docs: record epoll Loop runtime validation on real Linux (Apple container)

The std.event.Loop epoll backend is now runtime-validated, not just
lower-verified: a static aarch64-linux build of the 1632-equivalent Loop test
(plus the eventfd wake path) runs 6/6 green inside an Apple `container` Linux VM
(kernel 6.18 aarch64) — add_read, idle-timeout, readable+fd+udata, the MOD-mask
add_write path, the eventfd wake channel, and EPOLLRDHUP/HUP eof all behave
identically to kqueue (lone difference: nbytes is 0 on epoll). Update the
event.sx VALIDATION note (with the re-run recipe) and the fibers checkpoint;
the epoll deliverable is complete.

current/CHECKPOINT-FIBERS.md

@@ -531,12 +531,16 @@ a kqueue `EVFILT_TIMER`, future work.
 > aarch64 16 B layout also probe-verified). (B) **`std.event.Loop` branched on `inline if OS`** into two
 > top-level OS-selected structs (sx has no conditional struct fields): the kqueue Loop unchanged
 > (darwin, runs — 1632 green), a new epoll Loop (linux) with the per-fd registration table (combined
-> EPOLLIN/OUT mask via ADD/MOD/DEL), eventfd wake channel, and EPOLLRDHUP→eof. **Verified to LOWER**
-> clean for both linux arches (every epoll syscall emits) + self-reviewed; NOT corpus-snapshotted (a
-> Loop example drags the std barrel → ~18k-line brittle IR — documented in event.sx). Runtime validation
-> pends a linux runner. **Remaining:** a linux CI run to validate end-to-end; optionally route sched.sx
-> `block_on_fd` through `std.event` (still needs the linux sched.sx port — mmap consts, tramp symbol,
-> errno, x86_64 SysV switch).
+> EPOLLIN/OUT mask via ADD/MOD/DEL), eventfd wake channel, and EPOLLRDHUP→eof. **RUNTIME-VALIDATED on
+> real Linux:** a static `aarch64-linux` build of the 1632-equivalent Loop test (+ the eventfd wake path)
+> ran **6/6 green inside an Apple `container` Linux VM** (kernel 6.18 aarch64) — add_read, idle-timeout,
+> readable+fd+udata, the MOD-mask add_write path, the eventfd wake channel, and EPOLLRDHUP/HUP eof all
+> behave identically to kqueue (lone documented difference: `nbytes` is 0 on epoll). Also lowers clean for
+> both linux arches; the ABI is corpus-locked by 1633. NOT corpus-snapshotted (the corpus runner is
+> host-based, not container-aware; a Loop example drags the std barrel → ~18k-line brittle IR).
+> **The epoll deliverable is COMPLETE.** Re-validation recipe in the event.sx VALIDATION note. Optional
+> follow-on: route sched.sx `block_on_fd` through `std.event` (still needs the linux sched.sx port — mmap
+> consts, tramp symbol, errno, x86_64 SysV switch).
 
 > **✅ issue 0192 FIXED (2026-06-26) — epoll work UNBLOCKED.** A qualified-import-member const
 > (`m.EV_SIZE`) now folds as a compile-time constant in every position the bare/flat form does

library/modules/std/event.sx

@@ -30,15 +30,20 @@
 // waits, passing the nearest deadline as `wait`'s timeout.
 //
 // VALIDATION: the kqueue path runs end-to-end on the macOS dev host
-// (examples/event/1632 — which exercises the full facade surface:
-// add_read/write, add_wake/wake, wait, del_*, EOF). The epoll path has no
-// linux box here, so it is verified to LOWER clean for x86_64-linux and
-// aarch64-linux (the whole module + every epoll syscall emits) and is
-// self-reviewed; it is NOT corpus-snapshotted (a Loop example pulls in the
-// std barrel → an ~18k-line IR dump that would churn on any unrelated std
-// change — worse than the gap). The epoll ABI itself (the layout-sensitive
-// part) IS corpus-locked, by examples/event/1633 over the raw bindings.
-// Runtime behavior validates on a linux runner.
+// (examples/event/1632 — full facade surface: add_read/write, add_wake/wake,
+// wait, del_*, EOF). The epoll path is RUNTIME-VALIDATED on real Linux: a
+// static aarch64-linux build of the 1632-equivalent test (plus the eventfd
+// wake path) runs 6/6 green inside an Apple `container` Linux VM (kernel
+// 6.18 aarch64) — add_read, idle-timeout, readable+fd+udata, the MOD-mask
+// add_write path, the eventfd wake channel, and EPOLLRDHUP/EPOLLHUP eof all
+// behave identically to kqueue. The one intentional backend difference is
+// `nbytes` (kqueue reports the pending byte count; epoll reports 0). Re-run:
+//   sx build --target aarch64-linux --self-contained -o /tmp/ev <test>.sx
+//   container run --rm -v "$PWD/.sx-tmp:/work" alpine /work/ev
+// It is NOT corpus-snapshotted (a Loop example pulls in the std barrel → an
+// ~18k-line IR dump that churns on any unrelated std change, and the corpus
+// runner is host-based, not container-aware). The epoll ABI itself (the
+// layout-sensitive part) IS corpus-locked by examples/event/1633.
 
 #import "modules/std.sx";
 kqb  :: #import "modules/std/net/kqueue.sx";