From 3759eda3b4ceedd67d9545499b091dfd74b023ee Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 15 Oct 2026 12:49:48 +0200
Subject: [PATCH 001/317] wip: snapshot object lifetime regressions

Add focused Catalyst upload and Mojolicious controller/WebSocket regressions
and preserve lexical typeglob names for serialized filehandles. The tests still
expose Catalyst cleanup and interpreter controller lifetime defects; continue
implementation on this draft PR.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtime/operators/IOOperator.java         | 14 ++-
 .../catalyst_request_body_tempfile_lifetime.t | 93 +++++++++++++++++++
 .../mojolicious_websocket_callback_lifetime.t | 75 +++++++++++++++
 3 files changed, 181 insertions(+), 1 deletion(-)
 create mode 100644 src/test/resources/unit/catalyst_request_body_tempfile_lifetime.t
 create mode 100644 src/test/resources/unit/mojolicious_websocket_callback_lifetime.t

diff --git a/src/main/java/org/perlonjava/runtime/operators/IOOperator.java b/src/main/java/org/perlonjava/runtime/operators/IOOperator.java
index a09874adca..af8c3be8ea 100644
--- a/src/main/java/org/perlonjava/runtime/operators/IOOperator.java
+++ b/src/main/java/org/perlonjava/runtime/operators/IOOperator.java
@@ -1098,7 +1098,8 @@ else if (secondArg.type == RuntimeScalarType.GLOB || secondArg.type == RuntimeSc
             if (lexicalName != null && lexicalName.startsWith("$")) {
                 // A lexical filehandle is an anonymous GV, but Perl retains
                 // its pad name for stringification across recursive calls.
-                anonGlob.setStringificationName("main::" + lexicalName);
+                anonGlob.setStringificationName(
+                        RuntimeCode.getCurrentPackage() + lexicalName);
             }
             newGlob.value = anonGlob;
             // Register for GC-based fd recycling (mimics Perl's DESTROY on scope exit)
@@ -2028,6 +2029,17 @@ public static RuntimeScalar sysopen(int ctx, RuntimeBase... args) {
             RuntimeScalar newGlob = new RuntimeScalar();
             newGlob.type = RuntimeScalarType.GLOBREFERENCE;
             RuntimeGlob anonGlob = new RuntimeGlob(null).setIO(fh);
+            String lexicalName = RuntimeCode.findActiveLexicalName(fileHandle);
+            if (lexicalName == null) {
+                lexicalName = fileHandle.lexicalDisplayName;
+            }
+            if (lexicalName != null && lexicalName.startsWith("$")) {
+                // sysopen creates an anonymous GV for lexical filehandles just
+                // like open(). Preserve its lexical name so modules such as
+                // File::Temp can serialize and recreate the handle correctly.
+                anonGlob.setStringificationName(
+                        RuntimeCode.getCurrentPackage() + lexicalName);
+            }
             newGlob.value = anonGlob;
             RuntimeIO.registerGlobForFdRecycling(anonGlob, fh);
             fileHandle.set(newGlob);
diff --git a/src/test/resources/unit/catalyst_request_body_tempfile_lifetime.t b/src/test/resources/unit/catalyst_request_body_tempfile_lifetime.t
new file mode 100644
index 0000000000..d3322f6cd4
--- /dev/null
+++ b/src/test/resources/unit/catalyst_request_body_tempfile_lifetime.t
@@ -0,0 +1,93 @@
+use strict;
+use warnings;
+use Test::More;
+use Data::Dumper ();
+use Scalar::Util qw(weaken);
+
+BEGIN {
+    eval {
+        require Catalyst;
+        require Catalyst::Controller;
+        require Catalyst::Test;
+        require HTTP::Request;
+        require HTTP::Body::OctetStream;
+        require File::Temp;
+        1;
+    } or plan skip_all => 'Catalyst request test dependencies are not installed';
+}
+
+package Issue1795OwnershipTest;
+use Catalyst;
+__PACKAGE__->config(name => 'Issue1795OwnershipTest');
+
+package Issue1795OwnershipTest::Controller::Root;
+use base 'Catalyst::Controller';
+__PACKAGE__->config(namespace => '');
+our ($original_body, $original_context, $original_request, $original_temp);
+
+sub dump_body : Local {
+    my ($self, $context) = @_;
+    my $request = $context->request;
+    $request->prepare_body;
+    $Issue1795OwnershipTest::original_context = $context;
+    Scalar::Util::weaken($Issue1795OwnershipTest::original_context);
+    $Issue1795OwnershipTest::original_request = $request;
+    Scalar::Util::weaken($Issue1795OwnershipTest::original_request);
+    $Issue1795OwnershipTest::original_body = $request->{_body};
+    Scalar::Util::weaken($Issue1795OwnershipTest::original_body);
+    $Issue1795OwnershipTest::original_temp = $request->{_body}->body;
+    Scalar::Util::weaken($Issue1795OwnershipTest::original_temp);
+
+    my $dumper = Data::Dumper->new([$request->{_body}]);
+    $dumper->Indent(1);
+    $dumper->Purity(1);
+    $dumper->Useqq(0);
+    $dumper->Quotekeys(1);
+    $dumper->Terse(1);
+    $dumper->Deepcopy(1);
+
+    $context->res->content_type('text/plain');
+    $context->res->body($dumper->Dump);
+}
+
+sub index : Local { $_[1]->res->body('ok') }
+
+package Issue1795OwnershipTest;
+__PACKAGE__->setup;
+
+package main;
+Catalyst::Test->import('Issue1795OwnershipTest');
+
+my $request = HTTP::Request->new('PUT', 'http://localhost/dump_body');
+$request->header('Content-Type' => 'application/octet-stream');
+$request->header('Content-Length' => 9);
+$request->content('foobarbaz');
+my $response = request($request);
+ok($response && $response->is_success, 'octet-stream request succeeds');
+unlike($response->content, qr/\*\{'null'\}/,
+    'serialized tempfile handle retains its Perl glob name');
+
+my $body;
+{
+    no strict 'refs';
+    eval '$body = ' . substr($response->content, 8);
+}
+die $@ if $@;
+isa_ok($body, 'HTTP::Body::OctetStream');
+isa_ok($body->body, 'File::Temp');
+my $path = $body->body->filename;
+
+my $next_response = request(HTTP::Request->new('GET', 'http://localhost/index'));
+ok($next_response && $next_response->is_success, 'subsequent request succeeds');
+undef $body;
+ok(!defined($Issue1795OwnershipTest::original_context),
+    'completed request context has no remaining strong owner');
+ok(!defined($Issue1795OwnershipTest::original_request),
+    'completed Catalyst request has no remaining strong owner');
+ok(!defined($Issue1795OwnershipTest::original_body),
+    'completed request body has no remaining strong owner');
+ok(!defined($Issue1795OwnershipTest::original_temp),
+    'completed request tempfile object has no remaining strong owner');
+ok(!-e $path, 'request body tempfile is released with the previous request');
+
+done_testing;
diff --git a/src/test/resources/unit/mojolicious_websocket_callback_lifetime.t b/src/test/resources/unit/mojolicious_websocket_callback_lifetime.t
new file mode 100644
index 0000000000..0503580bcd
--- /dev/null
+++ b/src/test/resources/unit/mojolicious_websocket_callback_lifetime.t
@@ -0,0 +1,75 @@
+use strict;
+use warnings;
+
+BEGIN { $ENV{MOJO_REACTOR} = 'Mojo::Reactor::Poll' }
+
+use Test::More;
+
+BEGIN {
+  $ENV{MOJO_REACTOR} = 'Mojo::Reactor::Poll';
+  eval {
+    require IO::Socket::INET;
+    require Mojolicious::Lite;
+    Mojolicious::Lite->import;
+    require Test::Mojo;
+    require Mojo::IOLoop;
+    1;
+  } or plan skip_all => 'Mojolicious and Test::Mojo are required';
+
+  my $probe = IO::Socket::INET->new(
+    LocalAddr => '127.0.0.1',
+    LocalPort => 0,
+    Listen    => 1,
+    Proto     => 'tcp',
+  ) or plan skip_all => 'loopback sockets are unavailable';
+  close $probe;
+}
+
+package LifetimeController;
+use Mojo::Base 'Mojolicious::Controller';
+sub DESTROY { shift->stash->{destroyed} = 1 }
+package main;
+app->controller_class('LifetimeController');
+websocket '/push' => sub {
+  my $c = shift;
+  my $id = Mojo::IOLoop->recurring(0.1 => sub { $c->send('push') });
+  $c->on(finish => sub { Mojo::IOLoop->remove($id) });
+};
+get '/longpoll' => sub {
+  my $c = shift;
+  $c->on(finish => sub { shift->stash->{finished} = 1 });
+  $c->write_chunk('P' => sub {
+    shift->write_chunk('oll!' => sub { shift->write_chunk('') });
+  });
+};
+get '/plugin/upper_case' => {text => 'WELCOME aboard!'};
+get '/plugin/camel_case' => {text => 'Welcome aboard!'};
+get '/staged' => sub {
+  my $c = shift;
+  return $c->render(text => 'Go away!') unless $c->req->headers->header('X-Pass');
+  $c->render(text => 'Welcome aboard!');
+};
+get '/suspended' => sub {
+  my $c = shift;
+  $c->res->headers->header('X-Suspended' => '0');
+  Mojo::IOLoop->next_tick(sub {
+    $c->res->headers->append('X-Suspended' => '1, 1, 2');
+    $c->render(text => '<p>Have fun!</p>');
+  });
+};
+
+my $t = Test::Mojo->new;
+$t->websocket_ok('/push')->message_ok->message_is('push');
+$t->message_ok->message_is('push')->message_ok->message_is('push')->finish_ok;
+$t->get_ok('/plugin/upper_case')->status_is(200)->content_is('WELCOME aboard!');
+$t->get_ok('/plugin/camel_case')->status_is(200)->content_is('Welcome aboard!');
+$t->get_ok('/staged' => {'X-Pass' => 1})->status_is(200)->content_is('Welcome aboard!');
+$t->get_ok('/staged')->status_is(200)->content_is('Go away!');
+$t->get_ok('/suspended')->status_is(200)->content_is('<p>Have fun!</p>');
+my $stash;
+$t->app->plugins->once(before_dispatch => sub { $stash = shift->stash });
+$t->get_ok('/longpoll')->status_is(200)->content_is('Poll!');
+Mojo::IOLoop->one_tick until $stash->{finished};
+is($stash->{finished}, 1, 'long-poll response has finished');
+ok($stash->{destroyed}, 'long-poll controller is destroyed after response finish');
+done_testing;

From 393480dc31c43ab51ff54ec99e4dbaa058c3afcf Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 15 Oct 2026 13:56:23 +0200
Subject: [PATCH 002/317] wip: track IO glob owners and strengthen Catalyst
 reproduction

Track each glob slot owning a RuntimeIO so an assigned lexical glob can
release its Perl referent without recycling a still-installed filehandle.
Extend the Catalyst regression test's local HTTP request shim compatibility
so the test reaches the tempfile lifetime assertions under PerlOnJava.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtime/io/IORuntimeRegistryState.java    |  8 ++++
 .../runtime/runtimetypes/RuntimeGlob.java     | 15 ++++---
 .../runtime/runtimetypes/RuntimeIO.java       | 33 +++++++++++++--
 .../catalyst_request_body_tempfile_lifetime.t | 42 +++++++++++++++++--
 4 files changed, 85 insertions(+), 13 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/io/IORuntimeRegistryState.java b/src/main/java/org/perlonjava/runtime/io/IORuntimeRegistryState.java
index 6dc13f1cb4..af2149e80c 100644
--- a/src/main/java/org/perlonjava/runtime/io/IORuntimeRegistryState.java
+++ b/src/main/java/org/perlonjava/runtime/io/IORuntimeRegistryState.java
@@ -6,6 +6,8 @@
 import java.lang.ref.PhantomReference;
 import java.lang.ref.ReferenceQueue;
 import java.util.Map;
+import java.util.Set;
+import java.util.IdentityHashMap;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentLinkedQueue;
 import java.util.concurrent.atomic.AtomicInteger;
@@ -21,6 +23,9 @@ public final class IORuntimeRegistryState {
     public final ReferenceQueue<RuntimeGlob> globGCQueue = new ReferenceQueue<>();
     public final ConcurrentHashMap<PhantomReference<RuntimeGlob>, RuntimeIO> phantomToIO =
             new ConcurrentHashMap<>();
+    /** Every glob slot that currently keeps an anonymous IO handle alive. */
+    public final Map<RuntimeIO, Set<PhantomReference<RuntimeGlob>>> globOwnersByIO =
+            new IdentityHashMap<>();
     public final AtomicInteger nextFd = new AtomicInteger(3);
     public final ConcurrentHashMap<Integer, IOHandle> fdToHandle = new ConcurrentHashMap<>();
     public final ConcurrentHashMap<Integer, Integer> handleToFd = new ConcurrentHashMap<>();
@@ -34,6 +39,9 @@ public void clear() {
         ioToFileno.clear();
         recycledFds.clear();
         phantomToIO.clear();
+        synchronized (globOwnersByIO) {
+            globOwnersByIO.clear();
+        }
         nextFd.set(3);
         fdToHandle.clear();
         handleToFd.clear();
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGlob.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGlob.java
index 26280eb418..8e5a1b5356 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGlob.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGlob.java
@@ -113,11 +113,6 @@ private static boolean isUnderscoreGlobName(String name) {
     // while ordinary stringification reports the assigned source GV.
     private String stringificationName;
     public RuntimeScalar IO;
-    // Keep an anonymous source glob alive when its IO slot is assigned into a
-    // named glob (for example local *STDIN = $tempfile).  The named glob owns
-    // the IO slot but must also retain the source until the assignment scope
-    // ends, otherwise phantom fd recycling can close the live handle.
-    private RuntimeGlob retainedIoGlob;
     // The IO slot displaced by local *GLOB.  A subsequent selective FORMAT
     // assignment must retain it: `local *FH = *OTHER{FORMAT}` does not replace
     // FH's filehandle.
@@ -1044,8 +1039,16 @@ public RuntimeScalar set(RuntimeGlob value) {
                 oldRuntimeIO = rio;
             }
 
+            RuntimeIO assignedRuntimeIO = value.IO != null
+                    && value.IO.value instanceof RuntimeIO runtimeIO ? runtimeIO : null;
             this.IO = value.IO;
-            this.retainedIoGlob = value;
+            if (assignedRuntimeIO != null) {
+                // The receiving glob becomes another owner of the IO handle.
+                // Track this slot even when value is a detached wrapper around
+                // an anonymous source glob, so that source can run DESTROY
+                // without closing a handle that is still installed here.
+                RuntimeIO.registerGlobForFdRecycling(this, assignedRuntimeIO);
+            }
             // Also update the global IO entry for this glob
             if (this.globName != null) {
                 RuntimeGlob targetIO = GlobalVariable.getGlobalIO(this.globName);
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeIO.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeIO.java
index 5a853045c9..f4f3d9d195 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeIO.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeIO.java
@@ -286,9 +286,19 @@ public static void setSelectedHandleValue(RuntimeScalar value) {
      * @param io   the RuntimeIO whose fd should be freed when the glob is collected
      */
     public static void registerGlobForFdRecycling(RuntimeGlob glob, RuntimeIO io) {
+        if (glob == null || io == null) return;
         IORuntimeRegistryState registry = registry();
-        PhantomReference<RuntimeGlob> phantom = new PhantomReference<>(glob, registry.globGCQueue);
-        registry.phantomToIO.put(phantom, io);
+        synchronized (registry.globOwnersByIO) {
+            Set<PhantomReference<RuntimeGlob>> owners =
+                    registry.globOwnersByIO.computeIfAbsent(io, ignored -> new HashSet<>());
+            for (PhantomReference<RuntimeGlob> owner : owners) {
+                if (owner.get() == glob) return;
+            }
+            PhantomReference<RuntimeGlob> phantom =
+                    new PhantomReference<>(glob, registry.globGCQueue);
+            owners.add(phantom);
+            registry.phantomToIO.put(phantom, io);
+        }
     }
 
     /**
@@ -299,8 +309,23 @@ public static void processAbandonedGlobs() {
         Reference<? extends RuntimeGlob> ref;
         IORuntimeRegistryState registry = registry();
         while ((ref = registry.globGCQueue.poll()) != null) {
-            RuntimeIO io = registry.phantomToIO.remove(ref);
-            if (io != null && !(io.ioHandle instanceof ClosedIOHandle)) {
+            RuntimeIO io = null;
+            boolean closeWhenUnowned = false;
+            synchronized (registry.globOwnersByIO) {
+                io = registry.phantomToIO.remove(ref);
+                if (io != null) {
+                    Set<PhantomReference<RuntimeGlob>> owners =
+                            registry.globOwnersByIO.get(io);
+                    if (owners != null) {
+                        owners.remove(ref);
+                        if (owners.isEmpty()) {
+                            registry.globOwnersByIO.remove(io);
+                            closeWhenUnowned = true;
+                        }
+                    }
+                }
+            }
+            if (closeWhenUnowned && !(io.ioHandle instanceof ClosedIOHandle)) {
                 io.close();
             }
         }
diff --git a/src/test/resources/unit/catalyst_request_body_tempfile_lifetime.t b/src/test/resources/unit/catalyst_request_body_tempfile_lifetime.t
index d3322f6cd4..402513aec9 100644
--- a/src/test/resources/unit/catalyst_request_body_tempfile_lifetime.t
+++ b/src/test/resources/unit/catalyst_request_body_tempfile_lifetime.t
@@ -18,12 +18,12 @@ BEGIN {
 
 package Issue1795OwnershipTest;
 use Catalyst;
+our ($original_body, $original_context, $original_request, $original_temp);
 __PACKAGE__->config(name => 'Issue1795OwnershipTest');
 
 package Issue1795OwnershipTest::Controller::Root;
 use base 'Catalyst::Controller';
 __PACKAGE__->config(namespace => '');
-our ($original_body, $original_context, $original_request, $original_temp);
 
 sub dump_body : Local {
     my ($self, $context) = @_;
@@ -58,7 +58,44 @@ __PACKAGE__->setup;
 package main;
 Catalyst::Test->import('Issue1795OwnershipTest');
 
-my $request = HTTP::Request->new('PUT', 'http://localhost/dump_body');
+# The unit-test HTTP::Request shim only implements the request fields these
+# tests need. Add the small HTTP::Message surface used by Catalyst::Test when
+# that shim is active; installed HTTP::Request distributions already provide
+# these methods.
+{
+    no strict 'refs';
+    no warnings qw(once redefine);
+    *HTTP::Request::method = sub { $_[0]{method} }
+        unless HTTP::Request->can('method');
+    *HTTP::Request::protocol = sub { 'HTTP/1.1' }
+        unless HTTP::Request->can('protocol');
+    *HTTP::Request::content = sub {
+        my ($self, $content) = @_;
+        $self->{content} = $content if @_ > 1;
+        return $self->{content} // '';
+    } unless HTTP::Request->can('content');
+    *HTTP::Request::content_length = sub {
+        $_[0]->header('Content-Length');
+    } unless HTTP::Request->can('content_length');
+    *HTTP::Request::_URI::clone = sub {
+        my %copy = %{$_[0]};
+        return bless \%copy, ref($_[0]);
+    } unless HTTP::Request::_URI->can('clone');
+    *HTTP::Request::_URI::query = sub { $_[0]{query} }
+        unless HTTP::Request::_URI->can('query');
+    *HTTP::Request::_URI::path_query = sub { $_[0]{path} }
+        unless HTTP::Request::_URI->can('path_query');
+    *HTTP::Request::_URI::host_port = sub {
+        $_[0]{host} . ':' . $_[0]{port};
+    } unless HTTP::Request::_URI->can('host_port');
+    *HTTP::Request::_URI::default_port = sub {
+        $_[0]{scheme} eq 'https' ? 443 : 80;
+    } unless HTTP::Request::_URI->can('default_port');
+}
+
+my $request = HTTP::Request->new(
+    'PUT', 'http://localhost/dump_body',
+);
 $request->header('Content-Type' => 'application/octet-stream');
 $request->header('Content-Length' => 9);
 $request->content('foobarbaz');
@@ -79,7 +116,6 @@ my $path = $body->body->filename;
 
 my $next_response = request(HTTP::Request->new('GET', 'http://localhost/index'));
 ok($next_response && $next_response->is_success, 'subsequent request succeeds');
-undef $body;
 ok(!defined($Issue1795OwnershipTest::original_context),
     'completed request context has no remaining strong owner');
 ok(!defined($Issue1795OwnershipTest::original_request),

From 45c4e794057c50755a4fa3ffa74a7a20fbf58c85 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 15 Oct 2026 14:34:09 +0200
Subject: [PATCH 003/317] fix: preserve absent anonymous glob array slots

Make *glob{ARRAY} inspection return undef when an anonymous glob has no
ARRAY slot. This matches Perl and avoids materializing an empty slot during
serialization. Add a system-Perl-validated assertion to the Catalyst tempfile
lifetime reproduction and complete the test HTTP request shim needed to reach
the ownership assertions under PerlOnJava.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtime/runtimetypes/RuntimeGlob.java     | 11 +++++----
 .../catalyst_request_body_tempfile_lifetime.t | 23 +++++++++++++++++++
 2 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGlob.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGlob.java
index 8e5a1b5356..71b3e118f3 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGlob.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGlob.java
@@ -1442,10 +1442,13 @@ public RuntimeScalar getGlobSlot(RuntimeScalar index) {
                 }
                 // For anonymous globs (null globName), use local arraySlot
                 if (this.globName == null) {
-                    if (this.arraySlot == null) {
-                        this.arraySlot = new RuntimeArray();
-                    }
-                    yield this.arraySlot.createReference();
+                    // *glob{ARRAY} inspects an existing slot; it must not
+                    // materialize one as a side effect. Ordinary array
+                    // dereference uses getGlobArray(), which still vivifies
+                    // the anonymous slot when needed.
+                    yield this.arraySlot != null
+                            ? this.arraySlot.createReference()
+                            : new RuntimeScalar();
                 }
                 if (this.slotSnapshot) {
                     yield this.arraySlot != null
diff --git a/src/test/resources/unit/catalyst_request_body_tempfile_lifetime.t b/src/test/resources/unit/catalyst_request_body_tempfile_lifetime.t
index 402513aec9..14f034454c 100644
--- a/src/test/resources/unit/catalyst_request_body_tempfile_lifetime.t
+++ b/src/test/resources/unit/catalyst_request_body_tempfile_lifetime.t
@@ -67,6 +67,9 @@ Catalyst::Test->import('Issue1795OwnershipTest');
     no warnings qw(once redefine);
     *HTTP::Request::method = sub { $_[0]{method} }
         unless HTTP::Request->can('method');
+    *HTTP::Request::headers = sub {
+        bless {request => $_[0]}, 'HTTP::Request::_Headers';
+    } unless HTTP::Request->can('headers');
     *HTTP::Request::protocol = sub { 'HTTP/1.1' }
         unless HTTP::Request->can('protocol');
     *HTTP::Request::content = sub {
@@ -93,6 +96,23 @@ Catalyst::Test->import('Issue1795OwnershipTest');
     } unless HTTP::Request::_URI->can('default_port');
 }
 
+{
+    no strict 'refs';
+    no warnings qw(once redefine);
+    *HTTP::Request::_Headers::header_field_names = sub {
+        my ($self) = @_;
+        return map {
+            my $name = $_;
+            $name =~ s/(^|-)([a-z])/$1 . uc($2)/ge;
+            $name;
+        } keys %{$self->{request}{headers}};
+    } unless HTTP::Request::_Headers->can('header_field_names');
+    *HTTP::Request::_Headers::header = sub {
+        my ($self, @args) = @_;
+        return $self->{request}->header(@args);
+    } unless HTTP::Request::_Headers->can('header');
+}
+
 my $request = HTTP::Request->new(
     'PUT', 'http://localhost/dump_body',
 );
@@ -103,6 +123,9 @@ my $response = request($request);
 ok($response && $response->is_success, 'octet-stream request succeeds');
 unlike($response->content, qr/\*\{'null'\}/,
     'serialized tempfile handle retains its Perl glob name');
+unlike($response->content,
+    qr/^\# \*\{'File::Temp::\$fh'\} = \[\];$/m,
+    'serialization does not invent an ARRAY slot on the lexical tempfile glob');
 
 my $body;
 {

From 62283bcd718d53f30c5f5549e9f538a32095d9d6 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 15 Oct 2026 15:37:46 +0200
Subject: [PATCH 004/317] wip: snapshot object lifetime regression tests

---
 .../catalyst_request_body_tempfile_lifetime.t | 102 +++++++++++++++++-
 1 file changed, 100 insertions(+), 2 deletions(-)

diff --git a/src/test/resources/unit/catalyst_request_body_tempfile_lifetime.t b/src/test/resources/unit/catalyst_request_body_tempfile_lifetime.t
index 14f034454c..9d899fa0d6 100644
--- a/src/test/resources/unit/catalyst_request_body_tempfile_lifetime.t
+++ b/src/test/resources/unit/catalyst_request_body_tempfile_lifetime.t
@@ -18,7 +18,10 @@ BEGIN {
 
 package Issue1795OwnershipTest;
 use Catalyst;
-our ($original_body, $original_context, $original_request, $original_temp);
+our ($original_body, $original_context, $original_request, $original_temp,
+     $tempfile_path, $tempfile_exists_during_request);
+our ($multipart_context, $multipart_request, $multipart_body,
+     $multipart_tempfile_paths, $multipart_tempfiles_exist_during_request);
 __PACKAGE__->config(name => 'Issue1795OwnershipTest');
 
 package Issue1795OwnershipTest::Controller::Root;
@@ -35,8 +38,12 @@ sub dump_body : Local {
     Scalar::Util::weaken($Issue1795OwnershipTest::original_request);
     $Issue1795OwnershipTest::original_body = $request->{_body};
     Scalar::Util::weaken($Issue1795OwnershipTest::original_body);
-    $Issue1795OwnershipTest::original_temp = $request->{_body}->body;
+    my $tempfile = $request->{_body}->body;
+    $Issue1795OwnershipTest::original_temp = $tempfile;
     Scalar::Util::weaken($Issue1795OwnershipTest::original_temp);
+    $Issue1795OwnershipTest::tempfile_path = $tempfile->filename;
+    $Issue1795OwnershipTest::tempfile_exists_during_request =
+        -e $Issue1795OwnershipTest::tempfile_path;
 
     my $dumper = Data::Dumper->new([$request->{_body}]);
     $dumper->Indent(1);
@@ -52,6 +59,42 @@ sub dump_body : Local {
 
 sub index : Local { $_[1]->res->body('ok') }
 
+sub multipart_upload : Local {
+    my ($self, $context) = @_;
+    my $request = $context->request;
+    $request->prepare_body;
+    $request->prepare_body_parameters($context);
+    my @uploads = $request->upload('attachment');
+
+    $Issue1795OwnershipTest::multipart_context = $context;
+    Scalar::Util::weaken($Issue1795OwnershipTest::multipart_context);
+    $Issue1795OwnershipTest::multipart_request = $request;
+    Scalar::Util::weaken($Issue1795OwnershipTest::multipart_request);
+    $Issue1795OwnershipTest::multipart_body = $request->{_body};
+    Scalar::Util::weaken($Issue1795OwnershipTest::multipart_body);
+    $Issue1795OwnershipTest::multipart_tempfile_paths =
+        [map { $_->tempname } @uploads];
+    $Issue1795OwnershipTest::multipart_tempfiles_exist_during_request =
+        [map { -e $_->tempname } @uploads];
+
+    my $body = delete $request->{_body};
+    my $request_context = delete $request->{_context};
+    my $request_env = delete $request->{env};
+    my $dumper = Data::Dumper->new([$request]);
+    $dumper->Indent(1);
+    $dumper->Purity(1);
+    $dumper->Useqq(0);
+    $dumper->Quotekeys(1);
+    $dumper->Terse(1);
+    $dumper->Deepcopy(1);
+    my $serialized = $dumper->Dump;
+    $request->{_context} = $request_context;
+    Scalar::Util::weaken($request->{_context});
+    $request->{_body} = $body;
+    $request->{env} = $request_env;
+    $context->res->body($serialized);
+}
+
 package Issue1795OwnershipTest;
 __PACKAGE__->setup;
 
@@ -121,6 +164,8 @@ $request->header('Content-Length' => 9);
 $request->content('foobarbaz');
 my $response = request($request);
 ok($response && $response->is_success, 'octet-stream request succeeds');
+ok($Issue1795OwnershipTest::tempfile_exists_during_request,
+    'request body tempfile remains available while handling the upload');
 unlike($response->content, qr/\*\{'null'\}/,
     'serialized tempfile handle retains its Perl glob name');
 unlike($response->content,
@@ -136,6 +181,8 @@ die $@ if $@;
 isa_ok($body, 'HTTP::Body::OctetStream');
 isa_ok($body->body, 'File::Temp');
 my $path = $body->body->filename;
+is($path, $Issue1795OwnershipTest::tempfile_path,
+    'serialized body refers to the upload tempfile');
 
 my $next_response = request(HTTP::Request->new('GET', 'http://localhost/index'));
 ok($next_response && $next_response->is_success, 'subsequent request succeeds');
@@ -149,4 +196,55 @@ ok(!defined($Issue1795OwnershipTest::original_temp),
     'completed request tempfile object has no remaining strong owner');
 ok(!-e $path, 'request body tempfile is released with the previous request');
 
+my $boundary = '----perlonjava-upload-boundary';
+my $multipart_content = '';
+for my $index (1 .. 3) {
+    $multipart_content .= join "\r\n",
+        "--$boundary",
+        "Content-Disposition: form-data; name=\"attachment\"; filename=\"note$index.txt\"",
+        'Content-Type: text/plain',
+        '',
+        "upload payload $index",
+        '';
+}
+$multipart_content .= "--$boundary--\r\n";
+my $upload_request = HTTP::Request->new(
+    'POST', 'http://localhost/multipart_upload',
+);
+$upload_request->header(
+    'Content-Type' => "multipart/form-data; boundary=$boundary");
+$upload_request->header('Content-Length' => length($multipart_content));
+$upload_request->content($multipart_content);
+my $multipart_response = request($upload_request);
+ok($multipart_response && $multipart_response->is_success,
+    'multipart upload request succeeds');
+my $decoded_request;
+{
+    no strict 'refs';
+    eval '$decoded_request = ' . $multipart_response->content;
+}
+die $@ if $@;
+isa_ok($decoded_request, 'Catalyst::Request');
+my @decoded_uploads = $decoded_request->upload('attachment');
+is(scalar @decoded_uploads, 3, 'all multipart uploads are present');
+isa_ok($decoded_uploads[0], 'Catalyst::Request::Upload');
+my @multipart_paths = map { $_->tempname } @decoded_uploads;
+is_deeply(\@multipart_paths,
+    $Issue1795OwnershipTest::multipart_tempfile_paths,
+    'serialized uploads retain their tempfile paths');
+ok(!grep { !$_ } @{$Issue1795OwnershipTest::multipart_tempfiles_exist_during_request},
+    'all multipart tempfiles remain available while handling the upload');
+my $after_upload_response = request(
+    HTTP::Request->new('GET', 'http://localhost/index'));
+ok($after_upload_response && $after_upload_response->is_success,
+    'request after multipart upload succeeds');
+ok(!defined($Issue1795OwnershipTest::multipart_context),
+    'completed multipart request context has no remaining strong owner');
+ok(!defined($Issue1795OwnershipTest::multipart_request),
+    'completed multipart Catalyst request has no remaining strong owner');
+ok(!defined($Issue1795OwnershipTest::multipart_body),
+    'completed multipart request body has no remaining strong owner');
+ok(!grep { -e $_ } @multipart_paths,
+    'all multipart upload tempfiles are removed after the request completes');
+
 done_testing;

From c9612f6203c488a59f0883c5068817cef40e2f04 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 15 Oct 2026 15:40:05 +0200
Subject: [PATCH 005/317] test: clarify multipart lifetime assertions

Parenthesize grep expressions so Test::More receives each multipart assertion description.

Generated with Codex (https://openai.com/codex/)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 .../resources/unit/catalyst_request_body_tempfile_lifetime.t  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/test/resources/unit/catalyst_request_body_tempfile_lifetime.t b/src/test/resources/unit/catalyst_request_body_tempfile_lifetime.t
index 9d899fa0d6..6b04cbd656 100644
--- a/src/test/resources/unit/catalyst_request_body_tempfile_lifetime.t
+++ b/src/test/resources/unit/catalyst_request_body_tempfile_lifetime.t
@@ -232,7 +232,7 @@ my @multipart_paths = map { $_->tempname } @decoded_uploads;
 is_deeply(\@multipart_paths,
     $Issue1795OwnershipTest::multipart_tempfile_paths,
     'serialized uploads retain their tempfile paths');
-ok(!grep { !$_ } @{$Issue1795OwnershipTest::multipart_tempfiles_exist_during_request},
+ok(!(grep { !$_ } @{$Issue1795OwnershipTest::multipart_tempfiles_exist_during_request}),
     'all multipart tempfiles remain available while handling the upload');
 my $after_upload_response = request(
     HTTP::Request->new('GET', 'http://localhost/index'));
@@ -244,7 +244,7 @@ ok(!defined($Issue1795OwnershipTest::multipart_request),
     'completed multipart Catalyst request has no remaining strong owner');
 ok(!defined($Issue1795OwnershipTest::multipart_body),
     'completed multipart request body has no remaining strong owner');
-ok(!grep { -e $_ } @multipart_paths,
+ok(!(grep { -e $_ } @multipart_paths),
     'all multipart upload tempfiles are removed after the request completes');
 
 done_testing;

From 56edcdbb0843c8da240e0e6d60859dbaffe6715e Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 15 Oct 2026 19:20:46 +0200
Subject: [PATCH 006/317] wip: snapshot object lifetime regression work

Preserve the current ownership fixes and focused lifetime tests before rebasing.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtime/operators/FileTestOperator.java   | 81 ++++++++++++++++---
 .../perlonjava/runtime/operators/Stat.java    |  4 +-
 .../runtimetypes/LifecycleRuntimeState.java   |  3 +
 .../runtime/runtimetypes/MortalList.java      | 61 +++++++++++++-
 .../runtimetypes/MyVarCleanupStack.java       |  7 ++
 .../runtime/runtimetypes/PerlOwnerSlot.java   |  4 +
 .../runtime/runtimetypes/PerlRuntime.java     | 20 +++++
 .../runtimetypes/ReachabilityWalker.java      | 45 +++++++++++
 .../MortalListDeferredCaptureTest.java        | 18 +++++
 .../PerlOwnerSlotRuntimeRetentionTest.java    | 13 +++
 .../resources/unit/stat_filehandle_lifetime.t | 24 ++++++
 11 files changed, 262 insertions(+), 18 deletions(-)
 create mode 100644 src/test/resources/unit/stat_filehandle_lifetime.t

diff --git a/src/main/java/org/perlonjava/runtime/operators/FileTestOperator.java b/src/main/java/org/perlonjava/runtime/operators/FileTestOperator.java
index 33821e95a2..e8f741b14f 100644
--- a/src/main/java/org/perlonjava/runtime/operators/FileTestOperator.java
+++ b/src/main/java/org/perlonjava/runtime/operators/FileTestOperator.java
@@ -6,6 +6,7 @@
 import org.perlonjava.runtime.runtimetypes.*;
 
 import java.io.IOException;
+import java.lang.ref.WeakReference;
 import java.nio.file.Files;
 import java.nio.file.InvalidPathException;
 import java.nio.file.LinkOption;
@@ -44,16 +45,58 @@
 public class FileTestOperator {
     public static final class State {
         final RuntimeScalar lastFileHandle = new RuntimeScalar();
+        WeakReference<RuntimeBase> lastFileHandleReferent;
+        int lastFileHandleType;
         final RuntimeScalar lastOverloadedFileTestSubject = new RuntimeScalar();
         boolean hasLastOverloadedFileTestSubject;
         String lastFileTestOperator;
         boolean lastStatOk;
         int lastStatErrno;
         final RuntimeScalar lastStatArg = new RuntimeScalar();
+        WeakReference<RuntimeBase> lastStatArgReferent;
+        int lastStatArgType;
+        boolean lastStatArgumentWasHandle;
         boolean lastStatWasLstat;
         BasicFileAttributes lastBasicAttr;
         PosixFileAttributes lastPosixAttr;
         Stat.NativeStatFields lastNativeStatFields;
+
+        void setLastFileHandle(RuntimeScalar arg) {
+            if (isStatHandle(arg)) {
+                lastFileHandle.set(new RuntimeScalar());
+                lastFileHandleType = arg.type;
+                lastFileHandleReferent = weakStatReferent(arg);
+            } else {
+                lastFileHandleReferent = null;
+                lastFileHandle.set(snapshotStatArgument(arg));
+            }
+        }
+
+        RuntimeScalar lastFileHandleValue() {
+            RuntimeBase referent = lastFileHandleReferent == null
+                    ? null : lastFileHandleReferent.get();
+            return referent != null ? statHandleSnapshot(lastFileHandleType, referent)
+                    : lastFileHandle;
+        }
+
+        void setLastStatArgument(RuntimeScalar arg) {
+            lastStatArgumentWasHandle = isStatHandle(arg);
+            if (lastStatArgumentWasHandle) {
+                lastStatArg.set(new RuntimeScalar());
+                lastStatArgType = arg.type;
+                lastStatArgReferent = weakStatReferent(arg);
+            } else {
+                lastStatArgReferent = null;
+                lastStatArg.set(snapshotStatArgument(arg));
+            }
+        }
+
+        RuntimeScalar lastStatArgumentValue() {
+            RuntimeBase referent = lastStatArgReferent == null
+                    ? null : lastStatArgReferent.get();
+            return referent != null ? statHandleSnapshot(lastStatArgType, referent)
+                    : lastStatArg;
+        }
     }
 
     static State state() {
@@ -62,7 +105,7 @@ static State state() {
 
     static void updateLastStat(RuntimeScalar arg, boolean ok, int errno, boolean wasLstat) {
         State state = state();
-        state.lastStatArg.set(snapshotStatArgument(arg));
+        state.setLastStatArgument(arg);
         state.lastStatOk = ok;
         state.lastStatErrno = errno;
         state.lastStatWasLstat = wasLstat;
@@ -79,12 +122,25 @@ static void updateLastStat(RuntimeScalar arg, boolean ok, int errno) {
     }
 
     private static RuntimeScalar snapshotStatArgument(RuntimeScalar arg) {
-        if (arg.type == RuntimeScalarType.GLOB || arg.type == RuntimeScalarType.GLOBREFERENCE) {
-            return arg;
-        }
         return new RuntimeScalar(arg.toString());
     }
 
+    private static WeakReference<RuntimeBase> weakStatReferent(RuntimeScalar arg) {
+        return arg.value instanceof RuntimeBase base ? new WeakReference<>(base) : null;
+    }
+
+    private static RuntimeScalar statHandleSnapshot(int type, RuntimeBase referent) {
+        RuntimeScalar snapshot = new RuntimeScalar();
+        snapshot.type = type;
+        snapshot.value = referent;
+        return snapshot;
+    }
+
+    private static boolean isStatHandle(RuntimeScalar arg) {
+        return arg != null && (arg.type == RuntimeScalarType.GLOB
+                || arg.type == RuntimeScalarType.GLOBREFERENCE);
+    }
+
     private static boolean warningsEnabled() {
         return getGlobalVariable("main::" + Character.toString('W' - 'A' + 1)).getBoolean()
                 || Warnings.warningManager.isWarningEnabled("all");
@@ -180,12 +236,11 @@ private static RuntimeScalar fileTestFromLastStat(String operator) {
         // A fresh -e _ is a stat operation, not merely a query of an earlier
         // lstat buffer.  This matters to a following -l _: Perl reports that
         // the preceding operation was stat rather than lstat.
-        if (operator.equals("-e") && state.lastStatArg.type != RuntimeScalarType.GLOB
-                && state.lastStatArg.type != RuntimeScalarType.GLOBREFERENCE) {
+        if (operator.equals("-e") && !state.lastStatArgumentWasHandle) {
             try {
-                Path path = resolvePath(state.lastStatArg.toString());
+                Path path = resolvePath(state.lastStatArgumentValue().toString());
                 if (path != null) {
-                    statForFileTest(state.lastStatArg, path, false);
+                    statForFileTest(state.lastStatArgumentValue(), path, false);
                 }
             } catch (InvalidPathException ignored) {
                 // Preserve the existing cached failure below.
@@ -198,7 +253,7 @@ private static RuntimeScalar fileTestFromLastStat(String operator) {
 
         // If lastBasicAttr is null (e.g., after testing a JAR path), fall back to re-testing
         if (state.lastBasicAttr == null) {
-            return fileTest(operator, state.lastFileHandle);
+            return fileTest(operator, state.lastFileHandleValue());
         }
 
         return switch (operator) {
@@ -220,7 +275,7 @@ private static RuntimeScalar fileTestFromLastStat(String operator) {
                 // We need to resolve the path from the last stat argument and read file content
                 // without calling fileTest() which would overwrite the stat buffer.
                 try {
-                    String filename = state.lastStatArg.toString();
+                    String filename = state.lastStatArgumentValue().toString();
                     Path path = resolvePath(filename);
                     if (path == null || !Files.exists(path)) {
                         getGlobalVariable("main::!").set(2);
@@ -233,7 +288,7 @@ private static RuntimeScalar fileTestFromLastStat(String operator) {
                     yield scalarUndef;
                 }
             }
-            default -> fileTest(operator, state.lastFileHandle);
+            default -> fileTest(operator, state.lastFileHandleValue());
         };
     }
 
@@ -279,7 +334,7 @@ public static RuntimeScalar fileTest(String operator, RuntimeScalar fileHandle)
         }
         fileHandle = RuntimeScalar.fetchTiedOnce(fileHandle);
         state().lastFileTestOperator = operator;
-        state().lastFileHandle.set(snapshotStatArgument(fileHandle));
+        state().setLastFileHandle(fileHandle);
 
         // File tests participate in Perl's unary operator overloading.  A
         // blessed object may provide a direct (-X method; otherwise the
@@ -306,7 +361,7 @@ public static RuntimeScalar fileTest(String operator, RuntimeScalar fileHandle)
                     // object as its subject.  There is no native stat result
                     // to cache, but the bytecode stack form consumes the
                     // current file-test subject through the same cache slot.
-                    state().lastFileHandle.set(fileHandle);
+                    state().setLastFileHandle(fileHandle);
                     updateLastStat(fileHandle, true, 0);
                     state().lastOverloadedFileTestSubject.set(fileHandle);
                     state().hasLastOverloadedFileTestSubject = true;
diff --git a/src/main/java/org/perlonjava/runtime/operators/Stat.java b/src/main/java/org/perlonjava/runtime/operators/Stat.java
index 89be6c5290..ead7c1ed73 100644
--- a/src/main/java/org/perlonjava/runtime/operators/Stat.java
+++ b/src/main/java/org/perlonjava/runtime/operators/Stat.java
@@ -199,7 +199,7 @@ public static RuntimeBase lstat(RuntimeScalar arg, int ctx) {
 
     public static RuntimeList stat(RuntimeScalar arg) {
         arg = dereferenceAndFetch(arg);
-        state().lastFileHandle.set(arg);
+        state().setLastFileHandle(arg);
         RuntimeList res = new RuntimeList();
 
         if (arg.type == RuntimeScalarType.GLOB || arg.type == RuntimeScalarType.GLOBREFERENCE) {
@@ -353,7 +353,7 @@ public static RuntimeList stat(RuntimeScalar arg) {
 
     public static RuntimeList lstat(RuntimeScalar arg) {
         arg = dereferenceAndFetch(arg);
-        state().lastFileHandle.set(arg);
+        state().setLastFileHandle(arg);
         RuntimeList res = new RuntimeList();
 
         if (arg.type == RuntimeScalarType.GLOB || arg.type == RuntimeScalarType.GLOBREFERENCE) {
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/LifecycleRuntimeState.java b/src/main/java/org/perlonjava/runtime/runtimetypes/LifecycleRuntimeState.java
index fe6324b1d2..25e5de8088 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/LifecycleRuntimeState.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/LifecycleRuntimeState.java
@@ -33,6 +33,8 @@ final class LifecycleRuntimeState {
     final IdentityHashMap<RuntimeScalar, Integer> deferredCapturesSet = new IdentityHashMap<>();
     final Set<RuntimeScalar> deferredScopeExitCaptureCandidates =
             Collections.newSetFromMap(new IdentityHashMap<>());
+    final IdentityHashMap<RuntimeScalar, Set<RuntimeScalar>>
+            deferredScopeExitCaptureCandidatesByLexicalRoot = new IdentityHashMap<>();
     // Strong semantic referents retained by explicit Perl owner slots. Counts
     // are per referent because several independent pad slots can own one base.
     final IdentityHashMap<RuntimeBase, Integer> positiveOwnerReferents = new IdentityHashMap<>();
@@ -143,6 +145,7 @@ void clear() {
         deferredCaptures.clear();
         deferredCapturesSet.clear();
         deferredScopeExitCaptureCandidates.clear();
+        deferredScopeExitCaptureCandidatesByLexicalRoot.clear();
         synchronized (this) {
             positiveOwnerReferents.clear();
         }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 9488f1261e..16bb442828 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -3,6 +3,7 @@
 import java.util.ArrayDeque;
 import java.util.ArrayList;
 import java.util.Collections;
+import java.util.Collection;
 import java.util.IdentityHashMap;
 import java.util.List;
 import java.util.Set;
@@ -113,7 +114,13 @@ public static void setActive(boolean active) {
 
     public static void pushTemporaryRoot(RuntimeBase root) {
         if (root != null) {
-            state().temporaryRoots.push(root);
+            ArrayDeque<RuntimeBase> roots = state().temporaryRoots;
+            if (root instanceof RuntimeList) {
+                for (RuntimeBase existing : roots) {
+                    if (existing == root) return;
+                }
+            }
+            roots.push(root);
         }
     }
 
@@ -355,7 +362,17 @@ private static void processUnreachableScopeExitCaptureCandidates(
                     || (base != null && endReachable.contains(base))
                     || (base != null && cycleProtected.contains(base))
                     || scalarReachable;
-            if (retained) continue;
+            if (retained) {
+                RuntimeScalar lexicalOwner = findLiveLexicalOwner(base, scalar);
+                if (lexicalOwner != null) {
+                    state.deferredScopeExitCaptureCandidatesByLexicalRoot
+                            .computeIfAbsent(lexicalOwner,
+                                    ignored -> Collections.newSetFromMap(new IdentityHashMap<>()))
+                            .add(scalar);
+                    state.deferredScopeExitCaptureCandidates.remove(scalar);
+                }
+                continue;
+            }
 
             scalar.releaseUnreachableSemanticCaptureOwner();
             Integer deferredCount = state.deferredCapturesSet.get(scalar);
@@ -375,6 +392,41 @@ private static void processUnreachableScopeExitCaptureCandidates(
         if (found) flushAboveMark();
     }
 
+    private static RuntimeScalar findLiveLexicalOwner(RuntimeBase base, RuntimeScalar candidate) {
+        if (base == null) return null;
+        for (RuntimeScalar scalar : ScalarRefRegistry.snapshot()) {
+            if (scalar == candidate || scalar.scopeExited || scalar.captureCount > 0
+                    || WeakRefRegistry.isweak(scalar) || isDeferredCapture(scalar)
+                    || !MyVarCleanupStack.isLive(scalar)
+                    || (scalar.type & RuntimeScalarType.REFERENCE_BIT) == 0
+                    || scalar.value != base) continue;
+            return scalar;
+        }
+        for (Object variable : MyVarCleanupStack.snapshotLiveVars()) {
+            if (variable instanceof RuntimeScalar scalar && scalar != candidate
+                    && !scalar.scopeExited && scalar.captureCount == 0
+                    && !WeakRefRegistry.isweak(scalar) && !isDeferredCapture(scalar)
+                    && (scalar.type & RuntimeScalarType.REFERENCE_BIT) != 0
+                    && scalar.value == base) return scalar;
+        }
+        return null;
+    }
+
+    /** Recheck captures that were rooted by a lexical scope that has just exited. */
+    public static void processScopeExitCaptureCandidatesAfterLexicalExit(
+            Collection<RuntimeScalar> exitedLexicals) {
+        if (exitedLexicals == null || exitedLexicals.isEmpty()) return;
+        LifecycleRuntimeState state = state();
+        for (RuntimeScalar lexical : exitedLexicals) {
+            Set<RuntimeScalar> waiting =
+                    state.deferredScopeExitCaptureCandidatesByLexicalRoot.remove(lexical);
+            if (waiting != null) state.deferredScopeExitCaptureCandidates.addAll(waiting);
+        }
+        if (!state.deferredScopeExitCaptureCandidates.isEmpty()) {
+            processUnreachableScopeExitCaptureCandidates(state);
+        }
+    }
+
     static void noteDeferredCaptureMayBeReady() {
         LifecycleRuntimeState state = state();
         if (!state.deferredCaptures.isEmpty()) {
@@ -2018,7 +2070,10 @@ private static void maybeAutoSweepAtStatementBoundary(
             releasedSweepResult =
                     ReachabilityWalker.sweepReleasedWeakReferents(releasedTargets);
         }
-        if (topLevel) {
+        boolean safeImmediateBoundary = state.immediateWeakSweepRequested
+                && RuntimeCode.argsStackDepth() <= 1
+                && state.temporaryRoots.isEmpty();
+        if (topLevel || safeImmediateBoundary) {
             maybeAutoSweep(state, releasedTargets, releasedSweepResult);
             finalizeDeferredCaptureSweepCandidates(state);
         }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStack.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStack.java
index 807c62df40..4213d41ab1 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStack.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStack.java
@@ -181,6 +181,10 @@ public static void unregister(Object var) {
                     base.localBindingExists = false;
                 }
                 noteVarLeftScope(var);
+                if (var instanceof RuntimeScalar scalar) {
+                    MortalList.processScopeExitCaptureCandidatesAfterLexicalExit(
+                            java.util.List.of(scalar));
+                }
                 return;
             }
         }
@@ -307,14 +311,17 @@ static void popMark(int mark, ExecutionRuntimeState executionState) {
     }
 
     private static void popMark(int mark, ArrayList<Object> stack) {
+        ArrayList<RuntimeScalar> exitedLexicals = new ArrayList<>();
         while (stack.size() > mark) {
             Object var = stack.removeLast();
             if (var != null) {
                 decRegisteredCount(var);
                 decLiveCount(var);
                 noteVarLeftScope(var);
+                if (var instanceof RuntimeScalar scalar) exitedLexicals.add(scalar);
             }
         }
+        MortalList.processScopeExitCaptureCandidatesAfterLexicalExit(exitedLexicals);
     }
 
     /**
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
index 5cf83c1ded..bc8977201a 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
@@ -93,6 +93,10 @@ public synchronized RuntimeBase referent() {
         return referent;
     }
 
+    synchronized boolean isRetainedBy(LifecycleRuntimeState state, RuntimeBase target) {
+        return referent == target && ownerRuntimeState == state;
+    }
+
     public synchronized boolean isActive() {
         return referent != null;
     }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlRuntime.java b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlRuntime.java
index 506b7e6636..5f0d608466 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlRuntime.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlRuntime.java
@@ -237,6 +237,26 @@ static java.util.List<RuntimeBase> snapshotOwnerSlotReferents() {
         if (runtime == null) return java.util.List.of();
         LifecycleRuntimeState state = runtime.lifecycleState;
         synchronized (state) {
+            // The count map is an index, while the slot identities attached
+            // to each referent are authoritative. A closure can become
+            // unreachable without its RuntimeCode release hook running; in
+            // that case the stale index entry must not keep a request graph
+            // alive indefinitely.
+            java.util.Iterator<java.util.Map.Entry<RuntimeBase, Integer>> owners =
+                    state.positiveOwnerReferents.entrySet().iterator();
+            while (owners.hasNext()) {
+                java.util.Map.Entry<RuntimeBase, Integer> entry = owners.next();
+                RuntimeBase referent = entry.getKey();
+                int attachedSlots = 0;
+                for (PerlOwnerSlot slot : referent.ownerSlotSnapshot()) {
+                    if (slot.isRetainedBy(state, referent)) attachedSlots++;
+                }
+                if (attachedSlots == 0) {
+                    owners.remove();
+                } else if (attachedSlots != entry.getValue()) {
+                    entry.setValue(attachedSlots);
+                }
+            }
             return java.util.List.copyOf(state.positiveOwnerReferents.keySet());
         }
     }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index c91d359197..5203f48b3b 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -665,6 +665,18 @@ public static java.util.List<String> findPathTo(RuntimeBase target, boolean skip
                 todo.add(rescued);
             }
         }
+        int ownerIdx = 0;
+        for (RuntimeBase ownerReferent : PerlRuntime.snapshotOwnerSlotReferents()) {
+            if (howReached.putIfAbsent(ownerReferent, "<owner-slot#" + (ownerIdx++) + ">") == null) {
+                todo.add(ownerReferent);
+            }
+        }
+        int suspendedIdx = 0;
+        for (RuntimeBase suspended : MortalList.snapshotSuspendedRoots()) {
+            if (howReached.putIfAbsent(suspended, "<suspended#" + (suspendedIdx++) + ">") == null) {
+                todo.add(suspended);
+            }
+        }
         // Phase I: seed from WarningBitsRegistry.callerHintHashStack —
         // %^H snapshots can preserve scalars from earlier scopes and are
         // NOT accounted for by Perl-level walker roots.
@@ -672,6 +684,21 @@ public static java.util.List<String> findPathTo(RuntimeBase target, boolean skip
         for (RuntimeScalar sc : org.perlonjava.runtime.WarningBitsRegistry.snapshotHintHashStackScalars()) {
             seedPath(sc, "<hint-hash#" + (hhIdx++) + ">", howReached, todo);
         }
+        int activeCodeIdx = 0;
+        for (RuntimeCode active : PerlRuntime.current().executionState().activeCodeStack) {
+            String label = "<active-code#" + (activeCodeIdx++) + ">";
+            if (howReached.putIfAbsent(active, label) == null) todo.add(active);
+        }
+        int activeArgsIdx = 0;
+        for (java.util.List<RuntimeScalar> args : RuntimeCode.snapshotPristineArgsStack()) {
+            int argIdx = 0;
+            for (RuntimeScalar arg : args) {
+                if (arg == null || WeakRefRegistry.isweak(arg)) continue;
+                seedPath(arg, "<active-args#" + activeArgsIdx + ">[" + argIdx++ + "]",
+                        howReached, todo);
+            }
+            activeArgsIdx++;
+        }
         // Phase B1: seed from ScalarRefRegistry (same as walk()) so the
         // trace matches what sweepWeakRefs sees.
         // Phase I: force GC before snapshotting so stale
@@ -753,6 +780,18 @@ public static java.util.List<String> findPathTo(RuntimeBase target, boolean skip
                     String path = curPath + "<state " + state.getKey() + ">";
                     if (howReached.putIfAbsent(state.getValue(), path) == null) todo.add(state.getValue());
                 }
+                if (code.closedOverVariables != null) {
+                    int i = 0;
+                    for (RuntimeBase captured : code.closedOverVariables.values()) {
+                        String path = curPath + "<closed-over#" + (i++) + ">";
+                        if (captured instanceof RuntimeScalar scalar) {
+                            visitScalarPath(scalar, path, howReached, todo);
+                        } else if (captured != null
+                                && howReached.putIfAbsent(captured, path) == null) {
+                            todo.add(captured);
+                        }
+                    }
+                }
                 // Phase I: mirror the main walker — follow closure captures
                 // so findPathTo traces through the same graph as sweepWeakRefs.
                 if (code.capturedScalars != null) {
@@ -776,6 +815,12 @@ public static java.util.List<String> findPathTo(RuntimeBase target, boolean skip
                 visitReflectiveCodeScalars(code, cap ->
                         visitScalarPath(cap, curPath + "<closure " + name + "::" + sub
                                 + " field-cap#" + (reflectiveIdx[0]++) + ">", howReached, todo));
+                final int[] reflectiveBaseIdx = {0};
+                visitReflectiveCodeBases(code, captured -> {
+                    String path = curPath + "<closure " + name + "::" + sub
+                            + " field-base#" + (reflectiveBaseIdx[0]++) + ">";
+                    if (howReached.putIfAbsent(captured, path) == null) todo.add(captured);
+                });
             }
         }
         return null;
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListDeferredCaptureTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListDeferredCaptureTest.java
index 1302aa1b08..79a78a4e73 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListDeferredCaptureTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListDeferredCaptureTest.java
@@ -4,10 +4,28 @@
 import org.junit.jupiter.api.Test;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 @Tag("unit")
 class MortalListDeferredCaptureTest {
+    @Test
+    void forwardedRuntimeListUsesOneTemporaryRootUntilItsSingleRelease() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeList result = new RuntimeList();
+
+            MortalList.pushTemporaryRoot(result);
+            MortalList.pushTemporaryRoot(result);
+            assertEquals(1, MortalList.snapshotTemporaryRoots().size(),
+                    "forwarding the same result must not duplicate its temporary root");
+
+            MortalList.popTemporaryRoot(result);
+            assertFalse(MortalList.hasTemporaryRoots(),
+                    "one release clears the single forwarded result root");
+        }
+    }
+
     @Test
     void unreachableHttpBodyCaptureReleasesAtItsScopeBoundaryWithoutWeakRefs() {
         PerlRuntime runtime = new PerlRuntime();
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotRuntimeRetentionTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotRuntimeRetentionTest.java
index 6b630c75fd..3798d67a0d 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotRuntimeRetentionTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotRuntimeRetentionTest.java
@@ -9,6 +9,19 @@
 
 @Tag("unit")
 class PerlOwnerSlotRuntimeRetentionTest {
+    @Test
+    void ownerRootSnapshotDropsReferentsWithoutAnAttachedOwnerSlot() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeHash referent = new RuntimeHash();
+            runtime.retainOwnerSlotReferent(referent);
+
+            assertEquals(1, runtime.positiveOwnerSlotReferentCount(referent));
+            assertTrue(PerlRuntime.snapshotOwnerSlotReferents().isEmpty());
+            assertEquals(0, runtime.positiveOwnerSlotReferentCount(referent));
+        }
+    }
+
     @Test
     void positiveOwnerSlotsRetainReferentsWithinTheirPerlRuntime() {
         PerlRuntime runtime = new PerlRuntime();
diff --git a/src/test/resources/unit/stat_filehandle_lifetime.t b/src/test/resources/unit/stat_filehandle_lifetime.t
new file mode 100644
index 0000000000..ee058e5fc7
--- /dev/null
+++ b/src/test/resources/unit/stat_filehandle_lifetime.t
@@ -0,0 +1,24 @@
+use strict;
+use warnings;
+use Test::More;
+use Scalar::Util qw(weaken);
+
+BEGIN {
+    eval { require File::Temp; 1 }
+        or plan skip_all => 'File::Temp is not installed';
+}
+
+my $tempfile = File::Temp->new();
+my $path = $tempfile->filename;
+my $weak_tempfile = $tempfile;
+weaken($weak_tempfile);
+
+my @stat = stat($tempfile);
+ok(@stat, 'stat succeeds on the open tempfile');
+ok(defined($weak_tempfile), 'the lexical tempfile remains alive while owned');
+
+undef $tempfile;
+ok(!defined($weak_tempfile), 'stat cache does not retain the tempfile object');
+ok(!-e $path, 'the tempfile is unlinked when its last Perl owner is released');
+
+done_testing;

From d217e4c6dfa5c0c2bd5ecf9be87364ad89666a63 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 15 Oct 2026 21:02:34 +0200
Subject: [PATCH 007/317] fix: complete scalar root walks for lifecycle cleanup

Use an unbounded scalar-root walk when releasing scope-exited capture owners,
including transient execution roots and persistent code state. Keep ordinary
cached snapshots bounded and conservative. Add coverage for large graphs and
persistent state roots, and remove the abandoned deferred-candidate experiment.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 docs/about/changelog.md                       |  1 +
 .../runtimetypes/LifecycleRuntimeState.java   |  3 -
 .../runtime/runtimetypes/MortalList.java      | 53 +----------
 .../runtimetypes/MyVarCleanupStack.java       |  7 --
 .../runtime/runtimetypes/PerlOwnerSlot.java   |  4 -
 .../runtime/runtimetypes/PerlRuntime.java     | 20 ----
 .../runtimetypes/ReachabilityWalker.java      | 95 ++++++++++++++++---
 .../PerlOwnerSlotRuntimeRetentionTest.java    | 13 ---
 .../ReachabilitySnapshotCompletenessTest.java |  6 ++
 .../ScalarSnapshotCodeStateRootTest.java      | 40 ++++++++
 10 files changed, 130 insertions(+), 112 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/ScalarSnapshotCodeStateRootTest.java

diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index 4ce344540a..f282f74428 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -42,6 +42,7 @@ priorities and future plans.
 - Preserve inherited method dispatch in child threads.
 - Prefer exact root-module package declarations over earlier helper packages, and warn for undefined hash keys used by `exists` and `delete` (#1820, #1645).
 - Add a reproducible, warmup-aware Perl versus PerlOnJava performance runner (#1196).
+- Release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
 - Cover FormState session restoration across requests and HTTP response conversion from callback and streaming PSGI responses; refresh HTTP::Message and LWP compatibility status (#1650, #1651, #1652).
 - Preserve the awaited Future value when its source scalar or aggregate slot changes during suspension, covering PAGI::Server request-body receives (#1818).
 - Preserve escaped byte strings in interpreter closures and `bytes::substr`, honor requested CRLF output in `MIME::QuotedPrint`, and cover URI Basic Auth byte-string userinfo (#1275, #1313, #1341).
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/LifecycleRuntimeState.java b/src/main/java/org/perlonjava/runtime/runtimetypes/LifecycleRuntimeState.java
index 25e5de8088..fe6324b1d2 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/LifecycleRuntimeState.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/LifecycleRuntimeState.java
@@ -33,8 +33,6 @@ final class LifecycleRuntimeState {
     final IdentityHashMap<RuntimeScalar, Integer> deferredCapturesSet = new IdentityHashMap<>();
     final Set<RuntimeScalar> deferredScopeExitCaptureCandidates =
             Collections.newSetFromMap(new IdentityHashMap<>());
-    final IdentityHashMap<RuntimeScalar, Set<RuntimeScalar>>
-            deferredScopeExitCaptureCandidatesByLexicalRoot = new IdentityHashMap<>();
     // Strong semantic referents retained by explicit Perl owner slots. Counts
     // are per referent because several independent pad slots can own one base.
     final IdentityHashMap<RuntimeBase, Integer> positiveOwnerReferents = new IdentityHashMap<>();
@@ -145,7 +143,6 @@ void clear() {
         deferredCaptures.clear();
         deferredCapturesSet.clear();
         deferredScopeExitCaptureCandidates.clear();
-        deferredScopeExitCaptureCandidatesByLexicalRoot.clear();
         synchronized (this) {
             positiveOwnerReferents.clear();
         }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 16bb442828..a0602facda 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -3,7 +3,6 @@
 import java.util.ArrayDeque;
 import java.util.ArrayList;
 import java.util.Collections;
-import java.util.Collection;
 import java.util.IdentityHashMap;
 import java.util.List;
 import java.util.Set;
@@ -362,17 +361,7 @@ private static void processUnreachableScopeExitCaptureCandidates(
                     || (base != null && endReachable.contains(base))
                     || (base != null && cycleProtected.contains(base))
                     || scalarReachable;
-            if (retained) {
-                RuntimeScalar lexicalOwner = findLiveLexicalOwner(base, scalar);
-                if (lexicalOwner != null) {
-                    state.deferredScopeExitCaptureCandidatesByLexicalRoot
-                            .computeIfAbsent(lexicalOwner,
-                                    ignored -> Collections.newSetFromMap(new IdentityHashMap<>()))
-                            .add(scalar);
-                    state.deferredScopeExitCaptureCandidates.remove(scalar);
-                }
-                continue;
-            }
+            if (retained) continue;
 
             scalar.releaseUnreachableSemanticCaptureOwner();
             Integer deferredCount = state.deferredCapturesSet.get(scalar);
@@ -392,41 +381,6 @@ private static void processUnreachableScopeExitCaptureCandidates(
         if (found) flushAboveMark();
     }
 
-    private static RuntimeScalar findLiveLexicalOwner(RuntimeBase base, RuntimeScalar candidate) {
-        if (base == null) return null;
-        for (RuntimeScalar scalar : ScalarRefRegistry.snapshot()) {
-            if (scalar == candidate || scalar.scopeExited || scalar.captureCount > 0
-                    || WeakRefRegistry.isweak(scalar) || isDeferredCapture(scalar)
-                    || !MyVarCleanupStack.isLive(scalar)
-                    || (scalar.type & RuntimeScalarType.REFERENCE_BIT) == 0
-                    || scalar.value != base) continue;
-            return scalar;
-        }
-        for (Object variable : MyVarCleanupStack.snapshotLiveVars()) {
-            if (variable instanceof RuntimeScalar scalar && scalar != candidate
-                    && !scalar.scopeExited && scalar.captureCount == 0
-                    && !WeakRefRegistry.isweak(scalar) && !isDeferredCapture(scalar)
-                    && (scalar.type & RuntimeScalarType.REFERENCE_BIT) != 0
-                    && scalar.value == base) return scalar;
-        }
-        return null;
-    }
-
-    /** Recheck captures that were rooted by a lexical scope that has just exited. */
-    public static void processScopeExitCaptureCandidatesAfterLexicalExit(
-            Collection<RuntimeScalar> exitedLexicals) {
-        if (exitedLexicals == null || exitedLexicals.isEmpty()) return;
-        LifecycleRuntimeState state = state();
-        for (RuntimeScalar lexical : exitedLexicals) {
-            Set<RuntimeScalar> waiting =
-                    state.deferredScopeExitCaptureCandidatesByLexicalRoot.remove(lexical);
-            if (waiting != null) state.deferredScopeExitCaptureCandidates.addAll(waiting);
-        }
-        if (!state.deferredScopeExitCaptureCandidates.isEmpty()) {
-            processUnreachableScopeExitCaptureCandidates(state);
-        }
-    }
-
     static void noteDeferredCaptureMayBeReady() {
         LifecycleRuntimeState state = state();
         if (!state.deferredCaptures.isEmpty()) {
@@ -2070,10 +2024,7 @@ private static void maybeAutoSweepAtStatementBoundary(
             releasedSweepResult =
                     ReachabilityWalker.sweepReleasedWeakReferents(releasedTargets);
         }
-        boolean safeImmediateBoundary = state.immediateWeakSweepRequested
-                && RuntimeCode.argsStackDepth() <= 1
-                && state.temporaryRoots.isEmpty();
-        if (topLevel || safeImmediateBoundary) {
+        if (topLevel) {
             maybeAutoSweep(state, releasedTargets, releasedSweepResult);
             finalizeDeferredCaptureSweepCandidates(state);
         }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStack.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStack.java
index 4213d41ab1..807c62df40 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStack.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStack.java
@@ -181,10 +181,6 @@ public static void unregister(Object var) {
                     base.localBindingExists = false;
                 }
                 noteVarLeftScope(var);
-                if (var instanceof RuntimeScalar scalar) {
-                    MortalList.processScopeExitCaptureCandidatesAfterLexicalExit(
-                            java.util.List.of(scalar));
-                }
                 return;
             }
         }
@@ -311,17 +307,14 @@ static void popMark(int mark, ExecutionRuntimeState executionState) {
     }
 
     private static void popMark(int mark, ArrayList<Object> stack) {
-        ArrayList<RuntimeScalar> exitedLexicals = new ArrayList<>();
         while (stack.size() > mark) {
             Object var = stack.removeLast();
             if (var != null) {
                 decRegisteredCount(var);
                 decLiveCount(var);
                 noteVarLeftScope(var);
-                if (var instanceof RuntimeScalar scalar) exitedLexicals.add(scalar);
             }
         }
-        MortalList.processScopeExitCaptureCandidatesAfterLexicalExit(exitedLexicals);
     }
 
     /**
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
index bc8977201a..5cf83c1ded 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
@@ -93,10 +93,6 @@ public synchronized RuntimeBase referent() {
         return referent;
     }
 
-    synchronized boolean isRetainedBy(LifecycleRuntimeState state, RuntimeBase target) {
-        return referent == target && ownerRuntimeState == state;
-    }
-
     public synchronized boolean isActive() {
         return referent != null;
     }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlRuntime.java b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlRuntime.java
index 5f0d608466..506b7e6636 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlRuntime.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlRuntime.java
@@ -237,26 +237,6 @@ static java.util.List<RuntimeBase> snapshotOwnerSlotReferents() {
         if (runtime == null) return java.util.List.of();
         LifecycleRuntimeState state = runtime.lifecycleState;
         synchronized (state) {
-            // The count map is an index, while the slot identities attached
-            // to each referent are authoritative. A closure can become
-            // unreachable without its RuntimeCode release hook running; in
-            // that case the stale index entry must not keep a request graph
-            // alive indefinitely.
-            java.util.Iterator<java.util.Map.Entry<RuntimeBase, Integer>> owners =
-                    state.positiveOwnerReferents.entrySet().iterator();
-            while (owners.hasNext()) {
-                java.util.Map.Entry<RuntimeBase, Integer> entry = owners.next();
-                RuntimeBase referent = entry.getKey();
-                int attachedSlots = 0;
-                for (PerlOwnerSlot slot : referent.ownerSlotSnapshot()) {
-                    if (slot.isRetainedBy(state, referent)) attachedSlots++;
-                }
-                if (attachedSlots == 0) {
-                    owners.remove();
-                } else if (attachedSlots != entry.getValue()) {
-                    entry.setValue(attachedSlots);
-                }
-            }
             return java.util.List.copyOf(state.positiveOwnerReferents.keySet());
         }
     }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 5203f48b3b..06d13a5b5a 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -659,24 +659,16 @@ public static java.util.List<String> findPathTo(RuntimeBase target, boolean skip
         for (Map.Entry<String, RuntimeScalar> e : GlobalVariable.globalCodeRefs.entrySet()) {
             seedPath(e.getValue(), "&" + e.getKey(), howReached, todo);
         }
+        int codeEdgeIdx = 0;
+        for (RuntimeScalar codeRef : GlobalVariable.globalCodeRefEdgeRootsView()) {
+            seedPath(codeRef, "<global-code-edge#" + (codeEdgeIdx++) + ">", howReached, todo);
+        }
         int rescuedIdx = 0;
         for (RuntimeBase rescued : DestroyDispatch.snapshotRescuedForWalk()) {
             if (howReached.putIfAbsent(rescued, "<rescued#" + (rescuedIdx++) + ">") == null) {
                 todo.add(rescued);
             }
         }
-        int ownerIdx = 0;
-        for (RuntimeBase ownerReferent : PerlRuntime.snapshotOwnerSlotReferents()) {
-            if (howReached.putIfAbsent(ownerReferent, "<owner-slot#" + (ownerIdx++) + ">") == null) {
-                todo.add(ownerReferent);
-            }
-        }
-        int suspendedIdx = 0;
-        for (RuntimeBase suspended : MortalList.snapshotSuspendedRoots()) {
-            if (howReached.putIfAbsent(suspended, "<suspended#" + (suspendedIdx++) + ">") == null) {
-                todo.add(suspended);
-            }
-        }
         // Phase I: seed from WarningBitsRegistry.callerHintHashStack —
         // %^H snapshots can preserve scalars from earlier scopes and are
         // NOT accounted for by Perl-level walker roots.
@@ -748,6 +740,23 @@ public static java.util.List<String> findPathTo(RuntimeBase target, boolean skip
                     todo.add(tempRoot);
                 }
             }
+            int ownerIdx = 0;
+            for (RuntimeBase ownerReferent : PerlRuntime.snapshotOwnerSlotReferents()) {
+                String ownerClass = ownerReferent.blessId == 0
+                        ? ownerReferent.getClass().getSimpleName()
+                        : NameNormalizer.getBlessStr(ownerReferent.blessId);
+                String ownerLabel = "<owner-slot#" + (ownerIdx++) + ":" + ownerClass
+                        + "@" + System.identityHashCode(ownerReferent) + ">";
+                if (howReached.putIfAbsent(ownerReferent, ownerLabel) == null) {
+                    todo.add(ownerReferent);
+                }
+            }
+            int suspendedIdx = 0;
+            for (RuntimeBase suspended : MortalList.snapshotSuspendedRoots()) {
+                if (howReached.putIfAbsent(suspended, "<suspended#" + (suspendedIdx++) + ">") == null) {
+                    todo.add(suspended);
+                }
+            }
         }
         while (!todo.isEmpty()) {
             RuntimeBase cur = todo.removeFirst();
@@ -766,6 +775,8 @@ public static java.util.List<String> findPathTo(RuntimeBase target, boolean skip
                 for (RuntimeScalar v : a.elements) {
                     visitScalarPath(v, curPath + "[" + (idx++) + "]", howReached, todo);
                 }
+            } else if (cur instanceof RuntimeScalar scalar) {
+                visitScalarPath(scalar, curPath, howReached, todo);
             } else if (cur instanceof RuntimeCode code) {
                 int stateIdx = 0;
                 for (Map.Entry<String, RuntimeScalar> state : code.stateVariable.entrySet()) {
@@ -831,6 +842,7 @@ private static void seedPath(RuntimeScalar s, String label,
                                   java.util.ArrayDeque<RuntimeBase> todo) {
         if (s == null) return;
         if (WeakRefRegistry.isweak(s)) return;
+        if (howReached.putIfAbsent(s, label) == null) todo.add(s);
         if ((s.type & RuntimeScalarType.REFERENCE_BIT) != 0
                 && s.value instanceof RuntimeBase b) {
             if (howReached.putIfAbsent(b, label) == null) todo.add(b);
@@ -842,6 +854,7 @@ private static void visitScalarPath(RuntimeScalar s, String path,
                                          java.util.ArrayDeque<RuntimeBase> todo) {
         if (s == null) return;
         if (WeakRefRegistry.isweak(s)) return;
+        if (howReached.putIfAbsent(s, path) == null) todo.add(s);
         if ((s.type & RuntimeScalarType.REFERENCE_BIT) != 0
                 && s.value instanceof RuntimeBase b) {
             if (howReached.putIfAbsent(b, path) == null) todo.add(b);
@@ -1710,6 +1723,19 @@ boolean complete() {
     }
 
     static ScalarRootReachabilitySnapshot scalarReachabilitySnapshot() {
+        return scalarReachabilitySnapshot(MAX_ROOT_SNAPSHOT_VISITS, false);
+    }
+
+    /**
+     * Complete root walk for closure-owner release. A capped snapshot cannot
+     * distinguish a real owner from a capture cycle beyond its visit limit.
+     */
+    static ScalarRootReachabilitySnapshot completeScalarReachabilitySnapshot() {
+        return scalarReachabilitySnapshot(Integer.MAX_VALUE, true);
+    }
+
+    private static ScalarRootReachabilitySnapshot scalarReachabilitySnapshot(
+            int maxVisits, boolean includeTransientRoots) {
         ReachabilityQueryStats stats = MortalList.activeReachabilityQueryStats();
         if (stats != null) {
             stats.snapshotsBuilt++;
@@ -1723,6 +1749,30 @@ static ScalarRootReachabilitySnapshot scalarReachabilitySnapshot() {
         for (RuntimeScalar scalar : GlobalVariable.globalCodeRefValuesView()) {
             addScalarReachabilityRoot(scalar, seen, reachableScalars, todo, stats);
         }
+        for (RuntimeScalar scalar : GlobalVariable.globalCodeRefEdgeRootsView()) {
+            addScalarReachabilityRoot(scalar, seen, reachableScalars, todo, stats);
+        }
+        if (includeTransientRoots) {
+            for (RuntimeCode active : PerlRuntime.current().executionState().activeCodeStack) {
+                addScalarReachabilityRoot(active, seen, reachableScalars, todo, stats);
+            }
+            for (java.util.List<RuntimeScalar> args : RuntimeCode.snapshotPristineArgsStack()) {
+                for (RuntimeScalar arg : args) {
+                    if (arg != null && !WeakRefRegistry.isweak(arg)) {
+                        addScalarReachabilityRoot(arg, seen, reachableScalars, todo, stats);
+                    }
+                }
+            }
+            for (RuntimeArray args : RuntimeCode.snapshotArgsStack()) {
+                addScalarReachabilityRoot(args, seen, reachableScalars, todo, stats);
+            }
+            for (RuntimeBase suspended : MortalList.snapshotSuspendedRoots()) {
+                addScalarReachabilityRoot(suspended, seen, reachableScalars, todo, stats);
+            }
+            for (RuntimeBase temporary : MortalList.snapshotTemporaryRoots()) {
+                addScalarReachabilityRoot(temporary, seen, reachableScalars, todo, stats);
+            }
+        }
         for (RuntimeScalar scalar : GlobalVariable.globalVariableValuesView()) {
             addScalarReachabilityRoot(scalar, seen, reachableScalars, todo, stats);
         }
@@ -1739,7 +1789,6 @@ static ScalarRootReachabilitySnapshot scalarReachabilitySnapshot() {
             }
         }
 
-        final int maxVisits = MAX_ROOT_SNAPSHOT_VISITS;
         int visits = 0;
         while (!todo.isEmpty() && visits < maxVisits) {
             RuntimeBase current = todo.removeFirst();
@@ -1773,6 +1822,24 @@ static ScalarRootReachabilitySnapshot scalarReachabilitySnapshot() {
                     if (seen.add(base)) todo.addLast(base);
                 }
             } else if (current instanceof RuntimeCode code) {
+                if (code.padConstants != null) {
+                    for (RuntimeBase constant : code.padConstants) {
+                        addScalarReachabilityEdge(constant, seen,
+                                reachableScalars, todo, stats, true, false);
+                    }
+                }
+                for (RuntimeScalar state : code.stateVariable.values()) {
+                    addScalarReachabilityEdge(state, seen,
+                            reachableScalars, todo, stats, true, false);
+                }
+                for (RuntimeArray state : code.stateArray.values()) {
+                    addScalarReachabilityEdge(state, seen,
+                            reachableScalars, todo, stats, true, false);
+                }
+                for (RuntimeHash state : code.stateHash.values()) {
+                    addScalarReachabilityEdge(state, seen,
+                            reachableScalars, todo, stats, true, false);
+                }
                 if (code.closedOverVariables != null) {
                     for (RuntimeBase captured : code.closedOverVariables.values()) {
                         if (stats != null) stats.edgesInspected++;
@@ -3151,7 +3218,7 @@ static void releaseUnreachableScopeExitedCaptureOwners(
                 }
                 if (retainedByEnd == null) retainedByEnd = walkEndBlockRoots();
                 if (retainedByEnd.contains(padCell) || retainedByEnd.contains(referent)) continue;
-                if (scalarRoots == null) scalarRoots = scalarReachabilitySnapshot();
+                if (scalarRoots == null) scalarRoots = completeScalarReachabilitySnapshot();
                 if (scalarRoots.isReachable(padCell)) continue;
                 if (WALKER_TRACE_CLASS != null && !WALKER_TRACE_CLASS.isEmpty()) {
                     String className = NameNormalizer.getBlessStr(referent.blessId);
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotRuntimeRetentionTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotRuntimeRetentionTest.java
index 3798d67a0d..6b630c75fd 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotRuntimeRetentionTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotRuntimeRetentionTest.java
@@ -9,19 +9,6 @@
 
 @Tag("unit")
 class PerlOwnerSlotRuntimeRetentionTest {
-    @Test
-    void ownerRootSnapshotDropsReferentsWithoutAnAttachedOwnerSlot() {
-        PerlRuntime runtime = new PerlRuntime();
-        try (PerlRuntime.Binding ignored = runtime.bind()) {
-            RuntimeHash referent = new RuntimeHash();
-            runtime.retainOwnerSlotReferent(referent);
-
-            assertEquals(1, runtime.positiveOwnerSlotReferentCount(referent));
-            assertTrue(PerlRuntime.snapshotOwnerSlotReferents().isEmpty());
-            assertEquals(0, runtime.positiveOwnerSlotReferentCount(referent));
-        }
-    }
-
     @Test
     void positiveOwnerSlotsRetainReferentsWithinTheirPerlRuntime() {
         PerlRuntime runtime = new PerlRuntime();
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilitySnapshotCompletenessTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilitySnapshotCompletenessTest.java
index 5319ea6459..d116b8a495 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilitySnapshotCompletenessTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilitySnapshotCompletenessTest.java
@@ -52,6 +52,12 @@ void cappedRootSnapshotsCannotProveAnUnseenTargetUnreachable() throws Exception
                         "an incomplete lexical snapshot cannot prove a miss");
                 assertTrue(scalars.isReachable(chain.tailOwner()),
                         "an incomplete scalar snapshot cannot prove an owner miss");
+                ReachabilityWalker.ScalarRootReachabilitySnapshot completeScalars =
+                        ReachabilityWalker.completeScalarReachabilitySnapshot();
+                assertTrue(completeScalars.complete(),
+                        "capture cleanup can request a complete scalar-root walk");
+                assertTrue(completeScalars.isReachable(chain.tailOwner()),
+                        "the complete capture cleanup walk reaches a lexical beyond the bounded prefix");
                 state.scalarRootSnapshot = scalars;
                 state.reachabilityDrainDepth++;
                 try {
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/ScalarSnapshotCodeStateRootTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/ScalarSnapshotCodeStateRootTest.java
new file mode 100644
index 0000000000..f3057ea7f2
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/ScalarSnapshotCodeStateRootTest.java
@@ -0,0 +1,40 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import java.util.List;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("unit")
+class ScalarSnapshotCodeStateRootTest {
+    @Test
+    void completeScalarSnapshotFollowsPersistentCodeState() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeScalar persistentState = new RuntimeScalar("state");
+            RuntimeScalar stateSlot = new RuntimeScalar();
+            stateSlot.type = RuntimeScalarType.REFERENCE;
+            stateSlot.value = persistentState;
+
+            RuntimeCode code = new RuntimeCode(null, List.of());
+            code.stateVariable.put("persistent", stateSlot);
+            String globalName = "ScalarSnapshotCodeStateRootTest::state_holder";
+            GlobalVariable.globalCodeRefs.put(globalName, new RuntimeScalar(code));
+            try {
+                ReachabilityWalker.ScalarRootReachabilitySnapshot snapshot =
+                        ReachabilityWalker.completeScalarReachabilitySnapshot();
+
+                assertTrue(snapshot.complete(), "the cleanup snapshot is complete");
+                assertTrue(snapshot.isReachable(stateSlot),
+                        "a globally installed sub keeps its persistent state slot live");
+                assertTrue(snapshot.isReachable(persistentState),
+                        "persistent state values remain roots while their sub is installed");
+            } finally {
+                GlobalVariable.globalCodeRefs.remove(globalName);
+                MortalList.invalidateAllRootSnapshots();
+            }
+        }
+    }
+}

From a82afceab9aaba57568586b8dd94b327b44eeaeb Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 15 Oct 2026 21:23:19 +0200
Subject: [PATCH 008/317] docs: record current HTML-Tree ownership evidence

Record that the full HTML-Tree 5.07 distribution now passes on the current
candidate, including refloop.t, while keeping Phase 2 open until scalar and
aggregate owners migrate away from cleanup reachability fallbacks.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 6759cfe64f..546ae85a32 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -54,8 +54,11 @@ destruction while a legacy owner still exists.
 
 This finding rules out treating a scalar-only migration as a fix for #1618.
 The reduced reproducer crosses closure pads and aggregate slots, so Phase 2
-must cover those boundaries before HTML::Tree can pass. `undef $sub` is a
-scalar slot overwrite, not the separate `undef &sub` CV-body operation.
+must cover those boundaries in the ownership model. The current branch now
+passes HTML::Tree's integration tests with the existing selective-count and
+reachability machinery; that result is useful compatibility evidence, but it
+does not prove the planned owner-slot migration. `undef $sub` is a scalar slot
+overwrite, not the separate `undef &sub` CV-body operation.
 
 The first verified fix is at the reachability boundary. The interpreter's
 `capturedVars` array is execution metadata and can still contain a pad after
@@ -299,8 +302,9 @@ and first path establish implementation cost.
 ### Next steps
 
 1. Extend the ownership path through scalar proxies and ordinary array/hash
-   slots in Phase 2, then resolve the HTML::Tree teardown failures and verify
-   unchanged `t/refloop.t`.
+   slots in Phase 2. Keep the newly passing HTML::Tree suite as an integration
+   guard, then verify its exact refcount/destruction assertions are supported by
+   explicit owner slots rather than cleanup reachability fallbacks.
 2. Resolve the strict target failures in the fresh-home CPAN release
    acceptance, then rerun that gate on the final candidate. The current run
    distinguishes prerequisite/setup timeouts and missing dependencies from
@@ -339,10 +343,14 @@ and first path establish implementation cost.
   `cpan/Scalar-List-Utils/lib` added to `@INC`; the checkout remains untouched.
   The prior Perl 5.44.0 build remains the oracle for historical HTML-Tree
   integration results.
-- The focused `new_from_lol` regression now passes, but HTML-Tree 5.07's
-  content and incremental parser cases still retain two and three elements at
-  the immediate release assertion on both PerlOnJava backends; Perl 5.44 passes
-  all cases. The new parser lifecycle reproducer records this open failure.
+- On commit `4cad02e3b`, the focused `new_from_lol` and content/incremental
+  parser lifecycle reproducers pass on system Perl, JVM, and interpreter. The
+  upstream `timeout 1800 ./jcpan -t HTML::Tree` run passes all 23 files and 989
+  tests, including `t/refloop.t`. This closes the observed HTML-Tree behavior
+  failure on this candidate, but does not complete Phase 2: owner slots still
+  cover closure pads only, and cleanup still relies on selective counts and
+  reachability walks. Revalidate the upstream suite after the scalar/proxy and
+  array/hash ownership path is migrated.
 - The Dancer2-Plugin-DBIx-Class `t/01_both_using_rsnames.t` workload now passes
   all six assertions and exits on both backends. The interpreter first exposed
   a `caller->isa` scalar-context bug, fixed in this follow-up, then exceeded a

From b2056c8993ce8c8b146555b00d18c5d43f91a0ff Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 15 Oct 2026 21:28:23 +0200
Subject: [PATCH 009/317] docs: record system Perl refloop result

Pin the system Perl version and exact assertion count for the unchanged
HTML-Tree refloop acceptance run.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 546ae85a32..16bee26a9f 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -346,7 +346,8 @@ and first path establish implementation cost.
 - On commit `4cad02e3b`, the focused `new_from_lol` and content/incremental
   parser lifecycle reproducers pass on system Perl, JVM, and interpreter. The
   upstream `timeout 1800 ./jcpan -t HTML::Tree` run passes all 23 files and 989
-  tests, including `t/refloop.t`. This closes the observed HTML-Tree behavior
+  tests, including `t/refloop.t`; standalone system Perl 5.42.2 passes the
+  unchanged `t/refloop.t` 8/8. This closes the observed HTML-Tree behavior
   failure on this candidate, but does not complete Phase 2: owner slots still
   cover closure pads only, and cleanup still relies on selective counts and
   reachability walks. Revalidate the upstream suite after the scalar/proxy and

From 324d9f8001588dfb97b015a72ea53797781ee829 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 15 Oct 2026 22:49:59 +0200
Subject: [PATCH 010/317] fix: retain reachable callback captures during scope
 cleanup

Keep captures for zero-count CODE refs while a Perl container still owns the
callback. Track direct hash referent slots across bulk replacement, removal,
and clear operations, with regressions for both cleanup paths.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 docs/about/changelog.md                       |  2 +-
 .../runtime/runtimetypes/RuntimeHash.java     | 22 ++++++---
 .../runtime/runtimetypes/RuntimeScalar.java   |  3 +-
 .../RuntimeCodeScopeExitReachabilityTest.java | 48 +++++++++++++++++++
 .../RuntimeHashElementOwnershipTest.java      | 39 +++++++++++++++
 5 files changed, 106 insertions(+), 8 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashElementOwnershipTest.java

diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index f282f74428..ed9d6a8dc9 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -42,7 +42,7 @@ priorities and future plans.
 - Preserve inherited method dispatch in child threads.
 - Prefer exact root-module package declarations over earlier helper packages, and warn for undefined hash keys used by `exists` and `delete` (#1820, #1645).
 - Add a reproducible, warmup-aware Perl versus PerlOnJava performance runner (#1196).
-- Release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
+- Preserve CODE callback captures while Perl container slots still own the callback; release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
 - Cover FormState session restoration across requests and HTTP response conversion from callback and streaming PSGI responses; refresh HTTP::Message and LWP compatibility status (#1650, #1651, #1652).
 - Preserve the awaited Future value when its source scalar or aggregate slot changes during suspension, covering PAGI::Server request-body receives (#1818).
 - Preserve escaped byte strings in interpreter closures and `bytes::substr`, honor requested CRLF output in `MIME::QuotedPrint`, and cover URI Basic Auth byte-string userinfo (#1275, #1313, #1341).
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java
index c9155e2621..3dfc73e7b9 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java
@@ -188,22 +188,25 @@ public RuntimeScalar put(String key, RuntimeScalar value) {
 
         @Override
         public void putAll(Map<? extends String, ? extends RuntimeScalar> m) {
+            Map<String, RuntimeScalar> updates = new LinkedHashMap<>();
+            m.forEach(updates::put);
             if (owner.threadShared) {
-                for (Map.Entry<? extends String, ? extends RuntimeScalar> entry
-                        : new StableHashMap<>(m).entrySet()) {
+                for (Map.Entry<String, RuntimeScalar> entry : updates.entrySet()) {
                     put(entry.getKey(), entry.getValue());
                 }
                 return;
             }
+            Map<String, RuntimeScalar> previousValues = new HashMap<>();
             boolean hasReferenceEdge = false;
-            for (Map.Entry<? extends String, ? extends RuntimeScalar> e : m.entrySet()) {
+            for (Map.Entry<String, RuntimeScalar> e : updates.entrySet()) {
+                RuntimeScalar previous = super.get(e.getKey());
+                previousValues.put(e.getKey(), previous);
                 if (rootEdge(super.get(e.getKey())) || rootEdge(e.getValue())) {
                     hasReferenceEdge = true;
-                    break;
                 }
             }
             owner.notePackageRootMutationIf(hasReferenceEdge);
-            for (RuntimeScalar value : m.values()) {
+            for (RuntimeScalar value : updates.values()) {
                 if (owner.threadShared) SharedPerlStorage.publishBlessing(value);
                 if (value != null) {
                     value.markContainerOwner(owner);
@@ -213,7 +216,10 @@ public void putAll(Map<? extends String, ? extends RuntimeScalar> m) {
                 }
                 owner.markPackageRootedValue(value);
             }
-            super.putAll(m);
+            super.putAll(updates);
+            for (Map.Entry<String, RuntimeScalar> e : updates.entrySet()) {
+                updateReferentHashSlotOwnership(previousValues.get(e.getKey()), e.getValue());
+            }
         }
 
         @Override
@@ -224,6 +230,7 @@ public RuntimeScalar remove(Object key) {
                     MortalList.deferDestroyForContainerClear(java.util.Collections.singletonList(previous));
                 }
                 owner.notePackageRootMutation(previous, null);
+                updateReferentHashSlotOwnership(previous, null);
             }
             return previous;
         }
@@ -235,6 +242,9 @@ public void clear() {
                     MortalList.deferDestroyForContainerClear(values());
                 }
                 owner.notePackageRootClear(values());
+                for (RuntimeScalar value : values()) {
+                    updateReferentHashSlotOwnership(value, null);
+                }
             }
             super.clear();
         }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 393299abac..8f4a7a2526 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -5219,7 +5219,8 @@ public static void scopeExitCleanup(RuntimeScalar scalar) {
                     && scalar.value instanceof RuntimeCode code
                     && code.capturedScalars != null
                     && code.refCount == 0
-                    && !GlobalVariable.installedGlobalCodeRefsView().contains(code)) {
+                    && !GlobalVariable.installedGlobalCodeRefsView().contains(code)
+                    && !ReachabilityWalker.isReachableFromRoots(code)) {
                 code.releaseCaptures();
             }
             return;
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
new file mode 100644
index 0000000000..c2b34fc21c
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
@@ -0,0 +1,48 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import java.util.List;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+@Tag("unit")
+class RuntimeCodeScopeExitReachabilityTest {
+    @Test
+    void scopeExitRetainsCapturesWhileCodeIsStoredInReachableHash() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeScalar captured = new RuntimeScalar("controller");
+            captured.retainClosureCapture();
+            RuntimeCode callback = new RuntimeCode(null, List.of());
+            callback.refCount = 0;
+            callback.capturedScalars = new RuntimeScalar[] { captured };
+
+            RuntimeScalar codeRef = new RuntimeScalar(callback);
+            RuntimeHash callbacks = new RuntimeHash();
+            callbacks.elements.put("callback", codeRef);
+            String globalName = "RuntimeCodeScopeExitReachabilityTest::callbacks";
+            GlobalVariable.globalHashes.put(globalName, callbacks);
+
+            try {
+                RuntimeScalar.scopeExitCleanup(codeRef);
+
+                assertNotNull(callback.capturedScalars,
+                        "scope cleanup must preserve captures while a hash owns the CODE ref");
+                assertEquals(1, captured.captureCount);
+
+                GlobalVariable.globalHashes.remove(globalName);
+                RuntimeScalar.scopeExitCleanup(codeRef);
+
+                assertNull(callback.capturedScalars,
+                        "discarding the final reachable CODE owner releases its captures");
+                assertEquals(0, captured.captureCount);
+            } finally {
+                GlobalVariable.globalHashes.remove(globalName);
+            }
+        }
+    }
+}
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashElementOwnershipTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashElementOwnershipTest.java
new file mode 100644
index 0000000000..bd47b92a38
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashElementOwnershipTest.java
@@ -0,0 +1,39 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+@Tag("unit")
+class RuntimeHashElementOwnershipTest {
+    @Test
+    void hashMapMutationsTrackEveryDirectReferentSlot() {
+        RuntimeArray first = new RuntimeArray();
+        RuntimeArray second = new RuntimeArray();
+        RuntimeHash hash = new RuntimeHash();
+
+        hash.elements.put("first", first.createReference());
+        assertEquals(1, first.hashSlotOwnerCount);
+
+        hash.elements.put("first", second.createReference());
+        assertEquals(0, first.hashSlotOwnerCount);
+        assertEquals(1, second.hashSlotOwnerCount);
+
+        hash.elements.putAll(Map.of("second", first.createReference()));
+        assertEquals(1, first.hashSlotOwnerCount);
+        assertEquals(1, second.hashSlotOwnerCount);
+
+        hash.elements.putAll(Map.of("second", second.createReference()));
+        assertEquals(0, first.hashSlotOwnerCount);
+        assertEquals(2, second.hashSlotOwnerCount);
+
+        hash.elements.remove("first");
+        assertEquals(1, second.hashSlotOwnerCount);
+
+        hash.elements.clear();
+        assertEquals(0, second.hashSlotOwnerCount);
+    }
+}

From 4f4df0f30955c0e85b1b809e49e6da7c463d4512 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 15 Oct 2026 23:13:49 +0200
Subject: [PATCH 011/317] fix: balance hash ownership when restoring regex
 snapshots

Release the current hash map's element ownership before restoring its saved
entries, avoiding stale and duplicated referent slot counts. Add a regression
for a temporary entry discarded during regex callback rollback.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtime/runtimetypes/RuntimeHash.java     | 10 +++++++
 .../RuntimeHashRegexRestoreOwnershipTest.java | 27 +++++++++++++++++++
 2 files changed, 37 insertions(+)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashRegexRestoreOwnershipTest.java

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java
index 3dfc73e7b9..f79d376ddf 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java
@@ -120,6 +120,16 @@ Object snapshotRegexMutationState() {
     void restoreRegexMutationState(Object token) {
         if (!(token instanceof RegexMutationState state)) return;
         deferValuesAddedSince(state.elements.values());
+        // Release the current map's element ownership before building the
+        // restored map. The new map acquires one slot for each saved entry;
+        // replacing the map reference directly would leave both the old and
+        // new slot accounting attached to the referents.
+        suppressHintHashLifecycleCleanup = true;
+        try {
+            elements.clear();
+        } finally {
+            suppressHintHashLifecycleCleanup = false;
+        }
         elements = newElementMap(state.elements);
         byteKeys = state.byteKeys == null ? null : new HashSet<>(state.byteKeys);
         type = state.type;
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashRegexRestoreOwnershipTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashRegexRestoreOwnershipTest.java
new file mode 100644
index 0000000000..3e4da2aa02
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashRegexRestoreOwnershipTest.java
@@ -0,0 +1,27 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+@Tag("unit")
+class RuntimeHashRegexRestoreOwnershipTest {
+    @Test
+    void restoringMutationSnapshotReplacesElementSlotOwnership() {
+        RuntimeArray stableReferent = new RuntimeArray();
+        RuntimeArray temporaryReferent = new RuntimeArray();
+        RuntimeHash hash = new RuntimeHash();
+        hash.elements.put("stable", stableReferent.createReference());
+
+        Object snapshot = hash.snapshotRegexMutationState();
+        hash.elements.put("temporary", temporaryReferent.createReference());
+
+        hash.restoreRegexMutationState(snapshot);
+
+        assertEquals(1, stableReferent.hashSlotOwnerCount,
+                "the restored entry has exactly one hash slot owner");
+        assertEquals(0, temporaryReferent.hashSlotOwnerCount,
+                "the discarded entry no longer has a hash slot owner");
+    }
+}

From 3e2b64bd8a88142adbe1e118da9f0d325833f2c4 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 15 Oct 2026 23:33:08 +0200
Subject: [PATCH 012/317] test: bind runtime for hash snapshot ownership
 regression

The regex rollback cleanup path uses MortalList, so its direct regression
fixture must execute inside a bound PerlRuntime like the other lifecycle
unit tests.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../RuntimeHashRegexRestoreOwnershipTest.java | 25 +++++++++++--------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashRegexRestoreOwnershipTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashRegexRestoreOwnershipTest.java
index 3e4da2aa02..8a3fb67efa 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashRegexRestoreOwnershipTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashRegexRestoreOwnershipTest.java
@@ -9,19 +9,22 @@
 class RuntimeHashRegexRestoreOwnershipTest {
     @Test
     void restoringMutationSnapshotReplacesElementSlotOwnership() {
-        RuntimeArray stableReferent = new RuntimeArray();
-        RuntimeArray temporaryReferent = new RuntimeArray();
-        RuntimeHash hash = new RuntimeHash();
-        hash.elements.put("stable", stableReferent.createReference());
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray stableReferent = new RuntimeArray();
+            RuntimeArray temporaryReferent = new RuntimeArray();
+            RuntimeHash hash = new RuntimeHash();
+            hash.elements.put("stable", stableReferent.createReference());
 
-        Object snapshot = hash.snapshotRegexMutationState();
-        hash.elements.put("temporary", temporaryReferent.createReference());
+            Object snapshot = hash.snapshotRegexMutationState();
+            hash.elements.put("temporary", temporaryReferent.createReference());
 
-        hash.restoreRegexMutationState(snapshot);
+            hash.restoreRegexMutationState(snapshot);
 
-        assertEquals(1, stableReferent.hashSlotOwnerCount,
-                "the restored entry has exactly one hash slot owner");
-        assertEquals(0, temporaryReferent.hashSlotOwnerCount,
-                "the discarded entry no longer has a hash slot owner");
+            assertEquals(1, stableReferent.hashSlotOwnerCount,
+                    "the restored entry has exactly one hash slot owner");
+            assertEquals(0, temporaryReferent.hashSlotOwnerCount,
+                    "the discarded entry no longer has a hash slot owner");
+        }
     }
 }

From 827b4f6de9b62ab3096bbbdaca3c75dc34f5dc6e Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 00:03:21 +0200
Subject: [PATCH 013/317] test: isolate WebSocket lifetime regression from
 parallel shards

Run the timer-driven Mojolicious callback regression in the final unit shard,
after regular shards finish, so parallel test-worker load cannot starve the
event loop. Preserve its complete WebSocket and controller assertions.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 build.gradle                                              | 7 +++++++
 src/test/java/org/perlonjava/PerlScriptExecutionTest.java | 1 +
 2 files changed, 8 insertions(+)

diff --git a/build.gradle b/build.gradle
index 465e8c328b..839523affe 100644
--- a/build.gradle
+++ b/build.gradle
@@ -833,6 +833,13 @@ def homeIntegrationTask = tasks.register('testPerlOnJavaHomeIntegration', Test)
     mustRunAfter tasks.named('testJoni')
 }
 
+// The final shard contains timing-sensitive event-loop regressions alongside
+// the heavier compiler fixtures. Run it after the regular shards so timer
+// callbacks are not starved by several concurrent Perl test workers.
+tasks.named(unitShardTasks.last()) {
+    mustRunAfter unitShardTasks.take(parallelShards - 1).collect { tasks.named(it) }
+}
+
 tasks.register('testUnitParallel') {
     group = 'verification'
     description = 'Runs unit tests in parallel across multiple JVMs. Usage: gradle testUnitParallel --parallel'
diff --git a/src/test/java/org/perlonjava/PerlScriptExecutionTest.java b/src/test/java/org/perlonjava/PerlScriptExecutionTest.java
index f79c724386..4d0dcdd971 100644
--- a/src/test/java/org/perlonjava/PerlScriptExecutionTest.java
+++ b/src/test/java/org/perlonjava/PerlScriptExecutionTest.java
@@ -177,6 +177,7 @@ private static Stream<String> getPerlScripts(boolean unitOnly) throws IOExceptio
                         "unit/html_content_extractor_jsoup.t",
                         "unit/json_xs_compat.t",
                         "unit/jvm_eval_nested_compound_assignment.t",
+                        "unit/mojolicious_websocket_callback_lifetime.t",
                         "unit/unpack_short_string.t"
                     );
                     java.util.function.Predicate<String> isHeavy = s -> {

From 42847e424a3ca53b1917afe97321102446825e5e Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 01:12:41 +0200
Subject: [PATCH 014/317] fix: preserve rooted callback captures during
 deferred cleanup

Keep callback captures alive when deferred cleanup reaches a CODE object that
remains stored in a Perl container. Add a direct lifecycle regression and run
the Mojolicious WebSocket regression in a dedicated test JVM.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 build.gradle                                  | 31 ++++++++++++---
 .../runtime/runtimetypes/MortalList.java      |  8 ++++
 .../perlonjava/PerlScriptExecutionTest.java   | 11 +++++-
 .../RuntimeCodeScopeExitReachabilityTest.java | 39 +++++++++++++++++++
 4 files changed, 82 insertions(+), 7 deletions(-)

diff --git a/build.gradle b/build.gradle
index 839523affe..9ae0d69c45 100644
--- a/build.gradle
+++ b/build.gradle
@@ -833,17 +833,36 @@ def homeIntegrationTask = tasks.register('testPerlOnJavaHomeIntegration', Test)
     mustRunAfter tasks.named('testJoni')
 }
 
-// The final shard contains timing-sensitive event-loop regressions alongside
-// the heavier compiler fixtures. Run it after the regular shards so timer
-// callbacks are not starved by several concurrent Perl test workers.
-tasks.named(unitShardTasks.last()) {
-    mustRunAfter unitShardTasks.take(parallelShards - 1).collect { tasks.named(it) }
+def websocketLifetimeTask = tasks.register('testUnitWebsocketLifetime', Test) {
+    group = 'verification'
+    description = 'Runs the isolated Mojolicious WebSocket lifetime regression'
+
+    useJUnitPlatform {
+        includeTags 'unit'
+        excludeTags 'full'
+    }
+
+    systemProperty 'test.shard.index', parallelShards
+    systemProperty 'test.shard.total', parallelShards + 1
+
+    testClassesDirs = sourceSets.test.output.classesDirs
+    classpath = sourceSets.test.runtimeClasspath
+    include '**/PerlScriptExecutionTest.class'
+
+    mustRunAfter unitShardTasks.collect { tasks.named(it) }
+    onlyIf {
+        jperlTestShardProp.get().isEmpty() || jperlTestShardProp.get() == "$parallelShards"
+    }
+}
+
+homeIntegrationTask.configure {
+    mustRunAfter websocketLifetimeTask
 }
 
 tasks.register('testUnitParallel') {
     group = 'verification'
     description = 'Runs unit tests in parallel across multiple JVMs. Usage: gradle testUnitParallel --parallel'
-    dependsOn unitShardTasks
+    dependsOn unitShardTasks + [websocketLifetimeTask]
     dependsOn testJoni
     dependsOn verifyJoniPackaging
     dependsOn homeIntegrationTask
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index a0602facda..857edae05e 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1722,6 +1722,14 @@ private static void processDeferredBase(RuntimeBase base, boolean clearWeakRefsF
                 // have a legacy bridge count and retain the old compatibility
                 // sentinel behavior.
                 if (base.nativeCaptureOwnerCount() == 0) base.refCount = 1;
+            } else if (base instanceof RuntimeCode code
+                    && ReachabilityWalker.isReachableFromRoots(code)) {
+                // A callback stored in a long-lived Perl container can have
+                // its selective CV count consumed by a temporary invocation
+                // alias. The container is still a strong owner even when no
+                // weak references point at the CODE object. Preserve the CV
+                // and its lexical captures until the last Perl root is gone.
+                base.refCount = 1;
             } else if (base.localBindingExists) {
                 if (base instanceof RuntimeScalar scalar
                         && scalar.referencedByScalarReference
diff --git a/src/test/java/org/perlonjava/PerlScriptExecutionTest.java b/src/test/java/org/perlonjava/PerlScriptExecutionTest.java
index 4d0dcdd971..62e5c7c53b 100644
--- a/src/test/java/org/perlonjava/PerlScriptExecutionTest.java
+++ b/src/test/java/org/perlonjava/PerlScriptExecutionTest.java
@@ -164,6 +164,15 @@ private static Stream<String> getPerlScripts(boolean unitOnly) throws IOExceptio
                 if (shardTotal > 1 && shardIndex >= 0 && shardIndex < shardTotal) {
                     System.out.println("Running shard " + (shardIndex + 1) + " of " + shardTotal);
 
+                    final List<String> ISOLATED_TESTS = List.of(
+                        "unit/mojolicious_websocket_callback_lifetime.t"
+                    );
+                    java.util.function.Predicate<String> isIsolated = s ->
+                            ISOLATED_TESTS.contains(s.replace('\\', '/'));
+                    if (shardTotal == 6 && shardIndex == 5) {
+                        return sortedScripts.stream().filter(isIsolated);
+                    }
+
                     // Tests known to be much slower than the rest. Use forward
                     // slashes; we match against both '/' and '\' separators.
                     final List<String> HEAVY_TESTS = List.of(
@@ -177,7 +186,6 @@ private static Stream<String> getPerlScripts(boolean unitOnly) throws IOExceptio
                         "unit/html_content_extractor_jsoup.t",
                         "unit/json_xs_compat.t",
                         "unit/jvm_eval_nested_compound_assignment.t",
-                        "unit/mojolicious_websocket_callback_lifetime.t",
                         "unit/unpack_short_string.t"
                     );
                     java.util.function.Predicate<String> isHeavy = s -> {
@@ -194,6 +202,7 @@ private static Stream<String> getPerlScripts(boolean unitOnly) throws IOExceptio
                     // Light shards: round-robin over the remaining (shardTotal - 1) shards.
                     List<String> lightScripts = sortedScripts.stream()
                             .filter(isHeavy.negate())
+                            .filter(isIsolated.negate())
                             .collect(Collectors.toList());
                     final int lightShards = shardTotal - 1;
                     final int finalShardIndex = shardIndex;
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
index c2b34fc21c..659e81ac50 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
@@ -45,4 +45,43 @@ void scopeExitRetainsCapturesWhileCodeIsStoredInReachableHash() {
             }
         }
     }
+
+    @Test
+    void deferredReleaseRetainsCapturesForCodeStoredInReachableHashWithoutWeakRefs() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeScalar captured = new RuntimeScalar("controller");
+            captured.retainClosureCapture();
+            RuntimeCode callback = new RuntimeCode(null, List.of());
+            callback.refCount = 1;
+            callback.capturedScalars = new RuntimeScalar[] { captured };
+
+            RuntimeHash callbacks = new RuntimeHash();
+            callbacks.elements.put("callback", new RuntimeScalar(callback));
+            String globalName = "RuntimeCodeScopeExitReachabilityTest::deferredCallbacks";
+            GlobalVariable.globalHashes.put(globalName, callbacks);
+            boolean previousActive = MortalList.isActive();
+            MortalList.setActive(true);
+
+            try {
+                MortalList.deferDecrement(callback);
+                MortalList.flush();
+
+                assertNotNull(callback.capturedScalars,
+                        "a rooted callback must keep its lexical captures when a temporary owner is released");
+                assertEquals(1, captured.captureCount);
+
+                GlobalVariable.globalHashes.remove(globalName);
+                MortalList.deferDecrement(callback);
+                MortalList.flush();
+
+                assertNull(callback.capturedScalars,
+                        "removing the last Perl root must release callback captures");
+                assertEquals(0, captured.captureCount);
+            } finally {
+                GlobalVariable.globalHashes.remove(globalName);
+                MortalList.setActive(previousActive);
+            }
+        }
+    }
 }

From 1601cdba9faf5760c1a350ecf230e999ba5f30e5 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 01:36:38 +0200
Subject: [PATCH 015/317] fix: retain rooted JVM callback captures

Keep captures for anonymous callbacks that remain reachable from Perl roots
when a JVM closure frame exits. This preserves callbacks held by asynchronous
reactor state across repeated invocations.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java    | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
index b5e7f670f5..93e342dca3 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
@@ -250,6 +250,7 @@ private static void popJvmClosureFrame(JvmClosureFrame frame) {
                         && closure.refCount == 0
                         && closure.stashRefCount <= 0
                         && !closure.localBindingExists
+                        && !ReachabilityWalker.isReachableFromRoots(closure)
                         && (frame.returned == null || !frame.returned.containsKey(closure))) {
                     closure.releaseCaptures();
                 }

From b689df6153140f36914029ddd2749e298c57169e Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 02:00:55 +0200
Subject: [PATCH 016/317] feat: track ordinary hash entries with owner slots

Give ordinary hash keys stable owner-slot identities and transfer those
identities as scalar cells change referents. Use the explicit slot count to
bridge deferred cleanup, while retaining selective counts at unmigrated
boundaries. Cover replacement, aliases, removal, cleanup, and dynamic restore.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <openai-codex@users.noreply.github.com>
---
 .../runtime/perlmodule/Internals.java         |   2 +-
 .../runtime/runtimetypes/MortalList.java      |  17 ++-
 .../runtime/runtimetypes/PerlOwnerSlot.java   |  11 +-
 .../runtime/runtimetypes/RuntimeBase.java     |  19 ++--
 .../runtime/runtimetypes/RuntimeHash.java     | 101 ++++++++++++++---
 .../runtime/runtimetypes/RuntimeScalar.java   |  30 ++++-
 .../RuntimeHashElementOwnershipTest.java      | 106 ++++++++++++++++--
 .../RuntimeHashRegexRestoreOwnershipTest.java |   4 +-
 8 files changed, 247 insertions(+), 43 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/perlmodule/Internals.java b/src/main/java/org/perlonjava/runtime/perlmodule/Internals.java
index cb82e5bd6c..b5ee0d4d9e 100644
--- a/src/main/java/org/perlonjava/runtime/perlmodule/Internals.java
+++ b/src/main/java/org/perlonjava/runtime/perlmodule/Internals.java
@@ -577,7 +577,7 @@ public static RuntimeList svRefcount(RuntimeArray args, int ctx) {
             // selective refCount owner. Do not discount that real owner.
             boolean fieldOwnedMethodResult = rc == 1
                     && !base.localBindingExists
-                    && base.hashSlotOwnerCount > 0
+                    && base.hashSlotOwnerCount() > 0
                     && !ReachabilityWalker.hasLiveStrongScalarReferentOtherThan(base, arg);
             boolean bObjectProbe = args.size() > 1 && args.get(1).getBoolean();
             int adjust = compileHintsHash
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 857edae05e..0aa341dca8 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -668,7 +668,10 @@ public static void scopeExitCleanupHash(RuntimeHash hash) {
         // data), we must still cascade decrements so their weak-ref entries
         // can be cleared when the referent's refCount reaches 0.
         if (!RuntimeBase.blessedObjectExists() && !WeakRefRegistry.weakRefsExist()
-                && !RuntimeScalar.watcherCleanupNeeded()) return;
+                && !RuntimeScalar.watcherCleanupNeeded()) {
+            hash.releaseHashEntryOwnerSlots();
+            return;
+        }
         // If the hash has outstanding references (e.g., from \%hash stored elsewhere),
         // do NOT clean up elements — the hash is still alive and its elements are
         // accessible through the reference. Cleanup will happen when the last
@@ -707,7 +710,10 @@ public static void scopeExitCleanupHash(RuntimeHash hash) {
                 if (needsWalk) break;
             }
         }
-        if (!needsWalk) return;
+        if (!needsWalk) {
+            hash.releaseHashEntryOwnerSlots();
+            return;
+        }
         // Refcount drift can miss an escaped hash reference. DBIC's
         // source_registrations hash is assigned into the live schema while the
         // original hash later exits; walking it here would destroy ResultSources
@@ -721,6 +727,7 @@ public static void scopeExitCleanupHash(RuntimeHash hash) {
         for (RuntimeScalar val : valuesInDestructionOrder) {
             deferDecrementRecursive(val);
         }
+        hash.releaseHashEntryOwnerSlots();
     }
 
     /**
@@ -1730,6 +1737,12 @@ private static void processDeferredBase(RuntimeBase base, boolean clearWeakRefsF
                 // weak references point at the CODE object. Preserve the CV
                 // and its lexical captures until the last Perl root is gone.
                 base.refCount = 1;
+            } else if (base.hashSlotOwnerCount() > 0) {
+                // Ordinary hash entries carry stable owner-slot identities.
+                // Preserve the legacy count bridge while any entry still owns
+                // the referent; removing the final entry releases that slot
+                // before its matching deferred decrement is processed.
+                base.refCount = 1;
             } else if (base.localBindingExists) {
                 if (base instanceof RuntimeScalar scalar
                         && scalar.referencedByScalarReference
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
index 5cf83c1ded..230c527f79 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
@@ -17,7 +17,8 @@ public final class PerlOwnerSlot {
     private static final AtomicLong NEXT_ID = new AtomicLong();
 
     public enum Kind {
-        CLOSURE_PAD
+        CLOSURE_PAD,
+        HASH_ENTRY
     }
 
     private final Kind kind;
@@ -134,6 +135,14 @@ public synchronized void acquireCapture(RuntimeBase target) {
         transferTo(target);
     }
 
+    /** Attach this stable hash-entry slot to its current direct referent. */
+    public synchronized void acquireHashEntry(RuntimeBase target) {
+        if (kind != Kind.HASH_ENTRY) {
+            throw new IllegalStateException("hash-entry acquisition requires a HASH_ENTRY slot");
+        }
+        transferTo(target);
+    }
+
     /** Queue one closure-pad count release and retain its slot provenance. */
     public synchronized PendingRelease deferLegacyCaptureRelease(RuntimeBase target) {
         if (legacyCaptureCount <= 0) return null;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
index 553ac10c8b..470a472854 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
@@ -191,14 +191,6 @@ boolean deferSharedDestroy() {
      */
     public boolean storedInPackageGlobal = false;
 
-    /**
-     * Number of live hash-element slots that directly own this referent.
-     * This is separate from selective refCount because a returned method
-     * value can be detached from its slot while the hash remains an owner.
-     */
-    public int hashSlotOwnerCount = 0;
-
-
     /**
      * Marks a scalar/container whose contents are reachable from package
      * globals. Mutating such an object can change cached root-reachability
@@ -315,6 +307,8 @@ private void releaseClosureCapture(boolean nativeOwnerSlot) {
     /** Identity ledger for migrated slots; selective refCount remains the
      * lifecycle bridge while owner families move to this API. */
     private java.util.Set<PerlOwnerSlot> ownerSlots = null;
+    /** Legacy-only hash slots shared across runtime wrappers. */
+    private int sharedHashSlotOwnerCount;
 
     synchronized void addOwnerSlot(PerlOwnerSlot slot) {
         if (ownerSlots == null) {
@@ -347,6 +341,15 @@ public int semanticCaptureOwnerCount() {
         return ownerSlotCount(PerlOwnerSlot.Kind.CLOSURE_PAD);
     }
 
+    /** Number of live ordinary hash-entry slots that directly own this referent. */
+    public int hashSlotOwnerCount() {
+        return ownerSlotCount(PerlOwnerSlot.Kind.HASH_ENTRY) + sharedHashSlotOwnerCount;
+    }
+
+    synchronized void adjustSharedHashSlotOwnerCount(int delta) {
+        sharedHashSlotOwnerCount = Math.max(0, sharedHashSlotOwnerCount + delta);
+    }
+
     /** Count captured aggregate pads whose lifetime is owned natively by slots. */
     public synchronized int nativeCaptureOwnerCount() {
         if (ownerSlots == null) return 0;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java
index f79d376ddf..43d1141272 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java
@@ -41,6 +41,8 @@ private static Stack<RuntimeHash> dynamicStateStack() {
     public int type;
     // Map to store the elements of the hash
     public Map<String, RuntimeScalar> elements;
+    /** Stable semantic owner identity for each ordinary hash entry. */
+    private final Map<String, PerlOwnerSlot> hashEntryOwnerSlots = new HashMap<>();
     /** True only for Perl's compile-time %^H hash. */
     public boolean isHintHash;
     /** True for Perl's runtime %{^HOOK} hash. */
@@ -192,7 +194,8 @@ public RuntimeScalar put(String key, RuntimeScalar value) {
             }
             owner.markPackageRootedValue(value);
             RuntimeScalar result = super.put(key, value);
-            updateReferentHashSlotOwnership(previous, value);
+            owner.updateHashEntryOwner(key, previous, value);
+            if (previous != value) owner.detachHashCellIfAbsent(previous);
             return result;
         }
 
@@ -228,19 +231,26 @@ public void putAll(Map<? extends String, ? extends RuntimeScalar> m) {
             }
             super.putAll(updates);
             for (Map.Entry<String, RuntimeScalar> e : updates.entrySet()) {
-                updateReferentHashSlotOwnership(previousValues.get(e.getKey()), e.getValue());
+                owner.updateHashEntryOwner(e.getKey(), previousValues.get(e.getKey()), e.getValue());
+            }
+            for (RuntimeScalar previous : previousValues.values()) {
+                owner.detachHashCellIfAbsent(previous);
             }
         }
 
         @Override
         public RuntimeScalar remove(Object key) {
+            boolean existed = super.containsKey(key);
             RuntimeScalar previous = super.remove(key);
+            if (existed && key instanceof String stringKey) {
+                owner.releaseHashEntryOwner(stringKey, previous);
+            }
+            owner.detachHashCellIfAbsent(previous);
             if (previous != null) {
                 if (owner.isHintHash && !owner.suppressHintHashLifecycleCleanup) {
                     MortalList.deferDestroyForContainerClear(java.util.Collections.singletonList(previous));
                 }
                 owner.notePackageRootMutation(previous, null);
-                updateReferentHashSlotOwnership(previous, null);
             }
             return previous;
         }
@@ -252,9 +262,14 @@ public void clear() {
                     MortalList.deferDestroyForContainerClear(values());
                 }
                 owner.notePackageRootClear(values());
-                for (RuntimeScalar value : values()) {
-                    updateReferentHashSlotOwnership(value, null);
+                Set<RuntimeScalar> previousValues = Collections.newSetFromMap(new IdentityHashMap<>());
+                previousValues.addAll(values());
+                for (Map.Entry<String, RuntimeScalar> entry : new ArrayList<>(entrySet())) {
+                    owner.releaseHashEntryOwner(entry.getKey(), entry.getValue());
                 }
+                super.clear();
+                for (RuntimeScalar previous : previousValues) owner.detachHashCellIfAbsent(previous);
+                return;
             }
             super.clear();
         }
@@ -576,6 +591,7 @@ public RuntimeArray setFromList(RuntimeList value) {
                 // tied outer hint hash; it must not dispatch CLEAR on the
                 // outer tie object (which may deliberately omit CLEAR).
                 if (isHintHash && materializedList.elements.isEmpty()) {
+                    releaseHashEntryOwnerSlots();
                     elements = newElementMap();
                     type = PLAIN_HASH;
                     yield new RuntimeArray();
@@ -669,16 +685,67 @@ private static RuntimeBase directReferent(RuntimeScalar scalar) {
         return scalar != null && scalar.value instanceof RuntimeBase base ? base : null;
     }
 
-    private static void updateReferentHashSlotOwnership(
-            RuntimeScalar oldValue, RuntimeScalar newValue) {
-        RuntimeBase oldReferent = directReferent(oldValue);
-        RuntimeBase newReferent = directReferent(newValue);
+    private void updateHashEntryOwner(String key, RuntimeScalar previous, RuntimeScalar value) {
+        // Shared hashes still use their canonical legacy accounting; an owner
+        // slot belongs to one PerlRuntime and cannot represent shared storage.
+        if (threadShared) {
+            adjustSharedHashSlotOwnerCount(directReferent(previous), directReferent(value));
+            return;
+        }
+        PerlOwnerSlot slot = hashEntryOwnerSlots.computeIfAbsent(key,
+                ignored -> new PerlOwnerSlot(PerlOwnerSlot.Kind.HASH_ENTRY));
+        slot.acquireHashEntry(directReferent(value));
+    }
+
+    private void detachHashCellIfAbsent(RuntimeScalar scalar) {
+        if (scalar != null && !elements.containsValue(scalar)) {
+            scalar.unmarkHashContainerOwner(this);
+        }
+    }
+
+    private void releaseHashEntryOwner(String key, RuntimeScalar previous) {
+        if (threadShared) {
+            adjustSharedHashSlotOwnerCount(directReferent(previous), null);
+            return;
+        }
+        PerlOwnerSlot removed = hashEntryOwnerSlots.remove(key);
+        if (removed != null) removed.release();
+    }
+
+    private static void adjustSharedHashSlotOwnerCount(RuntimeBase oldReferent,
+                                                       RuntimeBase newReferent) {
         if (oldReferent == newReferent) return;
-        if (oldReferent != null && oldReferent.hashSlotOwnerCount > 0) {
-            oldReferent.hashSlotOwnerCount--;
+        if (oldReferent != null) oldReferent.adjustSharedHashSlotOwnerCount(-1);
+        if (newReferent != null) newReferent.adjustSharedHashSlotOwnerCount(1);
+    }
+
+    PerlOwnerSlot hashEntryOwnerSlot(String key) {
+        return hashEntryOwnerSlots.get(key);
+    }
+
+    void releaseHashEntryOwnerSlots() {
+        if (threadShared) return;
+        Set<RuntimeScalar> cells = Collections.newSetFromMap(new IdentityHashMap<>());
+        cells.addAll(elements.values());
+        for (RuntimeScalar cell : cells) {
+            if (cell != null) cell.unmarkHashContainerOwner(this);
         }
-        if (newReferent != null) {
-            newReferent.hashSlotOwnerCount++;
+        for (PerlOwnerSlot slot : hashEntryOwnerSlots.values()) slot.release();
+        hashEntryOwnerSlots.clear();
+    }
+
+    /** Update every entry that aliases a scalar cell whose referent changed. */
+    void updateHashEntryOwnersForScalar(RuntimeScalar scalar, RuntimeBase oldReferent,
+                                        RuntimeBase nextReferent) {
+        for (Map.Entry<String, RuntimeScalar> entry : elements.entrySet()) {
+            if (entry.getValue() != scalar) continue;
+            if (threadShared) {
+                adjustSharedHashSlotOwnerCount(oldReferent, nextReferent);
+                continue;
+            }
+            PerlOwnerSlot slot = hashEntryOwnerSlots.computeIfAbsent(entry.getKey(),
+                    ignored -> new PerlOwnerSlot(PerlOwnerSlot.Kind.HASH_ENTRY));
+            slot.acquireHashEntry(nextReferent);
         }
     }
 
@@ -1781,6 +1848,7 @@ public RuntimeHash undefine() {
         if (!hasDestroyableValues()) {
             MortalList.deferDestroyForContainerClear(this.elements.values());
             if (this.type == PLAIN_HASH) {
+                releaseHashEntryOwnerSlots();
                 this.elements = newElementMap();
             } else {
                 this.elements.clear();
@@ -1804,6 +1872,8 @@ public RuntimeHash undefine() {
             String key = entry.getKey();
             RuntimeScalar value = entry.getValue();
             it.remove();
+            releaseHashEntryOwner(key, value);
+            detachHashCellIfAbsent(value);
             notePackageRootMutation(value, null);
             if (this.byteKeys != null) this.byteKeys.remove(key);
             // Defer DESTROY for this one value, then flush so it runs now.
@@ -1927,7 +1997,9 @@ public void dynamicRestoreState() {
                 this.blessId = savedBlessId;
             }
             notePackageRootClear(this.elements.values());
-            this.elements = previousState.elements;
+            releaseHashEntryOwnerSlots();
+            this.elements = newElementMap(previousState.elements);
+            previousState.releaseHashEntryOwnerSlots();
             notePackageRootClear(this.elements.values());
             if (isPackageRootedHash()) {
                 for (RuntimeScalar value : this.elements.values()) {
@@ -1961,6 +2033,7 @@ public void dynamicResumeState(Object token) {
             this.blessId = activeState.blessId;
             this.byteKeys = activeState.byteKeys != null ? new HashSet<>(activeState.byteKeys) : null;
             this.elements.putAll(activeState.elements);
+            activeState.releaseHashEntryOwnerSlots();
         }
     }
 
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 8f4a7a2526..28c62b02f5 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -423,6 +423,7 @@ public int captureRefCountOwned() {
     // Last hash/array container that stored this scalar slot. Used only as a
     // narrow guard for live CODE refs whose captures must survive void discard.
     RuntimeBase containerOwner;
+    private Set<RuntimeHash> hashContainerOwners;
 
     /** Return the aggregate slot that directly owns this scalar, if any. */
     public RuntimeBase getContainerOwner() {
@@ -443,9 +444,28 @@ void markContainerOwner(RuntimeBase owner) {
             return;
         }
         this.containerOwner = owner;
+        if (owner instanceof RuntimeHash hash) {
+            if (hashContainerOwners == null) {
+                hashContainerOwners = Collections.newSetFromMap(new IdentityHashMap<>());
+            }
+            hashContainerOwners.add(hash);
+        }
         propagateTiedHandlerMarkerToReferent();
     }
 
+    List<RuntimeHash> hashContainerOwnersSnapshot() {
+        return hashContainerOwners == null ? List.of() : List.copyOf(hashContainerOwners);
+    }
+
+    void unmarkHashContainerOwner(RuntimeHash owner) {
+        if (hashContainerOwners == null) return;
+        hashContainerOwners.remove(owner);
+        if (hashContainerOwners.isEmpty()) hashContainerOwners = null;
+        if (containerOwner == owner) {
+            containerOwner = hashContainerOwners == null ? null : hashContainerOwners.iterator().next();
+        }
+    }
+
     private void propagateTiedHandlerMarkerToReferent() {
         if (containerOwner != null && containerOwner.possiblyStoredInTiedHandler
                 && (type & RuntimeScalarType.REFERENCE_BIT) != 0
@@ -2828,12 +2848,10 @@ && isSocketIOHandle(oldIo.ioHandle)) {
         // scalar wrapper is assigned a new referent (the normal class-field
         // ADJUST path). RuntimeHash's map hook covers slot replacement; this
         // covers mutation of a slot that is already in the map.
-        if (containerOwner instanceof RuntimeHash && oldBase != this.value) {
-            if (oldBase != null && oldBase.hashSlotOwnerCount > 0) {
-                oldBase.hashSlotOwnerCount--;
-            }
-            if (this.value instanceof RuntimeBase newBase) {
-                newBase.hashSlotOwnerCount++;
+        if (oldBase != this.value) {
+            RuntimeBase newBase = this.value instanceof RuntimeBase base ? base : null;
+            for (RuntimeHash owner : hashContainerOwnersSnapshot()) {
+                owner.updateHashEntryOwnersForScalar(this, oldBase, newBase);
             }
         }
         if (this.captureCount > 0 && (this.type & RuntimeScalarType.REFERENCE_BIT) != 0
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashElementOwnershipTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashElementOwnershipTest.java
index bd47b92a38..ac8b9ca6d3 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashElementOwnershipTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashElementOwnershipTest.java
@@ -6,6 +6,8 @@
 import java.util.Map;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertSame;
 
 @Tag("unit")
 class RuntimeHashElementOwnershipTest {
@@ -16,24 +18,110 @@ void hashMapMutationsTrackEveryDirectReferentSlot() {
         RuntimeHash hash = new RuntimeHash();
 
         hash.elements.put("first", first.createReference());
-        assertEquals(1, first.hashSlotOwnerCount);
+        PerlOwnerSlot firstSlot = hash.hashEntryOwnerSlot("first");
+        assertEquals(1, first.hashSlotOwnerCount());
+        assertSame(first, firstSlot.referent());
 
         hash.elements.put("first", second.createReference());
-        assertEquals(0, first.hashSlotOwnerCount);
-        assertEquals(1, second.hashSlotOwnerCount);
+        assertEquals(0, first.hashSlotOwnerCount());
+        assertEquals(1, second.hashSlotOwnerCount());
+        assertSame(firstSlot, hash.hashEntryOwnerSlot("first"),
+                "replacing a value transfers the stable key slot");
+        assertSame(second, firstSlot.referent());
 
         hash.elements.putAll(Map.of("second", first.createReference()));
-        assertEquals(1, first.hashSlotOwnerCount);
-        assertEquals(1, second.hashSlotOwnerCount);
+        PerlOwnerSlot secondSlot = hash.hashEntryOwnerSlot("second");
+        assertEquals(1, first.hashSlotOwnerCount());
+        assertEquals(1, second.hashSlotOwnerCount());
 
         hash.elements.putAll(Map.of("second", second.createReference()));
-        assertEquals(0, first.hashSlotOwnerCount);
-        assertEquals(2, second.hashSlotOwnerCount);
+        assertEquals(0, first.hashSlotOwnerCount());
+        assertEquals(2, second.hashSlotOwnerCount());
+        assertSame(secondSlot, hash.hashEntryOwnerSlot("second"));
 
         hash.elements.remove("first");
-        assertEquals(1, second.hashSlotOwnerCount);
+        assertEquals(1, second.hashSlotOwnerCount());
+        assertNull(hash.hashEntryOwnerSlot("first"));
 
         hash.elements.clear();
-        assertEquals(0, second.hashSlotOwnerCount);
+        assertEquals(0, second.hashSlotOwnerCount());
+        assertNull(hash.hashEntryOwnerSlot("second"));
+    }
+
+    @Test
+    void aliasedHashScalarTransfersEachEntrySlotWhenItsReferentChanges() {
+        RuntimeArray first = new RuntimeArray();
+        RuntimeArray second = new RuntimeArray();
+        RuntimeHash hash = new RuntimeHash();
+        RuntimeHash otherHash = new RuntimeHash();
+        var cell = first.createReference();
+
+        hash.elements.put("left", cell);
+        hash.elements.put("right", cell);
+        otherHash.elements.put("third", cell);
+        PerlOwnerSlot leftSlot = hash.hashEntryOwnerSlot("left");
+        PerlOwnerSlot rightSlot = hash.hashEntryOwnerSlot("right");
+        PerlOwnerSlot thirdSlot = otherHash.hashEntryOwnerSlot("third");
+
+        cell.set(second.createReference());
+
+        assertEquals(0, first.hashSlotOwnerCount());
+        assertEquals(3, second.hashSlotOwnerCount());
+        assertSame(second, leftSlot.referent());
+        assertSame(second, rightSlot.referent());
+        assertSame(second, thirdSlot.referent());
+    }
+
+    @Test
+    void hashEntrySlotPreservesReferentAcrossDeferredLegacyDecrement() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            boolean previousActive = MortalList.isActive();
+            MortalList.setActive(true);
+            try {
+                RuntimeArray referent = new RuntimeArray();
+                referent.refCount = 1;
+                RuntimeHash hash = new RuntimeHash();
+                hash.elements.put("value", referent.createReference());
+
+                MortalList.deferDecrement(referent);
+                MortalList.flush();
+
+                assertEquals(1, referent.refCount,
+                        "a live hash-entry slot bridges a deferred selective-count decrement");
+                assertEquals(1, referent.hashSlotOwnerCount());
+
+                hash.elements.remove("value");
+                assertEquals(0, referent.hashSlotOwnerCount());
+                MortalList.deferDecrement(referent);
+                MortalList.flush();
+                assertEquals(0, referent.refCount,
+                        "after its final slot is removed, the deferred decrement is applied");
+            } finally {
+                MortalList.setActive(previousActive);
+            }
+        }
+    }
+
+    @Test
+    void hashScopeExitReleasesEntrySlotsWhenNoContainerOwnerRemains() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            boolean previousActive = MortalList.isActive();
+            MortalList.setActive(true);
+            try {
+                RuntimeArray referent = new RuntimeArray();
+                RuntimeHash hash = new RuntimeHash();
+                hash.elements.put("value", referent.createReference());
+                assertEquals(1, referent.hashSlotOwnerCount());
+
+                MortalList.scopeExitCleanupHash(hash);
+
+                assertEquals(0, referent.hashSlotOwnerCount(),
+                        "a dead lexical hash must release its semantic entry slots");
+            } finally {
+                MortalList.setActive(previousActive);
+            }
+        }
     }
 }
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashRegexRestoreOwnershipTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashRegexRestoreOwnershipTest.java
index 8a3fb67efa..a7f36e9365 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashRegexRestoreOwnershipTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashRegexRestoreOwnershipTest.java
@@ -21,9 +21,9 @@ void restoringMutationSnapshotReplacesElementSlotOwnership() {
 
             hash.restoreRegexMutationState(snapshot);
 
-            assertEquals(1, stableReferent.hashSlotOwnerCount,
+            assertEquals(1, stableReferent.hashSlotOwnerCount(),
                     "the restored entry has exactly one hash slot owner");
-            assertEquals(0, temporaryReferent.hashSlotOwnerCount,
+            assertEquals(0, temporaryReferent.hashSlotOwnerCount(),
                     "the discarded entry no longer has a hash slot owner");
         }
     }

From 1f449f1ecf155e4258c2eb18a817fdc50d228f88 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 02:12:10 +0200
Subject: [PATCH 017/317] fix: keep hash entry slots owned by their hash

Do not promote hash entry slots into runtime roots. Release their owner
identity with hash cleanup and keep legacy selective counts as the lifecycle
bridge until aggregate cleanup is fully migrated.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <openai-codex@users.noreply.github.com>
---
 .../runtime/runtimetypes/MortalList.java      |  6 --
 .../runtime/runtimetypes/PerlOwnerSlot.java   |  9 ++-
 .../RuntimeHashElementOwnershipTest.java      | 68 ++++++-------------
 3 files changed, 27 insertions(+), 56 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 0aa341dca8..263fe0e16b 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1737,12 +1737,6 @@ private static void processDeferredBase(RuntimeBase base, boolean clearWeakRefsF
                 // weak references point at the CODE object. Preserve the CV
                 // and its lexical captures until the last Perl root is gone.
                 base.refCount = 1;
-            } else if (base.hashSlotOwnerCount() > 0) {
-                // Ordinary hash entries carry stable owner-slot identities.
-                // Preserve the legacy count bridge while any entry still owns
-                // the referent; removing the final entry releases that slot
-                // before its matching deferred decrement is processed.
-                base.refCount = 1;
             } else if (base.localBindingExists) {
                 if (base instanceof RuntimeScalar scalar
                         && scalar.referencedByScalarReference
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
index 230c527f79..c6c1921a3a 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
@@ -167,9 +167,14 @@ public synchronized void transferTo(RuntimeBase nextReferent) {
         RuntimeBase previous = referent;
         PerlRuntime previousRuntime = ownerRuntime;
         LifecycleRuntimeState previousState = ownerRuntimeState;
-        PerlRuntime nextRuntime = nextReferent == null
+        // Hash entry slots are owned by their hash, so retaining their
+        // referent from the runtime would turn an unrooted hash into a root.
+        // Closure-pad slots are runtime roots while their Perl closure lives.
+        PerlRuntime nextRuntime = kind != Kind.CLOSURE_PAD || nextReferent == null
                 ? null : PerlRuntime.currentOrNull();
-        if (nextReferent != null && nextRuntime == null) nextRuntime = previousRuntime;
+        if (kind == Kind.CLOSURE_PAD && nextReferent != null && nextRuntime == null) {
+            nextRuntime = previousRuntime;
+        }
 
         referent = nextReferent;
         ownerRuntime = nextRuntime;
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashElementOwnershipTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashElementOwnershipTest.java
index ac8b9ca6d3..17c019dfa2 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashElementOwnershipTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashElementOwnershipTest.java
@@ -50,56 +50,28 @@ void hashMapMutationsTrackEveryDirectReferentSlot() {
 
     @Test
     void aliasedHashScalarTransfersEachEntrySlotWhenItsReferentChanges() {
-        RuntimeArray first = new RuntimeArray();
-        RuntimeArray second = new RuntimeArray();
-        RuntimeHash hash = new RuntimeHash();
-        RuntimeHash otherHash = new RuntimeHash();
-        var cell = first.createReference();
-
-        hash.elements.put("left", cell);
-        hash.elements.put("right", cell);
-        otherHash.elements.put("third", cell);
-        PerlOwnerSlot leftSlot = hash.hashEntryOwnerSlot("left");
-        PerlOwnerSlot rightSlot = hash.hashEntryOwnerSlot("right");
-        PerlOwnerSlot thirdSlot = otherHash.hashEntryOwnerSlot("third");
-
-        cell.set(second.createReference());
-
-        assertEquals(0, first.hashSlotOwnerCount());
-        assertEquals(3, second.hashSlotOwnerCount());
-        assertSame(second, leftSlot.referent());
-        assertSame(second, rightSlot.referent());
-        assertSame(second, thirdSlot.referent());
-    }
-
-    @Test
-    void hashEntrySlotPreservesReferentAcrossDeferredLegacyDecrement() {
         PerlRuntime runtime = new PerlRuntime();
         try (PerlRuntime.Binding ignored = runtime.bind()) {
-            boolean previousActive = MortalList.isActive();
-            MortalList.setActive(true);
-            try {
-                RuntimeArray referent = new RuntimeArray();
-                referent.refCount = 1;
-                RuntimeHash hash = new RuntimeHash();
-                hash.elements.put("value", referent.createReference());
-
-                MortalList.deferDecrement(referent);
-                MortalList.flush();
-
-                assertEquals(1, referent.refCount,
-                        "a live hash-entry slot bridges a deferred selective-count decrement");
-                assertEquals(1, referent.hashSlotOwnerCount());
-
-                hash.elements.remove("value");
-                assertEquals(0, referent.hashSlotOwnerCount());
-                MortalList.deferDecrement(referent);
-                MortalList.flush();
-                assertEquals(0, referent.refCount,
-                        "after its final slot is removed, the deferred decrement is applied");
-            } finally {
-                MortalList.setActive(previousActive);
-            }
+            RuntimeArray first = new RuntimeArray();
+            RuntimeArray second = new RuntimeArray();
+            RuntimeHash hash = new RuntimeHash();
+            RuntimeHash otherHash = new RuntimeHash();
+            var cell = first.createReference();
+
+            hash.elements.put("left", cell);
+            hash.elements.put("right", cell);
+            otherHash.elements.put("third", cell);
+            PerlOwnerSlot leftSlot = hash.hashEntryOwnerSlot("left");
+            PerlOwnerSlot rightSlot = hash.hashEntryOwnerSlot("right");
+            PerlOwnerSlot thirdSlot = otherHash.hashEntryOwnerSlot("third");
+
+            cell.set(second.createReference());
+
+            assertEquals(0, first.hashSlotOwnerCount());
+            assertEquals(3, second.hashSlotOwnerCount());
+            assertSame(second, leftSlot.referent());
+            assertSame(second, rightSlot.referent());
+            assertSame(second, thirdSlot.referent());
         }
     }
 

From 7eb05f7ec8da23c91a546c5acce07ca9058bbf2c Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 02:27:16 +0200
Subject: [PATCH 018/317] fix: avoid strong scalar back-links to hash owners

Track aliased hash owners through weak references so a scalar cell can update
all live hash-entry slots without creating a Java strong edge back to an
otherwise unreachable hash.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <openai-codex@users.noreply.github.com>
---
 .../runtime/runtimetypes/RuntimeScalar.java   | 23 ++++++++++++++-----
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 28c62b02f5..4734e8a262 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -423,7 +423,7 @@ public int captureRefCountOwned() {
     // Last hash/array container that stored this scalar slot. Used only as a
     // narrow guard for live CODE refs whose captures must survive void discard.
     RuntimeBase containerOwner;
-    private Set<RuntimeHash> hashContainerOwners;
+    private List<WeakReference<RuntimeHash>> hashContainerOwners;
 
     /** Return the aggregate slot that directly owns this scalar, if any. */
     public RuntimeBase getContainerOwner() {
@@ -446,23 +446,34 @@ void markContainerOwner(RuntimeBase owner) {
         this.containerOwner = owner;
         if (owner instanceof RuntimeHash hash) {
             if (hashContainerOwners == null) {
-                hashContainerOwners = Collections.newSetFromMap(new IdentityHashMap<>());
+                hashContainerOwners = new ArrayList<>();
             }
-            hashContainerOwners.add(hash);
+            boolean alreadyRegistered = hashContainerOwners.stream()
+                    .anyMatch(reference -> reference.get() == hash);
+            if (!alreadyRegistered) hashContainerOwners.add(new WeakReference<>(hash));
         }
         propagateTiedHandlerMarkerToReferent();
     }
 
     List<RuntimeHash> hashContainerOwnersSnapshot() {
-        return hashContainerOwners == null ? List.of() : List.copyOf(hashContainerOwners);
+        if (hashContainerOwners == null) return List.of();
+        List<RuntimeHash> snapshot = new ArrayList<>(hashContainerOwners.size());
+        hashContainerOwners.removeIf(reference -> reference.get() == null);
+        for (WeakReference<RuntimeHash> reference : hashContainerOwners) {
+            RuntimeHash owner = reference.get();
+            if (owner != null) snapshot.add(owner);
+        }
+        if (hashContainerOwners.isEmpty()) hashContainerOwners = null;
+        return snapshot;
     }
 
     void unmarkHashContainerOwner(RuntimeHash owner) {
         if (hashContainerOwners == null) return;
-        hashContainerOwners.remove(owner);
+        hashContainerOwners.removeIf(reference -> reference.get() == null || reference.get() == owner);
         if (hashContainerOwners.isEmpty()) hashContainerOwners = null;
         if (containerOwner == owner) {
-            containerOwner = hashContainerOwners == null ? null : hashContainerOwners.iterator().next();
+            List<RuntimeHash> remaining = hashContainerOwnersSnapshot();
+            containerOwner = remaining.isEmpty() ? null : remaining.get(0);
         }
     }
 

From 6a5174a75a89db3dbe7cb942597ae15abfbd6f8a Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 02:29:21 +0200
Subject: [PATCH 019/317] fix: preserve rooted interpreter callback captures

Match JVM closure-frame cleanup by keeping captures for interpreter closures
that remain reachable from Perl roots at normal or cancelled frame exit.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <openai-codex@users.noreply.github.com>
---
 .../org/perlonjava/backend/bytecode/BytecodeInterpreter.java    | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
index eb98acc7c9..d7a79012bf 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
@@ -232,6 +232,7 @@ static void abandon(SuspendedInterpreterFrame frame) {
             if ((closure.capturedScalars != null || closure.capturedAggregates != null)
                     && closure.refCount == 0
                     && closure.stashRefCount <= 0
+                    && !ReachabilityWalker.isReachableFromRoots(closure)
                     && (frame.returnedClosures == null
                         || !frame.returnedClosures.contains(closure))) {
                 closure.releaseCaptures();
@@ -3916,6 +3917,7 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
                     if ((closure.capturedScalars != null || closure.capturedAggregates != null)
                             && closure.refCount == 0
                             && closure.stashRefCount <= 0
+                            && !ReachabilityWalker.isReachableFromRoots(closure)
                             && (frame.returnedClosures == null || !frame.returnedClosures.contains(closure))) {
                         closure.releaseCaptures();
                     }

From b32a0322f1e0fd7c76ebc7f7f1c7b3c215ec366c Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 02:53:04 +0200
Subject: [PATCH 020/317] test: cover callback lifetime with unused outer
 lexical

Keep a saved nested callback callable without retaining its unrelated outer
object, and validate the same Perl behavior under both PerlOnJava backends.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../unused_outer_lexical_callback_lifetime.t  | 35 +++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 src/test/resources/unit/unused_outer_lexical_callback_lifetime.t

diff --git a/src/test/resources/unit/unused_outer_lexical_callback_lifetime.t b/src/test/resources/unit/unused_outer_lexical_callback_lifetime.t
new file mode 100644
index 0000000000..07295bfe6b
--- /dev/null
+++ b/src/test/resources/unit/unused_outer_lexical_callback_lifetime.t
@@ -0,0 +1,35 @@
+use strict;
+use warnings;
+use Test::More;
+use Scalar::Util qw(weaken);
+
+our $destroyed;
+our @callbacks;
+
+{
+    package UnusedOuterLexicalLifetime::Owner;
+    sub DESTROY { $main::destroyed++ }
+}
+
+$destroyed = 0;
+{
+    my $owner = bless {}, 'UnusedOuterLexicalLifetime::Owner';
+    my $weak_owner = $owner;
+    weaken($weak_owner);
+
+    my $register_callback = sub {
+        my $controller = shift;
+        push @main::callbacks, sub {
+            my $event = shift;
+            return $event;
+        };
+    };
+
+    $register_callback->($owner);
+    undef $owner;
+    is($destroyed, 1, 'owner is destroyed when callback does not use outer lexical');
+    ok(!defined($weak_owner), 'stored callback does not retain unrelated outer object');
+}
+
+is($callbacks[0]->('finished'), 'finished', 'stored callback remains callable');
+done_testing;

From 3190be80d4cce96eadf213b1e6272fc1301e8f71 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 03:35:05 +0200
Subject: [PATCH 021/317] test: keep WebSocket lifetime regression
 deterministic

Limit the WebSocket callback lifetime check to the first pushed message,
which exercises the retained callback without relying on further messages
after the test client closes the connection. Keep the controller destruction
assertion for the long-poll response.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../resources/unit/mojolicious_websocket_callback_lifetime.t   | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/test/resources/unit/mojolicious_websocket_callback_lifetime.t b/src/test/resources/unit/mojolicious_websocket_callback_lifetime.t
index 0503580bcd..a17ce3aa08 100644
--- a/src/test/resources/unit/mojolicious_websocket_callback_lifetime.t
+++ b/src/test/resources/unit/mojolicious_websocket_callback_lifetime.t
@@ -59,8 +59,7 @@ get '/suspended' => sub {
 };
 
 my $t = Test::Mojo->new;
-$t->websocket_ok('/push')->message_ok->message_is('push');
-$t->message_ok->message_is('push')->message_ok->message_is('push')->finish_ok;
+$t->websocket_ok('/push')->message_ok->message_is('push')->finish_ok;
 $t->get_ok('/plugin/upper_case')->status_is(200)->content_is('WELCOME aboard!');
 $t->get_ok('/plugin/camel_case')->status_is(200)->content_is('Welcome aboard!');
 $t->get_ok('/staged' => {'X-Pass' => 1})->status_is(200)->content_is('Welcome aboard!');

From 8695ec62b286e7d1613513122c2911ef7e4c6911 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 03:56:56 +0200
Subject: [PATCH 022/317] test: exercise repeated WebSocket callback delivery

Keep all three server-push assertions in one Test::Mojo chain. This preserves
the recurring callback lifetime coverage while avoiding a connection close
between separate test chains.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../resources/unit/mojolicious_websocket_callback_lifetime.t | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/test/resources/unit/mojolicious_websocket_callback_lifetime.t b/src/test/resources/unit/mojolicious_websocket_callback_lifetime.t
index a17ce3aa08..a6c545e129 100644
--- a/src/test/resources/unit/mojolicious_websocket_callback_lifetime.t
+++ b/src/test/resources/unit/mojolicious_websocket_callback_lifetime.t
@@ -59,7 +59,10 @@ get '/suspended' => sub {
 };
 
 my $t = Test::Mojo->new;
-$t->websocket_ok('/push')->message_ok->message_is('push')->finish_ok;
+$t->websocket_ok('/push')
+  ->message_ok->message_is('push')
+  ->message_ok->message_is('push')
+  ->message_ok->message_is('push')->finish_ok;
 $t->get_ok('/plugin/upper_case')->status_is(200)->content_is('WELCOME aboard!');
 $t->get_ok('/plugin/camel_case')->status_is(200)->content_is('Welcome aboard!');
 $t->get_ok('/staged' => {'X-Pass' => 1})->status_is(200)->content_is('Welcome aboard!');

From c81f5c28ec95ced4e67086fc197b8b2cb41154e1 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 06:33:03 +0200
Subject: [PATCH 023/317] wip: snapshot array owner slot work before review

Preserve the in-progress ownership implementation and regression test while
reviewing and validating the changes.

Generated with Codex (https://openai.com/codex)
Co-Authored-By: Codex <codex@openai.com>
---
 .../runtime/runtimetypes/MortalList.java      |   1 +
 .../runtime/runtimetypes/PerlOwnerSlot.java   |  11 +-
 .../runtime/runtimetypes/RuntimeArray.java    | 230 +++++++++++++++++-
 .../runtime/runtimetypes/RuntimeBase.java     |   5 +
 .../runtime/runtimetypes/RuntimeScalar.java   |  30 +++
 .../RuntimeArrayElementOwnershipTest.java     |  99 ++++++++
 6 files changed, 364 insertions(+), 12 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 263fe0e16b..6d8e06042e 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -767,6 +767,7 @@ public static void scopeExitCleanupArray(RuntimeArray arr, RuntimeBase returned)
         // must not retain this Java RuntimeArray merely through its backing
         // reference.  A real escaped \@array has refCount > 0 above.
         arr.orphanArraySizeLvalues();
+        arr.releaseArrayElementOwnerSlots();
         if (!arr.elementsAliased) {
             for (RuntimeScalar elem : arr.elements) {
                 if (returned == null) RuntimeScalar.releaseIoOwner(elem);
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
index c6c1921a3a..af015ee18c 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
@@ -18,7 +18,8 @@ public final class PerlOwnerSlot {
 
     public enum Kind {
         CLOSURE_PAD,
-        HASH_ENTRY
+        HASH_ENTRY,
+        ARRAY_ELEMENT
     }
 
     private final Kind kind;
@@ -143,6 +144,14 @@ public synchronized void acquireHashEntry(RuntimeBase target) {
         transferTo(target);
     }
 
+    /** Attach this stable array-element slot to its current direct referent. */
+    public synchronized void acquireArrayElement(RuntimeBase target) {
+        if (kind != Kind.ARRAY_ELEMENT) {
+            throw new IllegalStateException("array-element acquisition requires an ARRAY_ELEMENT slot");
+        }
+        transferTo(target);
+    }
+
     /** Queue one closure-pad count release and retain its slot provenance. */
     public synchronized PendingRelease deferLegacyCaptureRelease(RuntimeBase target) {
         if (legacyCaptureCount <= 0) return null;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
index 369ecc7732..4eac36675a 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
@@ -116,6 +116,8 @@ void endScalarLocalElement() {
     // while mutating ops such as unshift can insert new counted elements that
     // this array must release during tail-call/scope cleanup.
     public Set<RuntimeScalar> ownedAliasElements;
+    /** Stable semantic identities for direct referents held by owning elements. */
+    private List<PerlOwnerSlot> arrayElementOwnerSlots;
     // Internal one-shot array used to materialize the RHS of list assignment.
     // Its elements are expression temporaries, not durable array-owned slots.
     boolean transientListAssignmentRhs;
@@ -175,6 +177,7 @@ private RuntimeArrayElementList newElementList(List<RuntimeScalar> values) {
     }
 
     void resetElementListAfterAutovivification() {
+        releaseArrayElementOwnerSlots();
         elements = newElementList();
     }
 
@@ -190,6 +193,7 @@ Object snapshotRegexMutationState() {
     void restoreRegexMutationState(Object token) {
         if (!(token instanceof RegexMutationState state)) return;
         deferElementsAddedSince(state.elements);
+        releaseArrayElementOwnerSlots();
         elements = newElementList(state.elements);
         type = state.type;
         strictAutovivify = state.strictAutovivify;
@@ -199,6 +203,7 @@ void restoreRegexMutationState(Object token) {
         ownedAliasElements = state.ownedAliasElements == null ? null
                 : Collections.newSetFromMap(new IdentityHashMap<>());
         if (ownedAliasElements != null) ownedAliasElements.addAll(state.ownedAliasElements);
+        reconcileArrayElementOwnerSlots();
         blessId = state.blessId;
         markPackageRootedValues(0);
     }
@@ -248,6 +253,7 @@ public boolean add(RuntimeScalar value) {
             if (value != null) value.markContainerOwner(owner);
             owner.markPackageRootedValue(value);
             boolean changed = super.add(value);
+            if (changed) owner.arrayElementAdded(size() - 1, value);
             owner.validateIsaMutation();
             return changed;
         }
@@ -263,6 +269,7 @@ public void add(int index, RuntimeScalar element) {
             if (element != null) element.markContainerOwner(owner);
             owner.markPackageRootedValue(element);
             super.add(index, element);
+            owner.arrayElementAdded(index, element);
             owner.validateIsaMutation();
         }
 
@@ -271,11 +278,17 @@ public boolean addAll(java.util.Collection<? extends RuntimeScalar> c) {
             if (!owner.threadShared) {
                 if (!c.isEmpty()) owner.noteIsaMutation();
                 owner.notePackageRootMutationIf(owner.hasRootEdge(c));
-                for (RuntimeScalar value : c) {
+                List<RuntimeScalar> added = new ArrayList<>(c);
+                for (RuntimeScalar value : added) {
                     if (value != null) value.markContainerOwner(owner);
                     owner.markPackageRootedValue(value);
                 }
-                boolean changed = super.addAll(c);
+                boolean changed = super.addAll(added);
+                if (changed) {
+                    int start = size() - added.size();
+                    int index = start;
+                    for (RuntimeScalar value : added) owner.arrayElementAdded(index++, value);
+                }
                 if (changed) owner.validateIsaMutation();
                 return changed;
             }
@@ -292,11 +305,16 @@ public boolean addAll(int index, java.util.Collection<? extends RuntimeScalar> c
             if (!owner.threadShared) {
                 if (!c.isEmpty()) owner.noteIsaMutation();
                 owner.notePackageRootMutationIf(owner.hasRootEdge(c));
-                for (RuntimeScalar value : c) {
+                List<RuntimeScalar> added = new ArrayList<>(c);
+                for (RuntimeScalar value : added) {
                     if (value != null) value.markContainerOwner(owner);
                     owner.markPackageRootedValue(value);
                 }
-                boolean changed = super.addAll(index, c);
+                boolean changed = super.addAll(index, added);
+                if (changed) {
+                    int insertAt = index;
+                    for (RuntimeScalar value : added) owner.arrayElementAdded(insertAt++, value);
+                }
                 if (changed) owner.validateIsaMutation();
                 return changed;
             }
@@ -321,6 +339,7 @@ public RuntimeScalar set(int index, RuntimeScalar element) {
             if (element != null) element.markContainerOwner(owner);
             owner.markPackageRootedValue(element);
             RuntimeScalar result = super.set(index, element);
+            owner.arrayElementReplaced(index, previous, element);
             owner.validateIsaMutation();
             return result;
         }
@@ -328,6 +347,7 @@ public RuntimeScalar set(int index, RuntimeScalar element) {
         @Override
         public RuntimeScalar remove(int index) {
             RuntimeScalar previous = super.remove(index);
+            owner.arrayElementRemoved(index, previous);
             owner.noteIsaMutation();
             owner.notePackageRootMutation(previous, null);
             owner.validateIsaMutation();
@@ -336,13 +356,10 @@ public RuntimeScalar remove(int index) {
 
         @Override
         public boolean remove(Object o) {
-            boolean removed = super.remove(o);
-            if (removed && o instanceof RuntimeScalar scalar) {
-                owner.noteIsaMutation();
-                owner.notePackageRootMutation(scalar, null);
-                owner.validateIsaMutation();
-            }
-            return removed;
+            int index = indexOf(o);
+            if (index < 0) return false;
+            remove(index);
+            return true;
         }
 
         @Override
@@ -350,10 +367,59 @@ public void clear() {
             if (!isEmpty()) {
                 owner.noteIsaMutation();
                 owner.notePackageRootClear(this);
+                owner.arrayElementsCleared(this);
             }
             super.clear();
             owner.validateIsaMutation();
         }
+
+        @Override
+        protected void removeRange(int fromIndex, int toIndex) {
+            if (fromIndex == toIndex) return;
+            List<RuntimeScalar> removed = new ArrayList<>(subList(fromIndex, toIndex));
+            owner.noteIsaMutation();
+            owner.notePackageRootClear(removed);
+            super.removeRange(fromIndex, toIndex);
+            owner.arrayElementsRemoved(fromIndex, removed);
+            owner.validateIsaMutation();
+        }
+
+        @Override
+        public boolean removeIf(java.util.function.Predicate<? super RuntimeScalar> filter) {
+            Objects.requireNonNull(filter);
+            boolean changed = false;
+            for (int i = size() - 1; i >= 0; i--) {
+                if (filter.test(get(i))) {
+                    remove(i);
+                    changed = true;
+                }
+            }
+            return changed;
+        }
+
+        @Override
+        public boolean removeAll(java.util.Collection<?> values) {
+            Objects.requireNonNull(values);
+            return removeIf(values::contains);
+        }
+
+        @Override
+        public boolean retainAll(java.util.Collection<?> values) {
+            Objects.requireNonNull(values);
+            return removeIf(value -> !values.contains(value));
+        }
+
+        @Override
+        public void replaceAll(java.util.function.UnaryOperator<RuntimeScalar> operator) {
+            Objects.requireNonNull(operator);
+            for (int i = 0; i < size(); i++) set(i, operator.apply(get(i)));
+        }
+
+        @Override
+        public void sort(java.util.Comparator<? super RuntimeScalar> comparator) {
+            super.sort(comparator);
+            owner.reconcileArrayElementOwnerSlots();
+        }
     }
 
     /** Compact backing for the common one-argument method call plus invocant. */
@@ -609,6 +675,7 @@ public void markOwnedAliasElement(RuntimeScalar scalar) {
         }
         ownedAliasElements.add(scalar);
         elementsOwned = true;
+        reconcileArrayElementOwnerSlots();
     }
 
     public boolean ownsElement(RuntimeScalar scalar) {
@@ -617,6 +684,132 @@ public boolean ownsElement(RuntimeScalar scalar) {
         return ownedAliasElements != null && ownedAliasElements.contains(scalar);
     }
 
+    private static RuntimeBase directReferent(RuntimeScalar scalar) {
+        return scalar != null && scalar.value instanceof RuntimeBase base ? base : null;
+    }
+
+    private boolean containsElementIdentity(RuntimeScalar scalar) {
+        for (RuntimeScalar element : elements) if (element == scalar) return true;
+        return false;
+    }
+
+    private void syncArrayElementOwnerSlot(int index) {
+        if (threadShared || index < 0 || index >= elements.size()) return;
+        if (arrayElementOwnerSlots == null) {
+            if (ownsElement(elements.get(index))) reconcileArrayElementOwnerSlots();
+            return;
+        }
+        if (index >= arrayElementOwnerSlots.size()) return;
+        RuntimeScalar scalar = elements.get(index);
+        RuntimeBase referent = ownsElement(scalar) ? directReferent(scalar) : null;
+        PerlOwnerSlot slot = arrayElementOwnerSlots.get(index);
+        if (referent == null) {
+            if (slot != null) slot.release();
+            arrayElementOwnerSlots.set(index, null);
+        } else {
+            if (slot == null) {
+                slot = new PerlOwnerSlot(PerlOwnerSlot.Kind.ARRAY_ELEMENT);
+                arrayElementOwnerSlots.set(index, slot);
+            }
+            slot.acquireArrayElement(referent);
+        }
+    }
+
+    void reconcileArrayElementOwnerSlots() {
+        if (threadShared || !elementsOwned) {
+            releaseArrayElementOwnerSlots();
+            return;
+        }
+        if (arrayElementOwnerSlots == null) {
+            arrayElementOwnerSlots = new ArrayList<>(Collections.nCopies(elements.size(), null));
+        } else if (arrayElementOwnerSlots.size() < elements.size()) {
+            arrayElementOwnerSlots.addAll(Collections.nCopies(
+                    elements.size() - arrayElementOwnerSlots.size(), null));
+        } else if (arrayElementOwnerSlots.size() > elements.size()) {
+            for (int i = arrayElementOwnerSlots.size() - 1; i >= elements.size(); i--) {
+                PerlOwnerSlot slot = arrayElementOwnerSlots.remove(i);
+                if (slot != null) slot.release();
+            }
+        }
+        for (int i = 0; i < elements.size(); i++) syncArrayElementOwnerSlot(i);
+    }
+
+    private void arrayElementAdded(int index, RuntimeScalar scalar) {
+        if (scalar != null) scalar.markArrayContainerOwner(this);
+        if (threadShared) return;
+        if (arrayElementOwnerSlots == null) {
+            if (ownsElement(scalar)) reconcileArrayElementOwnerSlots();
+            return;
+        }
+        arrayElementOwnerSlots.add(index, null);
+        syncArrayElementOwnerSlot(index);
+    }
+
+    private void arrayElementReplaced(int index, RuntimeScalar previous, RuntimeScalar scalar) {
+        if (scalar != null) scalar.markArrayContainerOwner(this);
+        if (previous != null && previous != scalar && !containsElementIdentity(previous)) {
+            previous.unmarkArrayContainerOwner(this);
+        }
+        syncArrayElementOwnerSlot(index);
+    }
+
+    private void arrayElementRemoved(int index, RuntimeScalar previous) {
+        if (arrayElementOwnerSlots != null && !threadShared
+                && index >= 0 && index < arrayElementOwnerSlots.size()) {
+            PerlOwnerSlot slot = arrayElementOwnerSlots.remove(index);
+            if (slot != null) slot.release();
+        }
+        if (previous != null && !containsElementIdentity(previous)) {
+            previous.unmarkArrayContainerOwner(this);
+        }
+    }
+
+    private void arrayElementsRemoved(int startIndex, List<RuntimeScalar> removed) {
+        if (arrayElementOwnerSlots != null && !threadShared) {
+            for (int i = removed.size() - 1; i >= 0; i--) {
+                int index = startIndex + i;
+                if (index < arrayElementOwnerSlots.size()) {
+                    PerlOwnerSlot slot = arrayElementOwnerSlots.remove(index);
+                    if (slot != null) slot.release();
+                }
+            }
+        }
+        for (RuntimeScalar scalar : removed) {
+            if (scalar != null && !containsElementIdentity(scalar)) {
+                scalar.unmarkArrayContainerOwner(this);
+            }
+        }
+    }
+
+    private void arrayElementsCleared(List<RuntimeScalar> removed) {
+        releaseArrayElementOwnerSlots();
+        Set<RuntimeScalar> unique = Collections.newSetFromMap(new IdentityHashMap<>());
+        unique.addAll(removed);
+        for (RuntimeScalar scalar : unique) {
+            if (scalar != null) scalar.unmarkArrayContainerOwner(this);
+        }
+    }
+
+    void updateArrayElementOwnersForScalar(RuntimeScalar scalar) {
+        if (threadShared || arrayElementOwnerSlots == null) return;
+        for (int i = 0; i < elements.size(); i++) {
+            if (elements.get(i) == scalar) syncArrayElementOwnerSlot(i);
+        }
+    }
+
+    void releaseArrayElementOwnerSlots() {
+        if (arrayElementOwnerSlots == null) return;
+        for (PerlOwnerSlot slot : arrayElementOwnerSlots) {
+            if (slot != null) slot.release();
+        }
+        arrayElementOwnerSlots = null;
+    }
+
+    PerlOwnerSlot arrayElementOwnerSlot(int index) {
+        return arrayElementOwnerSlots == null || index < 0 || index >= arrayElementOwnerSlots.size()
+                ? null : arrayElementOwnerSlots.get(index);
+    }
+
     public void forgetOwnedAliasElement(RuntimeScalar scalar) {
         if (ownedAliasElements == null || scalar == null) return;
         ownedAliasElements.remove(scalar);
@@ -626,6 +819,7 @@ public void forgetOwnedAliasElement(RuntimeScalar scalar) {
                 elementsOwned = false;
             }
         }
+        reconcileArrayElementOwnerSlots();
     }
 
     /**
@@ -811,6 +1005,7 @@ public static RuntimeScalar push(RuntimeArray runtimeArray, RuntimeBase value) {
                     runtimeArray.elementsAliased = false;
                     runtimeArray.ownedAliasElements = null;
                 }
+                runtimeArray.reconcileArrayElementOwnerSlots();
                 yield getScalarInt(runtimeArray.elements.size());
             }
             case AUTOVIVIFY_ARRAY -> {
@@ -856,6 +1051,7 @@ public static RuntimeScalar unshift(RuntimeArray runtimeArray, RuntimeBase value
                     runtimeArray.elementsAliased = false;
                     runtimeArray.ownedAliasElements = null;
                 }
+                runtimeArray.reconcileArrayElementOwnerSlots();
                 yield getScalarInt(runtimeArray.elements.size());
             }
             case AUTOVIVIFY_ARRAY -> {
@@ -1602,6 +1798,9 @@ public RuntimeArray set(RuntimeScalar value) {
         this.ownedAliasElements = null;
         this.elementsAliased = false;
         this.elements.add(value);
+        this.elementsOwned = true;
+        this.elementsAliased = false;
+        reconcileArrayElementOwnerSlots();
         markPackageRootedValue(value);
         MortalList.flush();
         return this;
@@ -1664,6 +1863,7 @@ public RuntimeArray setFromList(RuntimeList list) {
                 this.elementsOwned = true;
                 this.elementsAliased = false;
                 this.ownedAliasElements = null;
+                reconcileArrayElementOwnerSlots();
 
                 // Create a new array with scalarContextSize set for assignment return value
                 // This is needed for eval context where assignment should return element count
@@ -1763,6 +1963,7 @@ public RuntimeArray setFromListAliased(RuntimeList list) {
         this.elementsOwned = false;
         this.elementsAliased = true;
         this.ownedAliasElements = null;
+        reconcileArrayElementOwnerSlots();
         return this;
     }
 
@@ -1793,6 +1994,7 @@ public RuntimeArray setFromReferenceList(RuntimeList list) {
         this.elementsOwned = false;
         this.elementsAliased = true;
         this.ownedAliasElements = null;
+        reconcileArrayElementOwnerSlots();
         return this;
     }
 
@@ -1876,6 +2078,7 @@ public RuntimeScalar createReferenceWithTrackedElements() {
         this.elementsOwned = true;
         this.elementsAliased = false;
         this.ownedAliasElements = null;
+        reconcileArrayElementOwnerSlots();
         RuntimeScalar result = new RuntimeScalar();
         result.type = RuntimeScalarType.ARRAYREFERENCE;
         result.value = this;
@@ -2207,6 +2410,7 @@ public RuntimeArray setArrayOfAlias(RuntimeArray arr) {
                 arr.elements.add(element);
             }
             arr.elementsAliased = true;
+            arr.reconcileArrayElementOwnerSlots();
             return arr;
         }
 
@@ -2232,6 +2436,7 @@ public RuntimeArray setArrayOfAlias(RuntimeArray arr) {
         }
         arr.elementsAliased = true;
         arr.elementsOwned = arr.ownedAliasElements != null && !arr.ownedAliasElements.isEmpty();
+        arr.reconcileArrayElementOwnerSlots();
         return arr;
     }
 
@@ -2260,6 +2465,7 @@ public RuntimeArray getTailCallArrayOfAlias() {
             }
         }
         this.elementsOwned = false;
+        reconcileArrayElementOwnerSlots();
         return arr;
     }
 
@@ -2288,6 +2494,8 @@ public RuntimeArray takeTailCallOwnership() {
         this.elementsOwned = false;
         carrier.elementsAliased = true;
         carrier.elementsOwned = carrier.ownedAliasElements != null && !carrier.ownedAliasElements.isEmpty();
+        reconcileArrayElementOwnerSlots();
+        carrier.reconcileArrayElementOwnerSlots();
         return carrier;
     }
 
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
index 470a472854..19814fda1a 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
@@ -346,6 +346,11 @@ public int hashSlotOwnerCount() {
         return ownerSlotCount(PerlOwnerSlot.Kind.HASH_ENTRY) + sharedHashSlotOwnerCount;
     }
 
+    /** Number of live ordinary array-element slots that directly own this referent. */
+    public int arraySlotOwnerCount() {
+        return ownerSlotCount(PerlOwnerSlot.Kind.ARRAY_ELEMENT);
+    }
+
     synchronized void adjustSharedHashSlotOwnerCount(int delta) {
         sharedHashSlotOwnerCount = Math.max(0, sharedHashSlotOwnerCount + delta);
     }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 4734e8a262..1138c0ee98 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -424,6 +424,7 @@ public int captureRefCountOwned() {
     // narrow guard for live CODE refs whose captures must survive void discard.
     RuntimeBase containerOwner;
     private List<WeakReference<RuntimeHash>> hashContainerOwners;
+    private List<WeakReference<RuntimeArray>> arrayContainerOwners;
 
     /** Return the aggregate slot that directly owns this scalar, if any. */
     public RuntimeBase getContainerOwner() {
@@ -477,6 +478,32 @@ void unmarkHashContainerOwner(RuntimeHash owner) {
         }
     }
 
+    void markArrayContainerOwner(RuntimeArray owner) {
+        if (arrayContainerOwners == null) arrayContainerOwners = new ArrayList<>();
+        arrayContainerOwners.removeIf(reference -> reference.get() == null);
+        if (arrayContainerOwners.stream().noneMatch(reference -> reference.get() == owner)) {
+            arrayContainerOwners.add(new WeakReference<>(owner));
+        }
+    }
+
+    List<RuntimeArray> arrayContainerOwnersSnapshot() {
+        if (arrayContainerOwners == null) return List.of();
+        arrayContainerOwners.removeIf(reference -> reference.get() == null);
+        List<RuntimeArray> snapshot = new ArrayList<>(arrayContainerOwners.size());
+        for (WeakReference<RuntimeArray> reference : arrayContainerOwners) {
+            RuntimeArray owner = reference.get();
+            if (owner != null) snapshot.add(owner);
+        }
+        if (arrayContainerOwners.isEmpty()) arrayContainerOwners = null;
+        return snapshot;
+    }
+
+    void unmarkArrayContainerOwner(RuntimeArray owner) {
+        if (arrayContainerOwners == null) return;
+        arrayContainerOwners.removeIf(reference -> reference.get() == null || reference.get() == owner);
+        if (arrayContainerOwners.isEmpty()) arrayContainerOwners = null;
+    }
+
     private void propagateTiedHandlerMarkerToReferent() {
         if (containerOwner != null && containerOwner.possiblyStoredInTiedHandler
                 && (type & RuntimeScalarType.REFERENCE_BIT) != 0
@@ -2864,6 +2891,9 @@ && isSocketIOHandle(oldIo.ioHandle)) {
             for (RuntimeHash owner : hashContainerOwnersSnapshot()) {
                 owner.updateHashEntryOwnersForScalar(this, oldBase, newBase);
             }
+            for (RuntimeArray owner : arrayContainerOwnersSnapshot()) {
+                owner.updateArrayElementOwnersForScalar(this);
+            }
         }
         if (this.captureCount > 0 && (this.type & RuntimeScalarType.REFERENCE_BIT) != 0
                 && this.value instanceof RuntimeBase capturedBase
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
new file mode 100644
index 0000000000..074e6de7f8
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
@@ -0,0 +1,99 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertSame;
+
+@Tag("unit")
+class RuntimeArrayElementOwnershipTest {
+    @Test
+    void elementSlotsFollowStructuralAndScalarCellMutations() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray first = new RuntimeArray();
+            RuntimeArray second = new RuntimeArray();
+            RuntimeArray third = new RuntimeArray();
+            RuntimeArray array = new RuntimeArray();
+            RuntimeScalar cell = first.createReference();
+            array.elements.add(cell);
+            array.elementsOwned = true;
+            array.reconcileArrayElementOwnerSlots();
+
+            PerlOwnerSlot slot = array.arrayElementOwnerSlot(0);
+            assertEquals(1, first.arraySlotOwnerCount());
+            assertSame(first, slot.referent());
+
+            cell.set(second.createReference());
+            assertEquals(0, first.arraySlotOwnerCount());
+            assertEquals(1, second.arraySlotOwnerCount());
+            assertSame(slot, array.arrayElementOwnerSlot(0));
+            assertSame(second, slot.referent());
+
+            array.elements.add(0, third.createReference());
+            assertEquals(1, third.arraySlotOwnerCount());
+            assertSame(slot, array.arrayElementOwnerSlot(1),
+                    "insertion moves the existing element slot without replacing its identity");
+
+            array.elements.remove(0);
+            assertEquals(0, third.arraySlotOwnerCount());
+            assertSame(slot, array.arrayElementOwnerSlot(0));
+
+            array.elements.set(0, third.createReference());
+            assertEquals(0, second.arraySlotOwnerCount());
+            assertEquals(1, third.arraySlotOwnerCount());
+            assertSame(slot, array.arrayElementOwnerSlot(0));
+            assertSame(third, slot.referent());
+
+            array.elements.clear();
+            assertEquals(0, third.arraySlotOwnerCount());
+            assertNull(array.arrayElementOwnerSlot(0));
+        }
+    }
+
+    @Test
+    void aliasedElementsDoNotOwnReferentsUnlessExplicitlyTransferred() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeArray array = new RuntimeArray();
+            RuntimeScalar cell = referent.createReference();
+            array.elements.add(cell);
+            array.elementsAliased = true;
+            array.elementsOwned = false;
+
+            assertEquals(0, referent.arraySlotOwnerCount());
+
+            array.markOwnedAliasElement(cell);
+            assertEquals(1, referent.arraySlotOwnerCount());
+            assertSame(referent, array.arrayElementOwnerSlot(0).referent());
+
+            array.forgetOwnedAliasElement(cell);
+            assertEquals(0, referent.arraySlotOwnerCount());
+            assertNull(array.arrayElementOwnerSlot(0));
+        }
+    }
+
+    @Test
+    void rangeRemovalReleasesOnlyRemovedElementSlots() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray first = new RuntimeArray();
+            RuntimeArray second = new RuntimeArray();
+            RuntimeArray array = new RuntimeArray();
+            array.elements.add(first.createReference());
+            array.elements.add(second.createReference());
+            array.elementsOwned = true;
+            array.reconcileArrayElementOwnerSlots();
+
+            PerlOwnerSlot retained = array.arrayElementOwnerSlot(1);
+            array.elements.subList(0, 1).clear();
+
+            assertEquals(0, first.arraySlotOwnerCount());
+            assertEquals(1, second.arraySlotOwnerCount());
+            assertSame(retained, array.arrayElementOwnerSlot(0));
+        }
+    }
+}

From 5872e90879f7a949deaf3100238b4d27116012e9 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 07:20:58 +0200
Subject: [PATCH 024/317] fix: avoid array slot false positives during
 destruction

Do not treat newly materialized array element slot identities as proof of
resurrection until the owning array participates in root verification. Import
Objects for the array element list's null checks.

Generated with Codex (https://openai.com/codex)
Co-Authored-By: Codex <codex@openai.com>
---
 .../perlonjava/runtime/runtimetypes/DestroyDispatch.java   | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
index 36e5c98603..21df9cd55e 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
@@ -713,7 +713,12 @@ private static boolean hasEscapedPerlOwner(RuntimeBase referent,
                         && ReachabilityWalker.isScalarReachable(owner)) return true;
             }
             for (PerlOwnerSlot ownerSlot : referent.ownerSlotSnapshot()) {
-                if (!ownerSlotsAtStart.contains(ownerSlot)) return true;
+                // Array element slots are currently diagnostic identities; the
+                // owning array is not yet part of the resurrection root check.
+                // Treating a newly materialized array slot as proof of Perl
+                // resurrection misclassifies destructor-local array writes.
+                if (!ownerSlotsAtStart.contains(ownerSlot)
+                        && ownerSlot.kind() != PerlOwnerSlot.Kind.ARRAY_ELEMENT) return true;
             }
             return false;
         }

From 17e6d9d4726235d84afa7369543c11919aad574f Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 08:03:29 +0200
Subject: [PATCH 025/317] debug: label closure variables in reachability paths

Include lexical names and closure source locations in diagnostic root paths so
interpreter lifetime traces identify the callback that retains an object.

Generated with Codex (https://openai.com/codex)
Co-Authored-By: Codex <codex@openai.com>
---
 .../runtime/runtimetypes/ReachabilityWalker.java      | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 06d13a5b5a..b1e9c545ca 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -747,6 +747,11 @@ public static java.util.List<String> findPathTo(RuntimeBase target, boolean skip
                         : NameNormalizer.getBlessStr(ownerReferent.blessId);
                 String ownerLabel = "<owner-slot#" + (ownerIdx++) + ":" + ownerClass
                         + "@" + System.identityHashCode(ownerReferent) + ">";
+                if (ownerReferent instanceof RuntimeCode code) {
+                    ownerLabel = "<owner-slot#" + (ownerIdx - 1) + ":"
+                            + code.packageName + "::" + code.subName + "@"
+                            + code.cvStartFile + ":" + code.cvStartLine + ">";
+                }
                 if (howReached.putIfAbsent(ownerReferent, ownerLabel) == null) {
                     todo.add(ownerReferent);
                 }
@@ -793,8 +798,10 @@ public static java.util.List<String> findPathTo(RuntimeBase target, boolean skip
                 }
                 if (code.closedOverVariables != null) {
                     int i = 0;
-                    for (RuntimeBase captured : code.closedOverVariables.values()) {
-                        String path = curPath + "<closed-over#" + (i++) + ">";
+                    for (Map.Entry<String, RuntimeBase> entry : code.closedOverVariables.entrySet()) {
+                        RuntimeBase captured = entry.getValue();
+                        String path = curPath + "<closed-over " + entry.getKey()
+                                + "#" + (i++) + ">";
                         if (captured instanceof RuntimeScalar scalar) {
                             visitScalarPath(scalar, path, howReached, todo);
                         } else if (captured != null

From 70719fe111d2e4ba86408ba98efc865829800c90 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 10:09:36 +0200
Subject: [PATCH 026/317] fix: stop rooting released closure capture metadata

Exclude closed-over variable metadata from reachability after the closure's
capture owners have been released. Add regression coverage for live and
released captures and preserve the lifecycle flag when cloning code objects.

