Pushes 36, 37, 38 all gated against the stale python_gate from push 33 (8382896), not their respective HEAD binaries. Root cause: 'cp "$PYTHON" "${PYTHON}_gate" 2>/dev/null || true'. When a prior gate left python_gate held open (or otherwise busy), cp failed with 'Text file busy', stderr was discarded, '|| true' swallowed the exit code, and PYTHON pointed to the leftover stale copy. Subsequent test runs reported 981 PASS — against a binary from 3 commits ago. Fix: rm -f the destination first, then cp without || true. If cp fails for any reason, set -e aborts the gate. No more silent fallback to a stale binary. Discovery: testkeeper investigated SIGSEGV during G1.6 LIR-capture prep on the actual HEAD binary (carrying generalist's in-flight LOAD_ATTR_SLOT stash). The crash didn't reproduce on python_gate because python_gate was 3 commits old and predated the SLOT work. The version-string mismatch ('79890e7b73-dirty' vs '8382896c85') made the stale-binary substitution visible. Also adds catch python#4 to docs/wiring_catches.md per supervisor 2026-04-22 00:42:38Z directive.

…ation) Push 39's e808676 + 0a5f096 added BINARY_MATCH on both arches. The grep is bare-hash: 'grep "$COMMIT_HASH" "$LONG_VERSION"'. That matches both clean ':<hash>,' AND '-dirty:<hash>' suffix — the exact contamination class that bit catch python#4 (binary built from a dirty working tree masquerades as a clean build). Pre-push-39, 'cp || true' accidentally protected against this by falling back to a stale-clean python_gate when local build was dirty. Push 39 removed the fallback. Without -dirty rejection, the next contaminated build IS the binary the gate tests, while BINARY_MATCH still passes. Fix: tighten the check to reject any version string containing '-dirty'. Mirror on ARM64 path (mirrors 0a5f096 symmetry). Output now distinguishes BINARY_MISMATCH (wrong hash) from BINARY_DIRTY (right hash, dirty build). Adds catches python#5 (push-39 in-flight commit race) and python#6 (this fix) to docs/wiring_catches.md. Per supervisor 2026-04-22 01:08:18Z + theologian 01:08:00Z (defense-in-depth: when a single incident exposes N adjacent gaps, fixing 1 leaves N-1 unprotected).

Per supervisor 2026-04-22 03:06:55Z + theologian 03:07:12Z + pythia python#58: push 44 introduces the W3 R4 oracle dispatcher in compiler.cpp behind #ifdef RC_ORACLE. The push-44 nm production-binary check is one-shot — need a STANDING gate assertion so future compiler.cpp edits cannot silently leak RC_ORACLE dispatch into production. Failure mode caught: Any future commit that drops, inverts, or accidentally hard-defines the #ifdef RC_ORACLE guard would leak the C++ rc_oracle dispatch path (linked from libphoenix_rc_oracle.a) into the production python binary. Without this assertion, the leak is invisible until the next manual nm audit. Same silent-failure class as the cp-||-true loophole (catch python#4, push 38) — accepted bad state silently. Implementation (5 LOC after BINARY_MATCH (clean) ✓): RC_ORACLE_LEAK=$(nm $PYTHON | grep -c 'rc_oracle') if [ $RC_ORACLE_LEAK -ne 0 ]; then echo BINARY_RC_ORACLE_LEAK_DETECTED ... exit 1 fi echo BINARY_RC_ORACLE_OK: production binary clean (0 rc_oracle symbols) Verbatim wording per gatekeeper item python#15 (03:07:25Z): - PASS: 'BINARY_RC_ORACLE_OK: production binary clean (0 rc_oracle symbols)' - FAIL: 'BINARY_RC_ORACLE_LEAK_DETECTED' + FATAL + exit 1 - Mirrors BINARY_DIRTY discipline (catch silent failure structurally) Verification (compile-clean pre-commit): bash -n scripts/gate_phoenix.sh: SYNTAX OK Inserted at line 120 (immediately after BINARY_MATCH block at line 119). Bundled into push 44 (rather than standalone push 45) because the dispatcher lands in this push — the leak-check guards it from day 1 instead of leaving a one-push window where item python#15 isn't enforced. Push 44 batch grows 3 → 4 commits: THIS COMMIT — gate item python#15 (RC_ORACLE leak assertion) 63568c0 — W3 Step 5 expansion (4 injection classes + invariant python#7) 4f591a1 — W3 Step 5 v1 (rc_oracle_self_test.sh) a99db92 — W3 Steps 1-4 (scratch lib + dispatcher) ABBA cap usage: 17 → 18 (4 commits this push).

Convert HIRBuilder::emitLoadMethodOrAttrSuper from C++ multi-block deopt+dispatch to a thin delegation stub. New C function hir_builder_emit_load_method_or_attr_super_c builds the deopt path (snapshot+deopt) and fast path (CondBranchCheckType + RefineType + LoadAttrSuper or LoadMethodSuper+GetSecondOutput). C++ stub computes nothing — passes oparg + bc_offset.value() through to C. The C body computes name_idx/load_method/no_args from oparg (3.11+ packing per theologian audit python#3 — load_method param overwrite), following the project's 3.12-only convention dropping the pre-3.11 oparg-tuple branch. Theologian invariant audit (2026-04-22 11:58:52Z) drives the implementation: python#1 phx_frame_state_copy runs BEFORE the 3 pops so deopt-path frame preserves PRE-POP stack for interpreter resumption python#4 pop order: receiver (TOS), type, global_super python#5 push order varies by load_method (1 value vs 2) python#8 deopt-path emits go into deopt_tc.block python#9 CondBranchCheckType branches; tc.block <- fast_path; emit RefineType in-place Both exit paths phx_frame_state_destroy the deopt_tc to avoid leaking the heap-allocated stack/locals arrays. testkeeper pre-commit verify (2026-04-22 12:15:46Z): JIT_BUILD_EXIT=0, full BUILD_EXIT=0, 7/7 phoenix-jit tests PASS at HEAD+uncommitted. W26 gate-hardening not triggered (no recent fail).

