c 200 "$UPGRADE_OUT"; echo
         exit 1
     fi
 fi
diff --git a/tests/integration/http_server_h2_middleware/test_http_server_h2_middleware.sh b/tests/integration/http_server_h2_middleware/test_http_server_h2_middleware.sh
index 6d768c83d..c66036538 100755
--- a/tests/integration/http_server_h2_middleware/test_http_server_h2_middleware.sh
+++ b/tests/integration/http_server_h2_middleware/test_http_server_h2_middleware.sh
@@ -33,6 +33,7 @@ set -e
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 . "$ROOT/tests/lib/wait_port.sh"
 . "$ROOT/tests/lib/server_jobs.sh"
 AE="$ROOT/build/ae"
@@ -112,9 +113,9 @@ fi
 # string-interpolation builder may produce different lengths under
 # different builds; the prefix check is enough to prove the
 # pipeline worked end-to-end.
-if ! gunzip -c "$BODY_GZ" | head -c 36 | grep -q '^abcdefghijklmnopqrstuvwxyz0123456789$'; then
+if ! gunzip -c "$BODY_GZ" | head_c 36 | grep -q '^abcdefghijklmnopqrstuvwxyz0123456789$'; then
     echo "  [FAIL] decompressed body prefix mismatch:"
-    gunzip -c "$BODY_GZ" 2>&1 | head -c 100; echo
+    gunzip -c "$BODY_GZ" 2>&1 | head_c 100; echo
     exit 1
 fi
 
diff --git a/tests/integration/https_client_pure_tls/test_https_client_pure_tls.sh b/tests/integration/https_client_pure_tls/test_https_client_pure_tls.sh
index 4cb71ee43..4584673c4 100755
--- a/tests/integration/https_client_pure_tls/test_https_client_pure_tls.sh
+++ b/tests/integration/https_client_pure_tls/test_https_client_pure_tls.sh
@@ -64,7 +64,7 @@ gen req -x509 $EC -keyout "$TMP/ca.key" -out "$TMP/ca.pem" -days 2 -nodes \
 gen req $EC -keyout "$TMP/leaf.key" -out "$TMP/leaf.csr" -nodes -subj "/CN=localhost"
 printf 'subjectAltName=DNS:localhost\nbasicConstraints=CA:FALSE\n' > "$TMP/leaf.ext"
 gen x509 -req -in "$TMP/leaf.csr" -CA "$TMP/ca.pem" -CAkey "$TMP/ca.key" -CAcreateserial \
-    -out "$TMP/leaf.pem" -days 2 -extfile "$TMP/leaf.ext"
+    -out "$TMP/leaf.pem" -days 2 -sha256 -extfile "$TMP/leaf.ext"
 # A self-signed certificate for the same name, which nothing trusts.
 gen req -x509 $EC -keyout "$TMP/self.key" -out "$TMP/self.pem" -days 2 -nodes \
     -subj "/CN=localhost" -addext "subjectAltName=DNS:localhost"
diff --git a/tests/integration/https_openssl_policy/test_https_openssl_policy.sh b/tests/integration/https_openssl_policy/test_https_openssl_policy.sh
index a98c13552..693c4efef 100644
--- a/tests/integration/https_openssl_policy/test_https_openssl_policy.sh
+++ b/tests/integration/https_openssl_policy/test_https_openssl_policy.sh
@@ -28,6 +28,12 @@ NAME=https_openssl_policy
 
 [ -x "$AE" ] || { echo "  [SKIP] $NAME: ae not built"; exit 0; }
 command -v openssl >/dev/null 2>&1 || { echo "  [SKIP] $NAME: no openssl to make certificates"; exit 0; }
+. "$ROOT/tests/lib/test_openssl_conf.sh"
+if openssl_is_libressl; then
+    # The test sets the peer's policy through OpenSSL's ssl_conf module.
+    echo "  [SKIP] $NAME: $(openssl version) has no ssl_conf configuration module"
+    exit 0
+fi
 
 unset SSL_CERT_FILE SSL_CERT_DIR AETHER_PURE_TLS || :
 
@@ -150,7 +156,7 @@ if [ "$HAVE_OPENSSL" = 1 ]; then
     PIDS="$PIDS $wpid"
     i=0
     while [ "$i" -lt 100 ]; do
-        grep -q 'READY\|FAIL' "$TMP/srv_weak.log" 2>/dev/null && break
+        grep -q -E 'READY|FAIL' "$TMP/srv_weak.log" 2>/dev/null && break
         sleep 0.1
         i=$((i + 1))
     done
@@ -160,7 +166,7 @@ if [ "$HAVE_OPENSSL" = 1 ]; then
     PIDS="$PIDS $!"
     i=0
     while [ "$i" -lt 100 ]; do
-        grep -q 'READY\|FAIL' "$TMP/srv_strong.log" 2>/dev/null && break
+        grep -q -E 'READY|FAIL' "$TMP/srv_strong.log" 2>/dev/null && break
         sleep 0.1
         i=$((i + 1))
     done
diff --git a/tests/integration/https_partial_chain/test_https_partial_chain.sh b/tests/integration/https_partial_chain/test_https_partial_chain.sh
index 65a50a1be..d670793f9 100755
--- a/tests/integration/https_partial_chain/test_https_partial_chain.sh
+++ b/tests/integration/https_partial_chain/test_https_partial_chain.sh
@@ -30,6 +30,11 @@ NAME=https_partial_chain
 
 [ -x "$AE" ] || { echo "  [SKIP] $NAME: ae not built"; exit 0; }
 command -v openssl >/dev/null 2>&1 || { echo "  [SKIP] $NAME: no openssl to make certificates"; exit 0; }
+. "$ROOT/tests/lib/test_openssl_conf.sh"
+if ! openssl_has_option s_server -cert_chain; then
+    echo "  [SKIP] $NAME: $(openssl version) s_server has no -cert_chain to send an intermediate"
+    exit 0
+fi
 
 unset SSL_CERT_FILE SSL_CERT_DIR AETHER_PURE_TLS || :
 
diff --git a/tests/integration/https_pure_server_keys/test_https_pure_server_keys.sh b/tests/integration/https_pure_server_keys/test_https_pure_server_keys.sh
index 566ba3c49..58aea2625 100755
--- a/tests/integration/https_pure_server_keys/test_https_pure_server_keys.sh
+++ b/tests/integration/https_pure_server_keys/test_https_pure_server_keys.sh
@@ -130,7 +130,7 @@ start_server() {
     PIDS="$PIDS $spid"
     i=0
     while [ "$i" -lt 300 ]; do
-        grep -q 'READY\|FAIL' "$slog" 2>/dev/null && break
+        grep -q -E 'READY|FAIL' "$slog" 2>/dev/null && break
         sleep 0.1
         i=$((i + 1))
     done
@@ -147,6 +147,10 @@ for k in p256 p384 p521 ed25519 rsa rsa1; do
     start_server "$k" "$k"
     [ -n "$S_PORT" ] || { echo "    got: $OUT"; fail "the $k server did not start"; }
     for b in $BACKENDS; do
+        if [ "$k" = ed25519 ] && [ "$b" = openssl ] && openssl_is_libressl; then
+            echo "    skip: $k key, client \"$b\" ($(openssl version) has no Ed25519 certificates in TLS)"
+            continue
+        fi
         run env URL="https://localhost:$S_PORT/" CAFILE="$TMP/$k.pem" BACKEND="$b" "$TMP/client"
         case "$OUT" in
             *"STATUS 200 BODY keys-ok"*) echo "    ok: $k key, client \"$b\"" ;;
@@ -171,13 +175,17 @@ refused_at_setup p256 enc "encrypted" "an encrypted key"
 refused_at_setup p256 missing "cannot read the TLS private key" "a missing key file"
 
 # 3. No scheme in common: the RSA server and a client that offers ECDSA-P256 only.
-start_server rsa rsa
-[ -n "$S_PORT" ] || { echo "    got: $OUT"; fail "the RSA server did not start"; }
-openssl s_client -connect "127.0.0.1:$S_PORT" -servername localhost -tls1_3 \
-    -sigalgs ecdsa_secp256r1_sha256 </dev/null >"$TMP/sclient.log" 2>&1 || :
-grep -qi "handshake failure\|alert number 40" "$TMP/sclient.log" \
-    || { sed -n '1,15p' "$TMP/sclient.log"; fail "no handshake_failure for a client without the key's scheme"; }
-echo "    ok: a client without the key's scheme gets handshake_failure"
+if openssl_has_option s_client -sigalgs; then
+    start_server rsa rsa
+    [ -n "$S_PORT" ] || { echo "    got: $OUT"; fail "the RSA server did not start"; }
+    openssl s_client -connect "127.0.0.1:$S_PORT" -servername localhost -tls1_3 \
+        -sigalgs ecdsa_secp256r1_sha256 </dev/null >"$TMP/sclient.log" 2>&1 || :
+    grep -qi -E "handshake failure|alert number 40" "$TMP/sclient.log" \
+        || { sed -n '1,15p' "$TMP/sclient.log"; fail "no handshake_failure for a client without the key's scheme"; }
+    echo "    ok: a client without the key's scheme gets handshake_failure"
+else
+    echo "    skip: a client without the key's scheme ($(openssl version) s_client has no -sigalgs)"
+fi
 