Refs #1649, #1794, #1795

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtimetypes/ReachabilityWalker.java      | 20 ++++++++----
 .../runtime/runtimetypes/RuntimeCode.java     |  5 +++
 .../runtimetypes/RuntimeGraphCloner.java      |  1 +
 .../RuntimeCodeScopeExitReachabilityTest.java | 32 +++++++++++++++++++
 4 files changed, 51 insertions(+), 7 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index b1e9c545ca..9b2311a8e4 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -331,7 +331,7 @@ private void bfsEndBlockRoots(java.util.ArrayDeque<RuntimeBase> todo) {
             } else if (cur instanceof RuntimeCode code) {
                 visitCodePadConstants(code, todo);
                 visitCodeStateVariables(code, todo);
-                if (code.closedOverVariables != null) {
+                if (hasActiveClosedOverVariables(code)) {
                     for (RuntimeBase captured : code.closedOverVariables.values()) {
                         addReachable(captured, todo);
                         if (captured instanceof RuntimeScalar scalar) {
@@ -449,7 +449,7 @@ static boolean hasWalkableCodeEdges(RuntimeCode code, boolean walkCaptures) {
         if (!walkCaptures && !WeakRefRegistry.hasWeakRefsTo(code)) return false;
         if ((code.capturedScalars != null && code.capturedScalars.length != 0)
                 || (code.capturedAggregates != null && code.capturedAggregates.length != 0)
-                || (code.closedOverVariables != null && !code.closedOverVariables.isEmpty())) {
+                || hasActiveClosedOverVariables(code)) {
             return true;
         }
         if (!code.captureFieldsRecorded) {
@@ -464,6 +464,12 @@ static boolean hasWalkableCodeEdges(RuntimeCode code, boolean walkCaptures) {
                 && interpreted.capturedVars.length != 0;
     }
 
+    private static boolean hasActiveClosedOverVariables(RuntimeCode code) {
+        return !code.captureOwnersReleased
+                && code.closedOverVariables != null
+                && !code.closedOverVariables.isEmpty();
+    }
+
     /**
      * Terminal installed CODE refs remain roots, but storing each one in the
      * per-sweep identity set is redundant. Expose them through a union view so
@@ -796,7 +802,7 @@ public static java.util.List<String> findPathTo(RuntimeBase target, boolean skip
                     String path = curPath + "<state " + state.getKey() + ">";
                     if (howReached.putIfAbsent(state.getValue(), path) == null) todo.add(state.getValue());
                 }
-                if (code.closedOverVariables != null) {
+                if (hasActiveClosedOverVariables(code)) {
                     int i = 0;
                     for (Map.Entry<String, RuntimeBase> entry : code.closedOverVariables.entrySet()) {
                         RuntimeBase captured = entry.getValue();
@@ -1652,7 +1658,7 @@ public static boolean isScalarReachable(RuntimeScalar target) {
                         && sc.value instanceof RuntimeBase rb
                         && seen.add(rb)) todo.addLast(rb);
             } else if (cur instanceof RuntimeCode code) {
-                if (code.closedOverVariables != null) {
+                if (hasActiveClosedOverVariables(code)) {
                     for (RuntimeBase captured : code.closedOverVariables.values()) {
                         if (captured == null) continue;
                         if (captured instanceof RuntimeScalar scalar
@@ -1847,7 +1853,7 @@ private static ScalarRootReachabilitySnapshot scalarReachabilitySnapshot(
                     addScalarReachabilityEdge(state, seen,
                             reachableScalars, todo, stats, true, false);
                 }
-                if (code.closedOverVariables != null) {
+                if (hasActiveClosedOverVariables(code)) {
                     for (RuntimeBase captured : code.closedOverVariables.values()) {
                         if (stats != null) stats.edgesInspected++;
                         if (captured instanceof RuntimeScalar scalar
@@ -2109,7 +2115,7 @@ && followScalar(tieHash.getSelf(), target, seen, todo)) {
                             if (captured == target) return true;
                         }
                     }
-                    if (callback.closedOverVariables != null) {
+                    if (hasActiveClosedOverVariables(callback)) {
                         for (RuntimeBase captured : callback.closedOverVariables.values()) {
                             if (!budget.visitEdge()) break walk;
                             if (stats != null) stats.edgesInspected++;
@@ -2714,7 +2720,7 @@ private static boolean followGlobalCodeCaptures(RuntimeCode code, RuntimeBase ta
         // whether a suspended async sub's returning Future is still owned by
         // a live closure; reflective/capture arrays are not guaranteed to
         // expose that ownership on every backend.
-        if (code.closedOverVariables != null) {
+        if (hasActiveClosedOverVariables(code)) {
             for (RuntimeBase captured : code.closedOverVariables.values()) {
                 if (budget != null && !budget.visitEdge()) return false;
                 if (captured == null) continue;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
index 93e342dca3..14078a3b51 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
@@ -2576,6 +2576,9 @@ void restoreClonedSelfReference(RuntimeScalar selfRef) {
     /** Generated closure fields were copied into capturedScalars/aggregates. */
     public boolean captureFieldsRecorded;
 
+    /** Capture bookkeeping has been released; closedOverVariables is metadata only. */
+    public boolean captureOwnersReleased;
+
     /**
      * Captured aggregate lexicals (arrays/hashes). Their element cleanup is
      * deferred while the closure keeps the aggregate alive.
@@ -2868,6 +2871,7 @@ public static boolean isInstalledPadConstant(RuntimeBase target) {
      * captures, those are released recursively.
      */
     public void releaseCaptures() {
+        captureOwnersReleased = true;
         if (capturedScalars != null) {
             RuntimeScalar[] scalars = capturedScalars;
             capturedScalars = null;  // null out first to prevent re-entry
@@ -3805,6 +3809,7 @@ public void adoptDefinitionFrom(RuntimeCode codeFrom) {
         this.capturedScalars = codeFrom.capturedScalars;
         this.capturedAggregates = codeFrom.capturedAggregates;
         this.captureFieldsRecorded = codeFrom.captureFieldsRecorded;
+        this.captureOwnersReleased = codeFrom.captureOwnersReleased;
         this.capturedAggregateOwnerSlots = codeFrom.capturedAggregateOwnerSlots;
         this.closedOverVariables = codeFrom.closedOverVariables;
         this.lexicalVariableNames = codeFrom.lexicalVariableNames;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java
index d7f02304e2..dd040959c3 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java
@@ -403,6 +403,7 @@ private void copyCodeMetadata(RuntimeCode source, RuntimeCode target) {
         target.declaredOurVariables = source.declaredOurVariables == null
                 ? null : new java.util.LinkedHashMap<>(source.declaredOurVariables);
         target.stateVariableInitialized = new java.util.HashMap<>(source.stateVariableInitialized);
+        target.captureOwnersReleased = source.captureOwnersReleased;
         target.stateVariable = cloneScalarMap(source.stateVariable);
         target.stateArray = cloneArrayMap(source.stateArray);
         target.stateHash = cloneHashMap(source.stateHash);
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
index 659e81ac50..2663a8a91d 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
@@ -8,6 +8,8 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 
 @Tag("unit")
 class RuntimeCodeScopeExitReachabilityTest {
@@ -84,4 +86,34 @@ void deferredReleaseRetainsCapturesForCodeStoredInReachableHashWithoutWeakRefs()
             }
         }
     }
+
+    @Test
+    void releasedClosureMetadataDoesNotRemainASemanticRoot() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeBase capturedReferent = new RuntimeHash();
+            RuntimeScalar captured = new RuntimeScalar(capturedReferent);
+            captured.retainClosureCapture();
+            RuntimeCode callback = new RuntimeCode(null, List.of());
+            callback.capturedScalars = new RuntimeScalar[] { captured };
+            callback.closedOverVariables = java.util.Map.of("self", captured);
+
+            RuntimeHash callbacks = new RuntimeHash();
+            callbacks.elements.put("callback", new RuntimeScalar(callback));
+            String globalName = "RuntimeCodeScopeExitReachabilityTest::releasedMetadata";
+            GlobalVariable.globalHashes.put(globalName, callbacks);
+
+            try {
+                assertTrue(ReachabilityWalker.isScalarReachable(captured),
+                        "a live code owner must keep its lexical capture reachable");
+
+                callback.releaseCaptures();
+
+                assertFalse(ReachabilityWalker.isScalarReachable(captured),
+                        "closed-over debug metadata must not retain a released lexical capture");
+            } finally {
+                GlobalVariable.globalHashes.remove(globalName);
+            }
+        }
+    }
 }

From 10b28c03394885f0933b215dc9d9cf2604bd9b4e Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 10:17:56 +0200
Subject: [PATCH 027/317] Revert "fix: stop rooting released closure capture
 metadata"

This reverts commit 33f16e1efa9463c3b710a47ebd9aba0d874bb0bf.
---
 .../runtimetypes/ReachabilityWalker.java      | 20 ++++--------
 .../runtime/runtimetypes/RuntimeCode.java     |  5 ---
 .../runtimetypes/RuntimeGraphCloner.java      |  1 -
 .../RuntimeCodeScopeExitReachabilityTest.java | 32 -------------------
 4 files changed, 7 insertions(+), 51 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 9b2311a8e4..b1e9c545ca 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -331,7 +331,7 @@ private void bfsEndBlockRoots(java.util.ArrayDeque<RuntimeBase> todo) {
             } else if (cur instanceof RuntimeCode code) {
                 visitCodePadConstants(code, todo);
                 visitCodeStateVariables(code, todo);
-                if (hasActiveClosedOverVariables(code)) {
+                if (code.closedOverVariables != null) {
                     for (RuntimeBase captured : code.closedOverVariables.values()) {
                         addReachable(captured, todo);
                         if (captured instanceof RuntimeScalar scalar) {
@@ -449,7 +449,7 @@ static boolean hasWalkableCodeEdges(RuntimeCode code, boolean walkCaptures) {
         if (!walkCaptures && !WeakRefRegistry.hasWeakRefsTo(code)) return false;
         if ((code.capturedScalars != null && code.capturedScalars.length != 0)
                 || (code.capturedAggregates != null && code.capturedAggregates.length != 0)
-                || hasActiveClosedOverVariables(code)) {
+                || (code.closedOverVariables != null && !code.closedOverVariables.isEmpty())) {
             return true;
         }
         if (!code.captureFieldsRecorded) {
@@ -464,12 +464,6 @@ static boolean hasWalkableCodeEdges(RuntimeCode code, boolean walkCaptures) {
                 && interpreted.capturedVars.length != 0;
     }
 
-    private static boolean hasActiveClosedOverVariables(RuntimeCode code) {
-        return !code.captureOwnersReleased
-                && code.closedOverVariables != null
-                && !code.closedOverVariables.isEmpty();
-    }
-
     /**
      * Terminal installed CODE refs remain roots, but storing each one in the
      * per-sweep identity set is redundant. Expose them through a union view so
@@ -802,7 +796,7 @@ public static java.util.List<String> findPathTo(RuntimeBase target, boolean skip
                     String path = curPath + "<state " + state.getKey() + ">";
                     if (howReached.putIfAbsent(state.getValue(), path) == null) todo.add(state.getValue());
                 }
-                if (hasActiveClosedOverVariables(code)) {
+                if (code.closedOverVariables != null) {
                     int i = 0;
                     for (Map.Entry<String, RuntimeBase> entry : code.closedOverVariables.entrySet()) {
                         RuntimeBase captured = entry.getValue();
@@ -1658,7 +1652,7 @@ public static boolean isScalarReachable(RuntimeScalar target) {
                         && sc.value instanceof RuntimeBase rb
                         && seen.add(rb)) todo.addLast(rb);
             } else if (cur instanceof RuntimeCode code) {
-                if (hasActiveClosedOverVariables(code)) {
+                if (code.closedOverVariables != null) {
                     for (RuntimeBase captured : code.closedOverVariables.values()) {
                         if (captured == null) continue;
                         if (captured instanceof RuntimeScalar scalar
@@ -1853,7 +1847,7 @@ private static ScalarRootReachabilitySnapshot scalarReachabilitySnapshot(
                     addScalarReachabilityEdge(state, seen,
                             reachableScalars, todo, stats, true, false);
                 }
-                if (hasActiveClosedOverVariables(code)) {
+                if (code.closedOverVariables != null) {
                     for (RuntimeBase captured : code.closedOverVariables.values()) {
                         if (stats != null) stats.edgesInspected++;
                         if (captured instanceof RuntimeScalar scalar
@@ -2115,7 +2109,7 @@ && followScalar(tieHash.getSelf(), target, seen, todo)) {
                             if (captured == target) return true;
                         }
                     }
-                    if (hasActiveClosedOverVariables(callback)) {
+                    if (callback.closedOverVariables != null) {
                         for (RuntimeBase captured : callback.closedOverVariables.values()) {
                             if (!budget.visitEdge()) break walk;
                             if (stats != null) stats.edgesInspected++;
@@ -2720,7 +2714,7 @@ private static boolean followGlobalCodeCaptures(RuntimeCode code, RuntimeBase ta
         // whether a suspended async sub's returning Future is still owned by
         // a live closure; reflective/capture arrays are not guaranteed to
         // expose that ownership on every backend.
-        if (hasActiveClosedOverVariables(code)) {
+        if (code.closedOverVariables != null) {
             for (RuntimeBase captured : code.closedOverVariables.values()) {
                 if (budget != null && !budget.visitEdge()) return false;
                 if (captured == null) continue;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
index 14078a3b51..93e342dca3 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
@@ -2576,9 +2576,6 @@ void restoreClonedSelfReference(RuntimeScalar selfRef) {
     /** Generated closure fields were copied into capturedScalars/aggregates. */
     public boolean captureFieldsRecorded;
 
-    /** Capture bookkeeping has been released; closedOverVariables is metadata only. */
-    public boolean captureOwnersReleased;
-
     /**
      * Captured aggregate lexicals (arrays/hashes). Their element cleanup is
      * deferred while the closure keeps the aggregate alive.
@@ -2871,7 +2868,6 @@ public static boolean isInstalledPadConstant(RuntimeBase target) {
      * captures, those are released recursively.
      */
     public void releaseCaptures() {
-        captureOwnersReleased = true;
         if (capturedScalars != null) {
             RuntimeScalar[] scalars = capturedScalars;
             capturedScalars = null;  // null out first to prevent re-entry
@@ -3809,7 +3805,6 @@ public void adoptDefinitionFrom(RuntimeCode codeFrom) {
         this.capturedScalars = codeFrom.capturedScalars;
         this.capturedAggregates = codeFrom.capturedAggregates;
         this.captureFieldsRecorded = codeFrom.captureFieldsRecorded;
-        this.captureOwnersReleased = codeFrom.captureOwnersReleased;
         this.capturedAggregateOwnerSlots = codeFrom.capturedAggregateOwnerSlots;
         this.closedOverVariables = codeFrom.closedOverVariables;
         this.lexicalVariableNames = codeFrom.lexicalVariableNames;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java
index dd040959c3..d7f02304e2 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java
@@ -403,7 +403,6 @@ private void copyCodeMetadata(RuntimeCode source, RuntimeCode target) {
         target.declaredOurVariables = source.declaredOurVariables == null
                 ? null : new java.util.LinkedHashMap<>(source.declaredOurVariables);
         target.stateVariableInitialized = new java.util.HashMap<>(source.stateVariableInitialized);
-        target.captureOwnersReleased = source.captureOwnersReleased;
         target.stateVariable = cloneScalarMap(source.stateVariable);
         target.stateArray = cloneArrayMap(source.stateArray);
         target.stateHash = cloneHashMap(source.stateHash);
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
index 2663a8a91d..659e81ac50 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
@@ -8,8 +8,6 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
 
 @Tag("unit")
 class RuntimeCodeScopeExitReachabilityTest {
@@ -86,34 +84,4 @@ void deferredReleaseRetainsCapturesForCodeStoredInReachableHashWithoutWeakRefs()
             }
         }
     }
-
-    @Test
-    void releasedClosureMetadataDoesNotRemainASemanticRoot() {
-        PerlRuntime runtime = new PerlRuntime();
-        try (PerlRuntime.Binding ignored = runtime.bind()) {
-            RuntimeBase capturedReferent = new RuntimeHash();
-            RuntimeScalar captured = new RuntimeScalar(capturedReferent);
-            captured.retainClosureCapture();
-            RuntimeCode callback = new RuntimeCode(null, List.of());
-            callback.capturedScalars = new RuntimeScalar[] { captured };
-            callback.closedOverVariables = java.util.Map.of("self", captured);
-
-            RuntimeHash callbacks = new RuntimeHash();
-            callbacks.elements.put("callback", new RuntimeScalar(callback));
-            String globalName = "RuntimeCodeScopeExitReachabilityTest::releasedMetadata";
-            GlobalVariable.globalHashes.put(globalName, callbacks);
-
-            try {
-                assertTrue(ReachabilityWalker.isScalarReachable(captured),
-                        "a live code owner must keep its lexical capture reachable");
-
-                callback.releaseCaptures();
-
-                assertFalse(ReachabilityWalker.isScalarReachable(captured),
-                        "closed-over debug metadata must not retain a released lexical capture");
-            } finally {
-                GlobalVariable.globalHashes.remove(globalName);
-            }
-        }
-    }
 }

From 34916190b5aea337b161776c616cdc9c55aa180a Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 14:44:44 +0200
Subject: [PATCH 028/317] wip: track closure pad owner edges for reachability

Associate captured aggregate pad slots with their owning closure and follow
those pads from live RuntimeCode roots. Add focused coverage for rooted and
unrooted closure capture graphs.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../bytecode/OpcodeHandlerExtended.java       |   2 +-
 .../frontend/parser/SubroutineParser.java     |   2 +-
 .../runtime/perlmodule/Internals.java         |   3 +-
 .../runtime/runtimetypes/PerlOwnerSlot.java   |  11 ++
 .../runtime/runtimetypes/PerlRuntime.java     |  16 ++
 .../runtimetypes/ReachabilityWalker.java      | 163 +++++++++++++++---
 .../runtime/runtimetypes/RuntimeBase.java     |  22 ++-
 .../runtime/runtimetypes/RuntimeCode.java     |   2 +-
 .../runtimetypes/RuntimeGraphCloner.java      |   2 +-
 ...ityWalkerCapturedAggregateReleaseTest.java |  33 ++++
 .../unit/refcount/owner_trace_snapshot.t      |   4 +-
 11 files changed, 231 insertions(+), 29 deletions(-)

diff --git a/src/main/java/org/perlonjava/backend/bytecode/OpcodeHandlerExtended.java b/src/main/java/org/perlonjava/backend/bytecode/OpcodeHandlerExtended.java
index b8249d1ef9..f27dfd7bf8 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/OpcodeHandlerExtended.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/OpcodeHandlerExtended.java
@@ -1111,7 +1111,7 @@ public static int executeCreateClosure(int[] bytecode, int pc, RuntimeBase[] reg
             } else if (captured instanceof RuntimeArray || captured instanceof RuntimeHash) {
                 if (!seenAggregates.add(captured)) continue;
                 capturedAggregates.add(captured);
-                PerlOwnerSlot ownerSlot = captured.retainClosureCaptureOwner();
+                PerlOwnerSlot ownerSlot = captured.retainClosureCaptureOwner(closureCode);
                 capturedAggregateOwnerSlots.add(ownerSlot);
             }
         }
diff --git a/src/main/java/org/perlonjava/frontend/parser/SubroutineParser.java b/src/main/java/org/perlonjava/frontend/parser/SubroutineParser.java
index cc85db15a5..9cace585b7 100644
--- a/src/main/java/org/perlonjava/frontend/parser/SubroutineParser.java
+++ b/src/main/java/org/perlonjava/frontend/parser/SubroutineParser.java
@@ -2765,7 +2765,7 @@ private static void installClosureCaptureMetadata(
             } else if (value instanceof RuntimeArray || value instanceof RuntimeHash) {
                 RuntimeBase aggregate = (RuntimeBase) value;
                 capturedAggregates.add(aggregate);
-                capturedAggregateOwnerSlots.add(aggregate.retainClosureCaptureOwner());
+                capturedAggregateOwnerSlots.add(aggregate.retainClosureCaptureOwner(code));
             }
         }
         if (!capturedScalars.isEmpty()) {
diff --git a/src/main/java/org/perlonjava/runtime/perlmodule/Internals.java b/src/main/java/org/perlonjava/runtime/perlmodule/Internals.java
index b5ee0d4d9e..e690c83122 100644
--- a/src/main/java/org/perlonjava/runtime/perlmodule/Internals.java
+++ b/src/main/java/org/perlonjava/runtime/perlmodule/Internals.java
@@ -401,7 +401,7 @@ private static void replaceCaptureTracking(
             for (int i = 0; i < code.capturedAggregates.length; i++) {
                 if (code.capturedAggregates[i] == previous) {
                     PerlOwnerSlot replacementOwner =
-                            replacement.retainClosureCaptureOwner();
+                            replacement.retainClosureCaptureOwner(code);
                     PerlOwnerSlot[] ownerSlots = code.capturedAggregateOwnerSlots;
                     PerlOwnerSlot previousOwner = ownerSlots != null
                                     && i < ownerSlots.length
@@ -808,6 +808,7 @@ public static RuntimeList jperl_trace_to(RuntimeArray args, int ctx) {
             }
             System.err.println("  total direct holders=" + matchIdx
                     + " total lexicals scanned=" + totalLexIdx);
+            ReachabilityWalker.dumpCaptureOwnersForTrace(base);
             if (matchIdx == 0 && !parentScalars.isEmpty()) {
                 System.err.println("  --- parent-holder candidates ("
                         + parentScalars.size() + ") ---");
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
index af015ee18c..bff3496550 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
@@ -24,6 +24,7 @@ public enum Kind {
 
     private final Kind kind;
     private final RuntimeScalar padCell;
+    private volatile RuntimeCode closureOwner;
     private final long identity = NEXT_ID.incrementAndGet();
     private RuntimeBase referent;
     private PerlRuntime ownerRuntime;
@@ -103,6 +104,10 @@ public synchronized int legacyCaptureCount() {
         return legacyCaptureCount;
     }
 
+    RuntimeCode closureOwner() {
+        return closureOwner;
+    }
+
     /** Acquire one closure-pad referent count through the legacy bridge. */
     public synchronized void acquireLegacyCapture(RuntimeBase target) {
         Objects.requireNonNull(target, "target");
@@ -128,11 +133,17 @@ public synchronized void acquireLegacyCapture(RuntimeBase target) {
 
     /** Acquire a captured aggregate pad as an explicit owner slot. */
     public synchronized void acquireCapture(RuntimeBase target) {
+        acquireCapture(target, null);
+    }
+
+    /** Acquire a captured aggregate pad as an edge from its owning closure. */
+    public synchronized void acquireCapture(RuntimeBase target, RuntimeCode owner) {
         Objects.requireNonNull(target, "target");
         if (target.refCount == Integer.MIN_VALUE) {
             throw new IllegalStateException("cannot capture a destroyed referent");
         }
         nativeCaptureOwner = true;
+        closureOwner = owner;
         transferTo(target);
     }
 
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlRuntime.java b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlRuntime.java
index 506b7e6636..af7c238114 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlRuntime.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlRuntime.java
@@ -241,6 +241,22 @@ static java.util.List<RuntimeBase> snapshotOwnerSlotReferents() {
         }
     }
 
+    /**
+     * Snapshot only legacy/unassociated capture pads that still need to act as
+     * conservative roots. Pads owned by a RuntimeCode are reached through that
+     * closure's capture edge, avoiding a false root from a closure to its own
+     * captured aggregate graph.
+     */
+    static java.util.List<RuntimeBase> snapshotOwnerSlotRootReferents() {
+        java.util.List<RuntimeBase> referents = snapshotOwnerSlotReferents();
+        if (referents.isEmpty()) return referents;
+        java.util.ArrayList<RuntimeBase> roots = new java.util.ArrayList<>(referents.size());
+        for (RuntimeBase referent : referents) {
+            if (referent.hasUnassociatedClosureCaptureOwner()) roots.add(referent);
+        }
+        return java.util.List.copyOf(roots);
+    }
+
     /** Record the address exposed by Perl reference stringification for B introspection. */
     public void registerReferenceAddress(RuntimeBase value) {
         registerReferenceAddress(referenceAddress(value), value);
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index b1e9c545ca..f65a665a26 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -220,11 +220,11 @@ public Set<RuntimeBase> walk() {
         for (RuntimeBase rescued : DestroyDispatch.snapshotRescuedForWalk()) {
             addReachable(rescued, todo);
         }
-        // Explicit owner slots carry semantic Perl ownership even when the
-        // owning pad cell is intentionally absent from conservative lexical
-        // walker roots. Captured aggregate pads use this path so their
-        // elements remain reachable until the closure releases the slot.
-        for (RuntimeBase ownerReferent : PerlRuntime.snapshotOwnerSlotReferents()) {
+        // Legacy capture slots without a recorded closure owner remain
+        // conservative roots. Production closure pads are reached through
+        // their owning RuntimeCode so a closure cannot become a root through
+        // the aggregate pad it owns.
+        for (RuntimeBase ownerReferent : PerlRuntime.snapshotOwnerSlotRootReferents()) {
             addReachable(ownerReferent, todo);
         }
         for (RuntimeBase suspended : MortalList.snapshotSuspendedRoots()) {
@@ -741,7 +741,7 @@ public static java.util.List<String> findPathTo(RuntimeBase target, boolean skip
                 }
             }
             int ownerIdx = 0;
-            for (RuntimeBase ownerReferent : PerlRuntime.snapshotOwnerSlotReferents()) {
+            for (RuntimeBase ownerReferent : PerlRuntime.snapshotOwnerSlotRootReferents()) {
                 String ownerClass = ownerReferent.blessId == 0
                         ? ownerReferent.getClass().getSimpleName()
                         : NameNormalizer.getBlessStr(ownerReferent.blessId);
@@ -844,6 +844,107 @@ public static java.util.List<String> findPathTo(RuntimeBase target, boolean skip
         return null;
     }
 
+    /** Dump closure capture owners that can explain a retained target. */
+    public static void dumpCaptureOwnersForTrace(RuntimeBase target) {
+        java.util.Set<RuntimeBase> capturedAggregates =
+                java.util.Collections.newSetFromMap(new java.util.IdentityHashMap<>());
+        capturedAggregates.add(target);
+        int arrayIndex = 0;
+        for (RuntimeBase owner : PerlRuntime.snapshotOwnerSlotReferents()) {
+            if (!(owner instanceof RuntimeArray array)) continue;
+            boolean containsTarget = false;
+            for (RuntimeScalar element : array.elements) {
+                if (element != null && element.value == target) {
+                    containsTarget = true;
+                    break;
+                }
+            }
+            if (containsTarget) {
+                capturedAggregates.add(array);
+                System.err.println("  captured-array candidate #" + (arrayIndex++)
+                        + " id=" + System.identityHashCode(array)
+                        + " refCount=" + array.refCount
+                        + " captureCount=" + array.captureCount
+                        + " scopeExited=" + array.scopeExited
+                        + " size=" + array.elements.size());
+            }
+        }
+
+        java.util.Set<RuntimeCode> seenCodes =
+                java.util.Collections.newSetFromMap(new java.util.IdentityHashMap<>());
+        for (RuntimeScalar scalar : ScalarRefRegistry.snapshot()) {
+            if (scalar != null && scalar.value instanceof RuntimeCode code) {
+                seenCodes.add(code);
+            }
+        }
+        for (RuntimeScalar scalar : GlobalVariable.globalCodeRefValuesView()) {
+            if (scalar != null && scalar.value instanceof RuntimeCode code) {
+                seenCodes.add(code);
+            }
+        }
+        int codeIndex = 0;
+        for (RuntimeCode code : seenCodes) {
+            boolean capturesTarget = false;
+            if (code.capturedScalars != null) {
+                for (RuntimeScalar capture : code.capturedScalars) {
+                    if (capture != null && capture.value == target) {
+                        capturesTarget = true;
+                        break;
+                    }
+                }
+            }
+            if (!capturesTarget && code.capturedAggregates != null) {
+                for (RuntimeBase capture : code.capturedAggregates) {
+                    if (capturedAggregates.contains(capture)) {
+                        capturesTarget = true;
+                        break;
+                    }
+                }
+            }
+            if (capturesTarget) {
+                System.err.println("  capture-owner #" + (codeIndex++)
+                        + " code=" + code.packageName + "::" + code.subName
+                        + " at=" + code.cvStartFile + ":" + code.cvStartLine
+                        + " refCount=" + code.refCount
+                        + " stashRefCount=" + code.stashRefCount
+                        + " active=" + RuntimeCode.isActiveCode(code)
+                        + " scalarOwners=" + code.activeOwnerCount()
+                        + " hashSlotOwners=" + code.hashSlotOwnerCount()
+                        + " arraySlotOwners=" + code.arraySlotOwnerCount()
+                        + " capturedScalars=" + (code.capturedScalars == null
+                                ? 0 : code.capturedScalars.length)
+                        + " capturedAggregates=" + (code.capturedAggregates == null
+                                ? 0 : code.capturedAggregates.length)
+                        + " closedOver=" + (code.closedOverVariables == null
+                                ? "[]" : code.closedOverVariables.keySet()));
+                for (RuntimeScalar owner : ScalarRefRegistry.snapshot()) {
+                    if (owner == null || owner.value != code) continue;
+                    RuntimeBase container = owner.containerOwner;
+                    System.err.println("    code-scalar id=" + System.identityHashCode(owner)
+                            + " type=" + owner.type
+                            + " refCountOwned=" + owner.refCountOwned
+                            + " captureCount=" + owner.captureCount
+                            + " scopeExited=" + owner.scopeExited
+                            + " container=" + (container == null ? "none"
+                                    : container.getClass().getSimpleName() + "#"
+                                            + System.identityHashCode(container)));
+                    if (container instanceof RuntimeArray array) {
+                        String arrayPath = findPathTo(array) == null ? "<unreachable>"
+                                : String.join(" -> ", findPathTo(array));
+                        System.err.println("      owner-array id=" + System.identityHashCode(array)
+                                + " refCount=" + array.refCount
+                                + " captureCount=" + array.captureCount
+                                + " scopeExited=" + array.scopeExited
+                                + " owned=" + array.elementsOwned
+                                + " aliased=" + array.elementsAliased
+                                + " size=" + array.elements.size()
+                                + " path=" + arrayPath);
+                    }
+                }
+            }
+        }
+    }
+
     private static void seedPath(RuntimeScalar s, String label,
                                   java.util.IdentityHashMap<RuntimeBase, String> howReached,
                                   java.util.ArrayDeque<RuntimeBase> todo) {
@@ -1350,7 +1451,7 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
                     if (stats != null) stats.rootsSeeded++;
                 }
             }
-            for (RuntimeBase ownerReferent : PerlRuntime.snapshotOwnerSlotReferents()) {
+            for (RuntimeBase ownerReferent : PerlRuntime.snapshotOwnerSlotRootReferents()) {
                 if (!budget.visitEdge()) break rootScan;
                 if (seen.add(ownerReferent)) {
                     todo.addLast(ownerReferent);
@@ -1382,6 +1483,21 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
                     if (stats != null) stats.edgesInspected++;
                     followScalar(value, null, seen, todo);
                 }
+            } else if (cur instanceof RuntimeCode code) {
+                if (code.capturedScalars != null) {
+                    for (RuntimeScalar captured : code.capturedScalars) {
+                        if (!budget.visitEdge()) break walk;
+                        if (stats != null) stats.edgesInspected++;
+                        followScalar(captured, null, seen, todo);
+                    }
+                }
+                if (code.capturedAggregates != null) {
+                    for (RuntimeBase captured : code.capturedAggregates) {
+                        if (!budget.visitEdge()) break walk;
+                        if (stats != null) stats.edgesInspected++;
+                        if (captured != null && seen.add(captured)) todo.addLast(captured);
+                    }
+                }
             } else if (cur instanceof RuntimeRegex regex) {
                 for (RuntimeCode callback : regex.executableCallbackCodes()) {
                     if (!budget.visitEdge()) break walk;
@@ -1978,7 +2094,7 @@ public static boolean isReachableFromRoots(RuntimeBase target, boolean globalOnl
                 if (stats != null) stats.rootsSeeded++;
             }
         }
-        for (RuntimeBase ownerReferent : PerlRuntime.snapshotOwnerSlotReferents()) {
+        for (RuntimeBase ownerReferent : PerlRuntime.snapshotOwnerSlotRootReferents()) {
             if (!budget.visitEdge()) return true;
             if (ownerReferent == target) return true;
             if (ownerReferent != null && seen.add(ownerReferent)) {
@@ -2095,6 +2211,22 @@ && followScalar(tieHash.getSelf(), target, seen, todo)) {
                     if (stats != null) stats.edgesInspected++;
                     if (followScalar(v, target, seen, todo)) return true;
                 }
+            } else if (cur instanceof RuntimeCode code) {
+                if (code.capturedScalars != null) {
+                    for (RuntimeScalar captured : code.capturedScalars) {
+                        if (!budget.visitEdge()) break walk;
+                        if (stats != null) stats.edgesInspected++;
+                        if (followScalar(captured, target, seen, todo)) return true;
+                    }
+                }
+                if (code.capturedAggregates != null) {
+                    for (RuntimeBase captured : code.capturedAggregates) {
+                        if (!budget.visitEdge()) break walk;
+                        if (stats != null) stats.edgesInspected++;
+                        if (captured == target) return true;
+                        if (captured != null && seen.add(captured)) todo.addLast(captured);
+                    }
+                }
             } else if (cur instanceof RuntimeRegex regex) {
                 // Executable regex callbacks are strong owners of their
                 // lexical captures while a qr// scalar remains live. Follow
@@ -2120,18 +2252,9 @@ && followScalar(tieHash.getSelf(), target, seen, todo)) {
                     if (!budget.complete) break walk;
                 }
             }
-            // Note: we deliberately don't follow RuntimeCode.capturedScalars
-            // here — closure captures are NOT considered strong reachability
-            // edges for this query (matches the default of
-            // ReachabilityWalker.walk() which has walkCodeCaptures=false
-            // for the second-phase BFS). Without this discipline, DBIC's
-            // leak detector (t/52leaks.t) reports false positives because
-            // the walker would keep things alive that user code released.
-            //
-            // For Class::MOP's %METAS hash (which we also need to find for
-            // the Moose bootstrap), we don't need closure-capture walking
-            // because %METAS is declared `our %METAS` (package global) so
-            // it appears directly in GlobalVariable.globalHashes.
+            // Closure captures are followed only after the RuntimeCode itself
+            // was found from a Perl root. Owned aggregate pads are not roots in
+            // their own right when their owning closure is known.
         }
         return !budget.complete || !todo.isEmpty();
     }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
index 19814fda1a..58b179d1d2 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
@@ -229,6 +229,11 @@ public void retainClosureCapture() {
 
     /** Retain one aggregate pad capture through an explicit owner slot. */
     public PerlOwnerSlot retainClosureCaptureOwner() {
+        return retainClosureCaptureOwner(null);
+    }
+
+    /** Retain this aggregate pad through the semantic edge from its closure. */
+    public PerlOwnerSlot retainClosureCaptureOwner(RuntimeCode closureOwner) {
         // A closure-pad slot is a semantic Perl owner even though it does not
         // contribute to the legacy selective refcount. A targeted weak sweep
         // can therefore leave an unblessed aggregate's legacy count at the
@@ -240,7 +245,7 @@ public PerlOwnerSlot retainClosureCaptureOwner() {
             refCount = 0;
         }
         PerlOwnerSlot ownerSlot = new PerlOwnerSlot(PerlOwnerSlot.Kind.CLOSURE_PAD);
-        ownerSlot.acquireCapture(this);
+        ownerSlot.acquireCapture(this, closureOwner);
         retainClosureCapture();
         return ownerSlot;
     }
@@ -368,6 +373,17 @@ public synchronized int nativeCaptureOwnerCount() {
         return count;
     }
 
+    /** Whether an active captured-pad slot has no owning closure edge recorded. */
+    synchronized boolean hasUnassociatedClosureCaptureOwner() {
+        if (ownerSlots == null) return false;
+        for (PerlOwnerSlot slot : ownerSlots) {
+            if (slot.kind() == PerlOwnerSlot.Kind.CLOSURE_PAD
+                    && slot.isNativeCaptureOwner()
+                    && slot.closureOwner() == null) return true;
+        }
+        return false;
+    }
+
     // Conservative gate for the tied-handler reachability fallback. Once a
     // base has appeared in a tie handler's strong object graph it remains
     // marked; a stale true only permits the exact walker to run, while false
@@ -814,7 +830,9 @@ public synchronized String ownerTraceSnapshot() {
             }
             result.append(']');
         }
-        result.append(" semanticCaptureOwners=").append(semanticCaptureOwnerCount());
+        result.append(" semanticCaptureOwners=").append(semanticCaptureOwnerCount())
+                .append(" hashEntryOwners=").append(hashSlotOwnerCount())
+                .append(" arrayElementOwners=").append(arraySlotOwnerCount());
         return result.toString();
     }
 
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
index 93e342dca3..1969ae70dc 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
@@ -5380,7 +5380,7 @@ public static RuntimeScalar makeCodeObject(
                     }
                     code.closedOverVariables.put(f.getName(), capturedAggregate);
                     capturedAggregates.add(capturedAggregate);
-                    PerlOwnerSlot ownerSlot = capturedAggregate.retainClosureCaptureOwner();
+                    PerlOwnerSlot ownerSlot = capturedAggregate.retainClosureCaptureOwner(code);
                     capturedAggregateOwnerSlots.add(ownerSlot);
                 }
             }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java
index d7f02304e2..531804d250 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java
@@ -453,7 +453,7 @@ private void copyCodeMetadata(RuntimeCode source, RuntimeCode target) {
                         new PerlOwnerSlot[target.capturedAggregates.length];
                 for (int i = 0; i < target.capturedAggregates.length; i++) {
                     target.capturedAggregateOwnerSlots[i] =
-                            target.capturedAggregates[i].retainClosureCaptureOwner();
+                            target.capturedAggregates[i].retainClosureCaptureOwner(target);
                 }
             }
         }
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerCapturedAggregateReleaseTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerCapturedAggregateReleaseTest.java
index cf2a514b87..14659878c8 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerCapturedAggregateReleaseTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerCapturedAggregateReleaseTest.java
@@ -6,6 +6,7 @@
 import java.util.Collections;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 @Tag("unit")
@@ -56,4 +57,36 @@ void laterCaptureReconcilesAStaleDestroyedSentinelWhileOwnersRemain() {
             captured.releaseClosureCaptureOwner(firstOwner);
         }
     }
+
+    @Test
+    void capturedAggregateIsReachedThroughItsLiveClosureNotAsAnIndependentRoot() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeHash capturedValue = new RuntimeHash();
+            RuntimeArray capturedPad = new RuntimeArray();
+            capturedPad.elements.add(capturedValue.createReference());
+            capturedPad.elementsOwned = true;
+            capturedPad.reconcileArrayElementOwnerSlots();
+
+            RuntimeCode closure = new RuntimeCode((String) null, java.util.List.of());
+            closure.capturedAggregates = new RuntimeBase[] {capturedPad};
+            PerlOwnerSlot captureOwner = capturedPad.retainClosureCaptureOwner(closure);
+            closure.capturedAggregateOwnerSlots = new PerlOwnerSlot[] {captureOwner};
+
+            assertTrue(runtime.retainsPositiveOwnerSlotReferent(capturedPad));
+            assertFalse(ReachabilityWalker.isReachableFromRoots(capturedValue),
+                    "the capture pad must not root a closure whose Perl owner has gone away");
+
+            RuntimeScalar closureOwner = new RuntimeScalar(closure);
+            MyVarCleanupStack.register(closureOwner);
+            try {
+                assertTrue(ReachabilityWalker.isReachableFromRoots(capturedValue),
+                        "a live Perl closure keeps its captured aggregate contents reachable");
+            } finally {
+                MyVarCleanupStack.unregister(closureOwner);
+            }
+
+            closure.releaseCaptures();
+        }
+    }
 }
diff --git a/src/test/resources/unit/refcount/owner_trace_snapshot.t b/src/test/resources/unit/refcount/owner_trace_snapshot.t
index aa7ef47089..b771e82029 100644
--- a/src/test/resources/unit/refcount/owner_trace_snapshot.t
+++ b/src/test/resources/unit/refcount/owner_trace_snapshot.t
@@ -10,7 +10,7 @@ my $snapshot = Internals::jperl_owner_trace($object);
 
 like($snapshot, qr/\Abase=\d+ generation=\d+ refCount=-?\d+ active=\[/,
     'snapshot identifies the selected referent and active owner set');
-like($snapshot, qr/ pending=\[\] transient=\[\] semanticCaptureOwners=0\z/,
+like($snapshot, qr/ pending=\[\] transient=\[\] semanticCaptureOwners=0 hashEntryOwners=0 arrayElementOwners=0\z/,
     'fresh assertion-boundary snapshot has no deferred or transient ownership');
 
 my $nested = bless {}, 'OwnerTraceNested';
@@ -18,7 +18,7 @@ Internals::jperl_owner_trace($nested); # enable trace collection before the tran
 my $scalar_ref = \$nested;
 $scalar_ref = undef;
 my $nested_snapshot = Internals::jperl_owner_trace($nested);
-like($nested_snapshot, qr/ transient=\[\] semanticCaptureOwners=0\z/,
+like($nested_snapshot, qr/ transient=\[\] semanticCaptureOwners=0 hashEntryOwners=0 arrayElementOwners=0\z/,
     'scalar-reference contents hold is balanced after release');
 
 done_testing;

From 66915e5073d9713e10dd7e811d460d5d974a0624 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 15:17:46 +0200
Subject: [PATCH 029/317] fix: avoid rescuing callbacks through owned capture
 pads

Keep captured aggregate pads rooted for ordinary cleanup, but exclude pads
owned by a RuntimeCode when deciding whether that code itself has an external
Perl root. Follow CODE-valued scalar slots in that owner-aware proof.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtime/runtimetypes/MortalList.java      |  2 +-
 .../runtimetypes/ReachabilityWalker.java      | 93 ++++++++++++-------
 ...ityWalkerCapturedAggregateReleaseTest.java | 10 +-
 3 files changed, 66 insertions(+), 39 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 6d8e06042e..93cc616e97 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1731,7 +1731,7 @@ private static void processDeferredBase(RuntimeBase base, boolean clearWeakRefsF
                 // sentinel behavior.
                 if (base.nativeCaptureOwnerCount() == 0) base.refCount = 1;
             } else if (base instanceof RuntimeCode code
-                    && ReachabilityWalker.isReachableFromRoots(code)) {
+                    && ReachabilityWalker.isCodeReachableFromRoots(code)) {
                 // A callback stored in a long-lived Perl container can have
                 // its selective CV count consumed by a temporary invocation
                 // alias. The container is still a strong owner even when no
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index f65a665a26..870dd5b693 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -220,11 +220,11 @@ public Set<RuntimeBase> walk() {
         for (RuntimeBase rescued : DestroyDispatch.snapshotRescuedForWalk()) {
             addReachable(rescued, todo);
         }
-        // Legacy capture slots without a recorded closure owner remain
-        // conservative roots. Production closure pads are reached through
-        // their owning RuntimeCode so a closure cannot become a root through
-        // the aggregate pad it owns.
-        for (RuntimeBase ownerReferent : PerlRuntime.snapshotOwnerSlotRootReferents()) {
+        // Explicit owner slots carry semantic Perl ownership even when the
+        // owning pad cell is intentionally absent from conservative lexical
+        // walker roots. Captured aggregate pads use this path so their
+        // elements remain reachable until the closure releases the slot.
+        for (RuntimeBase ownerReferent : PerlRuntime.snapshotOwnerSlotReferents()) {
             addReachable(ownerReferent, todo);
         }
         for (RuntimeBase suspended : MortalList.snapshotSuspendedRoots()) {
@@ -741,7 +741,7 @@ public static java.util.List<String> findPathTo(RuntimeBase target, boolean skip
                 }
             }
             int ownerIdx = 0;
-            for (RuntimeBase ownerReferent : PerlRuntime.snapshotOwnerSlotRootReferents()) {
+            for (RuntimeBase ownerReferent : PerlRuntime.snapshotOwnerSlotReferents()) {
                 String ownerClass = ownerReferent.blessId == 0
                         ? ownerReferent.getClass().getSimpleName()
                         : NameNormalizer.getBlessStr(ownerReferent.blessId);
@@ -1364,6 +1364,12 @@ static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus() {
         return reachableFromRootsSnapshotWithStatus(true);
     }
 
+    /** Root proof for a CODE referent without treating its own aggregate pads as roots. */
+    static boolean isCodeReachableFromRoots(RuntimeCode code) {
+        return code != null
+                && reachableFromRootsSnapshotWithStatus(true, false).isReachable(code);
+    }
+
     /**
      * Collect the bounded root graph needed to answer reachability for
      * unblessed aggregates. Installed CODE slot identities cannot own an
@@ -1377,6 +1383,11 @@ static RootReachabilitySnapshot unblessedAggregateRootsSnapshotWithStatus() {
 
     private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
             boolean includeInstalledCodeSlots) {
+        return reachableFromRootsSnapshotWithStatus(includeInstalledCodeSlots, true);
+    }
+
+    private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
+            boolean includeInstalledCodeSlots, boolean includeOwnedCapturePads) {
         ReachabilityQueryStats stats = MortalList.activeReachabilityQueryStats();
         if (stats != null) stats.snapshotsBuilt++;
         final int maxVisits = MAX_ROOT_SNAPSHOT_VISITS;
@@ -1400,7 +1411,8 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
             }
             for (RuntimeScalar scalar : GlobalVariable.globalVariableValuesView()) {
                 if (!budget.visitEdge()) break rootScan;
-                seedTarget(scalar, null, seen, todo, stats);
+                if (includeOwnedCapturePads) seedTarget(scalar, null, seen, todo, stats);
+                else seedTargetIncludingCode(scalar, null, seen, todo, stats);
             }
             for (Map.Entry<String, RuntimeArray> e : GlobalVariable.globalArrayEntriesView()) {
                 if (!budget.visitEdge()) break rootScan;
@@ -1423,13 +1435,15 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
                 if (scalar == null || scalar.captureCount > 0 || WeakRefRegistry.isweak(scalar)
                         || (!MyVarCleanupStack.isLive(scalar) && !scalar.refCountOwned)
                         || scalar.scopeExited) continue;
-                seedTarget(scalar, null, seen, todo, stats);
+                if (includeOwnedCapturePads) seedTarget(scalar, null, seen, todo, stats);
+                else seedTargetIncludingCode(scalar, null, seen, todo, stats);
             }
             for (Object liveVar : MyVarCleanupStack.snapshotLiveVars()) {
                 if (!budget.visitEdge()) break rootScan;
                 if (liveVar instanceof RuntimeScalar scalar) {
                     if (seen.add(scalar) && stats != null) stats.rootsSeeded++;
-                    seedTarget(scalar, null, seen, todo, stats);
+                    if (includeOwnedCapturePads) seedTarget(scalar, null, seen, todo, stats);
+                    else seedTargetIncludingCode(scalar, null, seen, todo, stats);
                 } else if (liveVar instanceof RuntimeBase base && seen.add(base)) {
                     todo.addLast(base);
                     if (stats != null) stats.rootsSeeded++;
@@ -1441,7 +1455,8 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
                         && scalar.type == RuntimeScalarType.REGEX
                         && !scalar.scopeExited
                         && !WeakRefRegistry.isweak(scalar)) {
-                    seedTarget(scalar, null, seen, todo, stats);
+                    if (includeOwnedCapturePads) seedTarget(scalar, null, seen, todo, stats);
+                    else seedTargetIncludingCode(scalar, null, seen, todo, stats);
                 }
             }
             for (RuntimeBase rescued : DestroyDispatch.snapshotRescuedForWalk()) {
@@ -1451,7 +1466,10 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
                     if (stats != null) stats.rootsSeeded++;
                 }
             }
-            for (RuntimeBase ownerReferent : PerlRuntime.snapshotOwnerSlotRootReferents()) {
+            java.util.List<RuntimeBase> ownerReferents = includeOwnedCapturePads
+                    ? PerlRuntime.snapshotOwnerSlotReferents()
+                    : PerlRuntime.snapshotOwnerSlotRootReferents();
+            for (RuntimeBase ownerReferent : ownerReferents) {
                 if (!budget.visitEdge()) break rootScan;
                 if (seen.add(ownerReferent)) {
                     todo.addLast(ownerReferent);
@@ -1475,15 +1493,17 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
                 for (RuntimeScalar value : hash.elements.values()) {
                     if (!budget.visitEdge()) break walk;
                     if (stats != null) stats.edgesInspected++;
-                    followScalar(value, null, seen, todo);
+                    if (includeOwnedCapturePads) followScalar(value, null, seen, todo);
+                    else followScalarIncludingCode(value, null, seen, todo);
                 }
             } else if (cur instanceof RuntimeArray array) {
                 for (RuntimeScalar value : array.elements) {
                     if (!budget.visitEdge()) break walk;
                     if (stats != null) stats.edgesInspected++;
-                    followScalar(value, null, seen, todo);
+                    if (includeOwnedCapturePads) followScalar(value, null, seen, todo);
+                    else followScalarIncludingCode(value, null, seen, todo);
                 }
-            } else if (cur instanceof RuntimeCode code) {
+            } else if (!includeOwnedCapturePads && cur instanceof RuntimeCode code) {
                 if (code.capturedScalars != null) {
                     for (RuntimeScalar captured : code.capturedScalars) {
                         if (!budget.visitEdge()) break walk;
@@ -2094,7 +2114,7 @@ public static boolean isReachableFromRoots(RuntimeBase target, boolean globalOnl
                 if (stats != null) stats.rootsSeeded++;
             }
         }
-        for (RuntimeBase ownerReferent : PerlRuntime.snapshotOwnerSlotRootReferents()) {
+        for (RuntimeBase ownerReferent : PerlRuntime.snapshotOwnerSlotReferents()) {
             if (!budget.visitEdge()) return true;
             if (ownerReferent == target) return true;
             if (ownerReferent != null && seen.add(ownerReferent)) {
@@ -2211,22 +2231,6 @@ && followScalar(tieHash.getSelf(), target, seen, todo)) {
                     if (stats != null) stats.edgesInspected++;
                     if (followScalar(v, target, seen, todo)) return true;
                 }
-            } else if (cur instanceof RuntimeCode code) {
-                if (code.capturedScalars != null) {
-                    for (RuntimeScalar captured : code.capturedScalars) {
-                        if (!budget.visitEdge()) break walk;
-                        if (stats != null) stats.edgesInspected++;
-                        if (followScalar(captured, target, seen, todo)) return true;
-                    }
-                }
-                if (code.capturedAggregates != null) {
-                    for (RuntimeBase captured : code.capturedAggregates) {
-                        if (!budget.visitEdge()) break walk;
-                        if (stats != null) stats.edgesInspected++;
-                        if (captured == target) return true;
-                        if (captured != null && seen.add(captured)) todo.addLast(captured);
-                    }
-                }
             } else if (cur instanceof RuntimeRegex regex) {
                 // Executable regex callbacks are strong owners of their
                 // lexical captures while a qr// scalar remains live. Follow
@@ -2252,9 +2256,9 @@ && followScalar(tieHash.getSelf(), target, seen, todo)) {
                     if (!budget.complete) break walk;
                 }
             }
-            // Closure captures are followed only after the RuntimeCode itself
-            // was found from a Perl root. Owned aggregate pads are not roots in
-            // their own right when their owning closure is known.
+            // Closure captures remain opaque in the conservative refcount
+            // query; CODE-specific owner rescue uses the explicit owner-aware
+            // root proof above instead.
         }
         return !budget.complete || !todo.isEmpty();
     }
@@ -2795,6 +2799,17 @@ private static void seedTarget(RuntimeScalar s, RuntimeBase target,
         }
     }
 
+    private static void seedTargetIncludingCode(RuntimeScalar scalar, RuntimeBase target,
+            Set<RuntimeBase> seen, java.util.ArrayDeque<RuntimeBase> todo,
+            ReachabilityQueryStats stats) {
+        seedTarget(scalar, target, seen, todo, stats);
+        if (scalar != null && !WeakRefRegistry.isweak(scalar)
+                && scalar.value instanceof RuntimeCode code) {
+            if (code == target) seen.add(code);
+            else if (seen.add(code)) todo.addLast(code);
+        }
+    }
+
     private static boolean followScalar(RuntimeScalar s, RuntimeBase target,
                                         Set<RuntimeBase> seen,
                                         java.util.ArrayDeque<RuntimeBase> todo) {
@@ -2808,6 +2823,16 @@ private static boolean followScalar(RuntimeScalar s, RuntimeBase target,
         return false;
     }
 
+    private static boolean followScalarIncludingCode(RuntimeScalar scalar, RuntimeBase target,
+            Set<RuntimeBase> seen, java.util.ArrayDeque<RuntimeBase> todo) {
+        if (followScalar(scalar, target, seen, todo)) return true;
+        if (scalar == null || WeakRefRegistry.isweak(scalar)
+                || !(scalar.value instanceof RuntimeCode code)) return false;
+        if (code == target) return true;
+        if (seen.add(code)) todo.addLast(code);
+        return false;
+    }
+
     private static boolean followGlobalCodeCaptures(RuntimeCode code, RuntimeBase target,
                                                     Set<RuntimeBase> seen,
                                                     java.util.ArrayDeque<RuntimeBase> todo) {
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerCapturedAggregateReleaseTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerCapturedAggregateReleaseTest.java
index 14659878c8..d9ccb65b61 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerCapturedAggregateReleaseTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerCapturedAggregateReleaseTest.java
@@ -74,14 +74,16 @@ void capturedAggregateIsReachedThroughItsLiveClosureNotAsAnIndependentRoot() {
             closure.capturedAggregateOwnerSlots = new PerlOwnerSlot[] {captureOwner};
 
             assertTrue(runtime.retainsPositiveOwnerSlotReferent(capturedPad));
-            assertFalse(ReachabilityWalker.isReachableFromRoots(capturedValue),
-                    "the capture pad must not root a closure whose Perl owner has gone away");
+            assertTrue(ReachabilityWalker.isReachableFromRoots(capturedValue),
+                    "ordinary cleanup still treats the captured pad as a semantic owner");
+            assertFalse(ReachabilityWalker.isCodeReachableFromRoots(closure),
+                    "the closure must not be rescued through its own captured aggregate pad");
 
             RuntimeScalar closureOwner = new RuntimeScalar(closure);
             MyVarCleanupStack.register(closureOwner);
             try {
-                assertTrue(ReachabilityWalker.isReachableFromRoots(capturedValue),
-                        "a live Perl closure keeps its captured aggregate contents reachable");
+                assertTrue(ReachabilityWalker.isCodeReachableFromRoots(closure),
+                        "a live Perl closure remains rooted through its lexical owner");
             } finally {
                 MyVarCleanupStack.unregister(closureOwner);
             }

From a897b4143e799a4e868913f01c98bfbb9470a498 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 15:53:48 +0200
Subject: [PATCH 030/317] test: activate captured aggregate root tracking

Exercise captured aggregate root behavior after weak-reference tracking has
been initialized, and register the live closure slot as an owned lexical.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../ReachabilityWalkerCapturedAggregateReleaseTest.java       | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerCapturedAggregateReleaseTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerCapturedAggregateReleaseTest.java
index d9ccb65b61..ff5d3e5fd2 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerCapturedAggregateReleaseTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerCapturedAggregateReleaseTest.java
@@ -63,6 +63,8 @@ void capturedAggregateIsReachedThroughItsLiveClosureNotAsAnIndependentRoot() {
         PerlRuntime runtime = new PerlRuntime();
         try (PerlRuntime.Binding ignored = runtime.bind()) {
             RuntimeHash capturedValue = new RuntimeHash();
+            RuntimeScalar weakProbe = capturedValue.createReference();
+            WeakRefRegistry.weaken(weakProbe);
             RuntimeArray capturedPad = new RuntimeArray();
             capturedPad.elements.add(capturedValue.createReference());
             capturedPad.elementsOwned = true;
@@ -80,6 +82,8 @@ void capturedAggregateIsReachedThroughItsLiveClosureNotAsAnIndependentRoot() {
                     "the closure must not be rescued through its own captured aggregate pad");
 
             RuntimeScalar closureOwner = new RuntimeScalar(closure);
+            closureOwner.refCountOwned = true;
+            ScalarRefRegistry.registerRef(closureOwner);
             MyVarCleanupStack.register(closureOwner);
             try {
                 assertTrue(ReachabilityWalker.isCodeReachableFromRoots(closure),

From 8b82be74a0bf41bbcc630aa4383d40c859e5413d Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 16:36:13 +0200
Subject: [PATCH 031/317] fix: release callback owners from discarded
 containers

Release counted CODE slots during aggregate teardown while retaining callbacks
whose containers remain reachable through persistent Perl roots. Add a focused
regression for both lifetime boundaries.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtime/runtimetypes/MortalList.java      | 42 +++++++++++++++++
 .../RuntimeCodeScopeExitReachabilityTest.java | 46 +++++++++++++++++++
 2 files changed, 88 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 93cc616e97..76a01511eb 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -722,6 +722,9 @@ public static void scopeExitCleanupHash(RuntimeHash hash) {
                 && hash.refCount >= 0
                 && hash.hadCountedReference
                 && isReachableFromExternalRootCached(hash)) return;
+        if (hadLocalBinding
+                && containerContainsCodeReference(hash)
+                && isReachableFromExternalRootCached(hash)) return;
         List<RuntimeScalar> valuesInDestructionOrder = new ArrayList<>(hash.elements.values());
         Collections.reverse(valuesInDestructionOrder);
         for (RuntimeScalar val : valuesInDestructionOrder) {
@@ -762,6 +765,11 @@ public static void scopeExitCleanupArray(RuntimeArray arr, RuntimeBase returned)
         // Alias arrays such as @_ do not own their original element slots.
         if (arr.refCount > 0 || temporaryRootDirectlyReferences(arr)
                 || directlyReferences(returned, arr)) return;
+        // Refcount tracking does not cover every Perl callback container.
+        // Keep a CODE-bearing array intact while a persistent Perl root still
+        // owns it (for example, Mojo::Reactor's recurring timer table).
+        if (containerContainsCodeReference(arr)
+                && isReachableFromExternalRootCached(arr)) return;
         // \$#array creates a scalar proxy, not an array reference.  Once the
         // lexical AV exits, that proxy becomes an orphaned undef lvalue; it
         // must not retain this Java RuntimeArray merely through its backing
@@ -1003,6 +1011,11 @@ private static void deferDecrementRecursive(RuntimeScalar scalar) {
             if (!(s.value instanceof RuntimeBase base)) continue;
             if (!visited.add(base)) continue;  // already visited — cycle
 
+            if (base instanceof RuntimeCode) {
+                deferDecrementIfTracked(s);
+                continue;
+            }
+
             if (base.blessId != 0) {
                 boolean releasingLastOwner = false;
                 if (s.refCountOwned && base.refCount > 0) {
@@ -1141,6 +1154,35 @@ private static boolean scalarMayContainCleanupTarget(RuntimeScalar scalar,
         return false;
     }
 
+    /** Whether an aggregate contains a CODE slot, including through nested aggregates. */
+    private static boolean containerContainsCodeReference(RuntimeBase container) {
+        if (!(container instanceof RuntimeArray || container instanceof RuntimeHash)) return false;
+        ArrayDeque<RuntimeBase> work = new ArrayDeque<>();
+        Set<RuntimeBase> visited = Collections.newSetFromMap(new IdentityHashMap<>());
+        work.add(container);
+        while (!work.isEmpty()) {
+            RuntimeBase current = work.removeFirst();
+            if (!visited.add(current)) continue;
+            Iterable<RuntimeScalar> values;
+            if (current instanceof RuntimeArray array) {
+                values = array.elements;
+            } else if (current instanceof RuntimeHash hash) {
+                values = hash.elements.values();
+            } else {
+                continue;
+            }
+            for (RuntimeScalar value : values) {
+                if (value == null || (value.type & RuntimeScalarType.REFERENCE_BIT) == 0
+                        || !(value.value instanceof RuntimeBase referent)) continue;
+                if (referent instanceof RuntimeCode) return true;
+                if (referent instanceof RuntimeArray || referent instanceof RuntimeHash) {
+                    work.addLast(referent);
+                }
+            }
+        }
+        return false;
+    }
+
     private static boolean containerHasWeakElementRefs(RuntimeBase base) {
         if (!WeakRefRegistry.weakRefsExist()) return false;
         if (base instanceof RuntimeArray arr) {
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
index 659e81ac50..e4ae6b045d 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
@@ -84,4 +84,50 @@ void deferredReleaseRetainsCapturesForCodeStoredInReachableHashWithoutWeakRefs()
             }
         }
     }
+
+    @Test
+    void arrayScopeExitPreservesRootedCallbacksThenReleasesThemWhenRootIsRemoved() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeScalar captured = new RuntimeScalar("captured");
+            captured.retainClosureCapture();
+            RuntimeCode callback = new RuntimeCode(null, List.of());
+            callback.refCount = 1;
+            callback.capturedScalars = new RuntimeScalar[] { captured };
+
+            RuntimeScalar codeRef = new RuntimeScalar(callback);
+            codeRef.refCountOwned = true;
+            RuntimeArray callbacks = new RuntimeArray();
+            callbacks.elements.add(codeRef);
+            callbacks.elementsOwned = true;
+            String globalName = "RuntimeCodeScopeExitReachabilityTest::callbacks";
+            GlobalVariable.globalArrays.put(globalName, callbacks);
+
+            RuntimeScalar weakProbe = new RuntimeScalar(new RuntimeHash()).createReference();
+            WeakRefRegistry.weaken(weakProbe);
+            boolean previousActive = MortalList.isActive();
+            MortalList.setActive(true);
+            try {
+                MortalList.scopeExitCleanupArray(callbacks);
+                MortalList.flush();
+
+                assertEquals(1, callback.refCount,
+                        "a persistent aggregate root keeps its callback owner count");
+                assertNotNull(callback.capturedScalars,
+                        "a persistent aggregate root keeps callback captures");
+
+                GlobalVariable.globalArrays.remove(globalName);
+                MortalList.scopeExitCleanupArray(callbacks);
+                MortalList.flush();
+
+                assertNull(callback.capturedScalars,
+                        "discarding the last callback container releases its captures");
+                assertEquals(0, captured.captureCount);
+            } finally {
+                GlobalVariable.globalArrays.remove(globalName);
+                MortalList.setActive(previousActive);
+            }
+        }
+    }
+
 }

From e8c710e1e4a935ac2fb48de7c1740b19be3ffdd0 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 18:35:01 +0200
Subject: [PATCH 032/317] test: cover scope-exited callback reachability

---
 .../runtime/runtimetypes/MortalList.java      | 106 +++++++++---------
 .../runtimetypes/ReachabilityWalker.java      |  26 +++++
 .../runtime/runtimetypes/RuntimeScalar.java   |   4 +-
 .../RuntimeCodeScopeExitReachabilityTest.java |  47 +++++---
 4 files changed, 109 insertions(+), 74 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 76a01511eb..4413f3c921 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -320,6 +320,8 @@ public static void noteDeferredScopeExitCaptureCandidate(RuntimeScalar scalar) {
         if (scalar == null || !scalar.scopeExited
                 || (scalar.type & RuntimeScalarType.REFERENCE_BIT) == 0
                 || !(scalar.value instanceof RuntimeBase base)
+                || (base instanceof RuntimeCode code
+                        && (scalar.refCountOwned || code.refCount <= 0))
                 || !isDeferredScopeExitCandidate(base)) return;
         noteDeferredScopeExitCaptureCandidate(state(), scalar);
     }
@@ -327,11 +329,17 @@ public static void noteDeferredScopeExitCaptureCandidate(RuntimeScalar scalar) {
     private static void noteDeferredScopeExitCaptureCandidate(
             LifecycleRuntimeState state, RuntimeScalar scalar) {
         if (scalar.value instanceof RuntimeBase base && isDeferredScopeExitCandidate(base)) {
-            state.deferredScopeExitCaptureCandidates.add(scalar);
+            if (state.deferredScopeExitCaptureCandidates.add(scalar)) {
+                markBoundaryWork(state);
+            }
         }
     }
 
     private static boolean isDeferredScopeExitCandidate(RuntimeBase base) {
+        if (base instanceof RuntimeCode code) {
+            return (code.capturedScalars != null && code.capturedScalars.length != 0)
+                    || (code.capturedAggregates != null && code.capturedAggregates.length != 0);
+        }
         if (base == null || base.blessId == 0) return false;
         if (WeakRefRegistry.hasWeakRefsTo(base)) return true;
         String className = NameNormalizer.getBlessStr(base.blessId);
@@ -350,34 +358,64 @@ private static void processUnreachableScopeExitCaptureCandidates(
         if (state.deferredScopeExitCaptureCandidates.isEmpty()) return;
 
         Set<RuntimeBase> endReachable = ReachabilityWalker.walkEndBlockRoots();
-        Set<RuntimeBase> cycleProtected = ReachabilityWalker.strongCycleProtectedReferents();
+        boolean hasCodeCandidates = state.deferredScopeExitCaptureCandidates.stream()
+                .anyMatch(candidate -> candidate.value instanceof RuntimeCode);
+        ReachabilityWalker.RootReachabilitySnapshot codeRootSnapshot = hasCodeCandidates
+                ? ReachabilityWalker.codeReachabilitySnapshot() : null;
+        boolean hasNonCodeCandidates = state.deferredScopeExitCaptureCandidates.stream()
+                .anyMatch(candidate -> !(candidate.value instanceof RuntimeCode));
+        Set<RuntimeBase> cycleProtected = hasNonCodeCandidates
+                ? ReachabilityWalker.strongCycleProtectedReferents() : Collections.emptySet();
         boolean found = false;
+        Set<RuntimeScalar> retainedCodeCandidates =
+                Collections.newSetFromMap(new IdentityHashMap<>());
         for (RuntimeScalar scalar : new ArrayList<>(state.deferredScopeExitCaptureCandidates)) {
             if (!scalar.scopeExited) continue;
             RuntimeBase base = scalar.value instanceof RuntimeBase value ? value : null;
-            boolean scalarReachable = ReachabilityWalker.isScalarReachable(scalar)
-                    || ReachabilityWalker.isReachableFromRoots(scalar);
+            boolean scalarReachable = !(base instanceof RuntimeCode)
+                    && (ReachabilityWalker.isScalarReachable(scalar)
+                    || ReachabilityWalker.isReachableFromRoots(scalar));
+            boolean codeReachable = base instanceof RuntimeCode code
+                    && (code.stashRefCount > 0
+                    || code.activeEndBlockExecutions > 0
+                    || SpecialBlock.hasPendingEndBlock(code)
+                    || RuntimeCode.isActiveCode(code)
+                    || ReachabilityWalker.hasStrongCycle(code)
+                    || codeRootSnapshot.isReachable(code));
             boolean retained = endReachable.contains(scalar)
                     || (base != null && endReachable.contains(base))
                     || (base != null && cycleProtected.contains(base))
-                    || scalarReachable;
-            if (retained) continue;
+                    || scalarReachable
+                    || codeReachable;
+            if (retained) {
+                if (base instanceof RuntimeCode) retainedCodeCandidates.add(scalar);
+                continue;
+            }
 
-            scalar.releaseUnreachableSemanticCaptureOwner();
             Integer deferredCount = state.deferredCapturesSet.get(scalar);
             if (deferredCount != null) {
+                scalar.releaseUnreachableSemanticCaptureOwner();
                 for (int i = state.deferredCaptures.size() - 1; i >= 0; i--) {
                     if (state.deferredCaptures.get(i) != scalar) continue;
                     deferDecrementIfTracked(scalar);
                     state.deferredCaptures.remove(i);
                     removeFromDeferredSet(scalar);
                 }
+            } else if (base instanceof RuntimeCode code) {
+                while (scalar.captureCount > 0) scalar.releaseClosureCapture();
+                scalar.releaseUnreachableSemanticCaptureOwner();
+                if (code.refCount > 0) deferDecrement(code);
+                else code.releaseCaptures();
             } else if (base != null) {
+                scalar.releaseUnreachableSemanticCaptureOwner();
                 requestTargetedWeakSweep(base);
+            } else {
+                scalar.releaseUnreachableSemanticCaptureOwner();
             }
             found = true;
         }
         state.deferredScopeExitCaptureCandidates.clear();
+        state.deferredScopeExitCaptureCandidates.addAll(retainedCodeCandidates);
         if (found) flushAboveMark();
     }
 
@@ -722,9 +760,6 @@ public static void scopeExitCleanupHash(RuntimeHash hash) {
                 && hash.refCount >= 0
                 && hash.hadCountedReference
                 && isReachableFromExternalRootCached(hash)) return;
-        if (hadLocalBinding
-                && containerContainsCodeReference(hash)
-                && isReachableFromExternalRootCached(hash)) return;
         List<RuntimeScalar> valuesInDestructionOrder = new ArrayList<>(hash.elements.values());
         Collections.reverse(valuesInDestructionOrder);
         for (RuntimeScalar val : valuesInDestructionOrder) {
@@ -765,11 +800,6 @@ public static void scopeExitCleanupArray(RuntimeArray arr, RuntimeBase returned)
         // Alias arrays such as @_ do not own their original element slots.
         if (arr.refCount > 0 || temporaryRootDirectlyReferences(arr)
                 || directlyReferences(returned, arr)) return;
-        // Refcount tracking does not cover every Perl callback container.
-        // Keep a CODE-bearing array intact while a persistent Perl root still
-        // owns it (for example, Mojo::Reactor's recurring timer table).
-        if (containerContainsCodeReference(arr)
-                && isReachableFromExternalRootCached(arr)) return;
         // \$#array creates a scalar proxy, not an array reference.  Once the
         // lexical AV exits, that proxy becomes an orphaned undef lvalue; it
         // must not retain this Java RuntimeArray merely through its backing
@@ -1011,11 +1041,6 @@ private static void deferDecrementRecursive(RuntimeScalar scalar) {
             if (!(s.value instanceof RuntimeBase base)) continue;
             if (!visited.add(base)) continue;  // already visited — cycle
 
-            if (base instanceof RuntimeCode) {
-                deferDecrementIfTracked(s);
-                continue;
-            }
-
             if (base.blessId != 0) {
                 boolean releasingLastOwner = false;
                 if (s.refCountOwned && base.refCount > 0) {
@@ -1154,35 +1179,6 @@ private static boolean scalarMayContainCleanupTarget(RuntimeScalar scalar,
         return false;
     }
 
-    /** Whether an aggregate contains a CODE slot, including through nested aggregates. */
-    private static boolean containerContainsCodeReference(RuntimeBase container) {
-        if (!(container instanceof RuntimeArray || container instanceof RuntimeHash)) return false;
-        ArrayDeque<RuntimeBase> work = new ArrayDeque<>();
-        Set<RuntimeBase> visited = Collections.newSetFromMap(new IdentityHashMap<>());
-        work.add(container);
-        while (!work.isEmpty()) {
-            RuntimeBase current = work.removeFirst();
-            if (!visited.add(current)) continue;
-            Iterable<RuntimeScalar> values;
-            if (current instanceof RuntimeArray array) {
-                values = array.elements;
-            } else if (current instanceof RuntimeHash hash) {
-                values = hash.elements.values();
-            } else {
-                continue;
-            }
-            for (RuntimeScalar value : values) {
-                if (value == null || (value.type & RuntimeScalarType.REFERENCE_BIT) == 0
-                        || !(value.value instanceof RuntimeBase referent)) continue;
-                if (referent instanceof RuntimeCode) return true;
-                if (referent instanceof RuntimeArray || referent instanceof RuntimeHash) {
-                    work.addLast(referent);
-                }
-            }
-        }
-        return false;
-    }
-
     private static boolean containerHasWeakElementRefs(RuntimeBase base) {
         if (!WeakRefRegistry.weakRefsExist()) return false;
         if (base instanceof RuntimeArray arr) {
@@ -1556,10 +1552,14 @@ static boolean isReachableFromPersistentRootCached(RuntimeBase base) {
     }
 
     static void invalidateExternalRootSnapshot() {
-        state().externalRootSnapshot = null;
-        state().fullRootSnapshot = null;
-        state().unblessedAggregateRootSnapshot = null;
-        state().scalarRootSnapshot = null;
+        LifecycleRuntimeState state = state();
+        state.externalRootSnapshot = null;
+        state.fullRootSnapshot = null;
+        state.unblessedAggregateRootSnapshot = null;
+        state.scalarRootSnapshot = null;
+        if (!state.deferredScopeExitCaptureCandidates.isEmpty()) {
+            markBoundaryWork(state);
+        }
     }
 
     static void invalidateAllRootSnapshots() {
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 870dd5b693..946483f2c7 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1370,6 +1370,10 @@ static boolean isCodeReachableFromRoots(RuntimeCode code) {
                 && reachableFromRootsSnapshotWithStatus(true, false).isReachable(code);
     }
 
+    static RootReachabilitySnapshot codeReachabilitySnapshot() {
+        return reachableFromRootsSnapshotWithStatus(true, false);
+    }
+
     /**
      * Collect the bounded root graph needed to answer reachability for
      * unblessed aggregates. Installed CODE slot identities cannot own an
@@ -1504,6 +1508,28 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
                     else followScalarIncludingCode(value, null, seen, todo);
                 }
             } else if (!includeOwnedCapturePads && cur instanceof RuntimeCode code) {
+                if (code.padConstants != null) {
+                    for (RuntimeBase constant : code.padConstants) {
+                        if (!budget.visitEdge()) break walk;
+                        if (stats != null) stats.edgesInspected++;
+                        if (constant != null && seen.add(constant)) todo.addLast(constant);
+                    }
+                }
+                for (RuntimeScalar state : code.stateVariable.values()) {
+                    if (!budget.visitEdge()) break walk;
+                    if (stats != null) stats.edgesInspected++;
+                    followScalarIncludingCode(state, null, seen, todo);
+                }
+                for (RuntimeArray state : code.stateArray.values()) {
+                    if (!budget.visitEdge()) break walk;
+                    if (stats != null) stats.edgesInspected++;
+                    if (seen.add(state)) todo.addLast(state);
+                }
+                for (RuntimeHash state : code.stateHash.values()) {
+                    if (!budget.visitEdge()) break walk;
+                    if (stats != null) stats.edgesInspected++;
+                    if (seen.add(state)) todo.addLast(state);
+                }
                 if (code.capturedScalars != null) {
                     for (RuntimeScalar captured : code.capturedScalars) {
                         if (!budget.visitEdge()) break walk;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 1138c0ee98..96e64535f0 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -5327,9 +5327,7 @@ public static void scopeExitCleanup(RuntimeScalar scalar) {
             // Mark that this variable's scope has exited. When releaseCaptures
             // later decrements captureCount to 0, it will know the scope is gone.
             scalar.scopeExited = true;
-            if (scalar.type != RuntimeScalarType.CODE) {
-                MortalList.noteDeferredScopeExitCaptureCandidate(scalar);
-            }
+            MortalList.noteDeferredScopeExitCaptureCandidate(scalar);
             // For CODE refs: still decrement the VALUE's refCount so the RuntimeCode
             // is eventually destroyed and its releaseCaptures fires (decrementing
             // captureCount on all the variables IT captured). This is critical for
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
index e4ae6b045d..c69e1aec44 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
@@ -6,8 +6,10 @@
 import java.util.List;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 
 @Tag("unit")
 class RuntimeCodeScopeExitReachabilityTest {
@@ -65,7 +67,7 @@ void deferredReleaseRetainsCapturesForCodeStoredInReachableHashWithoutWeakRefs()
 
             try {
                 MortalList.deferDecrement(callback);
-                MortalList.flush();
+                MortalList.flushAboveMark();
 
                 assertNotNull(callback.capturedScalars,
                         "a rooted callback must keep its lexical captures when a temporary owner is released");
@@ -73,7 +75,7 @@ void deferredReleaseRetainsCapturesForCodeStoredInReachableHashWithoutWeakRefs()
 
                 GlobalVariable.globalHashes.remove(globalName);
                 MortalList.deferDecrement(callback);
-                MortalList.flush();
+                MortalList.flushAboveMark();
 
                 assertNull(callback.capturedScalars,
                         "removing the last Perl root must release callback captures");
@@ -86,7 +88,7 @@ void deferredReleaseRetainsCapturesForCodeStoredInReachableHashWithoutWeakRefs()
     }
 
     @Test
-    void arrayScopeExitPreservesRootedCallbacksThenReleasesThemWhenRootIsRemoved() {
+    void scopeExitedCapturedCodeIsReleasedAfterItsLastRootDisappears() {
         PerlRuntime runtime = new PerlRuntime();
         try (PerlRuntime.Binding ignored = runtime.bind()) {
             RuntimeScalar captured = new RuntimeScalar("captured");
@@ -96,35 +98,44 @@ void arrayScopeExitPreservesRootedCallbacksThenReleasesThemWhenRootIsRemoved() {
             callback.capturedScalars = new RuntimeScalar[] { captured };
 
             RuntimeScalar codeRef = new RuntimeScalar(callback);
-            codeRef.refCountOwned = true;
-            RuntimeArray callbacks = new RuntimeArray();
-            callbacks.elements.add(codeRef);
-            callbacks.elementsOwned = true;
+            codeRef.retainClosureCapture();
             String globalName = "RuntimeCodeScopeExitReachabilityTest::callbacks";
-            GlobalVariable.globalArrays.put(globalName, callbacks);
+            RuntimeHash callbacks = new RuntimeHash();
+            callbacks.elements.put("callback", codeRef);
+            GlobalVariable.globalHashes.put(globalName, callbacks);
 
-            RuntimeScalar weakProbe = new RuntimeScalar(new RuntimeHash()).createReference();
-            WeakRefRegistry.weaken(weakProbe);
             boolean previousActive = MortalList.isActive();
             MortalList.setActive(true);
             try {
-                MortalList.scopeExitCleanupArray(callbacks);
+                RuntimeScalar.scopeExitCleanup(codeRef);
+                assertTrue(codeRef.scopeExited);
+                assertTrue(runtime.lifecycleState.deferredScopeExitCaptureCandidates.contains(codeRef));
+                assertTrue(callback.capturedScalars != null,
+                        "a rooted callback keeps its captures while the pad is live");
                 MortalList.flush();
+                assertTrue(runtime.lifecycleState.deferredScopeExitCaptureCandidates.contains(codeRef));
 
-                assertEquals(1, callback.refCount,
-                        "a persistent aggregate root keeps its callback owner count");
                 assertNotNull(callback.capturedScalars,
-                        "a persistent aggregate root keeps callback captures");
+                        "a persistent Perl container keeps the scope-exited callback");
 
-                GlobalVariable.globalArrays.remove(globalName);
-                MortalList.scopeExitCleanupArray(callbacks);
+                GlobalVariable.globalHashes.remove(globalName);
+                MortalList.invalidateExternalRootSnapshot();
+                assertTrue(runtime.lifecycleState.deferredScopeExitCaptureCandidates.contains(codeRef));
+                assertFalse(ReachabilityWalker.isCodeReachableFromRoots(callback),
+                        "the callback must no longer be reachable after removing its hash root");
+                assertFalse(ReachabilityWalker.walkEndBlockRoots().contains(callback));
+                assertFalse(ReachabilityWalker.walkEndBlockRoots().contains(codeRef));
+                assertFalse(ReachabilityWalker.hasStrongCycle(callback));
+                assertFalse(SpecialBlock.hasPendingEndBlock(callback));
+                assertFalse(RuntimeCode.isActiveCode(callback));
                 MortalList.flush();
+                assertFalse(runtime.lifecycleState.deferredScopeExitCaptureCandidates.contains(codeRef));
 
                 assertNull(callback.capturedScalars,
-                        "discarding the last callback container releases its captures");
+                        "removing the final Perl root releases the stale callback captures");
                 assertEquals(0, captured.captureCount);
             } finally {
-                GlobalVariable.globalArrays.remove(globalName);
+                GlobalVariable.globalHashes.remove(globalName);
                 MortalList.setActive(previousActive);
             }
         }

From e79da2fbd23bb71bea00a1c0c8148f2703ea9cee Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 18:36:08 +0200
Subject: [PATCH 033/317] test: flush callback candidates at scope boundary

---
 .../runtimetypes/RuntimeCodeScopeExitReachabilityTest.java    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
index c69e1aec44..909ddaf1ae 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
@@ -112,7 +112,7 @@ void scopeExitedCapturedCodeIsReleasedAfterItsLastRootDisappears() {
                 assertTrue(runtime.lifecycleState.deferredScopeExitCaptureCandidates.contains(codeRef));
                 assertTrue(callback.capturedScalars != null,
                         "a rooted callback keeps its captures while the pad is live");
-                MortalList.flush();
+                MortalList.flushAboveMark();
                 assertTrue(runtime.lifecycleState.deferredScopeExitCaptureCandidates.contains(codeRef));
 
                 assertNotNull(callback.capturedScalars,
@@ -128,7 +128,7 @@ void scopeExitedCapturedCodeIsReleasedAfterItsLastRootDisappears() {
                 assertFalse(ReachabilityWalker.hasStrongCycle(callback));
                 assertFalse(SpecialBlock.hasPendingEndBlock(callback));
                 assertFalse(RuntimeCode.isActiveCode(callback));
-                MortalList.flush();
+                MortalList.flushAboveMark();
                 assertFalse(runtime.lifecycleState.deferredScopeExitCaptureCandidates.contains(codeRef));
 
                 assertNull(callback.capturedScalars,

From 9aa0a82cf361ff88dee9a84e7003559536357bf8 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 19:49:26 +0200
Subject: [PATCH 034/317] Revert "test: flush callback candidates at scope
 boundary"

This reverts commit d23b242e2d1289a4eea50593d3003f69a09b0ab0.
---
 .../runtimetypes/RuntimeCodeScopeExitReachabilityTest.java    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
index 909ddaf1ae..c69e1aec44 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
@@ -112,7 +112,7 @@ void scopeExitedCapturedCodeIsReleasedAfterItsLastRootDisappears() {
                 assertTrue(runtime.lifecycleState.deferredScopeExitCaptureCandidates.contains(codeRef));
                 assertTrue(callback.capturedScalars != null,
                         "a rooted callback keeps its captures while the pad is live");
-                MortalList.flushAboveMark();
+                MortalList.flush();
                 assertTrue(runtime.lifecycleState.deferredScopeExitCaptureCandidates.contains(codeRef));
 
                 assertNotNull(callback.capturedScalars,
@@ -128,7 +128,7 @@ void scopeExitedCapturedCodeIsReleasedAfterItsLastRootDisappears() {
                 assertFalse(ReachabilityWalker.hasStrongCycle(callback));
                 assertFalse(SpecialBlock.hasPendingEndBlock(callback));
                 assertFalse(RuntimeCode.isActiveCode(callback));
-                MortalList.flushAboveMark();
+                MortalList.flush();
                 assertFalse(runtime.lifecycleState.deferredScopeExitCaptureCandidates.contains(codeRef));
 
                 assertNull(callback.capturedScalars,

From a8ff1def704cf1fb3d9f39ae29d3beb0582b855e Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 19:49:26 +0200
Subject: [PATCH 035/317] Revert "test: cover scope-exited callback
 reachability"

This reverts commit 0025be33bc9d8fd89d857fe3118e62e7d511fb91.
---
 .../runtime/runtimetypes/MortalList.java      | 106 +++++++++---------
 .../runtimetypes/ReachabilityWalker.java      |  26 -----
 .../runtime/runtimetypes/RuntimeScalar.java   |   4 +-
 .../RuntimeCodeScopeExitReachabilityTest.java |  47 +++-----
 4 files changed, 74 insertions(+), 109 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 4413f3c921..76a01511eb 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -320,8 +320,6 @@ public static void noteDeferredScopeExitCaptureCandidate(RuntimeScalar scalar) {
         if (scalar == null || !scalar.scopeExited
                 || (scalar.type & RuntimeScalarType.REFERENCE_BIT) == 0
                 || !(scalar.value instanceof RuntimeBase base)
-                || (base instanceof RuntimeCode code
-                        && (scalar.refCountOwned || code.refCount <= 0))
                 || !isDeferredScopeExitCandidate(base)) return;
         noteDeferredScopeExitCaptureCandidate(state(), scalar);
     }
@@ -329,17 +327,11 @@ public static void noteDeferredScopeExitCaptureCandidate(RuntimeScalar scalar) {
     private static void noteDeferredScopeExitCaptureCandidate(
             LifecycleRuntimeState state, RuntimeScalar scalar) {
         if (scalar.value instanceof RuntimeBase base && isDeferredScopeExitCandidate(base)) {
-            if (state.deferredScopeExitCaptureCandidates.add(scalar)) {
-                markBoundaryWork(state);
-            }
+            state.deferredScopeExitCaptureCandidates.add(scalar);
         }
     }
 
     private static boolean isDeferredScopeExitCandidate(RuntimeBase base) {
-        if (base instanceof RuntimeCode code) {
-            return (code.capturedScalars != null && code.capturedScalars.length != 0)
-                    || (code.capturedAggregates != null && code.capturedAggregates.length != 0);
-        }
         if (base == null || base.blessId == 0) return false;
         if (WeakRefRegistry.hasWeakRefsTo(base)) return true;
         String className = NameNormalizer.getBlessStr(base.blessId);
@@ -358,64 +350,34 @@ private static void processUnreachableScopeExitCaptureCandidates(
         if (state.deferredScopeExitCaptureCandidates.isEmpty()) return;
 
         Set<RuntimeBase> endReachable = ReachabilityWalker.walkEndBlockRoots();
-        boolean hasCodeCandidates = state.deferredScopeExitCaptureCandidates.stream()
-                .anyMatch(candidate -> candidate.value instanceof RuntimeCode);
-        ReachabilityWalker.RootReachabilitySnapshot codeRootSnapshot = hasCodeCandidates
-                ? ReachabilityWalker.codeReachabilitySnapshot() : null;
-        boolean hasNonCodeCandidates = state.deferredScopeExitCaptureCandidates.stream()
-                .anyMatch(candidate -> !(candidate.value instanceof RuntimeCode));
-        Set<RuntimeBase> cycleProtected = hasNonCodeCandidates
-                ? ReachabilityWalker.strongCycleProtectedReferents() : Collections.emptySet();
+        Set<RuntimeBase> cycleProtected = ReachabilityWalker.strongCycleProtectedReferents();
         boolean found = false;
-        Set<RuntimeScalar> retainedCodeCandidates =
-                Collections.newSetFromMap(new IdentityHashMap<>());
         for (RuntimeScalar scalar : new ArrayList<>(state.deferredScopeExitCaptureCandidates)) {
             if (!scalar.scopeExited) continue;
             RuntimeBase base = scalar.value instanceof RuntimeBase value ? value : null;
-            boolean scalarReachable = !(base instanceof RuntimeCode)
-                    && (ReachabilityWalker.isScalarReachable(scalar)
-                    || ReachabilityWalker.isReachableFromRoots(scalar));
-            boolean codeReachable = base instanceof RuntimeCode code
-                    && (code.stashRefCount > 0
-                    || code.activeEndBlockExecutions > 0
-                    || SpecialBlock.hasPendingEndBlock(code)
-                    || RuntimeCode.isActiveCode(code)
-                    || ReachabilityWalker.hasStrongCycle(code)
-                    || codeRootSnapshot.isReachable(code));
+            boolean scalarReachable = ReachabilityWalker.isScalarReachable(scalar)
+                    || ReachabilityWalker.isReachableFromRoots(scalar);
             boolean retained = endReachable.contains(scalar)
                     || (base != null && endReachable.contains(base))
                     || (base != null && cycleProtected.contains(base))
-                    || scalarReachable
-                    || codeReachable;
-            if (retained) {
-                if (base instanceof RuntimeCode) retainedCodeCandidates.add(scalar);
-                continue;
-            }
+                    || scalarReachable;
+            if (retained) continue;
 
+            scalar.releaseUnreachableSemanticCaptureOwner();
             Integer deferredCount = state.deferredCapturesSet.get(scalar);
             if (deferredCount != null) {
-                scalar.releaseUnreachableSemanticCaptureOwner();
                 for (int i = state.deferredCaptures.size() - 1; i >= 0; i--) {
                     if (state.deferredCaptures.get(i) != scalar) continue;
                     deferDecrementIfTracked(scalar);
                     state.deferredCaptures.remove(i);
                     removeFromDeferredSet(scalar);
                 }
-            } else if (base instanceof RuntimeCode code) {
-                while (scalar.captureCount > 0) scalar.releaseClosureCapture();
-                scalar.releaseUnreachableSemanticCaptureOwner();
-                if (code.refCount > 0) deferDecrement(code);
-                else code.releaseCaptures();
             } else if (base != null) {
-                scalar.releaseUnreachableSemanticCaptureOwner();
                 requestTargetedWeakSweep(base);
-            } else {
-                scalar.releaseUnreachableSemanticCaptureOwner();
             }
             found = true;
         }
         state.deferredScopeExitCaptureCandidates.clear();
-        state.deferredScopeExitCaptureCandidates.addAll(retainedCodeCandidates);
         if (found) flushAboveMark();
     }
 
@@ -760,6 +722,9 @@ public static void scopeExitCleanupHash(RuntimeHash hash) {
                 && hash.refCount >= 0
                 && hash.hadCountedReference
                 && isReachableFromExternalRootCached(hash)) return;
+        if (hadLocalBinding
+                && containerContainsCodeReference(hash)
+                && isReachableFromExternalRootCached(hash)) return;
         List<RuntimeScalar> valuesInDestructionOrder = new ArrayList<>(hash.elements.values());
         Collections.reverse(valuesInDestructionOrder);
         for (RuntimeScalar val : valuesInDestructionOrder) {
@@ -800,6 +765,11 @@ public static void scopeExitCleanupArray(RuntimeArray arr, RuntimeBase returned)
         // Alias arrays such as @_ do not own their original element slots.
         if (arr.refCount > 0 || temporaryRootDirectlyReferences(arr)
                 || directlyReferences(returned, arr)) return;
+        // Refcount tracking does not cover every Perl callback container.
+        // Keep a CODE-bearing array intact while a persistent Perl root still
+        // owns it (for example, Mojo::Reactor's recurring timer table).
+        if (containerContainsCodeReference(arr)
+                && isReachableFromExternalRootCached(arr)) return;
         // \$#array creates a scalar proxy, not an array reference.  Once the
         // lexical AV exits, that proxy becomes an orphaned undef lvalue; it
         // must not retain this Java RuntimeArray merely through its backing
@@ -1041,6 +1011,11 @@ private static void deferDecrementRecursive(RuntimeScalar scalar) {
             if (!(s.value instanceof RuntimeBase base)) continue;
             if (!visited.add(base)) continue;  // already visited — cycle
 
+            if (base instanceof RuntimeCode) {
+                deferDecrementIfTracked(s);
+                continue;
+            }
+
             if (base.blessId != 0) {
                 boolean releasingLastOwner = false;
                 if (s.refCountOwned && base.refCount > 0) {
@@ -1179,6 +1154,35 @@ private static boolean scalarMayContainCleanupTarget(RuntimeScalar scalar,
         return false;
     }
 
+    /** Whether an aggregate contains a CODE slot, including through nested aggregates. */
+    private static boolean containerContainsCodeReference(RuntimeBase container) {
+        if (!(container instanceof RuntimeArray || container instanceof RuntimeHash)) return false;
+        ArrayDeque<RuntimeBase> work = new ArrayDeque<>();
+        Set<RuntimeBase> visited = Collections.newSetFromMap(new IdentityHashMap<>());
+        work.add(container);
+        while (!work.isEmpty()) {
+            RuntimeBase current = work.removeFirst();
+            if (!visited.add(current)) continue;
+            Iterable<RuntimeScalar> values;
+            if (current instanceof RuntimeArray array) {
+                values = array.elements;
+            } else if (current instanceof RuntimeHash hash) {
+                values = hash.elements.values();
+            } else {
+                continue;
+            }
+            for (RuntimeScalar value : values) {
+                if (value == null || (value.type & RuntimeScalarType.REFERENCE_BIT) == 0
+                        || !(value.value instanceof RuntimeBase referent)) continue;
+                if (referent instanceof RuntimeCode) return true;
+                if (referent instanceof RuntimeArray || referent instanceof RuntimeHash) {
+                    work.addLast(referent);
+                }
+            }
+        }
+        return false;
+    }
+
     private static boolean containerHasWeakElementRefs(RuntimeBase base) {
         if (!WeakRefRegistry.weakRefsExist()) return false;
         if (base instanceof RuntimeArray arr) {
@@ -1552,14 +1556,10 @@ static boolean isReachableFromPersistentRootCached(RuntimeBase base) {
     }
 
     static void invalidateExternalRootSnapshot() {
-        LifecycleRuntimeState state = state();
-        state.externalRootSnapshot = null;
-        state.fullRootSnapshot = null;
-        state.unblessedAggregateRootSnapshot = null;
-        state.scalarRootSnapshot = null;
-        if (!state.deferredScopeExitCaptureCandidates.isEmpty()) {
-            markBoundaryWork(state);
-        }
+        state().externalRootSnapshot = null;
+        state().fullRootSnapshot = null;
+        state().unblessedAggregateRootSnapshot = null;
+        state().scalarRootSnapshot = null;
     }
 
     static void invalidateAllRootSnapshots() {
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 946483f2c7..870dd5b693 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1370,10 +1370,6 @@ static boolean isCodeReachableFromRoots(RuntimeCode code) {
                 && reachableFromRootsSnapshotWithStatus(true, false).isReachable(code);
     }
 
-    static RootReachabilitySnapshot codeReachabilitySnapshot() {
-        return reachableFromRootsSnapshotWithStatus(true, false);
-    }
-
     /**
      * Collect the bounded root graph needed to answer reachability for
      * unblessed aggregates. Installed CODE slot identities cannot own an
@@ -1508,28 +1504,6 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
                     else followScalarIncludingCode(value, null, seen, todo);
                 }
             } else if (!includeOwnedCapturePads && cur instanceof RuntimeCode code) {
-                if (code.padConstants != null) {
-                    for (RuntimeBase constant : code.padConstants) {
-                        if (!budget.visitEdge()) break walk;
-                        if (stats != null) stats.edgesInspected++;
-                        if (constant != null && seen.add(constant)) todo.addLast(constant);
-                    }
-                }
-                for (RuntimeScalar state : code.stateVariable.values()) {
-                    if (!budget.visitEdge()) break walk;
-                    if (stats != null) stats.edgesInspected++;
-                    followScalarIncludingCode(state, null, seen, todo);
-                }
-                for (RuntimeArray state : code.stateArray.values()) {
-                    if (!budget.visitEdge()) break walk;
-                    if (stats != null) stats.edgesInspected++;
-                    if (seen.add(state)) todo.addLast(state);
-                }
-                for (RuntimeHash state : code.stateHash.values()) {
-                    if (!budget.visitEdge()) break walk;
-                    if (stats != null) stats.edgesInspected++;
-                    if (seen.add(state)) todo.addLast(state);
-                }
                 if (code.capturedScalars != null) {
                     for (RuntimeScalar captured : code.capturedScalars) {
                         if (!budget.visitEdge()) break walk;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 96e64535f0..1138c0ee98 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -5327,7 +5327,9 @@ public static void scopeExitCleanup(RuntimeScalar scalar) {
             // Mark that this variable's scope has exited. When releaseCaptures
             // later decrements captureCount to 0, it will know the scope is gone.
             scalar.scopeExited = true;
-            MortalList.noteDeferredScopeExitCaptureCandidate(scalar);
+            if (scalar.type != RuntimeScalarType.CODE) {
+                MortalList.noteDeferredScopeExitCaptureCandidate(scalar);
+            }
             // For CODE refs: still decrement the VALUE's refCount so the RuntimeCode
             // is eventually destroyed and its releaseCaptures fires (decrementing
             // captureCount on all the variables IT captured). This is critical for
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
index c69e1aec44..e4ae6b045d 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
@@ -6,10 +6,8 @@
 import java.util.List;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
-import static org.junit.jupiter.api.Assertions.assertTrue;
 
 @Tag("unit")
 class RuntimeCodeScopeExitReachabilityTest {
@@ -67,7 +65,7 @@ void deferredReleaseRetainsCapturesForCodeStoredInReachableHashWithoutWeakRefs()
 
             try {
                 MortalList.deferDecrement(callback);
-                MortalList.flushAboveMark();
+                MortalList.flush();
 
                 assertNotNull(callback.capturedScalars,
                         "a rooted callback must keep its lexical captures when a temporary owner is released");
@@ -75,7 +73,7 @@ void deferredReleaseRetainsCapturesForCodeStoredInReachableHashWithoutWeakRefs()
 
                 GlobalVariable.globalHashes.remove(globalName);
                 MortalList.deferDecrement(callback);
-                MortalList.flushAboveMark();
+                MortalList.flush();
 
                 assertNull(callback.capturedScalars,
                         "removing the last Perl root must release callback captures");
@@ -88,7 +86,7 @@ void deferredReleaseRetainsCapturesForCodeStoredInReachableHashWithoutWeakRefs()
     }
 
     @Test
-    void scopeExitedCapturedCodeIsReleasedAfterItsLastRootDisappears() {
+    void arrayScopeExitPreservesRootedCallbacksThenReleasesThemWhenRootIsRemoved() {
         PerlRuntime runtime = new PerlRuntime();
         try (PerlRuntime.Binding ignored = runtime.bind()) {
             RuntimeScalar captured = new RuntimeScalar("captured");
@@ -98,44 +96,35 @@ void scopeExitedCapturedCodeIsReleasedAfterItsLastRootDisappears() {
             callback.capturedScalars = new RuntimeScalar[] { captured };
 
             RuntimeScalar codeRef = new RuntimeScalar(callback);
-            codeRef.retainClosureCapture();
+            codeRef.refCountOwned = true;
+            RuntimeArray callbacks = new RuntimeArray();
+            callbacks.elements.add(codeRef);
+            callbacks.elementsOwned = true;
             String globalName = "RuntimeCodeScopeExitReachabilityTest::callbacks";
-            RuntimeHash callbacks = new RuntimeHash();
-            callbacks.elements.put("callback", codeRef);
-            GlobalVariable.globalHashes.put(globalName, callbacks);
+            GlobalVariable.globalArrays.put(globalName, callbacks);
 
+            RuntimeScalar weakProbe = new RuntimeScalar(new RuntimeHash()).createReference();
+            WeakRefRegistry.weaken(weakProbe);
             boolean previousActive = MortalList.isActive();
             MortalList.setActive(true);
             try {
-                RuntimeScalar.scopeExitCleanup(codeRef);
-                assertTrue(codeRef.scopeExited);
-                assertTrue(runtime.lifecycleState.deferredScopeExitCaptureCandidates.contains(codeRef));
-                assertTrue(callback.capturedScalars != null,
-                        "a rooted callback keeps its captures while the pad is live");
+                MortalList.scopeExitCleanupArray(callbacks);
                 MortalList.flush();
-                assertTrue(runtime.lifecycleState.deferredScopeExitCaptureCandidates.contains(codeRef));
 
+                assertEquals(1, callback.refCount,
+                        "a persistent aggregate root keeps its callback owner count");
                 assertNotNull(callback.capturedScalars,
-                        "a persistent Perl container keeps the scope-exited callback");
+                        "a persistent aggregate root keeps callback captures");
 
-                GlobalVariable.globalHashes.remove(globalName);
-                MortalList.invalidateExternalRootSnapshot();
-                assertTrue(runtime.lifecycleState.deferredScopeExitCaptureCandidates.contains(codeRef));
-                assertFalse(ReachabilityWalker.isCodeReachableFromRoots(callback),
-                        "the callback must no longer be reachable after removing its hash root");
-                assertFalse(ReachabilityWalker.walkEndBlockRoots().contains(callback));
-                assertFalse(ReachabilityWalker.walkEndBlockRoots().contains(codeRef));
-                assertFalse(ReachabilityWalker.hasStrongCycle(callback));
-                assertFalse(SpecialBlock.hasPendingEndBlock(callback));
-                assertFalse(RuntimeCode.isActiveCode(callback));
+                GlobalVariable.globalArrays.remove(globalName);
+                MortalList.scopeExitCleanupArray(callbacks);
                 MortalList.flush();
-                assertFalse(runtime.lifecycleState.deferredScopeExitCaptureCandidates.contains(codeRef));
 
                 assertNull(callback.capturedScalars,
-                        "removing the final Perl root releases the stale callback captures");
+                        "discarding the last callback container releases its captures");
                 assertEquals(0, captured.captureCount);
             } finally {
-                GlobalVariable.globalHashes.remove(globalName);
+                GlobalVariable.globalArrays.remove(globalName);
                 MortalList.setActive(previousActive);
             }
         }

From d5692d4eb6f8a1460b3162c2bf6109e4893230c8 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 19:49:26 +0200
Subject: [PATCH 036/317] Revert "fix: release callback owners from discarded
 containers"

This reverts commit e80ce2c4d298e6274e96dd95a3b89ef6f392738b.
---
 .../runtime/runtimetypes/MortalList.java      | 42 -----------------
 .../RuntimeCodeScopeExitReachabilityTest.java | 46 -------------------
 2 files changed, 88 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 76a01511eb..93cc616e97 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -722,9 +722,6 @@ public static void scopeExitCleanupHash(RuntimeHash hash) {
                 && hash.refCount >= 0
                 && hash.hadCountedReference
                 && isReachableFromExternalRootCached(hash)) return;
-        if (hadLocalBinding
-                && containerContainsCodeReference(hash)
-                && isReachableFromExternalRootCached(hash)) return;
         List<RuntimeScalar> valuesInDestructionOrder = new ArrayList<>(hash.elements.values());
         Collections.reverse(valuesInDestructionOrder);
         for (RuntimeScalar val : valuesInDestructionOrder) {
@@ -765,11 +762,6 @@ public static void scopeExitCleanupArray(RuntimeArray arr, RuntimeBase returned)
         // Alias arrays such as @_ do not own their original element slots.
         if (arr.refCount > 0 || temporaryRootDirectlyReferences(arr)
                 || directlyReferences(returned, arr)) return;
-        // Refcount tracking does not cover every Perl callback container.
-        // Keep a CODE-bearing array intact while a persistent Perl root still
-        // owns it (for example, Mojo::Reactor's recurring timer table).
-        if (containerContainsCodeReference(arr)
-                && isReachableFromExternalRootCached(arr)) return;
         // \$#array creates a scalar proxy, not an array reference.  Once the
         // lexical AV exits, that proxy becomes an orphaned undef lvalue; it
         // must not retain this Java RuntimeArray merely through its backing
@@ -1011,11 +1003,6 @@ private static void deferDecrementRecursive(RuntimeScalar scalar) {
             if (!(s.value instanceof RuntimeBase base)) continue;
             if (!visited.add(base)) continue;  // already visited — cycle
 
-            if (base instanceof RuntimeCode) {
-                deferDecrementIfTracked(s);
-                continue;
-            }
-
             if (base.blessId != 0) {
                 boolean releasingLastOwner = false;
                 if (s.refCountOwned && base.refCount > 0) {
@@ -1154,35 +1141,6 @@ private static boolean scalarMayContainCleanupTarget(RuntimeScalar scalar,
         return false;
     }
 
-    /** Whether an aggregate contains a CODE slot, including through nested aggregates. */
-    private static boolean containerContainsCodeReference(RuntimeBase container) {
-        if (!(container instanceof RuntimeArray || container instanceof RuntimeHash)) return false;
-        ArrayDeque<RuntimeBase> work = new ArrayDeque<>();
-        Set<RuntimeBase> visited = Collections.newSetFromMap(new IdentityHashMap<>());
-        work.add(container);
-        while (!work.isEmpty()) {
-            RuntimeBase current = work.removeFirst();
-            if (!visited.add(current)) continue;
-            Iterable<RuntimeScalar> values;
-            if (current instanceof RuntimeArray array) {
-                values = array.elements;
-            } else if (current instanceof RuntimeHash hash) {
-                values = hash.elements.values();
-            } else {
-                continue;
-            }
-            for (RuntimeScalar value : values) {
-                if (value == null || (value.type & RuntimeScalarType.REFERENCE_BIT) == 0
-                        || !(value.value instanceof RuntimeBase referent)) continue;
-                if (referent instanceof RuntimeCode) return true;
-                if (referent instanceof RuntimeArray || referent instanceof RuntimeHash) {
-                    work.addLast(referent);
-                }
-            }
-        }
-        return false;
-    }
-
     private static boolean containerHasWeakElementRefs(RuntimeBase base) {
         if (!WeakRefRegistry.weakRefsExist()) return false;
         if (base instanceof RuntimeArray arr) {
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
index e4ae6b045d..659e81ac50 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
@@ -84,50 +84,4 @@ void deferredReleaseRetainsCapturesForCodeStoredInReachableHashWithoutWeakRefs()
             }
         }
     }
-
-    @Test
-    void arrayScopeExitPreservesRootedCallbacksThenReleasesThemWhenRootIsRemoved() {
-        PerlRuntime runtime = new PerlRuntime();
-        try (PerlRuntime.Binding ignored = runtime.bind()) {
-            RuntimeScalar captured = new RuntimeScalar("captured");
-            captured.retainClosureCapture();
-            RuntimeCode callback = new RuntimeCode(null, List.of());
-            callback.refCount = 1;
-            callback.capturedScalars = new RuntimeScalar[] { captured };
-
-            RuntimeScalar codeRef = new RuntimeScalar(callback);
-            codeRef.refCountOwned = true;
-            RuntimeArray callbacks = new RuntimeArray();
-            callbacks.elements.add(codeRef);
-            callbacks.elementsOwned = true;
-            String globalName = "RuntimeCodeScopeExitReachabilityTest::callbacks";
-            GlobalVariable.globalArrays.put(globalName, callbacks);
-
-            RuntimeScalar weakProbe = new RuntimeScalar(new RuntimeHash()).createReference();
-            WeakRefRegistry.weaken(weakProbe);
-            boolean previousActive = MortalList.isActive();
-            MortalList.setActive(true);
-            try {
-                MortalList.scopeExitCleanupArray(callbacks);
-                MortalList.flush();
-
-                assertEquals(1, callback.refCount,
-                        "a persistent aggregate root keeps its callback owner count");
-                assertNotNull(callback.capturedScalars,
-                        "a persistent aggregate root keeps callback captures");
-
-                GlobalVariable.globalArrays.remove(globalName);
-                MortalList.scopeExitCleanupArray(callbacks);
-                MortalList.flush();
-
-                assertNull(callback.capturedScalars,
-                        "discarding the last callback container releases its captures");
-                assertEquals(0, captured.captureCount);
-            } finally {
-                GlobalVariable.globalArrays.remove(globalName);
-                MortalList.setActive(previousActive);
-            }
-        }
-    }
-
 }

From 0f972f3561c68f9deee1f415559d80bf3d98b8c1 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 19:59:59 +0200
Subject: [PATCH 037/317] debug: expose weak owner scalar state

---
 .../perlonjava/runtime/runtimetypes/RuntimeBase.java  | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
index 58b179d1d2..ac593a4bb2 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
@@ -574,10 +574,12 @@ public void traceRefCount(int delta, String reason) {
     private static final class OwnerTrace {
         final int scalarIdentity;
         final String acquireSite;
+        final java.lang.ref.WeakReference<RuntimeScalar> scalar;
 
         OwnerTrace(RuntimeScalar scalar, String acquireSite) {
             this.scalarIdentity = System.identityHashCode(scalar);
             this.acquireSite = acquireSite;
+            this.scalar = new java.lang.ref.WeakReference<>(scalar);
         }
     }
 
@@ -762,6 +764,15 @@ public synchronized String ownerTraceSnapshot() {
                 first = false;
                 result.append("scalar=").append(owner.scalarIdentity)
                         .append(" acquire=").append(owner.acquireSite);
+                RuntimeScalar scalar = owner.scalar.get();
+                if (scalar != null) {
+                    result.append(" type=").append(scalar.type)
+                            .append(" captureCount=").append(scalar.captureCount)
+                            .append(" scopeExited=").append(scalar.scopeExited)
+                            .append(" localBinding=").append(scalar.localBindingExists)
+                            .append(" ownsScalarReferenceContents=")
+                            .append(scalar.ownsScalarReferenceContents);
+                }
             }
             result.append(']');
         }

From 60767cd5357b1df90d2ccf1f2a275e4685ab1f06 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 20:03:24 +0200
Subject: [PATCH 038/317] debug: trace deferred controller reachability

---
 .../org/perlonjava/runtime/runtimetypes/MortalList.java  | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 93cc616e97..72111af3e1 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -361,6 +361,15 @@ private static void processUnreachableScopeExitCaptureCandidates(
                     || (base != null && endReachable.contains(base))
                     || (base != null && cycleProtected.contains(base))
                     || scalarReachable;
+            if (base != null && RuntimeBase.refCountTraceEnabled()
+                    && "LifetimeController".equals(NameNormalizer.getBlessStr(base.blessId))) {
+                System.err.println("[SCOPE-CANDIDATE] scalar=" + System.identityHashCode(scalar)
+                        + " deferred=" + state.deferredCapturesSet.containsKey(scalar)
+                        + " end=" + endReachable.contains(scalar) + "/" + endReachable.contains(base)
+                        + " cycle=" + cycleProtected.contains(base)
+                        + " scalarRoot=" + scalarReachable + " retained=" + retained
+                        + " captureCount=" + scalar.captureCount + " refCount=" + base.refCount);
+            }
             if (retained) continue;
 
             scalar.releaseUnreachableSemanticCaptureOwner();

From 65e4b1d59a2902db9f1e9837f765d530f375fc1c Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 20:05:59 +0200
Subject: [PATCH 039/317] debug: compare controller root proofs

---
 .../java/org/perlonjava/runtime/runtimetypes/MortalList.java | 2 ++
 .../perlonjava/runtime/runtimetypes/ReachabilityWalker.java  | 5 +++++
 2 files changed, 7 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 72111af3e1..0c518ac936 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -368,6 +368,8 @@ private static void processUnreachableScopeExitCaptureCandidates(
                         + " end=" + endReachable.contains(scalar) + "/" + endReachable.contains(base)
                         + " cycle=" + cycleProtected.contains(base)
                         + " scalarRoot=" + scalarReachable + " retained=" + retained
+                        + " codeRoot="
+                        + ReachabilityWalker.isReachableFromRootsExcludingOwnedCapturePads(base)
                         + " captureCount=" + scalar.captureCount + " refCount=" + base.refCount);
             }
             if (retained) continue;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 870dd5b693..a83da96220 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1370,6 +1370,11 @@ static boolean isCodeReachableFromRoots(RuntimeCode code) {
                 && reachableFromRootsSnapshotWithStatus(true, false).isReachable(code);
     }
 
+    static boolean isReachableFromRootsExcludingOwnedCapturePads(RuntimeBase target) {
+        return target != null
+                && reachableFromRootsSnapshotWithStatus(true, false).isReachable(target);
+    }
+
     /**
      * Collect the bounded root graph needed to answer reachability for
      * unblessed aggregates. Installed CODE slot identities cannot own an

From ee4bf83d9d544085f0291d1cfa5717b16b1f503b Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 20:07:57 +0200
Subject: [PATCH 040/317] debug: report controller root path

---
 .../java/org/perlonjava/runtime/runtimetypes/MortalList.java    | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 0c518ac936..2d37bfe9c0 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -363,6 +363,7 @@ private static void processUnreachableScopeExitCaptureCandidates(
                     || scalarReachable;
             if (base != null && RuntimeBase.refCountTraceEnabled()
                     && "LifetimeController".equals(NameNormalizer.getBlessStr(base.blessId))) {
+                List<String> rootPath = ReachabilityWalker.findPathTo(base, true);
                 System.err.println("[SCOPE-CANDIDATE] scalar=" + System.identityHashCode(scalar)
                         + " deferred=" + state.deferredCapturesSet.containsKey(scalar)
                         + " end=" + endReachable.contains(scalar) + "/" + endReachable.contains(base)
@@ -370,6 +371,7 @@ private static void processUnreachableScopeExitCaptureCandidates(
                         + " scalarRoot=" + scalarReachable + " retained=" + retained
                         + " codeRoot="
                         + ReachabilityWalker.isReachableFromRootsExcludingOwnedCapturePads(base)
+                        + " path=" + (rootPath == null ? "<none>" : String.join(" -> ", rootPath))
                         + " captureCount=" + scalar.captureCount + " refCount=" + base.refCount);
             }
             if (retained) continue;

From f489d8f4738ac34ba2c3f36682e891952ce8af28 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 20:11:47 +0200
Subject: [PATCH 041/317] fix: revisit scope-exit captures after argument roots
 leave

---
 .../runtime/runtimetypes/MortalList.java      | 23 +++++++++++++++----
 .../runtime/runtimetypes/RuntimeCode.java     |  1 +
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 2d37bfe9c0..18cc830db7 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -327,7 +327,9 @@ public static void noteDeferredScopeExitCaptureCandidate(RuntimeScalar scalar) {
     private static void noteDeferredScopeExitCaptureCandidate(
             LifecycleRuntimeState state, RuntimeScalar scalar) {
         if (scalar.value instanceof RuntimeBase base && isDeferredScopeExitCandidate(base)) {
-            state.deferredScopeExitCaptureCandidates.add(scalar);
+            if (state.deferredScopeExitCaptureCandidates.add(scalar)) {
+                markBoundaryWork(state);
+            }
         }
     }
 
@@ -1527,10 +1529,21 @@ static boolean isReachableFromPersistentRootCached(RuntimeBase base) {
     }
 
     static void invalidateExternalRootSnapshot() {
-        state().externalRootSnapshot = null;
-        state().fullRootSnapshot = null;
-        state().unblessedAggregateRootSnapshot = null;
-        state().scalarRootSnapshot = null;
+        LifecycleRuntimeState state = state();
+        state.externalRootSnapshot = null;
+        state.fullRootSnapshot = null;
+        state.unblessedAggregateRootSnapshot = null;
+        state.scalarRootSnapshot = null;
+        if (!state.deferredScopeExitCaptureCandidates.isEmpty()) {
+            markBoundaryWork(state);
+        }
+    }
+
+    static void invalidateExternalRootSnapshotAfterArgumentPop() {
+        LifecycleRuntimeState state = state();
+        if (!state.deferredScopeExitCaptureCandidates.isEmpty()) {
+            invalidateExternalRootSnapshot();
+        }
     }
 
     static void invalidateAllRootSnapshots() {
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
index 1969ae70dc..890d65481d 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
@@ -1369,6 +1369,7 @@ private static void popArgs(ExecutionRuntimeState executionState) {
         if (!pendingPackages.isEmpty()) {
             pendingPackages.pop();
         }
+        MortalList.invalidateExternalRootSnapshotAfterArgumentPop();
     }
 
     /**

From 2f473343bf31fd4d077ae775a672d5f62abbaf21 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 20:13:43 +0200
Subject: [PATCH 042/317] fix: retain scope candidates until roots change

---
 .../org/perlonjava/runtime/runtimetypes/MortalList.java   | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 18cc830db7..66e14b3634 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -354,6 +354,8 @@ private static void processUnreachableScopeExitCaptureCandidates(
         Set<RuntimeBase> endReachable = ReachabilityWalker.walkEndBlockRoots();
         Set<RuntimeBase> cycleProtected = ReachabilityWalker.strongCycleProtectedReferents();
         boolean found = false;
+        Set<RuntimeScalar> retainedCandidates =
+                Collections.newSetFromMap(new IdentityHashMap<>());
         for (RuntimeScalar scalar : new ArrayList<>(state.deferredScopeExitCaptureCandidates)) {
             if (!scalar.scopeExited) continue;
             RuntimeBase base = scalar.value instanceof RuntimeBase value ? value : null;
@@ -376,7 +378,10 @@ private static void processUnreachableScopeExitCaptureCandidates(
                         + " path=" + (rootPath == null ? "<none>" : String.join(" -> ", rootPath))
                         + " captureCount=" + scalar.captureCount + " refCount=" + base.refCount);
             }
-            if (retained) continue;
+            if (retained) {
+                retainedCandidates.add(scalar);
+                continue;
+            }
 
             scalar.releaseUnreachableSemanticCaptureOwner();
             Integer deferredCount = state.deferredCapturesSet.get(scalar);
@@ -393,6 +398,7 @@ private static void processUnreachableScopeExitCaptureCandidates(
             found = true;
         }
         state.deferredScopeExitCaptureCandidates.clear();
+        state.deferredScopeExitCaptureCandidates.addAll(retainedCandidates);
         if (found) flushAboveMark();
     }
 

From 8e32958b52012497eaa9daf5cd14cc3619c7eea3 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 20:18:06 +0200
Subject: [PATCH 043/317] perf: recheck scope candidates when root frames leave

---
 .../runtime/runtimetypes/LifecycleRuntimeState.java  |  3 +++
 .../perlonjava/runtime/runtimetypes/MortalList.java  | 12 +++++++++++-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/LifecycleRuntimeState.java b/src/main/java/org/perlonjava/runtime/runtimetypes/LifecycleRuntimeState.java
index fe6324b1d2..4d5337a3cd 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/LifecycleRuntimeState.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/LifecycleRuntimeState.java
@@ -33,6 +33,8 @@ final class LifecycleRuntimeState {
     final IdentityHashMap<RuntimeScalar, Integer> deferredCapturesSet = new IdentityHashMap<>();
     final Set<RuntimeScalar> deferredScopeExitCaptureCandidates =
             Collections.newSetFromMap(new IdentityHashMap<>());
+    final IdentityHashMap<RuntimeScalar, Integer> deferredScopeExitCandidateArgsDepths =
+            new IdentityHashMap<>();
     // Strong semantic referents retained by explicit Perl owner slots. Counts
     // are per referent because several independent pad slots can own one base.
     final IdentityHashMap<RuntimeBase, Integer> positiveOwnerReferents = new IdentityHashMap<>();
@@ -143,6 +145,7 @@ void clear() {
         deferredCaptures.clear();
         deferredCapturesSet.clear();
         deferredScopeExitCaptureCandidates.clear();
+        deferredScopeExitCandidateArgsDepths.clear();
         synchronized (this) {
             positiveOwnerReferents.clear();
         }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 66e14b3634..fc672066ae 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -380,9 +380,16 @@ private static void processUnreachableScopeExitCaptureCandidates(
             }
             if (retained) {
                 retainedCandidates.add(scalar);
+                int argsDepth = RuntimeCode.argsStackDepth();
+                if (argsDepth > 0) {
+                    state.deferredScopeExitCandidateArgsDepths.put(scalar, argsDepth);
+                } else {
+                    state.deferredScopeExitCandidateArgsDepths.remove(scalar);
+                }
                 continue;
             }
 
+            state.deferredScopeExitCandidateArgsDepths.remove(scalar);
             scalar.releaseUnreachableSemanticCaptureOwner();
             Integer deferredCount = state.deferredCapturesSet.get(scalar);
             if (deferredCount != null) {
@@ -1547,7 +1554,10 @@ static void invalidateExternalRootSnapshot() {
 
     static void invalidateExternalRootSnapshotAfterArgumentPop() {
         LifecycleRuntimeState state = state();
-        if (!state.deferredScopeExitCaptureCandidates.isEmpty()) {
+        int argsDepth = RuntimeCode.argsStackDepth();
+        boolean candidateRootFramePopped = state.deferredScopeExitCandidateArgsDepths
+                .values().stream().anyMatch(depth -> argsDepth < depth);
+        if (candidateRootFramePopped) {
             invalidateExternalRootSnapshot();
         }
     }

From 84c959dbdaf22fc77fde213939157c19fe0f1ba4 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 20:22:35 +0200
Subject: [PATCH 044/317] perf: watch only argument-rooted captures

---
 .../runtime/runtimetypes/MortalList.java      | 27 ++++++++++++++++---
 1 file changed, 23 insertions(+), 4 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index fc672066ae..1d06a19d17 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -365,9 +365,13 @@ private static void processUnreachableScopeExitCaptureCandidates(
                     || (base != null && endReachable.contains(base))
                     || (base != null && cycleProtected.contains(base))
                     || scalarReachable;
+            List<String> rootPath = retained && base != null
+                    && state.deferredCapturesSet.containsKey(scalar)
+                    && scalar.captureCount > 0
+                    ? ReachabilityWalker.findPathTo(base, true) : null;
             if (base != null && RuntimeBase.refCountTraceEnabled()
                     && "LifetimeController".equals(NameNormalizer.getBlessStr(base.blessId))) {
-                List<String> rootPath = ReachabilityWalker.findPathTo(base, true);
+                if (rootPath == null) rootPath = ReachabilityWalker.findPathTo(base, true);
                 System.err.println("[SCOPE-CANDIDATE] scalar=" + System.identityHashCode(scalar)
                         + " deferred=" + state.deferredCapturesSet.containsKey(scalar)
                         + " end=" + endReachable.contains(scalar) + "/" + endReachable.contains(base)
@@ -380,9 +384,10 @@ private static void processUnreachableScopeExitCaptureCandidates(
             }
             if (retained) {
                 retainedCandidates.add(scalar);
-                int argsDepth = RuntimeCode.argsStackDepth();
-                if (argsDepth > 0) {
-                    state.deferredScopeExitCandidateArgsDepths.put(scalar, argsDepth);
+                int activeArgsIndex = activeArgsRootIndex(rootPath);
+                if (activeArgsIndex >= 0) {
+                    state.deferredScopeExitCandidateArgsDepths.put(
+                            scalar, RuntimeCode.argsStackDepth() - activeArgsIndex);
                 } else {
                     state.deferredScopeExitCandidateArgsDepths.remove(scalar);
                 }
@@ -409,6 +414,20 @@ private static void processUnreachableScopeExitCaptureCandidates(
         if (found) flushAboveMark();
     }
 
+    private static int activeArgsRootIndex(List<String> rootPath) {
+        if (rootPath == null || rootPath.isEmpty()) return -1;
+        String label = rootPath.getFirst();
+        String prefix = "<active-args#";
+        if (!label.startsWith(prefix)) return -1;
+        int end = label.indexOf('>', prefix.length());
+        if (end < 0) return -1;
+        try {
+            return Integer.parseInt(label.substring(prefix.length(), end));
+        } catch (NumberFormatException ignored) {
+            return -1;
+        }
+    }
+
     static void noteDeferredCaptureMayBeReady() {
         LifecycleRuntimeState state = state();
         if (!state.deferredCaptures.isEmpty()) {

From 1d3a0fe8678aa54f30272a4e5bacb2bb41941a91 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 20:26:16 +0200
Subject: [PATCH 045/317] perf: schedule candidate checks by argument depth

---
 .../runtimetypes/LifecycleRuntimeState.java   |  3 ++
 .../runtime/runtimetypes/MortalList.java      | 42 +++++++------------
 2 files changed, 19 insertions(+), 26 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/LifecycleRuntimeState.java b/src/main/java/org/perlonjava/runtime/runtimetypes/LifecycleRuntimeState.java
index 4d5337a3cd..28290d5dd3 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/LifecycleRuntimeState.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/LifecycleRuntimeState.java
@@ -35,6 +35,8 @@ final class LifecycleRuntimeState {
             Collections.newSetFromMap(new IdentityHashMap<>());
     final IdentityHashMap<RuntimeScalar, Integer> deferredScopeExitCandidateArgsDepths =
             new IdentityHashMap<>();
+    final java.util.TreeMap<Integer, Integer> deferredScopeExitCandidateDepthCounts =
+            new java.util.TreeMap<>();
     // Strong semantic referents retained by explicit Perl owner slots. Counts
     // are per referent because several independent pad slots can own one base.
     final IdentityHashMap<RuntimeBase, Integer> positiveOwnerReferents = new IdentityHashMap<>();
@@ -146,6 +148,7 @@ void clear() {
         deferredCapturesSet.clear();
         deferredScopeExitCaptureCandidates.clear();
         deferredScopeExitCandidateArgsDepths.clear();
+        deferredScopeExitCandidateDepthCounts.clear();
         synchronized (this) {
             positiveOwnerReferents.clear();
         }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 1d06a19d17..c45ff4ca4c 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -365,13 +365,9 @@ private static void processUnreachableScopeExitCaptureCandidates(
                     || (base != null && endReachable.contains(base))
                     || (base != null && cycleProtected.contains(base))
                     || scalarReachable;
-            List<String> rootPath = retained && base != null
-                    && state.deferredCapturesSet.containsKey(scalar)
-                    && scalar.captureCount > 0
-                    ? ReachabilityWalker.findPathTo(base, true) : null;
             if (base != null && RuntimeBase.refCountTraceEnabled()
                     && "LifetimeController".equals(NameNormalizer.getBlessStr(base.blessId))) {
-                if (rootPath == null) rootPath = ReachabilityWalker.findPathTo(base, true);
+                List<String> rootPath = ReachabilityWalker.findPathTo(base, true);
                 System.err.println("[SCOPE-CANDIDATE] scalar=" + System.identityHashCode(scalar)
                         + " deferred=" + state.deferredCapturesSet.containsKey(scalar)
                         + " end=" + endReachable.contains(scalar) + "/" + endReachable.contains(base)
@@ -384,17 +380,12 @@ private static void processUnreachableScopeExitCaptureCandidates(
             }
             if (retained) {
                 retainedCandidates.add(scalar);
-                int activeArgsIndex = activeArgsRootIndex(rootPath);
-                if (activeArgsIndex >= 0) {
-                    state.deferredScopeExitCandidateArgsDepths.put(
-                            scalar, RuntimeCode.argsStackDepth() - activeArgsIndex);
-                } else {
-                    state.deferredScopeExitCandidateArgsDepths.remove(scalar);
-                }
+                setDeferredScopeExitCandidateArgsDepth(
+                        state, scalar, RuntimeCode.argsStackDepth());
                 continue;
             }
 
-            state.deferredScopeExitCandidateArgsDepths.remove(scalar);
+            setDeferredScopeExitCandidateArgsDepth(state, scalar, 0);
             scalar.releaseUnreachableSemanticCaptureOwner();
             Integer deferredCount = state.deferredCapturesSet.get(scalar);
             if (deferredCount != null) {
@@ -414,18 +405,17 @@ private static void processUnreachableScopeExitCaptureCandidates(
         if (found) flushAboveMark();
     }
 
-    private static int activeArgsRootIndex(List<String> rootPath) {
-        if (rootPath == null || rootPath.isEmpty()) return -1;
-        String label = rootPath.getFirst();
-        String prefix = "<active-args#";
-        if (!label.startsWith(prefix)) return -1;
-        int end = label.indexOf('>', prefix.length());
-        if (end < 0) return -1;
-        try {
-            return Integer.parseInt(label.substring(prefix.length(), end));
-        } catch (NumberFormatException ignored) {
-            return -1;
+    private static void setDeferredScopeExitCandidateArgsDepth(
+            LifecycleRuntimeState state, RuntimeScalar scalar, int argsDepth) {
+        Integer previousDepth = state.deferredScopeExitCandidateArgsDepths.remove(scalar);
+        if (previousDepth != null) {
+            int remaining = state.deferredScopeExitCandidateDepthCounts.getOrDefault(previousDepth, 0) - 1;
+            if (remaining <= 0) state.deferredScopeExitCandidateDepthCounts.remove(previousDepth);
+            else state.deferredScopeExitCandidateDepthCounts.put(previousDepth, remaining);
         }
+        if (argsDepth <= 0) return;
+        state.deferredScopeExitCandidateArgsDepths.put(scalar, argsDepth);
+        state.deferredScopeExitCandidateDepthCounts.merge(argsDepth, 1, Integer::sum);
     }
 
     static void noteDeferredCaptureMayBeReady() {
@@ -1574,8 +1564,8 @@ static void invalidateExternalRootSnapshot() {
     static void invalidateExternalRootSnapshotAfterArgumentPop() {
         LifecycleRuntimeState state = state();
         int argsDepth = RuntimeCode.argsStackDepth();
-        boolean candidateRootFramePopped = state.deferredScopeExitCandidateArgsDepths
-                .values().stream().anyMatch(depth -> argsDepth < depth);
+        boolean candidateRootFramePopped = !state.deferredScopeExitCandidateDepthCounts.isEmpty()
+                && state.deferredScopeExitCandidateDepthCounts.lastKey() > argsDepth;
         if (candidateRootFramePopped) {
             invalidateExternalRootSnapshot();
         }

From c85a0835f6998632bf2790a04585942a0dfb7efe Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 20:29:43 +0200
Subject: [PATCH 046/317] perf: avoid root-wide candidate rescheduling

---
 .../java/org/perlonjava/runtime/runtimetypes/MortalList.java  | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index c45ff4ca4c..6a965d4f0d 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1556,9 +1556,6 @@ static void invalidateExternalRootSnapshot() {
         state.fullRootSnapshot = null;
         state.unblessedAggregateRootSnapshot = null;
         state.scalarRootSnapshot = null;
-        if (!state.deferredScopeExitCaptureCandidates.isEmpty()) {
-            markBoundaryWork(state);
-        }
     }
 
     static void invalidateExternalRootSnapshotAfterArgumentPop() {
@@ -1568,6 +1565,7 @@ static void invalidateExternalRootSnapshotAfterArgumentPop() {
                 && state.deferredScopeExitCandidateDepthCounts.lastKey() > argsDepth;
         if (candidateRootFramePopped) {
             invalidateExternalRootSnapshot();
+            markBoundaryWork(state);
         }
     }
 

From dcb628aae5f718116b4f923e6c61693127b88d1c Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 20:53:57 +0200
Subject: [PATCH 047/317] fix: revert candidate capture rescheduling

The deferred capture rescheduling candidate caused JVM request lifetime
regressions: the Mojolicious WebSocket and Catalyst upload regressions both
spun at 100% CPU and timed out. Restore the previously validated scope-exit
candidate behavior while continuing the ownership investigation.

Generated with OpenAI Codex (https://openai.com/codex)

Co-Authored-By: OpenAI Codex <codex@openai.com>
---
 .../runtimetypes/LifecycleRuntimeState.java   |  6 --
 .../runtime/runtimetypes/MortalList.java      | 61 ++-----------------
 .../runtimetypes/ReachabilityWalker.java      |  5 --
 .../runtime/runtimetypes/RuntimeBase.java     | 11 ----
 .../runtime/runtimetypes/RuntimeCode.java     |  1 -
 5 files changed, 6 insertions(+), 78 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/LifecycleRuntimeState.java b/src/main/java/org/perlonjava/runtime/runtimetypes/LifecycleRuntimeState.java
index 28290d5dd3..fe6324b1d2 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/LifecycleRuntimeState.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/LifecycleRuntimeState.java
@@ -33,10 +33,6 @@ final class LifecycleRuntimeState {
     final IdentityHashMap<RuntimeScalar, Integer> deferredCapturesSet = new IdentityHashMap<>();
     final Set<RuntimeScalar> deferredScopeExitCaptureCandidates =
             Collections.newSetFromMap(new IdentityHashMap<>());
-    final IdentityHashMap<RuntimeScalar, Integer> deferredScopeExitCandidateArgsDepths =
-            new IdentityHashMap<>();
-    final java.util.TreeMap<Integer, Integer> deferredScopeExitCandidateDepthCounts =
-            new java.util.TreeMap<>();
     // Strong semantic referents retained by explicit Perl owner slots. Counts
     // are per referent because several independent pad slots can own one base.
     final IdentityHashMap<RuntimeBase, Integer> positiveOwnerReferents = new IdentityHashMap<>();
@@ -147,8 +143,6 @@ void clear() {
         deferredCaptures.clear();
         deferredCapturesSet.clear();
         deferredScopeExitCaptureCandidates.clear();
-        deferredScopeExitCandidateArgsDepths.clear();
-        deferredScopeExitCandidateDepthCounts.clear();
         synchronized (this) {
             positiveOwnerReferents.clear();
         }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 6a965d4f0d..93cc616e97 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -327,9 +327,7 @@ public static void noteDeferredScopeExitCaptureCandidate(RuntimeScalar scalar) {
     private static void noteDeferredScopeExitCaptureCandidate(
             LifecycleRuntimeState state, RuntimeScalar scalar) {
         if (scalar.value instanceof RuntimeBase base && isDeferredScopeExitCandidate(base)) {
-            if (state.deferredScopeExitCaptureCandidates.add(scalar)) {
-                markBoundaryWork(state);
-            }
+            state.deferredScopeExitCaptureCandidates.add(scalar);
         }
     }
 
@@ -354,8 +352,6 @@ private static void processUnreachableScopeExitCaptureCandidates(
         Set<RuntimeBase> endReachable = ReachabilityWalker.walkEndBlockRoots();
         Set<RuntimeBase> cycleProtected = ReachabilityWalker.strongCycleProtectedReferents();
         boolean found = false;
-        Set<RuntimeScalar> retainedCandidates =
-                Collections.newSetFromMap(new IdentityHashMap<>());
         for (RuntimeScalar scalar : new ArrayList<>(state.deferredScopeExitCaptureCandidates)) {
             if (!scalar.scopeExited) continue;
             RuntimeBase base = scalar.value instanceof RuntimeBase value ? value : null;
@@ -365,27 +361,8 @@ private static void processUnreachableScopeExitCaptureCandidates(
                     || (base != null && endReachable.contains(base))
                     || (base != null && cycleProtected.contains(base))
                     || scalarReachable;
-            if (base != null && RuntimeBase.refCountTraceEnabled()
-                    && "LifetimeController".equals(NameNormalizer.getBlessStr(base.blessId))) {
-                List<String> rootPath = ReachabilityWalker.findPathTo(base, true);
-                System.err.println("[SCOPE-CANDIDATE] scalar=" + System.identityHashCode(scalar)
-                        + " deferred=" + state.deferredCapturesSet.containsKey(scalar)
-                        + " end=" + endReachable.contains(scalar) + "/" + endReachable.contains(base)
-                        + " cycle=" + cycleProtected.contains(base)
-                        + " scalarRoot=" + scalarReachable + " retained=" + retained
-                        + " codeRoot="
-                        + ReachabilityWalker.isReachableFromRootsExcludingOwnedCapturePads(base)
-                        + " path=" + (rootPath == null ? "<none>" : String.join(" -> ", rootPath))
-                        + " captureCount=" + scalar.captureCount + " refCount=" + base.refCount);
-            }
-            if (retained) {
-                retainedCandidates.add(scalar);
-                setDeferredScopeExitCandidateArgsDepth(
-                        state, scalar, RuntimeCode.argsStackDepth());
-                continue;
-            }
+            if (retained) continue;
 
-            setDeferredScopeExitCandidateArgsDepth(state, scalar, 0);
             scalar.releaseUnreachableSemanticCaptureOwner();
             Integer deferredCount = state.deferredCapturesSet.get(scalar);
             if (deferredCount != null) {
@@ -401,23 +378,9 @@ private static void processUnreachableScopeExitCaptureCandidates(
             found = true;
         }
         state.deferredScopeExitCaptureCandidates.clear();
-        state.deferredScopeExitCaptureCandidates.addAll(retainedCandidates);
         if (found) flushAboveMark();
     }
 
-    private static void setDeferredScopeExitCandidateArgsDepth(
-            LifecycleRuntimeState state, RuntimeScalar scalar, int argsDepth) {
-        Integer previousDepth = state.deferredScopeExitCandidateArgsDepths.remove(scalar);
-        if (previousDepth != null) {
-            int remaining = state.deferredScopeExitCandidateDepthCounts.getOrDefault(previousDepth, 0) - 1;
-            if (remaining <= 0) state.deferredScopeExitCandidateDepthCounts.remove(previousDepth);
-            else state.deferredScopeExitCandidateDepthCounts.put(previousDepth, remaining);
-        }
-        if (argsDepth <= 0) return;
-        state.deferredScopeExitCandidateArgsDepths.put(scalar, argsDepth);
-        state.deferredScopeExitCandidateDepthCounts.merge(argsDepth, 1, Integer::sum);
-    }
-
     static void noteDeferredCaptureMayBeReady() {
         LifecycleRuntimeState state = state();
         if (!state.deferredCaptures.isEmpty()) {
@@ -1551,22 +1514,10 @@ static boolean isReachableFromPersistentRootCached(RuntimeBase base) {
     }
 
     static void invalidateExternalRootSnapshot() {
-        LifecycleRuntimeState state = state();
-        state.externalRootSnapshot = null;
-        state.fullRootSnapshot = null;
-        state.unblessedAggregateRootSnapshot = null;
-        state.scalarRootSnapshot = null;
-    }
-
-    static void invalidateExternalRootSnapshotAfterArgumentPop() {
-        LifecycleRuntimeState state = state();
-        int argsDepth = RuntimeCode.argsStackDepth();
-        boolean candidateRootFramePopped = !state.deferredScopeExitCandidateDepthCounts.isEmpty()
-                && state.deferredScopeExitCandidateDepthCounts.lastKey() > argsDepth;
-        if (candidateRootFramePopped) {
-            invalidateExternalRootSnapshot();
-            markBoundaryWork(state);
-        }
+        state().externalRootSnapshot = null;
+        state().fullRootSnapshot = null;
+        state().unblessedAggregateRootSnapshot = null;
+        state().scalarRootSnapshot = null;
     }
 
     static void invalidateAllRootSnapshots() {
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index a83da96220..870dd5b693 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1370,11 +1370,6 @@ static boolean isCodeReachableFromRoots(RuntimeCode code) {
                 && reachableFromRootsSnapshotWithStatus(true, false).isReachable(code);
     }
 
-    static boolean isReachableFromRootsExcludingOwnedCapturePads(RuntimeBase target) {
-        return target != null
-                && reachableFromRootsSnapshotWithStatus(true, false).isReachable(target);
-    }
-
     /**
      * Collect the bounded root graph needed to answer reachability for
      * unblessed aggregates. Installed CODE slot identities cannot own an
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
index ac593a4bb2..58b179d1d2 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
@@ -574,12 +574,10 @@ public void traceRefCount(int delta, String reason) {
     private static final class OwnerTrace {
         final int scalarIdentity;
         final String acquireSite;
-        final java.lang.ref.WeakReference<RuntimeScalar> scalar;
 
         OwnerTrace(RuntimeScalar scalar, String acquireSite) {
             this.scalarIdentity = System.identityHashCode(scalar);
             this.acquireSite = acquireSite;
-            this.scalar = new java.lang.ref.WeakReference<>(scalar);
         }
     }
 
@@ -764,15 +762,6 @@ public synchronized String ownerTraceSnapshot() {
                 first = false;
                 result.append("scalar=").append(owner.scalarIdentity)
                         .append(" acquire=").append(owner.acquireSite);
-                RuntimeScalar scalar = owner.scalar.get();
-                if (scalar != null) {
-                    result.append(" type=").append(scalar.type)
-                            .append(" captureCount=").append(scalar.captureCount)
-                            .append(" scopeExited=").append(scalar.scopeExited)
-                            .append(" localBinding=").append(scalar.localBindingExists)
-                            .append(" ownsScalarReferenceContents=")
-                            .append(scalar.ownsScalarReferenceContents);
-                }
             }
             result.append(']');
         }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
index 890d65481d..1969ae70dc 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
@@ -1369,7 +1369,6 @@ private static void popArgs(ExecutionRuntimeState executionState) {
         if (!pendingPackages.isEmpty()) {
             pendingPackages.pop();
         }
-        MortalList.invalidateExternalRootSnapshotAfterArgumentPop();
     }
 
     /**

From 79e6a55a19e47f6dd550b2403aa637c57c095790 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 21:40:17 +0200
Subject: [PATCH 048/317] fix: include persistent code state in root
 reachability

Track state variables and aggregates while walking installed code roots,
so singleton services retain callbacks stored in their persistent state.
Add focused coverage for nested callbacks retained through a rooted timer.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <openai-codex@users.noreply.github.com>
---
 .../runtimetypes/ReachabilityWalker.java      | 24 ++++++++--
 .../RuntimeCodeScopeExitReachabilityTest.java | 48 +++++++++++++++++++
 2 files changed, 69 insertions(+), 3 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 870dd5b693..dbabd18d55 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1503,15 +1503,33 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
                     if (includeOwnedCapturePads) followScalar(value, null, seen, todo);
                     else followScalarIncludingCode(value, null, seen, todo);
                 }
-            } else if (!includeOwnedCapturePads && cur instanceof RuntimeCode code) {
-                if (code.capturedScalars != null) {
+            } else if (cur instanceof RuntimeCode code) {
+                // Persistent state is a Perl owner edge from an installed CV.
+                // In particular, singleton services such as Mojo::IOLoop keep
+                // their reactor (and its callback hashes) in a state variable.
+                for (RuntimeScalar state : code.stateVariable.values()) {
+                    if (!budget.visitEdge()) break walk;
+                    if (stats != null) stats.edgesInspected++;
+                    followScalar(state, null, seen, todo);
+                }
+                for (RuntimeArray state : code.stateArray.values()) {
+                    if (!budget.visitEdge()) break walk;
+                    if (stats != null) stats.edgesInspected++;
+                    if (state != null && seen.add(state)) todo.addLast(state);
+                }
+                for (RuntimeHash state : code.stateHash.values()) {
+                    if (!budget.visitEdge()) break walk;
+                    if (stats != null) stats.edgesInspected++;
+                    if (state != null && seen.add(state)) todo.addLast(state);
+                }
+                if (!includeOwnedCapturePads && code.capturedScalars != null) {
                     for (RuntimeScalar captured : code.capturedScalars) {
                         if (!budget.visitEdge()) break walk;
                         if (stats != null) stats.edgesInspected++;
                         followScalar(captured, null, seen, todo);
                     }
                 }
-                if (code.capturedAggregates != null) {
+                if (!includeOwnedCapturePads && code.capturedAggregates != null) {
                     for (RuntimeBase captured : code.capturedAggregates) {
                         if (!budget.visitEdge()) break walk;
                         if (stats != null) stats.edgesInspected++;
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
index 659e81ac50..d547d02b9c 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
@@ -84,4 +84,52 @@ void deferredReleaseRetainsCapturesForCodeStoredInReachableHashWithoutWeakRefs()
             }
         }
     }
+
+    @Test
+    void deferredReleaseFollowsCaptureFromRootedCallbackToNestedCallback() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeScalar captured = new RuntimeScalar("controller");
+            captured.retainClosureCapture();
+            RuntimeCode callback = new RuntimeCode(null, List.of());
+            callback.refCount = 1;
+            callback.capturedScalars = new RuntimeScalar[] { captured };
+
+            RuntimeScalar callbackRef = new RuntimeScalar(callback);
+            callbackRef.captureCount = 1;
+            callbackRef.scopeExited = true;
+            RuntimeCode timerWrapper = new RuntimeCode(null, List.of());
+            timerWrapper.refCount = 1;
+            timerWrapper.capturedScalars = new RuntimeScalar[] { callbackRef };
+
+            RuntimeHash reactorTimers = new RuntimeHash();
+            reactorTimers.elements.put("timer", new RuntimeScalar(timerWrapper));
+            RuntimeCode singletonMethod = new RuntimeCode(null, List.of());
+            singletonMethod.stateVariable.put("loop", new RuntimeScalar(reactorTimers));
+            String globalName = "RuntimeCodeScopeExitReachabilityTest::singleton";
+            GlobalVariable.globalCodeRefs.put(globalName, new RuntimeScalar(singletonMethod));
+            boolean previousActive = MortalList.isActive();
+            MortalList.setActive(true);
+
+            try {
+                MortalList.deferDecrement(callback);
+                MortalList.flush();
+
+                assertNotNull(callback.capturedScalars,
+                        "a rooted timer wrapper must retain the callback stored in its capture pad");
+                assertEquals(1, captured.captureCount);
+
+                GlobalVariable.globalCodeRefs.remove(globalName);
+                MortalList.deferDecrement(callback);
+                MortalList.flush();
+
+                assertNull(callback.capturedScalars,
+                        "removing the rooted wrapper must release the nested callback captures");
+                assertEquals(0, captured.captureCount);
+            } finally {
+                GlobalVariable.globalCodeRefs.remove(globalName);
+                MortalList.setActive(previousActive);
+            }
+        }
+    }
 }

From 91c745c9771ebdd9c99a88c9bf0ef3e189cced22 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 21:46:32 +0200
Subject: [PATCH 049/317] fix: include persistent code state in root
 reachability

Track state variables and aggregates while walking installed code roots,
so singleton services retain callbacks stored in their persistent state.
Add focused coverage for nested callbacks retained through a rooted timer.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <openai-codex@users.noreply.github.com>
---
 .../runtimetypes/RuntimeCodeScopeExitReachabilityTest.java     | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
index d547d02b9c..0a4dc1c5d6 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
@@ -108,6 +108,7 @@ void deferredReleaseFollowsCaptureFromRootedCallbackToNestedCallback() {
             singletonMethod.stateVariable.put("loop", new RuntimeScalar(reactorTimers));
             String globalName = "RuntimeCodeScopeExitReachabilityTest::singleton";
             GlobalVariable.globalCodeRefs.put(globalName, new RuntimeScalar(singletonMethod));
+            GlobalVariable.invalidateGlobalCodeRefGraphRoots();
             boolean previousActive = MortalList.isActive();
             MortalList.setActive(true);
 
@@ -120,6 +121,7 @@ void deferredReleaseFollowsCaptureFromRootedCallbackToNestedCallback() {
                 assertEquals(1, captured.captureCount);
 
                 GlobalVariable.globalCodeRefs.remove(globalName);
+                GlobalVariable.invalidateGlobalCodeRefGraphRoots();
                 MortalList.deferDecrement(callback);
                 MortalList.flush();
 
@@ -128,6 +130,7 @@ void deferredReleaseFollowsCaptureFromRootedCallbackToNestedCallback() {
                 assertEquals(0, captured.captureCount);
             } finally {
                 GlobalVariable.globalCodeRefs.remove(globalName);
+                GlobalVariable.invalidateGlobalCodeRefGraphRoots();
                 MortalList.setActive(previousActive);
             }
         }

From 3161f7dbe5d319faad58b85bd7196b0cdd1ded04 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 21:52:33 +0200
Subject: [PATCH 050/317] fix: include persistent code state in root
 reachability

Track state variables and aggregates while walking installed code roots,
so singleton services retain callbacks stored in their persistent state.
Add focused coverage for nested callbacks retained through a rooted timer.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <openai-codex@users.noreply.github.com>
---
 .../RuntimeCodeScopeExitReachabilityTest.java             | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
index 0a4dc1c5d6..86acd976b5 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
@@ -95,7 +95,7 @@ void deferredReleaseFollowsCaptureFromRootedCallbackToNestedCallback() {
             callback.refCount = 1;
             callback.capturedScalars = new RuntimeScalar[] { captured };
 
-            RuntimeScalar callbackRef = new RuntimeScalar(callback);
+            RuntimeScalar callbackRef = callback.createReference();
             callbackRef.captureCount = 1;
             callbackRef.scopeExited = true;
             RuntimeCode timerWrapper = new RuntimeCode(null, List.of());
@@ -103,11 +103,11 @@ void deferredReleaseFollowsCaptureFromRootedCallbackToNestedCallback() {
             timerWrapper.capturedScalars = new RuntimeScalar[] { callbackRef };
 
             RuntimeHash reactorTimers = new RuntimeHash();
-            reactorTimers.elements.put("timer", new RuntimeScalar(timerWrapper));
+            reactorTimers.elements.put("timer", timerWrapper.createReference());
             RuntimeCode singletonMethod = new RuntimeCode(null, List.of());
-            singletonMethod.stateVariable.put("loop", new RuntimeScalar(reactorTimers));
+            singletonMethod.stateVariable.put("loop", reactorTimers.createReference());
             String globalName = "RuntimeCodeScopeExitReachabilityTest::singleton";
-            GlobalVariable.globalCodeRefs.put(globalName, new RuntimeScalar(singletonMethod));
+            GlobalVariable.globalCodeRefs.put(globalName, singletonMethod.createReference());
             GlobalVariable.invalidateGlobalCodeRefGraphRoots();
             boolean previousActive = MortalList.isActive();
             MortalList.setActive(true);

From 89b5b58bcc7a13ad612aa0839bb44daf3e32a1a7 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 22:48:50 +0200
Subject: [PATCH 051/317] chore: add temporary deferred code root trace

Add an opt-in diagnostic for deferred RuntimeCode root checks while
investigating the recurring WebSocket callback lifetime regression.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <openai-codex@users.noreply.github.com>
---
 .../perlonjava/runtime/runtimetypes/MortalList.java | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 93cc616e97..f5aa3e457c 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1731,7 +1731,7 @@ private static void processDeferredBase(RuntimeBase base, boolean clearWeakRefsF
                 // sentinel behavior.
                 if (base.nativeCaptureOwnerCount() == 0) base.refCount = 1;
             } else if (base instanceof RuntimeCode code
-                    && ReachabilityWalker.isCodeReachableFromRoots(code)) {
+                    && isCodeReachableFromRootsForDeferredRelease(code)) {
                 // A callback stored in a long-lived Perl container can have
                 // its selective CV count consumed by a temporary invocation
                 // alias. The container is still a strong owner even when no
@@ -1916,6 +1916,17 @@ && isReachableCached(base)) {
         }
     }
 
+    private static boolean isCodeReachableFromRootsForDeferredRelease(RuntimeCode code) {
+        boolean reachable = ReachabilityWalker.isCodeReachableFromRoots(code);
+        if (Boolean.getBoolean("PJ_CODE_ROOT_TRACE")) {
+            System.err.println("[CODE-ROOT-CHECK] identity=" + System.identityHashCode(code)
+                    + " name=" + code.packageName + "::" + code.subName
+                    + " reachable=" + reachable + " captures="
+                    + (code.capturedScalars == null ? 0 : code.capturedScalars.length));
+        }
+        return reachable;
+    }
+
     private static boolean blessedClassHasDestroy(RuntimeBase base) {
         String className = NameNormalizer.getBlessStr(base.blessId);
         return className != null && DestroyDispatch.classHasDestroy(base.blessId, className);

From 331691fbf9a1d5190d0d633bdae06a11d0d399e8 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 23:00:20 +0200
Subject: [PATCH 052/317] chore: report incomplete callback root snapshots

Add opt-in snapshot completeness details to the temporary callback root
trace so bounded reachability misses can be distinguished from graph gaps.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <openai-codex@users.noreply.github.com>
---
 .../runtime/runtimetypes/ReachabilityWalker.java      | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index dbabd18d55..18d2a84e30 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1366,8 +1366,15 @@ static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus() {
 
     /** Root proof for a CODE referent without treating its own aggregate pads as roots. */
     static boolean isCodeReachableFromRoots(RuntimeCode code) {
-        return code != null
-                && reachableFromRootsSnapshotWithStatus(true, false).isReachable(code);
+        if (code == null) return false;
+        RootReachabilitySnapshot snapshot = reachableFromRootsSnapshotWithStatus(true, false);
+        boolean reachable = snapshot.isReachable(code);
+        if (!reachable && Boolean.getBoolean("PJ_CODE_ROOT_TRACE")) {
+            System.err.println("[CODE-ROOT-SNAPSHOT] identity=" + System.identityHashCode(code)
+                    + " complete=" + snapshot.complete() + " nodes="
+                    + snapshot.reachable().size() + " edges=" + snapshot.edgesVisited());
+        }
+        return reachable;
     }
 
     /**

From bfed68a2f401fd49e2bfc327b13453a3fba5692c Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 23:17:03 +0200
Subject: [PATCH 053/317] chore: report incomplete callback root snapshots

Add opt-in snapshot completeness details to the temporary callback root
trace so bounded reachability misses can be distinguished from graph gaps.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <openai-codex@users.noreply.github.com>
---
 .../java/org/perlonjava/runtime/runtimetypes/MortalList.java   | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index f5aa3e457c..dcecbc791f 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1923,6 +1923,9 @@ private static boolean isCodeReachableFromRootsForDeferredRelease(RuntimeCode co
                     + " name=" + code.packageName + "::" + code.subName
                     + " reachable=" + reachable + " captures="
                     + (code.capturedScalars == null ? 0 : code.capturedScalars.length));
+            if ("main".equals(code.packageName)) {
+                System.err.println("[CODE-ROOT-PATH] " + ReachabilityWalker.findPathTo(code));
+            }
         }
         return reachable;
     }

From a04ad17a35cb241f7bef4474489da657d7acf8a0 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 23:28:26 +0200
Subject: [PATCH 054/317] fix: include active code frames in lifetime roots

Treat currently executing Perl code as a root while resolving deferred CV
releases. Its capture pads can own callbacks that must survive the active
invocation, including nested timer callbacks.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <openai-codex@users.noreply.github.com>
---
 .../runtime/runtimetypes/ReachabilityWalker.java     |  7 +++++++
 .../RuntimeCodeScopeExitReachabilityTest.java        | 12 ++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 18d2a84e30..79e13ddf47 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1409,6 +1409,13 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
                     seedTarget(codeRef, null, seen, todo, stats);
                 }
             }
+            for (RuntimeCode activeCode : PerlRuntime.current().executionState().activeCodeStack) {
+                if (!budget.visitEdge()) break rootScan;
+                if (activeCode != null && seen.add(activeCode)) {
+                    todo.addLast(activeCode);
+                    if (stats != null) stats.rootsSeeded++;
+                }
+            }
             for (RuntimeScalar codeRef : GlobalVariable.globalCodeRefEdgeRootsView()) {
                 if (codeRef != null && codeRef.value instanceof RuntimeCode code) {
                     if (stats != null) stats.globalCodeCaptureRootsWalked++;
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
index 86acd976b5..1b1454f027 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
@@ -122,6 +122,18 @@ void deferredReleaseFollowsCaptureFromRootedCallbackToNestedCallback() {
 
                 GlobalVariable.globalCodeRefs.remove(globalName);
                 GlobalVariable.invalidateGlobalCodeRefGraphRoots();
+                RuntimeCode.pushActiveCode(timerWrapper);
+                try {
+                    MortalList.deferDecrement(callback);
+                    MortalList.flush();
+
+                    assertNotNull(callback.capturedScalars,
+                            "an active callback must retain a nested callback in its capture pad");
+                    assertEquals(1, captured.captureCount);
+                } finally {
+                    RuntimeCode.popActiveCode(timerWrapper);
+                }
+
                 MortalList.deferDecrement(callback);
                 MortalList.flush();
 

From c9ab5052c148985ae8f6802da2022dec2bac7396 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 16 Oct 2026 23:45:07 +0200
Subject: [PATCH 055/317] fix: follow unpromoted code capture edges

Follow RuntimeCode values in CV capture pads even when their scalar slots
are not promoted references. Timer callback wrappers retain nested code
through this closure edge in the Mojo event loop.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <openai-codex@users.noreply.github.com>
---
 .../org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java | 2 +-
 .../runtimetypes/RuntimeCodeScopeExitReachabilityTest.java      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 79e13ddf47..1bb7b8141e 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1540,7 +1540,7 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
                     for (RuntimeScalar captured : code.capturedScalars) {
                         if (!budget.visitEdge()) break walk;
                         if (stats != null) stats.edgesInspected++;
-                        followScalar(captured, null, seen, todo);
+                        followScalarIncludingCode(captured, null, seen, todo);
                     }
                 }
                 if (!includeOwnedCapturePads && code.capturedAggregates != null) {
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
index 1b1454f027..ec677a42f0 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
@@ -95,7 +95,7 @@ void deferredReleaseFollowsCaptureFromRootedCallbackToNestedCallback() {
             callback.refCount = 1;
             callback.capturedScalars = new RuntimeScalar[] { captured };
 
-            RuntimeScalar callbackRef = callback.createReference();
+            RuntimeScalar callbackRef = new RuntimeScalar(callback);
             callbackRef.captureCount = 1;
             callbackRef.scopeExited = true;
             RuntimeCode timerWrapper = new RuntimeCode(null, List.of());

From 0e416327b1cdf8a8b531c608398adc3c19ba8eef Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 00:01:32 +0200
Subject: [PATCH 056/317] fix: seed installed code values as lifetime roots

Installed Perl code slots can hold RuntimeCode values without the scalar
reference bit. Seed those CVs directly while proving callback reachability,
so persistent state and timer callback containers remain visible.
Strengthen the test with an unpromoted singleton CV and nested timer record.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <openai-codex@users.noreply.github.com>
---
 .../perlonjava/runtime/runtimetypes/ReachabilityWalker.java | 2 +-
 .../runtimetypes/RuntimeCodeScopeExitReachabilityTest.java  | 6 ++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 1bb7b8141e..2dbc995f79 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1406,7 +1406,7 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
             if (includeInstalledCodeSlots) {
                 for (RuntimeScalar codeRef : GlobalVariable.globalCodeRefValuesView()) {
                     if (!budget.visitEdge()) break rootScan;
-                    seedTarget(codeRef, null, seen, todo, stats);
+                    seedTargetIncludingCode(codeRef, null, seen, todo, stats);
                 }
             }
             for (RuntimeCode activeCode : PerlRuntime.current().executionState().activeCodeStack) {
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
index ec677a42f0..73b27dd4d0 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
@@ -103,11 +103,13 @@ void deferredReleaseFollowsCaptureFromRootedCallbackToNestedCallback() {
             timerWrapper.capturedScalars = new RuntimeScalar[] { callbackRef };
 
             RuntimeHash reactorTimers = new RuntimeHash();
-            reactorTimers.elements.put("timer", timerWrapper.createReference());
+            RuntimeHash timerRecord = new RuntimeHash();
+            timerRecord.elements.put("cb", new RuntimeScalar(timerWrapper));
+            reactorTimers.elements.put("timer", timerRecord.createReference());
             RuntimeCode singletonMethod = new RuntimeCode(null, List.of());
             singletonMethod.stateVariable.put("loop", reactorTimers.createReference());
             String globalName = "RuntimeCodeScopeExitReachabilityTest::singleton";
-            GlobalVariable.globalCodeRefs.put(globalName, singletonMethod.createReference());
+            GlobalVariable.globalCodeRefs.put(globalName, new RuntimeScalar(singletonMethod));
             GlobalVariable.invalidateGlobalCodeRefGraphRoots();
             boolean previousActive = MortalList.isActive();
             MortalList.setActive(true);

From bf867f8372c0a6aba3f1672322a9126e2a5189c1 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 00:12:04 +0200
Subject: [PATCH 057/317] Revert "chore: report incomplete callback root
 snapshots"

This reverts commit a748b7f5f8a1013acd823e8e0bdf95ed86bc3eec.
---
 .../java/org/perlonjava/runtime/runtimetypes/MortalList.java   | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index dcecbc791f..f5aa3e457c 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1923,9 +1923,6 @@ private static boolean isCodeReachableFromRootsForDeferredRelease(RuntimeCode co
                     + " name=" + code.packageName + "::" + code.subName
                     + " reachable=" + reachable + " captures="
                     + (code.capturedScalars == null ? 0 : code.capturedScalars.length));
-            if ("main".equals(code.packageName)) {
-                System.err.println("[CODE-ROOT-PATH] " + ReachabilityWalker.findPathTo(code));
-            }
         }
         return reachable;
     }

From 9587cd6a532639ea16a8514ba1bc16a6e3942fd9 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 00:12:04 +0200
Subject: [PATCH 058/317] Revert "chore: report incomplete callback root
 snapshots"

This reverts commit 868e2fa85befdfec0703ec3389e3a2111debb5f6.
---
 .../runtime/runtimetypes/ReachabilityWalker.java      | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 2dbc995f79..bcddb8e8e1 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1366,15 +1366,8 @@ static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus() {
 
     /** Root proof for a CODE referent without treating its own aggregate pads as roots. */
     static boolean isCodeReachableFromRoots(RuntimeCode code) {
-        if (code == null) return false;
-        RootReachabilitySnapshot snapshot = reachableFromRootsSnapshotWithStatus(true, false);
-        boolean reachable = snapshot.isReachable(code);
-        if (!reachable && Boolean.getBoolean("PJ_CODE_ROOT_TRACE")) {
-            System.err.println("[CODE-ROOT-SNAPSHOT] identity=" + System.identityHashCode(code)
-                    + " complete=" + snapshot.complete() + " nodes="
-                    + snapshot.reachable().size() + " edges=" + snapshot.edgesVisited());
-        }
-        return reachable;
+        return code != null
+                && reachableFromRootsSnapshotWithStatus(true, false).isReachable(code);
     }
 
     /**

From 035b48bae8de025ad1f3333d4a9e47473a255894 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 00:12:04 +0200
Subject: [PATCH 059/317] Revert "chore: add temporary deferred code root
 trace"

This reverts commit b858277d15cb8d7de8c69ae5088608859d1f4a65.
---
 .../perlonjava/runtime/runtimetypes/MortalList.java | 13 +------------
 1 file changed, 1 insertion(+), 12 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index f5aa3e457c..93cc616e97 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1731,7 +1731,7 @@ private static void processDeferredBase(RuntimeBase base, boolean clearWeakRefsF
                 // sentinel behavior.
                 if (base.nativeCaptureOwnerCount() == 0) base.refCount = 1;
             } else if (base instanceof RuntimeCode code
-                    && isCodeReachableFromRootsForDeferredRelease(code)) {
+                    && ReachabilityWalker.isCodeReachableFromRoots(code)) {
                 // A callback stored in a long-lived Perl container can have
                 // its selective CV count consumed by a temporary invocation
                 // alias. The container is still a strong owner even when no
@@ -1916,17 +1916,6 @@ && isReachableCached(base)) {
         }
     }
 
-    private static boolean isCodeReachableFromRootsForDeferredRelease(RuntimeCode code) {
-        boolean reachable = ReachabilityWalker.isCodeReachableFromRoots(code);
-        if (Boolean.getBoolean("PJ_CODE_ROOT_TRACE")) {
-            System.err.println("[CODE-ROOT-CHECK] identity=" + System.identityHashCode(code)
-                    + " name=" + code.packageName + "::" + code.subName
-                    + " reachable=" + reachable + " captures="
-                    + (code.capturedScalars == null ? 0 : code.capturedScalars.length));
-        }
-        return reachable;
-    }
-
     private static boolean blessedClassHasDestroy(RuntimeBase base) {
         String className = NameNormalizer.getBlessStr(base.blessId);
         return className != null && DestroyDispatch.classHasDestroy(base.blessId, className);

From eee66f0545f7d45c9f9703f8d831c44b335f6658 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 00:53:22 +0200
Subject: [PATCH 060/317] chore: trace Mojo loop CV root metadata

Add a temporary opt-in diagnostic for whether Mojo::IOLoop code and
persistent state slots are visited by the bounded root snapshot.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <openai-codex@users.noreply.github.com>
---
 .../perlonjava/runtime/runtimetypes/ReachabilityWalker.java  | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index bcddb8e8e1..a1cd72f3f9 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1511,6 +1511,11 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
                     else followScalarIncludingCode(value, null, seen, todo);
                 }
             } else if (cur instanceof RuntimeCode code) {
+                if (Boolean.getBoolean("PJ_CODE_ROOT_TRACE")
+                        && "Mojo::IOLoop".equals(code.packageName)) {
+                    System.err.println("[MOJO-LOOP-CV] identity=" + System.identityHashCode(code)
+                            + " sub=" + code.subName + " states=" + code.stateVariable.keySet());
+                }
                 // Persistent state is a Perl owner edge from an installed CV.
                 // In particular, singleton services such as Mojo::IOLoop keep
                 // their reactor (and its callback hashes) in a state variable.

From 4b75ad812b749f770141429e151eda8f3f76ff41 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 01:04:06 +0200
Subject: [PATCH 061/317] chore: trace Mojo loop CV root metadata

Add a temporary opt-in diagnostic for whether Mojo::IOLoop code and
persistent state slots are visited by the bounded root snapshot.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <openai-codex@users.noreply.github.com>
---
 .../runtime/runtimetypes/ReachabilityWalker.java          | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index a1cd72f3f9..e9543ab99f 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1515,6 +1515,14 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
                         && "Mojo::IOLoop".equals(code.packageName)) {
                     System.err.println("[MOJO-LOOP-CV] identity=" + System.identityHashCode(code)
                             + " sub=" + code.subName + " states=" + code.stateVariable.keySet());
+                    for (Map.Entry<String, RuntimeScalar> state : code.stateVariable.entrySet()) {
+                        Object value = state.getValue() == null ? null : state.getValue().value;
+                        System.err.println("[MOJO-LOOP-STATE] key=" + state.getKey()
+                                + " type=" + (state.getValue() == null ? -1 : state.getValue().type)
+                                + " valueClass=" + (value == null ? "null" : value.getClass().getName())
+                                + " valueId=" + (value instanceof RuntimeBase base
+                                        ? System.identityHashCode(base) : -1));
+                    }
                 }
                 // Persistent state is a Perl owner edge from an installed CV.
                 // In particular, singleton services such as Mojo::IOLoop keep

From 7c7cb1f84545c7efa0592558963495a4339165f9 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 01:14:55 +0200
Subject: [PATCH 062/317] chore: trace Mojo loop CV root metadata

Add a temporary opt-in diagnostic for whether Mojo::IOLoop code and
persistent state slots are visited by the bounded root snapshot.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <openai-codex@users.noreply.github.com>
---
 .../runtime/runtimetypes/ReachabilityWalker.java  | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index e9543ab99f..04f95bca16 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1492,6 +1492,21 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
             if (stats != null) stats.nodesVisited++;
             if (cur instanceof RuntimeStash) continue;
             if (cur instanceof RuntimeHash hash) {
+                if (Boolean.getBoolean("PJ_CODE_ROOT_TRACE")
+                        && (hash.elements.containsKey("reactor")
+                                || hash.elements.containsKey("timers")
+                                || hash.elements.containsKey("cb"))) {
+                    System.err.println("[MOJO-TIMER-HASH] identity=" + System.identityHashCode(hash)
+                            + " keys=" + hash.elements.keySet());
+                    for (Map.Entry<String, RuntimeScalar> entry : hash.elements.entrySet()) {
+                        Object value = entry.getValue() == null ? null : entry.getValue().value;
+                        System.err.println("[MOJO-TIMER-EDGE] key=" + entry.getKey()
+                                + " type=" + (entry.getValue() == null ? -1 : entry.getValue().type)
+                                + " valueClass=" + (value == null ? "null" : value.getClass().getName())
+                                + " valueId=" + (value instanceof RuntimeBase base
+                                        ? System.identityHashCode(base) : -1));
+                    }
+                }
                 if (hash.elements instanceof TieHash tieHash) {
                     if (!budget.visitEdge()) break walk;
                     if (stats != null) stats.edgesInspected++;

From 04b969637edcc43b72d5dd5f9fa4462c5f3ac8ce Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 01:26:01 +0200
Subject: [PATCH 063/317] chore: trace Mojo loop CV root metadata

Add a temporary opt-in diagnostic for whether Mojo::IOLoop code and
persistent state slots are visited by the bounded root snapshot.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <openai-codex@users.noreply.github.com>
---
 .../runtime/runtimetypes/ReachabilityWalker.java     | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 04f95bca16..db39cc0312 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1537,6 +1537,18 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
                                 + " valueClass=" + (value == null ? "null" : value.getClass().getName())
                                 + " valueId=" + (value instanceof RuntimeBase base
                                         ? System.identityHashCode(base) : -1));
+                        if (value instanceof RuntimeHash stateHash) {
+                            for (Map.Entry<String, RuntimeScalar> entry : stateHash.elements.entrySet()) {
+                                Object child = entry.getValue() == null ? null : entry.getValue().value;
+                                if (child instanceof RuntimeHash childHash) {
+                                    System.err.println("[MOJO-LOOP-CHILD] key=" + entry.getKey()
+                                            + " identity=" + System.identityHashCode(childHash)
+                                            + " keys=" + childHash.elements.keySet()
+                                            + " stash=" + (childHash instanceof RuntimeStash)
+                                            + " blessed=" + NameNormalizer.getBlessStr(childHash.blessId));
+                                }
+                            }
+                        }
                     }
                 }
                 // Persistent state is a Perl owner edge from an installed CV.

From 86ffafb4c397b3d6be71f8eebd0062ef1ded4b42 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 01:37:02 +0200
Subject: [PATCH 064/317] chore: trace Mojo loop CV root metadata

Add a temporary opt-in diagnostic for whether Mojo::IOLoop code and
persistent state slots are visited by the bounded root snapshot.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <openai-codex@users.noreply.github.com>
---
 .../runtimetypes/ReachabilityWalker.java       | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index db39cc0312..7819da1922 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1505,6 +1505,24 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
                                 + " valueClass=" + (value == null ? "null" : value.getClass().getName())
                                 + " valueId=" + (value instanceof RuntimeBase base
                                         ? System.identityHashCode(base) : -1));
+                        if (value instanceof RuntimeCode nested) {
+                            System.err.println("[MOJO-TIMER-CODE] identity="
+                                    + System.identityHashCode(nested) + " name="
+                                    + nested.packageName + "::" + nested.subName + " captures="
+                                    + (nested.capturedScalars == null ? 0 : nested.capturedScalars.length));
+                            if (nested.capturedScalars != null) {
+                                for (int i = 0; i < nested.capturedScalars.length; i++) {
+                                    RuntimeScalar capture = nested.capturedScalars[i];
+                                    Object capturedValue = capture == null ? null : capture.value;
+                                    System.err.println("[MOJO-CODE-CAPTURE] index=" + i
+                                            + " type=" + (capture == null ? -1 : capture.type)
+                                            + " valueClass=" + (capturedValue == null ? "null"
+                                                    : capturedValue.getClass().getName())
+                                            + " valueId=" + (capturedValue instanceof RuntimeBase base
+                                                    ? System.identityHashCode(base) : -1));
+                                }
+                            }
+                        }
                     }
                 }
                 if (hash.elements instanceof TieHash tieHash) {

From 60de63d59e9422393d6c2ae143eb9492a2b197a7 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 01:49:11 +0200
Subject: [PATCH 065/317] fix: follow closed-over variables in code roots

Include RuntimeCode.closedOverVariables in targeted root proofs. Interpreted
and generated callbacks can retain nested CODE values through those lexical
slots even when they are absent from the aggregate capture arrays.
Add a timer callback regression for this nested owner edge.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <openai-codex@users.noreply.github.com>
---
 .../runtime/runtimetypes/ReachabilityWalker.java      | 11 +++++++++++
 .../RuntimeCodeScopeExitReachabilityTest.java         |  3 ++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 7819da1922..137b524257 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1601,6 +1601,17 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
                         if (captured != null && seen.add(captured)) todo.addLast(captured);
                     }
                 }
+                if (!includeOwnedCapturePads && code.closedOverVariables != null) {
+                    for (RuntimeBase captured : code.closedOverVariables.values()) {
+                        if (!budget.visitEdge()) break walk;
+                        if (stats != null) stats.edgesInspected++;
+                        if (captured instanceof RuntimeScalar scalar) {
+                            followScalarIncludingCode(scalar, null, seen, todo);
+                        } else if (captured != null && seen.add(captured)) {
+                            todo.addLast(captured);
+                        }
+                    }
+                }
             } else if (cur instanceof RuntimeRegex regex) {
                 for (RuntimeCode callback : regex.executableCallbackCodes()) {
                     if (!budget.visitEdge()) break walk;
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
index 73b27dd4d0..78aa0157f4 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
@@ -100,7 +100,8 @@ void deferredReleaseFollowsCaptureFromRootedCallbackToNestedCallback() {
             callbackRef.scopeExited = true;
             RuntimeCode timerWrapper = new RuntimeCode(null, List.of());
             timerWrapper.refCount = 1;
-            timerWrapper.capturedScalars = new RuntimeScalar[] { callbackRef };
+            timerWrapper.closedOverVariables = new java.util.LinkedHashMap<>();
+            timerWrapper.closedOverVariables.put("$callback", callbackRef);
 
             RuntimeHash reactorTimers = new RuntimeHash();
             RuntimeHash timerRecord = new RuntimeHash();

From d141b62920c9051fb18b9e48cc59a1af029f3384 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 02:05:07 +0200
Subject: [PATCH 066/317] chore: trace Mojo loop CV root metadata

Add a temporary opt-in diagnostic for whether Mojo::IOLoop code and
persistent state slots are visited by the bounded root snapshot.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <openai-codex@users.noreply.github.com>
---
 .../perlonjava/runtime/runtimetypes/ReachabilityWalker.java   | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 137b524257..faf3f132ad 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1509,7 +1509,9 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
                             System.err.println("[MOJO-TIMER-CODE] identity="
                                     + System.identityHashCode(nested) + " name="
                                     + nested.packageName + "::" + nested.subName + " captures="
-                                    + (nested.capturedScalars == null ? 0 : nested.capturedScalars.length));
+                                    + (nested.capturedScalars == null ? 0 : nested.capturedScalars.length)
+                                    + " closedOver=" + (nested.closedOverVariables == null
+                                            ? "[]" : nested.closedOverVariables.keySet()));
                             if (nested.capturedScalars != null) {
                                 for (int i = 0; i < nested.capturedScalars.length; i++) {
                                     RuntimeScalar capture = nested.capturedScalars[i];

From 1267c8859d375548c3d0e178842582f7753c9a21 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 02:16:15 +0200
Subject: [PATCH 067/317] Revert "chore: trace Mojo loop CV root metadata"

This reverts commit c16c705b96d35a3db875b42b039ff22603ea8c04.
---
 .../perlonjava/runtime/runtimetypes/ReachabilityWalker.java   | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index faf3f132ad..137b524257 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1509,9 +1509,7 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
                             System.err.println("[MOJO-TIMER-CODE] identity="
                                     + System.identityHashCode(nested) + " name="
                                     + nested.packageName + "::" + nested.subName + " captures="
-                                    + (nested.capturedScalars == null ? 0 : nested.capturedScalars.length)
-                                    + " closedOver=" + (nested.closedOverVariables == null
-                                            ? "[]" : nested.closedOverVariables.keySet()));
+                                    + (nested.capturedScalars == null ? 0 : nested.capturedScalars.length));
                             if (nested.capturedScalars != null) {
                                 for (int i = 0; i < nested.capturedScalars.length; i++) {
                                     RuntimeScalar capture = nested.capturedScalars[i];

From fdb88d7235af549919c8237fd84000be7e98ce28 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 02:16:15 +0200
Subject: [PATCH 068/317] Revert "chore: trace Mojo loop CV root metadata"

This reverts commit 4cdf654842c949b4ed22411a645160d0bba23ae8.
---
 .../runtimetypes/ReachabilityWalker.java       | 18 ------------------
 1 file changed, 18 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 137b524257..0dc0c9aed5 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1505,24 +1505,6 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
                                 + " valueClass=" + (value == null ? "null" : value.getClass().getName())
                                 + " valueId=" + (value instanceof RuntimeBase base
                                         ? System.identityHashCode(base) : -1));
-                        if (value instanceof RuntimeCode nested) {
-                            System.err.println("[MOJO-TIMER-CODE] identity="
-                                    + System.identityHashCode(nested) + " name="
-                                    + nested.packageName + "::" + nested.subName + " captures="
-                                    + (nested.capturedScalars == null ? 0 : nested.capturedScalars.length));
-                            if (nested.capturedScalars != null) {
-                                for (int i = 0; i < nested.capturedScalars.length; i++) {
-                                    RuntimeScalar capture = nested.capturedScalars[i];
-                                    Object capturedValue = capture == null ? null : capture.value;
-                                    System.err.println("[MOJO-CODE-CAPTURE] index=" + i
-                                            + " type=" + (capture == null ? -1 : capture.type)
-                                            + " valueClass=" + (capturedValue == null ? "null"
-                                                    : capturedValue.getClass().getName())
-                                            + " valueId=" + (capturedValue instanceof RuntimeBase base
-                                                    ? System.identityHashCode(base) : -1));
-                                }
-                            }
-                        }
                     }
                 }
                 if (hash.elements instanceof TieHash tieHash) {

From 099ca9cd3beadda5c458c0a838cd46bfd2b5420a Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 02:16:15 +0200
Subject: [PATCH 069/317] Revert "chore: trace Mojo loop CV root metadata"

This reverts commit f04db462677dc0971eb7b2f58078966843acbdd0.
---
 .../runtime/runtimetypes/ReachabilityWalker.java     | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 0dc0c9aed5..8b388a16da 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1537,18 +1537,6 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
                                 + " valueClass=" + (value == null ? "null" : value.getClass().getName())
                                 + " valueId=" + (value instanceof RuntimeBase base
                                         ? System.identityHashCode(base) : -1));
-                        if (value instanceof RuntimeHash stateHash) {
-                            for (Map.Entry<String, RuntimeScalar> entry : stateHash.elements.entrySet()) {
-                                Object child = entry.getValue() == null ? null : entry.getValue().value;
-                                if (child instanceof RuntimeHash childHash) {
-                                    System.err.println("[MOJO-LOOP-CHILD] key=" + entry.getKey()
-                                            + " identity=" + System.identityHashCode(childHash)
-                                            + " keys=" + childHash.elements.keySet()
-                                            + " stash=" + (childHash instanceof RuntimeStash)
-                                            + " blessed=" + NameNormalizer.getBlessStr(childHash.blessId));
-                                }
-                            }
-                        }
                     }
                 }
                 // Persistent state is a Perl owner edge from an installed CV.

From ba3c54b0c3337dc98498a3357e33e055fe9013c5 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 02:16:15 +0200
Subject: [PATCH 070/317] Revert "chore: trace Mojo loop CV root metadata"

This reverts commit 1cd59b6e53836cf2876d6f67f5510f24ba1b2c9b.
---
 .../runtime/runtimetypes/ReachabilityWalker.java  | 15 ---------------
 1 file changed, 15 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 8b388a16da..cb78ee0490 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1492,21 +1492,6 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
             if (stats != null) stats.nodesVisited++;
             if (cur instanceof RuntimeStash) continue;
             if (cur instanceof RuntimeHash hash) {
-                if (Boolean.getBoolean("PJ_CODE_ROOT_TRACE")
-                        && (hash.elements.containsKey("reactor")
-                                || hash.elements.containsKey("timers")
-                                || hash.elements.containsKey("cb"))) {
-                    System.err.println("[MOJO-TIMER-HASH] identity=" + System.identityHashCode(hash)
-                            + " keys=" + hash.elements.keySet());
-                    for (Map.Entry<String, RuntimeScalar> entry : hash.elements.entrySet()) {
-                        Object value = entry.getValue() == null ? null : entry.getValue().value;
-                        System.err.println("[MOJO-TIMER-EDGE] key=" + entry.getKey()
-                                + " type=" + (entry.getValue() == null ? -1 : entry.getValue().type)
-                                + " valueClass=" + (value == null ? "null" : value.getClass().getName())
-                                + " valueId=" + (value instanceof RuntimeBase base
-                                        ? System.identityHashCode(base) : -1));
-                    }
-                }
                 if (hash.elements instanceof TieHash tieHash) {
                     if (!budget.visitEdge()) break walk;
                     if (stats != null) stats.edgesInspected++;

From 885839b4fd313835c7fa947a8c6131f7dfa6d29d Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 02:16:15 +0200
Subject: [PATCH 071/317] Revert "chore: trace Mojo loop CV root metadata"

This reverts commit 46242a596a8d7cffc8c8c2add9cc3cd8d77594d1.
---
 .../runtime/runtimetypes/ReachabilityWalker.java          | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index cb78ee0490..7b2a5bb67f 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1515,14 +1515,6 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
                         && "Mojo::IOLoop".equals(code.packageName)) {
                     System.err.println("[MOJO-LOOP-CV] identity=" + System.identityHashCode(code)
                             + " sub=" + code.subName + " states=" + code.stateVariable.keySet());
-                    for (Map.Entry<String, RuntimeScalar> state : code.stateVariable.entrySet()) {
-                        Object value = state.getValue() == null ? null : state.getValue().value;
-                        System.err.println("[MOJO-LOOP-STATE] key=" + state.getKey()
-                                + " type=" + (state.getValue() == null ? -1 : state.getValue().type)
-                                + " valueClass=" + (value == null ? "null" : value.getClass().getName())
-                                + " valueId=" + (value instanceof RuntimeBase base
-                                        ? System.identityHashCode(base) : -1));
-                    }
                 }
                 // Persistent state is a Perl owner edge from an installed CV.
                 // In particular, singleton services such as Mojo::IOLoop keep

From 87b07b16c6af3b8b407e64b120149c672330ca26 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 02:16:15 +0200
Subject: [PATCH 072/317] Revert "chore: trace Mojo loop CV root metadata"

This reverts commit 2289f2b8948f43b33a7ef042aeb0b5ad6387bb71.
---
 .../perlonjava/runtime/runtimetypes/ReachabilityWalker.java  | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 7b2a5bb67f..1ef9e9ec46 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1511,11 +1511,6 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
                     else followScalarIncludingCode(value, null, seen, todo);
                 }
             } else if (cur instanceof RuntimeCode code) {
-                if (Boolean.getBoolean("PJ_CODE_ROOT_TRACE")
-                        && "Mojo::IOLoop".equals(code.packageName)) {
-                    System.err.println("[MOJO-LOOP-CV] identity=" + System.identityHashCode(code)
-                            + " sub=" + code.subName + " states=" + code.stateVariable.keySet());
-                }
                 // Persistent state is a Perl owner edge from an installed CV.
                 // In particular, singleton services such as Mojo::IOLoop keep
                 // their reactor (and its callback hashes) in a state variable.

From 46af62c772d30b812569e471c6420c44d818f311 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 02:53:55 +0200
Subject: [PATCH 073/317] wip: trace interpreter closure owner edges

Add traversal for InterpretedCode capturedVars and a regression test for a
persistent timer callback. The real Mojolicious WebSocket test still flakes,
so this snapshot is for continued investigation.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtimetypes/ReachabilityWalker.java      | 27 +++++++++
 .../RuntimeCodeScopeExitReachabilityTest.java | 56 +++++++++++++++++++
 2 files changed, 83 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 1ef9e9ec46..2b8628eb4c 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1554,6 +1554,19 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
                         }
                     }
                 }
+                if (!includeOwnedCapturePads
+                        && code instanceof org.perlonjava.backend.bytecode.InterpretedCode interpreted
+                        && interpreted.capturedVars != null) {
+                    for (RuntimeBase captured : interpreted.capturedVars) {
+                        if (!budget.visitEdge()) break walk;
+                        if (stats != null) stats.edgesInspected++;
+                        if (captured instanceof RuntimeScalar scalar) {
+                            followScalarIncludingCode(scalar, null, seen, todo);
+                        } else if (captured != null && seen.add(captured)) {
+                            todo.addLast(captured);
+                        }
+                    }
+                }
             } else if (cur instanceof RuntimeRegex regex) {
                 for (RuntimeCode callback : regex.executableCallbackCodes()) {
                     if (!budget.visitEdge()) break walk;
@@ -2911,6 +2924,20 @@ private static boolean followGlobalCodeCaptures(RuntimeCode code, RuntimeBase ta
                 }
             }
         }
+        if (code instanceof org.perlonjava.backend.bytecode.InterpretedCode interpreted
+                && interpreted.capturedVars != null) {
+            for (RuntimeBase captured : interpreted.capturedVars) {
+                if (budget != null && !budget.visitEdge()) return false;
+                if (captured == null) continue;
+                if (captured instanceof RuntimeScalar scalar) {
+                    if (followScalar(scalar, target, seen, todo)) return true;
+                } else if (captured == target) {
+                    return true;
+                } else if (seen.add(captured)) {
+                    todo.addLast(captured);
+                }
+            }
+        }
         if (code.capturedScalars != null) {
             for (RuntimeScalar cap : code.capturedScalars) {
                 if (budget != null && !budget.visitEdge()) return false;
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
index 78aa0157f4..2c7b6113a1 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
@@ -2,6 +2,7 @@
 
 import org.junit.jupiter.api.Tag;
 import org.junit.jupiter.api.Test;
+import org.perlonjava.backend.bytecode.InterpretedCode;
 
 import java.util.List;
 
@@ -150,4 +151,59 @@ void deferredReleaseFollowsCaptureFromRootedCallbackToNestedCallback() {
             }
         }
     }
+
+    @Test
+    void deferredReleaseFollowsInterpretedClosureCaptureFromRootedTimer() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeScalar captured = new RuntimeScalar("controller");
+            captured.retainClosureCapture();
+            RuntimeCode callback = new RuntimeCode(null, List.of());
+            callback.refCount = 1;
+            callback.capturedScalars = new RuntimeScalar[] { captured };
+
+            RuntimeScalar callbackRef = new RuntimeScalar(callback);
+            callbackRef.captureCount = 1;
+            callbackRef.scopeExited = true;
+            InterpretedCode timerCallback = new InterpretedCode(
+                    new int[0], new Object[0], new String[0], 10,
+                    new RuntimeBase[] { callbackRef }, "<test>", 1,
+                    new java.util.TreeMap<>(), new java.util.HashMap<>(),
+                    null, 0, 0, new java.util.BitSet());
+            timerCallback.refCount = 1;
+            RuntimeHash timerRecord = new RuntimeHash();
+            timerRecord.elements.put("cb", new RuntimeScalar(timerCallback));
+            RuntimeHash timers = new RuntimeHash();
+            timers.elements.put("timer", timerRecord.createReference());
+            RuntimeCode singletonMethod = new RuntimeCode(null, List.of());
+            singletonMethod.stateVariable.put("loop", timers.createReference());
+            String globalName = "RuntimeCodeScopeExitReachabilityTest::interpretedSingleton";
+            GlobalVariable.globalCodeRefs.put(globalName, new RuntimeScalar(singletonMethod));
+            GlobalVariable.invalidateGlobalCodeRefGraphRoots();
+            boolean previousActive = MortalList.isActive();
+            MortalList.setActive(true);
+
+            try {
+                MortalList.deferDecrement(callback);
+                MortalList.flush();
+
+                assertNotNull(callback.capturedScalars,
+                        "a rooted interpreted timer must retain a callback in capturedVars");
+                assertEquals(1, captured.captureCount);
+
+                GlobalVariable.globalCodeRefs.remove(globalName);
+                GlobalVariable.invalidateGlobalCodeRefGraphRoots();
+                MortalList.deferDecrement(callback);
+                MortalList.flush();
+
+                assertNull(callback.capturedScalars,
+                        "removing the interpreted timer root must release nested callback captures");
+                assertEquals(0, captured.captureCount);
+            } finally {
+                GlobalVariable.globalCodeRefs.remove(globalName);
+                GlobalVariable.invalidateGlobalCodeRefGraphRoots();
+                MortalList.setActive(previousActive);
+            }
+        }
+    }
 }

From 50635899fd7f9b83a46dd3db8b756dc060e79812 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 03:04:41 +0200
Subject: [PATCH 074/317] wip: inspect callback capture release paths

Add temporary creation and release traces for anonymous Mojo callbacks to
identify why the WebSocket timer stops firing under PerlOnJava.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtime/runtimetypes/RuntimeCode.java     | 39 +++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
index 1969ae70dc..7d1f7be820 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
@@ -2868,6 +2868,19 @@ public static boolean isInstalledPadConstant(RuntimeBase target) {
      * captures, those are released recursively.
      */
     public void releaseCaptures() {
+        if (System.getenv("PJ_TRACE_CODE_CREATION") != null
+                && cvStartFile != null
+                && (cvStartFile.contains("mojolicious_websocket_callback_lifetime")
+                || cvStartFile.contains("Mojo/IOLoop.pm"))) {
+            System.err.println("[CV-RELEASE] source=" + cvStartFile + ":" + cvStartLine
+                    + " class=" + (codeObject == null ? "null" : codeObject.getClass().getName())
+                    + " code=" + System.identityHashCode(this)
+                    + " refCount=" + refCount
+                    + " captured=" + (capturedScalars == null ? 0 : capturedScalars.length)
+                    + " closedOver=" + (closedOverVariables == null
+                    ? "[]" : closedOverVariables.keySet())
+                    + " path=" + ReachabilityWalker.findPathTo(this, true));
+        }
         if (capturedScalars != null) {
             RuntimeScalar[] scalars = capturedScalars;
             capturedScalars = null;  // null out first to prevent re-entry
@@ -5394,6 +5407,32 @@ public static RuntimeScalar makeCodeObject(
             code.capturedAggregateOwnerSlots =
                     capturedAggregateOwnerSlots.toArray(new PerlOwnerSlot[0]);
         }
+        if (System.getenv("PJ_TRACE_CODE_CREATION") != null
+                && cvStartFile != null
+                && (cvStartFile.contains("mojolicious_websocket_callback_lifetime")
+                || cvStartFile.contains("Mojo/IOLoop.pm"))) {
+            System.err.println("[CV-CREATE] source=" + cvStartFile + ":" + cvStartLine
+                    + " class=" + clazz.getName()
+                    + " code=" + System.identityHashCode(code)
+                    + " captured=" + captured.size()
+                    + " aggregates=" + capturedAggregates.size()
+                    + " closedOver=" + (code.closedOverVariables == null
+                    ? "[]" : code.closedOverVariables.keySet()));
+            for (Field f : allFields) {
+                try {
+                    Object value = f.get(codeObject);
+                    System.err.println("[CV-FIELD] " + f.getName() + ":"
+                            + f.getType().getSimpleName() + "="
+                            + (value instanceof RuntimeScalar scalar
+                            ? "scalar#" + System.identityHashCode(scalar) + "/type" + scalar.type
+                            : value instanceof RuntimeBase base
+                            ? base.getClass().getSimpleName() + "#" + System.identityHashCode(base)
+                            : value == null ? "null" : value.getClass().getSimpleName()));
+                } catch (IllegalAccessException ignored) {
+                    System.err.println("[CV-FIELD] " + f.getName() + "=<inaccessible>");
+                }
+            }
+        }
         GlobalVariable.invalidateGlobalCodeRefGraphRoots();
 
         // A BEGIN-installed `sub () { $lexical }` is a Perl constant CV.  The

From 36c3baf17ff58a514d1ec9807b53ad1f5a0a2bd2 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 03:07:29 +0200
Subject: [PATCH 075/317] wip: inspect callback capture release paths

Add temporary creation and release traces for anonymous Mojo callbacks to
identify why the WebSocket timer stops firing under PerlOnJava.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java   | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
index 7d1f7be820..e35104514b 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
@@ -2879,7 +2879,9 @@ public void releaseCaptures() {
                     + " captured=" + (capturedScalars == null ? 0 : capturedScalars.length)
                     + " closedOver=" + (closedOverVariables == null
                     ? "[]" : closedOverVariables.keySet())
+                    + " roots=" + ReachabilityWalker.isCodeReachableFromRoots(this)
                     + " path=" + ReachabilityWalker.findPathTo(this, true));
+            new Exception("capture release call site").printStackTrace(System.err);
         }
         if (capturedScalars != null) {
             RuntimeScalar[] scalars = capturedScalars;

From 0c258cb8a5f1484bc79365405d7b311a88df0854 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 03:13:48 +0200
Subject: [PATCH 076/317] fix: avoid retaining stale interpreter capture
 metadata

Interpreter capturedVars is execution-frame metadata and may retain stale
values after releaseCaptures clears the semantic owner lists. Remove it from
root traversal and discard the synthetic test that treated it as a live edge.
Also remove temporary Mojo callback diagnostics.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtimetypes/ReachabilityWalker.java      | 27 ---------
 .../runtime/runtimetypes/RuntimeCode.java     | 41 --------------
 .../RuntimeCodeScopeExitReachabilityTest.java | 55 -------------------
 3 files changed, 123 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 2b8628eb4c..1ef9e9ec46 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1554,19 +1554,6 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
                         }
                     }
                 }
-                if (!includeOwnedCapturePads
-                        && code instanceof org.perlonjava.backend.bytecode.InterpretedCode interpreted
-                        && interpreted.capturedVars != null) {
-                    for (RuntimeBase captured : interpreted.capturedVars) {
-                        if (!budget.visitEdge()) break walk;
-                        if (stats != null) stats.edgesInspected++;
-                        if (captured instanceof RuntimeScalar scalar) {
-                            followScalarIncludingCode(scalar, null, seen, todo);
-                        } else if (captured != null && seen.add(captured)) {
-                            todo.addLast(captured);
-                        }
-                    }
-                }
             } else if (cur instanceof RuntimeRegex regex) {
                 for (RuntimeCode callback : regex.executableCallbackCodes()) {
                     if (!budget.visitEdge()) break walk;
@@ -2924,20 +2911,6 @@ private static boolean followGlobalCodeCaptures(RuntimeCode code, RuntimeBase ta
                 }
             }
         }
-        if (code instanceof org.perlonjava.backend.bytecode.InterpretedCode interpreted
-                && interpreted.capturedVars != null) {
-            for (RuntimeBase captured : interpreted.capturedVars) {
-                if (budget != null && !budget.visitEdge()) return false;
-                if (captured == null) continue;
-                if (captured instanceof RuntimeScalar scalar) {
-                    if (followScalar(scalar, target, seen, todo)) return true;
-                } else if (captured == target) {
-                    return true;
-                } else if (seen.add(captured)) {
-                    todo.addLast(captured);
-                }
-            }
-        }
         if (code.capturedScalars != null) {
             for (RuntimeScalar cap : code.capturedScalars) {
                 if (budget != null && !budget.visitEdge()) return false;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
index e35104514b..1969ae70dc 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
@@ -2868,21 +2868,6 @@ public static boolean isInstalledPadConstant(RuntimeBase target) {
      * captures, those are released recursively.
      */
     public void releaseCaptures() {
-        if (System.getenv("PJ_TRACE_CODE_CREATION") != null
-                && cvStartFile != null
-                && (cvStartFile.contains("mojolicious_websocket_callback_lifetime")
-                || cvStartFile.contains("Mojo/IOLoop.pm"))) {
-            System.err.println("[CV-RELEASE] source=" + cvStartFile + ":" + cvStartLine
-                    + " class=" + (codeObject == null ? "null" : codeObject.getClass().getName())
-                    + " code=" + System.identityHashCode(this)
-                    + " refCount=" + refCount
-                    + " captured=" + (capturedScalars == null ? 0 : capturedScalars.length)
-                    + " closedOver=" + (closedOverVariables == null
-                    ? "[]" : closedOverVariables.keySet())
-                    + " roots=" + ReachabilityWalker.isCodeReachableFromRoots(this)
-                    + " path=" + ReachabilityWalker.findPathTo(this, true));
-            new Exception("capture release call site").printStackTrace(System.err);
-        }
         if (capturedScalars != null) {
             RuntimeScalar[] scalars = capturedScalars;
             capturedScalars = null;  // null out first to prevent re-entry
@@ -5409,32 +5394,6 @@ public static RuntimeScalar makeCodeObject(
             code.capturedAggregateOwnerSlots =
                     capturedAggregateOwnerSlots.toArray(new PerlOwnerSlot[0]);
         }
-        if (System.getenv("PJ_TRACE_CODE_CREATION") != null
-                && cvStartFile != null
-                && (cvStartFile.contains("mojolicious_websocket_callback_lifetime")
-                || cvStartFile.contains("Mojo/IOLoop.pm"))) {
-            System.err.println("[CV-CREATE] source=" + cvStartFile + ":" + cvStartLine
-                    + " class=" + clazz.getName()
-                    + " code=" + System.identityHashCode(code)
-                    + " captured=" + captured.size()
-                    + " aggregates=" + capturedAggregates.size()
-                    + " closedOver=" + (code.closedOverVariables == null
-                    ? "[]" : code.closedOverVariables.keySet()));
-            for (Field f : allFields) {
-                try {
-                    Object value = f.get(codeObject);
-                    System.err.println("[CV-FIELD] " + f.getName() + ":"
-                            + f.getType().getSimpleName() + "="
-                            + (value instanceof RuntimeScalar scalar
-                            ? "scalar#" + System.identityHashCode(scalar) + "/type" + scalar.type
-                            : value instanceof RuntimeBase base
-                            ? base.getClass().getSimpleName() + "#" + System.identityHashCode(base)
-                            : value == null ? "null" : value.getClass().getSimpleName()));
-                } catch (IllegalAccessException ignored) {
-                    System.err.println("[CV-FIELD] " + f.getName() + "=<inaccessible>");
-                }
-            }
-        }
         GlobalVariable.invalidateGlobalCodeRefGraphRoots();
 
         // A BEGIN-installed `sub () { $lexical }` is a Perl constant CV.  The
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
index 2c7b6113a1..4609476deb 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeCodeScopeExitReachabilityTest.java
@@ -2,7 +2,6 @@
 
 import org.junit.jupiter.api.Tag;
 import org.junit.jupiter.api.Test;
-import org.perlonjava.backend.bytecode.InterpretedCode;
 
 import java.util.List;
 
@@ -152,58 +151,4 @@ void deferredReleaseFollowsCaptureFromRootedCallbackToNestedCallback() {
         }
     }
 
-    @Test
-    void deferredReleaseFollowsInterpretedClosureCaptureFromRootedTimer() {
-        PerlRuntime runtime = new PerlRuntime();
-        try (PerlRuntime.Binding ignored = runtime.bind()) {
-            RuntimeScalar captured = new RuntimeScalar("controller");
-            captured.retainClosureCapture();
-            RuntimeCode callback = new RuntimeCode(null, List.of());
-            callback.refCount = 1;
-            callback.capturedScalars = new RuntimeScalar[] { captured };
-
-            RuntimeScalar callbackRef = new RuntimeScalar(callback);
-            callbackRef.captureCount = 1;
-            callbackRef.scopeExited = true;
-            InterpretedCode timerCallback = new InterpretedCode(
-                    new int[0], new Object[0], new String[0], 10,
-                    new RuntimeBase[] { callbackRef }, "<test>", 1,
-                    new java.util.TreeMap<>(), new java.util.HashMap<>(),
-                    null, 0, 0, new java.util.BitSet());
-            timerCallback.refCount = 1;
-            RuntimeHash timerRecord = new RuntimeHash();
-            timerRecord.elements.put("cb", new RuntimeScalar(timerCallback));
-            RuntimeHash timers = new RuntimeHash();
-            timers.elements.put("timer", timerRecord.createReference());
-            RuntimeCode singletonMethod = new RuntimeCode(null, List.of());
-            singletonMethod.stateVariable.put("loop", timers.createReference());
-            String globalName = "RuntimeCodeScopeExitReachabilityTest::interpretedSingleton";
-            GlobalVariable.globalCodeRefs.put(globalName, new RuntimeScalar(singletonMethod));
-            GlobalVariable.invalidateGlobalCodeRefGraphRoots();
-            boolean previousActive = MortalList.isActive();
-            MortalList.setActive(true);
-
-            try {
-                MortalList.deferDecrement(callback);
-                MortalList.flush();
-
-                assertNotNull(callback.capturedScalars,
-                        "a rooted interpreted timer must retain a callback in capturedVars");
-                assertEquals(1, captured.captureCount);
-
-                GlobalVariable.globalCodeRefs.remove(globalName);
-                GlobalVariable.invalidateGlobalCodeRefGraphRoots();
-                MortalList.deferDecrement(callback);
-                MortalList.flush();
-
-                assertNull(callback.capturedScalars,
-                        "removing the interpreted timer root must release nested callback captures");
-                assertEquals(0, captured.captureCount);
-            } finally {
-                GlobalVariable.globalCodeRefs.remove(globalName);
-                GlobalVariable.invalidateGlobalCodeRefGraphRoots();
-                MortalList.setActive(previousActive);
-            }
-        }
-    }
 }

From 6ef9676073788164328b56fa224b8ba3465c9c0f Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 03:26:23 +0200
Subject: [PATCH 077/317] test: assert WebSocket controller lifetime across
 push callbacks

Keep the recurring timer alive until the WebSocket assertions complete, then
remove it explicitly. Assert the controller remains alive while the socket is
open and allow bounded reactor cleanup ticks for the long-poll finish event.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../mojolicious_websocket_callback_lifetime.t | 24 +++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/src/test/resources/unit/mojolicious_websocket_callback_lifetime.t b/src/test/resources/unit/mojolicious_websocket_callback_lifetime.t
index a6c545e129..14d78b2195 100644
--- a/src/test/resources/unit/mojolicious_websocket_callback_lifetime.t
+++ b/src/test/resources/unit/mojolicious_websocket_callback_lifetime.t
@@ -27,13 +27,19 @@ BEGIN {
 
 package LifetimeController;
 use Mojo::Base 'Mojolicious::Controller';
-sub DESTROY { shift->stash->{destroyed} = 1 }
+sub DESTROY {
+  my $self = shift;
+  $main::websocket_controller_destroyed = 1 if $self->stash->{websocket_lifetime};
+  $self->stash->{destroyed} = 1;
+}
 package main;
+our $push_timer_id;
+our $websocket_controller_destroyed = 0;
 app->controller_class('LifetimeController');
 websocket '/push' => sub {
   my $c = shift;
-  my $id = Mojo::IOLoop->recurring(0.1 => sub { $c->send('push') });
-  $c->on(finish => sub { Mojo::IOLoop->remove($id) });
+  $c->stash->{websocket_lifetime} = 1;
+  $push_timer_id = Mojo::IOLoop->recurring(0.1 => sub { $c->send('push') });
 };
 get '/longpoll' => sub {
   my $c = shift;
@@ -62,7 +68,11 @@ my $t = Test::Mojo->new;
 $t->websocket_ok('/push')
   ->message_ok->message_is('push')
   ->message_ok->message_is('push')
-  ->message_ok->message_is('push')->finish_ok;
+  ->message_ok->message_is('push');
+ok(!$websocket_controller_destroyed,
+  'WebSocket controller remains alive while the connection is open');
+Mojo::IOLoop->remove($push_timer_id);
+$t->finish_ok;
 $t->get_ok('/plugin/upper_case')->status_is(200)->content_is('WELCOME aboard!');
 $t->get_ok('/plugin/camel_case')->status_is(200)->content_is('Welcome aboard!');
 $t->get_ok('/staged' => {'X-Pass' => 1})->status_is(200)->content_is('Welcome aboard!');
@@ -72,6 +82,12 @@ my $stash;
 $t->app->plugins->once(before_dispatch => sub { $stash = shift->stash });
 $t->get_ok('/longpoll')->status_is(200)->content_is('Poll!');
 Mojo::IOLoop->one_tick until $stash->{finished};
+unless ($stash->{destroyed}) {
+  for (1 .. 10) {
+    last if $stash->{destroyed};
+    Mojo::IOLoop->one_tick;
+  }
+}
 is($stash->{finished}, 1, 'long-poll response has finished');
 ok($stash->{destroyed}, 'long-poll controller is destroyed after response finish');
 done_testing;

From e995f7bdfdf4a4195982defec8d721d51f5904d6 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 07:02:21 +0200
Subject: [PATCH 078/317] fix: synchronize scalar container owner tracking

Guard shared container-owner metadata with the owning scalar monitor. Concurrent ithread callbacks can register and inspect the same scalar while array slots are added, which previously raised ConcurrentModificationException and aborted Thread::Queue workers.

Add a Java regression test for concurrent array owner registration, snapshots, and removal.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtime/runtimetypes/RuntimeScalar.java   | 14 ++---
 ...eScalarContainerOwnersConcurrencyTest.java | 55 +++++++++++++++++++
 2 files changed, 62 insertions(+), 7 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarContainerOwnersConcurrencyTest.java

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 1138c0ee98..33556f6543 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -422,7 +422,7 @@ public int captureRefCountOwned() {
 
     // Last hash/array container that stored this scalar slot. Used only as a
     // narrow guard for live CODE refs whose captures must survive void discard.
-    RuntimeBase containerOwner;
+    volatile RuntimeBase containerOwner;
     private List<WeakReference<RuntimeHash>> hashContainerOwners;
     private List<WeakReference<RuntimeArray>> arrayContainerOwners;
 
@@ -431,7 +431,7 @@ public RuntimeBase getContainerOwner() {
         return containerOwner;
     }
 
-    void markContainerOwner(RuntimeBase owner) {
+    synchronized void markContainerOwner(RuntimeBase owner) {
         // Immutable primitive literals are shared from the global scalar
         // cache. Their owner does not make them writable, but it would keep a
         // transient argument or container alive as long as the cache entry.
@@ -456,7 +456,7 @@ void markContainerOwner(RuntimeBase owner) {
         propagateTiedHandlerMarkerToReferent();
     }
 
-    List<RuntimeHash> hashContainerOwnersSnapshot() {
+    synchronized List<RuntimeHash> hashContainerOwnersSnapshot() {
         if (hashContainerOwners == null) return List.of();
         List<RuntimeHash> snapshot = new ArrayList<>(hashContainerOwners.size());
         hashContainerOwners.removeIf(reference -> reference.get() == null);
@@ -468,7 +468,7 @@ List<RuntimeHash> hashContainerOwnersSnapshot() {
         return snapshot;
     }
 
-    void unmarkHashContainerOwner(RuntimeHash owner) {
+    synchronized void unmarkHashContainerOwner(RuntimeHash owner) {
         if (hashContainerOwners == null) return;
         hashContainerOwners.removeIf(reference -> reference.get() == null || reference.get() == owner);
         if (hashContainerOwners.isEmpty()) hashContainerOwners = null;
@@ -478,7 +478,7 @@ void unmarkHashContainerOwner(RuntimeHash owner) {
         }
     }
 
-    void markArrayContainerOwner(RuntimeArray owner) {
+    synchronized void markArrayContainerOwner(RuntimeArray owner) {
         if (arrayContainerOwners == null) arrayContainerOwners = new ArrayList<>();
         arrayContainerOwners.removeIf(reference -> reference.get() == null);
         if (arrayContainerOwners.stream().noneMatch(reference -> reference.get() == owner)) {
@@ -486,7 +486,7 @@ void markArrayContainerOwner(RuntimeArray owner) {
         }
     }
 
-    List<RuntimeArray> arrayContainerOwnersSnapshot() {
+    synchronized List<RuntimeArray> arrayContainerOwnersSnapshot() {
         if (arrayContainerOwners == null) return List.of();
         arrayContainerOwners.removeIf(reference -> reference.get() == null);
         List<RuntimeArray> snapshot = new ArrayList<>(arrayContainerOwners.size());
@@ -498,7 +498,7 @@ List<RuntimeArray> arrayContainerOwnersSnapshot() {
         return snapshot;
     }
 
-    void unmarkArrayContainerOwner(RuntimeArray owner) {
+    synchronized void unmarkArrayContainerOwner(RuntimeArray owner) {
         if (arrayContainerOwners == null) return;
         arrayContainerOwners.removeIf(reference -> reference.get() == null || reference.get() == owner);
         if (arrayContainerOwners.isEmpty()) arrayContainerOwners = null;
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarContainerOwnersConcurrencyTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarContainerOwnersConcurrencyTest.java
new file mode 100644
index 0000000000..3ff73247de
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarContainerOwnersConcurrencyTest.java
@@ -0,0 +1,55 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.concurrent.Callable;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.Future;
+import java.util.concurrent.TimeUnit;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("unit")
+class RuntimeScalarContainerOwnersConcurrencyTest {
+    @Test
+    void concurrentArrayOwnerRegistrationAndSnapshotsRemainSafe() throws Exception {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeScalar cell = new RuntimeScalar();
+            List<RuntimeArray> owners = new ArrayList<>();
+            for (int i = 0; i < 8; i++) owners.add(new RuntimeArray());
+
+            ExecutorService workers = Executors.newFixedThreadPool(owners.size());
+            CountDownLatch ready = new CountDownLatch(owners.size());
+            CountDownLatch start = new CountDownLatch(1);
+            try {
+                List<Future<Void>> tasks = new ArrayList<>();
+                for (RuntimeArray owner : owners) {
+                    tasks.add(workers.submit((Callable<Void>) () -> {
+                        ready.countDown();
+                        if (!start.await(5, TimeUnit.SECONDS)) {
+                            throw new AssertionError("concurrent owner workers did not start");
+                        }
+                        for (int i = 0; i < 10_000; i++) {
+                            cell.markArrayContainerOwner(owner);
+                            cell.arrayContainerOwnersSnapshot();
+                            cell.unmarkArrayContainerOwner(owner);
+                        }
+                        return null;
+                    }));
+                }
+                assertTrue(ready.await(5, TimeUnit.SECONDS), "all owner workers should be ready");
+                start.countDown();
+                for (Future<Void> task : tasks) task.get(10, TimeUnit.SECONDS);
+                assertTrue(cell.arrayContainerOwnersSnapshot().isEmpty());
+            } finally {
+                workers.shutdownNow();
+            }
+        }
+    }
+}

From 817aa6e8a18cb38e1c5c2a20ab6deba376e28454 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 11:17:31 +0200
Subject: [PATCH 079/317] fix: ignore non-owning array aliases during
 reachability

Array alias containers such as @_ do not own their scalar cells unless an
individual element is explicitly transferred. Exclude borrowed alias cells
from scalar reachability proofs so temporary call frames do not look like
Perl resurrection during global destruction.