Per pythia python#79 python#4 [chat L2032] + supervisor [chat L2034] python#4 assignment + theologian [chat L2036] design + generalist take. Closes pythia python#79 python#4 'PartialConversion calcification trigger conditional on external direction' substance: provides a forcing-function (test that fails in the calcification window) instead of an aspirational marker (REABSORB-WHEN comment alone, which depends on a future reader seeing it at the right moment). Lib/test/test_phoenix_partial_conversions.py: Pre-condition + assertion pattern per theologian L2036 spec. test_anycall_reabsorb_when_invokes_converted: Pre-condition: at least one of bool HIRBuilder::emitInvokeFunction / Native / Method remains C++ in builder.cpp → skip (legitimate partial state). Assertion: when all 3 INVOKE_* converted, fail if hir_builder_emit_awaited_call_tail_c bridge call remains in builder.cpp (i.e. emitAnyCall body still partial). Failure msg cites builder_emit_c.c PARTIAL CONVERSION ARTIFACT comment + reabsorb action so future readers locate the decision context. VERIFIED PASS today (INVOKE_* still C++ → test skipped): $ python3 -m unittest Lib.test.test_phoenix_partial_conversions -v test_anycall_reabsorb_when_invokes_converted: skipped Ran 1 test in 0.001s, OK (skipped=1) Pattern docs in module docstring for future PartialConversion authors: 1. Add test_<method>_reabsorb_when_<condition> 2. Encode pre-condition as text-grep on builder.cpp source 3. Encode assertion as bridge-symbol grep with explicit failure msg Forces the calcification check to run in EVERY normal test gate cycle, without requiring CI machinery additions (no lint script, no DCHECK runtime overhead, no comment-only marker reliance). Pattern generalizes: each future PartialConversion gets one test function. Authorization chain: - pythia python#79 python#4 surfaced calcification risk: chat L2032 - supervisor python#4 assignment to theologian (design): chat L2034 - theologian design (option ii test-as-forcing-function): chat L2036 - generalist implementation per scope-for-generalist-if-she-takes-it: chat L2034 ack

Per pythia python#80 python#4 [chat 2026-04-22 19:12Z] + supervisor [chat L2105] python#4 assignment: count_emit_methods.sh closes /144 vector specifically; no analogous script for §1b TU counts (the count that lapsed 4 times today: /144, /38 INVOKE_*, /24 §1b, /5 §1a). This script anchors W25 §1b TU baseline mechanically: - Enumerates TUs in Python/jit/hir/ that include hir_basic_block_c.h - Categorizes each as "with extern decls" (Step B cleanup target) vs "type-only" (no-op for Step B) - Uses the narrow lint pattern from spec §3 Step C — same pattern Step B's lint gate will install Reference values verified at HEAD e6a8a2d (post-W25-Step-A, push 65): TOTAL: 17 §1b TUs WITH extern decls (lint-pattern match): 7 (Step B cleanup targets) TYPE-ONLY: 10 (no-op for Step B) DISCREPANCY from spec §1b table (9 with externs / 8 type-only at b808cda): spec used BROADER grep (any "extern.*hir_") which counts non-API externs (e.g. hir_liveness_* in refcount_env_c.c). This script uses the NARROW lint-pattern grep matching spec §3 Step C — the actual gate Step B will install. refcount_env_c.c + refcount_pass_c.c correctly classified as type-only-for-Step-B (their non-API externs won't fail the lint gate). This shifts Step B planning: 7 cleanup-target TUs (not 9), still 5-10 small commits per spec §3. Pythia python#80 python#4 + python#1 substance closed: - python#1 stale 17/9/8 count post-Step-A: re-verified 17/7/10 at HEAD - python#4 method-specific scripts: pattern broadened — now 2 baseline scripts (count_emit_methods.sh + count_w25_b1b_tus.sh). Future consolidation to scripts/count_phoenix_baselines.sh dispatcher possible if more baselines accrue. Authorization chain: - pythia python#80 python#4 surfaced gap: chat L2104 - supervisor python#4 assignment: chat L2105

PRIMITIVE_COMPARE_OP (Static Python) opcode handler. Per W27a Step A scope. C body: hir_builder_emit_primitive_compare_c (~50 lines). Inlines the PRIM_OP_* → HIR_PCMP_* mapping switch directly. Reuses PHX_PRIM_OP_* defines from python#3 (emitPrimitiveBinaryOp). C primitives used: hir_c_create_primitive_compare + hir_builder_temps_alloc_stack (both existing). C++ HIRBuilder::emitPrimitiveCompare → 3-line delegation stub. Verification: cmake --build target jit/phoenix_jit clean (BUILD_EXIT=0).

BUILD_CHECKED_MAP (Static Python) opcode handler. Per W27b Step A scope. C body: hir_builder_emit_build_checked_map_c (~30 lines). Pops descr + dict_size, queries preloader type+py_type, emits make_checked_dict_reg, walks bottom dict_size*2 stack entries left-to-right as (key,value) pairs emitting set_dict_item_reg for each, decrements stack count, pushes dict. C primitives used: hir_builder_preloader_type + hir_builder_preloader_py_type + hir_c_create_make_checked_dict_reg + hir_c_create_set_dict_item_reg + hir_builder_temps_alloc_stack (all existing). C++ HIRBuilder::emitBuildCheckedMap → 3-line delegation stub. Verification: cmake --build target jit/phoenix_jit clean (BUILD_EXIT=0).

SEND (mainline) opcode handler. Per W27c Step A scope. C body: hir_builder_emit_send_c (~25 lines). Pops value_out, peeks iter, allocates value_in (stack temp) + is_done (non-stack via hir_func_alloc_register per AllocateNonStack convention), emits Send + GetSecondOutput<TCInt64>, pushes value_in, then cond-branch on is_done to done_block (jump target) or continue_block (next instr). ZERO new bridges. Uses existing primitives + existing hir_builder_get_block_at_off bridge. C primitives used: hir_c_create_send_reg + hir_c_create_get_second_output_reg + hir_c_create_cond_branch + hir_func_alloc_register + hir_builder_temps_alloc_stack + hir_builder_get_block_at_off (all existing). C++ HIRBuilder::emitSend → 5-line delegation stub (passes current_func_ + jump_target/next_instr offset values from bc_instr). Verification: cmake --build target jit/phoenix_jit clean (BUILD_EXIT=0). Sole-path coverage: SEND is mainline-tested per theologian L2521 observation.

MATCH_MAPPING/MATCH_SEQUENCE (mainline) opcode handler. Per W27d Step A scope. C body: hir_builder_emit_match_mapping_sequence_c (~55 lines). Peeks top of stack, loads ob_type → tp_flags, loads tf_flag const as TCUInt64, IntBinaryOp<And>(tp_flags, flag) → and_result. Cond-branch on and_result → true (Py_True const) / false (Py_False const). Converges at done, pushes result. ZERO new bridges. C primitives: hir_c_create_load_field_reg + hir_c_create_load_const + hir_c_create_int_binary_op + hir_c_create_cond_branch + hir_c_create_branch_cpp + hir_type_from_cuint + hir_type_from_object + hir_cfg_alloc_block + hir_builder_temps_alloc_stack (all existing). C++ HIRBuilder::emitMatchMappingSequence → 5-line delegation stub. Verification: cmake --build target jit/phoenix_jit clean (BUILD_EXIT=0). Sole-path: MATCH_MAPPING/SEQUENCE is mainline-tested per theologian L2544 coverage observation.

