hono fixture: r1 regressed from 200 to 404 after v0.5.722 dynamic-dispatch override probe #632

Summary

After v0.5.722's dynamic-dispatch override probe (#620 followup), the hono-basic fixture's first request regressed: previously r1.status=200 / r1.body={"hello":"world"}; now r1.status=404 / r1.body=not found. r2 and r3 also return 404. New [PERRY WARN] js_box_get: invalid box pointer 0x0 warnings appear on each request.

Repro

tests/release/packages/hono-basic/entry.ts from #603 — see issue body. Pre-v0.5.722 produced r1=200 + silent exit on r2 (Fatal error from #628). Post-v0.5.722 dispatches all 3 calls but matches none.

Bisection

• v0.5.721 (after class-method bound closure returns undefined when invoked via local var (blocks hono compose) #628 fix): r1=200, then exits silently on r2 (compose's "Fatal error" throw).
• v0.5.722 (after dynamic-dispatch override probe): all 3 calls run, all return 404.

The dynamic-dispatch override fix is correct in isolation: test_628_dyn.ts (interface-typed receiver with this.method = X override) now matches Node byte-for-byte. Other dispatch tests (test_628.ts, test_603_smartrouter_mock.ts, test_603_sr_loop.ts, the cross-module SmartRouter mock at /tmp/repro_xmod) all match Node.

But hono regressed. The js_box_get: invalid box pointer 0x0 warnings hint at a closure-capture interaction the probe may have broken — perhaps the probe call's IR ordering disturbs an SSA value's dominance, or the new blocks cause a phi-edge mismatch in some call path.

Suggested investigation

1. Compare LLVM IR for app.get("/", handler) registration before and after v0.5.722 — does the handler get stored differently?
2. Check whether the route-registration this.router.add(...) call from app.get lands in the dynamic-dispatch path. If so, my override probe runs there too. The probe is supposed to be a no-op when the receiver has no override, but may be perturbing something.
3. Trace whether matchResult[0] is empty (route not registered) vs non-empty (route registered but dispatch fails).

Acceptance

tests/release/packages/hono-basic/out produces the expected:

r1.status=200
r1.body={"hello":"world"}
r2.status=200
r2.body={"id":"42","name":"User 42"}
r3.status=404
r3.body=not found

Environment

• Perry 0.5.722
• macOS arm64

Refs #603 (acceptance fixture), #620 (override probe), v0.5.722 (where this regressed).