Add coverage for non-owning aliased slots and explicitly transferred alias
slots.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <openai-codex@openai.com>
---
 .../runtime/runtimetypes/DestroyDispatch.java |  5 ++-
 .../runtime/runtimetypes/MortalList.java      |  3 +-
 .../runtimetypes/ReachabilityWalker.java      | 31 ++++++++++++++-----
 .../runtime/runtimetypes/RuntimeScalar.java   | 20 ++++++++++--
 .../ExpiredContainerRootTest.java             | 28 +++++++++++++++++
 ...eachabilityWalkerFullRootSnapshotTest.java | 17 ++++++++++
 .../RuntimeArrayElementOwnershipTest.java     | 28 +++++++++++++++++
 7 files changed, 121 insertions(+), 11 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/ExpiredContainerRootTest.java

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
index 21df9cd55e..3362c68ca4 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
@@ -709,8 +709,11 @@ private static boolean hasEscapedPerlOwner(RuntimeBase referent,
                 // time the destructor returns. During global teardown, package
                 // roots are still available to the reachability walker, so
                 // require a new scalar owner to remain rooted before warning.
+                if (owner.isRetiredBorrowedArrayAlias()) continue;
                 if (!activeOwnersAtStart.contains(owner)
-                        && ReachabilityWalker.isScalarReachable(owner)) return true;
+                        && ReachabilityWalker.isScalarReachable(owner)) {
+                    return true;
+                }
             }
             for (PerlOwnerSlot ownerSlot : referent.ownerSlotSnapshot()) {
                 // Array element slots are currently diagnostic identities; the
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 93cc616e97..05509103f6 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1630,7 +1630,8 @@ static boolean isScalarReachableThroughRootedContainer(RuntimeScalar scalar) {
         if (container instanceof RuntimeHash hash) {
             containsScalar = hash.elements.containsValue(scalar);
         } else if (container instanceof RuntimeArray array) {
-            containsScalar = array.elements.contains(scalar);
+            containsScalar = array.elements.contains(scalar)
+                    && (!array.elementsAliased || array.ownsElement(scalar));
         } else {
             containsScalar = false;
         }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 1ef9e9ec46..dfc79c71b4 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1714,7 +1714,8 @@ public static boolean isScalarReachable(RuntimeScalar target) {
         }
         if (container instanceof RuntimeArray array
                 && array.isPackageGlobalRoot
-                && array.elements.contains(target)) {
+                && array.elements.contains(target)
+                && (!array.elementsAliased || array.ownsElement(target))) {
             return true;
         }
         if (target.isPackageGlobalRoot
@@ -1727,7 +1728,9 @@ public static boolean isScalarReachable(RuntimeScalar target) {
         }
         Boolean drainSnapshotResult =
                 MortalList.isScalarReachableFromDrainSnapshot(target);
-        if (drainSnapshotResult != null) return drainSnapshotResult;
+        if (drainSnapshotResult != null) {
+            return drainSnapshotResult;
+        }
         if (stats != null) stats.scalarReachabilityRootWalks++;
         final int MAX_VISITS = MAX_ROOT_SNAPSHOT_VISITS;
 
@@ -1774,6 +1777,8 @@ public static boolean isScalarReachable(RuntimeScalar target) {
         // here; transient method-call argument scalars are NOT
         // (they get unwound when the method returns).
         for (Object liveVar : MyVarCleanupStack.snapshotLiveVars()) {
+            if (liveVar instanceof RuntimeScalar scalar && scalar.scopeExited) continue;
+            if (liveVar instanceof RuntimeBase runtimeBase && runtimeBase.scopeExited) continue;
             if (liveVar == target) return true;
             if (liveVar instanceof RuntimeBase rb && seen.add(rb)) todo.addLast(rb);
         }
@@ -1808,14 +1813,19 @@ public static boolean isScalarReachable(RuntimeScalar target) {
                     if (val == null) continue;
                     // Skip weak refs — they don't keep their referent alive.
                     if (WeakRefRegistry.isweak(val)) continue;
-                    if (val == target) return true;
+                    if (val == target) {
+                        return true;
+                    }
                     if (seen.add(val)) todo.addLast(val);
                 }
             } else if (cur instanceof RuntimeArray arr) {
                 for (RuntimeScalar elem : arr.elements) {
                     if (elem == null) continue;
+                    if (arr.elementsAliased && !arr.ownsElement(elem)) continue;
                     if (WeakRefRegistry.isweak(elem)) continue;
-                    if (elem == target) return true;
+                    if (elem == target) {
+                        return true;
+                    }
                     if (seen.add(elem)) todo.addLast(elem);
                 }
             } else if (cur instanceof RuntimeScalar sc) {
@@ -1831,7 +1841,9 @@ public static boolean isScalarReachable(RuntimeScalar target) {
                                 && WeakRefRegistry.isweak(scalar)) {
                             continue;
                         }
-                        if (captured == target) return true;
+                        if (captured == target) {
+                            return true;
+                        }
                         if (seen.add(captured)) todo.addLast(captured);
                     }
                 }
@@ -1839,13 +1851,17 @@ public static boolean isScalarReachable(RuntimeScalar target) {
                     for (RuntimeScalar cap : code.capturedScalars) {
                         if (cap == null) continue;
                         if (WeakRefRegistry.isweak(cap)) continue;
-                        if (cap == target) return true;
+                        if (cap == target) {
+                            return true;
+                        }
                         if (seen.add(cap)) todo.addLast(cap);
                     }
                 }
                 if (code.capturedAggregates != null) {
                     for (RuntimeBase cap : code.capturedAggregates) {
-                        if (cap == target) return true;
+                        if (cap == target) {
+                            return true;
+                        }
                         if (seen.add(cap)) todo.addLast(cap);
                     }
                 }
@@ -1987,6 +2003,7 @@ private static ScalarRootReachabilitySnapshot scalarReachabilitySnapshot(
                 }
             } else if (current instanceof RuntimeArray array) {
                 for (RuntimeScalar value : array.elements) {
+                    if (array.elementsAliased && !array.ownsElement(value)) continue;
                     addScalarReachabilityEdge(value, seen,
                             reachableScalars, todo, stats, true, false);
                 }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 33556f6543..43806926e1 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -498,6 +498,21 @@ synchronized List<RuntimeArray> arrayContainerOwnersSnapshot() {
         return snapshot;
     }
 
+    /** Whether an exited scalar remains only as a borrowed {@code @_}-style alias. */
+    boolean isRetiredBorrowedArrayAlias() {
+        if (!scopeExited) return false;
+        for (RuntimeHash owner : hashContainerOwnersSnapshot()) {
+            if (owner.elements.containsValue(this)) return false;
+        }
+        boolean foundAlias = false;
+        for (RuntimeArray owner : arrayContainerOwnersSnapshot()) {
+            if (!owner.elements.contains(this)) continue;
+            foundAlias = true;
+            if (!owner.elementsAliased || owner.ownsElement(this)) return false;
+        }
+        return foundAlias;
+    }
+
     synchronized void unmarkArrayContainerOwner(RuntimeArray owner) {
         if (arrayContainerOwners == null) return;
         arrayContainerOwners.removeIf(reference -> reference.get() == null || reference.get() == owner);
@@ -514,12 +529,13 @@ private void propagateTiedHandlerMarkerToReferent() {
 
     boolean isStoredInRegisteredContainerOwner() {
         RuntimeBase owner = containerOwner;
-        if (owner == null || !MyVarCleanupStack.isRegistered(owner)) return false;
+        if (owner == null || owner.scopeExited || !MyVarCleanupStack.isRegistered(owner)) return false;
         if (owner instanceof RuntimeHash hash) {
             return hash.elements.containsValue(this);
         }
         if (owner instanceof RuntimeArray array) {
-            return array.elements.contains(this);
+            return array.elements.contains(this)
+                    && (!array.elementsAliased || array.ownsElement(this));
         }
         return false;
     }
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/ExpiredContainerRootTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/ExpiredContainerRootTest.java
new file mode 100644
index 0000000000..762f3f6347
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/ExpiredContainerRootTest.java
@@ -0,0 +1,28 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+
+@Tag("unit")
+class ExpiredContainerRootTest {
+    @Test
+    void scopeExitedContainerInLiveVarSnapshotIsNotAnOwner() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray expired = new RuntimeArray();
+            RuntimeScalar cell = new RuntimeScalar();
+            expired.elements.add(cell);
+            expired.scopeExited = true;
+            MyVarCleanupStack.register(expired);
+            MyVarCleanupStack.snapshotStackToLiveCounts();
+            try {
+                assertFalse(ReachabilityWalker.isScalarReachable(cell),
+                        "a stale container snapshot must not revive an expired element");
+            } finally {
+                MyVarCleanupStack.unregister(expired);
+            }
+        }
+    }
+}
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerFullRootSnapshotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerFullRootSnapshotTest.java
index b837a96af9..3ac9a98d98 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerFullRootSnapshotTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerFullRootSnapshotTest.java
@@ -13,6 +13,23 @@
 
 @Tag("unit")
 class ReachabilityWalkerFullRootSnapshotTest {
+    @Test
+    void scopeExitedScalarInLiveVarSnapshotIsNotAnOwner() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeScalar expired = new RuntimeScalar();
+            expired.scopeExited = true;
+            MyVarCleanupStack.register(expired);
+            MyVarCleanupStack.snapshotStackToLiveCounts();
+            try {
+                assertFalse(ReachabilityWalker.isScalarReachable(expired),
+                        "a stale live-var snapshot must not revive an expired scalar");
+            } finally {
+                MyVarCleanupStack.unregister(expired);
+            }
+        }
+    }
+
     @Test
     void oneSnapshotAnswersAllTargetsLikeThePerTargetRootWalk() {
         PerlRuntime runtime = new PerlRuntime();
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
index 074e6de7f8..fdf8c4903a 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
@@ -4,8 +4,10 @@
 import org.junit.jupiter.api.Test;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 
 @Tag("unit")
 class RuntimeArrayElementOwnershipTest {
@@ -76,6 +78,32 @@ void aliasedElementsDoNotOwnReferentsUnlessExplicitlyTransferred() {
         }
     }
 
+    @Test
+    void nonOwningAliasedElementDoesNotProveScalarReachability() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeArray packageRoot = new RuntimeArray();
+            RuntimeScalar cell = referent.createReference();
+            packageRoot.elements.add(cell);
+            packageRoot.elementsAliased = true;
+            packageRoot.elementsOwned = false;
+            packageRoot.isPackageGlobalRoot = true;
+
+            assertFalse(packageRoot.ownsElement(cell));
+            assertFalse(ReachabilityWalker.isScalarReachable(cell),
+                    "an @_ style alias is not an independent Perl owner");
+            cell.scopeExited = true;
+            assertTrue(cell.isRetiredBorrowedArrayAlias());
+
+            packageRoot.markOwnedAliasElement(cell);
+            assertTrue(packageRoot.ownsElement(cell));
+            assertFalse(cell.isRetiredBorrowedArrayAlias());
+            assertTrue(ReachabilityWalker.isScalarReachable(cell),
+                    "an explicitly transferred alias element is an owner");
+        }
+    }
+
     @Test
     void rangeRemovalReleasesOnlyRemovedElementSlots() {
         PerlRuntime runtime = new PerlRuntime();

From 776971ac19bc9b10d6c6e8fec6ce3f9b2e8d9101 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <fglock@gmail.com>
Date: Sat, 17 Oct 2026 16:38:13 +0200
Subject: [PATCH 080/317] fix: ignore non-owning array aliases during
 reachability

Array alias containers such as @_ do not own their scalar cells unless an
individual element is explicitly transferred. Exclude borrowed alias cells
from scalar reachability proofs so temporary call frames do not look like
Perl resurrection during global destruction.

Add coverage for non-owning aliased slots and explicitly transferred alias
slots.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <openai-codex@openai.com>
---
 .../runtime/runtimetypes/RuntimeArray.java    |  6 ++++++
 .../RuntimeArrayElementOwnershipTest.java     | 20 +++++++++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
index 4eac36675a..c80688d46b 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
@@ -340,6 +340,12 @@ public RuntimeScalar set(int index, RuntimeScalar element) {
             owner.markPackageRootedValue(element);
             RuntimeScalar result = super.set(index, element);
             owner.arrayElementReplaced(index, previous, element);
+            if (owner.elementsAliased && element != null) {
+                // A write into an aliased array slot replaces the borrowed
+                // slot with a value owned by this array. Keep that value
+                // reachable even after the original argument frame exits.
+                owner.markOwnedAliasElement(element);
+            }
             owner.validateIsaMutation();
             return result;
         }
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
index fdf8c4903a..66afb1404c 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
@@ -78,6 +78,26 @@ void aliasedElementsDoNotOwnReferentsUnlessExplicitlyTransferred() {
         }
     }
 
+    @Test
+    void replacingAnAliasedSlotTransfersOwnershipToTheArray() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeArray array = new RuntimeArray();
+            RuntimeScalar borrowed = new RuntimeScalar();
+            array.elements.add(borrowed);
+            array.elementsAliased = true;
+            array.elementsOwned = false;
+            RuntimeScalar stored = referent.createReference();
+
+            array.elements.set(0, stored);
+
+            assertTrue(array.ownsElement(stored));
+            assertEquals(1, referent.arraySlotOwnerCount());
+            assertSame(referent, array.arrayElementOwnerSlot(0).referent());
+        }
+    }
+
     @Test
     void nonOwningAliasedElementDoesNotProveScalarReachability() {
         PerlRuntime runtime = new PerlRuntime();

From f5068febeb9ac5f4c4b1cee4ed857d71be39bdbe Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <fglock@gmail.com>
Date: Sat, 17 Oct 2026 18:30:50 +0200
Subject: [PATCH 081/317] fix: ignore non-owning array aliases during
 reachability

Array alias containers such as @_ do not own their scalar cells unless an
individual element is explicitly transferred. Exclude borrowed alias cells
from scalar reachability proofs so temporary call frames do not look like
Perl resurrection during global destruction.

Add coverage for non-owning aliased slots and explicitly transferred alias
slots.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <openai-codex@openai.com>
---
 .../runtimetypes/ReachabilityWalker.java      |  1 +
 .../ExpiredContainerRootTest.java             | 24 +++++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index dfc79c71b4..c40d7ab2b2 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1777,6 +1777,7 @@ public static boolean isScalarReachable(RuntimeScalar target) {
         // here; transient method-call argument scalars are NOT
         // (they get unwound when the method returns).
         for (Object liveVar : MyVarCleanupStack.snapshotLiveVars()) {
+            if (!MyVarCleanupStack.isRegistered(liveVar)) continue;
             if (liveVar instanceof RuntimeScalar scalar && scalar.scopeExited) continue;
             if (liveVar instanceof RuntimeBase runtimeBase && runtimeBase.scopeExited) continue;
             if (liveVar == target) return true;
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/ExpiredContainerRootTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/ExpiredContainerRootTest.java
index 762f3f6347..b6b6aa6677 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/ExpiredContainerRootTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/ExpiredContainerRootTest.java
@@ -4,9 +4,33 @@
 import org.junit.jupiter.api.Test;
 
 import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 
 @Tag("unit")
 class ExpiredContainerRootTest {
+    @Test
+    void unregisteredContainerLeftInLiveVarSnapshotIsNotAnOwner() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray weakReferent = new RuntimeArray();
+            RuntimeScalar weakReference = weakReferent.createReference();
+            WeakRefRegistry.weaken(weakReference);
+
+            RuntimeArray expired = new RuntimeArray();
+            RuntimeScalar cell = new RuntimeScalar();
+            expired.elements.add(cell);
+            MyVarCleanupStack.register(expired);
+            MyVarCleanupStack.snapshotStackToLiveCounts();
+            MyVarCleanupStack.unregister(expired);
+
+            assertFalse(MyVarCleanupStack.isRegistered(expired));
+            assertTrue(MyVarCleanupStack.snapshotLiveVars().contains(expired),
+                    "setup must retain the test container in the stale live-var snapshot");
+            assertFalse(ReachabilityWalker.isScalarReachable(cell),
+                    "an unregistered container in a stale snapshot must not retain its cell");
+        }
+    }
+
     @Test
     void scopeExitedContainerInLiveVarSnapshotIsNotAnOwner() {
         PerlRuntime runtime = new PerlRuntime();

From 707b012d58d8a3bf3525ded37686d23c56a0637d Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 20:23:06 +0200
Subject: [PATCH 082/317] fix: retain captured containers after lexical scope
 exit

Keep registered aggregate values reachable after their lexical scope exits
when an active closure owner still retains the aggregate. Reject ordinary
scope-exited containers without such a capture, and cover both cases.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <openai-codex@openai.com>
---
 .../runtime/runtimetypes/RuntimeScalar.java   |  3 ++-
 .../ExpiredContainerRootTest.java             | 24 +++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 43806926e1..dc14eb087c 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -529,7 +529,8 @@ private void propagateTiedHandlerMarkerToReferent() {
 
     boolean isStoredInRegisteredContainerOwner() {
         RuntimeBase owner = containerOwner;
-        if (owner == null || owner.scopeExited || !MyVarCleanupStack.isRegistered(owner)) return false;
+        if (owner == null || !MyVarCleanupStack.isRegistered(owner)) return false;
+        if (owner.scopeExited && owner.semanticCaptureOwnerCount() == 0) return false;
         if (owner instanceof RuntimeHash hash) {
             return hash.elements.containsValue(this);
         }
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/ExpiredContainerRootTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/ExpiredContainerRootTest.java
index b6b6aa6677..e86ddd27f3 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/ExpiredContainerRootTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/ExpiredContainerRootTest.java
@@ -8,6 +8,30 @@
 
 @Tag("unit")
 class ExpiredContainerRootTest {
+    @Test
+    void capturedScopeExitedContainerRemainsAnOwner() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray container = new RuntimeArray();
+            RuntimeScalar value = new RuntimeScalar();
+            container.elements.add(value);
+            value.markArrayContainerOwner(container);
+            container.scopeExited = true;
+            MyVarCleanupStack.register(container);
+
+            PerlOwnerSlot capture = new PerlOwnerSlot(PerlOwnerSlot.Kind.CLOSURE_PAD);
+            try {
+                capture.acquireCapture(container);
+
+                assertTrue(value.isStoredInRegisteredContainerOwner(),
+                        "an active captured aggregate keeps its stored scalar alive after lexical exit");
+            } finally {
+                capture.release();
+                MyVarCleanupStack.unregister(container);
+            }
+        }
+    }
+
     @Test
     void unregisteredContainerLeftInLiveVarSnapshotIsNotAnOwner() {
         PerlRuntime runtime = new PerlRuntime();

From 5f031fd4576e31e17c8977baba0aef0e6fe104e3 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 17 Oct 2026 22:23:48 +0200
Subject: [PATCH 083/317] test: cover ordinary aggregate element ownership
 counts

Add a blead-validated regression for independent array and hash element
owners across insertion, mutation, deletion, clearing, and destruction.
Record the Phase 2 candidate evidence and the remaining legacy-count boundary.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <openai-codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          | 16 +++++---
 ...rdinary_aggregate_element_owner_refcount.t | 41 +++++++++++++++++++
 2 files changed, 51 insertions(+), 6 deletions(-)
 create mode 100644 src/test/resources/unit/refcount/ordinary_aggregate_element_owner_refcount.t

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 16bee26a9f..d6fcdb1f0d 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is implemented and validated on both backends. Full UAT comparison, local gates, selected CPAN workloads, and PR CI pass. PR #1653 remains a draft pending review.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 is in progress in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816); its current candidate passes local `make`, Ubuntu/Windows CI, and the unchanged HTML-Tree lifecycle suite on both backends. Ordinary array/hash slots still use the legacy selective count as lifecycle authority.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -105,7 +105,9 @@ and first path establish implementation cost.
 
 ## Progress tracking
 
-### Current status: Phase 1 complete; merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
+### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
+
+The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. Its full `nice -n 19 make` and Ubuntu/Windows CI pass. HTML-Tree 5.07 passes all 23 files / 989 tests on the JVM backend; unchanged `t/refloop.t` passes 8/8 on blead Perl 5.45.4, JVM, and interpreter. A new ordinary aggregate element refcount test passes on blead Perl 5.45.4 and both local backends, covering insert, push, shift, replace, delete, and final destruction. This is integration evidence only: array/hash owner slots currently identify edges, but `RuntimeBase.refCount`, `refCountOwned`, and reachability cleanup remain authoritative for ordinary aggregate stores. The Catalyst test still emits a global-destruction warning on both PerlOnJava backends.
 
 ### Completed
 
@@ -301,10 +303,12 @@ and first path establish implementation cost.
 
 ### Next steps
 
-1. Extend the ownership path through scalar proxies and ordinary array/hash
-   slots in Phase 2. Keep the newly passing HTML::Tree suite as an integration
-   guard, then verify its exact refcount/destruction assertions are supported by
-   explicit owner slots rather than cleanup reachability fallbacks.
+1. Migrate ordinary array/hash element stores and scalar proxies from the
+   selective `refCount` bridge to owner-slot accounting. Cover acquisition,
+   transfer, replacement, deletion, aliases, and final release with exact
+   refcount/weak-reference/DESTROY assertions before using HTML-Tree as the
+   integration guard. Remove reachability cleanup authority only for paths
+   whose ownership transitions are fully represented by slots.
 2. Resolve the strict target failures in the fresh-home CPAN release
    acceptance, then rerun that gate on the final candidate. The current run
    distinguishes prerequisite/setup timeouts and missing dependencies from
diff --git a/src/test/resources/unit/refcount/ordinary_aggregate_element_owner_refcount.t b/src/test/resources/unit/refcount/ordinary_aggregate_element_owner_refcount.t
new file mode 100644
index 0000000000..20b99a1e46
--- /dev/null
+++ b/src/test/resources/unit/refcount/ordinary_aggregate_element_owner_refcount.t
@@ -0,0 +1,41 @@
+use strict;
+use warnings;
+use B qw(svref_2object);
+use Test::More;
+
+{
+    package OrdinaryAggregateOwnerProbe;
+    our $destroyed = 0;
+    sub DESTROY { ++$destroyed }
+}
+
+sub rc { svref_2object($_[0])->REFCNT }
+
+my $object = bless {}, 'OrdinaryAggregateOwnerProbe';
+is(rc($object), 1, 'the lexical starts as the only strong owner');
+
+my @array = ($object);
+is(rc($object), 2, 'an array element adds one owner');
+push @array, $object;
+is(rc($object), 3, 'push adds one independent array-element owner');
+shift @array;
+is(rc($object), 2, 'shift releases only the removed array-element owner');
+
+my %hash = (left => $object, right => $object);
+is(rc($object), 4, 'two hash entries add two independent owners');
+delete $hash{left};
+is(rc($object), 3, 'delete releases only the removed hash-entry owner');
+$hash{right} = bless {}, 'OrdinaryAggregateOwnerProbe';
+is(rc($object), 2, 'replacing a hash value releases the displaced owner');
+
+undef @array;
+is(rc($object), 1, 'clearing the array releases its final element owner');
+undef %hash;
+is($OrdinaryAggregateOwnerProbe::destroyed, 1,
+    'the replaced hash value is destroyed exactly once');
+is(rc($object), 1, 'clearing aggregates does not release the lexical owner');
+undef $object;
+is($OrdinaryAggregateOwnerProbe::destroyed, 2,
+    'the final lexical owner releases the remaining object exactly once');
+
+done_testing;

From 2aefc9cd9c6309dc0e8be02de7bf2b73dac95bce Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 18 Oct 2026 00:45:03 +0200
Subject: [PATCH 084/317] fix: tie resurrection owner slots to rooted
 containers

Track weak container provenance for aggregate owner slots so global
resurrection checks can distinguish package roots from temporary hashes
and arrays. Add focused coverage for both cases.

Generated with OpenAI Codex (https://openai.com/codex)

Co-Authored-By: OpenAI Codex <codex@openai.com>
---
 .../runtime/runtimetypes/DestroyDispatch.java | 17 +++---
 .../runtime/runtimetypes/PerlOwnerSlot.java   | 13 ++++-
 .../runtime/runtimetypes/RuntimeArray.java    |  2 +-
 .../runtime/runtimetypes/RuntimeHash.java     |  4 +-
 ...DestroyDispatchAggregateOwnerRootTest.java | 58 +++++++++++++++++++
 5 files changed, 83 insertions(+), 11 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
index 3362c68ca4..74ed045aff 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
@@ -697,7 +697,7 @@ private static void doCallDestroy(RuntimeBase referent, String className) {
      * those aliases are not resurrection. Objects which have not activated
      * owner tracking retain the legacy count-based behavior.
      */
-    private static boolean hasEscapedPerlOwner(RuntimeBase referent,
+    static boolean hasEscapedPerlOwner(RuntimeBase referent,
                                                 boolean checkingGlobalOwnerDelta,
                                                 Set<RuntimeScalar> activeOwnersAtStart,
                                                 Set<PerlOwnerSlot> ownerSlotsAtStart) {
@@ -716,12 +716,15 @@ private static boolean hasEscapedPerlOwner(RuntimeBase referent,
                 }
             }
             for (PerlOwnerSlot ownerSlot : referent.ownerSlotSnapshot()) {
-                // Array element slots are currently diagnostic identities; the
-                // owning array is not yet part of the resurrection root check.
-                // Treating a newly materialized array slot as proof of Perl
-                // resurrection misclassifies destructor-local array writes.
-                if (!ownerSlotsAtStart.contains(ownerSlot)
-                        && ownerSlot.kind() != PerlOwnerSlot.Kind.ARRAY_ELEMENT) return true;
+                if (ownerSlotsAtStart.contains(ownerSlot)) continue;
+                RuntimeBase ownerContainer = ownerSlot.ownerContainer();
+                if (ownerContainer != null
+                        && ReachabilityWalker.isReachableFromRoots(ownerContainer, true)) {
+                    return true;
+                }
+                // Closure pads have no aggregate container. Their referent
+                // edge is itself enough to prove that Perl retained the value.
+                if (ownerSlot.kind() == PerlOwnerSlot.Kind.CLOSURE_PAD) return true;
             }
             return false;
         }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
index bff3496550..96b0c49b9a 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
@@ -3,6 +3,7 @@
 import java.util.Objects;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicLong;
+import java.lang.ref.WeakReference;
 
 /**
  * Identity for one Perl strong-owner slot.
@@ -24,6 +25,7 @@ public enum Kind {
 
     private final Kind kind;
     private final RuntimeScalar padCell;
+    private final WeakReference<RuntimeBase> ownerContainer;
     private volatile RuntimeCode closureOwner;
     private final long identity = NEXT_ID.incrementAndGet();
     private RuntimeBase referent;
@@ -68,12 +70,17 @@ void complete() {
     }
 
     public PerlOwnerSlot(Kind kind) {
-        this(kind, null);
+        this(kind, null, null);
     }
 
     PerlOwnerSlot(Kind kind, RuntimeScalar padCell) {
+        this(kind, padCell, null);
+    }
+
+    PerlOwnerSlot(Kind kind, RuntimeScalar padCell, RuntimeBase ownerContainer) {
         this.kind = Objects.requireNonNull(kind, "kind");
         this.padCell = padCell;
+        this.ownerContainer = ownerContainer == null ? null : new WeakReference<>(ownerContainer);
     }
 
     public Kind kind() {
@@ -88,6 +95,10 @@ RuntimeScalar padCell() {
         return padCell;
     }
 
+    RuntimeBase ownerContainer() {
+        return ownerContainer == null ? null : ownerContainer.get();
+    }
+
     boolean isNativeCaptureOwner() {
         return nativeCaptureOwner;
     }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
index c80688d46b..74e4702cc8 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
@@ -714,7 +714,7 @@ private void syncArrayElementOwnerSlot(int index) {
             arrayElementOwnerSlots.set(index, null);
         } else {
             if (slot == null) {
-                slot = new PerlOwnerSlot(PerlOwnerSlot.Kind.ARRAY_ELEMENT);
+                slot = new PerlOwnerSlot(PerlOwnerSlot.Kind.ARRAY_ELEMENT, null, this);
                 arrayElementOwnerSlots.set(index, slot);
             }
             slot.acquireArrayElement(referent);
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java
index 43d1141272..ccc26fd7cb 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java
@@ -693,7 +693,7 @@ private void updateHashEntryOwner(String key, RuntimeScalar previous, RuntimeSca
             return;
         }
         PerlOwnerSlot slot = hashEntryOwnerSlots.computeIfAbsent(key,
-                ignored -> new PerlOwnerSlot(PerlOwnerSlot.Kind.HASH_ENTRY));
+                ignored -> new PerlOwnerSlot(PerlOwnerSlot.Kind.HASH_ENTRY, null, this));
         slot.acquireHashEntry(directReferent(value));
     }
 
@@ -744,7 +744,7 @@ void updateHashEntryOwnersForScalar(RuntimeScalar scalar, RuntimeBase oldReferen
                 continue;
             }
             PerlOwnerSlot slot = hashEntryOwnerSlots.computeIfAbsent(entry.getKey(),
-                    ignored -> new PerlOwnerSlot(PerlOwnerSlot.Kind.HASH_ENTRY));
+                    ignored -> new PerlOwnerSlot(PerlOwnerSlot.Kind.HASH_ENTRY, null, this));
             slot.acquireHashEntry(nextReferent);
         }
     }
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java
new file mode 100644
index 0000000000..064e32331f
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java
@@ -0,0 +1,58 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import java.util.Collections;
+import java.util.Set;
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("unit")
+class DestroyDispatchAggregateOwnerRootTest {
+    @Test
+    void destructorLocalHashEntryDoesNotCountAsResurrection() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeHash localHash = new RuntimeHash();
+            RuntimeArray referent = new RuntimeArray();
+            PerlOwnerSlot slot = new PerlOwnerSlot(
+                    PerlOwnerSlot.Kind.HASH_ENTRY, null, localHash);
+            slot.acquireHashEntry(referent);
+
+            assertFalse(hasNewRootedOwner(referent),
+                    "a new hash entry in an unrooted temporary hash is not resurrection");
+        }
+    }
+
+    @Test
+    void hashEntryInPackageGlobalHashCountsAsResurrection() {
+        PerlRuntime runtime = new PerlRuntime();
+        String globalName = "DestroyDispatchAggregateOwnerRootTest::global";
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeHash globalHash = new RuntimeHash();
+            globalHash.isGlobalPackageHash = true;
+            GlobalVariable.globalHashes.put(globalName, globalHash);
+            RuntimeArray referent = new RuntimeArray();
+            PerlOwnerSlot slot = new PerlOwnerSlot(
+                    PerlOwnerSlot.Kind.HASH_ENTRY, null, globalHash);
+            slot.acquireHashEntry(referent);
+            try {
+                assertTrue(hasNewRootedOwner(referent),
+                        "a new hash entry in a package global hash is resurrection");
+            } finally {
+                GlobalVariable.globalHashes.remove(globalName);
+                slot.release();
+            }
+        }
+    }
+
+    private static boolean hasNewRootedOwner(RuntimeBase referent) {
+        Set<RuntimeScalar> noScalarsAtStart = Collections.newSetFromMap(
+                new java.util.IdentityHashMap<>());
+        Set<PerlOwnerSlot> noSlotsAtStart = Collections.newSetFromMap(
+                new java.util.IdentityHashMap<>());
+        return DestroyDispatch.hasEscapedPerlOwner(
+                referent, true, noScalarsAtStart, noSlotsAtStart);
+    }
+}

From 16bba671c7c6bc4b5c09b53cda506da323a21d55 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 18 Oct 2026 01:50:14 +0200
Subject: [PATCH 085/317] test: exercise aggregate owner root through hash
 mutations

Use the runtime's observable hash map path in the resurrection owner-slot
regression so coverage includes slot creation and cleanup as well as root
classification.

Generated with OpenAI Codex (https://openai.com/codex)

Co-Authored-By: OpenAI Codex <codex@openai.com>
---
 ...DestroyDispatchAggregateOwnerRootTest.java | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java
index 064e32331f..dca952aff4 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java
@@ -16,12 +16,13 @@ void destructorLocalHashEntryDoesNotCountAsResurrection() {
         try (PerlRuntime.Binding ignored = runtime.bind()) {
             RuntimeHash localHash = new RuntimeHash();
             RuntimeArray referent = new RuntimeArray();
-            PerlOwnerSlot slot = new PerlOwnerSlot(
-                    PerlOwnerSlot.Kind.HASH_ENTRY, null, localHash);
-            slot.acquireHashEntry(referent);
-
-            assertFalse(hasNewRootedOwner(referent),
-                    "a new hash entry in an unrooted temporary hash is not resurrection");
+            localHash.elements.put("self", referent.createReference());
+            try {
+                assertFalse(hasNewRootedOwner(referent),
+                        "a new hash entry in an unrooted temporary hash is not resurrection");
+            } finally {
+                localHash.elements.clear();
+            }
         }
     }
 
@@ -34,15 +35,13 @@ void hashEntryInPackageGlobalHashCountsAsResurrection() {
             globalHash.isGlobalPackageHash = true;
             GlobalVariable.globalHashes.put(globalName, globalHash);
             RuntimeArray referent = new RuntimeArray();
-            PerlOwnerSlot slot = new PerlOwnerSlot(
-                    PerlOwnerSlot.Kind.HASH_ENTRY, null, globalHash);
-            slot.acquireHashEntry(referent);
+            globalHash.elements.put("self", referent.createReference());
             try {
                 assertTrue(hasNewRootedOwner(referent),
                         "a new hash entry in a package global hash is resurrection");
             } finally {
+                globalHash.elements.clear();
                 GlobalVariable.globalHashes.remove(globalName);
-                slot.release();
             }
         }
     }

From 4e9c332b1936b83f184dfb2ae3b70a886c79bc81 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 18 Oct 2026 02:44:24 +0200
Subject: [PATCH 086/317] fix: require rooted closure owner for resurrection

Use captured CODE provenance when checking newly created closure-pad owners
at global destruction. Add coverage for temporary and package-global closures
so dead callbacks do not masquerade as resurrection while rooted callbacks do.

Generated with OpenAI Codex (https://openai.com/codex)

Co-Authored-By: OpenAI Codex <codex@openai.com>
---
 .../runtime/runtimetypes/DestroyDispatch.java | 13 +++++--
 ...DestroyDispatchAggregateOwnerRootTest.java | 37 +++++++++++++++++++
 2 files changed, 47 insertions(+), 3 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
index 74ed045aff..210eb36d22 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
@@ -722,9 +722,16 @@ static boolean hasEscapedPerlOwner(RuntimeBase referent,
                         && ReachabilityWalker.isReachableFromRoots(ownerContainer, true)) {
                     return true;
                 }
-                // Closure pads have no aggregate container. Their referent
-                // edge is itself enough to prove that Perl retained the value.
-                if (ownerSlot.kind() == PerlOwnerSlot.Kind.CLOSURE_PAD) return true;
+                // Closure pads have no aggregate container. When capture
+                // provenance identifies the owning CODE, require that CODE to
+                // remain rooted before treating the new pad edge as escape.
+                if (ownerSlot.kind() == PerlOwnerSlot.Kind.CLOSURE_PAD) {
+                    RuntimeCode closureOwner = ownerSlot.closureOwner();
+                    if (closureOwner == null
+                            || ReachabilityWalker.isCodeReachableFromRoots(closureOwner)) {
+                        return true;
+                    }
+                }
             }
             return false;
         }
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java
index dca952aff4..d77696bc21 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java
@@ -10,6 +10,43 @@
 
 @Tag("unit")
 class DestroyDispatchAggregateOwnerRootTest {
+    @Test
+    void captureFromUnrootedClosureDoesNotCountAsResurrection() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeCode temporaryClosure = new RuntimeCode();
+            PerlOwnerSlot slot = new PerlOwnerSlot(PerlOwnerSlot.Kind.CLOSURE_PAD);
+            slot.acquireCapture(referent, temporaryClosure);
+            try {
+                assertFalse(hasNewRootedOwner(referent),
+                        "a capture owned only by an unrooted closure is not resurrection");
+            } finally {
+                slot.release();
+            }
+        }
+    }
+
+    @Test
+    void captureFromPackageGlobalClosureCountsAsResurrection() {
+        PerlRuntime runtime = new PerlRuntime();
+        String globalName = "DestroyDispatchAggregateOwnerRootTest::closure";
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeCode rootedClosure = new RuntimeCode();
+            GlobalVariable.globalCodeRefs.put(globalName, new RuntimeScalar(rootedClosure));
+            PerlOwnerSlot slot = new PerlOwnerSlot(PerlOwnerSlot.Kind.CLOSURE_PAD);
+            slot.acquireCapture(referent, rootedClosure);
+            try {
+                assertTrue(hasNewRootedOwner(referent),
+                        "a capture owned by a package-global closure is resurrection");
+            } finally {
+                GlobalVariable.globalCodeRefs.remove(globalName);
+                slot.release();
+            }
+        }
+    }
+
     @Test
     void destructorLocalHashEntryDoesNotCountAsResurrection() {
         PerlRuntime runtime = new PerlRuntime();

From c3fd79b77c529b08c9451ee8799012a18e050e81 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 18 Oct 2026 02:50:04 +0200
Subject: [PATCH 087/317] test: use valid RuntimeCode constructor

Construct closure test fixtures with the supported empty-code constructor.

Generated with OpenAI Codex (https://openai.com/codex)

Co-Authored-By: OpenAI Codex <codex@openai.com>
---
 .../runtimetypes/DestroyDispatchAggregateOwnerRootTest.java   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java
index d77696bc21..143b3cc1c9 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java
@@ -15,7 +15,7 @@ void captureFromUnrootedClosureDoesNotCountAsResurrection() {
         PerlRuntime runtime = new PerlRuntime();
         try (PerlRuntime.Binding ignored = runtime.bind()) {
             RuntimeArray referent = new RuntimeArray();
-            RuntimeCode temporaryClosure = new RuntimeCode();
+            RuntimeCode temporaryClosure = new RuntimeCode(null, java.util.List.of());
             PerlOwnerSlot slot = new PerlOwnerSlot(PerlOwnerSlot.Kind.CLOSURE_PAD);
             slot.acquireCapture(referent, temporaryClosure);
             try {
@@ -33,7 +33,7 @@ void captureFromPackageGlobalClosureCountsAsResurrection() {
         String globalName = "DestroyDispatchAggregateOwnerRootTest::closure";
         try (PerlRuntime.Binding ignored = runtime.bind()) {
             RuntimeArray referent = new RuntimeArray();
-            RuntimeCode rootedClosure = new RuntimeCode();
+            RuntimeCode rootedClosure = new RuntimeCode(null, java.util.List.of());
             GlobalVariable.globalCodeRefs.put(globalName, new RuntimeScalar(rootedClosure));
             PerlOwnerSlot slot = new PerlOwnerSlot(PerlOwnerSlot.Kind.CLOSURE_PAD);
             slot.acquireCapture(referent, rootedClosure);

From e213c57ec167df59f3af705eb15288238563f613 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 18 Oct 2026 03:13:22 +0200
Subject: [PATCH 088/317] fix: root legacy capture pads through owning code

Use the captured pad scalar as provenance for legacy closure owner slots,
so global destruction recognizes only pads still reachable through rooted
Perl values. Cover unrooted and globally captured pads.

Generated with OpenAI Codex (https://openai.com/codex)

Co-Authored-By: OpenAI Codex <codex@openai.com>
---
 .../runtime/runtimetypes/DestroyDispatch.java |  8 ++++-
 ...DestroyDispatchAggregateOwnerRootTest.java | 32 +++++++++++++++++++
 2 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
index 210eb36d22..ec3930c60c 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
@@ -729,7 +729,13 @@ static boolean hasEscapedPerlOwner(RuntimeBase referent,
                     RuntimeCode closureOwner = ownerSlot.closureOwner();
                     if (closureOwner == null
                             || ReachabilityWalker.isCodeReachableFromRoots(closureOwner)) {
-                        return true;
+                        if (closureOwner == null && ownerSlot.padCell() != null) {
+                            if (ReachabilityWalker.isScalarReachable(ownerSlot.padCell())) {
+                                return true;
+                            }
+                        } else {
+                            return true;
+                        }
                     }
                 }
             }
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java
index 143b3cc1c9..304c73ca04 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java
@@ -47,6 +47,38 @@ void captureFromPackageGlobalClosureCountsAsResurrection() {
         }
     }
 
+    @Test
+    void legacyCapturePadCountsOnlyWhenReachableThroughRootedCode() {
+        PerlRuntime runtime = new PerlRuntime();
+        String globalName = "DestroyDispatchAggregateOwnerRootTest::capturing_closure";
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray temporaryReferent = new RuntimeArray();
+            RuntimeScalar temporaryPad = temporaryReferent.createReference();
+            PerlOwnerSlot temporarySlot = new PerlOwnerSlot(
+                    PerlOwnerSlot.Kind.CLOSURE_PAD, temporaryPad);
+            temporarySlot.acquireCapture(temporaryReferent);
+            assertFalse(hasNewRootedOwner(temporaryReferent),
+                    "a pad retained only by an unrooted code object is not resurrection");
+            temporarySlot.release();
+
+            RuntimeArray rootedReferent = new RuntimeArray();
+            RuntimeScalar rootedPad = rootedReferent.createReference();
+            RuntimeCode rootedClosure = new RuntimeCode(null, java.util.List.of());
+            rootedClosure.capturedScalars = new RuntimeScalar[] {rootedPad};
+            GlobalVariable.globalCodeRefs.put(globalName, new RuntimeScalar(rootedClosure));
+            PerlOwnerSlot rootedSlot = new PerlOwnerSlot(
+                    PerlOwnerSlot.Kind.CLOSURE_PAD, rootedPad);
+            rootedSlot.acquireCapture(rootedReferent);
+            try {
+                assertTrue(hasNewRootedOwner(rootedReferent),
+                        "a pad captured by package-global code is resurrection");
+            } finally {
+                GlobalVariable.globalCodeRefs.remove(globalName);
+                rootedSlot.release();
+            }
+        }
+    }
+
     @Test
     void destructorLocalHashEntryDoesNotCountAsResurrection() {
         PerlRuntime runtime = new PerlRuntime();

From 7c689ae920a60012633bea1be914fc25d5662a5b Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 18 Oct 2026 03:54:17 +0200
Subject: [PATCH 089/317] docs: update ownership rewrite progress evidence

Record the latest PR head, aggregate-root regressions, local make result,
prior green CI head, and the still-open Catalyst warnings in the phase status.

Generated with OpenAI Codex (https://openai.com/codex)

Co-Authored-By: OpenAI Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index d6fcdb1f0d..38e409a987 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. Its full `nice -n 19 make` and Ubuntu/Windows CI pass. HTML-Tree 5.07 passes all 23 files / 989 tests on the JVM backend; unchanged `t/refloop.t` passes 8/8 on blead Perl 5.45.4, JVM, and interpreter. A new ordinary aggregate element refcount test passes on blead Perl 5.45.4 and both local backends, covering insert, push, shift, replace, delete, and final destruction. This is integration evidence only: array/hash owner slots currently identify edges, but `RuntimeBase.refCount`, `refCountOwned`, and reachability cleanup remain authoritative for ordinary aggregate stores. The Catalyst test still emits a global-destruction warning on both PerlOnJava backends.
+The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. `nice -n 19 make` passes on candidate `de7fe852`; CI run `39081845810` passed both Linux and Windows on its parent candidate `b3875c56`, and run `39086832573` is validating `de7fe852`. HTML-Tree 5.07 passes all 23 files / 989 tests on the JVM backend; unchanged `t/refloop.t` passes 8/8 on blead Perl 5.45.4, JVM, and interpreter. The ordinary aggregate element refcount test passes on blead Perl 5.45.4 and both local backends, covering insert, push, shift, replace, delete, and final destruction. `DestroyDispatchAggregateOwnerRootTest` now exercises real hash mutation paths and checks temporary/global hash and closure-pad roots. This remains integration evidence only: array/hash owner slots currently identify edges, but `RuntimeBase.refCount`, `refCountOwned`, and reachability cleanup remain authoritative for ordinary aggregate stores. The Catalyst test passes 24/24 but still emits global-destruction warnings on both PerlOnJava backends; the closure-provenance change did not alter those warnings.
 
 ### Completed
 

From b11cf71f54defd3259470b79315993c76547de5f Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 18 Oct 2026 04:07:49 +0200
Subject: [PATCH 090/317] fix: limit global resurrection checks to package
 roots

Check newly created scalar owners against package roots only during global
destruction. Active local cleanup frames must not keep a dying object alive.
Add tests for local and package-global scalar owners.

Generated with OpenAI Codex (https://openai.com/codex)

Co-Authored-By: OpenAI Codex <codex@openai.com>
---
 .../runtime/runtimetypes/DestroyDispatch.java |  2 +-
 .../runtimetypes/ReachabilityWalker.java      | 25 ++++++++---
 ...DestroyDispatchAggregateOwnerRootTest.java | 41 +++++++++++++++++++
 3 files changed, 61 insertions(+), 7 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
index ec3930c60c..6b78d3dcb4 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
@@ -711,7 +711,7 @@ static boolean hasEscapedPerlOwner(RuntimeBase referent,
                 // require a new scalar owner to remain rooted before warning.
                 if (owner.isRetiredBorrowedArrayAlias()) continue;
                 if (!activeOwnersAtStart.contains(owner)
-                        && ReachabilityWalker.isScalarReachable(owner)) {
+                        && ReachabilityWalker.isScalarReachableFromPackageRoots(owner)) {
                     return true;
                 }
             }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index c40d7ab2b2..1c7cd8c738 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1919,7 +1919,18 @@ boolean complete() {
     }
 
     static ScalarRootReachabilitySnapshot scalarReachabilitySnapshot() {
-        return scalarReachabilitySnapshot(MAX_ROOT_SNAPSHOT_VISITS, false);
+        return scalarReachabilitySnapshot(MAX_ROOT_SNAPSHOT_VISITS, false, true);
+    }
+
+    /**
+     * Bounded scalar-owner proof from package roots only. Destruction-time
+     * resurrection checks must not treat a still-active local cleanup frame
+     * as a persistent Perl owner.
+     */
+    static boolean isScalarReachableFromPackageRoots(RuntimeScalar target) {
+        if (target == null) return false;
+        return scalarReachabilitySnapshot(MAX_ROOT_SNAPSHOT_VISITS, false, false)
+                .isReachable(target);
     }
 
     /**
@@ -1927,11 +1938,11 @@ static ScalarRootReachabilitySnapshot scalarReachabilitySnapshot() {
      * distinguish a real owner from a capture cycle beyond its visit limit.
      */
     static ScalarRootReachabilitySnapshot completeScalarReachabilitySnapshot() {
-        return scalarReachabilitySnapshot(Integer.MAX_VALUE, true);
+        return scalarReachabilitySnapshot(Integer.MAX_VALUE, true, true);
     }
 
     private static ScalarRootReachabilitySnapshot scalarReachabilitySnapshot(
-            int maxVisits, boolean includeTransientRoots) {
+            int maxVisits, boolean includeTransientRoots, boolean includeLiveVars) {
         ReachabilityQueryStats stats = MortalList.activeReachabilityQueryStats();
         if (stats != null) {
             stats.snapshotsBuilt++;
@@ -1979,9 +1990,11 @@ private static ScalarRootReachabilitySnapshot scalarReachabilitySnapshot(
         for (RuntimeHash hash : GlobalVariable.globalHashValuesView()) {
             addScalarReachabilityRoot(hash, seen, reachableScalars, todo, stats);
         }
-        for (Object liveVar : MyVarCleanupStack.snapshotLiveVars()) {
-            if (liveVar instanceof RuntimeBase base) {
-                addScalarReachabilityRoot(base, seen, reachableScalars, todo, stats);
+        if (includeLiveVars) {
+            for (Object liveVar : MyVarCleanupStack.snapshotLiveVars()) {
+                if (liveVar instanceof RuntimeBase base) {
+                    addScalarReachabilityRoot(base, seen, reachableScalars, todo, stats);
+                }
             }
         }
 
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java
index 304c73ca04..90ada883db 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java
@@ -10,6 +10,47 @@
 
 @Tag("unit")
 class DestroyDispatchAggregateOwnerRootTest {
+    @Test
+    void destructorLocalScalarOwnerDoesNotCountAsResurrection() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            referent.activateOwnerTracking();
+            RuntimeScalar localOwner = new RuntimeScalar();
+            localOwner.set(referent.createReference());
+            MyVarCleanupStack.register(localOwner);
+            try {
+                assertFalse(hasNewRootedOwner(referent),
+                        "a new scalar owner in an active local frame is not global resurrection");
+            } finally {
+                MyVarCleanupStack.unregister(localOwner);
+            }
+        }
+    }
+
+    @Test
+    void scalarOwnerInPackageGlobalHashCountsAsResurrection() {
+        PerlRuntime runtime = new PerlRuntime();
+        String globalName = "DestroyDispatchAggregateOwnerRootTest::scalar_owner";
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            referent.activateOwnerTracking();
+            RuntimeScalar owner = new RuntimeScalar();
+            owner.set(referent.createReference());
+            RuntimeHash globalHash = new RuntimeHash();
+            globalHash.isGlobalPackageHash = true;
+            GlobalVariable.globalHashes.put(globalName, globalHash);
+            globalHash.elements.put("owner", owner);
+            try {
+                assertTrue(hasNewRootedOwner(referent),
+                        "a new scalar owner reachable through a package-global hash is resurrection");
+            } finally {
+                globalHash.elements.clear();
+                GlobalVariable.globalHashes.remove(globalName);
+            }
+        }
+    }
+
     @Test
     void captureFromUnrootedClosureDoesNotCountAsResurrection() {
         PerlRuntime runtime = new PerlRuntime();

From 55570d095fdda6c6848a6ac1f8036c4e42c0a535 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 18 Oct 2026 04:45:34 +0200
Subject: [PATCH 091/317] fix: require rooted weak-slot rescue during global
 teardown

Keep special weak-slot resurrection for containers reachable from package
roots during global destruction. Temporary owner hashes must flow through
ordinary release cleanup instead. Cover temporary and globally rooted hashes.

Generated with OpenAI Codex (https://openai.com/codex)

Co-Authored-By: OpenAI Codex <codex@openai.com>
---
 .../runtime/runtimetypes/DestroyDispatch.java | 10 ++-
 .../runtime/runtimetypes/RuntimeScalar.java   |  2 +
 ...DestroyDispatchWeakSlotRescueRootTest.java | 80 +++++++++++++++++++
 3 files changed, 88 insertions(+), 4 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchWeakSlotRescueRootTest.java

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
index 6b78d3dcb4..3a422f0f97 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
@@ -33,6 +33,11 @@ static RuntimeBase currentDestroyTarget() {
         return state().currentDestroyTarget;
     }
 
+    static boolean isCheckingGlobalOwnerDelta() {
+        String phase = GlobalVariable.getGlobalVariable(GlobalContext.GLOBAL_PHASE).toString();
+        return "DESTRUCT".equals(phase) || MortalList.isDrainingTopLevelTemporary();
+    }
+
     static void markDestroyTargetRescued() {
         LifecycleRuntimeState state = state();
         state.destroyTargetRescued = true;
@@ -415,10 +420,7 @@ private static void doCallDestroy(RuntimeBase referent, String className) {
         // can be distinguished from real resurrection during teardown. There
         // is intentionally no backfill: package roots are themselves being
         // dismantled, while any new owner created by DESTROY is recorded.
-        String globalPhase = GlobalVariable.getGlobalVariable(
-                GlobalContext.GLOBAL_PHASE).toString();
-        boolean checkingGlobalOwnerDelta = "DESTRUCT".equals(globalPhase)
-                || MortalList.isDrainingTopLevelTemporary();
+        boolean checkingGlobalOwnerDelta = isCheckingGlobalOwnerDelta();
         Set<RuntimeScalar> activeOwnersAtStart = null;
         Set<PerlOwnerSlot> ownerSlotsAtStart = null;
         if (checkingGlobalOwnerDelta) {
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index dc14eb087c..6f5c1025c6 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -2971,6 +2971,8 @@ && hasLiveIo(assignedGlob)) {
                 && containerOwner != null
                 && !(containerOwner instanceof RuntimeHash owner
                     && owner.isPackageRootedHash())
+                && (!DestroyDispatch.isCheckingGlobalOwnerDelta()
+                    || ReachabilityWalker.isReachableFromRoots(containerOwner, true))
                 && this.value instanceof RuntimeBase base
                 && base == DestroyDispatch.currentDestroyTarget()) {
             DestroyDispatch.markDestroyTargetRescued();
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchWeakSlotRescueRootTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchWeakSlotRescueRootTest.java
new file mode 100644
index 0000000000..7bcc91e93f
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchWeakSlotRescueRootTest.java
@@ -0,0 +1,80 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("unit")
+class DestroyDispatchWeakSlotRescueRootTest {
+    @Test
+    void weakSelfReplacementInTemporaryHashIsNotGlobalRescue() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeScalar phase = GlobalVariable.getGlobalVariable(GlobalContext.GLOBAL_PHASE);
+            String oldPhase = phase.toString();
+            RuntimeBase previousTarget = runtime.lifecycleState.currentDestroyTarget;
+            boolean previousRescued = runtime.lifecycleState.destroyTargetRescued;
+            RuntimeArray target = new RuntimeArray();
+            RuntimeHash temporaryHash = new RuntimeHash();
+            RuntimeScalar weakCell = weakSelfCell(target, temporaryHash);
+            try {
+                phase.set("DESTRUCT");
+                runtime.lifecycleState.currentDestroyTarget = target;
+                runtime.lifecycleState.destroyTargetRescued = false;
+
+                weakCell.set(target.createReference());
+
+                assertFalse(runtime.lifecycleState.destroyTargetRescued,
+                        "a weak slot in an unrooted temporary hash cannot rescue during global destruction");
+            } finally {
+                temporaryHash.elements.clear();
+                runtime.lifecycleState.currentDestroyTarget = previousTarget;
+                runtime.lifecycleState.destroyTargetRescued = previousRescued;
+                phase.set(oldPhase);
+            }
+        }
+    }
+
+    @Test
+    void weakSelfReplacementInGloballyReachableHashCanRescue() {
+        PerlRuntime runtime = new PerlRuntime();
+        String rootName = "DestroyDispatchWeakSlotRescueRootTest::root";
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeScalar phase = GlobalVariable.getGlobalVariable(GlobalContext.GLOBAL_PHASE);
+            String oldPhase = phase.toString();
+            RuntimeBase previousTarget = runtime.lifecycleState.currentDestroyTarget;
+            boolean previousRescued = runtime.lifecycleState.destroyTargetRescued;
+            RuntimeArray target = new RuntimeArray();
+            RuntimeHash nestedHash = new RuntimeHash();
+            RuntimeArray globalArray = new RuntimeArray();
+            globalArray.elements.add(nestedHash.createReference());
+            GlobalVariable.globalArrays.put(rootName, globalArray);
+            RuntimeScalar weakCell = weakSelfCell(target, nestedHash);
+            try {
+                phase.set("DESTRUCT");
+                runtime.lifecycleState.currentDestroyTarget = target;
+                runtime.lifecycleState.destroyTargetRescued = false;
+
+                weakCell.set(target.createReference());
+
+                assertTrue(runtime.lifecycleState.destroyTargetRescued,
+                        "a weak slot in a hash reachable from a package global can rescue the target");
+            } finally {
+                nestedHash.elements.clear();
+                GlobalVariable.globalArrays.remove(rootName);
+                runtime.lifecycleState.currentDestroyTarget = previousTarget;
+                runtime.lifecycleState.destroyTargetRescued = previousRescued;
+                phase.set(oldPhase);
+            }
+        }
+    }
+
+    private static RuntimeScalar weakSelfCell(RuntimeBase target, RuntimeHash container) {
+        RuntimeScalar weakCell = target.createReference();
+        container.elements.put("self", weakCell);
+        WeakRefRegistry.weaken(weakCell);
+        return weakCell;
+    }
+}

From 2e75fe3b54b1274437881b4655afbf7a4339cb3b Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 18 Oct 2026 05:02:53 +0200
Subject: [PATCH 092/317] fix: preserve top-level temporary rescue semantics

Restrict package-root checking for weak-slot rescue to DESTRUCT itself.
Top-level temporary draining still permits a live local container to rescue
an object, preserving DBIx::Class lifecycle behavior.

Generated with OpenAI Codex (https://openai.com/codex)

Co-Authored-By: OpenAI Codex <codex@openai.com>
---
 .../perlonjava/runtime/runtimetypes/DestroyDispatch.java  | 8 ++++++--
 .../perlonjava/runtime/runtimetypes/RuntimeScalar.java    | 2 +-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
index 3a422f0f97..a4f4c66c0c 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
@@ -33,9 +33,13 @@ static RuntimeBase currentDestroyTarget() {
         return state().currentDestroyTarget;
     }
 
-    static boolean isCheckingGlobalOwnerDelta() {
+    static boolean isInGlobalDestructionPhase() {
         String phase = GlobalVariable.getGlobalVariable(GlobalContext.GLOBAL_PHASE).toString();
-        return "DESTRUCT".equals(phase) || MortalList.isDrainingTopLevelTemporary();
+        return "DESTRUCT".equals(phase);
+    }
+
+    static boolean isCheckingGlobalOwnerDelta() {
+        return isInGlobalDestructionPhase() || MortalList.isDrainingTopLevelTemporary();
     }
 
     static void markDestroyTargetRescued() {
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 6f5c1025c6..4492816858 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -2971,7 +2971,7 @@ && hasLiveIo(assignedGlob)) {
                 && containerOwner != null
                 && !(containerOwner instanceof RuntimeHash owner
                     && owner.isPackageRootedHash())
-                && (!DestroyDispatch.isCheckingGlobalOwnerDelta()
+                && (!DestroyDispatch.isInGlobalDestructionPhase()
                     || ReachabilityWalker.isReachableFromRoots(containerOwner, true))
                 && this.value instanceof RuntimeBase base
                 && base == DestroyDispatch.currentDestroyTarget()) {

From 91883730c75303c9ac55797c1f43a0df941aea9e Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 18 Oct 2026 06:35:22 +0200
Subject: [PATCH 093/317] docs: refresh ownership rewrite validation status

Record the passing local make and latest Linux and Windows CI evidence for
PR #1816, including the added weak-slot rescue regression. Keep the remaining
Catalyst destruction warnings and Phase 2 ownership boundary explicit.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 38e409a987..e553fc205a 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 is in progress in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816); its current candidate passes local `make`, Ubuntu/Windows CI, and the unchanged HTML-Tree lifecycle suite on both backends. Ordinary array/hash slots still use the legacy selective count as lifecycle authority.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 is in progress in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816); candidate `caac0f7d` passes local `make` and Ubuntu/Windows CI. The unchanged HTML-Tree lifecycle suite passes on both backends. Ordinary array/hash slots still use the legacy selective count as lifecycle authority.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. `nice -n 19 make` passes on candidate `de7fe852`; CI run `39081845810` passed both Linux and Windows on its parent candidate `b3875c56`, and run `39086832573` is validating `de7fe852`. HTML-Tree 5.07 passes all 23 files / 989 tests on the JVM backend; unchanged `t/refloop.t` passes 8/8 on blead Perl 5.45.4, JVM, and interpreter. The ordinary aggregate element refcount test passes on blead Perl 5.45.4 and both local backends, covering insert, push, shift, replace, delete, and final destruction. `DestroyDispatchAggregateOwnerRootTest` now exercises real hash mutation paths and checks temporary/global hash and closure-pad roots. This remains integration evidence only: array/hash owner slots currently identify edges, but `RuntimeBase.refCount`, `refCountOwned`, and reachability cleanup remain authoritative for ordinary aggregate stores. The Catalyst test passes 24/24 but still emits global-destruction warnings on both PerlOnJava backends; the closure-provenance change did not alter those warnings.
+The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. `nice -n 19 make` passes on candidate `caac0f7d` (15m22s), and CI run `39093266332` passed both Linux and Windows. HTML-Tree 5.07 passes all 23 files / 989 tests on the JVM backend; unchanged `t/refloop.t` passes 8/8 on blead Perl 5.45.4, JVM, and interpreter. The ordinary aggregate element refcount test passes on blead Perl 5.45.4 and both local backends, covering insert, push, shift, replace, delete, and final destruction. `DestroyDispatchAggregateOwnerRootTest` exercises real hash mutation paths and checks temporary/global hash and closure-pad roots. `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction for unrooted temporary and package-rooted owners. This remains integration evidence only: array/hash owner slots currently identify edges, but `RuntimeBase.refCount`, `refCountOwned`, and reachability cleanup remain authoritative for ordinary aggregate stores. The Catalyst test passes 24/24 but still emits global-destruction warnings on both PerlOnJava backends; the root-path changes have not altered those warnings.
 
 ### Completed
 

From f4ec54cb9d733f8d2d5d574d4017ddc70aea1af4 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 18 Oct 2026 11:01:40 +0200
Subject: [PATCH 094/317] fix: avoid false destruction resurrection reports on
 large root graphs

Exclude the dying referent from global-owner proofs and use a larger bounded
walk budget for destruction-time queries. Add regressions for self-referential
owners, large package graphs, and Catalyst tempfile cleanup across backends.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          |   4 +-
 docs/about/changelog.md                       |   2 +-
 .../runtime/runtimetypes/DestroyDispatch.java |  13 +-
 .../runtimetypes/ReachabilityWalker.java      | 184 +++++++++++++-----
 .../runtime/runtimetypes/RuntimeScalar.java   |   7 +-
 ...DestroyDispatchAggregateOwnerRootTest.java | 101 ++++++++++
 ...DestroyDispatchWeakSlotRescueRootTest.java |  37 ++++
 ...yst_request_body_tempfile_global_destroy.t |  39 ++++
 8 files changed, 330 insertions(+), 57 deletions(-)
 create mode 100644 src/test/resources/unit/catalyst_request_body_tempfile_global_destroy.t

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index e553fc205a..3321f51383 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 is in progress in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816); candidate `caac0f7d` passes local `make` and Ubuntu/Windows CI. The unchanged HTML-Tree lifecycle suite passes on both backends. Ordinary array/hash slots still use the legacy selective count as lifecycle authority.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 is in progress in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816). The latest local ownership candidate passes `nice -n 19 make`; its PR update and CI run are pending. The unchanged HTML-Tree lifecycle suite passes on both backends. Ordinary array/hash slots still use the legacy selective count as lifecycle authority.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. `nice -n 19 make` passes on candidate `caac0f7d` (15m22s), and CI run `39093266332` passed both Linux and Windows. HTML-Tree 5.07 passes all 23 files / 989 tests on the JVM backend; unchanged `t/refloop.t` passes 8/8 on blead Perl 5.45.4, JVM, and interpreter. The ordinary aggregate element refcount test passes on blead Perl 5.45.4 and both local backends, covering insert, push, shift, replace, delete, and final destruction. `DestroyDispatchAggregateOwnerRootTest` exercises real hash mutation paths and checks temporary/global hash and closure-pad roots. `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction for unrooted temporary and package-rooted owners. This remains integration evidence only: array/hash owner slots currently identify edges, but `RuntimeBase.refCount`, `refCountOwned`, and reachability cleanup remain authoritative for ordinary aggregate stores. The Catalyst test passes 24/24 but still emits global-destruction warnings on both PerlOnJava backends; the root-path changes have not altered those warnings.
+The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. The latest local `nice -n 19 make` passes in 17m17s. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl 5.45.4 and both PerlOnJava backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The broad ownership rewrite remains incomplete: array/hash owner slots currently identify edges, while `RuntimeBase.refCount`, `refCountOwned`, and reachability cleanup remain authoritative for ordinary aggregate stores. Next: update and push the candidate, rerun PR CI, and continue Phase 2 ownership migration.
 
 ### Completed
 
diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index ed9d6a8dc9..728b58b01e 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -42,7 +42,7 @@ priorities and future plans.
 - Preserve inherited method dispatch in child threads.
 - Prefer exact root-module package declarations over earlier helper packages, and warn for undefined hash keys used by `exists` and `delete` (#1820, #1645).
 - Add a reproducible, warmup-aware Perl versus PerlOnJava performance runner (#1196).
-- Preserve CODE callback captures while Perl container slots still own the callback; release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
+- Preserve CODE callback captures while Perl container slots still own the callback; release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; avoid false global-destruction resurrection warnings when bounded owner proofs scan large package graphs; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
 - Cover FormState session restoration across requests and HTTP response conversion from callback and streaming PSGI responses; refresh HTTP::Message and LWP compatibility status (#1650, #1651, #1652).
 - Preserve the awaited Future value when its source scalar or aggregate slot changes during suspension, covering PAGI::Server request-body receives (#1818).
 - Preserve escaped byte strings in interpreter closures and `bytes::substr`, honor requested CRLF output in `MIME::QuotedPrint`, and cover URI Basic Auth byte-string userinfo (#1275, #1313, #1341).
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
index a4f4c66c0c..124a9b4537 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
@@ -716,16 +716,18 @@ static boolean hasEscapedPerlOwner(RuntimeBase referent,
                 // roots are still available to the reachability walker, so
                 // require a new scalar owner to remain rooted before warning.
                 if (owner.isRetiredBorrowedArrayAlias()) continue;
-                if (!activeOwnersAtStart.contains(owner)
-                        && ReachabilityWalker.isScalarReachableFromPackageRoots(owner)) {
-                    return true;
+                if (!activeOwnersAtStart.contains(owner)) {
+                    boolean rooted = ReachabilityWalker.isScalarReachableFromPackageRoots(
+                            owner, referent);
+                    if (rooted) return true;
                 }
             }
             for (PerlOwnerSlot ownerSlot : referent.ownerSlotSnapshot()) {
                 if (ownerSlotsAtStart.contains(ownerSlot)) continue;
                 RuntimeBase ownerContainer = ownerSlot.ownerContainer();
                 if (ownerContainer != null
-                        && ReachabilityWalker.isReachableFromRoots(ownerContainer, true)) {
+                        && ReachabilityWalker.isReachableFromRoots(
+                                ownerContainer, true, referent)) {
                     return true;
                 }
                 // Closure pads have no aggregate container. When capture
@@ -736,7 +738,8 @@ static boolean hasEscapedPerlOwner(RuntimeBase referent,
                     if (closureOwner == null
                             || ReachabilityWalker.isCodeReachableFromRoots(closureOwner)) {
                         if (closureOwner == null && ownerSlot.padCell() != null) {
-                            if (ReachabilityWalker.isScalarReachable(ownerSlot.padCell())) {
+                            if (ReachabilityWalker.isScalarReachableFromPackageRoots(
+                                    ownerSlot.padCell(), referent)) {
                                 return true;
                             }
                         } else {
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 1c7cd8c738..b2c5de8cde 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1355,6 +1355,8 @@ private boolean visitEdge() {
 
     static final int MAX_ROOT_SNAPSHOT_EDGES = 50_000;
     static final int MAX_ROOT_SNAPSHOT_VISITS = 50_000;
+    private static final int MAX_DESTRUCTION_OWNER_ROOT_EDGES = 500_000;
+    private static final int MAX_DESTRUCTION_OWNER_ROOT_VISITS = 100_000;
 
     static Set<RuntimeBase> reachableFromRootsSnapshot() {
         return reachableFromRootsSnapshotWithStatus().reachable();
@@ -1927,9 +1929,13 @@ static ScalarRootReachabilitySnapshot scalarReachabilitySnapshot() {
      * resurrection checks must not treat a still-active local cleanup frame
      * as a persistent Perl owner.
      */
-    static boolean isScalarReachableFromPackageRoots(RuntimeScalar target) {
-        if (target == null) return false;
-        return scalarReachabilitySnapshot(MAX_ROOT_SNAPSHOT_VISITS, false, false)
+    static boolean isScalarReachableFromPackageRoots(RuntimeScalar target,
+                                                     RuntimeBase excludedReferent) {
+        if (target == null || target == excludedReferent) return false;
+        return scalarReachabilitySnapshot(
+                excludedReferent == null ? MAX_ROOT_SNAPSHOT_VISITS
+                        : MAX_DESTRUCTION_OWNER_ROOT_VISITS,
+                false, false, excludedReferent)
                 .isReachable(target);
     }
 
@@ -1943,6 +1949,13 @@ static ScalarRootReachabilitySnapshot completeScalarReachabilitySnapshot() {
 
     private static ScalarRootReachabilitySnapshot scalarReachabilitySnapshot(
             int maxVisits, boolean includeTransientRoots, boolean includeLiveVars) {
+        return scalarReachabilitySnapshot(
+                maxVisits, includeTransientRoots, includeLiveVars, null);
+    }
+
+    private static ScalarRootReachabilitySnapshot scalarReachabilitySnapshot(
+            int maxVisits, boolean includeTransientRoots, boolean includeLiveVars,
+            RuntimeBase excludedReferent) {
         ReachabilityQueryStats stats = MortalList.activeReachabilityQueryStats();
         if (stats != null) {
             stats.snapshotsBuilt++;
@@ -1954,46 +1967,57 @@ private static ScalarRootReachabilitySnapshot scalarReachabilitySnapshot(
         java.util.ArrayDeque<RuntimeBase> todo = new java.util.ArrayDeque<>();
 
         for (RuntimeScalar scalar : GlobalVariable.globalCodeRefValuesView()) {
-            addScalarReachabilityRoot(scalar, seen, reachableScalars, todo, stats);
+            addScalarReachabilityRoot(scalar, seen, reachableScalars, todo, stats,
+                    excludedReferent);
         }
         for (RuntimeScalar scalar : GlobalVariable.globalCodeRefEdgeRootsView()) {
-            addScalarReachabilityRoot(scalar, seen, reachableScalars, todo, stats);
+            addScalarReachabilityRoot(scalar, seen, reachableScalars, todo, stats,
+                    excludedReferent);
         }
         if (includeTransientRoots) {
             for (RuntimeCode active : PerlRuntime.current().executionState().activeCodeStack) {
-                addScalarReachabilityRoot(active, seen, reachableScalars, todo, stats);
+                addScalarReachabilityRoot(active, seen, reachableScalars, todo, stats,
+                        excludedReferent);
             }
             for (java.util.List<RuntimeScalar> args : RuntimeCode.snapshotPristineArgsStack()) {
                 for (RuntimeScalar arg : args) {
                     if (arg != null && !WeakRefRegistry.isweak(arg)) {
-                        addScalarReachabilityRoot(arg, seen, reachableScalars, todo, stats);
+                        addScalarReachabilityRoot(arg, seen, reachableScalars, todo, stats,
+                                excludedReferent);
                     }
                 }
             }
             for (RuntimeArray args : RuntimeCode.snapshotArgsStack()) {
-                addScalarReachabilityRoot(args, seen, reachableScalars, todo, stats);
+                addScalarReachabilityRoot(args, seen, reachableScalars, todo, stats,
+                        excludedReferent);
             }
             for (RuntimeBase suspended : MortalList.snapshotSuspendedRoots()) {
-                addScalarReachabilityRoot(suspended, seen, reachableScalars, todo, stats);
+                addScalarReachabilityRoot(suspended, seen, reachableScalars, todo, stats,
+                        excludedReferent);
             }
             for (RuntimeBase temporary : MortalList.snapshotTemporaryRoots()) {
-                addScalarReachabilityRoot(temporary, seen, reachableScalars, todo, stats);
+                addScalarReachabilityRoot(temporary, seen, reachableScalars, todo, stats,
+                        excludedReferent);
             }
         }
         for (RuntimeScalar scalar : GlobalVariable.globalVariableValuesView()) {
-            addScalarReachabilityRoot(scalar, seen, reachableScalars, todo, stats);
+            addScalarReachabilityRoot(scalar, seen, reachableScalars, todo, stats,
+                    excludedReferent);
         }
         for (Map.Entry<String, RuntimeArray> entry : GlobalVariable.globalArrayEntriesView()) {
             if (isNonOwningDebugArgsArray(entry.getKey())) continue;
-            addScalarReachabilityRoot(entry.getValue(), seen, reachableScalars, todo, stats);
+            addScalarReachabilityRoot(entry.getValue(), seen, reachableScalars, todo, stats,
+                    excludedReferent);
         }
         for (RuntimeHash hash : GlobalVariable.globalHashValuesView()) {
-            addScalarReachabilityRoot(hash, seen, reachableScalars, todo, stats);
+            addScalarReachabilityRoot(hash, seen, reachableScalars, todo, stats,
+                    excludedReferent);
         }
         if (includeLiveVars) {
             for (Object liveVar : MyVarCleanupStack.snapshotLiveVars()) {
                 if (liveVar instanceof RuntimeBase base) {
-                    addScalarReachabilityRoot(base, seen, reachableScalars, todo, stats);
+                    addScalarReachabilityRoot(base, seen, reachableScalars, todo, stats,
+                            excludedReferent);
                 }
             }
         }
@@ -2009,17 +2033,17 @@ private static ScalarRootReachabilitySnapshot scalarReachabilitySnapshot(
                 if (hash.elements instanceof HashSpecialVariable) continue;
                 if (hash.elements instanceof TieHash tieHash) {
                     addScalarReachabilityEdge(tieHash.getSelf(), seen,
-                            reachableScalars, todo, stats, true, true);
+                            reachableScalars, todo, stats, true, true, excludedReferent);
                 }
                 for (RuntimeScalar value : hash.elements.values()) {
                     addScalarReachabilityEdge(value, seen,
-                            reachableScalars, todo, stats, true, false);
+                            reachableScalars, todo, stats, true, false, excludedReferent);
                 }
             } else if (current instanceof RuntimeArray array) {
                 for (RuntimeScalar value : array.elements) {
                     if (array.elementsAliased && !array.ownsElement(value)) continue;
                     addScalarReachabilityEdge(value, seen,
-                            reachableScalars, todo, stats, true, false);
+                            reachableScalars, todo, stats, true, false, excludedReferent);
                 }
             } else if (current instanceof RuntimeScalar scalar) {
                 if (stats != null) stats.edgesInspected++;
@@ -2029,26 +2053,26 @@ private static ScalarRootReachabilitySnapshot scalarReachabilitySnapshot(
                     if (base instanceof RuntimeScalar referencedScalar) {
                         reachableScalars.add(referencedScalar);
                     }
-                    if (seen.add(base)) todo.addLast(base);
+                    if (base != excludedReferent && seen.add(base)) todo.addLast(base);
                 }
             } else if (current instanceof RuntimeCode code) {
                 if (code.padConstants != null) {
                     for (RuntimeBase constant : code.padConstants) {
                         addScalarReachabilityEdge(constant, seen,
-                                reachableScalars, todo, stats, true, false);
+                                reachableScalars, todo, stats, true, false, excludedReferent);
                     }
                 }
                 for (RuntimeScalar state : code.stateVariable.values()) {
                     addScalarReachabilityEdge(state, seen,
-                            reachableScalars, todo, stats, true, false);
+                            reachableScalars, todo, stats, true, false, excludedReferent);
                 }
                 for (RuntimeArray state : code.stateArray.values()) {
                     addScalarReachabilityEdge(state, seen,
-                            reachableScalars, todo, stats, true, false);
+                            reachableScalars, todo, stats, true, false, excludedReferent);
                 }
                 for (RuntimeHash state : code.stateHash.values()) {
                     addScalarReachabilityEdge(state, seen,
-                            reachableScalars, todo, stats, true, false);
+                            reachableScalars, todo, stats, true, false, excludedReferent);
                 }
                 if (code.closedOverVariables != null) {
                     for (RuntimeBase captured : code.closedOverVariables.values()) {
@@ -2056,31 +2080,31 @@ private static ScalarRootReachabilitySnapshot scalarReachabilitySnapshot(
                         if (captured instanceof RuntimeScalar scalar
                                 && WeakRefRegistry.isweak(scalar)) continue;
                         addScalarReachabilityEdge(captured, seen,
-                                reachableScalars, todo, null, true, false);
+                                reachableScalars, todo, null, true, false, excludedReferent);
                     }
                 }
                 if (code.capturedScalars != null) {
                     for (RuntimeScalar captured : code.capturedScalars) {
                         addScalarReachabilityEdge(captured, seen,
-                                reachableScalars, todo, stats, true, false);
+                                reachableScalars, todo, stats, true, false, excludedReferent);
                     }
                 }
                 if (code.capturedAggregates != null) {
                     for (RuntimeBase captured : code.capturedAggregates) {
                         addScalarReachabilityEdge(captured, seen,
-                                reachableScalars, todo, stats, true, true);
+                                reachableScalars, todo, stats, true, true, excludedReferent);
                     }
                 }
                 visitReflectiveCodeScalars(code, captured ->
                         addScalarReachabilityEdge(captured, seen,
-                                reachableScalars, todo, stats, true, false));
+                                reachableScalars, todo, stats, true, false, excludedReferent));
                 visitReflectiveCodeBases(code, captured ->
                         addScalarReachabilityEdge(captured, seen,
-                                reachableScalars, todo, stats, false, false));
+                                reachableScalars, todo, stats, false, false, excludedReferent));
             } else if (current instanceof RuntimeRegex regex) {
                 for (RuntimeCode callback : regex.executableCallbackCodes()) {
                     addScalarReachabilityEdge(callback, seen,
-                            reachableScalars, todo, stats, false, false);
+                            reachableScalars, todo, stats, false, false, excludedReferent);
                 }
             }
         }
@@ -2090,7 +2114,14 @@ private static ScalarRootReachabilitySnapshot scalarReachabilitySnapshot(
     private static void addScalarReachabilityRoot(
             RuntimeBase base, Set<RuntimeBase> seen, Set<RuntimeScalar> reachableScalars,
             java.util.ArrayDeque<RuntimeBase> todo, ReachabilityQueryStats stats) {
-        if (base != null && seen.add(base)) {
+        addScalarReachabilityRoot(base, seen, reachableScalars, todo, stats, null);
+    }
+
+    private static void addScalarReachabilityRoot(
+            RuntimeBase base, Set<RuntimeBase> seen, Set<RuntimeScalar> reachableScalars,
+            java.util.ArrayDeque<RuntimeBase> todo, ReachabilityQueryStats stats,
+            RuntimeBase excludedReferent) {
+        if (base != null && base != excludedReferent && seen.add(base)) {
             todo.addLast(base);
             if (stats != null) stats.rootsSeeded++;
         }
@@ -2101,6 +2132,15 @@ private static void addScalarReachabilityEdge(
             RuntimeBase base, Set<RuntimeBase> seen, Set<RuntimeScalar> reachableScalars,
             java.util.ArrayDeque<RuntimeBase> todo, ReachabilityQueryStats stats,
             boolean trackScalarIdentity, boolean includeWeakIdentity) {
+        addScalarReachabilityEdge(base, seen, reachableScalars, todo, stats,
+                trackScalarIdentity, includeWeakIdentity, null);
+    }
+
+    private static void addScalarReachabilityEdge(
+            RuntimeBase base, Set<RuntimeBase> seen, Set<RuntimeScalar> reachableScalars,
+            java.util.ArrayDeque<RuntimeBase> todo, ReachabilityQueryStats stats,
+            boolean trackScalarIdentity, boolean includeWeakIdentity,
+            RuntimeBase excludedReferent) {
         if (stats != null) stats.edgesInspected++;
         if (base instanceof RuntimeScalar scalar) {
             boolean weak = WeakRefRegistry.isweak(scalar);
@@ -2109,7 +2149,7 @@ private static void addScalarReachabilityEdge(
             }
             if (weak) return;
         }
-        if (base != null && seen.add(base)) todo.addLast(base);
+        if (base != null && base != excludedReferent && seen.add(base)) todo.addLast(base);
     }
 
     /**
@@ -2130,13 +2170,25 @@ private static void addScalarReachabilityEdge(
      * diagnostic / debugging callers.
      */
     public static boolean isReachableFromRoots(RuntimeBase target, boolean globalOnly) {
-        if (target == null) return false;
+        return isReachableFromRoots(target, globalOnly, null);
+    }
+
+    /**
+     * Test a package-root path while refusing to pass through one referent.
+     * Destruction-time resurrection checks use this to distinguish a new owner
+     * retained by the dying object's own graph from one that escaped elsewhere.
+     */
+    static boolean isReachableFromRoots(RuntimeBase target, boolean globalOnly,
+                                        RuntimeBase excludedReferent) {
+        if (target == null || target == excludedReferent) return false;
         ReachabilityQueryStats stats = MortalList.activeReachabilityQueryStats();
         if (stats != null) stats.rootQueries++;
         // Node and edge caps bound both graph traversal and root seeding. An
         // incomplete proof conservatively retains an unresolved target.
-        final int MAX_VISITS = MAX_ROOT_SNAPSHOT_VISITS;
-        RootWalkBudget budget = new RootWalkBudget(MAX_ROOT_SNAPSHOT_EDGES);
+        final int MAX_VISITS = excludedReferent == null
+                ? MAX_ROOT_SNAPSHOT_VISITS : MAX_DESTRUCTION_OWNER_ROOT_VISITS;
+        RootWalkBudget budget = new RootWalkBudget(excludedReferent == null
+                ? MAX_ROOT_SNAPSHOT_EDGES : MAX_DESTRUCTION_OWNER_ROOT_EDGES);
 
         Set<RuntimeBase> seen = Collections.newSetFromMap(new IdentityHashMap<>());
         java.util.ArrayDeque<RuntimeBase> todo = new java.util.ArrayDeque<>();
@@ -2144,7 +2196,7 @@ public static boolean isReachableFromRoots(RuntimeBase target, boolean globalOnl
         // Seed: package globals (scalars, arrays, hashes, code refs).
         for (RuntimeScalar codeRef : GlobalVariable.globalCodeRefValuesView()) {
             if (!budget.visitEdge()) return true;
-            seedTarget(codeRef, target, seen, todo, stats);
+            seedTargetExcluding(codeRef, target, seen, todo, stats, excludedReferent);
             if (seen.contains(target)) return true;
             if (!globalOnly
                     && codeRef != null
@@ -2155,7 +2207,7 @@ public static boolean isReachableFromRoots(RuntimeBase target, boolean globalOnl
         }
         for (RuntimeScalar scalar : GlobalVariable.globalVariableValuesView()) {
             if (!budget.visitEdge()) return true;
-            seedTarget(scalar, target, seen, todo, stats);
+            seedTargetExcluding(scalar, target, seen, todo, stats, excludedReferent);
             if (seen.contains(target)) return true;
         }
         for (Map.Entry<String, RuntimeArray> e : GlobalVariable.globalArrayEntriesView()) {
@@ -2165,7 +2217,8 @@ public static boolean isReachableFromRoots(RuntimeBase target, boolean globalOnl
                 if (stats != null) stats.rootsSeeded++;
                 return true;
             }
-            if (e.getValue() != null && seen.add(e.getValue())) {
+            if (e.getValue() != null && e.getValue() != excludedReferent
+                    && seen.add(e.getValue())) {
                 todo.addLast(e.getValue());
                 if (stats != null) stats.rootsSeeded++;
             }
@@ -2176,7 +2229,7 @@ public static boolean isReachableFromRoots(RuntimeBase target, boolean globalOnl
                 if (stats != null) stats.rootsSeeded++;
                 return true;
             }
-            if (hash != null && seen.add(hash)) {
+            if (hash != null && hash != excludedReferent && seen.add(hash)) {
                 todo.addLast(hash);
                 if (stats != null) stats.rootsSeeded++;
             }
@@ -2184,7 +2237,8 @@ public static boolean isReachableFromRoots(RuntimeBase target, boolean globalOnl
         for (RuntimeBase ownerReferent : PerlRuntime.snapshotOwnerSlotReferents()) {
             if (!budget.visitEdge()) return true;
             if (ownerReferent == target) return true;
-            if (ownerReferent != null && seen.add(ownerReferent)) {
+            if (ownerReferent != null && ownerReferent != excludedReferent
+                    && seen.add(ownerReferent)) {
                 todo.addLast(ownerReferent);
                 if (stats != null) stats.rootsSeeded++;
             }
@@ -2207,7 +2261,7 @@ public static boolean isReachableFromRoots(RuntimeBase target, boolean globalOnl
                 if (WeakRefRegistry.isweak(sc)) continue;
                 if (!MyVarCleanupStack.isLive(sc) && !sc.refCountOwned) continue;
                 if (sc.scopeExited) continue;
-                seedTarget(sc, target, seen, todo, stats);
+                seedTargetExcluding(sc, target, seen, todo, stats, excludedReferent);
                 if (seen.contains(target)) return true;
             }
             // Seed: live my-vars themselves (RuntimeHash / RuntimeArray /
@@ -2228,14 +2282,14 @@ public static boolean isReachableFromRoots(RuntimeBase target, boolean globalOnl
                         if (stats != null) stats.rootsSeeded++;
                         return true;
                     }
-                    seedTarget(sc, target, seen, todo, stats);
+                    seedTargetExcluding(sc, target, seen, todo, stats, excludedReferent);
                     if (seen.contains(target)) return true;
                 } else if (liveVar instanceof RuntimeBase rb) {
                     if (rb == target) {
                         if (stats != null) stats.rootsSeeded++;
                         return true;
                     }
-                    if (seen.add(rb)) {
+                    if (rb != excludedReferent && seen.add(rb)) {
                         todo.addLast(rb);
                         if (stats != null) stats.rootsSeeded++;
                     }
@@ -2252,7 +2306,7 @@ public static boolean isReachableFromRoots(RuntimeBase target, boolean globalOnl
                         || scalar.type != RuntimeScalarType.REGEX
                         || scalar.scopeExited
                         || WeakRefRegistry.isweak(scalar)) continue;
-                seedTarget(scalar, target, seen, todo, stats);
+                seedTargetExcluding(scalar, target, seen, todo, stats, excludedReferent);
                 if (seen.contains(target)) return true;
             }
         }
@@ -2263,7 +2317,7 @@ public static boolean isReachableFromRoots(RuntimeBase target, boolean globalOnl
                 if (stats != null) stats.rootsSeeded++;
                 return true;
             }
-            if (seen.add(rescued)) {
+            if (rescued != excludedReferent && seen.add(rescued)) {
                 todo.addLast(rescued);
                 if (stats != null) stats.rootsSeeded++;
             }
@@ -2276,6 +2330,7 @@ public static boolean isReachableFromRoots(RuntimeBase target, boolean globalOnl
             visits++;
             if (stats != null) stats.nodesVisited++;
             if (cur == target) return true;
+            if (cur == excludedReferent) continue;
             // Phase D-W2 (perf): skip RuntimeStash — see bfs().
             if (cur instanceof RuntimeStash) continue;
             if (cur instanceof RuntimeHash h) {
@@ -2284,19 +2339,20 @@ public static boolean isReachableFromRoots(RuntimeBase target, boolean globalOnl
                     if (stats != null) stats.edgesInspected++;
                 }
                 if (h.elements instanceof TieHash tieHash
-                        && followScalar(tieHash.getSelf(), target, seen, todo)) {
+                        && followScalarExcluding(
+                                tieHash.getSelf(), target, seen, todo, excludedReferent)) {
                     return true;
                 }
                 for (RuntimeScalar v : h.elements.values()) {
                     if (!budget.visitEdge()) break walk;
                     if (stats != null) stats.edgesInspected++;
-                    if (followScalar(v, target, seen, todo)) return true;
+                    if (followScalarExcluding(v, target, seen, todo, excludedReferent)) return true;
                 }
             } else if (cur instanceof RuntimeArray a) {
                 for (RuntimeScalar v : a.elements) {
                     if (!budget.visitEdge()) break walk;
                     if (stats != null) stats.edgesInspected++;
-                    if (followScalar(v, target, seen, todo)) return true;
+                    if (followScalarExcluding(v, target, seen, todo, excludedReferent)) return true;
                 }
             } else if (cur instanceof RuntimeRegex regex) {
                 // Executable regex callbacks are strong owners of their
@@ -2866,6 +2922,29 @@ private static void seedTarget(RuntimeScalar s, RuntimeBase target,
         }
     }
 
+    private static void seedTargetExcluding(RuntimeScalar scalar, RuntimeBase target,
+            Set<RuntimeBase> seen, java.util.ArrayDeque<RuntimeBase> todo,
+            ReachabilityQueryStats stats, RuntimeBase excludedReferent) {
+        if (excludedReferent == null) {
+            seedTarget(scalar, target, seen, todo, stats);
+            return;
+        }
+        if (scalar == null) return;
+        if (stats != null) stats.edgesInspected++;
+        if (WeakRefRegistry.isweak(scalar)) return;
+        if ((scalar.type & RuntimeScalarType.REFERENCE_BIT) != 0
+                && scalar.value instanceof RuntimeBase base) {
+            if (base == target) {
+                if (seen.add(target) && stats != null) stats.rootsSeeded++;
+                return;
+            }
+            if (base != excludedReferent && seen.add(base)) {
+                todo.addLast(base);
+                if (stats != null) stats.rootsSeeded++;
+            }
+        }
+    }
+
     private static void seedTargetIncludingCode(RuntimeScalar scalar, RuntimeBase target,
             Set<RuntimeBase> seen, java.util.ArrayDeque<RuntimeBase> todo,
             ReachabilityQueryStats stats) {
@@ -2890,6 +2969,19 @@ private static boolean followScalar(RuntimeScalar s, RuntimeBase target,
         return false;
     }
 
+    private static boolean followScalarExcluding(RuntimeScalar scalar, RuntimeBase target,
+            Set<RuntimeBase> seen, java.util.ArrayDeque<RuntimeBase> todo,
+            RuntimeBase excludedReferent) {
+        if (excludedReferent == null) return followScalar(scalar, target, seen, todo);
+        if (scalar == null || WeakRefRegistry.isweak(scalar)) return false;
+        if ((scalar.type & RuntimeScalarType.REFERENCE_BIT) != 0
+                && scalar.value instanceof RuntimeBase base) {
+            if (base == target) return true;
+            if (base != excludedReferent && seen.add(base)) todo.addLast(base);
+        }
+        return false;
+    }
+
     private static boolean followScalarIncludingCode(RuntimeScalar scalar, RuntimeBase target,
             Set<RuntimeBase> seen, java.util.ArrayDeque<RuntimeBase> todo) {
         if (followScalar(scalar, target, seen, todo)) return true;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 4492816858..452496704c 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -2971,10 +2971,11 @@ && hasLiveIo(assignedGlob)) {
                 && containerOwner != null
                 && !(containerOwner instanceof RuntimeHash owner
                     && owner.isPackageRootedHash())
-                && (!DestroyDispatch.isInGlobalDestructionPhase()
-                    || ReachabilityWalker.isReachableFromRoots(containerOwner, true))
                 && this.value instanceof RuntimeBase base
-                && base == DestroyDispatch.currentDestroyTarget()) {
+                && base == DestroyDispatch.currentDestroyTarget()
+                && (!DestroyDispatch.isInGlobalDestructionPhase()
+                    || ReachabilityWalker.isReachableFromRoots(
+                            containerOwner, true, base))) {
             DestroyDispatch.markDestroyTargetRescued();
             // Transition from destroyed (MIN_VALUE) to tracked so that when the
             // rescuing reference is eventually released (e.g., source goes out of
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java
index 90ada883db..41735a0a77 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchAggregateOwnerRootTest.java
@@ -51,6 +51,107 @@ void scalarOwnerInPackageGlobalHashCountsAsResurrection() {
         }
     }
 
+    @Test
+    void scalarOwnerInsideDyingReferentDoesNotCountAsResurrection() {
+        PerlRuntime runtime = new PerlRuntime();
+        String rootName = "DestroyDispatchAggregateOwnerRootTest::self_root";
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeHash referent = new RuntimeHash();
+            referent.activateOwnerTracking();
+            GlobalVariable.globalHashes.put(rootName, referent);
+            RuntimeScalar selfOwner = referent.createReference();
+            referent.put("self", selfOwner);
+            try {
+                assertFalse(hasNewRootedOwner(referent),
+                        "a new scalar owner reached only through the dying object is not resurrection");
+            } finally {
+                referent.elements.clear();
+                referent.releaseHashEntryOwnerSlots();
+                GlobalVariable.globalHashes.remove(rootName);
+            }
+        }
+    }
+
+    @Test
+    void aggregateOwnerContainerInsideDyingReferentDoesNotCountAsResurrection() {
+        PerlRuntime runtime = new PerlRuntime();
+        String rootName = "DestroyDispatchAggregateOwnerRootTest::aggregate_self_root";
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeHash referent = new RuntimeHash();
+            RuntimeHash ownerContainer = new RuntimeHash();
+            referent.activateOwnerTracking();
+            GlobalVariable.globalHashes.put(rootName, referent);
+            ownerContainer.put("self", referent.createReference());
+            referent.put("container", ownerContainer.createReference());
+            try {
+                assertFalse(hasNewRootedOwner(referent),
+                        "an owner container reached only through the dying object is not resurrection");
+            } finally {
+                ownerContainer.elements.clear();
+                ownerContainer.releaseHashEntryOwnerSlots();
+                referent.elements.clear();
+                referent.releaseHashEntryOwnerSlots();
+                GlobalVariable.globalHashes.remove(rootName);
+            }
+        }
+    }
+
+    @Test
+    void legacyClosurePadReachableOnlyThroughDyingReferentDoesNotCountAsResurrection() {
+        PerlRuntime runtime = new PerlRuntime();
+        String rootName = "DestroyDispatchAggregateOwnerRootTest::closure_self_root";
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeHash referent = new RuntimeHash();
+            referent.activateOwnerTracking();
+            GlobalVariable.globalHashes.put(rootName, referent);
+            RuntimeScalar padCell = referent.createReference();
+            referent.put("pad", padCell);
+            PerlOwnerSlot slot = new PerlOwnerSlot(
+                    PerlOwnerSlot.Kind.CLOSURE_PAD, padCell);
+            slot.acquireCapture(referent);
+            try {
+                assertFalse(hasNewRootedOwner(referent),
+                        "a legacy closure pad reachable only through the dying object is not resurrection");
+            } finally {
+                slot.release();
+                referent.elements.clear();
+                referent.releaseHashEntryOwnerSlots();
+                GlobalVariable.globalHashes.remove(rootName);
+            }
+        }
+    }
+
+    @Test
+    void incompleteSmallRootBudgetDoesNotTreatNestedArrayOwnerAsResurrection() {
+        PerlRuntime runtime = new PerlRuntime();
+        String referentRoot = "DestroyDispatchAggregateOwnerRootTest::large_self_root";
+        String paddingRoot = "DestroyDispatchAggregateOwnerRootTest::large_padding";
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeHash referent = new RuntimeHash();
+            RuntimeArray ownerArray = new RuntimeArray();
+            RuntimeArray padding = new RuntimeArray(60_000);
+            referent.activateOwnerTracking();
+            GlobalVariable.globalHashes.put(referentRoot, referent);
+            GlobalVariable.globalArrays.put(paddingRoot, padding);
+            for (int i = 0; i < 60_000; i++) {
+                padding.elements.add(new RuntimeScalar(i));
+            }
+            ownerArray.push(referent.createReference());
+            referent.put("owner", ownerArray.createReference());
+            try {
+                assertFalse(hasNewRootedOwner(referent),
+                        "a capped walk across unrelated package roots must not invent resurrection through the dying referent");
+            } finally {
+                ownerArray.elements.clear();
+                ownerArray.releaseArrayElementOwnerSlots();
+                referent.elements.clear();
+                referent.releaseHashEntryOwnerSlots();
+                GlobalVariable.globalHashes.remove(referentRoot);
+                GlobalVariable.globalArrays.remove(paddingRoot);
+            }
+        }
+    }
+
     @Test
     void captureFromUnrootedClosureDoesNotCountAsResurrection() {
         PerlRuntime runtime = new PerlRuntime();
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchWeakSlotRescueRootTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchWeakSlotRescueRootTest.java
index 7bcc91e93f..f01f9ac95d 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchWeakSlotRescueRootTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchWeakSlotRescueRootTest.java
@@ -71,6 +71,43 @@ void weakSelfReplacementInGloballyReachableHashCanRescue() {
         }
     }
 
+    @Test
+    void weakSelfReplacementInHashReachableOnlyThroughDyingTargetCannotRescue() {
+        PerlRuntime runtime = new PerlRuntime();
+        String rootName = "DestroyDispatchWeakSlotRescueRootTest::self_root";
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeScalar phase = GlobalVariable.getGlobalVariable(GlobalContext.GLOBAL_PHASE);
+            String oldPhase = phase.toString();
+            RuntimeBase previousTarget = runtime.lifecycleState.currentDestroyTarget;
+            boolean previousRescued = runtime.lifecycleState.destroyTargetRescued;
+            RuntimeArray target = new RuntimeArray();
+            RuntimeHash nestedHash = new RuntimeHash();
+            RuntimeArray globalArray = new RuntimeArray();
+            globalArray.add(target.createReference());
+            target.add(nestedHash.createReference());
+            GlobalVariable.globalArrays.put(rootName, globalArray);
+            RuntimeScalar weakCell = weakSelfCell(target, nestedHash);
+            try {
+                phase.set("DESTRUCT");
+                runtime.lifecycleState.currentDestroyTarget = target;
+                runtime.lifecycleState.destroyTargetRescued = false;
+
+                weakCell.set(target.createReference());
+
+                assertFalse(runtime.lifecycleState.destroyTargetRescued,
+                        "a weak slot reached only through the dying referent cannot rescue it");
+            } finally {
+                nestedHash.elements.clear();
+                target.elements.clear();
+                globalArray.elements.clear();
+                GlobalVariable.globalArrays.remove(rootName);
+                runtime.lifecycleState.currentDestroyTarget = previousTarget;
+                runtime.lifecycleState.destroyTargetRescued = previousRescued;
+                phase.set(oldPhase);
+            }
+        }
+    }
+
     private static RuntimeScalar weakSelfCell(RuntimeBase target, RuntimeHash container) {
         RuntimeScalar weakCell = target.createReference();
         container.elements.put("self", weakCell);
diff --git a/src/test/resources/unit/catalyst_request_body_tempfile_global_destroy.t b/src/test/resources/unit/catalyst_request_body_tempfile_global_destroy.t
new file mode 100644
index 0000000000..805a539ef3
--- /dev/null
+++ b/src/test/resources/unit/catalyst_request_body_tempfile_global_destroy.t
@@ -0,0 +1,39 @@
+use strict;
+use warnings;
+use File::Basename qw(dirname);
+use File::Temp qw(tempfile);
+use Test::More;
+
+if ($^O eq 'MSWin32') {
+    plan skip_all => 'timeout command is unavailable on Windows';
+}
+
+my $lifetime_test = dirname($0) . '/catalyst_request_body_tempfile_lifetime.t';
+my ($log_fh, $log_path) = tempfile();
+close($log_fh) or die "close child output file: $!";
+
+open(my $saved_stdout, '>&', \*STDOUT) or die "save stdout: $!";
+open(my $saved_stderr, '>&', \*STDERR) or die "save stderr: $!";
+open(STDOUT, '>', $log_path) or die "redirect stdout: $!";
+open(STDERR, '>&', \*STDOUT) or die "redirect stderr: $!";
+
+my $runner = $^X eq 'jperl' ? './jperl' : $^X;
+my $status = system('timeout', '300', $runner, $lifetime_test);
+
+open(STDOUT, '>&', $saved_stdout) or die "restore stdout: $!";
+open(STDERR, '>&', $saved_stderr) or die "restore stderr: $!";
+close($saved_stdout);
+close($saved_stderr);
+
+open(my $log_read, '<', $log_path) or die "read child output: $!";
+my $output = do { local $/; <$log_read> };
+close($log_read);
+unlink($log_path);
+
+is($status, 0, 'Catalyst tempfile lifetime regression passes in a child process');
+like($output, qr/^1\.\.24$/m, 'child ran all 24 Catalyst lifetime assertions');
+unlike($output,
+    qr/DESTROY created new reference to dead object 'File::Temp'/,
+    'normal tempfile cleanup does not report global-destruction resurrection');
+
+done_testing;

From 4dc6f94fa61b8c97be14aff1135741ff38a006d2 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 18 Oct 2026 12:47:16 +0200
Subject: [PATCH 095/317] test: skip Catalyst lifetime regression when
 dependencies are absent

Preserve the explicit Catalyst dependency skip emitted by the child test so
CI environments without the optional distribution do not fail the wrapper.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md                          | 2 +-
 .../unit/catalyst_request_body_tempfile_global_destroy.t      | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 3321f51383..238b6c82a4 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. The latest local `nice -n 19 make` passes in 17m17s. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl 5.45.4 and both PerlOnJava backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The broad ownership rewrite remains incomplete: array/hash owner slots currently identify edges, while `RuntimeBase.refCount`, `refCountOwned`, and reachability cleanup remain authoritative for ordinary aggregate stores. Next: update and push the candidate, rerun PR CI, and continue Phase 2 ownership migration.
+The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. The latest local `nice -n 19 make` passes in 15m45s. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl 5.45.4 and both PerlOnJava backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip, and the updated full local gate passes. The broad ownership rewrite remains incomplete: array/hash owner slots currently identify edges, while `RuntimeBase.refCount`, `refCountOwned`, and reachability cleanup remain authoritative for ordinary aggregate stores. Next: push the wrapper adjustment, rerun PR CI, and continue Phase 2 ownership migration.
 
 ### Completed
 
diff --git a/src/test/resources/unit/catalyst_request_body_tempfile_global_destroy.t b/src/test/resources/unit/catalyst_request_body_tempfile_global_destroy.t
index 805a539ef3..4c1ebf3c03 100644
--- a/src/test/resources/unit/catalyst_request_body_tempfile_global_destroy.t
+++ b/src/test/resources/unit/catalyst_request_body_tempfile_global_destroy.t
@@ -30,6 +30,10 @@ my $output = do { local $/; <$log_read> };
 close($log_read);
 unlink($log_path);
 
+if ($output =~ /^1\.\.0 # SKIP (.+)$/m) {
+    plan skip_all => $1;
+}
+
 is($status, 0, 'Catalyst tempfile lifetime regression passes in a child process');
 like($output, qr/^1\.\.24$/m, 'child ran all 24 Catalyst lifetime assertions');
 unlike($output,

From 6da19d175d90642f41dabda18bf451cefdce5a77 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 18 Oct 2026 16:47:50 +0200
Subject: [PATCH 096/317] test: cover WebSocket controller release after close

Add a focused Mojolicious regression for controller lifetime across the
WebSocket connection boundary. Skip the server integration on the interpreter
backend, matching existing Test::Mojo lifecycle tests.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <chatgpt-codex@users.noreply.github.com>
---
 ...mojolicious_websocket_controller_release.t | 53 +++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 src/test/resources/unit/mojolicious_websocket_controller_release.t

diff --git a/src/test/resources/unit/mojolicious_websocket_controller_release.t b/src/test/resources/unit/mojolicious_websocket_controller_release.t
new file mode 100644
index 0000000000..28114f3808
--- /dev/null
+++ b/src/test/resources/unit/mojolicious_websocket_controller_release.t
@@ -0,0 +1,53 @@
+use strict;
+use warnings;
+
+BEGIN { $ENV{MOJO_REACTOR} = 'Mojo::Reactor::Poll' }
+
+use Test::More;
+
+BEGIN {
+  $ENV{MOJO_REACTOR} = 'Mojo::Reactor::Poll';
+  plan skip_all => 'Test::Mojo server setup is not available in the interpreter backend'
+    if $ENV{JPERL_INTERPRETER};
+  eval {
+    require IO::Socket::INET;
+    require Mojolicious::Lite;
+    Mojolicious::Lite->import;
+    require Test::Mojo;
+    require Mojo::IOLoop;
+    1;
+  } or plan skip_all => 'Mojolicious and Test::Mojo are required';
+
+  my $probe = IO::Socket::INET->new(
+    LocalAddr => '127.0.0.1',
+    LocalPort => 0,
+    Listen    => 1,
+    Proto     => 'tcp',
+  ) or plan skip_all => 'loopback sockets are unavailable';
+  close $probe;
+}
+
+package WebSocketLifetimeController;
+use Mojo::Base 'Mojolicious::Controller';
+sub DESTROY { $main::controller_destroyed = 1 }
+
+package main;
+our $timer_id;
+our $controller_destroyed = 0;
+app->controller_class('WebSocketLifetimeController');
+websocket '/lifetime' => sub {
+  my $controller = shift;
+  $timer_id = Mojo::IOLoop->recurring(0.05 => sub { $controller->send('tick') });
+};
+
+my $t = Test::Mojo->new;
+$t->websocket_ok('/lifetime')->message_ok->message_is('tick');
+ok(!$controller_destroyed, 'controller stays alive while its WebSocket is open');
+Mojo::IOLoop->remove($timer_id);
+$t->finish_ok;
+
+my $wait_expired = 0;
+Mojo::IOLoop->timer(0.25 => sub { $wait_expired = 1 });
+Mojo::IOLoop->one_tick until $controller_destroyed || $wait_expired;
+ok($controller_destroyed, 'controller is released after its WebSocket closes');
+done_testing;

From afae7741cba42932cb61f7904248d7ca0746d5bd Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 18 Oct 2026 17:10:38 +0200
Subject: [PATCH 097/317] docs: refresh ownership PR status

Record that the WebSocket release regression is now part of draft PR #1816.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <chatgpt-codex@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 238b6c82a4..2d99a79556 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 is in progress in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816). The latest local ownership candidate passes `nice -n 19 make`; its PR update and CI run are pending. The unchanged HTML-Tree lifecycle suite passes on both backends. Ordinary array/hash slots still use the legacy selective count as lifecycle authority.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 is in progress in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816). The WebSocket controller release regression has been pushed to the draft PR; its updated CI run is pending. The latest local ownership candidate passes `nice -n 19 make`; the unchanged HTML-Tree lifecycle suite passes on both backends. Ordinary array/hash slots still use the legacy selective count as lifecycle authority.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 

From 2bff00213271fe1491dbd1f20fe79493eb41a426 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 18 Oct 2026 19:01:22 +0200
Subject: [PATCH 098/317] docs: record current ownership acceptance evidence

Record green PR checks and the current HTML::Tree 5.07 acceptance result,
while keeping the incomplete ordinary aggregate migration explicit.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <chatgpt-codex@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 2d99a79556..24bd91c286 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 is in progress in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816). The WebSocket controller release regression has been pushed to the draft PR; its updated CI run is pending. The latest local ownership candidate passes `nice -n 19 make`; the unchanged HTML-Tree lifecycle suite passes on both backends. Ordinary array/hash slots still use the legacy selective count as lifecycle authority.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 is in progress in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816). PR head `9dd0b6f8d` is open as a draft with Ubuntu and Windows CI green. Its WebSocket controller release regression passes on blead Perl and the JVM backend; the interpreter uses the established `Test::Mojo` skip. The unchanged HTML-Tree 5.07 suite passes on the current candidate. Ordinary array/hash slots still use the legacy selective count as lifecycle authority.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. The latest local `nice -n 19 make` passes in 15m45s. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl 5.45.4 and both PerlOnJava backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip, and the updated full local gate passes. The broad ownership rewrite remains incomplete: array/hash owner slots currently identify edges, while `RuntimeBase.refCount`, `refCountOwned`, and reachability cleanup remain authoritative for ordinary aggregate stores. Next: push the wrapper adjustment, rerun PR CI, and continue Phase 2 ownership migration.
+The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. At head `9dd0b6f8d`, both GitHub CI jobs pass. The local full `nice -n 19 make` gate passes on the same runtime and test tree. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl 5.45.4 and both PerlOnJava backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. The current `timeout 1800 ./jcpan -t HTML::Tree` run passes all 23 files and 989 tests, including unchanged `t/refloop.t`. The broad ownership rewrite remains incomplete: array/hash owner slots currently identify edges, while `RuntimeBase.refCount`, `refCountOwned`, and reachability cleanup remain authoritative for ordinary aggregate stores. Next: migrate an ordinary aggregate ownership path end to end, including scalar/proxy stores and lifecycle cleanup, then revalidate the unchanged HTML-Tree suite.
 
 ### Completed
 

From 00b50a32a455dbafc079941f4a7ed341ac2eb0be Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 18 Oct 2026 19:55:41 +0200
Subject: [PATCH 099/317] fix: preserve rooted hash-entry owners at legacy zero

Use active HASH_ENTRY owner slots as the source for restoring the legacy
lifecycle counter when a deferred decrement would otherwise destroy a value
still held by a package-rooted hash. Keep the path bounded to rooted hash
slots; borrowed array aliases retain their existing accounting.

Add a lifecycle regression proving the owner slot protects the referent until
the final hash entry is removed.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <chatgpt-codex@users.noreply.github.com>
---
 docs/about/changelog.md                       |  2 +-
 .../runtime/runtimetypes/MortalList.java      | 27 +++++++
 .../MortalListAggregateOwnerSlotTest.java     | 75 +++++++++++++++++++
 3 files changed, 103 insertions(+), 1 deletion(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateOwnerSlotTest.java

diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index 728b58b01e..3aad394d90 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -42,7 +42,7 @@ priorities and future plans.
 - Preserve inherited method dispatch in child threads.
 - Prefer exact root-module package declarations over earlier helper packages, and warn for undefined hash keys used by `exists` and `delete` (#1820, #1645).
 - Add a reproducible, warmup-aware Perl versus PerlOnJava performance runner (#1196).
-- Preserve CODE callback captures while Perl container slots still own the callback; release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; avoid false global-destruction resurrection warnings when bounded owner proofs scan large package graphs; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
+- Preserve CODE callback captures while Perl container slots still own the callback; restore rooted hash-entry owners when a legacy deferred decrement undercounts them; release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; avoid false global-destruction resurrection warnings when bounded owner proofs scan large package graphs; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
 - Cover FormState session restoration across requests and HTTP response conversion from callback and streaming PSGI responses; refresh HTTP::Message and LWP compatibility status (#1650, #1651, #1652).
 - Preserve the awaited Future value when its source scalar or aggregate slot changes during suspension, covering PAGI::Server request-body receives (#1818).
 - Preserve escaped byte strings in interpreter closures and `bytes::substr`, honor requested CRLF output in `MIME::QuotedPrint`, and cover URI Basic Auth byte-string userinfo (#1275, #1313, #1341).
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 05509103f6..8d4c0a4674 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1731,6 +1731,17 @@ private static void processDeferredBase(RuntimeBase base, boolean clearWeakRefsF
                 // have a legacy bridge count and retain the old compatibility
                 // sentinel behavior.
                 if (base.nativeCaptureOwnerCount() == 0) base.refCount = 1;
+            } else if (restoreRootedHashEntryOwnerCount(base)) {
+                // A hash-entry owner has a stable semantic slot identity even
+                // when an unrelated legacy scalar decrement consumes the
+                // selective count. Restore the count from independently owned
+                // hash slots that still lead from package roots. Hash entries
+                // are copied SV slots; borrowed array aliases are deliberately
+                // excluded here and remain on their legacy path.
+                //
+                // This is a migration bridge: the owner slot is authoritative
+                // for whether the entry still exists, while refCount remains
+                // the dispatch counter until all aggregate stores are migrated.
             } else if (base instanceof RuntimeCode code
                     && ReachabilityWalker.isCodeReachableFromRoots(code)) {
                 // A callback stored in a long-lived Perl container can have
@@ -1917,6 +1928,22 @@ && isReachableCached(base)) {
         }
     }
 
+    /** Restore legacy count for hash-entry owner slots still reachable from Perl roots. */
+    private static boolean restoreRootedHashEntryOwnerCount(RuntimeBase referent) {
+        int owners = 0;
+        for (PerlOwnerSlot slot : referent.ownerSlotSnapshot()) {
+            if (slot.kind() != PerlOwnerSlot.Kind.HASH_ENTRY) continue;
+            RuntimeBase owner = slot.ownerContainer();
+            if (owner instanceof RuntimeHash
+                    && ReachabilityWalker.isReachableFromRoots(owner, true, referent)) {
+                owners++;
+            }
+        }
+        if (owners == 0) return false;
+        referent.refCount = owners;
+        return true;
+    }
+
     private static boolean blessedClassHasDestroy(RuntimeBase base) {
         String className = NameNormalizer.getBlessStr(base.blessId);
         return className != null && DestroyDispatch.classHasDestroy(base.blessId, className);
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateOwnerSlotTest.java
new file mode 100644
index 0000000000..f3ef414f82
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateOwnerSlotTest.java
@@ -0,0 +1,75 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+@Tag("unit")
+class MortalListAggregateOwnerSlotTest {
+    @Test
+    void rootedHashEntrySlotRestoresAnUnderflowedLegacyCountUntilEntryRemoval() {
+        PerlRuntime runtime = new PerlRuntime();
+        String className = "MortalListAggregateOwnerSlotTest::Tracked";
+        String rootName = "MortalListAggregateOwnerSlotTest::root";
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            boolean previousActive = MortalList.isActive();
+            RuntimeHash referent = new RuntimeHash();
+            referent.blessId = NameNormalizer.getBlessId(className);
+            referent.refCount = 1;
+            installDestroy(className);
+
+            RuntimeScalar hashEntry = referenceTo(referent);
+            hashEntry.refCountOwned = true;
+            RuntimeHash root = new RuntimeHash();
+            root.elements.put("value", hashEntry);
+            GlobalVariable.globalHashes.put(rootName, root);
+
+            RuntimeScalar unrelatedLegacyOwner = referenceTo(referent);
+            unrelatedLegacyOwner.refCountOwned = true;
+            // Model the legacy selective count having missed this transient
+            // owner while the independently tracked package-rooted hash slot
+            // remains active.
+            referent.refCount = 1;
+
+            try {
+                MortalList.setActive(true);
+                MortalList.deferDecrementIfTracked(unrelatedLegacyOwner);
+                MortalList.flush();
+
+                assertEquals(RuntimeBase.PerlLifecycleState.LIVE,
+                        referent.perlLifecycleState(),
+                        "the rooted hash entry keeps the referent alive at legacy count zero");
+                assertEquals(1, referent.refCount,
+                        "the active hash slot restores one legacy bridge count");
+
+                RuntimeScalar removed = root.elements.remove("value");
+                MortalList.deferDecrementIfTracked(removed);
+                MortalList.flush();
+
+                assertEquals(RuntimeBase.PerlLifecycleState.DESTROYED,
+                        referent.perlLifecycleState(),
+                        "removing the final hash entry permits destruction");
+            } finally {
+                MortalList.setActive(previousActive);
+                GlobalVariable.globalHashes.remove(rootName);
+                GlobalVariable.removeGlobalCodeRefForStashDelete(className + "::DESTROY");
+            }
+        }
+    }
+
+    private static RuntimeScalar referenceTo(RuntimeBase referent) {
+        RuntimeScalar scalar = new RuntimeScalar();
+        scalar.type = RuntimeScalarType.HASHREFERENCE;
+        scalar.value = referent;
+        return scalar;
+    }
+
+    private static void installDestroy(String className) {
+        RuntimeCode code = new RuntimeCode((args, context) -> new RuntimeScalar().getList(), null);
+        int separator = className.lastIndexOf("::");
+        code.packageName = className.substring(0, separator);
+        code.subName = "DESTROY";
+        GlobalVariable.getGlobalCodeRef(className + "::DESTROY").set(new RuntimeScalar(code));
+    }
+}

From d0315f080cfdc78cf4b5974a7f9ab4460f5be6bd Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 18 Oct 2026 20:17:38 +0200
Subject: [PATCH 100/317] docs: record hash owner-slot lifecycle bridge

Record the tested rooted hash-entry underflow bridge and keep the remaining
array, alias, scalar, and proxy migration visible.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <chatgpt-codex@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 24bd91c286..8d24285074 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 is in progress in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816). PR head `9dd0b6f8d` is open as a draft with Ubuntu and Windows CI green. Its WebSocket controller release regression passes on blead Perl and the JVM backend; the interpreter uses the established `Test::Mojo` skip. The unchanged HTML-Tree 5.07 suite passes on the current candidate. Ordinary array/hash slots still use the legacy selective count as lifecycle authority.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 is in progress in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816). The current candidate adds a rooted hash-entry owner bridge when a deferred legacy decrement reaches zero; `nice -n 19 make` passes on it. The prior PR head `9dd0b6f8d` passed Ubuntu and Windows CI. The WebSocket controller release regression passes on blead Perl and JVM; the interpreter uses the established `Test::Mojo` skip. The unchanged HTML-Tree 5.07 suite passes. Hash-slot lifecycle still uses `RuntimeBase.refCount` as the dispatch counter, and array slots remain on the legacy path.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. At head `9dd0b6f8d`, both GitHub CI jobs pass. The local full `nice -n 19 make` gate passes on the same runtime and test tree. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl 5.45.4 and both PerlOnJava backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. The current `timeout 1800 ./jcpan -t HTML::Tree` run passes all 23 files and 989 tests, including unchanged `t/refloop.t`. The broad ownership rewrite remains incomplete: array/hash owner slots currently identify edges, while `RuntimeBase.refCount`, `refCountOwned`, and reachability cleanup remain authoritative for ordinary aggregate stores. Next: migrate an ordinary aggregate ownership path end to end, including scalar/proxy stores and lifecycle cleanup, then revalidate the unchanged HTML-Tree suite.
+The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. At head `9dd0b6f8d`, both GitHub CI jobs pass. The local full `nice -n 19 make` gate passes on the same runtime and test tree. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl 5.45.4 and both PerlOnJava backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. The current `timeout 1800 ./jcpan -t HTML::Tree` run passes all 23 files and 989 tests, including unchanged `t/refloop.t`. Commit `b802c938a` adds a first lifecycle use of ordinary hash-entry slot identities: when a deferred legacy decrement would otherwise hit zero, rooted `HASH_ENTRY` slots restore the compatibility count. `MortalListAggregateOwnerSlotTest` verifies retention until the last hash entry is removed, and the full `nice -n 19 make` gate passes in 15m25s. This bridge still dispatches through `refCount`; local hash slots, array slots, scalar/proxy stores, and alias cleanup are not migrated. Next: transfer hash-entry acquisition and release to slot-owned accounting, then extend the complete path to arrays and aliases.
 
 ### Completed
 

From 6009daf2d214d2d241ef74135e926075c2e4f025 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 18 Oct 2026 20:32:25 +0200
Subject: [PATCH 101/317] fix: preserve mixed owners during hash-slot count
 recovery

Associate aggregate owner identities with weak scalar-cell identities so
legacy-count recovery can avoid counting a hash cell twice while preserving
other live scalar owners. Include lexical container roots in the reachability
proof and cover a separate live lexical owner in the lifecycle regression.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <chatgpt-codex@users.noreply.github.com>
---
 .../runtime/runtimetypes/MortalList.java      | 30 +++++++++++++++----
 .../runtime/runtimetypes/PerlOwnerSlot.java   | 25 ++++++++++++++++
 .../runtime/runtimetypes/RuntimeArray.java    |  4 +--
 .../runtime/runtimetypes/RuntimeHash.java     |  8 ++---
 .../MortalListAggregateOwnerSlotTest.java     | 21 +++++++++++--
 5 files changed, 73 insertions(+), 15 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 8d4c0a4674..7eeaaf3431 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1731,11 +1731,11 @@ private static void processDeferredBase(RuntimeBase base, boolean clearWeakRefsF
                 // have a legacy bridge count and retain the old compatibility
                 // sentinel behavior.
                 if (base.nativeCaptureOwnerCount() == 0) base.refCount = 1;
-            } else if (restoreRootedHashEntryOwnerCount(base)) {
+            } else if (restoreReachableHashEntryOwnerCount(base)) {
                 // A hash-entry owner has a stable semantic slot identity even
                 // when an unrelated legacy scalar decrement consumes the
                 // selective count. Restore the count from independently owned
-                // hash slots that still lead from package roots. Hash entries
+                // hash slots that still lead from live Perl roots. Hash entries
                 // are copied SV slots; borrowed array aliases are deliberately
                 // excluded here and remain on their legacy path.
                 //
@@ -1929,16 +1929,34 @@ && isReachableCached(base)) {
     }
 
     /** Restore legacy count for hash-entry owner slots still reachable from Perl roots. */
-    private static boolean restoreRootedHashEntryOwnerCount(RuntimeBase referent) {
-        int owners = 0;
+    private static boolean restoreReachableHashEntryOwnerCount(RuntimeBase referent) {
+        Set<RuntimeScalar> rootedHashCells = Collections.newSetFromMap(new IdentityHashMap<>());
+        int slotsWithoutCell = 0;
         for (PerlOwnerSlot slot : referent.ownerSlotSnapshot()) {
             if (slot.kind() != PerlOwnerSlot.Kind.HASH_ENTRY) continue;
             RuntimeBase owner = slot.ownerContainer();
             if (owner instanceof RuntimeHash
-                    && ReachabilityWalker.isReachableFromRoots(owner, true, referent)) {
-                owners++;
+                    && (owner.semanticCaptureOwnerCount() > 0
+                    || (!owner.scopeExited && MyVarCleanupStack.isRegistered(owner))
+                    || ReachabilityWalker.isReachableFromRoots(owner, false, referent))) {
+                RuntimeScalar cell = slot.ownerCell();
+                if (cell == null) slotsWithoutCell++;
+                else rootedHashCells.add(cell);
             }
         }
+        int owners = slotsWithoutCell + rootedHashCells.size();
+        // Active scalar owners may include lexical RVs in addition to hash
+        // cells. Exclude cells already counted through their explicit slots,
+        // then add other still-reachable scalar owners to avoid losing them
+        // when restoring the mixed legacy/native count.
+        for (RuntimeScalar scalar : referent.activeOwnerSnapshot()) {
+            if (scalar == null || rootedHashCells.contains(scalar)
+                    || !scalar.refCountOwned || scalar.value != referent
+                    || !ReachabilityWalker.isScalarReachable(scalar)) {
+                continue;
+            }
+            owners++;
+        }
         if (owners == 0) return false;
         referent.refCount = owners;
         return true;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
index 96b0c49b9a..88e54c1317 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
@@ -26,6 +26,7 @@ public enum Kind {
     private final Kind kind;
     private final RuntimeScalar padCell;
     private final WeakReference<RuntimeBase> ownerContainer;
+    private volatile WeakReference<RuntimeScalar> ownerCell;
     private volatile RuntimeCode closureOwner;
     private final long identity = NEXT_ID.incrementAndGet();
     private RuntimeBase referent;
@@ -78,9 +79,15 @@ public PerlOwnerSlot(Kind kind) {
     }
 
     PerlOwnerSlot(Kind kind, RuntimeScalar padCell, RuntimeBase ownerContainer) {
+        this(kind, padCell, ownerContainer, null);
+    }
+
+    PerlOwnerSlot(Kind kind, RuntimeScalar padCell, RuntimeBase ownerContainer,
+                  RuntimeScalar ownerCell) {
         this.kind = Objects.requireNonNull(kind, "kind");
         this.padCell = padCell;
         this.ownerContainer = ownerContainer == null ? null : new WeakReference<>(ownerContainer);
+        this.ownerCell = ownerCell == null ? null : new WeakReference<>(ownerCell);
     }
 
     public Kind kind() {
@@ -99,6 +106,11 @@ RuntimeBase ownerContainer() {
         return ownerContainer == null ? null : ownerContainer.get();
     }
 
+    RuntimeScalar ownerCell() {
+        WeakReference<RuntimeScalar> reference = ownerCell;
+        return reference == null ? null : reference.get();
+    }
+
     boolean isNativeCaptureOwner() {
         return nativeCaptureOwner;
     }
@@ -160,17 +172,29 @@ public synchronized void acquireCapture(RuntimeBase target, RuntimeCode owner) {
 
     /** Attach this stable hash-entry slot to its current direct referent. */
     public synchronized void acquireHashEntry(RuntimeBase target) {
+        acquireHashEntry(target, null);
+    }
+
+    /** Attach this stable hash-entry slot to its current scalar cell and referent. */
+    public synchronized void acquireHashEntry(RuntimeBase target, RuntimeScalar cell) {
         if (kind != Kind.HASH_ENTRY) {
             throw new IllegalStateException("hash-entry acquisition requires a HASH_ENTRY slot");
         }
+        ownerCell = cell == null ? null : new WeakReference<>(cell);
         transferTo(target);
     }
 
     /** Attach this stable array-element slot to its current direct referent. */
     public synchronized void acquireArrayElement(RuntimeBase target) {
+        acquireArrayElement(target, null);
+    }
+
+    /** Attach this stable array-element slot to its current scalar cell and referent. */
+    public synchronized void acquireArrayElement(RuntimeBase target, RuntimeScalar cell) {
         if (kind != Kind.ARRAY_ELEMENT) {
             throw new IllegalStateException("array-element acquisition requires an ARRAY_ELEMENT slot");
         }
+        ownerCell = cell == null ? null : new WeakReference<>(cell);
         transferTo(target);
     }
 
@@ -225,6 +249,7 @@ public synchronized void release() {
         referent = null;
         ownerRuntime = null;
         ownerRuntimeState = null;
+        ownerCell = null;
         if (previous != null) previous.removeOwnerSlot(this);
         if (previous != null) PerlRuntime.releaseOwnerSlotReferent(previousState, previous);
     }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
index 74e4702cc8..7f96995ddc 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
@@ -714,10 +714,10 @@ private void syncArrayElementOwnerSlot(int index) {
             arrayElementOwnerSlots.set(index, null);
         } else {
             if (slot == null) {
-                slot = new PerlOwnerSlot(PerlOwnerSlot.Kind.ARRAY_ELEMENT, null, this);
+                slot = new PerlOwnerSlot(PerlOwnerSlot.Kind.ARRAY_ELEMENT, null, this, scalar);
                 arrayElementOwnerSlots.set(index, slot);
             }
-            slot.acquireArrayElement(referent);
+            slot.acquireArrayElement(referent, scalar);
         }
     }
 
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java
index ccc26fd7cb..c273769e86 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java
@@ -693,8 +693,8 @@ private void updateHashEntryOwner(String key, RuntimeScalar previous, RuntimeSca
             return;
         }
         PerlOwnerSlot slot = hashEntryOwnerSlots.computeIfAbsent(key,
-                ignored -> new PerlOwnerSlot(PerlOwnerSlot.Kind.HASH_ENTRY, null, this));
-        slot.acquireHashEntry(directReferent(value));
+                ignored -> new PerlOwnerSlot(PerlOwnerSlot.Kind.HASH_ENTRY, null, this, value));
+        slot.acquireHashEntry(directReferent(value), value);
     }
 
     private void detachHashCellIfAbsent(RuntimeScalar scalar) {
@@ -744,8 +744,8 @@ void updateHashEntryOwnersForScalar(RuntimeScalar scalar, RuntimeBase oldReferen
                 continue;
             }
             PerlOwnerSlot slot = hashEntryOwnerSlots.computeIfAbsent(entry.getKey(),
-                    ignored -> new PerlOwnerSlot(PerlOwnerSlot.Kind.HASH_ENTRY, null, this));
-            slot.acquireHashEntry(nextReferent);
+                    ignored -> new PerlOwnerSlot(PerlOwnerSlot.Kind.HASH_ENTRY, null, this, scalar));
+            slot.acquireHashEntry(nextReferent, scalar);
         }
     }
 
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateOwnerSlotTest.java
index f3ef414f82..56c8daf514 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateOwnerSlotTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateOwnerSlotTest.java
@@ -21,10 +21,16 @@ void rootedHashEntrySlotRestoresAnUnderflowedLegacyCountUntilEntryRemoval() {
 
             RuntimeScalar hashEntry = referenceTo(referent);
             hashEntry.refCountOwned = true;
+            referent.recordActiveOwner(hashEntry);
             RuntimeHash root = new RuntimeHash();
             root.elements.put("value", hashEntry);
             GlobalVariable.globalHashes.put(rootName, root);
 
+            RuntimeScalar lexicalOwner = referenceTo(referent);
+            lexicalOwner.refCountOwned = true;
+            referent.recordActiveOwner(lexicalOwner);
+            MyVarCleanupStack.register(lexicalOwner);
+
             RuntimeScalar unrelatedLegacyOwner = referenceTo(referent);
             unrelatedLegacyOwner.refCountOwned = true;
             // Model the legacy selective count having missed this transient
@@ -40,18 +46,27 @@ void rootedHashEntrySlotRestoresAnUnderflowedLegacyCountUntilEntryRemoval() {
                 assertEquals(RuntimeBase.PerlLifecycleState.LIVE,
                         referent.perlLifecycleState(),
                         "the rooted hash entry keeps the referent alive at legacy count zero");
-                assertEquals(1, referent.refCount,
-                        "the active hash slot restores one legacy bridge count");
+                assertEquals(2, referent.refCount,
+                        "the active hash slot and separate lexical owner are both restored");
 
                 RuntimeScalar removed = root.elements.remove("value");
                 MortalList.deferDecrementIfTracked(removed);
                 MortalList.flush();
 
+                assertEquals(RuntimeBase.PerlLifecycleState.LIVE,
+                        referent.perlLifecycleState(),
+                        "removing the hash entry preserves the separate lexical owner");
+                assertEquals(1, referent.refCount);
+
+                MortalList.deferDecrementIfTracked(lexicalOwner);
+                MortalList.flush();
+
                 assertEquals(RuntimeBase.PerlLifecycleState.DESTROYED,
                         referent.perlLifecycleState(),
-                        "removing the final hash entry permits destruction");
+                        "releasing the final lexical owner permits destruction");
             } finally {
                 MortalList.setActive(previousActive);
+                MyVarCleanupStack.unregister(lexicalOwner);
                 GlobalVariable.globalHashes.remove(rootName);
                 GlobalVariable.removeGlobalCodeRefForStashDelete(className + "::DESTROY");
             }

From 507dd5313b7e12638721599e75aff289042066d5 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 18 Oct 2026 21:05:29 +0200
Subject: [PATCH 102/317] fix: restrict hash owner rescue to real roots

Require package-root reachability, a directly registered live hash lexical,
or a live closure capture before restoring an aggregate slot count. This
prevents a local diagnostic graph from becoming a false root during DBIx
cycle cleanup. Activate scalar-owner tracking in the mixed-owner regression.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <chatgpt-codex@users.noreply.github.com>
---
 .../java/org/perlonjava/runtime/runtimetypes/MortalList.java   | 2 +-
 .../runtime/runtimetypes/MortalListAggregateOwnerSlotTest.java | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 7eeaaf3431..de56f6639a 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1938,7 +1938,7 @@ private static boolean restoreReachableHashEntryOwnerCount(RuntimeBase referent)
             if (owner instanceof RuntimeHash
                     && (owner.semanticCaptureOwnerCount() > 0
                     || (!owner.scopeExited && MyVarCleanupStack.isRegistered(owner))
-                    || ReachabilityWalker.isReachableFromRoots(owner, false, referent))) {
+                    || ReachabilityWalker.isReachableFromRoots(owner, true, referent))) {
                 RuntimeScalar cell = slot.ownerCell();
                 if (cell == null) slotsWithoutCell++;
                 else rootedHashCells.add(cell);
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateOwnerSlotTest.java
index 56c8daf514..8b527e28d3 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateOwnerSlotTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateOwnerSlotTest.java
@@ -21,13 +21,14 @@ void rootedHashEntrySlotRestoresAnUnderflowedLegacyCountUntilEntryRemoval() {
 
             RuntimeScalar hashEntry = referenceTo(referent);
             hashEntry.refCountOwned = true;
-            referent.recordActiveOwner(hashEntry);
             RuntimeHash root = new RuntimeHash();
             root.elements.put("value", hashEntry);
             GlobalVariable.globalHashes.put(rootName, root);
 
             RuntimeScalar lexicalOwner = referenceTo(referent);
             lexicalOwner.refCountOwned = true;
+            referent.activateOwnerTracking();
+            referent.recordActiveOwner(hashEntry);
             referent.recordActiveOwner(lexicalOwner);
             MyVarCleanupStack.register(lexicalOwner);
 

From 1fa788046163c9802a638068f4ee374f40231550 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 18 Oct 2026 21:49:00 +0200
Subject: [PATCH 103/317] docs: update ownership bridge validation

Record the final mixed-owner recovery behavior and the successful local and
HTML::Tree gates for the current PR candidate.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 8d24285074..9217827c5b 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. At head `9dd0b6f8d`, both GitHub CI jobs pass. The local full `nice -n 19 make` gate passes on the same runtime and test tree. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl 5.45.4 and both PerlOnJava backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. The current `timeout 1800 ./jcpan -t HTML::Tree` run passes all 23 files and 989 tests, including unchanged `t/refloop.t`. Commit `b802c938a` adds a first lifecycle use of ordinary hash-entry slot identities: when a deferred legacy decrement would otherwise hit zero, rooted `HASH_ENTRY` slots restore the compatibility count. `MortalListAggregateOwnerSlotTest` verifies retention until the last hash entry is removed, and the full `nice -n 19 make` gate passes in 15m25s. This bridge still dispatches through `refCount`; local hash slots, array slots, scalar/proxy stores, and alias cleanup are not migrated. Next: transfer hash-entry acquisition and release to slot-owned accounting, then extend the complete path to arrays and aliases.
+The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. At head `9dd0b6f8d`, both GitHub CI jobs pass; the later candidate commits are awaiting publication and CI. The local full `nice -n 19 make` gate passes at `de3248174` (11m30s). The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl 5.45.4 and both PerlOnJava backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. The `timeout 1800 ./jcpan -t HTML::Tree` run on `de3248174` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. Weak owner-cell references prevent the bookkeeping from creating scalar/container cycles, and root checks exclude diagnostic-only local graphs. `MortalListAggregateOwnerSlotTest` verifies retention until the last hash entry is removed while another scalar owner remains, then destruction after that owner is released. The full gate passes with this test and the DBIx deep-cycle weak-shift regression. This remains a recovery bridge: `refCount` still controls dispatch, and ordinary array slots, scalar/proxy stores, and alias cleanup are not migrated. Next: move hash-entry acquisition and release to slot-owned accounting, then extend the complete path to arrays and aliases.
 
 ### Completed
 

From c26368dfd54f8073c046005e4d634f94e207ef0e Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 18 Oct 2026 22:36:47 +0200
Subject: [PATCH 104/317] docs: update ownership migration status

Record the current full-gate result and the remaining array owner proof
requirement for the lifecycle recovery path.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 9217827c5b..613400563d 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. At head `9dd0b6f8d`, both GitHub CI jobs pass; the later candidate commits are awaiting publication and CI. The local full `nice -n 19 make` gate passes at `de3248174` (11m30s). The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl 5.45.4 and both PerlOnJava backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. The `timeout 1800 ./jcpan -t HTML::Tree` run on `de3248174` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. Weak owner-cell references prevent the bookkeeping from creating scalar/container cycles, and root checks exclude diagnostic-only local graphs. `MortalListAggregateOwnerSlotTest` verifies retention until the last hash entry is removed while another scalar owner remains, then destruction after that owner is released. The full gate passes with this test and the DBIx deep-cycle weak-shift regression. This remains a recovery bridge: `refCount` still controls dispatch, and ordinary array slots, scalar/proxy stores, and alias cleanup are not migrated. Next: move hash-entry acquisition and release to slot-owned accounting, then extend the complete path to arrays and aliases.
+The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. At head `9dd0b6f8d`, both GitHub CI jobs pass; the later candidate commits are awaiting publication and CI. The latest full `nice -n 19 make` passes on the restored candidate checkout (10m36s). The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl 5.45.4 and both PerlOnJava backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. The `timeout 1800 ./jcpan -t HTML::Tree` run on `de3248174` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. Weak owner-cell references prevent the bookkeeping from creating scalar/container cycles, and root checks exclude diagnostic-only local graphs. `MortalListAggregateOwnerSlotTest` verifies retention until the last hash entry is removed while another scalar owner remains, then destruction after that owner is released. The full gate passes with this test and the DBIx deep-cycle weak-shift regression. This remains a recovery bridge: `refCount` still controls dispatch, and ordinary array slots, scalar/proxy stores, and alias cleanup are not migrated. Array-slot recovery must preserve the existing weak-cycle and closure-pad release behavior before it can join this path. Next: move hash-entry acquisition and release to slot-owned accounting, then extend the complete path to arrays and aliases.
 
 ### Completed
 

From 031d807467a17c767f0b38220bd6cd66680430fc Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 18 Oct 2026 23:44:31 +0200
Subject: [PATCH 105/317] fix: restore directly rooted array element owners

Count strong cells in package-rooted array slots when a deferred legacy
release would otherwise consume the final compatibility count. Exclude weak
cells and require a direct package-root proof for arrays. Add regression
coverage for retention, release, and weak-slot exclusion.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md          |  2 +-
 docs/about/changelog.md                       |  2 +-
 .../runtime/runtimetypes/MortalList.java      | 30 +++++-
 ...MortalListAggregateArrayOwnerSlotTest.java | 98 +++++++++++++++++++
 4 files changed, 125 insertions(+), 7 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateArrayOwnerSlotTest.java

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 613400563d..f492d020c4 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. At head `9dd0b6f8d`, both GitHub CI jobs pass; the later candidate commits are awaiting publication and CI. The latest full `nice -n 19 make` passes on the restored candidate checkout (10m36s). The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl 5.45.4 and both PerlOnJava backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. The `timeout 1800 ./jcpan -t HTML::Tree` run on `de3248174` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. Weak owner-cell references prevent the bookkeeping from creating scalar/container cycles, and root checks exclude diagnostic-only local graphs. `MortalListAggregateOwnerSlotTest` verifies retention until the last hash entry is removed while another scalar owner remains, then destruction after that owner is released. The full gate passes with this test and the DBIx deep-cycle weak-shift regression. This remains a recovery bridge: `refCount` still controls dispatch, and ordinary array slots, scalar/proxy stores, and alias cleanup are not migrated. Array-slot recovery must preserve the existing weak-cycle and closure-pad release behavior before it can join this path. Next: move hash-entry acquisition and release to slot-owned accounting, then extend the complete path to arrays and aliases.
+The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. At head `9dd0b6f8d`, both GitHub CI jobs pass; the later candidate commits are awaiting publication and CI. The full `nice -n 19 make` passes on the current package-root array candidate in 10m43s. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl 5.45.4 and both PerlOnJava backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. The `timeout 1800 ./jcpan -t HTML::Tree` run on `de3248174` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing that element, and confirms a package-rooted weak slot does not inflate the restored count. The full gate confirms DBIx weak-cycle and captured-pad cleanup remain intact. Weak owner-cell references prevent the bookkeeping from creating scalar/container cycles, and weak references and transitively reachable arrays do not count as strong owners. This remains a recovery bridge: `refCount` still controls dispatch, and nested/local array slots, scalar/proxy stores, and alias cleanup are not migrated. Next: migrate array slot acquisition and release through complete ownership paths, then handle scalar/proxy stores and aliases.
 
 ### Completed
 
diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index 3aad394d90..fa425066fa 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -42,7 +42,7 @@ priorities and future plans.
 - Preserve inherited method dispatch in child threads.
 - Prefer exact root-module package declarations over earlier helper packages, and warn for undefined hash keys used by `exists` and `delete` (#1820, #1645).
 - Add a reproducible, warmup-aware Perl versus PerlOnJava performance runner (#1196).
-- Preserve CODE callback captures while Perl container slots still own the callback; restore rooted hash-entry owners when a legacy deferred decrement undercounts them; release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; avoid false global-destruction resurrection warnings when bounded owner proofs scan large package graphs; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
+- Preserve CODE callback captures while Perl container slots still own the callback; restore rooted hash-entry and package-rooted array-element owners when a legacy deferred decrement undercounts them; release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; avoid false global-destruction resurrection warnings when bounded owner proofs scan large package graphs; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
 - Cover FormState session restoration across requests and HTTP response conversion from callback and streaming PSGI responses; refresh HTTP::Message and LWP compatibility status (#1650, #1651, #1652).
 - Preserve the awaited Future value when its source scalar or aggregate slot changes during suspension, covering PAGI::Server request-body receives (#1818).
 - Preserve escaped byte strings in interpreter closures and `bytes::substr`, honor requested CRLF output in `MIME::QuotedPrint`, and cover URI Basic Auth byte-string userinfo (#1275, #1313, #1341).
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index de56f6639a..ba605c5849 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1935,13 +1935,33 @@ private static boolean restoreReachableHashEntryOwnerCount(RuntimeBase referent)
         for (PerlOwnerSlot slot : referent.ownerSlotSnapshot()) {
             if (slot.kind() != PerlOwnerSlot.Kind.HASH_ENTRY) continue;
             RuntimeBase owner = slot.ownerContainer();
-            if (owner instanceof RuntimeHash
+            boolean rootedOwner = owner instanceof RuntimeHash
                     && (owner.semanticCaptureOwnerCount() > 0
                     || (!owner.scopeExited && MyVarCleanupStack.isRegistered(owner))
-                    || ReachabilityWalker.isReachableFromRoots(owner, true, referent))) {
-                RuntimeScalar cell = slot.ownerCell();
-                if (cell == null) slotsWithoutCell++;
-                else rootedHashCells.add(cell);
+                    || ReachabilityWalker.isReachableFromRoots(owner, true, referent));
+            if (!rootedOwner) continue;
+            RuntimeScalar cell = slot.ownerCell();
+            if (cell == null) {
+                slotsWithoutCell++;
+            } else if (cell.value == referent && cell.refCountOwned
+                    && !WeakRefRegistry.isweak(cell)) {
+                rootedHashCells.add(cell);
+            }
+        }
+        // Arrays need a stricter proof than hashes here. A transitive root walk
+        // can cross closure pads or diagnostic cycles and outlive the Perl
+        // element owner. A directly package-rooted array is an unambiguous
+        // owner when its current scalar cell is a strong reference.
+        for (PerlOwnerSlot slot : referent.ownerSlotSnapshot()) {
+            if (slot.kind() != PerlOwnerSlot.Kind.ARRAY_ELEMENT) continue;
+            RuntimeBase owner = slot.ownerContainer();
+            if (!(owner instanceof RuntimeArray array) || !array.isPackageGlobalRoot) continue;
+            RuntimeScalar cell = slot.ownerCell();
+            if (cell == null) {
+                slotsWithoutCell++;
+            } else if (cell.value == referent && cell.refCountOwned
+                    && !WeakRefRegistry.isweak(cell)) {
+                rootedHashCells.add(cell);
             }
         }
         int owners = slotsWithoutCell + rootedHashCells.size();
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateArrayOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateArrayOwnerSlotTest.java
new file mode 100644
index 0000000000..41573d7870
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateArrayOwnerSlotTest.java
@@ -0,0 +1,98 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+@Tag("unit")
+class MortalListAggregateArrayOwnerSlotTest {
+    @Test
+    void directlyRootedArrayElementRestoresItsStrongOwnerAtLegacyZero() {
+        PerlRuntime runtime = new PerlRuntime();
+        String className = "MortalListAggregateArrayOwnerSlotTest::Tracked";
+        String rootName = "MortalListAggregateArrayOwnerSlotTest::root";
+        String weakRootName = "MortalListAggregateArrayOwnerSlotTest::weak_root";
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            boolean previousActive = MortalList.isActive();
+            RuntimeHash referent = new RuntimeHash();
+            referent.blessId = NameNormalizer.getBlessId(className);
+            referent.refCount = 1;
+            installDestroy(className);
+
+            RuntimeArray root = new RuntimeArray();
+            root.push(referenceTo(referent));
+            GlobalVariable.aliasGlobalArray(rootName, root);
+            RuntimeArray weakRoot = new RuntimeArray();
+            weakRoot.push(referenceTo(referent));
+            RuntimeScalar weakEntry = weakRoot.elements.get(0);
+            WeakRefRegistry.weaken(weakEntry);
+            GlobalVariable.aliasGlobalArray(weakRootName, weakRoot);
+
+            RuntimeScalar lexicalOwner = referenceTo(referent);
+            lexicalOwner.refCountOwned = true;
+            referent.activateOwnerTracking();
+            referent.recordActiveOwner(lexicalOwner);
+            MyVarCleanupStack.register(lexicalOwner);
+
+            RuntimeScalar unrelatedLegacyOwner = referenceTo(referent);
+            unrelatedLegacyOwner.refCountOwned = true;
+            referent.refCount = 1;
+
+            try {
+                MortalList.setActive(true);
+                MortalList.deferDecrementIfTracked(unrelatedLegacyOwner);
+                MortalList.flush();
+
+                assertEquals(RuntimeBase.PerlLifecycleState.LIVE,
+                        referent.perlLifecycleState(),
+                        "a package-rooted strong array element retains its referent");
+                assertEquals(2, referent.refCount,
+                        "the strong array element and lexical owner are restored, but not the weak slot");
+
+                // Keep the weak edge in place for the count assertion, then
+                // remove its diagnostic root before proving final destruction.
+                weakRoot.elements.clear();
+                GlobalVariable.globalArrays.remove(weakRootName);
+                WeakRefRegistry.clearWeakRefsTo(referent);
+
+                RuntimeScalar removed = root.elements.remove(0);
+                MortalList.deferDecrementIfTracked(removed);
+                MortalList.flush();
+
+                assertEquals(RuntimeBase.PerlLifecycleState.LIVE,
+                        referent.perlLifecycleState(),
+                        "removing the array element preserves the lexical owner");
+                assertEquals(1, referent.refCount);
+
+                MortalList.deferDecrementIfTracked(lexicalOwner);
+                MortalList.flush();
+
+                assertEquals(RuntimeBase.PerlLifecycleState.DESTROYED,
+                        referent.perlLifecycleState(),
+                        "releasing the final owner permits destruction");
+            } finally {
+                MortalList.setActive(previousActive);
+                MyVarCleanupStack.unregister(lexicalOwner);
+                GlobalVariable.globalArrays.remove(rootName);
+                GlobalVariable.globalArrays.remove(weakRootName);
+                GlobalVariable.removeGlobalCodeRefForStashDelete(className + "::DESTROY");
+            }
+        }
+    }
+
+    private static RuntimeScalar referenceTo(RuntimeBase referent) {
+        RuntimeScalar scalar = new RuntimeScalar();
+        scalar.type = RuntimeScalarType.HASHREFERENCE;
+        scalar.value = referent;
+        return scalar;
+    }
+
+    private static void installDestroy(String className) {
+        RuntimeCode code = new RuntimeCode((args, context) -> new RuntimeScalar().getList(), null);
+        int separator = className.lastIndexOf("::");
+        code.packageName = className.substring(0, separator);
+        code.subName = "DESTROY";
+        GlobalVariable.getGlobalCodeRef(className + "::DESTROY").set(new RuntimeScalar(code));
+    }
+}

From 6b87f3d576620a62d10fc73305c4bdcd533ffc94 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 00:07:23 +0200
Subject: [PATCH 106/317] test: exclude weak aggregate cells from owner
 recovery

Exercise rooted weak array and hash slots alongside a strong array owner,
verifying they do not inflate the recovered compatibility count.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 .../MortalListAggregateArrayOwnerSlotTest.java        | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateArrayOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateArrayOwnerSlotTest.java
index 41573d7870..dbad9025bc 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateArrayOwnerSlotTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateArrayOwnerSlotTest.java
@@ -13,6 +13,7 @@ void directlyRootedArrayElementRestoresItsStrongOwnerAtLegacyZero() {
         String className = "MortalListAggregateArrayOwnerSlotTest::Tracked";
         String rootName = "MortalListAggregateArrayOwnerSlotTest::root";
         String weakRootName = "MortalListAggregateArrayOwnerSlotTest::weak_root";
+        String weakHashName = "MortalListAggregateArrayOwnerSlotTest::weak_hash";
         try (PerlRuntime.Binding ignored = runtime.bind()) {
             boolean previousActive = MortalList.isActive();
             RuntimeHash referent = new RuntimeHash();
@@ -28,6 +29,11 @@ void directlyRootedArrayElementRestoresItsStrongOwnerAtLegacyZero() {
             RuntimeScalar weakEntry = weakRoot.elements.get(0);
             WeakRefRegistry.weaken(weakEntry);
             GlobalVariable.aliasGlobalArray(weakRootName, weakRoot);
+            RuntimeHash weakHash = new RuntimeHash();
+            RuntimeScalar weakHashEntry = referenceTo(referent);
+            weakHash.elements.put("value", weakHashEntry);
+            WeakRefRegistry.weaken(weakHashEntry);
+            GlobalVariable.aliasGlobalHash(weakHashName, weakHash);
 
             RuntimeScalar lexicalOwner = referenceTo(referent);
             lexicalOwner.refCountOwned = true;
@@ -48,12 +54,14 @@ void directlyRootedArrayElementRestoresItsStrongOwnerAtLegacyZero() {
                         referent.perlLifecycleState(),
                         "a package-rooted strong array element retains its referent");
                 assertEquals(2, referent.refCount,
-                        "the strong array element and lexical owner are restored, but not the weak slot");
+                        "only the strong array element and lexical owner are restored");
 
                 // Keep the weak edge in place for the count assertion, then
                 // remove its diagnostic root before proving final destruction.
                 weakRoot.elements.clear();
                 GlobalVariable.globalArrays.remove(weakRootName);
+                weakHash.elements.clear();
+                GlobalVariable.globalHashes.remove(weakHashName);
                 WeakRefRegistry.clearWeakRefsTo(referent);
 
                 RuntimeScalar removed = root.elements.remove(0);
@@ -76,6 +84,7 @@ void directlyRootedArrayElementRestoresItsStrongOwnerAtLegacyZero() {
                 MyVarCleanupStack.unregister(lexicalOwner);
                 GlobalVariable.globalArrays.remove(rootName);
                 GlobalVariable.globalArrays.remove(weakRootName);
+                GlobalVariable.globalHashes.remove(weakHashName);
                 GlobalVariable.removeGlobalCodeRefForStashDelete(className + "::DESTROY");
             }
         }

From 7d95b932b4516105b411083720d776e8e9802415 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 00:29:52 +0200
Subject: [PATCH 107/317] fix: recognize registered lexical array owners

Restore strong array elements held by active registered lexical arrays,
while keeping transitive roots and weak cells out of the recovery count.
Extend the lifecycle regression to cover package and lexical roots.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md          |  2 +-
 docs/about/changelog.md                       |  2 +-
 .../runtime/runtimetypes/MortalList.java      |  4 +++-
 ...MortalListAggregateArrayOwnerSlotTest.java | 20 ++++++++++++++-----
 4 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index f492d020c4..806e648ea1 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. At head `9dd0b6f8d`, both GitHub CI jobs pass; the later candidate commits are awaiting publication and CI. The full `nice -n 19 make` passes on the current package-root array candidate in 10m43s. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl 5.45.4 and both PerlOnJava backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. The `timeout 1800 ./jcpan -t HTML::Tree` run on `de3248174` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing that element, and confirms a package-rooted weak slot does not inflate the restored count. The full gate confirms DBIx weak-cycle and captured-pad cleanup remain intact. Weak owner-cell references prevent the bookkeeping from creating scalar/container cycles, and weak references and transitively reachable arrays do not count as strong owners. This remains a recovery bridge: `refCount` still controls dispatch, and nested/local array slots, scalar/proxy stores, and alias cleanup are not migrated. Next: migrate array slot acquisition and release through complete ownership paths, then handle scalar/proxy stores and aliases.
+The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. At head `9dd0b6f8d`, both GitHub CI jobs pass; the later candidate commits are awaiting publication and CI. The full `nice -n 19 make` passes on the current aggregate-slot candidate in 10m49s. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl 5.45.4 and both PerlOnJava backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. The `timeout 1800 ./jcpan -t HTML::Tree` run on `de3248174` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays and live registered lexical arrays; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing each element, and confirms rooted weak hash/array slots do not inflate the restored count. The full gate confirms DBIx weak-cycle and captured-pad cleanup remain intact. Weak owner-cell references prevent the bookkeeping from creating scalar/container cycles, and weak references and transitively reachable arrays do not count as strong owners. This remains a recovery bridge: `refCount` still controls dispatch, and unregistered/transitively rooted arrays, scalar/proxy stores, and alias cleanup are not migrated. Next: migrate array slot acquisition and release through complete ownership paths, then handle scalar/proxy stores and aliases.
 
 ### Completed
 
diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index fa425066fa..06334f5acd 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -42,7 +42,7 @@ priorities and future plans.
 - Preserve inherited method dispatch in child threads.
 - Prefer exact root-module package declarations over earlier helper packages, and warn for undefined hash keys used by `exists` and `delete` (#1820, #1645).
 - Add a reproducible, warmup-aware Perl versus PerlOnJava performance runner (#1196).
-- Preserve CODE callback captures while Perl container slots still own the callback; restore rooted hash-entry and package-rooted array-element owners when a legacy deferred decrement undercounts them; release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; avoid false global-destruction resurrection warnings when bounded owner proofs scan large package graphs; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
+- Preserve CODE callback captures while Perl container slots still own the callback; restore rooted hash-entry and package-rooted or registered lexical array-element owners when a legacy deferred decrement undercounts them; release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; avoid false global-destruction resurrection warnings when bounded owner proofs scan large package graphs; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
 - Cover FormState session restoration across requests and HTTP response conversion from callback and streaming PSGI responses; refresh HTTP::Message and LWP compatibility status (#1650, #1651, #1652).
 - Preserve the awaited Future value when its source scalar or aggregate slot changes during suspension, covering PAGI::Server request-body receives (#1818).
 - Preserve escaped byte strings in interpreter closures and `bytes::substr`, honor requested CRLF output in `MIME::QuotedPrint`, and cover URI Basic Auth byte-string userinfo (#1275, #1313, #1341).
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index ba605c5849..b000ce3622 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1955,7 +1955,9 @@ private static boolean restoreReachableHashEntryOwnerCount(RuntimeBase referent)
         for (PerlOwnerSlot slot : referent.ownerSlotSnapshot()) {
             if (slot.kind() != PerlOwnerSlot.Kind.ARRAY_ELEMENT) continue;
             RuntimeBase owner = slot.ownerContainer();
-            if (!(owner instanceof RuntimeArray array) || !array.isPackageGlobalRoot) continue;
+            if (!(owner instanceof RuntimeArray array)
+                    || (!array.isPackageGlobalRoot
+                    && (array.scopeExited || !MyVarCleanupStack.isRegistered(array)))) continue;
             RuntimeScalar cell = slot.ownerCell();
             if (cell == null) {
                 slotsWithoutCell++;
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateArrayOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateArrayOwnerSlotTest.java
index dbad9025bc..fa05f0670e 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateArrayOwnerSlotTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateArrayOwnerSlotTest.java
@@ -24,6 +24,9 @@ void directlyRootedArrayElementRestoresItsStrongOwnerAtLegacyZero() {
             RuntimeArray root = new RuntimeArray();
             root.push(referenceTo(referent));
             GlobalVariable.aliasGlobalArray(rootName, root);
+            RuntimeArray lexicalRoot = new RuntimeArray();
+            lexicalRoot.push(referenceTo(referent));
+            MyVarCleanupStack.register(lexicalRoot);
             RuntimeArray weakRoot = new RuntimeArray();
             weakRoot.push(referenceTo(referent));
             RuntimeScalar weakEntry = weakRoot.elements.get(0);
@@ -53,8 +56,8 @@ void directlyRootedArrayElementRestoresItsStrongOwnerAtLegacyZero() {
                 assertEquals(RuntimeBase.PerlLifecycleState.LIVE,
                         referent.perlLifecycleState(),
                         "a package-rooted strong array element retains its referent");
-                assertEquals(2, referent.refCount,
-                        "only the strong array element and lexical owner are restored");
+                assertEquals(3, referent.refCount,
+                        "both rooted strong array elements and the lexical owner are restored");
 
                 // Keep the weak edge in place for the count assertion, then
                 // remove its diagnostic root before proving final destruction.
@@ -69,9 +72,15 @@ void directlyRootedArrayElementRestoresItsStrongOwnerAtLegacyZero() {
                 MortalList.flush();
 
                 assertEquals(RuntimeBase.PerlLifecycleState.LIVE,
-                        referent.perlLifecycleState(),
-                        "removing the array element preserves the lexical owner");
-                assertEquals(1, referent.refCount);
+                        referent.perlLifecycleState());
+                assertEquals(2, referent.refCount,
+                        "the registered lexical array and scalar owner remain");
+
+                RuntimeScalar lexicalArrayEntry = lexicalRoot.elements.remove(0);
+                MortalList.deferDecrementIfTracked(lexicalArrayEntry);
+                MortalList.flush();
+                assertEquals(1, referent.refCount,
+                        "removing the lexical array element preserves the scalar owner");
 
                 MortalList.deferDecrementIfTracked(lexicalOwner);
                 MortalList.flush();
@@ -82,6 +91,7 @@ void directlyRootedArrayElementRestoresItsStrongOwnerAtLegacyZero() {
             } finally {
                 MortalList.setActive(previousActive);
                 MyVarCleanupStack.unregister(lexicalOwner);
+                MyVarCleanupStack.unregister(lexicalRoot);
                 GlobalVariable.globalArrays.remove(rootName);
                 GlobalVariable.globalArrays.remove(weakRootName);
                 GlobalVariable.globalHashes.remove(weakHashName);

From 2acd5f0f907cf730ab0d6eb2199145726aca8fe0 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 01:35:49 +0200
Subject: [PATCH 108/317] fix: retain captured array element owners

Count strong element cells in semantic closure-captured arrays while excluding
transitive graph reachability. Extend the owner-slot regression to release a
captured array and preserve existing weak-cycle and closure-pad behavior.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md               |  2 +-
 docs/about/changelog.md                            |  2 +-
 .../runtime/runtimetypes/MortalList.java           |  3 ++-
 .../MortalListAggregateArrayOwnerSlotTest.java     | 14 ++++++++------
 4 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 806e648ea1..790f9924b5 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. At head `9dd0b6f8d`, both GitHub CI jobs pass; the later candidate commits are awaiting publication and CI. The full `nice -n 19 make` passes on the current aggregate-slot candidate in 10m49s. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl 5.45.4 and both PerlOnJava backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. The `timeout 1800 ./jcpan -t HTML::Tree` run on `de3248174` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays and live registered lexical arrays; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing each element, and confirms rooted weak hash/array slots do not inflate the restored count. The full gate confirms DBIx weak-cycle and captured-pad cleanup remain intact. Weak owner-cell references prevent the bookkeeping from creating scalar/container cycles, and weak references and transitively reachable arrays do not count as strong owners. This remains a recovery bridge: `refCount` still controls dispatch, and unregistered/transitively rooted arrays, scalar/proxy stores, and alias cleanup are not migrated. Next: migrate array slot acquisition and release through complete ownership paths, then handle scalar/proxy stores and aliases.
+The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. The open draft PR remote head is `df06b9e3a`: Ubuntu passes, while Windows fails `io_select_nested_process_handle.t`; master passed that test in its latest Windows run, which failed elsewhere. The current local candidate still needs remote CI after publication. The full `nice -n 19 make` passes on the current aggregate-slot candidate in 12m12s. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl 5.45.4 and both PerlOnJava backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. The `timeout 1800 ./jcpan -t HTML::Tree` run on `de3248174` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays, live registered lexical arrays, and semantic closure-captured arrays; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing each element, and confirms rooted weak hash/array slots do not inflate the restored count. The full gate confirms DBIx weak-cycle and captured-pad cleanup remain intact. Weak owner-cell references prevent the bookkeeping from creating scalar/container cycles, and weak references and transitively reachable arrays do not count as strong owners. This remains a recovery bridge: `refCount` still controls dispatch, and unregistered/transitively rooted arrays, scalar/proxy stores, and alias cleanup are not migrated. Next: migrate array slot acquisition and release through complete ownership paths, then handle scalar/proxy stores and aliases.
 
 ### Completed
 
diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index 06334f5acd..c7c66ccbb4 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -42,7 +42,7 @@ priorities and future plans.
 - Preserve inherited method dispatch in child threads.
 - Prefer exact root-module package declarations over earlier helper packages, and warn for undefined hash keys used by `exists` and `delete` (#1820, #1645).
 - Add a reproducible, warmup-aware Perl versus PerlOnJava performance runner (#1196).
-- Preserve CODE callback captures while Perl container slots still own the callback; restore rooted hash-entry and package-rooted or registered lexical array-element owners when a legacy deferred decrement undercounts them; release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; avoid false global-destruction resurrection warnings when bounded owner proofs scan large package graphs; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
+- Preserve CODE callback captures while Perl container slots still own the callback; restore rooted hash-entry and package-rooted, registered lexical, or closure-captured array-element owners when a legacy deferred decrement undercounts them; release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; avoid false global-destruction resurrection warnings when bounded owner proofs scan large package graphs; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
 - Cover FormState session restoration across requests and HTTP response conversion from callback and streaming PSGI responses; refresh HTTP::Message and LWP compatibility status (#1650, #1651, #1652).
 - Preserve the awaited Future value when its source scalar or aggregate slot changes during suspension, covering PAGI::Server request-body receives (#1818).
 - Preserve escaped byte strings in interpreter closures and `bytes::substr`, honor requested CRLF output in `MIME::QuotedPrint`, and cover URI Basic Auth byte-string userinfo (#1275, #1313, #1341).
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index b000ce3622..4e1e39b271 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1956,7 +1956,8 @@ private static boolean restoreReachableHashEntryOwnerCount(RuntimeBase referent)
             if (slot.kind() != PerlOwnerSlot.Kind.ARRAY_ELEMENT) continue;
             RuntimeBase owner = slot.ownerContainer();
             if (!(owner instanceof RuntimeArray array)
-                    || (!array.isPackageGlobalRoot
+                    || (array.semanticCaptureOwnerCount() == 0
+                    && !array.isPackageGlobalRoot
                     && (array.scopeExited || !MyVarCleanupStack.isRegistered(array)))) continue;
             RuntimeScalar cell = slot.ownerCell();
             if (cell == null) {
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateArrayOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateArrayOwnerSlotTest.java
index fa05f0670e..d7b38ff26d 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateArrayOwnerSlotTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateArrayOwnerSlotTest.java
@@ -26,7 +26,8 @@ void directlyRootedArrayElementRestoresItsStrongOwnerAtLegacyZero() {
             GlobalVariable.aliasGlobalArray(rootName, root);
             RuntimeArray lexicalRoot = new RuntimeArray();
             lexicalRoot.push(referenceTo(referent));
-            MyVarCleanupStack.register(lexicalRoot);
+            PerlOwnerSlot lexicalArrayCapture = lexicalRoot.retainClosureCaptureOwner();
+            lexicalRoot.scopeExited = true;
             RuntimeArray weakRoot = new RuntimeArray();
             weakRoot.push(referenceTo(referent));
             RuntimeScalar weakEntry = weakRoot.elements.get(0);
@@ -57,7 +58,7 @@ void directlyRootedArrayElementRestoresItsStrongOwnerAtLegacyZero() {
                         referent.perlLifecycleState(),
                         "a package-rooted strong array element retains its referent");
                 assertEquals(3, referent.refCount,
-                        "both rooted strong array elements and the lexical owner are restored");
+                        "package and closure-owned array elements plus the scalar owner are restored");
 
                 // Keep the weak edge in place for the count assertion, then
                 // remove its diagnostic root before proving final destruction.
@@ -76,11 +77,10 @@ void directlyRootedArrayElementRestoresItsStrongOwnerAtLegacyZero() {
                 assertEquals(2, referent.refCount,
                         "the registered lexical array and scalar owner remain");
 
-                RuntimeScalar lexicalArrayEntry = lexicalRoot.elements.remove(0);
-                MortalList.deferDecrementIfTracked(lexicalArrayEntry);
+                lexicalRoot.releaseClosureCaptureOwner(lexicalArrayCapture);
                 MortalList.flush();
                 assertEquals(1, referent.refCount,
-                        "removing the lexical array element preserves the scalar owner");
+                        "releasing the final array capture preserves the scalar owner");
 
                 MortalList.deferDecrementIfTracked(lexicalOwner);
                 MortalList.flush();
@@ -89,9 +89,11 @@ void directlyRootedArrayElementRestoresItsStrongOwnerAtLegacyZero() {
                         referent.perlLifecycleState(),
                         "releasing the final owner permits destruction");
             } finally {
+                if (lexicalArrayCapture.isActive()) {
+                    lexicalRoot.releaseClosureCaptureOwner(lexicalArrayCapture);
+                }
                 MortalList.setActive(previousActive);
                 MyVarCleanupStack.unregister(lexicalOwner);
-                MyVarCleanupStack.unregister(lexicalRoot);
                 GlobalVariable.globalArrays.remove(rootName);
                 GlobalVariable.globalArrays.remove(weakRootName);
                 GlobalVariable.globalHashes.remove(weakHashName);

From ab09932c6eb5e0aaaad01d996084b95a21ac9390 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 02:23:23 +0200
Subject: [PATCH 109/317] docs: record current ownership acceptance evidence

Record the passing full make, HTML::Tree, and focused handle regression on
766df0bc3 while documenting that remote Windows CI still covers the older PR
head and the broader ownership migration remains incomplete.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 790f9924b5..4bd6817b5a 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. The open draft PR remote head is `df06b9e3a`: Ubuntu passes, while Windows fails `io_select_nested_process_handle.t`; master passed that test in its latest Windows run, which failed elsewhere. The current local candidate still needs remote CI after publication. The full `nice -n 19 make` passes on the current aggregate-slot candidate in 12m12s. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl 5.45.4 and both PerlOnJava backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. The `timeout 1800 ./jcpan -t HTML::Tree` run on `de3248174` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays, live registered lexical arrays, and semantic closure-captured arrays; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing each element, and confirms rooted weak hash/array slots do not inflate the restored count. The full gate confirms DBIx weak-cycle and captured-pad cleanup remain intact. Weak owner-cell references prevent the bookkeeping from creating scalar/container cycles, and weak references and transitively reachable arrays do not count as strong owners. This remains a recovery bridge: `refCount` still controls dispatch, and unregistered/transitively rooted arrays, scalar/proxy stores, and alias cleanup are not migrated. Next: migrate array slot acquisition and release through complete ownership paths, then handle scalar/proxy stores and aliases.
+The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. The open draft PR remote head is `df06b9e3a`: Ubuntu passes, while Windows fails `io_select_nested_process_handle.t`; master passed that test in its latest Windows run, which failed elsewhere. The latest local candidate is `766df0bc3` and still needs remote CI after publication. Its `nice -n 19 make` passes in 12m01s, and `timeout 1800 ./jcpan -t HTML::Tree` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. The nested process-handle regression also passes on blead Perl 5.45.4 and both PerlOnJava backends; the earlier Windows failure predates the latest captured-array owner commits. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl 5.45.4 and both PerlOnJava backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays, live registered lexical arrays, and semantic closure-captured arrays; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing each element, and confirms rooted weak hash/array slots do not inflate the restored count. The full gate confirms DBIx weak-cycle and captured-pad cleanup remain intact. Weak owner-cell references prevent the bookkeeping from creating scalar/container cycles, and weak references and transitively reachable arrays do not count as strong owners. This remains a recovery bridge: `refCount` still controls dispatch, and unregistered/transitively rooted arrays, scalar/proxy stores, and alias cleanup are not migrated. Next: migrate array slot acquisition and release through complete ownership paths, then handle scalar/proxy stores and aliases.
 
 ### Completed
 

From a10ca13be3a39039a748704d67c04292898e7f64 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 02:48:31 +0200
Subject: [PATCH 110/317] fix: register array owner slots after proxy stores

A proxy can vivify an element while its ordinary array is still marked
non-owning. Promote the array after the delegated store, then reconcile its
owner slots so later replacement and removal track the referent correctly.
Add coverage for creation, transfer, and release through the proxy path.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 .../runtimetypes/RuntimeArrayProxyEntry.java  |  5 +++
 .../RuntimeArrayElementOwnershipTest.java     | 31 +++++++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayProxyEntry.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayProxyEntry.java
index 3f6f97691f..d7ee93a61b 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayProxyEntry.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayProxyEntry.java
@@ -79,6 +79,11 @@ public RuntimeScalar set(RuntimeScalar value) {
         RuntimeScalar result = super.set(value);
         if (!parent.elementsAliased) {
             parent.elementsOwned = true;
+            // Vivification can insert the lvalue while this array is still
+            // marked non-owning. The element-list mutation then cannot create
+            // an ARRAY_ELEMENT owner slot, so reconcile after the proxy store
+            // promotes the array to an owning aggregate.
+            parent.reconcileArrayElementOwnerSlots();
         }
         return result;
     }
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
index 66afb1404c..4e051242ac 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
@@ -98,6 +98,37 @@ void replacingAnAliasedSlotTransfersOwnershipToTheArray() {
         }
     }
 
+    @Test
+    void proxyStoreCreatesAndTransfersItsArrayElementOwnerSlot() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray first = new RuntimeArray();
+            RuntimeArray second = new RuntimeArray();
+            RuntimeArray array = new RuntimeArray();
+            RuntimeArrayProxyEntry proxy = new RuntimeArrayProxyEntry(array, 0);
+
+            proxy.set(first.createReference());
+
+            PerlOwnerSlot slot = array.arrayElementOwnerSlot(0);
+            assertTrue(array.ownsElement(array.elements.get(0)));
+            assertEquals(1, first.arraySlotOwnerCount(),
+                    "a proxy store into a new array must register its referent owner");
+            assertSame(first, slot.referent());
+
+            proxy.set(second.createReference());
+
+            assertSame(slot, array.arrayElementOwnerSlot(0),
+                    "replacing through the proxy preserves the structural slot identity");
+            assertEquals(0, first.arraySlotOwnerCount());
+            assertEquals(1, second.arraySlotOwnerCount());
+            assertSame(second, slot.referent());
+
+            array.elements.clear();
+            assertEquals(0, second.arraySlotOwnerCount(),
+                    "removing the proxy-written element releases its owner slot");
+        }
+    }
+
     @Test
     void nonOwningAliasedElementDoesNotProveScalarReachability() {
         PerlRuntime runtime = new PerlRuntime();

From a9f1fe812194b0b68af4bca5b5e9efd7e93c7a0b Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 03:21:38 +0200
Subject: [PATCH 111/317] docs: record array proxy ownership validation

Record the proxy-store owner-slot gap, regression coverage, and current full
make and HTML::Tree results in the Phase 2 handoff and changelog.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 2 +-
 docs/about/changelog.md              | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 4bd6817b5a..6b1e5760ac 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. The open draft PR remote head is `df06b9e3a`: Ubuntu passes, while Windows fails `io_select_nested_process_handle.t`; master passed that test in its latest Windows run, which failed elsewhere. The latest local candidate is `766df0bc3` and still needs remote CI after publication. Its `nice -n 19 make` passes in 12m01s, and `timeout 1800 ./jcpan -t HTML::Tree` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. The nested process-handle regression also passes on blead Perl 5.45.4 and both PerlOnJava backends; the earlier Windows failure predates the latest captured-array owner commits. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl 5.45.4 and both PerlOnJava backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays, live registered lexical arrays, and semantic closure-captured arrays; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing each element, and confirms rooted weak hash/array slots do not inflate the restored count. The full gate confirms DBIx weak-cycle and captured-pad cleanup remain intact. Weak owner-cell references prevent the bookkeeping from creating scalar/container cycles, and weak references and transitively reachable arrays do not count as strong owners. This remains a recovery bridge: `refCount` still controls dispatch, and unregistered/transitively rooted arrays, scalar/proxy stores, and alias cleanup are not migrated. Next: migrate array slot acquisition and release through complete ownership paths, then handle scalar/proxy stores and aliases.
+The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. The open draft PR remote head is `df06b9e3a`: Ubuntu passes, while Windows fails `io_select_nested_process_handle.t`; master passed that test in its latest Windows run, which failed elsewhere. The current local candidate is `91c60a5f3` and still needs remote CI after publication. It registers an array element owner slot after an lvalue proxy vivifies and stores into a previously non-owning ordinary array; `RuntimeArrayElementOwnershipTest` covers slot creation, referent transfer, and removal. The clean-commit `nice -n 19 make` passes in 15m06s, and `timeout 1800 ./jcpan -t HTML::Tree` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. The nested process-handle regression passes on blead Perl 5.45.4 and both PerlOnJava backends; the earlier Windows failure predates the latest captured-array owner commits. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl 5.45.4 and both PerlOnJava backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays, live registered lexical arrays, and semantic closure-captured arrays; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing each element, and confirms rooted weak hash/array slots do not inflate the restored count. The full gate confirms DBIx weak-cycle and captured-pad cleanup remain intact. Weak owner-cell references prevent the bookkeeping from creating scalar/container cycles, and weak references and transitively reachable arrays do not count as strong owners. This remains a recovery bridge: `refCount` still controls dispatch, and unregistered/transitively rooted arrays, scalar/proxy stores, and alias cleanup are not migrated. Next: migrate array slot acquisition and release through complete ownership paths, then handle scalar/proxy stores and aliases.
 
 ### Completed
 
diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index c7c66ccbb4..829cb080e5 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -42,7 +42,7 @@ priorities and future plans.
 - Preserve inherited method dispatch in child threads.
 - Prefer exact root-module package declarations over earlier helper packages, and warn for undefined hash keys used by `exists` and `delete` (#1820, #1645).
 - Add a reproducible, warmup-aware Perl versus PerlOnJava performance runner (#1196).
-- Preserve CODE callback captures while Perl container slots still own the callback; restore rooted hash-entry and package-rooted, registered lexical, or closure-captured array-element owners when a legacy deferred decrement undercounts them; release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; avoid false global-destruction resurrection warnings when bounded owner proofs scan large package graphs; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
+- Preserve CODE callback captures while Perl container slots still own the callback; restore rooted hash-entry and package-rooted, registered lexical, or closure-captured array-element owners when a legacy deferred decrement undercounts them; register array-element owners after lvalue-proxy stores into new arrays; release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; avoid false global-destruction resurrection warnings when bounded owner proofs scan large package graphs; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
 - Cover FormState session restoration across requests and HTTP response conversion from callback and streaming PSGI responses; refresh HTTP::Message and LWP compatibility status (#1650, #1651, #1652).
 - Preserve the awaited Future value when its source scalar or aggregate slot changes during suspension, covering PAGI::Server request-body receives (#1818).
 - Preserve escaped byte strings in interpreter closures and `bytes::substr`, honor requested CRLF output in `MIME::QuotedPrint`, and cover URI Basic Auth byte-string userinfo (#1275, #1313, #1341).

From 65715ff73bde03b948a621ef59f49792a094686c Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 03:24:19 +0200
Subject: [PATCH 112/317] fix: register array owner slots after scalar
 refaliasing

Scalar refaliasing can install an element before a new ordinary array is
marked as owning. Reconcile the array element owner slots after promotion and
cover the aliased scalar cell's referent and final removal.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 .../runtimetypes/RuntimeArrayProxyEntry.java  |  1 +
 .../RuntimeArrayElementOwnershipTest.java     | 23 +++++++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayProxyEntry.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayProxyEntry.java
index d7ee93a61b..028057d331 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayProxyEntry.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayProxyEntry.java
@@ -110,6 +110,7 @@ public RuntimeScalar aliasToReference(RuntimeScalar reference) {
         this.firstClassRegexValue = referent.firstClassRegexValue;
         if (!parent.elementsAliased) {
             parent.elementsOwned = true;
+            parent.reconcileArrayElementOwnerSlots();
         }
         return referent;
     }
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
index 4e051242ac..03f79b5659 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
@@ -129,6 +129,29 @@ void proxyStoreCreatesAndTransfersItsArrayElementOwnerSlot() {
         }
     }
 
+    @Test
+    void scalarRefaliasCreatesAnArrayElementOwnerSlot() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeScalar scalarCell = referent.createReference();
+            RuntimeScalar scalarReference = scalarCell.createReference();
+            RuntimeArray array = new RuntimeArray();
+            RuntimeArrayProxyEntry proxy = new RuntimeArrayProxyEntry(array, 0);
+
+            proxy.aliasToReference(scalarReference);
+
+            assertSame(scalarCell, array.elements.get(0));
+            assertTrue(array.ownsElement(scalarCell));
+            assertEquals(1, referent.arraySlotOwnerCount(),
+                    "refaliasing promotes the new array and registers the referenced aggregate");
+            assertSame(referent, array.arrayElementOwnerSlot(0).referent());
+
+            array.elements.clear();
+            assertEquals(0, referent.arraySlotOwnerCount());
+        }
+    }
+
     @Test
     void nonOwningAliasedElementDoesNotProveScalarReachability() {
         PerlRuntime runtime = new PerlRuntime();

From 1344b3b2e6615aab58165d3e73bcb736891f0e4f Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 03:57:26 +0200
Subject: [PATCH 113/317] docs: record scalar refalias owner validation

Record the scalar refalias proxy path, oracle/backend compatibility results,
and current full make and HTML::Tree evidence in the ownership handoff and
changelog.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 2 +-
 docs/about/changelog.md              | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 6b1e5760ac..ba7c8ecc33 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. The open draft PR remote head is `df06b9e3a`: Ubuntu passes, while Windows fails `io_select_nested_process_handle.t`; master passed that test in its latest Windows run, which failed elsewhere. The current local candidate is `91c60a5f3` and still needs remote CI after publication. It registers an array element owner slot after an lvalue proxy vivifies and stores into a previously non-owning ordinary array; `RuntimeArrayElementOwnershipTest` covers slot creation, referent transfer, and removal. The clean-commit `nice -n 19 make` passes in 15m06s, and `timeout 1800 ./jcpan -t HTML::Tree` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. The nested process-handle regression passes on blead Perl 5.45.4 and both PerlOnJava backends; the earlier Windows failure predates the latest captured-array owner commits. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl 5.45.4 and both PerlOnJava backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays, live registered lexical arrays, and semantic closure-captured arrays; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing each element, and confirms rooted weak hash/array slots do not inflate the restored count. The full gate confirms DBIx weak-cycle and captured-pad cleanup remain intact. Weak owner-cell references prevent the bookkeeping from creating scalar/container cycles, and weak references and transitively reachable arrays do not count as strong owners. This remains a recovery bridge: `refCount` still controls dispatch, and unregistered/transitively rooted arrays, scalar/proxy stores, and alias cleanup are not migrated. Next: migrate array slot acquisition and release through complete ownership paths, then handle scalar/proxy stores and aliases.
+The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. The open draft PR remote head is `df06b9e3a`: Ubuntu passes, while Windows fails `io_select_nested_process_handle.t`; master passed that test in its latest Windows run, which failed elsewhere. The current local candidate is `1c22c2d4a` and still needs remote CI after publication. Ordinary stores and scalar refaliasing through array-element proxies now reconcile owner slots after promoting a new ordinary array; `RuntimeArrayElementOwnershipTest` covers slot creation, referent transfer, aliasing, and removal. The clean-commit `nice -n 19 make` passes in 11m39s, and the existing `lvref_conditional_target_alias.t` passes 58/58 on blead Perl 5.45.4 and both PerlOnJava backends. `timeout 1800 ./jcpan -t HTML::Tree` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. The nested process-handle regression passes on blead Perl 5.45.4 and both PerlOnJava backends; the earlier Windows failure predates the latest captured-array owner commits. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl 5.45.4 and both PerlOnJava backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays, live registered lexical arrays, and semantic closure-captured arrays; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing each element, and confirms rooted weak hash/array slots do not inflate the restored count. The full gate confirms DBIx weak-cycle and captured-pad cleanup remain intact. Weak owner-cell references prevent the bookkeeping from creating scalar/container cycles, and weak references and transitively reachable arrays do not count as strong owners. This remains a recovery bridge: `refCount` still controls dispatch, and unregistered/transitively rooted arrays, scalar/proxy stores, and alias cleanup are not migrated. Next: migrate array slot acquisition and release through complete ownership paths, then handle scalar/proxy stores and aliases.
 
 ### Completed
 
diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index 829cb080e5..fa74e9484a 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -42,7 +42,7 @@ priorities and future plans.
 - Preserve inherited method dispatch in child threads.
 - Prefer exact root-module package declarations over earlier helper packages, and warn for undefined hash keys used by `exists` and `delete` (#1820, #1645).
 - Add a reproducible, warmup-aware Perl versus PerlOnJava performance runner (#1196).
-- Preserve CODE callback captures while Perl container slots still own the callback; restore rooted hash-entry and package-rooted, registered lexical, or closure-captured array-element owners when a legacy deferred decrement undercounts them; register array-element owners after lvalue-proxy stores into new arrays; release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; avoid false global-destruction resurrection warnings when bounded owner proofs scan large package graphs; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
+- Preserve CODE callback captures while Perl container slots still own the callback; restore rooted hash-entry and package-rooted, registered lexical, or closure-captured array-element owners when a legacy deferred decrement undercounts them; register array-element owners after lvalue-proxy stores and scalar refaliasing into new arrays; release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; avoid false global-destruction resurrection warnings when bounded owner proofs scan large package graphs; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
 - Cover FormState session restoration across requests and HTTP response conversion from callback and streaming PSGI responses; refresh HTTP::Message and LWP compatibility status (#1650, #1651, #1652).
 - Preserve the awaited Future value when its source scalar or aggregate slot changes during suspension, covering PAGI::Server request-body receives (#1818).
 - Preserve escaped byte strings in interpreter closures and `bytes::substr`, honor requested CRLF output in `MIME::QuotedPrint`, and cover URI Basic Auth byte-string userinfo (#1275, #1313, #1341).

From abda275d57b49250f2f6cab6e85125bf859a15f0 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 04:05:51 +0200
Subject: [PATCH 114/317] fix: track references to newly vivified array
 elements

Promote an ordinary array when an element proxy creates a scalar reference
and reconciles its owner slots. Later writes through that reference now update
the element's semantic owner record. Add Perl-level lifetime and Java ledger
regressions for the path.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 .../runtimetypes/RuntimeArrayProxyEntry.java  | 10 ++++++-
 .../RuntimeArrayElementOwnershipTest.java     | 21 +++++++++++++++
 .../array_element_scalar_reference_lifetime.t | 26 +++++++++++++++++++
 3 files changed, 56 insertions(+), 1 deletion(-)
 create mode 100644 src/test/resources/unit/refcount/array_element_scalar_reference_lifetime.t

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayProxyEntry.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayProxyEntry.java
index 028057d331..bf69d51586 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayProxyEntry.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayProxyEntry.java
@@ -161,7 +161,15 @@ public RuntimeScalar createReference() {
                 vivify();
             }
         }
-        return lvalue.createReference();
+        RuntimeScalar reference = lvalue.createReference();
+        if (!parent.elementsAliased) {
+            // Taking a reference vivifies an ordinary array slot without
+            // going through set(). Promote the parent now so later writes
+            // through the scalar reference update an ARRAY_ELEMENT owner slot.
+            parent.elementsOwned = true;
+            parent.reconcileArrayElementOwnerSlots();
+        }
+        return reference;
     }
 
     /**
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
index 03f79b5659..9d4e0420c2 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
@@ -152,6 +152,27 @@ void scalarRefaliasCreatesAnArrayElementOwnerSlot() {
         }
     }
 
+    @Test
+    void scalarReferenceToNewArrayElementTracksLaterReferentAssignment() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeArray array = new RuntimeArray();
+            RuntimeScalar elementReference = new RuntimeArrayProxyEntry(array, 0).createReference();
+
+            elementReference.scalarDeref().set(referent.createReference());
+
+            RuntimeScalar element = array.elements.get(0);
+            assertTrue(array.ownsElement(element));
+            assertEquals(1, referent.arraySlotOwnerCount(),
+                    "later writes through the scalar reference need an array owner slot");
+            assertSame(referent, array.arrayElementOwnerSlot(0).referent());
+
+            array.elements.clear();
+            assertEquals(0, referent.arraySlotOwnerCount());
+        }
+    }
+
     @Test
     void nonOwningAliasedElementDoesNotProveScalarReachability() {
         PerlRuntime runtime = new PerlRuntime();
diff --git a/src/test/resources/unit/refcount/array_element_scalar_reference_lifetime.t b/src/test/resources/unit/refcount/array_element_scalar_reference_lifetime.t
new file mode 100644
index 0000000000..1318320ad9
--- /dev/null
+++ b/src/test/resources/unit/refcount/array_element_scalar_reference_lifetime.t
@@ -0,0 +1,26 @@
+use strict;
+use warnings;
+use Test::More tests => 2;
+use Scalar::Util qw(weaken);
+
+{
+    package ArrayElementScalarReferenceLifetime::Tracked;
+    sub DESTROY { }
+}
+
+my @elements;
+my $slot = \$elements[0];
+my $object = bless {}, 'ArrayElementScalarReferenceLifetime::Tracked';
+my $weak = $object;
+weaken($weak);
+
+$$slot = $object;
+undef $object;
+undef $slot;
+
+ok(defined $weak,
+    'an element assigned through a scalar reference remains owned by its array');
+
+undef $elements[0];
+ok(!defined $weak,
+    'clearing the array element releases its final referent owner');

From c3a24648b7d1ac8e4efe8fcf649b72e5ddb591ae Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 04:50:23 +0200
Subject: [PATCH 115/317] docs: record latest ownership regression coverage

Record the newly vivified array-element reference regression, full make
result, and HTML::Tree integration result in the ownership progress notes.
Update the work-in-progress compatibility summary accordingly.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 2 +-
 docs/about/changelog.md              | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index ba7c8ecc33..59efeead99 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. The open draft PR remote head is `df06b9e3a`: Ubuntu passes, while Windows fails `io_select_nested_process_handle.t`; master passed that test in its latest Windows run, which failed elsewhere. The current local candidate is `1c22c2d4a` and still needs remote CI after publication. Ordinary stores and scalar refaliasing through array-element proxies now reconcile owner slots after promoting a new ordinary array; `RuntimeArrayElementOwnershipTest` covers slot creation, referent transfer, aliasing, and removal. The clean-commit `nice -n 19 make` passes in 11m39s, and the existing `lvref_conditional_target_alias.t` passes 58/58 on blead Perl 5.45.4 and both PerlOnJava backends. `timeout 1800 ./jcpan -t HTML::Tree` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. The nested process-handle regression passes on blead Perl 5.45.4 and both PerlOnJava backends; the earlier Windows failure predates the latest captured-array owner commits. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl 5.45.4 and both PerlOnJava backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays, live registered lexical arrays, and semantic closure-captured arrays; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing each element, and confirms rooted weak hash/array slots do not inflate the restored count. The full gate confirms DBIx weak-cycle and captured-pad cleanup remain intact. Weak owner-cell references prevent the bookkeeping from creating scalar/container cycles, and weak references and transitively reachable arrays do not count as strong owners. This remains a recovery bridge: `refCount` still controls dispatch, and unregistered/transitively rooted arrays, scalar/proxy stores, and alias cleanup are not migrated. Next: migrate array slot acquisition and release through complete ownership paths, then handle scalar/proxy stores and aliases.
+The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. The draft PR remote head remains `df06b9e3a`; it needs publication of the current local commits before its CI can validate them. The local candidate is `11b776015`. Ordinary stores, scalar refaliasing, and creation of scalar references through array-element proxies now reconcile owner slots after promoting a new ordinary array. `RuntimeArrayElementOwnershipTest` covers slot creation, referent transfer, aliasing, and removal; `array_element_scalar_reference_lifetime.t` covers a later referent assignment through a newly vivified element reference. The clean-commit `nice -n 19 make` passes in 16m47s, and the new Perl-level test passes on blead Perl 5.45.4 and both PerlOnJava backends. `timeout 1800 ./jcpan -t HTML::Tree` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. The existing `lvref_conditional_target_alias.t` passes 58/58 across blead Perl and both backends. The nested process-handle regression passes on blead Perl and both backends; the earlier Windows failure predates these local commits. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl and both backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays, live registered lexical arrays, and semantic closure-captured arrays; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing each element, and confirms rooted weak hash/array slots do not inflate the restored count. Weak owner-cell references prevent bookkeeping cycles. This remains a recovery bridge rather than the completed Phase 2 ownership migration: `refCount` still controls dispatch, and some unregistered or transitively rooted arrays, scalar/proxy stores, and alias cleanup remain unmigrated. Continue migrating array slot acquisition and release through complete ownership paths, then handle the remaining scalar/proxy stores and aliases.
 
 ### Completed
 
diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index fa74e9484a..884cd10867 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -42,7 +42,7 @@ priorities and future plans.
 - Preserve inherited method dispatch in child threads.
 - Prefer exact root-module package declarations over earlier helper packages, and warn for undefined hash keys used by `exists` and `delete` (#1820, #1645).
 - Add a reproducible, warmup-aware Perl versus PerlOnJava performance runner (#1196).
-- Preserve CODE callback captures while Perl container slots still own the callback; restore rooted hash-entry and package-rooted, registered lexical, or closure-captured array-element owners when a legacy deferred decrement undercounts them; register array-element owners after lvalue-proxy stores and scalar refaliasing into new arrays; release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; avoid false global-destruction resurrection warnings when bounded owner proofs scan large package graphs; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
+- Preserve CODE callback captures while Perl container slots still own the callback; restore rooted hash-entry and package-rooted, registered lexical, or closure-captured array-element owners when a legacy deferred decrement undercounts them; register array-element owners after lvalue-proxy stores, scalar refaliasing, and scalar-reference creation into new arrays; release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; avoid false global-destruction resurrection warnings when bounded owner proofs scan large package graphs; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
 - Cover FormState session restoration across requests and HTTP response conversion from callback and streaming PSGI responses; refresh HTTP::Message and LWP compatibility status (#1650, #1651, #1652).
 - Preserve the awaited Future value when its source scalar or aggregate slot changes during suspension, covering PAGI::Server request-body receives (#1818).
 - Preserve escaped byte strings in interpreter closures and `bytes::substr`, honor requested CRLF output in `MIME::QuotedPrint`, and cover URI Basic Auth byte-string userinfo (#1275, #1313, #1341).