…ERO C++ SEQUENCE_GET (Static Python) opcode handler. FINAL emit-method conversion in W27 burndown. Per W27d Step A scope. C body: hir_builder_emit_sequence_get_c (~85 lines). Same shape as emitSequenceSet (W27c python#5) + SEQ_SUBSCR_UNCHECKED bit gating + emitLoadArrayItem (vs StoreArrayItem): - oparg & SEQ_SUBSCR_UNCHECKED set → skip CheckSequenceBounds, raw idx - else CheckSequenceBounds + adjusted_idx - Per (oparg & ~UNCHECKED): SEQ_LIST/INEXACT/CHECKED_LIST → load_field 'ob_item' at PyListObject offset + TCPtr; SEQ_ARRAY_INT64 → load_const offset + load_field_address - LoadArrayItem with element_type_from_seq_type(oparg) PHX_SEQ_SUBSCR_UNCHECKED = (1<<3) = 8 hard-coded inline. PHX_SEQ_* base values reused from W27c python#5 (PHX_SEQ_LIST/TUPLE/LIST_INEXACT/ CHECKED_LIST/ARRAY_INT64). ZERO new bridges. C primitives: hir_c_create_load_field_reg + hir_c_create_guard_is_reg + hir_c_create_refine_type_reg + hir_c_create_check_seq_bounds_reg + hir_c_create_load_field_address_reg + hir_c_create_load_array_item_reg + hir_c_create_load_const + hir_type_from_cint + hir_builder_temps_alloc_stack (all existing). C++ HIRBuilder::emitSequenceGet → 4-line delegation stub. Verification: cmake --build target jit/phoenix_jit clean (BUILD_EXIT=0). Sole-path: SEQUENCE_GET is __static__-only per accepted-residual L2531. 🎯 W27d CLOSURE — ZERO C++ ACHIEVED for emit-methods: W27d python#1: emitCopyFreeVars W27d python#2: emitGetYieldFromIter W27d python#3: emitMatchClass W27d python#4: emitMatchMappingSequence W27d python#5: emitSequenceGet (THIS) Pure-C++ count: 5 → 0 / 123 (100% per scripts/count_emit_methods.sh). Total W27 burndown: 20 → 0 across 4 batches (W27a/b/c/d). W27e residual paragraph (theologian L2533) attached to closure announcement to Alex (10 __static__-only methods accepted-residual per Phoenix-doesn't- expose-Static-Python framing).

Per supervisor L2565 + theologian L2569 ACK. Reduces C++ stub from ~16 lines to 7 lines (qualifies as STUB). Strategy: move jit_get_config()->specialized_opcodes gating from C++ stub into C body. C body now overrides specialized_op to -1 inline if config disables specialized opcodes. C++ stub passes bc_instr.specializedOpcode() unconditionally. ZERO new bridges (jit_get_config() already accessible in C body — multiple existing callers at line 423/431/1137). Verification: cmake --build target jit/phoenix_jit clean (BUILD_EXIT=0). Pure-C++ count unchanged (still 0); PARTIAL count drops 8→7.

…oadSpecial/MatchClass/MatchMappingSequence/Send) Per supervisor 21:45:14Z + theologian 21:45:17Z methodology cross-check PASS for batch-of-5: emitCopyFreeVars + emitLoadSpecial + emitMatchClass + emitMatchMappingSequence + emitSend. Methods deleted (all bytecode-dispatch overloads, NOT the inline helpers in HIRBuilder class body that share the same name with Register*-based signatures — overload distinction verified by theologian on disk: helper at builder.cpp:710/807/859 vs dispatch at :4642/4679/4728). emitSetupWith DROPPED from batch (25-line PY_VERSION_HEX-conditional enter_id/exit_id logic = Cat-B per emitBeforeWith precedent in python#3). 6 caller-rewrites (multi-caller methods: emitCopyFreeVars × 2 at 1065+1878, emitMatchMappingSequence × 2 at 2408+2412; single-caller methods: emitLoadSpecial+emitMatchClass+emitSend × 1 each). Numstat (verified pre-commit per shepard 20:41:46Z + supervisor 20:16:25Z discipline): builder.cpp +18/-60 (NET -42; 5 wrapper bodies + 5 inline extern decls deleted, +18 from caller-rewrite expansions and 5 file-scope extern decls for the new C dispatch targets) builder.h +0/-12 (NET -12; 5 method declarations removed) Bundle: -54L net, ZERO new bridges (5 existing C functions reused via file-scope extern hoists; matches Phase 1 python#3 -52L precedent). Verified at HEAD post-fix: test_phoenix_jit_comparisons + controlflow + autocompile + partial_conversions: 369/369 PASS (no regression). W44 DO-NOT-USE caller gate: PASS. Phase 1 cumulative burndown: -35 (python#1+python#1.5) + -5 (python#2) + -52 (python#3) + -54 (python#4) = -146L total. builder.cpp 4859→4817.

Per supervisor 21:54:07Z + theologian 21:53:58Z methodology cross-check PASS for batch-of-6: emitPrimitiveLoadConst + emitPrimitiveBox + emitPrimitiveUnbox + emitPrimitiveBinaryOp + emitPrimitiveCompare + emitPrimitiveUnaryOp. All 6 had 1 caller each in builder.cpp dispatch (lines 2005/2009/2013/ 2017/2021/2025) + Lib/test/ scope EMPIRICALLY VERIFIED clean per theologian 21:53:58Z (grep -E 'emitPrimitive(LoadConst|Box|Unbox| BinaryOp|Compare|UnaryOp)' Lib/test/test_phoenix_*.py = 0 references). Methods deleted (all bytecode-dispatch overloads). Inline helpers in HIRBuilder class body with Register*-based signatures (lines 944, 733, 456, 978) STAY — distinct overloads. tc.emitPrimitiveBox / tc.emitPrimitiveUnbox at lines 3875/3884 are TranslationContext class methods (different class) — NOT affected. 6 caller-rewrites (lines 2005, 2009, 2013, 2017, 2021, 2025) at bytecode dispatch. Numstat (verified pre-commit per shepard 20:41:46Z + supervisor 20:16:25Z discipline + supervisor 21:54:07Z 'commit-message count = 6 caller-rewrites avoid python#4 annotation typo'): builder.cpp +14/-62 (NET -48; 6 wrapper bodies + 6 inline extern decls deleted, +14 from caller-rewrite expansions and 6 file-scope extern decl hoists) builder.h +0/-18 (NET -18; 6 method declarations removed, 3 lines per declaration) Bundle: -66L net, ZERO new bridges (6 existing C functions reused via file-scope extern hoists). Verified at HEAD post-fix: test_phoenix_jit_comparisons + controlflow + autocompile + partial_conversions: 369/369 PASS (no regression). W44 DO-NOT-USE caller gate: PASS (2 markers, 0 violations). Phase 1 cumulative burndown: -35 (python#1+python#1.5) + -5 (python#2) + -52 (python#3) + -54 (python#4) + -66 (python#5) = -212L total. builder.cpp 4817→4769.

