diff --git a/src/xenia/cpu/cpu_flags.cc b/src/xenia/cpu/cpu_flags.cc
index 19e87186b..41051e4b2 100644
--- a/src/xenia/cpu/cpu_flags.cc
+++ b/src/xenia/cpu/cpu_flags.cc
@@ -88,3 +88,24 @@ DEFINE_bool(kernel_emit_contention, false,
             "Phase D Stage 1: emit `contention.observed` events. Default false "
             "(zero cost when disabled). Requires --phase_a_event_log_path.",
             "Audit");
+
+// Phase B — see kernel/phase_b_snapshot.h. Ported alongside the snapshot
+// probe itself, which was taken as files from
+// auto/canary-instrumentation-snapshot-2026-07-28 rather than merged.
+DEFINE_string(phase_b_snapshot_dir, "",
+              "Phase B: write 5-file structured state snapshot to "
+              "<dir>/canary/ at the moment immediately before the first "
+              "guest PPC instruction of entry_point. Empty (default) = "
+              "disabled, zero overhead.",
+              "Audit");
+DEFINE_bool(phase_b_snapshot_and_exit, false,
+            "Phase B: after writing the snapshot, exit the process "
+            "immediately (std::_Exit(0)) so re-runs are byte-deterministic.",
+            "Audit");
+DEFINE_bool(phase_b_dump_section_content, false,
+            "Phase B: in memory.json, populate section_contents[].content_b64 "
+            "with raw bytes of every committed XEX-image region. Default "
+            "false — per-region SHA-256 is enough for the routine diff; "
+            "this is the escape hatch for the STOP-and-report condition "
+            "(image_loaded_sha256 mismatch).",
+            "Audit");
diff --git a/src/xenia/cpu/cpu_flags.h b/src/xenia/cpu/cpu_flags.h
index 467311cc1..2245c3762 100644
--- a/src/xenia/cpu/cpu_flags.h
+++ b/src/xenia/cpu/cpu_flags.h
@@ -42,4 +42,9 @@ DECLARE_bool(phase_a_trace_args);
 DECLARE_string(phase_a_hash_probe);
 DECLARE_bool(kernel_emit_contention);
 
+// Phase B — structured state snapshot; see kernel/phase_b_snapshot.h.
+DECLARE_string(phase_b_snapshot_dir);
+DECLARE_bool(phase_b_snapshot_and_exit);
+DECLARE_bool(phase_b_dump_section_content);
+
 #endif  // XENIA_CPU_CPU_FLAGS_H_
diff --git a/src/xenia/kernel/phase_b_snapshot.cc b/src/xenia/kernel/phase_b_snapshot.cc
index c4a3ac74b..dff59d41b 100644
--- a/src/xenia/kernel/phase_b_snapshot.cc
+++ b/src/xenia/kernel/phase_b_snapshot.cc
@@ -818,7 +818,10 @@ void EmitFile(const std::filesystem::path& dir, const char* name,
 void WriteSnapshot(XThread* xthread, cpu::ThreadState* thread_state,
                    uint32_t entry_pc) {
   auto* kstate = xthread->kernel_state();
-  std::filesystem::path base(cvars::phase_b_snapshot_dir);
+  // Braces, not parens: with a single named argument this parses as a function
+  // declaration under a newer clang than the branch this file came from
+  // (-Wvexing-parse, and -Werror here).
+  std::filesystem::path base{cvars::phase_b_snapshot_dir};
   std::filesystem::path engine_dir = base / "canary";
   std::error_code ec;
   std::filesystem::create_directories(engine_dir, ec);
diff --git a/third_party/snappy b/third_party/snappy
index 77c78fad9..6af9287fb 160000
--- a/third_party/snappy
+++ b/third_party/snappy
@@ -1 +1 @@
-Subproject commit 77c78fad94fc4640149dc7901816159571b04df1
+Subproject commit 6af9287fbdb913f0794d0148c6aa43b58e63c8e3