 # 4. The chain is exactly the certificates in the certificate text (#3378):
 #    a key between two certificates, and a combined key-and-certificate file
diff --git a/tests/integration/https_server_tls_pem/test_https_server_tls_pem.sh b/tests/integration/https_server_tls_pem/test_https_server_tls_pem.sh
index 0fbcb7823..2df8aaf7f 100644
--- a/tests/integration/https_server_tls_pem/test_https_server_tls_pem.sh
+++ b/tests/integration/https_server_tls_pem/test_https_server_tls_pem.sh
@@ -57,10 +57,10 @@ ssl env MSYS2_ARG_CONV_EXCL='/CN=' openssl req -x509 -new -key "$TMP/root.key" -
     -addext "keyUsage=critical,keyCertSign,cRLSign"
 ssl env MSYS2_ARG_CONV_EXCL='/CN=' openssl req -new -key "$TMP/inter.key" -out "$TMP/inter.csr" -subj "/CN=PEM Test Intermediate"
 ssl openssl x509 -req -in "$TMP/inter.csr" -CA "$TMP/root.pem" -CAkey "$TMP/root.key" -CAcreateserial \
-    -days 2 -extfile "$TMP/ca.ext" -out "$TMP/inter.pem"
+    -days 2 -sha256 -extfile "$TMP/ca.ext" -out "$TMP/inter.pem"
 ssl env MSYS2_ARG_CONV_EXCL='/CN=' openssl req -new -key "$TMP/leaf.key" -out "$TMP/leaf.csr" -subj "/CN=localhost"
 ssl openssl x509 -req -in "$TMP/leaf.csr" -CA "$TMP/inter.pem" -CAkey "$TMP/inter.key" -CAcreateserial \
-    -days 2 -extfile "$TMP/leaf.ext" -out "$TMP/leafonly.pem"
+    -days 2 -sha256 -extfile "$TMP/leaf.ext" -out "$TMP/leafonly.pem"
 cat "$TMP/leafonly.pem" "$TMP/inter.pem" >"$TMP/chain.pem"
 ssl openssl verify -CAfile "$TMP/root.pem" -untrusted "$TMP/inter.pem" "$TMP/leafonly.pem"
 ssl openssl pkey -in "$TMP/leaf.key" -aes256 -passout pass:secret -out "$TMP/enc.key"
@@ -104,7 +104,7 @@ start_server() {
     PIDS="$PIDS $spid"
     i=0
     while [ "$i" -lt 300 ]; do
-        grep -q 'READY\|FAIL' "$log" 2>/dev/null && break
+        grep -q -E 'READY|FAIL' "$log" 2>/dev/null && break
         sleep 0.1
         i=$((i + 1))
     done
diff --git a/tests/integration/https_tls_backend_select/test_https_tls_backend_select.sh b/tests/integration/https_tls_backend_select/test_https_tls_backend_select.sh
index 8db696107..c8c683d71 100644
--- a/tests/integration/https_tls_backend_select/test_https_tls_backend_select.sh
+++ b/tests/integration/https_tls_backend_select/test_https_tls_backend_select.sh
@@ -80,7 +80,7 @@ start_server() { # name backend -> PORT
     PIDS="$PIDS $!"
     i=0
     while [ "$i" -lt 100 ]; do
-        grep -q 'READY\|BACKEND-ERR\|FAIL' "$TMP/$1.log" 2>/dev/null && break
+        grep -q -E 'READY|BACKEND-ERR|FAIL' "$TMP/$1.log" 2>/dev/null && break
         sleep 0.1
         i=$((i + 1))
     done
@@ -110,15 +110,17 @@ done
 if [ "$HAVE_OPENSSL" = 1 ] && openssl s_client -help 2>&1 | grep -q -- '-tls1_2'; then
     # 2. The server backend really is the one chosen: a TLS 1.2-only client
     #    completes a handshake with OpenSSL and not with the pure server
-    #    (s_client prints "New, TLSv1.2, Cipher is ..." only on success).
+    #    (s_client prints "New, TLSv1.2, Cipher is ..." only on success;
+    #    LibreSSL's prints "New, TLSv1/SSLv3, Cipher is ..." on success and
+    #    "New, (NONE), Cipher is (NONE)" on failure, whatever the version).
     S12A=$(echo | openssl s_client -tls1_2 -connect "127.0.0.1:$PORT_aether" 2>&1 || :)
     S12O=$(echo | openssl s_client -tls1_2 -connect "127.0.0.1:$PORT_openssl" 2>&1 || :)
     case "$S12O" in
-        *"New, TLSv1.2"*) echo "    ok: the \"openssl\" server speaks TLS 1.2" ;;
+        *"New, TLSv1.2"*|*"New, TLSv1/SSLv3, Cipher is "[A-Za-z0-9]*) echo "    ok: the \"openssl\" server speaks TLS 1.2" ;;
         *) printf '%s\n' "$S12O" | sed -n '1,8p'; fail "the \"openssl\" server refused TLS 1.2" ;;
     esac
     case "$S12A" in
-        *"New, TLSv1.2"*) fail "the \"aether\" server negotiated TLS 1.2: it is not the pure server" ;;
+        *"New, TLSv1.2"*|*"New, TLSv1/SSLv3, Cipher is "[A-Za-z0-9]*) fail "the \"aether\" server negotiated TLS 1.2: it is not the pure server" ;;
         *) echo "    ok: the \"aether\" server refuses TLS 1.2 (the pure stack)" ;;
     esac
 fi
diff --git a/tests/integration/https_tls_reload/test_https_tls_reload.sh b/tests/integration/https_tls_reload/test_https_tls_reload.sh
index 24ad283cf..77c59ebbb 100644
--- a/tests/integration/https_tls_reload/test_https_tls_reload.sh
+++ b/tests/integration/https_tls_reload/test_https_tls_reload.sh
@@ -46,7 +46,7 @@ ssl env MSYS2_ARG_CONV_EXCL='/CN=' openssl req -x509 -new -key "$TMP/root.key" -
 for k in a b; do
     ssl env MSYS2_ARG_CONV_EXCL='/CN=' openssl req -new -key "$TMP/$k.key" -out "$TMP/$k.csr" -subj "/CN=localhost"
     ssl openssl x509 -req -in "$TMP/$k.csr" -CA "$TMP/root.pem" -CAkey "$TMP/root.key" -CAcreateserial \
-        -days 2 -extfile "$TMP/leaf.ext" -out "$TMP/$k.pem"
+        -days 2 -sha256 -extfile "$TMP/leaf.ext" -out "$TMP/$k.pem"
 done
 
 "$AE" build "$SCRIPT_DIR/reload.ae" -o "$TMP/reload" >"$TMP/build.log" 2>&1 \
diff --git a/tests/integration/https_windows_trust/test_https_windows_trust.sh b/tests/integration/https_windows_trust/test_https_windows_trust.sh
index 727bcba39..ed3b305f6 100755
--- a/tests/integration/https_windows_trust/test_https_windows_trust.sh
+++ b/tests/integration/https_windows_trust/test_https_windows_trust.sh
@@ -62,7 +62,7 @@ gen req -x509 $EC -keyout "$TMP/ca.key" -out "$TMP/ca.pem" -days 2 -nodes \
 gen req $EC -keyout "$TMP/leaf.key" -out "$TMP/leaf.csr" -nodes -subj "/CN=localhost"
 printf 'subjectAltName=DNS:localhost\nbasicConstraints=CA:FALSE\n' > "$TMP/leaf.ext"
 gen x509 -req -in "$TMP/leaf.csr" -CA "$TMP/ca.pem" -CAkey "$TMP/ca.key" -CAcreateserial \
-    -out "$TMP/leaf.pem" -days 2 -extfile "$TMP/leaf.ext"
+    -out "$TMP/leaf.pem" -days 2 -sha256 -extfile "$TMP/leaf.ext"
 # A CA that signed nothing here.
 gen req -x509 $EC -keyout "$TMP/other.key" -out "$TMP/other.pem" -days 2 -nodes \
     -subj "/CN=Aether Unrelated Test CA" \
diff --git a/tests/lib/test_openssl_conf.sh b/tests/lib/test_openssl_conf.sh
index 93c70b1a9..002c13238 100644
--- a/tests/lib/test_openssl_conf.sh
+++ b/tests/lib/test_openssl_conf.sh
@@ -21,3 +21,13 @@ test_openssl_conf() {
     fi
     export OPENSSL_CONF
 }
+
+# What this machine's openssl CLI and TLS library are. OpenBSD's is LibreSSL:
+# it has no ssl_conf configuration module, `s_server -cert_chain` or
+# `s_client -sigalgs`, reads no SSL_CERT_FILE of its own, prints its protocol
+# version differently, and cannot do Ed25519 certificates in TLS. A test whose
+# subject is one of those asks, and skips with the reason, rather than failing
+# on a tool that cannot do what it asks of it.
+openssl_is_libressl() { openssl version 2>/dev/null | grep -q '^LibreSSL'; }
+# openssl_has_option SUBCOMMAND OPTION: the subcommand's usage names the option.
+openssl_has_option() { openssl "$1" -help 2>&1 | grep -q -- "$2"; }

From 03cecc7c25e5c1e72c711a84aab233676a2740ca Mon Sep 17 00:00:00 2001
From: paul <paul@hammant.org>
Date: Tue, 10 Nov 2026 00:53:16 +0000
Subject: [PATCH 04/11] tests: skip, with the reason, what the host genuinely
 lacks

