checkpoint: P5.4 core done; record remaining BuildOptions-migration plan

current/CHECKPOINT-COMPILER-API.md

@@ -422,6 +422,51 @@ when reached (sentinels or accessor fns; see the design doc Risks).
   `List` growth; orthogonal, see `current/CHECKPOINT-METATYPE.md`.)
 
 ## Log
+- **P5.4 CORE — the whole build is sx-driven via `default_pipeline`; no Zig auto-emit/auto-link (2026-06-19).**
+  The compiler's post-IR role is now: codegen → invoke the build callback. **There is NO auto-emit / auto-link.**
+  Commits (all green): (1) **core** (`d178454`) — `emit_object()` is an ACTION (verify+emit via a host
+  `BuildHooks` vtable; `main.BuildHooksCtx`); new query primitives `build_output`/`build_target`/
+  `build_frameworks`/`build_flags` (read the merged `BuildConfig`); `library/modules/build.sx` imports
+  `compiler.sx` + defines `default_pipeline` (emit → gather c_objs → link); the compiler **force-lowers**
+  `default_pipeline` (well-known name, `decl.isDefaultBuildPipeline`, force-lowered after Pass 2) and
+  **auto-invokes** it post-codegen when no `on_build` override (`main` final fallback `invokeByName
+  "default_pipeline"`); the BUILD path **auto-imports `modules/build.sx`** (prepends a synthetic import node in
+  `compileWithTimer`) so prelude-less programs (asm tests) still get `default_pipeline`; removed the build cache
+  short-circuits (a future cache can live in `default_pipeline`). (2) **on_build-only** (`65ac370`) — migrated
+  all 9 `set_post_link_callback` callers to `on_build(cb)` (callback gains `opt: BuildOptions`); DELETED
+  `set_post_link_callback`. **Override semantics changed:** an `on_build` callback REPLACES the build (must
+  emit+link or `return default_pipeline(opt)` — delegation verified), unlike the old post-link callback that ran
+  AFTER the auto-link. Reworked tests: 1662 (queries) + 1664 (override+List-grow) DELEGATE to `default_pipeline`;
+  deleted 1661/1663 (primitives now exercised by EVERY AOT build). `sx run` (JIT) is UNTOUCHED (emits in-process,
+  never invokes `default_pipeline`). Benign `.ir` churn each step; **703/0 both gates.**
+  > **REMAINING P5.4 (the BuildOptions-surface migration — large, mechanical, dual-path, string-lifetime-sensitive;
+  > NOT YET DONE — paused to avoid rushing core-IR deletion on a depleted context budget):**
+  > - **Migrate the 36 `BuildOptions :: struct #compiler` methods → free `ufcs … abi(.compiler)` fns** (the
+  >   pattern S5a used for `set_post_link_callback`). Families: string SETTERS (`set_bundle_path`/`set_bundle_id`/
+  >   `set_codesign_identity`/`set_provisioning_profile`/`set_manifest_path`/`set_keystore_path`/`add_framework`/
+  >   `add_link_flag`/`set_output_path`/`set_wasm_shell`/`set_post_link_module`/`add_asset_dir`) — write/append to
+  >   `BuildConfig`; string GETTERS (`binary_path`/`bundle_path`/`bundle_id`/`codesign_identity`/
+  >   `provisioning_profile`/`target_triple`/`manifest_path`/`keystore_path`) — read `BuildConfig`; BOOL getters
+  >   (`is_macos`/`is_ios`/`is_ios_device`/`is_ios_simulator`/`is_android`) — compute from the triple; LIST/index
+  >   getters (`framework_count`/`framework_at`/`framework_path_*`/`asset_dir_*`/`jni_main_*`).
+  > - **Each method = dual-path:** a VM `callCompilerFn` arm (flat memory) + a legacy `compiler_lib` handler. The
+  >   legacy handlers can REUSE the existing `compiler_hooks` hook bodies (make them `pub`; the hook already dupes
+  >   strings into a long-lived allocator + reads/writes `BuildConfig`). **String lifetime:** a setter called at
+  >   `#run` (emit-time VM eval) must dupe the flat-memory string into a PERSISTENT allocator (NOT the per-eval VM
+  >   arena which frees at `Vm.deinit`) — thread `emit_llvm.alloc` in (e.g. a `BuildConfig.string_alloc` field) so
+  >   real bundle builds keep the strings; for the strict-bail JIT case the config is set-but-never-read so any
+  >   alloc works, but do it right for real `sx build`.
+  > - **This kills the 4 strict `compiler_call` bails** (1609 `add_framework`; 1614/1615/1616 `set_bundle_*`/
+  >   `set_codesign_*`/`set_provisioning_*` — all SETTERS at `#run configure()`). Migrating the SETTERS alone
+  >   suffices for strict-green (the GETTERS run only at post-link, which JIT/strict-run never fires).
+  > - **Then DELETE** `#compiler` (parse/lower attribute), the `compiler_call` IR op (`inst.zig` + every
+  >   switch arm + `interp.zig:1130` dispatch), and `compiler_hooks.zig` `HookFn`/`Registry` (keep the pub hook
+  >   bodies only if the legacy handlers call them — else inline + delete). The `BuildOptions` struct becomes a
+  >   plain (zero-field) handle type, or is dropped if `opt` is unused. **Migrate the bundler** (`platform/bundle.sx`
+  >   `bundle_main`) so `default_pipeline` calls it when `bundle_path` is set (the `#compiler` accessors it reads
+  >   become the migrated `abi(.compiler)` getters) + the `--bundle` shim / `post_link_module` path is reworked or
+  >   removed (default_pipeline owns bundling). **No corpus AOT bundle test exists** → add dedicated bundle smoke
+  >   tests (the stream's top risk). After strict goes green: flip VM-to-default + delete `interp.zig` (4F).
 - **P5.3 (`on_build` registrar) — the build-callback registration mechanism; callback takes `BuildOptions` (2026-06-19).**
   Per the user's design: `on_build(cb)` is the build-callback registrar (a FREE fn), generalizing
   `set_post_link_callback` — the callback is `(opt: BuildOptions) -> bool abi(.compiler)` and the compiler invokes