Thanks. I try to take a look at it at the weekend.
As I have seen it in the meantime, on C128 the Phoenix routine calls the ROM entries, which is started from the Basic cold start (where it ends and steps forward to warm start).
The C65 also has a Phoenix routine, but it has some slightly different function (system diagnostic tests).
So it must be somewhere around the Basic cold start the most likely (unless it is removed).
:: @rosettif added on 15 Jun ’19 · 16:03
By the way, I have already prepared my program so that it can be called at any location: it gets its actual address by a stack trick first, then relocates itself to a safe RAM place (which is free on all machines) and runs from there.
So if any routine from any OS finds and calls it at any place in any way one day, it should run. (Though not tested yet, of course.)