[Audit] Make the ported Phase B snapshot actually build

Taking phase_b_snapshot.{cc,h} as files from the snapshot branch left it
referencing three cvars that live in that branch's cpu_flags and were not
carried across, so the kernel library failed to compile:

  phase_b_snapshot_dir / phase_b_snapshot_and_exit / phase_b_dump_section_content

Ported their DEFINE_/DECLARE_ pair verbatim. Also switched one
`std::filesystem::path base(...)` to brace init -- with a single named argument
that parses as a function declaration under a newer clang than the branch was
written against, and this tree builds with -Werror.

Verified on the linked binary: all fifteen instrumentation cvars from the three
merged lineages are present, and so is every output path the superset draw
logger emits (xenia_re_draws.log, xenia_re_shaders.log, xenia_re_files.log,
xenia_ship_capture_NN.log, with idx_raw / vsconst / psconst records).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/xenia/cpu/cpu_flags.cc

@@ -88,3 +88,24 @@ DEFINE_bool(kernel_emit_contention, false,
             "Phase D Stage 1: emit `contention.observed` events. Default false "
             "(zero cost when disabled). Requires --phase_a_event_log_path.",
             "Audit");
+
+// Phase B — see kernel/phase_b_snapshot.h. Ported alongside the snapshot
+// probe itself, which was taken as files from
+// auto/canary-instrumentation-snapshot-2026-07-28 rather than merged.
+DEFINE_string(phase_b_snapshot_dir, "",
+              "Phase B: write 5-file structured state snapshot to "
+              "<dir>/canary/ at the moment immediately before the first "
+              "guest PPC instruction of entry_point. Empty (default) = "
+              "disabled, zero overhead.",
+              "Audit");
+DEFINE_bool(phase_b_snapshot_and_exit, false,
+            "Phase B: after writing the snapshot, exit the process "
+            "immediately (std::_Exit(0)) so re-runs are byte-deterministic.",
+            "Audit");
+DEFINE_bool(phase_b_dump_section_content, false,
+            "Phase B: in memory.json, populate section_contents[].content_b64 "
+            "with raw bytes of every committed XEX-image region. Default "
+            "false — per-region SHA-256 is enough for the routine diff; "
+            "this is the escape hatch for the STOP-and-report condition "
+            "(image_loaded_sha256 mismatch).",
+            "Audit");

src/xenia/cpu/cpu_flags.h

@@ -42,4 +42,9 @@ DECLARE_bool(phase_a_trace_args);
 DECLARE_string(phase_a_hash_probe);
 DECLARE_bool(kernel_emit_contention);
 
+// Phase B — structured state snapshot; see kernel/phase_b_snapshot.h.
+DECLARE_string(phase_b_snapshot_dir);
+DECLARE_bool(phase_b_snapshot_and_exit);
+DECLARE_bool(phase_b_dump_section_content);
+
 #endif  // XENIA_CPU_CPU_FLAGS_H_

src/xenia/kernel/phase_b_snapshot.cc

@@ -818,7 +818,10 @@ void EmitFile(const std::filesystem::path& dir, const char* name,
 void WriteSnapshot(XThread* xthread, cpu::ThreadState* thread_state,
                    uint32_t entry_pc) {
   auto* kstate = xthread->kernel_state();
-  std::filesystem::path base(cvars::phase_b_snapshot_dir);
+  // Braces, not parens: with a single named argument this parses as a function
+  // declaration under a newer clang than the branch this file came from
+  // (-Wvexing-parse, and -Werror here).
+  std::filesystem::path base{cvars::phase_b_snapshot_dir};
   std::filesystem::path engine_dir = base / "canary";
   std::error_code ec;
   std::filesystem::create_directories(engine_dir, ec);