- ae_download_api_fallback: no release build for the host ("Platform: unsupported").
- musl targets (cross_linux_musl, cross_riscv64_loongarch64, sqlite_vendored_cross,
  and the cross legs of c_include_directive and source_directive): only when
  zig reports it could not build musl's libc.a, which it cannot on OpenBSD.
- cross_emit_lib: no target triple whose binary runs on OpenBSD/NetBSD.
- http_ipv6: OpenBSD's sockets are IPv6-only, so "::" is not dual-stack.
- string_into_c_memory / ownership_grid: no malloc_usable_size on OpenBSD.
- sandbox_toolchain: spawn_sandboxed is Linux and FreeBSD only.
- checksec_hardening: libc has no __*_chk, so FORTIFY is asserted to be "no".
- killed_compiler_diagnostic: kill the stand-in with SIGKILL; ksh answers a
  SIGTERM to itself with exit 143, which is an exit, not a signal death.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../test_ae_download_api_fallback.sh          |  8 +++-
 .../test_c_include_directive.sh               |  5 +-
 .../test_checksec_hardening.sh                | 47 ++++++++++++-------
 .../cross_emit_lib/test_cross_emit_lib.sh     | 27 +++++++----
 .../cross_linux_musl/test_cross_linux_musl.sh | 13 +++--
 .../test_cross_riscv64_loongarch64.sh         | 10 ++--
 tests/integration/http_ipv6/test_http_ipv6.sh | 14 ++++--
 .../test_killed_compiler_diagnostic.sh        |  8 ++--
 .../test_sandbox_toolchain.sh                 |  9 +++-
 .../source_directive/test_source_directive.sh |  5 +-
 .../test_sqlite_vendored_cross.sh             | 13 +++--
 .../test_string_into_c_memory.sh              | 10 +++-
 tests/ownership_grid/run.ae                   |  5 +-
 13 files changed, 121 insertions(+), 53 deletions(-)

diff --git a/tests/integration/ae_download_api_fallback/test_ae_download_api_fallback.sh b/tests/integration/ae_download_api_fallback/test_ae_download_api_fallback.sh
index ef3a71fe0..f01de77bf 100755
--- a/tests/integration/ae_download_api_fallback/test_ae_download_api_fallback.sh
+++ b/tests/integration/ae_download_api_fallback/test_ae_download_api_fallback.sh
@@ -19,6 +19,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 . "$ROOT/tests/lib/server_jobs.sh"
 AE="$ROOT/build/ae"
 [ -n "${EXE_EXT:-}" ] && AE="$AE$EXE_EXT"
@@ -40,6 +41,9 @@ fail() {
 
 PLAT="$("$AE" version 2>&1 | sed -n 's/^Platform:[[:space:]]*//p' | head -1)"
 [ -n "$PLAT" ] || { echo "  [SKIP] ae_download_api_fallback: cannot read the platform from 'ae version'"; exit 0; }
+# A host with no release build (OpenBSD, NetBSD, ...) has no asset to serve:
+# `ae version` says "unsupported" and `ae version install` takes the source path.
+[ "$PLAT" = unsupported ] && { echo "  [SKIP] ae_download_api_fallback: no release build for this host ($(uname -s))"; exit 0; }
 case "$PLAT" in windows*) echo "  [SKIP] ae_download_api_fallback: zip archives, not covered here"; exit 0 ;; esac
 
 # A release archive that passes ae's post-extract checks: flat layout, a
@@ -49,8 +53,8 @@ ASSET="aether-9.9.9-$PLAT.tar.gz"
 mkdir -p "$TMP/pkg/bin" "$TMP/pkg/lib/aether" "$TMP/pkg/share/aether" "$TMP/rel"
 printf '#!/bin/sh\necho aetherc 9.9.9\n' > "$TMP/pkg/bin/aetherc"
 chmod 755 "$TMP/pkg/bin/aetherc"; cp "$TMP/pkg/bin/aetherc" "$TMP/pkg/bin/ae"
-{ printf '!<arch>\n'; head -c 70000 /dev/urandom; } > "$TMP/pkg/lib/aether/libaether.a"
-head -c 20000 /dev/urandom > "$TMP/pkg/share/aether/pad.bin"
+{ printf '!<arch>\n'; head_c 70000 /dev/urandom; } > "$TMP/pkg/lib/aether/libaether.a"
+head_c 20000 /dev/urandom > "$TMP/pkg/share/aether/pad.bin"
 echo 9.9.9 > "$TMP/pkg/VERSION"
 ( cd "$TMP/pkg" && COPYFILE_DISABLE=1 tar -czf "$TMP/rel/$ASSET" . )
 
diff --git a/tests/integration/c_include_directive/test_c_include_directive.sh b/tests/integration/c_include_directive/test_c_include_directive.sh
index d51d9f6de..ce24e830d 100644
--- a/tests/integration/c_include_directive/test_c_include_directive.sh
+++ b/tests/integration/c_include_directive/test_c_include_directive.sh
@@ -15,6 +15,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 AE="$ROOT/build/ae"
 AETHERC="$ROOT/build/aetherc"
 
@@ -122,9 +123,11 @@ cross="cross build: zig not on PATH, skipped"
 if command -v zig >/dev/null 2>&1; then
     if (cd "$tmp/proj" && "$AE" build --lib "$tmp/lib" main.ae --target=x86_64-linux-musl -o "$tmp/cross_main" >"$tmp/cross.log" 2>&1) && [ -f "$tmp/cross_main" ]; then
         cross="the cross path finds it too"
+    elif zig_musl_unavailable "$tmp/cross.log"; then
+        cross="cross build skipped: zig cannot build musl libc.a on this host"
     else
         echo "  [FAIL] c_include_directive: ae build --target did not find the module's header"
-        grep -i "error\|not found" "$tmp/cross.log" | head -3 | sed 's/^/        /'
+        grep -i -E "error|not found" "$tmp/cross.log" | head -3 | sed 's/^/        /'
         fail=1
     fi
 fi
diff --git a/tests/integration/checksec_hardening/test_checksec_hardening.sh b/tests/integration/checksec_hardening/test_checksec_hardening.sh
index b898d7a30..d1e1aa015 100755
--- a/tests/integration/checksec_hardening/test_checksec_hardening.sh
+++ b/tests/integration/checksec_hardening/test_checksec_hardening.sh
@@ -157,23 +157,34 @@ esac
 # Apple libc, all of them non-zero); an unfortified one writes past the object
 # and prints. Both halves are asserted, because a process that dies for some
 # other reason would otherwise look like a pass.
-if ! "$AE" build "$TMP/overflow.ae" --extra "$TMP/probe_copy.c" -o "$TMP/overflow" \
-        >"$TMP/overflow_build.log" 2>&1; then
-    sed 's/^/        /' "$TMP/overflow_build.log" | head -10
-    fail "the overflow probe did not build"
-fi
-OVERFLOW="$(sed -n 's/^Built[^:]*: //p' "$TMP/overflow_build.log" | tail -1)"
-[ -n "$OVERFLOW" ] || fail "the overflow build printed no artifact path"
-
-overflow_out="$("$OVERFLOW" 2>&1)"
-overflow_rc=$?
-[ "$overflow_rc" -ne 0 ] \
-    || fail "the overflow completed with exit 0: FORTIFY did not catch a 32-byte write into a 16-byte object"
-case "$overflow_out" in
-    *"overflow not caught"*)
-        fail "the overflow ran to completion (output: $overflow_out): FORTIFY is not in effect" ;;
+# OpenBSD's libc has no __*_chk functions and its compiler no _FORTIFY_SOURCE
+# lowering to them: there is nothing to fortify there, so the overflow below
+# completes by design, and checksec must say so (a "no", not a "yes" or an
+# "n/a") rather than the test pretending the protection exists.
+case "$(uname -s)" in
+    OpenBSD) HAS_FORTIFY=no ;;
+    *)       HAS_FORTIFY=yes ;;
 esac
 
+if [ "$HAS_FORTIFY" = yes ]; then
+    if ! "$AE" build "$TMP/overflow.ae" --extra "$TMP/probe_copy.c" -o "$TMP/overflow" \
+            >"$TMP/overflow_build.log" 2>&1; then
+        sed 's/^/        /' "$TMP/overflow_build.log" | head -10
+        fail "the overflow probe did not build"
+    fi
+    OVERFLOW="$(sed -n 's/^Built[^:]*: //p' "$TMP/overflow_build.log" | tail -1)"
+    [ -n "$OVERFLOW" ] || fail "the overflow build printed no artifact path"
+
+    overflow_out="$("$OVERFLOW" 2>&1)"
+    overflow_rc=$?
+    [ "$overflow_rc" -ne 0 ] \
+        || fail "the overflow completed with exit 0: FORTIFY did not catch a 32-byte write into a 16-byte object"
+    case "$overflow_out" in
+        *"overflow not caught"*)
+            fail "the overflow ran to completion (output: $overflow_out): FORTIFY is not in effect" ;;
+    esac
+fi
+
 # And what checksec reads back agrees. glibc and Apple libc leave a __*_chk
 # call to find; mingw-w64 inlines the check, so a PE with no symbol table has
 # nothing to read and says n/a rather than guessing "no". The run above is
@@ -184,13 +195,15 @@ case "$fmt" in
               yes|n/a) ;;
               *) fail "FORTIFY is '$fortify' on PE, expected yes or n/a" ;;
           esac ;;
-    *)    [ "$fortify" = "yes" ] || fail "FORTIFY is '$fortify' on $fmt, expected yes" ;;
+    *)    [ "$fortify" = "$HAS_FORTIFY" ] || fail "FORTIFY is '$fortify' on $fmt, expected $HAS_FORTIFY" ;;
 esac
 
 # The gate agrees with the report, and it is the same gate everywhere: a
 # property the format cannot express reports n/a and satisfies --require, so
 # `relro-full` is in this list on Mach-O and PE too.
-"$AE" checksec --require "pie,nx,relro-full,canary,fortify" "$PROBE" >/dev/null 2>&1 \
+REQUIRE="pie,nx,relro-full,canary"
+[ "$HAS_FORTIFY" = yes ] && REQUIRE="$REQUIRE,fortify"
+"$AE" checksec --require "$REQUIRE" "$PROBE" >/dev/null 2>&1 \
     || fail "--require rejected a binary the report says is hardened"
 
 # And the gate is a gate: something the report says the binary lacks must fail
diff --git a/tests/integration/cross_emit_lib/test_cross_emit_lib.sh b/tests/integration/cross_emit_lib/test_cross_emit_lib.sh
index 2273b4882..7a7f48bb7 100755
--- a/tests/integration/cross_emit_lib/test_cross_emit_lib.sh
+++ b/tests/integration/cross_emit_lib/test_cross_emit_lib.sh
@@ -33,6 +33,7 @@ set -e
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 AE="$ROOT/build/ae"
 
 if ! command -v zig >/dev/null 2>&1; then
@@ -60,7 +61,7 @@ if [ ! -f "$TMPDIR_T/libgreet.so" ]; then
     exit 1
 fi
 