Implements scripts/w45_bridge_drift_falsifier.sh per docs/w45-bridge-signature-drift-falsifier.md. Mutate-Build-Verify-Restore loop: - Mutates a bridge signature (extern "C" decl in builder.cpp + function definition in builder_emit_c.c, in lockstep) by appending a sentinel param 'int phx_w45_drift'. - Verifies the build fails at the C++ dispatch-switch call site (which has the OLD arity). - Restores both files; clean rebuild verifies tree state. Catches the structural drift class identified by pythia python#90/python#91: void* args at the bridge crossing erase the type-safety C++ overload resolution would normally provide. 252+ dispatch sites in builder.cpp post Phase 1 burndown — manual audit unscalable. Initial 6 fixtures (per spec §2.2 + §2.6 retro): - hir_builder_emit_before_with_c (Phase 1 python#6 retro) - hir_builder_emit_setup_with_c (Phase 1 python#7 retro) - hir_builder_emit_format_simple_c (Phase 1 python#2 sample) - hir_builder_emit_copy_free_vars_c (Phase 1 python#4 sample) - hir_builder_emit_get_yield_from_iter_c (Phase 1 python#4 sample) - hir_builder_emit_primitive_load_const_c (Phase 1 python#5 sample) Modes: - --dry-run: stage mutations, no build (any agent — bypass build lock) - --strict: exit 1 on FAIL (for gate integration) - --verbose: show build stderr Uses perl -0777 multi-line slurp for robust parsing of multi-line extern decls + function definitions. Mutation marker (phx_w45_drift) verified post-mutation to guard against silent no-op substitutions. Build lock: BUILD mode invokes cmake --build --target jit; per CLAUDE.md Phase 3D Build Lock, only testkeeper / gate_phoenix.sh may invoke with builds enabled. --dry-run is unrestricted. Authorization: theologian 21:55:24Z + supervisor 21:55:36Z + 22:33:17Z DISPOSITION (C). §3.5 fold-into-C derivation falsifier (opcode-constant shadow class) is deferred — needs W21 golden integration. Sibling workstreams: W33 (zero-bridge verifier), W42 (refcount correctness), W44 (DO-NOT-USE caller gate).

Codifies three protocols developed across the emitAnyCall PURE conversion arc (push 56-59) per pythia python#142/python#141/python#143 + supervisor + theologian authorizations: P8 — Phase 0' Coverage Extension to Perf-Regressing Benchmarks Per pythia python#142 python#1 + supervisor 22:46:24Z + 22:47:40Z. Sentinel-only HIR diff has empirical blind spot to single-bench regressions on unrelated workloads (caught when emitAnyCall push 59 showed int_arith -10% with exception-sentinel HIR-diff PASSING). Procedure: identify 24-bench >5% benches, run Phase 0' HIR-diff on bench source per identified bench (precise scrub, structural diff). Add to gate Step 7 post-processing. P9 — Filesystem-First Cross-Check Before Fabrication HALT Per medic 2026-04-22 build-claim false positive + medic 2026-04-25 22:50:53Z PYTHONJITDUMPFINALHIR false positive against generalist HIR dumps that were filesystem-verified at /tmp + retracted at 22:53:44Z. Procedure: identify implied artifact, ls + stat to confirm existence/mtime, post QUERY (not HALT) if artifact exists, never cite session-log absence as sole evidence. Costs ~30s vs ~5-10min false- positive recovery cycle. P10 — Variance Characterization Before (B) Investigation Per W-EMITANYCALL-INT-ARITH-PERF closure 22:57:29Z + pythia python#143 python#1 amendment 23:21:18Z + supervisor 23:21:51Z. Mirrors agent-memory feedback_falsifier_convergent_negative.md (per-agent reasoning side); P10 codifies team-process side. Procedure (7 steps): identify >5% benches, 3-run targeted re-runs for in-isolation variance, AT LEAST ONE full-24-bench re-run for in-context variance (different statistical populations: page-cache, branch-predictor, allocator history, subprocess-position effects). Closure REQUIRES both isolated AND in-context corroboration; if isolated clean but in-context reproduces delta → real signal in sequence-context layer (cold-start/page-cache), not at conversion layer. Pythia python#143 python#4 caught these 3 protocols as 'LANDED in spec but uncommitted at HEAD 0810be4 — exist only in working tree, not yet history.' This commit closes that gap: protocols now in git history before being cited as canonical (CC3 codification-on-authoring rule). Spec doc: P1-P10 + 3 cross-cutting (CC1/CC2/CC3) + paired empirical controls (PhxMem positive / HirType negative). Bundle target: push 60 if Alex authorizes (A)/(B)/(C); separate codification push if Alex direction is delayed >2hr per supervisor 23:21:51Z.

Push 62 (doc-only) — env-spec updated with lessons from 02:33Z dry-run + 02:39Z successful oracle execution that produced Phoenix-vs-Cinder verdict (Phoenix faster on 3/3 benches, sub-1.0x inherited from Cinder). Updates per theologian 02:41:37Z: - Phoenix JIT activation: import _cinderx FIRST, then import cinderjit (corrects v1 assumption that cinderjit was directly importable) - cinderx_dev JIT activation: from cinderx import jit; jit.force_compile - Binary paths: ~/local/cinderx_dev/python-3.12/python (corrects v1 assumption of ~/local/cinderx_dev/cinderx/python) - LD_LIBRARY_PATH + PYTHONPATH env requirements for cinderx_dev - Same-arch comparison (both ARM64 on devgpu004) verified working - Application result section: oracle verdict + per-bench numbers - Failure modes from 01:16Z (-X jit didn't activate) + 02:33Z (API enumeration gap) + both resolved methodologies Closes pythia python#148 python#4 (spec-from-single-failure shipping before empirical validation). v2 ships AFTER successful oracle execution.

