diff --git a/current/CHECKPOINT-COMPILER-API.md b/current/CHECKPOINT-COMPILER-API.md
index dfc3d160..e6e4db79 100644
--- a/current/CHECKPOINT-COMPILER-API.md
+++ b/current/CHECKPOINT-COMPILER-API.md
@@ -422,6 +422,35 @@ when reached (sentinels or accessor fns; see the design doc Risks).
   `List` growth; orthogonal, see `current/CHECKPOINT-METATYPE.md`.)
 
 ## Log
+- **P5.3 (`on_build` registrar) — the build-callback registration mechanism; callback takes `BuildOptions` (2026-06-19).**
+  Per the user's design: `on_build(cb)` is the build-callback registrar (a FREE fn), generalizing
+  `set_post_link_callback` — the callback is `(opt: BuildOptions) -> bool abi(.compiler)` and the compiler invokes
+  it post-codegen WITH the opaque `BuildOptions` handle. **Key simplification:** the handle is a single
+  null-sentinel word, so passing it sidesteps the feared fat-`BuildConfig` marshaling. Changes: VM
+  `callCompilerFn` `on_build` arm + legacy `handleOnBuild` (both set `post_link_callback_fn` + a new
+  `BuildConfig.post_link_takes_options` flag); `comptime_vm` `runEntry`→`runEntryArgs(extra)` (implicit ctx +
+  explicit args) + a public `runBuildCallback(..., pass_options)`; `core.invokeByFuncId`/`invokeByName` now take
+  `pass_options` (was an always-empty args slice); `main.zig` passes `getPostLinkTakesOptions()`; `build.sx`
+  `on_build` decl. Smoke test `1664-platform-on-build-callback` (AOT). Benign 37-`.ir` churn (type table +1 for
+  the `on_build` fn type; behavior identical — verified only `.ir` streams changed). **705/0 both gates.**
+  > **CONSOLIDATED REMAINING PLAN (P5.4 — from the user's 2026-06-19 direction; large + coupled + re-churns
+  > snapshots; the bundler has NO corpus coverage = the stream's top risk):**
+  > 1. **Migrate to `on_build` ONLY** — convert every `set_post_link_callback(cb)` caller (`platform/bundle.sx`
+  >    `bundle_main`, examples 1611/1614/1615/1616, 0602/0603) to `#run on_build(cb)` with `cb: (opt:
+  >    BuildOptions) -> bool`; DELETE `set_post_link_callback` (build.sx + compiler_lib + VM arm).
+  > 2. **Bundle/Android config → sx data in the default script.** The `#compiler` accessors the user flagged —
+  >    `set_bundle_path`/`bundle_path`/`bundle_id`/`codesign_identity`/`provisioning_profile`,
+  >    `set_manifest_path`/`keystore_path`, `jni_main_count`/`jni_main_runtime_path_at`/`jni_main_java_source_at`
+  >    — move into the sx `BuildConfig`/default script (sx-owned data), not compiler hooks.
+  > 3. **`default_pipeline` + override model.** `library/modules/build.sx` ships `#run on_build(default_pipeline)`
+  >    (the stdlib default); a user's `#run on_build(custom)` in main.sx OVERRIDES it (LAST-WINS — already the
+  >    behavior, since registration just overwrites `post_link_callback_fn`). `default_pipeline` calls
+  >    `emit_object`/`c_object_paths`/`link_libraries`/`link` + the sx bundler.
+  > 4. **REMOVE the Zig driver's auto-emit/auto-link** (`main.compileWithTimer`) — COUPLED with (3): once
+  >    `default_pipeline` drives emit+link, the driver must stop doing them or it double-links. Riskiest piece
+  >    (whole build/bundle path; no corpus guard → needs dedicated bundle smoke tests).
+  > 5. **Delete `#compiler`/`compiler_call`/`compiler_hooks`** + the S5a `build_options` once config is sx data →
+  >    kills the 4 strict `compiler_call` bails (1609/1614/1615/1616) → strict sweep green → `interp.zig` deletable.
 - **P5.2b (`link` ACTION) — the sx `link` primitive links on the VM via a host-installed vtable; build callback de-failable'd (2026-06-19).**
   Phase 5's one genuine ACTION primitive: `link(objects, output, libraries, frameworks, flags, target)` (in
   `library/modules/compiler.sx`). **USER DECISION this step: drop fallibility from the build callback** — so