-DESC=$(file "$TMPDIR_T/libgreet.so" 2>/dev/null || echo "")
+DESC=$(file_desc "$TMPDIR_T/libgreet.so" 2>/dev/null || echo "")
 case "$DESC" in
     *"shared object"*aarch64*) ;;
     *)
@@ -73,9 +74,9 @@ esac
 # The symbol has to be there. A stripped-to-nothing .so links fine and is
 # useless to the consumer this feature exists for.
 if command -v nm >/dev/null 2>&1; then
-    if ! nm -D --defined-only "$TMPDIR_T/libgreet.so" 2>/dev/null | grep -q "aether_greet"; then
+    if ! dyn_syms "$TMPDIR_T/libgreet.so" | grep -q "aether_greet"; then
         echo "  [FAIL] cross_emit_lib: aether_greet not exported from the .so"
-        nm -D --defined-only "$TMPDIR_T/libgreet.so" 2>/dev/null | head -10 | sed 's/^/    /'
+        dyn_syms "$TMPDIR_T/libgreet.so" | head -10 | sed 's/^/    /'
         exit 1
     fi
 fi
@@ -100,7 +101,7 @@ if [ ! -f "$TMPDIR_T/greet.dll" ]; then
     exit 1
 fi
 
-DESC=$(file "$TMPDIR_T/greet.dll" 2>/dev/null || echo "")
+DESC=$(file_desc "$TMPDIR_T/greet.dll" 2>/dev/null || echo "")
 case "$DESC" in
     *DLL*) ;;
     *)
@@ -186,8 +187,8 @@ fi
 # executable (e_type 2) beside a shared object (e_type 3), or a PE image
 # beside one with the IMAGE_FILE_DLL bit.
 if [ "$BOTH_KIND" = elf ]; then
-    et_exe=$(od -An -tu2 -j16 -N2 "$TMPDIR_T/$BOTH_EXE" | tr -d ' ')
-    et_lib=$(od -An -tu2 -j16 -N2 "$TMPDIR_T/$BOTH_LIB" | tr -d ' ')
+    et_exe=$(od_uint "$TMPDIR_T/$BOTH_EXE" 16 2)
+    et_lib=$(od_uint "$TMPDIR_T/$BOTH_LIB" 16 2)
     if [ "$et_exe" != 2 ] && [ "$et_exe" != 3 ]; then
         echo "  [FAIL] cross_emit_lib: --emit=both's executable is not an ELF image (e_type $et_exe)"; exit 1
     fi
@@ -196,8 +197,8 @@ if [ "$BOTH_KIND" = elf ]; then
     fi
 else
     pe_chars() {
-        off=$(od -An -tu4 -j60 -N4 "$1" | tr -d ' ')
-        od -An -tu2 -j$((off + 22)) -N2 "$1" | tr -d ' '
+        off=$(od_uint "$1" 60 4)
+        od_uint "$1" $((off + 22)) 2
     }
     c_exe=$(pe_chars "$TMPDIR_T/$BOTH_EXE")
     c_lib=$(pe_chars "$TMPDIR_T/$BOTH_LIB")
@@ -255,6 +256,14 @@ case "$(uname -s)/$(uname -m)" in
         SL_LIBS="-lws2_32 -lcrypt32 -lgdi32 -luser32 -ladvapi32 -lbcrypt -ldbghelp" ;;
     Linux/x86_64|*)       SL_TARGET=x86_64-linux-musl ;;
 esac
+# Nothing here can run a Linux, macOS or Windows binary: no triple to match.
+case "$(uname -s)" in
+    OpenBSD|NetBSD)
+        echo "  [PASS] cross_emit_lib: aarch64 .so with exports, PE .dll named correctly,"
+        echo "         --emit=both builds both, named for the target"
+        echo "         (static archive link-and-run skipped: $(uname -s) has no target triple whose binary runs here)"
+        exit 0 ;;
+esac
 if ! "$AE" build --target="$SL_TARGET" --emit=staticlib "$LIB" \
         -o "$TMPDIR_T/libgreet.a" > "$TMPDIR_T/sl.log" 2>&1; then
     echo "  [FAIL] cross_emit_lib: --emit=staticlib did not build"
@@ -276,7 +285,7 @@ if grep -q 'install_name_tool' "$TMPDIR_T/elf.log"; then
     exit 1
 fi
 
-DESC=$(file "$TMPDIR_T/libgreet.a" 2>/dev/null || echo "")
+DESC=$(file_desc "$TMPDIR_T/libgreet.a" 2>/dev/null || echo "")
 case "$DESC" in
     *archive*) ;;
     *)
diff --git a/tests/integration/cross_linux_musl/test_cross_linux_musl.sh b/tests/integration/cross_linux_musl/test_cross_linux_musl.sh
index 83d092558..bca1f3021 100755
--- a/tests/integration/cross_linux_musl/test_cross_linux_musl.sh
+++ b/tests/integration/cross_linux_musl/test_cross_linux_musl.sh
@@ -23,6 +23,7 @@ set -e
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 AE="$ROOT/build/ae"
 
 [ -x "$AE" ] || { echo "  [SKIP] cross_linux_musl: ae not built"; exit 0; }
@@ -37,9 +38,13 @@ printf 'main() {\n    println("musl-ok")\n    return 0\n}\n' > "$TMP/hello.ae"
 
 # --- x86_64 musl: the full set of claims -----------------------------------
 "$AE" build "$TMP/hello.ae" --target=x86_64-linux-musl -o "$TMP/x64" \
-    >"$TMP/b1.log" 2>&1 || { sed -n '1,10p' "$TMP/b1.log"; fail "x86_64-linux-musl did not build"; }
+    >"$TMP/b1.log" 2>&1 || {
+        if zig_musl_unavailable "$TMP/b1.log"; then
+            echo "  [SKIP] cross_linux_musl: zig cannot build musl libc.a on this host"; exit 0
+        fi
+        sed -n '1,10p' "$TMP/b1.log"; fail "x86_64-linux-musl did not build"; }
 
-desc=$(file -b "$TMP/x64" 2>/dev/null || echo "")
+desc=$(file_desc "$TMP/x64" 2>/dev/null || echo "")
 case "$desc" in
     *"statically linked"*) ;;
     *) fail "x86_64-linux-musl is not statically linked: $desc" ;;
@@ -58,7 +63,7 @@ fi
 # --- the gnu target must be unchanged --------------------------------------
 "$AE" build "$TMP/hello.ae" --target=x86_64-linux -o "$TMP/gnu" \
     >"$TMP/b2.log" 2>&1 || { sed -n '1,10p' "$TMP/b2.log"; fail "x86_64-linux did not build"; }
-case "$(file -b "$TMP/gnu" 2>/dev/null)" in
+case "$(file_desc "$TMP/gnu" 2>/dev/null)" in
     *"dynamically linked"*) ;;
     *) fail "x86_64-linux should still be dynamically linked (musl rows changed it)" ;;
 esac
@@ -66,7 +71,7 @@ esac
 # --- aarch64 musl ----------------------------------------------------------
 "$AE" build "$TMP/hello.ae" --target=aarch64-linux-musl -o "$TMP/a64" \
     >"$TMP/b3.log" 2>&1 || { sed -n '1,10p' "$TMP/b3.log"; fail "aarch64-linux-musl did not build"; }
-desc=$(file -b "$TMP/a64" 2>/dev/null || echo "")
+desc=$(file_desc "$TMP/a64" 2>/dev/null || echo "")
 case "$desc" in
     *"statically linked"*) ;;
     *) fail "aarch64-linux-musl is not statically linked: $desc" ;;
diff --git a/tests/integration/cross_riscv64_loongarch64/test_cross_riscv64_loongarch64.sh b/tests/integration/cross_riscv64_loongarch64/test_cross_riscv64_loongarch64.sh
index 913e78340..06aa50b04 100755
--- a/tests/integration/cross_riscv64_loongarch64/test_cross_riscv64_loongarch64.sh
+++ b/tests/integration/cross_riscv64_loongarch64/test_cross_riscv64_loongarch64.sh
@@ -18,6 +18,7 @@ set -e
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 AE="$ROOT/build/ae"
 
 [ -x "$AE" ] || { echo "  [SKIP] cross_riscv64_loongarch64: ae not built"; exit 0; }
@@ -64,9 +65,12 @@ ran=""
 skipped=""
 check() {   # <target> <file(1) machine text> <qemu arch> <min qemu major> <min minor>
     t="$1"
-    "$AE" build "$TMP/ping.ae" --target="$t" -o "$TMP/$t" > "$TMP/$t.log" 2>&1 ||
-        { sed -n '1,10p' "$TMP/$t.log"; fail "$t did not build"; }
-    desc=$(file -b "$TMP/$t" 2>/dev/null || echo "")
+    "$AE" build "$TMP/ping.ae" --target="$t" -o "$TMP/$t" > "$TMP/$t.log" 2>&1 || {
+        if zig_musl_unavailable "$TMP/$t.log"; then
+            echo "  [SKIP] cross_riscv64_loongarch64: zig cannot build musl libc.a on this host"; exit 0
+        fi
+        sed -n '1,10p' "$TMP/$t.log"; fail "$t did not build"; }
+    desc=$(file_desc "$TMP/$t" 2>/dev/null || echo "")
     case "$desc" in *"statically linked"*) ;; *) fail "$t is not statically linked: $desc" ;; esac
     case "$desc" in *"$2"*) ;; *) fail "$t produced the wrong machine: $desc" ;; esac
     # The first of qemu-<arch>-static / qemu-<arch> on PATH that is new enough:
diff --git a/tests/integration/http_ipv6/test_http_ipv6.sh b/tests/integration/http_ipv6/test_http_ipv6.sh
index f17501cb0..1455f1bde 100755
--- a/tests/integration/http_ipv6/test_http_ipv6.sh
+++ b/tests/integration/http_ipv6/test_http_ipv6.sh
@@ -67,7 +67,7 @@ start() {
     SRV_PID=$!
     _i=0
     while [ "$_i" -lt 100 ]; do
-        grep -q "READY\|BIND FAILED" "$_log" 2>/dev/null && break
+        grep -q -E "READY|BIND FAILED" "$_log" 2>/dev/null && break
         sleep 0.1
         _i=$((_i + 1))
     done
@@ -130,9 +130,13 @@ stop_server "$SRV_PID"; SRV_PID=""
 