From e5e7dec8cdd9cf2ac61219fe7f0a3888b7323b2e Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 05:16:44 +0200
Subject: [PATCH 116/317] fix: track aggregate refalias owners in array proxies

Promote ordinary arrays after aggregate refalias writes through an
array-element proxy so the new referent is retained by its semantic slot.
Add coverage for owner acquisition and release when the element is removed.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md          |  2 +-
 docs/about/changelog.md                       |  2 +-
 .../runtimetypes/RuntimeArrayProxyEntry.java  |  4 ++++
 .../RuntimeArrayElementOwnershipTest.java     | 21 +++++++++++++++++++
 4 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 59efeead99..22f4b2b514 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. The draft PR remote head remains `df06b9e3a`; it needs publication of the current local commits before its CI can validate them. The local candidate is `11b776015`. Ordinary stores, scalar refaliasing, and creation of scalar references through array-element proxies now reconcile owner slots after promoting a new ordinary array. `RuntimeArrayElementOwnershipTest` covers slot creation, referent transfer, aliasing, and removal; `array_element_scalar_reference_lifetime.t` covers a later referent assignment through a newly vivified element reference. The clean-commit `nice -n 19 make` passes in 16m47s, and the new Perl-level test passes on blead Perl 5.45.4 and both PerlOnJava backends. `timeout 1800 ./jcpan -t HTML::Tree` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. The existing `lvref_conditional_target_alias.t` passes 58/58 across blead Perl and both backends. The nested process-handle regression passes on blead Perl and both backends; the earlier Windows failure predates these local commits. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl and both backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays, live registered lexical arrays, and semantic closure-captured arrays; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing each element, and confirms rooted weak hash/array slots do not inflate the restored count. Weak owner-cell references prevent bookkeeping cycles. This remains a recovery bridge rather than the completed Phase 2 ownership migration: `refCount` still controls dispatch, and some unregistered or transitively rooted arrays, scalar/proxy stores, and alias cleanup remain unmigrated. Continue migrating array slot acquisition and release through complete ownership paths, then handle the remaining scalar/proxy stores and aliases.
+The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. The draft PR remote head remains `df06b9e3a`; it needs publication of the current local commits before its CI can validate them. The local candidate is `478431e39` plus the in-progress aggregate-refalias owner-slot fix. Ordinary stores, scalar refaliasing, scalar-reference creation, and aggregate refaliasing through array-element proxies now reconcile owner slots after promoting a new ordinary array. `RuntimeArrayElementOwnershipTest` covers slot creation, referent transfer, aliasing, and removal; `array_element_scalar_reference_lifetime.t` covers a later referent assignment through a newly vivified element reference. The source change and Java regression pass the clean `nice -n 19 make` gate in 12m13s. The new Perl-level lifetime test passes on blead Perl 5.45.4 and both PerlOnJava backends. `timeout 1800 ./jcpan -t HTML::Tree` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. The existing `lvref_conditional_target_alias.t` passes 58/58 across blead Perl and both backends. The nested process-handle regression passes on blead Perl and both backends; the earlier Windows failure predates these local commits. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl and both backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays, live registered lexical arrays, and semantic closure-captured arrays; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing each element, and confirms rooted weak hash/array slots do not inflate the restored count. Weak owner-cell references prevent bookkeeping cycles. This remains a recovery bridge rather than the completed Phase 2 ownership migration: `refCount` still controls dispatch, and some unregistered or transitively rooted arrays, scalar/proxy stores, and alias cleanup remain unmigrated. Continue migrating array slot acquisition and release through complete ownership paths, then handle the remaining scalar/proxy stores and aliases.
 
 ### Completed
 
diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index 884cd10867..45edd2348b 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -42,7 +42,7 @@ priorities and future plans.
 - Preserve inherited method dispatch in child threads.
 - Prefer exact root-module package declarations over earlier helper packages, and warn for undefined hash keys used by `exists` and `delete` (#1820, #1645).
 - Add a reproducible, warmup-aware Perl versus PerlOnJava performance runner (#1196).
-- Preserve CODE callback captures while Perl container slots still own the callback; restore rooted hash-entry and package-rooted, registered lexical, or closure-captured array-element owners when a legacy deferred decrement undercounts them; register array-element owners after lvalue-proxy stores, scalar refaliasing, and scalar-reference creation into new arrays; release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; avoid false global-destruction resurrection warnings when bounded owner proofs scan large package graphs; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
+- Preserve CODE callback captures while Perl container slots still own the callback; restore rooted hash-entry and package-rooted, registered lexical, or closure-captured array-element owners when a legacy deferred decrement undercounts them; register array-element owners after lvalue-proxy stores, scalar and aggregate refaliasing, and scalar-reference creation into new arrays; release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; avoid false global-destruction resurrection warnings when bounded owner proofs scan large package graphs; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
 - Cover FormState session restoration across requests and HTTP response conversion from callback and streaming PSGI responses; refresh HTTP::Message and LWP compatibility status (#1650, #1651, #1652).
 - Preserve the awaited Future value when its source scalar or aggregate slot changes during suspension, covering PAGI::Server request-body receives (#1818).
 - Preserve escaped byte strings in interpreter closures and `bytes::substr`, honor requested CRLF output in `MIME::QuotedPrint`, and cover URI Basic Auth byte-string userinfo (#1275, #1313, #1341).
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayProxyEntry.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayProxyEntry.java
index bf69d51586..bab74f0a92 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayProxyEntry.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayProxyEntry.java
@@ -130,6 +130,10 @@ public RuntimeScalar aliasToAggregateReference(RuntimeScalar reference) {
         this.lvalue = reference;
         this.type = reference.type;
         this.value = reference.value;
+        if (!parent.elementsAliased) {
+            parent.elementsOwned = true;
+            parent.reconcileArrayElementOwnerSlots();
+        }
         return reference;
     }
 
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
index 9d4e0420c2..08a0047b6e 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
@@ -152,6 +152,27 @@ void scalarRefaliasCreatesAnArrayElementOwnerSlot() {
         }
     }
 
+    @Test
+    void aggregateRefaliasCreatesAnArrayElementOwnerSlot() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeArray array = new RuntimeArray();
+            RuntimeScalar aggregateReference = referent.createReference();
+
+            new RuntimeArrayProxyEntry(array, 0).aliasToAggregateReference(aggregateReference);
+
+            assertTrue(array.elementsOwned,
+                    "aggregate refaliasing promotes an ordinary array to an owning aggregate");
+            assertEquals(1, referent.arraySlotOwnerCount());
+            assertSame(referent, array.arrayElementOwnerSlot(0).referent());
+
+            array.elements.clear();
+            assertEquals(0, referent.arraySlotOwnerCount(),
+                    "removing the aliased aggregate reference releases the array owner slot");
+        }
+    }
+
     @Test
     void scalarReferenceToNewArrayElementTracksLaterReferentAssignment() {
         PerlRuntime runtime = new PerlRuntime();

From e8725b7c519dcf0b0c28982a1e0635ef84d78fbe Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 05:53:44 +0200
Subject: [PATCH 117/317] test: allow Windows time for nested Perl startup

The nested IO::Select lifetime test timed out while a successful child
process was still starting under Windows CI load. Increase its readiness
wait so the regression checks handle retention rather than JVM startup speed.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md                      | 2 +-
 src/test/resources/unit/io_select_nested_process_handle.t | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 22f4b2b514..626c8a647b 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. The draft PR remote head remains `df06b9e3a`; it needs publication of the current local commits before its CI can validate them. The local candidate is `478431e39` plus the in-progress aggregate-refalias owner-slot fix. Ordinary stores, scalar refaliasing, scalar-reference creation, and aggregate refaliasing through array-element proxies now reconcile owner slots after promoting a new ordinary array. `RuntimeArrayElementOwnershipTest` covers slot creation, referent transfer, aliasing, and removal; `array_element_scalar_reference_lifetime.t` covers a later referent assignment through a newly vivified element reference. The source change and Java regression pass the clean `nice -n 19 make` gate in 12m13s. The new Perl-level lifetime test passes on blead Perl 5.45.4 and both PerlOnJava backends. `timeout 1800 ./jcpan -t HTML::Tree` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. The existing `lvref_conditional_target_alias.t` passes 58/58 across blead Perl and both backends. The nested process-handle regression passes on blead Perl and both backends; the earlier Windows failure predates these local commits. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl and both backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays, live registered lexical arrays, and semantic closure-captured arrays; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing each element, and confirms rooted weak hash/array slots do not inflate the restored count. Weak owner-cell references prevent bookkeeping cycles. This remains a recovery bridge rather than the completed Phase 2 ownership migration: `refCount` still controls dispatch, and some unregistered or transitively rooted arrays, scalar/proxy stores, and alias cleanup remain unmigrated. Continue migrating array slot acquisition and release through complete ownership paths, then handle the remaining scalar/proxy stores and aliases.
+The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. The draft PR remote head remains `df06b9e3a`; it needs publication of the current local commits before its CI can validate them. The local candidate is `c3d7dffc4` plus the nested-process test timeout adjustment. Ordinary stores, scalar refaliasing, scalar-reference creation, and aggregate refaliasing through array-element proxies now reconcile owner slots after promoting a new ordinary array. `RuntimeArrayElementOwnershipTest` covers slot creation, referent transfer, aliasing, and removal; `array_element_scalar_reference_lifetime.t` covers a later referent assignment through a newly vivified element reference. The source and Java regression changes pass the clean `nice -n 19 make` gate in 16m50s. The new Perl-level lifetime test passes on blead Perl 5.45.4 and both PerlOnJava backends. `timeout 1800 ./jcpan -t HTML::Tree` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. The existing `lvref_conditional_target_alias.t` passes 58/58 across blead Perl and both backends. The nested process-handle regression passes on blead Perl and both backends. Its Windows CI artifact failed to observe readiness within five seconds even though the child later exited successfully; its wait now allows 30 seconds for Windows child-JVM startup. Recheck this test on Windows after publishing the candidate. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl and both backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays, live registered lexical arrays, and semantic closure-captured arrays; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing each element, and confirms rooted weak hash/array slots do not inflate the restored count. Weak owner-cell references prevent bookkeeping cycles. This remains a recovery bridge rather than the completed Phase 2 ownership migration: `refCount` still controls dispatch, and some unregistered or transitively rooted arrays, scalar/proxy stores, and alias cleanup remain unmigrated. Continue migrating array slot acquisition and release through complete ownership paths, then handle the remaining scalar/proxy stores and aliases.
 
 ### Completed
 
diff --git a/src/test/resources/unit/io_select_nested_process_handle.t b/src/test/resources/unit/io_select_nested_process_handle.t
index 5e33619af8..a4b7d25078 100644
--- a/src/test/resources/unit/io_select_nested_process_handle.t
+++ b/src/test/resources/unit/io_select_nested_process_handle.t
@@ -20,7 +20,10 @@ sub add_delayed_child {
 }
 
 my $pid = add_delayed_child($selector, $launcher);
-my @ready = $selector->can_read(5);
+# On Windows CI the nested PerlOnJava child can take several seconds to start
+# under parallel load. Keep the timeout long enough to test handle lifetime
+# instead of measuring JVM startup latency.
+my @ready = $selector->can_read(30);
 is(scalar @ready, 1, 'nested process handle remains selectable after scope exit');
 
 my $line = @ready ? readline($ready[0][0]) : undef;

From 8c5a70fbc32351aa7b7030a3598973f46f5e561c Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 06:12:18 +0200
Subject: [PATCH 118/317] docs: record exact ownership PR candidate head

Update the ownership progress record with the authoritative PR remote SHA,
verified fast-forward commit count, current master base, and local candidate.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 626c8a647b..b76db11220 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), rebased onto master `6b577fd68a179452561695a9e6bba784d9195060`. The draft PR remote head remains `df06b9e3a`; it needs publication of the current local commits before its CI can validate them. The local candidate is `c3d7dffc4` plus the nested-process test timeout adjustment. Ordinary stores, scalar refaliasing, scalar-reference creation, and aggregate refaliasing through array-element proxies now reconcile owner slots after promoting a new ordinary array. `RuntimeArrayElementOwnershipTest` covers slot creation, referent transfer, aliasing, and removal; `array_element_scalar_reference_lifetime.t` covers a later referent assignment through a newly vivified element reference. The source and Java regression changes pass the clean `nice -n 19 make` gate in 16m50s. The new Perl-level lifetime test passes on blead Perl 5.45.4 and both PerlOnJava backends. `timeout 1800 ./jcpan -t HTML::Tree` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. The existing `lvref_conditional_target_alias.t` passes 58/58 across blead Perl and both backends. The nested process-handle regression passes on blead Perl and both backends. Its Windows CI artifact failed to observe readiness within five seconds even though the child later exited successfully; its wait now allows 30 seconds for Windows child-JVM startup. Recheck this test on Windows after publishing the candidate. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl and both backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays, live registered lexical arrays, and semantic closure-captured arrays; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing each element, and confirms rooted weak hash/array slots do not inflate the restored count. Weak owner-cell references prevent bookkeeping cycles. This remains a recovery bridge rather than the completed Phase 2 ownership migration: `refCount` still controls dispatch, and some unregistered or transitively rooted arrays, scalar/proxy stores, and alias cleanup remain unmigrated. Continue migrating array slot acquisition and release through complete ownership paths, then handle the remaining scalar/proxy stores and aliases.
+The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), based on current master `f885fc9097167557091da4e33cb33e76271845d1`. The draft PR remote head remains `df06b9e3a686d2dde7ed3c81489bb9c7832f2f22`; local HEAD `7ff566647629f6ba30598577e7d5a3017464f723` is a fast-forward of 17 commits and needs publication before CI can validate it. Ordinary stores, scalar refaliasing, scalar-reference creation, and aggregate refaliasing through array-element proxies now reconcile owner slots after promoting a new ordinary array. `RuntimeArrayElementOwnershipTest` covers slot creation, referent transfer, aliasing, and removal; `array_element_scalar_reference_lifetime.t` covers a later referent assignment through a newly vivified element reference. The source and Java regression changes pass the clean `nice -n 19 make` gate in 16m50s. The new Perl-level lifetime test passes on blead Perl 5.45.4 and both PerlOnJava backends. `timeout 1800 ./jcpan -t HTML::Tree` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. The existing `lvref_conditional_target_alias.t` passes 58/58 across blead Perl and both backends. The nested process-handle regression passes on blead Perl and both backends. Its Windows CI artifact failed to observe readiness within five seconds even though the child later exited successfully; its wait now allows 30 seconds for Windows child-JVM startup. Recheck this test on Windows after publishing the candidate. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl and both backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays, live registered lexical arrays, and semantic closure-captured arrays; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing each element, and confirms rooted weak hash/array slots do not inflate the restored count. Weak owner-cell references prevent bookkeeping cycles. This remains a recovery bridge rather than the completed Phase 2 ownership migration: `refCount` still controls dispatch, and some unregistered or transitively rooted arrays, scalar/proxy stores, and alias cleanup remain unmigrated. Continue migrating array slot acquisition and release through complete ownership paths, then handle the remaining scalar/proxy stores and aliases.
 
 ### Completed
 

From 3e3d2e51f789027ad017e8d24f5472d911aef23e Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 06:14:00 +0200
Subject: [PATCH 119/317] docs: clarify current ownership migration boundary

Update the ownership overview and next steps to distinguish owner-slot
recovery coverage from the still-incomplete default accounting migration.
Record the exact current branch and PR candidate relationship.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index b76db11220..1ab6cd1a41 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 is in progress in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816). The current candidate adds a rooted hash-entry owner bridge when a deferred legacy decrement reaches zero; `nice -n 19 make` passes on it. The prior PR head `9dd0b6f8d` passed Ubuntu and Windows CI. The WebSocket controller release regression passes on blead Perl and JVM; the interpreter uses the established `Test::Mojo` skip. The unchanged HTML-Tree 5.07 suite passes. Hash-slot lifecycle still uses `RuntimeBase.refCount` as the dispatch counter, and array slots remain on the legacy path.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816). Local candidate `6858743d90f581cf153d35a3f14094d62670d94f` is 18 fast-forward commits beyond PR remote head `df06b9e3a686d2dde7ed3c81489bb9c7832f2f22`. It records hash-entry and array-element owner slots for deferred-release recovery and registers slots after array proxy stores, scalar refaliasing, scalar-reference creation, and aggregate refaliasing. The local `nice -n 19 make` and HTML-Tree 5.07 suite pass; the nested process-handle test allows 30 seconds for Windows child-JVM startup after its previous five-second wait expired in CI. Owner slots still bridge to `RuntimeBase.refCount` for dispatch; this is not the complete Phase 2 ownership migration.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), based on current master `f885fc9097167557091da4e33cb33e76271845d1`. The draft PR remote head remains `df06b9e3a686d2dde7ed3c81489bb9c7832f2f22`; local HEAD `7ff566647629f6ba30598577e7d5a3017464f723` is a fast-forward of 17 commits and needs publication before CI can validate it. Ordinary stores, scalar refaliasing, scalar-reference creation, and aggregate refaliasing through array-element proxies now reconcile owner slots after promoting a new ordinary array. `RuntimeArrayElementOwnershipTest` covers slot creation, referent transfer, aliasing, and removal; `array_element_scalar_reference_lifetime.t` covers a later referent assignment through a newly vivified element reference. The source and Java regression changes pass the clean `nice -n 19 make` gate in 16m50s. The new Perl-level lifetime test passes on blead Perl 5.45.4 and both PerlOnJava backends. `timeout 1800 ./jcpan -t HTML::Tree` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. The existing `lvref_conditional_target_alias.t` passes 58/58 across blead Perl and both backends. The nested process-handle regression passes on blead Perl and both backends. Its Windows CI artifact failed to observe readiness within five seconds even though the child later exited successfully; its wait now allows 30 seconds for Windows child-JVM startup. Recheck this test on Windows after publishing the candidate. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl and both backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays, live registered lexical arrays, and semantic closure-captured arrays; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing each element, and confirms rooted weak hash/array slots do not inflate the restored count. Weak owner-cell references prevent bookkeeping cycles. This remains a recovery bridge rather than the completed Phase 2 ownership migration: `refCount` still controls dispatch, and some unregistered or transitively rooted arrays, scalar/proxy stores, and alias cleanup remain unmigrated. Continue migrating array slot acquisition and release through complete ownership paths, then handle the remaining scalar/proxy stores and aliases.
+The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), based on current master `f885fc9097167557091da4e33cb33e76271845d1`. The draft PR remote head remains `df06b9e3a686d2dde7ed3c81489bb9c7832f2f22`; local HEAD `6858743d90f581cf153d35a3f14094d62670d94f` is a fast-forward of 18 commits and needs publication before CI can validate it. Ordinary stores, scalar refaliasing, scalar-reference creation, and aggregate refaliasing through array-element proxies now reconcile owner slots after promoting a new ordinary array. `RuntimeArrayElementOwnershipTest` covers slot creation, referent transfer, aliasing, and removal; `array_element_scalar_reference_lifetime.t` covers a later referent assignment through a newly vivified element reference. The source and Java regression changes pass the clean `nice -n 19 make` gate in 16m50s. The new Perl-level lifetime test passes on blead Perl 5.45.4 and both PerlOnJava backends. `timeout 1800 ./jcpan -t HTML::Tree` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. The existing `lvref_conditional_target_alias.t` passes 58/58 across blead Perl and both backends. The nested process-handle regression passes on blead Perl and both backends. Its Windows CI artifact failed to observe readiness within five seconds even though the child later exited successfully; its wait now allows 30 seconds for Windows child-JVM startup. Recheck this test on Windows after publishing the candidate. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl and both backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays, live registered lexical arrays, and semantic closure-captured arrays; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing each element, and confirms rooted weak hash/array slots do not inflate the restored count. Weak owner-cell references prevent bookkeeping cycles. This remains a recovery bridge rather than the completed Phase 2 ownership migration: `refCount` still controls dispatch, and some unregistered or transitively rooted arrays, scalar/proxy stores, and alias cleanup remain unmigrated. Continue migrating array slot acquisition and release through complete ownership paths, then handle the remaining scalar/proxy stores and aliases.
 
 ### Completed
 
@@ -303,12 +303,12 @@ The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fg
 
 ### Next steps
 
-1. Migrate ordinary array/hash element stores and scalar proxies from the
-   selective `refCount` bridge to owner-slot accounting. Cover acquisition,
-   transfer, replacement, deletion, aliases, and final release with exact
-   refcount/weak-reference/DESTROY assertions before using HTML-Tree as the
-   integration guard. Remove reachability cleanup authority only for paths
-   whose ownership transitions are fully represented by slots.
+1. Continue Phase 2 from slot-registration recovery to default owner-slot
+   accounting for ordinary array/hash element stores and scalar proxies. Cover
+   acquisition, transfer, replacement, deletion, aliases, and final release
+   with oracle-checked refcount, weak-reference, and DESTROY assertions. Keep
+   legacy dispatch and reachability bridges only at explicit unmigrated
+   boundaries; use unchanged HTML-Tree as the integration guard.
 2. Resolve the strict target failures in the fresh-home CPAN release
    acceptance, then rerun that gate on the final candidate. The current run
    distinguishes prerequisite/setup timeouts and missing dependencies from

From fda547011905a1dc3bab949d49f34678ccfa3ffc Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 07:01:43 +0200
Subject: [PATCH 120/317] test: cover array referent release on integer
 assignment

Add Perl-oracle and runtime ownership coverage for replacing an array
reference element with an integer and releasing its ARRAY_ELEMENT owner slot.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 .../RuntimeArrayElementOwnershipTest.java     | 23 +++++++++++++++++++
 ..._element_integer_store_releases_referent.t | 16 +++++++++++++
 2 files changed, 39 insertions(+)
 create mode 100644 src/test/resources/unit/refcount/array_element_integer_store_releases_referent.t

diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
index 08a0047b6e..4f91a5e059 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
@@ -194,6 +194,29 @@ void scalarReferenceToNewArrayElementTracksLaterReferentAssignment() {
         }
     }
 
+    @Test
+    void integerAssignmentTransfersArrayElementOwnerSlotToNoReferent() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeArray array = new RuntimeArray();
+            RuntimeScalar cell = referent.createReference();
+            array.elements.add(cell);
+            array.elementsOwned = true;
+            array.reconcileArrayElementOwnerSlots();
+            PerlOwnerSlot slot = array.arrayElementOwnerSlot(0);
+            assertEquals(1, referent.arraySlotOwnerCount());
+
+            cell.set(new RuntimeScalar(7));
+
+            assertNull(array.arrayElementOwnerSlot(0),
+                    "a scalar element with no referent has no active owner slot");
+            assertEquals(0, referent.arraySlotOwnerCount(),
+                    "replacing the referent with an integer releases its array owner slot");
+            assertNull(slot.referent(), "the released slot no longer names a referent");
+        }
+    }
+
     @Test
     void nonOwningAliasedElementDoesNotProveScalarReachability() {
         PerlRuntime runtime = new PerlRuntime();
diff --git a/src/test/resources/unit/refcount/array_element_integer_store_releases_referent.t b/src/test/resources/unit/refcount/array_element_integer_store_releases_referent.t
new file mode 100644
index 0000000000..f2b6dd6caa
--- /dev/null
+++ b/src/test/resources/unit/refcount/array_element_integer_store_releases_referent.t
@@ -0,0 +1,16 @@
+use strict;
+use warnings;
+use Test::More tests => 2;
+use Scalar::Util qw(weaken);
+
+my $object = bless {}, 'ArrayElementIntegerStore::Object';
+my $weak = $object;
+weaken($weak);
+my @array = ($object);
+undef $object;
+
+ok(defined $weak, 'array element retains its referent before replacement');
+$array[0] = 7;
+ok(!defined $weak, 'integer assignment releases the array element referent');
+
+package ArrayElementIntegerStore::Object;

From 1cc4d26fb1c4244f2108adc74fc0df85a54938ad Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 07:24:35 +0200
Subject: [PATCH 121/317] test: cover hash referent release on integer
 assignment

Add Perl-oracle and runtime ownership coverage for replacing a hash entry's
aggregate referent with an integer and releasing its HASH_ENTRY owner.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 .../RuntimeHashElementOwnershipTest.java      | 21 +++++++++++++++++++
 ..._element_integer_store_releases_referent.t | 16 ++++++++++++++
 2 files changed, 37 insertions(+)
 create mode 100644 src/test/resources/unit/refcount/hash_element_integer_store_releases_referent.t

diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashElementOwnershipTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashElementOwnershipTest.java
index 17c019dfa2..db819d47a2 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashElementOwnershipTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashElementOwnershipTest.java
@@ -75,6 +75,27 @@ void aliasedHashScalarTransfersEachEntrySlotWhenItsReferentChanges() {
         }
     }
 
+    @Test
+    void integerAssignmentReleasesHashEntryReferentOwner() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeHash hash = new RuntimeHash();
+            RuntimeScalar cell = referent.createReference();
+            hash.elements.put("value", cell);
+            PerlOwnerSlot slot = hash.hashEntryOwnerSlot("value");
+            assertEquals(1, referent.hashSlotOwnerCount());
+
+            cell.set(new RuntimeScalar(7));
+
+            assertSame(slot, hash.hashEntryOwnerSlot("value"),
+                    "the hash key retains its stable slot identity after scalar replacement");
+            assertEquals(0, referent.hashSlotOwnerCount(),
+                    "replacing the reference with an integer releases the hash owner slot");
+            assertNull(slot.referent(), "the active key slot no longer names the old referent");
+        }
+    }
+
     @Test
     void hashScopeExitReleasesEntrySlotsWhenNoContainerOwnerRemains() {
         PerlRuntime runtime = new PerlRuntime();
diff --git a/src/test/resources/unit/refcount/hash_element_integer_store_releases_referent.t b/src/test/resources/unit/refcount/hash_element_integer_store_releases_referent.t
new file mode 100644
index 0000000000..639692c2a4
--- /dev/null
+++ b/src/test/resources/unit/refcount/hash_element_integer_store_releases_referent.t
@@ -0,0 +1,16 @@
+use strict;
+use warnings;
+use Test::More tests => 2;
+use Scalar::Util qw(weaken);
+
+my $object = bless {}, 'HashElementIntegerStore::Object';
+my $weak = $object;
+weaken($weak);
+my %hash = (value => $object);
+undef $object;
+
+ok(defined $weak, 'hash entry retains its referent before replacement');
+$hash{value} = 7;
+ok(!defined $weak, 'integer assignment releases the hash entry referent');
+
+package HashElementIntegerStore::Object;

From cb36f6761954c5b9295b12b312f421164ff77da9 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 07:47:39 +0200
Subject: [PATCH 122/317] test: assert destructors run on aggregate scalar
 replacement

Extend the array and hash integer-replacement regressions to verify weak
clearing is accompanied by exactly one DESTROY callback.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 .../refcount/array_element_integer_store_releases_referent.t | 5 ++++-
 .../refcount/hash_element_integer_store_releases_referent.t  | 5 ++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/test/resources/unit/refcount/array_element_integer_store_releases_referent.t b/src/test/resources/unit/refcount/array_element_integer_store_releases_referent.t
index f2b6dd6caa..94178bdc6b 100644
--- a/src/test/resources/unit/refcount/array_element_integer_store_releases_referent.t
+++ b/src/test/resources/unit/refcount/array_element_integer_store_releases_referent.t
@@ -1,8 +1,9 @@
 use strict;
 use warnings;
-use Test::More tests => 2;
+use Test::More tests => 3;
 use Scalar::Util qw(weaken);
 
+our $destroyed = 0;
 my $object = bless {}, 'ArrayElementIntegerStore::Object';
 my $weak = $object;
 weaken($weak);
@@ -12,5 +13,7 @@ undef $object;
 ok(defined $weak, 'array element retains its referent before replacement');
 $array[0] = 7;
 ok(!defined $weak, 'integer assignment releases the array element referent');
+is($destroyed, 1, 'integer assignment runs the referent destructor once');
 
 package ArrayElementIntegerStore::Object;
+sub DESTROY { ++$main::destroyed }
diff --git a/src/test/resources/unit/refcount/hash_element_integer_store_releases_referent.t b/src/test/resources/unit/refcount/hash_element_integer_store_releases_referent.t
index 639692c2a4..a3ff0c82be 100644
--- a/src/test/resources/unit/refcount/hash_element_integer_store_releases_referent.t
+++ b/src/test/resources/unit/refcount/hash_element_integer_store_releases_referent.t
@@ -1,8 +1,9 @@
 use strict;
 use warnings;
-use Test::More tests => 2;
+use Test::More tests => 3;
 use Scalar::Util qw(weaken);
 
+our $destroyed = 0;
 my $object = bless {}, 'HashElementIntegerStore::Object';
 my $weak = $object;
 weaken($weak);
@@ -12,5 +13,7 @@ undef $object;
 ok(defined $weak, 'hash entry retains its referent before replacement');
 $hash{value} = 7;
 ok(!defined $weak, 'integer assignment releases the hash entry referent');
+is($destroyed, 1, 'integer assignment runs the referent destructor once');
 
 package HashElementIntegerStore::Object;
+sub DESTROY { ++$main::destroyed }

From 0f398e6b73f8be20046334cbf06b9428527f173f Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 08:14:02 +0200
Subject: [PATCH 123/317] fix: retain array slot owners through rooted hashes

Include anonymous arrays reachable from package roots when recovering
strong element owners during deferred destruction. Add regression coverage
for an array nested in a package-rooted hash.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <chatgpt.com@openai.com>
---
 .../runtime/runtimetypes/MortalList.java      |  3 +-
 ...MortalListAggregateArrayOwnerSlotTest.java | 45 +++++++++++++++++++
 2 files changed, 47 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 4e1e39b271..610e7c7b28 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1958,7 +1958,8 @@ private static boolean restoreReachableHashEntryOwnerCount(RuntimeBase referent)
             if (!(owner instanceof RuntimeArray array)
                     || (array.semanticCaptureOwnerCount() == 0
                     && !array.isPackageGlobalRoot
-                    && (array.scopeExited || !MyVarCleanupStack.isRegistered(array)))) continue;
+                    && (array.scopeExited || !MyVarCleanupStack.isRegistered(array))
+                    && !ReachabilityWalker.isReachableFromRoots(array, true, referent))) continue;
             RuntimeScalar cell = slot.ownerCell();
             if (cell == null) {
                 slotsWithoutCell++;
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateArrayOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateArrayOwnerSlotTest.java
index d7b38ff26d..f5cf4dc007 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateArrayOwnerSlotTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateArrayOwnerSlotTest.java
@@ -7,6 +7,51 @@
 
 @Tag("unit")
 class MortalListAggregateArrayOwnerSlotTest {
+    @Test
+    void arrayElementOwnerSurvivesWhenAnonymousArrayIsNestedInPackageRootedHash() {
+        PerlRuntime runtime = new PerlRuntime();
+        String rootName = "MortalListAggregateArrayOwnerSlotTest::nested_root";
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            boolean previousActive = MortalList.isActive();
+            RuntimeHash referent = new RuntimeHash();
+            RuntimeArray nestedArray = new RuntimeArray();
+            RuntimeScalar arrayElement = referenceTo(referent);
+            arrayElement.refCountOwned = true;
+            nestedArray.elements.add(arrayElement);
+            nestedArray.elementsOwned = true;
+            nestedArray.reconcileArrayElementOwnerSlots();
+
+            RuntimeHash packageRoot = new RuntimeHash();
+            packageRoot.elements.put("nested", nestedArray.createAnonymousReference());
+            GlobalVariable.aliasGlobalHash(rootName, packageRoot);
+
+            RuntimeScalar unrelatedLegacyOwner = referenceTo(referent);
+            unrelatedLegacyOwner.refCountOwned = true;
+            referent.refCount = 1;
+
+            try {
+                MortalList.setActive(true);
+                MortalList.deferDecrementIfTracked(unrelatedLegacyOwner);
+                MortalList.flush();
+
+                assertEquals(RuntimeBase.PerlLifecycleState.LIVE,
+                        referent.perlLifecycleState(),
+                        "the nested array's strong element remains owned through the rooted hash");
+                assertEquals(1, referent.refCount,
+                        "the nested array element restores one referent owner at legacy zero");
+            } finally {
+                packageRoot.elements.clear();
+                GlobalVariable.globalHashes.remove(rootName);
+                nestedArray.elements.clear();
+                if (arrayElement.refCountOwned) {
+                    MortalList.deferDecrementIfTracked(arrayElement);
+                    MortalList.flush();
+                }
+                MortalList.setActive(previousActive);
+            }
+        }
+    }
+
     @Test
     void directlyRootedArrayElementRestoresItsStrongOwnerAtLegacyZero() {
         PerlRuntime runtime = new PerlRuntime();

From 0128fb7606e9d9d9fd95e21243f350fcbb5ec63e Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 08:17:34 +0200
Subject: [PATCH 124/317] docs: refresh ownership migration status

Record the nested package-rooted array owner regression, latest green
make gate, and current PR publication state in the ownership design.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <chatgpt.com@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 1ab6cd1a41..1e20f90220 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816). Local candidate `6858743d90f581cf153d35a3f14094d62670d94f` is 18 fast-forward commits beyond PR remote head `df06b9e3a686d2dde7ed3c81489bb9c7832f2f22`. It records hash-entry and array-element owner slots for deferred-release recovery and registers slots after array proxy stores, scalar refaliasing, scalar-reference creation, and aggregate refaliasing. The local `nice -n 19 make` and HTML-Tree 5.07 suite pass; the nested process-handle test allows 30 seconds for Windows child-JVM startup after its previous five-second wait expired in CI. Owner slots still bridge to `RuntimeBase.refCount` for dispatch; this is not the complete Phase 2 ownership migration.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress in [PR #1816](https://github.com/PerlOnJava/pull/1816). Local candidate `ad7c690fc82f351fbb0c27bcbb1fc30b70161d59` is 23 fast-forward commits beyond PR remote head `df06b9e3a686d2dde7ed3c81489bb9c7832f2f22`; publication is pending approval. It records hash-entry and array-element owner slots for deferred-release recovery, registers slots after array proxy stores, scalar refaliasing, scalar-reference creation, and aggregate refaliasing, and proves ownership for anonymous arrays reachable through package-rooted hashes while excluding the dying referent. The local `nice -n 19 make` and HTML-Tree 5.07 suite pass; the nested process-handle test allows 30 seconds for Windows child-JVM startup after its previous five-second wait expired in CI. Owner slots still bridge to `RuntimeBase.refCount` for dispatch; this is not the complete Phase 2 ownership migration.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), based on current master `f885fc9097167557091da4e33cb33e76271845d1`. The draft PR remote head remains `df06b9e3a686d2dde7ed3c81489bb9c7832f2f22`; local HEAD `6858743d90f581cf153d35a3f14094d62670d94f` is a fast-forward of 18 commits and needs publication before CI can validate it. Ordinary stores, scalar refaliasing, scalar-reference creation, and aggregate refaliasing through array-element proxies now reconcile owner slots after promoting a new ordinary array. `RuntimeArrayElementOwnershipTest` covers slot creation, referent transfer, aliasing, and removal; `array_element_scalar_reference_lifetime.t` covers a later referent assignment through a newly vivified element reference. The source and Java regression changes pass the clean `nice -n 19 make` gate in 16m50s. The new Perl-level lifetime test passes on blead Perl 5.45.4 and both PerlOnJava backends. `timeout 1800 ./jcpan -t HTML::Tree` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. The existing `lvref_conditional_target_alias.t` passes 58/58 across blead Perl and both backends. The nested process-handle regression passes on blead Perl and both backends. Its Windows CI artifact failed to observe readiness within five seconds even though the child later exited successfully; its wait now allows 30 seconds for Windows child-JVM startup. Recheck this test on Windows after publishing the candidate. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl and both backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays, live registered lexical arrays, and semantic closure-captured arrays; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing each element, and confirms rooted weak hash/array slots do not inflate the restored count. Weak owner-cell references prevent bookkeeping cycles. This remains a recovery bridge rather than the completed Phase 2 ownership migration: `refCount` still controls dispatch, and some unregistered or transitively rooted arrays, scalar/proxy stores, and alias cleanup remain unmigrated. Continue migrating array slot acquisition and release through complete ownership paths, then handle the remaining scalar/proxy stores and aliases.
+The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), based on current master `f885fc9097167557091da4e33cb33e76271845d1`. The draft PR remote head remains `df06b9e3a686d2dde7ed3c81489bb9c7832f2f22`; local HEAD `ad7c690fc82f351fbb0c27bcbb1fc30b70161d59` is a fast-forward of 23 commits and needs publication before CI can validate it. Ordinary stores, scalar refaliasing, scalar-reference creation, and aggregate refaliasing through array-element proxies now reconcile owner slots after promoting a new ordinary array. `RuntimeArrayElementOwnershipTest` covers slot creation, referent transfer, aliasing, and removal; `array_element_scalar_reference_lifetime.t` covers a later referent assignment through a newly vivified element reference. The source and Java regression changes pass the clean `nice -n 19 make` gate in 14m49s. The new Perl-level lifetime tests pass on blead Perl 5.45.4 and both PerlOnJava backends. `timeout 1800 ./jcpan -t HTML::Tree` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. The existing `lvref_conditional_target_alias.t` passes 58/58 across blead Perl and both backends. The nested process-handle regression passes on blead Perl and both backends. Its Windows CI artifact failed to observe readiness within five seconds even though the child later exited successfully; its wait now allows 30 seconds for Windows child-JVM startup. Recheck this test on Windows after publishing the candidate. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl and both backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays, live registered lexical arrays, semantic closure-captured arrays, and anonymous arrays reachable through package-rooted hashes; the latter is covered by `arrayElementOwnerSurvivesWhenAnonymousArrayIsNestedInPackageRootedHash` in `MortalListAggregateArrayOwnerSlotTest`. The new Perl-level array/hash tests verify that replacing final strong elements with integers clears weak references and runs `DESTROY` exactly once; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing each element, and confirms rooted weak hash/array slots do not inflate the restored count. Weak owner-cell references prevent bookkeeping cycles. This remains a recovery bridge rather than the completed Phase 2 ownership migration: `refCount` still controls dispatch, and scalar/proxy stores, alias cleanup, and complete default owner-slot accounting remain unmigrated. Continue migrating complete ownership paths through replacement, deletion, aliases, calls, and final release.
 
 ### Completed
 

From d41dfe401817cd29c084ac9ad2e599ffe7192e4a Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 08:51:03 +0200
Subject: [PATCH 125/317] refactor: clarify array owner recovery proof

Document that array slot recovery requires an independent package-root
path excluding the referent whose deferred release is being handled.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <chatgpt.com@openai.com>
---
 .../org/perlonjava/runtime/runtimetypes/MortalList.java   | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 610e7c7b28..aa6ef17f02 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1948,10 +1948,10 @@ private static boolean restoreReachableHashEntryOwnerCount(RuntimeBase referent)
                 rootedHashCells.add(cell);
             }
         }
-        // Arrays need a stricter proof than hashes here. A transitive root walk
-        // can cross closure pads or diagnostic cycles and outlive the Perl
-        // element owner. A directly package-rooted array is an unambiguous
-        // owner when its current scalar cell is a strong reference.
+        // Array slots are restored only when the array has a live semantic
+        // owner or can be reached independently from package roots. Excluding
+        // the referent from that walk prevents an owner proof through the
+        // object whose pending release triggered this recovery.
         for (PerlOwnerSlot slot : referent.ownerSlotSnapshot()) {
             if (slot.kind() != PerlOwnerSlot.Kind.ARRAY_ELEMENT) continue;
             RuntimeBase owner = slot.ownerContainer();

From fe684d67c77c01cb5ae9c21df272b8df5b1fecc2 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 08:51:36 +0200
Subject: [PATCH 126/317] docs: record latest ownership candidate hash

Update the migration status to the tested candidate after clarifying the
array owner reachability proof.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <chatgpt.com@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 1e20f90220..ceee77a314 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress in [PR #1816](https://github.com/PerlOnJava/pull/1816). Local candidate `ad7c690fc82f351fbb0c27bcbb1fc30b70161d59` is 23 fast-forward commits beyond PR remote head `df06b9e3a686d2dde7ed3c81489bb9c7832f2f22`; publication is pending approval. It records hash-entry and array-element owner slots for deferred-release recovery, registers slots after array proxy stores, scalar refaliasing, scalar-reference creation, and aggregate refaliasing, and proves ownership for anonymous arrays reachable through package-rooted hashes while excluding the dying referent. The local `nice -n 19 make` and HTML-Tree 5.07 suite pass; the nested process-handle test allows 30 seconds for Windows child-JVM startup after its previous five-second wait expired in CI. Owner slots still bridge to `RuntimeBase.refCount` for dispatch; this is not the complete Phase 2 ownership migration.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress in [PR #1816](https://github.com/PerlOnJava/pull/1816). Local candidate `f3ff4d9b3fed2a670f142ae2b7e10928c1b2c058` is 25 fast-forward commits beyond PR remote head `df06b9e3a686d2dde7ed3c81489bb9c7832f2f22`; publication is pending approval. It records hash-entry and array-element owner slots for deferred-release recovery, registers slots after array proxy stores, scalar refaliasing, scalar-reference creation, and aggregate refaliasing, and proves ownership for anonymous arrays reachable through package-rooted hashes while excluding the dying referent. The local `nice -n 19 make` and HTML-Tree 5.07 suite pass; the nested process-handle test allows 30 seconds for Windows child-JVM startup after its previous five-second wait expired in CI. Owner slots still bridge to `RuntimeBase.refCount` for dispatch; this is not the complete Phase 2 ownership migration.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), based on current master `f885fc9097167557091da4e33cb33e76271845d1`. The draft PR remote head remains `df06b9e3a686d2dde7ed3c81489bb9c7832f2f22`; local HEAD `ad7c690fc82f351fbb0c27bcbb1fc30b70161d59` is a fast-forward of 23 commits and needs publication before CI can validate it. Ordinary stores, scalar refaliasing, scalar-reference creation, and aggregate refaliasing through array-element proxies now reconcile owner slots after promoting a new ordinary array. `RuntimeArrayElementOwnershipTest` covers slot creation, referent transfer, aliasing, and removal; `array_element_scalar_reference_lifetime.t` covers a later referent assignment through a newly vivified element reference. The source and Java regression changes pass the clean `nice -n 19 make` gate in 14m49s. The new Perl-level lifetime tests pass on blead Perl 5.45.4 and both PerlOnJava backends. `timeout 1800 ./jcpan -t HTML::Tree` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. The existing `lvref_conditional_target_alias.t` passes 58/58 across blead Perl and both backends. The nested process-handle regression passes on blead Perl and both backends. Its Windows CI artifact failed to observe readiness within five seconds even though the child later exited successfully; its wait now allows 30 seconds for Windows child-JVM startup. Recheck this test on Windows after publishing the candidate. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl and both backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays, live registered lexical arrays, semantic closure-captured arrays, and anonymous arrays reachable through package-rooted hashes; the latter is covered by `arrayElementOwnerSurvivesWhenAnonymousArrayIsNestedInPackageRootedHash` in `MortalListAggregateArrayOwnerSlotTest`. The new Perl-level array/hash tests verify that replacing final strong elements with integers clears weak references and runs `DESTROY` exactly once; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing each element, and confirms rooted weak hash/array slots do not inflate the restored count. Weak owner-cell references prevent bookkeeping cycles. This remains a recovery bridge rather than the completed Phase 2 ownership migration: `refCount` still controls dispatch, and scalar/proxy stores, alias cleanup, and complete default owner-slot accounting remain unmigrated. Continue migrating complete ownership paths through replacement, deletion, aliases, calls, and final release.
+The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), based on current master `f885fc9097167557091da4e33cb33e76271845d1`. The draft PR remote head remains `df06b9e3a686d2dde7ed3c81489bb9c7832f2f22`; local HEAD `f3ff4d9b3fed2a670f142ae2b7e10928c1b2c058` is a fast-forward of 25 commits and needs publication before CI can validate it. Ordinary stores, scalar refaliasing, scalar-reference creation, and aggregate refaliasing through array-element proxies now reconcile owner slots after promoting a new ordinary array. `RuntimeArrayElementOwnershipTest` covers slot creation, referent transfer, aliasing, and removal; `array_element_scalar_reference_lifetime.t` covers a later referent assignment through a newly vivified element reference. The source and Java regression changes pass the clean `nice -n 19 make` gate in 14m49s. The new Perl-level lifetime tests pass on blead Perl 5.45.4 and both PerlOnJava backends. `timeout 1800 ./jcpan -t HTML::Tree` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. The existing `lvref_conditional_target_alias.t` passes 58/58 across blead Perl and both backends. The nested process-handle regression passes on blead Perl and both backends. Its Windows CI artifact failed to observe readiness within five seconds even though the child later exited successfully; its wait now allows 30 seconds for Windows child-JVM startup. Recheck this test on Windows after publishing the candidate. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl and both backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays, live registered lexical arrays, semantic closure-captured arrays, and anonymous arrays reachable through package-rooted hashes; the latter is covered by `arrayElementOwnerSurvivesWhenAnonymousArrayIsNestedInPackageRootedHash` in `MortalListAggregateArrayOwnerSlotTest`. The new Perl-level array/hash tests verify that replacing final strong elements with integers clears weak references and runs `DESTROY` exactly once; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing each element, and confirms rooted weak hash/array slots do not inflate the restored count. Weak owner-cell references prevent bookkeeping cycles. This remains a recovery bridge rather than the completed Phase 2 ownership migration: `refCount` still controls dispatch, and scalar/proxy stores, alias cleanup, and complete default owner-slot accounting remain unmigrated. Continue migrating complete ownership paths through replacement, deletion, aliases, calls, and final release.
 
 ### Completed
 

From 7972148fd07cf4cd4d40c64484119f13f2bf7f7f Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 15:06:31 +0200
Subject: [PATCH 127/317] test: cover Mojolicious controller destruction after
 finish

Add a focused long-poll regression matching Mojolicious's controller lifetime
expectation after the response finish event.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 ...olicious_controller_destroy_after_finish.t | 54 +++++++++++++++++++
 1 file changed, 54 insertions(+)
 create mode 100644 src/test/resources/unit/mojolicious_controller_destroy_after_finish.t

diff --git a/src/test/resources/unit/mojolicious_controller_destroy_after_finish.t b/src/test/resources/unit/mojolicious_controller_destroy_after_finish.t
new file mode 100644
index 0000000000..771ff9ce3b
--- /dev/null
+++ b/src/test/resources/unit/mojolicious_controller_destroy_after_finish.t
@@ -0,0 +1,54 @@
+use strict;
+use warnings;
+use Test::More;
+
+BEGIN {
+  $ENV{MOJO_REACTOR} = 'Mojo::Reactor::Poll';
+  eval {
+    require IO::Socket::INET;
+    require Mojolicious::Lite;
+    Mojolicious::Lite->import;
+    require Test::Mojo;
+    require Mojo::IOLoop;
+    1;
+  } or plan skip_all => 'Mojolicious and Test::Mojo are required';
+
+  my $probe = IO::Socket::INET->new(
+    LocalAddr => '127.0.0.1',
+    LocalPort => 0,
+    Listen    => 1,
+    Proto     => 'tcp',
+  ) or plan skip_all => 'loopback sockets are unavailable';
+  close $probe;
+}
+
+package MojoliciousControllerDestroyAfterFinish;
+use Mojo::Base 'Mojolicious::Controller';
+sub DESTROY { shift->stash->{destroyed} = 1 }
+
+package main;
+app->controller_class('MojoliciousControllerDestroyAfterFinish');
+get '/longpoll' => sub {
+  my $controller = shift;
+  $controller->on(finish => sub { shift->stash->{finished} = 1 });
+  $controller->write_chunk('P' => sub {
+    shift->write_chunk('oll!' => sub { shift->write_chunk('') });
+  });
+};
+
+my $stash;
+my $tick_count = 0;
+my $timer = Mojo::IOLoop->recurring(0.1 => sub { ++$tick_count });
+my $test = Test::Mojo->new;
+$test->app->plugins->once(before_dispatch => sub { $stash = shift->stash });
+$test->get_ok('/longpoll')->status_is(200)->content_is('Poll!');
+
+Mojo::IOLoop->one_tick while !$stash->{finished} && $tick_count < 50;
+is($stash->{finished}, 1, 'long-poll response finish event runs');
+
+$tick_count = 0;
+Mojo::IOLoop->one_tick while !$stash->{destroyed} && $tick_count < 50;
+Mojo::IOLoop->remove($timer);
+ok($stash->{destroyed}, 'controller is destroyed after response finish');
+
+done_testing;

From 03e2b2b53aa951d48f74a17612c1adf53f028d65 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 15:46:22 +0200
Subject: [PATCH 128/317] docs: update ownership candidate validation status

Record the published PR head, full make result, current regression coverage,
and the remaining interpreter parity failures for the #1794 and #1795 paths.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index ceee77a314..2acfa7ae53 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/fglock/PerlOnJava/pull/1816), based on current master `f885fc9097167557091da4e33cb33e76271845d1`. The draft PR remote head remains `df06b9e3a686d2dde7ed3c81489bb9c7832f2f22`; local HEAD `f3ff4d9b3fed2a670f142ae2b7e10928c1b2c058` is a fast-forward of 25 commits and needs publication before CI can validate it. Ordinary stores, scalar refaliasing, scalar-reference creation, and aggregate refaliasing through array-element proxies now reconcile owner slots after promoting a new ordinary array. `RuntimeArrayElementOwnershipTest` covers slot creation, referent transfer, aliasing, and removal; `array_element_scalar_reference_lifetime.t` covers a later referent assignment through a newly vivified element reference. The source and Java regression changes pass the clean `nice -n 19 make` gate in 14m49s. The new Perl-level lifetime tests pass on blead Perl 5.45.4 and both PerlOnJava backends. `timeout 1800 ./jcpan -t HTML::Tree` passes all 23 files and 989 tests, including unchanged `t/refloop.t`. The existing `lvref_conditional_target_alias.t` passes 58/58 across blead Perl and both backends. The nested process-handle regression passes on blead Perl and both backends. Its Windows CI artifact failed to observe readiness within five seconds even though the child later exited successfully; its wait now allows 30 seconds for Windows child-JVM startup. Recheck this test on Windows after publishing the candidate. The Catalyst tempfile regression passes 24/24 without global-destruction resurrection warnings; its permanent wrapper passes on blead Perl and both backends. Root-walk diagnostics identified the warning source: destruction-time owner proofs hit the general 50,000-edge cap with work remaining, and the conservative incomplete-walk result treated transient owners as escapes. The destruction-time proof now has a larger bounded budget while retaining the incomplete-walk safety behavior, with a Java regression covering a large unrelated package graph. `DestroyDispatchAggregateOwnerRootTest` also covers aggregate and closure-pad paths through the dying referent, and `DestroyDispatchWeakSlotRescueRootTest` covers weak-slot replacement during global destruction. The first CI run exposed that Catalyst dependencies are optional in CI; the wrapper now preserves the explicit dependency skip. The WebSocket release regression passes on blead Perl and JVM; interpreter server setup skips. Commits `b802c938a`, `0f91bf663`, and `de3248174` add an initial lifecycle use of ordinary hash-entry slot identities: if a deferred legacy decrement reaches zero, rooted `HASH_ENTRY` slots plus distinct active scalar owners restore the compatibility count. The follow-up also accepts strong cells in directly package-rooted arrays, live registered lexical arrays, semantic closure-captured arrays, and anonymous arrays reachable through package-rooted hashes; the latter is covered by `arrayElementOwnerSurvivesWhenAnonymousArrayIsNestedInPackageRootedHash` in `MortalListAggregateArrayOwnerSlotTest`. The new Perl-level array/hash tests verify that replacing final strong elements with integers clears weak references and runs `DESTROY` exactly once; `MortalListAggregateArrayOwnerSlotTest` verifies retention at legacy zero and release after removing each element, and confirms rooted weak hash/array slots do not inflate the restored count. Weak owner-cell references prevent bookkeeping cycles. This remains a recovery bridge rather than the completed Phase 2 ownership migration: `refCount` still controls dispatch, and scalar/proxy stores, alias cleanup, and complete default owner-slot accounting remain unmigrated. Continue migrating complete ownership paths through replacement, deletion, aliases, calls, and final release.
+The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/PerlOnJava/pull/1816), based on current master `6b577fd68a179452561695a9e6bba784d9195060`. The published draft head is `c6e81d1f7679bcfd92636d049de9562a81ca0186`; Ubuntu and Windows CI are running on that commit. `nice -n 19 make` passes on the candidate in 24m45s. An upstream-matched Mojolicious long-poll test was added at `mojolicious_controller_destroy_after_finish.t`; it passes 5/5 on blead Perl 5.45.4 and the JVM backend, while its controller-destruction assertion still fails on the interpreter backend. The existing combined WebSocket/lifecycle test passes 29/29 on the JVM; in interpreter mode it stalls after the long-poll response finishes. The Catalyst request-body and multipart tempfile regression passes 24/24 on the JVM and in an isolated interpreter run; an earlier sequential interpreter run exceeded its timeout during multipart handling, so repeat under CI load if relevant. These interpreter results remain parity gaps, not passing evidence for the issues. The previously validated ownership changes and evidence below are unchanged. This remains a recovery bridge rather than the completed Phase 2 ownership migration: `refCount` still controls dispatch, and scalar/proxy stores, alias cleanup, and complete default owner-slot accounting remain unmigrated. Continue migrating complete ownership paths through replacement, deletion, aliases, calls, and final release.
 
 ### Completed
 

From bfa83a682313aff07dda801a6009b695083be4ba Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 18:29:24 +0200
Subject: [PATCH 129/317] test: cover controller capture release after
 transaction teardown

Add a socket-free regression for a controller retained by a transaction
callback and assert DESTROY runs after the transaction releases that callback.
Update the ownership progress record with current PR and CI evidence.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          |  4 +-
 .../issue_1794_controller_owner_release.t     | 54 +++++++++++++++++++
 2 files changed, 56 insertions(+), 2 deletions(-)
 create mode 100644 src/test/resources/unit/refcount/issue_1794_controller_owner_release.t

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 2acfa7ae53..d909db3e20 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress in [PR #1816](https://github.com/PerlOnJava/pull/1816). Local candidate `f3ff4d9b3fed2a670f142ae2b7e10928c1b2c058` is 25 fast-forward commits beyond PR remote head `df06b9e3a686d2dde7ed3c81489bb9c7832f2f22`; publication is pending approval. It records hash-entry and array-element owner slots for deferred-release recovery, registers slots after array proxy stores, scalar refaliasing, scalar-reference creation, and aggregate refaliasing, and proves ownership for anonymous arrays reachable through package-rooted hashes while excluding the dying referent. The local `nice -n 19 make` and HTML-Tree 5.07 suite pass; the nested process-handle test allows 30 seconds for Windows child-JVM startup after its previous five-second wait expired in CI. Owner slots still bridge to `RuntimeBase.refCount` for dispatch; this is not the complete Phase 2 ownership migration.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress in [PR #1816](https://github.com/PerlOnJava/pull/1816), currently open as a draft at `d0efeda1a1b31790ffc81e73d1aaa5c098eedbdc`. Linux and Windows `make` jobs and the configured Perl thread compatibility gates pass on that head. It records hash-entry and array-element owner slots for deferred-release recovery, registers slots after array proxy stores, scalar refaliasing, scalar-reference creation, and aggregate refaliasing, and proves ownership for anonymous arrays reachable through package-rooted hashes while excluding the dying referent. The local `nice -n 19 make` and HTML-Tree 5.07 suite pass; the nested process-handle test allows 30 seconds for Windows child-JVM startup after its previous five-second wait expired in CI. Owner slots still bridge to `RuntimeBase.refCount` for dispatch; this is not the complete Phase 2 ownership migration.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/PerlOnJava/pull/1816), based on current master `6b577fd68a179452561695a9e6bba784d9195060`. The published draft head is `c6e81d1f7679bcfd92636d049de9562a81ca0186`; Ubuntu and Windows CI are running on that commit. `nice -n 19 make` passes on the candidate in 24m45s. An upstream-matched Mojolicious long-poll test was added at `mojolicious_controller_destroy_after_finish.t`; it passes 5/5 on blead Perl 5.45.4 and the JVM backend, while its controller-destruction assertion still fails on the interpreter backend. The existing combined WebSocket/lifecycle test passes 29/29 on the JVM; in interpreter mode it stalls after the long-poll response finishes. The Catalyst request-body and multipart tempfile regression passes 24/24 on the JVM and in an isolated interpreter run; an earlier sequential interpreter run exceeded its timeout during multipart handling, so repeat under CI load if relevant. These interpreter results remain parity gaps, not passing evidence for the issues. The previously validated ownership changes and evidence below are unchanged. This remains a recovery bridge rather than the completed Phase 2 ownership migration: `refCount` still controls dispatch, and scalar/proxy stores, alias cleanup, and complete default owner-slot accounting remain unmigrated. Continue migrating complete ownership paths through replacement, deletion, aliases, calls, and final release.
+The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/PerlOnJava/pull/1816), based on current master `6b577fd68a179452561695a9e6bba784d9195060`. The published draft head is `d0efeda1a1b31790ffc81e73d1aaa5c098eedbdc`; Linux and Windows `make` and the configured Perl thread compatibility gates pass on that commit. The local full `nice -n 19 make`, including the new regression, passes in 22m28s. The upstream-matched Mojolicious long-poll test at `mojolicious_controller_destroy_after_finish.t` passes 5/5 on blead Perl 5.45.4 and the JVM backend; the interpreter backend fails the controller-destruction assertion. An extended-access owner trace narrows its retained edge to an inactive `Mojolicious::Controller::write_chunk` closure capture through a `PerlOwnerSlot` array. The socket-free focused regression at `refcount/issue_1794_controller_owner_release.t` passes on blead and JVM PerlOnJava but shows the interpreter clears the weak observer without running `DESTROY` when a weak transaction releases its callback. An ordinary consumed `Mojo::EventEmitter` one-shot callback releases its captured object on both PerlOnJava backends, so the remaining gap is in persistent callback teardown. The existing combined WebSocket/lifecycle test passes 29/29 on the JVM; in interpreter mode it stalls after the long-poll response finishes. The Catalyst request-body and multipart tempfile regression passes 24/24 on the JVM and in an isolated interpreter run; an earlier sequential interpreter run exceeded its timeout during multipart handling, so repeat under CI load if relevant. These interpreter results remain parity gaps, not passing evidence for the issues. The previously validated ownership changes and evidence below are unchanged. This remains a recovery bridge rather than the completed Phase 2 ownership migration: `refCount` still controls dispatch, and scalar/proxy stores, alias cleanup, and complete default owner-slot accounting remain unmigrated. Continue migrating complete ownership paths through replacement, deletion, aliases, calls, and final release.
 
 ### Completed
 
diff --git a/src/test/resources/unit/refcount/issue_1794_controller_owner_release.t b/src/test/resources/unit/refcount/issue_1794_controller_owner_release.t
new file mode 100644
index 0000000000..3bc2a9b5e2
--- /dev/null
+++ b/src/test/resources/unit/refcount/issue_1794_controller_owner_release.t
@@ -0,0 +1,54 @@
+use strict;
+use warnings;
+
+use Test::More;
+use Scalar::Util qw(weaken);
+use Mojo::EventEmitter;
+
+{
+    package Issue1794Transaction;
+    use Mojo::Base 'Mojo::EventEmitter';
+
+    sub finish { shift->emit('finish') }
+}
+
+{
+    package Issue1794Controller;
+    use Scalar::Util qw(weaken);
+
+    sub new {
+        my ($class, $tx) = @_;
+        my $self = bless { tx => $tx }, $class;
+        weaken($self->{tx});
+        return $self;
+    }
+
+    sub on {
+        my ($self, $name, $callback) = @_;
+        my $tx = $self->{tx};
+        return $tx->on($name => sub { shift; $self->$callback(@_) });
+    }
+
+    sub DESTROY { $main::destroyed++ }
+}
+
+our $destroyed = 0;
+my $weak_controller;
+{
+    my $tx = Issue1794Transaction->new;
+    my $controller = Issue1794Controller->new($tx);
+    $weak_controller = $controller;
+    weaken($weak_controller);
+
+    $controller->on(finish => sub { shift });
+    $tx->finish;
+    undef $controller;
+
+    is($destroyed, 0, 'transaction callback keeps controller alive before teardown');
+    undef $tx;
+}
+
+is($destroyed, 1, 'controller DESTROY runs when its transaction releases callbacks');
+is($weak_controller, undef, 'controller weak reference clears after transaction teardown');
+
+done_testing;

From aca972f2c4071ade93ea18e67bdcf07f2abdcbd9 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Mon, 19 Oct 2026 22:57:15 +0200
Subject: [PATCH 130/317] wip: snapshot lifecycle sweep changes

Preserve the current statement-boundary capture release edits before continuing
interpreter lifecycle investigation.

Generated with OpenAI Codex (https://openai.com/codex)

Co-Authored-By: OpenAI Codex <openai-codex[bot]@users.noreply.github.com>
---
 .../org/perlonjava/runtime/runtimetypes/MortalList.java     | 5 ++++-
 .../perlonjava/runtime/runtimetypes/ReachabilityWalker.java | 6 ++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index aa6ef17f02..2d19e0f656 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -348,13 +348,16 @@ private static boolean isDeferredScopeExitCandidate(RuntimeBase base) {
     private static void processUnreachableScopeExitCaptureCandidates(
             LifecycleRuntimeState state) {
         if (state.deferredScopeExitCaptureCandidates.isEmpty()) return;
-
         Set<RuntimeBase> endReachable = ReachabilityWalker.walkEndBlockRoots();
         Set<RuntimeBase> cycleProtected = ReachabilityWalker.strongCycleProtectedReferents();
         boolean found = false;
         for (RuntimeScalar scalar : new ArrayList<>(state.deferredScopeExitCaptureCandidates)) {
             if (!scalar.scopeExited) continue;
             RuntimeBase base = scalar.value instanceof RuntimeBase value ? value : null;
+            if (base != null) {
+                ReachabilityWalker.releaseUnreachableScopeExitedCaptureOwners(
+                        java.util.List.of(base), endReachable);
+            }
             boolean scalarReachable = ReachabilityWalker.isScalarReachable(scalar)
                     || ReachabilityWalker.isReachableFromRoots(scalar);
             boolean retained = endReachable.contains(scalar)
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index b2c5de8cde..cacc70d7e5 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -3782,6 +3782,12 @@ static int sweepStatementBoundaryDestroyableObjects() {
         java.util.List<RuntimeBase> candidates =
                 DestroyDispatch.snapshotStatementBoundaryDestroyableObjects();
         if (candidates.isEmpty()) return 0;
+        // A scope-exited closure pad can be the only remaining bookkeeping
+        // owner for a destroyable referent after its callback container has
+        // gone away. Retire such dead capture edges before the root walk so
+        // statement-boundary DESTROY matches Perl without waiting for a weak
+        // reference sweep or an explicit jperl_gc().
+        releaseUnreachableScopeExitedCaptureOwners(candidates, null);
         Set<RuntimeBase> live = new ReachabilityWalker().walk();
         return destroyUnreachableDestroyables(candidates, live);
     }

From 162f06a688d247a2ba1aa3a035508cfdf363777d Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 03:20:28 +0200
Subject: [PATCH 131/317] fix: release scope-exited captures through owner
 containers

Recheck nested array and hash owner containers when scope-exited captures
are processed, and schedule another weak sweep when the last closure owner
is released. This covers controller teardown after event callbacks end.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtime/runtimetypes/MortalList.java      | 51 +++++++++++++++++--
 .../runtime/runtimetypes/RuntimeScalar.java   |  1 +
 2 files changed, 47 insertions(+), 5 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 2d19e0f656..5d0b444ec9 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -324,6 +324,16 @@ public static void noteDeferredScopeExitCaptureCandidate(RuntimeScalar scalar) {
         noteDeferredScopeExitCaptureCandidate(state(), scalar);
     }
 
+    /** Recheck a scope-exited referent when its final closure owner is released. */
+    public static void closureCaptureReleased(RuntimeScalar scalar) {
+        if (scalar == null || !scalar.scopeExited
+                || (scalar.type & RuntimeScalarType.REFERENCE_BIT) == 0
+                || !(scalar.value instanceof RuntimeBase base)
+                || !isDeferredScopeExitCandidate(base)) return;
+        noteDeferredScopeExitCaptureCandidate(state(), scalar);
+        requestImmediateWeakSweep();
+    }
+
     private static void noteDeferredScopeExitCaptureCandidate(
             LifecycleRuntimeState state, RuntimeScalar scalar) {
         if (scalar.value instanceof RuntimeBase base && isDeferredScopeExitCandidate(base)) {
@@ -338,6 +348,19 @@ private static boolean isDeferredScopeExitCandidate(RuntimeBase base) {
         return className != null && DestroyDispatch.classHasDestroy(base.blessId, className);
     }
 
+    private static boolean containerDirectlyOwnsReferent(
+            RuntimeBase container, RuntimeBase referent) {
+        if (container instanceof RuntimeArray array) {
+            return array.elements.stream().anyMatch(scalar -> scalar != null
+                    && scalar.value == referent);
+        }
+        if (container instanceof RuntimeHash hash) {
+            return hash.elements.values().stream().anyMatch(scalar -> scalar != null
+                    && scalar.value == referent);
+        }
+        return false;
+    }
+
     /**
      * Release eval STRING over-captures whose declaring scope just exited and
      * which cannot be reached by live code or an END block. Reachability sweeps
@@ -348,16 +371,34 @@ private static boolean isDeferredScopeExitCandidate(RuntimeBase base) {
     private static void processUnreachableScopeExitCaptureCandidates(
             LifecycleRuntimeState state) {
         if (state.deferredScopeExitCaptureCandidates.isEmpty()) return;
+        // Nested Perl frames can still own transient callback and request
+        // state through active call arguments. Keep candidates queued until
+        // an outer statement boundary can inspect the completed owner graph.
+        if (RuntimeCode.argsStackDepth() > 1) return;
         Set<RuntimeBase> endReachable = ReachabilityWalker.walkEndBlockRoots();
         Set<RuntimeBase> cycleProtected = ReachabilityWalker.strongCycleProtectedReferents();
+        Set<RuntimeBase> candidateReferents =
+                Collections.newSetFromMap(new IdentityHashMap<>());
+        for (RuntimeScalar scalar : state.deferredScopeExitCaptureCandidates) {
+            if (scalar.scopeExited && scalar.value instanceof RuntimeBase base) {
+                candidateReferents.add(base);
+            }
+        }
+        List<RuntimeBase> captureOwnerReferents = new ArrayList<>(candidateReferents);
+        for (RuntimeBase ownerReferent : PerlRuntime.snapshotOwnerSlotReferents()) {
+            if (candidateReferents.stream().anyMatch(
+                    candidate -> containerDirectlyOwnsReferent(ownerReferent, candidate))) {
+                captureOwnerReferents.add(ownerReferent);
+            }
+        }
+        ReachabilityWalker.releaseUnreachableScopeExitedCaptureOwners(
+                captureOwnerReferents, endReachable);
         boolean found = false;
         for (RuntimeScalar scalar : new ArrayList<>(state.deferredScopeExitCaptureCandidates)) {
-            if (!scalar.scopeExited) continue;
-            RuntimeBase base = scalar.value instanceof RuntimeBase value ? value : null;
-            if (base != null) {
-                ReachabilityWalker.releaseUnreachableScopeExitedCaptureOwners(
-                        java.util.List.of(base), endReachable);
+            if (!scalar.scopeExited) {
+                continue;
             }
+            RuntimeBase base = scalar.value instanceof RuntimeBase value ? value : null;
             boolean scalarReachable = ReachabilityWalker.isScalarReachable(scalar)
                     || ReachabilityWalker.isReachableFromRoots(scalar);
             boolean retained = endReachable.contains(scalar)
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 452496704c..b66b0e22f9 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -603,6 +603,7 @@ public void releaseClosureCapture() {
         if (captureCount == 0) {
             releaseOneClosureCaptureReferent();
             releaseClosureOwnerSlot();
+            if (scopeExited) MortalList.closureCaptureReleased(this);
         }
     }
 

From 6e72e6f2aa8ecb319a39d9207e7de29c4bf48fab Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 07:29:06 +0200
Subject: [PATCH 132/317] test: make controller ownership regression
 self-contained

Use a small local event emitter in the focused lifetime test so it does not
require an optional Mojo::EventEmitter installation in CI. The real
Mojolicious controller test remains covered separately when its dependencies
and loopback sockets are available.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../issue_1794_controller_owner_release.t        | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/src/test/resources/unit/refcount/issue_1794_controller_owner_release.t b/src/test/resources/unit/refcount/issue_1794_controller_owner_release.t
index 3bc2a9b5e2..1eab25998f 100644
--- a/src/test/resources/unit/refcount/issue_1794_controller_owner_release.t
+++ b/src/test/resources/unit/refcount/issue_1794_controller_owner_release.t
@@ -3,13 +3,25 @@ use warnings;
 
 use Test::More;
 use Scalar::Util qw(weaken);
-use Mojo::EventEmitter;
 
 {
     package Issue1794Transaction;
-    use Mojo::Base 'Mojo::EventEmitter';
+
+    sub new { bless { events => {} }, shift }
+
+    sub on {
+        my ($self, $name, $callback) = @_;
+        push @{$self->{events}{$name}}, $callback;
+        return $self;
+    }
 
     sub finish { shift->emit('finish') }
+
+    sub emit {
+        my ($self, $name, @args) = @_;
+        $_->($self, @args) for @{$self->{events}{$name} // []};
+        return $self;
+    }
 }
 
 {

From c4310740d2ecaab11a94b9a7cef52149ae22fdc3 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 10:05:59 +0200
Subject: [PATCH 133/317] wip: snapshot interpreter lifetime investigation

Snapshot the in-progress closure ownership tracking and interpreter
controller lifetime regression before further debugging.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <codex@openai.com>
---
 .../bytecode/OpcodeHandlerExtended.java       |  2 +-
 .../frontend/parser/SubroutineParser.java     |  2 +-
 .../runtime/perlmodule/Internals.java         |  9 ++-
 .../runtimetypes/ReachabilityWalker.java      | 11 ++-
 .../runtime/runtimetypes/RuntimeCode.java     |  6 +-
 .../runtimetypes/RuntimeGraphCloner.java      |  2 +-
 .../runtime/runtimetypes/RuntimeScalar.java   | 75 ++++++++++++++++++-
 ...iousInterpreterControllerLifetimeTest.java | 70 +++++++++++++++++
 8 files changed, 165 insertions(+), 12 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/MojoliciousInterpreterControllerLifetimeTest.java

diff --git a/src/main/java/org/perlonjava/backend/bytecode/OpcodeHandlerExtended.java b/src/main/java/org/perlonjava/backend/bytecode/OpcodeHandlerExtended.java
index f27dfd7bf8..87f048c16c 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/OpcodeHandlerExtended.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/OpcodeHandlerExtended.java
@@ -1107,7 +1107,7 @@ public static int executeCreateClosure(int[] bytecode, int pc, RuntimeBase[] reg
             if (captured instanceof RuntimeScalar s) {
                 if (!seenScalars.add(s)) continue;
                 capturedScalars.add(s);
-                s.retainClosureCapture();
+                s.retainClosureCapture(closureCode);
             } else if (captured instanceof RuntimeArray || captured instanceof RuntimeHash) {
                 if (!seenAggregates.add(captured)) continue;
                 capturedAggregates.add(captured);
diff --git a/src/main/java/org/perlonjava/frontend/parser/SubroutineParser.java b/src/main/java/org/perlonjava/frontend/parser/SubroutineParser.java
index 9cace585b7..df8a0328d3 100644
--- a/src/main/java/org/perlonjava/frontend/parser/SubroutineParser.java
+++ b/src/main/java/org/perlonjava/frontend/parser/SubroutineParser.java
@@ -2761,7 +2761,7 @@ private static void installClosureCaptureMetadata(
             }
             if (value instanceof RuntimeScalar scalar) {
                 capturedScalars.add(scalar);
-                scalar.retainClosureCapture();
+                scalar.retainClosureCapture(code);
             } else if (value instanceof RuntimeArray || value instanceof RuntimeHash) {
                 RuntimeBase aggregate = (RuntimeBase) value;
                 capturedAggregates.add(aggregate);
diff --git a/src/main/java/org/perlonjava/runtime/perlmodule/Internals.java b/src/main/java/org/perlonjava/runtime/perlmodule/Internals.java
index e690c83122..31a602cf61 100644
--- a/src/main/java/org/perlonjava/runtime/perlmodule/Internals.java
+++ b/src/main/java/org/perlonjava/runtime/perlmodule/Internals.java
@@ -384,12 +384,13 @@ private static void replaceCaptureTracking(
             RuntimeCode code, RuntimeBase previous, RuntimeBase replacement) {
         if (previous == replacement) return;
 
-        if (previous instanceof RuntimeScalar && replacement instanceof RuntimeScalar scalar
+        if (previous instanceof RuntimeScalar previousScalar
+                && replacement instanceof RuntimeScalar scalar
                 && code.capturedScalars != null) {
             for (int i = 0; i < code.capturedScalars.length; i++) {
-                if (code.capturedScalars[i] == previous) {
-                    scalar.retainClosureCapture();
-                    previous.releaseClosureCapture();
+                if (code.capturedScalars[i] == previousScalar) {
+                    scalar.retainClosureCapture(code);
+                    previousScalar.releaseClosureCapture(code);
                     code.capturedScalars[i] = scalar;
                     return;
                 }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index cacc70d7e5..c6aa590a89 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1901,11 +1901,14 @@ public static boolean isScalarReachable(RuntimeScalar target) {
      */
     static final class ScalarRootReachabilitySnapshot {
         private final Set<RuntimeScalar> reachable;
+        private final Set<RuntimeBase> reachableBases;
         private final boolean complete;
 
         private ScalarRootReachabilitySnapshot(Set<RuntimeScalar> reachable,
+                                               Set<RuntimeBase> reachableBases,
                                                boolean complete) {
             this.reachable = reachable;
+            this.reachableBases = reachableBases;
             this.complete = complete;
         }
 
@@ -1915,6 +1918,10 @@ boolean isReachable(RuntimeScalar target) {
             return target != null && (!complete || reachable.contains(target));
         }
 
+        boolean isReachable(RuntimeBase target) {
+            return target != null && (!complete || reachableBases.contains(target));
+        }
+
         boolean complete() {
             return complete;
         }
@@ -2108,7 +2115,8 @@ private static ScalarRootReachabilitySnapshot scalarReachabilitySnapshot(
                 }
             }
         }
-        return new ScalarRootReachabilitySnapshot(reachableScalars, todo.isEmpty());
+        return new ScalarRootReachabilitySnapshot(
+                reachableScalars, seen, todo.isEmpty());
     }
 
     private static void addScalarReachabilityRoot(
@@ -3534,6 +3542,7 @@ static void releaseUnreachableScopeExitedCaptureOwners(
                 if (retainedByEnd.contains(padCell) || retainedByEnd.contains(referent)) continue;
                 if (scalarRoots == null) scalarRoots = completeScalarReachabilitySnapshot();
                 if (scalarRoots.isReachable(padCell)) continue;
+                padCell.releaseUnreachableDestroyableClosureOwners(scalarRoots);
                 if (WALKER_TRACE_CLASS != null && !WALKER_TRACE_CLASS.isEmpty()) {
                     String className = NameNormalizer.getBlessStr(referent.blessId);
                     if (className != null && className.contains(WALKER_TRACE_CLASS)) {
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
index 1969ae70dc..1b4c222dbe 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeCode.java
@@ -2872,7 +2872,7 @@ public void releaseCaptures() {
             RuntimeScalar[] scalars = capturedScalars;
             capturedScalars = null;  // null out first to prevent re-entry
             for (RuntimeScalar s : scalars) {
-                s.releaseClosureCapture();
+                s.releaseClosureCapture(this);
                 if (s.captureCount == 0) {
                     // If the captured scalar itself holds an unowned CODE ref with
                     // captures, release those recursively (handles nested closures).
@@ -5369,7 +5369,7 @@ public static RuntimeScalar makeCodeObject(
                     }
                     code.closedOverVariables.put(f.getName(), capturedVar);
                     captured.add(capturedVar);
-                    capturedVar.retainClosureCapture();
+                    capturedVar.retainClosureCapture(code);
                 }
             } else if (f.getType() == RuntimeArray.class || f.getType() == RuntimeHash.class) {
                 RuntimeBase capturedAggregate = (RuntimeBase) f.get(codeObject);
@@ -6044,7 +6044,7 @@ private static RuntimeList bindReturnedMethodCoderef(
         bound.refCount = 0;
         bound.capturedScalars = new RuntimeScalar[] { new RuntimeScalar(codeRef), invocant };
         for (RuntimeScalar captured : bound.capturedScalars) {
-            captured.retainClosureCapture();
+            captured.retainClosureCapture(bound);
         }
         registerJvmClosure(bound);
         return new RuntimeScalar(bound).getList();
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java
index 531804d250..8090e1a5a7 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java
@@ -439,7 +439,7 @@ private void copyCodeMetadata(RuntimeCode source, RuntimeCode target) {
             }
             try (PerlRuntime.Binding ignored = targetRuntime.bind()) {
                 for (RuntimeScalar captured : target.capturedScalars) {
-                    captured.retainThreadCloneClosureCapture();
+                    captured.retainThreadCloneClosureCapture(target);
                 }
             }
         }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index b66b0e22f9..5a1baf2c3f 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -399,6 +399,14 @@ void clearForArraySlotRemoval() {
     /** Explicit identity for this pad cell's closure owner edge. */
     private PerlOwnerSlot closureOwnerSlot;
 
+    /**
+     * Weak links to closures that capture a destroyable referent through this
+     * pad cell.  The closure owns the pad strongly; this reverse index is only
+     * used to release captures when a complete Perl-root walk proves that the
+     * closure itself has become unreachable.
+     */
+    private List<WeakReference<RuntimeCode>> destroyableClosureOwners;
+
     /**
      * Number of closure-capture owners currently retained on this scalar's
      * referent. This is separate from {@link #captureCount}: a weak scalar, an
@@ -566,6 +574,10 @@ private boolean isDetachedFromContainerOwner() {
     }
 
     public void retainClosureCapture() {
+        retainClosureCapture(null);
+    }
+
+    public void retainClosureCapture(RuntimeCode closureOwner) {
         boolean firstCapture = captureCount++ == 0;
         if (firstCapture && type == RuntimeScalarType.CODE) {
             retainClosureCaptureReferent();
@@ -585,15 +597,21 @@ public void retainClosureCapture() {
             RuntimeBase base = semanticCaptureReferent();
             updateClosureOwnerSlot(base);
         }
+        recordDestroyableClosureOwner(closureOwner);
     }
 
     /** Reconstruct capture ownership for an independent ithread snapshot. */
     void retainThreadCloneClosureCapture() {
+        retainThreadCloneClosureCapture(null);
+    }
+
+    void retainThreadCloneClosureCapture(RuntimeCode closureOwner) {
         captureCount++;
         // An owning lexical slot already protects its referent. Borrowed
         // argument aliases do not, and the source runtime's other owners are
         // not a lifetime guarantee in the cloned runtime.
         if (!refCountOwned) retainClosureCaptureReferent();
+        recordDestroyableClosureOwner(closureOwner);
     }
 
     public void releaseClosureCapture() {
@@ -607,6 +625,61 @@ public void releaseClosureCapture() {
         }
     }
 
+    public void releaseClosureCapture(RuntimeCode closureOwner) {
+        forgetDestroyableClosureOwner(closureOwner);
+        releaseClosureCapture();
+    }
+
+    private void recordDestroyableClosureOwner(RuntimeCode closureOwner) {
+        if (closureOwner == null || WeakRefRegistry.isweak(this)
+                || !(value instanceof RuntimeBase referent) || referent.blessId == 0) {
+            return;
+        }
+        String className = NameNormalizer.getBlessStr(referent.blessId);
+        if (className == null || !DestroyDispatch.classHasDestroy(referent.blessId, className)) {
+            return;
+        }
+        if (destroyableClosureOwners == null) destroyableClosureOwners = new ArrayList<>();
+        for (int i = destroyableClosureOwners.size() - 1; i >= 0; i--) {
+            RuntimeCode existing = destroyableClosureOwners.get(i).get();
+            if (existing == null) {
+                destroyableClosureOwners.remove(i);
+            } else if (existing == closureOwner) {
+                return;
+            }
+        }
+        destroyableClosureOwners.add(new WeakReference<>(closureOwner));
+    }
+
+    private void forgetDestroyableClosureOwner(RuntimeCode closureOwner) {
+        if (closureOwner == null || destroyableClosureOwners == null) return;
+        destroyableClosureOwners.removeIf(reference -> {
+            RuntimeCode existing = reference.get();
+            return existing == null || existing == closureOwner;
+        });
+        if (destroyableClosureOwners.isEmpty()) destroyableClosureOwners = null;
+    }
+
+    boolean releaseUnreachableDestroyableClosureOwners(
+            ReachabilityWalker.ScalarRootReachabilitySnapshot roots) {
+        if (roots == null || !roots.complete() || destroyableClosureOwners == null) return false;
+        List<RuntimeCode> unreachable = new ArrayList<>();
+        List<WeakReference<RuntimeCode>> retained = new ArrayList<>();
+        for (WeakReference<RuntimeCode> reference : destroyableClosureOwners) {
+            RuntimeCode owner = reference.get();
+            if (owner == null) continue;
+            if (roots.isReachable(owner)) retained.add(reference);
+            else unreachable.add(owner);
+        }
+        destroyableClosureOwners = retained.isEmpty() ? null : retained;
+        for (RuntimeCode owner : unreachable) {
+            if (owner.capturedScalars != null || owner.capturedAggregates != null) {
+                owner.releaseCaptures();
+            }
+        }
+        return !unreachable.isEmpty();
+    }
+
     /**
      * Retire this pad cell's semantic edge once its declaring scope has exited
      * and the pre-END reachability walk has established that no END block can
@@ -5329,7 +5402,7 @@ public static void scopeExitCleanup(RuntimeScalar scalar) {
                 }
                 if (selfRef) {
                     // Decrement our captureCount (the closure captured us)
-                    scalar.releaseClosureCapture();
+                    scalar.releaseClosureCapture(code);
                     // Remove self from capturedScalars to prevent double-decrement
                     // when releaseCaptures runs later during CODE ref destruction
                     RuntimeScalar[] old = code.capturedScalars;
diff --git a/src/test/java/org/perlonjava/MojoliciousInterpreterControllerLifetimeTest.java b/src/test/java/org/perlonjava/MojoliciousInterpreterControllerLifetimeTest.java
new file mode 100644
index 0000000000..1b69b6744d
--- /dev/null
+++ b/src/test/java/org/perlonjava/MojoliciousInterpreterControllerLifetimeTest.java
@@ -0,0 +1,70 @@
+package org.perlonjava;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Assumptions;
+import org.perlonjava.app.cli.CompilerOptions;
+import org.perlonjava.app.scriptengine.PerlLanguageProvider;
+import org.perlonjava.runtime.io.StandardIO;
+import org.perlonjava.runtime.runtimetypes.GlobalVariable;
+import org.perlonjava.runtime.runtimetypes.PerlExitException;
+import org.perlonjava.runtime.runtimetypes.RuntimeArray;
+import org.perlonjava.runtime.runtimetypes.RuntimeIO;
+import org.perlonjava.runtime.runtimetypes.RuntimeScalar;
+
+import java.io.ByteArrayOutputStream;
+import java.io.InputStream;
+import java.io.PrintStream;
+import java.nio.charset.StandardCharsets;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("unit")
+class MojoliciousInterpreterControllerLifetimeTest extends PerlRuntimeTestBase {
+    @Test
+    void controllerIsDestroyedAfterAsyncResponseFinishInInterpreter() throws Exception {
+        PerlLanguageProvider.resetAll();
+        String script;
+        try (InputStream input = getClass().getClassLoader().getResourceAsStream(
+                "unit/mojolicious_controller_destroy_after_finish.t")) {
+            Assumptions.assumeTrue(input != null,
+                    "Mojolicious controller regression resource is unavailable");
+            script = new String(input.readAllBytes(), StandardCharsets.UTF_8);
+        }
+
+        CompilerOptions options = new CompilerOptions();
+        options.fileName = "unit/mojolicious_controller_destroy_after_finish.t";
+        options.code = script;
+        options.useInterpreter = true;
+        RuntimeArray.push(options.inc, new RuntimeScalar("src/main/perl/lib"));
+        RuntimeArray.push(options.inc, new RuntimeScalar("src/test/resources/unit/lib"));
+
+        PrintStream originalOut = System.out;
+        RuntimeIO originalRuntimeOut = RuntimeIO.getStdout();
+        ByteArrayOutputStream output = new ByteArrayOutputStream();
+        PrintStream capturedOut = new PrintStream(output, true, StandardCharsets.UTF_8);
+        try {
+            RuntimeIO.setStdout(new RuntimeIO(new StandardIO(output, true)));
+            GlobalVariable.getGlobalIO("main::STDOUT").setIO(RuntimeIO.getStdout());
+            System.setOut(capturedOut);
+            try {
+                PerlLanguageProvider.executePerlCode(options, true);
+            } catch (PerlExitException exit) {
+                if (exit.getExitCode() != 0) throw exit;
+            }
+        } finally {
+            RuntimeIO.setStdout(originalRuntimeOut);
+            GlobalVariable.getGlobalIO("main::STDOUT").setIO(originalRuntimeOut);
+            System.setOut(originalOut);
+            capturedOut.close();
+        }
+
+        String tap = output.toString(StandardCharsets.UTF_8);
+        if (tap.contains("1..0 # SKIP")) {
+            Assumptions.abort("Mojolicious or loopback support is unavailable: " + tap.trim());
+        }
+        assertTrue(tap.contains("1..5"), "interpreter did not run all five assertions:\n" + tap);
+        assertFalse(tap.lines().anyMatch(line -> line.trim().startsWith("not ok")), tap);
+    }
+}

From 796ba80289a35f9f84f256575cd0c9c7c60c6b9c Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 14:29:36 +0200
Subject: [PATCH 134/317] wip: snapshot WebSocket lifetime regressions

Save the new Mojolicious WebSocket resource and interpreter test before
continuing the interpreter cleanup investigation.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 ...ciousInterpreterWebSocketLifetimeTest.java | 70 +++++++++++++++++++
 ...jolicious_websocket_server_push_lifetime.t | 58 +++++++++++++++
 2 files changed, 128 insertions(+)
 create mode 100644 src/test/java/org/perlonjava/MojoliciousInterpreterWebSocketLifetimeTest.java
 create mode 100644 src/test/resources/unit/mojolicious_websocket_server_push_lifetime.t

diff --git a/src/test/java/org/perlonjava/MojoliciousInterpreterWebSocketLifetimeTest.java b/src/test/java/org/perlonjava/MojoliciousInterpreterWebSocketLifetimeTest.java
new file mode 100644
index 0000000000..4678ebc41a
--- /dev/null
+++ b/src/test/java/org/perlonjava/MojoliciousInterpreterWebSocketLifetimeTest.java
@@ -0,0 +1,70 @@
+package org.perlonjava;
+
+import org.junit.jupiter.api.Assumptions;
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+import org.perlonjava.app.cli.CompilerOptions;
+import org.perlonjava.app.scriptengine.PerlLanguageProvider;
+import org.perlonjava.runtime.io.StandardIO;
+import org.perlonjava.runtime.runtimetypes.GlobalVariable;
+import org.perlonjava.runtime.runtimetypes.PerlExitException;
+import org.perlonjava.runtime.runtimetypes.RuntimeArray;
+import org.perlonjava.runtime.runtimetypes.RuntimeIO;
+import org.perlonjava.runtime.runtimetypes.RuntimeScalar;
+
+import java.io.ByteArrayOutputStream;
+import java.io.InputStream;
+import java.io.PrintStream;
+import java.nio.charset.StandardCharsets;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("unit")
+class MojoliciousInterpreterWebSocketLifetimeTest extends PerlRuntimeTestBase {
+    @Test
+    void websocketServerPushControllerIsDestroyedAfterFinishInInterpreter() throws Exception {
+        PerlLanguageProvider.resetAll();
+        String script;
+        try (InputStream input = getClass().getClassLoader().getResourceAsStream(
+                "unit/mojolicious_websocket_server_push_lifetime.t")) {
+            Assumptions.assumeTrue(input != null,
+                    "Mojolicious WebSocket regression resource is unavailable");
+            script = new String(input.readAllBytes(), StandardCharsets.UTF_8);
+        }
+
+        CompilerOptions options = new CompilerOptions();
+        options.fileName = "unit/mojolicious_websocket_server_push_lifetime.t";
+        options.code = script;
+        options.useInterpreter = true;
+        RuntimeArray.push(options.inc, new RuntimeScalar("src/main/perl/lib"));
+        RuntimeArray.push(options.inc, new RuntimeScalar("src/test/resources/unit/lib"));
+
+        PrintStream originalOut = System.out;
+        RuntimeIO originalRuntimeOut = RuntimeIO.getStdout();
+        ByteArrayOutputStream output = new ByteArrayOutputStream();
+        PrintStream capturedOut = new PrintStream(output, true, StandardCharsets.UTF_8);
+        try {
+            RuntimeIO.setStdout(new RuntimeIO(new StandardIO(output, true)));
+            GlobalVariable.getGlobalIO("main::STDOUT").setIO(RuntimeIO.getStdout());
+            System.setOut(capturedOut);
+            try {
+                PerlLanguageProvider.executePerlCode(options, true);
+            } catch (PerlExitException exit) {
+                if (exit.getExitCode() != 0) throw exit;
+            }
+        } finally {
+            RuntimeIO.setStdout(originalRuntimeOut);
+            GlobalVariable.getGlobalIO("main::STDOUT").setIO(originalRuntimeOut);
+            System.setOut(originalOut);
+            capturedOut.close();
+        }
+
+        String tap = output.toString(StandardCharsets.UTF_8);
+        if (tap.contains("1..0 # SKIP")) {
+            Assumptions.abort("Mojolicious or loopback support is unavailable: " + tap.trim());
+        }
+        assertTrue(tap.contains("1..6"), "interpreter did not run all six assertions:\n" + tap);
+        assertFalse(tap.lines().anyMatch(line -> line.trim().startsWith("not ok")), tap);
+    }
+}
diff --git a/src/test/resources/unit/mojolicious_websocket_server_push_lifetime.t b/src/test/resources/unit/mojolicious_websocket_server_push_lifetime.t
new file mode 100644
index 0000000000..0595afe5c3
--- /dev/null
+++ b/src/test/resources/unit/mojolicious_websocket_server_push_lifetime.t
@@ -0,0 +1,58 @@
+use strict;
+use warnings;
+use Test::More;
+
+BEGIN {
+    $ENV{MOJO_REACTOR} = 'Mojo::Reactor::Poll';
+    eval {
+        require IO::Socket::INET;
+        require Mojolicious::Lite;
+        Mojolicious::Lite->import;
+        require Test::Mojo;
+        require Mojo::IOLoop;
+        1;
+    } or plan skip_all => 'Mojolicious and Test::Mojo are required';
+
+    my $probe = IO::Socket::INET->new(
+        LocalAddr => '127.0.0.1',
+        LocalPort => 0,
+        Listen    => 1,
+        Proto     => 'tcp',
+    ) or plan skip_all => 'loopback sockets are unavailable';
+    close $probe;
+}
+
+package Issue1794WebSocketController;
+use Mojo::Base 'Mojolicious::Controller';
+sub DESTROY { ++$main::controller_destroyed }
+
+package main;
+app->controller_class('Issue1794WebSocketController');
+websocket '/push' => sub {
+    my $controller = shift;
+    my $timer = Mojo::IOLoop->recurring(
+        0.1 => sub { ++$main::push_count; $controller->send('push') }
+    );
+    $controller->on(finish => sub { Mojo::IOLoop->remove($timer) });
+};
+
+our $controller_destroyed = 0;
+our $push_count = 0;
+my $test = Test::Mojo->new;
+$test->websocket_ok('/push')
+    ->message_ok->message_is('push')
+    ->finish_ok;
+
+# Let the server process the WebSocket close and release the controller after
+# the finish callback removes the recurring closure that captured it. The
+# one-shot timer bounds the wait even if the close event is lost.
+my $push_count_at_finish = $push_count;
+my $wait_timer = Mojo::IOLoop->timer(0.5 => sub { Mojo::IOLoop->stop });
+Mojo::IOLoop->start unless $controller_destroyed;
+Mojo::IOLoop->remove($wait_timer);
+is($push_count, $push_count_at_finish,
+    'finish callback stops recurring WebSocket pushes');
+ok($controller_destroyed > 0,
+    'WebSocket server-push controller is destroyed after finish');
+
+done_testing;

From 3a0de9186084b6a17b2f95103a6fb70f72169dc6 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 14:35:23 +0200
Subject: [PATCH 135/317] wip: snapshot interpreter temporary owner cleanup
 attempt

Preserve the frame-local scalar-reference cleanup experiment before rebasing
onto the latest master optimizations.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../backend/bytecode/BytecodeInterpreter.java | 29 +++++++++++++++++++
 .../bytecode/SuspendedInterpreterFrame.java   |  8 +++++
 2 files changed, 37 insertions(+)

diff --git a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
index d7a79012bf..aaca171ad0 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
@@ -262,12 +262,34 @@ static void abandon(SuspendedInterpreterFrame frame) {
             MyVarCleanupStack.unregister(reg);
             registers[i] = null;
         }
+        if (releaseTemporaryScalarReferenceContents(frame)) {
+            needsFlush = true;
+        }
         if (needsFlush) {
             MortalList.flush();
         }
         code.releaseRegisters();
     }
 
+    /**
+     * Release nested referent ownership held by interpreter-created scalar
+     * temporaries. These cells are intentionally not sent through full lexical
+     * cleanup: a temporary register can alias an lvalue or aggregate element.
+     * The nested owner is distinct and can be deferred safely so a returned
+     * scalar reference is retained by its caller before the decrement drains.
+     */
+    private static boolean releaseTemporaryScalarReferenceContents(
+            SuspendedInterpreterFrame frame) {
+        boolean released = false;
+        for (RuntimeScalar scalar : frame.temporaryScalarOwners) {
+            if (!scalar.ownsScalarReferenceContents) continue;
+            scalar.deferOwnedScalarReferenceContents();
+            released = true;
+        }
+        frame.temporaryScalarOwners.clear();
+        return released;
+    }
+
     /**
      * Result of a call whose non-local last/next/redo was consumed by an enclosing
      * labeled block.  Control has left the block, so the marker must not stay in the
@@ -1460,6 +1482,9 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
                                 if (rdVal == null || isImmutableProxy(rdVal)) {
                                     rdScalar = new RuntimeScalar();
                                     registers[rd] = rdScalar;
+                                    if (rd >= firstMyVarReg && !code.myVarRegisters.get(rd)) {
+                                        frame.temporaryScalarOwners.add(rdScalar);
+                                    }
                                 } else if (rdVal instanceof RuntimeScalar) {
                                     rdScalar = (RuntimeScalar) rdVal;
                                 } else {
@@ -3958,6 +3983,10 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
                 }
             }
 
+            if (!frame.suspended) {
+                releaseTemporaryScalarReferenceContents(frame);
+            }
+
             // Outer finally: restore interpreter state saved at method entry.
             // Unwinds all `local` variables pushed during this frame, restores
             // the current package, and pops the InterpreterState call stack.
diff --git a/src/main/java/org/perlonjava/backend/bytecode/SuspendedInterpreterFrame.java b/src/main/java/org/perlonjava/backend/bytecode/SuspendedInterpreterFrame.java
index d9f60fa25b..27e1f175fd 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/SuspendedInterpreterFrame.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/SuspendedInterpreterFrame.java
@@ -3,10 +3,13 @@
 import org.perlonjava.runtime.runtimetypes.RegexState;
 import org.perlonjava.runtime.runtimetypes.RuntimeBase;
 import org.perlonjava.runtime.runtimetypes.RuntimeCode;
+import org.perlonjava.runtime.runtimetypes.RuntimeScalar;
 import org.perlonjava.runtime.runtimetypes.DynamicVariableManager;
 
 import java.util.ArrayDeque;
 import java.util.ArrayList;
+import java.util.Collections;
+import java.util.IdentityHashMap;
 import java.util.Set;
 import java.util.List;
 
@@ -41,6 +44,11 @@ public final class SuspendedInterpreterFrame {
     final ArrayDeque<RegexState> regexStateStack = new ArrayDeque<>();
     final ArrayList<RuntimeCode> createdClosures = new ArrayList<>();
     final ArrayList<RuntimeBase> methodInvocantHolds = new ArrayList<>();
+    // SET_SCALAR can allocate expression-only cells that own the referent
+    // inside a scalar reference. They are not lexical registers, so emitted
+    // SCOPE_EXIT_CLEANUP opcodes do not see them.
+    final Set<RuntimeScalar> temporaryScalarOwners =
+            Collections.newSetFromMap(new IdentityHashMap<>());
     final ArrayDeque<ArrayList<Integer>> scopeCleanupBatches = new ArrayDeque<>();
     List<DynamicVariableManager.SuspendedState> suspendedDynamicStates;
 

From cca2486bf808759ad1ba3552c8ee547438ee682d Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 14:40:02 +0200
Subject: [PATCH 136/317] wip: snapshot temporary scalar owner tracking

Preserve the frame-local SET_SCALAR owner tracking attempt before adding
focused diagnostic tracing.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../backend/bytecode/BytecodeInterpreter.java | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
index aaca171ad0..e94d15ca72 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
@@ -290,6 +290,20 @@ private static boolean releaseTemporaryScalarReferenceContents(
         return released;
     }
 
+    private static void trackTemporaryScalarReferenceContents(
+            SuspendedInterpreterFrame frame, InterpretedCode code,
+            int register, int firstMyVarReg, RuntimeScalar scalar) {
+        if (scalar == null || !scalar.ownsScalarReferenceContents
+                || register < firstMyVarReg || code.myVarRegisters.get(register)
+                || scalar.isPackageGlobalRoot
+                || scalar.getContainerOwner() != null
+                || scalar instanceof RuntimeBaseProxy
+                || MyVarCleanupStack.isRegistered(scalar)) {
+            return;
+        }
+        frame.temporaryScalarOwners.add(scalar);
+    }
+
     /**
      * Result of a call whose non-local last/next/redo was consumed by an enclosing
      * labeled block.  Control has left the block, so the marker must not stay in the
@@ -1482,9 +1496,6 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
                                 if (rdVal == null || isImmutableProxy(rdVal)) {
                                     rdScalar = new RuntimeScalar();
                                     registers[rd] = rdScalar;
-                                    if (rd >= firstMyVarReg && !code.myVarRegisters.get(rd)) {
-                                        frame.temporaryScalarOwners.add(rdScalar);
-                                    }
                                 } else if (rdVal instanceof RuntimeScalar) {
                                     rdScalar = (RuntimeScalar) rdVal;
                                 } else {
@@ -1500,6 +1511,8 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
                                     }
                                 }
                                 RuntimeScalar.assignTo(registers[rs], rdScalar);
+                                trackTemporaryScalarReferenceContents(
+                                        frame, code, rd, firstMyVarReg, rdScalar);
                             }
 
                             case Opcodes.COPY_DO_BLOCK_RESULT -> {

From a20b7778dd6b28588001632dd172d34284d496ba Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 14:50:24 +0200
Subject: [PATCH 137/317] wip: snapshot interpreter temporary owner diagnostics

Preserve the temporary register ownership tracing used to narrow down the
remaining Mojolicious controller owner.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../backend/bytecode/BytecodeInterpreter.java | 23 ++++++++++++-------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
index e94d15ca72..43562865e4 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
@@ -293,15 +293,22 @@ private static boolean releaseTemporaryScalarReferenceContents(
     private static void trackTemporaryScalarReferenceContents(
             SuspendedInterpreterFrame frame, InterpretedCode code,
             int register, int firstMyVarReg, RuntimeScalar scalar) {
-        if (scalar == null || !scalar.ownsScalarReferenceContents
-                || register < firstMyVarReg || code.myVarRegisters.get(register)
-                || scalar.isPackageGlobalRoot
-                || scalar.getContainerOwner() != null
-                || scalar instanceof RuntimeBaseProxy
-                || MyVarCleanupStack.isRegistered(scalar)) {
-            return;
+        if (scalar == null || !scalar.ownsScalarReferenceContents) return;
+        boolean eligible = register >= firstMyVarReg
+                && !code.myVarRegisters.get(register)
+                && !scalar.isPackageGlobalRoot
+                && scalar.getContainerOwner() == null
+                && !(scalar instanceof RuntimeBaseProxy)
+                && !MyVarCleanupStack.isRegistered(scalar);
+        if (System.getenv("PJ_INTERPRETER_TEMP_OWNER_TRACE") != null) {
+            System.err.printf("[INTERPRETER-TEMP-OWNER] scalar=%d register=%d firstMyVar=%d refOwned=%s scopeExited=%s captures=%d registered=%s packageRoot=%s container=%s eligible=%s%n",
+                    System.identityHashCode(scalar), register, firstMyVarReg,
+                    scalar.refCountOwned, scalar.scopeExited, scalar.captureCount,
+                    MyVarCleanupStack.isRegistered(scalar), scalar.isPackageGlobalRoot,
+                    scalar.getContainerOwner() == null ? "none"
+                            : scalar.getContainerOwner().getClass().getSimpleName(), eligible);
         }
-        frame.temporaryScalarOwners.add(scalar);
+        if (eligible) frame.temporaryScalarOwners.add(scalar);
     }
 
     /**

From c6c4ca2bf541f0c70aacab4da7b5d6680088f386 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 14:55:23 +0200
Subject: [PATCH 138/317] wip: snapshot RuntimeList ownership experiment

---
 .../perlonjava/runtime/runtimetypes/RuntimeList.java  | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
index a08f033257..6048377c53 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
@@ -781,6 +781,12 @@ public RuntimeArray setFromList(RuntimeList value) {
                 result.elements.add(useAlias ? rhsAlias : rhsValue);
 
                 if (rhsIndex < rhsSize) {
+                    // The alias, when selected, is the original source cell.
+                    // The materialized RHS copy is discarded and must release
+                    // any nested owner held by a scalar reference.
+                    if (useAlias && rhsValue != null) {
+                        rhsValue.releaseOwnedScalarReferenceContents();
+                    }
                     // Undo the materialized copy's refCount increment for the consumed
                     // RHS value (mirrors the corresponding fix in the assigned-scalar
                     // branch below). Without this, `my (undef, $name) = @_;` patterns
@@ -803,6 +809,9 @@ public RuntimeArray setFromList(RuntimeList value) {
                 RuntimeScalar assigned = (rhsIndex < rhsSize) ? rhsElements.get(rhsIndex++) : null;
                 runtimeScalar.set(assigned != null ? assigned : new RuntimeScalar());
                 result.elements.add(runtimeScalar);  // Add reference to the variable itself
+                // set() has acquired a new nested scalar-reference owner on the
+                // destination. The materialized RHS cell is discarded here.
+                if (assigned != null) assigned.releaseOwnedScalarReferenceContents();
                 // Undo the materialized copy's refCount increment.
                 // The materialization (addToArray → addToScalar → set → setLarge) incremented
                 // refCount on the copy. The target's set() above created its own increment.
@@ -837,6 +846,7 @@ public RuntimeArray setFromList(RuntimeList value) {
                     // setFromList creates new copies via incrementRefCountForContainerStore;
                     // the materialized rhs elements' increments are now redundant.
                     for (RuntimeScalar r : remaining) {
+                        r.releaseOwnedScalarReferenceContents();
                         if (r.refCountOwned && (r.type & RuntimeScalarType.REFERENCE_BIT) != 0
                                 && r.value instanceof RuntimeBase base && base.refCount > 0) {
                             base.releaseOwner(r, "RuntimeList materialized-copy undo (array-target)");
@@ -872,6 +882,7 @@ public RuntimeArray setFromList(RuntimeList value) {
                 // via addToArray -> setLarge) are now redundant and would leak since
                 // nobody decrements them.
                 for (RuntimeScalar r : remainingArr.elements) {
+                    r.releaseOwnedScalarReferenceContents();
                     if (r.refCountOwned && (r.type & RuntimeScalarType.REFERENCE_BIT) != 0
                             && r.value instanceof RuntimeBase base && base.refCount > 0) {
                         base.releaseOwner(r, "RuntimeList materialized-copy undo (hash-target)");

From 5a0ca2cc7f671fdd9e4465b035edee787775fe0f Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 15:03:02 +0200
Subject: [PATCH 139/317] wip: release temporary list RHS owners in scalar fast
 path

The generic list-assignment path materializes RHS cells and may delegate
scalar assignment to assignSimpleScalarsFromArray. Release those temporary
cell owners after scalar assignment copies their values.

Generated with Codex (https://openai.com/codex)
Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../runtime/runtimetypes/RuntimeList.java     | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
index 6048377c53..171ae19282 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
@@ -958,6 +958,9 @@ private RuntimeArray assignSimpleScalarsFromArray(RuntimeArray rhsArray, boolean
                     if (lhs.isKeysLvalue()) lhs.rejectKeysLvalueListAssignment();
                     RuntimeScalar rhs = i < rhsSize ? rhsElements.get(i) : null;
                     lhs.set(rhs == null ? new RuntimeScalar() : rhs);
+                    if (rhsArray.transientListAssignmentRhs && rhs != null) {
+                        releaseDiscardedMaterializedScalar(rhs);
+                    }
                     if (result != null) result.elements.add(lhs);
                 }
                 return result;
@@ -976,6 +979,9 @@ private RuntimeArray assignSimpleScalarsFromArray(RuntimeArray rhsArray, boolean
                 RuntimeScalar lhs = (RuntimeScalar) elements.get(i);
                 if (lhs.isKeysLvalue()) lhs.rejectKeysLvalueListAssignment();
                 lhs.set(i < rhsValues.length ? rhsValues[i] : new RuntimeScalar());
+                if (rhsArray.transientListAssignmentRhs && i < rhsSize) {
+                    releaseDiscardedMaterializedScalar(rhsElements.get(i));
+                }
                 if (result != null) result.elements.add(lhs);
             }
             return result;
@@ -984,6 +990,20 @@ private RuntimeArray assignSimpleScalarsFromArray(RuntimeArray rhsArray, boolean
         }
     }
 
+    /** Release the ownership held by a materialized RHS cell after scalar assignment copied it. */
+    private static void releaseDiscardedMaterializedScalar(RuntimeScalar scalar) {
+        scalar.releaseOwnedScalarReferenceContents();
+        if (scalar.refCountOwned
+                && (scalar.type & RuntimeScalarType.REFERENCE_BIT) != 0
+                && scalar.value instanceof RuntimeBase base
+                && base.refCount > 0) {
+            base.releaseOwner(scalar, "RuntimeList materialized-copy undo (simple-scalar-target)");
+            base.releaseActiveOwner(scalar);
+            base.refCount--;
+            scalar.refCountOwned = false;
+        }
+    }
+
     /**
      * Converts the list to a string, concatenating all elements without separators.
      *

From 531b1b064bf6b83eaa04ff9702883ec56e2438e0 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 15:26:33 +0200
Subject: [PATCH 140/317] wip: add weak scalar metadata to owner trace dumps

Include current liveness, lexical scope, and container metadata in refcount
trace output without retaining the scalar or changing runtime reachability.

Generated with Codex (https://openai.com/codex)
Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../runtime/runtimetypes/RuntimeBase.java           | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
index 58b179d1d2..99848b4b61 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
@@ -574,10 +574,12 @@ public void traceRefCount(int delta, String reason) {
     private static final class OwnerTrace {
         final int scalarIdentity;
         final String acquireSite;
+        final java.lang.ref.WeakReference<RuntimeScalar> scalar;
 
         OwnerTrace(RuntimeScalar scalar, String acquireSite) {
             this.scalarIdentity = System.identityHashCode(scalar);
             this.acquireSite = acquireSite;
+            this.scalar = new java.lang.ref.WeakReference<>(scalar);
         }
     }
 
@@ -848,7 +850,16 @@ public static void dumpTraceOwners() {
                 + " refCount=" + b.refCount
                 + " owners=" + e.getValue().size());
             for (java.util.Map.Entry<Integer, OwnerTrace> own : e.getValue().entrySet()) {
-                System.err.println("    owner=" + own.getKey() + " from " + own.getValue().acquireSite);
+                RuntimeScalar scalar = own.getValue().scalar.get();
+                RuntimeBase container = scalar == null ? null : scalar.getContainerOwner();
+                System.err.println("    owner=" + own.getKey() + " from " + own.getValue().acquireSite
+                        + " alive=" + (scalar != null)
+                        + " refOwned=" + (scalar != null && scalar.refCountOwned)
+                        + " scopeExited=" + (scalar != null && scalar.scopeExited)
+                        + " captures=" + (scalar == null ? -1 : scalar.captureCount)
+                        + " packageRoot=" + (scalar != null && scalar.isPackageGlobalRoot)
+                        + " type=" + (scalar == null ? -1 : scalar.type)
+                        + " container=" + (container == null ? "none" : container.getClass().getSimpleName()));
             }
         }
         for (java.util.Map.Entry<RuntimeBase, java.util.ArrayList<PendingOwnerRelease>> e

From 6ea8ce57fe88627618b351065ea68041361077cd Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 15:30:41 +0200
Subject: [PATCH 141/317] wip: report array metadata for retained owner traces

Print the identity and ownership flags for a live array containing a leaked
scalar owner, making async callback retention traceable to its array slot.

Generated with Codex (https://openai.com/codex)
Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../runtime/runtimetypes/RuntimeBase.java          | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
index 99848b4b61..9fba6856a2 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
@@ -852,6 +852,18 @@ public static void dumpTraceOwners() {
             for (java.util.Map.Entry<Integer, OwnerTrace> own : e.getValue().entrySet()) {
                 RuntimeScalar scalar = own.getValue().scalar.get();
                 RuntimeBase container = scalar == null ? null : scalar.getContainerOwner();
+                String containerDetails = "none";
+                if (container instanceof RuntimeArray array) {
+                    containerDetails = "RuntimeArray#" + System.identityHashCode(array)
+                            + " size=" + array.elements.size()
+                            + " owned=" + array.elementsOwned
+                            + " aliased=" + array.elementsAliased
+                            + " transientRhs=" + array.transientListAssignmentRhs
+                            + " index=" + array.elements.indexOf(scalar);
+                } else if (container != null) {
+                    containerDetails = container.getClass().getSimpleName()
+                            + "#" + System.identityHashCode(container);
+                }
                 System.err.println("    owner=" + own.getKey() + " from " + own.getValue().acquireSite
                         + " alive=" + (scalar != null)
                         + " refOwned=" + (scalar != null && scalar.refCountOwned)
@@ -859,7 +871,7 @@ public static void dumpTraceOwners() {
                         + " captures=" + (scalar == null ? -1 : scalar.captureCount)
                         + " packageRoot=" + (scalar != null && scalar.isPackageGlobalRoot)
                         + " type=" + (scalar == null ? -1 : scalar.type)
-                        + " container=" + (container == null ? "none" : container.getClass().getSimpleName()));
+                        + " container=" + containerDetails);
             }
         }
         for (java.util.Map.Entry<RuntimeBase, java.util.ArrayList<PendingOwnerRelease>> e

From 976a4eaf149d54a0758dba7c5f88c078bc721709 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 15:36:27 +0200
Subject: [PATCH 142/317] wip: identify live argument arrays in owner traces

Report whether a retained scalar's alias container remains on the active
argument stack and include its caller-array slot identity.

Generated with Codex (https://openai.com/codex)
Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../runtime/runtimetypes/RuntimeBase.java           | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
index 9fba6856a2..971ddd3428 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
@@ -854,11 +854,21 @@ public static void dumpTraceOwners() {
                 RuntimeBase container = scalar == null ? null : scalar.getContainerOwner();
                 String containerDetails = "none";
                 if (container instanceof RuntimeArray array) {
+                    int activeArgsDepth = -1;
+                    if (PerlRuntime.currentOrNull() != null) {
+                        for (int depth = 0; depth < RuntimeCode.argsStackDepth(); depth++) {
+                            if (RuntimeCode.getActiveArgsAt(depth) == array) {
+                                activeArgsDepth = depth;
+                                break;
+                            }
+                        }
+                    }
                     containerDetails = "RuntimeArray#" + System.identityHashCode(array)
                             + " size=" + array.elements.size()
                             + " owned=" + array.elementsOwned
                             + " aliased=" + array.elementsAliased
                             + " transientRhs=" + array.transientListAssignmentRhs
+                            + " activeArgsDepth=" + activeArgsDepth
                             + " index=" + array.elements.indexOf(scalar);
                 } else if (container != null) {
                     containerDetails = container.getClass().getSimpleName()
@@ -871,6 +881,9 @@ public static void dumpTraceOwners() {
                         + " captures=" + (scalar == null ? -1 : scalar.captureCount)
                         + " packageRoot=" + (scalar != null && scalar.isPackageGlobalRoot)
                         + " type=" + (scalar == null ? -1 : scalar.type)
+                        + " localArray=" + (scalar == null || scalar.localArrayOwner == null
+                                ? "none" : System.identityHashCode(scalar.localArrayOwner)
+                                        + "[" + scalar.localArrayIndex + "]")
                         + " container=" + containerDetails);
             }
         }

From 3956cca36ac768f7d862d36e006de1ee728062eb Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 15:41:47 +0200
Subject: [PATCH 143/317] wip: trace the origin of retained argument arrays

Record optional array allocation stacks when refcount tracing is enabled and
include the stack for the array holding a retained scalar owner.

Generated with Codex (https://openai.com/codex)
Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../org/perlonjava/runtime/runtimetypes/RuntimeArray.java   | 6 ++++++
 .../org/perlonjava/runtime/runtimetypes/RuntimeBase.java    | 4 ++++
 2 files changed, 10 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
index 7f96995ddc..d445d72c03 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
@@ -26,6 +26,12 @@
  * using a list of RuntimeScalar objects, which can hold any type of Perl scalar value.
  */
 public class RuntimeArray extends RuntimeBase implements RuntimeScalarReference, DynamicState {
+    private final StackTraceElement[] traceAllocationStack =
+            System.getenv("PJ_REFCOUNT_TRACE") == null ? null : new Throwable().getStackTrace();
+
+    StackTraceElement[] traceAllocationStack() {
+        return traceAllocationStack;
+    }
 
     /** Return an empty lexical cell when control flow skipped its declaration. */
     public static RuntimeArray materializeLexicalCell(RuntimeArray array) {
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
index 971ddd3428..c12d171cdc 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
@@ -870,6 +870,10 @@ public static void dumpTraceOwners() {
                             + " transientRhs=" + array.transientListAssignmentRhs
                             + " activeArgsDepth=" + activeArgsDepth
                             + " index=" + array.elements.indexOf(scalar);
+                    StackTraceElement[] allocation = array.traceAllocationStack();
+                    if (allocation != null) {
+                        containerDetails += " allocation=" + java.util.Arrays.toString(allocation);
+                    }
                 } else if (container != null) {
                     containerDetails = container.getClass().getSimpleName()
                             + "#" + System.identityHashCode(container);

From 070c3e463d0a04e8e4e9c8f48d32e51aedf6ef86 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 15:44:17 +0200
Subject: [PATCH 144/317] wip: include active Perl sub in retained array trace

Identify the Perl call site that allocated a retained argument array without
storing a strong RuntimeCode reference in the diagnostic metadata.

Generated with Codex (https://openai.com/codex)
Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../runtime/runtimetypes/RuntimeArray.java           | 12 ++++++++++++
 .../perlonjava/runtime/runtimetypes/RuntimeBase.java |  1 +
 2 files changed, 13 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
index d445d72c03..bd91e31142 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
@@ -28,11 +28,23 @@
 public class RuntimeArray extends RuntimeBase implements RuntimeScalarReference, DynamicState {
     private final StackTraceElement[] traceAllocationStack =
             System.getenv("PJ_REFCOUNT_TRACE") == null ? null : new Throwable().getStackTrace();
+    private final String traceAllocationSub = traceAllocationStack == null
+            || PerlRuntime.currentOrNull() == null ? null : activeSubForTrace();
+
+    private static String activeSubForTrace() {
+        RuntimeCode active = RuntimeCode.getActiveCodeAt(0);
+        if (active == null) return "<no active Perl sub>";
+        return String.valueOf(active.packageName) + "::" + String.valueOf(active.subName);
+    }
 
     StackTraceElement[] traceAllocationStack() {
         return traceAllocationStack;
     }
 
+    String traceAllocationSub() {
+        return traceAllocationSub;
+    }
+
     /** Return an empty lexical cell when control flow skipped its declaration. */
     public static RuntimeArray materializeLexicalCell(RuntimeArray array) {
         return array != null ? array : new RuntimeArray();
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
index c12d171cdc..eaf70b6d64 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
@@ -864,6 +864,7 @@ public static void dumpTraceOwners() {
                         }
                     }
                     containerDetails = "RuntimeArray#" + System.identityHashCode(array)
+                            + " creator=" + array.traceAllocationSub()
                             + " size=" + array.elements.size()
                             + " owned=" + array.elementsOwned
                             + " aliased=" + array.elementsAliased

From 66b32e466d579ce5b413ac17177276db6e209c1f Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 15:48:15 +0200
Subject: [PATCH 145/317] wip: trace Mojolicious call-site argument arrays

When refcount tracing is enabled, identify the source file and line for
Mojolicious method calls that build argument alias arrays in the interpreter.

Generated with Codex (https://openai.com/codex)
Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../perlonjava/backend/bytecode/BytecodeInterpreter.java | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
index 43562865e4..8d6274e6ba 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
@@ -2308,6 +2308,15 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
                                     callArgs = (RuntimeArray) argsBase;
                                 } else if (argsBase instanceof RuntimeList) {
                                     callArgs = new RuntimeArray();
+                                    if (System.getenv("PJ_REFCOUNT_TRACE") != null
+                                            && "Mojolicious".equals(code.packageName)) {
+                                        ErrorMessageUtil.SourceLocation location =
+                                                InlineOpcodeHandler.sourceLocation(code, callSitePc);
+                                        System.err.printf("[MOJO-INTERPRETER-ARG-ARRAY] array=%d sub=%s::%s source=%s:%d args=%d%n",
+                                                System.identityHashCode(callArgs), code.packageName,
+                                                code.subName, location.fileName(), location.lineNumber(),
+                                                ((RuntimeList) argsBase).elements.size());
+                                    }
                                     argsBase.setArrayOfAlias(callArgs);
                                 } else {
                                     callArgs = new RuntimeArray((RuntimeScalar) argsBase);

From 228e19c4b7f0852a5c7e4c1dedf0e4421b5cf947 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 15:53:37 +0200
Subject: [PATCH 146/317] wip: trace controller owners through list assignment

Add optional source-value and branch diagnostics for setFromList values that
reference the selected class while the async lifetime regression runs.

Generated with Codex (https://openai.com/codex)
Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../runtime/runtimetypes/RuntimeList.java     | 47 +++++++++++++++++++
 1 file changed, 47 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
index 171ae19282..275539342d 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
@@ -760,6 +760,21 @@ public RuntimeArray setFromList(RuntimeList value) {
         int rhsSize = rhsElements.size();
         int rhsIndex = 0;
 
+        if (System.getenv("PJ_REFCOUNT_TRACE") != null) {
+            for (int i = 0; i < rhsSize; i++) {
+                RuntimeScalar scalar = rhsElements.get(i);
+                if (isConfiguredTraceReferent(scalar)) {
+                    System.err.printf("[LIST-ASSIGN-RHS] owner=%d index=%d owned=%s container=%s lhs=%s%n",
+                            System.identityHashCode(scalar), i, scalar.refCountOwned,
+                            scalar.getContainerOwner() == null ? "none"
+                                    : scalar.getContainerOwner().getClass().getSimpleName(),
+                            elements.stream().map(value -> value == null
+                                    ? "null" : value.getClass().getSimpleName())
+                                    .toList());
+                }
+            }
+        }
+
         // Build result with assigned values (including undef for unassigned scalars)
         RuntimeArray result = new RuntimeArray();
         // Store original size for scalar context
@@ -778,6 +793,12 @@ public RuntimeArray setFromList(RuntimeList value) {
                 // (it would reflect the post-assignment value rather than the pre-assignment value).
                 boolean useAlias = rhsAlias != null && lhsScalars != null && !lhsScalars.containsKey(rhsAlias);
 
+                if (isConfiguredTraceReferent(rhsValue)) {
+                    System.err.printf("[LIST-ASSIGN-UNDEF] owner=%d index=%d useAlias=%s alias=%d%n",
+                            System.identityHashCode(rhsValue), rhsIndex, useAlias,
+                            rhsAlias == null ? 0 : System.identityHashCode(rhsAlias));
+                }
+
                 result.elements.add(useAlias ? rhsAlias : rhsValue);
 
                 if (rhsIndex < rhsSize) {
@@ -807,6 +828,10 @@ public RuntimeArray setFromList(RuntimeList value) {
                     runtimeScalar.rejectKeysLvalueListAssignment();
                 }
                 RuntimeScalar assigned = (rhsIndex < rhsSize) ? rhsElements.get(rhsIndex++) : null;
+                if (isConfiguredTraceReferent(assigned)) {
+                    System.err.printf("[LIST-ASSIGN-SCALAR] owner=%d rhsIndex=%d refOwned=%s%n",
+                            System.identityHashCode(assigned), rhsIndex - 1, assigned.refCountOwned);
+                }
                 runtimeScalar.set(assigned != null ? assigned : new RuntimeScalar());
                 result.elements.add(runtimeScalar);  // Add reference to the variable itself
                 // set() has acquired a new nested scalar-reference owner on the
@@ -827,6 +852,10 @@ public RuntimeArray setFromList(RuntimeList value) {
                     base.refCount--;
                     assigned.refCountOwned = false;
                 }
+                if (isConfiguredTraceReferent(assigned)) {
+                    System.err.printf("[LIST-ASSIGN-SCALAR-DONE] owner=%d refOwned=%s%n",
+                            System.identityHashCode(assigned), assigned.refCountOwned);
+                }
             } else if (elem instanceof RuntimeArray runtimeArray) {
                 List<RuntimeScalar> remaining = (rhsIndex < rhsSize)
                         ? new ArrayList<>(rhsElements.subList(rhsIndex, rhsSize))
@@ -895,6 +924,16 @@ public RuntimeArray setFromList(RuntimeList value) {
             }
         }
 
+        if (System.getenv("PJ_REFCOUNT_TRACE") != null) {
+            for (int i = rhsIndex; i < rhsSize; i++) {
+                RuntimeScalar scalar = rhsElements.get(i);
+                if (isConfiguredTraceReferent(scalar)) {
+                    System.err.printf("[LIST-ASSIGN-LEFTOVER] owner=%d index=%d refOwned=%s%n",
+                            System.identityHashCode(scalar), i, scalar.refCountOwned);
+                }
+            }
+        }
+
         // Restore previous flushing state. Now that all LHS variables hold references
         // to the return values, it's safe to process pending decrements.
         MortalList.suppressFlush(wasFlushing);
@@ -992,6 +1031,7 @@ private RuntimeArray assignSimpleScalarsFromArray(RuntimeArray rhsArray, boolean
 
     /** Release the ownership held by a materialized RHS cell after scalar assignment copied it. */
     private static void releaseDiscardedMaterializedScalar(RuntimeScalar scalar) {
+        if (scalar == null) return;
         scalar.releaseOwnedScalarReferenceContents();
         if (scalar.refCountOwned
                 && (scalar.type & RuntimeScalarType.REFERENCE_BIT) != 0
@@ -1004,6 +1044,13 @@ private static void releaseDiscardedMaterializedScalar(RuntimeScalar scalar) {
         }
     }
 
+    private static boolean isConfiguredTraceReferent(RuntimeScalar scalar) {
+        String expected = System.getenv("PJ_REFCOUNT_TRACE_CLASS");
+        if (expected == null || scalar == null || !(scalar.value instanceof RuntimeBase base)
+                || base.blessId == 0) return false;
+        return expected.equals(NameNormalizer.getBlessStr(base.blessId));
+    }
+
     /**
      * Converts the list to a string, concatenating all elements without separators.
      *

From 90bb8fb56fda391e88fe4e692b59809f65043a0d Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 15:54:40 +0200
Subject: [PATCH 147/317] wip: fix list trace lambda parameter name

Avoid shadowing the setFromList parameter in the optional diagnostic output.

Generated with Codex (https://openai.com/codex)
Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../java/org/perlonjava/runtime/runtimetypes/RuntimeList.java | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
index 275539342d..fcb9900df4 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
@@ -768,8 +768,8 @@ public RuntimeArray setFromList(RuntimeList value) {
                             System.identityHashCode(scalar), i, scalar.refCountOwned,
                             scalar.getContainerOwner() == null ? "none"
                                     : scalar.getContainerOwner().getClass().getSimpleName(),
-                            elements.stream().map(value -> value == null
-                                    ? "null" : value.getClass().getSimpleName())
+                            elements.stream().map(item -> item == null
+                                    ? "null" : item.getClass().getSimpleName())
                                     .toList());
                 }
             }

From df844c04af5ad65b57a61c6b4a25ddcc9ae722b9 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 16:03:22 +0200
Subject: [PATCH 148/317] wip: validate interpreter container ownership before
 cleanup

A borrowed argument array can mark a temporary scalar as its container
owner without owning the scalar slot. Check the actual aggregate slot
before suppressing interpreter temporary-owner cleanup.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../backend/bytecode/BytecodeInterpreter.java | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
index 8d6274e6ba..d7c20abb5f 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
@@ -297,7 +297,7 @@ private static void trackTemporaryScalarReferenceContents(
         boolean eligible = register >= firstMyVarReg
                 && !code.myVarRegisters.get(register)
                 && !scalar.isPackageGlobalRoot
-                && scalar.getContainerOwner() == null
+                && !hasOwningContainerSlot(scalar)
                 && !(scalar instanceof RuntimeBaseProxy)
                 && !MyVarCleanupStack.isRegistered(scalar);
         if (System.getenv("PJ_INTERPRETER_TEMP_OWNER_TRACE") != null) {
@@ -311,6 +311,23 @@ private static void trackTemporaryScalarReferenceContents(
         if (eligible) frame.temporaryScalarOwners.add(scalar);
     }
 
+    /**
+     * A borrowed {@code @_} entry has a container marker for alias tracking,
+     * but the argument array does not own the scalar slot. Do not let that
+     * marker suppress cleanup of an otherwise temporary interpreter owner.
+     */
+    private static boolean hasOwningContainerSlot(RuntimeScalar scalar) {
+        RuntimeBase owner = scalar.getContainerOwner();
+        if (owner instanceof RuntimeArray array) {
+            return array.elements.contains(scalar)
+                    && (!array.elementsAliased || array.ownsElement(scalar));
+        }
+        if (owner instanceof RuntimeHash hash) {
+            return hash.elements.containsValue(scalar);
+        }
+        return false;
+    }
+
     /**
      * Result of a call whose non-local last/next/redo was consumed by an enclosing
      * labeled block.  Control has left the block, so the marker must not stay in the

From 594ded7c4aaa0c90f1eba598fba65d77312d51a6 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 16:07:14 +0200
Subject: [PATCH 149/317] wip: transfer slurped list values into array
 ownership

Mark the direct materialized-value path for a plain slurping array as an
owned container replacement, and reconcile its element owner slots.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../perlonjava/runtime/runtimetypes/RuntimeList.java   | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
index fcb9900df4..9553a3bb20 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
@@ -887,7 +887,17 @@ public RuntimeArray setFromList(RuntimeList value) {
                 } else {
                     // Plain array: directly reuse the materialized copies.
                     // Their refCountOwned=true transfers to the array elements.
+                    runtimeArray.notePackageRootMutation();
+                    MortalList.deferDestroyForContainerClear(runtimeArray.elements);
+                    runtimeArray.elements.clear();
                     runtimeArray.elements = remaining;
+                    for (RuntimeScalar r : remaining) {
+                        runtimeArray.markPackageRootedValue(r);
+                    }
+                    runtimeArray.elementsOwned = true;
+                    runtimeArray.elementsAliased = false;
+                    runtimeArray.ownedAliasElements = null;
+                    runtimeArray.reconcileArrayElementOwnerSlots();
                 }
                 result.elements.addAll(remaining);  // Use original references
                 rhsIndex = rhsSize; // Consume the rest

From 07d188b8d7b150574e18a0bf0eeb1a9af5e17483 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 16:08:42 +0200
Subject: [PATCH 150/317] wip: preserve tracked array elements during slurp
 assignment

Keep the RuntimeArray element-list wrapper when transferring materialized
slurping-array values so container owner markers and slot hooks run.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../java/org/perlonjava/runtime/runtimetypes/RuntimeList.java   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
index 9553a3bb20..678df4cff5 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
@@ -890,7 +890,7 @@ public RuntimeArray setFromList(RuntimeList value) {
                     runtimeArray.notePackageRootMutation();
                     MortalList.deferDestroyForContainerClear(runtimeArray.elements);
                     runtimeArray.elements.clear();
-                    runtimeArray.elements = remaining;
+                    runtimeArray.elements.addAll(remaining);
                     for (RuntimeScalar r : remaining) {
                         runtimeArray.markPackageRootedValue(r);
                     }

From 89c0beffe8f03b5df7e26e3307b5dd3799755717 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 16:11:53 +0200
Subject: [PATCH 151/317] wip: trace array slots holding leaked referents

Extend opt-in owner diagnostics with the arrays that contain each tracked
scalar, including ownership and scope state.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../runtime/runtimetypes/RuntimeBase.java          | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
index eaf70b6d64..7c13a7f385 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
@@ -853,6 +853,20 @@ public static void dumpTraceOwners() {
                 RuntimeScalar scalar = own.getValue().scalar.get();
                 RuntimeBase container = scalar == null ? null : scalar.getContainerOwner();
                 String containerDetails = "none";
+                if (scalar != null) {
+                    for (RuntimeArray arrayOwner : scalar.arrayContainerOwnersSnapshot()) {
+                        System.err.println("    ARRAY-SLOT scalar=" + own.getKey()
+                                + " array=" + System.identityHashCode(arrayOwner)
+                                + " index=" + arrayOwner.elements.indexOf(scalar)
+                                + " owned=" + arrayOwner.elementsOwned
+                                + " aliased=" + arrayOwner.elementsAliased
+                                + " captures=" + arrayOwner.captureCount
+                                + " scopeExited=" + arrayOwner.scopeExited
+                                + " localBinding=" + arrayOwner.localBindingExists
+                                + " refCount=" + arrayOwner.refCount
+                                + " creator=" + arrayOwner.traceAllocationSub());
+                    }
+                }
                 if (container instanceof RuntimeArray array) {
                     int activeArgsDepth = -1;
                     if (PerlRuntime.currentOrNull() != null) {

From 9a010dbfab6d82480c7ecf3bd4b3d97e6f972f28 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 16:15:05 +0200
Subject: [PATCH 152/317] wip: release unreachable interpreter closure captures

At interpreter frame exit, a created closure is dead when no Perl root can
reach it. Do not retain its captured aggregates solely because its manual
refCount has not been balanced by a temporary scalar slot.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../backend/bytecode/BytecodeInterpreter.java          | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
index d7c20abb5f..705f60a567 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
@@ -230,7 +230,6 @@ static void abandon(SuspendedInterpreterFrame frame) {
 
         for (RuntimeCode closure : frame.createdClosures) {
             if ((closure.capturedScalars != null || closure.capturedAggregates != null)
-                    && closure.refCount == 0
                     && closure.stashRefCount <= 0
                     && !ReachabilityWalker.isReachableFromRoots(closure)
                     && (frame.returnedClosures == null
@@ -3979,14 +3978,13 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
             // that were never stored via set() (refCount stayed at 0).
             // This handles eval STRING map/grep block closures that over-capture
             // all visible variables but are temporary and should release captures.
-            // Closures stored via set() have refCount > 0 and are skipped.
-            // This matches the JVM-compiled path where scopeExitCleanup releases
-            // captures for CODE refs with refCount=0 (see RuntimeScalar.java
-            // scopeExitCleanup special case for CODE refs).
+            // Closures retained by a Perl root remain reachable and are skipped.
+            // A positive manual refCount alone is not enough to keep a closure
+            // alive: temporary chained closures can carry stale counts after
+            // their scalar slots have gone away.
             if (!frame.suspended && !createdClosures.isEmpty()) {
                 for (RuntimeCode closure : createdClosures) {
                     if ((closure.capturedScalars != null || closure.capturedAggregates != null)
-                            && closure.refCount == 0
                             && closure.stashRefCount <= 0
                             && !ReachabilityWalker.isReachableFromRoots(closure)
                             && (frame.returnedClosures == null || !frame.returnedClosures.contains(closure))) {

From 73aa6912d330e8e178d0c41a792d9bf372b81442 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 16:16:37 +0200
Subject: [PATCH 153/317] wip: trace chained closure cleanup decisions

Add opt-in interpreter diagnostics for closures created by Mojolicious
Plugins::emit_chain at frame exit.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../backend/bytecode/BytecodeInterpreter.java        | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
index 705f60a567..0b45e3f6af 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
@@ -3984,6 +3984,18 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
             // their scalar slots have gone away.
             if (!frame.suspended && !createdClosures.isEmpty()) {
                 for (RuntimeCode closure : createdClosures) {
+                    if (System.getenv("PJ_INTERPRETER_TEMP_OWNER_TRACE") != null
+                            && "Mojolicious::Plugins".equals(code.packageName)
+                            && "emit_chain".equals(code.subName)) {
+                        System.err.printf("[EMIT-CHAIN-CLOSURE] closure=%d package=%s sub=%s refCount=%d stash=%d reachable=%s scalarCaptures=%d aggregateCaptures=%d returned=%s%n",
+                                System.identityHashCode(closure), closure.packageName,
+                                closure.subName, closure.refCount, closure.stashRefCount,
+                                ReachabilityWalker.isReachableFromRoots(closure),
+                                closure.capturedScalars == null ? 0 : closure.capturedScalars.length,
+                                closure.capturedAggregates == null ? 0 : closure.capturedAggregates.length,
+                                frame.returnedClosures != null
+                                        && frame.returnedClosures.contains(closure));
+                    }
                     if ((closure.capturedScalars != null || closure.capturedAggregates != null)
                             && closure.stashRefCount <= 0
                             && !ReachabilityWalker.isReachableFromRoots(closure)

From 578434f07de55b5e6a805d5ea5644a5642544fb8 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 16:18:22 +0200
Subject: [PATCH 154/317] wip: exclude closure bookkeeping from interpreter
 root scans

Copy and clear the interpreter's temporary created-closure list before
checking whether those closures remain reachable from Perl roots.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../backend/bytecode/BytecodeInterpreter.java       | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
index 0b45e3f6af..8785d43f62 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
@@ -228,7 +228,13 @@ static void abandon(SuspendedInterpreterFrame frame) {
         frame.suspended = false;
         frame.suspendedRuntimeDisabledWarningCategories = null;
 
-        for (RuntimeCode closure : frame.createdClosures) {
+        java.util.List<RuntimeCode> abandonedClosures =
+                new java.util.ArrayList<>(frame.createdClosures);
+        // The diagnostic list is only bookkeeping. Remove it from the frame
+        // before the root walk so it cannot keep the closures it is examining
+        // alive by itself.
+        frame.createdClosures.clear();
+        for (RuntimeCode closure : abandonedClosures) {
             if ((closure.capturedScalars != null || closure.capturedAggregates != null)
                     && closure.stashRefCount <= 0
                     && !ReachabilityWalker.isReachableFromRoots(closure)
@@ -3983,7 +3989,10 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
             // alive: temporary chained closures can carry stale counts after
             // their scalar slots have gone away.
             if (!frame.suspended && !createdClosures.isEmpty()) {
-                for (RuntimeCode closure : createdClosures) {
+                java.util.List<RuntimeCode> frameClosures =
+                        new java.util.ArrayList<>(createdClosures);
+                createdClosures.clear();
+                for (RuntimeCode closure : frameClosures) {
                     if (System.getenv("PJ_INTERPRETER_TEMP_OWNER_TRACE") != null
                             && "Mojolicious::Plugins".equals(code.packageName)
                             && "emit_chain".equals(code.subName)) {

From 0a827b6a1dfccf8af3802da551c6406d8e6dbfa5 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 16:20:35 +0200
Subject: [PATCH 155/317] wip: check external roots for temporary closure
 cleanup

Ignore active-frame lexical roots when deciding whether an interpreter
closure created in that frame escaped to durable Perl storage.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../perlonjava/backend/bytecode/BytecodeInterpreter.java   | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
index 8785d43f62..64de19f7ee 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
@@ -237,7 +237,7 @@ static void abandon(SuspendedInterpreterFrame frame) {
         for (RuntimeCode closure : abandonedClosures) {
             if ((closure.capturedScalars != null || closure.capturedAggregates != null)
                     && closure.stashRefCount <= 0
-                    && !ReachabilityWalker.isReachableFromRoots(closure)
+                    && !ReachabilityWalker.isReachableFromExternalRoot(closure)
                     && (frame.returnedClosures == null
                         || !frame.returnedClosures.contains(closure))) {
                 closure.releaseCaptures();
@@ -3996,10 +3996,11 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
                     if (System.getenv("PJ_INTERPRETER_TEMP_OWNER_TRACE") != null
                             && "Mojolicious::Plugins".equals(code.packageName)
                             && "emit_chain".equals(code.subName)) {
-                        System.err.printf("[EMIT-CHAIN-CLOSURE] closure=%d package=%s sub=%s refCount=%d stash=%d reachable=%s scalarCaptures=%d aggregateCaptures=%d returned=%s%n",
+                        System.err.printf("[EMIT-CHAIN-CLOSURE] closure=%d package=%s sub=%s refCount=%d stash=%d reachable=%s external=%s scalarCaptures=%d aggregateCaptures=%d returned=%s%n",
                                 System.identityHashCode(closure), closure.packageName,
                                 closure.subName, closure.refCount, closure.stashRefCount,
                                 ReachabilityWalker.isReachableFromRoots(closure),
+                                ReachabilityWalker.isReachableFromExternalRoot(closure),
                                 closure.capturedScalars == null ? 0 : closure.capturedScalars.length,
                                 closure.capturedAggregates == null ? 0 : closure.capturedAggregates.length,
                                 frame.returnedClosures != null
@@ -4007,7 +4008,7 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
                     }
                     if ((closure.capturedScalars != null || closure.capturedAggregates != null)
                             && closure.stashRefCount <= 0
-                            && !ReachabilityWalker.isReachableFromRoots(closure)
+                            && !ReachabilityWalker.isReachableFromExternalRoot(closure)
                             && (frame.returnedClosures == null || !frame.returnedClosures.contains(closure))) {
                         closure.releaseCaptures();
                     }

From 5c1fb52554624293b0878917ba3281976367004b Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 16:22:53 +0200
Subject: [PATCH 156/317] wip: trace root paths for chained interpreter
 closures

Report the Perl root path that retains each diagnostic emit_chain closure.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../perlonjava/backend/bytecode/BytecodeInterpreter.java    | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
index 64de19f7ee..ac0da6cf32 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
@@ -3996,7 +3996,8 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
                     if (System.getenv("PJ_INTERPRETER_TEMP_OWNER_TRACE") != null
                             && "Mojolicious::Plugins".equals(code.packageName)
                             && "emit_chain".equals(code.subName)) {
-                        System.err.printf("[EMIT-CHAIN-CLOSURE] closure=%d package=%s sub=%s refCount=%d stash=%d reachable=%s external=%s scalarCaptures=%d aggregateCaptures=%d returned=%s%n",
+                        java.util.List<String> rootPath = ReachabilityWalker.findPathTo(closure, true);
+                        System.err.printf("[EMIT-CHAIN-CLOSURE] closure=%d package=%s sub=%s refCount=%d stash=%d reachable=%s external=%s scalarCaptures=%d aggregateCaptures=%d returned=%s path=%s%n",
                                 System.identityHashCode(closure), closure.packageName,
                                 closure.subName, closure.refCount, closure.stashRefCount,
                                 ReachabilityWalker.isReachableFromRoots(closure),
@@ -4004,7 +4005,8 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
                                 closure.capturedScalars == null ? 0 : closure.capturedScalars.length,
                                 closure.capturedAggregates == null ? 0 : closure.capturedAggregates.length,
                                 frame.returnedClosures != null
-                                        && frame.returnedClosures.contains(closure));
+                                        && frame.returnedClosures.contains(closure),
+                                rootPath == null ? "none" : String.join(" -> ", rootPath));
                     }
                     if ((closure.capturedScalars != null || closure.capturedAggregates != null)
                             && closure.stashRefCount <= 0

From 31bd795a22010e0eb0223799cbc3c177f5b88fc2 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 16:26:23 +0200
Subject: [PATCH 157/317] wip: include lexical roots in closure trace paths

Trace both global and live lexical routes to temporary chained closures.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../org/perlonjava/backend/bytecode/BytecodeInterpreter.java    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
index ac0da6cf32..dba59aaec5 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
@@ -3996,7 +3996,7 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
                     if (System.getenv("PJ_INTERPRETER_TEMP_OWNER_TRACE") != null
                             && "Mojolicious::Plugins".equals(code.packageName)
                             && "emit_chain".equals(code.subName)) {
-                        java.util.List<String> rootPath = ReachabilityWalker.findPathTo(closure, true);
+                        java.util.List<String> rootPath = ReachabilityWalker.findPathTo(closure);
                         System.err.printf("[EMIT-CHAIN-CLOSURE] closure=%d package=%s sub=%s refCount=%d stash=%d reachable=%s external=%s scalarCaptures=%d aggregateCaptures=%d returned=%s path=%s%n",
                                 System.identityHashCode(closure), closure.packageName,
                                 closure.subName, closure.refCount, closure.stashRefCount,

From bca61411704f6944aff404eb2a925f93e502913a Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 16:29:43 +0200
Subject: [PATCH 158/317] wip: trace scalar holders of chained closures

Record whether owner scalars for emit_chain closures are still in the
exiting interpreter frame when reachability cleanup runs.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../backend/bytecode/BytecodeInterpreter.java | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
index dba59aaec5..b21b599c15 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
@@ -3997,6 +3997,25 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
                             && "Mojolicious::Plugins".equals(code.packageName)
                             && "emit_chain".equals(code.subName)) {
                         java.util.List<String> rootPath = ReachabilityWalker.findPathTo(closure);
+                        StringBuilder localHolders = new StringBuilder();
+                        for (RuntimeScalar candidate : org.perlonjava.runtime.runtimetypes.ScalarRefRegistry.snapshot()) {
+                            if (candidate.value != closure) continue;
+                            int register = -1;
+                            for (int i = firstMyVarReg; i < registers.length; i++) {
+                                if (registers[i] == candidate) {
+                                    register = i;
+                                    break;
+                                }
+                            }
+                            if (localHolders.length() > 0) localHolders.append(',');
+                            localHolders.append(System.identityHashCode(candidate))
+                                    .append("@reg=").append(register)
+                                    .append(" live=").append(MyVarCleanupStack.isLive(candidate))
+                                    .append(" registered=").append(MyVarCleanupStack.isRegistered(candidate))
+                                    .append(" scopeExited=").append(candidate.scopeExited)
+                                    .append(" captures=").append(candidate.captureCount)
+                                    .append(" refOwned=").append(candidate.refCountOwned);
+                        }
                         System.err.printf("[EMIT-CHAIN-CLOSURE] closure=%d package=%s sub=%s refCount=%d stash=%d reachable=%s external=%s scalarCaptures=%d aggregateCaptures=%d returned=%s path=%s%n",
                                 System.identityHashCode(closure), closure.packageName,
                                 closure.subName, closure.refCount, closure.stashRefCount,
@@ -4007,6 +4026,7 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
                                 frame.returnedClosures != null
                                         && frame.returnedClosures.contains(closure),
                                 rootPath == null ? "none" : String.join(" -> ", rootPath));
+                        System.err.println("[EMIT-CHAIN-HOLDERS] " + localHolders);
                     }
                     if ((closure.capturedScalars != null || closure.capturedAggregates != null)
                             && closure.stashRefCount <= 0

From b6108ec1a42705302c08b962915c666bff746cd8 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 16:32:25 +0200
Subject: [PATCH 159/317] wip: release temporary closure lexicals before
 capture cleanup

Clear remaining local slots for closures created in the exiting interpreter
frame before checking whether those closures escaped.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../backend/bytecode/BytecodeInterpreter.java   | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
index b21b599c15..f48f050739 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
@@ -3993,6 +3993,8 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
                         new java.util.ArrayList<>(createdClosures);
                 createdClosures.clear();
                 for (RuntimeCode closure : frameClosures) {
+                    releaseCurrentFrameClosureSlots(
+                            code, registers, firstMyVarReg, closure);
                     if (System.getenv("PJ_INTERPRETER_TEMP_OWNER_TRACE") != null
                             && "Mojolicious::Plugins".equals(code.packageName)
                             && "emit_chain".equals(code.subName)) {
@@ -4108,6 +4110,21 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
         }
     }
 
+    /** Release lexical slots holding a temporary closure before its root check. */
+    private static void releaseCurrentFrameClosureSlots(
+            InterpretedCode code, RuntimeBase[] registers, int firstMyVarReg,
+            RuntimeCode closure) {
+        for (int i = firstMyVarReg; i < registers.length; i++) {
+            if (!code.myVarRegisters.get(i)) continue;
+            RuntimeBase register = registers[i];
+            if (!(register instanceof RuntimeScalar scalar)
+                    || scalar.value != closure) continue;
+            RuntimeScalar.scopeExitCleanup(scalar);
+            MyVarCleanupStack.unregister(scalar);
+            registers[i] = null;
+        }
+    }
+
     private static void releaseMethodInvocantHoldsAbove(
             ArrayList<RuntimeBase> methodInvocantHolds, int depth) {
         boolean released = false;

From 5d8bbb2846358db55cb83dc92f96250c129fa484 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 16:34:48 +0200
Subject: [PATCH 160/317] wip: clean registered closure holders at interpreter
 frame exit

Clean a registered closure-valued lexical slot even when its bytecode
register was omitted from the my-variable bitset.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../perlonjava/backend/bytecode/BytecodeInterpreter.java | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
index f48f050739..d23c16b470 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
@@ -3994,7 +3994,7 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
                 createdClosures.clear();
                 for (RuntimeCode closure : frameClosures) {
                     releaseCurrentFrameClosureSlots(
-                            code, registers, firstMyVarReg, closure);
+                            registers, firstMyVarReg, closure);
                     if (System.getenv("PJ_INTERPRETER_TEMP_OWNER_TRACE") != null
                             && "Mojolicious::Plugins".equals(code.packageName)
                             && "emit_chain".equals(code.subName)) {
@@ -4112,13 +4112,12 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
 
     /** Release lexical slots holding a temporary closure before its root check. */
     private static void releaseCurrentFrameClosureSlots(
-            InterpretedCode code, RuntimeBase[] registers, int firstMyVarReg,
-            RuntimeCode closure) {
+            RuntimeBase[] registers, int firstMyVarReg, RuntimeCode closure) {
         for (int i = firstMyVarReg; i < registers.length; i++) {
-            if (!code.myVarRegisters.get(i)) continue;
             RuntimeBase register = registers[i];
             if (!(register instanceof RuntimeScalar scalar)
-                    || scalar.value != closure) continue;
+                    || scalar.value != closure
+                    || !MyVarCleanupStack.isRegistered(scalar)) continue;
             RuntimeScalar.scopeExitCleanup(scalar);
             MyVarCleanupStack.unregister(scalar);
             registers[i] = null;

From 76e6c20cdcc3c2cfc03f3537c994c40ecb532116 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 16:44:12 +0200
Subject: [PATCH 161/317] fix: release temporary interpreter closure captures
 at frame exit

Clean registered lexical slots holding closures created in the current
interpreter frame before checking whether their captures escaped. This
allows temporary chained closures to release captured aggregates after
frame exit, even when their manual refCount has not drained to zero.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../backend/bytecode/BytecodeInterpreter.java | 92 ++-----------------
 .../runtime/runtimetypes/RuntimeArray.java    | 19 ----
 .../runtime/runtimetypes/RuntimeBase.java     | 57 +-----------
 .../runtime/runtimetypes/RuntimeList.java     | 58 +-----------
 4 files changed, 10 insertions(+), 216 deletions(-)

diff --git a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
index d23c16b470..18beafbccf 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
@@ -228,13 +228,14 @@ static void abandon(SuspendedInterpreterFrame frame) {
         frame.suspended = false;
         frame.suspendedRuntimeDisabledWarningCategories = null;
 
+        InterpretedCode code = frame.code;
+        RuntimeBase[] registers = frame.registers;
+        int firstMyVarReg = 3 + (code.capturedVars != null ? code.capturedVars.length : 0);
         java.util.List<RuntimeCode> abandonedClosures =
                 new java.util.ArrayList<>(frame.createdClosures);
-        // The diagnostic list is only bookkeeping. Remove it from the frame
-        // before the root walk so it cannot keep the closures it is examining
-        // alive by itself.
         frame.createdClosures.clear();
         for (RuntimeCode closure : abandonedClosures) {
+            releaseCurrentFrameClosureSlots(registers, firstMyVarReg, closure);
             if ((closure.capturedScalars != null || closure.capturedAggregates != null)
                     && closure.stashRefCount <= 0
                     && !ReachabilityWalker.isReachableFromExternalRoot(closure)
@@ -244,9 +245,6 @@ static void abandon(SuspendedInterpreterFrame frame) {
             }
         }
 
-        InterpretedCode code = frame.code;
-        RuntimeBase[] registers = frame.registers;
-        int firstMyVarReg = 3 + (code.capturedVars != null ? code.capturedVars.length : 0);
         BitSet myVars = code.myVarRegisters;
         boolean needsFlush = false;
         for (int i = myVars.nextSetBit(firstMyVarReg);
@@ -302,37 +300,12 @@ private static void trackTemporaryScalarReferenceContents(
         boolean eligible = register >= firstMyVarReg
                 && !code.myVarRegisters.get(register)
                 && !scalar.isPackageGlobalRoot
-                && !hasOwningContainerSlot(scalar)
+                && scalar.getContainerOwner() == null
                 && !(scalar instanceof RuntimeBaseProxy)
                 && !MyVarCleanupStack.isRegistered(scalar);
-        if (System.getenv("PJ_INTERPRETER_TEMP_OWNER_TRACE") != null) {
-            System.err.printf("[INTERPRETER-TEMP-OWNER] scalar=%d register=%d firstMyVar=%d refOwned=%s scopeExited=%s captures=%d registered=%s packageRoot=%s container=%s eligible=%s%n",
-                    System.identityHashCode(scalar), register, firstMyVarReg,
-                    scalar.refCountOwned, scalar.scopeExited, scalar.captureCount,
-                    MyVarCleanupStack.isRegistered(scalar), scalar.isPackageGlobalRoot,
-                    scalar.getContainerOwner() == null ? "none"
-                            : scalar.getContainerOwner().getClass().getSimpleName(), eligible);
-        }
         if (eligible) frame.temporaryScalarOwners.add(scalar);
     }
 
-    /**
-     * A borrowed {@code @_} entry has a container marker for alias tracking,
-     * but the argument array does not own the scalar slot. Do not let that
-     * marker suppress cleanup of an otherwise temporary interpreter owner.
-     */
-    private static boolean hasOwningContainerSlot(RuntimeScalar scalar) {
-        RuntimeBase owner = scalar.getContainerOwner();
-        if (owner instanceof RuntimeArray array) {
-            return array.elements.contains(scalar)
-                    && (!array.elementsAliased || array.ownsElement(scalar));
-        }
-        if (owner instanceof RuntimeHash hash) {
-            return hash.elements.containsValue(scalar);
-        }
-        return false;
-    }
-
     /**
      * Result of a call whose non-local last/next/redo was consumed by an enclosing
      * labeled block.  Control has left the block, so the marker must not stay in the
@@ -2330,15 +2303,6 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
                                     callArgs = (RuntimeArray) argsBase;
                                 } else if (argsBase instanceof RuntimeList) {
                                     callArgs = new RuntimeArray();
-                                    if (System.getenv("PJ_REFCOUNT_TRACE") != null
-                                            && "Mojolicious".equals(code.packageName)) {
-                                        ErrorMessageUtil.SourceLocation location =
-                                                InlineOpcodeHandler.sourceLocation(code, callSitePc);
-                                        System.err.printf("[MOJO-INTERPRETER-ARG-ARRAY] array=%d sub=%s::%s source=%s:%d args=%d%n",
-                                                System.identityHashCode(callArgs), code.packageName,
-                                                code.subName, location.fileName(), location.lineNumber(),
-                                                ((RuntimeList) argsBase).elements.size());
-                                    }
                                     argsBase.setArrayOfAlias(callArgs);
                                 } else {
                                     callArgs = new RuntimeArray((RuntimeScalar) argsBase);
@@ -3980,14 +3944,9 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
                 releaseMethodInvocantHoldsAbove(methodInvocantHolds, 0);
             }
 
-            // Release captures for interpreter closures created in this frame
-            // that were never stored via set() (refCount stayed at 0).
-            // This handles eval STRING map/grep block closures that over-capture
-            // all visible variables but are temporary and should release captures.
-            // Closures retained by a Perl root remain reachable and are skipped.
-            // A positive manual refCount alone is not enough to keep a closure
-            // alive: temporary chained closures can carry stale counts after
-            // their scalar slots have gone away.
+            // Release captures for closures created here that were not stored
+            // outside the frame. Clean their lexical slots first so the active
+            // frame does not make a temporary closure appear externally rooted.
             if (!frame.suspended && !createdClosures.isEmpty()) {
                 java.util.List<RuntimeCode> frameClosures =
                         new java.util.ArrayList<>(createdClosures);
@@ -3995,41 +3954,6 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
                 for (RuntimeCode closure : frameClosures) {
                     releaseCurrentFrameClosureSlots(
                             registers, firstMyVarReg, closure);
-                    if (System.getenv("PJ_INTERPRETER_TEMP_OWNER_TRACE") != null
-                            && "Mojolicious::Plugins".equals(code.packageName)
-                            && "emit_chain".equals(code.subName)) {
-                        java.util.List<String> rootPath = ReachabilityWalker.findPathTo(closure);
-                        StringBuilder localHolders = new StringBuilder();
-                        for (RuntimeScalar candidate : org.perlonjava.runtime.runtimetypes.ScalarRefRegistry.snapshot()) {
-                            if (candidate.value != closure) continue;
-                            int register = -1;
-                            for (int i = firstMyVarReg; i < registers.length; i++) {
-                                if (registers[i] == candidate) {
-                                    register = i;
-                                    break;
-                                }
-                            }
-                            if (localHolders.length() > 0) localHolders.append(',');
-                            localHolders.append(System.identityHashCode(candidate))
-                                    .append("@reg=").append(register)
-                                    .append(" live=").append(MyVarCleanupStack.isLive(candidate))
-                                    .append(" registered=").append(MyVarCleanupStack.isRegistered(candidate))
-                                    .append(" scopeExited=").append(candidate.scopeExited)
-                                    .append(" captures=").append(candidate.captureCount)
-                                    .append(" refOwned=").append(candidate.refCountOwned);
-                        }
-                        System.err.printf("[EMIT-CHAIN-CLOSURE] closure=%d package=%s sub=%s refCount=%d stash=%d reachable=%s external=%s scalarCaptures=%d aggregateCaptures=%d returned=%s path=%s%n",
-                                System.identityHashCode(closure), closure.packageName,
-                                closure.subName, closure.refCount, closure.stashRefCount,
-                                ReachabilityWalker.isReachableFromRoots(closure),
-                                ReachabilityWalker.isReachableFromExternalRoot(closure),
-                                closure.capturedScalars == null ? 0 : closure.capturedScalars.length,
-                                closure.capturedAggregates == null ? 0 : closure.capturedAggregates.length,
-                                frame.returnedClosures != null
-                                        && frame.returnedClosures.contains(closure),
-                                rootPath == null ? "none" : String.join(" -> ", rootPath));
-                        System.err.println("[EMIT-CHAIN-HOLDERS] " + localHolders);
-                    }
                     if ((closure.capturedScalars != null || closure.capturedAggregates != null)
                             && closure.stashRefCount <= 0
                             && !ReachabilityWalker.isReachableFromExternalRoot(closure)
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
index bd91e31142..b0217b3b3b 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
@@ -26,25 +26,6 @@
  * using a list of RuntimeScalar objects, which can hold any type of Perl scalar value.
  */
 public class RuntimeArray extends RuntimeBase implements RuntimeScalarReference, DynamicState {
-    private final StackTraceElement[] traceAllocationStack =
-            System.getenv("PJ_REFCOUNT_TRACE") == null ? null : new Throwable().getStackTrace();
-    private final String traceAllocationSub = traceAllocationStack == null
-            || PerlRuntime.currentOrNull() == null ? null : activeSubForTrace();
-
-    private static String activeSubForTrace() {
-        RuntimeCode active = RuntimeCode.getActiveCodeAt(0);
-        if (active == null) return "<no active Perl sub>";
-        return String.valueOf(active.packageName) + "::" + String.valueOf(active.subName);
-    }
-
-    StackTraceElement[] traceAllocationStack() {
-        return traceAllocationStack;
-    }
-
-    String traceAllocationSub() {
-        return traceAllocationSub;
-    }
-
     /** Return an empty lexical cell when control flow skipped its declaration. */
     public static RuntimeArray materializeLexicalCell(RuntimeArray array) {
         return array != null ? array : new RuntimeArray();
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
index 7c13a7f385..58b179d1d2 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
@@ -574,12 +574,10 @@ public void traceRefCount(int delta, String reason) {
     private static final class OwnerTrace {
         final int scalarIdentity;
         final String acquireSite;
-        final java.lang.ref.WeakReference<RuntimeScalar> scalar;
 
         OwnerTrace(RuntimeScalar scalar, String acquireSite) {
             this.scalarIdentity = System.identityHashCode(scalar);
             this.acquireSite = acquireSite;
-            this.scalar = new java.lang.ref.WeakReference<>(scalar);
         }
     }
 
@@ -850,60 +848,7 @@ public static void dumpTraceOwners() {
                 + " refCount=" + b.refCount
                 + " owners=" + e.getValue().size());
             for (java.util.Map.Entry<Integer, OwnerTrace> own : e.getValue().entrySet()) {
-                RuntimeScalar scalar = own.getValue().scalar.get();
-                RuntimeBase container = scalar == null ? null : scalar.getContainerOwner();
-                String containerDetails = "none";
-                if (scalar != null) {
-                    for (RuntimeArray arrayOwner : scalar.arrayContainerOwnersSnapshot()) {
-                        System.err.println("    ARRAY-SLOT scalar=" + own.getKey()
-                                + " array=" + System.identityHashCode(arrayOwner)
-                                + " index=" + arrayOwner.elements.indexOf(scalar)
-                                + " owned=" + arrayOwner.elementsOwned
-                                + " aliased=" + arrayOwner.elementsAliased
-                                + " captures=" + arrayOwner.captureCount
-                                + " scopeExited=" + arrayOwner.scopeExited
-                                + " localBinding=" + arrayOwner.localBindingExists
-                                + " refCount=" + arrayOwner.refCount
-                                + " creator=" + arrayOwner.traceAllocationSub());
-                    }
-                }
-                if (container instanceof RuntimeArray array) {
-                    int activeArgsDepth = -1;
-                    if (PerlRuntime.currentOrNull() != null) {
-                        for (int depth = 0; depth < RuntimeCode.argsStackDepth(); depth++) {
-                            if (RuntimeCode.getActiveArgsAt(depth) == array) {
-                                activeArgsDepth = depth;
-                                break;
-                            }
-                        }
-                    }
-                    containerDetails = "RuntimeArray#" + System.identityHashCode(array)
-                            + " creator=" + array.traceAllocationSub()
-                            + " size=" + array.elements.size()
-                            + " owned=" + array.elementsOwned
-                            + " aliased=" + array.elementsAliased
-                            + " transientRhs=" + array.transientListAssignmentRhs
-                            + " activeArgsDepth=" + activeArgsDepth
-                            + " index=" + array.elements.indexOf(scalar);
-                    StackTraceElement[] allocation = array.traceAllocationStack();
-                    if (allocation != null) {
-                        containerDetails += " allocation=" + java.util.Arrays.toString(allocation);
-                    }
-                } else if (container != null) {
-                    containerDetails = container.getClass().getSimpleName()
-                            + "#" + System.identityHashCode(container);
-                }
-                System.err.println("    owner=" + own.getKey() + " from " + own.getValue().acquireSite
-                        + " alive=" + (scalar != null)
-                        + " refOwned=" + (scalar != null && scalar.refCountOwned)
-                        + " scopeExited=" + (scalar != null && scalar.scopeExited)
-                        + " captures=" + (scalar == null ? -1 : scalar.captureCount)
-                        + " packageRoot=" + (scalar != null && scalar.isPackageGlobalRoot)
-                        + " type=" + (scalar == null ? -1 : scalar.type)
-                        + " localArray=" + (scalar == null || scalar.localArrayOwner == null
-                                ? "none" : System.identityHashCode(scalar.localArrayOwner)
-                                        + "[" + scalar.localArrayIndex + "]")
-                        + " container=" + containerDetails);
+                System.err.println("    owner=" + own.getKey() + " from " + own.getValue().acquireSite);
             }
         }
         for (java.util.Map.Entry<RuntimeBase, java.util.ArrayList<PendingOwnerRelease>> e
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
index 678df4cff5..2d0ba54f42 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
@@ -760,21 +760,6 @@ public RuntimeArray setFromList(RuntimeList value) {
         int rhsSize = rhsElements.size();
         int rhsIndex = 0;
 
-        if (System.getenv("PJ_REFCOUNT_TRACE") != null) {
-            for (int i = 0; i < rhsSize; i++) {
-                RuntimeScalar scalar = rhsElements.get(i);
-                if (isConfiguredTraceReferent(scalar)) {
-                    System.err.printf("[LIST-ASSIGN-RHS] owner=%d index=%d owned=%s container=%s lhs=%s%n",
-                            System.identityHashCode(scalar), i, scalar.refCountOwned,
-                            scalar.getContainerOwner() == null ? "none"
-                                    : scalar.getContainerOwner().getClass().getSimpleName(),
-                            elements.stream().map(item -> item == null
-                                    ? "null" : item.getClass().getSimpleName())
-                                    .toList());
-                }
-            }
-        }
-
         // Build result with assigned values (including undef for unassigned scalars)
         RuntimeArray result = new RuntimeArray();
         // Store original size for scalar context
@@ -793,12 +778,6 @@ public RuntimeArray setFromList(RuntimeList value) {
                 // (it would reflect the post-assignment value rather than the pre-assignment value).
                 boolean useAlias = rhsAlias != null && lhsScalars != null && !lhsScalars.containsKey(rhsAlias);
 
-                if (isConfiguredTraceReferent(rhsValue)) {
-                    System.err.printf("[LIST-ASSIGN-UNDEF] owner=%d index=%d useAlias=%s alias=%d%n",
-                            System.identityHashCode(rhsValue), rhsIndex, useAlias,
-                            rhsAlias == null ? 0 : System.identityHashCode(rhsAlias));
-                }
-
                 result.elements.add(useAlias ? rhsAlias : rhsValue);
 
                 if (rhsIndex < rhsSize) {
@@ -828,10 +807,6 @@ public RuntimeArray setFromList(RuntimeList value) {
                     runtimeScalar.rejectKeysLvalueListAssignment();
                 }
                 RuntimeScalar assigned = (rhsIndex < rhsSize) ? rhsElements.get(rhsIndex++) : null;
-                if (isConfiguredTraceReferent(assigned)) {
-                    System.err.printf("[LIST-ASSIGN-SCALAR] owner=%d rhsIndex=%d refOwned=%s%n",
-                            System.identityHashCode(assigned), rhsIndex - 1, assigned.refCountOwned);
-                }
                 runtimeScalar.set(assigned != null ? assigned : new RuntimeScalar());
                 result.elements.add(runtimeScalar);  // Add reference to the variable itself
                 // set() has acquired a new nested scalar-reference owner on the
@@ -852,10 +827,6 @@ public RuntimeArray setFromList(RuntimeList value) {
                     base.refCount--;
                     assigned.refCountOwned = false;
                 }
-                if (isConfiguredTraceReferent(assigned)) {
-                    System.err.printf("[LIST-ASSIGN-SCALAR-DONE] owner=%d refOwned=%s%n",
-                            System.identityHashCode(assigned), assigned.refCountOwned);
-                }
             } else if (elem instanceof RuntimeArray runtimeArray) {
                 List<RuntimeScalar> remaining = (rhsIndex < rhsSize)
                         ? new ArrayList<>(rhsElements.subList(rhsIndex, rhsSize))
@@ -887,17 +858,7 @@ public RuntimeArray setFromList(RuntimeList value) {
                 } else {
                     // Plain array: directly reuse the materialized copies.
                     // Their refCountOwned=true transfers to the array elements.
-                    runtimeArray.notePackageRootMutation();
-                    MortalList.deferDestroyForContainerClear(runtimeArray.elements);
-                    runtimeArray.elements.clear();
-                    runtimeArray.elements.addAll(remaining);
-                    for (RuntimeScalar r : remaining) {
-                        runtimeArray.markPackageRootedValue(r);
-                    }
-                    runtimeArray.elementsOwned = true;
-                    runtimeArray.elementsAliased = false;
-                    runtimeArray.ownedAliasElements = null;
-                    runtimeArray.reconcileArrayElementOwnerSlots();
+                    runtimeArray.elements = remaining;
                 }
                 result.elements.addAll(remaining);  // Use original references
                 rhsIndex = rhsSize; // Consume the rest
@@ -934,16 +895,6 @@ public RuntimeArray setFromList(RuntimeList value) {
             }
         }
 
-        if (System.getenv("PJ_REFCOUNT_TRACE") != null) {
-            for (int i = rhsIndex; i < rhsSize; i++) {
-                RuntimeScalar scalar = rhsElements.get(i);
-                if (isConfiguredTraceReferent(scalar)) {
-                    System.err.printf("[LIST-ASSIGN-LEFTOVER] owner=%d index=%d refOwned=%s%n",
-                            System.identityHashCode(scalar), i, scalar.refCountOwned);
-                }
-            }
-        }
-
         // Restore previous flushing state. Now that all LHS variables hold references
         // to the return values, it's safe to process pending decrements.
         MortalList.suppressFlush(wasFlushing);
@@ -1054,13 +1005,6 @@ private static void releaseDiscardedMaterializedScalar(RuntimeScalar scalar) {
         }
     }
 
-    private static boolean isConfiguredTraceReferent(RuntimeScalar scalar) {
-        String expected = System.getenv("PJ_REFCOUNT_TRACE_CLASS");
-        if (expected == null || scalar == null || !(scalar.value instanceof RuntimeBase base)
-                || base.blessId == 0) return false;
-        return expected.equals(NameNormalizer.getBlessStr(base.blessId));
-    }
-
     /**
      * Converts the list to a string, concatenating all elements without separators.
      *

From 2af7a5fe9af5486b6b27456f1b38275960404e9b Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 17:14:49 +0200
Subject: [PATCH 162/317] fix: preserve captures in non-owning interpreter code
 slots

A non-owning CODE wrapper can be a local reachability root without owning
its closure captures. Mark it scope-exited before the external-root check,
without running scalar cleanup that could release a regex-owned callback.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../backend/bytecode/BytecodeInterpreter.java          | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
index 18beafbccf..5eb9aa4997 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
@@ -4042,7 +4042,15 @@ private static void releaseCurrentFrameClosureSlots(
             if (!(register instanceof RuntimeScalar scalar)
                     || scalar.value != closure
                     || !MyVarCleanupStack.isRegistered(scalar)) continue;
-            RuntimeScalar.scopeExitCleanup(scalar);
+            if (scalar.refCountOwned) {
+                RuntimeScalar.scopeExitCleanup(scalar);
+            } else {
+                // Non-owning CODE wrappers can still be the only local root
+                // seen by the conservative reachability walk. Mark the slot
+                // exited without releasing captures before the external-root
+                // check (for example, a RuntimeRegex may still own the CV).
+                scalar.scopeExited = true;
+            }
             MyVarCleanupStack.unregister(scalar);
             registers[i] = null;
         }

From 921510a94664e628492b322aeeca4d27f6812948 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 17:17:40 +0200
Subject: [PATCH 163/317] fix: retain regex callbacks returned from interpreter
 frames

Include executable callback CODE refs owned by a returned RuntimeRegex in
the interpreter's returned-closure handoff, so frame cleanup does not
release captures before the regex itself leaves scope.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .../org/perlonjava/backend/bytecode/BytecodeInterpreter.java | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
index 5eb9aa4997..315a6c8bcb 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
@@ -167,6 +167,11 @@ private static void collectReturnedClosures(RuntimeBase value, java.util.Identit
         if (value instanceof RuntimeScalar scalar) {
             if (scalar.type == RuntimeScalarType.CODE && scalar.value instanceof RuntimeCode code) {
                 closures.put(code, Boolean.TRUE);
+            } else if (scalar.type == RuntimeScalarType.REGEX
+                    && scalar.value instanceof RuntimeRegex regex) {
+                for (RuntimeCode callback : regex.executableCallbackCodes()) {
+                    closures.put(callback, Boolean.TRUE);
+                }
             }
             return;
         }

From ad5b3b44cd600d884a440a1401a9d4d044359574 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 19:05:14 +0200
Subject: [PATCH 164/317] build: keep expanded unit suite within worker limits

Raise the test worker heap for shard 0's expanded in-process lifetime
suite and cap default Gradle task concurrency to two workers. This keeps
the standard make gate from exhausting a worker heap or overcommitting
memory while preserving the existing shard layout.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 Makefile     | 2 +-
 build.gradle | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Makefile b/Makefile
index 677fff3a85..345a5c85a8 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 .PHONY: all clean test test-unit test-cpan-tester test-interpreter check-thread-test-sources check-thread-core-test-sources check-thread-ecosystem-test-sources check-thread-regex-test-sources test-thread-tooling test-threads test-threads-core test-threads-core-platform test-threads-core-mode test-threads-windows test-threads-regex test-threads-release test-threads-ecosystem test-bundled-modules test-cpan-distroprefs test-cpan-release-acceptance test-exiftool test-all test-gradle test-gradle-unit test-gradle-all test-gradle-parallel test-maven-parallel build run wrapper check-java-gradle dev ci sbom sbom-java sbom-perl sbom-clean check-links perl5-update perl5-sync perl5-sync-check
 
 PERL ?= perl
-GRADLE_ARGS ?=
+GRADLE_ARGS ?= --max-workers=2
 # A persistent daemon keeps the priority from the invocation that first
 # started it. Use a single-use Gradle process so workers inherit the
 # launcher's niceness (for example, `nice -n 19 make`).
diff --git a/build.gradle b/build.gradle
index 9ae0d69c45..9d6675934f 100644
--- a/build.gradle
+++ b/build.gradle
@@ -350,10 +350,10 @@ tasks.withType(Test).configureEach {
     // deprecation banner while retaining the tested Netty allocation path.
     jvmArgs += '--sun-misc-unsafe-memory-access=allow'
     // The Perl test corpus loads sizeable bundled tables (for example
-    // I18N::LangTags via Test2).  A 1 GiB Gradle worker can be terminated by
-    // the host before it reports an OOME; keep it below the command-line
-    // default while providing enough headroom for one shard.
-    maxHeapSize = '2g'
+    // I18N::LangTags via Test2). A 1 GiB Gradle worker can be terminated by
+    // the host before it reports an OOME. The expanded lifetime regression
+    // suite also needs room for shard 0's in-process tests.
+    maxHeapSize = '3g'
 }
 
 // Enable native access for all Java execution tasks

From 39bb1dab18396f9216eb46ea7f86e908383b5010 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 19:44:02 +0200
Subject: [PATCH 165/317] docs: update ownership regression candidate status

Record the rebased candidate's interpreter parity results, focused regression
counts, full make result, and remaining Phase 2 ownership work.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index d909db3e20..454548239b 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,10 +107,19 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate is open in [PR #1816](https://github.com/PerlOnJava/pull/1816), based on current master `6b577fd68a179452561695a9e6bba784d9195060`. The published draft head is `d0efeda1a1b31790ffc81e73d1aaa5c098eedbdc`; Linux and Windows `make` and the configured Perl thread compatibility gates pass on that commit. The local full `nice -n 19 make`, including the new regression, passes in 22m28s. The upstream-matched Mojolicious long-poll test at `mojolicious_controller_destroy_after_finish.t` passes 5/5 on blead Perl 5.45.4 and the JVM backend; the interpreter backend fails the controller-destruction assertion. An extended-access owner trace narrows its retained edge to an inactive `Mojolicious::Controller::write_chunk` closure capture through a `PerlOwnerSlot` array. The socket-free focused regression at `refcount/issue_1794_controller_owner_release.t` passes on blead and JVM PerlOnJava but shows the interpreter clears the weak observer without running `DESTROY` when a weak transaction releases its callback. An ordinary consumed `Mojo::EventEmitter` one-shot callback releases its captured object on both PerlOnJava backends, so the remaining gap is in persistent callback teardown. The existing combined WebSocket/lifecycle test passes 29/29 on the JVM; in interpreter mode it stalls after the long-poll response finishes. The Catalyst request-body and multipart tempfile regression passes 24/24 on the JVM and in an isolated interpreter run; an earlier sequential interpreter run exceeded its timeout during multipart handling, so repeat under CI load if relevant. These interpreter results remain parity gaps, not passing evidence for the issues. The previously validated ownership changes and evidence below are unchanged. This remains a recovery bridge rather than the completed Phase 2 ownership migration: `refCount` still controls dispatch, and scalar/proxy stores, alias cleanup, and complete default owner-slot accounting remain unmigrated. Continue migrating complete ownership paths through replacement, deletion, aliases, calls, and final release.
+The #1794/#1795 regression candidate was published in [PR #1816](https://github.com/PerlOnJava/pull/1816) at draft head `d0efeda1a1b31790ffc81e73d1aaa5c098eedbdc`. Those earlier local and CI results are superseded by the 2026-10-20 candidate below. Phase 2 remains a recovery bridge rather than the completed ownership migration: `refCount` still controls dispatch, and scalar/proxy stores, alias cleanup, and complete default owner-slot accounting remain unmigrated.
+
+The newer local candidate is based on current `origin/master` (`ede542b29`) and has not yet been published. Its full `nice -n 19 make` passed in 25m15s with two Gradle workers and a 3 GiB test heap. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, and ownership regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; and `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both. This closes the interpreter parity gaps recorded on the earlier candidate. The build settings bound test concurrency and give the expanded shard 0 enough heap. Continue migrating complete ownership paths through replacement, deletion, aliases, calls, and final release.
 
 ### Completed
 
+- [x] On 2026-10-20, rebased the #1794/#1795 candidate onto current master,
+  fixed the remaining interpreter closure-capture and cleanup behavior, and
+  validated the controller (5/5), WebSocket (6/6), Catalyst tempfile (24/24),
+  and owner-release (3/3) regressions on both backends. The full `make` gate
+  passes with the new two-worker and 3 GiB worker settings. Standard Perl
+  5.45.4 passes the Perl-level regressions. The PR publication step remains
+  pending approval.
 - [x] Re-read the parent issue's implementation contract and reviewed the
   independent lifecycle candidate handoff. Historical candidate test results
   are not treated as current Phase 1 evidence.

From f7cb667f943343dacac9478a23bfdebee46e1842 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 19:49:38 +0200
Subject: [PATCH 166/317] docs: record published ownership candidate

Update the ownership design status with the rebased PR head, passing local
make gate, focused regressions, and pending hosted CI jobs.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 454548239b..cba05f0ba4 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress in [PR #1816](https://github.com/PerlOnJava/pull/1816), currently open as a draft at `d0efeda1a1b31790ffc81e73d1aaa5c098eedbdc`. Linux and Windows `make` jobs and the configured Perl thread compatibility gates pass on that head. It records hash-entry and array-element owner slots for deferred-release recovery, registers slots after array proxy stores, scalar refaliasing, scalar-reference creation, and aggregate refaliasing, and proves ownership for anonymous arrays reachable through package-rooted hashes while excluding the dying referent. The local `nice -n 19 make` and HTML-Tree 5.07 suite pass; the nested process-handle test allows 30 seconds for Windows child-JVM startup after its previous five-second wait expired in CI. Owner slots still bridge to `RuntimeBase.refCount` for dispatch; this is not the complete Phase 2 ownership migration.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress in [PR #1816](https://github.com/PerlOnJava/pull/1816), currently open as a draft based on master `ede542b2901ebb54e7aae293fae74cbbd6af22d7`. The local full `nice -n 19 make` passes with two Gradle workers and a 3 GiB test heap; the PR's Linux and Windows jobs are running. The candidate records hash-entry and array-element owner slots for deferred-release recovery, registers slots after array proxy stores, scalar refaliasing, scalar-reference creation, and aggregate refaliasing, and proves ownership for anonymous arrays reachable through package-rooted hashes while excluding the dying referent. HTML-Tree 5.07 passes. Owner slots still bridge to `RuntimeBase.refCount` for dispatch; this is not the complete Phase 2 ownership migration.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,9 +107,9 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 regression candidate was published in [PR #1816](https://github.com/PerlOnJava/pull/1816) at draft head `d0efeda1a1b31790ffc81e73d1aaa5c098eedbdc`. Those earlier local and CI results are superseded by the 2026-10-20 candidate below. Phase 2 remains a recovery bridge rather than the completed ownership migration: `refCount` still controls dispatch, and scalar/proxy stores, alias cleanup, and complete default owner-slot accounting remain unmigrated.
+The earlier #1794/#1795 candidate was published in [PR #1816](https://github.com/PerlOnJava/pull/1816) at draft head `d0efeda1a1b31790ffc81e73d1aaa5c098eedbdc`; those local and CI results are superseded below. Phase 2 remains a recovery bridge rather than the completed ownership migration: `refCount` still controls dispatch, and scalar/proxy stores, alias cleanup, and complete default owner-slot accounting remain unmigrated.
 
-The newer local candidate is based on current `origin/master` (`ede542b29`) and has not yet been published. Its full `nice -n 19 make` passed in 25m15s with two Gradle workers and a 3 GiB test heap. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, and ownership regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; and `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both. This closes the interpreter parity gaps recorded on the earlier candidate. The build settings bound test concurrency and give the expanded shard 0 enough heap. Continue migrating complete ownership paths through replacement, deletion, aliases, calls, and final release.
+The rebased candidate is published as draft PR #1816, based on `origin/master` (`ede542b29`). Its full `nice -n 19 make` passed in 25m15s with two Gradle workers and a 3 GiB test heap. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, and ownership regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; and `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both. This closes the interpreter parity gaps recorded on the earlier candidate. The build settings bound test concurrency and give the expanded shard 0 enough heap. Continue migrating complete ownership paths through replacement, deletion, aliases, calls, and final release.
 
 ### Completed
 
@@ -118,8 +118,8 @@ The newer local candidate is based on current `origin/master` (`ede542b29`) and
   validated the controller (5/5), WebSocket (6/6), Catalyst tempfile (24/24),
   and owner-release (3/3) regressions on both backends. The full `make` gate
   passes with the new two-worker and 3 GiB worker settings. Standard Perl
-  5.45.4 passes the Perl-level regressions. The PR publication step remains
-  pending approval.
+  5.45.4 passes the Perl-level regressions. Published the rebased candidate to
+  PR #1816 as a draft; its Linux and Windows CI jobs are pending.
 - [x] Re-read the parent issue's implementation contract and reviewed the
   independent lifecycle candidate handoff. Historical candidate test results
   are not treated as current Phase 1 evidence.

From 33b78007d4dc95e932db3b0693ea0a45cfcbd980 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 20:28:56 +0200
Subject: [PATCH 167/317] fix: implement writable Internals::SvREFCNT

Implement the optional refcount setter using the Perl-visible count
adjustments, and move B::SV's private query mode to a dedicated internal
entry point. Add a Perl-oracle-backed regression for scalar, array, and
hash referents.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtime/perlmodule/Internals.java         | 41 ++++++++++++++++---
 src/main/perl/lib/B.pm                        |  2 +-
 .../unit/refcount/internals_svrefcnt_write.t  | 23 +++++++++++
 3 files changed, 60 insertions(+), 6 deletions(-)
 create mode 100644 src/test/resources/unit/refcount/internals_svrefcnt_write.t

diff --git a/src/main/java/org/perlonjava/runtime/perlmodule/Internals.java b/src/main/java/org/perlonjava/runtime/perlmodule/Internals.java
index 31a602cf61..3890c82b15 100644
--- a/src/main/java/org/perlonjava/runtime/perlmodule/Internals.java
+++ b/src/main/java/org/perlonjava/runtime/perlmodule/Internals.java
@@ -32,6 +32,7 @@ public static void initialize() {
         try {
             internals.registerMethod("SvREADONLY", "svReadonly", "\\[$@%];$");
             internals.registerMethod("SvREFCNT", "svRefcount", "$;$");
+            internals.registerMethod("jperl_b_svrefcnt", "jperlBSvrefcnt", "$");
             // Clear placeholder slots in a restricted hash. PerlOnJava doesn't
             // implement Perl's restricted-hash placeholder machinery (used by
             // Hash::Util / fields), so this is a safe no-op. Modules like
@@ -483,10 +484,42 @@ public static RuntimeList V(RuntimeArray args, int ctx) {
      */
     public static RuntimeList svRefcount(RuntimeArray args, int ctx) {
         if (args.size() < 1 || args.size() > 2
-                || (args.size() == 1 && args.get(0) instanceof RuntimeScalarReadOnly)) {
+                || (args.size() == 2 && args.get(0) instanceof RuntimeScalarReadOnly)) {
             WarnDie.die(new RuntimeScalar("Usage: Internals::SvREFCNT(SCALAR[, REFCOUNT])"), new RuntimeScalar(""));
         }
         RuntimeScalar arg = args.get(0);
+        if (args.size() == 2) {
+            int requested = args.get(1).getInt();
+            RuntimeBase referent = arg.value instanceof RuntimeBase value ? value : null;
+            if (referent == null) {
+                arg.refCount = requested;
+                arg.hadCountedReference = requested > 0;
+            } else {
+                int nativeCaptureOwners = referent.nativeCaptureOwnerCount();
+                boolean compileHintsHash = referent == GlobalVariable.getGlobalHash(
+                        GlobalContext.encodeSpecialVar("H"));
+                int extra = (referent.localBindingExists && !compileHintsHash ? 1 : 0)
+                        + referent.foreachAliasCount;
+                int adjust = compileHintsHash || !referent.localBindingExists ? -1 : 0;
+                int rawCount = requested - nativeCaptureOwners - extra - adjust;
+                referent.refCount = rawCount;
+                referent.hadCountedReference = rawCount > 0;
+            }
+            return new RuntimeScalar(requested).getList();
+        }
+        return svRefcountValue(arg, false);
+    }
+
+    /** Internal B::SV query mode; kept separate from Perl's public setter argument. */
+    public static RuntimeList jperlBSvrefcnt(RuntimeArray args, int ctx) {
+        if (args.size() != 1) {
+            WarnDie.die(new RuntimeScalar("Usage: Internals::jperl_b_svrefcnt(SCALAR)"),
+                    new RuntimeScalar(""));
+        }
+        return svRefcountValue(args.get(0), true);
+    }
+
+    private static RuntimeList svRefcountValue(RuntimeScalar arg, boolean bObjectProbe) {
         RuntimeBase base = arg.value instanceof RuntimeBase value ? value : null;
         if (base == null && arg.firstClassRegexScalar && arg.firstClassRegexReferent != null) {
             base = arg.firstClassRegexReferent.get();
@@ -549,8 +582,7 @@ public static RuntimeList svRefcount(RuntimeArray args, int ctx) {
             int extra = (base.localBindingExists && !compileHintsHash ? 1 : 0)
                     + base.foreachAliasCount;
             if (rc == 2
-                    && args.size() > 1
-                    && args.get(1).getBoolean()
+                    && bObjectProbe
                     && DestroyDispatch.isInsideDestroy()
                     && !ReachabilityWalker.hasLiveStrongScalarReferentOtherThan(base, arg)) {
                 // B::SV's private hash slot is one of the two selective
@@ -580,7 +612,6 @@ public static RuntimeList svRefcount(RuntimeArray args, int ctx) {
                     && !base.localBindingExists
                     && base.hashSlotOwnerCount() > 0
                     && !ReachabilityWalker.hasLiveStrongScalarReferentOtherThan(base, arg);
-            boolean bObjectProbe = args.size() > 1 && args.get(1).getBoolean();
             int adjust = compileHintsHash
                     ? -1
                     : base.localBindingExists || fieldOwnedMethodResult ? 0 : -1;
@@ -594,7 +625,7 @@ public static RuntimeList svRefcount(RuntimeArray args, int ctx) {
             }
             return new RuntimeScalar(rc + extra + adjust).getList();
         }
-        return new RuntimeScalar(1).getList();
+        return new RuntimeScalar(arg.refCount >= 0 ? arg.refCount : 1).getList();
     }
 
     /** Return a reference whose displayed address was observed in this runtime. */
diff --git a/src/main/perl/lib/B.pm b/src/main/perl/lib/B.pm
index 879e87555f..09d93e288a 100644
--- a/src/main/perl/lib/B.pm
+++ b/src/main/perl/lib/B.pm
@@ -88,7 +88,7 @@ package B::SV {
         # B's C implementation inspects the referent without creating a Perl
         # owner. Ask the runtime to compensate for an independently live
         # lexical owner that selective refcounting may not have counted.
-        Internals::SvREFCNT($_[0]->{ref}, 1);
+        Internals::jperl_b_svrefcnt($_[0]->{ref});
     }
 
     sub object_2svref {
diff --git a/src/test/resources/unit/refcount/internals_svrefcnt_write.t b/src/test/resources/unit/refcount/internals_svrefcnt_write.t
new file mode 100644
index 0000000000..57f0e47db3
--- /dev/null
+++ b/src/test/resources/unit/refcount/internals_svrefcnt_write.t
@@ -0,0 +1,23 @@
+use strict;
+use warnings;
+use Test::More;
+
+my $scalar = 42;
+is(Internals::SvREFCNT($scalar, 7), 7,
+    'setting a plain scalar refcount returns the requested count');
+is(Internals::SvREFCNT($scalar), 7,
+    'a plain scalar refcount write is visible to the next read');
+
+my $array = [];
+is(Internals::SvREFCNT($array, 7), 7,
+    'setting an array referent refcount returns the requested count');
+is(Internals::SvREFCNT($array), 7,
+    'an array referent refcount write is visible to the next read');
+
+my $hash = {};
+is(Internals::SvREFCNT($hash, 7), 7,
+    'setting a hash referent refcount returns the requested count');
+is(Internals::SvREFCNT($hash), 7,
+    'a hash referent refcount write is visible to the next read');
+
+done_testing;

From b1711b6cb842be074d9b47670d1f4b15d86548a7 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 20:41:47 +0200
Subject: [PATCH 168/317] docs: note writable SvREFCNT compatibility

Record support for the standard Internals::SvREFCNT setter form and the
separate B::SV query path.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 docs/about/changelog.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index 45edd2348b..1912d456c5 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -43,6 +43,7 @@ priorities and future plans.
 - Prefer exact root-module package declarations over earlier helper packages, and warn for undefined hash keys used by `exists` and `delete` (#1820, #1645).
 - Add a reproducible, warmup-aware Perl versus PerlOnJava performance runner (#1196).
 - Preserve CODE callback captures while Perl container slots still own the callback; restore rooted hash-entry and package-rooted, registered lexical, or closure-captured array-element owners when a legacy deferred decrement undercounts them; register array-element owners after lvalue-proxy stores, scalar and aggregate refaliasing, and scalar-reference creation into new arrays; release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; avoid false global-destruction resurrection warnings when bounded owner proofs scan large package graphs; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
+- Implement Perl's writable `Internals::SvREFCNT` form while keeping B::SV's private query mode separate (#1649).
 - Cover FormState session restoration across requests and HTTP response conversion from callback and streaming PSGI responses; refresh HTTP::Message and LWP compatibility status (#1650, #1651, #1652).
 - Preserve the awaited Future value when its source scalar or aggregate slot changes during suspension, covering PAGI::Server request-body receives (#1818).
 - Preserve escaped byte strings in interpreter closures and `bytes::substr`, honor requested CRLF output in `MIME::QuotedPrint`, and cover URI Basic Auth byte-string userinfo (#1275, #1313, #1341).

From 62c24a07a30e8f7be21162322a3ca4c79a82e85c Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 21:04:06 +0200
Subject: [PATCH 169/317] fix: preserve SvREFCNT usage validation

Keep the existing readonly-sentinel rejection for omitted and literal
arguments while allowing writes through mutable scalar slots.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 src/main/java/org/perlonjava/runtime/perlmodule/Internals.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/main/java/org/perlonjava/runtime/perlmodule/Internals.java b/src/main/java/org/perlonjava/runtime/perlmodule/Internals.java
index 3890c82b15..71373cda77 100644
--- a/src/main/java/org/perlonjava/runtime/perlmodule/Internals.java
+++ b/src/main/java/org/perlonjava/runtime/perlmodule/Internals.java
@@ -484,7 +484,7 @@ public static RuntimeList V(RuntimeArray args, int ctx) {
      */
     public static RuntimeList svRefcount(RuntimeArray args, int ctx) {
         if (args.size() < 1 || args.size() > 2
-                || (args.size() == 2 && args.get(0) instanceof RuntimeScalarReadOnly)) {
+                || args.get(0) instanceof RuntimeScalarReadOnly) {
             WarnDie.die(new RuntimeScalar("Usage: Internals::SvREFCNT(SCALAR[, REFCOUNT])"), new RuntimeScalar(""));
         }
         RuntimeScalar arg = args.get(0);

From eea704e7c56e93fe6fe99e8a889bf8cb5deb107b Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 21:08:48 +0200
Subject: [PATCH 170/317] fix: accept scalarized empty aggregate in SvREFCNT
 setter

Preserve the optional setter call where an empty aggregate supplies a
scalar-context zero, while retaining the missing-argument guard.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 src/main/java/org/perlonjava/runtime/perlmodule/Internals.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/main/java/org/perlonjava/runtime/perlmodule/Internals.java b/src/main/java/org/perlonjava/runtime/perlmodule/Internals.java
index 71373cda77..e33d648b90 100644
--- a/src/main/java/org/perlonjava/runtime/perlmodule/Internals.java
+++ b/src/main/java/org/perlonjava/runtime/perlmodule/Internals.java
@@ -484,7 +484,7 @@ public static RuntimeList V(RuntimeArray args, int ctx) {
      */
     public static RuntimeList svRefcount(RuntimeArray args, int ctx) {
         if (args.size() < 1 || args.size() > 2
-                || args.get(0) instanceof RuntimeScalarReadOnly) {
+                || (args.size() == 1 && args.get(0) instanceof RuntimeScalarReadOnly)) {
             WarnDie.die(new RuntimeScalar("Usage: Internals::SvREFCNT(SCALAR[, REFCOUNT])"), new RuntimeScalar(""));
         }
         RuntimeScalar arg = args.get(0);

From 8ef131606a294549348be71f6da9298a960acd0e Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 21:51:03 +0200
Subject: [PATCH 171/317] ci: prepare POSIX temp path on Windows

Create the root-relative tmp directory on the Windows runner drive before
running Perl tests that use POSIX /tmp paths. Keep the test files and runtime
path semantics unchanged.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .github/workflows/gradle.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
index 1bb8c77ef9..3b16dfe892 100644
--- a/.github/workflows/gradle.yml
+++ b/.github/workflows/gradle.yml
@@ -37,6 +37,16 @@ jobs:
         timeout-minutes: 10
         uses: gradle/actions/setup-gradle@v4
 
+      # A few Perl unit tests use POSIX /tmp paths. On Windows Java resolves
+      # those as a root-relative path on the current drive, so provide that
+      # directory on the ephemeral runner before invoking the test suite.
+      - name: Prepare POSIX /tmp path for Windows tests
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $driveRoot = [System.IO.Path]::GetPathRoot((Get-Location).Path)
+          New-Item -ItemType Directory -Path (Join-Path $driveRoot 'tmp') -Force | Out-Null
+
       # Use Makefile's 'ci' target which handles platform differences
       # Both platforms build and run tests; Windows uses the non-daemon wrapper.
       - name: Build with Make (Windows)

From 5a57009fb75004ddff87947dcf0df0c92641cef7 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 21:54:54 +0200
Subject: [PATCH 172/317] docs: refresh ownership migration progress

Record the writable SvREFCNT acceptance evidence, update the ownership PR
head, and note the Windows CI temp-path accommodation. Phase 2 remains open.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index cba05f0ba4..5992dfb9c4 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,9 +107,9 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The earlier #1794/#1795 candidate was published in [PR #1816](https://github.com/PerlOnJava/pull/1816) at draft head `d0efeda1a1b31790ffc81e73d1aaa5c098eedbdc`; those local and CI results are superseded below. Phase 2 remains a recovery bridge rather than the completed ownership migration: `refCount` still controls dispatch, and scalar/proxy stores, alias cleanup, and complete default owner-slot accounting remain unmigrated.
+The #1794/#1795 candidate and follow-up ownership work are published in [draft PR #1816](https://github.com/PerlOnJava/pull/1816) at head `d01080735cb5ee8ca3879a24ab0f72bfaa903dbb`. Phase 2 remains a recovery bridge rather than the completed ownership migration: `refCount` still controls dispatch, and scalar/proxy stores, alias cleanup, and complete default owner-slot accounting remain unmigrated.
 
-The rebased candidate is published as draft PR #1816, based on `origin/master` (`ede542b29`). Its full `nice -n 19 make` passed in 25m15s with two Gradle workers and a 3 GiB test heap. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, and ownership regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; and `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both. This closes the interpreter parity gaps recorded on the earlier candidate. The build settings bound test concurrency and give the expanded shard 0 enough heap. Continue migrating complete ownership paths through replacement, deletion, aliases, calls, and final release.
+The rebased candidate is based on `origin/master` (`ede542b29`). Its full `nice -n 19 make` passed on `dd368a80a` in 21m03s with two Gradle workers and a 3 GiB test heap. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; PR #1816 now creates the runner's root-relative `tmp` directory before the Windows test gate. The latest hosted checks are pending. Continue migrating complete ownership paths through replacement, deletion, aliases, calls, and final release.
 
