fix(D-W6): restore walker gate and document drift-source findings

Empirical D-W6 progress is documented in moose_support.md.

Findings from the no-gate experiment (commit 230a672):

PASS — what removing the gate fixes (Perl 5 semantics replicated):
- t/cdbi/04-lazy.t test 11 (no phantom destroy clobbers row build).
- t/storage/txn_scope_guard.t test 18 (double-DESTROY warning fires).
- t/52leaks.t 11/11 (cycles leak naturally, $r stays defined).
- Refcount unit tests still pass.

FAIL — what removing the gate breaks (refCount drift in MOP code):
- use Class::MOP::Class fails: "Can't locate method initialize" — the
  CV for Class::MOP::Class::initialize is destroyed during the circular
  bootstrap. PJ_DESTROY_TRACE shows non-blessed RuntimeCode objects
  hitting refCount=0 inside MortalList.flush during MiniTrait::apply,
  which is a sub-installation path.
- use Moose itself works (different load order) but cmop bootstrap
  destroys subs prematurely.

Hybrid attempt (only destroy blessed objects through the gate path)
fixed the bootstrap but regressed t/52leaks.t cascade-cleanup of
non-blessed containers holding blessed children.

Conclusion: the proper D-W6 fix is multi-week — it requires auditing
each cooperative refCount source (sub installation, glob assignment,
@_ promotion, hash-slot stores, closure captures) and back-filling
the missing increments. Until then, restore the universal walker gate
as a safety net (no class-name dispatch; matches PR #599).

Adds a PJ_DESTROY_TRACE=1 env-flag in DestroyDispatch.callDestroy to
help future drift hunting.

Generated with [Devin](https://cli.devin.ai/docs)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Author: fglock

src/main/java/org/perlonjava/runtime/runtimetypes/DestroyDispatch.java

@@ -17,6 +17,12 @@
  */
 public class DestroyDispatch {
 
+    /** Phase D-W6 debug: enable destroy tracing via -Dperlonjava.destroyTrace=1
+     *  or env PJ_DESTROY_TRACE=1. */
+    private static final boolean DESTROY_TRACE =
+            "1".equals(System.getProperty("perlonjava.destroyTrace"))
+            || "1".equals(System.getenv("PJ_DESTROY_TRACE"));
+
     // BitSet indexed by |blessId| — set if the class defines DESTROY (or AUTOLOAD)
     private static final BitSet destroyClasses = new BitSet();
 
@@ -108,6 +114,19 @@ public static void invalidateCache() {
     public static void callDestroy(RuntimeBase referent) {
         // refCount is already MIN_VALUE (set by caller)
 
+        // Phase D-W6 debug: optional trace of every destroy call.
+        // Enable with -Dperlonjava.destroyTrace=1 (or env PJ_DESTROY_TRACE=1)
+        // to find refCount-drift sources.
+        if (DESTROY_TRACE) {
+            String klass = referent.blessId != 0
+                    ? NameNormalizer.getBlessStr(referent.blessId)
+                    : referent.getClass().getSimpleName();
+            System.err.println("[DESTROY] " + klass + "@"
+                    + System.identityHashCode(referent)
+                    + " refCount=" + referent.refCount);
+            new RuntimeException("destroy trace").printStackTrace(System.err);
+        }
+
         // Phase 3 (refcount_alignment_plan.md): Re-entry guard.
         // If this object is already inside its own DESTROY body, a transient
         // decrement-to-0 (local temp release, deferred MortalList flush,

src/main/java/org/perlonjava/runtime/runtimetypes/MortalList.java

@@ -555,18 +555,34 @@ public static void flush() {
                         // leak-tracing scenarios; those scenarios now use
                         // createAnonymousReference() (localBindingExists stays false)
                         // so the clear is no longer needed and broke #76716.
+                    } else if (base.blessId != 0
+                            && WeakRefRegistry.hasWeakRefsTo(base)
+                            && ReachabilityWalker.isReachableFromRoots(base)) {
+                        // Phase D-W6 (deferred): walker gate retained as
+                        // a temporary safeguard until cooperative
+                        // refCount accuracy is audited and fixed at the
+                        // sources documented in
+                        // dev/modules/moose_support.md (Phase D-W6).
+                        //
+                        // Empirically: removing the gate makes cycles
+                        // leak correctly (52leaks.t passes), DESTROY
+                        // fires twice on the second-DESTROY pattern
+                        // (txn_scope_guard.t passes), and DBIC row
+                        // construction stops losing column data
+                        // (cdbi/04-lazy.t passes). But it also breaks
+                        // Moose bootstrap because anonymous CVs are
+                        // briefly the only ref to themselves before
+                        // being installed in package stashes; the
+                        // cooperative refCount transient-drops to 0,
+                        // DESTROY fires on a CV that should still be
+                        // live, and Class::MOP::Class loses its
+                        // `initialize` method.
+                        //
+                        // The walker check absorbs this drift safely.
+                        // It is no longer class-name-based (PR #599)
+                        // and uses MyVarCleanupStack-seeded reachability
+                        // so live `my` variables pin their referents.
                     } else {
-                        // Phase D-W6: cooperative refCount is the single
-                        // source of truth for DESTROY firing — no walker
-                        // gate. Matches Perl 5 semantics:
-                        //   - Cycles leak (cooperative refCount keeps
-                        //     cycle members at refCount ≥ 1).
-                        //   - DESTROY fires at every refCount=0
-                        //     transition (no deferral via reachability
-                        //     analysis).
-                        // Any drift in cooperative refCount must be
-                        // fixed at the source, not papered over here.
-                        // See dev/modules/moose_support.md (D-W6).
                         base.refCount = Integer.MIN_VALUE;
                         DestroyDispatch.callDestroy(base);
                     }

src/main/java/org/perlonjava/runtime/runtimetypes/RuntimeScalar.java

@@ -1195,11 +1195,12 @@ private RuntimeScalar setLargeRefCounted(RuntimeScalar value) {
                     // slot holds a strong reference not counted in refCount.
                     // Don't call callDestroy — the container is still alive.
                     // Cleanup will happen at scope exit (scopeExitCleanupHash/Array).
+                } else if (oldBase.blessId != 0
+                        && WeakRefRegistry.hasWeakRefsTo(oldBase)
+                        && ReachabilityWalker.isReachableFromRoots(oldBase)) {
+                    // Phase D-W6 (deferred): see MortalList.flush() for
+                    // rationale — gate retained until refCount audit.
                 } else {
-                    // Phase D-W6: cooperative refCount is the single
-                    // source of truth — no walker gate. See
-                    // MortalList.flush() and dev/modules/moose_support.md
-                    // (D-W6) for the rationale.
                     oldBase.refCount = Integer.MIN_VALUE;
                     DestroyDispatch.callDestroy(oldBase);
                 }