simplify_primitive_compare_c at simplify_c.c:718 called hir_c_compare_op on a HirPrimitiveCompare instr. hir_c_compare_op casts to HirCompare* (HIR_DEOPT_FIELDS layout, op at offset ~104). HirPrimitiveCompare uses HIR_INSTR_FIELDS (op at offset ~40, total slab ~48 bytes). Read at instr+104 was ~56 bytes past the slab end, into adjacent (often freed) memory. Fix: add hir_c_primitive_compare_op accessor with correct HirPrimitiveCompare* cast. Replace simplify_c.c:718 call. Hardening (per pythia python#161 python#4 + feedback_class_of_bug_audit.md): add static_assert(offsetof(HirCompare, op) != offsetof(HirPrimitiveCompare, op)) in hir_instr_c_verify.cpp to prevent future single-accessor confusion. Verification (testkeeper valgrind, post-fix): Pre-fix: ERROR SUMMARY: 26 errors from 4 contexts Post-fix: ERROR SUMMARY: 1 errors from 1 contexts 24 simplify_primitive_compare_c UAF errors ELIMINATED. Re-verified post-amendment (generalist): Post-amend: ERROR SUMMARY: 1 errors from 1 contexts (unchanged) The remaining 1 error is the runtime StoreAttr NULL+0xAB deref (W-PYTORCH-CM-(ii)) — a separate, independent bug per SoK 4-class enumeration in docs/w-pytorch-cm-tooling-note.md. Class-of-bug audit (per feedback_class_of_bug_audit.md): - hir_c_compare_op (DEOPT cast): 4 callers — 3 correct (HirCompare context at simplify_c.c:648 simplify_compare_c, dynamic_comparison_ elimination.c:102 guarded by hir_c_is_compare, pass_output_type_c.c:45 HIR_OP_Compare case), 1 BUGGY (simplify_c.c:718, fixed) - hir_c_unary_op_kind (DEOPT cast): 3 callers, all correct - hir_c_inplace_op_kind (DEOPT cast): 1 caller, correct - hir_c_primitive_unary_op_kind (INSTR cast): exists, used correctly - HirFloatCompare/HirLongCompare/HirUnicodeCompare/HirCompareBool: no current op-field readers — would be candidates if added Sole bug. No parallel type-confusion in current code. Cinderx duplicate (per pythia python#161 python#3): NON-ISSUE. Python/cinderx/Jit/hir/* and Python/jit/hir/* are HARDLINKS (same inode); single edit covers both include paths. Build resolves 'cinderx/Jit/hir/' include to Python/cinderx/Jit/hir/, which is the same on-disk file as Python/jit/hir/. F7 R1 'ASAN false positive' classification (D-1777177190) was incorrect. ASAN/valgrind were right; this is a real type-confusion UAF that manifested as garbage reads driving wrong simplification logic. Bug latent because read past slab end returns garbage but doesn't crash; PrimitiveCompare branches on garbage land in valid-looking code most of the time. bench_pytorch_cm trigger correlates with workload exercising PrimitiveCompare simplification heavily (autocast/_NoGrad context manager enter/exit branches compile to PrimitiveCompare ops). Build: scripts/build_phoenix.sh Binary: /data/users/alexturner/phoenix/cpython/python Binary timestamp: 1777204101 (Apr 26 04:48:21 PDT) Binary md5: 687c34ef755aa6df9a2a57d7b568edc8

Design notes for the next round of fork-side perf work, after the autopsy-report consumer drove tracing overhead from ~1x (original exp28 baseline) to ~3x via the OID-refresh / type-name-fidelity / WAL_OBJ_SNAPSHOT correctness fixes. Six optimizations enumerated with first-pass risk assessments (LoC, invasiveness, crash risk): 1. User-code-only filter at capture time (~5-10x WAL volume win, high leverage; the simple variant is straightforward, the smart variant is more nuanced because mutations on user-visible objects from inside stdlib must still emit). 2. Resizable oid_map (~40 LoC, removes a sharp cliff at >16K live objects — what made one of our benchmarks hang for 20+ minutes). 3. Compact event encoding via varints (~2-3x smaller WAL, ~100 LoC, medium crash risk because varint decoding is finicky). 4. Streaming compression (~3-5x smaller bundles, stacks well with python#3, ~50 LoC + dep on liblz4/zstd). 5. Skip BIND for unchanged primitive values (modest win, ~20 LoC, trivial risk — freebie). 6. tp_dealloc hooks (~2x runtime speedup but high crash risk — foot-gun on cleanup ordering, race conditions, subclass coverage, collisions with other tools that patch tp_dealloc). Suggested order: python#2, python#1, python#5, python#3, python#4, python#6. None implemented; this is just a design-time scope-out so the work is shovel-ready when perf becomes a blocker.

Closes three spec gaps surfaced by pythia python#190 2026-04-27: (1) §4.A.5b add CALL-PATH SHAPE audit: site count alone insufficient, shape (single-setter / multi-direct-assignment / write-during-iteration) governs migration mode. SHAPE OVERRIDES COUNT — a 3-site multi-direct- assignment field is migrated under multi-commit + DCHECK rule, not single-commit. Per supervisor 2026-04-27T11:29:30Z (1). (3) §4.A.5c NEW bracket-validation probe gate: the §4.A.5b "DO-NOT-EXTRAPOLATE" annotation is a written warning, not a falsifier. Each bracket beyond ≤5 single-setter (kwnames_-class) requires a passed probe BEFORE cluster work commences. 3 probes: 6-15 single- setter, 6-15 multi-direct-assignment, >15 multi-direct-assignment (smallest in each class). Cost ~3-9 commits prep before ~13-19 commits of cluster work; acceptable de-risking. Per supervisor (3). (2) §6 decision python#4 + §5.F prerequisite: compiler.cpp:236 caller rewire reframed from "DEFER to Phase 4.D" to "HARD PREREQUISITE of Phase 4.E close gate." Without rewire, builder.cpp's C++ Pass class shell cannot delete (compiler.cpp consumes it) and §6 python#5 acceptance "builder.cpp ≤ 200 LOC" is unreachable. §5.F now includes explicit grep prerequisite check; FAIL → Phase 4 EXIT BLOCKED until rewire lands. Per supervisor (2). Authored 2026-04-27 per pythia python#190 + supervisor 2026-04-27T11:29:30Z. "The first photon to reach the lens does not describe the star — only that the lens works."