 # The "::" wildcard is what dual-stack means, and on Windows each new
 # executable listening on it opens a firewall prompt (#2639). There the
-# dual-stack parts are left out and TLS runs over ::1 alone.
+# dual-stack parts are left out and TLS runs over ::1 alone. OpenBSD has no
+# dual-stack at all (inet6(4): an AF_INET6 socket is IPv6-only, and
+# IPV6_V6ONLY cannot be cleared), so "::" there answers [::1] and never
+# 127.0.0.1: the same parts are left out, for that reason.
 case "$(uname -s)" in
-    MINGW*|MSYS*|CYGWIN*) WILDCARD=no ;;
+    MINGW*|MSYS*|CYGWIN*) WILDCARD=no; WILDCARD_WHY="Windows (wildcard listener)" ;;
+    OpenBSD) WILDCARD=no; WILDCARD_WHY="OpenBSD (no dual-stack sockets)" ;;
     *) WILDCARD=yes ;;
 esac
 
@@ -144,7 +148,7 @@ if [ "$WILDCARD" = yes ]; then
     stop_server "$SRV_PID"; SRV_PID=""
     DUAL_NOTE="dual-stack ::"
 else
-    DUAL_NOTE="dual-stack skipped on Windows (wildcard listener)"
+    DUAL_NOTE="dual-stack skipped on $WILDCARD_WHY"
 fi
 
 # --- 3. "localhost" still means 127.0.0.1 ---
@@ -181,7 +185,7 @@ fi
 
 # --- 5. TinyWeb WebSocket, SSE and long poll ---
 if [ "$WILDCARD" = no ]; then
-    STREAMS_NOTE="TinyWeb streams skipped on Windows (wildcard listener)"
+    STREAMS_NOTE="TinyWeb streams skipped on $WILDCARD_WHY"
 else
     streams "plain HTTP"
     STREAMS_NOTE="ws/SSE/long poll over HTTP"
diff --git a/tests/integration/killed_compiler_diagnostic/test_killed_compiler_diagnostic.sh b/tests/integration/killed_compiler_diagnostic/test_killed_compiler_diagnostic.sh
index e50a0e382..8c2145cff 100644
--- a/tests/integration/killed_compiler_diagnostic/test_killed_compiler_diagnostic.sh
+++ b/tests/integration/killed_compiler_diagnostic/test_killed_compiler_diagnostic.sh
@@ -50,13 +50,15 @@ killed="kill case: not stageable on this platform, skipped"
 if [ "$WINDOWS" = 0 ]; then
     cat > "$tmp/suicidal-cc" <<'EOF'
 #!/bin/sh
-# Stand in for a C compiler the OS takes away mid-build.
-kill -TERM $$
+# Stand in for a C compiler the OS takes away mid-build. SIGKILL, which no
+# shell can catch: OpenBSD's ksh answers a SIGTERM sent to itself by exiting
+# with status 143, which is an exit, not a death by signal.
+kill -KILL $$
 sleep 5
 EOF
     chmod +x "$tmp/suicidal-cc"
     out="$(AE_CC="$tmp/suicidal-cc" "$AE" run "$tmp/good.ae" 2>&1)"
-    if printf '%s\n' "$out" | grep -q 'Build failed\. (killed by signal 15'; then
+    if printf '%s\n' "$out" | grep -q 'Build failed\. (killed by signal 9'; then
         killed="a killed compile step names its signal"
     else
         echo "  [FAIL] killed_compiler_diagnostic: a killed compile step did not name its signal"
diff --git a/tests/integration/sandbox_toolchain/test_sandbox_toolchain.sh b/tests/integration/sandbox_toolchain/test_sandbox_toolchain.sh
index 6bee81484..a22fab90e 100755
--- a/tests/integration/sandbox_toolchain/test_sandbox_toolchain.sh
+++ b/tests/integration/sandbox_toolchain/test_sandbox_toolchain.sh
@@ -21,6 +21,7 @@ set -e
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/syslibs.sh"
 
 case "$(uname -s 2>/dev/null)" in
     MINGW*|MSYS*|CYGWIN*|Windows_NT)
@@ -30,6 +31,12 @@ case "$(uname -s 2>/dev/null)" in
         # spawn_sandboxed uses fork/shm_open/LD_PRELOAD — Linux-only.
         echo "  [SKIP] sandbox preload is Linux-only (LD_PRELOAD)"
         exit 0 ;;
+    Linux|FreeBSD) ;;
+    *)
+        # NetBSD, OpenBSD: ae's spawn_sandboxed answers "only available on
+        # Linux and FreeBSD", so there is no sandboxed child to build in.
+        echo "  [SKIP] spawn_sandboxed is Linux and FreeBSD only"
+        exit 0 ;;
 esac
 
 AE="$ROOT/build/ae"
@@ -47,7 +54,7 @@ TMPDIR="$(mktemp -d)"
 trap 'rm -rf "$TMPDIR" || true' EXIT
 
 # 1. Build the preload (matches what install.sh does for downstreams).
-cc -shared -fPIC -o "$TMPDIR/libaether_sandbox.so" "$PRELOAD_SRC" -ldl -lrt 2>"$TMPDIR/preload-cc.log" || {
+cc -shared -fPIC -o "$TMPDIR/libaether_sandbox.so" "$PRELOAD_SRC" $AE_DL_LIBS $AE_RT_LIBS 2>"$TMPDIR/preload-cc.log" || {
     echo "  [FAIL] preload .so build failed:"
     cat "$TMPDIR/preload-cc.log"
     exit 1
diff --git a/tests/integration/source_directive/test_source_directive.sh b/tests/integration/source_directive/test_source_directive.sh
index df7262402..1cfe61b8b 100644
--- a/tests/integration/source_directive/test_source_directive.sh
+++ b/tests/integration/source_directive/test_source_directive.sh
@@ -12,6 +12,7 @@
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 AE="$ROOT/build/ae"
 AETHERC="$ROOT/build/aetherc"
 
@@ -128,9 +129,11 @@ cross="cross build: zig not on PATH, skipped"
 if command -v zig >/dev/null 2>&1; then
     if (cd "$tmp/proj" && "$AE" build --lib "$tmp/my lib" main.ae --target=x86_64-linux-musl -o "$tmp/cross_main" >"$tmp/cross.log" 2>&1) && [ -f "$tmp/cross_main" ]; then
         cross="cross build links the module C"
+    elif zig_musl_unavailable "$tmp/cross.log"; then
+        cross="cross build skipped: zig cannot build musl libc.a on this host"
     else
         echo "  [FAIL] source_directive: ae build --target=x86_64-linux-musl did not link the module's C"
-        grep -i "undefined\|error" "$tmp/cross.log" | head -3 | sed 's/^/        /'
+        grep -i -E "undefined|error" "$tmp/cross.log" | head -3 | sed 's/^/        /'
         fail=1
     fi
 fi
diff --git a/tests/integration/sqlite_vendored_cross/test_sqlite_vendored_cross.sh b/tests/integration/sqlite_vendored_cross/test_sqlite_vendored_cross.sh
index a390d532c..2965cb337 100644
--- a/tests/integration/sqlite_vendored_cross/test_sqlite_vendored_cross.sh
+++ b/tests/integration/sqlite_vendored_cross/test_sqlite_vendored_cross.sh
@@ -22,6 +22,7 @@
 set -e
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+. "$ROOT/tests/lib/portable.sh"
 AE="$ROOT/build/ae"
 [ -x "$AE" ] || { echo "  [SKIP] sqlite_vendored_cross: ae not built"; exit 0; }
 command -v zig >/dev/null 2>&1 || { echo "  [SKIP] sqlite_vendored_cross: zig not on PATH (scripts/get-zig.sh)"; exit 0; }
@@ -42,7 +43,7 @@ HOST_ARCH="$(uname -m)"
 
 fail() {
     echo "  [FAIL] sqlite_vendored_cross: $1"
-    [ -n "${2:-}" ] && printf '%s\n' "$2" | grep -vE '^\s*$' | tail -12 | sed 's/^/    /'
+    [ -n "${2:-}" ] && printf '%s\n' "$2" | grep -vE '^[[:space:]]*$' | tail -12 | sed 's/^/    /'
     exit 1
 }
 