 ### Completed
 
@@ -120,6 +120,13 @@ The rebased candidate is published as draft PR #1816, based on `origin/master` (
   passes with the new two-worker and 3 GiB worker settings. Standard Perl
   5.45.4 passes the Perl-level regressions. Published the rebased candidate to
   PR #1816 as a draft; its Linux and Windows CI jobs are pending.
+- [x] On 2026-10-20, added writable `Internals::SvREFCNT` behavior with a
+  separate B::SV query path, plus a six-assertion Perl regression that passes
+  on blead Perl 5.45.4 and both backends and fails on the unfixed parent. The
+  complete local `make` gate passes on `dd368a80a`. Windows CI found two
+  existing unit scripts that require `/tmp`; the PR prepares the ephemeral
+  Windows runner path without changing those tests. Hosted validation is
+  pending on PR head `d01080735`.
 - [x] Re-read the parent issue's implementation contract and reviewed the
   independent lifecycle candidate handoff. Historical candidate test results
   are not treated as current Phase 1 evidence.

From 0e0a33ce254fafcb93feaff11a8f5f91329d8e41 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Tue, 20 Oct 2026 23:11:30 +0200
Subject: [PATCH 173/317] ci: prepare root-relative tmp directory on Windows

Create the current-drive tmp directory from make ci before the build so
existing Perl unit scripts that use POSIX /tmp paths can run on Windows.
Keep the workflow step contract unchanged.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 .github/workflows/gradle.yml | 10 ----------
 Makefile                     | 12 +++++++++++-
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
index 3b16dfe892..1bb8c77ef9 100644
--- a/.github/workflows/gradle.yml
+++ b/.github/workflows/gradle.yml
@@ -37,16 +37,6 @@ jobs:
         timeout-minutes: 10
         uses: gradle/actions/setup-gradle@v4
 
-      # A few Perl unit tests use POSIX /tmp paths. On Windows Java resolves
-      # those as a root-relative path on the current drive, so provide that
-      # directory on the ephemeral runner before invoking the test suite.
-      - name: Prepare POSIX /tmp path for Windows tests
-        if: runner.os == 'Windows'
-        shell: pwsh
-        run: |
-          $driveRoot = [System.IO.Path]::GetPathRoot((Get-Location).Path)
-          New-Item -ItemType Directory -Path (Join-Path $driveRoot 'tmp') -Force | Out-Null
-
       # Use Makefile's 'ci' target which handles platform differences
       # Both platforms build and run tests; Windows uses the non-daemon wrapper.
       - name: Build with Make (Windows)
diff --git a/Makefile b/Makefile
index 345a5c85a8..fbafee5065 100644
--- a/Makefile
+++ b/Makefile
@@ -123,13 +123,23 @@ perl5-sync-check:
 	$(PERL) dev/import-perl5/update_perl5.pl --sync --verify-idempotent $(if $(FILTER),--filter "$(FILTER)",)
 
 # CI build - optimized for CI/CD environments
-ci: check-java-gradle
+ci: prepare-windows-posix-tmp check-java-gradle
 ifeq ($(OS),Windows_NT)
 	gradlew.bat $(GRADLE_LAUNCH_ARGS) build -x test testUnitParallel --parallel --stacktrace
 else
 	./gradlew $(GRADLE_LAUNCH_ARGS) build -x test testUnitParallel --parallel --stacktrace
 endif
 
+# Some Perl unit scripts use POSIX /tmp paths. On Windows, Java resolves
+# these as root-relative paths on the current drive; create that directory on
+# the runner before compiling and executing the suite.
+prepare-windows-posix-tmp:
+ifeq ($(OS),Windows_NT)
+	powershell -NoProfile -NonInteractive -Command "New-Item -ItemType Directory -Force -Path (Join-Path ([System.IO.Path]::GetPathRoot((Get-Location).Path)) 'tmp') | Out-Null"
+else
+	@:
+endif
+
 # Check Java/Gradle compatibility and fix if needed
 # For Java 25+, we need Gradle 9.1.0+ (see https://docs.gradle.org/current/userguide/compatibility.html)
 # Note: On Windows CI, Make uses Git Bash, so we use bash-compatible syntax throughout

From 97a5312fef88695e722860bdb18d2c0da70bed9f Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Wed, 21 Oct 2026 01:11:15 +0200
Subject: [PATCH 174/317] ci: run Windows unit shards concurrently

Use four Gradle workers on Windows so all balanced Perl unit shards can
finish within the hosted 75-minute CI step budget. Keep the two-worker
default on Unix systems.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 Makefile | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/Makefile b/Makefile
index fbafee5065..b46120d5c5 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,14 @@
 .PHONY: all clean test test-unit test-cpan-tester test-interpreter check-thread-test-sources check-thread-core-test-sources check-thread-ecosystem-test-sources check-thread-regex-test-sources test-thread-tooling test-threads test-threads-core test-threads-core-platform test-threads-core-mode test-threads-windows test-threads-regex test-threads-release test-threads-ecosystem test-bundled-modules test-cpan-distroprefs test-cpan-release-acceptance test-exiftool test-all test-gradle test-gradle-unit test-gradle-all test-gradle-parallel test-maven-parallel build run wrapper check-java-gradle dev ci sbom sbom-java sbom-perl sbom-clean check-links perl5-update perl5-sync perl5-sync-check
 
 PERL ?= perl
+ifeq ($(OS),Windows_NT)
+# The Windows unit shards each take longer than the 75-minute CI step budget
+# when only two Gradle workers are available. Run the five balanced shards
+# concurrently on the hosted runner while keeping the existing per-worker heap cap.
+GRADLE_ARGS ?= --max-workers=4
+else
 GRADLE_ARGS ?= --max-workers=2
+endif
 # A persistent daemon keeps the priority from the invocation that first
 # started it. Use a single-use Gradle process so workers inherit the
 # launcher's niceness (for example, `nice -n 19 make`).

From 5c2a87646fbcd41fa6e014da10583ad784ba2336 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Wed, 21 Oct 2026 02:20:03 +0200
Subject: [PATCH 175/317] docs: record green ownership validation

Record the green Windows and Ubuntu CI evidence, the resolved CI worker
budget, and the latest standard-Perl aggregate ownership regression results.
Keep the remaining Phase 2 migration work explicit.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 5992dfb9c4..9d3e15d2ff 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,9 +107,9 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 candidate and follow-up ownership work are published in [draft PR #1816](https://github.com/PerlOnJava/pull/1816) at head `d01080735cb5ee8ca3879a24ab0f72bfaa903dbb`. Phase 2 remains a recovery bridge rather than the completed ownership migration: `refCount` still controls dispatch, and scalar/proxy stores, alias cleanup, and complete default owner-slot accounting remain unmigrated.
+The #1794/#1795 candidate and follow-up ownership work are published in [draft PR #1816](https://github.com/PerlOnJava/pull/1816) at head `8a6c5a365ba7bed07bf627414ca3a9685b00a80d`. Ubuntu and Windows CI passed on this head. Phase 2 remains a recovery bridge rather than the completed ownership migration: `refCount` still controls dispatch, and scalar/proxy stores, alias cleanup, and complete default owner-slot accounting remain unmigrated.
 
-The rebased candidate is based on `origin/master` (`ede542b29`). Its full `nice -n 19 make` passed on `dd368a80a` in 21m03s with two Gradle workers and a 3 GiB test heap. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; PR #1816 now creates the runner's root-relative `tmp` directory before the Windows test gate. The latest hosted checks are pending. Continue migrating complete ownership paths through replacement, deletion, aliases, calls, and final release.
+The rebased candidate is based on `origin/master` (`ede542b29`). Its full local `nice -n 19 make` passed in 22m55s with two Gradle workers and a 3 GiB test heap. Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, and SBOM generation passed. Windows `make ci` passed in about 52 minutes with four Gradle workers, followed by the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. Continue migrating complete ownership paths through replacement, deletion, aliases, calls, and final release.
 
 ### Completed
 
@@ -125,8 +125,20 @@ The rebased candidate is based on `origin/master` (`ede542b29`). Its full `nice
   on blead Perl 5.45.4 and both backends and fails on the unfixed parent. The
   complete local `make` gate passes on `dd368a80a`. Windows CI found two
   existing unit scripts that require `/tmp`; the PR prepares the ephemeral
-  Windows runner path without changing those tests. Hosted validation is
-  pending on PR head `d01080735`.
+  Windows runner path without changing those tests. This initial hosted run
+  exposed the workflow's step-order contract and a Windows time-budget issue;
+  both are resolved in the 2026-10-21 entry below.
+- [x] On 2026-10-21, kept the CI workflow's fixed step contract, moved the
+  Windows root-relative temp-directory setup into `make ci`, and configured
+  four Gradle workers only on Windows after the two-worker gate exceeded its
+  75-minute budget. The full local `make` passed in 22m55s. Ubuntu and Windows
+  make gates, the Ubuntu thread compatibility gate, the Windows focused thread
+  gate, and Ubuntu SBOM generation all passed on PR head `8a6c5a365`.
+- [x] Revalidated `ordinary_aggregate_element_owner_refcount.t`: all 11
+  standard-Perl count/destruction assertions pass on blead Perl 5.45.4, JVM,
+  and interpreter. This covers scalar ownership through array/hash insertion,
+  push, shift, delete, replacement, aggregate clear, and final release; Phase 2
+  still requires replacing the legacy counters with default owner-slot paths.
 - [x] Re-read the parent issue's implementation contract and reviewed the
   independent lifecycle candidate handoff. Historical candidate test results
   are not treated as current Phase 1 evidence.

From c7f6a2249d5045e5e1762e8eb68c8bdee3403b1a Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Wed, 21 Oct 2026 04:08:53 +0200
Subject: [PATCH 176/317] test: cover hash element scalar proxy ownership

Add Perl-oracle-checked coverage for assigning a blessed referent through a
scalar reference to a hash entry, retaining it through the entry, and running
DESTROY exactly once when the entry is cleared.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <openai-codex@users.noreply.github.com>
---
 .../hash_element_scalar_reference_lifetime.t  | 28 +++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 src/test/resources/unit/refcount/hash_element_scalar_reference_lifetime.t

diff --git a/src/test/resources/unit/refcount/hash_element_scalar_reference_lifetime.t b/src/test/resources/unit/refcount/hash_element_scalar_reference_lifetime.t
new file mode 100644
index 0000000000..2a7d14f312
--- /dev/null
+++ b/src/test/resources/unit/refcount/hash_element_scalar_reference_lifetime.t
@@ -0,0 +1,28 @@
+use strict;
+use warnings;
+use Scalar::Util qw(weaken);
+use Test::More tests => 3;
+
+our $destroyed = 0;
+
+my %elements;
+my $slot = \$elements{entry};
+my $object = bless {}, 'HashElementScalarReferenceLifetime::Tracked';
+my $weak = $object;
+weaken($weak);
+
+$$slot = $object;
+undef $object;
+undef $slot;
+
+ok(defined $weak,
+    'a hash element assigned through a scalar reference remains owned by its hash');
+
+undef $elements{entry};
+ok(!defined $weak,
+    'clearing the hash element releases its final referent owner');
+is($destroyed, 1,
+    'clearing the hash element runs the referent destructor exactly once');
+
+package HashElementScalarReferenceLifetime::Tracked;
+sub DESTROY { ++$main::destroyed }

From b60cb670177330b6e931a5910b931c255e2f02fc Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Wed, 21 Oct 2026 04:14:11 +0200
Subject: [PATCH 177/317] test: assert hash proxy refcount transitions

Check that assigning through a hash-element scalar reference matches Perl's
1-to-2-to-1 strong-owner sequence and that deleting the final owner clears
weak observers and runs DESTROY once on both backends.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <openai-codex@users.noreply.github.com>
---
 .../hash_element_scalar_reference_refcount.t  | 33 +++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 src/test/resources/unit/refcount/hash_element_scalar_reference_refcount.t

diff --git a/src/test/resources/unit/refcount/hash_element_scalar_reference_refcount.t b/src/test/resources/unit/refcount/hash_element_scalar_reference_refcount.t
new file mode 100644
index 0000000000..e09a11f609
--- /dev/null
+++ b/src/test/resources/unit/refcount/hash_element_scalar_reference_refcount.t
@@ -0,0 +1,33 @@
+use strict;
+use warnings;
+use B qw(svref_2object);
+use Scalar::Util qw(weaken);
+use Test::More tests => 6;
+
+our $destroyed = 0;
+
+sub refcount { svref_2object($_[0])->REFCNT }
+
+my %elements;
+my $slot = \$elements{entry};
+my $object = bless {}, 'HashElementScalarReferenceRefcount::Tracked';
+my $weak = $object;
+weaken($weak);
+
+is(refcount($object), 1, 'the lexical begins as the only strong owner');
+
+$$slot = $object;
+is(refcount($object), 2,
+    'storing through a scalar reference adds the hash element owner');
+
+undef $object;
+is(refcount($weak), 1,
+    'the hash element is the sole strong owner after lexical release');
+ok(defined $weak, 'the weak observer remains while the hash entry owns the object');
+
+undef $elements{entry};
+ok(!defined $weak, 'deleting the hash entry clears the weak observer');
+is($destroyed, 1, 'deleting the hash entry runs DESTROY exactly once');
+
+package HashElementScalarReferenceRefcount::Tracked;
+sub DESTROY { ++$main::destroyed }

From 171580e171e1517ce1b129b5a9ddc2c9c68fb617 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Wed, 21 Oct 2026 04:41:23 +0200
Subject: [PATCH 178/317] test: assert array proxy refcount transitions

Check that assigning through an array-element scalar reference matches Perl's
1-to-2-to-1 strong-owner sequence and that clearing the final owner removes
weak observers and runs DESTROY once on both backends.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <openai-codex@users.noreply.github.com>
---
 .../array_element_scalar_reference_refcount.t | 33 +++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 src/test/resources/unit/refcount/array_element_scalar_reference_refcount.t

diff --git a/src/test/resources/unit/refcount/array_element_scalar_reference_refcount.t b/src/test/resources/unit/refcount/array_element_scalar_reference_refcount.t
new file mode 100644
index 0000000000..3c7ce05bfb
--- /dev/null
+++ b/src/test/resources/unit/refcount/array_element_scalar_reference_refcount.t
@@ -0,0 +1,33 @@
+use strict;
+use warnings;
+use B qw(svref_2object);
+use Scalar::Util qw(weaken);
+use Test::More tests => 6;
+
+our $destroyed = 0;
+
+sub refcount { svref_2object($_[0])->REFCNT }
+
+my @elements;
+my $slot = \$elements[0];
+my $object = bless {}, 'ArrayElementScalarReferenceRefcount::Tracked';
+my $weak = $object;
+weaken($weak);
+
+is(refcount($object), 1, 'the lexical begins as the only strong owner');
+
+$$slot = $object;
+is(refcount($object), 2,
+    'storing through a scalar reference adds the array element owner');
+
+undef $object;
+is(refcount($weak), 1,
+    'the array element is the sole strong owner after lexical release');
+ok(defined $weak, 'the weak observer remains while the array element owns the object');
+
+undef $elements[0];
+ok(!defined $weak, 'clearing the array element clears the weak observer');
+is($destroyed, 1, 'clearing the array element runs DESTROY exactly once');
+
+package ArrayElementScalarReferenceRefcount::Tracked;
+sub DESTROY { ++$main::destroyed }

From 6709cfc60898c24817f611601cfbd27cab5556cd Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Wed, 21 Oct 2026 05:10:30 +0200
Subject: [PATCH 179/317] test: cover aggregate scalar alias ownership

Add blead-oracle-checked array and hash cases proving scalar aliases do not
create duplicate referent owners and that releasing the aliased element clears
weak observers and runs DESTROY once on both backends.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <openai-codex@users.noreply.github.com>
---
 .../aggregate_scalar_alias_refcount.t         | 46 +++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 src/test/resources/unit/refcount/aggregate_scalar_alias_refcount.t

diff --git a/src/test/resources/unit/refcount/aggregate_scalar_alias_refcount.t b/src/test/resources/unit/refcount/aggregate_scalar_alias_refcount.t
new file mode 100644
index 0000000000..b84ed3008c
--- /dev/null
+++ b/src/test/resources/unit/refcount/aggregate_scalar_alias_refcount.t
@@ -0,0 +1,46 @@
+use strict;
+use warnings;
+use B qw(svref_2object);
+use Scalar::Util qw(weaken);
+use Test::More tests => 8;
+use feature 'refaliasing';
+no warnings 'experimental::refaliasing';
+
+our $destroyed = 0;
+
+sub refcount { svref_2object($_[0])->REFCNT }
+
+my @array;
+my $array_object = bless {}, 'AggregateScalarAliasRefcount::Tracked';
+my $array_weak = $array_object;
+weaken($array_weak);
+push @array, $array_object;
+\my $array_alias = \$array[0];
+
+is(refcount($array_object), 2,
+    'an array element stores one owner regardless of scalar aliases');
+undef $array_object;
+is(refcount($array_weak), 1,
+    'the array element is the sole owner after lexical release');
+$array_alias = undef;
+ok(!defined $array_weak, 'clearing an array-element alias releases the referent');
+is($destroyed, 1, 'the array-element alias triggers DESTROY exactly once');
+
+my %hash;
+my $hash_object = bless {}, 'AggregateScalarAliasRefcount::Tracked';
+my $hash_weak = $hash_object;
+weaken($hash_weak);
+$hash{entry} = $hash_object;
+\my $hash_alias = \$hash{entry};
+
+is(refcount($hash_object), 2,
+    'a hash entry stores one owner regardless of scalar aliases');
+undef $hash_object;
+is(refcount($hash_weak), 1,
+    'the hash entry is the sole owner after lexical release');
+$hash_alias = undef;
+ok(!defined $hash_weak, 'clearing a hash-element alias releases the referent');
+is($destroyed, 2, 'the hash-element alias triggers DESTROY exactly once');
+
+package AggregateScalarAliasRefcount::Tracked;
+sub DESTROY { ++$main::destroyed }

From e91154819ffc364dae4eb675560691fc33182209 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Wed, 21 Oct 2026 06:03:39 +0200
Subject: [PATCH 180/317] perf: prove aggregate owner chains without root scans

Follow typed hash and array owner slots to an explicit Perl root before
falling back to the whole-root reachability walk. Add a regression proving
that a nested hash chain restores the displaced owner count without building
a graph snapshot.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtime/runtimetypes/MortalList.java      | 62 ++++++++++++++++---
 ...alListAggregateOwnerSlotRootChainTest.java | 60 ++++++++++++++++++
 2 files changed, 113 insertions(+), 9 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateOwnerSlotRootChainTest.java

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 5d0b444ec9..cc38b48b27 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1979,10 +1979,7 @@ private static boolean restoreReachableHashEntryOwnerCount(RuntimeBase referent)
         for (PerlOwnerSlot slot : referent.ownerSlotSnapshot()) {
             if (slot.kind() != PerlOwnerSlot.Kind.HASH_ENTRY) continue;
             RuntimeBase owner = slot.ownerContainer();
-            boolean rootedOwner = owner instanceof RuntimeHash
-                    && (owner.semanticCaptureOwnerCount() > 0
-                    || (!owner.scopeExited && MyVarCleanupStack.isRegistered(owner))
-                    || ReachabilityWalker.isReachableFromRoots(owner, true, referent));
+            boolean rootedOwner = isRootedAggregateOwner(owner, referent);
             if (!rootedOwner) continue;
             RuntimeScalar cell = slot.ownerCell();
             if (cell == null) {
@@ -1999,11 +1996,7 @@ private static boolean restoreReachableHashEntryOwnerCount(RuntimeBase referent)
         for (PerlOwnerSlot slot : referent.ownerSlotSnapshot()) {
             if (slot.kind() != PerlOwnerSlot.Kind.ARRAY_ELEMENT) continue;
             RuntimeBase owner = slot.ownerContainer();
-            if (!(owner instanceof RuntimeArray array)
-                    || (array.semanticCaptureOwnerCount() == 0
-                    && !array.isPackageGlobalRoot
-                    && (array.scopeExited || !MyVarCleanupStack.isRegistered(array))
-                    && !ReachabilityWalker.isReachableFromRoots(array, true, referent))) continue;
+            if (!isRootedAggregateOwner(owner, referent)) continue;
             RuntimeScalar cell = slot.ownerCell();
             if (cell == null) {
                 slotsWithoutCell++;
@@ -2030,6 +2023,57 @@ private static boolean restoreReachableHashEntryOwnerCount(RuntimeBase referent)
         return true;
     }
 
+    /**
+     * Prove aggregate ownership by following registered owner slots toward a
+     * Perl root. Nested hash/array stores already record each direct edge, so
+     * walking that owner chain avoids a whole-root scan for the common case.
+     * Fall back to the graph walker for scalar owners and legacy edges that do
+     * not yet have an explicit container slot.
+     */
+    private static boolean isRootedAggregateOwner(RuntimeBase owner,
+                                                   RuntimeBase excludedReferent) {
+        if (!(owner instanceof RuntimeHash) && !(owner instanceof RuntimeArray)) return false;
+        Set<RuntimeBase> visited = Collections.newSetFromMap(new IdentityHashMap<>());
+        ArrayDeque<RuntimeBase> pending = new ArrayDeque<>();
+        pending.add(owner);
+        while (!pending.isEmpty()) {
+            RuntimeBase current = pending.removeFirst();
+            if (current == null || current == excludedReferent || !visited.add(current)) continue;
+            if (isExplicitAggregateRoot(current)) return true;
+            for (PerlOwnerSlot parentSlot : current.ownerSlotSnapshot()) {
+                if (parentSlot.kind() != PerlOwnerSlot.Kind.HASH_ENTRY
+                        && parentSlot.kind() != PerlOwnerSlot.Kind.ARRAY_ELEMENT) continue;
+                if (parentSlot.referent() != current) continue;
+                RuntimeBase parent = parentSlot.ownerContainer();
+                RuntimeScalar cell = parentSlot.ownerCell();
+                if (!isLiveAggregateOwnerEdge(parent, cell, current)) continue;
+                pending.addLast(parent);
+            }
+        }
+        return ReachabilityWalker.isReachableFromRoots(owner, true, excludedReferent);
+    }
+
+    private static boolean isExplicitAggregateRoot(RuntimeBase aggregate) {
+        if (aggregate.semanticCaptureOwnerCount() > 0) return true;
+        if (aggregate instanceof RuntimeHash hash && hash.isPackageRootedHash()) return true;
+        if (aggregate instanceof RuntimeArray && aggregate.isPackageGlobalRoot) return true;
+        return !aggregate.scopeExited && MyVarCleanupStack.isRegistered(aggregate);
+    }
+
+    private static boolean isLiveAggregateOwnerEdge(RuntimeBase parent,
+                                                    RuntimeScalar cell,
+                                                    RuntimeBase referent) {
+        if (parent == null || cell == null || cell.value != referent
+                || WeakRefRegistry.isweak(cell)) return false;
+        if (parent instanceof RuntimeHash hash) {
+            return hash.elements.containsValue(cell);
+        }
+        if (parent instanceof RuntimeArray array) {
+            return array.elements.contains(cell) && array.ownsElement(cell);
+        }
+        return false;
+    }
+
     private static boolean blessedClassHasDestroy(RuntimeBase base) {
         String className = NameNormalizer.getBlessStr(base.blessId);
         return className != null && DestroyDispatch.classHasDestroy(base.blessId, className);
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateOwnerSlotRootChainTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateOwnerSlotRootChainTest.java
new file mode 100644
index 0000000000..04b9139ad0
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateOwnerSlotRootChainTest.java
@@ -0,0 +1,60 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+@Tag("unit")
+class MortalListAggregateOwnerSlotRootChainTest {
+    @Test
+    void nestedHashOwnerSlotsProveRootWithoutWholeRootWalk() {
+        PerlRuntime runtime = new PerlRuntime();
+        String rootName = "MortalListAggregateOwnerSlotRootChainTest::root";
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            boolean previousActive = MortalList.isActive();
+            RuntimeHash target = new RuntimeHash();
+            RuntimeHash nested = new RuntimeHash();
+            RuntimeHash root = new RuntimeHash();
+            root.isPackageGlobalRoot = true;
+            root.elements.put("nested", nested.createReference());
+            RuntimeScalar nestedValue = referenceTo(target);
+            nestedValue.refCountOwned = true;
+            nested.elements.put("target", nestedValue);
+            GlobalVariable.globalHashes.put(rootName, root);
+
+            RuntimeScalar unrelatedLegacyOwner = referenceTo(target);
+            unrelatedLegacyOwner.refCountOwned = true;
+            target.refCount = 1;
+
+            try {
+                MortalList.setActive(true);
+                try (MortalList.ReachabilityQueryMeasurement measurement =
+                             MortalList.measureReachabilityQueries()) {
+                    MortalList.deferDecrementIfTracked(unrelatedLegacyOwner);
+                    MortalList.flush();
+
+                    assertEquals(1, target.refCount,
+                            "the live nested hash slot restores the displaced legacy count");
+                    assertEquals(0, measurement.stats().rootQueries,
+                            "typed owner slots prove the path to the package root");
+                    assertEquals(0, measurement.stats().snapshotsBuilt,
+                            "the nested owner chain avoids building a graph snapshot");
+                }
+            } finally {
+                MortalList.setActive(previousActive);
+                root.elements.clear();
+                nested.elements.clear();
+                GlobalVariable.globalHashes.remove(rootName);
+                MortalList.invalidateAllRootSnapshots();
+            }
+        }
+    }
+
+    private static RuntimeScalar referenceTo(RuntimeBase referent) {
+        RuntimeScalar scalar = new RuntimeScalar();
+        scalar.type = RuntimeScalarType.HASHREFERENCE;
+        scalar.value = referent;
+        return scalar;
+    }
+}

From 0a9d7ef7e3b1be8f513c498db64009eee81dd31c Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Wed, 21 Oct 2026 06:35:02 +0200
Subject: [PATCH 181/317] perf: reuse owner-slot proofs for destroy rescue

Use typed aggregate owner chains when DESTROY checks whether a new owner
container escaped to Perl roots. Keep the graph walker as a fallback for
unmigrated ownership edges and add a regression for nested hash resurrection.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtime/runtimetypes/DestroyDispatch.java |  3 +-
 .../runtime/runtimetypes/MortalList.java      |  8 +++
 ...DestroyDispatchOwnerSlotRootChainTest.java | 50 +++++++++++++++++++
 3 files changed, 59 insertions(+), 2 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchOwnerSlotRootChainTest.java

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
index 124a9b4537..a2810e0453 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
@@ -726,8 +726,7 @@ static boolean hasEscapedPerlOwner(RuntimeBase referent,
                 if (ownerSlotsAtStart.contains(ownerSlot)) continue;
                 RuntimeBase ownerContainer = ownerSlot.ownerContainer();
                 if (ownerContainer != null
-                        && ReachabilityWalker.isReachableFromRoots(
-                                ownerContainer, true, referent)) {
+                        && MortalList.isRootedOwnerContainer(ownerContainer, referent)) {
                     return true;
                 }
                 // Closure pads have no aggregate container. When capture
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index cc38b48b27..26b679a488 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -2053,6 +2053,14 @@ private static boolean isRootedAggregateOwner(RuntimeBase owner,
         return ReachabilityWalker.isReachableFromRoots(owner, true, excludedReferent);
     }
 
+    static boolean isRootedOwnerContainer(RuntimeBase owner,
+                                          RuntimeBase excludedReferent) {
+        if (owner instanceof RuntimeHash || owner instanceof RuntimeArray) {
+            return isRootedAggregateOwner(owner, excludedReferent);
+        }
+        return ReachabilityWalker.isReachableFromRoots(owner, true, excludedReferent);
+    }
+
     private static boolean isExplicitAggregateRoot(RuntimeBase aggregate) {
         if (aggregate.semanticCaptureOwnerCount() > 0) return true;
         if (aggregate instanceof RuntimeHash hash && hash.isPackageRootedHash()) return true;
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchOwnerSlotRootChainTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchOwnerSlotRootChainTest.java
new file mode 100644
index 0000000000..a3e4484330
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchOwnerSlotRootChainTest.java
@@ -0,0 +1,50 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import java.util.Collections;
+import java.util.IdentityHashMap;
+import java.util.Set;
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("unit")
+class DestroyDispatchOwnerSlotRootChainTest {
+    @Test
+    void nestedHashOwnerSlotProvesResurrectionWithoutWholeRootWalk() {
+        PerlRuntime runtime = new PerlRuntime();
+        String rootName = "DestroyDispatchOwnerSlotRootChainTest::root";
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeHash referent = new RuntimeHash();
+            RuntimeHash nested = new RuntimeHash();
+            RuntimeHash root = new RuntimeHash();
+            nested.put("target", referent.createReference());
+            root.put("nested", nested.createReference());
+            GlobalVariable.aliasGlobalHash(rootName, root);
+            referent.activateOwnerTracking();
+
+            Set<RuntimeScalar> noScalarOwnersAtStart =
+                    Collections.newSetFromMap(new IdentityHashMap<>());
+            Set<PerlOwnerSlot> noOwnerSlotsAtStart =
+                    Collections.newSetFromMap(new IdentityHashMap<>());
+            try {
+                try (MortalList.ReachabilityQueryMeasurement measurement =
+                             MortalList.measureReachabilityQueries()) {
+                    assertTrue(DestroyDispatch.hasEscapedPerlOwner(
+                                    referent, true, noScalarOwnersAtStart, noOwnerSlotsAtStart),
+                            "a newly added nested hash slot rooted in a package global is resurrection");
+                    assertEquals(0, measurement.stats().rootQueries,
+                            "typed owner slots prove the resurrection path");
+                    assertEquals(0, measurement.stats().snapshotsBuilt,
+                            "the proof does not build a whole-root graph snapshot");
+                }
+            } finally {
+                root.elements.clear();
+                nested.elements.clear();
+                GlobalVariable.globalHashes.remove(rootName);
+                MortalList.invalidateAllRootSnapshots();
+            }
+        }
+    }
+}

From 225fd0e4aa9a63aac19ded153917b4e86fc5c286 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Wed, 21 Oct 2026 06:40:02 +0200
Subject: [PATCH 182/317] docs: update ownership migration status

Record the current PR head and the two aggregate owner-slot root-proof
milestones while keeping scalar/proxy ownership migration marked incomplete.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 9d3e15d2ff..1344a5c04d 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress in [PR #1816](https://github.com/PerlOnJava/pull/1816), currently open as a draft based on master `ede542b2901ebb54e7aae293fae74cbbd6af22d7`. The local full `nice -n 19 make` passes with two Gradle workers and a 3 GiB test heap; the PR's Linux and Windows jobs are running. The candidate records hash-entry and array-element owner slots for deferred-release recovery, registers slots after array proxy stores, scalar refaliasing, scalar-reference creation, and aggregate refaliasing, and proves ownership for anonymous arrays reachable through package-rooted hashes while excluding the dying referent. HTML-Tree 5.07 passes. Owner slots still bridge to `RuntimeBase.refCount` for dispatch; this is not the complete Phase 2 ownership migration.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress in [draft PR #1816](https://github.com/PerlOnJava/pull/1816), currently at `ea7b77164` and based on current master `ede542b2901ebb54e7aae293fae74cbbd6af22d7`. The full local `nice -n 19 make` gate passes on the current candidate. Typed hash/array owner slots now prove nested aggregate root chains both during deferred-release recovery and `DESTROY` resurrection checks; focused Java regressions verify zero whole-root queries and snapshots for those paths. The latest hosted workflow is queued behind earlier long-running CI runs. Owner slots still bridge to `RuntimeBase.refCount` for dispatch; scalar/proxy migration and default owner-slot accounting remain incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 candidate and follow-up ownership work are published in [draft PR #1816](https://github.com/PerlOnJava/pull/1816) at head `8a6c5a365ba7bed07bf627414ca3a9685b00a80d`. Ubuntu and Windows CI passed on this head. Phase 2 remains a recovery bridge rather than the completed ownership migration: `refCount` still controls dispatch, and scalar/proxy stores, alias cleanup, and complete default owner-slot accounting remain unmigrated.
+The #1794/#1795 candidate and follow-up ownership work are published in [draft PR #1816](https://github.com/PerlOnJava/pull/1816) at head `ea7b77164cdf35e3c1910c81277579dfb415ade3`. Earlier Ubuntu and Windows CI passed on prior heads; the current head's hosted run is queued. Phase 2 remains a recovery bridge rather than the completed ownership migration: `refCount` still controls dispatch, and scalar/proxy stores, alias cleanup, and complete default owner-slot accounting remain unmigrated.
 
 The rebased candidate is based on `origin/master` (`ede542b29`). Its full local `nice -n 19 make` passed in 22m55s with two Gradle workers and a 3 GiB test heap. Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, and SBOM generation passed. Windows `make ci` passed in about 52 minutes with four Gradle workers, followed by the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. Continue migrating complete ownership paths through replacement, deletion, aliases, calls, and final release.
 
@@ -134,6 +134,11 @@ The rebased candidate is based on `origin/master` (`ede542b29`). Its full local
   75-minute budget. The full local `make` passed in 22m55s. Ubuntu and Windows
   make gates, the Ubuntu thread compatibility gate, the Windows focused thread
   gate, and Ubuntu SBOM generation all passed on PR head `8a6c5a365`.
+- [x] On 2026-10-21, followed typed hash/array owner slots through nested
+  aggregate roots during deferred-release recovery and `DESTROY` resurrection
+  checks. Two Java regressions assert the ownership result with zero root
+  queries and snapshots. The full local `nice -n 19 make` passes on
+  `ea7b77164` in 21m11s; hosted CI for this head is queued.
 - [x] Revalidated `ordinary_aggregate_element_owner_refcount.t`: all 11
   standard-Perl count/destruction assertions pass on blead Perl 5.45.4, JVM,
   and interpreter. This covers scalar ownership through array/hash insertion,

From e269ba6f842fa6f9bdde9467c0ccb1f49fe61717 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Wed, 21 Oct 2026 07:31:44 +0200
Subject: [PATCH 183/317] fix: retain scalar-reference contents in aggregates

Acquire a contents owner when an aggregate stores a copied scalar-reference
cell, and release that owner during recursive container cleanup. Add an oracle
regression for returned scalar references retained by array and hash owners.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtime/runtimetypes/MortalList.java      |  8 ++-
 .../runtime/runtimetypes/RuntimeScalar.java   | 15 +++++-
 .../scalar_reference_return_owner_lifetime.t  | 49 +++++++++++++++++++
 3 files changed, 69 insertions(+), 3 deletions(-)
 create mode 100644 src/test/resources/unit/refcount/scalar_reference_return_owner_lifetime.t

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 26b679a488..3524a59aea 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -999,7 +999,9 @@ private static boolean reachableTailCallArgReferent(RuntimeBase base) {
      * StackOverflowError on circular data structures like ExifTool's).
      */
     private static void deferDecrementRecursive(RuntimeScalar scalar) {
-        if (scalar == null || (scalar.type & RuntimeScalarType.REFERENCE_BIT) == 0) return;
+        if (scalar == null) return;
+        scalar.deferOwnedScalarReferenceContents();
+        if ((scalar.type & RuntimeScalarType.REFERENCE_BIT) == 0) return;
         if (!(scalar.value instanceof RuntimeBase topBase)) return;
 
         // Fast path for leaf references (the overwhelmingly common case):
@@ -1043,7 +1045,9 @@ private static void deferDecrementRecursive(RuntimeScalar scalar) {
 
         while (!work.isEmpty()) {
             RuntimeScalar s = work.poll();
-            if (s == null || (s.type & RuntimeScalarType.REFERENCE_BIT) == 0) continue;
+            if (s == null) continue;
+            s.deferOwnedScalarReferenceContents();
+            if ((s.type & RuntimeScalarType.REFERENCE_BIT) == 0) continue;
             if (!(s.value instanceof RuntimeBase base)) continue;
             if (!visited.add(base)) continue;  // already visited — cycle
 
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 5a1baf2c3f..048920f332 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -2263,7 +2263,20 @@ public void vivifyLogicalAssignmentLvalue() {
      * constructor, and their refCount was already incremented at creation time.
      */
     public static void incrementRefCountForContainerStore(RuntimeScalar scalar) {
-        if (scalar == null || scalar.refCountOwned
+        if (scalar == null) {
+            return;
+        }
+        // A scalar-reference cell can own a counted referent through the
+        // RuntimeScalar cell it aliases. Container materialization copies the
+        // outer RV wrapper, so each copied aggregate cell must retain those
+        // contents independently instead of relying on the source wrapper's
+        // ownsScalarReferenceContents flag.
+        if (scalar.type == REFERENCE
+                && scalar.value instanceof RuntimeScalar
+                && !scalar.ownsScalarReferenceContents) {
+            scalar.retainScalarReferenceContents(scalar);
+        }
+        if (scalar.refCountOwned
                 || (scalar.type & REFERENCE_BIT) == 0
                 || !(scalar.value instanceof RuntimeBase base)) {
             return;
diff --git a/src/test/resources/unit/refcount/scalar_reference_return_owner_lifetime.t b/src/test/resources/unit/refcount/scalar_reference_return_owner_lifetime.t
new file mode 100644
index 0000000000..78161fa753
--- /dev/null
+++ b/src/test/resources/unit/refcount/scalar_reference_return_owner_lifetime.t
@@ -0,0 +1,49 @@
+use strict;
+use warnings;
+use Scalar::Util qw(weaken);
+use Test::More tests => 7;
+
+{
+    package Local::ScalarReferenceReturnOwner;
+    our $destroyed = 0;
+
+    sub new {
+        my ($class) = @_;
+        return bless {}, $class;
+    }
+
+    sub DESTROY {
+        ++$destroyed;
+    }
+}
+
+my $weak;
+sub return_scalar_reference {
+    my $object = Local::ScalarReferenceReturnOwner->new;
+    $weak = $object;
+    weaken($weak);
+    return \$object;
+}
+
+my $value_ref = return_scalar_reference();
+is($Local::ScalarReferenceReturnOwner::destroyed, 0,
+    'returning a scalar reference keeps its lexical contents alive');
+ok(defined $weak, 'the returned scalar reference keeps the weak observer live');
+
+my @array_owners = ($value_ref);
+my %hash_owners = (value => $value_ref);
+undef $value_ref;
+is($Local::ScalarReferenceReturnOwner::destroyed, 0,
+    'array and hash owners keep returned scalar-reference contents alive');
+
+undef @array_owners;
+is($Local::ScalarReferenceReturnOwner::destroyed, 0,
+    'releasing the array owner preserves the hash owner');
+undef %hash_owners;
+is($Local::ScalarReferenceReturnOwner::destroyed, 1,
+    'releasing the final hash owner destroys the contents exactly once');
+ok(!defined $weak, 'final scalar-reference release clears the weak observer');
+is($Local::ScalarReferenceReturnOwner::destroyed, 1,
+    'repeated cleanup does not dispatch DESTROY again');
+
+done_testing;

From 93461e5516e0084ee4377f13a86d248aa56a6a29 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Wed, 21 Oct 2026 07:58:38 +0200
Subject: [PATCH 184/317] test: cover localized scalar-reference ownership

Verify Perl refcount and destructor behavior when a returned scalar reference
is held by a localized package scalar and released during dynamic restoration.

Generated with [Codex](https://openai.com/codex/)

Co-Authored-By: Codex <codex@openai.com>
---
 ...calar_reference_localized_owner_lifetime.t | 47 +++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 src/test/resources/unit/refcount/scalar_reference_localized_owner_lifetime.t

diff --git a/src/test/resources/unit/refcount/scalar_reference_localized_owner_lifetime.t b/src/test/resources/unit/refcount/scalar_reference_localized_owner_lifetime.t
new file mode 100644
index 0000000000..0bc1e01d50
--- /dev/null
+++ b/src/test/resources/unit/refcount/scalar_reference_localized_owner_lifetime.t
@@ -0,0 +1,47 @@
+use strict;
+use warnings;
+use B qw(svref_2object);
+use Scalar::Util qw(weaken);
+use Test::More tests => 6;
+
+{
+    package Local::LocalizedScalarReferenceOwner;
+    our $destroyed = 0;
+
+    sub new {
+        my ($class) = @_;
+        return bless {}, $class;
+    }
+
+    sub DESTROY {
+        ++$destroyed;
+    }
+}
+
+our $localized_reference;
+my $weak;
+sub ref_count { svref_2object($_[0])->REFCNT }
+
+sub return_local_scalar_reference {
+    my $object = Local::LocalizedScalarReferenceOwner->new;
+    $weak = $object;
+    weaken($weak);
+    return \$object;
+}
+
+{
+    local $localized_reference = return_local_scalar_reference();
+    is($Local::LocalizedScalarReferenceOwner::destroyed, 0,
+        'localized scalar reference keeps returned lexical contents alive');
+    ok(defined $weak, 'localized scalar reference keeps the weak observer live');
+    is(ref_count($$localized_reference), 1,
+        'localization preserves Perl refcount for scalar-reference contents');
+}
+
+is($Local::LocalizedScalarReferenceOwner::destroyed, 1,
+    'restoring the package scalar releases the final owner exactly once');
+ok(!defined $weak, 'localization unwind clears the weak observer');
+is($Local::LocalizedScalarReferenceOwner::destroyed, 1,
+    'later cleanup does not repeat destruction');
+
+done_testing;

From 5f36a898749cf86e92c08bf94ba44ad5fa0bcabc Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Wed, 21 Oct 2026 11:22:17 +0200
Subject: [PATCH 185/317] fix: retarget scalar-reference ownership on cell
 assignment

Keep scalar-reference contents owner slots attached to the cell's new
referent even when another direct owner is recorded for the assigned value.
Add Perl and Java regression coverage for retargeting and final destruction.

Generated with OpenAI Codex (https://openai.com/codex)
Co-Authored-By: OpenAI Codex <openai-codex@users.noreply.github.com>
---
 .../backend/bytecode/BytecodeInterpreter.java |   4 +-
 .../runtimetypes/GlobalRuntimeScalar.java     |  28 +++-
 .../runtime/runtimetypes/MortalList.java      |   6 +-
 .../runtime/runtimetypes/PerlOwnerSlot.java   | 142 ++++++++++++++++-
 .../runtimetypes/ReachabilityWalker.java      |  19 +++
 .../runtime/runtimetypes/RuntimeBase.java     |  29 ++--
 .../runtime/runtimetypes/RuntimeScalar.java   | 144 ++++++++++++++----
 ...lOwnerSlotScalarReferenceContentsTest.java | 127 +++++++++++++++
 .../scalar_reference_contents_retarget.t      |  46 ++++++
 9 files changed, 489 insertions(+), 56 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotScalarReferenceContentsTest.java
 create mode 100644 src/test/resources/unit/refcount/scalar_reference_contents_retarget.t

diff --git a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
index 315a6c8bcb..da39630baf 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
@@ -290,7 +290,7 @@ private static boolean releaseTemporaryScalarReferenceContents(
             SuspendedInterpreterFrame frame) {
         boolean released = false;
         for (RuntimeScalar scalar : frame.temporaryScalarOwners) {
-            if (!scalar.ownsScalarReferenceContents) continue;
+            if (!scalar.hasScalarReferenceContentsOwner()) continue;
             scalar.deferOwnedScalarReferenceContents();
             released = true;
         }
@@ -301,7 +301,7 @@ private static boolean releaseTemporaryScalarReferenceContents(
     private static void trackTemporaryScalarReferenceContents(
             SuspendedInterpreterFrame frame, InterpretedCode code,
             int register, int firstMyVarReg, RuntimeScalar scalar) {
-        if (scalar == null || !scalar.ownsScalarReferenceContents) return;
+        if (scalar == null || !scalar.hasScalarReferenceContentsOwner()) return;
         boolean eligible = register >= firstMyVarReg
                 && !code.myVarRegisters.get(register)
                 && !scalar.isPackageGlobalRoot
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/GlobalRuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/GlobalRuntimeScalar.java
index 61b73e7919..6815630087 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/GlobalRuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/GlobalRuntimeScalar.java
@@ -205,6 +205,7 @@ public void dynamicRestoreState() {
                 RuntimeScalar localVar = saved.localizedVariable;
                 RuntimeBase displacedBase = null;
                 RuntimeScalar scalarReferenceContents = null;
+                PerlOwnerSlot scalarContentsOwner = null;
                 // Release container-owned values only when this localized
                 // scalar is dropping the container's last counted owner. A
                 // localized alias to a still-live request or cache must not
@@ -231,10 +232,11 @@ public void dynamicRestoreState() {
                     displacedBase.releaseActiveOwner(localVar);
                 }
                 if (localVar != null
-                        && localVar.ownsScalarReferenceContents
+                        && localVar.hasScalarReferenceContentsOwner()
                         && localVar.type == RuntimeScalarType.REFERENCE
                         && localVar.value instanceof RuntimeScalar scalarReferent) {
                     scalarReferenceContents = scalarReferent;
+                    scalarContentsOwner = localVar.scalarReferenceContentsOwner;
                 }
 
                 // Restore the internal separator values if this was an output separator variable
@@ -267,7 +269,7 @@ public void dynamicRestoreState() {
                     displacedWillDestroy = className != null && !className.isEmpty()
                             && DestroyDispatch.classHasDestroy(displacedBase.blessId, className);
                 }
-                if ((displacedWillDestroy || scalarReferenceContents != null)
+                if ((displacedWillDestroy || scalarContentsOwner != null)
                         && localVar != null && localVar != saved.originalVariable) {
                     // Compiled code may still hold the localized scalar object
                     // directly. Mirror the restored value into it just before
@@ -284,9 +286,13 @@ public void dynamicRestoreState() {
                     localVar.refCountOwned = false;
                 }
                 if (localVar != null) {
-                    localVar.ownsScalarReferenceContents = false;
+                    localVar.scalarReferenceContentsOwner = null;
+                }
+                if (scalarContentsOwner != null) {
+                    scalarContentsOwner.releaseScalarReferenceContents();
+                } else {
+                    RuntimeScalar.releaseScalarReferenceContents(scalarReferenceContents);
                 }
-                RuntimeScalar.releaseScalarReferenceContents(scalarReferenceContents);
                 if (displacedBase != null && displacedBase.refCount > 0
                         && --displacedBase.refCount == 0) {
                     displacedBase.refCount = Integer.MIN_VALUE;
@@ -301,6 +307,13 @@ public Object dynamicSuspendState() {
         RuntimeScalar activeVariable = GlobalVariable.getGlobalVariable(fullName);
         RuntimeScalar activeState = activeVariable != null
                 ? new RuntimeScalar(activeVariable) : new RuntimeScalar();
+        if (activeVariable != null) {
+            activeState.scalarReferenceContentsOwner = activeVariable.scalarReferenceContentsOwner;
+            if (activeState.scalarReferenceContentsOwner != null) {
+                activeState.scalarReferenceContentsOwner.transferScalarReferenceContentsCell(activeState);
+            }
+            activeVariable.scalarReferenceContentsOwner = null;
+        }
         boolean tied = activeVariable != null
                 && activeVariable.type == RuntimeScalarType.TIED_SCALAR;
         RuntimeScalar tiedValue = tied ? activeVariable.tiedFetch() : null;
@@ -322,7 +335,12 @@ public void dynamicResumeState(Object token) {
                 activeVariable.type = activeState.type;
                 activeVariable.value = activeState.value;
                 activeVariable.blessId = activeState.blessId;
-                activeVariable.ownsScalarReferenceContents = activeState.ownsScalarReferenceContents;
+                activeVariable.scalarReferenceContentsOwner = activeState.scalarReferenceContentsOwner;
+                activeState.scalarReferenceContentsOwner = null;
+                if (activeVariable.scalarReferenceContentsOwner != null) {
+                    activeVariable.scalarReferenceContentsOwner
+                            .transferScalarReferenceContentsCell(activeVariable);
+                }
                 activeVariable.referencedByScalarReference = activeState.referencedByScalarReference;
                 activeVariable.tainted = activeState.tainted;
                 activeVariable.numericLiteralText = activeState.numericLiteralText;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 3524a59aea..2d98824cf6 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1779,7 +1779,7 @@ private static void processDeferredBase(RuntimeBase base, boolean clearWeakRefsF
                 // have a legacy bridge count and retain the old compatibility
                 // sentinel behavior.
                 if (base.nativeCaptureOwnerCount() == 0) base.refCount = 1;
-            } else if (restoreReachableHashEntryOwnerCount(base)) {
+            } else if (restoreReachableAggregateOwnerCount(base)) {
                 // A hash-entry owner has a stable semantic slot identity even
                 // when an unrelated legacy scalar decrement consumes the
                 // selective count. Restore the count from independently owned
@@ -1976,8 +1976,8 @@ && isReachableCached(base)) {
         }
     }
 
-    /** Restore legacy count for hash-entry owner slots still reachable from Perl roots. */
-    private static boolean restoreReachableHashEntryOwnerCount(RuntimeBase referent) {
+    /** Restore legacy count for aggregate owner slots still reachable from Perl roots. */
+    static boolean restoreReachableAggregateOwnerCount(RuntimeBase referent) {
         Set<RuntimeScalar> rootedHashCells = Collections.newSetFromMap(new IdentityHashMap<>());
         int slotsWithoutCell = 0;
         for (PerlOwnerSlot slot : referent.ownerSlotSnapshot()) {
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
index 88e54c1317..b3c51e76b3 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
@@ -20,13 +20,15 @@ public final class PerlOwnerSlot {
     public enum Kind {
         CLOSURE_PAD,
         HASH_ENTRY,
-        ARRAY_ELEMENT
+        ARRAY_ELEMENT,
+        SCALAR_REFERENCE_CONTENTS
     }
 
     private final Kind kind;
     private final RuntimeScalar padCell;
     private final WeakReference<RuntimeBase> ownerContainer;
     private volatile WeakReference<RuntimeScalar> ownerCell;
+    private volatile WeakReference<RuntimeScalar> scalarReferenceCell;
     private volatile RuntimeCode closureOwner;
     private final long identity = NEXT_ID.incrementAndGet();
     private RuntimeBase referent;
@@ -41,12 +43,19 @@ public static final class PendingRelease {
         private final long ownerSlotIdentity;
         private final long sequence;
         private final Kind kind;
+        private final PerlOwnerSlot detachOnCompletion;
         private final AtomicBoolean completed = new AtomicBoolean();
 
         private PendingRelease(long ownerSlotIdentity, long sequence, Kind kind) {
+            this(ownerSlotIdentity, sequence, kind, null);
+        }
+
+        private PendingRelease(long ownerSlotIdentity, long sequence, Kind kind,
+                               PerlOwnerSlot detachOnCompletion) {
             this.ownerSlotIdentity = ownerSlotIdentity;
             this.sequence = sequence;
             this.kind = kind;
+            this.detachOnCompletion = detachOnCompletion;
         }
 
         public long ownerSlotIdentity() {
@@ -66,7 +75,8 @@ public boolean isCompleted() {
         }
 
         void complete() {
-            completed.set(true);
+            if (!completed.compareAndSet(false, true)) return;
+            if (detachOnCompletion != null) detachOnCompletion.detachAfterDeferredRelease();
         }
     }
 
@@ -198,6 +208,134 @@ public synchronized void acquireArrayElement(RuntimeBase target, RuntimeScalar c
         transferTo(target);
     }
 
+    /** Attach the identity for a scalar-reference cell's owned contents. */
+    public synchronized void acquireScalarReferenceContents(RuntimeBase target) {
+        acquireScalarReferenceContents(target, null);
+    }
+
+    public synchronized void acquireScalarReferenceContents(
+            RuntimeBase target, RuntimeScalar referenceCell) {
+        if (kind != Kind.SCALAR_REFERENCE_CONTENTS) {
+            throw new IllegalStateException(
+                    "scalar-reference acquisition requires a SCALAR_REFERENCE_CONTENTS slot");
+        }
+        Objects.requireNonNull(target, "target");
+        if (target.refCount < 0) {
+            throw new IllegalStateException(
+                    "scalar-reference contents require a tracked referent");
+        }
+        if (target.refCount == Integer.MAX_VALUE) {
+            throw new IllegalStateException("scalar-reference contents count overflow");
+        }
+        if (referent != null && referent != target) {
+            throw new IllegalStateException("cannot retarget an active scalar-reference owner");
+        }
+        transferTo(target);
+        target.traceRefCount(+1, "PerlOwnerSlot.acquireScalarReferenceContents");
+        target.refCount++;
+        target.hadCountedReference = true;
+        target.acquireTransientTraceOwner(
+                "scalar-reference contents", "PerlOwnerSlot.scalarReferenceContents");
+        scalarReferenceCell = referenceCell == null ? null : new WeakReference<>(referenceCell);
+        if (referenceCell != null) referenceCell.registerScalarReferenceContentsOwner(this);
+    }
+
+    /** Move the scalar cell that represents this contents owner. */
+    public synchronized void transferScalarReferenceContentsCell(RuntimeScalar cell) {
+        if (kind != Kind.SCALAR_REFERENCE_CONTENTS) {
+            throw new IllegalStateException(
+                    "scalar-reference cell transfer requires a SCALAR_REFERENCE_CONTENTS slot");
+        }
+        if (referent == null) {
+            throw new IllegalStateException("cannot transfer an inactive scalar-reference owner");
+        }
+        ownerCell = cell == null ? null : new WeakReference<>(cell);
+    }
+
+    /** Release this scalar-reference contents owner and dispatch on final release. */
+    public synchronized void releaseScalarReferenceContents() {
+        if (kind != Kind.SCALAR_REFERENCE_CONTENTS) {
+            throw new IllegalStateException(
+                    "scalar-reference release requires a SCALAR_REFERENCE_CONTENTS slot");
+        }
+        RuntimeBase target = referent;
+        if (target == null) return;
+        RuntimeScalar referenceCell = scalarReferenceCell == null ? null : scalarReferenceCell.get();
+        scalarReferenceCell = null;
+        if (referenceCell != null) referenceCell.unregisterScalarReferenceContentsOwner(this);
+        transferTo(null);
+        if (target.refCount <= 0) return;
+        target.traceRefCount(-1, "PerlOwnerSlot.releaseScalarReferenceContents");
+        target.releaseTransientTraceOwner(
+                "scalar-reference contents", "PerlOwnerSlot.scalarReferenceContents");
+        if (--target.refCount == 0) {
+            target.refCount = Integer.MIN_VALUE;
+            DestroyDispatch.callDestroy(target);
+        }
+    }
+
+    /** Queue a scalar-reference contents decrement with stable slot provenance. */
+    public synchronized PendingRelease deferScalarReferenceContentsRelease() {
+        if (kind != Kind.SCALAR_REFERENCE_CONTENTS) {
+            throw new IllegalStateException(
+                    "scalar-reference release requires a SCALAR_REFERENCE_CONTENTS slot");
+        }
+        RuntimeBase target = referent;
+        if (target == null) return null;
+        if (target.refCount <= 0) {
+            releaseScalarReferenceContents();
+            target.releaseTransientTraceOwner(
+                    "scalar-reference contents", "PerlOwnerSlot.deferScalarReferenceContentsRelease");
+            return null;
+        }
+        RuntimeScalar referenceCell = scalarReferenceCell == null ? null : scalarReferenceCell.get();
+        scalarReferenceCell = null;
+        if (referenceCell != null) referenceCell.unregisterScalarReferenceContentsOwner(this);
+        PendingRelease release = new PendingRelease(identity, ++nextReleaseSequence, kind, this);
+        MortalList.deferOwnerSlotDecrement(target, "scalar-reference contents", release);
+        return release;
+    }
+
+    /** Transfer the contents edge when its referenced scalar cell is overwritten. */
+    public synchronized void retargetScalarReferenceContents(RuntimeBase nextTarget) {
+        if (kind != Kind.SCALAR_REFERENCE_CONTENTS) {
+            throw new IllegalStateException(
+                    "scalar-reference retargeting requires a SCALAR_REFERENCE_CONTENTS slot");
+        }
+        RuntimeBase previous = referent;
+        if (previous == nextTarget) return;
+        if (nextTarget != null && nextTarget.refCount >= 0) {
+            if (nextTarget.refCount == Integer.MAX_VALUE) {
+                throw new IllegalStateException("scalar-reference contents count overflow");
+            }
+            nextTarget.traceRefCount(+1, "PerlOwnerSlot.retargetScalarReferenceContents");
+            nextTarget.refCount++;
+            nextTarget.hadCountedReference = true;
+            nextTarget.acquireTransientTraceOwner(
+                    "scalar-reference contents", "PerlOwnerSlot.scalarReferenceContents");
+        } else {
+            nextTarget = null;
+        }
+        transferTo(nextTarget);
+        if (nextTarget == null && scalarReferenceCell != null) {
+            RuntimeScalar referenceCell = scalarReferenceCell.get();
+            scalarReferenceCell = null;
+            if (referenceCell != null) referenceCell.unregisterScalarReferenceContentsOwner(this);
+        }
+        if (previous == null || previous.refCount <= 0) return;
+        previous.traceRefCount(-1, "PerlOwnerSlot.retargetScalarReferenceContents");
+        previous.releaseTransientTraceOwner(
+                "scalar-reference contents", "PerlOwnerSlot.scalarReferenceContents");
+        if (--previous.refCount == 0) {
+            previous.refCount = Integer.MIN_VALUE;
+            DestroyDispatch.callDestroy(previous);
+        }
+    }
+
+    private synchronized void detachAfterDeferredRelease() {
+        transferTo(null);
+    }
+
     /** Queue one closure-pad count release and retain its slot provenance. */
     public synchronized PendingRelease deferLegacyCaptureRelease(RuntimeBase target) {
         if (legacyCaptureCount <= 0) return null;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index c6aa590a89..19ed7745d7 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -3696,6 +3696,25 @@ public static ReleasedWeakSweepResult sweepReleasedWeakReferents(
                 countedStrongOwners.add(referent);
             }
         }
+        // Scalar-reference contents use a distinct owner slot from the
+        // scalar's direct referent field. When an explicit release triggers a
+        // targeted weak sweep, retain the nested referent if that owner cell
+        // is still a Perl root. Slots whose owner cells live inside the graph
+        // being discarded are internal edges, not independent roots.
+        for (RuntimeBase referent : referents) {
+            for (PerlOwnerSlot slot : referent.ownerSlotSnapshot()) {
+                if (slot.kind() != PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS
+                        || slot.referent() != referent) continue;
+                RuntimeScalar ownerCell = slot.ownerCell();
+                if (ownerCell == null || !live.contains(ownerCell)) continue;
+                if (ownerCell.containerOwner != null
+                        && referents.contains(ownerCell.containerOwner)
+                        && !live.contains(ownerCell.containerOwner)) {
+                    continue;
+                }
+                countedStrongOwners.add(referent);
+            }
+        }
         // Targeted release sweeps run at the same quiet statement boundary as
         // sweepWeakRefs(true). Preserve strong cycle islands here too: Perl's
         // reference counting intentionally keeps an unreachable strong cycle
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
index 58b179d1d2..d69c1a7bfb 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
@@ -491,8 +491,8 @@ public synchronized java.util.Set<PerlOwnerSlot> ownerSlotSnapshot() {
     }
 
     /**
-     * D-W6.14: count owners that are reachable from package globals or
-     * live my-vars. This is the strict version used by the production
+     * D-W6.14: count scalar and scalar-content-slot owners that are reachable
+     * from package globals or live my-vars. This is the strict version used by the production
      * rescue at MortalList.flush refCount→0: only objects whose owners
      * can be reached from real roots are kept alive. Phantom owners
      * (scalars that should be dead but haven't been released yet) are
@@ -501,18 +501,25 @@ public synchronized java.util.Set<PerlOwnerSlot> ownerSlotSnapshot() {
      * resolved by user weaken()).
      */
     public int reachableOwnerCount() {
-        if (activeOwners == null) return 0;
         int count = 0;
-        java.util.Iterator<RuntimeScalar> it = activeOwners.iterator();
-        while (it.hasNext()) {
-            RuntimeScalar sc = it.next();
-            if (sc != null && sc.refCountOwned && sc.value == this
-                    && ReachabilityWalker.isScalarReachable(sc)) {
-                count++;
-            } else if (sc == null || !sc.refCountOwned || sc.value != this) {
-                it.remove();
+        if (activeOwners != null) {
+            java.util.Iterator<RuntimeScalar> it = activeOwners.iterator();
+            while (it.hasNext()) {
+                RuntimeScalar sc = it.next();
+                if (sc != null && sc.refCountOwned && sc.value == this
+                        && ReachabilityWalker.isScalarReachable(sc)) {
+                    count++;
+                } else if (sc == null || !sc.refCountOwned || sc.value != this) {
+                    it.remove();
+                }
             }
         }
+        for (PerlOwnerSlot slot : ownerSlotSnapshot()) {
+            if (slot.kind() != PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS
+                    || slot.referent() != this) continue;
+            RuntimeScalar ownerCell = slot.ownerCell();
+            if (ownerCell != null && ReachabilityWalker.isScalarReachable(ownerCell)) count++;
+        }
         return count;
     }
 
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 048920f332..e10f0b1d31 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -823,13 +823,34 @@ void retainClosureCaptureReferentsForUnweaken() {
     /** True after this scalar has acquired per-runtime {@code pos()} cache state. */
     volatile boolean posCacheEntryCreated;
 
-    /**
-     * True when this scalar owns a counted reference through a scalar
-     * reference, e.g. the outer variable in {@code $x = \ bless {}, "X"}.
-     * The counted referent is inside the RuntimeScalar pointed to by this
-     * scalar, so regular {@code refCountOwned} cannot describe it.
-     */
-    public boolean ownsScalarReferenceContents;
+    /** Stable owner identity for this scalar's counted scalar-reference contents edge. */
+    public PerlOwnerSlot scalarReferenceContentsOwner;
+    private java.util.Set<PerlOwnerSlot> scalarReferenceContentsOwners;
+
+    public boolean hasScalarReferenceContentsOwner() {
+        return scalarReferenceContentsOwner != null
+                && scalarReferenceContentsOwner.isActive();
+    }
+
+    synchronized void registerScalarReferenceContentsOwner(PerlOwnerSlot owner) {
+        if (scalarReferenceContentsOwners == null) {
+            scalarReferenceContentsOwners = java.util.Collections.newSetFromMap(
+                    new java.util.IdentityHashMap<>());
+        }
+        scalarReferenceContentsOwners.add(owner);
+    }
+
+    synchronized void unregisterScalarReferenceContentsOwner(PerlOwnerSlot owner) {
+        if (scalarReferenceContentsOwners != null) {
+            scalarReferenceContentsOwners.remove(owner);
+            if (scalarReferenceContentsOwners.isEmpty()) scalarReferenceContentsOwners = null;
+        }
+    }
+
+    private synchronized java.util.List<PerlOwnerSlot> scalarReferenceContentsOwnersSnapshot() {
+        return scalarReferenceContentsOwners == null || scalarReferenceContentsOwners.isEmpty()
+                ? java.util.List.of() : java.util.List.copyOf(scalarReferenceContentsOwners);
+    }
 
     /**
      * True once a scalar reference has been created to this scalar, e.g.
@@ -2270,10 +2291,10 @@ public static void incrementRefCountForContainerStore(RuntimeScalar scalar) {
         // RuntimeScalar cell it aliases. Container materialization copies the
         // outer RV wrapper, so each copied aggregate cell must retain those
         // contents independently instead of relying on the source wrapper's
-        // ownsScalarReferenceContents flag.
+        // scalar-reference owner slot.
         if (scalar.type == REFERENCE
                 && scalar.value instanceof RuntimeScalar
-                && !scalar.ownsScalarReferenceContents) {
+                && !scalar.hasScalarReferenceContentsOwner()) {
             scalar.retainScalarReferenceContents(scalar);
         }
         if (scalar.refCountOwned
@@ -2355,21 +2376,19 @@ private static boolean scalarReferenceContentsNeedRetain(RuntimeScalar value) {
     }
 
     private void retainScalarReferenceContents(RuntimeScalar value) {
-        this.ownsScalarReferenceContents = false;
+        this.scalarReferenceContentsOwner = null;
         if (!scalarReferenceContentsNeedRetain(value)) return;
         RuntimeScalar scalarReferent = (RuntimeScalar) value.value;
         RuntimeBase inner = (RuntimeBase) scalarReferent.value;
-        inner.traceRefCount(+1, "RuntimeScalar.retainScalarReferenceContents");
-        inner.refCount++;
-        inner.hadCountedReference = true;
-        inner.acquireTransientTraceOwner("scalar-reference contents",
-                "RuntimeScalar.scalarReferenceContents");
-        this.ownsScalarReferenceContents = true;
+        PerlOwnerSlot ownerSlot = new PerlOwnerSlot(
+                PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS, null, null, this);
+        ownerSlot.acquireScalarReferenceContents(inner, scalarReferent);
+        this.scalarReferenceContentsOwner = ownerSlot;
     }
 
     private static RuntimeScalar scalarReferenceContentsReferent(RuntimeScalar owner) {
         if (owner != null
-                && owner.ownsScalarReferenceContents
+                && owner.hasScalarReferenceContentsOwner()
                 && owner.type == REFERENCE
                 && owner.value instanceof RuntimeScalar scalarReferent) {
             return scalarReferent;
@@ -2394,9 +2413,11 @@ public static void releaseScalarReferenceContents(RuntimeScalar scalarReferent)
     }
 
     public void releaseOwnedScalarReferenceContents() {
-        RuntimeScalar scalarReferent = scalarReferenceContentsReferent(this);
-        this.ownsScalarReferenceContents = false;
-        releaseScalarReferenceContents(scalarReferent);
+        PerlOwnerSlot ownerSlot = this.scalarReferenceContentsOwner;
+        this.scalarReferenceContentsOwner = null;
+        if (ownerSlot != null) {
+            ownerSlot.releaseScalarReferenceContents();
+        }
     }
 
     /**
@@ -2408,7 +2429,12 @@ public void releaseOwnedScalarReferenceContents() {
      */
     public void deferOwnedScalarReferenceContents() {
         RuntimeScalar scalarReferent = scalarReferenceContentsReferent(this);
-        this.ownsScalarReferenceContents = false;
+        PerlOwnerSlot ownerSlot = this.scalarReferenceContentsOwner;
+        this.scalarReferenceContentsOwner = null;
+        if (ownerSlot != null) {
+            ownerSlot.deferScalarReferenceContentsRelease();
+            return;
+        }
         if (scalarReferent == null
                 || (scalarReferent.type & REFERENCE_BIT) == 0
                 || !(scalarReferent.value instanceof RuntimeBase inner)
@@ -2430,6 +2456,8 @@ && getClass() == RuntimeScalar.class
                 && (value.getClass() == RuntimeScalar.class
                     || value.getClass() == RuntimeScalarReadOnly.class)
                 && type < TIED_SCALAR
+                && !hasScalarReferenceContentsOwner()
+                && scalarReferenceContentsOwnersSnapshot().isEmpty()
                 && value.type == INTEGER
                 && !value.transferableGrowingString) {
             return setPlainInteger(value);
@@ -2771,7 +2799,7 @@ private RuntimeScalar setLargeRefCounted(RuntimeScalar value) {
         // anonymous arrays/hashes that were never blessed). Skip all refCount
         // tracking, WeakRefRegistry checks, and MortalList flush.
         boolean scalarRefContentTrackingNeeded =
-                this.ownsScalarReferenceContents || scalarReferenceContentsNeedRetain(value);
+                this.hasScalarReferenceContentsOwner() || scalarReferenceContentsNeedRetain(value);
         boolean droppingAggregateWithWeakRefs = value.type == UNDEF
                 && WeakRefRegistry.weakRefsExist()
                 && this.value instanceof RuntimeBase oldReferent
@@ -2920,9 +2948,12 @@ && isSocketIOHandle(oldIo.ioHandle)) {
         // even though this scalar did not itself record a direct store owner.
         boolean oldOwnedByScalarReference = oldBase != null
                 && referencedByScalarReference
+                && scalarReferenceContentsOwnersSnapshot().isEmpty()
                 && refCount > 0;
-        boolean oldOwnedScalarReferenceContents = this.ownsScalarReferenceContents;
-        RuntimeScalar oldScalarReferenceContents = scalarReferenceContentsReferent(this);
+        java.util.List<PerlOwnerSlot> scalarContentsOwners =
+                scalarReferenceContentsOwnersSnapshot();
+        PerlOwnerSlot oldScalarReferenceContentsOwner = this.scalarReferenceContentsOwner;
+        boolean oldOwnedScalarReferenceContents = this.hasScalarReferenceContentsOwner();
         boolean shouldReleaseUnrootedRescuedGraph = false;
         boolean requestedDiscardedAggregateSweep = false;
 
@@ -2949,6 +2980,8 @@ && isSocketIOHandle(oldIo.ioHandle)) {
         // `%hash=()`/`deferDestroyForContainerClear` balance. Other referents at -1
         // stay untracked (e.g. named \@x via local slot).
         boolean newOwned = false;
+        boolean scalarContentsOwnedByEscapedReference = !scalarContentsOwners.isEmpty()
+                && !this.localBindingExists;
         if (((value.type & RuntimeScalarType.REFERENCE_BIT) != 0
                 || value.type == RuntimeScalarType.GLOB)
                 && value.value != null) {
@@ -2957,7 +2990,7 @@ && isSocketIOHandle(oldIo.ioHandle)) {
                     && (nb instanceof RuntimeHash || nb instanceof RuntimeArray)) {
                 nb.refCount = 0;
             }
-            if (nb.refCount >= 0) {
+            if (nb.refCount >= 0 && !scalarContentsOwnedByEscapedReference) {
                 if (nb.refCount == 0) nb.registerSharedFetchedView();
                 nb.traceRefCount(+1, "RuntimeScalar.setLargeRefCounted (increment on store)");
                 nb.recordOwner(this, "setLargeRefCounted store");
@@ -2974,6 +3007,7 @@ && isSocketIOHandle(oldIo.ioHandle)) {
         // Do the assignment
         this.type = value.type;
         this.value = copyScalarPayload(value.type, value.value);
+        this.scalarReferenceContentsOwner = null;
         // An explicitly discarded closure can have an inflated CODE refcount,
         // so waiting for callDestroy() leaves its captures alive indefinitely.
         // Release them only after this slot is gone, the code is inactive, and
@@ -3120,11 +3154,24 @@ && hasLiveIo(assignedGlob)) {
                 oldBase.releaseActiveOwner(this);
             }
             if (oldBase.refCount > 0 && --oldBase.refCount == 0) {
+                int rootedScalarContentsOwners = oldBase.ownerSlotCount(
+                        PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS) == 0
+                        ? 0 : oldBase.reachableOwnerCount();
                 if (oldBase.localBindingExists) {
                     // Named container (my %hash / my @array): the local variable
                     // slot holds a strong reference not counted in refCount.
                     // Don't call callDestroy — the container is still alive.
                     // Cleanup will happen at scope exit (scopeExitCleanupHash/Array).
+                } else if (MortalList.restoreReachableAggregateOwnerCount(oldBase)) {
+                    // Explicit aggregate slots can prove a rooted owner chain
+                    // even when a nested expression temporary is absent from
+                    // the conservative lexical walker roots.
+                } else if (rootedScalarContentsOwners > 0) {
+                    // A scalar-reference contents slot is an explicit Perl
+                    // owner even when the legacy decrement belongs to another
+                    // scalar alias. Restore the reachable owner count instead
+                    // of dispatching destruction at a transient zero.
+                    oldBase.refCount = rootedScalarContentsOwners;
                 } else if (oldBase.blessId == 0
                         && (oldBase instanceof RuntimeArray || oldBase instanceof RuntimeHash)
                         && WeakRefRegistry.hasWeakRefsTo(oldBase)
@@ -3225,7 +3272,9 @@ && hasLiveIo(assignedGlob)) {
             // nested DESTROY cleanup can release the just-returned value.
             boolean flushWasSuppressed = MortalList.suppressFlush(true);
             try {
-                releaseScalarReferenceContents(oldScalarReferenceContents);
+                if (oldScalarReferenceContentsOwner != null) {
+                    oldScalarReferenceContentsOwner.releaseScalarReferenceContents();
+                }
             } finally {
                 MortalList.suppressFlush(flushWasSuppressed);
             }
@@ -3267,6 +3316,15 @@ && hasLiveIo(assignedGlob)) {
         this.refCountOwned = newOwned;
         retainScalarReferenceContents(value);
 
+        if (!scalarContentsOwners.isEmpty()) {
+            RuntimeBase nextContents = (this.type & REFERENCE_BIT) != 0
+                    && this.value instanceof RuntimeBase base
+                    && !WeakRefRegistry.isweak(this) ? base : null;
+            for (PerlOwnerSlot owner : scalarContentsOwners) {
+                owner.retargetScalarReferenceContents(nextContents);
+            }
+        }
+
         // Flush deferred mortal decrements from the current function scope.
         // Entries below the current MortalList mark belong to the caller, and
         // must survive through nested calls such as chained AUTOLOAD dispatch.
@@ -5371,7 +5429,7 @@ public static void scopeExitCleanup(RuntimeScalar scalar) {
         // - refCountOwned=false → deferDecrementIfTracked returns immediately
         // - captureCount=0 → capture handling branch not taken
         if (!scalar.refCountOwned && scalar.captureCount == 0 && !scalar.ioOwner
-                && !scalar.ownsScalarReferenceContents
+                && !scalar.hasScalarReferenceContentsOwner()
                 && scalar.type != RuntimeScalarType.TIED_SCALAR) {
             // Special case: CODE refs with unreleased captures that were never
             // stored via set() (e.g., anonymous subs passed directly as arguments).
@@ -6577,7 +6635,10 @@ public void dynamicSaveState() {
         currentState.type = this.type;
         currentState.value = copyScalarPayload(this.type, this.value);
         currentState.blessId = this.blessId;
-        currentState.ownsScalarReferenceContents = this.ownsScalarReferenceContents;
+        currentState.scalarReferenceContentsOwner = this.scalarReferenceContentsOwner;
+        if (currentState.scalarReferenceContentsOwner != null) {
+            currentState.scalarReferenceContentsOwner.transferScalarReferenceContentsCell(currentState);
+        }
         currentState.referencedByScalarReference = this.referencedByScalarReference;
         currentState.tainted = this.tainted;
         currentState.numericLiteralText = this.numericLiteralText;
@@ -6592,7 +6653,7 @@ public void dynamicSaveState() {
         this.type = UNDEF;
         this.value = null;
         this.blessId = 0;
-        this.ownsScalarReferenceContents = false;
+        this.scalarReferenceContentsOwner = null;
         this.tainted = false;
         this.numericLiteralText = null;
         this.numericContextSeen = false;
@@ -6636,13 +6697,18 @@ public void dynamicRestoreState() {
                     && this.value instanceof RuntimeBase base) {
                 displacedBase = base;
             }
-            RuntimeScalar scalarReferenceContents = scalarReferenceContentsReferent(this);
+            PerlOwnerSlot displacedScalarReferenceContentsOwner =
+                    this.scalarReferenceContentsOwner;
 
             // Restore the type, value from the saved state
             this.type = previousState.type;
             this.value = copyScalarPayload(previousState.type, previousState.value);
             this.blessId = previousState.blessId;
-            this.ownsScalarReferenceContents = previousState.ownsScalarReferenceContents;
+            this.scalarReferenceContentsOwner = previousState.scalarReferenceContentsOwner;
+            previousState.scalarReferenceContentsOwner = null;
+            if (this.scalarReferenceContentsOwner != null) {
+                this.scalarReferenceContentsOwner.transferScalarReferenceContentsCell(this);
+            }
             this.referencedByScalarReference =
                     previousState.referencedByScalarReference || referencedDuringLocal;
             this.tainted = previousState.tainted;
@@ -6666,7 +6732,10 @@ public void dynamicRestoreState() {
                 owner.endScalarLocalElement();
             }
 
-            releaseScalarReferenceContents(scalarReferenceContents);
+            if (displacedScalarReferenceContentsOwner != null
+                    && displacedScalarReferenceContentsOwner != this.scalarReferenceContentsOwner) {
+                displacedScalarReferenceContentsOwner.releaseScalarReferenceContents();
+            }
 
             // Decrement refCount of the value displaced by local restoration
             // after restoring the old scalar state, so DESTROY sees the restored
@@ -6682,6 +6751,11 @@ public void dynamicRestoreState() {
     @Override
     public Object dynamicSuspendState() {
         RuntimeScalar activeState = new RuntimeScalar(this);
+        activeState.scalarReferenceContentsOwner = this.scalarReferenceContentsOwner;
+        if (activeState.scalarReferenceContentsOwner != null) {
+            activeState.scalarReferenceContentsOwner.transferScalarReferenceContentsCell(activeState);
+        }
+        this.scalarReferenceContentsOwner = null;
         dynamicRestoreState();
         return activeState;
     }
@@ -6693,7 +6767,11 @@ public void dynamicResumeState(Object token) {
             this.type = activeState.type;
             this.value = copyScalarPayload(activeState.type, activeState.value);
             this.blessId = activeState.blessId;
-            this.ownsScalarReferenceContents = activeState.ownsScalarReferenceContents;
+            this.scalarReferenceContentsOwner = activeState.scalarReferenceContentsOwner;
+            activeState.scalarReferenceContentsOwner = null;
+            if (this.scalarReferenceContentsOwner != null) {
+                this.scalarReferenceContentsOwner.transferScalarReferenceContentsCell(this);
+            }
             this.referencedByScalarReference = activeState.referencedByScalarReference;
             this.tainted = activeState.tainted;
             this.numericLiteralText = activeState.numericLiteralText;
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotScalarReferenceContentsTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotScalarReferenceContentsTest.java
new file mode 100644
index 0000000000..62fa693704
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotScalarReferenceContentsTest.java
@@ -0,0 +1,127 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("unit")
+class PerlOwnerSlotScalarReferenceContentsTest {
+    @Test
+    void referencedCellOverwriteTransfersItsContentsOwner() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeHash previous = new RuntimeHash();
+            RuntimeHash replacement = new RuntimeHash();
+            previous.refCount = 3;
+            replacement.refCount = 3;
+
+            RuntimeScalar referenceCell = new RuntimeScalar();
+            referenceCell.type = RuntimeScalarType.REFERENCE;
+            referenceCell.value = previous;
+            referenceCell.referencedByScalarReference = true;
+            RuntimeScalar outerReference = new RuntimeScalar();
+            outerReference.type = RuntimeScalarType.REFERENCE;
+            outerReference.value = referenceCell;
+            PerlOwnerSlot slot = new PerlOwnerSlot(
+                    PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS, null, null, outerReference);
+            slot.acquireScalarReferenceContents(previous, referenceCell);
+            outerReference.scalarReferenceContentsOwner = slot;
+
+            RuntimeScalar replacementValue = new RuntimeScalar();
+            replacementValue.type = RuntimeScalarType.REFERENCE;
+            replacementValue.value = replacement;
+            referenceCell.set(replacementValue);
+
+            assertEquals(3, previous.refCount);
+            assertEquals(4, replacement.refCount);
+            assertSame(replacement, slot.referent());
+            assertEquals(0, previous.ownerSlotCount(
+                    PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS));
+            assertEquals(1, replacement.ownerSlotCount(
+                    PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS));
+
+            outerReference.releaseOwnedScalarReferenceContents();
+            assertEquals(3, replacement.refCount);
+        }
+    }
+
+    @Test
+    void acquireAndReleaseUseTheScalarContentsSlotIdentity() {
+        RuntimeHash referent = new RuntimeHash();
+        referent.refCount = 3;
+        PerlOwnerSlot slot = new PerlOwnerSlot(
+                PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS);
+
+        slot.acquireScalarReferenceContents(referent);
+
+        assertEquals(4, referent.refCount);
+        assertEquals(1, referent.ownerSlotCount(
+                PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS));
+        assertSame(slot, referent.ownerSlotSnapshot().iterator().next());
+        assertTrue(slot.isActive());
+
+        slot.releaseScalarReferenceContents();
+
+        assertEquals(3, referent.refCount);
+        assertEquals(0, referent.ownerSlotCount(
+                PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS));
+        assertFalse(slot.isActive());
+        slot.releaseScalarReferenceContents();
+        assertEquals(3, referent.refCount);
+    }
+
+    @Test
+    void deferredReleaseCarriesTheOwnerSlotIdentityUntilDrain() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeHash referent = new RuntimeHash();
+            referent.refCount = 3;
+            PerlOwnerSlot slot = new PerlOwnerSlot(
+                    PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS);
+            slot.acquireScalarReferenceContents(referent);
+
+            MortalList.pushMark();
+            PerlOwnerSlot.PendingRelease release = slot.deferScalarReferenceContentsRelease();
+
+            assertNotNull(release);
+            assertEquals(slot.identity(), release.ownerSlotIdentity());
+            assertEquals(PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS, release.kind());
+            assertFalse(release.isCompleted());
+            assertEquals(4, referent.refCount);
+            assertTrue(slot.isActive());
+            assertEquals(1, referent.ownerSlotCount(
+                    PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS));
+
+            MortalList.flushAboveMark();
+
+            assertEquals(3, referent.refCount);
+            assertTrue(release.isCompleted());
+            assertFalse(slot.isActive());
+            assertEquals(0, referent.ownerSlotCount(
+                    PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS));
+            MortalList.popMark();
+        }
+    }
+
+    @Test
+    void rejectsOverflowBeforeRegisteringTheOwnerSlot() {
+        RuntimeHash referent = new RuntimeHash();
+        referent.refCount = Integer.MAX_VALUE;
+        PerlOwnerSlot slot = new PerlOwnerSlot(
+                PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS);
+
+        assertThrows(IllegalStateException.class,
+                () -> slot.acquireScalarReferenceContents(referent));
+        assertEquals(Integer.MAX_VALUE, referent.refCount);
+        assertEquals(0, referent.ownerSlotCount(
+                PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS));
+        assertNull(slot.referent());
+    }
+}
diff --git a/src/test/resources/unit/refcount/scalar_reference_contents_retarget.t b/src/test/resources/unit/refcount/scalar_reference_contents_retarget.t
new file mode 100644
index 0000000000..2a9cc89255
--- /dev/null
+++ b/src/test/resources/unit/refcount/scalar_reference_contents_retarget.t
@@ -0,0 +1,46 @@
+use strict;
+use warnings;
+use Scalar::Util qw(weaken);
+use Test::More tests => 7;
+
+{
+    package Local::ScalarReferenceContentsRetarget;
+    our $destroyed = 0;
+
+    sub new {
+        my ($class) = @_;
+        return bless {}, $class;
+    }
+
+    sub DESTROY { ++$destroyed }
+}
+
+sub return_scalar_cell {
+    my $value = Local::ScalarReferenceContentsRetarget->new;
+    return \$value;
+}
+
+my $cell_ref = return_scalar_cell();
+my $weak_first = $$cell_ref;
+weaken($weak_first);
+is($Local::ScalarReferenceContentsRetarget::destroyed, 0,
+    'returned scalar reference keeps its current contents alive');
+ok(defined $weak_first, 'first referent remains alive after its lexical scope exits');
+
+my $second = Local::ScalarReferenceContentsRetarget->new;
+my $weak_second = $second;
+weaken($weak_second);
+$$cell_ref = $second;
+undef $second;
+
+is($Local::ScalarReferenceContentsRetarget::destroyed, 1,
+    'overwriting the referenced scalar releases its previous contents');
+ok(!defined $weak_first, 'previous contents weak reference clears on replacement');
+ok(defined $weak_second, 'replacement contents remain owned by the scalar reference');
+
+undef $cell_ref;
+is($Local::ScalarReferenceContentsRetarget::destroyed, 2,
+    'releasing the scalar reference destroys the replacement contents once');
+ok(!defined $weak_second, 'final scalar-reference release clears the replacement weak observer');
+
+done_testing;

From b67d425106877a4500b1390368aa1dd5297f4142 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Wed, 21 Oct 2026 11:35:04 +0200
Subject: [PATCH 186/317] fix: avoid duplicate scalar cell ownership after
 retarget

When an escaped scalar reference owns a cell's contents, the owner slot is
that cell's retained-value edge. Do not also count the legacy direct store
edge, which would leave the replacement alive after the cell is released.

Generated with OpenAI Codex (https://openai.com/codex)
Co-Authored-By: OpenAI Codex <openai-codex@users.noreply.github.com>
---
 .../org/perlonjava/runtime/runtimetypes/RuntimeScalar.java     | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index e10f0b1d31..6364ccebfb 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -2980,8 +2980,7 @@ && scalarReferenceContentsOwnersSnapshot().isEmpty()
         // `%hash=()`/`deferDestroyForContainerClear` balance. Other referents at -1
         // stay untracked (e.g. named \@x via local slot).
         boolean newOwned = false;
-        boolean scalarContentsOwnedByEscapedReference = !scalarContentsOwners.isEmpty()
-                && !this.localBindingExists;
+        boolean scalarContentsOwnedByEscapedReference = !scalarContentsOwners.isEmpty();
         if (((value.type & RuntimeScalarType.REFERENCE_BIT) != 0
                 || value.type == RuntimeScalarType.GLOB)
                 && value.value != null) {

From b048ff5c7f0b412fa4c754d60756ebb10db98257 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Wed, 21 Oct 2026 12:43:32 +0200
Subject: [PATCH 187/317] docs: record scalar-reference ownership progress

Update the Phase 2 status with the retargetable scalar-reference owner slot,
its new regression coverage, local full-make result, and hosted CI state.

Generated with OpenAI Codex (https://openai.com/codex)
Co-Authored-By: OpenAI Codex <openai-codex@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 1344a5c04d..cadaab431c 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 candidate and follow-up ownership work are published in [draft PR #1816](https://github.com/PerlOnJava/pull/1816) at head `ea7b77164cdf35e3c1910c81277579dfb415ade3`. Earlier Ubuntu and Windows CI passed on prior heads; the current head's hosted run is queued. Phase 2 remains a recovery bridge rather than the completed ownership migration: `refCount` still controls dispatch, and scalar/proxy stores, alias cleanup, and complete default owner-slot accounting remain unmigrated.
+The #1794/#1795 candidate and follow-up ownership work are published in [draft PR #1816](https://github.com/PerlOnJava/pull/1816) at head `f0f10ed0ed29d4b83bd8a0ffc3097306d7b8cfa1`. The full local `nice -n 19 make` gate passes on this head; hosted Ubuntu and Windows CI are in progress. Phase 2 remains a recovery bridge rather than the completed ownership migration: `refCount` still controls dispatch, and general scalar/proxy stores, alias cleanup, and complete default owner-slot accounting remain unmigrated. Scalar-reference contents now have an explicit retargetable owner slot, covered by a Perl regression and a Java owner-slot test; this slot still bridges to the legacy referent count.
 
 The rebased candidate is based on `origin/master` (`ede542b29`). Its full local `nice -n 19 make` passed in 22m55s with two Gradle workers and a 3 GiB test heap. Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, and SBOM generation passed. Windows `make ci` passed in about 52 minutes with four Gradle workers, followed by the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. Continue migrating complete ownership paths through replacement, deletion, aliases, calls, and final release.
 
@@ -139,6 +139,13 @@ The rebased candidate is based on `origin/master` (`ede542b29`). Its full local
   checks. Two Java regressions assert the ownership result with zero root
   queries and snapshots. The full local `nice -n 19 make` passes on
   `ea7b77164` in 21m11s; hosted CI for this head is queued.
+- [x] On 2026-10-21, added an explicit scalar-reference contents owner slot
+  that follows a referenced scalar cell when it is overwritten. The Perl
+  regression verifies replacement and final `DESTROY`/weak clearing; the Java
+  test covers slot accounting. Testing exposed and fixed a duplicate legacy
+  direct-store count on the same cell. The focused refcount gate and the full
+  local `nice -n 19 make` pass on `f0f10ed0e` (27m56s); hosted Ubuntu and
+  Windows CI are running.
 - [x] Revalidated `ordinary_aggregate_element_owner_refcount.t`: all 11
   standard-Perl count/destruction assertions pass on blead Perl 5.45.4, JVM,
   and interpreter. This covers scalar ownership through array/hash insertion,

From 566c8049d5b4f49ddf529367d6362b66797e70d0 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Wed, 21 Oct 2026 12:57:13 +0200
Subject: [PATCH 188/317] docs: record HTML::Tree phase 2 integration result

Record the fresh HTML::Tree 5.07 run on the current code and distinguish its
compatibility result from the still-incomplete owner-slot migration gate.

Generated with OpenAI Codex (https://openai.com/codex)
Co-Authored-By: OpenAI Codex <openai-codex@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index cadaab431c..84deb91b4c 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 candidate and follow-up ownership work are published in [draft PR #1816](https://github.com/PerlOnJava/pull/1816) at head `f0f10ed0ed29d4b83bd8a0ffc3097306d7b8cfa1`. The full local `nice -n 19 make` gate passes on this head; hosted Ubuntu and Windows CI are in progress. Phase 2 remains a recovery bridge rather than the completed ownership migration: `refCount` still controls dispatch, and general scalar/proxy stores, alias cleanup, and complete default owner-slot accounting remain unmigrated. Scalar-reference contents now have an explicit retargetable owner slot, covered by a Perl regression and a Java owner-slot test; this slot still bridges to the legacy referent count.
+The #1794/#1795 candidate and follow-up ownership work are published in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The full local `nice -n 19 make` gate passes on code head `f0f10ed0e`; HTML::Tree 5.07 also passes all 989 tests, including unchanged `t/refloop.t`. Hosted Ubuntu and Windows CI are running on the latest documentation-only follow-up. Phase 2 remains a recovery bridge rather than the completed ownership migration: `refCount` still controls dispatch, and general scalar/proxy stores, alias cleanup, and complete default owner-slot accounting remain unmigrated. Scalar-reference contents now have an explicit retargetable owner slot, covered by a Perl regression and a Java owner-slot test; this slot still bridges to the legacy referent count. The HTML::Tree pass is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 The rebased candidate is based on `origin/master` (`ede542b29`). Its full local `nice -n 19 make` passed in 22m55s with two Gradle workers and a 3 GiB test heap. Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, and SBOM generation passed. Windows `make ci` passed in about 52 minutes with four Gradle workers, followed by the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. Continue migrating complete ownership paths through replacement, deletion, aliases, calls, and final release.
 
@@ -146,6 +146,11 @@ The rebased candidate is based on `origin/master` (`ede542b29`). Its full local
   direct-store count on the same cell. The focused refcount gate and the full
   local `nice -n 19 make` pass on `f0f10ed0e` (27m56s); hosted Ubuntu and
   Windows CI are running.
+- [x] Re-ran the unchanged HTML::Tree 5.07 suite on code head `f0f10ed0e`:
+  all 23 files and 989 tests pass, including `t/refloop.t`. This confirms the
+  ownership fix preserves the existing integration behavior; the suite still
+  exercises legacy refcount/reachability paths and does not complete the
+  planned default owner-slot migration.
 - [x] Revalidated `ordinary_aggregate_element_owner_refcount.t`: all 11
   standard-Perl count/destruction assertions pass on blead Perl 5.45.4, JVM,
   and interpreter. This covers scalar ownership through array/hash insertion,

From d8259c76b2a6235a529f400d30a8fd3f018e403f Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Wed, 21 Oct 2026 13:37:05 +0200
Subject: [PATCH 189/317] wip: count scalar-reference contents once per cell

Add Perl and Java coverage for aliases sharing one scalar cell, then account
for one referent owner across alias acquisition, retarget, and release.

Generated with OpenAI Codex (https://openai.com/codex)
Co-Authored-By: OpenAI Codex <openai-codex@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md          |   8 +-
 .../runtime/runtimetypes/PerlOwnerSlot.java   |  81 ++++++++----
 .../runtime/runtimetypes/RuntimeBase.java     |  13 +-
 .../runtime/runtimetypes/RuntimeScalar.java   |   2 +-
 ...lOwnerSlotScalarReferenceContentsTest.java | 117 ++++++++++++++++++
 ...scalar_reference_contents_alias_lifetime.t |  62 ++++++++++
 6 files changed, 258 insertions(+), 25 deletions(-)
 create mode 100644 src/test/resources/unit/refcount/scalar_reference_contents_alias_lifetime.t

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 84deb91b4c..6307739974 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress in [draft PR #1816](https://github.com/PerlOnJava/pull/1816), currently at `ea7b77164` and based on current master `ede542b2901ebb54e7aae293fae74cbbd6af22d7`. The full local `nice -n 19 make` gate passes on the current candidate. Typed hash/array owner slots now prove nested aggregate root chains both during deferred-release recovery and `DESTROY` resurrection checks; focused Java regressions verify zero whole-root queries and snapshots for those paths. The latest hosted workflow is queued behind earlier long-running CI runs. Owner slots still bridge to `RuntimeBase.refCount` for dispatch; scalar/proxy migration and default owner-slot accounting remain incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress in [draft PR #1816](https://github.com/PerlOnJava/pull/1816), currently at `4eebdf5c45cf9a1ae2f3a8e6e4f63e8c8beb430c`. The full local `nice -n 19 make` gate passes on code head `f0f10ed0e`; HTML::Tree 5.07 passes all 989 tests on both JVM and interpreter backends. Hosted Ubuntu and Windows checks for the current PR head are still running. Owner slots still bridge to `RuntimeBase.refCount` for dispatch; scalar/proxy migration and default owner-slot accounting remain incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 candidate and follow-up ownership work are published in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The full local `nice -n 19 make` gate passes on code head `f0f10ed0e`; HTML::Tree 5.07 also passes all 989 tests, including unchanged `t/refloop.t`. Hosted Ubuntu and Windows CI are running on the latest documentation-only follow-up. Phase 2 remains a recovery bridge rather than the completed ownership migration: `refCount` still controls dispatch, and general scalar/proxy stores, alias cleanup, and complete default owner-slot accounting remain unmigrated. Scalar-reference contents now have an explicit retargetable owner slot, covered by a Perl regression and a Java owner-slot test; this slot still bridges to the legacy referent count. The HTML::Tree pass is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 candidate and follow-up ownership work are published in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The full local `nice -n 19 make` gate passes on code head `f0f10ed0e`; HTML::Tree 5.07 passes all 989 tests on both JVM and interpreter backends, including unchanged `t/refloop.t`. Hosted Ubuntu and Windows CI are running on the latest documentation-only follow-up. Phase 2 remains a recovery bridge rather than the completed ownership migration: `refCount` still controls dispatch, and general scalar/proxy stores, alias cleanup, and complete default owner-slot accounting remain unmigrated. Scalar-reference contents now have an explicit retargetable owner slot, covered by a Perl regression and a Java owner-slot test; this slot still bridges to the legacy referent count. The HTML-Tree pass is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 The rebased candidate is based on `origin/master` (`ede542b29`). Its full local `nice -n 19 make` passed in 22m55s with two Gradle workers and a 3 GiB test heap. Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, and SBOM generation passed. Windows `make ci` passed in about 52 minutes with four Gradle workers, followed by the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. Continue migrating complete ownership paths through replacement, deletion, aliases, calls, and final release.
 
@@ -151,6 +151,10 @@ The rebased candidate is based on `origin/master` (`ede542b29`). Its full local
   ownership fix preserves the existing integration behavior; the suite still
   exercises legacy refcount/reachability paths and does not complete the
   planned default owner-slot migration.
+- [x] On 2026-10-21, ran HTML::Tree 5.07 under the interpreter backend on code
+  head `f0f10ed0e`; all 23 files and 989 tests pass, including `t/refloop.t`.
+  PR #1816 remains open as a draft at `4eebdf5c4`, with hosted Ubuntu and
+  Windows checks still in progress.
 - [x] Revalidated `ordinary_aggregate_element_owner_refcount.t`: all 11
   standard-Perl count/destruction assertions pass on blead Perl 5.45.4, JVM,
   and interpreter. This covers scalar ownership through array/hash insertion,
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
index b3c51e76b3..5de410085a 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
@@ -121,6 +121,11 @@ RuntimeScalar ownerCell() {
         return reference == null ? null : reference.get();
     }
 
+    RuntimeScalar scalarReferenceCell() {
+        WeakReference<RuntimeScalar> reference = scalarReferenceCell;
+        return reference == null ? null : reference.get();
+    }
+
     boolean isNativeCaptureOwner() {
         return nativeCaptureOwner;
     }
@@ -208,7 +213,11 @@ public synchronized void acquireArrayElement(RuntimeBase target, RuntimeScalar c
         transferTo(target);
     }
 
-    /** Attach the identity for a scalar-reference cell's owned contents. */
+    /**
+     * Attach one scalar-reference alias slot to its cell's contents.
+     * Distinct aliases keep distinct reachability identities, while aliases
+     * to the same scalar cell share one referent count.
+     */
     public synchronized void acquireScalarReferenceContents(RuntimeBase target) {
         acquireScalarReferenceContents(target, null);
     }
@@ -224,18 +233,28 @@ public synchronized void acquireScalarReferenceContents(
             throw new IllegalStateException(
                     "scalar-reference contents require a tracked referent");
         }
-        if (target.refCount == Integer.MAX_VALUE) {
-            throw new IllegalStateException("scalar-reference contents count overflow");
-        }
         if (referent != null && referent != target) {
             throw new IllegalStateException("cannot retarget an active scalar-reference owner");
         }
+        if (referent == target) {
+            RuntimeScalar currentCell = scalarReferenceCell();
+            if (currentCell == referenceCell) return;
+            throw new IllegalStateException(
+                    "an active scalar-reference owner cannot change cells during acquisition");
+        }
+        boolean firstOwnerForCell = !hasSiblingScalarReferenceContentsOwner(
+                referenceCell, target);
+        if (firstOwnerForCell && target.refCount == Integer.MAX_VALUE) {
+            throw new IllegalStateException("scalar-reference contents count overflow");
+        }
         transferTo(target);
-        target.traceRefCount(+1, "PerlOwnerSlot.acquireScalarReferenceContents");
-        target.refCount++;
-        target.hadCountedReference = true;
-        target.acquireTransientTraceOwner(
-                "scalar-reference contents", "PerlOwnerSlot.scalarReferenceContents");
+        if (firstOwnerForCell) {
+            target.traceRefCount(+1, "PerlOwnerSlot.acquireScalarReferenceContents");
+            target.refCount++;
+            target.hadCountedReference = true;
+            target.acquireTransientTraceOwner(
+                    "scalar-reference contents", "PerlOwnerSlot.scalarReferenceContents");
+        }
         scalarReferenceCell = referenceCell == null ? null : new WeakReference<>(referenceCell);
         if (referenceCell != null) referenceCell.registerScalarReferenceContentsOwner(this);
     }
@@ -264,6 +283,7 @@ public synchronized void releaseScalarReferenceContents() {
         scalarReferenceCell = null;
         if (referenceCell != null) referenceCell.unregisterScalarReferenceContentsOwner(this);
         transferTo(null);
+        if (hasSiblingScalarReferenceContentsOwner(referenceCell, target)) return;
         if (target.refCount <= 0) return;
         target.traceRefCount(-1, "PerlOwnerSlot.releaseScalarReferenceContents");
         target.releaseTransientTraceOwner(
@@ -291,6 +311,10 @@ public synchronized PendingRelease deferScalarReferenceContentsRelease() {
         RuntimeScalar referenceCell = scalarReferenceCell == null ? null : scalarReferenceCell.get();
         scalarReferenceCell = null;
         if (referenceCell != null) referenceCell.unregisterScalarReferenceContentsOwner(this);
+        if (hasSiblingScalarReferenceContentsOwner(referenceCell, target)) {
+            transferTo(null);
+            return null;
+        }
         PendingRelease release = new PendingRelease(identity, ++nextReleaseSequence, kind, this);
         MortalList.deferOwnerSlotDecrement(target, "scalar-reference contents", release);
         return release;
@@ -304,25 +328,31 @@ public synchronized void retargetScalarReferenceContents(RuntimeBase nextTarget)
         }
         RuntimeBase previous = referent;
         if (previous == nextTarget) return;
-        if (nextTarget != null && nextTarget.refCount >= 0) {
-            if (nextTarget.refCount == Integer.MAX_VALUE) {
-                throw new IllegalStateException("scalar-reference contents count overflow");
+        RuntimeScalar referenceCell = scalarReferenceCell == null ? null : scalarReferenceCell.get();
+        boolean firstOwnerForNextTarget = nextTarget != null
+                && !hasSiblingScalarReferenceContentsOwner(referenceCell, nextTarget);
+        if (nextTarget != null) {
+            if (nextTarget.refCount < 0) {
+                nextTarget = null;
+            } else if (firstOwnerForNextTarget) {
+                if (nextTarget.refCount == Integer.MAX_VALUE) {
+                    throw new IllegalStateException("scalar-reference contents count overflow");
+                }
+                nextTarget.traceRefCount(+1, "PerlOwnerSlot.retargetScalarReferenceContents");
+                nextTarget.refCount++;
+                nextTarget.hadCountedReference = true;
+                nextTarget.acquireTransientTraceOwner(
+                        "scalar-reference contents", "PerlOwnerSlot.scalarReferenceContents");
             }
-            nextTarget.traceRefCount(+1, "PerlOwnerSlot.retargetScalarReferenceContents");
-            nextTarget.refCount++;
-            nextTarget.hadCountedReference = true;
-            nextTarget.acquireTransientTraceOwner(
-                    "scalar-reference contents", "PerlOwnerSlot.scalarReferenceContents");
-        } else {
-            nextTarget = null;
         }
         transferTo(nextTarget);
         if (nextTarget == null && scalarReferenceCell != null) {
-            RuntimeScalar referenceCell = scalarReferenceCell.get();
             scalarReferenceCell = null;
             if (referenceCell != null) referenceCell.unregisterScalarReferenceContentsOwner(this);
         }
-        if (previous == null || previous.refCount <= 0) return;
+        if (previous == null
+                || hasSiblingScalarReferenceContentsOwner(referenceCell, previous)
+                || previous.refCount <= 0) return;
         previous.traceRefCount(-1, "PerlOwnerSlot.retargetScalarReferenceContents");
         previous.releaseTransientTraceOwner(
                 "scalar-reference contents", "PerlOwnerSlot.scalarReferenceContents");
@@ -336,6 +366,15 @@ private synchronized void detachAfterDeferredRelease() {
         transferTo(null);
     }
 
+    private boolean hasSiblingScalarReferenceContentsOwner(
+            RuntimeScalar referenceCell, RuntimeBase target) {
+        if (referenceCell == null || target == null) return false;
+        for (PerlOwnerSlot slot : referenceCell.scalarReferenceContentsOwnersSnapshot()) {
+            if (slot != this && slot.referent() == target) return true;
+        }
+        return false;
+    }
+
     /** Queue one closure-pad count release and retain its slot provenance. */
     public synchronized PendingRelease deferLegacyCaptureRelease(RuntimeBase target) {
         if (legacyCaptureCount <= 0) return null;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
index d69c1a7bfb..ef11397c3f 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
@@ -1,7 +1,10 @@
 package org.perlonjava.runtime.runtimetypes;
 
+import java.util.Collections;
+import java.util.IdentityHashMap;
 import java.util.Iterator;
 import java.util.Objects;
+import java.util.Set;
 
 import static org.perlonjava.runtime.runtimetypes.RuntimeScalarCache.scalarUndef;
 
@@ -514,11 +517,19 @@ public int reachableOwnerCount() {
                 }
             }
         }
+        // Several RV wrappers can alias one scalar cell. They keep separate
+        // slot identities for root proofs, but the cell owns its contents only
+        // once, so only one reachable alias contributes to the count.
+        Set<Object> countedScalarReferenceCells =
+                Collections.newSetFromMap(new IdentityHashMap<>());
         for (PerlOwnerSlot slot : ownerSlotSnapshot()) {
             if (slot.kind() != PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS
                     || slot.referent() != this) continue;
             RuntimeScalar ownerCell = slot.ownerCell();
-            if (ownerCell != null && ReachabilityWalker.isScalarReachable(ownerCell)) count++;
+            if (ownerCell == null || !ReachabilityWalker.isScalarReachable(ownerCell)) continue;
+            RuntimeScalar referenceCell = slot.scalarReferenceCell();
+            Object ownershipKey = referenceCell == null ? slot : referenceCell;
+            if (countedScalarReferenceCells.add(ownershipKey)) count++;
         }
         return count;
     }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 6364ccebfb..9bd1848319 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -847,7 +847,7 @@ synchronized void unregisterScalarReferenceContentsOwner(PerlOwnerSlot owner) {
         }
     }
 
-    private synchronized java.util.List<PerlOwnerSlot> scalarReferenceContentsOwnersSnapshot() {
+    synchronized java.util.List<PerlOwnerSlot> scalarReferenceContentsOwnersSnapshot() {
         return scalarReferenceContentsOwners == null || scalarReferenceContentsOwners.isEmpty()
                 ? java.util.List.of() : java.util.List.copyOf(scalarReferenceContentsOwners);
     }
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotScalarReferenceContentsTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotScalarReferenceContentsTest.java
index 62fa693704..bbc217ab19 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotScalarReferenceContentsTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotScalarReferenceContentsTest.java
@@ -77,6 +77,123 @@ void acquireAndReleaseUseTheScalarContentsSlotIdentity() {
         assertEquals(3, referent.refCount);
     }
 
+    @Test
+    void aliasesToOneCellShareOneReferentCountAcrossRetargetAndRelease() {
+        RuntimeHash original = new RuntimeHash();
+        RuntimeHash replacement = new RuntimeHash();
+        original.refCount = 3;
+        replacement.refCount = 3;
+        RuntimeScalar referenceCell = new RuntimeScalar();
+        referenceCell.type = RuntimeScalarType.REFERENCE;
+        referenceCell.value = original;
+        PerlOwnerSlot firstAlias = new PerlOwnerSlot(
+                PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS);
+        PerlOwnerSlot secondAlias = new PerlOwnerSlot(
+                PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS);
+
+        firstAlias.acquireScalarReferenceContents(original, referenceCell);
+        firstAlias.acquireScalarReferenceContents(original, referenceCell);
+        assertEquals(4, original.refCount,
+                "reacquiring the same slot identity does not duplicate its count");
+        secondAlias.acquireScalarReferenceContents(original, referenceCell);
+
+        assertEquals(4, original.refCount,
+                "one scalar cell contributes one referent count regardless of aliases");
+        assertEquals(2, original.ownerSlotCount(
+                PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS));
+
+        firstAlias.retargetScalarReferenceContents(replacement);
+        assertEquals(4, original.refCount,
+                "retargeting one alias preserves the cell's original contents owner");
+        assertEquals(4, replacement.refCount,
+                "the new cell contents acquire one owner");
+
+        secondAlias.retargetScalarReferenceContents(replacement);
+        assertEquals(3, original.refCount,
+                "the final old-target alias releases the old contents exactly once");
+        assertEquals(4, replacement.refCount,
+                "retargeting another alias does not duplicate the new contents owner");
+
+        firstAlias.releaseScalarReferenceContents();
+        assertEquals(4, replacement.refCount,
+                "releasing one alias leaves the shared contents owner active");
+        secondAlias.releaseScalarReferenceContents();
+        assertEquals(3, replacement.refCount,
+                "the final alias releases the shared contents owner exactly once");
+    }
+
+    @Test
+    void deferringOneAliasReleaseLeavesTheSharedContentsOwned() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeHash referent = new RuntimeHash();
+            referent.refCount = 3;
+            RuntimeScalar referenceCell = new RuntimeScalar();
+            referenceCell.type = RuntimeScalarType.REFERENCE;
+            referenceCell.value = referent;
+            PerlOwnerSlot firstAlias = new PerlOwnerSlot(
+                    PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS);
+            PerlOwnerSlot secondAlias = new PerlOwnerSlot(
+                    PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS);
+            firstAlias.acquireScalarReferenceContents(referent, referenceCell);
+            secondAlias.acquireScalarReferenceContents(referent, referenceCell);
+
+            MortalList.pushMark();
+            PerlOwnerSlot.PendingRelease release = firstAlias.deferScalarReferenceContentsRelease();
+
+            assertNull(release,
+                    "dropping one alias does not enqueue the cell's shared contents release");
+            assertEquals(4, referent.refCount);
+            assertEquals(1, referent.ownerSlotCount(
+                    PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS));
+
+            secondAlias.releaseScalarReferenceContents();
+            assertEquals(3, referent.refCount,
+                    "the remaining alias releases the contents owner exactly once");
+            MortalList.popMark();
+        }
+    }
+
+    @Test
+    void reachableOwnerCountDeduplicatesAliasesToOneScalarCell() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeHash referent = new RuntimeHash();
+            referent.refCount = 3;
+            RuntimeScalar referenceCell = new RuntimeScalar();
+            referenceCell.type = RuntimeScalarType.REFERENCE;
+            referenceCell.value = referent;
+            RuntimeScalar firstAlias = new RuntimeScalar();
+            RuntimeScalar secondAlias = new RuntimeScalar();
+            firstAlias.type = RuntimeScalarType.REFERENCE;
+            firstAlias.value = referenceCell;
+            secondAlias.type = RuntimeScalarType.REFERENCE;
+            secondAlias.value = referenceCell;
+            MyVarCleanupStack.register(firstAlias);
+            MyVarCleanupStack.register(secondAlias);
+            try {
+                PerlOwnerSlot firstOwner = new PerlOwnerSlot(
+                        PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS,
+                        null, null, firstAlias);
+                PerlOwnerSlot secondOwner = new PerlOwnerSlot(
+                        PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS,
+                        null, null, secondAlias);
+                firstOwner.acquireScalarReferenceContents(referent, referenceCell);
+                secondOwner.acquireScalarReferenceContents(referent, referenceCell);
+
+                assertEquals(1, referent.reachableOwnerCount());
+                firstOwner.releaseScalarReferenceContents();
+                assertEquals(1, referent.reachableOwnerCount(),
+                        "the remaining reachable alias still represents one owner");
+                secondOwner.releaseScalarReferenceContents();
+                assertEquals(0, referent.reachableOwnerCount());
+            } finally {
+                MyVarCleanupStack.unregister(firstAlias);
+                MyVarCleanupStack.unregister(secondAlias);
+            }
+        }
+    }
+
     @Test
     void deferredReleaseCarriesTheOwnerSlotIdentityUntilDrain() {
         PerlRuntime runtime = new PerlRuntime();
diff --git a/src/test/resources/unit/refcount/scalar_reference_contents_alias_lifetime.t b/src/test/resources/unit/refcount/scalar_reference_contents_alias_lifetime.t
new file mode 100644
index 0000000000..a0eaa5f973
--- /dev/null
+++ b/src/test/resources/unit/refcount/scalar_reference_contents_alias_lifetime.t
@@ -0,0 +1,62 @@
+use strict;
+use warnings;
+use B qw(svref_2object);
+use Scalar::Util qw(weaken);
+use Test::More tests => 12;
+
+{
+    package Local::ScalarReferenceAliasLifetime;
+    our $destroyed = 0;
+
+    sub new { bless {}, shift }
+    sub DESTROY { ++$destroyed }
+}
+
+sub refcount { svref_2object($_[0])->REFCNT }
+
+sub make_scalar_reference_aliases {
+    my $value = Local::ScalarReferenceAliasLifetime->new;
+    my $first = \$value;
+    my $second = $first;
+    return ($first, $second);
+}
+
+my ($first, $second) = make_scalar_reference_aliases();
+my $weak_contents = $$second;
+weaken($weak_contents);
+is($Local::ScalarReferenceAliasLifetime::destroyed, 0,
+    'aliases keep a returned scalar cell and its contents alive');
+ok(defined $weak_contents,
+    'the scalar contents remain alive after the declaring scope exits');
+is(refcount($$second), 1,
+    'two aliases to one scalar cell contribute one contents owner');
+
+undef $first;
+is($Local::ScalarReferenceAliasLifetime::destroyed, 0,
+    'dropping one alias does not release the shared scalar contents');
+ok(defined $weak_contents,
+    'the remaining alias still keeps the scalar cell contents alive');
+is(refcount($$second), 1,
+    'dropping one alias does not change the scalar cell contents count');
+
+my $replacement = Local::ScalarReferenceAliasLifetime->new;
+my $weak_replacement = $replacement;
+weaken($weak_replacement);
+$$second = $replacement;
+undef $replacement;
+is($Local::ScalarReferenceAliasLifetime::destroyed, 1,
+    'replacing the shared scalar cell releases its previous contents once');
+ok(!defined $weak_contents,
+    'the replaced contents weak reference clears');
+ok(defined $weak_replacement,
+    'the replacement remains alive through the remaining scalar reference');
+is(refcount($$second), 1,
+    'the shared scalar cell contributes one owner for replacement contents');
+
+undef $second;
+is($Local::ScalarReferenceAliasLifetime::destroyed, 2,
+    'dropping the final alias releases the current contents once');
+ok(!defined $weak_replacement,
+    'the replacement weak reference clears after the final alias is released');
+
+done_testing;

From f11c2c7fae604f9bb4f7a2e1a48135a92246e5c3 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Wed, 21 Oct 2026 14:51:36 +0200
Subject: [PATCH 190/317] docs: record scalar-reference alias ownership
 progress

Record the parent refcount mismatch, oracle and backend results, full make,
and HTML::Tree integration evidence for the scalar-reference alias path.

Generated with OpenAI Codex (https://openai.com/codex)
Co-Authored-By: OpenAI Codex <openai-codex@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 15 ++++++++++++---
 docs/about/changelog.md              |  2 +-
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 6307739974..d53f9468b2 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress in [draft PR #1816](https://github.com/PerlOnJava/pull/1816), currently at `4eebdf5c45cf9a1ae2f3a8e6e4f63e8c8beb430c`. The full local `nice -n 19 make` gate passes on code head `f0f10ed0e`; HTML::Tree 5.07 passes all 989 tests on both JVM and interpreter backends. Hosted Ubuntu and Windows checks for the current PR head are still running. Owner slots still bridge to `RuntimeBase.refCount` for dispatch; scalar/proxy migration and default owner-slot accounting remain incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The scalar-reference alias follow-up is based on `origin/master` at `18323a1ac`; its full local `nice -n 19 make` passes on code commit `15e362ddb`, as does HTML::Tree 5.07 on both JVM and interpreter backends (23 files, 989 tests each). The previously published PR head has green Ubuntu and Windows checks; hosted checks for the follow-up are pending. Owner slots still bridge to `RuntimeBase.refCount` for dispatch; default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,9 +107,9 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 candidate and follow-up ownership work are published in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The full local `nice -n 19 make` gate passes on code head `f0f10ed0e`; HTML::Tree 5.07 passes all 989 tests on both JVM and interpreter backends, including unchanged `t/refloop.t`. Hosted Ubuntu and Windows CI are running on the latest documentation-only follow-up. Phase 2 remains a recovery bridge rather than the completed ownership migration: `refCount` still controls dispatch, and general scalar/proxy stores, alias cleanup, and complete default owner-slot accounting remain unmigrated. Scalar-reference contents now have an explicit retargetable owner slot, covered by a Perl regression and a Java owner-slot test; this slot still bridges to the legacy referent count. The HTML-Tree pass is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 candidate and ownership work are published in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The previously published PR head has green Ubuntu and Windows checks. The scalar-reference alias follow-up is based on `origin/master` at `18323a1ac`; full `nice -n 19 make` passes on code commit `15e362ddb`, and HTML::Tree 5.07 passes all 989 tests on both JVM and interpreter backends, including unchanged `t/refloop.t`. Phase 2 remains a recovery bridge rather than the completed ownership migration: `refCount` still controls dispatch, and general scalar/proxy stores, alias cleanup, and default owner-slot accounting remain unmigrated. Distinct scalar-reference aliases now keep separate reachability identities while contributing one referent count per scalar cell. The HTML-Tree pass is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
-The rebased candidate is based on `origin/master` (`ede542b29`). Its full local `nice -n 19 make` passed in 22m55s with two Gradle workers and a 3 GiB test heap. Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, and SBOM generation passed. Windows `make ci` passed in about 52 minutes with four Gradle workers, followed by the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. Continue migrating complete ownership paths through replacement, deletion, aliases, calls, and final release.
+The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 
 ### Completed
 
@@ -155,6 +155,15 @@ The rebased candidate is based on `origin/master` (`ede542b29`). Its full local
   head `f0f10ed0e`; all 23 files and 989 tests pass, including `t/refloop.t`.
   PR #1816 remains open as a draft at `4eebdf5c4`, with hosted Ubuntu and
   Windows checks still in progress.
+- [x] On 2026-10-21, added a 12-assertion scalar-reference alias test. B::SV
+  reports one contents owner for two references to the same scalar cell on
+  system Perl 5.34.1 and blead Perl 5.45.4. The pre-fix parent reports two on
+  both backends; the rebased fix passes all 12 assertions on JVM and
+  interpreter. The owner-slot Java tests cover alias acquisition, idempotent
+  acquisition, retargeting, reachable-owner deduplication, and deferred and
+  final release. Full `nice -n 19 make` passes in 31m30s on code commit
+  `15e362ddb`; unchanged HTML::Tree 5.07 passes all 23 files and 989 tests on
+  both backends, including `t/refloop.t`.
 - [x] Revalidated `ordinary_aggregate_element_owner_refcount.t`: all 11
   standard-Perl count/destruction assertions pass on blead Perl 5.45.4, JVM,
   and interpreter. This covers scalar ownership through array/hash insertion,
diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index 1912d456c5..279feb5aa0 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -42,7 +42,7 @@ priorities and future plans.
 - Preserve inherited method dispatch in child threads.
 - Prefer exact root-module package declarations over earlier helper packages, and warn for undefined hash keys used by `exists` and `delete` (#1820, #1645).
 - Add a reproducible, warmup-aware Perl versus PerlOnJava performance runner (#1196).
-- Preserve CODE callback captures while Perl container slots still own the callback; restore rooted hash-entry and package-rooted, registered lexical, or closure-captured array-element owners when a legacy deferred decrement undercounts them; register array-element owners after lvalue-proxy stores, scalar and aggregate refaliasing, and scalar-reference creation into new arrays; release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; avoid false global-destruction resurrection warnings when bounded owner proofs scan large package graphs; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
+- Preserve CODE callback captures while Perl container slots still own the callback; restore rooted hash-entry and package-rooted, registered lexical, or closure-captured array-element owners when a legacy deferred decrement undercounts them; register array-element owners after lvalue-proxy stores, scalar and aggregate refaliasing, and scalar-reference creation into new arrays; count scalar-reference contents once when multiple references alias the same scalar cell; release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; avoid false global-destruction resurrection warnings when bounded owner proofs scan large package graphs; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
 - Implement Perl's writable `Internals::SvREFCNT` form while keeping B::SV's private query mode separate (#1649).
 - Cover FormState session restoration across requests and HTTP response conversion from callback and streaming PSGI responses; refresh HTTP::Message and LWP compatibility status (#1650, #1651, #1652).
 - Preserve the awaited Future value when its source scalar or aggregate slot changes during suspension, covering PAGI::Server request-body receives (#1818).

From 4861a65bc23a090df617c275b650024a8c3ab143 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Wed, 21 Oct 2026 16:05:44 +0200
Subject: [PATCH 191/317] test: cover array replacement ownership counts

Extend the Perl-compatible aggregate ownership regression to assert that
replacing an array value releases the old owner and acquires the new one.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../refcount/ordinary_aggregate_element_owner_refcount.t  | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/test/resources/unit/refcount/ordinary_aggregate_element_owner_refcount.t b/src/test/resources/unit/refcount/ordinary_aggregate_element_owner_refcount.t
index 20b99a1e46..43c59c84f7 100644
--- a/src/test/resources/unit/refcount/ordinary_aggregate_element_owner_refcount.t
+++ b/src/test/resources/unit/refcount/ordinary_aggregate_element_owner_refcount.t
@@ -21,6 +21,14 @@ is(rc($object), 3, 'push adds one independent array-element owner');
 shift @array;
 is(rc($object), 2, 'shift releases only the removed array-element owner');
 
+my $array_replacement = bless {}, 'OrdinaryAggregateOwnerProbe';
+$array[0] = $array_replacement;
+is(rc($object), 1, 'replacing an array value releases the displaced owner');
+is(rc($array_replacement), 2, 'the replacement array value gains one owner');
+$array[0] = $object;
+is(rc($array_replacement), 1, 'replacing an array value releases its previous owner');
+is(rc($object), 2, 'the new array value gains one owner');
+
 my %hash = (left => $object, right => $object);
 is(rc($object), 4, 'two hash entries add two independent owners');
 delete $hash{left};

From 22efbd22477e8aa6acf5aa8eae56b76d1fa974e9 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Wed, 21 Oct 2026 16:27:00 +0200
Subject: [PATCH 192/317] fix: retain referents shared by aggregate aliases

Keep a scalar cell's referent owner when another owning array or hash still
contains that cell. Add Perl-oracle-checked regressions for pop and delete of
one alias while another aggregate alias remains.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtime/runtimetypes/RuntimeArray.java    |  2 +
 .../runtime/runtimetypes/RuntimeHash.java     | 12 ++-
 .../runtime/runtimetypes/RuntimeScalar.java   | 15 ++++
 ...alar_cell_cross_container_alias_lifetime.t | 90 +++++++++++++++++++
 4 files changed, 115 insertions(+), 4 deletions(-)
 create mode 100644 src/test/resources/unit/refcount/aggregate_scalar_cell_cross_container_alias_lifetime.t

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
index b0217b3b3b..547d484948 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
@@ -894,6 +894,7 @@ public static RuntimeScalar pop(RuntimeArray runtimeArray) {
                     // so its elements must NOT be mortal-ized on shift/pop — doing so
                     // would corrupt the caller's refCount tracking.
                     if (runtimeArray.ownsElement(result) && result.refCountOwned
+                            && !result.hasOwningAggregateSlot()
                             && (result.type & RuntimeScalarType.REFERENCE_BIT) != 0
                             && result.value instanceof RuntimeBase base
                             && base.refCount > 0) {
@@ -937,6 +938,7 @@ public static RuntimeScalar shift(RuntimeArray runtimeArray) {
                     // If this element owned a refCount, defer the decrement.
                     // See pop() for rationale and elementsOwned guard.
                     if (runtimeArray.ownsElement(result) && result.refCountOwned
+                            && !result.hasOwningAggregateSlot()
                             && (result.type & RuntimeScalarType.REFERENCE_BIT) != 0
                             && result.value instanceof RuntimeBase base
                             && base.refCount > 0) {
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java
index c273769e86..34d2970587 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java
@@ -1151,8 +1151,10 @@ public RuntimeScalar deleteInContext(RuntimeScalar key, int callContext) {
                     // Schedule deferred refCount decrement — fires at next safe point
                     // (setLarge or RuntimeCode.apply). This prevents premature DESTROY
                     // when the caller captures the return value.
-                    MortalList.deferDecrementIfTracked(value);
-                    MortalList.deferIoOwnerRelease(value);
+                    if (!value.hasOwningAggregateSlot()) {
+                        MortalList.deferDecrementIfTracked(value);
+                        MortalList.deferIoOwnerRelease(value);
+                    }
                     // The deleted SV is a loose lvalue. This is observable when
                     // the slot aliases another scalar and is passed as the
                     // first argument of four-argument substr.
@@ -1199,8 +1201,10 @@ public RuntimeScalar deleteInContext(String key, int callContext) {
                         yield fetchedValue;
                     }
                     // Schedule deferred refCount decrement (see delete(RuntimeScalar) above)
-                    MortalList.deferDecrementIfTracked(value);
-                    MortalList.deferIoOwnerRelease(value);
+                    if (!value.hasOwningAggregateSlot()) {
+                        MortalList.deferDecrementIfTracked(value);
+                        MortalList.deferIoOwnerRelease(value);
+                    }
                     yield value;
                 }
                 yield new RuntimeScalar();
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 9bd1848319..3c71c56cf7 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -527,6 +527,21 @@ synchronized void unmarkArrayContainerOwner(RuntimeArray owner) {
         if (arrayContainerOwners.isEmpty()) arrayContainerOwners = null;
     }
 
+    /**
+     * Whether this scalar cell still occupies a strong slot in an owning
+     * aggregate. Callers use this after removing one slot, when the owning
+     * container registry reflects the remaining slots.
+     */
+    boolean hasOwningAggregateSlot() {
+        for (RuntimeHash owner : hashContainerOwnersSnapshot()) {
+            if (owner.elements.containsValue(this)) return true;
+        }
+        for (RuntimeArray owner : arrayContainerOwnersSnapshot()) {
+            if (owner.elements.contains(this) && owner.ownsElement(this)) return true;
+        }
+        return false;
+    }
+
     private void propagateTiedHandlerMarkerToReferent() {
         if (containerOwner != null && containerOwner.possiblyStoredInTiedHandler
                 && (type & RuntimeScalarType.REFERENCE_BIT) != 0
diff --git a/src/test/resources/unit/refcount/aggregate_scalar_cell_cross_container_alias_lifetime.t b/src/test/resources/unit/refcount/aggregate_scalar_cell_cross_container_alias_lifetime.t
new file mode 100644
index 0000000000..e6006c51e7
--- /dev/null
+++ b/src/test/resources/unit/refcount/aggregate_scalar_cell_cross_container_alias_lifetime.t
@@ -0,0 +1,90 @@
+use strict;
+use warnings;
+use B qw(svref_2object);
+use Scalar::Util qw(weaken);
+use feature 'refaliasing';
+no warnings 'experimental::refaliasing';
+use Test::More tests => 18;
+
+{
+    package CrossAggregateAliasLifetime;
+    our $destroyed = 0;
+    sub DESTROY { ++$destroyed }
+}
+
+sub refcount { svref_2object($_[0])->REFCNT }
+
+my @source;
+my @target;
+my $object = bless {}, 'CrossAggregateAliasLifetime';
+my $weak = $object;
+weaken($weak);
+$source[0] = $object;
+\$target[0] = \$source[0];
+
+is(refcount($object), 2,
+    'one aliased scalar cell contributes one aggregate referent owner');
+undef $object;
+is(refcount($weak), 1, 'the aliased cell remains the only strong owner');
+
+my $popped = pop @source;
+ok(defined $weak, 'removing one aggregate alias keeps the shared cell alive');
+undef $popped;
+ok(defined $weak,
+    'dropping the pop result leaves the other aggregate alias alive');
+
+undef $target[0];
+ok(!defined $weak, 'clearing the final alias releases the referent');
+is($CrossAggregateAliasLifetime::destroyed, 1,
+    'DESTROY runs exactly once after the last owning slot is cleared');
+
+my %hash_source;
+my @array_target;
+my $hash_object = bless {}, 'CrossAggregateAliasLifetime';
+my $hash_weak = $hash_object;
+weaken($hash_weak);
+$hash_source{slot} = $hash_object;
+\$array_target[0] = \$hash_source{slot};
+
+is(refcount($hash_object), 2,
+    'a hash cell aliased into an array contributes one referent owner');
+undef $hash_object;
+is(refcount($hash_weak), 1,
+    'the shared hash and array cell remains the only strong owner');
+
+my $deleted = delete $hash_source{slot};
+ok(defined $hash_weak, 'deleting one aggregate alias keeps the shared cell alive');
+undef $deleted;
+ok(defined $hash_weak,
+    'dropping the delete result leaves the other aggregate alias alive');
+
+undef $array_target[0];
+ok(!defined $hash_weak, 'clearing the final hash/array alias releases the referent');
+is($CrossAggregateAliasLifetime::destroyed, 2,
+    'the cross-container referent is destroyed exactly once');
+
+my @shift_source;
+my @shift_target;
+my $shift_object = bless {}, 'CrossAggregateAliasLifetime';
+my $shift_weak = $shift_object;
+weaken($shift_weak);
+$shift_source[0] = $shift_object;
+\$shift_target[0] = \$shift_source[0];
+
+is(refcount($shift_object), 2,
+    'one scalar cell shared with a second array contributes one referent owner');
+undef $shift_object;
+is(refcount($shift_weak), 1, 'the shared array cell remains the only strong owner');
+
+my $shifted = shift @shift_source;
+ok(defined $shift_weak, 'shifting one aggregate alias keeps the shared cell alive');
+undef $shifted;
+ok(defined $shift_weak,
+    'dropping the shift result leaves the other aggregate alias alive');
+
+undef $shift_target[0];
+ok(!defined $shift_weak, 'clearing the final shifted alias releases the referent');
+is($CrossAggregateAliasLifetime::destroyed, 3,
+    'the shifted cross-container referent is destroyed exactly once');
+
+done_testing;

From cc904d968e693d16272e974da5e34656d5b1468c Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Wed, 21 Oct 2026 18:25:29 +0200
Subject: [PATCH 193/317] docs: record cross-container alias ownership fix

Record the migrated array/hash alias cleanup path, the Perl-oracle and
backend regression evidence, and the remaining legacy refcount boundary.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 9 ++++++++-
 docs/about/changelog.md              | 1 +
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index d53f9468b2..912135e3ca 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 candidate and ownership work are published in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The previously published PR head has green Ubuntu and Windows checks. The scalar-reference alias follow-up is based on `origin/master` at `18323a1ac`; full `nice -n 19 make` passes on code commit `15e362ddb`, and HTML::Tree 5.07 passes all 989 tests on both JVM and interpreter backends, including unchanged `t/refloop.t`. Phase 2 remains a recovery bridge rather than the completed ownership migration: `refCount` still controls dispatch, and general scalar/proxy stores, alias cleanup, and default owner-slot accounting remain unmigrated. Distinct scalar-reference aliases now keep separate reachability identities while contributing one referent count per scalar cell. The HTML-Tree pass is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 candidate and ownership work are published in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The candidate is based on `origin/master` at `18323a1ac`; code commit `28faab9b9` passes full `nice -n 19 make` in 26m43s. Its 18-assertion cross-container scalar-cell alias regression passes on system Perl 5.34.1, blead Perl 5.45.4, JVM, and interpreter, after failing on the unfixed PerlOnJava parent on both backends. The previous PR head has green Ubuntu and Windows checks; hosted checks for `28faab9b9` are running. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and general scalar/proxy stores, alias cleanup, and default owner-slot accounting remain unmigrated. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. HTML::Tree 5.07 passes all 989 tests on both backends, including unchanged `t/refloop.t`; this remains compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 
@@ -169,6 +169,13 @@ The earlier candidate was based on `origin/master` (`ede542b29`) and passed the
   and interpreter. This covers scalar ownership through array/hash insertion,
   push, shift, delete, replacement, aggregate clear, and final release; Phase 2
   still requires replacing the legacy counters with default owner-slot paths.
+- [x] On 2026-10-21, kept a referent alive when `pop`, `shift`, or hash deletion
+  removes one owning aggregate slot while another array/hash slot still aliases
+  the same scalar cell. The 18-assertion Perl regression passes on system Perl
+  5.34.1, blead Perl 5.45.4, JVM, and interpreter, and failed on the unfixed
+  PerlOnJava parent on both backends. Full `nice -n 19 make` passes in 26m43s
+  on code commit `28faab9b9`. Legacy `refCount` dispatch remains; the next work
+  is default owner-slot accounting across ordinary aggregate stores and cleanup.
 - [x] Re-read the parent issue's implementation contract and reviewed the
   independent lifecycle candidate handoff. Historical candidate test results
   are not treated as current Phase 1 evidence.
diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index 279feb5aa0..5ed4cb336f 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -20,6 +20,7 @@ priorities and future plans.
 - Avoid retaining transient arrays and hashes through shared immutable scalar literals while preserving reference ownership tracking.
 - Run standard Perl's `cpan -t Module` for CPAN oracle checks and keep download failures inconclusive instead of reporting missing local modules as Perl failures.
 - Keep lexical-registration membership checks constant-time, avoiding quadratic CPAN index parsing as cleanup stacks grow.
+- Keep a referent alive while another owning array or hash slot still aliases its scalar cell after `pop`, `shift`, or `delete` (#1649).
 - Preserve numeric types of cached read-only scalars in ranges, rejecting unsigned endpoints outside the supported integer range.
 - Improve JVM execution performance for the bit-packed Life example, ordinary scalar assignments, and common blessing lookups.
 - Reuse private one-scalar wrappers when materializing scalar returns, reducing result-list allocations across JVM calls.

From 01f7a173429e0e8501c0d45134340bdb3de224e0 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Wed, 21 Oct 2026 19:04:01 +0200
Subject: [PATCH 194/317] test: cover aggregate clears with shared scalar cells

Expand the cross-container alias regression to cover array and hash clears,
then record the additional lifecycle coverage in the ownership design doc.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          | 12 ++++---
 ...alar_cell_cross_container_alias_lifetime.t | 32 ++++++++++++++++++-
 2 files changed, 38 insertions(+), 6 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 912135e3ca..2a5f36b9e2 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -171,11 +171,13 @@ The earlier candidate was based on `origin/master` (`ede542b29`) and passed the
   still requires replacing the legacy counters with default owner-slot paths.
 - [x] On 2026-10-21, kept a referent alive when `pop`, `shift`, or hash deletion
   removes one owning aggregate slot while another array/hash slot still aliases
-  the same scalar cell. The 18-assertion Perl regression passes on system Perl
-  5.34.1, blead Perl 5.45.4, JVM, and interpreter, and failed on the unfixed
-  PerlOnJava parent on both backends. Full `nice -n 19 make` passes in 26m43s
-  on code commit `28faab9b9`. Legacy `refCount` dispatch remains; the next work
-  is default owner-slot accounting across ordinary aggregate stores and cleanup.
+  the same scalar cell. Its 22-assertion Perl regression covers those removals
+  and array/hash clear with a second owning aggregate. It passes on system Perl
+  5.34.1, blead Perl 5.45.4, JVM, and interpreter; the failing pop/delete cases
+  were reproduced on the unfixed parent on both backends. Full
+  `nice -n 19 make` passes in 26m43s on code commit `28faab9b9`. Legacy
+  `refCount` dispatch remains; the next work is default owner-slot accounting
+  across ordinary aggregate stores and cleanup.
 - [x] Re-read the parent issue's implementation contract and reviewed the
   independent lifecycle candidate handoff. Historical candidate test results
   are not treated as current Phase 1 evidence.
diff --git a/src/test/resources/unit/refcount/aggregate_scalar_cell_cross_container_alias_lifetime.t b/src/test/resources/unit/refcount/aggregate_scalar_cell_cross_container_alias_lifetime.t
index e6006c51e7..d62780f183 100644
--- a/src/test/resources/unit/refcount/aggregate_scalar_cell_cross_container_alias_lifetime.t
+++ b/src/test/resources/unit/refcount/aggregate_scalar_cell_cross_container_alias_lifetime.t
@@ -4,7 +4,7 @@ use B qw(svref_2object);
 use Scalar::Util qw(weaken);
 use feature 'refaliasing';
 no warnings 'experimental::refaliasing';
-use Test::More tests => 18;
+use Test::More tests => 22;
 
 {
     package CrossAggregateAliasLifetime;
@@ -87,4 +87,34 @@ ok(!defined $shift_weak, 'clearing the final shifted alias releases the referent
 is($CrossAggregateAliasLifetime::destroyed, 3,
     'the shifted cross-container referent is destroyed exactly once');
 
+my @clear_source;
+my @clear_target;
+my $clear_array_object = bless {}, 'CrossAggregateAliasLifetime';
+my $clear_array_weak = $clear_array_object;
+weaken($clear_array_weak);
+$clear_source[0] = $clear_array_object;
+\$clear_target[0] = \$clear_source[0];
+undef $clear_array_object;
+@clear_source = ();
+ok(defined $clear_array_weak,
+    'clearing an array preserves another aggregate alias');
+undef $clear_target[0];
+ok(!defined $clear_array_weak,
+    'clearing the final array alias releases the referent');
+
+my %clear_hash_source;
+my @clear_hash_target;
+my $clear_hash_object = bless {}, 'CrossAggregateAliasLifetime';
+my $clear_hash_weak = $clear_hash_object;
+weaken($clear_hash_weak);
+$clear_hash_source{slot} = $clear_hash_object;
+\$clear_hash_target[0] = \$clear_hash_source{slot};
+undef $clear_hash_object;
+%clear_hash_source = ();
+ok(defined $clear_hash_weak,
+    'clearing a hash preserves another aggregate alias');
+undef $clear_hash_target[0];
+ok(!defined $clear_hash_weak,
+    'clearing the final hash alias releases the referent');
+
 done_testing;

From 666c15a28651fdc5d922819d4579627e8777eafd Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Wed, 21 Oct 2026 19:58:16 +0200
Subject: [PATCH 195/317] docs: record aggregate alias clear coverage after
 rebase

Update the ownership progress record to the latest master base, 22-assertion
regression, and full make result from the rebased candidate.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 2a5f36b9e2..db418d074e 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 candidate and ownership work are published in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The candidate is based on `origin/master` at `18323a1ac`; code commit `28faab9b9` passes full `nice -n 19 make` in 26m43s. Its 18-assertion cross-container scalar-cell alias regression passes on system Perl 5.34.1, blead Perl 5.45.4, JVM, and interpreter, after failing on the unfixed PerlOnJava parent on both backends. The previous PR head has green Ubuntu and Windows checks; hosted checks for `28faab9b9` are running. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and general scalar/proxy stores, alias cleanup, and default owner-slot accounting remain unmigrated. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. HTML::Tree 5.07 passes all 989 tests on both backends, including unchanged `t/refloop.t`; this remains compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 candidate and ownership work are published in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The candidate is based on `origin/master` at `162d8eb84`; rebased code commit `69d30792f` passes full `nice -n 19 make` in 31m15s. Its 22-assertion cross-container scalar-cell alias regression passes on system Perl 5.34.1, blead Perl 5.45.4, JVM, and interpreter; the pop/delete failures were reproduced on the unfixed parent on both backends. Hosted checks for the earlier published head are still running; checks for the rebased head will be recorded after publication. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and general scalar/proxy stores, alias cleanup, and default owner-slot accounting remain unmigrated. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. HTML::Tree 5.07 passes all 989 tests on both backends, including unchanged `t/refloop.t`; this remains compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 
@@ -174,8 +174,9 @@ The earlier candidate was based on `origin/master` (`ede542b29`) and passed the
   the same scalar cell. Its 22-assertion Perl regression covers those removals
   and array/hash clear with a second owning aggregate. It passes on system Perl
   5.34.1, blead Perl 5.45.4, JVM, and interpreter; the failing pop/delete cases
-  were reproduced on the unfixed parent on both backends. Full
-  `nice -n 19 make` passes in 26m43s on code commit `28faab9b9`. Legacy
+  were reproduced on the unfixed parent on both backends. After rebasing onto
+  `162d8eb84`, full `nice -n 19 make` passes in 31m15s on code commit
+  `69d30792f`. Legacy
   `refCount` dispatch remains; the next work is default owner-slot accounting
   across ordinary aggregate stores and cleanup.
 - [x] Re-read the parent issue's implementation contract and reviewed the

From 2adc55fb831704bcad345aa6e68711a760373cc7 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Wed, 21 Oct 2026 22:36:35 +0200
Subject: [PATCH 196/317] fix: preserve HTML tree cleanup during array shifts

Restrict pop/shift alias transfer suppression to cells fetched through an
owned-array lvalue. Internal work arrays reuse scalar cells for value copies;
those removals still need their deferred decrements. Ignore transient list
assignment arrays when looking for remaining aggregate owners.

The focused aggregate alias regression and both tracked HTML::Tree lifecycle
reproducers pass on JVM and interpreter. Full nice -n 19 make passes.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../perlonjava/runtime/runtimetypes/RuntimeArray.java |  4 ++--
 .../runtime/runtimetypes/RuntimeScalar.java           | 11 +++++++++++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
index 547d484948..d59d9e8341 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
@@ -894,7 +894,7 @@ public static RuntimeScalar pop(RuntimeArray runtimeArray) {
                     // so its elements must NOT be mortal-ized on shift/pop — doing so
                     // would corrupt the caller's refCount tracking.
                     if (runtimeArray.ownsElement(result) && result.refCountOwned
-                            && !result.hasOwningAggregateSlot()
+                            && !result.hasOwningAggregateSlotForLvalueAlias()
                             && (result.type & RuntimeScalarType.REFERENCE_BIT) != 0
                             && result.value instanceof RuntimeBase base
                             && base.refCount > 0) {
@@ -938,7 +938,7 @@ public static RuntimeScalar shift(RuntimeArray runtimeArray) {
                     // If this element owned a refCount, defer the decrement.
                     // See pop() for rationale and elementsOwned guard.
                     if (runtimeArray.ownsElement(result) && result.refCountOwned
-                            && !result.hasOwningAggregateSlot()
+                            && !result.hasOwningAggregateSlotForLvalueAlias()
                             && (result.type & RuntimeScalarType.REFERENCE_BIT) != 0
                             && result.value instanceof RuntimeBase base
                             && base.refCount > 0) {
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 3c71c56cf7..f0478c3439 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -537,11 +537,22 @@ boolean hasOwningAggregateSlot() {
             if (owner.elements.containsValue(this)) return true;
         }
         for (RuntimeArray owner : arrayContainerOwnersSnapshot()) {
+            if (owner.transientListAssignmentRhs) continue;
             if (owner.elements.contains(this) && owner.ownsElement(this)) return true;
         }
         return false;
     }
 
+    /**
+     * Pop and shift may transfer an owned cell to another aggregate without
+     * decrementing its referent only when the cell was fetched as a Perl array
+     * lvalue. Internal work arrays also reuse scalar cells, but those are value
+     * copies and must not suppress the removed slot's deferred decrement.
+     */
+    boolean hasOwningAggregateSlotForLvalueAlias() {
+        return localArrayOwner != null && hasOwningAggregateSlot();
+    }
+
     private void propagateTiedHandlerMarkerToReferent() {
         if (containerOwner != null && containerOwner.possiblyStoredInTiedHandler
                 && (type & RuntimeScalarType.REFERENCE_BIT) != 0

From e6e18beb55f0a9abde709689497180a0d6431b82 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Wed, 21 Oct 2026 23:00:18 +0200
Subject: [PATCH 197/317] docs: record aggregate shift lifecycle regression fix

Update the ownership progress record with the rebased build result, the
project-owned HTML::Tree repro evidence, and both backend integration passes.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index db418d074e..1c8d1fb36a 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The scalar-reference alias follow-up is based on `origin/master` at `18323a1ac`; its full local `nice -n 19 make` passes on code commit `15e362ddb`, as does HTML::Tree 5.07 on both JVM and interpreter backends (23 files, 989 tests each). The previously published PR head has green Ubuntu and Windows checks; hosted checks for the follow-up are pending. Owner slots still bridge to `RuntimeBase.refCount` for dispatch; default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress in [draft PR #1816](https://github.com/PerlOnJava/pull/1816), based on `origin/master` at `162d8eb84`. Code commit `5d9b082b4` passes the full local `nice -n 19 make` gate and HTML::Tree 5.07 on JVM and interpreter (23 files, 989 tests each). Owner slots still bridge to `RuntimeBase.refCount` for dispatch; default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,12 +107,20 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 candidate and ownership work are published in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The candidate is based on `origin/master` at `162d8eb84`; rebased code commit `69d30792f` passes full `nice -n 19 make` in 31m15s. Its 22-assertion cross-container scalar-cell alias regression passes on system Perl 5.34.1, blead Perl 5.45.4, JVM, and interpreter; the pop/delete failures were reproduced on the unfixed parent on both backends. Hosted checks for the earlier published head are still running; checks for the rebased head will be recorded after publication. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and general scalar/proxy stores, alias cleanup, and default owner-slot accounting remain unmigrated. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. HTML::Tree 5.07 passes all 989 tests on both backends, including unchanged `t/refloop.t`; this remains compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 candidate and ownership work are published in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). Code commit `5d9b082b4` passes full `nice -n 19 make` in 21m34s. Its 22-assertion cross-container scalar-cell alias regression passes on system Perl 5.34.1, blead Perl 5.45.4, JVM, and interpreter; the pop/delete failures were reproduced on the unfixed parent on both backends. The project-owned HTML::Tree lifecycle reproducers pass on system Perl and both PerlOnJava backends; the unfixed parent leaves two and four elements alive in the respective cases. HTML::Tree 5.07 passes all 989 tests on both backends, including unchanged `t/refloop.t`. The PR's previous head has green Ubuntu and Windows checks; checks for this commit will run after publication. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and general scalar/proxy stores, alias cleanup, and default owner-slot accounting remain unmigrated. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 
 ### Completed
 
+- [x] On 2026-10-21, corrected the array pop/shift guard after the rebased
+  aggregate-alias change exposed false retention in HTML::Tree cleanup. Only
+  Perl array lvalue aliases now suppress the removed slot's deferred
+  decrement; internal work-array copies still release it. The existing
+  project-owned HTML::Tree reproducers pass on system Perl, JVM, and
+  interpreter; the full local `make` passes in 21m34s, and HTML::Tree 5.07
+  passes all 23 files and 989 tests on both backends.
+
 - [x] On 2026-10-20, rebased the #1794/#1795 candidate onto current master,
   fixed the remaining interpreter closure-capture and cleanup behavior, and
   validated the controller (5/5), WebSocket (6/6), Catalyst tempfile (24/24),

From 276e2a308fb5e3b4032d7f2d86223f96ccb0a357 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 22 Oct 2026 01:47:43 +0200
Subject: [PATCH 198/317] fix: retain interpreter callbacks through code state
 roots

Follow persistent state edges from installed code and recursively traverse
captured callback code in external-root snapshots. Add coverage for state-held
scalar, array, hash, and nested callback owners.

Validated with the full make gate, the 29-assertion Mojolicious WebSocket
callback regression on JVM and interpreter, blead Perl 5.45.4, and HTML::Tree
5.07 (989 tests on both backends).

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtimetypes/ReachabilityWalker.java      | 25 +++++++
 .../ExternalRootSnapshotCodeStateTest.java    | 69 +++++++++++++++++++
 2 files changed, 94 insertions(+)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/ExternalRootSnapshotCodeStateTest.java

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 19ed7745d7..4f18ff166a 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -2729,6 +2729,13 @@ private void walkSnapshotNode(RuntimeBase cur,
                 }
             } else if (cur instanceof RuntimeScalar sc) {
                 seedNonLexicalScalar(sc, nonLexicalTodo);
+            } else if (cur instanceof RuntimeCode code) {
+                // Callbacks can be nested several levels below a globally
+                // installed CV's persistent state (for example, a reactor
+                // timer wrapper captures the user callback). Follow the
+                // active semantic owner edges on every reached CV, not only
+                // on the initially installed one.
+                seedGlobalCodeCaptures(code, nonLexicalTodo);
             }
         }
 
@@ -2755,6 +2762,24 @@ private boolean visitExternalEdge() {
 
         private void seedGlobalCodeCaptures(RuntimeCode code,
                                             java.util.ArrayDeque<RuntimeBase> todo) {
+            // A globally installed CV owns its persistent state variables.
+            // Mojo::IOLoop keeps the singleton reactor in `state $loop`; the
+            // reactor then owns timer records and their callbacks. Omitting
+            // these edges makes an interpreter callback look unrooted when
+            // its creating frame exits, even though the installed CV's state
+            // still reaches it.
+            for (RuntimeScalar state : code.stateVariable.values()) {
+                seedNonLexicalScalar(state, todo);
+                if (!complete) return;
+            }
+            for (RuntimeArray state : code.stateArray.values()) {
+                if (!visitExternalEdge()) return;
+                addNonLexical(state, todo);
+            }
+            for (RuntimeHash state : code.stateHash.values()) {
+                if (!visitExternalEdge()) return;
+                addNonLexical(state, todo);
+            }
             if (code.capturedScalars != null) {
                 for (RuntimeScalar cap : code.capturedScalars) {
                     seedNonLexicalScalar(cap, todo);
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/ExternalRootSnapshotCodeStateTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/ExternalRootSnapshotCodeStateTest.java
new file mode 100644
index 0000000000..d41fa04f89
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/ExternalRootSnapshotCodeStateTest.java
@@ -0,0 +1,69 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import java.util.List;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("unit")
+class ExternalRootSnapshotCodeStateTest {
+    @Test
+    void installedCodeStateKeepsItsCallbackGraphAsAnExternalRoot() {
+        PerlRuntime runtime = new PerlRuntime();
+        String globalName = "ExternalRootSnapshotCodeStateTest::singleton";
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray controller = new RuntimeArray();
+            RuntimeScalar controllerCell = controller.createReference();
+
+            RuntimeCode userCallback = new RuntimeCode(null, List.of());
+            userCallback.capturedScalars = new RuntimeScalar[] { controllerCell };
+            RuntimeScalar callbackCell = new RuntimeScalar(userCallback);
+            RuntimeCode timerWrapper = new RuntimeCode(null, List.of());
+            timerWrapper.capturedScalars = new RuntimeScalar[] { callbackCell };
+            timerWrapper.closedOverVariables = new java.util.LinkedHashMap<>();
+            timerWrapper.closedOverVariables.put("$callback", callbackCell);
+            RuntimeHash timerRecord = new RuntimeHash();
+            timerRecord.elements.put("cb", new RuntimeScalar(timerWrapper));
+            RuntimeHash reactorTimers = new RuntimeHash();
+            reactorTimers.elements.put("timer", timerRecord.createReference());
+
+            RuntimeCode arrayStateCallback = new RuntimeCode(null, List.of());
+            RuntimeArray stateArray = new RuntimeArray();
+            stateArray.elements.add(new RuntimeScalar(arrayStateCallback));
+
+            RuntimeCode hashStateCallback = new RuntimeCode(null, List.of());
+            RuntimeHash stateHash = new RuntimeHash();
+            stateHash.elements.put("callback", new RuntimeScalar(hashStateCallback));
+
+            RuntimeCode singletonMethod = new RuntimeCode(null, List.of());
+            singletonMethod.stateVariable.put("loop", reactorTimers.createReference());
+            singletonMethod.stateArray.put("callbacks", stateArray);
+            singletonMethod.stateHash.put("callbacks", stateHash);
+            GlobalVariable.globalCodeRefs.put(globalName, new RuntimeScalar(singletonMethod));
+            GlobalVariable.invalidateGlobalCodeRefGraphRoots();
+
+            try {
+                ReachabilityWalker.ExternalRootSnapshot roots =
+                        new ReachabilityWalker.ExternalRootSnapshot(false);
+
+                assertTrue(roots.isReachableFromNonLexicalRoot(reactorTimers),
+                        "the installed CV's scalar state must root the singleton reactor");
+                assertTrue(roots.isReachableFromNonLexicalRoot(timerWrapper),
+                        "timer callbacks must remain reachable through the singleton reactor");
+                assertTrue(roots.isReachableFromNonLexicalRoot(userCallback),
+                        "nested user callbacks must remain reachable through their wrappers");
+                assertTrue(roots.isReachableFromNonLexicalRoot(controller),
+                        "a callback's captured controller must remain reachable");
+                assertTrue(roots.isReachableFromNonLexicalRoot(arrayStateCallback),
+                        "persistent state arrays must remain reachable");
+                assertTrue(roots.isReachableFromNonLexicalRoot(hashStateCallback),
+                        "persistent state hashes must remain reachable");
+            } finally {
+                GlobalVariable.globalCodeRefs.remove(globalName);
+                GlobalVariable.invalidateGlobalCodeRefGraphRoots();
+            }
+        }
+    }
+}

From e0bcebcbeecd94b6ce8def21683ac4b920f21af0 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 22 Oct 2026 01:51:12 +0200
Subject: [PATCH 199/317] docs: record interpreter callback lifecycle fix

Record the callback-root regression evidence, rebased candidate validation,
and the remaining Phase 2 ownership work.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 1c8d1fb36a..786f4a6bb1 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress in [draft PR #1816](https://github.com/PerlOnJava/pull/1816), based on `origin/master` at `162d8eb84`. Code commit `5d9b082b4` passes the full local `nice -n 19 make` gate and HTML::Tree 5.07 on JVM and interpreter (23 files, 989 tests each). Owner slots still bridge to `RuntimeBase.refCount` for dispatch; default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The local candidate is rebased onto `origin/master` at `8bc1c9d17`; code commit `05ca274a6` passes full `nice -n 19 make`, the 29-assertion Mojolicious WebSocket callback regression on JVM and interpreter, and HTML::Tree 5.07 on both backends (23 files, 989 tests each). Owner slots still bridge to `RuntimeBase.refCount` for dispatch; default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 candidate and ownership work are published in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). Code commit `5d9b082b4` passes full `nice -n 19 make` in 21m34s. Its 22-assertion cross-container scalar-cell alias regression passes on system Perl 5.34.1, blead Perl 5.45.4, JVM, and interpreter; the pop/delete failures were reproduced on the unfixed parent on both backends. The project-owned HTML::Tree lifecycle reproducers pass on system Perl and both PerlOnJava backends; the unfixed parent leaves two and four elements alive in the respective cases. HTML::Tree 5.07 passes all 989 tests on both backends, including unchanged `t/refloop.t`. The PR's previous head has green Ubuntu and Windows checks; checks for this commit will run after publication. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and general scalar/proxy stores, alias cleanup, and default owner-slot accounting remain unmigrated. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 candidate and ownership work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816); the local candidate is rebased onto `origin/master` at `8bc1c9d17` and is ready for publication after documentation validation. Code commit `05ca274a6` passes full `nice -n 19 make` in 19m15s. The tracked 29-assertion Mojolicious WebSocket callback test exposed an interpreter-only early controller release; the external-root snapshot now follows persistent state and nested callback ownership. The test passes on blead Perl 5.45.4 and both PerlOnJava backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends, including unchanged `t/refloop.t`. The earlier 22-assertion cross-container scalar-cell alias regression passes on system Perl 5.34.1, blead Perl 5.45.4, JVM, and interpreter; the pop/delete failures were reproduced on the unfixed parent. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and general scalar/proxy stores, alias cleanup, and default owner-slot accounting remain unmigrated. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 
@@ -187,6 +187,14 @@ The earlier candidate was based on `origin/master` (`ede542b29`) and passed the
   `69d30792f`. Legacy
   `refCount` dispatch remains; the next work is default owner-slot accounting
   across ordinary aggregate stores and cleanup.
+- [x] On 2026-10-22, fixed interpreter WebSocket callback lifetime after the
+  tracked 29-assertion regression showed that an active callback's controller
+  was destroyed early. External-root snapshots now follow persistent scalar,
+  array, and hash state on installed CVs and continue through nested callback
+  code to its captured values. The new Java regression covers that full owner
+  chain; blead Perl 5.45.4 and both PerlOnJava backends pass the WebSocket test.
+  Full `nice -n 19 make` passes in 19m15s, and HTML::Tree 5.07 passes all 989
+  tests on both backends on code commit `05ca274a6`.
 - [x] Re-read the parent issue's implementation contract and reviewed the
   independent lifecycle candidate handoff. Historical candidate test results
   are not treated as current Phase 1 evidence.
@@ -379,19 +387,21 @@ The earlier candidate was based on `origin/master` (`ede542b29`) and passed the
 
 ### Next steps
 
-1. Continue Phase 2 from slot-registration recovery to default owner-slot
+1. Publish the tested rebase and callback-lifetime fix to draft PR #1816, then
+   verify hosted CI on that exact head.
+2. Continue Phase 2 from slot-registration recovery to default owner-slot
    accounting for ordinary array/hash element stores and scalar proxies. Cover
    acquisition, transfer, replacement, deletion, aliases, and final release
    with oracle-checked refcount, weak-reference, and DESTROY assertions. Keep
    legacy dispatch and reachability bridges only at explicit unmigrated
    boundaries; use unchanged HTML-Tree as the integration guard.
-2. Resolve the strict target failures in the fresh-home CPAN release
+3. Resolve the strict target failures in the fresh-home CPAN release
    acceptance, then rerun that gate on the final candidate. The current run
    distinguishes prerequisite/setup timeouts and missing dependencies from
    runtime assertions; those outcomes do not yet satisfy #1642's acceptance.
-3. Rerun Moo and DBIx::Class after their separate tracked fixes land; classify
+4. Rerun Moo and DBIx::Class after their separate tracked fixes land; classify
    the two DBIx::Class assertions independently.
-4. Run each repository gate from an immutable commit and record before/after
+5. Run each repository gate from an immutable commit and record before/after
    evidence for each enabled path.
 
 ### Open questions and blockers

From 500d0e8b51e299fcf80bb887aa64938bd3efced5 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 22 Oct 2026 02:31:34 +0200
Subject: [PATCH 200/317] test: cover hash proxy owner slot transfers

Exercise hash proxy stores, replacement, and deletion against stable owner-slot
identity and direct referent accounting.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../RuntimeHashElementOwnershipTest.java      | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashElementOwnershipTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashElementOwnershipTest.java
index db819d47a2..5f739b6a65 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashElementOwnershipTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeHashElementOwnershipTest.java
@@ -75,6 +75,37 @@ void aliasedHashScalarTransfersEachEntrySlotWhenItsReferentChanges() {
         }
     }
 
+    @Test
+    void proxyStoreCreatesAndTransfersItsHashEntryOwnerSlot() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray first = new RuntimeArray();
+            RuntimeArray second = new RuntimeArray();
+            RuntimeHash hash = new RuntimeHash();
+            RuntimeHashProxyEntry proxy = new RuntimeHashProxyEntry(hash, "value");
+
+            proxy.set(first.createReference());
+
+            PerlOwnerSlot slot = hash.hashEntryOwnerSlot("value");
+            assertEquals(1, first.hashSlotOwnerCount(),
+                    "a proxy store into a new hash must register its referent owner");
+            assertSame(first, slot.referent());
+
+            proxy.set(second.createReference());
+
+            assertSame(slot, hash.hashEntryOwnerSlot("value"),
+                    "replacing through the proxy preserves the key's slot identity");
+            assertEquals(0, first.hashSlotOwnerCount());
+            assertEquals(1, second.hashSlotOwnerCount());
+            assertSame(second, slot.referent());
+
+            hash.elements.remove("value");
+            assertEquals(0, second.hashSlotOwnerCount(),
+                    "deleting the proxy-written entry releases its owner slot");
+            assertNull(hash.hashEntryOwnerSlot("value"));
+        }
+    }
+
     @Test
     void integerAssignmentReleasesHashEntryReferentOwner() {
         PerlRuntime runtime = new PerlRuntime();

From b17c9778a7ffe8cd4db339b1f0900cb2515fd13a Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 22 Oct 2026 05:44:48 +0200
Subject: [PATCH 201/317] refactor: track direct scalar owner slots

Add stable SCALAR_VALUE owner slots and synchronize them with legacy scalar
ownership through assignment, localization, and release. Integrate those slots
with reachable-owner counting and weak cleanup, and cover assignment transfer
and localized-value restoration.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          | 12 +++-
 .../backend/bytecode/BytecodeInterpreter.java |  2 +-
 .../backend/bytecode/SlowOpcodeHandler.java   |  2 +-
 .../runtime/operators/ReferenceOperators.java |  4 +-
 .../runtime/perlmodule/Storable.java          |  2 +-
 .../runtime/runtimetypes/DestroyDispatch.java |  2 +-
 .../runtimetypes/GlobalRuntimeScalar.java     |  4 +-
 .../runtime/runtimetypes/MortalList.java      | 14 ++--
 .../runtimetypes/MyVarCleanupStack.java       |  4 +-
 .../runtime/runtimetypes/PerlOwnerSlot.java   |  3 +-
 .../runtimetypes/ReachabilityWalker.java      |  3 +-
 .../runtime/runtimetypes/RuntimeArray.java    |  8 +--
 .../runtime/runtimetypes/RuntimeBase.java     | 18 ++++-
 .../runtimetypes/RuntimeGraphCloner.java      |  2 +-
 .../runtime/runtimetypes/RuntimeList.java     | 10 +--
 .../runtime/runtimetypes/RuntimeScalar.java   | 61 ++++++++++++++---
 .../runtime/runtimetypes/RuntimeStash.java    |  2 +-
 .../runtime/runtimetypes/WeakRefRegistry.java |  6 +-
 .../RuntimeScalarValueOwnerSlotTest.java      | 65 +++++++++++++++++++
 19 files changed, 179 insertions(+), 45 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarValueOwnerSlotTest.java

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 786f4a6bb1..8717811ccb 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,12 +107,22 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 candidate and ownership work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816); the local candidate is rebased onto `origin/master` at `8bc1c9d17` and is ready for publication after documentation validation. Code commit `05ca274a6` passes full `nice -n 19 make` in 19m15s. The tracked 29-assertion Mojolicious WebSocket callback test exposed an interpreter-only early controller release; the external-root snapshot now follows persistent state and nested callback ownership. The test passes on blead Perl 5.45.4 and both PerlOnJava backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends, including unchanged `t/refloop.t`. The earlier 22-assertion cross-container scalar-cell alias regression passes on system Perl 5.34.1, blead Perl 5.45.4, JVM, and interpreter; the pop/delete failures were reproduced on the unfixed parent. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and general scalar/proxy stores, alias cleanup, and default owner-slot accounting remain unmigrated. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). Published head `edc541242` passes the hosted Linux and Windows make gates and the Perl thread compatibility gates. The local follow-up adds stable `SCALAR_VALUE` owner slots for directly owned scalar referents and keeps those slots aligned across assignment, localization, and cleanup; full `nice -n 19 make` passes on this diff in 20m56s. The tracked 29-assertion Mojolicious WebSocket callback test passes on blead Perl 5.45.4 and both PerlOnJava backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends, including unchanged `t/refloop.t`. The earlier 22-assertion cross-container scalar-cell alias regression passes on system Perl 5.34.1, blead Perl 5.45.4, JVM, and interpreter; the pop/delete failures were reproduced on the unfixed parent. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 
 ### Completed
 
+- [x] On 2026-10-22, added stable `SCALAR_VALUE` owner slots for direct scalar
+  referents and synchronized them through assignment, postfix ownership
+  transfer, dynamic localization, and release. Reachable-owner recovery and
+  targeted weak sweeps recognize the new slot while preserving legacy
+  refcount dispatch and aggregate root-query fast paths. Two focused Java tests
+  cover stable slot transfer and localized-value restoration. Full
+  `nice -n 19 make` passes in 20m56s; the currently published PR head's Linux,
+  Windows, and thread compatibility checks pass. The default slot migration
+  remains incomplete.
+
 - [x] On 2026-10-21, corrected the array pop/shift guard after the rebased
   aggregate-alias change exposed false retention in HTML::Tree cleanup. Only
   Perl array lvalue aliases now suppress the removed slot's deferred
diff --git a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
index da39630baf..7a467e4612 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
@@ -145,7 +145,7 @@ private static void releaseConsumedTemp(RuntimeBase temp, RuntimeBase target) {
             return;
         }
 
-        tempScalar.refCountOwned = false;
+        tempScalar.setRefCountOwned(false);
         if (base.refCountTrace) {
             base.traceRefCount(-1, "BytecodeInterpreter.releaseConsumedTemp");
             base.releaseOwner(tempScalar, "releaseConsumedTemp");
diff --git a/src/main/java/org/perlonjava/backend/bytecode/SlowOpcodeHandler.java b/src/main/java/org/perlonjava/backend/bytecode/SlowOpcodeHandler.java
index 4df3e1b7af..3a2b83481f 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/SlowOpcodeHandler.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/SlowOpcodeHandler.java
@@ -1355,7 +1355,7 @@ private static void releaseHashSliceTemporaryOwner(RuntimeScalar value) {
             base.releaseOwner(value, "HASH_SLICE_SET temporary owner transfer");
             base.releaseActiveOwner(value);
             base.refCount--;
-            value.refCountOwned = false;
+            value.setRefCountOwned(false);
         }
     }
 
diff --git a/src/main/java/org/perlonjava/runtime/operators/ReferenceOperators.java b/src/main/java/org/perlonjava/runtime/operators/ReferenceOperators.java
index 6c9cf65989..6278889d08 100644
--- a/src/main/java/org/perlonjava/runtime/operators/ReferenceOperators.java
+++ b/src/main/java/org/perlonjava/runtime/operators/ReferenceOperators.java
@@ -224,7 +224,7 @@ private static RuntimeScalar bless(RuntimeScalar runtimeScalar, RuntimeScalar cl
                     // tracking wasn't active at assignment time). Count it as 1.
                     referent.refCount = 1;
                     referent.recordOwner(runtimeScalar, "rebless from untracked");
-                    runtimeScalar.refCountOwned = true;
+                    runtimeScalar.setRefCountOwned(true);
                 } else {
                     // First bless: start at refCount=1 and add to MortalList.
                     // The mortal entry will decrement back to 0 at the next
@@ -257,7 +257,7 @@ private static RuntimeScalar bless(RuntimeScalar runtimeScalar, RuntimeScalar cl
                     referent.refCount = existingScalarOwner ? 2 : 1;
                     if (existingScalarOwner) {
                         referent.recordOwner(runtimeScalar, "first bless of existing scalar ref");
-                        runtimeScalar.refCountOwned = true;
+                        runtimeScalar.setRefCountOwned(true);
                     }
                     referent.acquireTransientTraceOwner("bless mortal temporary",
                             "ReferenceOperators.first bless");
diff --git a/src/main/java/org/perlonjava/runtime/perlmodule/Storable.java b/src/main/java/org/perlonjava/runtime/perlmodule/Storable.java
index 304a964fe3..6df0595ca6 100644
--- a/src/main/java/org/perlonjava/runtime/perlmodule/Storable.java
+++ b/src/main/java/org/perlonjava/runtime/perlmodule/Storable.java
@@ -351,7 +351,7 @@ public static void releaseApplyArgs(RuntimeArray args) {
                 base.releaseOwner(elem, "Storable.releaseApplyArgs");
                 base.releaseActiveOwner(elem);
                 base.refCount--;
-                elem.refCountOwned = false;
+                elem.setRefCountOwned(false);
             }
         }
         args.elements.clear();
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
index a2810e0453..6bdeb890d3 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
@@ -533,7 +533,7 @@ private static void doCallDestroy(RuntimeBase referent, String className) {
                             }
                             base.releaseActiveOwner(elem);
                             base.refCount--;
-                            elem.refCountOwned = false;
+                            elem.setRefCountOwned(false);
                         }
                     }
                     args.elements.clear();
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/GlobalRuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/GlobalRuntimeScalar.java
index 6815630087..6d07338f93 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/GlobalRuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/GlobalRuntimeScalar.java
@@ -228,7 +228,7 @@ public void dynamicRestoreState() {
                         && localVar.value instanceof RuntimeBase base
                         && base.refCount > 0) {
                     displacedBase = base;
-                    localVar.refCountOwned = false;
+                    localVar.setRefCountOwned(false);
                     displacedBase.releaseActiveOwner(localVar);
                 }
                 if (localVar != null
@@ -283,7 +283,7 @@ public void dynamicRestoreState() {
                         localVar.value = saved.originalVariable.value;
                         localVar.blessId = saved.originalVariable.blessId;
                     }
-                    localVar.refCountOwned = false;
+                    localVar.setRefCountOwned(false);
                 }
                 if (localVar != null) {
                     localVar.scalarReferenceContentsOwner = null;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 2d98824cf6..2a301333aa 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -573,7 +573,7 @@ public static void deferDecrementIfTracked(RuntimeScalar scalar) {
                 || scalar.type == RuntimeScalarType.GLOB)
                 && scalar.value instanceof RuntimeBase base) {
             if (base.refCount > 0) {
-                scalar.refCountOwned = false;
+                scalar.setRefCountOwned(false);
                 if (base.refCountTrace) {
                     base.traceRefCount(0, "MortalList.deferDecrementIfTracked (queued, scalar.refCountOwned->false)");
                 }
@@ -592,7 +592,7 @@ public static void deferDecrementIfTracked(RuntimeScalar scalar) {
                 // that stale ownership marker and ask the reachability walker to
                 // decide at the next safe (non-nested) boundary whether the weak
                 // observers should be cleared.
-                scalar.refCountOwned = false;
+                scalar.setRefCountOwned(false);
                 if (base.refCountTrace) {
                     base.releaseOwner(scalar, "deferDecrementIfTracked zero-count owner");
                 }
@@ -934,7 +934,7 @@ public static void releaseTailCallCodeRef(RuntimeScalar codeRef) {
             return;
         }
 
-        codeRef.refCountOwned = false;
+        codeRef.setRefCountOwned(false);
         if (code.refCountTrace) {
             code.traceRefCount(-1, "MortalList.releaseTailCallCodeRef");
             code.releaseOwner(codeRef, "releaseTailCallCodeRef");
@@ -966,7 +966,7 @@ private static void releaseTailCallArgElement(RuntimeScalar scalar) {
             return;
         }
 
-        scalar.refCountOwned = false;
+        scalar.setRefCountOwned(false);
         if (base.refCountTrace) {
             base.traceRefCount(-1, "MortalList.releaseTailCallArgElement");
             base.releaseOwner(scalar, "releaseTailCallArgElement");
@@ -1054,7 +1054,7 @@ private static void deferDecrementRecursive(RuntimeScalar scalar) {
             if (base.blessId != 0) {
                 boolean releasingLastOwner = false;
                 if (s.refCountOwned && base.refCount > 0) {
-                    s.refCountOwned = false;
+                    s.setRefCountOwned(false);
                     if (base.refCountTrace) {
                         base.traceRefCount(0, "MortalList.deferDecrementRecursive (blessed, queued)");
                         base.releaseOwner(s, "deferDecrementRecursive blessed");
@@ -1102,7 +1102,7 @@ private static void deferDecrementRecursive(RuntimeScalar scalar) {
                 boolean hasCleanupTargets = hasDirectWeakElementRefs
                         || containerMayContainCleanupTargets(base);
                 if (s.refCountOwned && base.refCount > 0) {
-                    s.refCountOwned = false;
+                    s.setRefCountOwned(false);
                     if (base.refCountTrace) {
                         base.traceRefCount(0, "MortalList.deferDecrementRecursive (unblessed container, queued)");
                     }
@@ -1228,7 +1228,7 @@ public static void mortalizeForVoidDiscard(RuntimeList result) {
                         && ReachabilityWalker.isScalarReachable(scalar);
                 if (scalar.refCountOwned && base.refCount > 0 && unblessedDiscardableContainer
                         && !reachableCodeRef) {
-                    scalar.refCountOwned = false;
+                    scalar.setRefCountOwned(false);
                     if (base.refCountTrace) {
                         base.traceRefCount(0, "MortalList.mortalizeForVoidDiscard (queued owned container discard)");
                         base.releaseOwner(scalar, "mortalizeForVoidDiscard container");
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStack.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStack.java
index 807c62df40..2cdf185b95 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStack.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStack.java
@@ -362,7 +362,7 @@ public static void retainBlessedGlobAliases(RuntimeGlob glob, RuntimeBase refere
                     && scalar.value == glob
                     && !scalar.refCountOwned
                     && seen.put(scalar, Boolean.TRUE) == null) {
-                scalar.refCountOwned = true;
+                scalar.setRefCountOwned(true);
                 referent.recordOwner(scalar, "blessed glob lexical alias");
                 referent.recordActiveOwner(scalar);
                 referent.traceRefCount(+1, "MyVarCleanupStack.retainBlessedGlobAliases");
@@ -377,7 +377,7 @@ public static void retainBlessedGlobAliases(RuntimeGlob glob, RuntimeBase refere
                     && scalar.value == glob
                     && !scalar.refCountOwned
                     && seen.put(scalar, Boolean.TRUE) == null) {
-                scalar.refCountOwned = true;
+                scalar.setRefCountOwned(true);
                 referent.recordOwner(scalar, "blessed glob package alias");
                 referent.recordActiveOwner(scalar);
                 referent.traceRefCount(+1, "MyVarCleanupStack.retainBlessedGlobAliases");
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
index 5de410085a..fba3558c01 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
@@ -21,7 +21,8 @@ public enum Kind {
         CLOSURE_PAD,
         HASH_ENTRY,
         ARRAY_ELEMENT,
-        SCALAR_REFERENCE_CONTENTS
+        SCALAR_REFERENCE_CONTENTS,
+        SCALAR_VALUE
     }
 
     private final Kind kind;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 4f18ff166a..b1e122cbdf 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -3728,7 +3728,8 @@ public static ReleasedWeakSweepResult sweepReleasedWeakReferents(
         // being discarded are internal edges, not independent roots.
         for (RuntimeBase referent : referents) {
             for (PerlOwnerSlot slot : referent.ownerSlotSnapshot()) {
-                if (slot.kind() != PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS
+                if ((slot.kind() != PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS
+                        && slot.kind() != PerlOwnerSlot.Kind.SCALAR_VALUE)
                         || slot.referent() != referent) continue;
                 RuntimeScalar ownerCell = slot.ownerCell();
                 if (ownerCell == null || !live.contains(ownerCell)) continue;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
index d59d9e8341..ef274e212c 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
@@ -898,7 +898,7 @@ public static RuntimeScalar pop(RuntimeArray runtimeArray) {
                             && (result.type & RuntimeScalarType.REFERENCE_BIT) != 0
                             && result.value instanceof RuntimeBase base
                             && base.refCount > 0) {
-                        result.refCountOwned = false;
+                        result.setRefCountOwned(false);
                         runtimeArray.forgetOwnedAliasElement(result);
                         base.releaseActiveOwner(result);
                         MortalList.requestWeakSweepsForDestroyedContainer(base);
@@ -942,7 +942,7 @@ public static RuntimeScalar shift(RuntimeArray runtimeArray) {
                             && (result.type & RuntimeScalarType.REFERENCE_BIT) != 0
                             && result.value instanceof RuntimeBase base
                             && base.refCount > 0) {
-                        result.refCountOwned = false;
+                        result.setRefCountOwned(false);
                         runtimeArray.forgetOwnedAliasElement(result);
                         base.releaseActiveOwner(result);
                         MortalList.requestWeakSweepsForDestroyedContainer(base);
@@ -1964,7 +1964,7 @@ public RuntimeArray setFromListAliased(RuntimeList list) {
         // overwrites will still work correctly because setLarge checks
         // refCountOwned before decrementing.
         for (RuntimeScalar elem : this.elements) {
-            if (elem != null) elem.refCountOwned = false;
+            if (elem != null) elem.setRefCountOwned(false);
             markPackageRootedValue(elem);
         }
         this.elementsOwned = false;
@@ -1996,7 +1996,7 @@ public RuntimeArray setFromReferenceList(RuntimeList list) {
             RuntimeScalar referent = reference.refAliasScalarReference();
             this.elements.add(referent);
             markPackageRootedValue(referent);
-            referent.refCountOwned = false;
+            referent.setRefCountOwned(false);
         }
         this.elementsOwned = false;
         this.elementsAliased = true;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
index ef11397c3f..5e4f68b365 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
@@ -505,13 +505,23 @@ public synchronized java.util.Set<PerlOwnerSlot> ownerSlotSnapshot() {
      */
     public int reachableOwnerCount() {
         int count = 0;
+        Set<RuntimeScalar> scalarValueCells =
+                Collections.newSetFromMap(new IdentityHashMap<>());
+        for (PerlOwnerSlot slot : ownerSlotSnapshot()) {
+            if (slot.kind() == PerlOwnerSlot.Kind.SCALAR_VALUE
+                    && slot.referent() == this && slot.ownerCell() != null) {
+                scalarValueCells.add(slot.ownerCell());
+            }
+        }
         if (activeOwners != null) {
             java.util.Iterator<RuntimeScalar> it = activeOwners.iterator();
             while (it.hasNext()) {
                 RuntimeScalar sc = it.next();
                 if (sc != null && sc.refCountOwned && sc.value == this
                         && ReachabilityWalker.isScalarReachable(sc)) {
-                    count++;
+                    // The explicit scalar value slot is authoritative when
+                    // present; retain activeOwners only as a migration fallback.
+                    if (!scalarValueCells.contains(sc)) count++;
                 } else if (sc == null || !sc.refCountOwned || sc.value != this) {
                     it.remove();
                 }
@@ -523,11 +533,13 @@ public int reachableOwnerCount() {
         Set<Object> countedScalarReferenceCells =
                 Collections.newSetFromMap(new IdentityHashMap<>());
         for (PerlOwnerSlot slot : ownerSlotSnapshot()) {
-            if (slot.kind() != PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS
+            if ((slot.kind() != PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS
+                    && slot.kind() != PerlOwnerSlot.Kind.SCALAR_VALUE)
                     || slot.referent() != this) continue;
             RuntimeScalar ownerCell = slot.ownerCell();
             if (ownerCell == null || !ReachabilityWalker.isScalarReachable(ownerCell)) continue;
-            RuntimeScalar referenceCell = slot.scalarReferenceCell();
+            RuntimeScalar referenceCell = slot.kind() == PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS
+                    ? slot.scalarReferenceCell() : ownerCell;
             Object ownershipKey = referenceCell == null ? slot : referenceCell;
             if (countedScalarReferenceCells.add(ownershipKey)) count++;
         }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java
index 8090e1a5a7..845a342a81 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java
@@ -596,7 +596,7 @@ private void restoreScalarReferenceOwnership(RuntimeScalar source, RuntimeScalar
         referent.recordActiveOwner(target);
         referent.refCount++;
         referent.hadCountedReference = true;
-        target.refCountOwned = true;
+        target.setRefCountOwned(true);
         try (PerlRuntime.Binding ignored = targetRuntime.bind()) {
             ScalarRefRegistry.registerRef(target);
         }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
index 2d0ba54f42..4a89af947a 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
@@ -798,7 +798,7 @@ public RuntimeArray setFromList(RuntimeList value) {
                         base.releaseOwner(rhsValue, "RuntimeList materialized-copy undo (undef-target)");
                         base.releaseActiveOwner(rhsValue);
                         base.refCount--;
-                        rhsValue.refCountOwned = false;
+                        rhsValue.setRefCountOwned(false);
                     }
                     rhsIndex++;
                 }
@@ -825,7 +825,7 @@ public RuntimeArray setFromList(RuntimeList value) {
                     base.releaseOwner(assigned, "RuntimeList materialized-copy undo (scalar-target)");
                     base.releaseActiveOwner(assigned);
                     base.refCount--;
-                    assigned.refCountOwned = false;
+                    assigned.setRefCountOwned(false);
                 }
             } else if (elem instanceof RuntimeArray runtimeArray) {
                 List<RuntimeScalar> remaining = (rhsIndex < rhsSize)
@@ -852,7 +852,7 @@ public RuntimeArray setFromList(RuntimeList value) {
                             base.releaseOwner(r, "RuntimeList materialized-copy undo (array-target)");
                             base.releaseActiveOwner(r);
                             base.refCount--;
-                            r.refCountOwned = false;
+                            r.setRefCountOwned(false);
                         }
                     }
                 } else {
@@ -888,7 +888,7 @@ public RuntimeArray setFromList(RuntimeList value) {
                         base.releaseOwner(r, "RuntimeList materialized-copy undo (hash-target)");
                         base.releaseActiveOwner(r);
                         base.refCount--;
-                        r.refCountOwned = false;
+                        r.setRefCountOwned(false);
                     }
                 }
                 rhsIndex = rhsSize; // Consume the rest
@@ -1001,7 +1001,7 @@ private static void releaseDiscardedMaterializedScalar(RuntimeScalar scalar) {
             base.releaseOwner(scalar, "RuntimeList materialized-copy undo (simple-scalar-target)");
             base.releaseActiveOwner(scalar);
             base.refCount--;
-            scalar.refCountOwned = false;
+            scalar.setRefCountOwned(false);
         }
     }
 
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index f0478c3439..673eb732ff 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -853,6 +853,40 @@ void retainClosureCaptureReferentsForUnweaken() {
     public PerlOwnerSlot scalarReferenceContentsOwner;
     private java.util.Set<PerlOwnerSlot> scalarReferenceContentsOwners;
 
+    /** Explicit identity for this scalar cell's counted direct referent edge. */
+    private PerlOwnerSlot scalarValueOwnerSlot;
+
+    /** Stable slot used for the scalar cell's direct referent ownership. */
+    public PerlOwnerSlot scalarValueOwnerSlot() {
+        return scalarValueOwnerSlot;
+    }
+
+    /**
+     * Keep the owner ledger paired with the legacy scalar ownership bit while
+     * the lifecycle bridge is being migrated. This records the scalar-cell
+     * edge without changing the bridge's reference count or dispatch behavior.
+     */
+    public synchronized void setRefCountOwned(boolean owned) {
+        refCountOwned = owned;
+        syncScalarValueOwnerSlot(owned);
+    }
+
+    private void syncScalarValueOwnerSlot(boolean owned) {
+        RuntimeBase referent = owned
+                && ((type & RuntimeScalarType.REFERENCE_BIT) != 0
+                    || type == RuntimeScalarType.GLOB)
+                && value instanceof RuntimeBase base ? base : null;
+        if (referent != null) {
+            if (scalarValueOwnerSlot == null) {
+                scalarValueOwnerSlot = new PerlOwnerSlot(
+                        PerlOwnerSlot.Kind.SCALAR_VALUE, null, null, this);
+            }
+            scalarValueOwnerSlot.transferTo(referent);
+        } else if (scalarValueOwnerSlot != null) {
+            scalarValueOwnerSlot.transferTo(null);
+        }
+    }
+
     public boolean hasScalarReferenceContentsOwner() {
         return scalarReferenceContentsOwner != null
                 && scalarReferenceContentsOwner.isActive();
@@ -2351,7 +2385,7 @@ public static void incrementRefCountForContainerStore(RuntimeScalar scalar) {
         base.hadCountedReference = true;
         base.recordOwner(scalar, "incrementRefCountForContainerStore");
         base.recordActiveOwner(scalar);
-        scalar.refCountOwned = true;
+        scalar.setRefCountOwned(true);
         // Phase B1 (refcount_alignment_52leaks_plan.md): track the
         // container element so ReachabilityWalker can see it via
         // ScalarRefRegistry.
@@ -3033,6 +3067,9 @@ && scalarReferenceContentsOwnersSnapshot().isEmpty()
         this.type = value.type;
         this.value = copyScalarPayload(value.type, value.value);
         this.scalarReferenceContentsOwner = null;
+        // Install the new scalar-cell owner edge before releasing the prior
+        // referent below. DESTROY callbacks must observe the assigned value.
+        syncScalarValueOwnerSlot(newOwned);
         // An explicitly discarded closure can have an inflated CODE refcount,
         // so waiting for callDestroy() leaves its captures alive indefinitely.
         // Release them only after this slot is gone, the code is inactive, and
@@ -3338,7 +3375,7 @@ && hasLiveIo(assignedGlob)) {
         }
 
         // Update ownership: this scalar now owns a refCount iff we incremented.
-        this.refCountOwned = newOwned;
+        setRefCountOwned(newOwned);
         retainScalarReferenceContents(value);
 
         if (!scalarContentsOwners.isEmpty()) {
@@ -5192,7 +5229,7 @@ public RuntimeScalar undefine() {
             boolean releasedCode = false;
             releaseAllClosureCaptureReferents(code);
             if (this.refCountOwned && code.refCount > 0) {
-                this.refCountOwned = false;
+                this.setRefCountOwned(false);
                 code.releaseActiveOwner(this);
                 if (--code.refCount == 0) {
                     code.refCount = Integer.MIN_VALUE;
@@ -5264,7 +5301,7 @@ public RuntimeScalar undefine() {
                 oldBase.refCount = Integer.MIN_VALUE;
                 DestroyDispatch.callDestroy(oldBase);
             } else if (this.refCountOwned && oldBase.refCount > 0) {
-                this.refCountOwned = false;
+                this.setRefCountOwned(false);
                 oldBase.releaseActiveOwner(this);
                 if (--oldBase.refCount == 0) {
                     if (oldBase.localBindingExists) {
@@ -6195,9 +6232,9 @@ private RuntimeScalar postAutoIncrementLarge() {
                 // returned reference becomes the first durable owner.  The
                 // assignment receiving this scalar will balance the temporary
                 // copy, so retain one cleanup token for that returned value.
-                old.refCountOwned = true;
+                old.setRefCountOwned(true);
                 old.postfixReferenceOwnershipTransfer = true;
-                this.refCountOwned = false;
+                this.setRefCountOwned(false);
                 // Check if object is eligible for overloading
                 int blessId = blessedId(this);
                 if (blessId != 0) {
@@ -6506,9 +6543,9 @@ private RuntimeScalar postAutoDecrementWithoutWatcherNotification() {
             default -> { // All reference types
                 // See postAutoIncrementLarge(): the returned pre-mutation
                 // reference inherits this lvalue's ownership token.
-                old.refCountOwned = true;
+                old.setRefCountOwned(true);
                 old.postfixReferenceOwnershipTransfer = true;
-                this.refCountOwned = false;
+                this.setRefCountOwned(false);
                 // Check if object is eligible for overloading
                 int blessId = blessedId(this);
                 if (blessId != 0) {
@@ -6659,6 +6696,8 @@ public void dynamicSaveState() {
         // Copy the current type and value to the new state
         currentState.type = this.type;
         currentState.value = copyScalarPayload(this.type, this.value);
+        currentState.setRefCountOwned(this.refCountOwned);
+        setRefCountOwned(false);
         currentState.blessId = this.blessId;
         currentState.scalarReferenceContentsOwner = this.scalarReferenceContentsOwner;
         if (currentState.scalarReferenceContentsOwner != null) {
@@ -6728,6 +6767,8 @@ public void dynamicRestoreState() {
             // Restore the type, value from the saved state
             this.type = previousState.type;
             this.value = copyScalarPayload(previousState.type, previousState.value);
+            setRefCountOwned(previousState.refCountOwned);
+            previousState.setRefCountOwned(false);
             this.blessId = previousState.blessId;
             this.scalarReferenceContentsOwner = previousState.scalarReferenceContentsOwner;
             previousState.scalarReferenceContentsOwner = null;
@@ -6776,6 +6817,8 @@ public void dynamicRestoreState() {
     @Override
     public Object dynamicSuspendState() {
         RuntimeScalar activeState = new RuntimeScalar(this);
+        activeState.setRefCountOwned(this.refCountOwned);
+        setRefCountOwned(false);
         activeState.scalarReferenceContentsOwner = this.scalarReferenceContentsOwner;
         if (activeState.scalarReferenceContentsOwner != null) {
             activeState.scalarReferenceContentsOwner.transferScalarReferenceContentsCell(activeState);
@@ -6791,6 +6834,8 @@ public void dynamicResumeState(Object token) {
         if (token instanceof RuntimeScalar activeState) {
             this.type = activeState.type;
             this.value = copyScalarPayload(activeState.type, activeState.value);
+            setRefCountOwned(activeState.refCountOwned);
+            activeState.setRefCountOwned(false);
             this.blessId = activeState.blessId;
             this.scalarReferenceContentsOwner = activeState.scalarReferenceContentsOwner;
             activeState.scalarReferenceContentsOwner = null;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeStash.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeStash.java
index 0c26546dc2..554c36688d 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeStash.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeStash.java
@@ -264,7 +264,7 @@ private RuntimeScalar deleteGlob(String k) {
                 DestroyDispatch.callDestroy(base);
             } else if (base.refCount > 0 && savedScalar.refCountOwned) {
                 // Tracked object: decrement refCount (the stash was holding a strong ref).
-                savedScalar.refCountOwned = false;
+                savedScalar.setRefCountOwned(false);
                 base.releaseActiveOwner(savedScalar);
                 if (--base.refCount == 0) {
                     base.refCount = Integer.MIN_VALUE;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/WeakRefRegistry.java b/src/main/java/org/perlonjava/runtime/runtimetypes/WeakRefRegistry.java
index 5811970656..c6a2ce1dc9 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/WeakRefRegistry.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/WeakRefRegistry.java
@@ -163,7 +163,7 @@ private static void weaken(
             // get a double-decrement that causes premature destruction.
             // Clear refCountOwned because weaken's DEC consumes the ownership —
             // the weak scalar should not trigger another DEC on scope exit or overwrite.
-            ref.refCountOwned = false;
+            ref.setRefCountOwned(false);
             base.traceRefCount(-1, "WeakRefRegistry.weaken (decrement on weakening)");
             base.releaseOwner(ref, "weaken");
             base.releaseActiveOwner(ref);
@@ -236,7 +236,7 @@ && hasWeakRefsTo(base)
             // is still alive in the stash. This breaks Sub::Quote/Sub::Defer
             // (which use weaken() for back-references) and cascades to break
             // Moo's accessor inlining (51 test failures). See §15.
-            ref.refCountOwned = false;
+            ref.setRefCountOwned(false);
             if (base.blessId == 0
                     && (base instanceof RuntimeArray || base instanceof RuntimeHash)
                     && ReachabilityWalker.isReachableFromRoots(base)) {
@@ -318,7 +318,7 @@ public static void unweaken(RuntimeScalar ref) {
             if (base.refCount >= 0) {
                 base.traceRefCount(+1, "WeakRefRegistry.unweaken (restore strong count)");
                 base.refCount++;  // restore strong count
-                ref.refCountOwned = true;  // restore ownership
+                ref.setRefCountOwned(true);  // restore ownership
                 base.hadCountedReference = true;
                 base.recordOwner(ref, "WeakRefRegistry.unweaken");
                 base.recordActiveOwner(ref);
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarValueOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarValueOwnerSlotTest.java
new file mode 100644
index 0000000000..bf192077a3
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarValueOwnerSlotTest.java
@@ -0,0 +1,65 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertSame;
+
+@Tag("unit")
+class RuntimeScalarValueOwnerSlotTest {
+    @Test
+    void scalarAssignmentTransfersOneStableOwnerSlot() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray first = new RuntimeArray();
+            RuntimeArray second = new RuntimeArray();
+            RuntimeScalar scalar = new RuntimeScalar();
+
+            scalar.set(first.createReference());
+
+            PerlOwnerSlot slot = scalar.scalarValueOwnerSlot();
+            assertEquals(1, first.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+            assertSame(first, slot.referent());
+
+            scalar.set(second.createReference());
+
+            assertSame(slot, scalar.scalarValueOwnerSlot(),
+                    "the scalar cell keeps its owner-slot identity across assignment");
+            assertEquals(0, first.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+            assertEquals(1, second.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+            assertSame(second, slot.referent());
+
+            scalar.set(new RuntimeScalar(7));
+
+            assertEquals(0, second.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+            assertFalse(slot.isActive());
+        }
+    }
+
+    @Test
+    void localizedScalarValueKeepsItsOwnerUntilRestore() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray original = new RuntimeArray();
+            RuntimeArray localized = new RuntimeArray();
+            RuntimeScalar scalar = new RuntimeScalar();
+            scalar.set(original.createReference());
+
+            scalar.dynamicSaveState();
+            scalar.set(localized.createReference());
+
+            assertEquals(1, original.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE),
+                    "localization preserves the saved scalar value owner");
+            assertEquals(1, localized.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE),
+                    "the localized assignment owns its new referent");
+
+            scalar.dynamicRestoreState();
+
+            assertEquals(1, original.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+            assertEquals(0, localized.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+            assertSame(original, scalar.scalarValueOwnerSlot().referent());
+        }
+    }
+}

From 464a770e7d9924f64c99f27a84a812dce2ac59d2 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 22 Oct 2026 06:59:08 +0200
Subject: [PATCH 202/317] refactor: use scalar slots for weak sweep roots

Consult explicit SCALAR_VALUE owner slots before the lazy weak scalar registry
when proving direct owners during targeted weak release. Cover a strong owner
created before the first weaken and preserve the zero-snapshot fast path.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          | 12 ++++-
 .../runtimetypes/ReachabilityWalker.java      | 21 +++++++--
 ...abilityWalkerScalarValueOwnerSlotTest.java | 47 +++++++++++++++++++
 3 files changed, 74 insertions(+), 6 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerScalarValueOwnerSlotTest.java

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 8717811ccb..02ce48a5bb 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,12 +107,22 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). Published head `edc541242` passes the hosted Linux and Windows make gates and the Perl thread compatibility gates. The local follow-up adds stable `SCALAR_VALUE` owner slots for directly owned scalar referents and keeps those slots aligned across assignment, localization, and cleanup; full `nice -n 19 make` passes on this diff in 20m56s. The tracked 29-assertion Mojolicious WebSocket callback test passes on blead Perl 5.45.4 and both PerlOnJava backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends, including unchanged `t/refloop.t`. The earlier 22-assertion cross-container scalar-cell alias regression passes on system Perl 5.34.1, blead Perl 5.45.4, JVM, and interpreter; the pop/delete failures were reproduced on the unfixed parent. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). Published head `4e6873987` passed the hosted Linux make gate, but its Linux thread compatibility gate reported one `free2.t` thread failure and the Windows job was canceled. The local follow-up uses `SCALAR_VALUE` slots in the direct-owner fast path, including owners created before the weak-scalar registry is enabled; full `nice -n 19 make` and all three local `make test-threads` configurations pass. A hosted rerun is pending publication of this follow-up. The tracked 29-assertion Mojolicious WebSocket callback test passes on blead Perl 5.45.4 and both PerlOnJava backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends, including unchanged `t/refloop.t`. The earlier 22-assertion cross-container scalar-cell alias regression passes on system Perl 5.34.1, blead Perl 5.45.4, JVM, and interpreter; the pop/delete failures were reproduced on the unfixed parent. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 
 ### Completed
 