…-scratch W7c codegen-touching sub-batch (theologian docs/tier7-phase4a-preanalysis- 2026-04-30.md §9 W7c, supervisor D-1777583349 dispatch). Conversions: - BasicBlock::addPhiPredecessor (hir.cpp:620-633): std::vector<Phi*> + forEachPhi callback replaced with hir_c_bb_collect_phis_alloc + plain for-loop. The per-Phi pred-presence filter dropped from C++ shim — hir_c_phi_collect_add_args (called inside hir_c_phi_add_predecessor) returns 0 + early-returns when old_pred is not a current predecessor (hir_basic_block_c.h:380-385), so unconditional iteration is correct. - BasicBlock::removePhiPredecessor (hir.cpp:635-643): same pattern — std::vector replaced with C-side scratch. Both shims preserve the collect-then-mutate two-pass pattern (required because hir_c_phi_add/remove_predecessor REPLACES the Phi instruction in the BB list — hir_c_instr_replace_with at hir_basic_block_c.h:479 + :498; iterating + mutating in one pass would invalidate the iterator). New C helper: - hir_c_bb_collect_phis_alloc (hir_basic_block_c.h): two-pass count + malloc + fill returning a malloc'd scratch array of leading Phi pointers. NULL on empty BB. Loud-fail JIT_CHECK_C on OOM per feedback_no_workarounds + forward stance python#4 (gatekeeper 19:39:45Z). Caller frees the array. Falsifier (V5): - verify_phase4a_batch75_collect_phis_alloc: 4 sub-checks across 4 fresh BBs. (a) Empty BB: NULL + n=0 (sentinel n=999 must be overwritten) (b) 3-phi BB: malloc'd array length 3, chain order pointers (c) [Phi, Phi, non-Phi] BB: leading-Phi prefix only (n=2) (d) Non-Phi-first BB: NULL + n=0 Cumulative-drift watch counter: 9/5+ — second codegen-touching reload. Per Q-W7-4 dual-anchor stays: M3 vs prior PASS gate (W7b 1.33x); cumulative-drift trend ALSO vs W3 baseline (1.31x clean codegen). Per supervisor M-slate dispatch D-1777572112 + Phase 4.A W7c dispatch D-1777583349 (LEAD: generalist, medium tier per pre-analysis §9.2).

…et_set_insert realloc OOM Per theologian SR-3(a) 02:40:16Z catch on d5a9280. Original phx_bc_offset_set_insert had silent-skip on OOM realloc: s->data = (int *)realloc(s->data, new_cap * sizeof(int)); If OOM: s->data = NULL, capacity update succeeds, subsequent s->data[pos] = key crashes via NULL-deref instead of clean abort. Same class as W2-A1 silent-skip violation + gatekeeper forward stance python#4 codified rule (feedback_no_silent_bailout_in_helpers, supervisor 2026-04-30 20:10Z): BLOCK silent-return-on-malloc/resource-fail in Cat-A/B C helpers; loud-fail JIT_CHECK_C required regardless of tier. Fix (+5/-1 LOC): - Capture realloc result in new_data local before assigning to s->data - JIT_CHECK_C(new_data != NULL, "phx_bc_offset_set_insert realloc failed (new_cap=%zu)", new_cap) — loud-fail with diagnostic - Assign s->data = new_data only after the check - #include cinderx/Common/jit_log_c.h (matches builder_state_c.h pattern at line 31) Forward-fix per CLAUDE.md ("create NEW commit rather than amending"); d5a9280 stays as the X1a parent commit. Pre-commit chat-recheck applied per codified discipline; theologian flag at 02:40:16Z confirmed as latest disposition (no reversal).

…red substrate + W2-A1 fix Per supervisor 03:06:27Z (b) PROMOTE disposition + theologian 03:06:33Z CONFIRM. Substrate-grep payoff (X1a discipline applied): existing PhxQueue at licm_c.c:42-73 (file-scoped static) avoids NEW substrate authoring. (b) PROMOTE + retrospective W2-A1 silent-skip-on- realloc-OOM fix discharges latent forward-stance-python#4 violation as bonus. Substrate scope (X2a was originally PhxBlockCtxQueue, reframed per substrate-grep): generic void* FIFO queue (linear array, head/tail grow unbounded; bounded by per-call lifetime). Validates Phase 4.X-full hash/queue substrate class before X2c E-5 + X2d E-7 migrations. Changes (+82 LOC total: NEW phx_ptr_queue.h +88, hir_instr_c_verify.cpp +71, licm_c.c -50/+11 net): (1) NEW phx_ptr_queue.h (88 LOC): - typedef struct PhxPtrQueue { void **data; size_t head, tail, capacity; } - 5 static-inline ops: init/destroy/empty/push/pop - PHX_PTR_QUEUE_INITIAL_CAP=16u (matches original PhxQueue cap=16) - JIT_CHECK_C(new_data != NULL, ...) loud-fail post-realloc — forward stance python#4 discharge for original silent-skip - Allocator: plain malloc/realloc/free (was PyMem_RawMalloc; matches phx_ptr_array.h sibling pattern) - Header-only zero-cost abstraction - Block-comment documents promotion lineage + W2-A1 fix + use-class (2) licm_c.c (-50 LOC = removed file-scoped PhxQueue + 5 static fn defs; +11 LOC = #include phx_ptr_queue.h + 7 callsite renames in PhxQueue → PhxPtrQueue / queue_* → phx_ptr_queue_* at lines 134-151 LICM loop-body BFS): - Removed typedef PhxQueue { void**, head, tail, cap } at line 44-47 - Removed queue_init / queue_destroy / queue_empty / queue_push / queue_pop static functions - Comment-block at line 43 documents promotion ('PhxQueue → PhxPtrQueue promoted to phx_ptr_queue.h shared header') - Migrated 7 call sites in LICM loop-body BFS (line 162-179 → uses PhxPtrQueue + phx_ptr_queue_*) (3) hir_instr_c_verify.cpp (+71 LOC = batch91 fixture + #include + constructor entry): - verify_phase4x_full_batch91_ptr_queue: 5-section coverage per theologian §5.1 falsifier: (a) empty: phx_ptr_queue_empty true + lazy-alloc invariant (b) single push-pop: FIFO of one element (c) multi FIFO order: 3 push / 3 pop / order [a/b/c] preserved (d) cap-grow: 20 elements (past initial 16); capacity grew; order preserved across realloc (e) re-empty + post-drain reuse: push works after drain; destroy resets all fields - Include cinderx/Jit/hir/phx_ptr_queue.h - Fixture call appended to constructor chain Substrate ready for X2c migration (translate() std::deque<TranslationContext> queue → PhxPtrQueue replacement; value-vs-pointer storage decision belongs to X2c per generalist 03:06:18Z note). Falsifier (V5): 5-section verifier exercises the substrate; LICM body serves as live consumer (compile-passes proves migration is type-correct for that consumer; LICM unit tests validate runtime behavior). Cumulative-drift watch counter: 10/5+ — at threshold; gatekeeper's call on cap-check eligibility (12/20 since D3a reset). Phase 4.X-full progress: 2.1 ThreadedCompileSerialize DONE / 2.7 PhxBCOffsetSet (X1a-X1b, E-8 DISCHARGED) / 2.4 PhxPtrQueue (this) — 3 of 4 substrate classes initiated. Phase 4.X-full inventory unchanged (8 stay-C++ exceptions; X2a is substrate-only, X2c migration discharges E-5 + X2d migration discharges E-7). Per supervisor M-slate dispatch D-1777572112 + Phase 4.X-full ENTRY + X2a dispatch (LEAD: generalist, medium-STRUCT tier per pre-analysis §5).

