fix(verify): gate JIT verification to amd64 until trampolines are hardened

docs/DECISIONS.md

@@ -33,6 +33,37 @@ runs `go list` as a subprocess (consistent with `toolchainObjectPreamble`
 which already calls `go tool asm`).  All symbol data is cached per package
 for the lifetime of the GOOBJ emission.
 
+## 2026-08-30 non-amd64 JIT execution trampolines
+
+**Status:** open (blocks runtime verification on arm64, riscv64 and
+loong64 hosts).
+
+**State.**  The per-architecture trampolines compile for all targets, the
+kernels they execute are byte-for-byte correct against `go tool asm`, and
+under `qemu-aarch64` the arm64 kernel demonstrably executes and stores its
+result correctly.  The failure is on the return path into Go code: arm64
+and loong64 take a SIGSEGV after the kernel's RET (the Go-side unwind
+through `leaveJIT` and its interposed ABIInternal wrapper is the suspect),
+and riscv64 returns cleanly but with an untouched result area.  amd64 is
+unaffected (the checked trampoline saves and restores BP/R14 and the flow
+is validated end to end).
+
+**Evidence harness.**  `verify/jit_arch_test.go` (plain call) and
+`verify/abi_arch_test.go` (checked call) are GOARCH-guarded tests; build
+the test binary per target (`GOARCH=arm64 go test -c -o v.test ./verify/`)
+and run it under `qemu-aarch64-static` from the `verify/` directory.  A
+minimal reproducer pattern lives in the qemu exploration notes: verify
+loads, the kernel executes, the fault follows the return.
+
+**Fix direction.**  Compare the amd64 checked trampoline (GLOBL/DATA raw
+address, explicit SP/BP/R14 save-restore) against the arm64/riscv64/
+loong64 `leaveJIT` unwind, in particular the interaction with the
+ABIInternal wrapper that `reflect.ValueOf(leaveJIT).Pointer()` returns.
+The plain-call path (no sentinels) fails the same way, so the checked
+path is not the variable.
+
+---
+
 ## 2026-08-29 tooling round
 
 - `lint abi0-register-args`: flags kernels whose `// func` parameters are