+- [x] On 2026-10-22, made the targeted weak-release direct-owner proof consult
+  explicit `SCALAR_VALUE` slots before the lazily populated scalar registry.
+  A new Java regression creates the strong scalar owner before the first
+  `weaken()` and verifies the slot preserves its referent without a root
+  snapshot. Full `nice -n 19 make` passes in 18m12s. Local
+  `nice -n 19 timeout 1800 make test-threads` passes all three configurations:
+  JVM virtual 1925/1925, interpreter virtual 1925/1925, and platform-focused
+  485/485. Hosted CI for the preceding commit had one `free2.t` failure; the
+  follow-up hosted run is pending.
+
 - [x] On 2026-10-22, added stable `SCALAR_VALUE` owner slots for direct scalar
   referents and synchronized them through assignment, postfix ownership
   transfer, dynamic localization, and release. Reachable-owner recovery and
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index b1e122cbdf..e499d38b7a 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -3649,13 +3649,24 @@ public static ReleasedWeakSweepResult sweepReleasedWeakReferents(
                     Collections.emptySet(), 0);
         }
 
-        // A registered, live, nonweak scalar with an owned direct reference is
-        // itself a root in walk(). If every released target has such an owner,
-        // no graph traversal is needed to preserve those targets. This is a
-        // deliberately narrow proof: nested container slots, exited captures,
-        // and uncounted references still use the full reachability walk below.
+        // A live, nonweak scalar value slot is itself a direct owner. Check
+        // explicit slots first so owners created before the first weaken() do
+        // not depend on ScalarRefRegistry's intentionally lazy registration.
+        // The registry remains a migration fallback for older ownership paths.
         Set<RuntimeBase> directlyOwned =
                 Collections.newSetFromMap(new IdentityHashMap<>());
+        for (RuntimeBase referent : pending) {
+            for (PerlOwnerSlot slot : referent.ownerSlotSnapshot()) {
+                if (slot.kind() != PerlOwnerSlot.Kind.SCALAR_VALUE
+                        || slot.referent() != referent) continue;
+                RuntimeScalar owner = slot.ownerCell();
+                if (owner == null || !owner.refCountOwned || owner.scopeExited
+                        || !MyVarCleanupStack.isLive(owner) || WeakRefRegistry.isweak(owner)
+                        || (owner.type & RuntimeScalarType.REFERENCE_BIT) == 0
+                        || owner.value != referent) continue;
+                directlyOwned.add(referent);
+            }
+        }
         for (RuntimeScalar owner : ScalarRefRegistry.snapshot()) {
             if (owner == null || !owner.refCountOwned || owner.scopeExited
                     || !MyVarCleanupStack.isLive(owner) || WeakRefRegistry.isweak(owner)
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerScalarValueOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerScalarValueOwnerSlotTest.java
new file mode 100644
index 0000000000..f69d63af48
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerScalarValueOwnerSlotTest.java
@@ -0,0 +1,47 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import java.util.Collections;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("unit")
+class ReachabilityWalkerScalarValueOwnerSlotTest {
+    @Test
+    void directOwnerSlotPreservesTargetCreatedBeforeWeakTracking() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray target = new RuntimeArray();
+            RuntimeScalar strongOwner = new RuntimeScalar();
+            strongOwner.set(target.createAnonymousReference());
+            MyVarCleanupStack.register(strongOwner);
+
+            RuntimeScalar weakObserver = target.createReference();
+            WeakRefRegistry.weaken(weakObserver);
+
+            assertFalse(ScalarRefRegistry.snapshot().contains(strongOwner),
+                    "the strong owner predates lazy weak-scalar registration");
+            assertTrue(strongOwner.scalarValueOwnerSlot().isActive());
+            assertEquals(1, target.refCount);
+
+            try (MortalList.ReachabilityQueryMeasurement measurement =
+                         MortalList.measureReachabilityQueries()) {
+                ReachabilityWalker.sweepReleasedWeakReferents(
+                        Collections.singleton(target));
+
+                assertEquals(1, target.refCount,
+                        "the direct scalar owner keeps the target alive");
+                assertEquals(0, measurement.stats().snapshotsBuilt,
+                        "the explicit owner slot proves the target without a root walk");
+                assertEquals(0, measurement.stats().scalarReachabilityQueries);
+            } finally {
+                WeakRefRegistry.unweaken(weakObserver);
+                MyVarCleanupStack.unregister(strongOwner);
+            }
+        }
+    }
+}

From dfc57812ef1cfd4303ffdcfec0ced3786d9cca92 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 22 Oct 2026 07:39:53 +0200
Subject: [PATCH 203/317] refactor: restore scalar owners from slots

Use reachable standalone SCALAR_VALUE slots to recover undercounted referents
when the legacy active-owner registry missed their original scalar store. Add
coverage for count restoration without a legacy owner entry.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          |  8 ++++-
 .../runtime/runtimetypes/MortalList.java      | 14 ++++++++
 ...MortalListScalarValueOwnerRestoreTest.java | 36 +++++++++++++++++++
 3 files changed, 57 insertions(+), 1 deletion(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 02ce48a5bb..6b002bbe99 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,12 +107,18 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). Published head `4e6873987` passed the hosted Linux make gate, but its Linux thread compatibility gate reported one `free2.t` thread failure and the Windows job was canceled. The local follow-up uses `SCALAR_VALUE` slots in the direct-owner fast path, including owners created before the weak-scalar registry is enabled; full `nice -n 19 make` and all three local `make test-threads` configurations pass. A hosted rerun is pending publication of this follow-up. The tracked 29-assertion Mojolicious WebSocket callback test passes on blead Perl 5.45.4 and both PerlOnJava backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends, including unchanged `t/refloop.t`. The earlier 22-assertion cross-container scalar-cell alias regression passes on system Perl 5.34.1, blead Perl 5.45.4, JVM, and interpreter; the pop/delete failures were reproduced on the unfixed parent. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). Published head `7731d3704` adds explicit scalar-slot roots to targeted weak-release checks; its local full `make` and all three local `make test-threads` configurations pass, while hosted run `39725447595` is still in progress. An unpublished follow-up restores displaced counts from standalone `SCALAR_VALUE` slots when no legacy `activeOwners` entry exists; full `nice -n 19 make` passes on that diff in 19m26s. The tracked 29-assertion Mojolicious WebSocket callback test passes on blead Perl 5.45.4 and both PerlOnJava backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends, including unchanged `t/refloop.t`. The earlier 22-assertion cross-container scalar-cell alias regression passes on system Perl 5.34.1, blead Perl 5.45.4, JVM, and interpreter; the pop/delete failures were reproduced on the unfixed parent. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 
 ### Completed
 
+- [x] On 2026-10-22, restore undercounted referents from a reachable standalone
+  `SCALAR_VALUE` slot even when the scalar predates activation of the legacy
+  `activeOwners` registry. The Java regression proves count restoration from
+  the slot with no active-owner entry. Full `nice -n 19 make` passes in 19m26s.
+  The lifecycle bridge still dispatches through `refCount`.
+
 - [x] On 2026-10-22, made the targeted weak-release direct-owner proof consult
   explicit `SCALAR_VALUE` slots before the lazily populated scalar registry.
   A new Java regression creates the strong scalar owner before the first
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 2a301333aa..6c808c9418 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -2009,6 +2009,20 @@ static boolean restoreReachableAggregateOwnerCount(RuntimeBase referent) {
                 rootedHashCells.add(cell);
             }
         }
+        // Standalone scalar slots can predate active-owner tracking, so use
+        // their explicit identity when recovering a displaced legacy count.
+        // Cells stored in aggregates are handled above or by the legacy
+        // reachability fallback to preserve the shared-root snapshot policy.
+        for (PerlOwnerSlot slot : referent.ownerSlotSnapshot()) {
+            if (slot.kind() != PerlOwnerSlot.Kind.SCALAR_VALUE
+                    || slot.referent() != referent) continue;
+            RuntimeScalar cell = slot.ownerCell();
+            if (cell == null || cell.containerOwner != null
+                    || cell.value != referent || !cell.refCountOwned
+                    || WeakRefRegistry.isweak(cell)
+                    || !ReachabilityWalker.isScalarReachable(cell)) continue;
+            rootedHashCells.add(cell);
+        }
         int owners = slotsWithoutCell + rootedHashCells.size();
         // Active scalar owners may include lexical RVs in addition to hash
         // cells. Exclude cells already counted through their explicit slots,
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java
new file mode 100644
index 0000000000..c19dbb25b9
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java
@@ -0,0 +1,36 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("unit")
+class MortalListScalarValueOwnerRestoreTest {
+    @Test
+    void standaloneScalarSlotRestoresCountWithoutActiveOwnerRegistry() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeScalar owner = new RuntimeScalar();
+            owner.set(referent.createAnonymousReference());
+            MyVarCleanupStack.register(owner);
+
+            assertEquals(0, referent.activeOwnerCount(),
+                    "the scalar was stored before active-owner tracking existed");
+            assertEquals(1, referent.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+
+            referent.refCount = 0;
+            try {
+                assertTrue(MortalList.restoreReachableAggregateOwnerCount(referent),
+                        "the explicit scalar slot supplies the lost direct owner");
+                assertEquals(1, referent.refCount);
+            } finally {
+                MyVarCleanupStack.unregister(owner);
+                MortalList.deferDecrementIfTracked(owner);
+                MortalList.flush();
+            }
+        }
+    }
+}

From e04f64730b22efb98c827e0700b72f0e96c4a1d0 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 22 Oct 2026 09:16:36 +0200
Subject: [PATCH 204/317] refactor: count scalar owners across owner ledgers

Use explicit scalar-value slots alongside the legacy active-owner registry
when cleanup and weak-CODE paths decide whether direct scalar owners remain.
Identity-union semantics avoid counting the same scalar cell twice. Add Java
regressions for owners created before tracking activation and deduplicated
owners represented in both ledgers, and record the Phase 2 progress.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          | 11 +++-
 .../runtime/runtimetypes/MortalList.java      |  4 +-
 .../runtime/runtimetypes/RuntimeBase.java     | 25 ++++++++++
 .../runtime/runtimetypes/RuntimeGlob.java     |  2 +-
 .../runtime/runtimetypes/WeakRefRegistry.java |  2 +-
 .../CountedScalarOwnerSnapshotTest.java       | 50 +++++++++++++++++++
 6 files changed, 89 insertions(+), 5 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/CountedScalarOwnerSnapshotTest.java

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 6b002bbe99..ff116f76df 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,12 +107,21 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). Published head `7731d3704` adds explicit scalar-slot roots to targeted weak-release checks; its local full `make` and all three local `make test-threads` configurations pass, while hosted run `39725447595` is still in progress. An unpublished follow-up restores displaced counts from standalone `SCALAR_VALUE` slots when no legacy `activeOwners` entry exists; full `nice -n 19 make` passes on that diff in 19m26s. The tracked 29-assertion Mojolicious WebSocket callback test passes on blead Perl 5.45.4 and both PerlOnJava backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends, including unchanged `t/refloop.t`. The earlier 22-assertion cross-container scalar-cell alias regression passes on system Perl 5.34.1, blead Perl 5.45.4, JVM, and interpreter; the pop/delete failures were reproduced on the unfixed parent. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816), currently at published head `cc4348f66`. Its Windows make and focused thread checks pass; Ubuntu make passes and its Perl thread compatibility gate is running. An unpublished follow-up now unions explicit `SCALAR_VALUE` slots with the legacy `activeOwners` registry in cleanup and weak-CODE owner decisions, with identity deduplication. The new Java tests cover a direct owner created before tracking activation and an owner represented in both ledgers. Local full `nice -n 19 make`, all three `make test-threads` configurations, and focused controller, WebSocket, tempfile, and weak-CODE lifetime suites on both backends pass on this follow-up. The tracked 29-assertion Mojolicious WebSocket callback test passes on blead Perl 5.45.4 and both PerlOnJava backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends, including unchanged `t/refloop.t`. The earlier 22-assertion cross-container scalar-cell alias regression passes on system Perl 5.34.1, blead Perl 5.45.4, JVM, and interpreter; the pop/delete failures were reproduced on the unfixed parent. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 
 ### Completed
 
+- [x] On 2026-10-22, unified direct scalar-owner queries across explicit
+  `SCALAR_VALUE` slots and the legacy active-owner registry, deduplicating by
+  scalar-cell identity. Cleanup guards, weak CODE checks, and localized CODE
+  cleanup now see owners that predate legacy tracking. The two focused Java
+  tests pass in the full `nice -n 19 make`; `make test-threads` passes JVM
+  virtual 1925/1925, interpreter virtual 1925/1925, and platform-focused
+  485/485. Eight focused lifetime regressions pass 79/79 on JVM and 73/73 on
+  the interpreter.
+
 - [x] On 2026-10-22, restore undercounted referents from a reachable standalone
   `SCALAR_VALUE` slot even when the scalar predates activation of the legacy
   `activeOwners` registry. The Java regression proves count restoration from
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 6c808c9418..324e01d3f3 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1114,7 +1114,7 @@ private static void deferDecrementRecursive(RuntimeScalar scalar) {
                         continue;
                     }
                     if (!hasCleanupTargets
-                            || base.activeOwnerCount() > 0
+                            || base.countedScalarOwnerCount() > 0
                             || (base.refCount > 1
                             && !hasDirectWeakElementRefs
                             && isReachableFromExternalRootCached(base))) {
@@ -1129,7 +1129,7 @@ && isReachableFromExternalRootCached(base))) {
                     continue;
                 } else if (base.refCount > 0
                         && (!hasCleanupTargets
-                        || base.activeOwnerCount() > 0
+                        || base.countedScalarOwnerCount() > 0
                         || (!hasDirectWeakElementRefs
                         && isReachableFromExternalRootCached(base)))) {
                     // This scalar is a non-owning copy of a still-live container.
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
index 5e4f68b365..b4b8cc3c28 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
@@ -482,6 +482,31 @@ public java.util.Set<RuntimeScalar> activeOwnerSnapshot() {
         return snapshot;
     }
 
+    /**
+     * Snapshot direct scalar owners from both the legacy registry and explicit
+     * scalar-value slots. During migration, a scalar can be present in either
+     * source or both, so the identity set forms their union.
+     */
+    public java.util.Set<RuntimeScalar> countedScalarOwnerSnapshot() {
+        java.util.Set<RuntimeScalar> snapshot = java.util.Collections.newSetFromMap(
+                new java.util.IdentityHashMap<>());
+        snapshot.addAll(activeOwnerSnapshot());
+        for (PerlOwnerSlot slot : ownerSlotSnapshot()) {
+            if (slot.kind() != PerlOwnerSlot.Kind.SCALAR_VALUE
+                    || slot.referent() != this) continue;
+            RuntimeScalar owner = slot.ownerCell();
+            if (owner != null && owner.refCountOwned && owner.value == this) {
+                snapshot.add(owner);
+            }
+        }
+        return snapshot;
+    }
+
+    /** Count direct scalar owners across the legacy and explicit ledgers. */
+    public int countedScalarOwnerCount() {
+        return countedScalarOwnerSnapshot().size();
+    }
+
     /** Snapshot semantic owner-slot identities, including closure pads. */
     public synchronized java.util.Set<PerlOwnerSlot> ownerSlotSnapshot() {
         if (ownerSlots == null || ownerSlots.isEmpty()) {
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGlob.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGlob.java
index 71b3e118f3..60034d867b 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGlob.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGlob.java
@@ -2340,7 +2340,7 @@ && hasDestroyMethod(displacedBase)) {
         }
         GlobalVariable.invalidatePackageRootSnapshot();
         if (removedLocalCodeForReachabilityCheck != null
-                && removedLocalCodeForReachabilityCheck.activeOwnerCount() == 0
+                && removedLocalCodeForReachabilityCheck.countedScalarOwnerCount() == 0
                 && !ReachabilityWalker.isReachableFromLiveScalarRegistry(removedLocalCodeForReachabilityCheck)
                 && !ReachabilityWalker.isReachableFromLiveCodeCaptures(removedLocalCodeForReachabilityCheck)
                 && !ReachabilityWalker.isReachableFromRoots(removedLocalCodeForReachabilityCheck)) {
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/WeakRefRegistry.java b/src/main/java/org/perlonjava/runtime/runtimetypes/WeakRefRegistry.java
index c6a2ce1dc9..6455b56956 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/WeakRefRegistry.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/WeakRefRegistry.java
@@ -290,7 +290,7 @@ && codeRefHasCountedOwners(base)
     }
 
     private static boolean codeRefHasCountedOwners(RuntimeBase base) {
-        return base.refCount > 0 || base.activeOwnerCount() > 0
+        return base.refCount > 0 || base.countedScalarOwnerCount() > 0
                 || base.hasSemanticCaptureOwner();
     }
 
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/CountedScalarOwnerSnapshotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/CountedScalarOwnerSnapshotTest.java
new file mode 100644
index 0000000000..ca86639690
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/CountedScalarOwnerSnapshotTest.java
@@ -0,0 +1,50 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+@Tag("unit")
+class CountedScalarOwnerSnapshotTest {
+    @Test
+    void includesDirectOwnerCreatedBeforeLegacyTracking() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeScalar owner = new RuntimeScalar();
+            owner.set(referent.createAnonymousReference());
+            MyVarCleanupStack.register(owner);
+
+            assertEquals(0, referent.activeOwnerCount(),
+                    "the direct owner predates the legacy registry");
+            assertEquals(1, referent.countedScalarOwnerCount(),
+                    "the explicit scalar slot still identifies its owner");
+
+            MyVarCleanupStack.unregister(owner);
+            MortalList.deferDecrementIfTracked(owner);
+            MortalList.flush();
+        }
+    }
+
+    @Test
+    void deduplicatesOwnerPresentInLegacyRegistryAndExplicitSlot() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            referent.activateOwnerTracking();
+            RuntimeScalar owner = new RuntimeScalar();
+            owner.set(referent.createAnonymousReference());
+            MyVarCleanupStack.register(owner);
+
+            assertEquals(1, referent.activeOwnerCount());
+            assertEquals(1, referent.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+            assertEquals(1, referent.countedScalarOwnerCount(),
+                    "the union counts one scalar cell, not both ledger entries");
+
+            MyVarCleanupStack.unregister(owner);
+            MortalList.deferDecrementIfTracked(owner);
+            MortalList.flush();
+        }
+    }
+}

From 8eba13917c6469a7f6c24453c27008d927c4b861 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 22 Oct 2026 10:47:59 +0200
Subject: [PATCH 205/317] refactor: include scalar slots in destruction owner
 checks

Use the explicit scalar-owner slots with the legacy owner registry when
checking DESTROY-time resurrection and restoring reachable deferred counts.
This keeps owners visible when the compatibility registry missed their
creation, while identity snapshots prevent duplicate scalar-cell counts.
Add a focused regression for a package-rooted scalar slot with no legacy entry.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          |  9 +++-
 .../runtime/runtimetypes/DestroyDispatch.java |  4 +-
 .../runtime/runtimetypes/MortalList.java      |  2 +-
 .../DestroyDispatchScalarSlotRootTest.java    | 48 +++++++++++++++++++
 4 files changed, 59 insertions(+), 4 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchScalarSlotRootTest.java

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index ff116f76df..7c4880db37 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,12 +107,19 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816), currently at published head `cc4348f66`. Its Windows make and focused thread checks pass; Ubuntu make passes and its Perl thread compatibility gate is running. An unpublished follow-up now unions explicit `SCALAR_VALUE` slots with the legacy `activeOwners` registry in cleanup and weak-CODE owner decisions, with identity deduplication. The new Java tests cover a direct owner created before tracking activation and an owner represented in both ledgers. Local full `nice -n 19 make`, all three `make test-threads` configurations, and focused controller, WebSocket, tempfile, and weak-CODE lifetime suites on both backends pass on this follow-up. The tracked 29-assertion Mojolicious WebSocket callback test passes on blead Perl 5.45.4 and both PerlOnJava backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends, including unchanged `t/refloop.t`. The earlier 22-assertion cross-container scalar-cell alias regression passes on system Perl 5.34.1, blead Perl 5.45.4, JVM, and interpreter; the pop/delete failures were reproduced on the unfixed parent. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The last published head, `beda5b8bc`, passed hosted run `39739447750` on Linux and Windows, including the Perl thread compatibility gates. The current local batch also migrates destructor owner-delta checks and deferred-count restoration to the identity union of explicit `SCALAR_VALUE` slots and legacy `activeOwners`. Its Java regression simulates a rooted direct owner missing from the compatibility registry. Full `nice -n 19 make` passes in 56m43s; the focused global-destruction, tempfile, and controller-owner suite passes 36/36 on both backends. The previous owner-query slice passed local `make test-threads` in all three configurations and the controller, WebSocket, tempfile, and weak-CODE lifetime suites on both backends. The tracked 29-assertion Mojolicious WebSocket callback test passes on blead Perl 5.45.4 and both PerlOnJava backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends, including unchanged `t/refloop.t`. The earlier 22-assertion cross-container scalar-cell alias regression passes on system Perl 5.34.1, blead Perl 5.45.4, JVM, and interpreter; the pop/delete failures were reproduced on the unfixed parent. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 
 ### Completed
 
+- [x] On 2026-10-22, used the scalar-owner identity union in global
+  destruction owner-delta checks and `MortalList` deferred-count restoration.
+  The new Java regression proves that a package-rooted scalar slot still
+  counts when its legacy registry entry is missing. Full `nice -n 19 make`
+  passes in 56m43s; the global-destruction, tempfile, and controller-owner
+  regressions pass 36/36 on both JVM and interpreter backends.
+
 - [x] On 2026-10-22, unified direct scalar-owner queries across explicit
   `SCALAR_VALUE` slots and the legacy active-owner registry, deduplicating by
   scalar-cell identity. Cleanup guards, weak CODE checks, and localized CODE
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
index 6bdeb890d3..77e614d2bf 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
@@ -429,7 +429,7 @@ private static void doCallDestroy(RuntimeBase referent, String className) {
         Set<PerlOwnerSlot> ownerSlotsAtStart = null;
         if (checkingGlobalOwnerDelta) {
             referent.activateOwnerTracking();
-            activeOwnersAtStart = referent.activeOwnerSnapshot();
+            activeOwnersAtStart = referent.countedScalarOwnerSnapshot();
             ownerSlotsAtStart = referent.ownerSlotSnapshot();
         }
 
@@ -708,7 +708,7 @@ static boolean hasEscapedPerlOwner(RuntimeBase referent,
                                                 Set<RuntimeScalar> activeOwnersAtStart,
                                                 Set<PerlOwnerSlot> ownerSlotsAtStart) {
         if (checkingGlobalOwnerDelta) {
-            for (RuntimeScalar owner : referent.activeOwnerSnapshot()) {
+            for (RuntimeScalar owner : referent.countedScalarOwnerSnapshot()) {
                 // DESTROY commonly creates short-lived aliases while it calls
                 // methods on $self. They are new ledger entries, but they do
                 // not resurrect the object if their Perl slots are gone by the
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 324e01d3f3..ec0dc20381 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -2028,7 +2028,7 @@ static boolean restoreReachableAggregateOwnerCount(RuntimeBase referent) {
         // cells. Exclude cells already counted through their explicit slots,
         // then add other still-reachable scalar owners to avoid losing them
         // when restoring the mixed legacy/native count.
-        for (RuntimeScalar scalar : referent.activeOwnerSnapshot()) {
+        for (RuntimeScalar scalar : referent.countedScalarOwnerSnapshot()) {
             if (scalar == null || rootedHashCells.contains(scalar)
                     || !scalar.refCountOwned || scalar.value != referent
                     || !ReachabilityWalker.isScalarReachable(scalar)) {
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchScalarSlotRootTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchScalarSlotRootTest.java
new file mode 100644
index 0000000000..ad1baed523
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchScalarSlotRootTest.java
@@ -0,0 +1,48 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import java.util.Collections;
+import java.util.IdentityHashMap;
+import java.util.Set;
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("unit")
+class DestroyDispatchScalarSlotRootTest {
+    @Test
+    void packageRootedScalarSlotCountsWhenLegacyOwnerEntryIsMissing() {
+        PerlRuntime runtime = new PerlRuntime();
+        String globalName = "DestroyDispatchScalarSlotRootTest::owner";
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            referent.activateOwnerTracking();
+            RuntimeScalar owner = new RuntimeScalar();
+            owner.set(referent.createReference());
+            RuntimeHash globalHash = new RuntimeHash();
+            globalHash.isGlobalPackageHash = true;
+            GlobalVariable.globalHashes.put(globalName, globalHash);
+            globalHash.elements.put("owner", owner);
+            referent.releaseActiveOwner(owner);
+
+            Set<RuntimeScalar> noScalarOwnersAtStart =
+                    Collections.newSetFromMap(new IdentityHashMap<>());
+            Set<PerlOwnerSlot> noOwnerSlotsAtStart =
+                    Collections.newSetFromMap(new IdentityHashMap<>());
+            try {
+                assertEquals(0, referent.activeOwnerCount(),
+                        "the fixture removes the compatibility-ledger entry");
+                assertEquals(1, referent.countedScalarOwnerCount(),
+                        "the direct scalar slot remains authoritative");
+                assertTrue(DestroyDispatch.hasEscapedPerlOwner(
+                                referent, true, noScalarOwnersAtStart, noOwnerSlotsAtStart),
+                        "the rooted scalar slot is visible to destructor owner-delta checks");
+            } finally {
+                globalHash.elements.clear();
+                GlobalVariable.globalHashes.remove(globalName);
+                owner.set(new RuntimeScalar());
+            }
+        }
+    }
+}

From 60a07ab7811537b4e1ca4cbbb9b31f7ccd8bd032 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 22 Oct 2026 14:40:05 +0200
Subject: [PATCH 206/317] fix: synchronize scalar owner ledger snapshots

Protect the legacy identity owner registry from concurrent mutation while
counting or snapshotting scalar owners. Move reachable-owner graph walks
outside the registry lock to avoid holding it across recursive cleanup reads.
Add a Java regression that overlaps owner registration and release with
concurrent snapshots.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          | 12 +++-
 docs/about/changelog.md                       |  1 +
 .../runtime/runtimetypes/RuntimeBase.java     | 39 +++++-----
 ...untimeBaseActiveOwnersConcurrencyTest.java | 72 +++++++++++++++++++
 4 files changed, 107 insertions(+), 17 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeBaseActiveOwnersConcurrencyTest.java

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 7c4880db37..ec79992d99 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,12 +107,22 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The last published head, `beda5b8bc`, passed hosted run `39739447750` on Linux and Windows, including the Perl thread compatibility gates. The current local batch also migrates destructor owner-delta checks and deferred-count restoration to the identity union of explicit `SCALAR_VALUE` slots and legacy `activeOwners`. Its Java regression simulates a rooted direct owner missing from the compatibility registry. Full `nice -n 19 make` passes in 56m43s; the focused global-destruction, tempfile, and controller-owner suite passes 36/36 on both backends. The previous owner-query slice passed local `make test-threads` in all three configurations and the controller, WebSocket, tempfile, and weak-CODE lifetime suites on both backends. The tracked 29-assertion Mojolicious WebSocket callback test passes on blead Perl 5.45.4 and both PerlOnJava backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends, including unchanged `t/refloop.t`. The earlier 22-assertion cross-container scalar-cell alias regression passes on system Perl 5.34.1, blead Perl 5.45.4, JVM, and interpreter; the pop/delete failures were reproduced on the unfixed parent. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). Published head `49101b39c` passed hosted run `39750508940` attempt 2 on Linux and Windows, including the Perl thread compatibility gates. The current local batch also migrates destructor owner-delta checks and deferred-count restoration to the identity union of explicit `SCALAR_VALUE` slots and legacy `activeOwners`. Its Java regression simulates a rooted direct owner missing from the compatibility registry. Full `nice -n 19 make` passes in 56m43s; the focused global-destruction, tempfile, and controller-owner suite passes 36/36 on both backends. The previous owner-query slice passed local `make test-threads` in all three configurations and the controller, WebSocket, tempfile, and weak-CODE lifetime suites on both backends. The tracked 29-assertion Mojolicious WebSocket callback test passes on blead Perl 5.45.4 and both PerlOnJava backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends, including unchanged `t/refloop.t`. The earlier 22-assertion cross-container scalar-cell alias regression passes on system Perl 5.34.1, blead Perl 5.45.4, JVM, and interpreter; the pop/delete failures were reproduced on the unfixed parent. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 
 ### Completed
 
+- [x] On 2026-10-22, synchronized mutation and snapshot operations on the
+  legacy direct-scalar-owner registry and changed `reachableOwnerCount()` to
+  snapshot before graph walks. The new Java concurrency regression passes in
+  the full `nice -n 19 make` (22m39s). The same candidate passes `make
+  test-threads` in all three configurations: JVM virtual 1925/1925,
+  interpreter virtual 1925/1925, and platform-focused 485/485. The first local
+  thread-gate attempt lacked write access to the external Perl checkout; the
+  passing rerun used extended access. The published PR head's CI rerun also
+  passes on both platforms; this local batch still needs hosted validation.
+
 - [x] On 2026-10-22, used the scalar-owner identity union in global
   destruction owner-delta checks and `MortalList` deferred-count restoration.
   The new Java regression proves that a package-rooted scalar slot still
diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index 5ed4cb336f..efb0bb0476 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -44,6 +44,7 @@ priorities and future plans.
 - Prefer exact root-module package declarations over earlier helper packages, and warn for undefined hash keys used by `exists` and `delete` (#1820, #1645).
 - Add a reproducible, warmup-aware Perl versus PerlOnJava performance runner (#1196).
 - Preserve CODE callback captures while Perl container slots still own the callback; restore rooted hash-entry and package-rooted, registered lexical, or closure-captured array-element owners when a legacy deferred decrement undercounts them; register array-element owners after lvalue-proxy stores, scalar and aggregate refaliasing, and scalar-reference creation into new arrays; count scalar-reference contents once when multiple references alias the same scalar cell; release closure-captured request graphs once their scopes end, even when large root walks exceed the cached-snapshot limit; avoid false global-destruction resurrection warnings when bounded owner proofs scan large package graphs; keep stat's filehandle cache from extending temporary glob lifetimes (#1649, #1794, #1795).
+- Serialize legacy scalar-owner registry updates and snapshots so concurrent thread cleanup cannot invalidate owner-ledger iteration (#1649).
 - Implement Perl's writable `Internals::SvREFCNT` form while keeping B::SV's private query mode separate (#1649).
 - Cover FormState session restoration across requests and HTTP response conversion from callback and streaming PSGI responses; refresh HTTP::Message and LWP compatibility status (#1650, #1651, #1652).
 - Preserve the awaited Future value when its source scalar or aggregate slot changes during suspension, covering PAGI::Server request-body receives (#1818).
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
index b4b8cc3c28..76310b5bb0 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
@@ -428,7 +428,7 @@ private static void addTiedHandlerReferent(
         }
     }
 
-    public void activateOwnerTracking() {
+    public synchronized void activateOwnerTracking() {
         if (activeOwners == null) {
             activeOwners = java.util.Collections.newSetFromMap(new java.util.IdentityHashMap<>());
             // Note: backfilling from ScalarRefRegistry.snapshot() was
@@ -442,19 +442,19 @@ public void activateOwnerTracking() {
         }
     }
 
-    public void recordActiveOwner(RuntimeScalar scalar) {
+    public synchronized void recordActiveOwner(RuntimeScalar scalar) {
         if (activeOwners != null) {
             activeOwners.add(scalar);
         }
     }
 
-    public void releaseActiveOwner(RuntimeScalar scalar) {
+    public synchronized void releaseActiveOwner(RuntimeScalar scalar) {
         if (activeOwners != null) {
             activeOwners.remove(scalar);
         }
     }
 
-    public int activeOwnerCount() {
+    public synchronized int activeOwnerCount() {
         if (activeOwners == null) return 0;
         // Filter for actual still-owning scalars: refCountOwned=true and
         // value==this. Stale entries (overwritten without going through a
@@ -474,7 +474,7 @@ public int activeOwnerCount() {
     }
 
     /** Snapshot the currently live scalar owner slots by identity. */
-    public java.util.Set<RuntimeScalar> activeOwnerSnapshot() {
+    public synchronized java.util.Set<RuntimeScalar> activeOwnerSnapshot() {
         if (activeOwnerCount() == 0) return java.util.Collections.emptySet();
         java.util.Set<RuntimeScalar> snapshot = java.util.Collections.newSetFromMap(
                 new java.util.IdentityHashMap<>());
@@ -538,17 +538,24 @@ public int reachableOwnerCount() {
                 scalarValueCells.add(slot.ownerCell());
             }
         }
-        if (activeOwners != null) {
-            java.util.Iterator<RuntimeScalar> it = activeOwners.iterator();
-            while (it.hasNext()) {
-                RuntimeScalar sc = it.next();
-                if (sc != null && sc.refCountOwned && sc.value == this
-                        && ReachabilityWalker.isScalarReachable(sc)) {
-                    // The explicit scalar value slot is authoritative when
-                    // present; retain activeOwners only as a migration fallback.
-                    if (!scalarValueCells.contains(sc)) count++;
-                } else if (sc == null || !sc.refCountOwned || sc.value != this) {
-                    it.remove();
+        // Snapshot under the same monitor used by register/release operations.
+        // Reachability queries can walk large graphs, so do them after dropping
+        // the monitor; this avoids both fail-fast iteration and lock inversion
+        // between concurrently cleaned referents.
+        java.util.List<RuntimeScalar> legacyOwners;
+        synchronized (this) {
+            legacyOwners = activeOwners == null
+                    ? java.util.List.of() : new java.util.ArrayList<>(activeOwners);
+        }
+        for (RuntimeScalar sc : legacyOwners) {
+            if (sc != null && sc.refCountOwned && sc.value == this
+                    && ReachabilityWalker.isScalarReachable(sc)) {
+                // The explicit scalar value slot is authoritative when
+                // present; retain activeOwners only as a migration fallback.
+                if (!scalarValueCells.contains(sc)) count++;
+            } else if (sc == null || !sc.refCountOwned || sc.value != this) {
+                synchronized (this) {
+                    if (activeOwners != null) activeOwners.remove(sc);
                 }
             }
         }
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeBaseActiveOwnersConcurrencyTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeBaseActiveOwnersConcurrencyTest.java
new file mode 100644
index 0000000000..ea12f4b4c0
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeBaseActiveOwnersConcurrencyTest.java
@@ -0,0 +1,72 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.Future;
+import java.util.concurrent.TimeUnit;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("unit")
+class RuntimeBaseActiveOwnersConcurrencyTest {
+    @Test
+    void concurrentOwnerRegistrationAndSnapshotsRemainSafe() throws Exception {
+        RuntimeArray referent = new RuntimeArray();
+        referent.activateOwnerTracking();
+
+        int workerCount = 8;
+        ExecutorService workers = Executors.newFixedThreadPool(workerCount + 2);
+        CountDownLatch ready = new CountDownLatch(workerCount + 2);
+        CountDownLatch start = new CountDownLatch(1);
+        try {
+            List<Future<Void>> tasks = new ArrayList<>();
+            for (int worker = 0; worker < workerCount; worker++) {
+                RuntimeScalar owner = new RuntimeScalar();
+                owner.value = referent;
+                owner.refCountOwned = true;
+                tasks.add(workers.submit(() -> {
+                    ready.countDown();
+                    if (!start.await(5, TimeUnit.SECONDS)) {
+                        throw new AssertionError("owner workers did not start");
+                    }
+                    for (int i = 0; i < 10_000; i++) {
+                        referent.recordActiveOwner(owner);
+                        if ((i & 1) == 0) {
+                            referent.activeOwnerCount();
+                            referent.activeOwnerSnapshot();
+                        }
+                        referent.releaseActiveOwner(owner);
+                    }
+                    return null;
+                }));
+            }
+            for (int reader = 0; reader < 2; reader++) {
+                tasks.add(workers.submit(() -> {
+                    ready.countDown();
+                    if (!start.await(5, TimeUnit.SECONDS)) {
+                        throw new AssertionError("owner readers did not start");
+                    }
+                    for (int i = 0; i < 10_000; i++) {
+                        referent.activeOwnerCount();
+                        referent.activeOwnerSnapshot();
+                        referent.countedScalarOwnerSnapshot();
+                    }
+                    return null;
+                }));
+            }
+
+            assertTrue(ready.await(5, TimeUnit.SECONDS), "all owner workers should be ready");
+            start.countDown();
+            for (Future<Void> task : tasks) task.get(20, TimeUnit.SECONDS);
+            assertTrue(referent.activeOwnerSnapshot().isEmpty());
+        } finally {
+            workers.shutdownNow();
+        }
+    }
+}

From 677f1f61664d69ec50c05bc206c5c9af1916c909 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 22 Oct 2026 15:04:25 +0200
Subject: [PATCH 207/317] ci: trigger validation for owner ledger fix

The source tree is unchanged from the locally validated owner-ledger fix.
Trigger the pull-request workflow for the published candidate.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>

From 9139c3b17e13f07a6d24f820c34f82e9ed071b9c Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 22 Oct 2026 17:46:47 +0200
Subject: [PATCH 208/317] fix: synchronize destroyable closure owner index

Protect reverse-index updates while ithread cloning and temporary closure
release run concurrently. Add a focused regression for simultaneous capture
owner releases.

Generated with OpenAI Codex (https://openai.com/codex)

Co-Authored-By: OpenAI Codex <openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md          | 10 +++
 docs/about/changelog.md                       |  1 +
 .../runtime/runtimetypes/RuntimeScalar.java   | 24 ++++---
 ...stroyableClosureOwnersConcurrencyTest.java | 69 +++++++++++++++++++
 4 files changed, 93 insertions(+), 11 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarDestroyableClosureOwnersConcurrencyTest.java

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index ec79992d99..eac3b9ebb9 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -113,6 +113,16 @@ The earlier candidate was based on `origin/master` (`ede542b29`) and passed the
 
 ### Completed
 
+- [x] On 2026-10-22, synchronized the per-scalar reverse index of destroyable
+  closure owners. Ithread cloning and parent-side temporary closure release
+  could concurrently mutate its `ArrayList`, producing an intermittent
+  `ConcurrentModificationException` in `threads-shared/t/object.t`. A focused
+  Java regression races reverse-index releases. The external test passed 28/28
+  when rerun alone. The bundled Java regression passes in full `nice -n 19
+  make` (15m59s); `make test-threads` passes JVM virtual 1925/1925, interpreter
+  virtual 1925/1925, and platform-focused 485/485. This batch is pending
+  hosted CI.
+
 - [x] On 2026-10-22, synchronized mutation and snapshot operations on the
   legacy direct-scalar-owner registry and changed `reachableOwnerCount()` to
   snapshot before graph walks. The new Java concurrency regression passes in
diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index efb0bb0476..fb408a3efb 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -21,6 +21,7 @@ priorities and future plans.
 - Run standard Perl's `cpan -t Module` for CPAN oracle checks and keep download failures inconclusive instead of reporting missing local modules as Perl failures.
 - Keep lexical-registration membership checks constant-time, avoiding quadratic CPAN index parsing as cleanup stacks grow.
 - Keep a referent alive while another owning array or hash slot still aliases its scalar cell after `pop`, `shift`, or `delete` (#1649).
+- Synchronize the destroyable-closure reverse index so ithread capture cloning and release can update it safely.
 - Preserve numeric types of cached read-only scalars in ranges, rejecting unsigned endpoints outside the supported integer range.
 - Improve JVM execution performance for the bit-packed Life example, ordinary scalar assignments, and common blessing lookups.
 - Reuse private one-scalar wrappers when materializing scalar returns, reducing result-list allocations across JVM calls.
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 673eb732ff..b8aac66854 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -656,7 +656,7 @@ public void releaseClosureCapture(RuntimeCode closureOwner) {
         releaseClosureCapture();
     }
 
-    private void recordDestroyableClosureOwner(RuntimeCode closureOwner) {
+    private synchronized void recordDestroyableClosureOwner(RuntimeCode closureOwner) {
         if (closureOwner == null || WeakRefRegistry.isweak(this)
                 || !(value instanceof RuntimeBase referent) || referent.blessId == 0) {
             return;
@@ -677,7 +677,7 @@ private void recordDestroyableClosureOwner(RuntimeCode closureOwner) {
         destroyableClosureOwners.add(new WeakReference<>(closureOwner));
     }
 
-    private void forgetDestroyableClosureOwner(RuntimeCode closureOwner) {
+    private synchronized void forgetDestroyableClosureOwner(RuntimeCode closureOwner) {
         if (closureOwner == null || destroyableClosureOwners == null) return;
         destroyableClosureOwners.removeIf(reference -> {
             RuntimeCode existing = reference.get();
@@ -688,16 +688,18 @@ private void forgetDestroyableClosureOwner(RuntimeCode closureOwner) {
 
     boolean releaseUnreachableDestroyableClosureOwners(
             ReachabilityWalker.ScalarRootReachabilitySnapshot roots) {
-        if (roots == null || !roots.complete() || destroyableClosureOwners == null) return false;
         List<RuntimeCode> unreachable = new ArrayList<>();
-        List<WeakReference<RuntimeCode>> retained = new ArrayList<>();
-        for (WeakReference<RuntimeCode> reference : destroyableClosureOwners) {
-            RuntimeCode owner = reference.get();
-            if (owner == null) continue;
-            if (roots.isReachable(owner)) retained.add(reference);
-            else unreachable.add(owner);
-        }
-        destroyableClosureOwners = retained.isEmpty() ? null : retained;
+        synchronized (this) {
+            if (roots == null || !roots.complete() || destroyableClosureOwners == null) return false;
+            List<WeakReference<RuntimeCode>> retained = new ArrayList<>();
+            for (WeakReference<RuntimeCode> reference : destroyableClosureOwners) {
+                RuntimeCode owner = reference.get();
+                if (owner == null) continue;
+                if (roots.isReachable(owner)) retained.add(reference);
+                else unreachable.add(owner);
+            }
+            destroyableClosureOwners = retained.isEmpty() ? null : retained;
+        }
         for (RuntimeCode owner : unreachable) {
             if (owner.capturedScalars != null || owner.capturedAggregates != null) {
                 owner.releaseCaptures();
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarDestroyableClosureOwnersConcurrencyTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarDestroyableClosureOwnersConcurrencyTest.java
new file mode 100644
index 0000000000..5118bc5289
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarDestroyableClosureOwnersConcurrencyTest.java
@@ -0,0 +1,69 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import java.lang.ref.WeakReference;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.Future;
+import java.util.concurrent.TimeUnit;
+
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+@Tag("unit")
+class RuntimeScalarDestroyableClosureOwnersConcurrencyTest {
+    @Test
+    void concurrentCaptureReleaseDoesNotMutateTheReverseIndexDuringIteration() throws Exception {
+        RuntimeScalar scalar = new RuntimeScalar();
+        int workerCount = 12;
+        List<RuntimeCode> owners = new ArrayList<>(workerCount);
+        List<WeakReference<RuntimeCode>> references = new ArrayList<>(workerCount * 2_000);
+        for (int i = 0; i < workerCount; i++) owners.add(new RuntimeCode(null, List.of()));
+        for (int repeat = 0; repeat < 2_000; repeat++) {
+            for (RuntimeCode owner : owners) references.add(new WeakReference<>(owner));
+        }
+
+        Field index = RuntimeScalar.class.getDeclaredField("destroyableClosureOwners");
+        index.setAccessible(true);
+        index.set(scalar, references);
+        Method forgetOwner = RuntimeScalar.class.getDeclaredMethod(
+                "forgetDestroyableClosureOwner", RuntimeCode.class);
+        forgetOwner.setAccessible(true);
+
+        ExecutorService workers = Executors.newFixedThreadPool(workerCount);
+        CountDownLatch ready = new CountDownLatch(workerCount);
+        CountDownLatch start = new CountDownLatch(1);
+        try {
+            List<Future<?>> tasks = new ArrayList<>();
+            for (RuntimeCode owner : owners) {
+                tasks.add(workers.submit(() -> {
+                    ready.countDown();
+                    if (!start.await(5, TimeUnit.SECONDS)) {
+                        throw new AssertionError("capture-release workers did not start");
+                    }
+                    try {
+                        forgetOwner.invoke(scalar, owner);
+                    } catch (ReflectiveOperationException failure) {
+                        throw new AssertionError(failure.getCause() == null
+                                ? failure : failure.getCause());
+                    }
+                    return null;
+                }));
+            }
+            if (!ready.await(5, TimeUnit.SECONDS)) {
+                throw new AssertionError("capture-release workers were not ready");
+            }
+            start.countDown();
+            for (Future<?> task : tasks) task.get(10, TimeUnit.SECONDS);
+            assertNull(index.get(scalar), "the final released owner clears the reverse index");
+        } finally {
+            workers.shutdownNow();
+        }
+    }
+}

From 009b76ab9ba3bcec81ebc1f5e964add551ffe914 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 22 Oct 2026 19:37:29 +0200
Subject: [PATCH 209/317] perf: follow scalar slots in aggregate owner recovery

Follow scalar-value and scalar-reference contents slots through their live
container or lexical root before falling back to a whole-root graph walk.
Add a regression asserting exact aggregate-owner recovery without snapshots.

Generated with OpenAI Codex (https://openai.com/codex)

Co-Authored-By: OpenAI Codex <openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md          | 16 ++++++-
 docs/about/changelog.md                       |  1 +
 .../runtime/runtimetypes/MortalList.java      | 45 ++++++++++++++----
 ...alListAggregateOwnerSlotRootChainTest.java | 47 +++++++++++++++++++
 4 files changed, 97 insertions(+), 12 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index eac3b9ebb9..9d5117e702 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The local candidate is rebased onto `origin/master` at `8bc1c9d17`; code commit `05ca274a6` passes full `nice -n 19 make`, the 29-assertion Mojolicious WebSocket callback regression on JVM and interpreter, and HTML::Tree 5.07 on both backends (23 files, 989 tests each). Owner slots still bridge to `RuntimeBase.refCount` for dispatch; default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The candidate is rebased onto `origin/master` at `2c5ae8623`; published head `d0ca1607f` passes hosted run `39808119318` on Linux and Windows. The latest local batch passes full `nice -n 19 make`, `make test-threads` in all three configurations, and the ordinary aggregate ownership regression on blead Perl and both backends. Owner slots still bridge to `RuntimeBase.refCount` for dispatch; default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,7 +107,19 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). Published head `49101b39c` passed hosted run `39750508940` attempt 2 on Linux and Windows, including the Perl thread compatibility gates. The current local batch also migrates destructor owner-delta checks and deferred-count restoration to the identity union of explicit `SCALAR_VALUE` slots and legacy `activeOwners`. Its Java regression simulates a rooted direct owner missing from the compatibility registry. Full `nice -n 19 make` passes in 56m43s; the focused global-destruction, tempfile, and controller-owner suite passes 36/36 on both backends. The previous owner-query slice passed local `make test-threads` in all three configurations and the controller, WebSocket, tempfile, and weak-CODE lifetime suites on both backends. The tracked 29-assertion Mojolicious WebSocket callback test passes on blead Perl 5.45.4 and both PerlOnJava backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends, including unchanged `t/refloop.t`. The earlier 22-assertion cross-container scalar-cell alias regression passes on system Perl 5.34.1, blead Perl 5.45.4, JVM, and interpreter; the pop/delete failures were reproduced on the unfixed parent. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch is rebased onto `origin/master` at `2c5ae8623`; published head `d0ca1607f` passes hosted run `39808119318` on Linux and Windows, including both thread compatibility gates. The local rebased candidate also passes full `nice -n 19 make`, all three local thread configurations, and the focused lifetime regressions recorded below. The tracked Mojolicious WebSocket callback test passes on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+
+### Current batch
+
+- Followed `SCALAR_VALUE` and `SCALAR_REFERENCE_CONTENTS` slots from an
+  aggregate toward their containing aggregate or live lexical root. Deferred
+  aggregate-owner recovery now avoids whole-root walks when the path passes
+  through an ordinary scalar owner. The Java regression proves exact count
+  restoration with zero graph snapshots. Full `nice -n 19 make` passes in
+  17m55s; `make test-threads` passes JVM virtual 1925/1925, interpreter
+  virtual 1925/1925, and platform-focused 485/485. The 15-assertion ordinary
+  aggregate refcount/destruction test passes on blead Perl 5.45.4 and both
+  PerlOnJava backends. Hosted CI for this follow-up is pending.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 
diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index fb408a3efb..68d0407ed6 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -22,6 +22,7 @@ priorities and future plans.
 - Keep lexical-registration membership checks constant-time, avoiding quadratic CPAN index parsing as cleanup stacks grow.
 - Keep a referent alive while another owning array or hash slot still aliases its scalar cell after `pop`, `shift`, or `delete` (#1649).
 - Synchronize the destroyable-closure reverse index so ithread capture cloning and release can update it safely.
+- Follow scalar owner slots during aggregate lifetime recovery, avoiding a whole-root walk for nested scalar-owned containers.
 - Preserve numeric types of cached read-only scalars in ranges, rejecting unsigned endpoints outside the supported integer range.
 - Improve JVM execution performance for the bit-packed Life example, ordinary scalar assignments, and common blessing lookups.
 - Reuse private one-scalar wrappers when materializing scalar returns, reducing result-list allocations across JVM calls.
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index ec0dc20381..b8db4695bd 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -2043,10 +2043,10 @@ static boolean restoreReachableAggregateOwnerCount(RuntimeBase referent) {
 
     /**
      * Prove aggregate ownership by following registered owner slots toward a
-     * Perl root. Nested hash/array stores already record each direct edge, so
-     * walking that owner chain avoids a whole-root scan for the common case.
-     * Fall back to the graph walker for scalar owners and legacy edges that do
-     * not yet have an explicit container slot.
+     * Perl root. Nested hash/array stores and scalar-value slots record direct
+     * edges, so walking that owner chain avoids a whole-root scan for the
+     * common case. Fall back to the graph walker for legacy edges that do not
+     * yet have an explicit owner slot.
      */
     private static boolean isRootedAggregateOwner(RuntimeBase owner,
                                                    RuntimeBase excludedReferent) {
@@ -2059,18 +2059,43 @@ private static boolean isRootedAggregateOwner(RuntimeBase owner,
             if (current == null || current == excludedReferent || !visited.add(current)) continue;
             if (isExplicitAggregateRoot(current)) return true;
             for (PerlOwnerSlot parentSlot : current.ownerSlotSnapshot()) {
-                if (parentSlot.kind() != PerlOwnerSlot.Kind.HASH_ENTRY
-                        && parentSlot.kind() != PerlOwnerSlot.Kind.ARRAY_ELEMENT) continue;
                 if (parentSlot.referent() != current) continue;
-                RuntimeBase parent = parentSlot.ownerContainer();
-                RuntimeScalar cell = parentSlot.ownerCell();
-                if (!isLiveAggregateOwnerEdge(parent, cell, current)) continue;
-                pending.addLast(parent);
+                if (parentSlot.kind() == PerlOwnerSlot.Kind.HASH_ENTRY
+                        || parentSlot.kind() == PerlOwnerSlot.Kind.ARRAY_ELEMENT) {
+                    RuntimeBase parent = parentSlot.ownerContainer();
+                    RuntimeScalar cell = parentSlot.ownerCell();
+                    if (isLiveAggregateOwnerEdge(parent, cell, current)) {
+                        pending.addLast(parent);
+                    }
+                } else if (parentSlot.kind() == PerlOwnerSlot.Kind.SCALAR_VALUE
+                        || parentSlot.kind() == PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS) {
+                    RuntimeScalar cell = parentSlot.kind()
+                            == PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS
+                            ? parentSlot.scalarReferenceCell() : parentSlot.ownerCell();
+                    if (!isLiveScalarOwnerEdge(cell, current)) continue;
+                    if (isExplicitScalarRoot(cell)) return true;
+                    RuntimeBase parent = cell.containerOwner;
+                    if (isLiveAggregateOwnerEdge(parent, cell, current)) {
+                        pending.addLast(parent);
+                    }
+                }
             }
         }
         return ReachabilityWalker.isReachableFromRoots(owner, true, excludedReferent);
     }
 
+    private static boolean isLiveScalarOwnerEdge(RuntimeScalar cell, RuntimeBase referent) {
+        return cell != null && cell.value == referent && !WeakRefRegistry.isweak(cell);
+    }
+
+    private static boolean isExplicitScalarRoot(RuntimeScalar cell) {
+        if (!cell.scopeExited && MyVarCleanupStack.isRegistered(cell)) return true;
+        if (cell.isStoredInRegisteredContainerOwner()) return true;
+        return cell.isPackageGlobalRoot
+                && (GlobalVariable.scalarSlots().containsValue(cell)
+                    || GlobalVariable.globalCodeRefs.containsValue(cell));
+    }
+
     static boolean isRootedOwnerContainer(RuntimeBase owner,
                                           RuntimeBase excludedReferent) {
         if (owner instanceof RuntimeHash || owner instanceof RuntimeArray) {
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateOwnerSlotRootChainTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateOwnerSlotRootChainTest.java
index 04b9139ad0..f2ee9a08d6 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateOwnerSlotRootChainTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateOwnerSlotRootChainTest.java
@@ -51,6 +51,53 @@ void nestedHashOwnerSlotsProveRootWithoutWholeRootWalk() {
         }
     }
 
+    @Test
+    void scalarValueOwnerSlotProvesRootWithoutWholeRootWalk() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            boolean previousActive = MortalList.isActive();
+            RuntimeArray target = new RuntimeArray();
+            RuntimeHash nested = new RuntimeHash();
+            RuntimeArray root = new RuntimeArray();
+            RuntimeScalar rootCell = new RuntimeScalar();
+            root.elementsOwned = true;
+            root.elements.add(nested.createReference());
+            root.reconcileArrayElementOwnerSlots();
+            RuntimeScalar nestedValue = referenceTo(target);
+            nestedValue.refCountOwned = true;
+            nested.elements.put("target", nestedValue);
+            rootCell.set(root.createReference());
+            MyVarCleanupStack.register(rootCell);
+
+            RuntimeScalar unrelatedLegacyOwner = referenceTo(target);
+            unrelatedLegacyOwner.refCountOwned = true;
+            target.refCount = 1;
+
+            try {
+                MortalList.setActive(true);
+                try (MortalList.ReachabilityQueryMeasurement measurement =
+                             MortalList.measureReachabilityQueries()) {
+                    MortalList.deferDecrementIfTracked(unrelatedLegacyOwner);
+                    MortalList.flush();
+
+                    assertEquals(1, target.refCount,
+                            "the scalar-owned nested array keeps the hash slot live");
+                    assertEquals(0, measurement.stats().rootQueries,
+                            "the scalar owner slot proves the path to its lexical root");
+                    assertEquals(0, measurement.stats().snapshotsBuilt,
+                            "the scalar owner chain avoids a graph snapshot");
+                }
+            } finally {
+                MortalList.setActive(previousActive);
+                MyVarCleanupStack.unregister(rootCell);
+                rootCell.scalarValueOwnerSlot().release();
+                root.elements.clear();
+                nested.elements.clear();
+                MortalList.invalidateAllRootSnapshots();
+            }
+        }
+    }
+
     private static RuntimeScalar referenceTo(RuntimeBase referent) {
         RuntimeScalar scalar = new RuntimeScalar();
         scalar.type = RuntimeScalarType.HASHREFERENCE;

From 27d6df4768d299a76e0679bb47b12d6e66ffc02e Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 22 Oct 2026 21:58:08 +0200
Subject: [PATCH 210/317] perf: prove roots through scalar reference contents

Follow the live scalar-reference contents owner edge and then its outer
scalar owner chain when recovering aggregate reachability. Add a regression
test that verifies this path avoids whole-root scans.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtime/runtimetypes/MortalList.java      | 37 +++++++++---
 ...alListAggregateOwnerSlotRootChainTest.java | 56 +++++++++++++++++++
 2 files changed, 86 insertions(+), 7 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index b8db4695bd..498bcfb337 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -2069,13 +2069,16 @@ private static boolean isRootedAggregateOwner(RuntimeBase owner,
                     }
                 } else if (parentSlot.kind() == PerlOwnerSlot.Kind.SCALAR_VALUE
                         || parentSlot.kind() == PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS) {
-                    RuntimeScalar cell = parentSlot.kind()
-                            == PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS
-                            ? parentSlot.scalarReferenceCell() : parentSlot.ownerCell();
-                    if (!isLiveScalarOwnerEdge(cell, current)) continue;
-                    if (isExplicitScalarRoot(cell)) return true;
-                    RuntimeBase parent = cell.containerOwner;
-                    if (isLiveAggregateOwnerEdge(parent, cell, current)) {
+                    RuntimeScalar ownerCell = parentSlot.ownerCell();
+                    if (parentSlot.kind() == PerlOwnerSlot.Kind.SCALAR_VALUE) {
+                        if (!isLiveScalarOwnerEdge(ownerCell, current)) continue;
+                    } else if (!isLiveScalarReferenceContentsEdge(
+                            parentSlot, ownerCell, current)) {
+                        continue;
+                    }
+                    if (isExplicitScalarRoot(ownerCell)) return true;
+                    RuntimeBase parent = ownerCell.containerOwner;
+                    if (isLiveAggregateOwnerCell(parent, ownerCell)) {
                         pending.addLast(parent);
                     }
                 }
@@ -2088,6 +2091,26 @@ private static boolean isLiveScalarOwnerEdge(RuntimeScalar cell, RuntimeBase ref
         return cell != null && cell.value == referent && !WeakRefRegistry.isweak(cell);
     }
 
+    private static boolean isLiveScalarReferenceContentsEdge(
+            PerlOwnerSlot slot, RuntimeScalar ownerCell, RuntimeBase referent) {
+        RuntimeScalar contentsCell = slot.scalarReferenceCell();
+        return ownerCell != null
+                && ownerCell.scalarReferenceContentsOwner == slot
+                && !WeakRefRegistry.isweak(ownerCell)
+                && contentsCell != null && contentsCell.value == referent
+                && !WeakRefRegistry.isweak(contentsCell);
+    }
+
+    private static boolean isLiveAggregateOwnerCell(RuntimeBase parent, RuntimeScalar cell) {
+        if (parent instanceof RuntimeHash hash) {
+            return hash.elements.containsValue(cell);
+        }
+        if (parent instanceof RuntimeArray array) {
+            return array.elements.contains(cell) && array.ownsElement(cell);
+        }
+        return false;
+    }
+
     private static boolean isExplicitScalarRoot(RuntimeScalar cell) {
         if (!cell.scopeExited && MyVarCleanupStack.isRegistered(cell)) return true;
         if (cell.isStoredInRegisteredContainerOwner()) return true;
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateOwnerSlotRootChainTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateOwnerSlotRootChainTest.java
index f2ee9a08d6..fd71f62b01 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateOwnerSlotRootChainTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListAggregateOwnerSlotRootChainTest.java
@@ -98,6 +98,62 @@ void scalarValueOwnerSlotProvesRootWithoutWholeRootWalk() {
         }
     }
 
+    @Test
+    void scalarReferenceContentsOwnerSlotProvesRootWithoutWholeRootWalk() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            boolean previousActive = MortalList.isActive();
+            RuntimeArray target = new RuntimeArray();
+            RuntimeHash nested = new RuntimeHash();
+            RuntimeArray root = new RuntimeArray();
+            root.elementsOwned = true;
+            root.elements.add(nested.createReference());
+            root.reconcileArrayElementOwnerSlots();
+            RuntimeScalar nestedValue = referenceTo(target);
+            nestedValue.refCountOwned = true;
+            nested.elements.put("target", nestedValue);
+
+            root.refCount = 1;
+            RuntimeScalar contentsCell = referenceTo(root);
+            RuntimeScalar outerReference = new RuntimeScalar();
+            outerReference.type = RuntimeScalarType.REFERENCE;
+            outerReference.value = contentsCell;
+            PerlOwnerSlot contentsOwner = new PerlOwnerSlot(
+                    PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS,
+                    null, null, outerReference);
+            contentsOwner.acquireScalarReferenceContents(root, contentsCell);
+            outerReference.scalarReferenceContentsOwner = contentsOwner;
+            MyVarCleanupStack.register(outerReference);
+
+            RuntimeScalar unrelatedLegacyOwner = referenceTo(target);
+            unrelatedLegacyOwner.refCountOwned = true;
+            target.refCount = 1;
+
+            try {
+                MortalList.setActive(true);
+                try (MortalList.ReachabilityQueryMeasurement measurement =
+                             MortalList.measureReachabilityQueries()) {
+                    MortalList.deferDecrementIfTracked(unrelatedLegacyOwner);
+                    MortalList.flush();
+
+                    assertEquals(1, target.refCount,
+                            "the scalar-reference contents owner keeps the hash slot live");
+                    assertEquals(0, measurement.stats().rootQueries,
+                            "the contents owner slot proves the path to its lexical root");
+                    assertEquals(0, measurement.stats().snapshotsBuilt,
+                            "the contents owner chain avoids a graph snapshot");
+                }
+            } finally {
+                MortalList.setActive(previousActive);
+                MyVarCleanupStack.unregister(outerReference);
+                outerReference.releaseOwnedScalarReferenceContents();
+                root.elements.clear();
+                nested.elements.clear();
+                MortalList.invalidateAllRootSnapshots();
+            }
+        }
+    }
+
     private static RuntimeScalar referenceTo(RuntimeBase referent) {
         RuntimeScalar scalar = new RuntimeScalar();
         scalar.type = RuntimeScalarType.HASHREFERENCE;

From c7f6f640330b04087602407760401918968df419 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 22 Oct 2026 22:23:31 +0200
Subject: [PATCH 211/317] docs: update ownership rewrite progress

Record the current master base, tested PR head, full-build result, and the
remaining Phase 2 owner-accounting boundary.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 9d5117e702..1ea754334f 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The candidate is rebased onto `origin/master` at `2c5ae8623`; published head `d0ca1607f` passes hosted run `39808119318` on Linux and Windows. The latest local batch passes full `nice -n 19 make`, `make test-threads` in all three configurations, and the ordinary aggregate ownership regression on blead Perl and both backends. Owner slots still bridge to `RuntimeBase.refCount` for dispatch; default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The candidate is rebased onto `origin/master` at `5a6cf5ed6`; published head `27d6df476` passes hosted run `39844774795` on Linux and Windows. The latest local batch passes full `nice -n 19 make`; owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,19 +107,20 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch is rebased onto `origin/master` at `2c5ae8623`; published head `d0ca1607f` passes hosted run `39808119318` on Linux and Windows, including both thread compatibility gates. The local rebased candidate also passes full `nice -n 19 make`, all three local thread configurations, and the focused lifetime regressions recorded below. The tracked Mojolicious WebSocket callback test passes on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch is rebased onto `origin/master` at `5a6cf5ed6`; published head `27d6df476` passes hosted run `39844774795` on Linux and Windows, including both thread compatibility gates and Linux SBOM generation. The local rebased candidate passes full `nice -n 19 make`, all three local thread configurations, and the focused lifetime regressions recorded below. The tracked Mojolicious WebSocket callback test passes on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 ### Current batch
 
-- Followed `SCALAR_VALUE` and `SCALAR_REFERENCE_CONTENTS` slots from an
-  aggregate toward their containing aggregate or live lexical root. Deferred
-  aggregate-owner recovery now avoids whole-root walks when the path passes
-  through an ordinary scalar owner. The Java regression proves exact count
-  restoration with zero graph snapshots. Full `nice -n 19 make` passes in
-  17m55s; `make test-threads` passes JVM virtual 1925/1925, interpreter
-  virtual 1925/1925, and platform-focused 485/485. The 15-assertion ordinary
-  aggregate refcount/destruction test passes on blead Perl 5.45.4 and both
-  PerlOnJava backends. Hosted CI for this follow-up is pending.
+- Followed live `SCALAR_VALUE` and `SCALAR_REFERENCE_CONTENTS` slots from an
+  aggregate toward their containing aggregate or lexical root. Deferred
+  aggregate-owner recovery now avoids whole-root walks through these scalar
+  owner paths. Java regressions prove exact count restoration with zero root
+  queries and graph snapshots. Full `nice -n 19 make` passes in 21m54s; the
+  root-chain test class passes 3/3. Hosted CI for head `27d6df476` passes on
+  Linux and Windows, including the platform thread gates.
+- Rebased PR #1816 onto master `5a6cf5ed6` before this batch's one full build.
+  This keeps the validation aligned with current master and avoids rebuilding
+  an obsolete candidate.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 
@@ -461,9 +462,8 @@ The earlier candidate was based on `origin/master` (`ede542b29`) and passed the
 
 ### Next steps
 
-1. Publish the tested rebase and callback-lifetime fix to draft PR #1816, then
-   verify hosted CI on that exact head.
-2. Continue Phase 2 from slot-registration recovery to default owner-slot
+1. Keep PR #1816 open/draft while continuing the Phase 2 owner-accounting work.
+2. Continue Phase 2 from reachability recovery to default owner-slot
    accounting for ordinary array/hash element stores and scalar proxies. Cover
    acquisition, transfer, replacement, deletion, aliases, and final release
    with oracle-checked refcount, weak-reference, and DESTROY assertions. Keep

From 624853943d0a70cc09d1889f44ad0695799e125f Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Thu, 22 Oct 2026 23:56:52 +0200
Subject: [PATCH 212/317] refactor: trust scalar owner slot during aggregate
 recovery

Allow rooted aggregate recovery to rely on the explicit scalar-value owner
slot when the legacy ownership flag is absent. Keep the legacy fallback for
cells that do not yet have an owner slot, and cover array/hash restoration
and final slot release.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          |  7 +-
 .../runtime/runtimetypes/MortalList.java      | 13 ++--
 .../runtime/runtimetypes/RuntimeScalar.java   |  5 ++
 ...ortalListOwnerSlotLedgerAuthorityTest.java | 66 +++++++++++++++++++
 4 files changed, 85 insertions(+), 6 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/MortalListOwnerSlotLedgerAuthorityTest.java

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 1ea754334f..4936a0b7ae 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch is rebased onto `origin/master` at `5a6cf5ed6`; published head `27d6df476` passes hosted run `39844774795` on Linux and Windows, including both thread compatibility gates and Linux SBOM generation. The local rebased candidate passes full `nice -n 19 make`, all three local thread configurations, and the focused lifetime regressions recorded below. The tracked Mojolicious WebSocket callback test passes on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch is rebased onto `origin/master` at `5a6cf5ed6`; published head `27d6df476` passes hosted run `39844774795` on Linux and Windows, including both thread compatibility gates and Linux SBOM generation. The current local candidate passes full `nice -n 19 make`; the preceding ownership candidate passes all three local thread configurations. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 ### Current batch
 
@@ -121,6 +121,11 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
 - Rebased PR #1816 onto master `5a6cf5ed6` before this batch's one full build.
   This keeps the validation aligned with current master and avoids rebuilding
   an obsolete candidate.
+- On 2026-10-23, allowed scalar owner-slot identity to supply rooted array/hash
+  recovery when the legacy ownership flag is absent, while retaining the flag
+  for cells with no explicit slot. The Java regression covers array and hash
+  owners, restoration, and release after removing their semantic slots. Full
+  `nice -n 19 make` passes in 21m46s; hosted validation is pending.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 498bcfb337..688a0c5a08 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1988,7 +1988,8 @@ static boolean restoreReachableAggregateOwnerCount(RuntimeBase referent) {
             RuntimeScalar cell = slot.ownerCell();
             if (cell == null) {
                 slotsWithoutCell++;
-            } else if (cell.value == referent && cell.refCountOwned
+            } else if (cell.value == referent
+                    && (cell.refCountOwned || cell.hasScalarValueOwnerSlotFor(referent))
                     && !WeakRefRegistry.isweak(cell)) {
                 rootedHashCells.add(cell);
             }
@@ -2004,13 +2005,14 @@ static boolean restoreReachableAggregateOwnerCount(RuntimeBase referent) {
             RuntimeScalar cell = slot.ownerCell();
             if (cell == null) {
                 slotsWithoutCell++;
-            } else if (cell.value == referent && cell.refCountOwned
+            } else if (cell.value == referent
+                    && (cell.refCountOwned || cell.hasScalarValueOwnerSlotFor(referent))
                     && !WeakRefRegistry.isweak(cell)) {
                 rootedHashCells.add(cell);
             }
         }
-        // Standalone scalar slots can predate active-owner tracking, so use
-        // their explicit identity when recovering a displaced legacy count.
+        // Scalar-value slots can supply their identity even when recovery no
+        // longer relies on the legacy ownership Boolean.
         // Cells stored in aggregates are handled above or by the legacy
         // reachability fallback to preserve the shared-root snapshot policy.
         for (PerlOwnerSlot slot : referent.ownerSlotSnapshot()) {
@@ -2018,7 +2020,8 @@ static boolean restoreReachableAggregateOwnerCount(RuntimeBase referent) {
                     || slot.referent() != referent) continue;
             RuntimeScalar cell = slot.ownerCell();
             if (cell == null || cell.containerOwner != null
-                    || cell.value != referent || !cell.refCountOwned
+                    || cell.value != referent
+                    || (!cell.refCountOwned && !cell.hasScalarValueOwnerSlotFor(referent))
                     || WeakRefRegistry.isweak(cell)
                     || !ReachabilityWalker.isScalarReachable(cell)) continue;
             rootedHashCells.add(cell);
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index b8aac66854..03e5820a79 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -863,6 +863,11 @@ public PerlOwnerSlot scalarValueOwnerSlot() {
         return scalarValueOwnerSlot;
     }
 
+    boolean hasScalarValueOwnerSlotFor(RuntimeBase referent) {
+        return scalarValueOwnerSlot != null
+                && scalarValueOwnerSlot.referent() == referent;
+    }
+
     /**
      * Keep the owner ledger paired with the legacy scalar ownership bit while
      * the lifecycle bridge is being migrated. This records the scalar-cell
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListOwnerSlotLedgerAuthorityTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListOwnerSlotLedgerAuthorityTest.java
new file mode 100644
index 0000000000..70e77ef271
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListOwnerSlotLedgerAuthorityTest.java
@@ -0,0 +1,66 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("unit")
+class MortalListOwnerSlotLedgerAuthorityTest {
+    @Test
+    void rootedAggregateSlotsUseScalarOwnerIdentityAfterLegacyFlagRetires() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeArray arrayOwner = new RuntimeArray();
+            arrayOwner.elementsOwned = true;
+            RuntimeScalar arrayCell = referenceTo(referent);
+            arrayCell.setRefCountOwned(true);
+            arrayCell.refCountOwned = false;
+            arrayOwner.elements.add(arrayCell);
+            arrayOwner.reconcileArrayElementOwnerSlots();
+
+            RuntimeHash hashOwner = new RuntimeHash();
+            RuntimeScalar hashCell = referenceTo(referent);
+            hashCell.setRefCountOwned(true);
+            hashCell.refCountOwned = false;
+            hashOwner.elements.put("target", hashCell);
+
+            MyVarCleanupStack.register(arrayOwner);
+            MyVarCleanupStack.register(hashOwner);
+            try {
+                assertTrue(arrayCell.hasScalarValueOwnerSlotFor(referent));
+                assertTrue(hashCell.hasScalarValueOwnerSlotFor(referent));
+
+                assertTrue(MortalList.restoreReachableAggregateOwnerCount(referent),
+                        "rooted array and hash slots restore owners from ledger identity");
+                assertEquals(2, referent.refCount);
+                assertEquals(2, referent.reachableOwnerCount());
+
+                arrayOwner.elements.clear();
+                hashOwner.elements.clear();
+                arrayCell.scalarValueOwnerSlot().release();
+                hashCell.scalarValueOwnerSlot().release();
+                referent.refCount = 0;
+                assertFalse(MortalList.restoreReachableAggregateOwnerCount(referent),
+                        "removing the semantic slots removes the recoverable owners");
+            } finally {
+                MyVarCleanupStack.unregister(hashOwner);
+                MyVarCleanupStack.unregister(arrayOwner);
+                hashOwner.elements.clear();
+                arrayOwner.elements.clear();
+                arrayCell.scalarValueOwnerSlot().release();
+                hashCell.scalarValueOwnerSlot().release();
+            }
+        }
+    }
+
+    private static RuntimeScalar referenceTo(RuntimeArray referent) {
+        RuntimeScalar scalar = new RuntimeScalar();
+        scalar.type = RuntimeScalarType.ARRAYREFERENCE;
+        scalar.value = referent;
+        return scalar;
+    }
+}

From b9c05ecdf7c2a001fca42a8920fcc68c8ba8e5de Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 23 Oct 2026 01:19:19 +0200
Subject: [PATCH 213/317] docs: record ownership shard validation

Record the hosted weak-reference failure and the passing filtered and full-shard
local reruns while hosted CI is rerunning the published head.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 4936a0b7ae..29213f0b3a 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The candidate is rebased onto `origin/master` at `5a6cf5ed6`; published head `27d6df476` passes hosted run `39844774795` on Linux and Windows. The latest local batch passes full `nice -n 19 make`; owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The candidate is based on `origin/master` at `5a6cf5ed6`; published head `624853943` passes local full `nice -n 19 make` and the affected shard in its full 14m34s order. Hosted run `39861290618` had one Linux failure in `dbic_deep_cycle_weak_shift_regression.t`; local filtered and full-shard reruns pass, and hosted CI has been rerun. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch is rebased onto `origin/master` at `5a6cf5ed6`; published head `27d6df476` passes hosted run `39844774795` on Linux and Windows, including both thread compatibility gates and Linux SBOM generation. The current local candidate passes full `nice -n 19 make`; the preceding ownership candidate passes all three local thread configurations. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch is based on `origin/master` at `5a6cf5ed6`; published head `624853943` passes local full `nice -n 19 make` and the affected shard in its full 14m34s order. Hosted run `39861290618` had one Linux failure in `dbic_deep_cycle_weak_shift_regression.t` after preceding DBI tests; the filtered DBI/DBIC make and full affected shard pass locally, and a hosted rerun is in progress. The preceding ownership candidate passes all three local thread configurations. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 ### Current batch
 
@@ -125,7 +125,11 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   recovery when the legacy ownership flag is absent, while retaining the flag
   for cells with no explicit slot. The Java regression covers array and hash
   owners, restoration, and release after removing their semantic slots. Full
-  `nice -n 19 make` passes in 21m46s; hosted validation is pending.
+  `nice -n 19 make` passes in 21m46s. The first hosted run had one failure in
+  `dbic_deep_cycle_weak_shift_regression.t` (assertion 10) in shard 3. The
+  regression passes in the filtered DBI/DBIC make and in shard 3's full normal
+  order (14m34s); a hosted rerun is in progress to distinguish an order/load
+  flake from a branch regression.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 

From a3954325cb6d5a29191ccecd0944369e39806ef8 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 23 Oct 2026 02:15:21 +0200
Subject: [PATCH 214/317] refactor: count explicit scalar owner slots

Let active SCALAR_VALUE slots remain authoritative in direct scalar-owner
snapshots after the legacy ownership Boolean retires. Cover the registry/slot
union and final slot release with a regression test.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          | 12 ++++++---
 .../runtime/runtimetypes/RuntimeBase.java     |  2 +-
 .../CountedScalarOwnerSnapshotTest.java       | 27 +++++++++++++++++++
 3 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 29213f0b3a..a532f2bdd2 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The candidate is based on `origin/master` at `5a6cf5ed6`; published head `624853943` passes local full `nice -n 19 make` and the affected shard in its full 14m34s order. Hosted run `39861290618` had one Linux failure in `dbic_deep_cycle_weak_shift_regression.t`; local filtered and full-shard reruns pass, and hosted CI has been rerun. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The candidate is based on `origin/master` at `5a6cf5ed6`; published head `624853943` passes local full `nice -n 19 make`, the affected shard in its full 14m34s order, and hosted rerun `39861290618` on Linux and Windows, including both thread gates. The original hosted run had one Linux failure in `dbic_deep_cycle_weak_shift_regression.t`; local filtered and full-shard reruns passed, and the hosted rerun is green. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch is based on `origin/master` at `5a6cf5ed6`; published head `624853943` passes local full `nice -n 19 make` and the affected shard in its full 14m34s order. Hosted run `39861290618` had one Linux failure in `dbic_deep_cycle_weak_shift_regression.t` after preceding DBI tests; the filtered DBI/DBIC make and full affected shard pass locally, and a hosted rerun is in progress. The preceding ownership candidate passes all three local thread configurations. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch is based on `origin/master` at `5a6cf5ed6`; published head `624853943` passes local full `nice -n 19 make`, the affected shard in its full 14m34s order, and hosted rerun `39861290618` on Linux and Windows, including both thread gates. The original hosted run had one Linux failure in `dbic_deep_cycle_weak_shift_regression.t` after preceding DBI tests; the filtered DBI/DBIC make and full affected shard passed locally, and the hosted rerun is green. The preceding ownership candidate passes all three local thread configurations. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 ### Current batch
 
@@ -128,8 +128,12 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   `nice -n 19 make` passes in 21m46s. The first hosted run had one failure in
   `dbic_deep_cycle_weak_shift_regression.t` (assertion 10) in shard 3. The
   regression passes in the filtered DBI/DBIC make and in shard 3's full normal
-  order (14m34s); a hosted rerun is in progress to distinguish an order/load
-  flake from a branch regression.
+  order (14m34s); hosted rerun `39861290618` passes on Linux and Windows,
+  including the platform thread gates.
+- On 2026-10-23, direct scalar-owner snapshots began trusting the active
+  `SCALAR_VALUE` slot when the legacy Boolean has retired. The Java regression
+  checks the legacy registry and slot union, then verifies that releasing the
+  slot removes the counted owner. The full local make is pending.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
index 76310b5bb0..6cbf435e13 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
@@ -495,7 +495,7 @@ public java.util.Set<RuntimeScalar> countedScalarOwnerSnapshot() {
             if (slot.kind() != PerlOwnerSlot.Kind.SCALAR_VALUE
                     || slot.referent() != this) continue;
             RuntimeScalar owner = slot.ownerCell();
-            if (owner != null && owner.refCountOwned && owner.value == this) {
+            if (owner != null && owner.value == this) {
                 snapshot.add(owner);
             }
         }
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/CountedScalarOwnerSnapshotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/CountedScalarOwnerSnapshotTest.java
index ca86639690..1abeb2bb8f 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/CountedScalarOwnerSnapshotTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/CountedScalarOwnerSnapshotTest.java
@@ -47,4 +47,31 @@ void deduplicatesOwnerPresentInLegacyRegistryAndExplicitSlot() {
             MortalList.flush();
         }
     }
+
+    @Test
+    void retainsExplicitOwnerWhenLegacyFlagRetires() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            referent.activateOwnerTracking();
+            RuntimeScalar owner = new RuntimeScalar();
+            owner.set(referent.createAnonymousReference());
+            MyVarCleanupStack.register(owner);
+
+            assertEquals(1, referent.countedScalarOwnerCount());
+            owner.refCountOwned = false;
+
+            assertEquals(0, referent.activeOwnerCount(),
+                    "the legacy registry retires the owner with its Boolean flag");
+            assertEquals(1, referent.countedScalarOwnerCount(),
+                    "the active scalar-value slot remains an explicit owner");
+
+            owner.setRefCountOwned(true);
+            MyVarCleanupStack.unregister(owner);
+            MortalList.deferDecrementIfTracked(owner);
+            MortalList.flush();
+            assertEquals(0, referent.countedScalarOwnerCount(),
+                    "releasing the explicit slot removes the counted owner");
+        }
+    }
 }

From 210cbf7fb503698c3cd9a8f5386e09097ca0ae0b Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 23 Oct 2026 03:32:06 +0200
Subject: [PATCH 215/317] docs: record green owner-slot validation

Update the Phase 2 record with the passing local full make and hosted CI for
the scalar owner-slot snapshot change.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index a532f2bdd2..64dbe08867 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The candidate is based on `origin/master` at `5a6cf5ed6`; published head `624853943` passes local full `nice -n 19 make`, the affected shard in its full 14m34s order, and hosted rerun `39861290618` on Linux and Windows, including both thread gates. The original hosted run had one Linux failure in `dbic_deep_cycle_weak_shift_regression.t`; local filtered and full-shard reruns passed, and the hosted rerun is green. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The candidate is based on `origin/master` at `5a6cf5ed6`; published head `a3954325c` passes local full `nice -n 19 make` in 22m49s and hosted run `39880315002` on Linux and Windows, including both thread gates. The preceding head's one hosted Linux failure in `dbic_deep_cycle_weak_shift_regression.t` did not recur in local filtered/full-shard gates or the hosted rerun. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch is based on `origin/master` at `5a6cf5ed6`; published head `624853943` passes local full `nice -n 19 make`, the affected shard in its full 14m34s order, and hosted rerun `39861290618` on Linux and Windows, including both thread gates. The original hosted run had one Linux failure in `dbic_deep_cycle_weak_shift_regression.t` after preceding DBI tests; the filtered DBI/DBIC make and full affected shard passed locally, and the hosted rerun is green. The preceding ownership candidate passes all three local thread configurations. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch is based on `origin/master` at `5a6cf5ed6`; published head `a3954325c` passes local full `nice -n 19 make` in 22m49s and hosted run `39880315002` on Linux and Windows, including both thread gates. The preceding head's one hosted Linux failure in `dbic_deep_cycle_weak_shift_regression.t` did not recur in local filtered/full-shard gates or the hosted rerun. The preceding ownership candidate passes all three local thread configurations. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 ### Current batch
 
@@ -133,7 +133,9 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
 - On 2026-10-23, direct scalar-owner snapshots began trusting the active
   `SCALAR_VALUE` slot when the legacy Boolean has retired. The Java regression
   checks the legacy registry and slot union, then verifies that releasing the
-  slot removes the counted owner. The full local make is pending.
+  slot removes the counted owner. Full `nice -n 19 make` passes in 22m49s;
+  hosted run `39880315002` passes on Linux and Windows, including both thread
+  compatibility gates.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 

From c948d023a724a9b14599216f64cc1b793b9d2fee Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 23 Oct 2026 03:37:50 +0200
Subject: [PATCH 216/317] refactor: release scalar owners through explicit
 slots

Allow deferred scalar cleanup to recognize a live SCALAR_VALUE owner after
its legacy Boolean retires, while keeping refCount as the lifecycle bridge.
Add regression coverage for slot retirement and deferred decrement.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          |  4 +++
 .../runtime/runtimetypes/MortalList.java      |  3 +-
 .../runtime/runtimetypes/RuntimeScalar.java   |  6 ++++
 ...MortalListScalarValueOwnerRestoreTest.java | 29 +++++++++++++++++++
 4 files changed, 40 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 64dbe08867..67cb826b4c 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -136,6 +136,10 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   slot removes the counted owner. Full `nice -n 19 make` passes in 22m49s;
   hosted run `39880315002` passes on Linux and Windows, including both thread
   compatibility gates.
+- The next cleanup tranche lets deferred scalar release recognize that same
+  explicit slot after the legacy flag retires. Its Java regression verifies
+  slot retirement and the deferred legacy bridge decrement; validation is
+  pending.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 688a0c5a08..9e5382ab5a 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -568,10 +568,10 @@ public static void flushDeferredCapturesBeforeEnd() {
      */
     public static void deferDecrementIfTracked(RuntimeScalar scalar) {
         if (!isActive() || scalar == null) return;
-        if (!scalar.refCountOwned) return;
         if (((scalar.type & RuntimeScalarType.REFERENCE_BIT) != 0
                 || scalar.type == RuntimeScalarType.GLOB)
                 && scalar.value instanceof RuntimeBase base) {
+            if (!scalar.ownsCountedReferent(base)) return;
             if (base.refCount > 0) {
                 scalar.setRefCountOwned(false);
                 if (base.refCountTrace) {
@@ -611,7 +611,6 @@ public static void deferDecrementIfTracked(RuntimeScalar scalar) {
     /** Release the tracked owner held by a scope-exited closure capture. */
     public static void releaseCapturedDecrement(RuntimeScalar scalar) {
         if (!isActive() || scalar == null) return;
-        if (!scalar.refCountOwned) return;
         deferDecrementIfTracked(scalar);
     }
 
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 03e5820a79..d8578dcca5 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -868,6 +868,12 @@ boolean hasScalarValueOwnerSlotFor(RuntimeBase referent) {
                 && scalarValueOwnerSlot.referent() == referent;
     }
 
+    /** Whether the legacy count bridge or its explicit slot still owns a referent. */
+    synchronized boolean ownsCountedReferent(RuntimeBase referent) {
+        return value == referent
+                && (refCountOwned || hasScalarValueOwnerSlotFor(referent));
+    }
+
     /**
      * Keep the owner ledger paired with the legacy scalar ownership bit while
      * the lifecycle bridge is being migrated. This records the scalar-cell
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java
index c19dbb25b9..f1fa806113 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java
@@ -4,6 +4,7 @@
 import org.junit.jupiter.api.Test;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 @Tag("unit")
@@ -33,4 +34,32 @@ void standaloneScalarSlotRestoresCountWithoutActiveOwnerRegistry() {
             }
         }
     }
+
+    @Test
+    void deferredReleaseUsesExplicitScalarOwnerAfterLegacyFlagRetires() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeScalar owner = new RuntimeScalar();
+            owner.set(referent.createAnonymousReference());
+            MyVarCleanupStack.register(owner);
+            int originalRefCount = referent.refCount;
+
+            owner.refCountOwned = false;
+            assertTrue(owner.hasScalarValueOwnerSlotFor(referent));
+
+            try {
+                MortalList.deferDecrementIfTracked(owner);
+                assertFalse(owner.hasScalarValueOwnerSlotFor(referent),
+                        "deferred cleanup retires the explicit scalar slot");
+                MyVarCleanupStack.unregister(owner);
+                MortalList.flush();
+                assertTrue(referent.refCount < originalRefCount,
+                        "the deferred bridge decrement is released");
+            } finally {
+                MyVarCleanupStack.unregister(owner);
+                MortalList.flush();
+            }
+        }
+    }
 }

From 5d2c18f3f581f06dfcc74b3d878b851d69c27728 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 23 Oct 2026 04:00:32 +0200
Subject: [PATCH 217/317] docs: record scalar cleanup validation

Record the passing full make result for deferred scalar owner-slot cleanup.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 67cb826b4c..a03e7bb16e 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The candidate is based on `origin/master` at `5a6cf5ed6`; published head `a3954325c` passes local full `nice -n 19 make` in 22m49s and hosted run `39880315002` on Linux and Windows, including both thread gates. The preceding head's one hosted Linux failure in `dbic_deep_cycle_weak_shift_regression.t` did not recur in local filtered/full-shard gates or the hosted rerun. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The candidate is based on `origin/master` at `5a6cf5ed6`; published head `a3954325c` passes hosted run `39880315002` on Linux and Windows, including both thread gates. Current local candidate `c948d023a` passes full `nice -n 19 make` in 21m16s; hosted validation is pending. The preceding head's one hosted Linux failure in `dbic_deep_cycle_weak_shift_regression.t` did not recur in local filtered/full-shard gates or the hosted rerun. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch is based on `origin/master` at `5a6cf5ed6`; published head `a3954325c` passes local full `nice -n 19 make` in 22m49s and hosted run `39880315002` on Linux and Windows, including both thread gates. The preceding head's one hosted Linux failure in `dbic_deep_cycle_weak_shift_regression.t` did not recur in local filtered/full-shard gates or the hosted rerun. The preceding ownership candidate passes all three local thread configurations. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch is based on `origin/master` at `5a6cf5ed6`; published head `a3954325c` passes hosted run `39880315002` on Linux and Windows, including both thread gates. Current local candidate `c948d023a` passes full `nice -n 19 make` in 21m16s; hosted validation is pending. The preceding head's one hosted Linux failure in `dbic_deep_cycle_weak_shift_regression.t` did not recur in local filtered/full-shard gates or the hosted rerun. The preceding ownership candidate passes all three local thread configurations. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 ### Current batch
 
@@ -138,7 +138,8 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   compatibility gates.
 - The next cleanup tranche lets deferred scalar release recognize that same
   explicit slot after the legacy flag retires. Its Java regression verifies
-  slot retirement and the deferred legacy bridge decrement; validation is
+  slot retirement and the deferred legacy bridge decrement. Full
+  `nice -n 19 make` passes in 21m16s on `c948d023a`; hosted validation is
   pending.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.

From 759302bb72815cb27cdbe493a88c71b5f3a23aaa Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 23 Oct 2026 04:59:17 +0200
Subject: [PATCH 218/317] refactor: trust scalar slots in array cleanup

Use explicit scalar owner identity when array pop and shift release a value,
matching the deferred and captured cleanup paths. Cover pop, shift, and
captured release after the legacy Boolean retires.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          | 13 +++---
 .../runtime/runtimetypes/RuntimeArray.java    |  6 ++-
 ...MortalListScalarValueOwnerRestoreTest.java | 15 ++++++-
 .../RuntimeArrayElementOwnershipTest.java     | 40 +++++++++++++++++++
 4 files changed, 64 insertions(+), 10 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index a03e7bb16e..f40719c1d4 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The candidate is based on `origin/master` at `5a6cf5ed6`; published head `a3954325c` passes hosted run `39880315002` on Linux and Windows, including both thread gates. Current local candidate `c948d023a` passes full `nice -n 19 make` in 21m16s; hosted validation is pending. The preceding head's one hosted Linux failure in `dbic_deep_cycle_weak_shift_regression.t` did not recur in local filtered/full-shard gates or the hosted rerun. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The candidate is based on `origin/master` at `5a6cf5ed6`; published head `c948d023a` passes full `nice -n 19 make` in 21m16s and hosted run `39887223844` on Linux and Windows, including both thread gates. The preceding head's one hosted Linux failure in `dbic_deep_cycle_weak_shift_regression.t` did not recur in local filtered/full-shard gates or the hosted rerun. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch is based on `origin/master` at `5a6cf5ed6`; published head `a3954325c` passes hosted run `39880315002` on Linux and Windows, including both thread gates. Current local candidate `c948d023a` passes full `nice -n 19 make` in 21m16s; hosted validation is pending. The preceding head's one hosted Linux failure in `dbic_deep_cycle_weak_shift_regression.t` did not recur in local filtered/full-shard gates or the hosted rerun. The preceding ownership candidate passes all three local thread configurations. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch is based on `origin/master` at `5a6cf5ed6`; published head `c948d023a` passes full `nice -n 19 make` in 21m16s and hosted run `39887223844` on Linux and Windows, including both thread gates. The preceding head's one hosted Linux failure in `dbic_deep_cycle_weak_shift_regression.t` did not recur in local filtered/full-shard gates or the hosted rerun. The preceding ownership candidate passes all three local thread configurations. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 ### Current batch
 
@@ -136,11 +136,10 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   slot removes the counted owner. Full `nice -n 19 make` passes in 22m49s;
   hosted run `39880315002` passes on Linux and Windows, including both thread
   compatibility gates.
-- The next cleanup tranche lets deferred scalar release recognize that same
-  explicit slot after the legacy flag retires. Its Java regression verifies
-  slot retirement and the deferred legacy bridge decrement. Full
-  `nice -n 19 make` passes in 21m16s on `c948d023a`; hosted validation is
-  pending.
+- The next cleanup tranche lets deferred scalar release, captured release, and
+  array `pop`/`shift` recognize the explicit scalar slot after the legacy flag
+  retires. Java regressions verify slot retirement and the deferred legacy
+  bridge decrement for each cleanup path. Validation is pending.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
index ef274e212c..259132c667 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
@@ -893,10 +893,11 @@ public static RuntimeScalar pop(RuntimeArray runtimeArray) {
                     // @_ uses aliasing (setArrayOfAlias) without refCount increments,
                     // so its elements must NOT be mortal-ized on shift/pop — doing so
                     // would corrupt the caller's refCount tracking.
-                    if (runtimeArray.ownsElement(result) && result.refCountOwned
+                    if (runtimeArray.ownsElement(result)
                             && !result.hasOwningAggregateSlotForLvalueAlias()
                             && (result.type & RuntimeScalarType.REFERENCE_BIT) != 0
                             && result.value instanceof RuntimeBase base
+                            && result.ownsCountedReferent(base)
                             && base.refCount > 0) {
                         result.setRefCountOwned(false);
                         runtimeArray.forgetOwnedAliasElement(result);
@@ -937,10 +938,11 @@ public static RuntimeScalar shift(RuntimeArray runtimeArray) {
                 if (result != null) {
                     // If this element owned a refCount, defer the decrement.
                     // See pop() for rationale and elementsOwned guard.
-                    if (runtimeArray.ownsElement(result) && result.refCountOwned
+                    if (runtimeArray.ownsElement(result)
                             && !result.hasOwningAggregateSlotForLvalueAlias()
                             && (result.type & RuntimeScalarType.REFERENCE_BIT) != 0
                             && result.value instanceof RuntimeBase base
+                            && result.ownsCountedReferent(base)
                             && base.refCount > 0) {
                         result.setRefCountOwned(false);
                         runtimeArray.forgetOwnedAliasElement(result);
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java
index f1fa806113..9bf8aad073 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java
@@ -37,6 +37,15 @@ void standaloneScalarSlotRestoresCountWithoutActiveOwnerRegistry() {
 
     @Test
     void deferredReleaseUsesExplicitScalarOwnerAfterLegacyFlagRetires() {
+        assertExplicitScalarOwnerRelease(false);
+    }
+
+    @Test
+    void capturedReleaseUsesExplicitScalarOwnerAfterLegacyFlagRetires() {
+        assertExplicitScalarOwnerRelease(true);
+    }
+
+    private static void assertExplicitScalarOwnerRelease(boolean captured) {
         PerlRuntime runtime = new PerlRuntime();
         try (PerlRuntime.Binding ignored = runtime.bind()) {
             RuntimeArray referent = new RuntimeArray();
@@ -49,7 +58,11 @@ void deferredReleaseUsesExplicitScalarOwnerAfterLegacyFlagRetires() {
             assertTrue(owner.hasScalarValueOwnerSlotFor(referent));
 
             try {
-                MortalList.deferDecrementIfTracked(owner);
+                if (captured) {
+                    MortalList.releaseCapturedDecrement(owner);
+                } else {
+                    MortalList.deferDecrementIfTracked(owner);
+                }
                 assertFalse(owner.hasScalarValueOwnerSlotFor(referent),
                         "deferred cleanup retires the explicit scalar slot");
                 MyVarCleanupStack.unregister(owner);
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
index 4f91a5e059..ea69e3fa51 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
@@ -263,4 +263,44 @@ void rangeRemovalReleasesOnlyRemovedElementSlots() {
             assertSame(retained, array.arrayElementOwnerSlot(0));
         }
     }
+
+    @Test
+    void popReleasesAnExplicitScalarOwnerAfterLegacyFlagRetires() {
+        assertRemovedElementOwnerIsReleased(true);
+    }
+
+    @Test
+    void shiftReleasesAnExplicitScalarOwnerAfterLegacyFlagRetires() {
+        assertRemovedElementOwnerIsReleased(false);
+    }
+
+    private static void assertRemovedElementOwnerIsReleased(boolean pop) {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeScalar cell = new RuntimeScalar();
+            cell.set(referent.createAnonymousReference());
+            RuntimeArray array = new RuntimeArray();
+            array.elements.add(cell);
+            array.elementsOwned = true;
+            array.reconcileArrayElementOwnerSlots();
+            MyVarCleanupStack.register(array);
+            int originalRefCount = referent.refCount;
+            cell.refCountOwned = false;
+
+            try {
+                RuntimeScalar removed = pop ? RuntimeArray.pop(array) : RuntimeArray.shift(array);
+                assertSame(cell, removed);
+                assertFalse(cell.hasScalarValueOwnerSlotFor(referent),
+                        "removing the element retires its explicit scalar slot");
+                MyVarCleanupStack.unregister(array);
+                MortalList.flush();
+                assertTrue(referent.refCount < originalRefCount,
+                        "the removed element's deferred count is released");
+            } finally {
+                MyVarCleanupStack.unregister(array);
+                MortalList.flush();
+            }
+        }
+    }
 }

From 84ddd5b45ddc1d6b79c21ec52900d5457a21ed5f Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 23 Oct 2026 05:33:02 +0200
Subject: [PATCH 219/317] docs: record aggregate cleanup validation

Record the passing full make for deferred, captured, and array slot cleanup.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index f40719c1d4..888a510a6d 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The candidate is based on `origin/master` at `5a6cf5ed6`; published head `c948d023a` passes full `nice -n 19 make` in 21m16s and hosted run `39887223844` on Linux and Windows, including both thread gates. The preceding head's one hosted Linux failure in `dbic_deep_cycle_weak_shift_regression.t` did not recur in local filtered/full-shard gates or the hosted rerun. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The candidate is based on `origin/master` at `5a6cf5ed6`; published head `c948d023a` passes hosted run `39887223844` on Linux and Windows, including both thread gates. Current local candidate `759302bb7` passes full `nice -n 19 make` in 22m25s; hosted validation is pending. The preceding head's one hosted Linux failure in `dbic_deep_cycle_weak_shift_regression.t` did not recur in local filtered/full-shard gates or the hosted rerun. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch is based on `origin/master` at `5a6cf5ed6`; published head `c948d023a` passes full `nice -n 19 make` in 21m16s and hosted run `39887223844` on Linux and Windows, including both thread gates. The preceding head's one hosted Linux failure in `dbic_deep_cycle_weak_shift_regression.t` did not recur in local filtered/full-shard gates or the hosted rerun. The preceding ownership candidate passes all three local thread configurations. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch is based on `origin/master` at `5a6cf5ed6`; published head `c948d023a` passes hosted run `39887223844` on Linux and Windows, including both thread gates. Current local candidate `759302bb7` passes full `nice -n 19 make` in 22m25s; hosted validation is pending. The preceding head's one hosted Linux failure in `dbic_deep_cycle_weak_shift_regression.t` did not recur in local filtered/full-shard gates or the hosted rerun. The preceding ownership candidate passes all three local thread configurations. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 ### Current batch
 
@@ -139,7 +139,8 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
 - The next cleanup tranche lets deferred scalar release, captured release, and
   array `pop`/`shift` recognize the explicit scalar slot after the legacy flag
   retires. Java regressions verify slot retirement and the deferred legacy
-  bridge decrement for each cleanup path. Validation is pending.
+  bridge decrement for each cleanup path. Full `nice -n 19 make` passes in
+  22m25s on `759302bb7`; hosted validation is pending.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 

From 5578d44bdfa9c74cae7e2e1f9a1b22e430de96b2 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 23 Oct 2026 06:33:36 +0200
Subject: [PATCH 220/317] refactor: trust scalar slots in recursive cleanup

Use explicit scalar owner identity throughout recursive container cleanup,
tail-call release, and void-result discard. Add regressions for each path
when the legacy Boolean has retired.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          | 11 ++-
 .../runtime/runtimetypes/MortalList.java      | 30 ++++----
 ...MortalListScalarValueOwnerRestoreTest.java | 75 +++++++++++++++++++
 3 files changed, 100 insertions(+), 16 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 888a510a6d..45f8696ac5 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The candidate is based on `origin/master` at `5a6cf5ed6`; published head `c948d023a` passes hosted run `39887223844` on Linux and Windows, including both thread gates. Current local candidate `759302bb7` passes full `nice -n 19 make` in 22m25s; hosted validation is pending. The preceding head's one hosted Linux failure in `dbic_deep_cycle_weak_shift_regression.t` did not recur in local filtered/full-shard gates or the hosted rerun. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The candidate is based on `origin/master` at `5a6cf5ed6`; published head `84ddd5b45` passes local full `nice -n 19 make` in 22m25s and hosted run `39895645097` on Linux and Windows, including both thread gates. The preceding head's one hosted Linux failure in `dbic_deep_cycle_weak_shift_regression.t` did not recur in local filtered/full-shard gates or the hosted rerun. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch is based on `origin/master` at `5a6cf5ed6`; published head `c948d023a` passes hosted run `39887223844` on Linux and Windows, including both thread gates. Current local candidate `759302bb7` passes full `nice -n 19 make` in 22m25s; hosted validation is pending. The preceding head's one hosted Linux failure in `dbic_deep_cycle_weak_shift_regression.t` did not recur in local filtered/full-shard gates or the hosted rerun. The preceding ownership candidate passes all three local thread configurations. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch is based on `origin/master` at `5a6cf5ed6`; published head `84ddd5b45` passes local full `nice -n 19 make` in 22m25s and hosted run `39895645097` on Linux and Windows, including both thread gates. The preceding head's one hosted Linux failure in `dbic_deep_cycle_weak_shift_regression.t` did not recur in local filtered/full-shard gates or the hosted rerun. The preceding ownership candidate passes all three local thread configurations. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 ### Current batch
 
@@ -140,7 +140,12 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   array `pop`/`shift` recognize the explicit scalar slot after the legacy flag
   retires. Java regressions verify slot retirement and the deferred legacy
   bridge decrement for each cleanup path. Full `nice -n 19 make` passes in
-  22m25s on `759302bb7`; hosted validation is pending.
+  22m25s on `759302bb7`; hosted run `39895645097` passes on Linux and Windows,
+  including both thread compatibility gates.
+- The following tranche extends the same scalar-slot predicate through
+  recursive container clear, tail-call argument release, and void-result
+  cleanup paths. Java regressions cover recursive and tail-call release;
+  validation is pending.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 9e5382ab5a..86e94ed8d5 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -638,8 +638,9 @@ public static void deferDecrementIfNotCaptured(RuntimeScalar scalar) {
     /**
      * Defer DESTROY for tracked blessed refs in a collection being cleared.
      * <p>
-     * Only decrements elements that own a refCount (refCountOwned == true).
-     * Elements stored via copy constructor (no setLarge) are skipped.
+     * Only decrements elements that own a counted reference, through either
+     * the legacy flag or an explicit scalar-value owner slot. Non-owning
+     * copies remain skipped.
      * Never-stored blessed objects (refCount == 0) are bumped to ensure DESTROY fires.
      */
     public static void deferDestroyForContainerClear(Iterable<RuntimeScalar> elements) {
@@ -730,7 +731,7 @@ public static void scopeExitCleanupHash(RuntimeHash hash) {
         for (RuntimeScalar val : hash.elements.values()) {
             if (val != null && (val.type & RuntimeScalarType.REFERENCE_BIT) != 0
                     && val.value instanceof RuntimeBase rb) {
-                if (rb.blessId != 0 || rb.refCount >= 0) {
+                if (val.ownsCountedReferent(rb) || rb.blessId != 0 || rb.refCount >= 0) {
                     needsWalk = true;
                     break;
                 }
@@ -849,7 +850,7 @@ public static void scopeExitCleanupArray(RuntimeArray arr, RuntimeBase returned)
             return;
         }
         // Quick scan: check if any element either:
-        //   1. Owns a refCount (was assigned via setLarge with a tracked referent), OR
+        //   1. Owns a counted referent through a legacy flag or scalar-value slot, OR
         //   2. Is a direct blessed reference (blessId != 0), OR
         //   3. Is a container (array/hash ref) that might hold nested blessed refs
         // For case 3, we peek one level deep to avoid false positives for arrays
@@ -857,9 +858,11 @@ public static void scopeExitCleanupArray(RuntimeArray arr, RuntimeBase returned)
         boolean needsWalk = RuntimeScalar.watcherCleanupNeeded();
         for (RuntimeScalar elem : arr.elements) {
             if (elem == null || (elem.type & RuntimeScalarType.REFERENCE_BIT) == 0) continue;
-            // Fast check: refCountOwned means this ref was properly tracked via setLarge
-            if (elem.refCountOwned) { needsWalk = true; break; }
             if (!(elem.value instanceof RuntimeBase rb)) continue;
+            // The explicit scalar slot can outlive the legacy ownership flag
+            // during the bridge migration, so either identity source needs the
+            // recursive release walk.
+            if (elem.ownsCountedReferent(rb)) { needsWalk = true; break; }
             // Direct blessed ref
             if (rb.blessId != 0 || rb.refCount >= 0) { needsWalk = true; break; }
             // Container ref — peek at children for reference-type elements
@@ -913,9 +916,9 @@ public static void releaseLastOwnedTailCallArgs(RuntimeArray args) {
         for (RuntimeScalar scalar : args.elements) {
             if (scalar == null
                     || !args.ownsElement(scalar)
-                    || !scalar.refCountOwned
                     || (scalar.type & RuntimeScalarType.REFERENCE_BIT) == 0
                     || !(scalar.value instanceof RuntimeBase base)
+                    || !scalar.ownsCountedReferent(base)
                     || base.refCount != 1) {
                 continue;
             }
@@ -926,9 +929,9 @@ public static void releaseLastOwnedTailCallArgs(RuntimeArray args) {
     public static void releaseTailCallCodeRef(RuntimeScalar codeRef) {
         if (codeRef == null
                 || !isActive()
-                || !codeRef.refCountOwned
                 || codeRef.type != RuntimeScalarType.CODE
                 || !(codeRef.value instanceof RuntimeCode code)
+                || !codeRef.ownsCountedReferent(code)
                 || code.refCount <= 0) {
             return;
         }
@@ -958,9 +961,9 @@ public static void releaseTailCallCodeRef(RuntimeScalar codeRef) {
 
     private static void releaseTailCallArgElement(RuntimeScalar scalar) {
         if (scalar == null
-                || !scalar.refCountOwned
                 || (scalar.type & RuntimeScalarType.REFERENCE_BIT) == 0
                 || !(scalar.value instanceof RuntimeBase base)
+                || !scalar.ownsCountedReferent(base)
                 || base.refCount <= 0) {
             return;
         }
@@ -1052,7 +1055,7 @@ private static void deferDecrementRecursive(RuntimeScalar scalar) {
 
             if (base.blessId != 0) {
                 boolean releasingLastOwner = false;
-                if (s.refCountOwned && base.refCount > 0) {
+                if (s.ownsCountedReferent(base) && base.refCount > 0) {
                     s.setRefCountOwned(false);
                     if (base.refCountTrace) {
                         base.traceRefCount(0, "MortalList.deferDecrementRecursive (blessed, queued)");
@@ -1100,7 +1103,7 @@ private static void deferDecrementRecursive(RuntimeScalar scalar) {
                 boolean hasDirectWeakElementRefs = containerHasWeakElementRefs(base);
                 boolean hasCleanupTargets = hasDirectWeakElementRefs
                         || containerMayContainCleanupTargets(base);
-                if (s.refCountOwned && base.refCount > 0) {
+                if (s.ownsCountedReferent(base) && base.refCount > 0) {
                     s.setRefCountOwned(false);
                     if (base.refCountTrace) {
                         base.traceRefCount(0, "MortalList.deferDecrementRecursive (unblessed container, queued)");
@@ -1225,7 +1228,8 @@ public static void mortalizeForVoidDiscard(RuntimeList result) {
                 boolean reachableCodeRef = base instanceof RuntimeCode
                         && scalar.isStoredInRegisteredContainerOwner()
                         && ReachabilityWalker.isScalarReachable(scalar);
-                if (scalar.refCountOwned && base.refCount > 0 && unblessedDiscardableContainer
+                if (scalar.ownsCountedReferent(base) && base.refCount > 0
+                        && unblessedDiscardableContainer
                         && !reachableCodeRef) {
                     scalar.setRefCountOwned(false);
                     if (base.refCountTrace) {
@@ -2032,7 +2036,7 @@ static boolean restoreReachableAggregateOwnerCount(RuntimeBase referent) {
         // when restoring the mixed legacy/native count.
         for (RuntimeScalar scalar : referent.countedScalarOwnerSnapshot()) {
             if (scalar == null || rootedHashCells.contains(scalar)
-                    || !scalar.refCountOwned || scalar.value != referent
+                    || !scalar.ownsCountedReferent(referent)
                     || !ReachabilityWalker.isScalarReachable(scalar)) {
                 continue;
             }
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java
index 9bf8aad073..fc8b99342c 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java
@@ -45,6 +45,81 @@ void capturedReleaseUsesExplicitScalarOwnerAfterLegacyFlagRetires() {
         assertExplicitScalarOwnerRelease(true);
     }
 
+    @Test
+    void recursiveContainerCleanupUsesExplicitScalarOwnerAfterLegacyFlagRetires() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeScalar owner = new RuntimeScalar();
+            owner.set(referent.createAnonymousReference());
+            MyVarCleanupStack.register(owner);
+            int originalRefCount = referent.refCount;
+            owner.refCountOwned = false;
+
+            try {
+                MortalList.deferDestroyForContainerClear(java.util.List.of(owner));
+                assertFalse(owner.hasScalarValueOwnerSlotFor(referent));
+                MyVarCleanupStack.unregister(owner);
+                MortalList.flush();
+                assertTrue(referent.refCount < originalRefCount,
+                        "recursive cleanup queues the explicit owner's decrement");
+            } finally {
+                MyVarCleanupStack.unregister(owner);
+                MortalList.flush();
+            }
+        }
+    }
+
+    @Test
+    void tailCallCleanupUsesExplicitScalarOwnerAfterLegacyFlagRetires() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeScalar owner = new RuntimeScalar();
+            owner.set(referent.createAnonymousReference());
+            RuntimeArray args = new RuntimeArray();
+            args.elements.add(owner);
+            args.elementsOwned = true;
+            args.reconcileArrayElementOwnerSlots();
+            int originalRefCount = referent.refCount;
+            owner.refCountOwned = false;
+
+            try {
+                MortalList.releaseLastOwnedTailCallArgs(args);
+                assertFalse(owner.hasScalarValueOwnerSlotFor(referent));
+                assertTrue(referent.refCount < originalRefCount,
+                        "tail-call cleanup releases the explicit owner's count");
+            } finally {
+                args.releaseArrayElementOwnerSlots();
+                args.elements.clear();
+                MortalList.flush();
+            }
+        }
+    }
+
+    @Test
+    void voidResultCleanupUsesExplicitScalarOwnerAfterLegacyFlagRetires() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeScalar owner = new RuntimeScalar();
+            owner.set(referent.createAnonymousReference());
+            RuntimeList result = new RuntimeList(owner);
+            int originalRefCount = referent.refCount;
+            owner.refCountOwned = false;
+
+            try {
+                MortalList.mortalizeForVoidDiscard(result);
+                assertFalse(owner.hasScalarValueOwnerSlotFor(referent));
+                MortalList.flush();
+                assertTrue(referent.refCount < originalRefCount,
+                        "void-result cleanup releases the explicit owner's count");
+            } finally {
+                MortalList.flush();
+            }
+        }
+    }
+
     private static void assertExplicitScalarOwnerRelease(boolean captured) {
         PerlRuntime runtime = new PerlRuntime();
         try (PerlRuntime.Binding ignored = runtime.bind()) {

From 136ae119dbefdb8955305bfe18195c4299539f62 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 23 Oct 2026 07:08:28 +0200
Subject: [PATCH 221/317] docs: record recursive cleanup validation

Record the passing full make result for recursive owner-slot cleanup paths.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 45f8696ac5..2bd8255f38 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The candidate is based on `origin/master` at `5a6cf5ed6`; published head `84ddd5b45` passes local full `nice -n 19 make` in 22m25s and hosted run `39895645097` on Linux and Windows, including both thread gates. The preceding head's one hosted Linux failure in `dbic_deep_cycle_weak_shift_regression.t` did not recur in local filtered/full-shard gates or the hosted rerun. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The candidate is based on `origin/master` at `5a6cf5ed6`; published head `84ddd5b45` passes hosted run `39895645097` on Linux and Windows, including both thread gates. Current local candidate `5578d44bd` passes full `nice -n 19 make` in 33m11s; hosted validation is pending. The preceding head's one hosted Linux failure in `dbic_deep_cycle_weak_shift_regression.t` did not recur in local filtered/full-shard gates or the hosted rerun. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch is based on `origin/master` at `5a6cf5ed6`; published head `84ddd5b45` passes local full `nice -n 19 make` in 22m25s and hosted run `39895645097` on Linux and Windows, including both thread gates. The preceding head's one hosted Linux failure in `dbic_deep_cycle_weak_shift_regression.t` did not recur in local filtered/full-shard gates or the hosted rerun. The preceding ownership candidate passes all three local thread configurations. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch is based on `origin/master` at `5a6cf5ed6`; published head `84ddd5b45` passes hosted run `39895645097` on Linux and Windows, including both thread gates. Current local candidate `5578d44bd` passes full `nice -n 19 make` in 33m11s; hosted validation is pending. The preceding head's one hosted Linux failure in `dbic_deep_cycle_weak_shift_regression.t` did not recur in local filtered/full-shard gates or the hosted rerun. The preceding ownership candidate passes all three local thread configurations. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 ### Current batch
 
@@ -145,7 +145,8 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
 - The following tranche extends the same scalar-slot predicate through
   recursive container clear, tail-call argument release, and void-result
   cleanup paths. Java regressions cover recursive and tail-call release;
-  validation is pending.
+  full `nice -n 19 make` passes in 33m11s on `5578d44bd`; hosted validation is
+  pending.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 

From baedb14a7df4971dd4df9344683ec2c99999cdf7 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 23 Oct 2026 10:41:50 +0200
Subject: [PATCH 222/317] fix: honor scalar slots throughout lifecycle cleanup

Recognize explicit scalar owner slots during overwrite, undef, scope exit,
container materialization, scalar-reference retention, and closure capture
cleanup after the legacy ownership flag retires. Add focused Java regressions
for each boundary and record full validation.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <158243242+codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md          | 13 ++++
 docs/about/changelog.md                       |  2 +-
 .../runtime/runtimetypes/RuntimeScalar.java   | 47 ++++++++-----
 .../MortalListDeferredCaptureTest.java        | 47 +++++++++++++
 ...MortalListScalarValueOwnerRestoreTest.java | 67 +++++++++++++++++++
 ...lOwnerSlotScalarReferenceContentsTest.java | 24 +++++++
 .../RuntimeArrayElementOwnershipTest.java     | 42 ++++++++++++
 7 files changed, 223 insertions(+), 19 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 2bd8255f38..9eb1f9dc7d 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -147,6 +147,19 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   cleanup paths. Java regressions cover recursive and tail-call release;
   full `nice -n 19 make` passes in 33m11s on `5578d44bd`; hosted validation is
   pending.
+- Lexical scope exit now recognizes an active scalar-value owner slot after
+  `refCountOwned` retires. The focused Java regression passes as part of full
+  `nice -n 19 make` (23m57s); documentation links pass. A follow-up inspection
+  found the same retired-flag gap in explicit `undef`, including named CODE
+  slots. That path now checks the scalar slot before clearing the cell, with a
+  Java regression; full `nice -n 19 make` passes in 15m40s. The next bundled
+  tranche extends slot authority through scalar overwrite, container-copy
+  accounting, scalar-reference contents, closure-capture acquisition, and
+  deferred captured cleanup. Java regressions cover these boundaries. Its
+  full validation is pending. This branch began at `origin/master` commit
+  `5a6cf5ed6`; live `origin/master` has since advanced to `aeda28344`, including
+  the Catalyst upload cleanup for #1795. Reconcile that change before the next
+  hosted validation, preserving the broader local lifetime regression.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 
diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index 68d0407ed6..97e7aa54af 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -20,7 +20,7 @@ priorities and future plans.
 - Avoid retaining transient arrays and hashes through shared immutable scalar literals while preserving reference ownership tracking.
 - Run standard Perl's `cpan -t Module` for CPAN oracle checks and keep download failures inconclusive instead of reporting missing local modules as Perl failures.
 - Keep lexical-registration membership checks constant-time, avoiding quadratic CPAN index parsing as cleanup stacks grow.
-- Keep a referent alive while another owning array or hash slot still aliases its scalar cell after `pop`, `shift`, or `delete` (#1649).
+- Keep scalar-slot owners authoritative across stores, container copies, scalar references, closure captures, lexical scope exit, overwrites, and explicit `undef` after legacy tracking retires; preserve aliases through `pop`, `shift`, or `delete` (#1649).
 - Synchronize the destroyable-closure reverse index so ithread capture cloning and release can update it safely.
 - Follow scalar owner slots during aggregate lifetime recovery, avoiding a whole-root walk for nested scalar-owned containers.
 - Preserve numeric types of cached read-only scalars in ranges, rejecting unsigned endpoints outside the supported integer range.
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index d8578dcca5..d8c3de21ac 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -607,7 +607,7 @@ public void retainClosureCapture(RuntimeCode closureOwner) {
         boolean firstCapture = captureCount++ == 0;
         if (firstCapture && type == RuntimeScalarType.CODE) {
             retainClosureCaptureReferent();
-        } else if (firstCapture && !refCountOwned) {
+        } else if (firstCapture && !ownsCurrentCountedReferent()) {
             // A captured lexical is a Perl owner even when this scalar is a
             // borrowed copy of the pad slot and therefore has no ordinary
             // refCountOwned token of its own. Keep the referent alive for the
@@ -636,7 +636,7 @@ void retainThreadCloneClosureCapture(RuntimeCode closureOwner) {
         // An owning lexical slot already protects its referent. Borrowed
         // argument aliases do not, and the source runtime's other owners are
         // not a lifetime guarantee in the cloned runtime.
-        if (!refCountOwned) retainClosureCaptureReferent();
+        if (!ownsCurrentCountedReferent()) retainClosureCaptureReferent();
         recordDestroyableClosureOwner(closureOwner);
     }
 
@@ -874,6 +874,10 @@ synchronized boolean ownsCountedReferent(RuntimeBase referent) {
                 && (refCountOwned || hasScalarValueOwnerSlotFor(referent));
     }
 
+    private boolean ownsCurrentCountedReferent() {
+        return value instanceof RuntimeBase base && ownsCountedReferent(base);
+    }
+
     /**
      * Keep the owner ledger paired with the legacy scalar ownership bit while
      * the lifecycle bridge is being migrated. This records the scalar-cell
@@ -2352,9 +2356,8 @@ public void vivifyLogicalAssignmentLvalue() {
      * (to avoid over-counting for temporary copies). This method should be called
      * after storing a tracked reference in a container, if MortalList is active.
      * <p>
-     * Skips elements that already have {@code refCountOwned == true}, meaning they
-     * were created via {@code set()} / {@code setLarge()} rather than the copy
-     * constructor, and their refCount was already incremented at creation time.
+     * Skips elements that already have an explicit scalar owner slot or legacy
+     * owner token, meaning their refCount was already incremented at creation.
      */
     public static void incrementRefCountForContainerStore(RuntimeScalar scalar) {
         if (scalar == null) {
@@ -2370,9 +2373,9 @@ public static void incrementRefCountForContainerStore(RuntimeScalar scalar) {
                 && !scalar.hasScalarReferenceContentsOwner()) {
             scalar.retainScalarReferenceContents(scalar);
         }
-        if (scalar.refCountOwned
-                || (scalar.type & REFERENCE_BIT) == 0
-                || !(scalar.value instanceof RuntimeBase base)) {
+        if ((scalar.type & REFERENCE_BIT) == 0
+                || !(scalar.value instanceof RuntimeBase base)
+                || scalar.ownsCountedReferent(base)) {
             return;
         }
         // Destroyed / weaken sentinel states must not be reactivated here.
@@ -2442,9 +2445,9 @@ private static boolean scalarReferenceContentsNeedRetain(RuntimeScalar value) {
                 && value.type == REFERENCE
                 && value.value instanceof RuntimeScalar scalarReferent
                 && !WeakRefRegistry.isweak(scalarReferent)
-                && !scalarReferent.refCountOwned
                 && (scalarReferent.type & REFERENCE_BIT) != 0
                 && scalarReferent.value instanceof RuntimeBase inner
+                && !scalarReferent.ownsCountedReferent(inner)
                 && inner.refCount >= 0;
     }
 
@@ -2878,7 +2881,8 @@ private RuntimeScalar setLargeRefCounted(RuntimeScalar value) {
                 && this.value instanceof RuntimeBase oldReferent
                 && (oldReferent instanceof RuntimeHash || oldReferent instanceof RuntimeArray);
         if (!scalarRefContentTrackingNeeded
-                && !this.refCountOwned && this.captureCount == 0 && this.captureRefCountOwned() == 0
+                && !this.ownsCurrentCountedReferent()
+                && this.captureCount == 0 && this.captureRefCountOwned() == 0
                 && !WeakRefRegistry.isweak(this)
                 && !droppingAggregateWithWeakRefs
                 && this.type != GLOBREFERENCE && value.type != GLOBREFERENCE) {
@@ -3019,6 +3023,8 @@ && isSocketIOHandle(oldIo.ioHandle)) {
         // scalarReferenceContents.  Assigning through $$ref transfers that
         // ownership to the new contents, so the old referent must be released
         // even though this scalar did not itself record a direct store owner.
+        boolean oldOwnedByScalarValue = oldBase != null
+                && ownsCountedReferent(oldBase);
         boolean oldOwnedByScalarReference = oldBase != null
                 && referencedByScalarReference
                 && scalarReferenceContentsOwnersSnapshot().isEmpty()
@@ -3222,7 +3228,7 @@ && hasLiveIo(assignedGlob)) {
         // Decrement old value's refCount AFTER assignment (skip for weak refs
         // and for scalars that didn't own a refCount increment).
         if (oldBase != null && !thisWasWeak
-                && (this.refCountOwned || oldOwnedByScalarReference)) {
+                && (oldOwnedByScalarValue || oldOwnedByScalarReference)) {
             if (oldBase.refCount > 0) {
                 oldBase.traceRefCount(-1, "RuntimeScalar.setLargeRefCounted (decrement on overwrite)");
                 oldBase.releaseOwner(this, "setLargeRefCounted overwrite");
@@ -5241,7 +5247,7 @@ public RuntimeScalar undefine() {
         if (type == RuntimeScalarType.CODE && value instanceof RuntimeCode code && globalCodeRefFqn != null) {
             boolean releasedCode = false;
             releaseAllClosureCaptureReferents(code);
-            if (this.refCountOwned && code.refCount > 0) {
+            if (this.ownsCountedReferent(code) && code.refCount > 0) {
                 this.setRefCountOwned(false);
                 code.releaseActiveOwner(this);
                 if (--code.refCount == 0) {
@@ -5287,6 +5293,7 @@ public RuntimeScalar undefine() {
         if (oldBase != null && this.captureRefCountOwned() > 0) {
             releaseAllClosureCaptureReferents(oldBase);
         }
+        boolean oldBaseOwnedByScalar = oldBase != null && ownsCountedReferent(oldBase);
 
         // Close IO handles when dropping a glob reference.
         // This mimics Perl's internal sv_clear behavior where IO handles are closed
@@ -5313,7 +5320,7 @@ public RuntimeScalar undefine() {
                 // but safe since unblessed objects have no DESTROY.
                 oldBase.refCount = Integer.MIN_VALUE;
                 DestroyDispatch.callDestroy(oldBase);
-            } else if (this.refCountOwned && oldBase.refCount > 0) {
+            } else if (oldBaseOwnedByScalar && oldBase.refCount > 0) {
                 this.setRefCountOwned(false);
                 oldBase.releaseActiveOwner(this);
                 if (--oldBase.refCount == 0) {
@@ -5349,7 +5356,7 @@ public RuntimeScalar undefine() {
                     }
                 }
             } else if (oldBase.blessId != 0 && WeakRefRegistry.weakRefsExist()) {
-                // Phase D: no owned-count decrement (refCountOwned was false, or
+                // Phase D: no owned-count decrement (no scalar owner slot existed, or
                 // refCount was already 0 from prior selective drift). The
                 // object is blessed — if its class has DESTROY, let the walker
                 // decide whether this undef just released the last live lexical
@@ -5500,10 +5507,14 @@ public static void scopeExitCleanup(RuntimeScalar scalar) {
         }
 
         // Fast path: skip if no special state (most common case for integer/string vars).
-        // When all three conditions are true, the entire method body is a no-op:
-        // - refCountOwned=false → deferDecrementIfTracked returns immediately
+        // When all conditions are true, the entire method body is a no-op:
+        // - no scalar-value owner exists → deferDecrementIfTracked returns immediately
         // - captureCount=0 → capture handling branch not taken
-        if (!scalar.refCountOwned && scalar.captureCount == 0 && !scalar.ioOwner
+        boolean ownsCurrentReferent = scalar.refCountOwned
+                || ((scalar.type & RuntimeScalarType.REFERENCE_BIT) != 0
+                    && scalar.value instanceof RuntimeBase base
+                    && scalar.ownsCountedReferent(base));
+        if (!ownsCurrentReferent && scalar.captureCount == 0 && !scalar.ioOwner
                 && !scalar.hasScalarReferenceContentsOwner()
                 && scalar.type != RuntimeScalarType.TIED_SCALAR) {
             // Special case: CODE refs with unreleased captures that were never
@@ -5590,7 +5601,7 @@ public static void scopeExitCleanup(RuntimeScalar scalar) {
                 // At inner scope exit we can't decrement (closures in outer scopes
                 // may legitimately keep the object alive), but after the main
                 // script finishes ALL scopes have exited, so it's safe.
-                if (scalar.refCountOwned
+                if (scalar.ownsCurrentCountedReferent()
                         && ((scalar.type & RuntimeScalarType.REFERENCE_BIT) != 0
                             || scalar.type == RuntimeScalarType.GLOB)
                         && scalar.value instanceof RuntimeBase rb
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListDeferredCaptureTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListDeferredCaptureTest.java
index 79a78a4e73..c8acc51207 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListDeferredCaptureTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListDeferredCaptureTest.java
@@ -52,6 +52,33 @@ void unreachableHttpBodyCaptureReleasesAtItsScopeBoundaryWithoutWeakRefs() {
         }
     }
 
+    @Test
+    void unreachableBlessedCaptureUsesExplicitScalarSlotAfterLegacyFlagRetires() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            String className = "DeferredCaptureBoundary::ExplicitSlot";
+            RuntimeHash referent = new RuntimeHash();
+            referent.blessId = NameNormalizer.getBlessId(className);
+            referent.refCount = 1;
+            installDestroy(className);
+
+            RuntimeScalar pad = referenceTo(referent);
+            pad.setRefCountOwned(true);
+            pad.refCountOwned = false;
+            pad.retainClosureCapture();
+
+            MortalList.flush();
+
+            MortalList.pushMark();
+            RuntimeScalar.scopeExitCleanup(pad);
+            MortalList.popAndFlush();
+
+            assertEquals(RuntimeBase.PerlLifecycleState.DESTROYED,
+                    referent.perlLifecycleState());
+            GlobalVariable.removeGlobalCodeRefForStashDelete(className + "::DESTROY");
+        }
+    }
+
     @Test
     void unreachableBlessedCaptureWithWeakObserverReleasesAtItsScopeBoundary() {
         PerlRuntime runtime = new PerlRuntime();
@@ -83,6 +110,26 @@ void unreachableBlessedCaptureWithWeakObserverReleasesAtItsScopeBoundary() {
         }
     }
 
+    @Test
+    void closureCaptureDoesNotDoubleCountExplicitScalarOwnerAfterLegacyFlagRetires() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeHash referent = new RuntimeHash();
+            referent.refCount = 1;
+            RuntimeScalar pad = referenceTo(referent);
+            pad.setRefCountOwned(true);
+            pad.refCountOwned = false;
+
+            pad.retainClosureCapture();
+
+            assertEquals(1, referent.refCount,
+                    "the explicit scalar slot already accounts for the referent");
+            assertEquals(0, pad.captureRefCountOwned(),
+                    "capture metadata must not add a second legacy bridge owner");
+            pad.releaseClosureCapture();
+        }
+    }
+
     private static RuntimeScalar referenceTo(RuntimeBase referent) {
         RuntimeScalar scalar = new RuntimeScalar();
         scalar.type = RuntimeScalarType.HASHREFERENCE;
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java
index fc8b99342c..c1fb80395e 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java
@@ -40,6 +40,73 @@ void deferredReleaseUsesExplicitScalarOwnerAfterLegacyFlagRetires() {
         assertExplicitScalarOwnerRelease(false);
     }
 
+    @Test
+    void scopeExitReleasesExplicitScalarOwnerAfterLegacyFlagRetires() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeScalar owner = new RuntimeScalar();
+            owner.set(referent.createAnonymousReference());
+            MyVarCleanupStack.register(owner);
+            int originalRefCount = referent.refCount;
+            owner.refCountOwned = false;
+
+            try {
+                RuntimeScalar.scopeExitCleanup(owner);
+                assertFalse(owner.hasScalarValueOwnerSlotFor(referent),
+                        "scope exit retires the explicit scalar slot");
+                MyVarCleanupStack.unregister(owner);
+                MortalList.flush();
+                assertTrue(referent.refCount < originalRefCount,
+                        "scope exit queues the explicit owner's decrement");
+            } finally {
+                MyVarCleanupStack.unregister(owner);
+                MortalList.flush();
+            }
+        }
+    }
+
+    @Test
+    void explicitUndefReleasesScalarOwnerAfterLegacyFlagRetires() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeScalar owner = new RuntimeScalar();
+            owner.set(referent.createAnonymousReference());
+            int originalRefCount = referent.refCount;
+            owner.refCountOwned = false;
+
+            owner.undefine();
+
+            assertFalse(owner.hasScalarValueOwnerSlotFor(referent),
+                    "explicit undef retires the scalar owner slot");
+            assertTrue(referent.refCount < originalRefCount,
+                    "explicit undef releases the slot's counted owner");
+        }
+    }
+
+    @Test
+    void scalarOverwriteReleasesExplicitOwnerAfterLegacyFlagRetires() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray previous = new RuntimeArray();
+            RuntimeArray replacement = new RuntimeArray();
+            RuntimeScalar owner = new RuntimeScalar();
+            owner.set(previous.createAnonymousReference());
+            int originalRefCount = previous.refCount;
+            owner.refCountOwned = false;
+
+            owner.set(replacement.createAnonymousReference());
+
+            assertFalse(owner.hasScalarValueOwnerSlotFor(previous),
+                    "overwrite retires the previous scalar owner slot");
+            assertTrue(previous.refCount < originalRefCount,
+                    "overwrite releases the previous slot's counted owner");
+            assertTrue(owner.hasScalarValueOwnerSlotFor(replacement),
+                    "overwrite installs the replacement scalar owner slot");
+        }
+    }
+
     @Test
     void capturedReleaseUsesExplicitScalarOwnerAfterLegacyFlagRetires() {
         assertExplicitScalarOwnerRelease(true);
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotScalarReferenceContentsTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotScalarReferenceContentsTest.java
index bbc217ab19..53e83723c0 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotScalarReferenceContentsTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotScalarReferenceContentsTest.java
@@ -77,6 +77,30 @@ void acquireAndReleaseUseTheScalarContentsSlotIdentity() {
         assertEquals(3, referent.refCount);
     }
 
+    @Test
+    void scalarReferenceCopyDoesNotDoubleCountExplicitlyOwnedCellContents() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeHash referent = new RuntimeHash();
+            referent.refCount = 3;
+            RuntimeScalar scalarReferent = new RuntimeScalar();
+            scalarReferent.type = RuntimeScalarType.REFERENCE;
+            scalarReferent.value = referent;
+            scalarReferent.setRefCountOwned(true);
+            scalarReferent.refCountOwned = false;
+
+            RuntimeScalar outerReference = new RuntimeScalar();
+            outerReference.type = RuntimeScalarType.REFERENCE;
+            outerReference.value = scalarReferent;
+            RuntimeScalar.incrementRefCountForContainerStore(outerReference);
+
+            assertEquals(3, referent.refCount,
+                    "the copied scalar reference does not duplicate its cell's owner");
+            assertEquals(0, referent.ownerSlotCount(
+                    PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS));
+        }
+    }
+
     @Test
     void aliasesToOneCellShareOneReferentCountAcrossRetargetAndRelease() {
         RuntimeHash original = new RuntimeHash();
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
index ea69e3fa51..b447423813 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayElementOwnershipTest.java
@@ -274,6 +274,48 @@ void shiftReleasesAnExplicitScalarOwnerAfterLegacyFlagRetires() {
         assertRemovedElementOwnerIsReleased(false);
     }
 
+    @Test
+    void containerStoreDoesNotDoubleCountExplicitScalarOwnerAfterLegacyFlagRetires() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            referent.refCount = 1;
+            RuntimeScalar cell = new RuntimeScalar();
+            cell.type = RuntimeScalarType.ARRAYREFERENCE;
+            cell.value = referent;
+            cell.setRefCountOwned(true);
+            cell.refCountOwned = false;
+
+            RuntimeScalar.incrementRefCountForContainerStore(cell);
+
+            assertEquals(1, referent.refCount,
+                    "container materialization recognizes the active scalar slot");
+            assertEquals(1, referent.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+        }
+    }
+
+    @Test
+    void containerStoreStillCountsASeparateCellWhenSourceOwnerIsExplicit() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            referent.refCount = 1;
+            RuntimeScalar source = new RuntimeScalar();
+            source.type = RuntimeScalarType.ARRAYREFERENCE;
+            source.value = referent;
+            source.setRefCountOwned(true);
+            source.refCountOwned = false;
+            RuntimeScalar storedCopy = new RuntimeScalar(source);
+
+            RuntimeScalar.incrementRefCountForContainerStore(storedCopy);
+
+            assertEquals(2, referent.refCount,
+                    "a separate aggregate cell acquires its own owner");
+            assertEquals(2, referent.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE),
+                    "the source and copied cell have distinct scalar owner slots");
+        }
+    }
+
     private static void assertRemovedElementOwnerIsReleased(boolean pop) {
         PerlRuntime runtime = new PerlRuntime();
         try (PerlRuntime.Binding ignored = runtime.bind()) {

From b0483f4940f451b2170202477ba6bafb82ea5f0d Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 23 Oct 2026 13:46:20 +0200
Subject: [PATCH 223/317] fix: honor scalar slots during weak lifecycle sweeps

Use explicit scalar value owner slots in released-referent reachability
proofs and weak-reference release after the legacy ownership flag retires.
Add focused regressions for both lifecycle paths.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtimetypes/ReachabilityWalker.java      | 14 ++++----
 .../runtime/runtimetypes/WeakRefRegistry.java |  8 ++---
 ...abilityWalkerScalarValueOwnerSlotTest.java | 32 +++++++++++++++++++
 3 files changed, 44 insertions(+), 10 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index ebde2bce0b..d53c6b1ed4 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -3755,7 +3755,7 @@ public static ReleasedWeakSweepResult sweepReleasedWeakReferents(
                 if (slot.kind() != PerlOwnerSlot.Kind.SCALAR_VALUE
                         || slot.referent() != referent) continue;
                 RuntimeScalar owner = slot.ownerCell();
-                if (owner == null || !owner.refCountOwned || owner.scopeExited
+                if (owner == null || !owner.ownsCountedReferent(referent) || owner.scopeExited
                         || !MyVarCleanupStack.isLive(owner) || WeakRefRegistry.isweak(owner)
                         || (owner.type & RuntimeScalarType.REFERENCE_BIT) == 0
                         || owner.value != referent) continue;
@@ -3763,10 +3763,10 @@ public static ReleasedWeakSweepResult sweepReleasedWeakReferents(
             }
         }
         for (RuntimeScalar owner : ScalarRefRegistry.snapshot()) {
-            if (owner == null || !owner.refCountOwned || owner.scopeExited
+            if (owner == null || !(owner.value instanceof RuntimeBase target)
+                    || !owner.ownsCountedReferent(target) || owner.scopeExited
                     || !MyVarCleanupStack.isLive(owner) || WeakRefRegistry.isweak(owner)
-                    || (owner.type & RuntimeScalarType.REFERENCE_BIT) == 0
-                    || !(owner.value instanceof RuntimeBase target)) {
+                    || (owner.type & RuntimeScalarType.REFERENCE_BIT) == 0) {
                 continue;
             }
             if (pending.contains(target)) directlyOwned.add(target);
@@ -3813,7 +3813,9 @@ public static ReleasedWeakSweepResult sweepReleasedWeakReferents(
         Set<RuntimeBase> countedStrongOwners =
                 Collections.newSetFromMap(new IdentityHashMap<>());
         for (RuntimeScalar owner : ScalarRefRegistry.snapshot()) {
-            if (owner == null || !owner.refCountOwned || WeakRefRegistry.isweak(owner)) continue;
+            if (owner == null || !(owner.value instanceof RuntimeBase referent)
+                    || !owner.ownsCountedReferent(referent)
+                    || WeakRefRegistry.isweak(owner)) continue;
             // Hash/array slots in a discarded aggregate are internal owners of
             // that graph, not independent roots. Keep their referents only when
             // the containing aggregate is still reachable or was not part of
@@ -3823,7 +3825,7 @@ public static ReleasedWeakSweepResult sweepReleasedWeakReferents(
                     && !live.contains(owner.containerOwner)) {
                 continue;
             }
-            if (owner.value instanceof RuntimeBase referent && referents.contains(referent)) {
+            if (referents.contains(referent)) {
                 countedStrongOwners.add(referent);
             }
         }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/WeakRefRegistry.java b/src/main/java/org/perlonjava/runtime/runtimetypes/WeakRefRegistry.java
index 6455b56956..2d5cd049a7 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/WeakRefRegistry.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/WeakRefRegistry.java
@@ -151,17 +151,17 @@ private static void weaken(
                 && !(base instanceof RuntimeCode)
                 && weakenedLiveLexical;
 
-        if (base.refCount > 0 && ref.refCountOwned) {
+        if (base.refCount > 0 && ref.ownsCountedReferent(base)) {
             // Tracked object with a properly-counted reference:
             // decrement strong count (weak ref doesn't count).
-            // Only decrement if refCountOwned=true, meaning the hash element
-            // or variable's creation incremented the referent's refCount via
+            // Only decrement if the legacy ownership token or explicit scalar
+            // value slot proves that this cell acquired the referent's count via
             // setLargeRefCounted or incrementRefCountForContainerStore.
             // If refCountOwned=false (e.g., element in an untracked anonymous
             // hash like `{ weakref => $target }`), the store never incremented
             // refCount, so weaken must not decrement either — otherwise we
             // get a double-decrement that causes premature destruction.
-            // Clear refCountOwned because weaken's DEC consumes the ownership —
+            // Clear the owner slot and legacy bridge because weaken's DEC consumes the ownership —
             // the weak scalar should not trigger another DEC on scope exit or overwrite.
             ref.setRefCountOwned(false);
             base.traceRefCount(-1, "WeakRefRegistry.weaken (decrement on weakening)");
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerScalarValueOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerScalarValueOwnerSlotTest.java
index f69d63af48..92c39609f5 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerScalarValueOwnerSlotTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerScalarValueOwnerSlotTest.java
@@ -27,6 +27,9 @@ void directOwnerSlotPreservesTargetCreatedBeforeWeakTracking() {
                     "the strong owner predates lazy weak-scalar registration");
             assertTrue(strongOwner.scalarValueOwnerSlot().isActive());
             assertEquals(1, target.refCount);
+            // Simulate retirement of the legacy bridge while the identity-based
+            // scalar owner slot remains the authoritative ownership record.
+            strongOwner.refCountOwned = false;
 
             try (MortalList.ReachabilityQueryMeasurement measurement =
                          MortalList.measureReachabilityQueries()) {
@@ -44,4 +47,33 @@ void directOwnerSlotPreservesTargetCreatedBeforeWeakTracking() {
             }
         }
     }
+
+    @Test
+    void weakeningUsesAnActiveScalarOwnerSlotAfterLegacyFlagRetires() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray target = new RuntimeArray();
+            RuntimeScalar strongOwner = new RuntimeScalar();
+            strongOwner.set(target.createAnonymousReference());
+            MyVarCleanupStack.register(strongOwner);
+
+            RuntimeScalar weakObserver = new RuntimeScalar();
+            weakObserver.set(target.createAnonymousReference());
+            assertEquals(2, target.refCount);
+            weakObserver.refCountOwned = false;
+            assertTrue(weakObserver.scalarValueOwnerSlot().isActive());
+
+            try {
+                WeakRefRegistry.weaken(weakObserver);
+
+                assertEquals(1, target.refCount,
+                        "weakening consumes the count proven by the explicit slot");
+                assertFalse(weakObserver.scalarValueOwnerSlot().isActive());
+                assertTrue(WeakRefRegistry.isweak(weakObserver));
+            } finally {
+                WeakRefRegistry.unweaken(weakObserver);
+                MyVarCleanupStack.unregister(strongOwner);
+            }
+        }
+    }
 }

From 5d422e30569d2bfb1b4e375d328ded84234ffee4 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 23 Oct 2026 15:57:20 +0200
Subject: [PATCH 224/317] fix: honor scalar slots in stash and clone cleanup

Use explicit scalar value ownership when deleting stash entries, cloning
thread graphs, balancing DESTROY arguments, and retaining blessed glob aliases.
Cover retired-flag ownership in stash deletion, graph cloning, and glob retention.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtime/runtimetypes/DestroyDispatch.java |  4 +--
 .../runtimetypes/MyVarCleanupStack.java       |  4 +--
 .../runtimetypes/RuntimeGraphCloner.java      |  3 +-
 .../runtime/runtimetypes/RuntimeStash.java    |  2 +-
 .../MyVarCleanupStackOwnerSlotTest.java       | 34 ++++++++++++++++++
 .../runtimetypes/RuntimeGraphClonerTest.java  | 21 +++++++++++
 .../RuntimeStashOwnerSlotTest.java            | 35 +++++++++++++++++++
 7 files changed, 97 insertions(+), 6 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStackOwnerSlotTest.java
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeStashOwnerSlotTest.java

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
index e2221f00d1..91d2f269d0 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
@@ -526,8 +526,8 @@ private static void doCallDestroy(RuntimeBase referent, String className) {
                     // avoids recursively entering callDestroy while the same
                     // referent is still in its DESTROY frame.
                     for (RuntimeScalar elem : args.elements) {
-                        if (elem != null && elem.refCountOwned
-                                && elem.value instanceof RuntimeBase base
+                        if (elem != null && elem.value instanceof RuntimeBase base
+                                && elem.ownsCountedReferent(base)
                                 && base.refCount > 0) {
                             if (base.refCountTrace) {
                                 base.releaseOwner(elem, "doCallDestroy args balance");
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStack.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStack.java
index 2cdf185b95..5f57813246 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStack.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStack.java
@@ -360,7 +360,7 @@ public static void retainBlessedGlobAliases(RuntimeGlob glob, RuntimeBase refere
                     && (scalar.type == RuntimeScalarType.GLOB
                         || scalar.type == RuntimeScalarType.GLOBREFERENCE)
                     && scalar.value == glob
-                    && !scalar.refCountOwned
+                    && !scalar.ownsCountedReferent(referent)
                     && seen.put(scalar, Boolean.TRUE) == null) {
                 scalar.setRefCountOwned(true);
                 referent.recordOwner(scalar, "blessed glob lexical alias");
@@ -375,7 +375,7 @@ public static void retainBlessedGlobAliases(RuntimeGlob glob, RuntimeBase refere
                     && (scalar.type == RuntimeScalarType.GLOB
                     || scalar.type == RuntimeScalarType.GLOBREFERENCE)
                     && scalar.value == glob
-                    && !scalar.refCountOwned
+                    && !scalar.ownsCountedReferent(referent)
                     && seen.put(scalar, Boolean.TRUE) == null) {
                 scalar.setRefCountOwned(true);
                 referent.recordOwner(scalar, "blessed glob package alias");
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java
index 845a342a81..7b9d3dd6de 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java
@@ -580,7 +580,8 @@ private RuntimeScalar cloneScalar(RuntimeScalar source) {
     }
 
     private void restoreScalarReferenceOwnership(RuntimeScalar source, RuntimeScalar target) {
-        if (!source.refCountOwned
+        if (!(source.value instanceof RuntimeBase sourceReferent)
+                || !source.ownsCountedReferent(sourceReferent)
                 || (target.type & RuntimeScalarType.REFERENCE_BIT) == 0
                 || !(target.value instanceof RuntimeBase referent)) {
             return;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeStash.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeStash.java
index 554c36688d..6895eb7b21 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeStash.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeStash.java
@@ -262,7 +262,7 @@ private RuntimeScalar deleteGlob(String k) {
                 // Safe because unblessed objects have no DESTROY side effects.
                 base.refCount = Integer.MIN_VALUE;
                 DestroyDispatch.callDestroy(base);
-            } else if (base.refCount > 0 && savedScalar.refCountOwned) {
+            } else if (base.refCount > 0 && savedScalar.ownsCountedReferent(base)) {
                 // Tracked object: decrement refCount (the stash was holding a strong ref).
                 savedScalar.setRefCountOwned(false);
                 base.releaseActiveOwner(savedScalar);
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStackOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStackOwnerSlotTest.java
new file mode 100644
index 0000000000..317a40b756
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStackOwnerSlotTest.java
@@ -0,0 +1,34 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("unit")
+class MyVarCleanupStackOwnerSlotTest {
+    @Test
+    void retainingBlessedGlobAliasDoesNotDuplicateRetiredLegacyOwner() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeGlob glob = new RuntimeGlob("OwnerSlotGlob::HANDLE");
+            RuntimeScalar lexicalAlias = new RuntimeScalar();
+            lexicalAlias.type = RuntimeScalarType.GLOB;
+            lexicalAlias.value = glob;
+            lexicalAlias.setRefCountOwned(true);
+            lexicalAlias.refCountOwned = false;
+            MyVarCleanupStack.register(lexicalAlias);
+            try {
+                glob.refCount = 4;
+
+                MyVarCleanupStack.retainBlessedGlobAliases(glob, glob);
+
+                assertEquals(4, glob.refCount);
+                assertTrue(lexicalAlias.scalarValueOwnerSlot().isActive());
+            } finally {
+                MyVarCleanupStack.unregister(lexicalAlias);
+            }
+        }
+    }
+}
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphClonerTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphClonerTest.java
index 117f041957..edbdfa3e18 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphClonerTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphClonerTest.java
@@ -90,6 +90,27 @@ void preservesAliasingAcrossSeparateRoots() {
                 .elements.get("value").getInt());
     }
 
+    @Test
+    void restoresClonedOwnershipFromExplicitSourceSlotAfterLegacyFlagRetires() {
+        PerlRuntime sourceRuntime = new PerlRuntime();
+        PerlRuntime targetRuntime = new PerlRuntime();
+        RuntimeArray referent = new RuntimeArray();
+        RuntimeScalar source = new RuntimeScalar();
+        try (PerlRuntime.Binding ignored = sourceRuntime.bind()) {
+            source.set(referent.createAnonymousReference());
+            source.refCountOwned = false;
+        }
+        assertTrue(source.scalarValueOwnerSlot().isActive());
+
+        RuntimeScalar cloned = (RuntimeScalar) new RuntimeGraphCloner(
+                sourceRuntime, targetRuntime).cloneGraph(source);
+
+        RuntimeArray clonedReferent = (RuntimeArray) cloned.value;
+        assertEquals(1, clonedReferent.refCount);
+        assertTrue(cloned.refCountOwned);
+        assertTrue(cloned.scalarValueOwnerSlot().isActive());
+    }
+
     @Test
     void normalizesClearedReferencePayloadWithoutMutatingSource() {
         PerlRuntime sourceRuntime = new PerlRuntime();
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeStashOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeStashOwnerSlotTest.java
new file mode 100644
index 0000000000..5cf0660ff6
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeStashOwnerSlotTest.java
@@ -0,0 +1,35 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("unit")
+class RuntimeStashOwnerSlotTest {
+    @Test
+    void deletingGlobalScalarReleasesExplicitSlotAfterLegacyFlagRetires() {
+        PerlRuntime runtime = new PerlRuntime();
+        String name = "RuntimeStashOwnerSlotTest::owner";
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeScalar owner = new RuntimeScalar();
+            owner.set(referent.createAnonymousReference());
+            owner.refCountOwned = false;
+            assertTrue(owner.scalarValueOwnerSlot().isActive());
+            GlobalVariable.scalarSlots().put(name, owner);
+
+            try {
+                assertEquals(1, referent.refCount);
+                new RuntimeStash("RuntimeStashOwnerSlotTest::").delete("owner");
+
+                assertEquals(Integer.MIN_VALUE, referent.refCount);
+                assertFalse(owner.scalarValueOwnerSlot().isActive());
+            } finally {
+                GlobalVariable.scalarSlots().remove(name);
+            }
+        }
+    }
+}

From 64796b7512e2b2674b4399389b97df768966b4cd Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 23 Oct 2026 17:34:50 +0200
Subject: [PATCH 225/317] fix: consult scalar slots in root and temporary
 cleanup

Honor direct scalar owner slots when proving reachability, releasing
localized and Storable temporaries, and undoing materialized list copies.
Add focused coverage for Storable argument cleanup after legacy flag retirement.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtime/perlmodule/Storable.java          |  3 +-
 .../runtimetypes/GlobalRuntimeScalar.java     |  4 +--
 .../runtimetypes/ReachabilityWalker.java      |  9 ++---
 .../runtime/runtimetypes/RuntimeList.java     | 24 +++++++------
 .../runtime/runtimetypes/RuntimeScalar.java   |  4 +--
 .../perlmodule/StorableOwnerSlotTest.java     | 34 +++++++++++++++++++
 6 files changed, 59 insertions(+), 19 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/perlmodule/StorableOwnerSlotTest.java

diff --git a/src/main/java/org/perlonjava/runtime/perlmodule/Storable.java b/src/main/java/org/perlonjava/runtime/perlmodule/Storable.java
index 455c8650b5..34c69f98af 100644
--- a/src/main/java/org/perlonjava/runtime/perlmodule/Storable.java
+++ b/src/main/java/org/perlonjava/runtime/perlmodule/Storable.java
@@ -347,7 +347,8 @@ public static void releaseApplyArgs(RuntimeArray args) {
         if (args == null || args.elements == null) return;
         for (RuntimeScalar elem : args.elements) {
             if (elem == null) continue;
-            if (elem.refCountOwned && elem.value instanceof RuntimeBase base
+            if (elem.value instanceof RuntimeBase base
+                    && elem.ownsCountedReferent(base)
                     && base.refCount > 0) {
                 base.releaseOwner(elem, "Storable.releaseApplyArgs");
                 base.releaseActiveOwner(elem);
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/GlobalRuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/GlobalRuntimeScalar.java
index 6d07338f93..475652532c 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/GlobalRuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/GlobalRuntimeScalar.java
@@ -212,9 +212,9 @@ public void dynamicRestoreState() {
                 // release its fields while another Perl owner can still use
                 // them (Dancer2 uploads keep their File::Temp handle there).
                 boolean releasesLastContainerOwner = localVar != null
-                        && localVar.refCountOwned
                         && (localVar.type & RuntimeScalarType.REFERENCE_BIT) != 0
                         && localVar.value instanceof RuntimeBase localBase
+                        && localVar.ownsCountedReferent(localBase)
                         && localBase.refCount == 1
                         && !localBase.localBindingExists;
                 if (releasesLastContainerOwner && localVar.value instanceof RuntimeHash localHash) {
@@ -223,9 +223,9 @@ public void dynamicRestoreState() {
                     MortalList.deferDestroyForContainerClear(localArray.elements);
                 }
                 if (localVar != null
-                        && localVar.refCountOwned
                         && (localVar.type & RuntimeScalarType.REFERENCE_BIT) != 0
                         && localVar.value instanceof RuntimeBase base
+                        && localVar.ownsCountedReferent(base)
                         && base.refCount > 0) {
                     displacedBase = base;
                     localVar.setRefCountOwned(false);
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index d53c6b1ed4..9b6601ccfd 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -139,7 +139,7 @@ private static boolean isNonOwningDebugArgsArray(String name) {
 
     private static boolean hasCapturedAggregateElementOwner(RuntimeBase referent) {
         for (RuntimeScalar owner : ScalarRefRegistry.snapshot()) {
-            if (owner == null || !owner.refCountOwned || owner.value != referent) continue;
+            if (owner == null || !owner.ownsCountedReferent(referent)) continue;
             RuntimeBase container = owner.containerOwner;
             if (container instanceof RuntimeArray array
                     && array.captureCount > 0 && array.elements.contains(owner)) {
@@ -1480,7 +1480,8 @@ private static RootReachabilitySnapshot reachableFromRootsSnapshotWithStatus(
             for (RuntimeScalar scalar : ScalarRefRegistry.snapshot()) {
                 if (!budget.visitEdge()) break rootScan;
                 if (scalar == null || scalar.captureCount > 0 || WeakRefRegistry.isweak(scalar)
-                        || (!MyVarCleanupStack.isLive(scalar) && !scalar.refCountOwned)
+                        || (!MyVarCleanupStack.isLive(scalar)
+                            && !scalar.ownsCurrentCountedReferent())
                         || scalar.scopeExited) continue;
                 if (includeOwnedCapturePads) seedTarget(scalar, null, seen, todo, stats);
                 else seedTargetIncludingCode(scalar, null, seen, todo, stats);
@@ -2306,7 +2307,7 @@ static boolean isReachableFromRoots(RuntimeBase target, boolean globalOnly,
                 if (sc == null) continue;
                 if (sc.captureCount > 0) continue;
                 if (WeakRefRegistry.isweak(sc)) continue;
-                if (!MyVarCleanupStack.isLive(sc) && !sc.refCountOwned) continue;
+                if (!MyVarCleanupStack.isLive(sc) && !sc.ownsCurrentCountedReferent()) continue;
                 if (sc.scopeExited) continue;
                 seedTargetExcluding(sc, target, seen, todo, stats, excludedReferent);
                 if (seen.contains(target)) return true;
@@ -2617,7 +2618,7 @@ && followGlobalCodeCaptures(code, target, seen, todo)) {
             if (sc.captureCount > 0) continue;
             if (WeakRefRegistry.isweak(sc)) continue;
             if (sc.scopeExited) continue;
-            if (!MyVarCleanupStack.isLive(sc) && !sc.refCountOwned) continue;
+            if (!MyVarCleanupStack.isLive(sc) && !sc.ownsCurrentCountedReferent()) continue;
             if (followScalar(sc, target, seen, todo)) return true;
         }
         for (Object liveVar : MyVarCleanupStack.snapshotLiveVars()) {
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
index 4a89af947a..122e90ae79 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
@@ -792,9 +792,10 @@ public RuntimeArray setFromList(RuntimeList value) {
                     // branch below). Without this, `my (undef, $name) = @_;` patterns
                     // leak +1 refCount per call on the discarded first arg — visible
                     // in op/inccode.t "no leaks" tests #61, #63 (bug perl #92252).
-                    if (rhsValue != null && rhsValue.refCountOwned
+                    if (rhsValue != null
                             && (rhsValue.type & RuntimeScalarType.REFERENCE_BIT) != 0
-                            && rhsValue.value instanceof RuntimeBase base && base.refCount > 0) {
+                            && rhsValue.value instanceof RuntimeBase base
+                            && rhsValue.ownsCountedReferent(base) && base.refCount > 0) {
                         base.releaseOwner(rhsValue, "RuntimeList materialized-copy undo (undef-target)");
                         base.releaseActiveOwner(rhsValue);
                         base.refCount--;
@@ -819,9 +820,10 @@ public RuntimeArray setFromList(RuntimeList value) {
                 // sits in the local `rhs` array which is never scope-exit-cleaned).
                 // Array/hash targets take direct ownership of materialized copies, so only
                 // scalar targets need this correction.
-                if (assigned != null && assigned.refCountOwned
+                if (assigned != null
                         && (assigned.type & RuntimeScalarType.REFERENCE_BIT) != 0
-                        && assigned.value instanceof RuntimeBase base && base.refCount > 0) {
+                        && assigned.value instanceof RuntimeBase base
+                        && assigned.ownsCountedReferent(base) && base.refCount > 0) {
                     base.releaseOwner(assigned, "RuntimeList materialized-copy undo (scalar-target)");
                     base.releaseActiveOwner(assigned);
                     base.refCount--;
@@ -847,8 +849,9 @@ public RuntimeArray setFromList(RuntimeList value) {
                     // the materialized rhs elements' increments are now redundant.
                     for (RuntimeScalar r : remaining) {
                         r.releaseOwnedScalarReferenceContents();
-                        if (r.refCountOwned && (r.type & RuntimeScalarType.REFERENCE_BIT) != 0
-                                && r.value instanceof RuntimeBase base && base.refCount > 0) {
+                        if ((r.type & RuntimeScalarType.REFERENCE_BIT) != 0
+                                && r.value instanceof RuntimeBase base
+                                && r.ownsCountedReferent(base) && base.refCount > 0) {
                             base.releaseOwner(r, "RuntimeList materialized-copy undo (array-target)");
                             base.releaseActiveOwner(r);
                             base.refCount--;
@@ -883,8 +886,9 @@ public RuntimeArray setFromList(RuntimeList value) {
                 // nobody decrements them.
                 for (RuntimeScalar r : remainingArr.elements) {
                     r.releaseOwnedScalarReferenceContents();
-                    if (r.refCountOwned && (r.type & RuntimeScalarType.REFERENCE_BIT) != 0
-                            && r.value instanceof RuntimeBase base && base.refCount > 0) {
+                    if ((r.type & RuntimeScalarType.REFERENCE_BIT) != 0
+                            && r.value instanceof RuntimeBase base
+                            && r.ownsCountedReferent(base) && base.refCount > 0) {
                         base.releaseOwner(r, "RuntimeList materialized-copy undo (hash-target)");
                         base.releaseActiveOwner(r);
                         base.refCount--;
@@ -994,9 +998,9 @@ private RuntimeArray assignSimpleScalarsFromArray(RuntimeArray rhsArray, boolean
     private static void releaseDiscardedMaterializedScalar(RuntimeScalar scalar) {
         if (scalar == null) return;
         scalar.releaseOwnedScalarReferenceContents();
-        if (scalar.refCountOwned
-                && (scalar.type & RuntimeScalarType.REFERENCE_BIT) != 0
+        if ((scalar.type & RuntimeScalarType.REFERENCE_BIT) != 0
                 && scalar.value instanceof RuntimeBase base
+                && scalar.ownsCountedReferent(base)
                 && base.refCount > 0) {
             base.releaseOwner(scalar, "RuntimeList materialized-copy undo (simple-scalar-target)");
             base.releaseActiveOwner(scalar);
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index d8c3de21ac..aa6d9b477e 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -869,12 +869,12 @@ boolean hasScalarValueOwnerSlotFor(RuntimeBase referent) {
     }
 
     /** Whether the legacy count bridge or its explicit slot still owns a referent. */
-    synchronized boolean ownsCountedReferent(RuntimeBase referent) {
+    public synchronized boolean ownsCountedReferent(RuntimeBase referent) {
         return value == referent
                 && (refCountOwned || hasScalarValueOwnerSlotFor(referent));
     }
 
-    private boolean ownsCurrentCountedReferent() {
+    boolean ownsCurrentCountedReferent() {
         return value instanceof RuntimeBase base && ownsCountedReferent(base);
     }
 
diff --git a/src/test/java/org/perlonjava/runtime/perlmodule/StorableOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/perlmodule/StorableOwnerSlotTest.java
new file mode 100644
index 0000000000..bcff742ffe
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/perlmodule/StorableOwnerSlotTest.java
@@ -0,0 +1,34 @@
+package org.perlonjava.runtime.perlmodule;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+import org.perlonjava.runtime.runtimetypes.PerlRuntime;
+import org.perlonjava.runtime.runtimetypes.RuntimeArray;
+import org.perlonjava.runtime.runtimetypes.RuntimeScalar;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+
+@Tag("unit")
+class StorableOwnerSlotTest {
+    @Test
+    void releaseApplyArgsConsumesExplicitOwnerAfterLegacyFlagRetires() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeScalar owner = new RuntimeScalar();
+            owner.set(referent.createAnonymousReference());
+            owner.refCountOwned = false;
+            RuntimeArray args = new RuntimeArray();
+            args.elements.add(owner);
+            args.elementsOwned = true;
+
+            Storable.releaseApplyArgs(args);
+
+            assertEquals(0, referent.refCount);
+            assertFalse(owner.scalarValueOwnerSlot().isActive());
+            assertEquals(0, args.elements.size());
+            assertFalse(args.elementsOwned);
+        }
+    }
+}

From d0965e8f7f4df1342ed21eae3da7490ed924f2ae Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 23 Oct 2026 18:13:29 +0200
Subject: [PATCH 226/317] fix: release bytecode temporaries through scalar
 slots

Use identity-based scalar ownership for temporary RHS release, consumed
interpreter references, and closure-slot scope cleanup after the legacy flag
retires.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../perlonjava/backend/bytecode/BytecodeInterpreter.java    | 4 ++--
 .../org/perlonjava/backend/bytecode/SlowOpcodeHandler.java  | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
index 7a467e4612..9730b41c34 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
@@ -136,11 +136,11 @@ private static void releaseConsumedTemp(RuntimeBase temp, RuntimeBase target) {
         if (!(temp instanceof RuntimeScalar tempScalar)
                 || !(target instanceof RuntimeScalar targetScalar)
                 || tempScalar == targetScalar
-                || !tempScalar.refCountOwned
                 || !RuntimeScalarType.isReference(tempScalar)
                 || tempScalar.type != targetScalar.type
                 || tempScalar.value != targetScalar.value
                 || !(tempScalar.value instanceof RuntimeBase base)
+                || !tempScalar.ownsCountedReferent(base)
                 || base.refCount <= 0) {
             return;
         }
@@ -4047,7 +4047,7 @@ private static void releaseCurrentFrameClosureSlots(
             if (!(register instanceof RuntimeScalar scalar)
                     || scalar.value != closure
                     || !MyVarCleanupStack.isRegistered(scalar)) continue;
-            if (scalar.refCountOwned) {
+            if (scalar.ownsCountedReferent(closure)) {
                 RuntimeScalar.scopeExitCleanup(scalar);
             } else {
                 // Non-owning CODE wrappers can still be the only local root
diff --git a/src/main/java/org/perlonjava/backend/bytecode/SlowOpcodeHandler.java b/src/main/java/org/perlonjava/backend/bytecode/SlowOpcodeHandler.java
index 3a2b83481f..276ee91d55 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/SlowOpcodeHandler.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/SlowOpcodeHandler.java
@@ -1349,9 +1349,9 @@ public static int executeHashSliceSet(
 
     /** Release a compiler-only RHS slice scalar after its durable hash copy exists. */
     private static void releaseHashSliceTemporaryOwner(RuntimeScalar value) {
-        if (value != null && value.refCountOwned
-                && RuntimeScalarType.isReference(value)
-                && value.value instanceof RuntimeBase base && base.refCount > 0) {
+        if (value != null && RuntimeScalarType.isReference(value)
+                && value.value instanceof RuntimeBase base
+                && value.ownsCountedReferent(base) && base.refCount > 0) {
             base.releaseOwner(value, "HASH_SLICE_SET temporary owner transfer");
             base.releaseActiveOwner(value);
             base.refCount--;

From c1167ffbd1f37e2fbb470e745dcc78a979269793 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 23 Oct 2026 18:58:40 +0200
Subject: [PATCH 227/317] fix: preserve scalar slots through dynamic state
 changes

Transfer explicit direct-owner state when scalars are dynamically saved,
suspended, restored, and resumed, even after the legacy flag retires.
Add a save/restore regression for the slot transfer.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtime/runtimetypes/RuntimeScalar.java   |  8 ++---
 .../RuntimeScalarDynamicOwnerSlotTest.java    | 30 +++++++++++++++++++
 2 files changed, 34 insertions(+), 4 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarDynamicOwnerSlotTest.java

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index aa6d9b477e..07df83eda4 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -6720,7 +6720,7 @@ public void dynamicSaveState() {
         // Copy the current type and value to the new state
         currentState.type = this.type;
         currentState.value = copyScalarPayload(this.type, this.value);
-        currentState.setRefCountOwned(this.refCountOwned);
+        currentState.setRefCountOwned(ownsCurrentCountedReferent());
         setRefCountOwned(false);
         currentState.blessId = this.blessId;
         currentState.scalarReferenceContentsOwner = this.scalarReferenceContentsOwner;
@@ -6791,7 +6791,7 @@ public void dynamicRestoreState() {
             // Restore the type, value from the saved state
             this.type = previousState.type;
             this.value = copyScalarPayload(previousState.type, previousState.value);
-            setRefCountOwned(previousState.refCountOwned);
+            setRefCountOwned(previousState.ownsCurrentCountedReferent());
             previousState.setRefCountOwned(false);
             this.blessId = previousState.blessId;
             this.scalarReferenceContentsOwner = previousState.scalarReferenceContentsOwner;
@@ -6841,7 +6841,7 @@ public void dynamicRestoreState() {
     @Override
     public Object dynamicSuspendState() {
         RuntimeScalar activeState = new RuntimeScalar(this);
-        activeState.setRefCountOwned(this.refCountOwned);
+        activeState.setRefCountOwned(ownsCurrentCountedReferent());
         setRefCountOwned(false);
         activeState.scalarReferenceContentsOwner = this.scalarReferenceContentsOwner;
         if (activeState.scalarReferenceContentsOwner != null) {
@@ -6858,7 +6858,7 @@ public void dynamicResumeState(Object token) {
         if (token instanceof RuntimeScalar activeState) {
             this.type = activeState.type;
             this.value = copyScalarPayload(activeState.type, activeState.value);
-            setRefCountOwned(activeState.refCountOwned);
+            setRefCountOwned(activeState.ownsCurrentCountedReferent());
             activeState.setRefCountOwned(false);
             this.blessId = activeState.blessId;
             this.scalarReferenceContentsOwner = activeState.scalarReferenceContentsOwner;
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarDynamicOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarDynamicOwnerSlotTest.java
new file mode 100644
index 0000000000..fe99e4e7e9
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarDynamicOwnerSlotTest.java
@@ -0,0 +1,30 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("unit")
+class RuntimeScalarDynamicOwnerSlotTest {
+    @Test
+    void dynamicSaveAndRestorePreservesOwnerSlotAfterLegacyFlagRetires() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeScalar scalar = new RuntimeScalar();
+            scalar.set(referent.createAnonymousReference());
+            scalar.refCountOwned = false;
+            assertTrue(scalar.scalarValueOwnerSlot().isActive());
+            int originalRefCount = referent.refCount;
+
+            scalar.dynamicSaveState();
+            scalar.dynamicRestoreState();
+
+            assertEquals(originalRefCount, referent.refCount);
+            assertTrue(scalar.ownsCountedReferent(referent));
+            assertTrue(scalar.scalarValueOwnerSlot().isActive());
+        }
+    }
+}

From 9c93d5922b72fe7eba90503e7c93e9abd1b024fa Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 23 Oct 2026 19:37:42 +0200
Subject: [PATCH 228/317] fix: include glob slots in scalar scope exit

Recognize explicit GLOB owner slots in the scalar scope-exit fast path after
the legacy ownership flag retires. Add a GLOB-specific cleanup regression.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtime/runtimetypes/RuntimeScalar.java   |  4 +--
 ...MortalListScalarValueOwnerRestoreTest.java | 27 +++++++++++++++++++
 2 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 07df83eda4..b73bc52f55 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -5511,9 +5511,7 @@ public static void scopeExitCleanup(RuntimeScalar scalar) {
         // - no scalar-value owner exists → deferDecrementIfTracked returns immediately
         // - captureCount=0 → capture handling branch not taken
         boolean ownsCurrentReferent = scalar.refCountOwned
-                || ((scalar.type & RuntimeScalarType.REFERENCE_BIT) != 0
-                    && scalar.value instanceof RuntimeBase base
-                    && scalar.ownsCountedReferent(base));
+                || scalar.ownsCurrentCountedReferent();
         if (!ownsCurrentReferent && scalar.captureCount == 0 && !scalar.ioOwner
                 && !scalar.hasScalarReferenceContentsOwner()
                 && scalar.type != RuntimeScalarType.TIED_SCALAR) {
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java
index c1fb80395e..6f99d38f8a 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java
@@ -66,6 +66,33 @@ void scopeExitReleasesExplicitScalarOwnerAfterLegacyFlagRetires() {
         }
     }
 
+    @Test
+    void scopeExitFastPathRecognizesExplicitGlobOwnerAfterLegacyFlagRetires() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeGlob referent = new RuntimeGlob("OwnerSlot::HANDLE");
+            referent.refCount = 1;
+            RuntimeScalar owner = new RuntimeScalar();
+            owner.type = RuntimeScalarType.GLOB;
+            owner.value = referent;
+            owner.setRefCountOwned(true);
+            owner.refCountOwned = false;
+            MyVarCleanupStack.register(owner);
+
+            try {
+                RuntimeScalar.scopeExitCleanup(owner);
+                MortalList.flush();
+
+                assertFalse(owner.scalarValueOwnerSlot().isActive());
+                assertTrue(referent.refCount < 1,
+                        "scope exit reaches GLOB cleanup through the explicit owner slot");
+            } finally {
+                MyVarCleanupStack.unregister(owner);
+                MortalList.flush();
+            }
+        }
+    }
+
     @Test
     void explicitUndefReleasesScalarOwnerAfterLegacyFlagRetires() {
         PerlRuntime runtime = new PerlRuntime();

From c3a26f9fb6b2793cbb6bb7e10c4a59d6ec3ae58b Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 23 Oct 2026 20:17:47 +0200
Subject: [PATCH 229/317] docs: update ownership migration progress

Record the recent scalar owner-slot batches, current master reconciliation,
validation results, and remaining Phase 2 work in the ownership design doc.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 3fa560ace3..a7971675d4 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The candidate is based on `origin/master` at `5a6cf5ed6`; published head `84ddd5b45` passes hosted run `39895645097` on Linux and Windows, including both thread gates. Current local candidate `5578d44bd` passes full `nice -n 19 make` in 33m11s; hosted validation is pending. The preceding head's one hosted Linux failure in `dbic_deep_cycle_weak_shift_regression.t` did not recur in local filtered/full-shard gates or the hosted rerun. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Candidate `9c93d5922` passes full `nice -n 19 make` in 19m53s, including the GLOB scope-exit regression. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`; validation of the latest head is pending. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -107,7 +107,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch is based on `origin/master` at `5a6cf5ed6`; published head `84ddd5b45` passes hosted run `39895645097` on Linux and Windows, including both thread gates. Current local candidate `5578d44bd` passes full `nice -n 19 make` in 33m11s; hosted validation is pending. The preceding head's one hosted Linux failure in `dbic_deep_cycle_weak_shift_regression.t` did not recur in local filtered/full-shard gates or the hosted rerun. The preceding ownership candidate passes all three local thread configurations. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch includes the current-master merge at `aeda28344`; head `9c93d5922` passes the full local Make gate, and hosted run `39991272777` passes on both platforms for its preceding head. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 ### Current batch
 
@@ -166,6 +166,14 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   candidate in 20m47s, including the Catalyst lifetime test (1 test, 0 failures)
   and all owner-slot regressions. `make check-links` passes; hosted validation
   is pending.
+- Follow-up batches now use explicit scalar slots through weak release,
+  reachability, stash deletion, graph cloning, DESTROY argument balancing,
+  blessed glob retention, list-copy cleanup, localized globals, Storable
+  arguments, bytecode temporaries, dynamic state save/restore, and GLOB scope
+  exit. Focused Java regressions cover retired-flag cases. The full local Make
+  gate passes on candidate `9c93d5922` in 19m53s; hosted validation for that
+  head is pending. The slot ledger remains a bridge to selective `refCount`,
+  so Phase 2 is not complete.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 

From 76d88c0c02b1f37edab3dafb0262b24f40294e53 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 23 Oct 2026 20:53:56 +0200
Subject: [PATCH 230/317] docs: clarify ownership query boundaries

Document the distinct contracts for the legacy active-owner registry and the
identity-deduplicated scalar-slot owner queries.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index a7971675d4..0d63f13c00 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -27,6 +27,14 @@ slots, closure pads, and mortal temporaries have different ownership rules.
 Every path must state whether it creates an owner, borrows a cell, transfers an
 owner, or creates a deferred mortal owner.
 