…ate + verifier Per supervisor 03:17:18Z next-up dispatch + theologian docs/tier7-phase4x-full-entry-preanalysis-2026-05-01.md §2.4. X2b is substrate-only authoring (no migration this batch); X2c will replace std::unordered_set<BasicBlock*> processed/loop_headers at builder.cpp: 840-841 (translate() loop) → discharges E-7 substrate dependency. Pre-author substrate-grep per supervisor instruction: confirmed ZERO existing PhxPtrSet/PhxBlockPtrSet/phx_ptr_set tokens in Python/jit/hir/. Existing PhxBlockSet at licm_c.c:20-40 is dense bit-array indexed by block ID — different impl-class (use-class requires known max block ID upfront); cannot be reused for translate() pointer-keyed set semantic. Pre-commit chat-recheck applied per discipline (latest fixup checkpoint, no disposition reversal). NEW phx_ptr_set.h (137 LOC): - typedef struct PhxPtrSet { void **entries; size_t count; size_t capacity } - 7 static-inline ops: init/destroy/clear/contains/insert/insert_raw/resize + slot/size helpers - Open-addressed hash with linear probing - Power-of-2 capacity; PHX_PTR_SET_INITIAL_CAP=16u; load factor 0.7 triggers resize doubling - Knuth multiplicative hash on uintptr_t (64-bit constant 11400714819323198485) - Empty-slot sentinel: entries[i] == NULL - NULL-key invariant: cannot store NULL as a member (sentinel collision); callers must guard NULL-pointer insertion if NULL is a possible key - Allocator: plain calloc/realloc/free (matches phx_ptr_array.h sibling pattern; calloc zero-inits new entries to NULL sentinel) - Forward stance python#4: JIT_CHECK_C(new_entries != NULL, ...) loud-fail post-calloc per X1a 0bac3bc precedent Verifier (hir_instr_c_verify.cpp +90 LOC, batch92 6-section coverage): - (a) empty: contains 0, size 0, lazy-alloc invariant - (b) single insert + contains: returns 1 / size 1 / contains 1 - (c) duplicate insert: returns 0, size unchanged - (d) multi insert + contains across 3 keys + non-inserted-not-contained - (e) resize past initial cap (16): 20 distinct-key inserts; size 23 (3 prior + 20); capacity grew past 16; ALL pre-resize + post-resize keys still contained (validates rehash correctness) - (f) clear + reuse: count resets, contains returns 0; subsequent insert works without re-init; destroy resets all fields Substrate ready for X2c E-7 translate() std::unordered_set→PhxPtrSet migration. Header-only zero-cost abstraction; release-codegen IDENTICAL modulo new symbols. Phase 4.X-full progress: 2.1 ThreadedCompileSerialize DONE / 2.7 PhxBCOffsetSet (X1a-X1b, E-8 DISCHARGED) / 2.4 PhxPtrQueue (X2a) + PhxPtrSet (this) — all 4 substrate classes initiated. Phase 4.X-full inventory unchanged at 8 stay-C++ exceptions; X2c migration discharges E-7, X2d migration discharges E-5. Cumulative-drift watch counter: 12/5+. Header-only structural no-op (X2a precedent — substrate-only authoring is empirically variance-class); gatekeeper cap-check eligibility decision (13/20 since D3a reset). Per supervisor M-slate dispatch D-1777572112 + Phase 4.X-full ENTRY + X2b dispatch (LEAD: generalist, medium-STRUCT tier per pre-analysis §5).

…_ref bridges + verifier Per supervisor 04:04:50Z X3 disposition (Q-X3-1..5) + theologian docs/tier7-phase4x-x3-preanalysis-2026-05-01.md §2-§6. X3a is substrate-only authoring (no migration this batch); X3b/X3c will consume PhxPtrMap + bridges for E-1+E-2+E-3 Environment + E-6 BlockCanonicalizer migrations. Pre-author substrate-grep per supervisor instruction: confirmed ZERO existing PhxPtrMap/phx_ptr_map tokens in Python/jit/hir/. ZERO existing phx_threaded_incref/decref bridges. ThreadedRef class lives at threaded_compile.h:224 with static incref/decref template methods at :307+:337. Pre-commit chat-recheck applied per discipline. NEW files (+340 LOC across 3 NEW + 1 modified): (1) phx_ptr_map.h (190 LOC): PhxPtrMap generic void*-keyed open-address hash map with void* values. - typedef struct PhxPtrMapEntry { void *key; void *value } - typedef struct PhxPtrMap { PhxPtrMapEntry *entries; size_t count; capacity } - 11 static-inline ops: init/destroy/clear/lookup/contains/insert/ insert_raw/resize + slot/size/capacity/at_key/at_value - Open-addressed hash with linear probing (mirrors PhxPtrSet) - Power-of-2 capacity; PHX_PTR_MAP_INITIAL_CAP=16u; load 0.7 triggers resize doubling - Knuth multiplicative hash on uintptr_t (64-bit constant) - Empty-slot sentinel: entries[i].key == NULL - NULL-key invariant (cannot store NULL as key); NULL VALUE permitted with contains-vs-NULL-value disambiguation via separate phx_ptr_map_contains accessor - Allocator: plain calloc/realloc/free; JIT_CHECK_C(new_entries != NULL) loud-fail post-calloc per forward stance python#4 (X1a 0bac3bc precedent) - Q-X3-2 void*-VALUE only (YAGNI-bounded); specialize at E-9 if typed-value variant needed - Q-X3-5 E-9 forward-prep tag in header block-comment (audit-trail amortization signal; no speculative E-9 surface added) (2) phx_threaded_ref.h (32 LOC): extern "C" declarations for phx_threaded_incref / phx_threaded_decref. Both NULL-safe and immortal-safe (mirror ThreadedRef::incref/decref short-circuits). Uses Python.h opaque PyObject for C ABI. Per Q-X-full-5 supervisor 03:17:18Z: substrates stay in Python/jit/hir/ namespace. (3) phx_threaded_ref.cpp (18 LOC): extern "C" implementations. Thin wrappers calling jit::ThreadedRef<>::incref(obj) and ::decref(obj) static template methods. Auto-globbed by Python/jit_build/CMakeLists.txt:123 GLOB_RECURSE pattern; no build config change needed. (4) hir_instr_c_verify.cpp (+98 LOC): batch95 7-section coverage: (a) empty: lookup NULL, contains 0, size 0 (b) single insert: returns 1 / size 1 / lookup correct value (c) duplicate-key update: insert returns 0 (overwrite), size unchanged, lookup returns NEW value (d) multi insert + lookup across 4 distinct keys (e) contains-vs-NULL-value disambiguation: NULL value permitted; contains true; lookup returns NULL; absent-key contains false (f) iter raw slots: walk capacity collecting all 5 inserted keys (g) clear + reuse: count resets, lookup NULL; post-clear insert works; destroy resets all fields Substrate ready for X3b E-1+E-2+E-3 Environment migration + X3c E-6 BlockCanonicalizer migration. Header-only zero-cost abstractions for PhxPtrMap; thin extern 'C' bridge layer for ThreadedRef. Falsifier (V5): batch95 7-section verifier exercises empty/single/ duplicate-update/multi/NULL-value/iteration/clear semantics. Compile proves bridge linkage; phx_threaded_incref/decref delegate to ThreadedRef::incref/decref which has its own GIL-disabled atomic-counter + standard refcount paths. Cumulative-drift watch counter: 15/5+. Mostly header-only static-inline + thin C/C++ bridge .cpp; release-codegen IDENTICAL modulo new symbols (PhxPtrMap header-only; bridge .cpp adds 2 entries). Phase 4.X-full progress: 2.1 / 2.7 / 2.4 / 2.2 — all 4 substrate classes initiated. X3 cluster will discharge 4-of-7 remaining stay-C++ exceptions on full close (X3b/X3c migrations). Q-X3-4 phase-stop accepted post-X3; E-7 residual + E-9 cluster → next session(s). Per supervisor M-slate dispatch D-1777572112 + Phase 4.X-full ENTRY + X3a dispatch (LEAD: generalist, STRUCT substrate-authoring tier per supervisor 04:04:50Z).