@@ -82,8 +83,12 @@ for target in $TARGETS; do
 
     cold=1
     ls "$AETHER_CACHE_DIR" | grep -q "^sqlite3-$target-.*\.o$" && cold=0
-    FIRST=$(cd "$T" && "$AE" build --target="$target" version.ae -o "version-$target" 2>&1) \
-        || fail "version.ae did not build for $target" "$FIRST"
+    FIRST=$(cd "$T" && "$AE" build --target="$target" version.ae -o "version-$target" 2>&1) || {
+        case "$FIRST" in
+            *"sub-compilation of musl libc.a failed"*)
+                echo "  [SKIP] sqlite_vendored_cross: zig cannot build musl libc.a on this host"; exit 0 ;;
+        esac
+        fail "version.ae did not build for $target" "$FIRST"; }
     if [ "$cold" = 1 ]; then
         case "$FIRST" in *"Compiling SQLite for $target"*) ;;
             *) fail "a cold cache did not compile SQLite for $target" "$FIRST" ;; esac
@@ -97,7 +102,7 @@ for target in $TARGETS; do
     case "$SPEC_OUT" in *"Compiling SQLite"*) fail "a warm cache recompiled SQLite for $target" "$SPEC_OUT" ;; esac
 
     if command -v file >/dev/null 2>&1; then
-        desc="$(file -b "$T/version-$target")"
+        desc="$(file_desc "$T/version-$target")"
         printf '%s' "$desc" | grep -q "$want_file" || fail "$target binary has the wrong arch" "$desc"
         printf '%s' "$desc" | grep -q "statically linked" || fail "$target binary is not static" "$desc"
     fi
diff --git a/tests/integration/string_into_c_memory/test_string_into_c_memory.sh b/tests/integration/string_into_c_memory/test_string_into_c_memory.sh
index 409cbeef6..8300f17e7 100755
--- a/tests/integration/string_into_c_memory/test_string_into_c_memory.sh
+++ b/tests/integration/string_into_c_memory/test_string_into_c_memory.sh
@@ -146,7 +146,12 @@ else
         fails=$((fails + 1))
     fi
 fi
-if [ "$(uname -s)" != Darwin ]; then
+# The poisoning allocator needs the size of the block it poisons. macOS's
+# linker has no --wrap, and OpenBSD's libc has no malloc_usable_size (or any
+# other way to ask a block's size), so neither can build poison_alloc.c.
+case "$(uname -s)" in
+    Darwin|OpenBSD) echo "    skip: poisoning allocator (needs ld --wrap and malloc_usable_size)" ;;
+    *)
     WRAP="-Wl,--wrap=free,--wrap=realloc,--wrap=aether_numa_free,--wrap=aether_numa_free_aligned"
     if (cd "$TMP" && AETHER_HOME="$ROOT" AE_CC="${AE_CC:-${CC:-cc}} $WRAP" "$AE" build "$SCRIPT_DIR/prog.ae" \
             --extra "$ROOT/tests/ownership_grid/poison_alloc.c" -o "$TMP/poisoned") > "$TMP/pbuild.log" 2>&1; then
@@ -160,7 +165,8 @@ if [ "$(uname -s)" != Darwin ]; then
         sed 's/^/        /' "$TMP/pbuild.log" | head -8
         fails=$((fails + 1))
     fi
-fi
+    ;;
+esac
 
 [ "$fails" -eq 0 ] || exit 1
 echo "  [PASS] string_into_c_memory: a string into C memory that outlives the function goes through string.keep; block-local memory takes a local"
diff --git a/tests/ownership_grid/run.ae b/tests/ownership_grid/run.ae
index 9e9d044c2..0dca3bc5c 100644
--- a/tests/ownership_grid/run.ae
+++ b/tests/ownership_grid/run.ae
@@ -2092,6 +2092,9 @@ write_report(results_in: ptr, modes: ptr, wall_ms: long, jobs: int, check_text:
     if conf(C_SYSTEM) == "Darwin" {
         strbuilder.append(b, "\nThe poisoning allocator was not built: this linker has no `--wrap` (macOS), so no cell is UAF here.\n")
     }
+    if conf(C_SYSTEM) == "OpenBSD" {
+        strbuilder.append(b, "\nThe poisoning allocator was not built: OpenBSD's libc has no malloc_usable_size, so no cell is UAF here.\n")
+    }
     if any_status(results, "UNMEASURED") {
         strbuilder.append(b, "\n**The heap count is not exact on this platform: growth was not measured, so this run checks values and use after free only.**\n")
     }
@@ -2947,7 +2950,7 @@ main() {
     } else {
         collections.string_list_add(modes, mode)
     }
-    if conf(C_SYSTEM) != "Darwin" && !no_shim {
+    if conf(C_SYSTEM) != "Darwin" && conf(C_SYSTEM) != "OpenBSD" && !no_shim {
         g_use_shim = 1
     }
     cells = list.new()

From ed19a0c2372b4cf96ce2345c613b7e4a37621dea Mon Sep 17 00:00:00 2001
From: paul <paul@hammant.org>
Date: Tue, 10 Nov 2026 01:09:41 +0000
Subject: [PATCH 05/11] tests: deep_constants scans its C by split, not substr
 per character

The nesting scan read each line with substr($0, i, 1). The awk of OpenBSD
rescans the line from its start on every call, and these lines hold
1000-link constant chains: 5m52s alone, past the 420s per-test limit once the
suite ran in parallel. One split() per line: 10s.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 tests/integration/deep_constants/test_deep_constants.sh | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/tests/integration/deep_constants/test_deep_constants.sh b/tests/integration/deep_constants/test_deep_constants.sh
index 65a25fc72..7b9278ff8 100755
--- a/tests/integration/deep_constants/test_deep_constants.sh
+++ b/tests/integration/deep_constants/test_deep_constants.sh
@@ -73,11 +73,14 @@ AETHER_HOME="$ROOT" "$AETHERC" "$WORK/consts.ae" "$WORK/consts.c" >/dev/null 2>&
 d="$(awk 'BEGIN { d = 0; m = 0 }
           /^[ \t]*#/ { next }
           { gsub(/_AE_SEQ_OPEN/, "({"); gsub(/_AE_SEQ_CLOSE/, "; })")
-            n = length($0); str = 0
+            # One split, not a substr($0, i, 1) per character: the awk of OpenBSD
+            # rescans the line from its start on every substr, so a long line
+            # (these hold 1000-link chains) took six minutes to scan there.
+            n = split($0, ch, ""); str = 0
             for (i = 1; i <= n; i++) {
-                c = substr($0, i, 1)
+                c = ch[i]
                 if (str) { if (c == "\\") { i++; continue } if (c == q) str = 0; continue }
-                if (c == "/" && substr($0, i + 1, 1) == "/") break
+                if (c == "/" && ch[i + 1] == "/") break
                 if (c == "\"" || c == "\047") { str = 1; q = c; continue }
                 if (c == "(" || c == "[" || c == "{") { d++; if (d > m) m = d }
                 else if (c == ")" || c == "]" || c == "}") d--

From 3686eacfce4dbf35efc85b76a9afa53273586e33 Mon Sep 17 00:00:00 2001
From: paul <paul@hammant.org>
Date: Mon, 9 Nov 2026 21:37:40 +0000
Subject: [PATCH 06/11] win_batch_compiler_long_cmdline: keep each path under
 MAX_PATH

The test pushed the C command line past cmd.exe's 8191 cap with 25 --extra
paths of a fixed deep directory. Under a temp directory like MSYS2's
C:/msys64/tmp each path came to about 270 characters, past Windows' MAX_PATH,
so cc1 could open them only where long paths are enabled machine-wide
(LongPathsEnabled, set on GitHub's runners, off by default and on the win11
lab host): there it failed "No such file or directory" on every part, before
the response file the test is about was ever in question.

The deep directory is now sized from the temp directory's own length, so
each path is about 240 characters wherever TMP is, and as many parts are
added as keep the --extra list under ae's 8 KiB cap. The build runs
--verbose and the test checks ae says it wrote a response file, so the
command line is shown to be past the cap rather than assumed to be.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../test_win_batch_compiler_long_cmdline.sh   | 66 +++++++++++++------
 1 file changed, 46 insertions(+), 20 deletions(-)

diff --git a/tests/integration/win_batch_compiler_long_cmdline/test_win_batch_compiler_long_cmdline.sh b/tests/integration/win_batch_compiler_long_cmdline/test_win_batch_compiler_long_cmdline.sh
index 6810a1431..b9483e6d6 100644
--- a/tests/integration/win_batch_compiler_long_cmdline/test_win_batch_compiler_long_cmdline.sh
+++ b/tests/integration/win_batch_compiler_long_cmdline/test_win_batch_compiler_long_cmdline.sh
@@ -40,8 +40,24 @@ unset AE_CC CC
 mkdir -p "$TMP/cc"
 printf '@"%s" -DAE_CC_TAG=7 %%*\r\n' "$(cygpath -w "$REAL_CC")" > "$TMP/cc/gcc.cmd"
 
-# A directory whose name alone is long, so every --extra path is too.
-DEEP="$TMP/$(printf 'd%.0s' $(seq 1 60))/$(printf 'e%.0s' $(seq 1 60))/$(printf 'f%.0s' $(seq 1 60))"
+# A deep directory, so every --extra path is long. Each path stays under
+# Windows' MAX_PATH (260): past it, opening the file needs long paths
+# enabled machine-wide (LongPathsEnabled, on GitHub's runners and off by
+# default, as on the win11 lab host, where cc1 could not open one), which
+# is not what this test is about. The directory is sized from the temp
+# directory's own length, so the paths come out at about 240 characters
+# wherever TMP is.
+FNAME_LEN=62   # /part_with_a_long_file_name_to_lengthen_the_command_line_NN.c
+tmp_len=$(cygpath -m "$TMP" | awk '{ print length($0) }')
+room=$((240 - tmp_len - FNAME_LEN))
+DEEP="$TMP"
+for c in d e f g; do
+    [ "$room" -gt 1 ] || break
+    n=$room
+    [ "$n" -gt 61 ] && n=61
+    DEEP="$DEEP/$(printf "$c%.0s" $(seq 1 $((n - 1))))"
+    room=$((room - n))
+done
 mkdir -p "$DEEP"
 cd "$DEEP" || exit 1
 