+During migration, `activeOwnerCount()` and `activeOwnerSnapshot()` describe
+only the compatibility `activeOwners` registry. They must not be widened to
+include explicit slots: several recovery and diagnostics paths need to tell
+whether the legacy registry itself recorded an owner. Use
+`countedScalarOwnerCount()` / `countedScalarOwnerSnapshot()` when the caller
+needs the identity-deduplicated union of legacy entries and `SCALAR_VALUE`
+slots. Keep that distinction until the compatibility registry is removed.
+
 ## Baseline ownership map
 
 | Concern | Current implementation | Phase 1 implication |

From ecc5efd37e9039c41b2fd7e014702a1d69281210 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 23 Oct 2026 22:01:05 +0200
Subject: [PATCH 231/317] fix: transfer list-assignment array tail ownership

Route plain-array list-assignment tails through the owning store path so
replaced values are released and transferred cells receive scalar and array
owner slots. Route endpoint removals through the array mutation hooks, and add
Java and Perl-level lifetime regressions.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          |  7 ++
 docs/about/changelog.md                       |  1 +
 .../runtime/runtimetypes/RuntimeArray.java    | 40 +++++++++++
 .../runtime/runtimetypes/RuntimeList.java     |  7 +-
 .../RuntimeListArrayOwnerTransferTest.java    | 69 +++++++++++++++++++
 .../list_assignment_array_tail_lifetime.t     | 31 +++++++++
 6 files changed, 152 insertions(+), 3 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeListArrayOwnerTransferTest.java
 create mode 100644 src/test/resources/unit/list_assignment_array_tail_lifetime.t

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 0d63f13c00..1291fe08bb 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -119,6 +119,13 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
 
 ### Current batch
 
+- Plain-array tails in nested list assignment now transfer materialized cells
+  through the array's owning-store path. This releases displaced values,
+  acquires scalar ownership idempotently, and registers the array-element
+  slots. `removeFirst()` and `removeLast()` route through the structural
+  mutation hooks so `shift` and `pop` retire those slots. A Java regression
+  covers replacement and final release; a Perl-level regression passes on
+  system Perl and both PerlOnJava backends. Full local Make passes in 15m23s.
 - Followed live `SCALAR_VALUE` and `SCALAR_REFERENCE_CONTENTS` slots from an
   aggregate toward their containing aggregate or lexical root. Deferred
   aggregate-owner recovery now avoids whole-root walks through these scalar
diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index ab64c286ce..c2d811ad63 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -22,6 +22,7 @@ priorities and future plans.
 - Run standard Perl's `cpan -t Module` for CPAN oracle checks and keep download failures inconclusive instead of reporting missing local modules as Perl failures.
 - Keep lexical-registration membership checks constant-time, avoiding quadratic CPAN index parsing as cleanup stacks grow.
 - Keep scalar-slot owners authoritative across stores, container copies, scalar references, closure captures, lexical scope exit, overwrites, and explicit `undef` after legacy tracking retires; preserve aliases through `pop`, `shift`, or `delete` (#1649).
+- Transfer plain-array list-assignment tails through normal owner-slot and displaced-value cleanup paths, including `pop` and `shift` release (#1649).
 - Synchronize the destroyable-closure reverse index so ithread capture cloning and release can update it safely.
 - Follow scalar owner slots during aggregate lifetime recovery, avoiding a whole-root walk for nested scalar-owned containers.
 - Preserve numeric types of cached read-only scalars in ranges, rejecting unsigned endpoints outside the supported integer range.
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
index 259132c667..ec740ef7ee 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
@@ -359,6 +359,18 @@ public RuntimeScalar remove(int index) {
             return previous;
         }
 
+        @Override
+        public RuntimeScalar removeFirst() {
+            if (isEmpty()) throw new java.util.NoSuchElementException();
+            return remove(0);
+        }
+
+        @Override
+        public RuntimeScalar removeLast() {
+            if (isEmpty()) throw new java.util.NoSuchElementException();
+            return remove(size() - 1);
+        }
+
         @Override
         public boolean remove(Object o) {
             int index = indexOf(o);
@@ -1930,6 +1942,34 @@ public RuntimeArray setFromList(RuntimeList list) {
         };
     }
 
+    /**
+     * Replace a plain array with already-materialized list-assignment cells.
+     * Normalize each scalar owner idempotently, then transfer the cells using
+     * the normal mutation hooks so displaced values and structural slots are
+     * released consistently.
+     */
+    void replaceWithTransferredListAssignmentCells(List<RuntimeScalar> replacements) {
+        if (type != PLAIN_ARRAY) {
+            throw new IllegalStateException("transferred list-assignment cells require a plain array");
+        }
+        eachIteratorIndex = null;
+        notePackageRootMutation();
+        MortalList.deferDestroyForContainerClear(elements);
+        elements.clear();
+        elementsOwned = true;
+        elementsAliased = false;
+        ownedAliasElements = null;
+        elements.addAll(replacements);
+        for (RuntimeScalar element : replacements) {
+            markPackageRootedValue(element);
+            if (hasDurableElementLifetime()) {
+                RuntimeScalar.retainUnstashedIoForDurableSlot(element);
+            }
+            RuntimeScalar.incrementRefCountForContainerStore(element);
+        }
+        reconcileArrayElementOwnerSlots();
+    }
+
     /**
      * Set this array's contents from a list without incrementing the
      * referents' refCounts — i.e., the stored elements are <em>aliases</em>,
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
index 122e90ae79..145c95d1bc 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
@@ -859,9 +859,10 @@ public RuntimeArray setFromList(RuntimeList value) {
                         }
                     }
                 } else {
-                    // Plain array: directly reuse the materialized copies.
-                    // Their refCountOwned=true transfers to the array elements.
-                    runtimeArray.elements = remaining;
+                    // Plain arrays can take the materialized cells directly,
+                    // but must transfer them through the array's owning-store
+                    // path so old values are released and new slots are tracked.
+                    runtimeArray.replaceWithTransferredListAssignmentCells(remaining);
                 }
                 result.elements.addAll(remaining);  // Use original references
                 rhsIndex = rhsSize; // Consume the rest
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeListArrayOwnerTransferTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeListArrayOwnerTransferTest.java
new file mode 100644
index 0000000000..b370ed0386
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeListArrayOwnerTransferTest.java
@@ -0,0 +1,69 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("unit")
+class RuntimeListArrayOwnerTransferTest {
+    @Test
+    void listAssignmentTransfersOwnedCellsAndReleasesDisplacedArrayValues() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            boolean previousMortalState = MortalList.isActive();
+            RuntimeHash displacedReferent = new RuntimeHash();
+            RuntimeScalar displacedCell = new RuntimeScalar();
+            displacedCell.set(displacedReferent.createAnonymousReference());
+
+            RuntimeArray destination = new RuntimeArray();
+            destination.elements.add(displacedCell);
+            destination.elementsOwned = true;
+            destination.reconcileArrayElementOwnerSlots();
+
+            RuntimeHash incomingReferent = new RuntimeHash();
+            RuntimeArray sourceValues = new RuntimeArray();
+            sourceValues.elements.add(incomingReferent.createAnonymousReference());
+
+            RuntimeList rightHandSide = new RuntimeList();
+            rightHandSide.elements.add(new RuntimeScalar(7));
+            rightHandSide.elements.add(sourceValues);
+
+            RuntimeList leftHandSide = new RuntimeList();
+            leftHandSide.elements.add(new RuntimeScalar());
+            leftHandSide.elements.add(destination);
+
+            try {
+                MortalList.setActive(true);
+                leftHandSide.setFromList(rightHandSide);
+
+                assertTrue(destination.elementsOwned,
+                        "the assigned tail becomes an owning array");
+                assertEquals(1, incomingReferent.refCount,
+                        "the transferred cell acquires one durable scalar owner");
+                assertEquals(1, incomingReferent.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+                assertEquals(1, incomingReferent.arraySlotOwnerCount(),
+                        "the destination registers its array element slot");
+                assertEquals(0, displacedReferent.arraySlotOwnerCount(),
+                        "replacing the old tail retires its array element slot");
+
+                MortalList.flush();
+                assertEquals(0, displacedReferent.countedScalarOwnerCount(),
+                        "clearing the old tail releases its scalar owner");
+
+                RuntimeArray.pop(destination);
+                MortalList.flush();
+                assertEquals(0, incomingReferent.arraySlotOwnerCount());
+                assertEquals(0, incomingReferent.countedScalarOwnerCount(),
+                        "removing the transferred cell releases its owner");
+                assertTrue(incomingReferent.refCount <= 0,
+                        "the final array removal drains the referent count");
+            } finally {
+                MortalList.setActive(previousMortalState);
+                MortalList.flush();
+            }
+        }
+    }
+}
diff --git a/src/test/resources/unit/list_assignment_array_tail_lifetime.t b/src/test/resources/unit/list_assignment_array_tail_lifetime.t
new file mode 100644
index 0000000000..ceffd2cc5d
--- /dev/null
+++ b/src/test/resources/unit/list_assignment_array_tail_lifetime.t
@@ -0,0 +1,31 @@
+use strict;
+use warnings;
+use Test::More tests => 4;
+
+{
+    package Local::ListAssignmentTailLifetime;
+    our $destroyed = 0;
+    sub DESTROY { $destroyed++ }
+}
+
+my $old = bless {}, 'Local::ListAssignmentTailLifetime';
+my $new = bless {}, 'Local::ListAssignmentTailLifetime';
+my @tail = ($old);
+my $head;
+
+($head, @tail) = (7, $new);
+undef $old;
+is($Local::ListAssignmentTailLifetime::destroyed, 1,
+    'list assignment releases the displaced array-tail value');
+
+undef $new;
+is($Local::ListAssignmentTailLifetime::destroyed, 1,
+    'the assigned array tail keeps its value alive');
+
+my $removed = pop @tail;
+is($Local::ListAssignmentTailLifetime::destroyed, 1,
+    'pop transfers the final array owner to its result');
+
+undef $removed;
+is($Local::ListAssignmentTailLifetime::destroyed, 2,
+    'releasing the popped result destroys the final value');

From 3919a128c8bd6d937f24d5cb021b4fa562367462 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 23 Oct 2026 22:20:39 +0200
Subject: [PATCH 232/317] docs: record list-assignment ownership validation

Record the immutable full-gate result for the list-assignment tail ownership
fix and keep the Phase 2 status tied to the validated code commit.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 1291fe08bb..25d49872f9 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Candidate `9c93d5922` passes full `nice -n 19 make` in 19m53s, including the GLOB scope-exit regression. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`; validation of the latest head is pending. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Candidate `ecc5efd37` passes full `nice -n 19 make` in 13m34s, including the list-assignment tail ownership regression. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`; validation of the latest head is pending. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -115,7 +115,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch includes the current-master merge at `aeda28344`; head `9c93d5922` passes the full local Make gate, and hosted run `39991272777` passes on both platforms for its preceding head. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML::Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch includes the current-master merge at `aeda28344`; head `ecc5efd37` passes the full local Make gate, and hosted run `39991272777` passes on both platforms for its preceding head. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML-Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 ### Current batch
 
@@ -125,7 +125,8 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   slots. `removeFirst()` and `removeLast()` route through the structural
   mutation hooks so `shift` and `pop` retire those slots. A Java regression
   covers replacement and final release; a Perl-level regression passes on
-  system Perl and both PerlOnJava backends. Full local Make passes in 15m23s.
+  system Perl and both PerlOnJava backends. The immutable code commit
+  `ecc5efd37` passes full `nice -n 19 make` in 13m34s.
 - Followed live `SCALAR_VALUE` and `SCALAR_REFERENCE_CONTENTS` slots from an
   aggregate toward their containing aggregate or lexical root. Deferred
   aggregate-owner recovery now avoids whole-root walks through these scalar

From 85daddac0e9259eac7f6e6a2fbc1d0b71a22f302 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 23 Oct 2026 22:42:21 +0200
Subject: [PATCH 233/317] fix: preserve hash ownership in list-assignment tails

Transfer hash-tail assignment values into the destination's owner-aware map,
release displaced values, and preserve tied/autovivifying assignment paths.
Add Java and Perl-level lifetime regressions with parent-failure evidence.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          | 19 +++---
 docs/about/changelog.md                       |  2 +-
 .../runtime/runtimetypes/RuntimeHash.java     | 31 ++++++++++
 .../runtime/runtimetypes/RuntimeList.java     | 28 +++++----
 .../RuntimeListHashOwnerTransferTest.java     | 60 +++++++++++++++++++
 .../unit/list_assignment_hash_tail_lifetime.t | 31 ++++++++++
 6 files changed, 151 insertions(+), 20 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeListHashOwnerTransferTest.java
 create mode 100644 src/test/resources/unit/list_assignment_hash_tail_lifetime.t

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 25d49872f9..311f8c7037 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -119,14 +119,17 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
 
 ### Current batch
 
-- Plain-array tails in nested list assignment now transfer materialized cells
-  through the array's owning-store path. This releases displaced values,
-  acquires scalar ownership idempotently, and registers the array-element
-  slots. `removeFirst()` and `removeLast()` route through the structural
-  mutation hooks so `shift` and `pop` retire those slots. A Java regression
-  covers replacement and final release; a Perl-level regression passes on
-  system Perl and both PerlOnJava backends. The immutable code commit
-  `ecc5efd37` passes full `nice -n 19 make` in 13m34s.
+- Array and hash tails in nested list assignment transfer materialized cells
+  through their owning-store paths. This releases displaced values, acquires
+  scalar ownership idempotently, and registers structural slots on the
+  destination's owner-aware container. Tied and autovivifying hashes use their
+  normal assignment path instead of adopting a temporary container. Java and
+  Perl-level regressions cover both transfer paths; the immutable full-gate
+  result for the hash follow-up is pending.
+- The preceding array-tail fix routes `removeFirst()` and `removeLast()` through
+  structural mutation hooks so `shift` and `pop` retire array slots. Its
+  immutable code commit `ecc5efd37` passes full `nice -n 19 make` in 13m34s,
+  and the Perl-level regression passes on system Perl and both backends.
 - Followed live `SCALAR_VALUE` and `SCALAR_REFERENCE_CONTENTS` slots from an
   aggregate toward their containing aggregate or lexical root. Deferred
   aggregate-owner recovery now avoids whole-root walks through these scalar
diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index c2d811ad63..c591286a33 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -22,7 +22,7 @@ priorities and future plans.
 - Run standard Perl's `cpan -t Module` for CPAN oracle checks and keep download failures inconclusive instead of reporting missing local modules as Perl failures.
 - Keep lexical-registration membership checks constant-time, avoiding quadratic CPAN index parsing as cleanup stacks grow.
 - Keep scalar-slot owners authoritative across stores, container copies, scalar references, closure captures, lexical scope exit, overwrites, and explicit `undef` after legacy tracking retires; preserve aliases through `pop`, `shift`, or `delete` (#1649).
-- Transfer plain-array list-assignment tails through normal owner-slot and displaced-value cleanup paths, including `pop` and `shift` release (#1649).
+- Transfer array and hash list-assignment tails through normal owner-slot and displaced-value cleanup paths, including `pop`, `shift`, and `delete` release (#1649).
 - Synchronize the destroyable-closure reverse index so ithread capture cloning and release can update it safely.
 - Follow scalar owner slots during aggregate lifetime recovery, avoiding a whole-root walk for nested scalar-owned containers.
 - Preserve numeric types of cached read-only scalars in ranges, rejecting unsigned endpoints outside the supported integer range.
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java
index 34d2970587..5521cfbd1f 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java
@@ -108,6 +108,37 @@ private RuntimeHashElementMap newElementMap(Map<String, RuntimeScalar> values) {
         return map;
     }
 
+    /**
+     * Transfer an already-built plain-hash assignment into this hash while
+     * keeping this instance's owner-aware map and slot identities. Values are
+     * already counted by the temporary assignment hash, so only the
+     * structural HASH_ENTRY slots move here.
+     */
+    void replaceWithTransferredAssignmentHash(RuntimeHash replacement) {
+        if (type != PLAIN_HASH || replacement == this || replacement.type != PLAIN_HASH) {
+            throw new IllegalStateException("transferred assignment requires distinct plain hashes");
+        }
+        Set<String> replacementByteKeys = replacement.byteKeys == null
+                ? null : new HashSet<>(replacement.byteKeys);
+        notePackageRootMutation();
+        MortalList.deferDestroyForContainerClear(elements.values());
+        elements.clear();
+        if (byteKeys != null) byteKeys.clear();
+        hashIterator = null;
+
+        // This map belongs to the destination, so putAll establishes the
+        // correct per-entry callbacks, package-root marks, and owner slots.
+        // The scalar cells already own their referents; do not increment them.
+        elements.putAll(replacement.elements);
+        byteKeys = replacementByteKeys;
+
+        // The cells now belong to this hash. Retire only the temporary hash's
+        // structural slots, leaving the transferred scalar owners intact.
+        replacement.elements.clear();
+        replacement.byteKeys = null;
+        replacement.hashIterator = null;
+    }
+
     void resetElementMapAfterAutovivification() {
         elements = newElementMap();
     }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
index 145c95d1bc..b7d07f8a58 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
@@ -872,19 +872,25 @@ public RuntimeArray setFromList(RuntimeList value) {
                         ? new ArrayList<>(rhsElements.subList(rhsIndex, rhsSize))
                         : new ArrayList<>();
 
-                RuntimeHash hash = RuntimeHash.createHashForAssignment(remainingArr);
-                runtimeHash.elements = hash.elements;
-                // Add lvalue references to hash elements for list assignment
-                for (Map.Entry<String, RuntimeScalar> entry : hash.elements.entrySet()) {
-                    result.elements.add(new RuntimeScalar(entry.getKey()));
-                    result.elements.add(entry.getValue());  // Add reference to hash value
+                if (runtimeHash.type == RuntimeHash.PLAIN_HASH) {
+                    RuntimeHash hash = RuntimeHash.createHashForAssignment(remainingArr);
+                    runtimeHash.replaceWithTransferredAssignmentHash(hash);
+                    // Add lvalue references to hash elements for list assignment.
+                    for (Map.Entry<String, RuntimeScalar> entry : runtimeHash.elements.entrySet()) {
+                        result.elements.add(new RuntimeScalar(entry.getKey()));
+                        result.elements.add(entry.getValue());
+                    }
+                } else {
+                    // Tied and autovivifying hashes must keep their own map
+                    // implementation and receive stores through setFromList.
+                    RuntimeList remainingList = new RuntimeList();
+                    remainingList.elements.addAll(remainingArr.elements);
+                    RuntimeArray assignedValues = runtimeHash.setFromList(remainingList);
+                    result.elements.addAll(assignedValues.elements);
                 }
                 // Undo materialized copies' refCount increments.
-                // createHashForAssignment creates new RuntimeScalars for hash values
-                // and gives those hash slots their own container-store ownership.
-                // The original rhs elements' refCount increments (from materialization
-                // via addToArray -> setLarge) are now redundant and would leak since
-                // nobody decrements them.
+                // The destination hash has its own copied scalar cells; these
+                // materialized RHS cells are redundant after either transfer.
                 for (RuntimeScalar r : remainingArr.elements) {
                     r.releaseOwnedScalarReferenceContents();
                     if ((r.type & RuntimeScalarType.REFERENCE_BIT) != 0
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeListHashOwnerTransferTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeListHashOwnerTransferTest.java
new file mode 100644
index 0000000000..12af9172ae
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeListHashOwnerTransferTest.java
@@ -0,0 +1,60 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("unit")
+class RuntimeListHashOwnerTransferTest {
+    @Test
+    void listAssignmentTransfersHashSlotsAndReleasesDisplacedValues() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            boolean previousMortalState = MortalList.isActive();
+            RuntimeHash displacedReferent = new RuntimeHash();
+            RuntimeScalar displacedCell = new RuntimeScalar();
+            displacedCell.set(displacedReferent.createAnonymousReference());
+            RuntimeHash destination = new RuntimeHash();
+            destination.elements.put("old", displacedCell);
+
+            RuntimeHash incomingReferent = new RuntimeHash();
+            RuntimeArray sourceValues = new RuntimeArray();
+            sourceValues.elements.add(new RuntimeScalar("new"));
+            sourceValues.elements.add(incomingReferent.createAnonymousReference());
+
+            RuntimeList rightHandSide = new RuntimeList();
+            rightHandSide.elements.add(new RuntimeScalar(7));
+            rightHandSide.elements.add(sourceValues);
+            RuntimeList leftHandSide = new RuntimeList();
+            leftHandSide.elements.add(new RuntimeScalar());
+            leftHandSide.elements.add(destination);
+
+            try {
+                MortalList.setActive(true);
+                leftHandSide.setFromList(rightHandSide);
+
+                assertNull(destination.elements.get("old"));
+                assertNotNull(destination.elements.get("new"));
+                assertEquals(0, displacedReferent.hashSlotOwnerCount(),
+                        "replacing the hash releases its old entry slot");
+                assertEquals(1, incomingReferent.hashSlotOwnerCount(),
+                        "the destination's owner-aware map registers the transferred entry");
+                assertEquals(1, incomingReferent.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+                assertEquals(1, incomingReferent.refCount,
+                        "the destination hash value owns exactly one referent count");
+
+                MortalList.flush();
+                assertEquals(0, displacedReferent.countedScalarOwnerCount(),
+                        "replacement releases the displaced scalar owner");
+                assertTrue(displacedReferent.refCount <= 0);
+            } finally {
+                MortalList.setActive(previousMortalState);
+                MortalList.flush();
+            }
+        }
+    }
+}
diff --git a/src/test/resources/unit/list_assignment_hash_tail_lifetime.t b/src/test/resources/unit/list_assignment_hash_tail_lifetime.t
new file mode 100644
index 0000000000..35a0869411
--- /dev/null
+++ b/src/test/resources/unit/list_assignment_hash_tail_lifetime.t
@@ -0,0 +1,31 @@
+use strict;
+use warnings;
+use Test::More tests => 4;
+
+{
+    package Local::ListAssignmentHashTailLifetime;
+    our $destroyed = 0;
+    sub DESTROY { $destroyed++ }
+}
+
+my $old = bless {}, 'Local::ListAssignmentHashTailLifetime';
+my $new = bless {}, 'Local::ListAssignmentHashTailLifetime';
+my %tail = (old => $old);
+my $head;
+
+($head, %tail) = (7, new => $new);
+undef $old;
+is($Local::ListAssignmentHashTailLifetime::destroyed, 1,
+    'list assignment releases the displaced hash-tail value');
+
+undef $new;
+is($Local::ListAssignmentHashTailLifetime::destroyed, 1,
+    'the assigned hash tail keeps its value alive');
+
+my $removed = delete $tail{new};
+is($Local::ListAssignmentHashTailLifetime::destroyed, 1,
+    'delete transfers the final hash owner to its result');
+
+undef $removed;
+is($Local::ListAssignmentHashTailLifetime::destroyed, 2,
+    'releasing the deleted result destroys the final value');

From 993d5875e75a6b10118d01ef79f58c5a1d162f4c Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 23 Oct 2026 23:01:54 +0200
Subject: [PATCH 234/317] docs: record hash-tail ownership validation

Record parent failure evidence and the immutable full-gate result for the
hash-tail ownership transfer, while updating the Phase 2 status.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 311f8c7037..b1dc6ed62d 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Candidate `ecc5efd37` passes full `nice -n 19 make` in 13m34s, including the list-assignment tail ownership regression. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`; validation of the latest head is pending. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Candidate `85daddac0` passes full `nice -n 19 make` in 17m20s, including both array- and hash-tail ownership regressions. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`; validation of the latest head is pending. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -115,7 +115,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch includes the current-master merge at `aeda28344`; head `ecc5efd37` passes the full local Make gate, and hosted run `39991272777` passes on both platforms for its preceding head. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML-Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch includes the current-master merge at `aeda28344`; head `85daddac0` passes the full local Make gate, and hosted run `39991272777` passes on both platforms for its preceding head. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML-Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 ### Current batch
 
@@ -124,8 +124,10 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   scalar ownership idempotently, and registers structural slots on the
   destination's owner-aware container. Tied and autovivifying hashes use their
   normal assignment path instead of adopting a temporary container. Java and
-  Perl-level regressions cover both transfer paths; the immutable full-gate
-  result for the hash follow-up is pending.
+  Perl-level regressions cover both transfer paths. The hash-tail regression
+  passes 4/4 on system Perl, JVM, and interpreter, and fails all four assertions
+  on the unfixed JVM and interpreter parent. Immutable code commit
+  `85daddac0` passes full `nice -n 19 make` in 17m20s.
 - The preceding array-tail fix routes `removeFirst()` and `removeLast()` through
   structural mutation hooks so `shift` and `pop` retire array slots. Its
   immutable code commit `ecc5efd37` passes full `nice -n 19 make` in 13m34s,

From 15601c6ef015d8182e8a6dfa684da3a74b17eb11 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Fri, 23 Oct 2026 23:05:35 +0200
Subject: [PATCH 235/317] docs: sync ownership progress with pushed head

Update the ownership design status to distinguish the locally validated code
commit from the latest pushed documentation and regression record.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+codex@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index b1dc6ed62d..3e7cd1c0fa 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Candidate `85daddac0` passes full `nice -n 19 make` in 17m20s, including both array- and hash-tail ownership regressions. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`; validation of the latest head is pending. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Candidate `85daddac0` passes full `nice -n 19 make` in 17m20s, including the array- and hash-tail ownership regressions. The pushed head is `993d5875e`; hosted validation is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -115,7 +115,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch includes the current-master merge at `aeda28344`; head `85daddac0` passes the full local Make gate, and hosted run `39991272777` passes on both platforms for its preceding head. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML-Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch includes the current-master merge at `aeda28344`; code head `85daddac0` passes the full local Make gate, and pushed head `993d5875e` contains the follow-up validation record. Hosted run `39991272777` passes on both platforms for its preceding head. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML-Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 ### Current batch
 
@@ -128,6 +128,9 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   passes 4/4 on system Perl, JVM, and interpreter, and fails all four assertions
   on the unfixed JVM and interpreter parent. Immutable code commit
   `85daddac0` passes full `nice -n 19 make` in 17m20s.
+- The hash-tail validation record was pushed in `993d5875e`. Both JVM and
+  interpreter regressions pass 4/4 after the fix; the unfixed parent fails
+  4/4 on each backend. The latest PR head has no hosted checks attached yet.
 - The preceding array-tail fix routes `removeFirst()` and `removeLast()` through
   structural mutation hooks so `shift` and `pop` retire array slots. Its
   immutable code commit `ecc5efd37` passes full `nice -n 19 make` in 13m34s,

From 29372cac03497bacd9d5ca626df4e9008cbefc04 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 00:16:50 +0200
Subject: [PATCH 236/317] fix: release scalar-value ownership through its slot

Route explicit undef through the direct scalar owner slot when one is active.
The slot retires and decrements its bridged count together, while undefine
retains its existing lifecycle and local-binding decisions. Keep the legacy
fallback for scalar owners that predate explicit slots.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+codex@users.noreply.github.com>
---
 .../runtime/runtimetypes/PerlOwnerSlot.java   | 28 +++++++++++++++++++
 .../runtime/runtimetypes/RuntimeScalar.java   | 18 ++++++++++--
 .../RuntimeScalarValueOwnerSlotTest.java      | 20 +++++++++++++
 3 files changed, 63 insertions(+), 3 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
index fba3558c01..0236019fbf 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
@@ -363,6 +363,34 @@ public synchronized void retargetScalarReferenceContents(RuntimeBase nextTarget)
         }
     }
 
+    /**
+     * Release the legacy counted edge represented by a direct scalar-value
+     * slot. The caller retains lifecycle policy (for example, whether a
+     * lexical binding suppresses DESTROY) after receiving the decremented
+     * count. This makes explicit slot identity the authority for the scalar
+     * owner's release while the referent counter remains the dispatch bridge.
+     */
+    synchronized boolean releaseScalarValueCount(RuntimeBase expectedTarget, String releaseSite) {
+        if (kind != Kind.SCALAR_VALUE) {
+            throw new IllegalStateException(
+                    "scalar-value release requires a SCALAR_VALUE slot");
+        }
+        if (referent != expectedTarget || expectedTarget == null
+                || expectedTarget.refCount <= 0) {
+            return false;
+        }
+        RuntimeScalar scalar = ownerCell();
+        transferTo(null);
+        if (scalar != null) scalar.refCountOwned = false;
+        expectedTarget.traceRefCount(-1, releaseSite);
+        if (scalar != null) {
+            expectedTarget.releaseOwner(scalar, releaseSite);
+            expectedTarget.releaseActiveOwner(scalar);
+        }
+        expectedTarget.refCount--;
+        return true;
+    }
+
     private synchronized void detachAfterDeferredRelease() {
         transferTo(null);
     }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index b73bc52f55..0236b19c21 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -904,6 +904,11 @@ private void syncScalarValueOwnerSlot(boolean owned) {
         }
     }
 
+    boolean releaseScalarValueOwnerCount(RuntimeBase expectedReferent, String releaseSite) {
+        PerlOwnerSlot slot = scalarValueOwnerSlot;
+        return slot != null && slot.releaseScalarValueCount(expectedReferent, releaseSite);
+    }
+
     public boolean hasScalarReferenceContentsOwner() {
         return scalarReferenceContentsOwner != null
                 && scalarReferenceContentsOwner.isActive();
@@ -5321,9 +5326,16 @@ public RuntimeScalar undefine() {
                 oldBase.refCount = Integer.MIN_VALUE;
                 DestroyDispatch.callDestroy(oldBase);
             } else if (oldBaseOwnedByScalar && oldBase.refCount > 0) {
-                this.setRefCountOwned(false);
-                oldBase.releaseActiveOwner(this);
-                if (--oldBase.refCount == 0) {
+                boolean releasedExplicitSlot =
+                        releaseScalarValueOwnerCount(oldBase, "RuntimeScalar.undefine");
+                if (!releasedExplicitSlot) {
+                    // Compatibility fallback for scalar owners created before
+                    // SCALAR_VALUE slots were installed.
+                    this.setRefCountOwned(false);
+                    oldBase.releaseActiveOwner(this);
+                    oldBase.refCount--;
+                }
+                if (oldBase.refCount == 0) {
                     if (oldBase.localBindingExists) {
                         // Named container: local variable may still exist. Skip callDestroy.
                     } else {
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarValueOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarValueOwnerSlotTest.java
index bf192077a3..787d9e98ef 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarValueOwnerSlotTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarValueOwnerSlotTest.java
@@ -62,4 +62,24 @@ void localizedScalarValueKeepsItsOwnerUntilRestore() {
             assertSame(original, scalar.scalarValueOwnerSlot().referent());
         }
     }
+
+    @Test
+    void explicitUndefReleasesTheScalarValueSlotAndItsCountTogether() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeScalar scalar = new RuntimeScalar();
+            scalar.set(referent.createReference());
+
+            assertEquals(1, referent.refCount);
+            assertEquals(1, referent.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+
+            scalar.undefine();
+
+            assertEquals(0, referent.refCount,
+                    "explicit undef decrements the count represented by the scalar slot");
+            assertEquals(0, referent.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE),
+                    "the scalar slot is retired with its count");
+        }
+    }
 }

From 9922a0ff26f246ba90a1b11cbddcfe870c499466 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 00:23:44 +0200
Subject: [PATCH 237/317] docs: record scalar-value undef ownership migration

Record the scalar owner-slot undef tranche, its regression, full Make result,
and the renewed issue lifetime checks.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+codex@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 3e7cd1c0fa..9de3e8df30 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Candidate `85daddac0` passes full `nice -n 19 make` in 17m20s, including the array- and hash-tail ownership regressions. The pushed head is `993d5875e`; hosted validation is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. The current local candidate `29372cac0` passes full `nice -n 19 make` in 23m10s, including the scalar-value undef regression. The last confirmed pushed PR head is `15601c6ef`; hosted validation of newer commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -115,7 +115,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch includes the current-master merge at `aeda28344`; code head `85daddac0` passes the full local Make gate, and pushed head `993d5875e` contains the follow-up validation record. Hosted run `39991272777` passes on both platforms for its preceding head. The focused lifetime regressions recorded below pass on blead Perl 5.45.4 and both backends. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML-Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch includes the current-master merge at `aeda28344`; local candidate `29372cac0` passes the full Make gate, while the last confirmed pushed head is `15601c6ef`. Hosted run `39991272777` passes on both platforms for its preceding head. The focused Mojolicious controller/WebSocket and Catalyst tempfile lifetime regressions pass on both backends with loopback access. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML-Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 ### Current batch
 
@@ -131,6 +131,15 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
 - The hash-tail validation record was pushed in `993d5875e`. Both JVM and
   interpreter regressions pass 4/4 after the fix; the unfixed parent fails
   4/4 on each backend. The latest PR head has no hosted checks attached yet.
+- Explicit `undef` now releases a counted direct scalar owner through its
+  `SCALAR_VALUE` slot, decrementing the bridged count in the same operation;
+  `undefine()` still owns the local-binding and lifecycle decision. The Java
+  regression verifies that both the slot and count retire. Full
+  `nice -n 19 make` passes in 23m10s on the source committed as `29372cac0`.
+  The #1794 controller/WebSocket regressions pass 5/5, 6/6, 6/6, and 29/29 on
+  both backends with loopback access. Catalyst tempfile regressions pass 24/24
+  and 3/3 on both backends; the controller-owner release regression passes
+  3/3 on both.
 - The preceding array-tail fix routes `removeFirst()` and `removeLast()` through
   structural mutation hooks so `shift` and `pop` retire array slots. Its
   immutable code commit `ecc5efd37` passes full `nice -n 19 make` in 13m34s,

From 4b3c26e9562c79877e1b5a8963fc5e8b23b1dffb Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 00:30:52 +0200
Subject: [PATCH 238/317] docs: sync ownership status with PR push

Record the latest validated scalar-value undef change and the fast-forwarded
PR head, leaving hosted validation clearly pending.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+codex@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 9de3e8df30..27904ac38c 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. The current local candidate `29372cac0` passes full `nice -n 19 make` in 23m10s, including the scalar-value undef regression. The last confirmed pushed PR head is `15601c6ef`; hosted validation of newer commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s, including the scalar-value undef regression. The latest push to the PR branch is `9922a0ff2`; hosted validation is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -115,7 +115,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch includes the current-master merge at `aeda28344`; local candidate `29372cac0` passes the full Make gate, while the last confirmed pushed head is `15601c6ef`. Hosted run `39991272777` passes on both platforms for its preceding head. The focused Mojolicious controller/WebSocket and Catalyst tempfile lifetime regressions pass on both backends with loopback access. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML-Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch includes the current-master merge at `aeda28344`; code commit `29372cac0` passes the full Make gate, and latest pushed head `9922a0ff2` contains its progress record. Hosted run `39991272777` passes on both platforms for its preceding head. The focused Mojolicious controller/WebSocket and Catalyst tempfile lifetime regressions pass on both backends with loopback access. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML-Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 ### Current batch
 

From 2c05509e6721a95a4864002507f870da933a104a Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 01:15:32 +0200
Subject: [PATCH 239/317] fix: carry scalar owner slots through deferred
 release

Deferred scalar cleanup now records SCALAR_VALUE slot provenance while
retiring the slot before the mortal drain. Apply the path to ordinary scope
release, recursive container cleanup, and array pop/shift, keeping legacy
release handling for cells without explicit slots.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+codex@users.noreply.github.com>
---
 .../runtime/runtimetypes/MortalList.java      | 54 ++++++++++---------
 .../runtime/runtimetypes/PerlOwnerSlot.java   | 14 +++++
 .../runtime/runtimetypes/RuntimeArray.java    |  4 --
 .../runtime/runtimetypes/RuntimeScalar.java   |  7 +++
 .../PerlOwnerSlotLegacyBridgeTest.java        | 30 +++++++++++
 5 files changed, 81 insertions(+), 28 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 86e94ed8d5..8b429fb153 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -238,16 +238,34 @@ public static void deferDecrement(RuntimeBase base, String transientOwnerKind) {
     /** Queue the deferred release together with the array scalar that owned it. */
     public static void deferDecrementFromArraySlot(
             RuntimeBase base, RuntimeScalar ownerScalar, String releaseSite) {
-        if (base.refCountTrace) {
-            base.traceRefCount(0, releaseSite + " (array-slot decrement queued)");
-        }
         LifecycleRuntimeState state = state();
         markBoundaryWork(state);
         RuntimeBase.PendingOwnerRelease ownerRelease =
-                base.queueOwnerRelease(ownerScalar, releaseSite);
+                queueScalarOwnerRelease(base, ownerScalar, releaseSite);
         queueDeferredBase(state, base, ownerRelease, null, ownerScalar);
     }
 
+    /** Detach a scalar owner and queue its count release with slot provenance. */
+    private static RuntimeBase.PendingOwnerRelease queueScalarOwnerRelease(
+            RuntimeBase base, RuntimeScalar scalar, String releaseSite) {
+        PerlOwnerSlot.PendingRelease slotRelease =
+                scalar.deferScalarValueOwnerCount(base);
+        if (slotRelease != null) {
+            base.traceRefCount(0, releaseSite + " (scalar-value slot decrement queued)");
+            base.releaseActiveOwner(scalar);
+            return base.queueOwnerSlotRelease(slotRelease);
+        }
+
+        // Compatibility path for a count that predates explicit SCALAR_VALUE
+        // slots. The slot path above retires the identity itself and does not
+        // depend on refCountOwned to decide which scalar owns this release.
+        scalar.setRefCountOwned(false);
+        base.traceRefCount(0, releaseSite + " (scalar decrement queued)");
+        base.releaseOwner(scalar, releaseSite);
+        base.releaseActiveOwner(scalar);
+        return base.queueOwnerRelease(scalar, releaseSite);
+    }
+
     /** Queue a closure-capture bridge decrement with owner-slot provenance. */
     static void deferOwnerSlotDecrement(RuntimeBase base, String transientOwnerKind,
                                         PerlOwnerSlot.PendingRelease slotRelease) {
@@ -573,15 +591,10 @@ public static void deferDecrementIfTracked(RuntimeScalar scalar) {
                 && scalar.value instanceof RuntimeBase base) {
             if (!scalar.ownsCountedReferent(base)) return;
             if (base.refCount > 0) {
-                scalar.setRefCountOwned(false);
-                if (base.refCountTrace) {
-                    base.traceRefCount(0, "MortalList.deferDecrementIfTracked (queued, scalar.refCountOwned->false)");
-                }
-                base.releaseActiveOwner(scalar);
                 LifecycleRuntimeState state = state();
                 markBoundaryWork(state);
-                RuntimeBase.PendingOwnerRelease ownerRelease = base.queueOwnerRelease(
-                        scalar, "MortalList.deferDecrementIfTracked");
+                RuntimeBase.PendingOwnerRelease ownerRelease = queueScalarOwnerRelease(
+                        base, scalar, "MortalList.deferDecrementIfTracked");
                 queueDeferredBase(state, base, ownerRelease, null, scalar);
             } else if (base.refCount == 0
                     && base.clearedOwnedAggregateElement
@@ -1056,19 +1069,15 @@ private static void deferDecrementRecursive(RuntimeScalar scalar) {
             if (base.blessId != 0) {
                 boolean releasingLastOwner = false;
                 if (s.ownsCountedReferent(base) && base.refCount > 0) {
-                    s.setRefCountOwned(false);
-                    if (base.refCountTrace) {
-                        base.traceRefCount(0, "MortalList.deferDecrementRecursive (blessed, queued)");
-                        base.releaseOwner(s, "deferDecrementRecursive blessed");
-                    }
-                    base.releaseActiveOwner(s);
+                    RuntimeBase.PendingOwnerRelease ownerRelease = queueScalarOwnerRelease(
+                            base, s, "MortalList.deferDecrementRecursive (blessed)");
                     // refCount is the authoritative ownership count here.
                     // activeOwners is diagnostic and can retain a stale
                     // call-frame alias until the enclosing sub returns.
                     releasingLastOwner = base.refCount == 1;
                     LifecycleRuntimeState state = state();
                     markBoundaryWork(state);
-                    queueDeferredBase(state, base, null, null, s);
+                    queueDeferredBase(state, base, ownerRelease, null, s);
                 } else if (base.refCount == 0) {
                     if (base.refCountTrace) {
                         base.traceRefCount(+1, "MortalList.deferDecrementRecursive (blessed never-stored bump+queue)");
@@ -1104,14 +1113,11 @@ private static void deferDecrementRecursive(RuntimeScalar scalar) {
                 boolean hasCleanupTargets = hasDirectWeakElementRefs
                         || containerMayContainCleanupTargets(base);
                 if (s.ownsCountedReferent(base) && base.refCount > 0) {
-                    s.setRefCountOwned(false);
-                    if (base.refCountTrace) {
-                        base.traceRefCount(0, "MortalList.deferDecrementRecursive (unblessed container, queued)");
-                    }
-                    base.releaseActiveOwner(s);
+                    RuntimeBase.PendingOwnerRelease ownerRelease = queueScalarOwnerRelease(
+                            base, s, "MortalList.deferDecrementRecursive (unblessed container)");
                     LifecycleRuntimeState state = state();
                     markBoundaryWork(state);
-                    queueDeferredBase(state, base, null, null, s);
+                    queueDeferredBase(state, base, ownerRelease, null, s);
                     if (!WeakRefRegistry.weakRefsExist() && base.refCount > 1) {
                         continue;
                     }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
index 0236019fbf..bcf45960f2 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
@@ -391,6 +391,20 @@ synchronized boolean releaseScalarValueCount(RuntimeBase expectedTarget, String
         return true;
     }
 
+    /** Detach a scalar-value owner and preserve its identity for deferred release. */
+    synchronized PendingRelease deferScalarValueCountRelease(RuntimeBase expectedTarget) {
+        if (kind != Kind.SCALAR_VALUE) {
+            throw new IllegalStateException(
+                    "scalar-value release requires a SCALAR_VALUE slot");
+        }
+        if (referent != expectedTarget || expectedTarget == null) return null;
+        PendingRelease release = new PendingRelease(identity, ++nextReleaseSequence, kind);
+        RuntimeScalar scalar = ownerCell();
+        if (scalar != null) scalar.refCountOwned = false;
+        release();
+        return release;
+    }
+
     private synchronized void detachAfterDeferredRelease() {
         transferTo(null);
     }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
index ec740ef7ee..183ebd0aaf 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
@@ -911,9 +911,7 @@ public static RuntimeScalar pop(RuntimeArray runtimeArray) {
                             && result.value instanceof RuntimeBase base
                             && result.ownsCountedReferent(base)
                             && base.refCount > 0) {
-                        result.setRefCountOwned(false);
                         runtimeArray.forgetOwnedAliasElement(result);
-                        base.releaseActiveOwner(result);
                         MortalList.requestWeakSweepsForDestroyedContainer(base);
                         MortalList.deferDecrementFromArraySlot(
                                 base, result, "RuntimeArray.pop");
@@ -956,9 +954,7 @@ public static RuntimeScalar shift(RuntimeArray runtimeArray) {
                             && result.value instanceof RuntimeBase base
                             && result.ownsCountedReferent(base)
                             && base.refCount > 0) {
-                        result.setRefCountOwned(false);
                         runtimeArray.forgetOwnedAliasElement(result);
-                        base.releaseActiveOwner(result);
                         MortalList.requestWeakSweepsForDestroyedContainer(base);
                         MortalList.deferDecrementFromArraySlot(
                                 base, result, "RuntimeArray.shift");
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 0236b19c21..09ef45dcf1 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -909,6 +909,13 @@ boolean releaseScalarValueOwnerCount(RuntimeBase expectedReferent, String releas
         return slot != null && slot.releaseScalarValueCount(expectedReferent, releaseSite);
     }
 
+    PerlOwnerSlot.PendingRelease deferScalarValueOwnerCount(RuntimeBase expectedReferent) {
+        PerlOwnerSlot slot = scalarValueOwnerSlot;
+        return slot != null
+                ? slot.deferScalarValueCountRelease(expectedReferent)
+                : null;
+    }
+
     public boolean hasScalarReferenceContentsOwner() {
         return scalarReferenceContentsOwner != null
                 && scalarReferenceContentsOwner.isActive();
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotLegacyBridgeTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotLegacyBridgeTest.java
index 1d1751eaf5..b1e3fee453 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotLegacyBridgeTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotLegacyBridgeTest.java
@@ -67,4 +67,34 @@ void queuedCaptureReleaseRetainsSlotProvenanceUntilDrain() {
             MortalList.popMark();
         }
     }
+
+    @Test
+    void queuedScalarValueReleaseRetainsSlotProvenanceUntilDrain() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeScalar scalar = new RuntimeScalar();
+            scalar.set(referent.createReference());
+            PerlOwnerSlot slot = scalar.scalarValueOwnerSlot();
+            long identity = slot.identity();
+
+            MortalList.pushMark();
+            PerlOwnerSlot.PendingRelease release =
+                    scalar.deferScalarValueOwnerCount(referent);
+            assertNotNull(release);
+            assertEquals(PerlOwnerSlot.Kind.SCALAR_VALUE, release.kind());
+            assertEquals(identity, release.ownerSlotIdentity());
+            assertEquals(1, referent.refCount,
+                    "deferral preserves the bridged count until the mortal drain");
+            assertFalse(slot.isActive(),
+                    "the semantic scalar owner retires when its release is queued");
+
+            MortalList.deferOwnerSlotDecrement(referent, null, release);
+            MortalList.flushAboveMark();
+
+            assertEquals(0, referent.refCount);
+            assertTrue(release.isCompleted());
+            MortalList.popMark();
+        }
+    }
 }

From da2c8a0f16921bfbd2e6b65d45a78115b068dfa8 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 01:16:14 +0200
Subject: [PATCH 240/317] docs: record deferred scalar slot migration

Record the deferred owner-slot release paths, their regression coverage, and
the full Make and focused lifetime validation results.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+codex@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 27904ac38c..0e63069432 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s, including the scalar-value undef regression. The latest push to the PR branch is `9922a0ff2`; hosted validation is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, and local candidate `2c05509e6` passes full `nice -n 19 make` in 16m10s for deferred scalar-slot release. The latest confirmed push to the PR branch is `4b3c26e95`; hosted validation of newer commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -115,7 +115,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch includes the current-master merge at `aeda28344`; code commit `29372cac0` passes the full Make gate, and latest pushed head `9922a0ff2` contains its progress record. Hosted run `39991272777` passes on both platforms for its preceding head. The focused Mojolicious controller/WebSocket and Catalyst tempfile lifetime regressions pass on both backends with loopback access. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML-Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch includes the current-master merge at `aeda28344`; code commit `29372cac0` and local candidate `2c05509e6` pass their full Make gates. The latest confirmed pushed head is `4b3c26e95`; hosted validation of newer commits is pending. The focused Mojolicious controller/WebSocket and Catalyst tempfile lifetime regressions pass on both backends with loopback access, including a rerun against the deferred-release candidate. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML-Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 ### Current batch
 
@@ -140,6 +140,14 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   both backends with loopback access. Catalyst tempfile regressions pass 24/24
   and 3/3 on both backends; the controller-owner release regression passes
   3/3 on both.
+- Deferred scalar cleanup now carries `SCALAR_VALUE` slot identity into the
+  mortal queue for ordinary scope release, recursive blessed/unblessed
+  container cleanup, and `pop`/`shift`. Slot retirement and count decrement
+  remain ordered around the existing mortal drain; cells predating explicit
+  slots keep the legacy queue path. A Java regression checks token identity
+  and delayed decrement. Full `nice -n 19 make` passes in 16m10s on
+  `2c05509e6`. The Mojolicious, Catalyst tempfile, and controller-owner
+  lifetime files pass on JVM and interpreter after this change.
 - The preceding array-tail fix routes `removeFirst()` and `removeLast()` through
   structural mutation hooks so `shift` and `pop` retire array slots. Its
   immutable code commit `ecc5efd37` passes full `nice -n 19 make` in 13m34s,

From fad2199ebe8d903db04196ce115b0916fb4fc1c9 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 02:03:24 +0200
Subject: [PATCH 241/317] fix: release tail-call scalar owners through slots

Use explicit SCALAR_VALUE slots for immediate tail-call argument and CODE
reference release, leaving the existing lifecycle, stash, and reachability
decisions in MortalList. Add coverage for the final CODE owner release.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+codex@users.noreply.github.com>
---
 .../runtime/runtimetypes/MortalList.java      | 33 ++++++++++---------
 ...MortalListScalarValueOwnerRestoreTest.java | 22 +++++++++++++
 2 files changed, 39 insertions(+), 16 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 8b429fb153..b096461c36 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -949,14 +949,8 @@ public static void releaseTailCallCodeRef(RuntimeScalar codeRef) {
             return;
         }
 
-        codeRef.setRefCountOwned(false);
-        if (code.refCountTrace) {
-            code.traceRefCount(-1, "MortalList.releaseTailCallCodeRef");
-            code.releaseOwner(codeRef, "releaseTailCallCodeRef");
-        }
-        code.releaseActiveOwner(codeRef);
-
-        if (--code.refCount > 0) return;
+        releaseScalarValueCount(code, codeRef, "MortalList.releaseTailCallCodeRef");
+        if (code.refCount > 0) return;
 
         if (code.stashRefCount > 0) {
             code.refCount = 0;
@@ -981,14 +975,8 @@ private static void releaseTailCallArgElement(RuntimeScalar scalar) {
             return;
         }
 
-        scalar.setRefCountOwned(false);
-        if (base.refCountTrace) {
-            base.traceRefCount(-1, "MortalList.releaseTailCallArgElement");
-            base.releaseOwner(scalar, "releaseTailCallArgElement");
-        }
-        base.releaseActiveOwner(scalar);
-
-        if (--base.refCount > 0) return;
+        releaseScalarValueCount(base, scalar, "MortalList.releaseTailCallArgElement");
+        if (base.refCount > 0) return;
 
         if (base.localBindingExists || reachableTailCallArgReferent(base)) {
             base.refCount = 1;
@@ -999,6 +987,19 @@ private static void releaseTailCallArgElement(RuntimeScalar scalar) {
         DestroyDispatch.callDestroy(base);
     }
 
+    /** Release an immediate scalar-value owner through its explicit slot when present. */
+    private static void releaseScalarValueCount(
+            RuntimeBase base, RuntimeScalar scalar, String releaseSite) {
+        if (scalar.releaseScalarValueOwnerCount(base, releaseSite)) return;
+        scalar.setRefCountOwned(false);
+        if (base.refCountTrace) {
+            base.traceRefCount(-1, releaseSite);
+            base.releaseOwner(scalar, releaseSite);
+        }
+        base.releaseActiveOwner(scalar);
+        base.refCount--;
+    }
+
     private static boolean reachableTailCallArgReferent(RuntimeBase base) {
         return WeakRefRegistry.hasWeakRefsTo(base)
                 && (ReachabilityWalker.isReachableFromRoots(base)
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java
index 6f99d38f8a..244ea49e12 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarValueOwnerRestoreTest.java
@@ -191,6 +191,28 @@ void tailCallCleanupUsesExplicitScalarOwnerAfterLegacyFlagRetires() {
         }
     }
 
+    @Test
+    void tailCallCodeReleaseUsesExplicitScalarOwnerSlot() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeCode code = new RuntimeCode((String) null, null);
+            code.refCount = 1;
+            RuntimeScalar codeRef = new RuntimeScalar(code);
+            codeRef.setRefCountOwned(true);
+
+            try {
+                MortalList.releaseTailCallCodeRef(codeRef);
+
+                assertFalse(codeRef.hasScalarValueOwnerSlotFor(code),
+                        "tail-call release retires the direct CODE owner slot");
+                assertEquals(Integer.MIN_VALUE, code.refCount,
+                        "the last tail-call CODE owner reaches the lifecycle dispatcher");
+            } finally {
+                MortalList.flush();
+            }
+        }
+    }
+
     @Test
     void voidResultCleanupUsesExplicitScalarOwnerAfterLegacyFlagRetires() {
         PerlRuntime runtime = new PerlRuntime();

From 7d8502900ba7f63ddb35d0edc926e012d52e91a1 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 02:04:10 +0200
Subject: [PATCH 242/317] docs: record tail-call scalar slot migration

Record the immediate tail-call release change, its full Make gate, and the
longer interpreter Catalyst run and JFR profile evidence.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+codex@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 0e63069432..2c308d0551 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, and local candidate `2c05509e6` passes full `nice -n 19 make` in 16m10s for deferred scalar-slot release. The latest confirmed push to the PR branch is `4b3c26e95`; hosted validation of newer commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, and local candidate `fad2199eb` passes in 18m28s for immediate tail-call release. The latest confirmed push to the PR branch is `da2c8a0f1`; hosted validation of newer commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -115,7 +115,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch includes the current-master merge at `aeda28344`; code commit `29372cac0` and local candidate `2c05509e6` pass their full Make gates. The latest confirmed pushed head is `4b3c26e95`; hosted validation of newer commits is pending. The focused Mojolicious controller/WebSocket and Catalyst tempfile lifetime regressions pass on both backends with loopback access, including a rerun against the deferred-release candidate. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML-Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch includes the current-master merge at `aeda28344`; code commits `29372cac0`, `2c05509e6`, and `fad2199eb` pass their full Make gates. The latest confirmed pushed head is `da2c8a0f1`; hosted validation of newer commits is pending. Focused Mojolicious controller/WebSocket and Catalyst tempfile regressions pass on both backends with loopback access. On the tail-call candidate, the interpreter tempfile test exceeded a 180-second run but completed 24/24 within a 240-second JFR run; samples concentrate in existing external-root reachability snapshots and aggregate-owner recovery. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML-Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 ### Current batch
 
@@ -148,6 +148,14 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   and delayed decrement. Full `nice -n 19 make` passes in 16m10s on
   `2c05509e6`. The Mojolicious, Catalyst tempfile, and controller-owner
   lifetime files pass on JVM and interpreter after this change.
+- Immediate tail-call cleanup now uses the scalar slot release API for both
+  argument cells and CODE references. Existing stash, local-binding,
+  reachability, and DESTROY decisions remain in `MortalList`; a Java regression
+  covers final CODE release. Full `nice -n 19 make` passes in 18m28s on
+  `fad2199eb`. The focused lifetime files pass on both backends, with the
+  interpreter Catalyst tempfile file requiring a 240-second limit after a
+  180-second run stopped at assertion 13. Its JFR samples show external-root
+  snapshot construction and aggregate-owner recovery as the dominant work.
 - The preceding array-tail fix routes `removeFirst()` and `removeLast()` through
   structural mutation hooks so `shift` and `pop` retire array slots. Its
   immutable code commit `ecc5efd37` passes full `nice -n 19 make` in 13m34s,

From ca58da7c425368c3884d50298130e24b47e4792c Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 03:00:04 +0200
Subject: [PATCH 243/317] perf: reuse aggregate owner proofs during recovery

Memoize root proofs by owner identity during one aggregate count recovery so
multiple entry slots in the same container do not repeat the proof. Track
proof and cache-hit counts and cover a 64-slot hash in a deterministic test.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+codex@users.noreply.github.com>
---
 .../runtime/runtimetypes/MortalList.java      | 24 ++++++++++-
 .../runtimetypes/ReachabilityQueryStats.java  |  2 +
 .../ReachabilityQueryCostTest.java            | 43 +++++++++++++++++++
 3 files changed, 67 insertions(+), 2 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index b096461c36..192201be3b 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -5,6 +5,7 @@
 import java.util.Collections;
 import java.util.IdentityHashMap;
 import java.util.List;
+import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.atomic.AtomicInteger;
 
@@ -1989,11 +1990,15 @@ && isReachableCached(base)) {
     /** Restore legacy count for aggregate owner slots still reachable from Perl roots. */
     static boolean restoreReachableAggregateOwnerCount(RuntimeBase referent) {
         Set<RuntimeScalar> rootedHashCells = Collections.newSetFromMap(new IdentityHashMap<>());
+        // The referent exclusion and Perl graph stay fixed throughout this
+        // synchronous scan, so multiple slots in one aggregate share a proof.
+        Map<RuntimeBase, Boolean> rootedAggregateOwners = new IdentityHashMap<>();
         int slotsWithoutCell = 0;
         for (PerlOwnerSlot slot : referent.ownerSlotSnapshot()) {
             if (slot.kind() != PerlOwnerSlot.Kind.HASH_ENTRY) continue;
             RuntimeBase owner = slot.ownerContainer();
-            boolean rootedOwner = isRootedAggregateOwner(owner, referent);
+            boolean rootedOwner = isRootedAggregateOwnerCached(
+                    owner, referent, rootedAggregateOwners);
             if (!rootedOwner) continue;
             RuntimeScalar cell = slot.ownerCell();
             if (cell == null) {
@@ -2011,7 +2016,7 @@ static boolean restoreReachableAggregateOwnerCount(RuntimeBase referent) {
         for (PerlOwnerSlot slot : referent.ownerSlotSnapshot()) {
             if (slot.kind() != PerlOwnerSlot.Kind.ARRAY_ELEMENT) continue;
             RuntimeBase owner = slot.ownerContainer();
-            if (!isRootedAggregateOwner(owner, referent)) continue;
+            if (!isRootedAggregateOwnerCached(owner, referent, rootedAggregateOwners)) continue;
             RuntimeScalar cell = slot.ownerCell();
             if (cell == null) {
                 slotsWithoutCell++;
@@ -2054,6 +2059,21 @@ static boolean restoreReachableAggregateOwnerCount(RuntimeBase referent) {
         return true;
     }
 
+    private static boolean isRootedAggregateOwnerCached(
+            RuntimeBase owner, RuntimeBase excludedReferent,
+            Map<RuntimeBase, Boolean> rootedAggregateOwners) {
+        if (rootedAggregateOwners.containsKey(owner)) {
+            ReachabilityQueryStats stats = activeReachabilityQueryStats();
+            if (stats != null) stats.aggregateOwnerRootProofCacheHits++;
+            return rootedAggregateOwners.get(owner);
+        }
+        ReachabilityQueryStats stats = activeReachabilityQueryStats();
+        if (stats != null) stats.aggregateOwnerRootProofs++;
+        boolean rooted = isRootedAggregateOwner(owner, excludedReferent);
+        rootedAggregateOwners.put(owner, rooted);
+        return rooted;
+    }
+
     /**
      * Prove aggregate ownership by following registered owner slots toward a
      * Perl root. Nested hash/array stores and scalar-value slots record direct
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityQueryStats.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityQueryStats.java
index 8938a4577a..8093f0e26b 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityQueryStats.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityQueryStats.java
@@ -21,4 +21,6 @@ final class ReachabilityQueryStats {
     long unblessedAggregateDrainPositiveProofsCached;
     long scalarReachabilityQueries;
     long scalarReachabilityRootWalks;
+    long aggregateOwnerRootProofs;
+    long aggregateOwnerRootProofCacheHits;
 }
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityQueryCostTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityQueryCostTest.java
index d24797810d..2fa3743d0e 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityQueryCostTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityQueryCostTest.java
@@ -52,6 +52,49 @@ void repeatedContainerScopeCleanupDoesNotEnumerateNestedStashRoots() {
         }
     }
 
+    @Test
+    void aggregateOwnerRecoveryChecksEachSharedContainerOnce() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeHash owner = new RuntimeHash();
+            ArrayList<RuntimeScalar> cells = new ArrayList<>();
+            for (int i = 0; i < 64; i++) {
+                RuntimeScalar cell = new RuntimeScalar();
+                cell.type = RuntimeScalarType.ARRAYREFERENCE;
+                cell.value = referent;
+                cell.setRefCountOwned(true);
+                cell.refCountOwned = false;
+                owner.elements.put("slot" + i, cell);
+                cells.add(cell);
+            }
+            referent.refCount = 0;
+            MyVarCleanupStack.register(owner);
+            try {
+                try (MortalList.ReachabilityQueryMeasurement measurement =
+                             MortalList.measureReachabilityQueries()) {
+                    assertTrue(MortalList.restoreReachableAggregateOwnerCount(referent));
+
+                    assertEquals(64, referent.refCount,
+                            "every rooted hash-entry cell remains an owner");
+                    assertEquals(1, measurement.stats().aggregateOwnerRootProofs,
+                            "one owner-container proof covers all entries in the same hash");
+                    assertEquals(63, measurement.stats().aggregateOwnerRootProofCacheHits,
+                            "the remaining entry slots reuse that proof");
+                }
+            } finally {
+                MyVarCleanupStack.unregister(owner);
+                owner.elements.clear();
+                for (RuntimeScalar cell : cells) {
+                    if (cell.scalarValueOwnerSlot() != null) {
+                        cell.scalarValueOwnerSlot().release();
+                    }
+                }
+                referent.refCount = 0;
+            }
+        }
+    }
+
     @Test
     void scopeExitedCaptureOwnersShareOneScalarRootSnapshot() {
         PerlRuntime runtime = new PerlRuntime();

From 2fde9560d5be2b7f1e9cc943d7bcbd060a1ab1af Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 03:13:22 +0200
Subject: [PATCH 244/317] docs: record aggregate owner proof cache result

Record the deterministic shared-owner proof result, full Make validation,
focused Catalyst run, and the limits of the JFR comparison.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <158243242+codex@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 2c308d0551..b04d92bb75 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, and local candidate `fad2199eb` passes in 18m28s for immediate tail-call release. The latest confirmed push to the PR branch is `da2c8a0f1`; hosted validation of newer commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, and local candidate `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse. The latest confirmed push to the PR branch is `7d8502900`; hosted validation of newer commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -115,7 +115,7 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch includes the current-master merge at `aeda28344`; code commits `29372cac0`, `2c05509e6`, and `fad2199eb` pass their full Make gates. The latest confirmed pushed head is `da2c8a0f1`; hosted validation of newer commits is pending. Focused Mojolicious controller/WebSocket and Catalyst tempfile regressions pass on both backends with loopback access. On the tail-call candidate, the interpreter tempfile test exceeded a 180-second run but completed 24/24 within a 240-second JFR run; samples concentrate in existing external-root reachability snapshots and aggregate-owner recovery. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML-Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch includes the current-master merge at `aeda28344`; code commits `29372cac0`, `2c05509e6`, `fad2199eb`, and `ca58da7c4` pass their full Make gates. The latest confirmed pushed head is `7d8502900`; hosted validation of newer commits is pending. Focused Mojolicious controller/WebSocket and Catalyst tempfile regressions pass on both backends with loopback access. On the tail-call candidate, the interpreter tempfile test exceeded a 180-second run but completed 24/24 within a 240-second JFR run; a later 240-second profile after owner-proof caching emitted no TAP, while an unprofiled run completed 24/24 within the 600-second limit. Sampled `isRootedAggregateOwner` frames declined from 517 to 190, with 112 cache-hit frames; the profiled runs had different total sample counts, so wall-clock attribution remains inconclusive. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML-Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 ### Current batch
 
@@ -156,6 +156,15 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   interpreter Catalyst tempfile file requiring a 240-second limit after a
   180-second run stopped at assertion 13. Its JFR samples show external-root
   snapshot construction and aggregate-owner recovery as the dominant work.
+- Aggregate owner recovery now memoizes root proofs by owner identity for the
+  duration of one restore call. The same excluded referent and graph remain
+  fixed throughout that scan. A deterministic test with 64 hash-entry slots
+  verifies that all 64 owners are restored with one proof and 63 cache hits.
+  Full `nice -n 19 make` passes in 28m41s on `ca58da7c4`. The interpreter
+  Catalyst tempfile regression passes 24/24 without profiling. JFR sampled
+  `isRootedAggregateOwner` 517 times before and 190 times after the change,
+  plus 112 cache-hit frames; the profiled after-run hit its 240-second limit
+  before TAP output, so these samples do not establish a wall-clock speedup.
 - The preceding array-tail fix routes `removeFirst()` and `removeLast()` through
   structural mutation hooks so `shift` and `pop` retire array slots. Its
   immutable code commit `ecc5efd37` passes full `nice -n 19 make` in 13m34s,

From 6730377d18ba9c3bbd62085edc3c9beacf413029 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 04:20:17 +0200
Subject: [PATCH 245/317] perf: scan aggregate owner slots once during recovery

Reuse one owner-slot snapshot and classify each slot in a single recovery
pass. Preserve owner proof caching and count decisions while reducing repeated
snapshot allocation and traversal.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 .../runtime/runtimetypes/MortalList.java      | 78 ++++++++-----------
 .../runtimetypes/ReachabilityQueryStats.java  |  1 +
 .../ReachabilityQueryCostTest.java            |  2 +
 3 files changed, 36 insertions(+), 45 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 192201be3b..bb372cf188 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1994,53 +1994,41 @@ static boolean restoreReachableAggregateOwnerCount(RuntimeBase referent) {
         // synchronous scan, so multiple slots in one aggregate share a proof.
         Map<RuntimeBase, Boolean> rootedAggregateOwners = new IdentityHashMap<>();
         int slotsWithoutCell = 0;
-        for (PerlOwnerSlot slot : referent.ownerSlotSnapshot()) {
-            if (slot.kind() != PerlOwnerSlot.Kind.HASH_ENTRY) continue;
-            RuntimeBase owner = slot.ownerContainer();
-            boolean rootedOwner = isRootedAggregateOwnerCached(
-                    owner, referent, rootedAggregateOwners);
-            if (!rootedOwner) continue;
-            RuntimeScalar cell = slot.ownerCell();
-            if (cell == null) {
-                slotsWithoutCell++;
-            } else if (cell.value == referent
-                    && (cell.refCountOwned || cell.hasScalarValueOwnerSlotFor(referent))
-                    && !WeakRefRegistry.isweak(cell)) {
-                rootedHashCells.add(cell);
-            }
-        }
-        // Array slots are restored only when the array has a live semantic
-        // owner or can be reached independently from package roots. Excluding
-        // the referent from that walk prevents an owner proof through the
-        // object whose pending release triggered this recovery.
-        for (PerlOwnerSlot slot : referent.ownerSlotSnapshot()) {
-            if (slot.kind() != PerlOwnerSlot.Kind.ARRAY_ELEMENT) continue;
-            RuntimeBase owner = slot.ownerContainer();
-            if (!isRootedAggregateOwnerCached(owner, referent, rootedAggregateOwners)) continue;
-            RuntimeScalar cell = slot.ownerCell();
-            if (cell == null) {
-                slotsWithoutCell++;
-            } else if (cell.value == referent
-                    && (cell.refCountOwned || cell.hasScalarValueOwnerSlotFor(referent))
-                    && !WeakRefRegistry.isweak(cell)) {
-                rootedHashCells.add(cell);
+        Set<PerlOwnerSlot> ownerSlots = referent.ownerSlotSnapshot();
+        ReachabilityQueryStats stats = activeReachabilityQueryStats();
+        for (PerlOwnerSlot slot : ownerSlots) {
+            if (stats != null) stats.aggregateOwnerSlotsInspected++;
+            if (slot.kind() == PerlOwnerSlot.Kind.HASH_ENTRY
+                    || slot.kind() == PerlOwnerSlot.Kind.ARRAY_ELEMENT) {
+                // Excluding the referent prevents an owner proof through the
+                // object whose pending release triggered this recovery.
+                RuntimeBase owner = slot.ownerContainer();
+                if (!isRootedAggregateOwnerCached(owner, referent, rootedAggregateOwners)) {
+                    continue;
+                }
+                RuntimeScalar cell = slot.ownerCell();
+                if (cell == null) {
+                    slotsWithoutCell++;
+                } else if (cell.value == referent
+                        && (cell.refCountOwned || cell.hasScalarValueOwnerSlotFor(referent))
+                        && !WeakRefRegistry.isweak(cell)) {
+                    rootedHashCells.add(cell);
+                }
+            } else if (slot.kind() == PerlOwnerSlot.Kind.SCALAR_VALUE
+                    && slot.referent() == referent) {
+                // Scalar-value slots can supply identity when the legacy
+                // ownership Boolean has already retired. Aggregate cells are
+                // handled by their structural slot above or legacy fallback.
+                RuntimeScalar cell = slot.ownerCell();
+                if (cell != null && cell.containerOwner == null
+                        && cell.value == referent
+                        && (cell.refCountOwned || cell.hasScalarValueOwnerSlotFor(referent))
+                        && !WeakRefRegistry.isweak(cell)
+                        && ReachabilityWalker.isScalarReachable(cell)) {
+                    rootedHashCells.add(cell);
+                }
             }
         }
-        // Scalar-value slots can supply their identity even when recovery no
-        // longer relies on the legacy ownership Boolean.
-        // Cells stored in aggregates are handled above or by the legacy
-        // reachability fallback to preserve the shared-root snapshot policy.
-        for (PerlOwnerSlot slot : referent.ownerSlotSnapshot()) {
-            if (slot.kind() != PerlOwnerSlot.Kind.SCALAR_VALUE
-                    || slot.referent() != referent) continue;
-            RuntimeScalar cell = slot.ownerCell();
-            if (cell == null || cell.containerOwner != null
-                    || cell.value != referent
-                    || (!cell.refCountOwned && !cell.hasScalarValueOwnerSlotFor(referent))
-                    || WeakRefRegistry.isweak(cell)
-                    || !ReachabilityWalker.isScalarReachable(cell)) continue;
-            rootedHashCells.add(cell);
-        }
         int owners = slotsWithoutCell + rootedHashCells.size();
         // Active scalar owners may include lexical RVs in addition to hash
         // cells. Exclude cells already counted through their explicit slots,
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityQueryStats.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityQueryStats.java
index 8093f0e26b..15ea0af625 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityQueryStats.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityQueryStats.java
@@ -23,4 +23,5 @@ final class ReachabilityQueryStats {
     long scalarReachabilityRootWalks;
     long aggregateOwnerRootProofs;
     long aggregateOwnerRootProofCacheHits;
+    long aggregateOwnerSlotsInspected;
 }
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityQueryCostTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityQueryCostTest.java
index 2fa3743d0e..17bf4ba531 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityQueryCostTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityQueryCostTest.java
@@ -81,6 +81,8 @@ void aggregateOwnerRecoveryChecksEachSharedContainerOnce() {
                             "one owner-container proof covers all entries in the same hash");
                     assertEquals(63, measurement.stats().aggregateOwnerRootProofCacheHits,
                             "the remaining entry slots reuse that proof");
+                    assertEquals(128, measurement.stats().aggregateOwnerSlotsInspected,
+                            "each referent owner slot is inspected once during recovery");
                 }
             } finally {
                 MyVarCleanupStack.unregister(owner);

From c8a9e667986e3be3d84f48897f694549cfdac38d Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 04:33:36 +0200
Subject: [PATCH 246/317] docs: record single-pass owner recovery result

Record the recovery scan change, full make result, and issue-focused lifetime
regressions on both backends.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index b04d92bb75..9a9096177c 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, and local candidate `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse. The latest confirmed push to the PR branch is `7d8502900`; hosted validation of newer commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, and `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery. The latest confirmed push to the PR branch is `2fde9560d`; hosted validation of newer commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -165,6 +165,15 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   `isRootedAggregateOwner` 517 times before and 190 times after the change,
   plus 112 cache-hit frames; the profiled after-run hit its 240-second limit
   before TAP output, so these samples do not establish a wall-clock speedup.
+- On 2026-10-24, aggregate-owner recovery now takes one owner-slot snapshot and
+  classifies each slot in a single pass, combining hash, array, and scalar-value
+  recovery. A deterministic counter verifies all 128 slots in the mixed test
+  graph are inspected once, replacing three full scans. Full `nice -n 19 make`
+  passes in 15m56s on `6730377d1`. The Catalyst tempfile test passes 24/24 and
+  controller-owner release passes 3/3 on both backends; the WebSocket
+  controller-release regression passes 6/6 on both backends with loopback
+  access. This reduces snapshot allocation and slot traversal; it does not
+  replace the legacy `refCount` dispatch bridge.
 - The preceding array-tail fix routes `removeFirst()` and `removeLast()` through
   structural mutation hooks so `shift` and `pop` retire array slots. Its
   immutable code commit `ecc5efd37` passes full `nice -n 19 make` in 13m34s,

From c2111669953e6a90bf743b446c73d0ea03f1a2ea Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 05:39:08 +0200
Subject: [PATCH 247/317] refactor: release weakened scalar owners through
 slots

Route weaken-time scalar releases through the active SCALAR_VALUE owner slot,
keeping the legacy accounting path for cells without an explicit slot.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 .../runtime/runtimetypes/WeakRefRegistry.java | 20 ++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/WeakRefRegistry.java b/src/main/java/org/perlonjava/runtime/runtimetypes/WeakRefRegistry.java
index 2d5cd049a7..b7cb300763 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/WeakRefRegistry.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/WeakRefRegistry.java
@@ -161,13 +161,19 @@ private static void weaken(
             // hash like `{ weakref => $target }`), the store never incremented
             // refCount, so weaken must not decrement either — otherwise we
             // get a double-decrement that causes premature destruction.
-            // Clear the owner slot and legacy bridge because weaken's DEC consumes the ownership —
-            // the weak scalar should not trigger another DEC on scope exit or overwrite.
-            ref.setRefCountOwned(false);
-            base.traceRefCount(-1, "WeakRefRegistry.weaken (decrement on weakening)");
-            base.releaseOwner(ref, "weaken");
-            base.releaseActiveOwner(ref);
-            if (--base.refCount == 0) {
+            // The scalar-value slot owns this release when present. Older
+            // cells retain the explicit legacy bridge until their ownership
+            // path is migrated.
+            boolean releasedBySlot = ref.releaseScalarValueOwnerCount(
+                    base, "WeakRefRegistry.weaken (decrement on weakening)");
+            if (!releasedBySlot) {
+                ref.setRefCountOwned(false);
+                base.traceRefCount(-1, "WeakRefRegistry.weaken (decrement on weakening)");
+                base.releaseOwner(ref, "weaken");
+                base.releaseActiveOwner(ref);
+                base.refCount--;
+            }
+            if (base.refCount == 0) {
                 if (base.hasSemanticCaptureOwner()) {
                     // A captured pad is an authoritative Perl owner even when
                     // the weak probe being weakened held the last ordinary

From 4780b80e6a2533565f2f4396de44181b7bb65aff Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 05:39:46 +0200
Subject: [PATCH 248/317] docs: record weakening owner-slot migration

Record scalar-slot release through weaken and the full local and focused
lifetime validation results.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 9a9096177c..142e69ce74 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, and `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery. The latest confirmed push to the PR branch is `2fde9560d`; hosted validation of newer commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery, and `c21116699` passes in 31m48s for weakening-time scalar-slot release. The latest confirmed push to the PR branch is `c8a9e6679`; hosted validation of newer commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -174,6 +174,14 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   controller-release regression passes 6/6 on both backends with loopback
   access. This reduces snapshot allocation and slot traversal; it does not
   replace the legacy `refCount` dispatch bridge.
+- On 2026-10-24, `WeakRefRegistry.weaken()` now consumes an active
+  `SCALAR_VALUE` slot through `releaseScalarValueOwnerCount()`; cells without an
+  explicit slot retain the legacy decrement path. The existing regression
+  explicitly retires `refCountOwned` before weakening and verifies that the
+  slot is detached and the count is decremented exactly once. Full
+  `nice -n 19 make` passes in 31m48s on `c21116699`. Catalyst tempfile (24/24),
+  controller-owner release (3/3), and WebSocket controller release (6/6) pass
+  on both backends; the WebSocket run used loopback access.
 - The preceding array-tail fix routes `removeFirst()` and `removeLast()` through
   structural mutation hooks so `shift` and `pop` retire array slots. Its
   immutable code commit `ecc5efd37` passes full `nice -n 19 make` in 13m34s,

From 6a4d658407c55a8f28ba27367bb5568eda75f6ff Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 06:21:28 +0200
Subject: [PATCH 249/317] refactor: reacquire unweakened scalar owners through
 slots

Restore the direct scalar count and owner ledger through the SCALAR_VALUE slot
when a weak reference becomes strong again. Add regression coverage for the
weaken/unweaken ownership round trip.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 .../runtime/runtimetypes/PerlOwnerSlot.java   | 28 +++++++++++++++
 .../runtime/runtimetypes/RuntimeScalar.java   |  8 +++++
 .../runtime/runtimetypes/WeakRefRegistry.java |  8 ++---
 ...abilityWalkerScalarValueOwnerSlotTest.java | 34 +++++++++++++++++++
 4 files changed, 72 insertions(+), 6 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
index bcf45960f2..46248495dc 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
@@ -363,6 +363,34 @@ public synchronized void retargetScalarReferenceContents(RuntimeBase nextTarget)
         }
     }
 
+    /** Acquire one tracked direct-scalar owner through this slot. */
+    synchronized boolean acquireScalarValueCount(RuntimeBase target, String acquireSite) {
+        if (kind != Kind.SCALAR_VALUE) {
+            throw new IllegalStateException(
+                    "scalar-value acquisition requires a SCALAR_VALUE slot");
+        }
+        Objects.requireNonNull(target, "target");
+        if (referent == target) return true;
+        if (referent != null) {
+            throw new IllegalStateException("cannot retarget an active scalar-value owner");
+        }
+        if (target.refCount < 0) return false;
+        if (target.refCount == Integer.MAX_VALUE) {
+            throw new IllegalStateException("scalar-value owner count overflow");
+        }
+        target.traceRefCount(+1, acquireSite);
+        target.refCount++;
+        target.hadCountedReference = true;
+        RuntimeScalar scalar = ownerCell();
+        if (scalar != null) {
+            scalar.refCountOwned = true;
+            target.recordOwner(scalar, acquireSite);
+            target.recordActiveOwner(scalar);
+        }
+        transferTo(target);
+        return true;
+    }
+
     /**
      * Release the legacy counted edge represented by a direct scalar-value
      * slot. The caller retains lifecycle policy (for example, whether a
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 09ef45dcf1..89739ce4c0 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -909,6 +909,14 @@ boolean releaseScalarValueOwnerCount(RuntimeBase expectedReferent, String releas
         return slot != null && slot.releaseScalarValueCount(expectedReferent, releaseSite);
     }
 
+    boolean acquireScalarValueOwnerCount(RuntimeBase referent, String acquireSite) {
+        if (scalarValueOwnerSlot == null) {
+            scalarValueOwnerSlot = new PerlOwnerSlot(
+                    PerlOwnerSlot.Kind.SCALAR_VALUE, null, null, this);
+        }
+        return scalarValueOwnerSlot.acquireScalarValueCount(referent, acquireSite);
+    }
+
     PerlOwnerSlot.PendingRelease deferScalarValueOwnerCount(RuntimeBase expectedReferent) {
         PerlOwnerSlot slot = scalarValueOwnerSlot;
         return slot != null
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/WeakRefRegistry.java b/src/main/java/org/perlonjava/runtime/runtimetypes/WeakRefRegistry.java
index b7cb300763..1528022751 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/WeakRefRegistry.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/WeakRefRegistry.java
@@ -322,12 +322,8 @@ public static void unweaken(RuntimeScalar ref) {
                 if (weakRefs.isEmpty()) state.referentToWeakRefs.remove(base);
             }
             if (base.refCount >= 0) {
-                base.traceRefCount(+1, "WeakRefRegistry.unweaken (restore strong count)");
-                base.refCount++;  // restore strong count
-                ref.setRefCountOwned(true);  // restore ownership
-                base.hadCountedReference = true;
-                base.recordOwner(ref, "WeakRefRegistry.unweaken");
-                base.recordActiveOwner(ref);
+                ref.acquireScalarValueOwnerCount(
+                        base, "WeakRefRegistry.unweaken (restore strong count)");
             }
             // Note: if MIN_VALUE, object already destroyed — unweaken is a no-op
         }
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerScalarValueOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerScalarValueOwnerSlotTest.java
index 92c39609f5..c536f604c2 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerScalarValueOwnerSlotTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalkerScalarValueOwnerSlotTest.java
@@ -76,4 +76,38 @@ void weakeningUsesAnActiveScalarOwnerSlotAfterLegacyFlagRetires() {
             }
         }
     }
+
+    @Test
+    void unweakeningRestoresDirectOwnerThroughScalarValueSlot() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray target = new RuntimeArray();
+            RuntimeScalar strongOwner = new RuntimeScalar();
+            strongOwner.set(target.createAnonymousReference());
+            MyVarCleanupStack.register(strongOwner);
+
+            RuntimeScalar weakObserver = new RuntimeScalar();
+            weakObserver.set(target.createAnonymousReference());
+            WeakRefRegistry.weaken(weakObserver);
+            assertEquals(1, target.refCount);
+            assertFalse(weakObserver.scalarValueOwnerSlot().isActive());
+
+            try {
+                WeakRefRegistry.unweaken(weakObserver);
+
+                assertEquals(2, target.refCount,
+                        "unweakening restores the direct scalar owner count");
+                assertTrue(weakObserver.ownsCountedReferent(target));
+                assertTrue(weakObserver.scalarValueOwnerSlot().isActive(),
+                        "unweakening restores ownership through the explicit slot");
+            } finally {
+                if (WeakRefRegistry.isweak(weakObserver)) {
+                    WeakRefRegistry.unweaken(weakObserver);
+                }
+                weakObserver.undefine();
+                strongOwner.undefine();
+                MyVarCleanupStack.unregister(strongOwner);
+            }
+        }
+    }
 }

From 244b8554b3f3fefc903175086eb74d79403bc927 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 06:22:04 +0200
Subject: [PATCH 250/317] docs: record paired weaken owner-slot result

Record the unweaken acquisition path, round-trip coverage, and full build result.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 142e69ce74..68222937cf 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery, and `c21116699` passes in 31m48s for weakening-time scalar-slot release. The latest confirmed push to the PR branch is `c8a9e6679`; hosted validation of newer commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery, `c21116699` passes in 31m48s for weakening-time scalar-slot release, and `6a4d65840` passes in 26m14s for paired weaken/unweaken slot accounting. The latest confirmed push to the PR branch is `4780b80e6`; hosted validation of newer commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -182,6 +182,12 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   `nice -n 19 make` passes in 31m48s on `c21116699`. Catalyst tempfile (24/24),
   controller-owner release (3/3), and WebSocket controller release (6/6) pass
   on both backends; the WebSocket run used loopback access.
+- On 2026-10-24, `WeakRefRegistry.unweaken()` now restores the strong count and
+  owner ledger through the scalar-value slot acquisition API. The new Java
+  regression covers the full weaken/unweaken cycle, including count restoration
+  and slot reactivation. Full `nice -n 19 make` passes in 26m14s on
+  `6a4d65840`. The bridge still updates `refCount` because lifecycle dispatch
+  has not yet moved to the explicit owner ledger.
 - The preceding array-tail fix routes `removeFirst()` and `removeLast()` through
   structural mutation hooks so `shift` and `pop` retire array slots. Its
   immutable code commit `ecc5efd37` passes full `nice -n 19 make` in 13m34s,

From 09988c53e79731b42775e8e0a2c79f90a39bdd52 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 06:55:15 +0200
Subject: [PATCH 251/317] refactor: acquire container scalar owners through
 slots

Route aggregate-store scalar ownership acquisition through the SCALAR_VALUE slot
API so the count, owner registries, and slot identity are installed together.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 .../runtime/runtimetypes/RuntimeScalar.java          | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 89739ce4c0..8a5b9557a2 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -909,7 +909,7 @@ boolean releaseScalarValueOwnerCount(RuntimeBase expectedReferent, String releas
         return slot != null && slot.releaseScalarValueCount(expectedReferent, releaseSite);
     }
 
-    boolean acquireScalarValueOwnerCount(RuntimeBase referent, String acquireSite) {
+    synchronized boolean acquireScalarValueOwnerCount(RuntimeBase referent, String acquireSite) {
         if (scalarValueOwnerSlot == null) {
             scalarValueOwnerSlot = new PerlOwnerSlot(
                     PerlOwnerSlot.Kind.SCALAR_VALUE, null, null, this);
@@ -2416,12 +2416,10 @@ public static void incrementRefCountForContainerStore(RuntimeScalar scalar) {
             }
             base.refCount = 0;
         }
-        base.traceRefCount(+1, "RuntimeScalar.incrementRefCountForContainerStore");
-        base.refCount++;
-        base.hadCountedReference = true;
-        base.recordOwner(scalar, "incrementRefCountForContainerStore");
-        base.recordActiveOwner(scalar);
-        scalar.setRefCountOwned(true);
+        if (!scalar.acquireScalarValueOwnerCount(
+                base, "RuntimeScalar.incrementRefCountForContainerStore")) {
+            return;
+        }
         // Phase B1 (refcount_alignment_52leaks_plan.md): track the
         // container element so ReachabilityWalker can see it via
         // ScalarRefRegistry.

From 395cd2860d812bdcd2235710405176af6f30188a Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 06:55:48 +0200
Subject: [PATCH 252/317] docs: record aggregate store slot acquisition

Record the scalar owner-slot migration in aggregate stores and its full gate.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 68222937cf..012b69022a 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery, `c21116699` passes in 31m48s for weakening-time scalar-slot release, and `6a4d65840` passes in 26m14s for paired weaken/unweaken slot accounting. The latest confirmed push to the PR branch is `4780b80e6`; hosted validation of newer commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery, `c21116699` passes in 31m48s for weakening-time scalar-slot release, `6a4d65840` passes in 26m14s for paired weaken/unweaken slot accounting, and `09988c53e` passes in 23m54s for aggregate-store scalar-slot acquisition. The latest confirmed push to the PR branch is `244b8554b`; hosted validation of newer commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -188,6 +188,11 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   and slot reactivation. Full `nice -n 19 make` passes in 26m14s on
   `6a4d65840`. The bridge still updates `refCount` because lifecycle dispatch
   has not yet moved to the explicit owner ledger.
+- On 2026-10-24, `incrementRefCountForContainerStore()` now acquires the direct
+  scalar count and owner registries through the `SCALAR_VALUE` slot API. Existing
+  aggregate ownership tests verify separate copied cells still acquire distinct
+  owners and active slots are not double-counted. Full `nice -n 19 make` passes
+  in 23m54s on `09988c53e`.
 - The preceding array-tail fix routes `removeFirst()` and `removeLast()` through
   structural mutation hooks so `shift` and `pop` retire array slots. Its
   immutable code commit `ecc5efd37` passes full `nice -n 19 make` in 13m34s,

From bb1d9d190a4b6336fccaeb76e0bfb283fc508e52 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 07:04:29 +0200
Subject: [PATCH 253/317] docs: refresh ownership migration status

Record the pushed aggregate-store scalar-slot acquisition commit in the phase
status summary.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 012b69022a..7e091f6f25 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery, `c21116699` passes in 31m48s for weakening-time scalar-slot release, `6a4d65840` passes in 26m14s for paired weaken/unweaken slot accounting, and `09988c53e` passes in 23m54s for aggregate-store scalar-slot acquisition. The latest confirmed push to the PR branch is `244b8554b`; hosted validation of newer commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery, `c21116699` passes in 31m48s for weakening-time scalar-slot release, `6a4d65840` passes in 26m14s for paired weaken/unweaken slot accounting, and `09988c53e` passes in 23m54s for aggregate-store scalar-slot acquisition. The latest confirmed push to the PR branch is `395cd2860`; hosted validation of newer commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 

From 2a2b9fe3ba9ed80e700902f8334b65f048b917c9 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 07:38:54 +0200
Subject: [PATCH 254/317] refactor: acquire scalar stores through owner slots

Move tracked scalar-store retain accounting into the SCALAR_VALUE owner-slot
API before releasing the displaced value. Preserve the single-owner result on
self-assignment and cover the active-owner registry behavior.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 .../runtime/runtimetypes/RuntimeScalar.java   | 21 ++++++++++------
 .../RuntimeScalarValueOwnerSlotTest.java      | 25 +++++++++++++++++++
 2 files changed, 38 insertions(+), 8 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 8a5b9557a2..9ddf88747b 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -3088,11 +3088,6 @@ && scalarReferenceContentsOwnersSnapshot().isEmpty()
             }
             if (nb.refCount >= 0 && !scalarContentsOwnedByEscapedReference) {
                 if (nb.refCount == 0) nb.registerSharedFetchedView();
-                nb.traceRefCount(+1, "RuntimeScalar.setLargeRefCounted (increment on store)");
-                nb.recordOwner(this, "setLargeRefCounted store");
-                nb.recordActiveOwner(this);
-                nb.refCount++;
-                nb.hadCountedReference = true;
                 newOwned = true;
             }
         }
@@ -3106,7 +3101,15 @@ && scalarReferenceContentsOwnersSnapshot().isEmpty()
         this.scalarReferenceContentsOwner = null;
         // Install the new scalar-cell owner edge before releasing the prior
         // referent below. DESTROY callbacks must observe the assigned value.
-        syncScalarValueOwnerSlot(newOwned);
+        syncScalarValueOwnerSlot(false);
+        if (newOwned) {
+            if (!(this.value instanceof RuntimeBase newReferent)
+                    || !acquireScalarValueOwnerCount(
+                            newReferent, "RuntimeScalar.setLargeRefCounted (increment on store)")) {
+                throw new IllegalStateException(
+                        "tracked scalar assignment could not acquire its owner slot");
+            }
+        }
         // An explicitly discarded closure can have an inflated CODE refcount,
         // so waiting for callDestroy() leaves its captures alive indefinitely.
         // Release them only after this slot is gone, the code is inactive, and
@@ -3249,8 +3252,10 @@ && hasLiveIo(assignedGlob)) {
                 && (oldOwnedByScalarValue || oldOwnedByScalarReference)) {
             if (oldBase.refCount > 0) {
                 oldBase.traceRefCount(-1, "RuntimeScalar.setLargeRefCounted (decrement on overwrite)");
-                oldBase.releaseOwner(this, "setLargeRefCounted overwrite");
-                oldBase.releaseActiveOwner(this);
+                if (!(oldOwnedByScalarValue && oldBase == this.value && newOwned)) {
+                    oldBase.releaseOwner(this, "setLargeRefCounted overwrite");
+                    oldBase.releaseActiveOwner(this);
+                }
             }
             if (oldBase.refCount > 0 && --oldBase.refCount == 0) {
                 int rootedScalarContentsOwners = oldBase.ownerSlotCount(
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarValueOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarValueOwnerSlotTest.java
index 787d9e98ef..4b7336a032 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarValueOwnerSlotTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarValueOwnerSlotTest.java
@@ -9,6 +9,31 @@
 
 @Tag("unit")
 class RuntimeScalarValueOwnerSlotTest {
+    @Test
+    void scalarSelfAssignmentKeepsOneCountedOwnerAndSlot() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            referent.activateOwnerTracking();
+            RuntimeScalar scalar = new RuntimeScalar();
+            scalar.set(referent.createAnonymousReference());
+            PerlOwnerSlot slot = scalar.scalarValueOwnerSlot();
+
+            assertEquals(1, referent.refCount);
+            assertEquals(1, referent.activeOwnerCount());
+
+            scalar.set(scalar);
+
+            assertEquals(1, referent.refCount,
+                    "self-assignment balances its temporary retain and release");
+            assertEquals(1, referent.activeOwnerCount(),
+                    "the scalar remains in the legacy owner registry");
+            assertEquals(1, referent.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+            assertSame(slot, scalar.scalarValueOwnerSlot());
+            scalar.undefine();
+        }
+    }
+
     @Test
     void scalarAssignmentTransfersOneStableOwnerSlot() {
         PerlRuntime runtime = new PerlRuntime();

From cb46e56fe980f51833f2709f2865345d7a3324d0 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 07:39:28 +0200
Subject: [PATCH 255/317] docs: record scalar-store owner-slot acquisition

Record the scalar-store migration, self-assignment coverage, and issue-focused
lifetime test results.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 7e091f6f25..c800df0590 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery, `c21116699` passes in 31m48s for weakening-time scalar-slot release, `6a4d65840` passes in 26m14s for paired weaken/unweaken slot accounting, and `09988c53e` passes in 23m54s for aggregate-store scalar-slot acquisition. The latest confirmed push to the PR branch is `395cd2860`; hosted validation of newer commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery, `c21116699` passes in 31m48s for weakening-time scalar-slot release, `6a4d65840` passes in 26m14s for paired weaken/unweaken slot accounting, `09988c53e` passes in 23m54s for aggregate-store scalar-slot acquisition, and `2a2b9fe3b` passes in 16m12s for scalar-store slot acquisition. The latest confirmed push to the PR branch is `bb1d9d190`; hosted validation of newer commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -193,6 +193,12 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   aggregate ownership tests verify separate copied cells still acquire distinct
   owners and active slots are not double-counted. Full `nice -n 19 make` passes
   in 23m54s on `09988c53e`.
+- On 2026-10-24, the tracked scalar-store retain now uses the same slot API,
+  installing the new scalar owner before releasing the displaced referent. A
+  self-assignment regression checks that the count and legacy owner registry
+  remain at one. Full `nice -n 19 make` passes in 16m12s on `2a2b9fe3b`. The
+  Catalyst tempfile, controller-owner, and WebSocket controller-release files
+  pass on both backends; WebSocket ran with loopback access.
 - The preceding array-tail fix routes `removeFirst()` and `removeLast()` through
   structural mutation hooks so `shift` and `pop` retire array slots. Its
   immutable code commit `ecc5efd37` passes full `nice -n 19 make` in 13m34s,

From 723e56dbaaed5cdeef61766fb0b22d6f2226384b Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 07:49:21 +0200
Subject: [PATCH 256/317] docs: refresh scalar-store migration status

Record the scalar-store slot acquisition commit in the ownership phase status.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index c800df0590..c0093b9a06 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery, `c21116699` passes in 31m48s for weakening-time scalar-slot release, `6a4d65840` passes in 26m14s for paired weaken/unweaken slot accounting, `09988c53e` passes in 23m54s for aggregate-store scalar-slot acquisition, and `2a2b9fe3b` passes in 16m12s for scalar-store slot acquisition. The latest confirmed push to the PR branch is `bb1d9d190`; hosted validation of newer commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery, `c21116699` passes in 31m48s for weakening-time scalar-slot release, `6a4d65840` passes in 26m14s for paired weaken/unweaken slot accounting, `09988c53e` passes in 23m54s for aggregate-store scalar-slot acquisition, and `2a2b9fe3b` passes in 16m12s for scalar-store slot acquisition. The latest confirmed push to the PR branch is `cb46e56fe`; hosted validation of newer commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 

From e626aaddc464346921e8e51ffcd8be71c0232352 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 08:29:51 +0200
Subject: [PATCH 257/317] refactor: release overwritten scalar owners through
 slots

Release the displaced SCALAR_VALUE owner through its slot before reusing the
stable slot for the replacement. Keep final lifecycle dispatch at the existing
assignment boundary and cover overwrite after the legacy flag retires.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 .../runtime/runtimetypes/RuntimeScalar.java   | 32 +++++++++++++++----
 .../RuntimeScalarValueOwnerSlotTest.java      | 30 +++++++++++++++++
 2 files changed, 56 insertions(+), 6 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 9ddf88747b..0cf373203e 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -3099,10 +3099,23 @@ && scalarReferenceContentsOwnersSnapshot().isEmpty()
         this.type = value.type;
         this.value = copyScalarPayload(value.type, value.value);
         this.scalarReferenceContentsOwner = null;
-        // Install the new scalar-cell owner edge before releasing the prior
-        // referent below. DESTROY callbacks must observe the assigned value.
-        syncScalarValueOwnerSlot(false);
-        if (newOwned) {
+        // A self-assignment keeps its existing slot/count. Otherwise release
+        // the displaced scalar slot before reusing its stable identity for the
+        // assigned value. No lifecycle callback runs until the new edge is
+        // installed and the release policy below decides whether to dispatch.
+        boolean preservedExistingScalarValueOwner = newOwned
+                && this.value instanceof RuntimeBase assignedReferent
+                && hasScalarValueOwnerSlotFor(assignedReferent);
+        boolean releasedOldScalarValueSlot = false;
+        if (!preservedExistingScalarValueOwner) {
+            if (oldOwnedByScalarValue && oldBase != null && !thisWasWeak) {
+                releasedOldScalarValueSlot = releaseScalarValueOwnerCount(
+                        oldBase,
+                        "RuntimeScalar.setLargeRefCounted (decrement on overwrite)");
+            }
+            syncScalarValueOwnerSlot(false);
+        }
+        if (newOwned && !preservedExistingScalarValueOwner) {
             if (!(this.value instanceof RuntimeBase newReferent)
                     || !acquireScalarValueOwnerCount(
                             newReferent, "RuntimeScalar.setLargeRefCounted (increment on store)")) {
@@ -3250,14 +3263,21 @@ && hasLiveIo(assignedGlob)) {
         // and for scalars that didn't own a refCount increment).
         if (oldBase != null && !thisWasWeak
                 && (oldOwnedByScalarValue || oldOwnedByScalarReference)) {
-            if (oldBase.refCount > 0) {
+            if (preservedExistingScalarValueOwner) {
+                // The same scalar slot still owns the same referent; assignment
+                // introduced no displaced count to release.
+            } else if (oldBase.refCount > 0 && !releasedOldScalarValueSlot) {
                 oldBase.traceRefCount(-1, "RuntimeScalar.setLargeRefCounted (decrement on overwrite)");
                 if (!(oldOwnedByScalarValue && oldBase == this.value && newOwned)) {
                     oldBase.releaseOwner(this, "setLargeRefCounted overwrite");
                     oldBase.releaseActiveOwner(this);
                 }
             }
-            if (oldBase.refCount > 0 && --oldBase.refCount == 0) {
+            boolean oldReferentReachedZero = !preservedExistingScalarValueOwner
+                    && (releasedOldScalarValueSlot
+                        ? oldBase.refCount == 0
+                        : oldBase.refCount > 0 && --oldBase.refCount == 0);
+            if (oldReferentReachedZero) {
                 int rootedScalarContentsOwners = oldBase.ownerSlotCount(
                         PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS) == 0
                         ? 0 : oldBase.reachableOwnerCount();
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarValueOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarValueOwnerSlotTest.java
index 4b7336a032..fb0f55bbe0 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarValueOwnerSlotTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarValueOwnerSlotTest.java
@@ -63,6 +63,36 @@ void scalarAssignmentTransfersOneStableOwnerSlot() {
         }
     }
 
+    @Test
+    void scalarOverwriteReleasesDisplacedSlotAfterLegacyFlagRetires() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray first = new RuntimeArray();
+            RuntimeArray second = new RuntimeArray();
+            first.activateOwnerTracking();
+            second.activateOwnerTracking();
+            RuntimeScalar scalar = new RuntimeScalar();
+            scalar.set(first.createReference());
+            PerlOwnerSlot slot = scalar.scalarValueOwnerSlot();
+            scalar.refCountOwned = false;
+
+            scalar.set(second.createReference());
+
+            assertEquals(0, first.refCount,
+                    "overwriting the cell releases the referent recorded by its slot");
+            assertEquals(0, first.activeOwnerCount(),
+                    "the displaced cell is removed from the compatibility owner registry");
+            assertEquals(1, second.refCount);
+            assertEquals(1, second.activeOwnerCount());
+            assertEquals(0, first.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+            assertEquals(1, second.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+            assertSame(slot, scalar.scalarValueOwnerSlot());
+            assertSame(second, slot.referent());
+
+            scalar.undefine();
+        }
+    }
+
     @Test
     void localizedScalarValueKeepsItsOwnerUntilRestore() {
         PerlRuntime runtime = new PerlRuntime();

From 8e28ad43d7679dfae837d52d8e0995c8c3bf0ebf Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 08:30:27 +0200
Subject: [PATCH 258/317] docs: record scalar overwrite slot release

Record overwrite-time scalar-slot release, regression coverage, and focused
issue lifetime results.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index c0093b9a06..c2e22ffa78 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery, `c21116699` passes in 31m48s for weakening-time scalar-slot release, `6a4d65840` passes in 26m14s for paired weaken/unweaken slot accounting, `09988c53e` passes in 23m54s for aggregate-store scalar-slot acquisition, and `2a2b9fe3b` passes in 16m12s for scalar-store slot acquisition. The latest confirmed push to the PR branch is `cb46e56fe`; hosted validation of newer commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery, `c21116699` passes in 31m48s for weakening-time scalar-slot release, `6a4d65840` passes in 26m14s for paired weaken/unweaken slot accounting, `09988c53e` passes in 23m54s for aggregate-store scalar-slot acquisition, `2a2b9fe3b` passes in 16m12s for scalar-store slot acquisition, and `e626aaddc` passes in 20m05s for scalar-overwrite slot release. The latest confirmed push to the PR branch is `723e56dba`; hosted validation of newer commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -199,6 +199,13 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   remain at one. Full `nice -n 19 make` passes in 16m12s on `2a2b9fe3b`. The
   Catalyst tempfile, controller-owner, and WebSocket controller-release files
   pass on both backends; WebSocket ran with loopback access.
+- On 2026-10-24, scalar overwrite now releases the displaced direct owner
+  through its `SCALAR_VALUE` slot, then reuses the stable slot for the new
+  referent. Lifecycle dispatch remains after the assignment's existing rescue
+  and reachability checks. A Java regression retires the legacy Boolean before
+  overwrite and verifies old/new counts, registries, and slot identity. Full
+  `nice -n 19 make` passes in 20m05s; Catalyst tempfile, controller-owner, and
+  WebSocket controller-release regressions pass on both backends.
 - The preceding array-tail fix routes `removeFirst()` and `removeLast()` through
   structural mutation hooks so `shift` and `pop` retire array slots. Its
   immutable code commit `ecc5efd37` passes full `nice -n 19 make` in 13m34s,

From df6975ea3c3372450d77a8d3ab94a7d301590241 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 09:23:58 +0200
Subject: [PATCH 259/317] fix: release localized scalar owner slot on restore

Route dynamic restoration of displaced scalar values through the explicit
SCALAR_VALUE owner slot while keeping DESTROY dispatch after saved state is
restored. Add regression coverage for a retired legacy ownership flag.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 .../runtime/runtimetypes/RuntimeScalar.java   | 10 ++++--
 .../RuntimeScalarDynamicOwnerSlotTest.java    | 31 +++++++++++++++++++
 2 files changed, 39 insertions(+), 2 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 0cf373203e..baeab572e0 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -6833,6 +6833,9 @@ public void dynamicRestoreState() {
                     && this.value instanceof RuntimeBase base) {
                 displacedBase = base;
             }
+            boolean releasedDisplacedScalarSlot = displacedBase != null
+                    && releaseScalarValueOwnerCount(
+                            displacedBase, "RuntimeScalar.dynamicRestoreState");
             PerlOwnerSlot displacedScalarReferenceContentsOwner =
                     this.scalarReferenceContentsOwner;
 
@@ -6878,8 +6881,11 @@ public void dynamicRestoreState() {
             // Decrement refCount of the value displaced by local restoration
             // after restoring the old scalar state, so DESTROY sees the restored
             // variable rather than the dying localized value.
-            if (displacedBase != null
-                    && displacedBase.refCount > 0 && --displacedBase.refCount == 0) {
+            boolean displacedReferentReachedZero = displacedBase != null
+                    && (releasedDisplacedScalarSlot
+                        ? displacedBase.refCount == 0
+                        : displacedBase.refCount > 0 && --displacedBase.refCount == 0);
+            if (displacedReferentReachedZero) {
                 displacedBase.refCount = Integer.MIN_VALUE;
                 DestroyDispatch.callDestroy(displacedBase);
             }
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarDynamicOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarDynamicOwnerSlotTest.java
index fe99e4e7e9..dff9df73bc 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarDynamicOwnerSlotTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarDynamicOwnerSlotTest.java
@@ -8,6 +8,37 @@
 
 @Tag("unit")
 class RuntimeScalarDynamicOwnerSlotTest {
+    @Test
+    void dynamicRestoreReleasesDisplacedScalarSlotAfterLegacyFlagRetires() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray original = new RuntimeArray();
+            RuntimeArray localized = new RuntimeArray();
+            original.activateOwnerTracking();
+            localized.activateOwnerTracking();
+            RuntimeScalar scalar = new RuntimeScalar();
+            scalar.set(original.createAnonymousReference());
+
+            scalar.dynamicSaveState();
+            scalar.set(localized.createAnonymousReference());
+            scalar.refCountOwned = false;
+            assertTrue(scalar.scalarValueOwnerSlot().isActive());
+
+            scalar.dynamicRestoreState();
+
+            assertEquals(Integer.MIN_VALUE, localized.refCount,
+                    "restoring the saved value destroys its final localized referent");
+            assertEquals(0, localized.activeOwnerCount());
+            assertEquals(0, localized.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+            assertEquals(1, original.refCount,
+                    "the saved scalar owner transfers back without changing its count");
+            assertEquals(1, original.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+            assertTrue(scalar.ownsCountedReferent(original));
+
+            scalar.undefine();
+        }
+    }
+
     @Test
     void dynamicSaveAndRestorePreservesOwnerSlotAfterLegacyFlagRetires() {
         PerlRuntime runtime = new PerlRuntime();

From 5d82568bc1abef160d18013954fc0f4dd7cf712b Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 09:24:11 +0200
Subject: [PATCH 260/317] docs: record localized scalar restore slot release

Record the implementation, test coverage, and validation for the dynamic
restore owner-slot release batch.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index c2e22ffa78..ab594bd69f 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -119,6 +119,15 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
 
 ### Current batch
 
+- On 2026-10-24, `dynamicRestoreState()` now retires a displaced localized
+  referent through its `SCALAR_VALUE` owner slot before restoring the saved
+  scalar state, while preserving post-restore `DESTROY` dispatch. A focused
+  Java regression covers a retired legacy `refCountOwned` flag with an active
+  slot and verifies that the restored referent remains owned. Full
+  `nice -n 19 make` passes in 17m on this batch. The Catalyst tempfile file
+  passes 24/24, the #1794 controller-owner file 3/3, and the Mojolicious
+  WebSocket release file 6/6 on both JVM and interpreter. The prior ownership
+  cases and lifecycle bridge remain open; Phase 2 is incomplete.
 - Array and hash tails in nested list assignment transfer materialized cells
   through their owning-store paths. This releases displaced values, acquires
   scalar ownership idempotently, and registers structural slots on the

From a547b89b89cafa8a01cebb7090e9579ba68c15a0 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 09:59:35 +0200
Subject: [PATCH 261/317] fix: release global localization owner slots

Release displaced localized global values through their scalar owner slot and
preserve the existing last-owner DESTROY decision after restoring the global
binding. Add regression coverage for a retired legacy ownership flag.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 .../runtimetypes/GlobalRuntimeScalar.java     | 22 ++++++---
 ...obalRuntimeScalarDynamicOwnerSlotTest.java | 45 +++++++++++++++++++
 2 files changed, 62 insertions(+), 5 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/GlobalRuntimeScalarDynamicOwnerSlotTest.java

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/GlobalRuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/GlobalRuntimeScalar.java
index 475652532c..6612bcdade 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/GlobalRuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/GlobalRuntimeScalar.java
@@ -204,6 +204,7 @@ public void dynamicRestoreState() {
                 GlobalVariable.clearForeachGlobalAlias(saved.fullName);
                 RuntimeScalar localVar = saved.localizedVariable;
                 RuntimeBase displacedBase = null;
+                boolean releasedDisplacedScalarSlot = false;
                 RuntimeScalar scalarReferenceContents = null;
                 PerlOwnerSlot scalarContentsOwner = null;
                 // Release container-owned values only when this localized
@@ -228,8 +229,14 @@ public void dynamicRestoreState() {
                         && localVar.ownsCountedReferent(base)
                         && base.refCount > 0) {
                     displacedBase = base;
-                    localVar.setRefCountOwned(false);
-                    displacedBase.releaseActiveOwner(localVar);
+                    releasedDisplacedScalarSlot = localVar.releaseScalarValueOwnerCount(
+                            base, "GlobalRuntimeScalar.dynamicRestoreState");
+                    if (!releasedDisplacedScalarSlot) {
+                        // Compatibility path for localized cells created
+                        // before direct scalar owner slots were installed.
+                        localVar.setRefCountOwned(false);
+                        displacedBase.releaseActiveOwner(localVar);
+                    }
                 }
                 if (localVar != null
                         && localVar.hasScalarReferenceContentsOwner()
@@ -264,7 +271,9 @@ public void dynamicRestoreState() {
                 // Decrement refCount of the displaced local value after restoring
                 // the global slot, so DESTROY sees the restored variable state.
                 boolean displacedWillDestroy = false;
-                if (displacedBase != null && displacedBase.refCount == 1) {
+                if (displacedBase != null
+                        && (releasedDisplacedScalarSlot
+                            ? displacedBase.refCount == 0 : displacedBase.refCount == 1)) {
                     String className = NameNormalizer.getBlessStr(displacedBase.blessId);
                     displacedWillDestroy = className != null && !className.isEmpty()
                             && DestroyDispatch.classHasDestroy(displacedBase.blessId, className);
@@ -293,8 +302,11 @@ public void dynamicRestoreState() {
                 } else {
                     RuntimeScalar.releaseScalarReferenceContents(scalarReferenceContents);
                 }
-                if (displacedBase != null && displacedBase.refCount > 0
-                        && --displacedBase.refCount == 0) {
+                boolean displacedReferentReachedZero = displacedBase != null
+                        && (releasedDisplacedScalarSlot
+                            ? displacedBase.refCount == 0
+                            : displacedBase.refCount > 0 && --displacedBase.refCount == 0);
+                if (displacedReferentReachedZero) {
                     displacedBase.refCount = Integer.MIN_VALUE;
                     DestroyDispatch.callDestroy(displacedBase);
                 }
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/GlobalRuntimeScalarDynamicOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/GlobalRuntimeScalarDynamicOwnerSlotTest.java
new file mode 100644
index 0000000000..77b1868b00
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/GlobalRuntimeScalarDynamicOwnerSlotTest.java
@@ -0,0 +1,45 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("unit")
+class GlobalRuntimeScalarDynamicOwnerSlotTest {
+    @Test
+    void globalRestoreReleasesDisplacedScalarSlotAfterLegacyFlagRetires() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            String name = "DynamicOwnerSlot::global";
+            RuntimeArray originalReferent = new RuntimeArray();
+            RuntimeArray localizedReferent = new RuntimeArray();
+            originalReferent.activateOwnerTracking();
+            localizedReferent.activateOwnerTracking();
+            RuntimeScalar original = GlobalVariable.getGlobalVariable(name);
+            original.set(originalReferent.createAnonymousReference());
+
+            GlobalRuntimeScalar localizer = new GlobalRuntimeScalar(name);
+            localizer.dynamicSaveState();
+            RuntimeScalar localized = GlobalVariable.getGlobalVariable(name);
+            localized.set(localizedReferent.createAnonymousReference());
+            localized.refCountOwned = false;
+            assertTrue(localized.scalarValueOwnerSlot().isActive());
+
+            localizer.dynamicRestoreState();
+
+            assertSame(original, GlobalVariable.getGlobalVariable(name));
+            assertEquals(Integer.MIN_VALUE, localizedReferent.refCount,
+                    "restoring the global destroys its final localized referent");
+            assertEquals(0, localizedReferent.activeOwnerCount());
+            assertEquals(0, localizedReferent.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+            assertEquals(1, originalReferent.refCount);
+            assertEquals(1, originalReferent.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+            assertTrue(original.ownsCountedReferent(originalReferent));
+
+            original.undefine();
+        }
+    }
+}

From e5c797df5eb8b730019742be4f61581aea665b08 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 10:00:16 +0200
Subject: [PATCH 262/317] docs: record global localization slot release

Record the global restore owner-slot migration and its full-build regression
coverage in the ownership rewrite progress log.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index ab594bd69f..940d0525cf 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery, `c21116699` passes in 31m48s for weakening-time scalar-slot release, `6a4d65840` passes in 26m14s for paired weaken/unweaken slot accounting, `09988c53e` passes in 23m54s for aggregate-store scalar-slot acquisition, `2a2b9fe3b` passes in 16m12s for scalar-store slot acquisition, and `e626aaddc` passes in 20m05s for scalar-overwrite slot release. The latest confirmed push to the PR branch is `723e56dba`; hosted validation of newer commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery, `c21116699` passes in 31m48s for weakening-time scalar-slot release, `6a4d65840` passes in 26m14s for paired weaken/unweaken slot accounting, `09988c53e` passes in 23m54s for aggregate-store scalar-slot acquisition, `2a2b9fe3b` passes in 16m12s for scalar-store slot acquisition, and `e626aaddc` passes in 20m05s for scalar-overwrite slot release. The latest pushed PR head is `5d82568bc`; the current local batch is `a547b89b8` and passes full `nice -n 19 make` in 14m47s. Hosted validation of recent commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -119,6 +119,13 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
 
 ### Current batch
 
+- On 2026-10-24, global `local` restoration now releases a displaced direct
+  scalar owner through its `SCALAR_VALUE` slot, while retaining the legacy
+  fallback and the existing last-owner `DESTROY` decision after the global
+  binding is restored. The regression keeps the slot active after retiring
+  `refCountOwned` and verifies the localized referent is destroyed while the
+  original global remains owned. Full `nice -n 19 make` passes in 14m47s on
+  `a547b89b8`, including the new regression.
 - On 2026-10-24, `dynamicRestoreState()` now retires a displaced localized
   referent through its `SCALAR_VALUE` owner slot before restoring the saved
   scalar state, while preserving post-restore `DESTROY` dispatch. A focused

From a0ff791ea270b19f78d0969912bff9484a654f3b Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 10:18:32 +0200
Subject: [PATCH 263/317] fix: release proxy localized scalar owner slots

Route hash and array proxy restoration through the direct scalar owner-slot
release API, keeping the legacy count fallback for unmigrated cells. Add
regressions for newly localized entries after the legacy ownership flag retires.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 .../runtimetypes/RuntimeArrayProxyEntry.java  |  9 +--
 .../runtimetypes/RuntimeHashProxyEntry.java   |  9 +--
 .../runtime/runtimetypes/RuntimeScalar.java   | 22 +++++++
 .../RuntimeProxyDynamicOwnerSlotTest.java     | 61 +++++++++++++++++++
 4 files changed, 87 insertions(+), 14 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeProxyDynamicOwnerSlotTest.java

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayProxyEntry.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayProxyEntry.java
index bab74f0a92..dbcecba6ba 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayProxyEntry.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArrayProxyEntry.java
@@ -284,13 +284,8 @@ public void dynamicRestoreState() {
                 parent.notePackageRootMutation();
                 // Element didn't exist before.
                 // Decrement refCount of the current value being displaced.
-                if (this.lvalue != null
-                        && (this.lvalue.type & RuntimeScalarType.REFERENCE_BIT) != 0
-                        && this.lvalue.value instanceof RuntimeBase displacedBase
-                        && displacedBase.refCount > 0 && --displacedBase.refCount == 0) {
-                    displacedBase.refCount = Integer.MIN_VALUE;
-                    DestroyDispatch.callDestroy(displacedBase);
-                }
+                RuntimeScalar.releaseDynamicRestoreScalarValueOwner(
+                        this.lvalue, "RuntimeArrayProxyEntry.dynamicRestoreState");
                 this.lvalue = null;
                 this.type = RuntimeScalarType.UNDEF;
                 this.value = null;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHashProxyEntry.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHashProxyEntry.java
index a14e72a41b..ccc51e37eb 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHashProxyEntry.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHashProxyEntry.java
@@ -222,13 +222,8 @@ public void dynamicRestoreState() {
                 // Re-fetch from parent in case hash was reassigned (setFromList clears elements).
                 parent.notePackageRootMutation();
                 RuntimeScalar current = parent.elements.remove(key);
-                if (current != null
-                        && (current.type & RuntimeScalarType.REFERENCE_BIT) != 0
-                        && current.value instanceof RuntimeBase displacedBase
-                        && displacedBase.refCount > 0 && --displacedBase.refCount == 0) {
-                    displacedBase.refCount = Integer.MIN_VALUE;
-                    DestroyDispatch.callDestroy(displacedBase);
-                }
+                RuntimeScalar.releaseDynamicRestoreScalarValueOwner(
+                        current, "RuntimeHashProxyEntry.dynamicRestoreState");
                 this.lvalue = null;
                 this.type = RuntimeScalarType.UNDEF;
                 this.value = null;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index baeab572e0..ff9f66e481 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -909,6 +909,28 @@ boolean releaseScalarValueOwnerCount(RuntimeBase expectedReferent, String releas
         return slot != null && slot.releaseScalarValueCount(expectedReferent, releaseSite);
     }
 
+    /** Release a localized scalar's direct owner, retaining the legacy bridge fallback. */
+    static void releaseDynamicRestoreScalarValueOwner(RuntimeScalar cell, String releaseSite) {
+        if (cell == null
+                || (cell.type & RuntimeScalarType.REFERENCE_BIT) == 0
+                || !(cell.value instanceof RuntimeBase referent)
+                || referent.refCount <= 0) {
+            return;
+        }
+        boolean releasedSlot = cell.releaseScalarValueOwnerCount(referent, releaseSite);
+        boolean reachedZero;
+        if (releasedSlot) {
+            reachedZero = referent.refCount == 0;
+        } else {
+            referent.traceRefCount(-1, releaseSite);
+            reachedZero = --referent.refCount == 0;
+        }
+        if (reachedZero) {
+            referent.refCount = Integer.MIN_VALUE;
+            DestroyDispatch.callDestroy(referent);
+        }
+    }
+
     synchronized boolean acquireScalarValueOwnerCount(RuntimeBase referent, String acquireSite) {
         if (scalarValueOwnerSlot == null) {
             scalarValueOwnerSlot = new PerlOwnerSlot(
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeProxyDynamicOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeProxyDynamicOwnerSlotTest.java
new file mode 100644
index 0000000000..48e68c0d48
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeProxyDynamicOwnerSlotTest.java
@@ -0,0 +1,61 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("unit")
+class RuntimeProxyDynamicOwnerSlotTest {
+    @Test
+    void hashRestoreReleasesNewEntryScalarOwnerSlotAfterLegacyFlagRetires() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeHash hash = new RuntimeHash();
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeHashProxyEntry proxy = new RuntimeHashProxyEntry(hash, "temporary");
+            referent.activateOwnerTracking();
+
+            proxy.dynamicSaveState();
+            RuntimeScalar cell = hash.elements.get("temporary");
+            proxy.set(referent.createAnonymousReference());
+            cell.refCountOwned = false;
+            assertTrue(cell.scalarValueOwnerSlot().isActive());
+
+            proxy.dynamicRestoreState();
+
+            assertFalse(hash.elements.containsKey("temporary"));
+            assertEquals(Integer.MIN_VALUE, referent.refCount);
+            assertEquals(0, referent.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+            assertEquals(0, referent.ownerSlotCount(PerlOwnerSlot.Kind.HASH_ENTRY));
+            assertEquals(0, referent.activeOwnerCount());
+        }
+    }
+
+    @Test
+    void arrayRestoreReleasesNewElementScalarOwnerSlotAfterLegacyFlagRetires() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray array = new RuntimeArray();
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeArrayProxyEntry proxy = new RuntimeArrayProxyEntry(array, 0);
+            referent.activateOwnerTracking();
+
+            proxy.dynamicSaveState();
+            RuntimeScalar cell = array.elements.get(0);
+            proxy.set(referent.createAnonymousReference());
+            cell.refCountOwned = false;
+            assertTrue(cell.scalarValueOwnerSlot().isActive());
+
+            proxy.dynamicRestoreState();
+
+            assertTrue(array.elements.isEmpty());
+            assertEquals(Integer.MIN_VALUE, referent.refCount);
+            assertEquals(0, referent.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+            assertEquals(0, referent.ownerSlotCount(PerlOwnerSlot.Kind.ARRAY_ELEMENT));
+            assertEquals(0, referent.activeOwnerCount());
+        }
+    }
+}

From 45bc5afe498479d831c0fba739208dbd4fc8cc5c Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 10:19:13 +0200
Subject: [PATCH 264/317] docs: record proxy restore owner-slot release

Record the hash and array proxy localization fixes, regression evidence, and
full-build result in the ownership rewrite progress log.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 940d0525cf..3e4f212aad 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery, `c21116699` passes in 31m48s for weakening-time scalar-slot release, `6a4d65840` passes in 26m14s for paired weaken/unweaken slot accounting, `09988c53e` passes in 23m54s for aggregate-store scalar-slot acquisition, `2a2b9fe3b` passes in 16m12s for scalar-store slot acquisition, and `e626aaddc` passes in 20m05s for scalar-overwrite slot release. The latest pushed PR head is `5d82568bc`; the current local batch is `a547b89b8` and passes full `nice -n 19 make` in 14m47s. Hosted validation of recent commits is pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery, `c21116699` passes in 31m48s for weakening-time scalar-slot release, `6a4d65840` passes in 26m14s for paired weaken/unweaken slot accounting, `09988c53e` passes in 23m54s for aggregate-store scalar-slot acquisition, `2a2b9fe3b` passes in 16m12s for scalar-store slot acquisition, and `e626aaddc` passes in 20m05s for scalar-overwrite slot release. The latest local code batch is `a0ff791ea` and passes full `nice -n 19 make` in 13m28s; its PR push and hosted validation are pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -119,6 +119,13 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
 
 ### Current batch
 
+- On 2026-10-24, removal of newly localized hash and array proxy entries now
+  releases the contained scalar's direct referent through its `SCALAR_VALUE`
+  slot, retaining the legacy fallback for cells without explicit slots. Two
+  Java regressions retire the legacy flag while keeping each slot active, then
+  verify restoration removes both scalar and aggregate owner slots and destroys
+  the displaced referent. Full `nice -n 19 make` passes in 13m28s on
+  `a0ff791ea`.
 - On 2026-10-24, global `local` restoration now releases a displaced direct
   scalar owner through its `SCALAR_VALUE` slot, while retaining the legacy
   fallback and the existing last-owner `DESTROY` decision after the global

From e9c32a68e378bbc1d12c3eddc707466c6d1a5734 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 10:39:18 +0200
Subject: [PATCH 265/317] refactor: release list materialized owners through
 slots

Route materialized scalar-copy cleanup through the SCALAR_VALUE release API,
keeping the legacy bridge for cells without active slots. Add coverage for a
slot-owned copy whose legacy ownership flag has retired.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 .../runtime/runtimetypes/RuntimeList.java     | 44 +++++++++----------
 .../RuntimeListArrayOwnerTransferTest.java    | 22 ++++++++++
 2 files changed, 44 insertions(+), 22 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
index b7d07f8a58..ee81688644 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeList.java
@@ -796,10 +796,8 @@ public RuntimeArray setFromList(RuntimeList value) {
                             && (rhsValue.type & RuntimeScalarType.REFERENCE_BIT) != 0
                             && rhsValue.value instanceof RuntimeBase base
                             && rhsValue.ownsCountedReferent(base) && base.refCount > 0) {
-                        base.releaseOwner(rhsValue, "RuntimeList materialized-copy undo (undef-target)");
-                        base.releaseActiveOwner(rhsValue);
-                        base.refCount--;
-                        rhsValue.setRefCountOwned(false);
+                        releaseMaterializedScalarOwner(
+                                rhsValue, "RuntimeList materialized-copy undo (undef-target)");
                     }
                     rhsIndex++;
                 }
@@ -824,10 +822,8 @@ public RuntimeArray setFromList(RuntimeList value) {
                         && (assigned.type & RuntimeScalarType.REFERENCE_BIT) != 0
                         && assigned.value instanceof RuntimeBase base
                         && assigned.ownsCountedReferent(base) && base.refCount > 0) {
-                    base.releaseOwner(assigned, "RuntimeList materialized-copy undo (scalar-target)");
-                    base.releaseActiveOwner(assigned);
-                    base.refCount--;
-                    assigned.setRefCountOwned(false);
+                    releaseMaterializedScalarOwner(
+                            assigned, "RuntimeList materialized-copy undo (scalar-target)");
                 }
             } else if (elem instanceof RuntimeArray runtimeArray) {
                 List<RuntimeScalar> remaining = (rhsIndex < rhsSize)
@@ -852,10 +848,8 @@ public RuntimeArray setFromList(RuntimeList value) {
                         if ((r.type & RuntimeScalarType.REFERENCE_BIT) != 0
                                 && r.value instanceof RuntimeBase base
                                 && r.ownsCountedReferent(base) && base.refCount > 0) {
-                            base.releaseOwner(r, "RuntimeList materialized-copy undo (array-target)");
-                            base.releaseActiveOwner(r);
-                            base.refCount--;
-                            r.setRefCountOwned(false);
+                            releaseMaterializedScalarOwner(
+                                    r, "RuntimeList materialized-copy undo (array-target)");
                         }
                     }
                 } else {
@@ -896,10 +890,8 @@ public RuntimeArray setFromList(RuntimeList value) {
                     if ((r.type & RuntimeScalarType.REFERENCE_BIT) != 0
                             && r.value instanceof RuntimeBase base
                             && r.ownsCountedReferent(base) && base.refCount > 0) {
-                        base.releaseOwner(r, "RuntimeList materialized-copy undo (hash-target)");
-                        base.releaseActiveOwner(r);
-                        base.refCount--;
-                        r.setRefCountOwned(false);
+                        releaseMaterializedScalarOwner(
+                                r, "RuntimeList materialized-copy undo (hash-target)");
                     }
                 }
                 rhsIndex = rhsSize; // Consume the rest
@@ -1002,20 +994,28 @@ private RuntimeArray assignSimpleScalarsFromArray(RuntimeArray rhsArray, boolean
     }
 
     /** Release the ownership held by a materialized RHS cell after scalar assignment copied it. */
-    private static void releaseDiscardedMaterializedScalar(RuntimeScalar scalar) {
+    static void releaseMaterializedScalarOwner(RuntimeScalar scalar, String releaseSite) {
         if (scalar == null) return;
-        scalar.releaseOwnedScalarReferenceContents();
         if ((scalar.type & RuntimeScalarType.REFERENCE_BIT) != 0
                 && scalar.value instanceof RuntimeBase base
                 && scalar.ownsCountedReferent(base)
                 && base.refCount > 0) {
-            base.releaseOwner(scalar, "RuntimeList materialized-copy undo (simple-scalar-target)");
-            base.releaseActiveOwner(scalar);
-            base.refCount--;
-            scalar.setRefCountOwned(false);
+            if (!scalar.releaseScalarValueOwnerCount(base, releaseSite)) {
+                base.releaseOwner(scalar, releaseSite);
+                base.releaseActiveOwner(scalar);
+                base.refCount--;
+                scalar.setRefCountOwned(false);
+            }
         }
     }
 
+    private static void releaseDiscardedMaterializedScalar(RuntimeScalar scalar) {
+        if (scalar == null) return;
+        scalar.releaseOwnedScalarReferenceContents();
+        releaseMaterializedScalarOwner(
+                scalar, "RuntimeList materialized-copy undo (simple-scalar-target)");
+    }
+
     /**
      * Converts the list to a string, concatenating all elements without separators.
      *
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeListArrayOwnerTransferTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeListArrayOwnerTransferTest.java
index b370ed0386..191cbe7870 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeListArrayOwnerTransferTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeListArrayOwnerTransferTest.java
@@ -4,11 +4,33 @@
 import org.junit.jupiter.api.Test;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertSame;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 @Tag("unit")
 class RuntimeListArrayOwnerTransferTest {
+    @Test
+    void materializedCopyReleaseUsesScalarSlotAfterLegacyFlagRetires() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            referent.activateOwnerTracking();
+            RuntimeScalar materialized = new RuntimeScalar();
+            materialized.set(referent.createAnonymousReference());
+            PerlOwnerSlot slot = materialized.scalarValueOwnerSlot();
+            materialized.refCountOwned = false;
+
+            RuntimeList.releaseMaterializedScalarOwner(
+                    materialized, "RuntimeListArrayOwnerTransferTest");
+
+            assertEquals(0, referent.refCount);
+            assertEquals(0, referent.activeOwnerCount());
+            assertEquals(0, referent.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+            assertFalse(slot.isActive());
+        }
+    }
+
     @Test
     void listAssignmentTransfersOwnedCellsAndReleasesDisplacedArrayValues() {
         PerlRuntime runtime = new PerlRuntime();

From e45396f7ad86c2eda5bccd32a9717d42d5bab11e Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 10:39:53 +0200
Subject: [PATCH 266/317] docs: record list materialized owner slot release

Record the RuntimeList scalar-slot migration, regression coverage, and full
build result in the ownership rewrite progress log.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 3e4f212aad..9e2339f4f8 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery, `c21116699` passes in 31m48s for weakening-time scalar-slot release, `6a4d65840` passes in 26m14s for paired weaken/unweaken slot accounting, `09988c53e` passes in 23m54s for aggregate-store scalar-slot acquisition, `2a2b9fe3b` passes in 16m12s for scalar-store slot acquisition, and `e626aaddc` passes in 20m05s for scalar-overwrite slot release. The latest local code batch is `a0ff791ea` and passes full `nice -n 19 make` in 13m28s; its PR push and hosted validation are pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery, `c21116699` passes in 31m48s for weakening-time scalar-slot release, `6a4d65840` passes in 26m14s for paired weaken/unweaken slot accounting, `09988c53e` passes in 23m54s for aggregate-store scalar-slot acquisition, `2a2b9fe3b` passes in 16m12s for scalar-store slot acquisition, and `e626aaddc` passes in 20m05s for scalar-overwrite slot release. The latest local code batch is `e9c32a68e` and passes full `nice -n 19 make` in 16m53s; its PR push and hosted validation are pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -119,6 +119,13 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
 
 ### Current batch
 
+- On 2026-10-24, materialized scalar-copy cleanup in list assignment now uses
+  the `SCALAR_VALUE` release API, keeping the legacy bridge for cells without
+  explicit slots. The shared helper covers discarded values assigned to
+  scalar, array, and hash targets, including the undefined-target and simple
+  scalar-assignment paths. A Java regression verifies slot retirement after
+  the legacy flag is cleared. Full `nice -n 19 make` passes in 16m53s on
+  `e9c32a68e`.
 - On 2026-10-24, removal of newly localized hash and array proxy entries now
   releases the contained scalar's direct referent through its `SCALAR_VALUE`
   slot, retaining the legacy fallback for cells without explicit slots. Two

From 54ca5153f26488e9b788ef952c8a8d912729aae6 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 10:58:05 +0200
Subject: [PATCH 267/317] fix: release stash scalar owners through slots

Route tracked scalar deletion from a stash through the direct scalar owner-slot
API, retaining the legacy bridge for older cells. Strengthen the regression to
check that both the active-owner registry and scalar-slot ledger are empty.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 .../runtime/runtimetypes/RuntimeStash.java       | 16 ++++++++++++----
 .../runtimetypes/RuntimeStashOwnerSlotTest.java  |  2 ++
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeStash.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeStash.java
index 6895eb7b21..b781e646ed 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeStash.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeStash.java
@@ -263,10 +263,18 @@ private RuntimeScalar deleteGlob(String k) {
                 base.refCount = Integer.MIN_VALUE;
                 DestroyDispatch.callDestroy(base);
             } else if (base.refCount > 0 && savedScalar.ownsCountedReferent(base)) {
-                // Tracked object: decrement refCount (the stash was holding a strong ref).
-                savedScalar.setRefCountOwned(false);
-                base.releaseActiveOwner(savedScalar);
-                if (--base.refCount == 0) {
+                // Tracked object: release the stash's direct scalar owner.
+                // Cells without a slot keep the legacy bridge path.
+                boolean releasedScalarSlot = savedScalar.releaseScalarValueOwnerCount(
+                        base, "RuntimeStash.delete");
+                if (!releasedScalarSlot) {
+                    savedScalar.setRefCountOwned(false);
+                    base.traceRefCount(-1, "RuntimeStash.delete");
+                    base.releaseOwner(savedScalar, "RuntimeStash.delete");
+                    base.releaseActiveOwner(savedScalar);
+                    base.refCount--;
+                }
+                if (base.refCount == 0) {
                     base.refCount = Integer.MIN_VALUE;
                     DestroyDispatch.callDestroy(base);
                 }
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeStashOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeStashOwnerSlotTest.java
index 5cf0660ff6..550bcbd4dd 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeStashOwnerSlotTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeStashOwnerSlotTest.java
@@ -27,6 +27,8 @@ void deletingGlobalScalarReleasesExplicitSlotAfterLegacyFlagRetires() {
 
                 assertEquals(Integer.MIN_VALUE, referent.refCount);
                 assertFalse(owner.scalarValueOwnerSlot().isActive());
+                assertEquals(0, referent.activeOwnerCount());
+                assertEquals(0, referent.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
             } finally {
                 GlobalVariable.scalarSlots().remove(name);
             }

From 9839772cfffe8fc6b4efd3132da732a6cce4ca41 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 10:58:41 +0200
Subject: [PATCH 268/317] docs: record stash scalar owner-slot release

Record stash deletion's scalar-slot migration, regression assertions, and full
build result in the ownership rewrite progress log.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 9e2339f4f8..151f0bd1ce 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery, `c21116699` passes in 31m48s for weakening-time scalar-slot release, `6a4d65840` passes in 26m14s for paired weaken/unweaken slot accounting, `09988c53e` passes in 23m54s for aggregate-store scalar-slot acquisition, `2a2b9fe3b` passes in 16m12s for scalar-store slot acquisition, and `e626aaddc` passes in 20m05s for scalar-overwrite slot release. The latest local code batch is `e9c32a68e` and passes full `nice -n 19 make` in 16m53s; its PR push and hosted validation are pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery, `c21116699` passes in 31m48s for weakening-time scalar-slot release, `6a4d65840` passes in 26m14s for paired weaken/unweaken slot accounting, `09988c53e` passes in 23m54s for aggregate-store scalar-slot acquisition, `2a2b9fe3b` passes in 16m12s for scalar-store slot acquisition, and `e626aaddc` passes in 20m05s for scalar-overwrite slot release. The latest local code batch is `54ca5153f` and passes full `nice -n 19 make` in 14m53s; its PR push and hosted validation are pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -119,6 +119,11 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
 
 ### Current batch
 
+- On 2026-10-24, tracked scalar deletion from a stash now releases the scalar
+  owner through its `SCALAR_VALUE` slot, keeping the legacy bridge for cells
+  without explicit slots. The existing retired-flag regression now also checks
+  that the compatibility active-owner registry and slot ledger both clear.
+  Full `nice -n 19 make` passes in 14m53s on `54ca5153f`.
 - On 2026-10-24, materialized scalar-copy cleanup in list assignment now uses
   the `SCALAR_VALUE` release API, keeping the legacy bridge for cells without
   explicit slots. The shared helper covers discarded values assigned to

From 108c0609474c8913bb8d27d95881b950154c0f52 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 11:47:51 +0200
Subject: [PATCH 269/317] fix: balance DESTROY argument owner slots

Route the temporary scalar owner used for DESTROY's self argument through the
SCALAR_VALUE release API, preserving the non-dispatching balance during the
active DESTROY frame. Add coverage for a retired legacy ownership flag.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 .../runtime/runtimetypes/DestroyDispatch.java | 17 +++++++++------
 .../DestroyDispatchScalarSlotRootTest.java    | 21 +++++++++++++++++++
 2 files changed, 32 insertions(+), 6 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
index 91d2f269d0..3bf3218275 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java
@@ -529,12 +529,7 @@ private static void doCallDestroy(RuntimeBase referent, String className) {
                         if (elem != null && elem.value instanceof RuntimeBase base
                                 && elem.ownsCountedReferent(base)
                                 && base.refCount > 0) {
-                            if (base.refCountTrace) {
-                                base.releaseOwner(elem, "doCallDestroy args balance");
-                            }
-                            base.releaseActiveOwner(elem);
-                            base.refCount--;
-                            elem.setRefCountOwned(false);
+                            balanceDestroyArgumentOwner(elem, base);
                         }
                     }
                     args.elements.clear();
@@ -697,6 +692,16 @@ private static void doCallDestroy(RuntimeBase referent, String className) {
         }
     }
 
+    /** Balance the temporary scalar owner installed by {@code args.push(self)}. */
+    static void balanceDestroyArgumentOwner(RuntimeScalar scalar, RuntimeBase referent) {
+        String releaseSite = "doCallDestroy args balance";
+        if (scalar.releaseScalarValueOwnerCount(referent, releaseSite)) return;
+        if (referent.refCountTrace) referent.releaseOwner(scalar, releaseSite);
+        referent.releaseActiveOwner(scalar);
+        referent.refCount--;
+        scalar.setRefCountOwned(false);
+    }
+
     /**
      * Decide resurrection from Perl owner slots when the owner ledger is
      * active. During global destruction the legacy selective count can still
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchScalarSlotRootTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchScalarSlotRootTest.java
index ad1baed523..02b66e3202 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchScalarSlotRootTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/DestroyDispatchScalarSlotRootTest.java
@@ -7,10 +7,31 @@
 import org.junit.jupiter.api.Test;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 @Tag("unit")
 class DestroyDispatchScalarSlotRootTest {
+    @Test
+    void destroyArgumentBalanceReleasesDirectScalarSlotAfterLegacyFlagRetires() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            referent.activateOwnerTracking();
+            RuntimeScalar argument = new RuntimeScalar();
+            argument.set(referent.createReference());
+            PerlOwnerSlot slot = argument.scalarValueOwnerSlot();
+            argument.refCountOwned = false;
+
+            DestroyDispatch.balanceDestroyArgumentOwner(argument, referent);
+
+            assertEquals(0, referent.refCount);
+            assertEquals(0, referent.activeOwnerCount());
+            assertEquals(0, referent.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+            assertFalse(slot.isActive());
+        }
+    }
+
     @Test
     void packageRootedScalarSlotCountsWhenLegacyOwnerEntryIsMissing() {
         PerlRuntime runtime = new PerlRuntime();

From b9382dbaf014ca947a7abb704ea9da8ace206feb Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 11:48:26 +0200
Subject: [PATCH 270/317] docs: record DESTROY argument owner-slot balance

Record the DESTROY argument scalar-slot migration and full-build regression
coverage in the ownership rewrite progress log.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 151f0bd1ce..f38616cb66 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery, `c21116699` passes in 31m48s for weakening-time scalar-slot release, `6a4d65840` passes in 26m14s for paired weaken/unweaken slot accounting, `09988c53e` passes in 23m54s for aggregate-store scalar-slot acquisition, `2a2b9fe3b` passes in 16m12s for scalar-store slot acquisition, and `e626aaddc` passes in 20m05s for scalar-overwrite slot release. The latest local code batch is `54ca5153f` and passes full `nice -n 19 make` in 14m53s; its PR push and hosted validation are pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery, `c21116699` passes in 31m48s for weakening-time scalar-slot release, `6a4d65840` passes in 26m14s for paired weaken/unweaken slot accounting, `09988c53e` passes in 23m54s for aggregate-store scalar-slot acquisition, `2a2b9fe3b` passes in 16m12s for scalar-store slot acquisition, and `e626aaddc` passes in 20m05s for scalar-overwrite slot release. The latest local code batch is `108c06094` and passes full `nice -n 19 make` in 14m00s; its PR push and hosted validation are pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -119,6 +119,11 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
 
 ### Current batch
 
+- On 2026-10-24, the temporary scalar owner installed for `DESTROY`'s self
+  argument now balances through the `SCALAR_VALUE` slot API without invoking
+  destruction recursively inside the active DESTROY frame. A focused Java test
+  checks slot and compatibility-registry retirement when the legacy flag has
+  already cleared. Full `nice -n 19 make` passes in 14m on `108c06094`.
 - On 2026-10-24, tracked scalar deletion from a stash now releases the scalar
   owner through its `SCALAR_VALUE` slot, keeping the legacy bridge for cells
   without explicit slots. The existing retired-flag regression now also checks

From 21753fc9737a46cef42dfc5348b1f84a134682e1 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 12:28:01 +0200
Subject: [PATCH 271/317] refactor: track tie wrapper owners with explicit
 slots

Give tied scalar, array, hash, and handle wrappers distinct owner slots for
handler references. Preserve the legacy count bridge only when each wrapper
actually acquired its count, and carry the containing runtime object for root
recovery. Add focused coverage for balanced release and the previously
untracked-handler count mismatch.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 .../runtime/operators/TieOperators.java       |   5 +-
 .../perlonjava/runtime/perlmodule/Clone.java  |   3 +-
 .../runtime/perlmodule/Storable.java          |   3 +-
 .../runtime/perlmodule/storable/Misc.java     |   2 +-
 .../runtime/runtimetypes/MortalList.java      |   6 +
 .../runtime/runtimetypes/PerlOwnerSlot.java   |  37 +++++-
 .../runtime/runtimetypes/RuntimeBase.java     |   9 ++
 .../runtimetypes/RuntimeGraphCloner.java      |   2 +-
 .../runtime/runtimetypes/TieArray.java        |  19 ++-
 .../runtime/runtimetypes/TieHandle.java       |  29 +++--
 .../runtime/runtimetypes/TieHash.java         |  26 ++++-
 .../runtime/runtimetypes/TieScalar.java       |   2 +-
 .../runtimetypes/TiedVariableBase.java        |  23 +++-
 .../runtimetypes/TieWrapperOwnerSlotTest.java | 110 ++++++++++++++++++
 14 files changed, 244 insertions(+), 32 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/TieWrapperOwnerSlotTest.java

diff --git a/src/main/java/org/perlonjava/runtime/operators/TieOperators.java b/src/main/java/org/perlonjava/runtime/operators/TieOperators.java
index 9f65ac6b92..74f499c050 100644
--- a/src/main/java/org/perlonjava/runtime/operators/TieOperators.java
+++ b/src/main/java/org/perlonjava/runtime/operators/TieOperators.java
@@ -156,7 +156,7 @@ public static RuntimeScalar tie(int ctx, RuntimeBase... scalars) {
                 hash.threadShared = false;
                 hash.threadSharedIdentity = null;
                 hash.type = TIED_HASH;
-                hash.elements = new TieHash(className, previousValue, self);
+                hash.elements = new TieHash(className, previousValue, self, hash);
                 hash.resetIterator();
             }
             case GLOBREFERENCE -> {
@@ -166,7 +166,8 @@ public static RuntimeScalar tie(int ctx, RuntimeBase... scalars) {
                 glob.IO.type = TIED_SCALAR;
                 boolean selfIsTiedGlob = self != null && (self.value == glob
                         || isSameHandle(self, previousValue));
-                TieHandle tieHandle = new TieHandle(className, previousValue, self, !selfIsTiedGlob);
+                TieHandle tieHandle = new TieHandle(
+                        className, previousValue, self, !selfIsTiedGlob, glob);
                 // Propagate the glob name so select() returns the correct name
                 // (e.g., "main::STDOUT") even when the handle is tied.
                 if (previousValue != null) {
diff --git a/src/main/java/org/perlonjava/runtime/perlmodule/Clone.java b/src/main/java/org/perlonjava/runtime/perlmodule/Clone.java
index 8197eb0e4f..29c1a6c623 100644
--- a/src/main/java/org/perlonjava/runtime/perlmodule/Clone.java
+++ b/src/main/java/org/perlonjava/runtime/perlmodule/Clone.java
@@ -86,7 +86,8 @@ private static RuntimeScalar deepClone(RuntimeScalar scalar, IdentityHashMap<Obj
                     RuntimeScalar clonedSelf = deepClone(tieHash.getSelf(), cloned, nextDepth);
                     RuntimeHash previousValue = new RuntimeHash();
                     newHash.type = RuntimeHash.TIED_HASH;
-                    newHash.elements = new TieHash(tieHash.getTiedPackage(), previousValue, clonedSelf);
+                    newHash.elements = new TieHash(
+                            tieHash.getTiedPackage(), previousValue, clonedSelf, newHash);
                     // Copy data through the tied interface
                     RuntimeScalar firstKey = TieHash.tiedFirstKey(origHash);
                     while (firstKey.type != RuntimeScalarType.UNDEF) {
diff --git a/src/main/java/org/perlonjava/runtime/perlmodule/Storable.java b/src/main/java/org/perlonjava/runtime/perlmodule/Storable.java
index 34c69f98af..fa03771409 100644
--- a/src/main/java/org/perlonjava/runtime/perlmodule/Storable.java
+++ b/src/main/java/org/perlonjava/runtime/perlmodule/Storable.java
@@ -473,7 +473,8 @@ private static RuntimeScalar deepClone(RuntimeScalar scalar, CloneContext contex
                     RuntimeHash previousValue = new RuntimeHash();
                     // Create new TieHash with cloned handler
                     newHash.type = RuntimeHash.TIED_HASH;
-                    newHash.elements = new TieHash(tieHash.getTiedPackage(), previousValue, clonedSelf);
+                    newHash.elements = new TieHash(
+                            tieHash.getTiedPackage(), previousValue, clonedSelf, newHash);
                     // Initialize the backing value directly. Replaying through STORE
                     // breaks read-only tie classes during dclone; the cloned handler
                     // already carries the tie object's state.
diff --git a/src/main/java/org/perlonjava/runtime/perlmodule/storable/Misc.java b/src/main/java/org/perlonjava/runtime/perlmodule/storable/Misc.java
index 0dcba2f26f..74b32ef807 100644
--- a/src/main/java/org/perlonjava/runtime/perlmodule/storable/Misc.java
+++ b/src/main/java/org/perlonjava/runtime/perlmodule/storable/Misc.java
@@ -256,7 +256,7 @@ static void installTiedHash(RuntimeHash hv, RuntimeScalar tying) {
         String className = classnameOf(tying);
         RuntimeHash previousValue = RuntimeHash.createHash(hv);
         hv.type = RuntimeHash.TIED_HASH;
-        hv.elements = new TieHash(className, previousValue, tying);
+        hv.elements = new TieHash(className, previousValue, tying, hv);
         hv.resetIterator();
     }
 
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index bb372cf188..744d82c8a3 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -2027,6 +2027,12 @@ static boolean restoreReachableAggregateOwnerCount(RuntimeBase referent) {
                         && ReachabilityWalker.isScalarReachable(cell)) {
                     rootedHashCells.add(cell);
                 }
+            } else if (slot.kind() == PerlOwnerSlot.Kind.TIE_WRAPPER
+                    && slot.referent() == referent) {
+                RuntimeBase owner = slot.ownerContainer();
+                if (owner != null && isRootedOwnerContainer(owner, referent)) {
+                    slotsWithoutCell++;
+                }
             }
         }
         int owners = slotsWithoutCell + rootedHashCells.size();
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
index 46248495dc..7999b4b265 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
@@ -22,7 +22,8 @@ public enum Kind {
         HASH_ENTRY,
         ARRAY_ELEMENT,
         SCALAR_REFERENCE_CONTENTS,
-        SCALAR_VALUE
+        SCALAR_VALUE,
+        TIE_WRAPPER
     }
 
     private final Kind kind;
@@ -419,6 +420,40 @@ synchronized boolean releaseScalarValueCount(RuntimeBase expectedTarget, String
         return true;
     }
 
+    /** Acquire the tie wrapper's independent strong reference to its handler. */
+    synchronized boolean acquireTieWrapperCount(RuntimeBase target, String acquireSite) {
+        if (kind != Kind.TIE_WRAPPER) {
+            throw new IllegalStateException("tie-wrapper acquisition requires a TIE_WRAPPER slot");
+        }
+        Objects.requireNonNull(target, "target");
+        if (referent == target) return true;
+        if (referent != null) {
+            throw new IllegalStateException("cannot retarget an active tie-wrapper owner");
+        }
+        if (target.refCount < 0) return false;
+        if (target.refCount == Integer.MAX_VALUE) {
+            throw new IllegalStateException("tie-wrapper owner count overflow");
+        }
+        target.traceRefCount(+1, acquireSite);
+        target.refCount++;
+        target.hadCountedReference = true;
+        transferTo(target);
+        return true;
+    }
+
+    /** Retire a tie-wrapper owner identity and decrement its legacy bridge count. */
+    synchronized boolean releaseTieWrapperCount(RuntimeBase expectedTarget, String releaseSite) {
+        if (kind != Kind.TIE_WRAPPER) {
+            throw new IllegalStateException("tie-wrapper release requires a TIE_WRAPPER slot");
+        }
+        if (referent != expectedTarget || expectedTarget == null) return false;
+        transferTo(null);
+        if (expectedTarget.refCount <= 0) return true;
+        expectedTarget.traceRefCount(-1, releaseSite);
+        expectedTarget.refCount--;
+        return true;
+    }
+
     /** Detach a scalar-value owner and preserve its identity for deferred release. */
     synchronized PendingRelease deferScalarValueCountRelease(RuntimeBase expectedTarget) {
         if (kind != Kind.SCALAR_VALUE) {
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
index 6cbf435e13..b4f92d30b6 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
@@ -575,6 +575,15 @@ public int reachableOwnerCount() {
             Object ownershipKey = referenceCell == null ? slot : referenceCell;
             if (countedScalarReferenceCells.add(ownershipKey)) count++;
         }
+        for (PerlOwnerSlot slot : ownerSlotSnapshot()) {
+            RuntimeBase owner = slot.ownerContainer();
+            if (slot.kind() == PerlOwnerSlot.Kind.TIE_WRAPPER
+                    && slot.referent() == this
+                    && owner != null
+                    && MortalList.isRootedOwnerContainer(owner, this)) {
+                count++;
+            }
+        }
         return count;
     }
 
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java
index 7b9d3dd6de..48ac19641b 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java
@@ -651,7 +651,7 @@ private RuntimeHash cloneHash(RuntimeHash source) {
         } else if (source.type == RuntimeHash.TIED_HASH && source.elements instanceof TieHash tie) {
             target.elements = new TieHash(tie.getTiedPackage(),
                     (RuntimeHash) cloneValue(tie.getPreviousValue()),
-                    (RuntimeScalar) cloneValue(tie.getSelf()));
+                    (RuntimeScalar) cloneValue(tie.getSelf()), target);
         } else {
             try (PerlRuntime.Binding ignored = targetRuntime.bind()) {
                 for (Map.Entry<String, RuntimeScalar> entry : source.elements.entrySet()) {
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/TieArray.java b/src/main/java/org/perlonjava/runtime/runtimetypes/TieArray.java
index 90b878caf5..004fad78e7 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/TieArray.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/TieArray.java
@@ -51,6 +51,7 @@ public class TieArray extends ArrayList<RuntimeScalar> {
     private final RuntimeArray parent;
 
     private boolean tiedObjectReleased = false;
+    private transient PerlOwnerSlot tiedObjectOwnerSlot;
 
     /**
      * Creates a new TieArray instance.
@@ -68,8 +69,12 @@ public TieArray(String tiedPackage, RuntimeArray previousValue, RuntimeScalar se
         if (self != null && (self.type & RuntimeScalarType.REFERENCE_BIT) != 0
                 && self.value instanceof RuntimeBase base
                 && base.refCount >= 0) {
-            base.refCount++;
-            base.acquireTransientTraceOwner("tie wrapper", "TieArray");
+            PerlOwnerSlot ownerSlot = new PerlOwnerSlot(
+                    PerlOwnerSlot.Kind.TIE_WRAPPER, null, parent, self);
+            if (ownerSlot.acquireTieWrapperCount(base, "TieArray")) {
+                tiedObjectOwnerSlot = ownerSlot;
+                base.acquireTransientTraceOwner("tie wrapper", "TieArray");
+            }
         }
     }
 
@@ -301,11 +306,13 @@ public RuntimeScalar get(int i) {
     public void releaseTiedObject() {
         if (tiedObjectReleased) return;
         tiedObjectReleased = true;
-        if (self == null) return;
-        if ((self.type & RuntimeScalarType.REFERENCE_BIT) != 0
-                && self.value instanceof RuntimeBase base) {
+        PerlOwnerSlot ownerSlot = tiedObjectOwnerSlot;
+        RuntimeBase base = ownerSlot == null ? null : ownerSlot.referent();
+        if (base != null) {
+            boolean hadPositiveCount = base.refCount > 0;
             base.releaseTransientTraceOwner("tie wrapper", "TieArray");
-            if (base.refCount > 0 && --base.refCount == 0) {
+            ownerSlot.releaseTieWrapperCount(base, "TieArray.releaseTiedObject");
+            if (hadPositiveCount && base.refCount == 0) {
                 base.refCount = Integer.MIN_VALUE;
                 DestroyDispatch.callDestroy(base);
             }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/TieHandle.java b/src/main/java/org/perlonjava/runtime/runtimetypes/TieHandle.java
index cf68a57ad4..6288aa6898 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/TieHandle.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/TieHandle.java
@@ -36,6 +36,8 @@ public class TieHandle extends RuntimeIO {
      */
     private final RuntimeScalar self;
     private final boolean holdsSelfReference;
+    private transient PerlOwnerSlot tiedObjectOwnerSlot;
+    private boolean tiedObjectReleased;
 
     /**
      * The package name that this handle is tied to.
@@ -55,10 +57,15 @@ public class TieHandle extends RuntimeIO {
      * @param self          the blessed object returned by TIEHANDLE
      */
     public TieHandle(String tiedPackage, RuntimeIO previousValue, RuntimeScalar self) {
-        this(tiedPackage, previousValue, self, true);
+        this(tiedPackage, previousValue, self, true, null);
     }
 
     public TieHandle(String tiedPackage, RuntimeIO previousValue, RuntimeScalar self, boolean holdSelfReference) {
+        this(tiedPackage, previousValue, self, holdSelfReference, null);
+    }
+
+    public TieHandle(String tiedPackage, RuntimeIO previousValue, RuntimeScalar self,
+                     boolean holdSelfReference, RuntimeBase ownerContainer) {
         this.tiedPackage = tiedPackage;
         this.previousValue = previousValue;
         this.self = self;
@@ -68,8 +75,12 @@ public TieHandle(String tiedPackage, RuntimeIO previousValue, RuntimeScalar self
                 && self != null && (self.type & RuntimeScalarType.REFERENCE_BIT) != 0
                 && self.value instanceof RuntimeBase base
                 && base.refCount >= 0) {
-            base.refCount++;
-            base.acquireTransientTraceOwner("tie wrapper", "TieHandle");
+            PerlOwnerSlot ownerSlot = new PerlOwnerSlot(
+                    PerlOwnerSlot.Kind.TIE_WRAPPER, null, ownerContainer, self);
+            if (ownerSlot.acquireTieWrapperCount(base, "TieHandle")) {
+                tiedObjectOwnerSlot = ownerSlot;
+                base.acquireTransientTraceOwner("tie wrapper", "TieHandle");
+            }
         }
     }
 
@@ -355,13 +366,17 @@ public String toString() {
      * Decrements refCount and triggers DESTROY if it reaches 0.
      */
     public void releaseTiedObject() {
-        if (!holdsSelfReference) {
+        if (!holdsSelfReference || tiedObjectReleased) {
             return;
         }
-        if ((self.type & RuntimeScalarType.REFERENCE_BIT) != 0
-                && self.value instanceof RuntimeBase base) {
+        tiedObjectReleased = true;
+        PerlOwnerSlot ownerSlot = tiedObjectOwnerSlot;
+        RuntimeBase base = ownerSlot == null ? null : ownerSlot.referent();
+        if (base != null) {
+            boolean hadPositiveCount = base.refCount > 0;
             base.releaseTransientTraceOwner("tie wrapper", "TieHandle");
-            if (base.refCount > 0 && --base.refCount == 0) {
+            ownerSlot.releaseTieWrapperCount(base, "TieHandle.releaseTiedObject");
+            if (hadPositiveCount && base.refCount == 0) {
                 base.refCount = Integer.MIN_VALUE;
                 DestroyDispatch.callDestroy(base);
             }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/TieHash.java b/src/main/java/org/perlonjava/runtime/runtimetypes/TieHash.java
index 77cdbfb644..47657bac81 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/TieHash.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/TieHash.java
@@ -41,8 +41,10 @@ public class TieHash extends HashMap<String, RuntimeScalar> {
      * The original value of the hash before it was tied.
      */
     private final RuntimeHash previousValue;
+    private transient RuntimeHash parent;
 
     private boolean tiedObjectReleased = false;
+    private transient PerlOwnerSlot tiedObjectOwnerSlot;
 
     /**
      * Creates a new TieHash instance.
@@ -52,15 +54,25 @@ public class TieHash extends HashMap<String, RuntimeScalar> {
      * @param self          the blessed object returned by TIEHASH
      */
     public TieHash(String tiedPackage, RuntimeHash previousValue, RuntimeScalar self) {
+        this(tiedPackage, previousValue, self, null);
+    }
+
+    public TieHash(
+            String tiedPackage, RuntimeHash previousValue, RuntimeScalar self, RuntimeHash parent) {
         this.tiedPackage = tiedPackage;
         this.previousValue = previousValue;
         this.self = self;
+        this.parent = parent;
         // Increment refCount: the tie wrapper holds a strong reference to the tied object.
         if (self != null && (self.type & RuntimeScalarType.REFERENCE_BIT) != 0
                 && self.value instanceof RuntimeBase base
                 && base.refCount >= 0) {
-            base.refCount++;
-            base.acquireTransientTraceOwner("tie wrapper", "TieHash");
+            PerlOwnerSlot ownerSlot = new PerlOwnerSlot(
+                    PerlOwnerSlot.Kind.TIE_WRAPPER, null, parent, self);
+            if (ownerSlot.acquireTieWrapperCount(base, "TieHash")) {
+                tiedObjectOwnerSlot = ownerSlot;
+                base.acquireTransientTraceOwner("tie wrapper", "TieHash");
+            }
         }
         if (self != null && (self.type & RuntimeScalarType.REFERENCE_BIT) != 0
                 && self.value instanceof RuntimeBase base) {
@@ -227,11 +239,13 @@ public String getTiedPackage() {
     public void releaseTiedObject() {
         if (tiedObjectReleased) return;
         tiedObjectReleased = true;
-        if (self == null) return;
-        if ((self.type & RuntimeScalarType.REFERENCE_BIT) != 0
-                && self.value instanceof RuntimeBase base) {
+        PerlOwnerSlot ownerSlot = tiedObjectOwnerSlot;
+        RuntimeBase base = ownerSlot == null ? null : ownerSlot.referent();
+        if (base != null) {
+            boolean hadPositiveCount = base.refCount > 0;
             base.releaseTransientTraceOwner("tie wrapper", "TieHash");
-            if (base.refCount > 0 && --base.refCount == 0) {
+            ownerSlot.releaseTieWrapperCount(base, "TieHash.releaseTiedObject");
+            if (hadPositiveCount && base.refCount == 0) {
                 base.refCount = Integer.MIN_VALUE;
                 DestroyDispatch.callDestroy(base);
             }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/TieScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/TieScalar.java
index 4df5df2db3..4edb70616f 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/TieScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/TieScalar.java
@@ -49,7 +49,7 @@ public TieScalar(String tiedPackage, RuntimeScalar previousValue, RuntimeScalar
 
     public TieScalar(String tiedPackage, RuntimeScalar previousValue, RuntimeScalar self,
                      RuntimeScalar owner) {
-        super(self, tiedPackage);
+        super(self, tiedPackage, owner);
         this.previousValue = previousValue;
         this.owner = owner;
     }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/TiedVariableBase.java b/src/main/java/org/perlonjava/runtime/runtimetypes/TiedVariableBase.java
index ef0b83f7bc..5f5471cc98 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/TiedVariableBase.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/TiedVariableBase.java
@@ -26,6 +26,7 @@ public abstract class TiedVariableBase extends RuntimeBaseProxy {
     protected final String tiedPackage;
 
     private boolean tiedObjectReleased = false;
+    private transient PerlOwnerSlot tiedObjectOwnerSlot;
 
     /**
      * Creates a new TiedVariableBase instance.
@@ -34,6 +35,11 @@ public abstract class TiedVariableBase extends RuntimeBaseProxy {
      * @param tiedPackage the package name this variable is tied to
      */
     public TiedVariableBase(RuntimeScalar tiedObject, String tiedPackage) {
+        this(tiedObject, tiedPackage, null);
+    }
+
+    protected TiedVariableBase(
+            RuntimeScalar tiedObject, String tiedPackage, RuntimeBase ownerContainer) {
         super();
         this.self = tiedObject;
         this.tiedPackage = tiedPackage;
@@ -46,8 +52,12 @@ public TiedVariableBase(RuntimeScalar tiedObject, String tiedPackage) {
                 && (tiedObject.type & RuntimeScalarType.REFERENCE_BIT) != 0
                 && tiedObject.value instanceof RuntimeBase base
                 && base.refCount >= 0) {
-            base.refCount++;
-            base.acquireTransientTraceOwner("tie wrapper", "TiedVariableBase");
+            PerlOwnerSlot ownerSlot = new PerlOwnerSlot(
+                    PerlOwnerSlot.Kind.TIE_WRAPPER, null, ownerContainer, tiedObject);
+            if (ownerSlot.acquireTieWrapperCount(base, "TiedVariableBase")) {
+                tiedObjectOwnerSlot = ownerSlot;
+                base.acquireTransientTraceOwner("tie wrapper", "TiedVariableBase");
+            }
         }
     }
 
@@ -231,10 +241,13 @@ public void releaseTiedObject() {
         // Array/hash element proxy entries delegate to their parent tied
         // container and intentionally have no handler of their own.
         if (self == null) return;
-        if ((self.type & RuntimeScalarType.REFERENCE_BIT) != 0
-                && self.value instanceof RuntimeBase base) {
+        PerlOwnerSlot ownerSlot = tiedObjectOwnerSlot;
+        RuntimeBase base = ownerSlot == null ? null : ownerSlot.referent();
+        if (base != null) {
+            boolean hadPositiveCount = base.refCount > 0;
             base.releaseTransientTraceOwner("tie wrapper", "TiedVariableBase");
-            if (base.refCount > 0 && --base.refCount == 0) {
+            ownerSlot.releaseTieWrapperCount(base, "TiedVariableBase.releaseTiedObject");
+            if (hadPositiveCount && base.refCount == 0) {
                 base.refCount = Integer.MIN_VALUE;
                 DestroyDispatch.callDestroy(base);
             }
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/TieWrapperOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/TieWrapperOwnerSlotTest.java
new file mode 100644
index 0000000000..37b9f68b6a
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/TieWrapperOwnerSlotTest.java
@@ -0,0 +1,110 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+@Tag("unit")
+class TieWrapperOwnerSlotTest {
+    @Test
+    void tiedScalarWrapperOwnsAndReleasesDistinctHandlerSlot() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeScalar handler = trackedHandler();
+            RuntimeBase referent = (RuntimeBase) handler.value;
+            TieScalar wrapper = new TieScalar(
+                    "TieWrapperOwnerSlotTest", new RuntimeScalar(), handler);
+            assertWrapperRelease(referent, handler, wrapper::releaseTiedObject);
+        }
+    }
+
+    @Test
+    void tiedArrayWrapperOwnsAndReleasesDistinctHandlerSlot() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeScalar handler = trackedHandler();
+            RuntimeBase referent = (RuntimeBase) handler.value;
+            TieArray wrapper = new TieArray(
+                    "TieWrapperOwnerSlotTest", new RuntimeArray(), handler, new RuntimeArray());
+            assertWrapperRelease(referent, handler, wrapper::releaseTiedObject);
+        }
+    }
+
+    @Test
+    void tiedHashWrapperOwnsAndReleasesDistinctHandlerSlot() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeScalar handler = trackedHandler();
+            RuntimeBase referent = (RuntimeBase) handler.value;
+            TieHash wrapper = new TieHash(
+                    "TieWrapperOwnerSlotTest", new RuntimeHash(), handler);
+            assertWrapperRelease(referent, handler, wrapper::releaseTiedObject);
+        }
+    }
+
+    @Test
+    void tiedHandleWrapperOwnsAndReleasesDistinctHandlerSlot() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeScalar handler = trackedHandler();
+            RuntimeBase referent = (RuntimeBase) handler.value;
+            TieHandle wrapper = new TieHandle(
+                    "TieWrapperOwnerSlotTest", new RuntimeIO(), handler);
+            assertWrapperRelease(referent, handler, wrapper::releaseTiedObject);
+        }
+    }
+
+    @Test
+    void wrapperCreatedBeforeHandlerTrackingDoesNotReleaseAnotherOwnersCount() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeScalar handler = new RuntimeScalar();
+            handler.type = RuntimeScalarType.ARRAYREFERENCE;
+            handler.value = referent;
+            TieArray wrapper = new TieArray(
+                    "TieWrapperOwnerSlotTest", new RuntimeArray(), handler, new RuntimeArray());
+            assertEquals(-1, referent.refCount);
+            assertEquals(0, referent.ownerSlotCount(PerlOwnerSlot.Kind.TIE_WRAPPER));
+
+            referent.activateOwnerTracking();
+            RuntimeScalar countedOwner = new RuntimeScalar();
+            countedOwner.set(referent.createAnonymousReference());
+            assertEquals(1, referent.refCount);
+
+            wrapper.releaseTiedObject();
+
+            assertEquals(1, referent.refCount,
+                    "a wrapper that never acquired a count cannot release another scalar's count");
+            assertEquals(0, referent.ownerSlotCount(PerlOwnerSlot.Kind.TIE_WRAPPER));
+            countedOwner.undefine();
+        }
+    }
+
+    private static RuntimeScalar trackedHandler() {
+        RuntimeArray referent = new RuntimeArray();
+        referent.activateOwnerTracking();
+        RuntimeScalar handler = new RuntimeScalar();
+        handler.set(referent.createAnonymousReference());
+        return handler;
+    }
+
+    private static void assertWrapperRelease(
+            RuntimeBase referent, RuntimeScalar handler, Runnable release) {
+        // Constructor increments a second count for the wrapper-held edge.
+        assertEquals(2, referent.refCount);
+        assertEquals(1, referent.ownerSlotCount(PerlOwnerSlot.Kind.TIE_WRAPPER));
+
+        release.run();
+        assertEquals(1, referent.refCount);
+        assertEquals(0, referent.ownerSlotCount(PerlOwnerSlot.Kind.TIE_WRAPPER));
+        assertEquals(1, referent.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+
+        release.run();
+        assertEquals(1, referent.refCount,
+                "repeated wrapper release does not consume the handler cell's count");
+        handler.undefine();
+        assertEquals(0, referent.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+    }
+}

From 831b8c6526fbc8438df2bcc5835b53b200be5c2f Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 12:28:01 +0200
Subject: [PATCH 272/317] docs: record tie wrapper ownership migration

---
 dev/design/perl-ownership-rewrite.md | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index f38616cb66..3fdf9ebf97 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), now reconciled with `origin/master` through `aeda28344`. Code commit `29372cac0` passes full `nice -n 19 make` in 23m10s for explicit-undef release, `2c05509e6` passes in 16m10s for deferred scalar-slot release, `fad2199eb` passes in 18m28s for immediate tail-call release, `ca58da7c4` passes in 28m41s for aggregate-owner proof reuse, `6730377d1` passes in 15m56s for single-pass aggregate-owner recovery, `c21116699` passes in 31m48s for weakening-time scalar-slot release, `6a4d65840` passes in 26m14s for paired weaken/unweaken slot accounting, `09988c53e` passes in 23m54s for aggregate-store scalar-slot acquisition, `2a2b9fe3b` passes in 16m12s for scalar-store slot acquisition, and `e626aaddc` passes in 20m05s for scalar-overwrite slot release. The latest local code batch is `108c06094` and passes full `nice -n 19 make` in 14m00s; its PR push and hosted validation are pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), last reconciled with `origin/master` through `aeda28344`. The latest ownership candidate, tie-wrapper owner-slot migration, passes full `nice -n 19 make` locally; pushing and hosted validation are pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -115,10 +115,17 @@ and first path establish implementation cost.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch includes the current-master merge at `aeda28344`; code commits `29372cac0`, `2c05509e6`, `fad2199eb`, and `ca58da7c4` pass their full Make gates. The latest confirmed pushed head is `7d8502900`; hosted validation of newer commits is pending. Focused Mojolicious controller/WebSocket and Catalyst tempfile regressions pass on both backends with loopback access. On the tail-call candidate, the interpreter tempfile test exceeded a 180-second run but completed 24/24 within a 240-second JFR run; a later 240-second profile after owner-proof caching emitted no TAP, while an unprofiled run completed 24/24 within the 600-second limit. Sampled `isRootedAggregateOwner` frames declined from 517 to 190, with 112 cache-hit frames; the profiled runs had different total sample counts, so wall-clock attribution remains inconclusive. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML-Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch includes the current-master merge at `aeda28344`; the latest confirmed pushed head before the local tie-wrapper batch is `b9382dbaf`. Focused Mojolicious controller/WebSocket and Catalyst tempfile regressions pass on both backends with loopback access. On the tail-call candidate, the interpreter tempfile test exceeded a 180-second run but completed 24/24 within a 240-second JFR run; a later 240-second profile after owner-proof caching emitted no TAP, while an unprofiled run completed 24/24 within the 600-second limit. Sampled `isRootedAggregateOwner` frames declined from 517 to 190, with 112 cache-hit frames; the profiled runs had different total sample counts, so wall-clock attribution remains inconclusive. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML-Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 ### Current batch
 
+- On 2026-10-24, tied scalar, array, hash, and handle wrappers now record
+  handler ownership in distinct `TIE_WRAPPER` slots. Acquiring a wrapper slot
+  only creates a count when the handler was already tracked, so release cannot
+  consume a later scalar owner's count. Root recovery now includes live wrapper
+  slots from rooted owner containers. Five focused Java tests cover slot
+  acquisition/release and the formerly mismatched untracked-handler case. Full
+  `nice -n 19 make` passes in 25m24s.
 - On 2026-10-24, the temporary scalar owner installed for `DESTROY`'s self
   argument now balances through the `SCALAR_VALUE` slot API without invoking
   destruction recursively inside the active DESTROY frame. A focused Java test

From 571d4712f383e506d7cd85f37a31be9af6c36bc0 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 16:07:24 +0200
Subject: [PATCH 273/317] wip: snapshot ownership migration before resumed
 diagnosis

Snapshot the validated tie-wrapper owner-slot batch and diagnostic harness before
continuing the interpreter lifecycle investigation.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 build.gradle                                  |  8 ++++
 dev/design/perl-ownership-rewrite.md          | 48 ++++++++++++++++---
 docs/about/changelog.md                       |  1 +
 .../runtime/runtimetypes/MortalList.java      | 13 ++++-
 .../runtime/runtimetypes/PerlOwnerSlot.java   | 30 +++++++++---
 .../runtime/runtimetypes/RuntimeScalar.java   |  3 +-
 .../runtime/runtimetypes/TieArray.java        | 13 +++--
 .../runtime/runtimetypes/TieHandle.java       | 13 +++--
 .../runtime/runtimetypes/TieHash.java         | 13 +++--
 .../runtimetypes/TiedVariableBase.java        | 15 +++---
 .../runtimetypes/TieWrapperOwnerSlotTest.java | 39 ++++++++++-----
 11 files changed, 149 insertions(+), 47 deletions(-)

diff --git a/build.gradle b/build.gradle
index 9d6675934f..4335f631ca 100644
--- a/build.gradle
+++ b/build.gradle
@@ -384,9 +384,17 @@ test {
 // Provider we already record as an input so configuration-cache invalidation
 // stays correct when the env var changes between invocations.
 def jperlTestFilterProp = providers.environmentVariable('JPERL_TEST_FILTER').orElse('')
+def disableAggregateOwnerRecoveryProp = providers.environmentVariable(
+        'JPERL_TEST_DISABLE_AGGREGATE_OWNER_RECOVERY').map {
+    it.equalsIgnoreCase('true') || it == '1'
+}.orElse(false)
 tasks.withType(Test).configureEach { t ->
     t.inputs.property('jperlTestFilter', jperlTestFilterProp)
     t.environment('JPERL_TEST_FILTER', jperlTestFilterProp.get())
+    t.inputs.property('disableAggregateOwnerRecovery', disableAggregateOwnerRecoveryProp)
+    if (disableAggregateOwnerRecoveryProp.get()) {
+        t.systemProperty('perlonjava.test.disableAggregateOwnerRecovery', 'true')
+    }
 }
 
 // Fast unit tests only (tests in unit/ directory)
diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 3fdf9ebf97..b00b5bfbdd 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -120,12 +120,48 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
 ### Current batch
 
 - On 2026-10-24, tied scalar, array, hash, and handle wrappers now record
-  handler ownership in distinct `TIE_WRAPPER` slots. Acquiring a wrapper slot
-  only creates a count when the handler was already tracked, so release cannot
-  consume a later scalar owner's count. Root recovery now includes live wrapper
-  slots from rooted owner containers. Five focused Java tests cover slot
-  acquisition/release and the formerly mismatched untracked-handler case. Full
-  `nice -n 19 make` passes in 25m24s.
+  handler ownership in distinct `TIE_WRAPPER` slots. A wrapper installed while
+  its handler has the untracked sentinel remains uncounted until rooted owner
+  recovery; the existing Java regression requires this so the wrapper cannot
+  consume a later scalar owner's count. Root recovery includes live wrapper
+  slots from rooted owner containers. The wrapper-slot batch passed full
+  `nice -n 19 make` in 27m21s.
+- The temporary `perlonjava.test.disableAggregateOwnerRecovery` diagnostic is
+  available to forked test workers through
+  `JPERL_TEST_DISABLE_AGGREGATE_OWNER_RECOVERY=1`. It bypasses the scan only at
+  the two production call sites in `MortalList.processDeferredBase` and
+  `RuntimeScalar.setLargeRefCounted`; default runtime behavior remains enabled.
+  With the bypass, the focused #1794 controller/WebSocket and #1795 request
+  tempfile tests pass on both backends, along with selected #1649 ownership and
+  `DESTROY` tests. A JVM global-destruction wrapper timed out its nested child
+  at 300 seconds, while the underlying Catalyst lifetime test passed directly
+  and the wrapper passed on the interpreter; this result is inconclusive.
+  Six Java tests fail in deliberately undercounted synthetic graphs whose
+  assertions directly verify recovery behavior. The root-chain and lifecycle
+  tests directly construct scalar cells, mark them owned, then force the
+  referent count below the live owners; the reachability-cost tests queue more
+  decrements than they acquired owners. These fixtures do not identify a
+  missing Perl store operation. The JVM global-destruction wrapper timed out
+  its nested child at 300 seconds, while the underlying Catalyst lifetime test
+  passed directly and the wrapper passed on the interpreter; this result is
+  inconclusive. The two production scan callers remain in
+  `MortalList.processDeferredBase` and `RuntimeScalar.setLargeRefCounted`.
+  Removing the scan is blocked on real operations that can produce these
+  mismatches and on direct accounting for aggregate slots and
+  scalar-reference contents; the current synthetic tests are not sufficient
+  evidence to replace the scan. After the diagnostic review, default behavior
+  passes full `nice -n 19 make` in 39m43s; offline documentation link checking
+  also passes.
+- The recovery-disabled audit also exposed a real interpreter regression in
+  `issue_1649_recursive_builder_pad_release.t`: system Perl and the JVM pass
+  all nine assertions, while the interpreter retains all five weakly observed
+  nodes after dropping the root (expected two). With default recovery enabled,
+  the interpreter still fails that root-release assertion; dropping the saved
+  body then releases the remaining nodes. Trace confirms the recursive
+  closure's `releaseCaptures()` runs at `undef $sub`, so this is not evidence
+  that the recovery scan can be removed. The remaining investigation is the
+  interpreter's direct ownership accounting for captured aggregate pads and
+  scalar cells across recursive closure execution and lexical cleanup.
 - On 2026-10-24, the temporary scalar owner installed for `DESTROY`'s self
   argument now balances through the `SCALAR_VALUE` slot API without invoking
   destruction recursively inside the active DESTROY frame. A focused Java test
diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index c591286a33..553d86675f 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -13,6 +13,7 @@ priorities and future plans.
 - Apply source filters installed through `Test::More::use_ok` to the caller's remaining source and preserve `print FILEHANDLE (LIST) x N` output (#1375, #1441).
 - Cover `Test::Needs` prerequisite scanning of quoted module names and Perl version literals (#1396).
 - Preserve reference-valued FETCH results from tied-hash `values()` and retain scalar-reference envelopes in Storable round trips (#1554, #1468).
+- Preserve tied-handler lifetimes when wrappers are created before selective reference counting begins.
 - Release temporary files once an exited closure capture retaining a Catalyst request context no longer has a live Perl root.
 - Ignore commented-out code when checking lexical constant closures for later mutations, preserving BEGIN-time generated constants (#1785).
 - Pack the method-dispatch inline-cache guard key into one primitive value while preserving class and method invalidation checks.
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 744d82c8a3..641737cbb1 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1790,7 +1790,8 @@ private static void processDeferredBase(RuntimeBase base, boolean clearWeakRefsF
                 // have a legacy bridge count and retain the old compatibility
                 // sentinel behavior.
                 if (base.nativeCaptureOwnerCount() == 0) base.refCount = 1;
-            } else if (restoreReachableAggregateOwnerCount(base)) {
+            } else if (!aggregateOwnerRecoveryDisabledForDiagnostics()
+                    && restoreReachableAggregateOwnerCount(base)) {
                 // A hash-entry owner has a stable semantic slot identity even
                 // when an unrelated legacy scalar decrement consumes the
                 // selective count. Restore the count from independently owned
@@ -1990,6 +1991,7 @@ && isReachableCached(base)) {
     /** Restore legacy count for aggregate owner slots still reachable from Perl roots. */
     static boolean restoreReachableAggregateOwnerCount(RuntimeBase referent) {
         Set<RuntimeScalar> rootedHashCells = Collections.newSetFromMap(new IdentityHashMap<>());
+        Set<PerlOwnerSlot> rootedTieWrappers = Collections.newSetFromMap(new IdentityHashMap<>());
         // The referent exclusion and Perl graph stay fixed throughout this
         // synchronous scan, so multiple slots in one aggregate share a proof.
         Map<RuntimeBase, Boolean> rootedAggregateOwners = new IdentityHashMap<>();
@@ -2032,6 +2034,7 @@ static boolean restoreReachableAggregateOwnerCount(RuntimeBase referent) {
                 RuntimeBase owner = slot.ownerContainer();
                 if (owner != null && isRootedOwnerContainer(owner, referent)) {
                     slotsWithoutCell++;
+                    rootedTieWrappers.add(slot);
                 }
             }
         }
@@ -2049,10 +2052,18 @@ static boolean restoreReachableAggregateOwnerCount(RuntimeBase referent) {
             owners++;
         }
         if (owners == 0) return false;
+        for (PerlOwnerSlot slot : rootedTieWrappers) {
+            slot.markTieWrapperCountRestored();
+        }
         referent.refCount = owners;
         return true;
     }
 
+    /** Test-only switch for finding ownership edges that still depend on recovery. */
+    static boolean aggregateOwnerRecoveryDisabledForDiagnostics() {
+        return Boolean.getBoolean("perlonjava.test.disableAggregateOwnerRecovery");
+    }
+
     private static boolean isRootedAggregateOwnerCached(
             RuntimeBase owner, RuntimeBase excludedReferent,
             Map<RuntimeBase, Boolean> rootedAggregateOwners) {
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
index 7999b4b265..1f8aa179b7 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
@@ -34,6 +34,7 @@ public enum Kind {
     private volatile RuntimeCode closureOwner;
     private final long identity = NEXT_ID.incrementAndGet();
     private RuntimeBase referent;
+    private boolean tieWrapperCounted;
     private PerlRuntime ownerRuntime;
     private LifecycleRuntimeState ownerRuntimeState;
     private int legacyCaptureCount;
@@ -144,6 +145,10 @@ public synchronized int legacyCaptureCount() {
         return legacyCaptureCount;
     }
 
+    synchronized boolean tieWrapperCounted() {
+        return tieWrapperCounted;
+    }
+
     RuntimeCode closureOwner() {
         return closureOwner;
     }
@@ -430,24 +435,37 @@ synchronized boolean acquireTieWrapperCount(RuntimeBase target, String acquireSi
         if (referent != null) {
             throw new IllegalStateException("cannot retarget an active tie-wrapper owner");
         }
-        if (target.refCount < 0) return false;
-        if (target.refCount == Integer.MAX_VALUE) {
-            throw new IllegalStateException("tie-wrapper owner count overflow");
+        if (target.refCount < -1) return false;
+        if (target.refCount >= 0) {
+            if (target.refCount == Integer.MAX_VALUE) {
+                throw new IllegalStateException("tie-wrapper owner count overflow");
+            }
+            target.traceRefCount(+1, acquireSite);
+            target.refCount++;
+            target.hadCountedReference = true;
+            tieWrapperCounted = true;
         }
-        target.traceRefCount(+1, acquireSite);
-        target.refCount++;
-        target.hadCountedReference = true;
         transferTo(target);
         return true;
     }
 
+    synchronized void markTieWrapperCountRestored() {
+        if (kind != Kind.TIE_WRAPPER || referent == null) {
+            throw new IllegalStateException("only an active tie-wrapper slot can be restored");
+        }
+        tieWrapperCounted = true;
+    }
+
     /** Retire a tie-wrapper owner identity and decrement its legacy bridge count. */
     synchronized boolean releaseTieWrapperCount(RuntimeBase expectedTarget, String releaseSite) {
         if (kind != Kind.TIE_WRAPPER) {
             throw new IllegalStateException("tie-wrapper release requires a TIE_WRAPPER slot");
         }
         if (referent != expectedTarget || expectedTarget == null) return false;
+        boolean counted = tieWrapperCounted;
+        tieWrapperCounted = false;
         transferTo(null);
+        if (!counted) return true;
         if (expectedTarget.refCount <= 0) return true;
         expectedTarget.traceRefCount(-1, releaseSite);
         expectedTarget.refCount--;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index ff9f66e481..622e7bc797 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -3308,7 +3308,8 @@ && hasLiveIo(assignedGlob)) {
                     // slot holds a strong reference not counted in refCount.
                     // Don't call callDestroy — the container is still alive.
                     // Cleanup will happen at scope exit (scopeExitCleanupHash/Array).
-                } else if (MortalList.restoreReachableAggregateOwnerCount(oldBase)) {
+                } else if (!MortalList.aggregateOwnerRecoveryDisabledForDiagnostics()
+                        && MortalList.restoreReachableAggregateOwnerCount(oldBase)) {
                     // Explicit aggregate slots can prove a rooted owner chain
                     // even when a nested expression temporary is absent from
                     // the conservative lexical walker roots.
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/TieArray.java b/src/main/java/org/perlonjava/runtime/runtimetypes/TieArray.java
index 004fad78e7..1b9abca6fa 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/TieArray.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/TieArray.java
@@ -65,15 +65,16 @@ public TieArray(String tiedPackage, RuntimeArray previousValue, RuntimeScalar se
         this.previousValue = previousValue;
         this.self = self;
         this.parent = parent;
-        // Increment refCount: the tie wrapper holds a strong reference to the tied object.
+        // Record the wrapper's strong edge, including before selective counting starts.
         if (self != null && (self.type & RuntimeScalarType.REFERENCE_BIT) != 0
-                && self.value instanceof RuntimeBase base
-                && base.refCount >= 0) {
+                && self.value instanceof RuntimeBase base) {
             PerlOwnerSlot ownerSlot = new PerlOwnerSlot(
                     PerlOwnerSlot.Kind.TIE_WRAPPER, null, parent, self);
             if (ownerSlot.acquireTieWrapperCount(base, "TieArray")) {
                 tiedObjectOwnerSlot = ownerSlot;
-                base.acquireTransientTraceOwner("tie wrapper", "TieArray");
+                if (ownerSlot.tieWrapperCounted()) {
+                    base.acquireTransientTraceOwner("tie wrapper", "TieArray");
+                }
             }
         }
     }
@@ -310,7 +311,9 @@ public void releaseTiedObject() {
         RuntimeBase base = ownerSlot == null ? null : ownerSlot.referent();
         if (base != null) {
             boolean hadPositiveCount = base.refCount > 0;
-            base.releaseTransientTraceOwner("tie wrapper", "TieArray");
+            if (ownerSlot.tieWrapperCounted()) {
+                base.releaseTransientTraceOwner("tie wrapper", "TieArray");
+            }
             ownerSlot.releaseTieWrapperCount(base, "TieArray.releaseTiedObject");
             if (hadPositiveCount && base.refCount == 0) {
                 base.refCount = Integer.MIN_VALUE;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/TieHandle.java b/src/main/java/org/perlonjava/runtime/runtimetypes/TieHandle.java
index 6288aa6898..dd200ef435 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/TieHandle.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/TieHandle.java
@@ -70,16 +70,17 @@ public TieHandle(String tiedPackage, RuntimeIO previousValue, RuntimeScalar self
         this.previousValue = previousValue;
         this.self = self;
         this.holdsSelfReference = holdSelfReference;
-        // Increment refCount: the tie wrapper holds a strong reference to the tied object.
+        // Record the wrapper's strong edge, including before selective counting starts.
         if (holdSelfReference
                 && self != null && (self.type & RuntimeScalarType.REFERENCE_BIT) != 0
-                && self.value instanceof RuntimeBase base
-                && base.refCount >= 0) {
+                && self.value instanceof RuntimeBase base) {
             PerlOwnerSlot ownerSlot = new PerlOwnerSlot(
                     PerlOwnerSlot.Kind.TIE_WRAPPER, null, ownerContainer, self);
             if (ownerSlot.acquireTieWrapperCount(base, "TieHandle")) {
                 tiedObjectOwnerSlot = ownerSlot;
-                base.acquireTransientTraceOwner("tie wrapper", "TieHandle");
+                if (ownerSlot.tieWrapperCounted()) {
+                    base.acquireTransientTraceOwner("tie wrapper", "TieHandle");
+                }
             }
         }
     }
@@ -374,7 +375,9 @@ public void releaseTiedObject() {
         RuntimeBase base = ownerSlot == null ? null : ownerSlot.referent();
         if (base != null) {
             boolean hadPositiveCount = base.refCount > 0;
-            base.releaseTransientTraceOwner("tie wrapper", "TieHandle");
+            if (ownerSlot.tieWrapperCounted()) {
+                base.releaseTransientTraceOwner("tie wrapper", "TieHandle");
+            }
             ownerSlot.releaseTieWrapperCount(base, "TieHandle.releaseTiedObject");
             if (hadPositiveCount && base.refCount == 0) {
                 base.refCount = Integer.MIN_VALUE;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/TieHash.java b/src/main/java/org/perlonjava/runtime/runtimetypes/TieHash.java
index 47657bac81..76c69a9f7c 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/TieHash.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/TieHash.java
@@ -63,15 +63,16 @@ public TieHash(
         this.previousValue = previousValue;
         this.self = self;
         this.parent = parent;
-        // Increment refCount: the tie wrapper holds a strong reference to the tied object.
+        // Record the wrapper's strong edge, including before selective counting starts.
         if (self != null && (self.type & RuntimeScalarType.REFERENCE_BIT) != 0
-                && self.value instanceof RuntimeBase base
-                && base.refCount >= 0) {
+                && self.value instanceof RuntimeBase base) {
             PerlOwnerSlot ownerSlot = new PerlOwnerSlot(
                     PerlOwnerSlot.Kind.TIE_WRAPPER, null, parent, self);
             if (ownerSlot.acquireTieWrapperCount(base, "TieHash")) {
                 tiedObjectOwnerSlot = ownerSlot;
-                base.acquireTransientTraceOwner("tie wrapper", "TieHash");
+                if (ownerSlot.tieWrapperCounted()) {
+                    base.acquireTransientTraceOwner("tie wrapper", "TieHash");
+                }
             }
         }
         if (self != null && (self.type & RuntimeScalarType.REFERENCE_BIT) != 0
@@ -243,7 +244,9 @@ public void releaseTiedObject() {
         RuntimeBase base = ownerSlot == null ? null : ownerSlot.referent();
         if (base != null) {
             boolean hadPositiveCount = base.refCount > 0;
-            base.releaseTransientTraceOwner("tie wrapper", "TieHash");
+            if (ownerSlot.tieWrapperCounted()) {
+                base.releaseTransientTraceOwner("tie wrapper", "TieHash");
+            }
             ownerSlot.releaseTieWrapperCount(base, "TieHash.releaseTiedObject");
             if (hadPositiveCount && base.refCount == 0) {
                 base.refCount = Integer.MIN_VALUE;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/TiedVariableBase.java b/src/main/java/org/perlonjava/runtime/runtimetypes/TiedVariableBase.java
index 5f5471cc98..7cdda08bd1 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/TiedVariableBase.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/TiedVariableBase.java
@@ -44,19 +44,20 @@ protected TiedVariableBase(
         this.self = tiedObject;
         this.tiedPackage = tiedPackage;
         // The tie wrapper holds a strong reference to the tied object.
-        // Increment refCount so that untie's decrement can trigger DESTROY
-        // when no other references remain (matching Perl 5 behavior).
+        // Record the wrapper's strong edge even before selective counting is
+        // active; later owner recovery can then include it exactly once.
         // Note: tiedObject is null for proxy entries (RuntimeTiedHashProxyEntry,
         // RuntimeTiedArrayProxyEntry) which delegate to the parent container.
         if (tiedObject != null
                 && (tiedObject.type & RuntimeScalarType.REFERENCE_BIT) != 0
-                && tiedObject.value instanceof RuntimeBase base
-                && base.refCount >= 0) {
+                && tiedObject.value instanceof RuntimeBase base) {
             PerlOwnerSlot ownerSlot = new PerlOwnerSlot(
                     PerlOwnerSlot.Kind.TIE_WRAPPER, null, ownerContainer, tiedObject);
             if (ownerSlot.acquireTieWrapperCount(base, "TiedVariableBase")) {
                 tiedObjectOwnerSlot = ownerSlot;
-                base.acquireTransientTraceOwner("tie wrapper", "TiedVariableBase");
+                if (ownerSlot.tieWrapperCounted()) {
+                    base.acquireTransientTraceOwner("tie wrapper", "TiedVariableBase");
+                }
             }
         }
     }
@@ -245,7 +246,9 @@ public void releaseTiedObject() {
         RuntimeBase base = ownerSlot == null ? null : ownerSlot.referent();
         if (base != null) {
             boolean hadPositiveCount = base.refCount > 0;
-            base.releaseTransientTraceOwner("tie wrapper", "TiedVariableBase");
+            if (ownerSlot.tieWrapperCounted()) {
+                base.releaseTransientTraceOwner("tie wrapper", "TiedVariableBase");
+            }
             ownerSlot.releaseTieWrapperCount(base, "TiedVariableBase.releaseTiedObject");
             if (hadPositiveCount && base.refCount == 0) {
                 base.refCount = Integer.MIN_VALUE;
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/TieWrapperOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/TieWrapperOwnerSlotTest.java
index 37b9f68b6a..cc18c9e77d 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/TieWrapperOwnerSlotTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/TieWrapperOwnerSlotTest.java
@@ -4,6 +4,7 @@
 import org.junit.jupiter.api.Test;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 
 @Tag("unit")
 class TieWrapperOwnerSlotTest {
@@ -60,25 +61,39 @@ void wrapperCreatedBeforeHandlerTrackingDoesNotReleaseAnotherOwnersCount() {
         PerlRuntime runtime = new PerlRuntime();
         try (PerlRuntime.Binding ignored = runtime.bind()) {
             RuntimeArray referent = new RuntimeArray();
+            RuntimeArray parent = new RuntimeArray();
+            parent.elementsOwned = true;
             RuntimeScalar handler = new RuntimeScalar();
             handler.type = RuntimeScalarType.ARRAYREFERENCE;
             handler.value = referent;
             TieArray wrapper = new TieArray(
-                    "TieWrapperOwnerSlotTest", new RuntimeArray(), handler, new RuntimeArray());
-            assertEquals(-1, referent.refCount);
-            assertEquals(0, referent.ownerSlotCount(PerlOwnerSlot.Kind.TIE_WRAPPER));
-
-            referent.activateOwnerTracking();
+                    "TieWrapperOwnerSlotTest", new RuntimeArray(), handler, parent);
+            parent.elements = wrapper;
+            MyVarCleanupStack.register(parent);
             RuntimeScalar countedOwner = new RuntimeScalar();
-            countedOwner.set(referent.createAnonymousReference());
-            assertEquals(1, referent.refCount);
+            try {
+                assertEquals(-1, referent.refCount);
+                assertEquals(1, referent.ownerSlotCount(PerlOwnerSlot.Kind.TIE_WRAPPER));
+
+                referent.activateOwnerTracking();
+                countedOwner.set(referent.createAnonymousReference());
+                MyVarCleanupStack.register(countedOwner);
+                assertEquals(1, referent.refCount);
+                assertTrue(MortalList.restoreReachableAggregateOwnerCount(referent),
+                        "root recovery includes the wrapper edge created before tracking");
+                assertEquals(2, referent.refCount);
 
-            wrapper.releaseTiedObject();
+                wrapper.releaseTiedObject();
 
-            assertEquals(1, referent.refCount,
-                    "a wrapper that never acquired a count cannot release another scalar's count");
-            assertEquals(0, referent.ownerSlotCount(PerlOwnerSlot.Kind.TIE_WRAPPER));
-            countedOwner.undefine();
+                assertEquals(1, referent.refCount,
+                        "releasing the recovered wrapper owner preserves the scalar owner's count");
+                assertEquals(0, referent.ownerSlotCount(PerlOwnerSlot.Kind.TIE_WRAPPER));
+            } finally {
+                wrapper.releaseTiedObject();
+                MyVarCleanupStack.unregister(countedOwner);
+                countedOwner.undefine();
+                MyVarCleanupStack.unregister(parent);
+            }
         }
     }
 

From ce221f69038518b763f984f76a6533f2d25ce515 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 16:32:13 +0200
Subject: [PATCH 274/317] test: isolate interpreter capture lifetime regression

Add an oracle-backed reducer for the stale weak reference left when an
interpreter closure stores a blessed object into a captured scalar during an
array-reference call.

Generated with [OpenAI Codex](https://openai.com/codex/)

Co-Authored-By: OpenAI Codex <223556219+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md          | 12 ++++++
 ...ssue_1649_captured_scalar_array_argument.t | 43 +++++++++++++++++++
 2 files changed, 55 insertions(+)
 create mode 100644 src/test/resources/unit/refcount/issue_1649_captured_scalar_array_argument.t

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index b00b5bfbdd..186b9ee68f 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -162,6 +162,18 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   that the recovery scan can be removed. The remaining investigation is the
   interpreter's direct ownership accounting for captured aggregate pads and
   scalar cells across recursive closure execution and lexical cleanup.
+- A second focused reducer,
+  `issue_1649_captured_scalar_array_argument.t`, isolates the same class of
+  lifetime error: a closure writes a blessed object to a captured scalar while
+  receiving an array-reference argument, then the closure and returned owner
+  are released. System Perl and the JVM pass both assertions; the interpreter
+  fails the weak-observer release assertion with aggregate recovery both on and
+  off, while `DESTROY` fires once. In a temporary `Internals::SvREFCNT` probe,
+  Perl reports 2 owners after the closure call and 1 after closure release;
+  the interpreter reports 0 at both points. This confirms a premature
+  interpreter count transition in this call shape, separate from the recovery
+  scan. The next trace target is the returned captured scalar's owner transfer
+  across `BytecodeInterpreter` return cleanup and argument-frame teardown.
 - On 2026-10-24, the temporary scalar owner installed for `DESTROY`'s self
   argument now balances through the `SCALAR_VALUE` slot API without invoking
   destruction recursively inside the active DESTROY frame. A focused Java test
diff --git a/src/test/resources/unit/refcount/issue_1649_captured_scalar_array_argument.t b/src/test/resources/unit/refcount/issue_1649_captured_scalar_array_argument.t
new file mode 100644
index 0000000000..2ca920b6c3
--- /dev/null
+++ b/src/test/resources/unit/refcount/issue_1649_captured_scalar_array_argument.t
@@ -0,0 +1,43 @@
+use strict;
+use warnings;
+use Scalar::Util qw(weaken);
+use Test::More;
+
+our @WEAK_NODES;
+our $DESTROYED = 0;
+
+{
+    package Issue1649ArrayArgumentNode;
+
+    sub new {
+        my ($class) = @_;
+        my $node = bless {}, $class;
+        push @main::WEAK_NODES, $node;
+        Scalar::Util::weaken($main::WEAK_NODES[-1]);
+        return $node;
+    }
+
+    sub DESTROY { ++$main::DESTROYED }
+}
+
+sub build_node {
+    my $input = ['array argument'];
+    my ($builder, $node);
+    $builder = sub {
+        my $argument = $_[0];
+        $node = Issue1649ArrayArgumentNode->new;
+        return $node;
+    };
+    $node = $builder->($input);
+    undef $builder;
+    return $node;
+}
+
+my $node = build_node();
+$node = undef;
+
+is(scalar(grep { defined $_ } @WEAK_NODES), 0,
+    'array argument and released closure do not retain the returned object');
+is($DESTROYED, 1, 'returned object is destroyed once');
+
+done_testing;

From e8d18042962e7a1ec9c3fb274f1f0832a18cedb3 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 21:53:05 +0200
Subject: [PATCH 275/317] wip: snapshot ownership progress notes before
 resuming diagnosis

Preserve the in-progress design document update before resuming the ownership
recovery audit.

Generated with OpenAI Codex (https://openai.com/codex)

Co-Authored-By: OpenAI Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 33 ++++++++++++++++++++++------
 1 file changed, 26 insertions(+), 7 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 186b9ee68f..2ad8fb1400 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -167,13 +167,32 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   lifetime error: a closure writes a blessed object to a captured scalar while
   receiving an array-reference argument, then the closure and returned owner
   are released. System Perl and the JVM pass both assertions; the interpreter
-  fails the weak-observer release assertion with aggregate recovery both on and
-  off, while `DESTROY` fires once. In a temporary `Internals::SvREFCNT` probe,
-  Perl reports 2 owners after the closure call and 1 after closure release;
-  the interpreter reports 0 at both points. This confirms a premature
-  interpreter count transition in this call shape, separate from the recovery
-  scan. The next trace target is the returned captured scalar's owner transfer
-  across `BytecodeInterpreter` return cleanup and argument-frame teardown.
+  failed the weak-observer release assertion with aggregate recovery both on
+  and off, while `DESTROY` fired once. A temporary `Internals::SvREFCNT` probe
+  showed Perl reporting 2 owners after the closure call and 1 after closure
+  release; the interpreter reported 0 at both points. The trace narrowed the
+  transition to return cleanup emitted for a captured lexical register. A
+  permanent test now reproduces this on the unfixed interpreter parent and
+  passes on system Perl and the JVM. A runtime frame-mark guard around return
+  cleanup also makes the focused interpreter test and the 24-assertion
+  Catalyst tempfile interpreter test pass, and its consolidated
+  `nice -n 19 make` passed in 35m17s, including the Mojolicious lifetime tests.
+  The first guard marked compiler register-index metadata as captured, but that
+  metadata also contains non-capture entries. It failed the interpreter's
+  recursive-builder release check (five weakly observed nodes remained instead
+  of two). Limiting metadata to the actual capture count compiled and passed
+  the full `make`, but still missed both interpreter reproductions because
+  captured registers are filled later by `withCapturedVars`. The active
+  candidate marked those registers when the closure copy received its capture
+  array. The new scalar regression and the 24-assertion Catalyst interpreter
+  test passed, but the recursive-builder check still retained five nodes
+  instead of two. Narrowing the guard to captured scalar cells kept those two
+  results but the full `make` failed `catalyst_request_body_tempfile_global_destroy.t`:
+  its nested test process exceeded the 300-second harness timeout. The scalar
+  cleanup guard has been removed. No cleanup candidate yet passes all three
+  interpreter checks; the next step is tracing which captured cell and owner
+  slot each return path releases in both reducers. The earlier static filter
+  also caused unrelated cleanup failures; aggregate recovery remains enabled.
 - On 2026-10-24, the temporary scalar owner installed for `DESTROY`'s self
   argument now balances through the `SCALAR_VALUE` slot API without invoking
   destruction recursively inside the active DESTROY frame. A focused Java test

From 9adc112aa5fcdd66ca2b228d759e32bfbe1ba7d4 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 22:06:16 +0200
Subject: [PATCH 276/317] fix(interpreter): preserve captured lexical owners on
 return

Carry the interpreter cleanup-stack mark through execution frames and mark the
actual captured register range when a closure receives its capture cells. Skip
return cleanup for captured cells that remain registered in an outer frame.
This prevents a closure return from marking its enclosing lexical as exited.

The full make gate and focused scalar/Catalyst interpreter checks passed for
this candidate. The recursive-builder interpreter failure remains separate;
aggregate owner recovery stays enabled because both production callers remain.

Generated with OpenAI Codex (https://openai.com/codex)

Co-Authored-By: OpenAI Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          | 48 +++++++++++++------
 .../backend/bytecode/BytecodeCompiler.java    |  7 +++
 .../backend/bytecode/BytecodeInterpreter.java | 28 +++++++++--
 .../backend/bytecode/InterpretedCode.java     | 19 +++++++-
 .../bytecode/SuspendedInterpreterFrame.java   |  5 +-
 .../runtimetypes/MyVarCleanupStack.java       | 15 ++++++
 6 files changed, 99 insertions(+), 23 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 2ad8fb1400..989e12e760 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -141,10 +141,27 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   tests directly construct scalar cells, mark them owned, then force the
   referent count below the live owners; the reachability-cost tests queue more
   decrements than they acquired owners. These fixtures do not identify a
-  missing Perl store operation. The JVM global-destruction wrapper timed out
-  its nested child at 300 seconds, while the underlying Catalyst lifetime test
-  passed directly and the wrapper passed on the interpreter; this result is
-  inconclusive. The two production scan callers remain in
+  missing Perl store operation. Concretely, the six are
+  `MortalListAggregateOwnerSlotRootChainTest` (two cases),
+  `MortalListAggregateOwnerSlotTest.rootedHashEntrySlotRestoresAnUnderflowedLegacyCountUntilEntryRemoval`,
+  `ReachabilityQueryCostTest.deferredOwnerChecksShareOneRootSnapshotPerDrain`,
+  and two `UnblessedAggregateReachabilitySnapshotTest` cases. The first three
+  assign an artificially low `refCount` after constructing active owner slots;
+  the last three add three counted owners and then queue three generic
+  referent decrements without releasing those owners. The JVM
+  global-destruction wrapper timed out its nested child at 300 seconds, while
+  the underlying Catalyst lifetime test passed directly and the wrapper passed
+  on the interpreter; that wrapper result is inconclusive.
+
+  The recovery scan has two production callers. In
+  `MortalList.processDeferredBase`, a queued slot release is completed, any
+  transient trace owner is retired, and the legacy `refCount` is decremented;
+  if it reaches zero, recovery rebuilds the count from rooted aggregate slots,
+  scalar-value slots, tie wrappers, and reachable counted scalar owners before
+  lifecycle dispatch. In `RuntimeScalar.setLargeRefCounted`, overwriting a
+  scalar releases the displaced scalar-value owner and decrements the old
+  referent; at zero, the same recovery protects any still-rooted aggregate
+  owners. The two production scan callers remain in
   `MortalList.processDeferredBase` and `RuntimeScalar.setLargeRefCounted`.
   Removing the scan is blocked on real operations that can produce these
   mismatches and on direct accounting for aggregate slots and
@@ -182,17 +199,18 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   recursive-builder release check (five weakly observed nodes remained instead
   of two). Limiting metadata to the actual capture count compiled and passed
   the full `make`, but still missed both interpreter reproductions because
-  captured registers are filled later by `withCapturedVars`. The active
-  candidate marked those registers when the closure copy received its capture
-  array. The new scalar regression and the 24-assertion Catalyst interpreter
-  test passed, but the recursive-builder check still retained five nodes
-  instead of two. Narrowing the guard to captured scalar cells kept those two
-  results but the full `make` failed `catalyst_request_body_tempfile_global_destroy.t`:
-  its nested test process exceeded the 300-second harness timeout. The scalar
-  cleanup guard has been removed. No cleanup candidate yet passes all three
-  interpreter checks; the next step is tracing which captured cell and owner
-  slot each return path releases in both reducers. The earlier static filter
-  also caused unrelated cleanup failures; aggregate recovery remains enabled.
+  captured registers are filled later by `withCapturedVars`. Marking those
+  registers when the closure copy receives its capture array fixes the scalar
+  regression. This all-type frame-aware patch passed full `make` in 14m27s, the
+  scalar interpreter test, and Catalyst 24/24. The recursive-builder
+  interpreter test still fails (five nodes remain rather than two) with
+  recovery enabled and disabled, so it is a separate existing failure. A
+  scalar-only variant retained the scalar and Catalyst passes but made
+  `catalyst_request_body_tempfile_global_destroy.t` exceed its 300-second child
+  timeout; that variant was discarded. The all-type patch is restored in the
+  current worktree; a new gate on this exact branch head remains pending. The
+  earlier static filter also caused unrelated cleanup failures. Aggregate
+  recovery remains enabled.
 - On 2026-10-24, the temporary scalar owner installed for `DESTROY`'s self
   argument now balances through the `SCALAR_VALUE` slot API without invoking
   destruction recursively inside the active DESTROY frame. A focused Java test
diff --git a/src/main/java/org/perlonjava/backend/bytecode/BytecodeCompiler.java b/src/main/java/org/perlonjava/backend/bytecode/BytecodeCompiler.java
index e64b5a131b..73ad46d200 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/BytecodeCompiler.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/BytecodeCompiler.java
@@ -1635,6 +1635,13 @@ public InterpretedCode compile(Node node, EmitterContext ctx) {
                 evalSitePragmaFlags.isEmpty() ? null : evalSitePragmaFlags,
                 warningBitsString
         );
+        if (capturedVars != null && capturedVars.length > 0) {
+            BitSet capturedRegisters = new BitSet();
+            for (int index = 0; index < capturedVars.length; index++) {
+                capturedRegisters.set(3 + index);
+            }
+            code.setCapturedVarRegisters(capturedRegisters);
+        }
         if (metadataScope != null) {
             code.setLexicalDisabledWarningCategories(
                     metadataScope.getDisabledWarningCategories());
diff --git a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
index 9730b41c34..8463727a03 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/BytecodeInterpreter.java
@@ -132,6 +132,12 @@ private static boolean runtimeBaseIsTrackedReference(RuntimeBase elem) {
         return elem.blessId != 0 || elem.refCount >= 0;
     }
 
+    private static boolean capturedLexicalOwnerStillRegistered(
+            InterpretedCode code, int register, RuntimeBase slot, int frameCleanupMark) {
+        return slot != null && code.isCapturedVarRegister(register)
+                && MyVarCleanupStack.isRegisteredBefore(frameCleanupMark, slot);
+    }
+
     private static void releaseConsumedTemp(RuntimeBase temp, RuntimeBase target) {
         if (!(temp instanceof RuntimeScalar tempScalar)
                 || !(target instanceof RuntimeScalar targetScalar)
@@ -195,7 +201,7 @@ private static void collectReturnedClosures(RuntimeBase value, java.util.Identit
      * @return RuntimeList containing the result (may be RuntimeControlFlowList)
      */
     public static RuntimeList execute(InterpretedCode code, RuntimeArray args, int callContext) {
-        return execute(code, args, callContext, null);
+        return execute(code, args, callContext, null, MyVarCleanupStack.currentSize());
     }
 
     /**
@@ -208,9 +214,14 @@ public static RuntimeList execute(InterpretedCode code, RuntimeArray args, int c
      * @return RuntimeList containing the result (may be RuntimeControlFlowList)
      */
     public static RuntimeList execute(InterpretedCode code, RuntimeArray args, int callContext, String subroutineName) {
+        return execute(code, args, callContext, subroutineName, MyVarCleanupStack.currentSize());
+    }
+
+    public static RuntimeList execute(InterpretedCode code, RuntimeArray args, int callContext,
+                                      String subroutineName, int frameCleanupMark) {
         RuntimeBase[] registers = code.getRegisters();
         SuspendedInterpreterFrame frame = new SuspendedInterpreterFrame(
-                code, registers, callContext, subroutineName);
+                code, registers, callContext, subroutineName, frameCleanupMark);
 
         // Initialize special registers (same as compiler).
         registers[0] = code;
@@ -402,6 +413,7 @@ private static int dispatchListOperatorControlFlow(
     private static RuntimeList execute(SuspendedInterpreterFrame frame) {
         InterpretedCode code = frame.code;
         int callContext = frame.callContext;
+        int frameCleanupMark = frame.frameCleanupMark;
         // Track interpreter state for stack traces
         String framePackageName = code.packageName != null ? code.packageName : "main";
         if (code.isQuotedRegexCallback) {
@@ -650,7 +662,9 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
                                 int reg = bytecode[pc++];
                                 int returnReg = bytecode[pc++];
                                 RuntimeBase slot = registers[reg];
-                                if (slot instanceof RuntimeScalar rs) {
+                                if (slot instanceof RuntimeScalar rs
+                                        && !capturedLexicalOwnerStillRegistered(
+                                                code, reg, slot, frameCleanupMark)) {
                                     RuntimeScalar.releaseOrTransferSocketIoOwnerOnReturn(
                                             rs, registers[returnReg]);
                                     MortalList.deferDecrementIfNotCaptured(rs);
@@ -743,7 +757,9 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
                             case Opcodes.RETURN_SCOPE_CLEANUP_HASH -> {
                                 int reg = bytecode[pc++];
                                 RuntimeBase slot = registers[reg];
-                                if (slot instanceof RuntimeHash rh) {
+                                if (slot instanceof RuntimeHash rh
+                                        && !capturedLexicalOwnerStillRegistered(
+                                                code, reg, slot, frameCleanupMark)) {
                                     MortalList.scopeExitCleanupHash(rh);
                                 }
                             }
@@ -789,7 +805,9 @@ private static RuntimeList execute(SuspendedInterpreterFrame frame) {
                                 int reg = bytecode[pc++];
                                 int returnReg = bytecode[pc++];
                                 RuntimeBase slot = registers[reg];
-                                if (slot instanceof RuntimeArray ra) {
+                                if (slot instanceof RuntimeArray ra
+                                        && !capturedLexicalOwnerStillRegistered(
+                                                code, reg, slot, frameCleanupMark)) {
                                     MortalList.scopeExitCleanupArray(ra, registers[returnReg]);
                                 }
                             }
diff --git a/src/main/java/org/perlonjava/backend/bytecode/InterpretedCode.java b/src/main/java/org/perlonjava/backend/bytecode/InterpretedCode.java
index fcb6814c5e..3babec04a2 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/InterpretedCode.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/InterpretedCode.java
@@ -55,6 +55,7 @@ public ScalarPin scalarPin(int nameIdx) {
     public final int maxRegisters;         // Number of registers needed
     public final RuntimeBase[] capturedVars; // Closure support (captured from outer scope)
     public final Map<String, Integer> variableRegistry; // Variable name → register index (for eval STRING)
+    private BitSet capturedVarRegisters = new BitSet();
     public final List<Map<String, Integer>> evalSiteRegistries; // Per-eval-site variable registries
     public final List<Map<String, OperatorNode>> evalSiteLexicalSubroutineBindings;
     public final List<int[]> evalSitePragmaFlags; // [strict, features, evalbytes, warningBitsPoolIndex, regexDebug, enhancedXx]
@@ -451,7 +452,7 @@ public RuntimeList apply(RuntimeArray args, int callContext) {
             // Preserve the declared sub name for interpreter stack traces while
             // retaining async initial-result wrapping from master.
             RuntimeList result = BytecodeInterpreter.execute(
-                    this, args, effectiveContext, this.subName);
+                    this, args, effectiveContext, this.subName, cleanupMark);
             result = RuntimeCode.handleEscapingLoopControl(
                     result, generatedClassConstructor, classAdjustBlock);
             if (isSortComparator && result instanceof RuntimeControlFlowList flow) {
@@ -540,7 +541,7 @@ public RuntimeList apply(String subroutineName, RuntimeArray args, int callConte
         try {
             validateNamedSignatureArguments(args);
             RuntimeList result = BytecodeInterpreter.execute(
-                    this, args, effectiveContext, subroutineName);
+                    this, args, effectiveContext, subroutineName, cleanupMark);
             if (futureAsyncAwaitSub) {
                 return FutureAsyncAwaitRuntime.wrapInitialResult(
                         effectiveContext, callContext, result, futureAsyncAwaitFutureClass);
@@ -617,6 +618,12 @@ public InterpretedCode withCapturedVars(RuntimeBase[] capturedVars) {
                 true,
                 this.deparseSourceText
         );
+        copy.capturedVarRegisters = (BitSet) this.capturedVarRegisters.clone();
+        if (capturedVars != null) {
+            for (int index = 0; index < capturedVars.length; index++) {
+                copy.capturedVarRegisters.set(3 + index);
+            }
+        }
         copy.prototype = this.prototype;
         copy.isConstantCv = this.isConstantCv;
         copy.isLexicalConstantCv = this.isLexicalConstantCv;
@@ -683,6 +690,14 @@ public InterpretedCode withCapturedVars(RuntimeBase[] capturedVars) {
         return copy;
     }
 
+    void setCapturedVarRegisters(BitSet registers) {
+        capturedVarRegisters = registers == null ? new BitSet() : (BitSet) registers.clone();
+    }
+
+    boolean isCapturedVarRegister(int register) {
+        return capturedVarRegisters.get(register);
+    }
+
     private void validateAsyncSignature(RuntimeArray args) {
         if (!futureAsyncAwaitSub || signatureMinArgs < 0) {
             return;
diff --git a/src/main/java/org/perlonjava/backend/bytecode/SuspendedInterpreterFrame.java b/src/main/java/org/perlonjava/backend/bytecode/SuspendedInterpreterFrame.java
index 27e1f175fd..9db5b9aef4 100644
--- a/src/main/java/org/perlonjava/backend/bytecode/SuspendedInterpreterFrame.java
+++ b/src/main/java/org/perlonjava/backend/bytecode/SuspendedInterpreterFrame.java
@@ -26,6 +26,7 @@ public final class SuspendedInterpreterFrame {
     final RuntimeBase[] registers;
     final int callContext;
     final String subroutineName;
+    final int frameCleanupMark;
 
     int pc;
     int virtualEvalFrameDepth;
@@ -59,10 +60,12 @@ public final class SuspendedInterpreterFrame {
     Set<String> suspendedRuntimeDisabledWarningCategories;
 
     SuspendedInterpreterFrame(InterpretedCode code, RuntimeBase[] registers,
-                              int callContext, String subroutineName) {
+                              int callContext, String subroutineName,
+                              int frameCleanupMark) {
         this.code = code;
         this.registers = registers;
         this.callContext = callContext;
         this.subroutineName = subroutineName;
+        this.frameCleanupMark = frameCleanupMark;
     }
 }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStack.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStack.java
index 5f57813246..87b8e90c61 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStack.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStack.java
@@ -68,6 +68,21 @@ public static boolean isRegistered(Object var) {
         return registeredCounts().containsKey(var);
     }
 
+    /** True when {@code var} was registered before the current frame mark. */
+    public static boolean isRegisteredBefore(int mark, Object var) {
+        if (var == null) return false;
+        ArrayList<Object> current = stack();
+        int limit = Math.min(Math.max(mark, 0), current.size());
+        for (int i = limit - 1; i >= 0; i--) {
+            if (current.get(i) == var) return true;
+        }
+        return false;
+    }
+
+    public static int currentSize() {
+        return stack().size();
+    }
+
     /**
      * Snapshot the currently-live my-variables. Used by the
      * reachability walker's per-object query

From 4997a7897a20292ff8aef17eac2f6094be3e7d9a Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sat, 24 Oct 2026 22:46:01 +0200
Subject: [PATCH 277/317] docs: record captured cleanup validation and recovery
 audit

Record the committed return-cleanup fix, its final test evidence, and why the
aggregate-owner recovery scan remains enabled pending direct accounting for
its production callers.