… E-1+E-2+E-3 DISCHARGED Per supervisor 04:26:00Z X3b dispatch + theologian 04:26:18Z watchpoints + pre-analysis docs/tier7-phase4x-x3-preanalysis-2026-05-01.md §2 §4. X3b is the codegen-touching Environment migration consuming X3a substrate (PhxPtrSet + phx_threaded_ref bridges). Discharges 3 stay-C++ exceptions in single batch: - E-1 (Environment dtor STL clear via ~ThreadedRef destructor chain) - E-2 (Environment addReference STL emplace via ThreadedRef::create+incref) - E-3 (Environment::references() std::unordered_set return type) Phase 4.X-full inventory 7→4 stay-C++ exceptions remaining. Pre-author substrate-grep per supervisor instruction: confirmed Environment is the sole consumer of std::unordered_set<ThreadedRef<>>; single external caller of references() at gen_asm.cpp:1412 (range-for); HirEnvironment opaque-blob layout pinned at hir_instr_c.h:165 + HirEnvironmentLayoutVerifier static_asserts at verify.cpp:123-133. Pre-commit chat-recheck applied (latest shepard 04:31:51Z verbosity flag at supervisor, no reversal). Migration (+59 LOC across 5 files): (1) hir.h (+9 LOC): #include phx_ptr_set.h; ReferenceSet typedef std::unordered_set<ThreadedRef<>> → PhxPtrSet; references_{} value-init for POD struct (was default-init via std::unordered_set ctor) (2) hir.cpp (+28 LOC): #include phx_ptr_set.h + phx_threaded_ref.h. - ~Environment: ThreadedCompileSerialize guard retained (Phoenix concurrency-infra class, stays C++); iterate raw slots via phx_ptr_set_at + phx_threaded_decref each + phx_ptr_set_destroy (theologian watchpoint python#2) - addReference(PyObject*): contains-check BEFORE phx_threaded_incref (theologian watchpoint python#1: dedup semantic preserved; prevents double-incref on duplicate adds — matches prior unordered_set:: emplace dedup which would discard the temporary ThreadedRef on dup hit, balancing create's incref against ~ThreadedRef's decref) - addReference(Ref<>): unchanged (delegates) - references(): direct PhxPtrSet& return (no opaque-blob bridge cast) (3) hir_instr_c.h (+7 LOC): HirEnvironment.references_opaque[56] → references_entries (void*) + references_count (size_t) + references_capacity (size_t) = sizeof(PhxPtrSet) = 24 bytes on 64-bit. Block-comment documents the X3b layout migration. (4) hir_instr_c_verify.cpp (+1 LOC): HirEnvironmentLayoutVerifier offsetof(references_opaque) → offsetof(references_entries) == offsetof(Environment, references_); rest of static_asserts unchanged (sizeof + other field offsets intact since PhxPtrSet matches std:: unordered_set bucket-array sizeof on the typical libstdc++ impl). (5) gen_asm.cpp (+10/-3 LOC): range-for over std::unordered_set< ThreadedRef<>> → raw-slot iteration via phx_ptr_set_capacity + phx_ptr_set_at; cast PyObject* per code_rt->addReference signature (theologian watchpoint python#3 + supervisor watchpoint python#3 §4.4 falsifier: code_runtime.h:112 takes PyObject* directly). ThreadedCompileSerialize retained at all sites (Phoenix concurrency-infra class, OUT of stay-C++ exception inventory per supervisor 04:04:50Z Q-X3-3); thin extern "C" phx_threaded_incref/decref bridges (X3a) provide GIL-correct refcount paths via jit::ThreadedRef<>::incref/decref. Falsifier (V5): - Existing batch92 (PhxPtrSet) verifier covers C-side substrate - HirEnvironmentLayoutVerifier static_asserts pin field offsets - Py_REF_DEBUG ARM64 pydebug runtime test (theologian watchpoint python#4 + supervisor §4.2 falsifier) provides primary refcount-balance verification via testkeeper integration - E-1+E-2+E-3 behavior exercised by every JIT compile + teardown in test_phoenix.sh suite Cumulative-drift watch counter: 16/5+ (17/20 toward next cap-check). Codegen-touching but X3a substrate is empirically variance-class on this session arc; expected within forward-watch tolerance. nqueens advisory cleared X2c→X3a +2.9pp; func_calls sawtooth flat. Phase 4.X-full progress: X1 (E-8) / X2 (E-5 full + E-7 partial) / X3a substrate / X3b (this, E-1+E-2+E-3 discharge) — 5 of 9 original stay-C++ exceptions discharged this session arc. X3c (E-6 BlockCanonicalizer migration) next. Per supervisor M-slate dispatch D-1777572112 + Phase 4.X-full ENTRY + X3b dispatch (LEAD: generalist, STRUCT codegen-touching tier per pre-analysis §5).