However, I've managed to narrow it down. If the EST bypass (aka set timing) connector is open, the engine runs just fine! The ECM sets error code 42 and the SES light comes on, as should happen when the connector is open.
So, the problem is somehow related to how the ECM controls spark timing.
Last time, I had set the spark advance to "apparently 0", like this:
In this position, when the bypass cable is disconnected, the engine sputters a bit and feels like it's hesitating on idle. So I rotated the distributor until the idle sounded smooth and stable - the timing is now on the last tooth:
v v V V O
I haven't seen _any_ of the tachometer flip-outs, stalling, sputtering etc when driving like this. The power - what little the stock TBI has - is mostly present too.