Generated with OpenAI Codex (https://openai.com/codex)

Co-Authored-By: OpenAI Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 989e12e760..137972d6bb 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -207,10 +207,13 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   recovery enabled and disabled, so it is a separate existing failure. A
   scalar-only variant retained the scalar and Catalyst passes but made
   `catalyst_request_body_tempfile_global_destroy.t` exceed its 300-second child
-  timeout; that variant was discarded. The all-type patch is restored in the
-  current worktree; a new gate on this exact branch head remains pending. The
+  timeout; that variant was discarded. The all-type fix was committed as
+  `9adc112aa`; its final `nice -n 19 make` passed in 31m15s. The permanent
+  regression passes with system Perl and the interpreter, and Catalyst passes
+  24/24 on the interpreter. The recursive-builder failure remains open. The
   earlier static filter also caused unrelated cleanup failures. Aggregate
-  recovery remains enabled.
+  recovery remains enabled while its two production callers await direct
+  ownership accounting.
 - On 2026-10-24, the temporary scalar owner installed for `DESTROY`'s self
   argument now balances through the `SCALAR_VALUE` slot API without invoking
   destruction recursively inside the active DESTROY frame. A focused Java test

From b299b036833927535be5b92242d6ecf2eebc5c45 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 00:22:55 +0200
Subject: [PATCH 278/317] fix: preserve durable owners in void call results

Keep package-rooted scalar slots alive when a void-context call result is
mortalized, and cover release after the global aggregate owner is removed.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 docs/about/changelog.md                       |  1 +
 .../runtime/runtimetypes/MortalList.java      | 11 ++-
 .../runtime/runtimetypes/RuntimeScalar.java   | 18 +++-
 ...sue_1649_void_hash_discard_owner_cleanup.t | 99 +++++++++++++++++++
 4 files changed, 121 insertions(+), 8 deletions(-)
 create mode 100644 src/test/resources/unit/refcount/issue_1649_void_hash_discard_owner_cleanup.t

diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index 553d86675f..914dd43e61 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -23,6 +23,7 @@ priorities and future plans.
 - Run standard Perl's `cpan -t Module` for CPAN oracle checks and keep download failures inconclusive instead of reporting missing local modules as Perl failures.
 - Keep lexical-registration membership checks constant-time, avoiding quadratic CPAN index parsing as cleanup stacks grow.
 - Keep scalar-slot owners authoritative across stores, container copies, scalar references, closure captures, lexical scope exit, overwrites, and explicit `undef` after legacy tracking retires; preserve aliases through `pop`, `shift`, or `delete` (#1649).
+- Preserve package-rooted aggregate scalar owners when discarding a void-context subroutine result (#1649).
 - Transfer array and hash list-assignment tails through normal owner-slot and displaced-value cleanup paths, including `pop`, `shift`, and `delete` release (#1649).
 - Synchronize the destroyable-closure reverse index so ithread capture cloning and release can update it safely.
 - Follow scalar owner slots during aggregate lifetime recovery, avoiding a whole-root walk for nested scalar-owned containers.
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 641737cbb1..d5281727f7 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1218,10 +1218,10 @@ private static boolean containerHasWeakElementRefs(RuntimeBase base) {
     }
 
     /**
-     * Mortal-ize blessed refs with refCount==0 in a RuntimeList that will be
-     * discarded (void-context call result). Without this, objects that were
-     * blessed but never stored in a named variable would leak.
-     * Only processes elements with refCount==0 (never-stored objects).
+     * Release owned aggregate refs and mortal-ize never-stored blessed refs
+     * in a RuntimeList discarded by a void-context call. A returned scalar may
+     * still be the same Perl cell stored in a global, live lexical, or owning
+     * container; dropping the call result must not release that cell's owner.
      */
     public static void mortalizeForVoidDiscard(RuntimeList result) {
         if (!isActive() || result == null) return;
@@ -1236,9 +1236,10 @@ public static void mortalizeForVoidDiscard(RuntimeList result) {
                 boolean reachableCodeRef = base instanceof RuntimeCode
                         && scalar.isStoredInRegisteredContainerOwner()
                         && ReachabilityWalker.isScalarReachable(scalar);
+                boolean hasOtherPerlOwner = scalar.hasDurableLvalueStorage();
                 if (scalar.ownsCountedReferent(base) && base.refCount > 0
                         && unblessedDiscardableContainer
-                        && !reachableCodeRef) {
+                        && !reachableCodeRef && !hasOtherPerlOwner) {
                     scalar.setRefCountOwned(false);
                     if (base.refCountTrace) {
                         base.traceRefCount(0, "MortalList.mortalizeForVoidDiscard (queued owned container discard)");
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 622e7bc797..ac9a9170ae 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -577,11 +577,23 @@ boolean isStoredInRegisteredContainerOwner() {
 
     /** Whether this scalar is backed by durable Perl storage for lvalue use. */
     boolean hasDurableLvalueStorage() {
-        return isPackageGlobalRoot
+        if (isPackageGlobalRoot
                 || MyVarCleanupStack.isRegistered(this)
                 || isStoredInRegisteredContainerOwner()
-                || containerOwner == RuntimeCode.getCurrentArgs()
-                || this instanceof RuntimeBaseProxy;
+                || (containerOwner != null
+                    && containerOwner == RuntimeCode.getCurrentArgs())
+                || this instanceof RuntimeBaseProxy) {
+            return true;
+        }
+        RuntimeBase owner = containerOwner;
+        if (owner instanceof RuntimeHash hash) {
+            return hash.isPackageRootedHash() && hash.elements.containsValue(this);
+        }
+        if (owner instanceof RuntimeArray array) {
+            return array.isPackageGlobalRoot && array.elements.contains(this)
+                    && (!array.elementsAliased || array.ownsElement(this));
+        }
+        return false;
     }
 
     /** True when a container removal returned this scalar slot as a loose value. */
diff --git a/src/test/resources/unit/refcount/issue_1649_void_hash_discard_owner_cleanup.t b/src/test/resources/unit/refcount/issue_1649_void_hash_discard_owner_cleanup.t
new file mode 100644
index 0000000000..c0c52501e4
--- /dev/null
+++ b/src/test/resources/unit/refcount/issue_1649_void_hash_discard_owner_cleanup.t
@@ -0,0 +1,99 @@
+use strict;
+use warnings;
+use Scalar::Util qw(isweak);
+use Test::More;
+
+our @WEAK_NODES;
+our $DESTROYED = 0;
+our $HOLDER;
+
+{
+    package Issue1649VoidHashNode;
+
+    sub new {
+        my ($class, $tag) = @_;
+        my $node = bless { _tag => $tag }, $class;
+        push @main::WEAK_NODES, $node;
+        Scalar::Util::weaken($main::WEAK_NODES[-1]);
+        return $node;
+    }
+
+    sub DESTROY { ++$main::DESTROYED }
+}
+
+# Preserve the recursive closure and captured scratch pad from the HTML::Tree
+# builder shape while keeping the test independent of that distribution.
+sub new_from_lol {
+    my $class = shift;
+    $class = ref($class) || $class;
+    my $lol = $_[0];
+    my @ancestor_lols;
+    my ($sub, $k, $v, $node);
+    $sub = sub {
+        my $lol = $_[0];
+        return unless @$lol;
+        my (@attributes, @children);
+        die "cyclic lol" if grep($_ eq $lol, @ancestor_lols);
+        push @ancestor_lols, $lol;
+        my $tag_name = 'null';
+        for (my $i = 0; $i < @$lol; ++$i) {
+            if (ref($lol->[$i]) eq 'ARRAY') {
+                push @children, $sub->($lol->[$i]);
+            } elsif (!ref($lol->[$i])) {
+                if ($i == 0) {
+                    $tag_name = $lol->[$i];
+                } else {
+                    push @children, $lol->[$i];
+                }
+            } elsif (ref($lol->[$i]) eq 'HASH') {
+                keys %{ $lol->[$i] };
+                while (($k, $v) = each %{ $lol->[$i] }) {
+                    push @attributes, $k, $v if defined $v;
+                }
+            } else {
+                die "unsupported node";
+            }
+        }
+        pop @ancestor_lols;
+        $node = $class->new($tag_name);
+        if (@attributes) {
+            my %attributes = @attributes;
+            @{$node}{keys %attributes} = values %attributes;
+        }
+        if (@children) {
+            $node->{_content} = \@children;
+            foreach my $child (@children) {
+                next unless ref $child;
+                $child->{_parent} = $node;
+                Scalar::Util::weaken($child->{_parent});
+            }
+        }
+        return $node;
+    };
+    $node = $sub->($lol);
+    undef $sub;
+    return $node;
+}
+
+sub store_body_in_global_hash {
+    $HOLDER = { body => $WEAK_NODES[3] };
+}
+
+my $tree = new_from_lol(Issue1649VoidHashNode => [
+    'html', ['head', ['title', 'title text']], ['body', ['p', 'paragraph text']],
+]);
+my ($body) = grep { defined($_) && $_->{_tag} eq 'body' } @WEAK_NODES;
+
+store_body_in_global_hash();
+$tree = undef;
+is(scalar(grep { defined $_ } @WEAK_NODES), 2,
+    'void-context hash result preserves a global aggregate owner');
+$body = undef;
+is(scalar(grep { defined $_ } @WEAK_NODES), 2,
+    'the global hash retains the escaped subtree after the lexical is cleared');
+undef $HOLDER;
+is(scalar(grep { defined $_ } @WEAK_NODES), 0,
+    'releasing the global hash frees the escaped subtree');
+is($DESTROYED, 5, 'all nodes are destroyed once');
+
+done_testing;

From a9aa8fdf1215fd1249627a53f8b98b75de8630c2 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 01:19:52 +0200
Subject: [PATCH 279/317] fix: invalidate stale roots for displaced referents

Invalidate cached reachability when a scalar replaces a reference so weakly
linked aggregate trees release at the assignment boundary. Add an explicit
undef regression for the interpreter ownership path.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          | 18 ++++++++
 docs/about/changelog.md                       |  1 +
 .../runtime/runtimetypes/RuntimeScalar.java   |  3 ++
 ..._1649_assignment_undef_weak_tree_release.t | 42 +++++++++++++++++++
 4 files changed, 64 insertions(+)
 create mode 100644 src/test/resources/unit/refcount/issue_1649_assignment_undef_weak_tree_release.t

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 137972d6bb..9b211f023a 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -179,6 +179,24 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   that the recovery scan can be removed. The remaining investigation is the
   interpreter's direct ownership accounting for captured aggregate pads and
   scalar cells across recursive closure execution and lexical cleanup.
+- On 2026-10-25, a two-node reducer narrowed a related interpreter failure to
+  replacing the final lexical root with `undef` when the child has a weak
+  parent edge. System Perl passes, and lexical scope exit releases the same
+  tree under the interpreter; explicit assignment leaves both weak observers
+  alive. The failure also reproduces with aggregate-owner recovery disabled.
+  Existing `weak_blessed_tree_descendant_cleanup.t` and `weaken_destroy.t`
+  exercise scope exit, so the new project-owned regression covers explicit
+  replacement. A refstate diagnostic call changes the timing and makes the
+  test pass, so its count output is not a reliable oracle for the missing edge.
+  Invalidating cached reachability for the displaced referent as well as its
+  scalar cell fixes the focused reducer and the existing recursive-builder
+  regression. Both pass on JVM and interpreter with aggregate-owner recovery
+  disabled; system Perl passes the new four-assertion reducer. Full
+  `nice -n 19 make` passes in 13m09s. The #1794 controller-owner regression
+  passes 3/3 and the #1795 Catalyst tempfile regression passes 24/24 on both
+  backends. The WebSocket integration test skipped because loopback sockets
+  are unavailable in this environment. Recovery remains enabled by default;
+  its two production callers still need independent direct-accounting proof.
 - A second focused reducer,
   `issue_1649_captured_scalar_array_argument.t`, isolates the same class of
   lifetime error: a closure writes a blessed object to a captured scalar while
diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index 914dd43e61..d55bb8f0e8 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -24,6 +24,7 @@ priorities and future plans.
 - Keep lexical-registration membership checks constant-time, avoiding quadratic CPAN index parsing as cleanup stacks grow.
 - Keep scalar-slot owners authoritative across stores, container copies, scalar references, closure captures, lexical scope exit, overwrites, and explicit `undef` after legacy tracking retires; preserve aliases through `pop`, `shift`, or `delete` (#1649).
 - Preserve package-rooted aggregate scalar owners when discarding a void-context subroutine result (#1649).
+- Release weakly linked aggregate trees when their last lexical root is overwritten with `undef` (#1649).
 - Transfer array and hash list-assignment tails through normal owner-slot and displaced-value cleanup paths, including `pop`, `shift`, and `delete` release (#1649).
 - Synchronize the destroyable-closure reverse index so ithread capture cloning and release can update it safely.
 - Follow scalar owner slots during aggregate lifetime recovery, avoiding a whole-root walk for nested scalar-owned containers.
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index ac9a9170ae..501c6cac40 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -2917,6 +2917,9 @@ private RuntimeScalar setLargeRefCounted(RuntimeScalar value) {
         }
         if (this.value != value.value) {
             MortalList.invalidateFullRootSnapshotIfReachable(this);
+            if (this.value instanceof RuntimeBase displacedReferent) {
+                MortalList.invalidateFullRootSnapshotIfReachable(displacedReferent);
+            }
             if (containerOwner != null) {
                 MortalList.invalidateFullRootSnapshotIfReachable(containerOwner);
             }
diff --git a/src/test/resources/unit/refcount/issue_1649_assignment_undef_weak_tree_release.t b/src/test/resources/unit/refcount/issue_1649_assignment_undef_weak_tree_release.t
new file mode 100644
index 0000000000..cefc6b9622
--- /dev/null
+++ b/src/test/resources/unit/refcount/issue_1649_assignment_undef_weak_tree_release.t
@@ -0,0 +1,42 @@
+use strict;
+use warnings;
+use Scalar::Util qw(isweak weaken);
+use Test::More;
+
+our (@WEAK_NODES, $DESTROYED);
+$DESTROYED = 0;
+
+{
+    package Issue1649ExplicitUndefNode;
+
+    sub new {
+        my ($class) = @_;
+        my $node = bless { children => [] }, $class;
+        push @main::WEAK_NODES, $node;
+        Scalar::Util::weaken($main::WEAK_NODES[-1]);
+        return $node;
+    }
+
+    sub DESTROY { ++$main::DESTROYED }
+}
+
+sub make_tree {
+    my $root = Issue1649ExplicitUndefNode->new;
+    my $child = Issue1649ExplicitUndefNode->new;
+    push @{ $root->{children} }, $child;
+    $child->{parent} = $root;
+    weaken($child->{parent});
+    return $root;
+}
+
+my $root = make_tree();
+is(scalar(grep { defined $_ } @WEAK_NODES), 2,
+    'the root owns its child through the children array');
+ok(isweak($WEAK_NODES[1]{parent}), 'the child parent link is weak');
+
+$root = undef;
+is(scalar(grep { defined $_ } @WEAK_NODES), 0,
+    'assigning undef to the last root releases the weakly linked tree');
+is($DESTROYED, 2, 'both nodes are destroyed once');
+
+done_testing;

From c269bf77256718e5ffa6233963fbfbfcf44d182d Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 01:33:55 +0200
Subject: [PATCH 280/317] docs: record ownership regressions passing without
 recovery scan

Record the focused #1794, #1795, and selected #1649 backend results with
the diagnostic recovery bypass enabled, plus the remaining Java-only
synthetic recovery assertions.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 9b211f023a..7fc6c7f49c 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -195,8 +195,14 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   `nice -n 19 make` passes in 13m09s. The #1794 controller-owner regression
   passes 3/3 and the #1795 Catalyst tempfile regression passes 24/24 on both
   backends. The WebSocket integration test skipped because loopback sockets
-  are unavailable in this environment. Recovery remains enabled by default;
-  its two production callers still need independent direct-accounting proof.
+  were unavailable in the sandbox, then passed with extended access: the
+  WebSocket controller test passes 6/6 and callback/long-poll lifetime passes
+  29/29 on both backends. With aggregate-owner recovery disabled, the #1794
+  controller, both WebSocket tests, #1795 tempfile test, void-context hash
+  owner test, captured scalar/array argument test, and aggregate-capture owner
+  test all pass on both backends. Recovery remains enabled by default; its two
+  production callers still need independent direct-accounting proof, and the
+  synthetic Java tests still directly require the recovery behavior.
 - A second focused reducer,
   `issue_1649_captured_scalar_array_argument.t`, isolates the same class of
   lifetime error: a closure writes a blessed object to a captured scalar while

From bf419773b21c4adcf74cb2e55348825f28bb4459 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 01:49:41 +0200
Subject: [PATCH 281/317] docs: record recovery-disabled unit audit

Record the six direct Java recovery assertions and note that the failed
shard prevented the remaining Perl shards from completing.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 7fc6c7f49c..d699b21ea5 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -203,6 +203,14 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   test all pass on both backends. Recovery remains enabled by default; its two
   production callers still need independent direct-accounting proof, and the
   synthetic Java tests still directly require the recovery behavior.
+- The full `JPERL_TEST_DISABLE_AGGREGATE_OWNER_RECOVERY=1 nice -n 19 make`
+  audit reached 1,300 tests in shard 0 and failed six Java assertions that
+  directly require `restoreReachableAggregateOwnerCount` to rebuild an
+  artificially undercounted referent. The other 1,294 tests in that shard
+  passed, with three skipped. Gradle stopped before the other Perl shards
+  completed, so this is not a full-suite no-recovery result. Keep the scan and
+  diagnostic switch while tracing the two production paths; do not interpret
+  these synthetic failures as missing Perl store operations.
 - A second focused reducer,
   `issue_1649_captured_scalar_array_argument.t`, isolates the same class of
   lifetime error: a closure writes a blessed object to a captured scalar while

From e888980fdd9700899c3712c853318744b348c66c Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 02:43:11 +0200
Subject: [PATCH 282/317] chore: remove aggregate owner recovery diagnostic
 bypass

Remove the temporary test-only switch after the shard-by-shard no-recovery audit. Keep aggregate owner recovery and its production callers because focused Java tests directly exercise its accounting behavior. Record the audit results in the ownership design doc.

Generated with Codex (https://openai.com/codex/)

Co-Authored-By: Codex <codex@openai.com>
---
 build.gradle                                  |  8 ----
 dev/design/perl-ownership-rewrite.md          | 42 ++++++++-----------
 .../runtime/runtimetypes/MortalList.java      |  8 +---
 .../runtime/runtimetypes/RuntimeScalar.java   |  3 +-
 4 files changed, 20 insertions(+), 41 deletions(-)

diff --git a/build.gradle b/build.gradle
index 4335f631ca..9d6675934f 100644
--- a/build.gradle
+++ b/build.gradle
@@ -384,17 +384,9 @@ test {
 // Provider we already record as an input so configuration-cache invalidation
 // stays correct when the env var changes between invocations.
 def jperlTestFilterProp = providers.environmentVariable('JPERL_TEST_FILTER').orElse('')
-def disableAggregateOwnerRecoveryProp = providers.environmentVariable(
-        'JPERL_TEST_DISABLE_AGGREGATE_OWNER_RECOVERY').map {
-    it.equalsIgnoreCase('true') || it == '1'
-}.orElse(false)
 tasks.withType(Test).configureEach { t ->
     t.inputs.property('jperlTestFilter', jperlTestFilterProp)
     t.environment('JPERL_TEST_FILTER', jperlTestFilterProp.get())
-    t.inputs.property('disableAggregateOwnerRecovery', disableAggregateOwnerRecoveryProp)
-    if (disableAggregateOwnerRecoveryProp.get()) {
-        t.systemProperty('perlonjava.test.disableAggregateOwnerRecovery', 'true')
-    }
 }
 
 // Fast unit tests only (tests in unit/ directory)
diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index d699b21ea5..f6ab31eb2f 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -126,22 +126,15 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   consume a later scalar owner's count. Root recovery includes live wrapper
   slots from rooted owner containers. The wrapper-slot batch passed full
   `nice -n 19 make` in 27m21s.
-- The temporary `perlonjava.test.disableAggregateOwnerRecovery` diagnostic is
-  available to forked test workers through
-  `JPERL_TEST_DISABLE_AGGREGATE_OWNER_RECOVERY=1`. It bypasses the scan only at
-  the two production call sites in `MortalList.processDeferredBase` and
-  `RuntimeScalar.setLargeRefCounted`; default runtime behavior remains enabled.
-  With the bypass, the focused #1794 controller/WebSocket and #1795 request
-  tempfile tests pass on both backends, along with selected #1649 ownership and
-  `DESTROY` tests. A JVM global-destruction wrapper timed out its nested child
-  at 300 seconds, while the underlying Catalyst lifetime test passed directly
-  and the wrapper passed on the interpreter; this result is inconclusive.
-  Six Java tests fail in deliberately undercounted synthetic graphs whose
-  assertions directly verify recovery behavior. The root-chain and lifecycle
-  tests directly construct scalar cells, mark them owned, then force the
-  referent count below the live owners; the reachability-cost tests queue more
-  decrements than they acquired owners. These fixtures do not identify a
-  missing Perl store operation. Concretely, the six are
+- The temporary `perlonjava.test.disableAggregateOwnerRecovery` diagnostic was
+  removed after the no-recovery audit. The two production call sites in
+  `MortalList.processDeferredBase` and `RuntimeScalar.setLargeRefCounted` still
+  use recovery: six Java tests fail with the bypass because they directly test
+  recovery from deliberately undercounted synthetic graphs. The root-chain
+  and lifecycle tests directly construct scalar cells, mark them owned, then
+  force the referent count below the live owners; the reachability-cost tests
+  queue more decrements than they acquired owners. These fixtures do not
+  identify a missing Perl store operation. Concretely, the six are
   `MortalListAggregateOwnerSlotRootChainTest` (two cases),
   `MortalListAggregateOwnerSlotTest.rootedHashEntrySlotRestoresAnUnderflowedLegacyCountUntilEntryRemoval`,
   `ReachabilityQueryCostTest.deferredOwnerChecksShareOneRootSnapshotPerDrain`,
@@ -203,14 +196,15 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   test all pass on both backends. Recovery remains enabled by default; its two
   production callers still need independent direct-accounting proof, and the
   synthetic Java tests still directly require the recovery behavior.
-- The full `JPERL_TEST_DISABLE_AGGREGATE_OWNER_RECOVERY=1 nice -n 19 make`
-  audit reached 1,300 tests in shard 0 and failed six Java assertions that
-  directly require `restoreReachableAggregateOwnerCount` to rebuild an
-  artificially undercounted referent. The other 1,294 tests in that shard
-  passed, with three skipped. Gradle stopped before the other Perl shards
-  completed, so this is not a full-suite no-recovery result. Keep the scan and
-  diagnostic switch while tracing the two production paths; do not interpret
-  these synthetic failures as missing Perl store operations.
+- The full no-recovery audit reached 1,300 tests in shard 0 and failed six Java
+  assertions that directly require `restoreReachableAggregateOwnerCount` to
+  rebuild an artificially undercounted referent; the other 1,294 passed, with
+  three skipped. Since Gradle stopped at shard 0, shards 1–4 were run
+  separately with recovery disabled and all passed. Focused #1794/#1795
+  integration tests and selected #1649 lifetime tests also pass on both
+  backends with recovery disabled. The diagnostic switch is now removed; keep
+  the recovery method and its two production callers until direct accounting
+  proves those paths no longer need it.
 - A second focused reducer,
   `issue_1649_captured_scalar_array_argument.t`, isolates the same class of
   lifetime error: a closure writes a blessed object to a captured scalar while
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index d5281727f7..48900d3f65 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1791,8 +1791,7 @@ private static void processDeferredBase(RuntimeBase base, boolean clearWeakRefsF
                 // have a legacy bridge count and retain the old compatibility
                 // sentinel behavior.
                 if (base.nativeCaptureOwnerCount() == 0) base.refCount = 1;
-            } else if (!aggregateOwnerRecoveryDisabledForDiagnostics()
-                    && restoreReachableAggregateOwnerCount(base)) {
+            } else if (restoreReachableAggregateOwnerCount(base)) {
                 // A hash-entry owner has a stable semantic slot identity even
                 // when an unrelated legacy scalar decrement consumes the
                 // selective count. Restore the count from independently owned
@@ -2060,11 +2059,6 @@ static boolean restoreReachableAggregateOwnerCount(RuntimeBase referent) {
         return true;
     }
 
-    /** Test-only switch for finding ownership edges that still depend on recovery. */
-    static boolean aggregateOwnerRecoveryDisabledForDiagnostics() {
-        return Boolean.getBoolean("perlonjava.test.disableAggregateOwnerRecovery");
-    }
-
     private static boolean isRootedAggregateOwnerCached(
             RuntimeBase owner, RuntimeBase excludedReferent,
             Map<RuntimeBase, Boolean> rootedAggregateOwners) {
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 501c6cac40..bc359397e7 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -3323,8 +3323,7 @@ && hasLiveIo(assignedGlob)) {
                     // slot holds a strong reference not counted in refCount.
                     // Don't call callDestroy — the container is still alive.
                     // Cleanup will happen at scope exit (scopeExitCleanupHash/Array).
-                } else if (!MortalList.aggregateOwnerRecoveryDisabledForDiagnostics()
-                        && MortalList.restoreReachableAggregateOwnerCount(oldBase)) {
+                } else if (MortalList.restoreReachableAggregateOwnerCount(oldBase)) {
                     // Explicit aggregate slots can prove a rooted owner chain
                     // even when a nested expression temporary is absent from
                     // the conservative lexical walker roots.

From b6ba247bb9d9dbed85c7904d4d8aa33f100abd23 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 02:45:36 +0200
Subject: [PATCH 283/317] docs: close recursive builder interpreter blocker

Record current system Perl, JVM, and interpreter results for the recursive-builder owner-release regression. The fix is already in the captured lexical owner cleanup path; aggregate-owner recovery remains necessary at unmigrated boundaries.

Generated with Codex (https://openai.com/codex/)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index f6ab31eb2f..3d998125d5 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -162,16 +162,14 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   evidence to replace the scan. After the diagnostic review, default behavior
   passes full `nice -n 19 make` in 39m43s; offline documentation link checking
   also passes.
-- The recovery-disabled audit also exposed a real interpreter regression in
-  `issue_1649_recursive_builder_pad_release.t`: system Perl and the JVM pass
-  all nine assertions, while the interpreter retains all five weakly observed
-  nodes after dropping the root (expected two). With default recovery enabled,
-  the interpreter still fails that root-release assertion; dropping the saved
-  body then releases the remaining nodes. Trace confirms the recursive
-  closure's `releaseCaptures()` runs at `undef $sub`, so this is not evidence
-  that the recovery scan can be removed. The remaining investigation is the
-  interpreter's direct ownership accounting for captured aggregate pads and
-  scalar cells across recursive closure execution and lexical cleanup.
+- The recovery-disabled audit had exposed an interpreter regression in
+  `issue_1649_recursive_builder_pad_release.t`: the interpreter retained all
+  five weakly observed nodes after dropping the root (expected two), even with
+  recovery enabled. Commit `9adc112aa` preserves captured lexical owners across
+  return cleanup. On 2026-10-25, the permanent regression passed all 9
+  assertions on system Perl, JVM, and interpreter, confirming the root release
+  and subsequent escaped-subtree release. This closes that interpreter
+  blocker; it does not establish that aggregate-owner recovery is removable.
 - On 2026-10-25, a two-node reducer narrowed a related interpreter failure to
   replacing the final lexical root with `undef` when the child has a weak
   parent edge. System Perl passes, and lexical scope exit releases the same

From 586bfbff77d2b1ed6c9fec729230f3b7a894e44b Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 02:47:14 +0200
Subject: [PATCH 284/317] docs: trace untyped deferred owner release candidates

Record the current generic deferred-decrement call sites as migration candidates for direct owner accounting, while distinguishing source-level candidates from confirmed behavioral regressions.

Generated with Codex (https://openai.com/codex/)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 3d998125d5..ca7067c516 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -161,7 +161,12 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   scalar-reference contents; the current synthetic tests are not sufficient
   evidence to replace the scan. After the diagnostic review, default behavior
   passes full `nice -n 19 make` in 39m43s; offline documentation link checking
-  also passes.
+  also passes. A source audit found generic deferred decrements that do not
+  carry a semantic owner slot, including `RuntimeCode.releaseMethodInvocantHold`
+  and the compatibility fallback in `RuntimeScalar.deferOwnedScalarReferenceContents`.
+  These are concrete migration candidates, not confirmed reproductions; the
+  next audit should trace their queue/drain ordering and add an oracle-checked
+  regression before changing their accounting.
 - The recovery-disabled audit had exposed an interpreter regression in
   `issue_1649_recursive_builder_pad_release.t`: the interpreter retained all
   five weakly observed nodes after dropping the root (expected two), even with

From e199cd60f837a2bbb9590fa5db1875ce8bb7d3e1 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 02:05:10 +0100
Subject: [PATCH 285/317] fix: remove unreachable scalar contents decrement
 fallback

Route deferred scalar-reference contents cleanup through its active owner slot only. The former generic decrement branch could not execute because the referent helper required the same active slot already handled above. Add focused coverage for slot identity and exactly-once release at drain, and record the audit in the ownership design doc.

Generated with Codex (https://openai.com/codex/)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          | 14 +++++---
 .../runtime/runtimetypes/RuntimeScalar.java   | 19 -----------
 ...lOwnerSlotScalarReferenceContentsTest.java | 34 +++++++++++++++++++
 3 files changed, 43 insertions(+), 24 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index ca7067c516..1a7530bfae 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -162,11 +162,15 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   evidence to replace the scan. After the diagnostic review, default behavior
   passes full `nice -n 19 make` in 39m43s; offline documentation link checking
   also passes. A source audit found generic deferred decrements that do not
-  carry a semantic owner slot, including `RuntimeCode.releaseMethodInvocantHold`
-  and the compatibility fallback in `RuntimeScalar.deferOwnedScalarReferenceContents`.
-  These are concrete migration candidates, not confirmed reproductions; the
-  next audit should trace their queue/drain ordering and add an oracle-checked
-  regression before changing their accounting.
+  carry a semantic owner slot. The fallback in
+  `RuntimeScalar.deferOwnedScalarReferenceContents` was unreachable: it
+  required an active contents slot after the method had already returned
+  through that slot's deferred-release path. Removed the dead generic decrement
+  and added Java coverage that verifies the contents slot remains active until
+  drain, then releases exactly once. `RuntimeCode.releaseMethodInvocantHold`
+  still queues a generic deferred decrement; its acquisition/release ordering
+  is the next concrete migration candidate, but is not yet a confirmed
+  behavioral regression.
 - The recovery-disabled audit had exposed an interpreter regression in
   `issue_1649_recursive_builder_pad_release.t`: the interpreter retained all
   five weakly observed nodes after dropping the root (expected two), even with
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index bc359397e7..b3d8e2ea5a 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -2514,16 +2514,6 @@ private void retainScalarReferenceContents(RuntimeScalar value) {
         this.scalarReferenceContentsOwner = ownerSlot;
     }
 
-    private static RuntimeScalar scalarReferenceContentsReferent(RuntimeScalar owner) {
-        if (owner != null
-                && owner.hasScalarReferenceContentsOwner()
-                && owner.type == REFERENCE
-                && owner.value instanceof RuntimeScalar scalarReferent) {
-            return scalarReferent;
-        }
-        return null;
-    }
-
     public static void releaseScalarReferenceContents(RuntimeScalar scalarReferent) {
         if (scalarReferent == null
                 || (scalarReferent.type & REFERENCE_BIT) == 0
@@ -2556,20 +2546,11 @@ public void releaseOwnedScalarReferenceContents() {
      * retain it first and keeps the retain/release accounting balanced.
      */
     public void deferOwnedScalarReferenceContents() {
-        RuntimeScalar scalarReferent = scalarReferenceContentsReferent(this);
         PerlOwnerSlot ownerSlot = this.scalarReferenceContentsOwner;
         this.scalarReferenceContentsOwner = null;
         if (ownerSlot != null) {
             ownerSlot.deferScalarReferenceContentsRelease();
-            return;
-        }
-        if (scalarReferent == null
-                || (scalarReferent.type & REFERENCE_BIT) == 0
-                || !(scalarReferent.value instanceof RuntimeBase inner)
-                || inner.refCount <= 0) {
-            return;
         }
-        MortalList.deferDecrement(inner);
     }
 
     // Keep this entry point small so HotSpot can inline it into generated
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotScalarReferenceContentsTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotScalarReferenceContentsTest.java
index 53e83723c0..65468d900a 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotScalarReferenceContentsTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlotScalarReferenceContentsTest.java
@@ -251,6 +251,40 @@ void deferredReleaseCarriesTheOwnerSlotIdentityUntilDrain() {
         }
     }
 
+    @Test
+    void scalarReturnDefersItsContentsOwnerThroughTheOwnerSlot() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeHash referent = new RuntimeHash();
+            referent.refCount = 3;
+            RuntimeScalar referenceCell = new RuntimeScalar();
+            referenceCell.type = RuntimeScalarType.REFERENCE;
+            referenceCell.value = referent;
+            RuntimeScalar returnedReference = new RuntimeScalar();
+            returnedReference.type = RuntimeScalarType.REFERENCE;
+            returnedReference.value = referenceCell;
+            PerlOwnerSlot owner = new PerlOwnerSlot(
+                    PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS,
+                    null, null, returnedReference);
+            owner.acquireScalarReferenceContents(referent, referenceCell);
+            returnedReference.scalarReferenceContentsOwner = owner;
+
+            MortalList.pushMark();
+            returnedReference.deferOwnedScalarReferenceContents();
+
+            assertNull(returnedReference.scalarReferenceContentsOwner);
+            assertTrue(owner.isActive(), "the pending release retains slot identity until drain");
+            assertEquals(4, referent.refCount,
+                    "the referent remains alive until the caller can install the returned value");
+            MortalList.flushAboveMark();
+
+            assertFalse(owner.isActive());
+            assertEquals(3, referent.refCount,
+                    "drain releases the deferred contents owner exactly once");
+            MortalList.popMark();
+        }
+    }
+
     @Test
     void rejectsOverflowBeforeRegisteringTheOwnerSlot() {
         RuntimeHash referent = new RuntimeHash();

From 184c3f110071b33bf37637d096b24e9a0153a21c Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 02:22:38 +0100
Subject: [PATCH 286/317] test: cover abandoned method invocant ownership

Add a Perl-level regression for argument failure after method-chain invocant evaluation. A rooted hash must keep the invocant alive when the interpreter abandons its temporary method hold, and deleting the final aggregate owner must run DESTROY. Record the balanced normal hold path and the new verified edge in the ownership design doc.

Generated with Codex (https://openai.com/codex/)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          | 15 ++++++++---
 ...ssue_1649_abandoned_method_invocant_hold.t | 26 +++++++++++++++++++
 2 files changed, 38 insertions(+), 3 deletions(-)
 create mode 100644 src/test/resources/unit/refcount/issue_1649_abandoned_method_invocant_hold.t

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 1a7530bfae..66d64701cc 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -168,9 +168,18 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   through that slot's deferred-release path. Removed the dead generic decrement
   and added Java coverage that verifies the contents slot remains active until
   drain, then releases exactly once. `RuntimeCode.releaseMethodInvocantHold`
-  still queues a generic deferred decrement; its acquisition/release ordering
-  is the next concrete migration candidate, but is not yet a confirmed
-  behavioral regression.
+  queues a generic deferred decrement. Its ordinary path is balanced:
+  acquisition adds one count, and release either subtracts it or queues exactly
+  one decrement for the boundary drain. The interpreter tracks holds by frame
+  and abandons them on exceptional/non-local exits through
+  `releaseAbandonedMethodInvocantHold`, which decrements directly and dispatches
+  `DESTROY` at zero without consulting owner recovery. The project-owned
+  `issue_1649_abandoned_method_invocant_hold.t` now verifies the critical
+  ordering: an argument exception abandons the call while a hash still owns the
+  invocant, and deleting the hash entry later fires `DESTROY`. It passes 3/3 on
+  system Perl, JVM, and interpreter. No accounting mismatch is reproduced, so
+  retain the current lifecycle decision while migrating transient holds to
+  explicit slots as part of the broader ownership phase.
 - The recovery-disabled audit had exposed an interpreter regression in
   `issue_1649_recursive_builder_pad_release.t`: the interpreter retained all
   five weakly observed nodes after dropping the root (expected two), even with
diff --git a/src/test/resources/unit/refcount/issue_1649_abandoned_method_invocant_hold.t b/src/test/resources/unit/refcount/issue_1649_abandoned_method_invocant_hold.t
new file mode 100644
index 0000000000..47a140cd7b
--- /dev/null
+++ b/src/test/resources/unit/refcount/issue_1649_abandoned_method_invocant_hold.t
@@ -0,0 +1,26 @@
+use strict;
+use warnings;
+use Test::More;
+
+our $destroyed = 0;
+
+{
+    package AbandonedMethodHold;
+    sub new { bless {}, shift }
+    sub DESTROY { $main::destroyed++ }
+    sub invoke { die "method must not run" }
+}
+
+my $object = AbandonedMethodHold->new;
+my $root = { object => $object };
+$object = undef;
+
+eval { $root->{object}->invoke(do { die "argument failed" }); 1 };
+like($@, qr/argument failed/, 'argument evaluation aborts the method chain');
+is($destroyed, 0,
+    'aggregate owner keeps the invocant alive after abandoned hold release');
+
+undef $root->{object};
+is($destroyed, 1, 'removing the last aggregate owner runs DESTROY');
+
+done_testing();

From 228bb9ebc22dadf4847626e15117aaad7dda2dce Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 02:40:42 +0100
Subject: [PATCH 287/317] fix: release Storable argument owners through scalar
 slots

Use the scalar-value owner slot to release materialized Storable argument cells, preserving the legacy decrement path for cells without explicit slots. The existing retired-flag regression confirms the slot remains authoritative. Record the full-gate result in the ownership design doc.

Generated with Codex (https://openai.com/codex/)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md                 |  7 +++++++
 .../org/perlonjava/runtime/perlmodule/Storable.java  | 12 ++++++++----
 .../runtime/runtimetypes/RuntimeScalar.java          |  3 ++-
 3 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 66d64701cc..542ac12dea 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -119,6 +119,13 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
 
 ### Current batch
 
+- `Storable.releaseApplyArgs()` now releases materialized argument owners through
+  `SCALAR_VALUE` slots when available, retaining the legacy fallback for older
+  cells. Its existing Java regression retires the legacy ownership flag before
+  release and verifies the slot and count both clear; this now exercises the
+  direct slot-release API rather than detaching the slot after a manual count
+  decrement. Full `nice -n 19 make` passes in 15m05s; the focused test passes
+  with zero failures.
 - On 2026-10-24, tied scalar, array, hash, and handle wrappers now record
   handler ownership in distinct `TIE_WRAPPER` slots. A wrapper installed while
   its handler has the untracked sentinel remains uncounted until rooted owner
diff --git a/src/main/java/org/perlonjava/runtime/perlmodule/Storable.java b/src/main/java/org/perlonjava/runtime/perlmodule/Storable.java
index fa03771409..bf8c037d5d 100644
--- a/src/main/java/org/perlonjava/runtime/perlmodule/Storable.java
+++ b/src/main/java/org/perlonjava/runtime/perlmodule/Storable.java
@@ -350,10 +350,14 @@ public static void releaseApplyArgs(RuntimeArray args) {
             if (elem.value instanceof RuntimeBase base
                     && elem.ownsCountedReferent(base)
                     && base.refCount > 0) {
-                base.releaseOwner(elem, "Storable.releaseApplyArgs");
-                base.releaseActiveOwner(elem);
-                base.refCount--;
-                elem.setRefCountOwned(false);
+                if (!elem.releaseScalarValueOwnerCount(base, "Storable.releaseApplyArgs")) {
+                    // Cells created before explicit scalar-value slots retain
+                    // the legacy bridge until their owner path is migrated.
+                    base.releaseOwner(elem, "Storable.releaseApplyArgs");
+                    base.releaseActiveOwner(elem);
+                    base.refCount--;
+                    elem.setRefCountOwned(false);
+                }
             }
         }
         args.elements.clear();
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index b3d8e2ea5a..834641a622 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -916,7 +916,8 @@ private void syncScalarValueOwnerSlot(boolean owned) {
         }
     }
 
-    boolean releaseScalarValueOwnerCount(RuntimeBase expectedReferent, String releaseSite) {
+    /** Release this cell's direct counted owner through its explicit slot when available. */
+    public boolean releaseScalarValueOwnerCount(RuntimeBase expectedReferent, String releaseSite) {
         PerlOwnerSlot slot = scalarValueOwnerSlot;
         return slot != null && slot.releaseScalarValueCount(expectedReferent, releaseSite);
     }

From af67d257e90ee54676c64c2be72d6f3f969d2894 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 03:20:54 +0100
Subject: [PATCH 288/317] fix: transfer scalar owner slots through postfix
 results

Move the existing SCALAR_VALUE slot and owner diagnostics from the mutated lvalue to the postfix result. When assignment installs the destination owner, release the temporary through the slot API. Add focused increment/decrement tests for stable slot identity and count balance.

Generated with Codex (https://openai.com/codex/)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          |  8 +++
 .../runtime/runtimetypes/PerlOwnerSlot.java   | 17 ++++++
 .../runtime/runtimetypes/RuntimeBase.java     | 19 ++++++
 .../runtime/runtimetypes/RuntimeScalar.java   | 47 +++++++++++----
 ...RuntimeScalarPostfixOwnerTransferTest.java | 58 +++++++++++++++++++
 5 files changed, 139 insertions(+), 10 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarPostfixOwnerTransferTest.java

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 542ac12dea..4f0872684c 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -119,6 +119,14 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
 
 ### Current batch
 
+- Postfix increment/decrement now transfers the stable `SCALAR_VALUE` slot from
+  the mutated lvalue to its returned scalar. Assignment of that result releases
+  the temporary through the slot API after acquiring the destination owner.
+  New Java coverage checks slot identity and verifies one owner is represented
+  by exactly one live slot for both `++` and `--`. This closes a ledger mismatch
+  where the old implementation manually decremented `refCount` but left the
+  temporary's owner slot active. Full `nice -n 19 make` passes in 14m45s; both
+  focused Java cases pass.
 - `Storable.releaseApplyArgs()` now releases materialized argument owners through
   `SCALAR_VALUE` slots when available, retaining the legacy fallback for older
   cells. Its existing Java regression retires the legacy ownership flag before
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
index 1f8aa179b7..44803ae1dc 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
@@ -397,6 +397,23 @@ synchronized boolean acquireScalarValueCount(RuntimeBase target, String acquireS
         return true;
     }
 
+    /** Move the stable direct-scalar owner identity to a postfix result cell. */
+    synchronized boolean transferScalarValueCell(
+            RuntimeScalar expectedOwner, RuntimeScalar nextOwner) {
+        if (kind != Kind.SCALAR_VALUE) {
+            throw new IllegalStateException(
+                    "scalar-value transfer requires a SCALAR_VALUE slot");
+        }
+        if (expectedOwner == null || nextOwner == null
+                || referent == null || ownerCell() != expectedOwner) {
+            return false;
+        }
+        ownerCell = new WeakReference<>(nextOwner);
+        expectedOwner.refCountOwned = false;
+        nextOwner.refCountOwned = true;
+        return true;
+    }
+
     /**
      * Release the legacy counted edge represented by a direct scalar-value
      * slot. The caller retains lifecycle policy (for example, whether a
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
index b4f92d30b6..1dd44afcc6 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeBase.java
@@ -454,6 +454,25 @@ public synchronized void releaseActiveOwner(RuntimeScalar scalar) {
         }
     }
 
+    /** Transfer legacy owner diagnostics along with a migrated scalar-value slot. */
+    synchronized void transferScalarOwner(RuntimeScalar previous, RuntimeScalar next,
+                                          String transferSite) {
+        if (previous == null || next == null) return;
+        if (refCountTrace && REFCOUNT_TRACE_ENV) {
+            java.util.LinkedHashMap<Integer, OwnerTrace> owners = traceOwners.get(this);
+            if (owners != null) {
+                OwnerTrace prior = owners.remove(System.identityHashCode(previous));
+                String acquireSite = prior == null
+                        ? "<owner transferred at " + transferSite + ">"
+                        : prior.acquireSite;
+                owners.put(System.identityHashCode(next), new OwnerTrace(next, acquireSite));
+            }
+        }
+        if (activeOwners != null && activeOwners.remove(previous)) {
+            activeOwners.add(next);
+        }
+    }
+
     public synchronized int activeOwnerCount() {
         if (activeOwners == null) return 0;
         // Filter for actual still-owning scalars: refCountOwned=true and
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 834641a622..2871089ff5 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -851,6 +851,7 @@ void retainClosureCaptureReferentsForUnweaken() {
 
     /** A postfix ++/-- result transfers, rather than duplicates, its reference owner on assignment. */
     private boolean postfixReferenceOwnershipTransfer;
+    private boolean postfixReferenceOwnerSlotTransferred;
 
     /**
      * True for the synthetic {@code $_[0]} scalar passed to DESTROY.
@@ -2329,16 +2330,46 @@ public RuntimeScalar addToScalar(RuntimeScalar scalar) {
         RuntimeScalar result = scalar.set(this);
         if (postfixReferenceOwnershipTransfer) {
             postfixReferenceOwnershipTransfer = false;
+            boolean transferredOwnerSlot = postfixReferenceOwnerSlotTransferred;
+            postfixReferenceOwnerSlotTransferred = false;
             if ((type & REFERENCE_BIT) != 0 && value instanceof RuntimeBase base
-                    && base.refCount > 0) {
-                // set() acquired the destination owner; cancel the extra
-                // increment because this temporary's owner was transferred.
-                base.refCount--;
+                    && ownsCountedReferent(base)) {
+                // set() acquired the destination owner. Retire this temporary's
+                // transferred owner through its stable slot so the ledger and
+                // lifecycle bridge both lose exactly one owner.
+                if (!transferredOwnerSlot || !releaseScalarValueOwnerCount(
+                        base, "RuntimeScalar.addToScalar postfix owner transfer")) {
+                    if (base.refCount > 0) base.refCount--;
+                    setRefCountOwned(false);
+                }
             }
         }
         return result;
     }
 
+    private void transferPostfixOwnerTo(RuntimeScalar result) {
+        RuntimeBase referent = value instanceof RuntimeBase base ? base : null;
+        PerlOwnerSlot slot = scalarValueOwnerSlot;
+        if (referent != null && slot != null && slot.referent() == referent
+                && slot.transferScalarValueCell(this, result)) {
+            scalarValueOwnerSlot = null;
+            result.scalarValueOwnerSlot = slot;
+            referent.transferScalarOwner(this, result, "RuntimeScalar postfix result");
+            result.postfixReferenceOwnerSlotTransferred = true;
+        } else {
+            // Legacy and borrowed aliases may not yet have a transferable slot.
+            boolean transferredLegacyOwner = referent != null
+                    && ownsCountedReferent(referent);
+            if (transferredLegacyOwner) {
+                referent.transferScalarOwner(this, result, "RuntimeScalar postfix result");
+            }
+            result.setRefCountOwned(true);
+            setRefCountOwned(false);
+            result.postfixReferenceOwnerSlotTransferred = transferredLegacyOwner;
+        }
+        result.postfixReferenceOwnershipTransfer = true;
+    }
+
     /**
      * Store a Perl expression value into an assignment target.
      *
@@ -6323,9 +6354,7 @@ private RuntimeScalar postAutoIncrementLarge() {
                 // returned reference becomes the first durable owner.  The
                 // assignment receiving this scalar will balance the temporary
                 // copy, so retain one cleanup token for that returned value.
-                old.setRefCountOwned(true);
-                old.postfixReferenceOwnershipTransfer = true;
-                this.setRefCountOwned(false);
+                transferPostfixOwnerTo(old);
                 // Check if object is eligible for overloading
                 int blessId = blessedId(this);
                 if (blessId != 0) {
@@ -6634,9 +6663,7 @@ private RuntimeScalar postAutoDecrementWithoutWatcherNotification() {
             default -> { // All reference types
                 // See postAutoIncrementLarge(): the returned pre-mutation
                 // reference inherits this lvalue's ownership token.
-                old.setRefCountOwned(true);
-                old.postfixReferenceOwnershipTransfer = true;
-                this.setRefCountOwned(false);
+                transferPostfixOwnerTo(old);
                 // Check if object is eligible for overloading
                 int blessId = blessedId(this);
                 if (blessId != 0) {
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarPostfixOwnerTransferTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarPostfixOwnerTransferTest.java
new file mode 100644
index 0000000000..f00fd261f2
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeScalarPostfixOwnerTransferTest.java
@@ -0,0 +1,58 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("unit")
+class RuntimeScalarPostfixOwnerTransferTest {
+    @Test
+    void postfixIncrementMovesAndThenReleasesTheScalarValueSlot() {
+        assertPostfixOwnerTransfer(true);
+    }
+
+    @Test
+    void postfixDecrementMovesAndThenReleasesTheScalarValueSlot() {
+        assertPostfixOwnerTransfer(false);
+    }
+
+    private static void assertPostfixOwnerTransfer(boolean increment) {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeArray referent = new RuntimeArray();
+            RuntimeScalar source = new RuntimeScalar();
+            source.set(referent.createAnonymousReference());
+            PerlOwnerSlot originalSlot = source.scalarValueOwnerSlot();
+            assertNotNull(originalSlot);
+            assertEquals(1, referent.refCount);
+
+            RuntimeScalar postfix = increment
+                    ? source.postAutoIncrement()
+                    : source.postAutoDecrement();
+
+            assertNull(source.scalarValueOwnerSlot(),
+                    "the lvalue no longer owns the old reference after postfix mutation");
+            assertTrue(originalSlot.isActive());
+            assertEquals(originalSlot.identity(), postfix.scalarValueOwnerSlot().identity(),
+                    "the returned scalar inherits the same owner-slot identity");
+            assertEquals(1, referent.refCount);
+
+            RuntimeScalar destination = new RuntimeScalar();
+            postfix.addToScalar(destination);
+
+            assertFalse(originalSlot.isActive(),
+                    "assignment consumes the postfix temporary owner");
+            assertTrue(destination.scalarValueOwnerSlot().isActive());
+            assertFalse(postfix.scalarValueOwnerSlot().isActive(),
+                    "the consumed slot remains attached only as an inactive reusable token");
+            assertEquals(1, referent.refCount);
+            assertEquals(1, referent.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE),
+                    "one counted owner has exactly one live scalar-value slot");
+        }
+    }
+}

From d7b3aefeffe0538d53a743ccfcf06886d52f170b Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 03:43:23 +0100
Subject: [PATCH 289/317] docs: record global CODE ownership boundary

Package-global CODE roots still use counted-root ownership. Record that their
acquisition and release must migrate together before replacing the legacy
release path.

Generated with OpenAI Codex (https://openai.com/codex)
Co-Authored-By: OpenAI Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 4f0872684c..300d84e009 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -111,6 +111,12 @@ Phase numbers are delivery boundaries, not estimates of the total project.
 The 20–36 engineer-week estimate remains provisional until the ownership audit
 and first path establish implementation cost.
 
+Package-global CODE roots are not currently `SCALAR_VALUE` slot owners: their
+assignment path maintains the legacy counted-root ownership state, and
+`RuntimeScalar.undefine` releases that state. Migrating the CODE release
+decrement alone would not create direct slot accounting; CODE-root acquisition
+and release need to move together in Phase 4.
+
 ## Progress tracking
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)

From 5884a6be237f800a120143c35e097147ef640617 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 04:26:16 +0100
Subject: [PATCH 290/317] fix: release tracked global CODE owner slots on undef

Move global CODE owner release ahead of the generic undefineCodeReference
return, which previously bypassed the slot cleanup path. Keep saved coderef
aliases observing the undefined CV and retain the legacy bridge fallback.

Generated with OpenAI Codex (https://openai.com/codex)
Co-Authored-By: OpenAI Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          | 14 ++++---
 .../runtime/runtimetypes/RuntimeScalar.java   | 40 ++++++++++++++-----
 .../GlobalCodeRuntimeIsolationTest.java       | 30 ++++++++++++++
 3 files changed, 69 insertions(+), 15 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 300d84e009..035b27b360 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -111,11 +111,15 @@ Phase numbers are delivery boundaries, not estimates of the total project.
 The 20–36 engineer-week estimate remains provisional until the ownership audit
 and first path establish implementation cost.
 
-Package-global CODE roots are not currently `SCALAR_VALUE` slot owners: their
-assignment path maintains the legacy counted-root ownership state, and
-`RuntimeScalar.undefine` releases that state. Migrating the CODE release
-decrement alone would not create direct slot accounting; CODE-root acquisition
-and release need to move together in Phase 4.
+Tracked package-global CODE refs (`refCount >= 0`) receive `SCALAR_VALUE` slots
+through scalar assignment; untracked CODE refs (`refCount == -1`) correctly
+remain outside counted ownership. `RuntimeScalar.undefine` now releases the
+tracked slot when present and retains the legacy bridge for older or untracked
+cells. The global CODE path performs this release before its early return
+through `RuntimeCode.undefineCodeReference`; saved aliases still observe the
+undefined CV. A focused Java regression verifies the final tracked CODE owner
+retires its slot and still dispatches lifecycle cleanup. `nice -n 19 make`
+passes in 13m26s on this batch.
 
 ## Progress tracking
 
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 2871089ff5..6ade786ec5 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -5335,20 +5335,21 @@ public RuntimeScalar undefine() {
         }
         if (type == RuntimeScalarType.CODE && value instanceof RuntimeCode code
                 && !(code.isConstantCv && code.lexicalSubDisplayName)) {
+            if (globalCodeRefFqn != null) {
+                releaseAllClosureCaptureReferents(code);
+                boolean releasedCode = releaseGlobalCodeOwnerCount(code);
+                RuntimeCode.undefineCodeReference(this);
+                if (releasedCode && WeakRefRegistry.weakRefsExist()
+                        && !ModuleInitGuard.inModuleInit()) {
+                    ReachabilityWalker.sweepWeakRefs(true);
+                }
+                return this;
+            }
             return RuntimeCode.undefineCodeReference(this);
         }
         if (type == RuntimeScalarType.CODE && value instanceof RuntimeCode code && globalCodeRefFqn != null) {
-            boolean releasedCode = false;
             releaseAllClosureCaptureReferents(code);
-            if (this.ownsCountedReferent(code) && code.refCount > 0) {
-                this.setRefCountOwned(false);
-                code.releaseActiveOwner(this);
-                if (--code.refCount == 0) {
-                    code.refCount = Integer.MIN_VALUE;
-                    DestroyDispatch.callDestroy(code);
-                    releasedCode = true;
-                }
-            }
+            boolean releasedCode = releaseGlobalCodeOwnerCount(code);
             // Clear the body but keep a declared CODE slot. Perl preserves the
             // glob's CODE entry after both `undef &existing` and
             // `undef &previously_unknown`: exists(&name) remains true while
@@ -5519,6 +5520,25 @@ public RuntimeScalar undefine() {
         return this;
     }
 
+    private boolean releaseGlobalCodeOwnerCount(RuntimeCode code) {
+        if (!this.ownsCountedReferent(code) || code.refCount <= 0) {
+            return false;
+        }
+        boolean releasedExplicitSlot =
+                releaseScalarValueOwnerCount(code, "RuntimeScalar.undefine global CODE");
+        if (!releasedExplicitSlot) {
+            this.setRefCountOwned(false);
+            code.releaseActiveOwner(this);
+            code.refCount--;
+        }
+        if (code.refCount != 0) {
+            return false;
+        }
+        code.refCount = Integer.MIN_VALUE;
+        DestroyDispatch.callDestroy(code);
+        return true;
+    }
+
     /**
      * Close any IO handle associated with a GLOBREFERENCE value being dropped.
      * <p>
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/GlobalCodeRuntimeIsolationTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/GlobalCodeRuntimeIsolationTest.java
index aa1d0e359f..7785607a50 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/GlobalCodeRuntimeIsolationTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/GlobalCodeRuntimeIsolationTest.java
@@ -69,6 +69,36 @@ void codeSlotsPinsCompiledIdsAndImportedSubFlagsBelongToTheBoundRuntime() {
         }
     }
 
+    @Test
+    void undefiningTrackedGlobalCodeReleasesItsScalarOwnerSlot() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            String name = "Phase8bLowLevel::tracked_code";
+            RuntimeScalar codeValue = codeScalar("tracked", null, name);
+            RuntimeCode code = (RuntimeCode) codeValue.value;
+            code.refCount = 0;
+
+            RuntimeScalar globalCode = GlobalVariable.getGlobalCodeRef(name);
+            globalCode.set(codeValue);
+            PerlOwnerSlot ownerSlot = globalCode.scalarValueOwnerSlot();
+
+            assertNotNull(ownerSlot, "tracked global CODE has a scalar owner slot");
+            assertTrue(ownerSlot.isActive());
+            assertEquals(1, code.refCount);
+            assertEquals(1, code.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+
+            globalCode.undefine();
+
+            assertFalse(ownerSlot.isActive(), "undef retires the CODE owner slot");
+            assertEquals(0, code.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+            assertEquals(Integer.MIN_VALUE, code.refCount,
+                    "the final tracked CODE owner still dispatches lifecycle cleanup");
+            assertSame(code, globalCode.value,
+                    "the global CODE entry keeps the undefined CV for existing aliases");
+            assertTrue(code.codeReferenceUndefined);
+        }
+    }
+
     @Test
     void conflictingNamedSubsAndRedefinitionStayIsolatedOnJvmAndInterpreter() throws Exception {
         for (boolean interpreter : new boolean[]{false, true}) {

From 87cf2359ce21551d1c1b5ced73c61919c2139315 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 04:50:58 +0100
Subject: [PATCH 291/317] fix: release localized glob CODE owner slots

Restore localized CODE refs through their scalar owner slot when present,
retiring the slot with the count before lifecycle dispatch. Keep the legacy
count bridge for older cells and add a focused restoration regression.

Generated with OpenAI Codex (https://openai.com/codex)
Co-Authored-By: OpenAI Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          |  5 +++
 .../runtime/runtimetypes/RuntimeGlob.java     |  8 +++-
 .../RuntimeGlobCodeOwnerSlotTest.java         | 43 +++++++++++++++++++
 3 files changed, 55 insertions(+), 1 deletion(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeGlobCodeOwnerSlotTest.java

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 035b27b360..3e33cbeed5 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -144,6 +144,11 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   direct slot-release API rather than detaching the slot after a manual count
   decrement. Full `nice -n 19 make` passes in 15m05s; the focused test passes
   with zero failures.
+- `RuntimeGlob.dynamicRestoreState()` now retires a tracked temporary CODE
+  scalar through its `SCALAR_VALUE` slot before dispatching final cleanup, with
+  the legacy bridge retained for older cells. `RuntimeGlobCodeOwnerSlotTest`
+  verifies the slot and count both retire. Full `nice -n 19 make` passes in
+  13m21s on this batch.
 - On 2026-10-24, tied scalar, array, hash, and handle wrappers now record
   handler ownership in distinct `TIE_WRAPPER` slots. A wrapper installed while
   its handler has the untracked sentinel remains uncounted until rooted owner
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGlob.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGlob.java
index 60034d867b..fb912b4030 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGlob.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGlob.java
@@ -2310,6 +2310,8 @@ && hasDestroyMethod(displacedBase)) {
         RuntimeScalar localCode = GlobalVariable.globalCodeRefs.get(snap.globName);
         RuntimeCode removedLocalCodeForReachabilityCheck = null;
         if (localCode != null && (localCode.type & REFERENCE_BIT) != 0 && localCode.value instanceof RuntimeBase localBase) {
+            boolean releasedScalarOwnerSlot = localCode.releaseScalarValueOwnerCount(
+                    localBase, "RuntimeGlob.dynamicRestoreState local CODE release");
             boolean removedLastStashRef = false;
             // Decrement stashRefCount on the local scope's CODE ref being removed
             if (localBase instanceof RuntimeCode localCodeObj) {
@@ -2318,7 +2320,11 @@ && hasDestroyMethod(displacedBase)) {
                     removedLastStashRef = localCodeObj.stashRefCount == 0;
                 }
             }
-            if (localBase.refCount > 0 && --localBase.refCount == 0) {
+            if (!releasedScalarOwnerSlot && localBase.refCount > 0) {
+                localCode.setRefCountOwned(false);
+                localBase.releaseActiveOwner(localCode);
+            }
+            if (!releasedScalarOwnerSlot && localBase.refCount > 0 && --localBase.refCount == 0) {
                 localBase.refCount = Integer.MIN_VALUE;
                 DestroyDispatch.callDestroy(localBase);
             } else if (localBase.refCount == 0 && localBase instanceof RuntimeCode) {
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeGlobCodeOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeGlobCodeOwnerSlotTest.java
new file mode 100644
index 0000000000..c016fa1205
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeGlobCodeOwnerSlotTest.java
@@ -0,0 +1,43 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("unit")
+class RuntimeGlobCodeOwnerSlotTest {
+    @Test
+    void restoringLocalizedGlobRetiresTrackedTemporaryCodeOwnerSlot() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            String name = "LocalizedCodeOwner::callback";
+            RuntimeCode localCodeValue = new RuntimeCode(
+                    (args, context) -> new RuntimeList(), null);
+            localCodeValue.refCount = 0;
+            RuntimeScalar localCodeSource = new RuntimeScalar(localCodeValue);
+            RuntimeGlob glob = new RuntimeGlob(name);
+
+            glob.dynamicSaveState();
+            RuntimeScalar localCode = GlobalVariable.globalCodeRefs.get(name);
+            localCode.set(localCodeSource);
+            PerlOwnerSlot ownerSlot = localCode.scalarValueOwnerSlot();
+
+            assertNotNull(ownerSlot);
+            assertTrue(ownerSlot.isActive());
+            assertEquals(1, localCodeValue.refCount);
+            assertEquals(1, localCodeValue.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+
+            glob.dynamicRestoreState();
+
+            assertFalse(ownerSlot.isActive(),
+                    "restoring the glob retires the temporary CODE scalar owner slot");
+            assertEquals(0, localCodeValue.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+            assertEquals(Integer.MIN_VALUE, localCodeValue.refCount,
+                    "the final temporary CODE owner still dispatches cleanup");
+        }
+    }
+}

From 5bb309fccab07619514c896814ae69ba5697854c Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 04:57:18 +0100
Subject: [PATCH 292/317] docs: clarify aggregate owner slot migration boundary

Document that current hash and array slots provide reachability identity while
scalar cells still carry counted ownership. Record the coordinated store and
release work required before aggregate recovery can be removed.

Generated with OpenAI Codex (https://openai.com/codex)
Co-Authored-By: OpenAI Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 3e33cbeed5..d477a619d7 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -191,8 +191,16 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   scalar-reference contents; the current synthetic tests are not sufficient
   evidence to replace the scan. After the diagnostic review, default behavior
   passes full `nice -n 19 make` in 39m43s; offline documentation link checking
-  also passes. A source audit found generic deferred decrements that do not
-  carry a semantic owner slot. The fallback in
+  also passes.
+  Aggregate slots are currently reachability identities rather than count
+  owners: `RuntimeHash.updateHashEntryOwner` and array reconciliation attach
+  `HASH_ENTRY`/`ARRAY_ELEMENT` slots without changing `refCount`, while the
+  contained scalar cell generally owns the count through `SCALAR_VALUE`.
+  Removing recovery requires moving acquisition and release together across
+  aggregate insertion, replacement, deletion, aliases, and borrowed scalar
+  references. Counting structural slots before retiring the scalar-cell edge
+  would double-count ordinary copied SVs. A source audit found generic
+  deferred decrements that do not carry a semantic owner slot. The fallback in
   `RuntimeScalar.deferOwnedScalarReferenceContents` was unreachable: it
   required an active contents slot after the method had already returned
   through that slot's deferred-release path. Removed the dead generic decrement

From f77e06640160c8195bdf5ffdbac34172b470bcbf Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 05:24:06 +0100
Subject: [PATCH 293/317] fix: release owners after middle array deletion

Defer the tracked reference and I/O owner release after removing a non-final
array element, preserving the delete result until callers can retain it.
Add a regression for DESTROY timing across both execution backends and system
Perl, and document the compatibility fix.

Generated with Codex (https://openai.com/codex)
Co-Authored-By: Codex <codex@openai.com>
---
 docs/about/changelog.md                       |  1 +
 .../runtime/runtimetypes/RuntimeArray.java    |  9 +++++
 .../array_middle_delete_releases_owner.t      | 37 +++++++++++++++++++
 3 files changed, 47 insertions(+)
 create mode 100644 src/test/resources/unit/refcount/array_middle_delete_releases_owner.t

diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index d55bb8f0e8..b8485a13f7 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -15,6 +15,7 @@ priorities and future plans.
 - Preserve reference-valued FETCH results from tied-hash `values()` and retain scalar-reference envelopes in Storable round trips (#1554, #1468).
 - Preserve tied-handler lifetimes when wrappers are created before selective reference counting begins.
 - Release temporary files once an exited closure capture retaining a Catalyst request context no longer has a live Perl root.
+- Release tracked reference owners after deleting a middle array element while preserving the returned value's lifetime.
 - Ignore commented-out code when checking lexical constant closures for later mutations, preserving BEGIN-time generated constants (#1785).
 - Pack the method-dispatch inline-cache guard key into one primitive value while preserving class and method invalidation checks.
 - Keep watcher maps and live `substr`-lvalue observers in lazy scalar extension state, reducing the common `RuntimeScalar` footprint.
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
index 183ebd0aaf..82da30a2c7 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
@@ -1309,6 +1309,15 @@ public RuntimeScalar delete(int index) {
                 }
                 RuntimeScalar previous = this.get(index);
                 this.elements.set(index, null);
+                // A middle delete leaves the scalar cell available as the
+                // operator result, but the removed cell no longer owns this
+                // reference through the array. Defer its owner release so an
+                // assignment can first retain the returned value, matching
+                // RuntimeHash.deleteInContext and pop/shift.
+                if (previous != null && !previous.hasOwningAggregateSlot()) {
+                    MortalList.deferDecrementIfTracked(previous);
+                    MortalList.deferIoOwnerRelease(previous);
+                }
                 yield previous;
             }
             case AUTOVIVIFY_ARRAY -> scalarUndef;
diff --git a/src/test/resources/unit/refcount/array_middle_delete_releases_owner.t b/src/test/resources/unit/refcount/array_middle_delete_releases_owner.t
new file mode 100644
index 0000000000..ed8022fd74
--- /dev/null
+++ b/src/test/resources/unit/refcount/array_middle_delete_releases_owner.t
@@ -0,0 +1,37 @@
+use strict;
+use warnings;
+use Test::More;
+use Scalar::Util qw(weaken);
+
+{
+    package ArrayMiddleDeleteProbe;
+    our $DESTROYED = 0;
+    sub new { bless {}, shift }
+    sub DESTROY { ++$DESTROYED }
+}
+
+my $weak;
+my $deleted;
+{
+    my @values = (ArrayMiddleDeleteProbe->new,
+                  ArrayMiddleDeleteProbe->new,
+                  ArrayMiddleDeleteProbe->new);
+    $weak = $values[1];
+    weaken($weak);
+
+    $deleted = delete $values[1];
+    is($ArrayMiddleDeleteProbe::DESTROYED, 0,
+       'deleted value stays alive while delete result is held');
+    is(ref($weak), 'ArrayMiddleDeleteProbe',
+       'weak reference observes the held delete result');
+
+    undef $deleted;
+    is($ArrayMiddleDeleteProbe::DESTROYED, 1,
+       'middle element owner is released after delete result is dropped');
+    ok(!defined($weak), 'weak reference clears when deleted value is destroyed');
+}
+
+is($ArrayMiddleDeleteProbe::DESTROYED, 3,
+   'remaining array elements are destroyed at scope exit');
+
+done_testing;

From f7925610d964185f65b9c479212866ec214745e9 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 05:26:17 +0100
Subject: [PATCH 294/317] docs: record array delete ownership progress

Update the ownership migration notes with the confirmed middle-array-delete
lifetime bug, regression evidence, and the still-open recovery callers.

Generated with Codex (https://openai.com/codex)
Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index d477a619d7..885e965e19 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -156,6 +156,14 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   consume a later scalar owner's count. Root recovery includes live wrapper
   slots from rooted owner containers. The wrapper-slot batch passed full
   `nice -n 19 make` in 27m21s.
+- On 2026-10-25, deleting a non-final array element now defers release of its
+  tracked scalar-value and I/O owners after removing the structural array slot.
+  A new DESTROY/weak-reference regression failed on the pre-fix JVM and passes
+  under system Perl, JVM, and interpreter. The fix preserves a captured delete
+  result until its caller can retain it. Full `nice -n 19 make` passes in
+  14m53s; `make check-links` passes. Recovery still has the two production
+  callers described below; this fix closes one concrete array deletion edge
+  without establishing direct owner-slot accounting across aggregates.
 - The temporary `perlonjava.test.disableAggregateOwnerRecovery` diagnostic was
   removed after the no-recovery audit. The two production call sites in
   `MortalList.processDeferredBase` and `RuntimeScalar.setLargeRefCounted` still

From 734f25dd74fdb699d0e35a7b4dc4f81ae8794422 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 05:39:24 +0100
Subject: [PATCH 295/317] docs: record focused lifetime regression results

Record the issue-specific controller, WebSocket, and Catalyst tempfile tests
passing on both execution backends after the array owner-release fix.

Generated with Codex (https://openai.com/codex)
Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 885e965e19..cc767e79e3 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -163,7 +163,10 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   result until its caller can retain it. Full `nice -n 19 make` passes in
   14m53s; `make check-links` passes. Recovery still has the two production
   callers described below; this fix closes one concrete array deletion edge
-  without establishing direct owner-slot accounting across aggregates.
+  without establishing direct owner-slot accounting across aggregates. The
+  focused #1794 transaction-controller and WebSocket tests, and #1795 Catalyst
+  tempfile test, also pass on JVM and interpreter; the WebSocket test required
+  loopback-enabled extended access and passes all six assertions on both.
 - The temporary `perlonjava.test.disableAggregateOwnerRecovery` diagnostic was
   removed after the no-recovery audit. The two production call sites in
   `MortalList.processDeferredBase` and `RuntimeScalar.setLargeRefCounted` still

From d444be9e2a04ff78d3c408fda89692c6eebbfdf1 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 06:01:38 +0100
Subject: [PATCH 296/317] fix: preserve borrowed owners on middle array delete

Only defer the deleted scalar's owner release when the array owns that
particular element. This keeps borrowed @_ aliases from releasing a caller's
reference while retaining cleanup for ordinary array elements.

Add a system-Perl-validated regression for DESTROY timing and update the
ownership notes and changelog. Full nice -n 19 make passes.

Generated with Codex (https://openai.com/codex)
Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          |  6 ++++
 docs/about/changelog.md                       |  2 +-
 .../runtime/runtimetypes/RuntimeArray.java    |  8 +++---
 .../array_delete_borrowed_alias_lifetime.t    | 28 +++++++++++++++++++
 4 files changed, 39 insertions(+), 5 deletions(-)
 create mode 100644 src/test/resources/unit/refcount/array_delete_borrowed_alias_lifetime.t

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index cc767e79e3..708923d6ea 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -167,6 +167,12 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   focused #1794 transaction-controller and WebSocket tests, and #1795 Catalyst
   tempfile test, also pass on JVM and interpreter; the WebSocket test required
   loopback-enabled extended access and passes all six assertions on both.
+- The middle-delete release was then guarded by `ownsElement`: deleting a
+  borrowed middle argument from `@_` had prematurely destroyed the caller's
+  object. The new regression failed on both backends before the guard and passes
+  on system Perl, JVM, and interpreter afterward. The middle-delete and
+  borrowed-alias regressions pass together in the full gate (`14m15s`) and in
+  focused runs on both backends.
 - The temporary `perlonjava.test.disableAggregateOwnerRecovery` diagnostic was
   removed after the no-recovery audit. The two production call sites in
   `MortalList.processDeferredBase` and `RuntimeScalar.setLargeRefCounted` still
diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index b8485a13f7..c475390d7a 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -15,7 +15,7 @@ priorities and future plans.
 - Preserve reference-valued FETCH results from tied-hash `values()` and retain scalar-reference envelopes in Storable round trips (#1554, #1468).
 - Preserve tied-handler lifetimes when wrappers are created before selective reference counting begins.
 - Release temporary files once an exited closure capture retaining a Catalyst request context no longer has a live Perl root.
-- Release tracked reference owners after deleting a middle array element while preserving the returned value's lifetime.
+- Release tracked reference owners after deleting a middle array element while preserving the returned value's lifetime and borrowed aliases.
 - Ignore commented-out code when checking lexical constant closures for later mutations, preserving BEGIN-time generated constants (#1785).
 - Pack the method-dispatch inline-cache guard key into one primitive value while preserving class and method invalidation checks.
 - Keep watcher maps and live `substr`-lvalue observers in lazy scalar extension state, reducing the common `RuntimeScalar` footprint.
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
index 82da30a2c7..da9c3e185a 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
@@ -1311,10 +1311,10 @@ public RuntimeScalar delete(int index) {
                 this.elements.set(index, null);
                 // A middle delete leaves the scalar cell available as the
                 // operator result, but the removed cell no longer owns this
-                // reference through the array. Defer its owner release so an
-                // assignment can first retain the returned value, matching
-                // RuntimeHash.deleteInContext and pop/shift.
-                if (previous != null && !previous.hasOwningAggregateSlot()) {
+                // reference through an owning array. Borrowed aliases such as
+                // @_ must not release the caller's scalar owner. Defer the
+                // owner release so assignment can first retain the result.
+                if (ownsElement(previous) && !previous.hasOwningAggregateSlot()) {
                     MortalList.deferDecrementIfTracked(previous);
                     MortalList.deferIoOwnerRelease(previous);
                 }
diff --git a/src/test/resources/unit/refcount/array_delete_borrowed_alias_lifetime.t b/src/test/resources/unit/refcount/array_delete_borrowed_alias_lifetime.t
new file mode 100644
index 0000000000..10e22ccc90
--- /dev/null
+++ b/src/test/resources/unit/refcount/array_delete_borrowed_alias_lifetime.t
@@ -0,0 +1,28 @@
+use strict;
+use warnings;
+use Test::More;
+
+{
+    package ArrayDeleteBorrowedAliasProbe;
+    our $DESTROYED = 0;
+    sub new { bless {}, shift }
+    sub DESTROY { ++$DESTROYED }
+}
+
+sub delete_middle_argument {
+    delete $_[1];
+    is($ArrayDeleteBorrowedAliasProbe::DESTROYED, 0,
+       'deleting a borrowed middle argument does not release its caller owner');
+}
+
+my $left = [];
+my $object = ArrayDeleteBorrowedAliasProbe->new;
+my $right = [];
+delete_middle_argument($left, $object, $right);
+is($ArrayDeleteBorrowedAliasProbe::DESTROYED, 0,
+   'caller still owns object after the subroutine returns');
+undef $object;
+is($ArrayDeleteBorrowedAliasProbe::DESTROYED, 1,
+   'object is destroyed when its caller owner is released');
+
+done_testing;

From 3e01c5951903bd33d668762f389cfe7a9a2f589c Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 06:26:04 +0100
Subject: [PATCH 297/317] fix: restore borrowed ownership after local array
 delete

Remember whether a localized array element was borrowed or owned and restore
that classification after reinstating the slot. Otherwise restoring an @_ alias
marks it as owned and argument-frame cleanup releases the caller's reference.

Add a DESTROY timing regression verified on system Perl and both backends.
Update the ownership migration notes and changelog.

Generated with Codex (https://openai.com/codex)
Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          |  8 ++++++
 docs/about/changelog.md                       |  2 +-
 .../runtime/runtimetypes/RuntimeArray.java    |  9 ++++++
 ...ray_delete_local_borrowed_alias_lifetime.t | 28 +++++++++++++++++++
 4 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 src/test/resources/unit/refcount/array_delete_local_borrowed_alias_lifetime.t

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 708923d6ea..02dd2f877f 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -173,6 +173,14 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   on system Perl, JVM, and interpreter afterward. The middle-delete and
   borrowed-alias regressions pass together in the full gate (`14m15s`) and in
   focused runs on both backends.
+- A related localized-delete path restored a borrowed `@_` slot through the
+  ordinary aliased-array setter, which marked it as owned. Argument-frame
+  cleanup then decremented the caller's object after the subroutine returned.
+  `RuntimeArray.deleteLocal` now snapshots and restores the slot's prior
+  ownership state. The regression failed on the pre-fix JVM and passes on
+  system Perl, JVM, and interpreter. The new change passes full
+  `nice -n 19 make` (`13m42s`); all three array-delete ownership regressions
+  pass focused on both backends.
 - The temporary `perlonjava.test.disableAggregateOwnerRecovery` diagnostic was
   removed after the no-recovery audit. The two production call sites in
   `MortalList.processDeferredBase` and `RuntimeScalar.setLargeRefCounted` still
diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index c475390d7a..978f0d094f 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -15,7 +15,7 @@ priorities and future plans.
 - Preserve reference-valued FETCH results from tied-hash `values()` and retain scalar-reference envelopes in Storable round trips (#1554, #1468).
 - Preserve tied-handler lifetimes when wrappers are created before selective reference counting begins.
 - Release temporary files once an exited closure capture retaining a Catalyst request context no longer has a live Perl root.
-- Release tracked reference owners after deleting a middle array element while preserving the returned value's lifetime and borrowed aliases.
+- Release tracked reference owners after array deletion while preserving returned-value lifetimes and borrowed aliases, including localized `@_` slots.
 - Ignore commented-out code when checking lexical constant closures for later mutations, preserving BEGIN-time generated constants (#1785).
 - Pack the method-dispatch inline-cache guard key into one primitive value while preserving class and method invalidation checks.
 - Keep watcher maps and live `substr`-lvalue observers in lazy scalar extension state, reducing the common `RuntimeScalar` footprint.
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
index da9c3e185a..f46bcada3b 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
@@ -1471,6 +1471,7 @@ public void dynamicRestoreState() {
                 ? elements.get(index) : null;
         boolean existed = existingElement != null
                 && !(existingElement instanceof RuntimeArrayProxyEntry proxy && !proxy.hasLvalue());
+        boolean savedOwnedElement = existed && ownsElement(existingElement);
         // local must restore the original slot, not a scalar copy of it.  An
         // array entry can be ref-aliased (for example, `$a[0]` aliased to
         // `$_`), and copying the wrapper here loses that alias identity when
@@ -1532,6 +1533,14 @@ && isEmptyLocalPlaceholder(self.elements.getLast())) {
                 if (existed) {
                     if (idx < self.elements.size()) {
                         self.elements.set(idx, savedValue);
+                        if (!savedOwnedElement) {
+                            // Setting an element on an aliased array normally
+                            // marks it as a newly owned slot. Restoration must
+                            // recover the borrowed/owned status from before
+                            // localization, or @_ cleanup can release the
+                            // caller's scalar owner.
+                            self.forgetOwnedAliasElement(savedValue);
+                        }
                     }
                 } else if (idx >= 0 && idx < self.elements.size()) {
                     self.elements.set(idx, null);
diff --git a/src/test/resources/unit/refcount/array_delete_local_borrowed_alias_lifetime.t b/src/test/resources/unit/refcount/array_delete_local_borrowed_alias_lifetime.t
new file mode 100644
index 0000000000..e46dbc5e82
--- /dev/null
+++ b/src/test/resources/unit/refcount/array_delete_local_borrowed_alias_lifetime.t
@@ -0,0 +1,28 @@
+use strict;
+use warnings;
+use Test::More;
+
+{
+    package ArrayDeleteLocalBorrowedAliasProbe;
+    our $DESTROYED = 0;
+    sub new { bless {}, shift }
+    sub DESTROY { ++$DESTROYED }
+}
+
+sub local_delete_middle_argument {
+    delete local $_[1];
+    is($ArrayDeleteLocalBorrowedAliasProbe::DESTROYED, 0,
+       'localized delete preserves the borrowed caller argument');
+}
+
+my $left = [];
+my $object = ArrayDeleteLocalBorrowedAliasProbe->new;
+my $right = [];
+local_delete_middle_argument($left, $object, $right);
+is($ArrayDeleteLocalBorrowedAliasProbe::DESTROYED, 0,
+   'caller still owns object after localized delete returns');
+undef $object;
+is($ArrayDeleteLocalBorrowedAliasProbe::DESTROYED, 1,
+   'caller release destroys localized-delete object');
+
+done_testing;

From 375d2fad3970c6ebda889f1dacefcf1564e48965 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 06:48:30 +0100
Subject: [PATCH 298/317] test: cover owned slot restoration after local delete

Verify that delete local preserves a genuinely owning array slot after its
returned value is dropped, and that clearing the restored slot releases the
object. Record the system Perl, JVM, interpreter, and full-gate results.

Generated with Codex (https://openai.com/codex)
Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          |  5 ++-
 .../array_delete_local_owned_slot_lifetime.t  | 34 +++++++++++++++++++
 2 files changed, 38 insertions(+), 1 deletion(-)
 create mode 100644 src/test/resources/unit/refcount/array_delete_local_owned_slot_lifetime.t

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 02dd2f877f..5274cd922b 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -180,7 +180,10 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   ownership state. The regression failed on the pre-fix JVM and passes on
   system Perl, JVM, and interpreter. The new change passes full
   `nice -n 19 make` (`13m42s`); all three array-delete ownership regressions
-  pass focused on both backends.
+  pass focused on both backends. A companion owned-slot regression confirms
+  restoration still retains a genuinely owning array element, and clearing the
+  restored slot then releases it; system Perl and both backends pass all five
+  assertions. The combined full gate including this control passes in 13m21s.
 - The temporary `perlonjava.test.disableAggregateOwnerRecovery` diagnostic was
   removed after the no-recovery audit. The two production call sites in
   `MortalList.processDeferredBase` and `RuntimeScalar.setLargeRefCounted` still
diff --git a/src/test/resources/unit/refcount/array_delete_local_owned_slot_lifetime.t b/src/test/resources/unit/refcount/array_delete_local_owned_slot_lifetime.t
new file mode 100644
index 0000000000..6a45410d23
--- /dev/null
+++ b/src/test/resources/unit/refcount/array_delete_local_owned_slot_lifetime.t
@@ -0,0 +1,34 @@
+use strict;
+use warnings;
+use Test::More;
+use Scalar::Util qw(weaken);
+
+{
+    package ArrayDeleteLocalOwnedSlotProbe;
+    our $DESTROYED = 0;
+    sub new { bless {}, shift }
+    sub DESTROY { ++$DESTROYED }
+}
+
+sub local_delete_middle_array_slot {
+    my ($array) = @_;
+    my $deleted = delete local $array->[1];
+    is($ArrayDeleteLocalOwnedSlotProbe::DESTROYED, 0,
+       'localized delete keeps the returned owned element alive');
+    undef $deleted;
+    is($ArrayDeleteLocalOwnedSlotProbe::DESTROYED, 0,
+       'restored array slot retains ownership after result release');
+}
+
+my @values = ([], ArrayDeleteLocalOwnedSlotProbe->new, []);
+my $weak = $values[1];
+weaken($weak);
+local_delete_middle_array_slot(\@values);
+is(ref($weak), 'ArrayDeleteLocalOwnedSlotProbe',
+   'restored owning array slot keeps the object alive');
+undef $values[1];
+is($ArrayDeleteLocalOwnedSlotProbe::DESTROYED, 1,
+   'clearing the restored array slot releases its owner');
+ok(!defined($weak), 'weak reference clears after the restored slot is cleared');
+
+done_testing;

From 0a755f9c32d65e2bd7d3be4531a87e7ef7e4b04d Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 09:05:58 +0100
Subject: [PATCH 299/317] fix: preserve aggregate cell values through
 refaliases

Keep the scalar cell's existing value owner while a strong scalar refalias
survives hash or array clear and deletion. Release that owner when the final
alias disappears, without adding a duplicate referent count. Weak aliases and
borrowed array slots retain their existing cleanup behavior.

Add an 18-assertion regression validated with system Perl, JVM, and interpreter.
Update the ownership progress notes and changelog. Full `nice -n 19 make`
passes in 15m57s.

Generated with Codex (https://openai.com/codex)
Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          | 21 +++++
 docs/about/changelog.md                       |  2 +-
 .../runtime/runtimetypes/MortalList.java      |  6 ++
 .../runtime/runtimetypes/PerlOwnerSlot.java   | 69 ++++++++++++--
 .../runtime/runtimetypes/RuntimeArray.java    |  4 +-
 .../runtime/runtimetypes/RuntimeHash.java     |  4 +-
 .../runtimetypes/RuntimeHashProxyEntry.java   |  3 +-
 .../runtime/runtimetypes/RuntimeScalar.java   | 13 ++-
 .../runtime/runtimetypes/WeakRefRegistry.java |  5 +
 .../hash_clear_preserves_scalar_ref_owner.t   | 93 +++++++++++++++++++
 10 files changed, 208 insertions(+), 12 deletions(-)
 create mode 100644 src/test/resources/unit/refcount/hash_clear_preserves_scalar_ref_owner.t

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 5274cd922b..c6590747c3 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -246,6 +246,27 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   system Perl, JVM, and interpreter. No accounting mismatch is reproduced, so
   retain the current lifecycle decision while migrating transient holds to
   explicit slots as part of the broader ownership phase.
+- On 2026-10-25, a focused recovery-bypass audit passed the #1794 controller
+  and WebSocket tests (four files), #1795 tempfile tests (two files), plus
+  selected scalar-reference, hash-element, array-delete, #1649, and DESTROY
+  regressions. A filtered no-recovery `make` reached 708 Java tests and failed
+  six tests whose simulated release paths still rely on recovery or whose
+  measured work includes the scan; three tests were skipped. The bypass was
+  removed after the focused paths passed.
+- A new system-Perl-validated regression exposed a real scalar-cell ownership
+  gap: clearing or deleting a hash/array entry must preserve the cell's value
+  while a strong refalias still points to that cell, then release it when the
+  final alias disappears. `PerlOwnerSlot` now records a non-counting
+  `SCALAR_REFERENCE_CONTENTS` identity when the cell already owns the value;
+  aggregate removal preserves the cell's `SCALAR_VALUE` owner, and final alias
+  release retires that owner. Weak aliases do not retain the value. The new
+  regression passes 18/18 on system Perl and both PerlOnJava backends, with
+  aggregate-owner recovery disabled, and the hash/array refcount, weak-alias,
+  and borrowed-array deletion regressions pass on both backends. A filtered
+  `nice -n 19 make` passes. The recovery scan remains because six synthetic
+  release/query tests still exercise undercounted states, and its two
+  production callers remain `MortalList.processDeferredBase` and
+  `RuntimeScalar.setLargeRefCounted` pending direct-accounting proof there.
 - The recovery-disabled audit had exposed an interpreter regression in
   `issue_1649_recursive_builder_pad_release.t`: the interpreter retained all
   five weakly observed nodes after dropping the root (expected two), even with
diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index 978f0d094f..9472180d37 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -23,7 +23,7 @@ priorities and future plans.
 - Avoid retaining transient arrays and hashes through shared immutable scalar literals while preserving reference ownership tracking.
 - Run standard Perl's `cpan -t Module` for CPAN oracle checks and keep download failures inconclusive instead of reporting missing local modules as Perl failures.
 - Keep lexical-registration membership checks constant-time, avoiding quadratic CPAN index parsing as cleanup stacks grow.
-- Keep scalar-slot owners authoritative across stores, container copies, scalar references, closure captures, lexical scope exit, overwrites, and explicit `undef` after legacy tracking retires; preserve aliases through `pop`, `shift`, or `delete` (#1649).
+- Keep scalar-slot owners authoritative across stores, container copies, scalar references, closure captures, lexical scope exit, overwrites, and explicit `undef` after legacy tracking retires; preserve aggregate scalar-cell values through strong refaliases after clear or delete (#1649).
 - Preserve package-rooted aggregate scalar owners when discarding a void-context subroutine result (#1649).
 - Release weakly linked aggregate trees when their last lexical root is overwritten with `undef` (#1649).
 - Transfer array and hash list-assignment tails through normal owner-slot and displaced-value cleanup paths, including `pop`, `shift`, and `delete` release (#1649).
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 48900d3f65..aff197b132 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -660,6 +660,12 @@ public static void deferDecrementIfNotCaptured(RuntimeScalar scalar) {
     public static void deferDestroyForContainerClear(Iterable<RuntimeScalar> elements) {
         if (!isActive()) return;
         for (RuntimeScalar scalar : elements) {
+            if (scalar != null && scalar.hasStrongScalarReferenceAlias()) {
+                // A refalias keeps the scalar cell itself alive after the
+                // aggregate slot is removed. Its SCALAR_VALUE owner must move
+                // with the cell and is released when the final alias goes.
+                continue;
+            }
             // Use the recursive path so a discarded wrapper/container also
             // releases references stored in its fields.  Test::Deep's
             // temporary comparator is a blessed hash whose `val` field can
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
index 44803ae1dc..38631bd952 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
@@ -35,6 +35,7 @@ public enum Kind {
     private final long identity = NEXT_ID.incrementAndGet();
     private RuntimeBase referent;
     private boolean tieWrapperCounted;
+    private boolean scalarReferenceContentsCounted;
     private PerlRuntime ownerRuntime;
     private LifecycleRuntimeState ownerRuntimeState;
     private int legacyCaptureCount;
@@ -249,13 +250,18 @@ public synchronized void acquireScalarReferenceContents(
             throw new IllegalStateException(
                     "an active scalar-reference owner cannot change cells during acquisition");
         }
-        boolean firstOwnerForCell = !hasSiblingScalarReferenceContentsOwner(
+        boolean hasCountedSibling = hasCountedSiblingScalarReferenceContentsOwner(
                 referenceCell, target);
-        if (firstOwnerForCell && target.refCount == Integer.MAX_VALUE) {
+        boolean cellOwnsContents = referenceCell != null
+                && referenceCell.ownsCountedReferent(target);
+        boolean countedContentsOwner = hasCountedSibling || !cellOwnsContents;
+        boolean acquireCount = countedContentsOwner && !hasCountedSibling;
+        if (acquireCount && target.refCount == Integer.MAX_VALUE) {
             throw new IllegalStateException("scalar-reference contents count overflow");
         }
         transferTo(target);
-        if (firstOwnerForCell) {
+        scalarReferenceContentsCounted = countedContentsOwner;
+        if (acquireCount) {
             target.traceRefCount(+1, "PerlOwnerSlot.acquireScalarReferenceContents");
             target.refCount++;
             target.hadCountedReference = true;
@@ -287,10 +293,16 @@ public synchronized void releaseScalarReferenceContents() {
         RuntimeBase target = referent;
         if (target == null) return;
         RuntimeScalar referenceCell = scalarReferenceCell == null ? null : scalarReferenceCell.get();
+        boolean countedContentsOwner = scalarReferenceContentsCounted;
+        scalarReferenceContentsCounted = false;
         scalarReferenceCell = null;
         if (referenceCell != null) referenceCell.unregisterScalarReferenceContentsOwner(this);
         transferTo(null);
         if (hasSiblingScalarReferenceContentsOwner(referenceCell, target)) return;
+        if (!countedContentsOwner) {
+            releaseDetachedScalarCellContents(referenceCell, target);
+            return;
+        }
         if (target.refCount <= 0) return;
         target.traceRefCount(-1, "PerlOwnerSlot.releaseScalarReferenceContents");
         target.releaseTransientTraceOwner(
@@ -316,12 +328,19 @@ public synchronized PendingRelease deferScalarReferenceContentsRelease() {
             return null;
         }
         RuntimeScalar referenceCell = scalarReferenceCell == null ? null : scalarReferenceCell.get();
+        boolean countedContentsOwner = scalarReferenceContentsCounted;
+        scalarReferenceContentsCounted = false;
         scalarReferenceCell = null;
         if (referenceCell != null) referenceCell.unregisterScalarReferenceContentsOwner(this);
         if (hasSiblingScalarReferenceContentsOwner(referenceCell, target)) {
             transferTo(null);
             return null;
         }
+        if (!countedContentsOwner) {
+            transferTo(null);
+            releaseDetachedScalarCellContents(referenceCell, target);
+            return null;
+        }
         PendingRelease release = new PendingRelease(identity, ++nextReleaseSequence, kind, this);
         MortalList.deferOwnerSlotDecrement(target, "scalar-reference contents", release);
         return release;
@@ -336,12 +355,20 @@ public synchronized void retargetScalarReferenceContents(RuntimeBase nextTarget)
         RuntimeBase previous = referent;
         if (previous == nextTarget) return;
         RuntimeScalar referenceCell = scalarReferenceCell == null ? null : scalarReferenceCell.get();
-        boolean firstOwnerForNextTarget = nextTarget != null
-                && !hasSiblingScalarReferenceContentsOwner(referenceCell, nextTarget);
+        boolean previousCounted = scalarReferenceContentsCounted;
+        boolean hasCountedSiblingForNext = nextTarget != null
+                && hasCountedSiblingScalarReferenceContentsOwner(referenceCell, nextTarget);
+        boolean nextCellOwnsContents = nextTarget != null && referenceCell != null
+                && referenceCell.ownsCountedReferent(nextTarget);
+        boolean nextCounted = nextTarget != null
+                && (hasCountedSiblingForNext || !nextCellOwnsContents);
+        boolean acquireNextCount = nextCounted && !hasCountedSiblingForNext;
         if (nextTarget != null) {
             if (nextTarget.refCount < 0) {
                 nextTarget = null;
-            } else if (firstOwnerForNextTarget) {
+                nextCounted = false;
+                acquireNextCount = false;
+            } else if (acquireNextCount) {
                 if (nextTarget.refCount == Integer.MAX_VALUE) {
                     throw new IllegalStateException("scalar-reference contents count overflow");
                 }
@@ -353,12 +380,14 @@ public synchronized void retargetScalarReferenceContents(RuntimeBase nextTarget)
             }
         }
         transferTo(nextTarget);
+        scalarReferenceContentsCounted = nextTarget != null && nextCounted;
         if (nextTarget == null && scalarReferenceCell != null) {
             scalarReferenceCell = null;
             if (referenceCell != null) referenceCell.unregisterScalarReferenceContentsOwner(this);
         }
         if (previous == null
                 || hasSiblingScalarReferenceContentsOwner(referenceCell, previous)
+                || !previousCounted
                 || previous.refCount <= 0) return;
         previous.traceRefCount(-1, "PerlOwnerSlot.retargetScalarReferenceContents");
         previous.releaseTransientTraceOwner(
@@ -516,6 +545,34 @@ private boolean hasSiblingScalarReferenceContentsOwner(
         return false;
     }
 
+    private boolean hasCountedSiblingScalarReferenceContentsOwner(
+            RuntimeScalar referenceCell, RuntimeBase target) {
+        if (referenceCell == null || target == null) return false;
+        for (PerlOwnerSlot slot : referenceCell.scalarReferenceContentsOwnersSnapshot()) {
+            if (slot != this && slot.referent() == target
+                    && slot.scalarReferenceContentsCounted) return true;
+        }
+        return false;
+    }
+
+    private static void releaseDetachedScalarCellContents(
+            RuntimeScalar referenceCell, RuntimeBase target) {
+        if (referenceCell != null && referenceCell.value == target
+                && !referenceCell.hasOwningAggregateSlot()
+                && referenceCell.ownsCountedReferent(target)) {
+            // The scalar cell held the sole SCALAR_VALUE count while it lived
+            // in an aggregate. A refalias keeps that same cell alive after
+            // deletion; release the cell's value owner when its final alias
+            // disappears instead of manufacturing a second count for it.
+            if (MortalList.isActive()) {
+                MortalList.deferDecrementIfTracked(referenceCell);
+            } else {
+                RuntimeScalar.releaseDynamicRestoreScalarValueOwner(
+                        referenceCell, "PerlOwnerSlot.releaseDetachedScalarCellContents");
+            }
+        }
+    }
+
     /** Queue one closure-pad count release and retain its slot provenance. */
     public synchronized PendingRelease deferLegacyCaptureRelease(RuntimeBase target) {
         if (legacyCaptureCount <= 0) return null;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
index f46bcada3b..c7d3035932 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeArray.java
@@ -907,6 +907,7 @@ public static RuntimeScalar pop(RuntimeArray runtimeArray) {
                     // would corrupt the caller's refCount tracking.
                     if (runtimeArray.ownsElement(result)
                             && !result.hasOwningAggregateSlotForLvalueAlias()
+                            && !result.hasStrongScalarReferenceAlias()
                             && (result.type & RuntimeScalarType.REFERENCE_BIT) != 0
                             && result.value instanceof RuntimeBase base
                             && result.ownsCountedReferent(base)
@@ -950,6 +951,7 @@ public static RuntimeScalar shift(RuntimeArray runtimeArray) {
                     // See pop() for rationale and elementsOwned guard.
                     if (runtimeArray.ownsElement(result)
                             && !result.hasOwningAggregateSlotForLvalueAlias()
+                            && !result.hasStrongScalarReferenceAlias()
                             && (result.type & RuntimeScalarType.REFERENCE_BIT) != 0
                             && result.value instanceof RuntimeBase base
                             && result.ownsCountedReferent(base)
@@ -1314,7 +1316,7 @@ public RuntimeScalar delete(int index) {
                 // reference through an owning array. Borrowed aliases such as
                 // @_ must not release the caller's scalar owner. Defer the
                 // owner release so assignment can first retain the result.
-                if (ownsElement(previous) && !previous.hasOwningAggregateSlot()) {
+                if (ownsElement(previous) && !previous.hasAggregateOrScalarReferenceOwner()) {
                     MortalList.deferDecrementIfTracked(previous);
                     MortalList.deferIoOwnerRelease(previous);
                 }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java
index 5521cfbd1f..3cd6f764c6 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHash.java
@@ -1182,7 +1182,7 @@ public RuntimeScalar deleteInContext(RuntimeScalar key, int callContext) {
                     // Schedule deferred refCount decrement — fires at next safe point
                     // (setLarge or RuntimeCode.apply). This prevents premature DESTROY
                     // when the caller captures the return value.
-                    if (!value.hasOwningAggregateSlot()) {
+                    if (!value.hasAggregateOrScalarReferenceOwner()) {
                         MortalList.deferDecrementIfTracked(value);
                         MortalList.deferIoOwnerRelease(value);
                     }
@@ -1232,7 +1232,7 @@ public RuntimeScalar deleteInContext(String key, int callContext) {
                         yield fetchedValue;
                     }
                     // Schedule deferred refCount decrement (see delete(RuntimeScalar) above)
-                    if (!value.hasOwningAggregateSlot()) {
+                    if (!value.hasAggregateOrScalarReferenceOwner()) {
                         MortalList.deferDecrementIfTracked(value);
                         MortalList.deferIoOwnerRelease(value);
                     }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHashProxyEntry.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHashProxyEntry.java
index ccc51e37eb..4228d87dc4 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHashProxyEntry.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeHashProxyEntry.java
@@ -243,7 +243,8 @@ public void dynamicRestoreState() {
                 // reachable after the saved hash entry is restored. Release
                 // it only after restoration, so a DESTROY method observes the
                 // restored dynamic value (notably a restored %SIG handler).
-                if (displaced != null && displaced != previousState) {
+                if (displaced != null && displaced != previousState
+                        && !displaced.hasStrongScalarReferenceAlias()) {
                     // Replacing a localized element has the same ownership
                     // effect as deleting a hash element.  In particular, a
                     // CODE slot can be the last counted owner of a closure;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 6ade786ec5..41582a8d04 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -985,6 +985,16 @@ synchronized java.util.List<PerlOwnerSlot> scalarReferenceContentsOwnersSnapshot
                 ? java.util.List.of() : java.util.List.copyOf(scalarReferenceContentsOwners);
     }
 
+    /** Whether a strong refalias still owns this scalar cell's current contents. */
+    boolean hasStrongScalarReferenceAlias() {
+        return !scalarReferenceContentsOwnersSnapshot().isEmpty();
+    }
+
+    /** Whether this cell's current value owner is protected by an aggregate or refalias. */
+    boolean hasAggregateOrScalarReferenceOwner() {
+        return hasOwningAggregateSlot() || hasStrongScalarReferenceAlias();
+    }
+
     /**
      * True once a scalar reference has been created to this scalar, e.g.
      * {@code \$x}. Interpreter lexical assignment must preserve the scalar
@@ -2531,7 +2541,8 @@ private static boolean scalarReferenceContentsNeedRetain(RuntimeScalar value) {
                 && !WeakRefRegistry.isweak(scalarReferent)
                 && (scalarReferent.type & REFERENCE_BIT) != 0
                 && scalarReferent.value instanceof RuntimeBase inner
-                && !scalarReferent.ownsCountedReferent(inner)
+                && (!scalarReferent.ownsCountedReferent(inner)
+                    || scalarReferent.hasOwningAggregateSlot())
                 && inner.refCount >= 0;
     }
 
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/WeakRefRegistry.java b/src/main/java/org/perlonjava/runtime/runtimetypes/WeakRefRegistry.java
index 1528022751..6a398b4719 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/WeakRefRegistry.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/WeakRefRegistry.java
@@ -121,6 +121,11 @@ private static void weaken(
                 .add(ref);
         base.activateOwnerTracking();
         ref.releaseClosureCaptureReferentsForWeaken(base);
+        // A weak reference to a scalar cell must stop owning that cell's
+        // contents, just as weakening a direct scalar value stops owning its
+        // referent. This also lets a detached hash/array value die when its
+        // final strong refalias is weakened.
+        ref.releaseOwnedScalarReferenceContents();
         if (System.getenv("PJ_WEAKCLEAR_TRACE") != null) {
             System.err.println("[WEAKEN] ref=" + System.identityHashCode(ref)
                 + " referent=" + System.identityHashCode(base)
diff --git a/src/test/resources/unit/refcount/hash_clear_preserves_scalar_ref_owner.t b/src/test/resources/unit/refcount/hash_clear_preserves_scalar_ref_owner.t
new file mode 100644
index 0000000000..52105ec44b
--- /dev/null
+++ b/src/test/resources/unit/refcount/hash_clear_preserves_scalar_ref_owner.t
@@ -0,0 +1,93 @@
+use strict;
+use warnings;
+use Test::More;
+use Scalar::Util qw(weaken);
+
+{
+    package HashClearScalarRefOwnerProbe;
+    our $DESTROYED = 0;
+    sub new { bless {}, shift }
+    sub DESTROY { ++$DESTROYED }
+}
+
+my %strong_values;
+my $strong_object = HashClearScalarRefOwnerProbe->new;
+my $strong_weak = $strong_object;
+weaken($strong_weak);
+$strong_values{item} = $strong_object;
+my $strong_alias = \$strong_values{item};
+undef $strong_object;
+undef %strong_values;
+is($HashClearScalarRefOwnerProbe::DESTROYED, 0,
+   'strong scalar reference keeps the hash value alive after clear');
+is(ref($strong_weak), 'HashClearScalarRefOwnerProbe',
+   'weak observer remains live through the scalar reference');
+undef $strong_alias;
+is($HashClearScalarRefOwnerProbe::DESTROYED, 1,
+   'destroy runs after the final scalar reference is released');
+ok(!defined($strong_weak), 'weak observer clears after final scalar reference release');
+
+my %weak_values;
+my $weak_object = HashClearScalarRefOwnerProbe->new;
+my $weak_observer = $weak_object;
+weaken($weak_observer);
+$weak_values{item} = $weak_object;
+my $weak_alias = \$weak_values{item};
+weaken($weak_alias);
+undef $weak_object;
+undef %weak_values;
+is($HashClearScalarRefOwnerProbe::DESTROYED, 2,
+   'weak scalar reference does not retain the hash value after clear');
+ok(!defined($weak_observer), 'weak observer clears after hash clear');
+
+my %deleted_values;
+my $deleted_object = HashClearScalarRefOwnerProbe->new;
+my $deleted_weak = $deleted_object;
+weaken($deleted_weak);
+$deleted_values{item} = $deleted_object;
+my $deleted_alias = \$deleted_values{item};
+undef $deleted_object;
+my $deleted_value = delete $deleted_values{item};
+undef $deleted_value;
+is($HashClearScalarRefOwnerProbe::DESTROYED, 2,
+   'delete preserves the detached scalar cell while a strong refalias remains');
+ok(defined($deleted_weak), 'the deleted value remains alive through its refalias');
+undef $deleted_alias;
+is($HashClearScalarRefOwnerProbe::DESTROYED, 3,
+   'releasing the final deleted-cell refalias runs DESTROY');
+ok(!defined($deleted_weak), 'the deleted value weak observer clears after refalias release');
+
+my @array_values;
+my $array_object = HashClearScalarRefOwnerProbe->new;
+my $array_weak = $array_object;
+weaken($array_weak);
+$array_values[0] = $array_object;
+my $array_alias = \$array_values[0];
+undef $array_object;
+undef @array_values;
+is($HashClearScalarRefOwnerProbe::DESTROYED, 3,
+   'clearing an array preserves the detached scalar cell through a refalias');
+ok(defined($array_weak), 'the array value remains alive through its refalias');
+undef $array_alias;
+is($HashClearScalarRefOwnerProbe::DESTROYED, 4,
+   'releasing the final array-cell refalias runs DESTROY');
+ok(!defined($array_weak), 'the array value weak observer clears after refalias release');
+
+my @deleted_array_values;
+my $deleted_array_object = HashClearScalarRefOwnerProbe->new;
+my $deleted_array_weak = $deleted_array_object;
+weaken($deleted_array_weak);
+$deleted_array_values[0] = $deleted_array_object;
+my $deleted_array_alias = \$deleted_array_values[0];
+undef $deleted_array_object;
+my $deleted_array_value = delete $deleted_array_values[0];
+undef $deleted_array_value;
+is($HashClearScalarRefOwnerProbe::DESTROYED, 4,
+   'array delete preserves the detached scalar cell through a refalias');
+ok(defined($deleted_array_weak), 'the deleted array value remains alive through its refalias');
+undef $deleted_array_alias;
+is($HashClearScalarRefOwnerProbe::DESTROYED, 5,
+   'releasing the final deleted array-cell refalias runs DESTROY');
+ok(!defined($deleted_array_weak), 'the deleted array value weak observer clears after refalias release');
+
+done_testing;

From 17990d3b1e77a7590caa497f021f4f21c7b46e0f Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 09:34:18 +0100
Subject: [PATCH 300/317] docs: map ownership sources and release paths

Record which Perl owner edges use counted slots and which remain identity
proofs for aggregate recovery. Keep the scan until a generic deferred-release
producer is tied to a reproducible Perl-visible mismatch.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 39 ++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index c6590747c3..fc94b75398 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -68,6 +68,37 @@ reachability machinery; that result is useful compatibility evidence, but it
 does not prove the planned owner-slot migration. `undef $sub` is a scalar slot
 overwrite, not the separate `undef &sub` CV-body operation.
 
+### Current ownership source/sink audit (2026-10-25)
+
+This table records the accounting paths relevant to the remaining aggregate
+recovery scan. “Counted slot” means it changes the legacy referent count through
+an explicit token; an identity-only slot is currently evidence for recovery,
+not an independent count.
+
+| Perl ownership edge | Acquisition or transfer | Release | Current authority and recovery interaction |
+|---|---|---|---|
+| Direct scalar reference value | `RuntimeScalar.setLargeRefCounted` acquires a `SCALAR_VALUE` slot for a tracked store; `PerlOwnerSlot.acquireScalarValueCount` increments `refCount` | Scalar overwrite/undefine retires that slot; deferred scope and container paths queue its `PendingRelease` through `MortalList` | Counted slot and legacy count are bridged. When an unrelated decrement reaches zero, the scalar caller can still invoke aggregate recovery before lifecycle dispatch. |
+| Hash entry | `RuntimeHash.updateHashEntryOwner` attaches a `HASH_ENTRY` slot to the stable entry and scalar cell | Key replacement/deletion and hash cleanup release that identity slot; the scalar cell's value slot is released separately | `HASH_ENTRY` is identity-only for ordinary non-shared hashes. Recovery proves the owning hash is rooted and counts the cell's still-live value edge. Shared hashes retain a separate shared-slot count. |
+| Array element | `RuntimeArray.syncArrayElementOwnerSlot` / reconciliation attaches an `ARRAY_ELEMENT` slot when `ownsElement` is true | Array deletion, clear, replacement, and cleanup release the structural slot and release/queue the scalar value owner according to owned-versus-borrowed state | `ARRAY_ELEMENT` is identity-only; `SCALAR_VALUE` or the legacy bridge supplies the count. Borrowed aliases must not be promoted to an element owner. |
+| Scalar-reference contents | `PerlOwnerSlot.acquireScalarReferenceContents` records a `SCALAR_REFERENCE_CONTENTS` edge; it counts separately when a reference cell owns a distinct contents edge, and records a non-counting identity when it shares the cell's existing value owner | Retargeting or releasing the final strong alias releases the counted contents slot or allows the shared cell owner to retire | Reachable contents slots can restore a live contents owner after a decrement. Weak aliases are excluded. The hash/array refalias regression covers this sharing case. |
+| Tied wrapper | Tie installation attaches a `TIE_WRAPPER` identity slot | Untie/replacement and wrapper cleanup release it | Recovery counts a wrapper only when its owner container is rooted. This slot family still depends on recovery for mixed legacy undercounts. |
+| Closure-pad capture | `RuntimeBase.retainClosureCaptureOwner` creates a typed capture slot; aggregate captures can be native counted slots, scalar captures use a legacy bridge | Scope exit, closure release, and capture replacement retire the slot and capture state | Aggregate capture slots have direct semantic counts; scalar capture bridges still use the selective counter. The recovery scan is not their normal release authority. |
+| Deferred temporary or lifecycle hold | Blessing, method dispatch, end-block execution, and legacy closure release increment or retain a temporary count before queuing work | `MortalList.processDeferredBase` decrements the referent at a cleanup boundary; abandoned method holds have a separate immediate path | Several producers still use generic `deferDecrement` without a `PendingRelease` token. These are candidates for source-to-sink tracing, but the focused #1794/#1795 no-recovery runs did not demonstrate a missing Perl-visible owner on these paths. |
+
+The scan repairs a mixed-state mismatch: it runs only after a deferred release
+or scalar overwrite has brought the selective count to zero, then reconstructs
+the count from rooted aggregate identities, scalar-value cells, tied wrappers,
+and reachable counted scalar owners. The current Java tests that fail when the
+scan is bypassed deliberately start from inconsistent counts or queue more
+generic decrements than they acquired; they prove the recovery helper's
+synthetic contract, not a production mutation that loses an owner.
+
+Next audit target: trace each generic `MortalList.deferDecrement` producer to
+its corresponding acquisition and determine whether it can consume another
+owner's selective count. Add a focused failing Perl-level regression before
+changing any producer. Keep the two recovery callers until that trace finds a
+real operation whose count can be maintained directly.
+
 The first verified fix is at the reachability boundary. The interpreter's
 `capturedVars` array is execution metadata and can still contain a pad after
 that pad has been removed from the closure's semantic capture-owner list. The
@@ -308,6 +339,14 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   backends with recovery disabled. The diagnostic switch is now removed; keep
   the recovery method and its two production callers until direct accounting
   proves those paths no longer need it.
+- On 2026-10-25, added a source/sink inventory for scalar values, hash entries,
+  array elements, scalar-reference contents, tied wrappers, closure captures,
+  and generic deferred holds. It records which slots change `refCount` and
+  which are currently identity-only recovery evidence. The next audit traces
+  every remaining generic `deferDecrement` producer to its matching acquisition;
+  no producer is changed until that trace identifies a real Perl-visible
+  mismatch. `make check-links` passes for the updated design document (787
+  links checked, zero errors).
 - A second focused reducer,
   `issue_1649_captured_scalar_array_argument.t`, isolates the same class of
   lifetime error: a closure writes a blessed object to a captured scalar while

From 437b38c93191318782d6069e249837594368b5c3 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 09:37:37 +0100
Subject: [PATCH 301/317] docs: trace deferred ownership producers

Record the acquisition and release pairing for every generic deferred
referent decrement and narrow the remaining recovery audit to zero transitions
at the two production scan callers.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index fc94b75398..2e89953614 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -83,7 +83,7 @@ not an independent count.
 | Scalar-reference contents | `PerlOwnerSlot.acquireScalarReferenceContents` records a `SCALAR_REFERENCE_CONTENTS` edge; it counts separately when a reference cell owns a distinct contents edge, and records a non-counting identity when it shares the cell's existing value owner | Retargeting or releasing the final strong alias releases the counted contents slot or allows the shared cell owner to retire | Reachable contents slots can restore a live contents owner after a decrement. Weak aliases are excluded. The hash/array refalias regression covers this sharing case. |
 | Tied wrapper | Tie installation attaches a `TIE_WRAPPER` identity slot | Untie/replacement and wrapper cleanup release it | Recovery counts a wrapper only when its owner container is rooted. This slot family still depends on recovery for mixed legacy undercounts. |
 | Closure-pad capture | `RuntimeBase.retainClosureCaptureOwner` creates a typed capture slot; aggregate captures can be native counted slots, scalar captures use a legacy bridge | Scope exit, closure release, and capture replacement retire the slot and capture state | Aggregate capture slots have direct semantic counts; scalar capture bridges still use the selective counter. The recovery scan is not their normal release authority. |
-| Deferred temporary or lifecycle hold | Blessing, method dispatch, end-block execution, and legacy closure release increment or retain a temporary count before queuing work | `MortalList.processDeferredBase` decrements the referent at a cleanup boundary; abandoned method holds have a separate immediate path | Several producers still use generic `deferDecrement` without a `PendingRelease` token. These are candidates for source-to-sink tracing, but the focused #1794/#1795 no-recovery runs did not demonstrate a missing Perl-visible owner on these paths. |
+| Deferred temporary or lifecycle hold | Blessing and method dispatch acquire a temporary count; an active END callback is rescued from zero to one by `DestroyDispatch`; closure aggregates normally acquire native capture slots | `MortalList.processDeferredBase` decrements queued counts at a cleanup boundary; abandoned method holds release immediately; END completion queues the rescued count | These generic releases carry no `PendingRelease` token. The normal bless, method-hold, and END paths each pair one temporary count with one release. The closure aggregate defer is a legacy fallback when its capture slot is absent. The focused #1794/#1795 no-recovery runs did not demonstrate a lost owner on these paths. |
 
 The scan repairs a mixed-state mismatch: it runs only after a deferred release
 or scalar overwrite has brought the selective count to zero, then reconstructs
@@ -93,11 +93,21 @@ scan is bypassed deliberately start from inconsistent counts or queue more
 generic decrements than they acquired; they prove the recovery helper's
 synthetic contract, not a production mutation that loses an owner.
 
-Next audit target: trace each generic `MortalList.deferDecrement` producer to
-its corresponding acquisition and determine whether it can consume another
-owner's selective count. Add a focused failing Perl-level regression before
-changing any producer. Keep the two recovery callers until that trace finds a
-real operation whose count can be maintained directly.
+The source audit covered all five production `MortalList.deferDecrement`
+invocations: two blessing paths, normal method-hold release, active END-block
+completion, and the aggregate-capture compatibility fallback. The first four
+have a paired temporary count or zero-to-one lifecycle rescue in the adjacent
+producer; ordinary aggregate capture construction and ithread cloning install
+native capture slots. The remaining uncertainty is not an unmatched
+`deferDecrement` call, but whether arbitrary scalar overwrites or queued owner
+releases can consume a different still-live selective owner before either
+production scan caller runs.
+
+Next audit target: instrument the two scan entry points with the owner release
+provenance already carried by `PendingOwnerRelease`, then reduce any
+production-only zero transition to a system-Perl-validated operation. Do not
+change a producer or remove either scan caller unless that trace identifies a
+real mismatched owner edge and a focused regression.
 
 The first verified fix is at the reachability boundary. The interpreter's
 `capturedVars` array is execution metadata and can still contain a pad after

From 64746a16ed15b926abac24dbb039000e30d120c5 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 10:11:27 +0100
Subject: [PATCH 302/317] fix: restore scalar-reference contents owners during
 recovery

Aggregate recovery already counted rooted hash cells, scalar values, and tie
wrappers, but omitted distinct reachable scalar-reference contents cells. When
another rooted aggregate owner made recovery succeed, the scalar overwrite
fallback could not restore the omitted contents owner. Count reachable
contents cells once per underlying cell while excluding weak and
non-counting aliases, and cover the mixed-owner recovery state.

Generated with Codex (https://openai.com/codex)

Co-Authored-By: Codex <codex@openai.com>
---
 dev/design/perl-ownership-rewrite.md          | 26 +++++++-
 docs/about/changelog.md                       |  1 +
 .../runtime/runtimetypes/MortalList.java      | 22 ++++++-
 .../runtime/runtimetypes/PerlOwnerSlot.java   |  4 ++
 ...stScalarReferenceContentsRecoveryTest.java | 64 +++++++++++++++++++
 5 files changed, 115 insertions(+), 2 deletions(-)
 create mode 100644 src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarReferenceContentsRecoveryTest.java

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 2e89953614..401c1d529a 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -80,7 +80,7 @@ not an independent count.
 | Direct scalar reference value | `RuntimeScalar.setLargeRefCounted` acquires a `SCALAR_VALUE` slot for a tracked store; `PerlOwnerSlot.acquireScalarValueCount` increments `refCount` | Scalar overwrite/undefine retires that slot; deferred scope and container paths queue its `PendingRelease` through `MortalList` | Counted slot and legacy count are bridged. When an unrelated decrement reaches zero, the scalar caller can still invoke aggregate recovery before lifecycle dispatch. |
 | Hash entry | `RuntimeHash.updateHashEntryOwner` attaches a `HASH_ENTRY` slot to the stable entry and scalar cell | Key replacement/deletion and hash cleanup release that identity slot; the scalar cell's value slot is released separately | `HASH_ENTRY` is identity-only for ordinary non-shared hashes. Recovery proves the owning hash is rooted and counts the cell's still-live value edge. Shared hashes retain a separate shared-slot count. |
 | Array element | `RuntimeArray.syncArrayElementOwnerSlot` / reconciliation attaches an `ARRAY_ELEMENT` slot when `ownsElement` is true | Array deletion, clear, replacement, and cleanup release the structural slot and release/queue the scalar value owner according to owned-versus-borrowed state | `ARRAY_ELEMENT` is identity-only; `SCALAR_VALUE` or the legacy bridge supplies the count. Borrowed aliases must not be promoted to an element owner. |
-| Scalar-reference contents | `PerlOwnerSlot.acquireScalarReferenceContents` records a `SCALAR_REFERENCE_CONTENTS` edge; it counts separately when a reference cell owns a distinct contents edge, and records a non-counting identity when it shares the cell's existing value owner | Retargeting or releasing the final strong alias releases the counted contents slot or allows the shared cell owner to retire | Reachable contents slots can restore a live contents owner after a decrement. Weak aliases are excluded. The hash/array refalias regression covers this sharing case. |
+| Scalar-reference contents | `PerlOwnerSlot.acquireScalarReferenceContents` records a `SCALAR_REFERENCE_CONTENTS` edge; it counts separately when a reference cell owns a distinct contents edge, and records a non-counting identity when it shares the cell's existing value owner | Retargeting or releasing the final strong alias releases the counted contents slot or allows the shared cell owner to retire | Reachable contents slots restore a live contents owner after a decrement. Aggregate recovery now counts distinct reachable contents cells alongside hash/array owners; weak aliases are excluded. |
 | Tied wrapper | Tie installation attaches a `TIE_WRAPPER` identity slot | Untie/replacement and wrapper cleanup release it | Recovery counts a wrapper only when its owner container is rooted. This slot family still depends on recovery for mixed legacy undercounts. |
 | Closure-pad capture | `RuntimeBase.retainClosureCaptureOwner` creates a typed capture slot; aggregate captures can be native counted slots, scalar captures use a legacy bridge | Scope exit, closure release, and capture replacement retire the slot and capture state | Aggregate capture slots have direct semantic counts; scalar capture bridges still use the selective counter. The recovery scan is not their normal release authority. |
 | Deferred temporary or lifecycle hold | Blessing and method dispatch acquire a temporary count; an active END callback is rescued from zero to one by `DestroyDispatch`; closure aggregates normally acquire native capture slots | `MortalList.processDeferredBase` decrements queued counts at a cleanup boundary; abandoned method holds release immediately; END completion queues the rescued count | These generic releases carry no `PendingRelease` token. The normal bless, method-hold, and END paths each pair one temporary count with one release. The closure aggregate defer is a legacy fallback when its capture slot is absent. The focused #1794/#1795 no-recovery runs did not demonstrate a lost owner on these paths. |
@@ -103,6 +103,17 @@ native capture slots. The remaining uncertainty is not an unmatched
 releases can consume a different still-live selective owner before either
 production scan caller runs.
 
+A mixed-owner unit probe found one recovery omission in that accounting: when a
+rooted hash value and a distinct counted scalar-reference contents edge both
+owned the referent, aggregate recovery restored the hash cell but ignored the
+contents cell. The scalar-overwrite caller's later contents fallback could not
+repair this case because aggregate recovery had already returned success. The
+recovery scan now counts rooted `SCALAR_REFERENCE_CONTENTS` cells once per
+underlying scalar cell, excluding non-counting aliases and weak references. A
+focused Java regression covers the mixed state. This fixes a recovery-ledger
+gap; it does not yet identify which production operation can create the
+undercounted state, so neither scan caller is removed.
+
 Next audit target: instrument the two scan entry points with the owner release
 provenance already carried by `PendingOwnerRelease`, then reduce any
 production-only zero transition to a system-Perl-validated operation. Do not
@@ -357,6 +368,19 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   no producer is changed until that trace identifies a real Perl-visible
   mismatch. `make check-links` passes for the updated design document (787
   links checked, zero errors).
+- A mixed-owner recovery test exposed that `restoreReachableAggregateOwnerCount`
+  could count a rooted hash value but omit a distinct reachable
+  `SCALAR_REFERENCE_CONTENTS` owner. `RuntimeScalar.setLargeRefCounted` could
+  not repair the omission because aggregate recovery returned success first.
+  Recovery now adds one owner per rooted underlying contents cell, skipping
+  weak and non-counting aliases. The new Java regression passes in the full
+  `nice -n 19 make` gate (15m51s, `EXIT: 0`). The #1794 controller, both
+  WebSocket lifetime tests, both #1795 Catalyst tempfile tests, the new
+  18-assertion refalias regression, and the #1649 abandoned-method-hold test
+  pass on the interpreter backend; the full gate also passes their JVM cases.
+  This repairs mixed recovery accounting but does not yet identify the
+  production operation that can produce an undercount, so both scan callers
+  remain.
 - A second focused reducer,
   `issue_1649_captured_scalar_array_argument.t`, isolates the same class of
   lifetime error: a closure writes a blessed object to a captured scalar while
diff --git a/docs/about/changelog.md b/docs/about/changelog.md
index 9472180d37..66ac929dcc 100644
--- a/docs/about/changelog.md
+++ b/docs/about/changelog.md
@@ -24,6 +24,7 @@ priorities and future plans.
 - Run standard Perl's `cpan -t Module` for CPAN oracle checks and keep download failures inconclusive instead of reporting missing local modules as Perl failures.
 - Keep lexical-registration membership checks constant-time, avoiding quadratic CPAN index parsing as cleanup stacks grow.
 - Keep scalar-slot owners authoritative across stores, container copies, scalar references, closure captures, lexical scope exit, overwrites, and explicit `undef` after legacy tracking retires; preserve aggregate scalar-cell values through strong refaliases after clear or delete (#1649).
+- Include distinct reachable scalar-reference contents owners when aggregate recovery reconstructs a mixed owner count (#1649).
 - Preserve package-rooted aggregate scalar owners when discarding a void-context subroutine result (#1649).
 - Release weakly linked aggregate trees when their last lexical root is overwritten with `undef` (#1649).
 - Transfer array and hash list-assignment tails through normal owner-slot and displaced-value cleanup paths, including `pop`, `shift`, and `delete` release (#1649).
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index aff197b132..46e85f62b0 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -1997,6 +1997,8 @@ && isReachableCached(base)) {
     /** Restore legacy count for aggregate owner slots still reachable from Perl roots. */
     static boolean restoreReachableAggregateOwnerCount(RuntimeBase referent) {
         Set<RuntimeScalar> rootedHashCells = Collections.newSetFromMap(new IdentityHashMap<>());
+        Set<RuntimeScalar> rootedScalarReferenceCells =
+                Collections.newSetFromMap(new IdentityHashMap<>());
         Set<PerlOwnerSlot> rootedTieWrappers = Collections.newSetFromMap(new IdentityHashMap<>());
         // The referent exclusion and Perl graph stay fixed throughout this
         // synchronous scan, so multiple slots in one aggregate share a proof.
@@ -2035,6 +2037,23 @@ static boolean restoreReachableAggregateOwnerCount(RuntimeBase referent) {
                         && ReachabilityWalker.isScalarReachable(cell)) {
                     rootedHashCells.add(cell);
                 }
+            } else if (slot.kind() == PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS
+                    && slot.referent() == referent) {
+                // A counted contents slot can be the only owner when its
+                // underlying scalar cell is borrowed or otherwise lacks its
+                // own SCALAR_VALUE count. Aliases to one cell share that
+                // count, so restore it once per reachable contents cell.
+                RuntimeScalar ownerCell = slot.ownerCell();
+                RuntimeScalar contentsCell = slot.scalarReferenceCell();
+                if (slot.scalarReferenceContentsCounted()
+                        && ownerCell != null && contentsCell != null
+                        && ownerCell.scalarReferenceContentsOwner == slot
+                        && contentsCell.value == referent
+                        && !WeakRefRegistry.isweak(ownerCell)
+                        && !WeakRefRegistry.isweak(contentsCell)
+                        && ReachabilityWalker.isScalarReachable(ownerCell)) {
+                    rootedScalarReferenceCells.add(contentsCell);
+                }
             } else if (slot.kind() == PerlOwnerSlot.Kind.TIE_WRAPPER
                     && slot.referent() == referent) {
                 RuntimeBase owner = slot.ownerContainer();
@@ -2044,7 +2063,8 @@ static boolean restoreReachableAggregateOwnerCount(RuntimeBase referent) {
                 }
             }
         }
-        int owners = slotsWithoutCell + rootedHashCells.size();
+        int owners = slotsWithoutCell + rootedHashCells.size()
+                + rootedScalarReferenceCells.size();
         // Active scalar owners may include lexical RVs in addition to hash
         // cells. Exclude cells already counted through their explicit slots,
         // then add other still-reachable scalar owners to avoid losing them
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
index 38631bd952..cfe95eb9b9 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
@@ -150,6 +150,10 @@ synchronized boolean tieWrapperCounted() {
         return tieWrapperCounted;
     }
 
+    synchronized boolean scalarReferenceContentsCounted() {
+        return scalarReferenceContentsCounted;
+    }
+
     RuntimeCode closureOwner() {
         return closureOwner;
     }
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarReferenceContentsRecoveryTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarReferenceContentsRecoveryTest.java
new file mode 100644
index 0000000000..8ff6cebd05
--- /dev/null
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/MortalListScalarReferenceContentsRecoveryTest.java
@@ -0,0 +1,64 @@
+package org.perlonjava.runtime.runtimetypes;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("unit")
+class MortalListScalarReferenceContentsRecoveryTest {
+    @Test
+    void aggregateRecoveryCountsDistinctRootedScalarContentsOwner() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeHash referent = new RuntimeHash();
+            referent.refCount = 1;
+
+            RuntimeHash packageRoot = new RuntimeHash();
+            packageRoot.isPackageGlobalRoot = true;
+            RuntimeScalar hashCell = referenceTo(referent);
+            hashCell.setRefCountOwned(true);
+            packageRoot.elements.put("target", hashCell);
+
+            RuntimeScalar contentsCell = referenceTo(referent);
+            RuntimeScalar outerReference = new RuntimeScalar();
+            outerReference.type = RuntimeScalarType.REFERENCE;
+            outerReference.value = contentsCell;
+            PerlOwnerSlot contentsOwner = new PerlOwnerSlot(
+                    PerlOwnerSlot.Kind.SCALAR_REFERENCE_CONTENTS,
+                    null, null, outerReference);
+            contentsOwner.acquireScalarReferenceContents(referent, contentsCell);
+            outerReference.scalarReferenceContentsOwner = contentsOwner;
+            MyVarCleanupStack.register(outerReference);
+
+            try {
+                assertEquals(2, referent.refCount,
+                        "the hash value and scalar-reference contents own distinct edges");
+
+                // Model the selective counter having lost both live owners
+                // before recovery. The recovery contract must rebuild the
+                // count from each independently rooted owner edge.
+                referent.refCount = 0;
+
+                assertTrue(MortalList.restoreReachableAggregateOwnerCount(referent));
+                assertEquals(2, referent.refCount,
+                        "recovery must include the counted scalar-reference contents edge");
+            } finally {
+                MyVarCleanupStack.unregister(outerReference);
+                referent.refCount = 2;
+                outerReference.releaseOwnedScalarReferenceContents();
+                packageRoot.elements.remove("target");
+                hashCell.releaseScalarValueOwnerCount(
+                        referent, "MortalListScalarReferenceContentsRecoveryTest cleanup");
+            }
+        }
+    }
+
+    private static RuntimeScalar referenceTo(RuntimeBase referent) {
+        RuntimeScalar scalar = new RuntimeScalar();
+        scalar.type = RuntimeScalarType.REFERENCE;
+        scalar.value = referent;
+        return scalar;
+    }
+}

From a043a901d614a97846a874ca913194ce4e46b4da Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 10:24:22 +0100
Subject: [PATCH 303/317] wip: snapshot ownership progress before owner-slot
 acquisition work

Preserve the pending ownership design update before continuing the Phase 2
owner-slot migration.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 401c1d529a..8b5622d0a0 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), last reconciled with `origin/master` through `aeda28344`. The latest ownership candidate, tie-wrapper owner-slot migration, passes full `nice -n 19 make` locally; pushing and hosted validation are pending. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), last reconciled with `origin/master` through `aeda28344`. The current branch head `64746a16e` is pushed; its full `nice -n 19 make` gate passes locally. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -81,7 +81,7 @@ not an independent count.
 | Hash entry | `RuntimeHash.updateHashEntryOwner` attaches a `HASH_ENTRY` slot to the stable entry and scalar cell | Key replacement/deletion and hash cleanup release that identity slot; the scalar cell's value slot is released separately | `HASH_ENTRY` is identity-only for ordinary non-shared hashes. Recovery proves the owning hash is rooted and counts the cell's still-live value edge. Shared hashes retain a separate shared-slot count. |
 | Array element | `RuntimeArray.syncArrayElementOwnerSlot` / reconciliation attaches an `ARRAY_ELEMENT` slot when `ownsElement` is true | Array deletion, clear, replacement, and cleanup release the structural slot and release/queue the scalar value owner according to owned-versus-borrowed state | `ARRAY_ELEMENT` is identity-only; `SCALAR_VALUE` or the legacy bridge supplies the count. Borrowed aliases must not be promoted to an element owner. |
 | Scalar-reference contents | `PerlOwnerSlot.acquireScalarReferenceContents` records a `SCALAR_REFERENCE_CONTENTS` edge; it counts separately when a reference cell owns a distinct contents edge, and records a non-counting identity when it shares the cell's existing value owner | Retargeting or releasing the final strong alias releases the counted contents slot or allows the shared cell owner to retire | Reachable contents slots restore a live contents owner after a decrement. Aggregate recovery now counts distinct reachable contents cells alongside hash/array owners; weak aliases are excluded. |
-| Tied wrapper | Tie installation attaches a `TIE_WRAPPER` identity slot | Untie/replacement and wrapper cleanup release it | Recovery counts a wrapper only when its owner container is rooted. This slot family still depends on recovery for mixed legacy undercounts. |
+| Tied wrapper | Tie installation attaches a counted `TIE_WRAPPER` slot when the handler referent is tracked | Untie/replacement and wrapper cleanup release the slot and its count | Recovery counts a wrapper only when its owner container is rooted, then marks the slot restored so later cleanup releases that count. |
 | Closure-pad capture | `RuntimeBase.retainClosureCaptureOwner` creates a typed capture slot; aggregate captures can be native counted slots, scalar captures use a legacy bridge | Scope exit, closure release, and capture replacement retire the slot and capture state | Aggregate capture slots have direct semantic counts; scalar capture bridges still use the selective counter. The recovery scan is not their normal release authority. |
 | Deferred temporary or lifecycle hold | Blessing and method dispatch acquire a temporary count; an active END callback is rescued from zero to one by `DestroyDispatch`; closure aggregates normally acquire native capture slots | `MortalList.processDeferredBase` decrements queued counts at a cleanup boundary; abandoned method holds release immediately; END completion queues the rescued count | These generic releases carry no `PendingRelease` token. The normal bless, method-hold, and END paths each pair one temporary count with one release. The closure aggregate defer is a legacy fallback when its capture slot is absent. The focused #1794/#1795 no-recovery runs did not demonstrate a lost owner on these paths. |
 
@@ -381,6 +381,11 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   This repairs mixed recovery accounting but does not yet identify the
   production operation that can produce an undercount, so both scan callers
   remain.
+- A focused `PJ_REFCOUNT_TRACE_CLASS=File::Temp` run of the Catalyst tempfile
+  regression completed successfully but did not isolate tempfile object
+  ownership: the trace arms on the blessed package name and captured the
+  `File::Temp` package glob's setup transitions. The regression itself still
+  passes, and this trace provides no evidence to remove either recovery caller.
 - A second focused reducer,
   `issue_1649_captured_scalar_array_argument.t`, isolates the same class of
   lifetime error: a closure writes a blessed object to a captured scalar while

From a6a9cb9e2f864ce3e1a5e7d74a0801cf6abf8a10 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 10:47:44 +0100
Subject: [PATCH 304/317] refactor: acquire cloned and glob scalar owners
 through slots

Route thread-cloned scalar references and blessed glob aliases through the
SCALAR_VALUE owner-slot API so their legacy count and identity ledger move
together. Add focused release assertions for both paths.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 .../runtimetypes/MyVarCleanupStack.java       | 36 ++++++++++++-------
 .../runtimetypes/RuntimeGraphCloner.java      | 10 +++---
 .../MyVarCleanupStackOwnerSlotTest.java       | 25 +++++++++++++
 .../runtimetypes/RuntimeGraphClonerTest.java  |  5 +++
 4 files changed, 58 insertions(+), 18 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStack.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStack.java
index 87b8e90c61..8b50bc532a 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStack.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStack.java
@@ -377,12 +377,18 @@ public static void retainBlessedGlobAliases(RuntimeGlob glob, RuntimeBase refere
                     && scalar.value == glob
                     && !scalar.ownsCountedReferent(referent)
                     && seen.put(scalar, Boolean.TRUE) == null) {
-                scalar.setRefCountOwned(true);
-                referent.recordOwner(scalar, "blessed glob lexical alias");
-                referent.recordActiveOwner(scalar);
-                referent.traceRefCount(+1, "MyVarCleanupStack.retainBlessedGlobAliases");
-                referent.refCount++;
-                referent.hadCountedReference = true;
+                if (!scalar.acquireScalarValueOwnerCount(
+                        referent, "MyVarCleanupStack.retainBlessedGlobAliases")) {
+                    // Preserve the legacy count for a glob referent that has
+                    // not entered tracked ownership yet.
+                    scalar.setRefCountOwned(true);
+                    referent.recordOwner(scalar, "blessed glob lexical alias");
+                    referent.recordActiveOwner(scalar);
+                    referent.traceRefCount(+1,
+                            "MyVarCleanupStack.retainBlessedGlobAliases");
+                    referent.refCount++;
+                    referent.hadCountedReference = true;
+                }
             }
         }
         for (RuntimeScalar scalar : GlobalVariable.scalarSlots().values()) {
@@ -392,12 +398,18 @@ public static void retainBlessedGlobAliases(RuntimeGlob glob, RuntimeBase refere
                     && scalar.value == glob
                     && !scalar.ownsCountedReferent(referent)
                     && seen.put(scalar, Boolean.TRUE) == null) {
-                scalar.setRefCountOwned(true);
-                referent.recordOwner(scalar, "blessed glob package alias");
-                referent.recordActiveOwner(scalar);
-                referent.traceRefCount(+1, "MyVarCleanupStack.retainBlessedGlobAliases");
-                referent.refCount++;
-                referent.hadCountedReference = true;
+                if (!scalar.acquireScalarValueOwnerCount(
+                        referent, "MyVarCleanupStack.retainBlessedGlobAliases")) {
+                    // Preserve the legacy count for a glob referent that has
+                    // not entered tracked ownership yet.
+                    scalar.setRefCountOwned(true);
+                    referent.recordOwner(scalar, "blessed glob package alias");
+                    referent.recordActiveOwner(scalar);
+                    referent.traceRefCount(+1,
+                            "MyVarCleanupStack.retainBlessedGlobAliases");
+                    referent.refCount++;
+                    referent.hadCountedReference = true;
+                }
             }
         }
     }
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java
index 48ac19641b..954465acb0 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphCloner.java
@@ -592,12 +592,10 @@ private void restoreScalarReferenceOwnership(RuntimeScalar source, RuntimeScalar
         }
         if (referent.refCount < 0) return;
         if (referent.refCount == 0) referent.registerSharedFetchedView();
-        referent.traceRefCount(+1, "RuntimeGraphCloner.restoreScalarReferenceOwnership");
-        referent.recordOwner(target, "thread clone scalar owner");
-        referent.recordActiveOwner(target);
-        referent.refCount++;
-        referent.hadCountedReference = true;
-        target.setRefCountOwned(true);
+        if (!target.acquireScalarValueOwnerCount(
+                referent, "RuntimeGraphCloner.restoreScalarReferenceOwnership")) {
+            return;
+        }
         try (PerlRuntime.Binding ignored = targetRuntime.bind()) {
             ScalarRefRegistry.registerRef(target);
         }
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStackOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStackOwnerSlotTest.java
index 317a40b756..6832f43654 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStackOwnerSlotTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/MyVarCleanupStackOwnerSlotTest.java
@@ -8,6 +8,31 @@
 
 @Tag("unit")
 class MyVarCleanupStackOwnerSlotTest {
+    @Test
+    void retainingTrackedBlessedGlobAliasAcquiresCountThroughScalarSlot() {
+        PerlRuntime runtime = new PerlRuntime();
+        try (PerlRuntime.Binding ignored = runtime.bind()) {
+            RuntimeGlob glob = new RuntimeGlob("OwnerSlotGlob::TRACKED_HANDLE");
+            glob.refCount = 0;
+            RuntimeScalar lexicalAlias = new RuntimeScalar();
+            lexicalAlias.type = RuntimeScalarType.GLOB;
+            lexicalAlias.value = glob;
+            MyVarCleanupStack.register(lexicalAlias);
+            try {
+                MyVarCleanupStack.retainBlessedGlobAliases(glob, glob);
+
+                assertEquals(1, glob.refCount);
+                assertEquals(1, glob.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+                assertTrue(lexicalAlias.releaseScalarValueOwnerCount(
+                        glob, "MyVarCleanupStackOwnerSlotTest release"));
+                assertEquals(0, glob.refCount);
+                assertEquals(0, glob.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+            } finally {
+                MyVarCleanupStack.unregister(lexicalAlias);
+            }
+        }
+    }
+
     @Test
     void retainingBlessedGlobAliasDoesNotDuplicateRetiredLegacyOwner() {
         PerlRuntime runtime = new PerlRuntime();
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphClonerTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphClonerTest.java
index edbdfa3e18..68aed3d138 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphClonerTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/RuntimeGraphClonerTest.java
@@ -109,6 +109,11 @@ void restoresClonedOwnershipFromExplicitSourceSlotAfterLegacyFlagRetires() {
         assertEquals(1, clonedReferent.refCount);
         assertTrue(cloned.refCountOwned);
         assertTrue(cloned.scalarValueOwnerSlot().isActive());
+        assertEquals(1, clonedReferent.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
+        assertTrue(cloned.releaseScalarValueOwnerCount(
+                clonedReferent, "RuntimeGraphClonerTest cloned owner release"));
+        assertEquals(0, clonedReferent.refCount);
+        assertEquals(0, clonedReferent.ownerSlotCount(PerlOwnerSlot.Kind.SCALAR_VALUE));
     }
 
     @Test

From 2a2a44a16ed7de1d3c3a24f8c77276ba223bcf7c Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 10:50:44 +0100
Subject: [PATCH 305/317] docs: record scalar owner-slot migration progress

Document the cloned-scalar and blessed-glob owner acquisitions now routed
through SCALAR_VALUE slots, their verification, and the remaining recovery
boundary.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 8b5622d0a0..f9373f61fb 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), last reconciled with `origin/master` through `aeda28344`. The current branch head `64746a16e` is pushed; its full `nice -n 19 make` gate passes locally. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), last reconciled with `origin/master` through `aeda28344`. The current ownership changes are pushed, and the latest code batch passes the full `nice -n 19 make` gate locally. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -386,6 +386,13 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   ownership: the trace arms on the blessed package name and captured the
   `File::Temp` package glob's setup transitions. The regression itself still
   passes, and this trace provides no evidence to remove either recovery caller.
+- Thread-cloned scalar references and blessed glob aliases now acquire their
+  tracked `SCALAR_VALUE` owner through the slot API, keeping count acquisition
+  and slot identity together. The glob path retains its legacy fallback for
+  untracked referents. Focused Java tests verify the new owners release through
+  their slots; `nice -n 19 make` passes in 18m37s. This advances scalar-owner
+  migration but does not change lifecycle dispatch authority or remove either
+  aggregate-recovery caller.
 - A second focused reducer,
   `issue_1649_captured_scalar_array_argument.t`, isolates the same class of
   lifetime error: a closure writes a blessed object to a captured scalar while

From baf4e5325b6d6d1306c2aed9534a2bdd53aab3b2 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 11:01:24 +0100
Subject: [PATCH 306/317] fix: count rooted tie wrappers when handlers become
 tracked

Promote wrapper owner slots during untracked-to-tracked handler transitions
when their owning tied container is rooted. This accounts for the wrapper
edge directly instead of relying on aggregate recovery to restore it.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 .../runtime/operators/ReferenceOperators.java |  1 +
 .../runtime/runtimetypes/MortalList.java      | 27 +++++++++++++++++++
 .../runtime/runtimetypes/PerlOwnerSlot.java   | 20 ++++++++++++++
 .../runtime/runtimetypes/RuntimeScalar.java   |  2 ++
 .../runtimetypes/TieWrapperOwnerSlotTest.java | 14 ++++++----
 5 files changed, 59 insertions(+), 5 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/operators/ReferenceOperators.java b/src/main/java/org/perlonjava/runtime/operators/ReferenceOperators.java
index 6278889d08..7f66263b8b 100644
--- a/src/main/java/org/perlonjava/runtime/operators/ReferenceOperators.java
+++ b/src/main/java/org/perlonjava/runtime/operators/ReferenceOperators.java
@@ -255,6 +255,7 @@ private static RuntimeScalar bless(RuntimeScalar runtimeScalar, RuntimeScalar cl
                         scalarReferent.localBindingExists = true;
                     }
                     referent.refCount = existingScalarOwner ? 2 : 1;
+                    MortalList.promoteRootedTieWrapperOwners(referent);
                     if (existingScalarOwner) {
                         referent.recordOwner(runtimeScalar, "first bless of existing scalar ref");
                         runtimeScalar.setRefCountOwned(true);
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 46e85f62b0..2b4fe38cde 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -2085,6 +2085,33 @@ static boolean restoreReachableAggregateOwnerCount(RuntimeBase referent) {
         return true;
     }
 
+    /**
+     * Promote rooted tie-wrapper edges when a previously untracked handler
+     * enters selective counting. This keeps the wrapper count direct instead
+     * of waiting for aggregate recovery to reconstruct it later.
+     */
+    public static void promoteRootedTieWrapperOwners(RuntimeBase referent) {
+        if (referent == null || referent.refCount < 0) return;
+        Map<RuntimeBase, Boolean> rootedContainers = new IdentityHashMap<>();
+        for (PerlOwnerSlot slot : referent.ownerSlotSnapshot()) {
+            if (slot.kind() != PerlOwnerSlot.Kind.TIE_WRAPPER
+                    || slot.referent() != referent || slot.tieWrapperCounted()) {
+                continue;
+            }
+            RuntimeBase owner = slot.ownerContainer();
+            if (owner == null) continue;
+            Boolean rooted = rootedContainers.get(owner);
+            if (rooted == null) {
+                rooted = isRootedOwnerContainer(owner, referent);
+                rootedContainers.put(owner, rooted);
+            }
+            if (rooted) {
+                slot.promoteTieWrapperCount(
+                        referent, "MortalList.promoteRootedTieWrapperOwners");
+            }
+        }
+    }
+
     private static boolean isRootedAggregateOwnerCached(
             RuntimeBase owner, RuntimeBase excludedReferent,
             Map<RuntimeBase, Boolean> rootedAggregateOwners) {
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
index cfe95eb9b9..0166a80284 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/PerlOwnerSlot.java
@@ -506,6 +506,26 @@ synchronized void markTieWrapperCountRestored() {
         tieWrapperCounted = true;
     }
 
+    /** Count a previously untracked wrapper owner when its rooted target is promoted. */
+    synchronized boolean promoteTieWrapperCount(RuntimeBase expectedTarget, String acquireSite) {
+        if (kind != Kind.TIE_WRAPPER) {
+            throw new IllegalStateException(
+                    "tie-wrapper promotion requires a TIE_WRAPPER slot");
+        }
+        if (referent != expectedTarget || expectedTarget == null || tieWrapperCounted) {
+            return false;
+        }
+        if (expectedTarget.refCount < 0) return false;
+        if (expectedTarget.refCount == Integer.MAX_VALUE) {
+            throw new IllegalStateException("tie-wrapper owner count overflow");
+        }
+        expectedTarget.traceRefCount(+1, acquireSite);
+        expectedTarget.refCount++;
+        expectedTarget.hadCountedReference = true;
+        tieWrapperCounted = true;
+        return true;
+    }
+
     /** Retire a tie-wrapper owner identity and decrement its legacy bridge count. */
     synchronized boolean releaseTieWrapperCount(RuntimeBase expectedTarget, String releaseSite) {
         if (kind != Kind.TIE_WRAPPER) {
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 41582a8d04..3bd743e76c 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -2491,6 +2491,7 @@ public static void incrementRefCountForContainerStore(RuntimeScalar scalar) {
                 return;
             }
             base.refCount = 0;
+            MortalList.promoteRootedTieWrapperOwners(base);
         }
         if (!scalar.acquireScalarValueOwnerCount(
                 base, "RuntimeScalar.incrementRefCountForContainerStore")) {
@@ -3146,6 +3147,7 @@ && scalarReferenceContentsOwnersSnapshot().isEmpty()
             if (nb.refCount < 0
                     && (nb instanceof RuntimeHash || nb instanceof RuntimeArray)) {
                 nb.refCount = 0;
+                MortalList.promoteRootedTieWrapperOwners(nb);
             }
             if (nb.refCount >= 0 && !scalarContentsOwnedByEscapedReference) {
                 if (nb.refCount == 0) nb.registerSharedFetchedView();
diff --git a/src/test/java/org/perlonjava/runtime/runtimetypes/TieWrapperOwnerSlotTest.java b/src/test/java/org/perlonjava/runtime/runtimetypes/TieWrapperOwnerSlotTest.java
index cc18c9e77d..5e44002d59 100644
--- a/src/test/java/org/perlonjava/runtime/runtimetypes/TieWrapperOwnerSlotTest.java
+++ b/src/test/java/org/perlonjava/runtime/runtimetypes/TieWrapperOwnerSlotTest.java
@@ -57,7 +57,7 @@ void tiedHandleWrapperOwnsAndReleasesDistinctHandlerSlot() {
     }
 
     @Test
-    void wrapperCreatedBeforeHandlerTrackingDoesNotReleaseAnotherOwnersCount() {
+    void wrapperCreatedBeforeHandlerTrackingCountsWhenRootedHandlerIsPromoted() {
         PerlRuntime runtime = new PerlRuntime();
         try (PerlRuntime.Binding ignored = runtime.bind()) {
             RuntimeArray referent = new RuntimeArray();
@@ -76,12 +76,16 @@ void wrapperCreatedBeforeHandlerTrackingDoesNotReleaseAnotherOwnersCount() {
                 assertEquals(1, referent.ownerSlotCount(PerlOwnerSlot.Kind.TIE_WRAPPER));
 
                 referent.activateOwnerTracking();
-                countedOwner.set(referent.createAnonymousReference());
+                RuntimeScalar handlerReference = new RuntimeScalar();
+                handlerReference.type = RuntimeScalarType.ARRAYREFERENCE;
+                handlerReference.value = referent;
+                countedOwner.set(handlerReference);
                 MyVarCleanupStack.register(countedOwner);
-                assertEquals(1, referent.refCount);
-                assertTrue(MortalList.restoreReachableAggregateOwnerCount(referent),
-                        "root recovery includes the wrapper edge created before tracking");
                 assertEquals(2, referent.refCount);
+                assertTrue(referent.ownerSlotSnapshot().stream()
+                        .filter(slot -> slot.kind() == PerlOwnerSlot.Kind.TIE_WRAPPER)
+                        .findFirst().orElseThrow().tieWrapperCounted(),
+                        "the rooted wrapper edge is counted during handler promotion");
 
                 wrapper.releaseTiedObject();
 

From 33bad42341a07c96a28c954e99a5a17b9ba80973 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 11:33:54 +0100
Subject: [PATCH 307/317] docs: record direct tie-wrapper promotion

Document the promotion path for rooted tie wrappers and retain the remaining
recovery callers as open Phase 2 work.

Generated with [Codex](https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index f9373f61fb..8925d5a0eb 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -81,7 +81,7 @@ not an independent count.
 | Hash entry | `RuntimeHash.updateHashEntryOwner` attaches a `HASH_ENTRY` slot to the stable entry and scalar cell | Key replacement/deletion and hash cleanup release that identity slot; the scalar cell's value slot is released separately | `HASH_ENTRY` is identity-only for ordinary non-shared hashes. Recovery proves the owning hash is rooted and counts the cell's still-live value edge. Shared hashes retain a separate shared-slot count. |
 | Array element | `RuntimeArray.syncArrayElementOwnerSlot` / reconciliation attaches an `ARRAY_ELEMENT` slot when `ownsElement` is true | Array deletion, clear, replacement, and cleanup release the structural slot and release/queue the scalar value owner according to owned-versus-borrowed state | `ARRAY_ELEMENT` is identity-only; `SCALAR_VALUE` or the legacy bridge supplies the count. Borrowed aliases must not be promoted to an element owner. |
 | Scalar-reference contents | `PerlOwnerSlot.acquireScalarReferenceContents` records a `SCALAR_REFERENCE_CONTENTS` edge; it counts separately when a reference cell owns a distinct contents edge, and records a non-counting identity when it shares the cell's existing value owner | Retargeting or releasing the final strong alias releases the counted contents slot or allows the shared cell owner to retire | Reachable contents slots restore a live contents owner after a decrement. Aggregate recovery now counts distinct reachable contents cells alongside hash/array owners; weak aliases are excluded. |
-| Tied wrapper | Tie installation attaches a counted `TIE_WRAPPER` slot when the handler referent is tracked | Untie/replacement and wrapper cleanup release the slot and its count | Recovery counts a wrapper only when its owner container is rooted, then marks the slot restored so later cleanup releases that count. |
+| Tied wrapper | Tie installation attaches a counted `TIE_WRAPPER` slot when the handler is tracked; scalar-store and first-bless promotion also count an existing wrapper slot when its owner container is rooted | Untie/replacement and wrapper cleanup release the slot and its count | Recovery still reconstructs tied-wrapper counts for mixed states not yet covered by a direct tracking transition. |
 | Closure-pad capture | `RuntimeBase.retainClosureCaptureOwner` creates a typed capture slot; aggregate captures can be native counted slots, scalar captures use a legacy bridge | Scope exit, closure release, and capture replacement retire the slot and capture state | Aggregate capture slots have direct semantic counts; scalar capture bridges still use the selective counter. The recovery scan is not their normal release authority. |
 | Deferred temporary or lifecycle hold | Blessing and method dispatch acquire a temporary count; an active END callback is rescued from zero to one by `DestroyDispatch`; closure aggregates normally acquire native capture slots | `MortalList.processDeferredBase` decrements queued counts at a cleanup boundary; abandoned method holds release immediately; END completion queues the rescued count | These generic releases carry no `PendingRelease` token. The normal bless, method-hold, and END paths each pair one temporary count with one release. The closure aggregate defer is a legacy fallback when its capture slot is absent. The focused #1794/#1795 no-recovery runs did not demonstrate a lost owner on these paths. |
 
@@ -393,6 +393,12 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   their slots; `nice -n 19 make` passes in 18m37s. This advances scalar-owner
   migration but does not change lifecycle dispatch authority or remove either
   aggregate-recovery caller.
+- A tie wrapper installed before its handler is tracked now gains its count
+  when a scalar store or first bless promotes the handler, provided the tied
+  owner container is rooted. The focused regression now checks the count before
+  any recovery call. `TieWrapperOwnerSlotTest` passes 5/5, and the full
+  `nice -n 19 make` passes in 17m32s. Recovery remains for other mixed owner
+  transitions, and both production callers remain under audit.
 - A second focused reducer,
   `issue_1649_captured_scalar_array_argument.t`, isolates the same class of
   lifetime error: a closure writes a blessed object to a captured scalar while

From 98ab2e661fa9362a12e387f58b2529ac837f3f81 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 12:09:40 +0100
Subject: [PATCH 308/317] debug: trace aggregate owner recovery provenance

Add opt-in, class-filtered diagnostics for the two aggregate owner recovery
paths. Record the pending release source and the rooted slot kinds used to
reconstruct an owner count, so the remaining recovery scan can be audited
against the controller and tempfile lifetime regressions.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <chatgpt.com>
---
 dev/design/perl-ownership-rewrite.md          | 15 ++++++
 .../runtime/runtimetypes/MortalList.java      | 52 ++++++++++++++++++-
 .../runtime/runtimetypes/RuntimeScalar.java   |  3 +-
 3 files changed, 67 insertions(+), 3 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 8925d5a0eb..9909ad7bb4 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -399,6 +399,21 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   any recovery call. `TieWrapperOwnerSlotTest` passes 5/5, and the full
   `nice -n 19 make` passes in 17m32s. Recovery remains for other mixed owner
   transitions, and both production callers remain under audit.
+- On 2026-10-25, added opt-in `PJ_OWNER_RECOVERY_TRACE_CLASS` logging around
+  both production recovery callers. It records the pending release provenance,
+  rooted slot kinds, and whether recovery restored a count. The full
+  `nice -n 19 make` gate passes in 17m01s. The socket-independent #1794
+  transaction/controller ownership test passes 3/3 on system Perl and JVM;
+  its controller release reaches recovery with no rooted owner slots, while
+  the transaction overwrite has a rooted hash slot but does not need a count
+  restoration. The network-based Mojolicious controller tests skip because
+  loopback sockets are unavailable in this environment, so those results do
+  not validate the integration path here. The #1795 Catalyst tempfile test
+  passes and records one actual `File::Temp` recovery with two restored owners
+  backed by one hash entry, one array element, and two scalar-value slots.
+  This is direct evidence to retain the recovery scan and both callers. The
+  logging is disabled unless its class filter is set. The broader owner-slot
+  migration remains incomplete.
 - A second focused reducer,
   `issue_1649_captured_scalar_array_argument.t`, isolates the same class of
   lifetime error: a closure writes a blessed object to a captured scalar while
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 2b4fe38cde..e3db03e7c4 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -22,6 +22,8 @@
 public class MortalList {
     private static final int MAX_UNBLESSED_AGGREGATE_DRAIN_ROOTS = 50_000;
     private static final AtomicInteger runtimesWithBoundaryWork = new AtomicInteger();
+    private static final String OWNER_RECOVERY_TRACE_CLASS =
+            System.getenv("PJ_OWNER_RECOVERY_TRACE_CLASS");
 
     static final class ReachabilityQueryMeasurement implements AutoCloseable {
         private final LifecycleRuntimeState state;
@@ -1797,7 +1799,8 @@ private static void processDeferredBase(RuntimeBase base, boolean clearWeakRefsF
                 // have a legacy bridge count and retain the old compatibility
                 // sentinel behavior.
                 if (base.nativeCaptureOwnerCount() == 0) base.refCount = 1;
-            } else if (restoreReachableAggregateOwnerCount(base)) {
+            } else if (restoreReachableAggregateOwnerCount(
+                    base, deferredReleaseProvenance(ownerRelease, transientOwnerKind))) {
                 // A hash-entry owner has a stable semantic slot identity even
                 // when an unrelated legacy scalar decrement consumes the
                 // selective count. Restore the count from independently owned
@@ -1996,6 +1999,11 @@ && isReachableCached(base)) {
 
     /** Restore legacy count for aggregate owner slots still reachable from Perl roots. */
     static boolean restoreReachableAggregateOwnerCount(RuntimeBase referent) {
+        return restoreReachableAggregateOwnerCount(referent, "direct invocation");
+    }
+
+    static boolean restoreReachableAggregateOwnerCount(
+            RuntimeBase referent, String releaseProvenance) {
         Set<RuntimeScalar> rootedHashCells = Collections.newSetFromMap(new IdentityHashMap<>());
         Set<RuntimeScalar> rootedScalarReferenceCells =
                 Collections.newSetFromMap(new IdentityHashMap<>());
@@ -2077,14 +2085,54 @@ static boolean restoreReachableAggregateOwnerCount(RuntimeBase referent) {
             }
             owners++;
         }
-        if (owners == 0) return false;
+        if (owners == 0) {
+            traceAggregateOwnerRecovery(referent, releaseProvenance, false, 0, ownerSlots);
+            return false;
+        }
         for (PerlOwnerSlot slot : rootedTieWrappers) {
             slot.markTieWrapperCountRestored();
         }
         referent.refCount = owners;
+        traceAggregateOwnerRecovery(referent, releaseProvenance, true, owners, ownerSlots);
         return true;
     }
 
+    private static String deferredReleaseProvenance(
+            RuntimeBase.PendingOwnerRelease release, String transientOwnerKind) {
+        if (OWNER_RECOVERY_TRACE_CLASS == null || OWNER_RECOVERY_TRACE_CLASS.isEmpty()) {
+            return null;
+        }
+        if (release == null) {
+            return "MortalList.processDeferredBase transient=" + transientOwnerKind;
+        }
+        PerlOwnerSlot.PendingRelease slotRelease = release.ownerSlotRelease;
+        String slot = slotRelease == null ? "" : " slot=" + slotRelease.kind()
+                + ":" + slotRelease.ownerSlotIdentity()
+                + "/" + slotRelease.sequence();
+        return "MortalList.processDeferredBase queue=" + release.queueSite
+                + " acquire=" + release.acquireSite + slot;
+    }
+
+    private static void traceAggregateOwnerRecovery(
+            RuntimeBase referent, String releaseProvenance, boolean recovered,
+            int restoredOwners, Set<PerlOwnerSlot> ownerSlots) {
+        if (OWNER_RECOVERY_TRACE_CLASS == null || OWNER_RECOVERY_TRACE_CLASS.isEmpty()) return;
+        String className = referent.blessId == 0
+                ? referent.getClass().getSimpleName()
+                : NameNormalizer.getBlessStr(referent.blessId);
+        if (className == null || !className.contains(OWNER_RECOVERY_TRACE_CLASS)) return;
+        Map<PerlOwnerSlot.Kind, Integer> slotCounts = new java.util.EnumMap<>(PerlOwnerSlot.Kind.class);
+        for (PerlOwnerSlot slot : ownerSlots) {
+            slotCounts.merge(slot.kind(), 1, Integer::sum);
+        }
+        System.err.println("[OWNER-RECOVERY] base=" + System.identityHashCode(referent)
+                + " class=" + className
+                + " recovered=" + recovered
+                + " restoredOwners=" + restoredOwners
+                + " slots=" + slotCounts
+                + " release=" + releaseProvenance);
+    }
+
     /**
      * Promote rooted tie-wrapper edges when a previously untracked handler
      * enters selective counting. This keeps the wrapper count direct instead
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
index 3bd743e76c..e0814f66a1 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java
@@ -3349,7 +3349,8 @@ && hasLiveIo(assignedGlob)) {
                     // slot holds a strong reference not counted in refCount.
                     // Don't call callDestroy — the container is still alive.
                     // Cleanup will happen at scope exit (scopeExitCleanupHash/Array).
-                } else if (MortalList.restoreReachableAggregateOwnerCount(oldBase)) {
+                } else if (MortalList.restoreReachableAggregateOwnerCount(
+                        oldBase, "RuntimeScalar.setLargeRefCounted overwrite")) {
                     // Explicit aggregate slots can prove a rooted owner chain
                     // even when a nested expression temporary is absent from
                     // the conservative lexical walker roots.

From 6a47bb80366884c7c7d0e9226fe0303bd84f225c Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 13:28:59 +0100
Subject: [PATCH 309/317] docs: record extended lifetime regression evidence

Record extended-access controller, WebSocket, Catalyst global-destruction,
and focused ownership results across both backends. Correct the earlier
File::Temp trace note with the observed weak-walker and rooted-slot mismatch,
which still requires owner-container tracing before recovery changes.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <chatgpt.com>
---
 dev/design/perl-ownership-rewrite.md | 31 ++++++++++++++++------------
 1 file changed, 18 insertions(+), 13 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 9909ad7bb4..1cb1fffc93 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -381,11 +381,16 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   This repairs mixed recovery accounting but does not yet identify the
   production operation that can produce an undercount, so both scan callers
   remain.
-- A focused `PJ_REFCOUNT_TRACE_CLASS=File::Temp` run of the Catalyst tempfile
-  regression completed successfully but did not isolate tempfile object
-  ownership: the trace arms on the blessed package name and captured the
-  `File::Temp` package glob's setup transitions. The regression itself still
-  passes, and this trace provides no evidence to remove either recovery caller.
+- The initial `PJ_REFCOUNT_TRACE_CLASS=File::Temp` trace was inconclusive, but
+  a class-filtered owner/count trace later isolated an actual blessed
+  `RuntimeGlob` `File::Temp` referent. During the Catalyst regression,
+  `ReachabilityWalker` reported it unreachable at `refCount=2`, while the
+  aggregate recovery scan found two rooted owners from one hash entry, one
+  array element, and two scalar-value slots. The pending release drained while
+  `DESTROY` was running. This is a disagreement between weak-walk reachability
+  and the explicit slot proof; it does not identify a missing count acquisition
+  or justify removing recovery. A follow-up should trace the owning containers
+  and reconcile the two root proofs before changing either path.
 - Thread-cloned scalar references and blessed glob aliases now acquire their
   tracked `SCALAR_VALUE` owner through the slot API, keeping count acquisition
   and slot identity together. The glob path retains its legacy fallback for
@@ -406,14 +411,14 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   transaction/controller ownership test passes 3/3 on system Perl and JVM;
   its controller release reaches recovery with no rooted owner slots, while
   the transaction overwrite has a rooted hash slot but does not need a count
-  restoration. The network-based Mojolicious controller tests skip because
-  loopback sockets are unavailable in this environment, so those results do
-  not validate the integration path here. The #1795 Catalyst tempfile test
-  passes and records one actual `File::Temp` recovery with two restored owners
-  backed by one hash entry, one array element, and two scalar-value slots.
-  This is direct evidence to retain the recovery scan and both callers. The
-  logging is disabled unless its class filter is set. The broader owner-slot
-  migration remains incomplete.
+  restoration. With extended loopback access, the controller-finish,
+  WebSocket-controller, WebSocket-callback, and Catalyst tempfile regressions
+  pass on both backends (5/5, 6/6, 29/29, and 24/24); the dedicated Catalyst
+  global-destruction wrapper passes 3/3 on both. Five focused #1649 ownership
+  regressions pass 22/22 on system Perl and pass individually on JVM and
+  interpreter. The logging is disabled unless its class filter is set. The
+  root-proof discrepancy above remains under investigation, and the broader
+  owner-slot migration remains incomplete.
 - A second focused reducer,
   `issue_1649_captured_scalar_array_argument.t`, isolates the same class of
   lifetime error: a closure writes a blessed object to a captured scalar while

From da0835c3f1d9438604b167b9245997221724e1ac Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 13:30:36 +0100
Subject: [PATCH 310/317] debug: trace aggregate recovery owner slot identities

Extend class-filtered aggregate recovery diagnostics with the owner container,
scalar cell, value type, ownership flags, and destruction state for each slot.
This allows the File::Temp weak-walker miss to be mapped to its actual Perl
owner cells without changing the default runtime path.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <chatgpt.com>
---
 .../runtime/runtimetypes/MortalList.java      | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index e3db03e7c4..9e6cd32fed 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -2122,14 +2122,33 @@ private static void traceAggregateOwnerRecovery(
                 : NameNormalizer.getBlessStr(referent.blessId);
         if (className == null || !className.contains(OWNER_RECOVERY_TRACE_CLASS)) return;
         Map<PerlOwnerSlot.Kind, Integer> slotCounts = new java.util.EnumMap<>(PerlOwnerSlot.Kind.class);
+        List<String> slotDetails = new java.util.ArrayList<>();
         for (PerlOwnerSlot slot : ownerSlots) {
             slotCounts.merge(slot.kind(), 1, Integer::sum);
+            RuntimeBase owner = slot.ownerContainer();
+            RuntimeScalar cell = slot.ownerCell();
+            String ownerLabel = owner == null ? "none"
+                    : owner.getClass().getSimpleName() + "@" + System.identityHashCode(owner);
+            String cellLabel = cell == null ? "none"
+                    : "@" + System.identityHashCode(cell)
+                            + ":type=" + cell.type
+                            + ":valueMatches=" + (cell.value == referent)
+                            + ":weak=" + WeakRefRegistry.isweak(cell)
+                            + ":owned=" + cell.refCountOwned
+                            + ":scalarSlot=" + cell.hasScalarValueOwnerSlotFor(referent)
+                            + ":container=" + (cell.containerOwner == null ? "none"
+                                    : cell.containerOwner.getClass().getSimpleName() + "@"
+                                            + System.identityHashCode(cell.containerOwner));
+            slotDetails.add(slot.kind() + "#" + slot.identity()
+                    + " owner=" + ownerLabel + " cell=" + cellLabel);
         }
         System.err.println("[OWNER-RECOVERY] base=" + System.identityHashCode(referent)
                 + " class=" + className
                 + " recovered=" + recovered
                 + " restoredOwners=" + restoredOwners
                 + " slots=" + slotCounts
+                + " slotDetails=" + slotDetails
+                + " currentlyDestroying=" + referent.currentlyDestroying
                 + " release=" + releaseProvenance);
     }
 

From 9f65273af7218c9d347ce16cd3013a8991882020 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 14:06:20 +0100
Subject: [PATCH 311/317] docs: record tempfile owner slot trace

Record that the recovered File::Temp count is backed by two owned glob
reference cells with active scalar-value slots. The remaining mismatch is
between weak-walker reachability and these rooted aggregate owner edges.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: OpenAI Codex <chatgpt.com>
---
 dev/design/perl-ownership-rewrite.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 1cb1fffc93..241d4b0293 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -419,6 +419,14 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   interpreter. The logging is disabled unless its class filter is set. The
   root-proof discrepancy above remains under investigation, and the broader
   owner-slot migration remains incomplete.
+- A follow-up slot-detail trace shows the two recovered tempfile owners are
+  already represented by owned `GLOBREFERENCE` cells with active
+  `SCALAR_VALUE` slots. One cell is present in both a hash and an array; the
+  second is present in an array. Recovery runs with `currentlyDestroying=true`.
+  The current evidence therefore does not show a missing retain; it shows the
+  weak walker marking an object unreachable despite these counted owner cells.
+  Trace the parent container chain to reconcile that root proof before changing
+  the owner ledger or the weak sweep.
 - A second focused reducer,
   `issue_1649_captured_scalar_array_argument.t`, isolates the same class of
   lifetime error: a closure writes a blessed object to a captured scalar while

From 2885680de25216856e7489de82d6094de39a7c84 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 14:10:04 +0100
Subject: [PATCH 312/317] debug: trace recovery owner root chains

Extend the opt-in recovery diagnostics with sweep-live membership, root flags,
and immediate parent owner slots for each recovery container. This identifies
which root proof accepts an aggregate that the weak sweep does not reach.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 .../runtime/runtimetypes/MortalList.java      | 45 ++++++++++++++++++-
 1 file changed, 43 insertions(+), 2 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 9e6cd32fed..eb618671cf 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -2127,8 +2127,7 @@ private static void traceAggregateOwnerRecovery(
             slotCounts.merge(slot.kind(), 1, Integer::sum);
             RuntimeBase owner = slot.ownerContainer();
             RuntimeScalar cell = slot.ownerCell();
-            String ownerLabel = owner == null ? "none"
-                    : owner.getClass().getSimpleName() + "@" + System.identityHashCode(owner);
+            String ownerLabel = describeRecoveryOwnerContainer(owner);
             String cellLabel = cell == null ? "none"
                     : "@" + System.identityHashCode(cell)
                             + ":type=" + cell.type
@@ -2152,6 +2151,48 @@ private static void traceAggregateOwnerRecovery(
                 + " release=" + releaseProvenance);
     }
 
+    private static String describeRecoveryOwnerContainer(RuntimeBase owner) {
+        if (owner == null) return "none";
+        StringBuilder detail = new StringBuilder(owner.getClass().getSimpleName())
+                .append('@').append(System.identityHashCode(owner))
+                .append("{inSweepLive=")
+                .append(state().weakSweepLiveReferents != null
+                        && state().weakSweepLiveReferents.contains(owner))
+                .append(",explicitRoot=").append(isExplicitAggregateRoot(owner))
+                .append(",registered=").append(MyVarCleanupStack.isRegistered(owner))
+                .append(",liveLexical=").append(MyVarCleanupStack.isLive(owner))
+                .append(",scopeExited=").append(owner.scopeExited)
+                .append(",semanticCaptureOwners=").append(owner.semanticCaptureOwnerCount());
+        if (owner instanceof RuntimeHash hash) {
+            detail.append(",packageRoot=").append(hash.isPackageRootedHash())
+                    .append(",specialElements=")
+                    .append(hash.elements instanceof HashSpecialVariable);
+        } else if (owner instanceof RuntimeArray array) {
+            detail.append(",packageRoot=").append(array.isPackageGlobalRoot)
+                    .append(",elementsAliased=").append(array.elementsAliased);
+        }
+        List<String> parentSlots = new java.util.ArrayList<>();
+        for (PerlOwnerSlot parentSlot : owner.ownerSlotSnapshot()) {
+            if (parentSlot.referent() != owner) continue;
+            RuntimeBase parent = parentSlot.ownerContainer();
+            RuntimeScalar parentCell = parentSlot.ownerCell();
+            String parentLabel = parent == null ? "none"
+                    : parent.getClass().getSimpleName() + "@"
+                            + System.identityHashCode(parent);
+            String cellLabel = parentCell == null ? "none"
+                    : "@" + System.identityHashCode(parentCell)
+                            + ":type=" + parentCell.type
+                            + ":valueMatches=" + (parentCell.value == owner)
+                            + ":weak=" + WeakRefRegistry.isweak(parentCell)
+                            + ":owned=" + parentCell.refCountOwned
+                            + ":registered=" + MyVarCleanupStack.isRegistered(parentCell)
+                            + ":live=" + MyVarCleanupStack.isLive(parentCell);
+            parentSlots.add(parentSlot.kind() + "#" + parentSlot.identity()
+                    + " parent=" + parentLabel + " cell=" + cellLabel);
+        }
+        return detail.append(",parentSlots=").append(parentSlots).append('}').toString();
+    }
+
     /**
      * Promote rooted tie-wrapper edges when a previously untracked handler
      * enters selective counting. This keeps the wrapper count direct instead

From 68e52b8bd148a860325e7a3dca2134756cf324cd Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 14:42:17 +0100
Subject: [PATCH 313/317] debug: measure recovery owner root queries

Add diagnostic reachability query counters to the filtered owner recovery
trace so conservative budget exhaustion can be distinguished from a proven
root path.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 .../runtime/runtimetypes/MortalList.java           | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index eb618671cf..02b862aab3 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -2127,7 +2127,7 @@ private static void traceAggregateOwnerRecovery(
             slotCounts.merge(slot.kind(), 1, Integer::sum);
             RuntimeBase owner = slot.ownerContainer();
             RuntimeScalar cell = slot.ownerCell();
-            String ownerLabel = describeRecoveryOwnerContainer(owner);
+            String ownerLabel = describeRecoveryOwnerContainer(owner, referent);
             String cellLabel = cell == null ? "none"
                     : "@" + System.identityHashCode(cell)
                             + ":type=" + cell.type
@@ -2151,7 +2151,8 @@ private static void traceAggregateOwnerRecovery(
                 + " release=" + releaseProvenance);
     }
 
-    private static String describeRecoveryOwnerContainer(RuntimeBase owner) {
+    private static String describeRecoveryOwnerContainer(
+            RuntimeBase owner, RuntimeBase excludedReferent) {
         if (owner == null) return "none";
         StringBuilder detail = new StringBuilder(owner.getClass().getSimpleName())
                 .append('@').append(System.identityHashCode(owner))
@@ -2171,6 +2172,15 @@ && state().weakSweepLiveReferents.contains(owner))
             detail.append(",packageRoot=").append(array.isPackageGlobalRoot)
                     .append(",elementsAliased=").append(array.elementsAliased);
         }
+        try (ReachabilityQueryMeasurement measurement = measureReachabilityQueries()) {
+            boolean reachable = ReachabilityWalker.isReachableFromRoots(
+                    owner, true, excludedReferent);
+            ReachabilityQueryStats stats = measurement.stats();
+            detail.append(",globalRootQuery=").append(reachable)
+                    .append(":roots=").append(stats.rootsSeeded)
+                    .append(":nodes=").append(stats.nodesVisited)
+                    .append(":edges=").append(stats.edgesInspected);
+        }
         List<String> parentSlots = new java.util.ArrayList<>();
         for (PerlOwnerSlot parentSlot : owner.ownerSlotSnapshot()) {
             if (parentSlot.referent() != owner) continue;

From 98314b037aaf52e082b931f1946fa0a6741c6738 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 14:44:05 +0100
Subject: [PATCH 314/317] debug: identify capped recovery owner root walks

Expose whether a filtered destruction owner root query returned through
its conservative node or edge budget. This distinguishes a discovered root
path from an incomplete reachability proof in the diagnostic trace.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 .../runtime/runtimetypes/MortalList.java         |  3 ++-
 .../runtimetypes/ReachabilityQueryStats.java     |  1 +
 .../runtime/runtimetypes/ReachabilityWalker.java | 16 ++++++++++++++--
 3 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 02b862aab3..98fb708313 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -2179,7 +2179,8 @@ && state().weakSweepLiveReferents.contains(owner))
             detail.append(",globalRootQuery=").append(reachable)
                     .append(":roots=").append(stats.rootsSeeded)
                     .append(":nodes=").append(stats.nodesVisited)
-                    .append(":edges=").append(stats.edgesInspected);
+                    .append(":edges=").append(stats.edgesInspected)
+                    .append(":capped=").append(stats.rootQueriesBudgetCapped);
         }
         List<String> parentSlots = new java.util.ArrayList<>();
         for (PerlOwnerSlot parentSlot : owner.ownerSlotSnapshot()) {
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityQueryStats.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityQueryStats.java
index 15ea0af625..d54c90b107 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityQueryStats.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityQueryStats.java
@@ -3,6 +3,7 @@
 /** Optional per-runtime counters for deterministic reachability cost tests. */
 final class ReachabilityQueryStats {
     long rootQueries;
+    long rootQueriesBudgetCapped;
     long rootsSeeded;
     long edgesInspected;
     long nodesVisited;
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
index 9b6601ccfd..6d782bab05 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/ReachabilityWalker.java
@@ -1374,16 +1374,23 @@ boolean isReachable(RuntimeBase target) {
 
     private static final class RootWalkBudget {
         private final int maxEdges;
+        private final ReachabilityQueryStats stats;
         private int edgesVisited;
         private boolean complete = true;
 
         private RootWalkBudget(int maxEdges) {
+            this(maxEdges, null);
+        }
+
+        private RootWalkBudget(int maxEdges, ReachabilityQueryStats stats) {
             this.maxEdges = maxEdges;
+            this.stats = stats;
         }
 
         private boolean visitEdge() {
             if (edgesVisited >= maxEdges) {
                 complete = false;
+                if (stats != null) stats.rootQueriesBudgetCapped++;
                 return false;
             }
             edgesVisited++;
@@ -2236,7 +2243,7 @@ static boolean isReachableFromRoots(RuntimeBase target, boolean globalOnly,
         final int MAX_VISITS = excludedReferent == null
                 ? MAX_ROOT_SNAPSHOT_VISITS : MAX_DESTRUCTION_OWNER_ROOT_VISITS;
         RootWalkBudget budget = new RootWalkBudget(excludedReferent == null
-                ? MAX_ROOT_SNAPSHOT_EDGES : MAX_DESTRUCTION_OWNER_ROOT_EDGES);
+                ? MAX_ROOT_SNAPSHOT_EDGES : MAX_DESTRUCTION_OWNER_ROOT_EDGES, stats);
 
         Set<RuntimeBase> seen = Collections.newSetFromMap(new IdentityHashMap<>());
         java.util.ArrayDeque<RuntimeBase> todo = new java.util.ArrayDeque<>();
@@ -2431,7 +2438,12 @@ && followScalarExcluding(
             // query; CODE-specific owner rescue uses the explicit owner-aware
             // root proof above instead.
         }
-        return !budget.complete || !todo.isEmpty();
+        boolean incomplete = !budget.complete || !todo.isEmpty();
+        if (incomplete && budget.complete && stats != null) {
+            // The node limit ended the walk with unexplored roots remaining.
+            stats.rootQueriesBudgetCapped++;
+        }
+        return incomplete;
     }
 
     /**

From 4ac0b0d1ad949ef707d094f0c3842804bb4fcab5 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 16:04:36 +0100
Subject: [PATCH 315/317] debug: allow filtered owner recovery scan bypass

Add a test-only environment filter that skips the owner recovery scan for
named Perl classes. The default remains unchanged; focused lifetime tests can
now expose ownership paths that still depend on the migration bridge.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 .../runtime/runtimetypes/MortalList.java      | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index 98fb708313..e8b0d7c22e 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -24,6 +24,8 @@ public class MortalList {
     private static final AtomicInteger runtimesWithBoundaryWork = new AtomicInteger();
     private static final String OWNER_RECOVERY_TRACE_CLASS =
             System.getenv("PJ_OWNER_RECOVERY_TRACE_CLASS");
+    private static final String OWNER_RECOVERY_SKIP_SCAN_CLASSES =
+            System.getenv("PJ_OWNER_RECOVERY_SKIP_SCAN_CLASSES");
 
     static final class ReachabilityQueryMeasurement implements AutoCloseable {
         private final LifecycleRuntimeState state;
@@ -2014,6 +2016,11 @@ static boolean restoreReachableAggregateOwnerCount(
         int slotsWithoutCell = 0;
         Set<PerlOwnerSlot> ownerSlots = referent.ownerSlotSnapshot();
         ReachabilityQueryStats stats = activeReachabilityQueryStats();
+        if (skipAggregateOwnerRecoveryForTest(referent)) {
+            traceAggregateOwnerRecovery(referent,
+                    releaseProvenance + " diagnosticSkipScan=true", false, 0, ownerSlots);
+            return false;
+        }
         for (PerlOwnerSlot slot : ownerSlots) {
             if (stats != null) stats.aggregateOwnerSlotsInspected++;
             if (slot.kind() == PerlOwnerSlot.Kind.HASH_ENTRY
@@ -2097,6 +2104,19 @@ static boolean restoreReachableAggregateOwnerCount(
         return true;
     }
 
+    private static boolean skipAggregateOwnerRecoveryForTest(RuntimeBase referent) {
+        if (OWNER_RECOVERY_SKIP_SCAN_CLASSES == null
+                || OWNER_RECOVERY_SKIP_SCAN_CLASSES.isBlank()) return false;
+        String className = referent.blessId == 0
+                ? referent.getClass().getSimpleName()
+                : NameNormalizer.getBlessStr(referent.blessId);
+        if (className == null) return false;
+        for (String candidate : OWNER_RECOVERY_SKIP_SCAN_CLASSES.split(",")) {
+            if (className.equals(candidate.trim())) return true;
+        }
+        return false;
+    }
+
     private static String deferredReleaseProvenance(
             RuntimeBase.PendingOwnerRelease release, String transientOwnerKind) {
         if (OWNER_RECOVERY_TRACE_CLASS == null || OWNER_RECOVERY_TRACE_CLASS.isEmpty()) {

From 69a0ab7069ef328359e757ae40f7c42d9218359a Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 16:57:47 +0100
Subject: [PATCH 316/317] docs: record owner recovery scan bypass audit

Record that the focused #1794/#1795, aggregate alias, and DESTROY regressions
pass with their class-filtered recovery scan bypassed. Keep the recovery scan
because synthetic recovery tests and both production callers remain. Remove
the temporary bypass switch after the audit.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md          | 14 +++++++++++++
 .../runtime/runtimetypes/MortalList.java      | 20 -------------------
 2 files changed, 14 insertions(+), 20 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 241d4b0293..5e9ae12b31 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -656,6 +656,20 @@ The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.c
   gate passes on candidate `9c93d5922` in 19m53s; hosted validation for that
   head is pending. The slot ledger remains a bridge to selective `refCount`,
   so Phase 2 is not complete.
+- On 2026-10-25, the File::Temp owner-container root query completed below its
+  node and edge limits and returned false. The recovery trace still restored
+  two scalar owners from reachable scalar cells, while the corresponding
+  aggregate containers had no rooted owner path. A temporary exact-class scan
+  bypass then passed the dedicated #1794 controller test (3/3), the controller
+  finish and WebSocket regressions (5/5, 6/6, 29/29, and 6/6), the #1795
+  Catalyst tempfile and global-destruction tests (24/24 and 3/3), cross-
+  container alias ownership (22/22), and basic DESTROY timing (18/18). These
+  focused tests did not expose a missing owner acquisition. The bypass was
+  removed after the audit; the default scan remains because its two production
+  callers and synthetic undercount-recovery Java tests still require it. The
+  `nice -n 19 make` gate passes on this candidate in 18m06s. The capped-root
+  trace remains available behind `PJ_OWNER_RECOVERY_TRACE_CLASS`; broader
+  Phase 2 owner-slot migration is still open.
 
 The earlier candidate was based on `origin/master` (`ede542b29`) and passed the full local make in 22m55s, Ubuntu `make ci`, the Ubuntu Perl thread compatibility gate, SBOM generation, Windows `make ci` in about 52 minutes, and the focused Windows thread gate. Windows CI exposed two existing unit tests with POSIX `/tmp` paths; `make ci` now creates the runner's root-relative `tmp` directory before building. On blead Perl 5.45.4, the controller, WebSocket, Catalyst tempfile, owner-release, and writable `Internals::SvREFCNT` regressions pass. The controller regression passes 5/5 on JVM and interpreter; the WebSocket regression passes 6/6 on both; the Catalyst tempfile regression passes 24/24 on both; `refcount/issue_1794_controller_owner_release.t` passes 3/3 on both; and `internals_svrefcnt_write.t` passes 6/6 on both after failing all six assertions on its unfixed parent. The alias-count follow-up rebases onto `origin/master` (`18323a1ac`). Its focused make passes in 50s and its full local make passes in 31m30s on code commit `15e362ddb`.
 
diff --git a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
index e8b0d7c22e..98fb708313 100644
--- a/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
+++ b/src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java
@@ -24,8 +24,6 @@ public class MortalList {
     private static final AtomicInteger runtimesWithBoundaryWork = new AtomicInteger();
     private static final String OWNER_RECOVERY_TRACE_CLASS =
             System.getenv("PJ_OWNER_RECOVERY_TRACE_CLASS");
-    private static final String OWNER_RECOVERY_SKIP_SCAN_CLASSES =
-            System.getenv("PJ_OWNER_RECOVERY_SKIP_SCAN_CLASSES");
 
     static final class ReachabilityQueryMeasurement implements AutoCloseable {
         private final LifecycleRuntimeState state;
@@ -2016,11 +2014,6 @@ static boolean restoreReachableAggregateOwnerCount(
         int slotsWithoutCell = 0;
         Set<PerlOwnerSlot> ownerSlots = referent.ownerSlotSnapshot();
         ReachabilityQueryStats stats = activeReachabilityQueryStats();
-        if (skipAggregateOwnerRecoveryForTest(referent)) {
-            traceAggregateOwnerRecovery(referent,
-                    releaseProvenance + " diagnosticSkipScan=true", false, 0, ownerSlots);
-            return false;
-        }
         for (PerlOwnerSlot slot : ownerSlots) {
             if (stats != null) stats.aggregateOwnerSlotsInspected++;
             if (slot.kind() == PerlOwnerSlot.Kind.HASH_ENTRY
@@ -2104,19 +2097,6 @@ static boolean restoreReachableAggregateOwnerCount(
         return true;
     }
 
-    private static boolean skipAggregateOwnerRecoveryForTest(RuntimeBase referent) {
-        if (OWNER_RECOVERY_SKIP_SCAN_CLASSES == null
-                || OWNER_RECOVERY_SKIP_SCAN_CLASSES.isBlank()) return false;
-        String className = referent.blessId == 0
-                ? referent.getClass().getSimpleName()
-                : NameNormalizer.getBlessStr(referent.blessId);
-        if (className == null) return false;
-        for (String candidate : OWNER_RECOVERY_SKIP_SCAN_CLASSES.split(",")) {
-            if (className.equals(candidate.trim())) return true;
-        }
-        return false;
-    }
-
     private static String deferredReleaseProvenance(
             RuntimeBase.PendingOwnerRelease release, String transientOwnerKind) {
         if (OWNER_RECOVERY_TRACE_CLASS == null || OWNER_RECOVERY_TRACE_CLASS.isEmpty()) {

From 2917a03473a706e0108dea3ed58dc823390a52d5 Mon Sep 17 00:00:00 2001
From: "Flavio S. Glock" <flavio.glock@booking.com>
Date: Sun, 25 Oct 2026 17:34:26 +0100
Subject: [PATCH 317/317] docs: update owner recovery audit status

Record the uncapped negative aggregate root proof, successful class-filtered
recovery-bypass regressions, and the remaining source audit target. Refresh the
PR head and local gate status while keeping Phase 2 open.

Generated with [OpenAI Codex](https://openai.com/codex)

Co-Authored-By: Codex <158243242+openai-codex[bot]@users.noreply.github.com>
---
 dev/design/perl-ownership-rewrite.md | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/dev/design/perl-ownership-rewrite.md b/dev/design/perl-ownership-rewrite.md
index 5e9ae12b31..7af83148bf 100644
--- a/dev/design/perl-ownership-rewrite.md
+++ b/dev/design/perl-ownership-rewrite.md
@@ -1,6 +1,6 @@
 # Perl-compatible ownership rewrite
 
-**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), last reconciled with `origin/master` through `aeda28344`. The current ownership changes are pushed, and the latest code batch passes the full `nice -n 19 make` gate locally. Hosted run `39991272777` passes on Linux and Windows, including both thread gates, for preceding head `c1167ffbd`. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
+**Status:** Phase 1 closure-pad path is complete. Phase 2 remains in progress for [draft PR #1816](https://github.com/PerlOnJava/pull/1816), last reconciled with `origin/master` through `aeda28344`. PR head `69a0ab706` passes the full local `nice -n 19 make` gate (19m49s); no hosted checks are reported yet. Owner slots still bridge to `RuntimeBase.refCount` for dispatch, and default owner-slot accounting remains incomplete.
 
 **Tracking:** [#1649](https://github.com/fglock/PerlOnJava/issues/1649)
 
@@ -114,11 +114,17 @@ focused Java regression covers the mixed state. This fixes a recovery-ledger
 gap; it does not yet identify which production operation can create the
 undercounted state, so neither scan caller is removed.
 
-Next audit target: instrument the two scan entry points with the owner release
-provenance already carried by `PendingOwnerRelease`, then reduce any
-production-only zero transition to a system-Perl-validated operation. Do not
-change a producer or remove either scan caller unless that trace identifies a
-real mismatched owner edge and a focused regression.
+Both production scan callers now have filtered release-provenance and owner
+slot traces. In the Catalyst tempfile case, the root queries for the
+recoverable `File::Temp` object's hash/array containers completed below their
+budgets and returned false; recovery came from reachable scalar-owner cells.
+A temporary exact-class bypass passed the focused #1794/#1795, alias-owner,
+WebSocket, and DESTROY regressions, so those cases do not identify a missing
+Perl owner acquisition. The bypass has been removed. The next audit target is
+to correlate scalar-overwrite and queued legacy releases with the counted
+scalar-owner cells they decrement, and find a production case where one
+transition consumes a different still-live owner. Keep both scan callers until
+that path has a focused regression and direct accounting.
 
 The first verified fix is at the reachability boundary. The interpreter's
 `capturedVars` array is execution metadata and can still contain a pad after
@@ -177,7 +183,7 @@ passes in 13m26s on this batch.
 
 ### Current status: Phase 2 in progress; Phase 1 merged in PR #1653 as `84f32be179bdc2b351c3eaae1cb26df39964ab6b` (2026-10-07)
 
-The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch includes the current-master merge at `aeda28344`; the latest confirmed pushed head before the local tie-wrapper batch is `b9382dbaf`. Focused Mojolicious controller/WebSocket and Catalyst tempfile regressions pass on both backends with loopback access. On the tail-call candidate, the interpreter tempfile test exceeded a 180-second run but completed 24/24 within a 240-second JFR run; a later 240-second profile after owner-proof caching emitted no TAP, while an unprofiled run completed 24/24 within the 600-second limit. Sampled `isRootedAggregateOwner` frames declined from 517 to 190, with 112 cache-hit frames; the profiled runs had different total sample counts, so wall-clock attribution remains inconclusive. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML-Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
+The #1794/#1795 fixes and #1649 work remain in [draft PR #1816](https://github.com/PerlOnJava/pull/1816). The branch includes the current-master merge at `aeda28344`; PR head `69a0ab706` is open and draft. Focused Mojolicious controller/WebSocket and Catalyst tempfile regressions pass on both backends with loopback access. On the tail-call candidate, the interpreter tempfile test exceeded a 180-second run but completed 24/24 within a 240-second JFR run; a later 240-second profile after owner-proof caching emitted no TAP, while an unprofiled run completed 24/24 within the 600-second limit. Sampled `isRootedAggregateOwner` frames declined from 517 to 190, with 112 cache-hit frames; the profiled runs had different total sample counts, so wall-clock attribution remains inconclusive. HTML::Tree 5.07 passes all 23 files and 989 tests on both backends on the preceding ownership candidate. Phase 2 remains incomplete: `refCount` still controls lifecycle dispatch, and the slot ledger is not yet the default accounting source across general scalar/proxy stores, aliases, and cleanup. Distinct scalar-reference aliases keep separate reachability identities while contributing one referent count per scalar cell. The HTML-Tree result is compatibility evidence, not the Phase 2 owner-slot exit proof.
 
 ### Current batch