@@ -64,29 +80,35 @@ int cc_tag(void) {
 }
 COF
 
-# Extra files (one `--extra` each), each named by an absolute path of about
-# 250 characters: with the deep directory in every other path of the C
-# command line, this takes it well past 8191 characters, while the --extra
-# list itself stays under ae's own 8 KiB cap on it.
+# Extra files (one `--extra` each), each named by its absolute path, as many
+# as keep the --extra list under ae's own 8 KiB cap on it (7600 bytes, with
+# room for tag.c and sum.c): the list alone is near the 8000 at which ae
+# writes a response file, and the rest of the C command line takes it past.
+# The build below runs --verbose and must say it did.
 extras="--extra tag.c"
-i=0
-while [ $i -lt 25 ]; do
-    f="part_with_a_long_file_name_to_lengthen_the_command_line_$i.c"
-    printf 'int part_%d(void) { return 1; }\n' "$i" > "$f"
-    extras="$extras --extra $(cygpath -m "$DEEP/$f")"
-    i=$((i + 1))
+list_len=0
+nparts=0
+while :; do
+    f="part_with_a_long_file_name_to_lengthen_the_command_line_$nparts.c"
+    p="$(cygpath -m "$DEEP/$f")"
+    [ $((list_len + ${#p} + 1)) -le 7600 ] || break
+    printf 'int part_%d(void) { return 1; }\n' "$nparts" > "$f"
+    extras="$extras --extra $p"
+    list_len=$((list_len + ${#p} + 1))
+    nparts=$((nparts + 1))
 done
 {
     printf 'int part_sum(void) {\n    int s = 0;\n'
     i=0
-    while [ $i -lt 25 ]; do printf '    { extern int part_%d(void); s += part_%d(); }\n' "$i" "$i"; i=$((i + 1)); done
+    while [ $i -lt $nparts ]; do printf '    { extern int part_%d(void); s += part_%d(); }\n' "$i" "$i"; i=$((i + 1)); done
     printf '    return s;\n}\n'
 } > sum.c
 extras="$extras --extra sum.c"
+want="tag=7 parts=$nparts"
 
 # $extras is expanded unquoted below, to split it into words, and nothing in
-# it is meant as a pattern. Pathname expansion stays off: these paths are
-# past 260 characters, so cygpath writes them in the long-path form
+# it is meant as a pattern. Pathname expansion stays off: a path past 260
+# characters (a long TMP) comes back from cygpath in the long-path form
 # //?/C:/..., and the shell globbed each one, whose `?` made it list the
 # network root // (about three seconds a path on Windows, so about 80 s
 # before each build started, #2596). No match was ever found, so the words
@@ -94,14 +116,18 @@ extras="$extras --extra sum.c"
 set -f
 
 # shellcheck disable=SC2086
-if ! env PATH="$TMP/cc:$PATH" "$AE" build main.ae $extras -o ./app >"$TMP/build.log" 2>&1; then
+if ! env PATH="$TMP/cc:$PATH" "$AE" build --verbose main.ae $extras -o ./app >"$TMP/build.log" 2>&1; then
     echo "  [FAIL] win_batch_compiler_long_cmdline: build through the .cmd compiler failed"
-    sed 's/^/        /' "$TMP/build.log" | head -10
+    grep -v '^\[cmd\]' "$TMP/build.log" | sed 's/^/        /' | head -10
+    exit 1
+fi
+if ! grep -q '^\[cmd\] arguments in ' "$TMP/build.log"; then
+    echo "  [FAIL] win_batch_compiler_long_cmdline: the C command line ($nparts parts) never went through a response file"
     exit 1
 fi
 got=$(./app 2>&1 | tr -d '\r')
-if [ "$got" != "tag=7 parts=25" ]; then
-    echo "  [FAIL] win_batch_compiler_long_cmdline: printed '$got', expected 'tag=7 parts=25'"
+if [ "$got" != "$want" ]; then
+    echo "  [FAIL] win_batch_compiler_long_cmdline: printed '$got', expected '$want'"
     exit 1
 fi
 
@@ -120,7 +146,7 @@ if ! env PATH="$TMP/cc:$PATH" TEMP="$spaced" TMP="$spaced" AETHER_CACHE_DIR="$TM
     exit 1
 fi
 got=$(./app 2>&1 | tr -d '\r')
-if [ "$got" != "tag=7 parts=25" ]; then
+if [ "$got" != "$want" ]; then
     echo "  [FAIL] win_batch_compiler_long_cmdline: with a spaced temp directory, printed '$got'"
     exit 1
 fi

From 905dd1b632abf00099a5041d05d74cbe873e147f Mon Sep 17 00:00:00 2001
From: paul <paul@hammant.org>
Date: Mon, 9 Nov 2026 21:37:40 +0000
Subject: [PATCH 07/11] release_contrib_c_modules: skip avcodec on Windows by
 uname, not by ae's name

The avcodec check is meant to stay off Windows (ae links -static there and
MSYS2's static FFmpeg needs its whole dependency closure), and was gated on
$EXE being ".exe". $EXE came from a name probe, `[ ! -x build/ae ]`, which
MSYS2 answers true for build/ae.exe, so it stayed empty and the check ran
wherever MSYS2's FFmpeg is installed: on the win11 lab host it failed with
undefined soxr_* references from libswresample.a. CI's Windows job installs
no FFmpeg, so it never got that far.

Gated on uname now, as the other Windows-aware tests are. $EXE is left as it
was, so the direct-link check, which passes on Windows, still runs there.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../test_release_contrib_c_modules.sh                    | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/tests/integration/release_contrib_c_modules/test_release_contrib_c_modules.sh b/tests/integration/release_contrib_c_modules/test_release_contrib_c_modules.sh
index 92b817699..f7c3e9d34 100755
--- a/tests/integration/release_contrib_c_modules/test_release_contrib_c_modules.sh
+++ b/tests/integration/release_contrib_c_modules/test_release_contrib_c_modules.sh
@@ -151,7 +151,14 @@ main() { println("collate=${collate.compare("en", "cafe", "café")}") }' "collat
 # Not on Windows: `ae` links -static there, and MSYS2's static FFmpeg needs
 # its whole dependency closure (soxr, the codecs, ...), which only
 # `pkg-config --static --libs` knows; that goes in [build] link_flags.
-if [ "$EXE" != ".exe" ] && command -v pkg-config >/dev/null 2>&1 &&
+# Windows by the system, not by $EXE: MSYS2's `test -x build/ae` finds
+# build/ae.exe, so $EXE is empty there, and this ran (and failed to link)
+# wherever MSYS2's FFmpeg is installed.
+case "$(uname -s 2>/dev/null)" in
+    MINGW*|MSYS*|CYGWIN*) on_windows=1 ;;
+    *) on_windows=0 ;;
+esac
+if [ "$EXE" != ".exe" ] && [ "$on_windows" = 0 ] && command -v pkg-config >/dev/null 2>&1 &&
    pkg-config --exists libavcodec libavformat libavutil libswscale libswresample 2>/dev/null; then
     check avcodec 'import contrib.avcodec
 main() {

From dad1415b38768793940f632e539d56fb91577f83 Mon Sep 17 00:00:00 2001
From: paul <paul@hammant.org>
Date: Mon, 9 Nov 2026 21:48:23 +0000
Subject: [PATCH 08/11] operator_chain_nesting: keep the brackets with sed and
 tr, not an awk gsub

max_seq_depth stripped every non-bracket from each generated line with
gsub(/[^][(){}]/, ""). MSYS2's gawk 5.4.0 takes 32 s for that on one of the
150 KB lines of the 1000-link chains (5.4.1 takes 0.4 s), and the test reads
seven such lines: it ran 262 s alone on the win11 lab host and past the
sweep's 420 s limit under load. The macros are now spelled out by sed and
the brackets kept by tr, so awk only walks the brackets: 12 s on the same
host with gawk 5.4.0 (181 s before), the same depths on macOS (2 4 5 5 5 5 8 7 5 5).

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../test_operator_chain_nesting.sh                       | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/tests/integration/operator_chain_nesting/test_operator_chain_nesting.sh b/tests/integration/operator_chain_nesting/test_operator_chain_nesting.sh
index 998e8b138..3618b0806 100644
--- a/tests/integration/operator_chain_nesting/test_operator_chain_nesting.sh
+++ b/tests/integration/operator_chain_nesting/test_operator_chain_nesting.sh
@@ -122,10 +122,13 @@ fi
 # A substr() a character on the whole line is quadratic in FreeBSD's awk,
 # whose substr and length count UTF-8 characters from the start each call:
 # the 1000-link lines took this test past the sweep's 420 s limit there.
+# The brackets are kept by sed and tr, not by an awk gsub: MSYS2's gawk
+# 5.4.0 took 32 s for gsub(/[^][(){}]/, "") on one 150 KB line (0.4 s in
+# 5.4.1), seven such lines, and the test ran 262 s alone on Windows and past
+# the 420 s limit under the sweep's load.
 max_seq_depth() {
-    LC_ALL=C awk '{ gsub(/_AE_SEQ_OPEN/, "({"); gsub(/_AE_SEQ_CLOSE/, "; })")
-           gsub(/[^][(){}]/, "")
-           n = split($0, ch, "")
+    sed 's/_AE_SEQ_OPEN/({/g; s/_AE_SEQ_CLOSE/; })/g' | LC_ALL=C tr -cd '()[]{}\n' |
+        LC_ALL=C awk '{ n = split($0, ch, "")
            d = 0; m = 0
            for (i = 1; i <= n; i++) {
                c = ch[i]

