docs(asm): document symbol operands ("s") + checkpoint

Adds a 'Symbol inputs — "s" = fn' section to docs/inline-assembly.md
(direct bl/call, portability, the export-vs-callconv linkage point) and
logs the symbol-operand + round-trip work in CHECKPOINT-ASM.

current/CHECKPOINT-ASM.md

@@ -216,9 +216,10 @@ guards fire: corrupting the `.ir` → IR mismatch; deleting it → the require-f
 **Inline assembly works end-to-end: 0, 1, and N value outputs (tuples).** Full
 pipeline: lex (A.0) → parse (A.1) → validate (B.0/B.1 + `%[name]` check) → IR op
 (C.0) → lower-builds-op + LLVM emit + JIT asm-parser init (C.1/D) → multi-output
-tuples (E). Register-class + register-pinned operands, inputs, clobbers, `#string`
-multi-instruction templates, `%[name]`/`%%` rewriting, and the §II.5 auto-naming
-rule all work and execute on the host JIT. Global `asm { … }` (Phase F) works via
+tuples (E). Register-class + register-pinned operands, inputs, **symbol operands
+(`"s"` → direct `bl`/`call` to a function/global by mangled name)**, clobbers,
+`#string` multi-instruction templates, `%[name]`/`%%` rewriting, and the §II.5
+auto-naming rule all work and execute on the host JIT. Global `asm { … }` (Phase F) works via
 lib-less `extern` under BOTH the JIT (`sx run` → 1653) and AOT (1648) — `sx run`
 compiles to an object, so the integrated assembler bakes the `module asm` symbol
 in and ORC resolves it. All three `-> @place` output forms now work and execute
@@ -352,6 +353,21 @@ Orthogonal: **issue 0137** (no-`main` segfault).
   symbol fails loud (`comptime extern call: symbol not found via dlsym`) because
   the interpreter resolves externs via host dlsym before link. Arch-independent
   (no `.build`). `zig build test` green (663 corpus, 446 unit).
+- (round trip) `examples/1655-platform-asm-callback-into-sx.sx` — global-asm
+  trampoline that `bl _cb` back into an `export`ed sx function (sx→asm→sx, → 42).
+  Documented that `export` (external linkage + C symbol + C ABI) is what makes
+  the callback resolvable; `callconv(.c)` alone leaves it `internal` (DCE'd).
+  `zig build test` green (664 corpus, 446 unit).
+- (symbol ops) symbol operands (`"s"`) — feed a function/global symbol; the
+  template emits its platform-mangled name so `bl %[fn]` is a DIRECT branch (one
+  fewer indirection than register-indirect `blr`, portable — no hardcoded `_`).
+  Emit passes the operand with its own llvm type (LLVMTypeOf), no coercion
+  (`asmIsSymbol` helper); lowering lowers the function RHS to `ptr @fn`. Decided
+  AGAINST mirroring Zig (which has no symbol operand — 483 std asm sites, none
+  call a function) because the direct `bl` matters. Two commits (cadence): 1656
+  locked the rejection (replacing an LLVM-verifier crash), then implemented +
+  flipped to a runnable aarch64 example (objdump-confirmed direct `bl <_cb>`).
+  `zig build test` green (665 corpus, 446 unit).
 
 ## Known issues
 - **0138** — RESOLVED. `@const` (address-of a `::` comptime constant) yielded a