fix(gc): audit raw TLS holders and pin census snapshot lifetime

changelog.d/9750-raw-tls-holder-audit.md

@@ -0,0 +1,3 @@
+### Fixed
+- Include raw `thread_local!` declarations in the GC holder inventory, so skipping Perry's TLS convention cannot hide a new opaque holder. Existing uncovered declarations join the identity ratchet as explicit audit debt.
+- Give the GC census's deliberately untraced address snapshot a source-pinned, non-moving collection-window contract, and move its production TLS into the hot TLS registry.

crates/perry-runtime/src/gc/census.rs

@@ -43,7 +43,7 @@ static SIGNAL_PENDING: AtomicBool = AtomicBool::new(false);
 static SIGNAL_INSTALLED: AtomicBool = AtomicBool::new(false);
 static MAIN_THREAD: OnceLock<std::thread::ThreadId> = OnceLock::new();
 
-thread_local! {
+crate::perry_thread_local! {
     static ARMED: Cell<bool> = const { Cell::new(false) };
     static SEQ: Cell<u32> = const { Cell::new(0) };
     static LABEL: RefCell<&'static str> = const { RefCell::new("manual") };
@@ -177,12 +177,18 @@ fn census_service_signal() {
     super::js_gc_collect();
 }
 
-thread_local! {
+crate::perry_thread_local! {
     /// Pass-1 snapshot: sorted header addresses that were marked when mark
     /// propagation finished (see the module docs).
     static PASS1_MARKED: RefCell<Option<Vec<usize>>> = const { RefCell::new(None) };
 }
 
+/// The snapshot must be consumed before the collector returns to the mutator.
+#[cfg(test)]
+pub(crate) fn test_has_pass1_snapshot() -> bool {
+    PASS1_MARKED.with(|p| p.borrow().is_some())
+}
+
 #[inline]
 fn header_is_marked(header: *const GcHeader) -> bool {
     // SAFETY: caller hands out headers of walkable objects inside mapped

crates/perry-runtime/src/gc/tests/census.rs

@@ -7,8 +7,13 @@ use super::super::*;
 use super::support::*;
 
 fn take(label: &'static str) {
+    assert!(!super::super::census::test_has_pass1_snapshot());
     super::super::census::census_arm(label);
     gc_collect_full_mark_sweep_with_trigger(GcTriggerSnapshot::capture(GcTriggerKind::Manual));
+    assert!(
+        !super::super::census::test_has_pass1_snapshot(),
+        "the untraced snapshot must not outlive the synchronous full cycle"
+    );
 }
 
 fn read_lines(path: &str) -> Vec<serde_json::Value> {
@@ -88,6 +93,9 @@ fn census_reports_a_known_composition_and_sees_deadness() {
         let lines = read_lines(&path_str);
         let _ = std::fs::remove_file(&path);
         assert_eq!(lines.len(), 3, "one census line per armed full collection");
+        for line in &lines {
+            assert_eq!(line["totals"]["reachability_pass"], true, "pass 1 must run");
+        }
         let (b, a, d) = (&lines[0], &lines[1], &lines[2]);
         assert_eq!(b["label"], "baseline");
         assert_eq!(a["label"], "populated");