From 7109bb00e8539d2829f77795e9e1c0915f4eb405 Mon Sep 17 00:00:00 2001
From: paul <paul@hammant.org>
Date: Mon, 9 Nov 2026 22:06:34 +0000
Subject: [PATCH 09/11] crypto_tls13_peer: the test servers drain before
 closing a refused handshake

server.ae and kuserver.ae closed the socket of a refused handshake with
tcp.close, while the library's own entry closes it with tcp.close_drained
(#3465). What the client sent after the refused record is still unread
then (in "server HRR: two change_cipher_spec records", the second CCS), so
the close ends with a reset, and on Windows that reset can take the alert
from the client before it reads it: the case saw "HRR CLOSED" for
"HRR ALERT 10". On the win11 lab host, 25 runs of that case: 8 failed with
the plain close, none drained.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 tests/integration/crypto_tls13_peer/kuserver.ae | 3 ++-
 tests/integration/crypto_tls13_peer/server.ae   | 7 ++++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/tests/integration/crypto_tls13_peer/kuserver.ae b/tests/integration/crypto_tls13_peer/kuserver.ae
index eda6cfca0..42b82d522 100644
--- a/tests/integration/crypto_tls13_peer/kuserver.ae
+++ b/tests/integration/crypto_tls13_peer/kuserver.ae
@@ -32,7 +32,8 @@ main() {
     tls13_server.free_private_key(key)
     if err != "" {
         println("REFUSED: ${err}")
-        tcp.close(sock)
+        // Drained, as server.ae's: a reset could take the alert (#3465).
+        tcp.close_drained(sock)
         tls13_server.free_cert_chain(chain, lens)
         tcp.server_close(srv)
         exit(0)
diff --git a/tests/integration/crypto_tls13_peer/server.ae b/tests/integration/crypto_tls13_peer/server.ae
index feddfb247..65b0800a8 100644
--- a/tests/integration/crypto_tls13_peer/server.ae
+++ b/tests/integration/crypto_tls13_peer/server.ae
@@ -52,7 +52,12 @@ main() {
     tls13_server.free_private_key(key)
     if err != "" {
         println("REFUSED: ${err}")
-        tcp.close(sock)
+        // Drained, as the library's own entry closes a failed handshake
+        // (#3465): what the client sent after the record refused (a second
+        // change_cipher_spec, say) is still unread, and a plain close ends
+        // with a reset, which on Windows can take the alert from the client
+        // before it reads it ("HRR CLOSED" for "HRR ALERT 10").
+        tcp.close_drained(sock)
         tls13_server.free_cert_chain(chain, lens)
         tcp.server_close(srv)
         exit(0)

From 60f0ea2b3c850b38a8f8a0cfb0f40b21e182818e Mon Sep 17 00:00:00 2001
From: paul <paul@hammant.org>
Date: Mon, 9 Nov 2026 22:11:07 +0000
Subject: [PATCH 10/11] crypto_tls13_peer: build its seven programs at once, at
 -O0

Each program is the whole pure TLS stack in one C file. GCC on Windows
compiled each in 18-23 s at -O2 (2-4 s on macOS), one after another, so the
builds alone took 168 s of the test's 440 on the win11 lab host (468 s with
its older MSYS2), past the sweep's 420 s limit under load; CI's 4-core
runner took 311 s. They now build in parallel with --quick (-O0 -g): 7-9 s
each there, and the cases, which check the bytes on the wire, take the same
time (about 1 s a handshake either way). The whole test: 242 s on win11 from
a cold cache, 90 s on macOS (101 before). Every build is waited for before a
failed one ends the test, so none still writes into $TMP as it is removed.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../crypto_tls13_peer/test_tls13_peer.sh      | 21 +++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/tests/integration/crypto_tls13_peer/test_tls13_peer.sh b/tests/integration/crypto_tls13_peer/test_tls13_peer.sh
index a1dbabb36..45707f7b2 100644
--- a/tests/integration/crypto_tls13_peer/test_tls13_peer.sh
+++ b/tests/integration/crypto_tls13_peer/test_tls13_peer.sh
@@ -62,9 +62,26 @@ cleanup() {
 trap cleanup EXIT
 fail() { echo "  [FAIL] $NAME: $1"; exit 1; }
 
+# The seven programs build at once, and at -O0 (--quick): each is the whole
+# pure TLS stack in one C file, which GCC on Windows took 18-23 s to compile
+# at -O2 (2-4 s on macOS), so the builds alone came to 168 s of the test's
+# 440 on the win11 lab host, and to past the sweep's 420 s limit under its
+# load. At -O0 they take 7-9 s each there, and the cases, which check what
+# goes over the wire, run in the same time (about 1 s a handshake).
+bpids=""
 for p in peer client server rawclient peerclient kuclient kuserver; do
-    "$AE" build "$SCRIPT_DIR/$p.ae" -o "$TMP/$p" >"$TMP/b_$p.log" 2>&1 \
-        || { sed -n '1,12p' "$TMP/b_$p.log"; fail "$p did not build"; }
+    "$AE" build --quick "$SCRIPT_DIR/$p.ae" -o "$TMP/$p" >"$TMP/b_$p.log" 2>&1 &
+    bpids="$bpids $p:$!"
+done
+# Every build is waited for before one that failed ends the test, so none
+# is left writing into $TMP as the trap removes it.
+bfail=""
+for bp in $bpids; do
+    wait "${bp#*:}" || bfail="$bfail ${bp%%:*}"
+done
+for p in $bfail; do
+    sed -n '1,12p' "$TMP/b_$p.log"
+    fail "$p did not build"
 done
 
 fails=0

From 007c86e73549dba3a531e9d54ea014ea9166184c Mon Sep 17 00:00:00 2001
From: paul <paul@hammant.org>
Date: Tue, 10 Nov 2026 01:28:48 +0000
Subject: [PATCH 11/11] tests: the bracket-depth awk walks run in the C locale

deep_constants, deep_nesting, block_nesting_cc and operator_chain_nesting
measure the bracket depth of generated C with an awk loop that takes
substr($0, i, 1) for each character. Under a UTF-8 locale (MSYS2's default,
en_US.UTF-8, and CI's Windows runner) gawk's substr counts characters from
the start of the line on every call, so the walk is quadratic in a line.
deep_constants' consts.c has lines of 245 KB: its awk took 361 s on the
win11 lab host (the test 367 s alone, 771 s beside three others, past the
sweep's 420 s limit) and the test 292 s on CI's Windows runner. With
LC_ALL=C the same awk takes 6 s and the test 14 s on win11. The walks only
compare ASCII characters, which no byte of a UTF-8 multibyte character
equals, so the depths are the same (51, 1018, and the rest, on macOS and
win11).

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../integration/block_nesting_cc/test_block_nesting_cc.sh  | 2 +-
 tests/integration/deep_constants/test_deep_constants.sh    | 7 ++++++-
 tests/integration/deep_nesting/test_deep_nesting.sh        | 2 +-
 .../operator_chain_nesting/test_operator_chain_nesting.sh  | 2 +-
 4 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/tests/integration/block_nesting_cc/test_block_nesting_cc.sh b/tests/integration/block_nesting_cc/test_block_nesting_cc.sh
index 7c96acf88..b8e31b560 100755
--- a/tests/integration/block_nesting_cc/test_block_nesting_cc.sh
+++ b/tests/integration/block_nesting_cc/test_block_nesting_cc.sh
@@ -59,7 +59,7 @@ runs matches "matches 0"
 
 # The deepest ( [ { of the C of the matches, outside literals and comments.
 AETHER_HOME="$ROOT" "$AETHERC" "$WORK/matches.ae" "$WORK/matches.c" >/dev/null 2>&1
-d="$(awk 'BEGIN { d = 0; m = 0 }
+d="$(LC_ALL=C awk 'BEGIN { d = 0; m = 0 }
           /^[ \t]*#/ { next }
           { n = length($0); str = 0
             for (i = 1; i <= n; i++) {
diff --git a/tests/integration/deep_constants/test_deep_constants.sh b/tests/integration/deep_constants/test_deep_constants.sh
index 7b9278ff8..6d2d17439 100755
--- a/tests/integration/deep_constants/test_deep_constants.sh
+++ b/tests/integration/deep_constants/test_deep_constants.sh
@@ -70,7 +70,12 @@ case "$got" in
 esac
 
 AETHER_HOME="$ROOT" "$AETHERC" "$WORK/consts.ae" "$WORK/consts.c" >/dev/null 2>&1
-d="$(awk 'BEGIN { d = 0; m = 0 }
+# LC_ALL=C: under a UTF-8 locale gawk's substr counts characters from the
+# start of the line on every call, so this walk is quadratic in a line, and
+# consts.c has lines of 245 KB: 361 s of the test on the win11 lab host and
+# 292 s on CI's Windows runner, against 6 s in the C locale. The walk only
+# compares ASCII, which a UTF-8 multibyte character never contains.
+d="$(LC_ALL=C awk 'BEGIN { d = 0; m = 0 }
           /^[ \t]*#/ { next }
           { gsub(/_AE_SEQ_OPEN/, "({"); gsub(/_AE_SEQ_CLOSE/, "; })")
             # One split, not a substr($0, i, 1) per character: the awk of OpenBSD
diff --git a/tests/integration/deep_nesting/test_deep_nesting.sh b/tests/integration/deep_nesting/test_deep_nesting.sh
index ba2b272ba..afffecbcb 100755
--- a/tests/integration/deep_nesting/test_deep_nesting.sh
+++ b/tests/integration/deep_nesting/test_deep_nesting.sh
@@ -39,7 +39,7 @@ depths=""
 # The deepest ( [ { of a C file outside literals, comments and directives,
 # with the sequence macros spelled as a GCC-compatible compiler has them.
 c_depth() {
-    awk 'BEGIN { d = 0; m = 0; com = 0 }
+    LC_ALL=C awk 'BEGIN { d = 0; m = 0; com = 0 }
          /^[ \t]*#/ { next }
          { gsub(/_AE_SEQ_OPEN/, "({"); gsub(/_AE_SEQ_CLOSE/, "; })")
            n = length($0); str = 0
diff --git a/tests/integration/operator_chain_nesting/test_operator_chain_nesting.sh b/tests/integration/operator_chain_nesting/test_operator_chain_nesting.sh
index 3618b0806..600d363a9 100644
--- a/tests/integration/operator_chain_nesting/test_operator_chain_nesting.sh
+++ b/tests/integration/operator_chain_nesting/test_operator_chain_nesting.sh
@@ -55,7 +55,7 @@ if [ "$got" != "$want" ]; then
 fi
 
 max_depth() {
-    awk '{ d = 0; m = 0
+    LC_ALL=C awk '{ d = 0; m = 0
            for (i = 1; i <= length($0); i++) {
                c = substr($0, i, 1)
                if (c == "(") d++