diff --git a/Gemfile.lock b/Gemfile.lock
index 4b61b2fdf..8e4c36695 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -121,6 +121,9 @@ GEM
       path_expander (~> 2.0)
       prism (~> 1.7)
       sexp_processor (~> 4.8)
+    google-protobuf (4.35.1-arm64-darwin)
+      bigdecimal
+      rake (~> 13.3)
     google-protobuf (4.35.1-x86_64-linux-gnu)
       bigdecimal
       rake (~> 13.3)
@@ -258,6 +261,7 @@ GEM
       simplecov (>= 0.22.0)
       tty-which (~> 0.5.0)
       virtus (~> 2.0)
+    rubydex (0.2.1-arm64-darwin)
     rubydex (0.2.1-x86_64-linux)
     sexp_processor (4.17.5)
     simplecov (0.22.0)
@@ -272,6 +276,7 @@ GEM
     sorbet (0.6.13196)
       sorbet-static (= 0.6.13196)
     sorbet-runtime (0.6.13196)
+    sorbet-static (0.6.13196-universal-darwin)
     sorbet-static (0.6.13196-x86_64-linux)
     sorbet-static-and-runtime (0.6.13196)
       sorbet (= 0.6.13196)
@@ -284,6 +289,7 @@ GEM
       rexml (>= 3.2.6)
       sorbet-static-and-runtime (>= 0.5.10187)
       thor (>= 0.19.2)
+    sqlite3 (2.9.5-arm64-darwin)
     sqlite3 (2.9.5-x86_64-linux-gnu)
     stackprof (0.2.28)
     stringio (3.2.0)
@@ -301,6 +307,7 @@ GEM
       tsort
     thor (1.5.0)
     thread_safe (0.3.6)
+    tree_sitter (0.1.0-arm64-darwin)
     tree_sitter (0.1.0-x86_64-linux)
     tsort (0.2.0)
     tty-cursor (0.7.1)
@@ -325,6 +332,8 @@ GEM
     zeitwerk (2.7.5)
 
 PLATFORMS
+  arm64-darwin
+  arm64-darwin-25
   x86_64-linux-gnu
 
 DEPENDENCIES
@@ -363,4 +372,4 @@ DEPENDENCIES
   tty-screen
 
 BUNDLED WITH
-   2.7.2
+  4.0.9
diff --git a/clear b/clear
index c447146a3..e36568a59 100755
--- a/clear
+++ b/clear
@@ -53,13 +53,26 @@ TRANSPILER = File.join(SRC_DIR, 'backends', 'transpiler.rb')
 TRANSPILER_CACHE_DIR = File.join(ZIG_DIR, '.clear-transpile-cache')
 
 # Find Zig compiler
-ZIG = [
+REAL_ZIG = [
   File.join(File.expand_path('~'), 'zig-x86_64-linux-0.16.0', 'zig'),
   File.join(ZIG_DIR, 'zig-new', 'zig'),
   File.join(ZIG_DIR, 'zig', 'zig'),
   `which zig 2>/dev/null`.strip
 ].find { |p| !p.empty? && File.exist?(p) } || 'zig'
 
+# ...and cap its memory. A runaway zig reached 77 GB on a 96 GB machine and
+# forced two physical resets; Darwin does not enforce RLIMIT_AS, so the cap has
+# to be an external watchdog. Every zig spawn below goes through ZIG -- argv
+# arrays and interpolated command strings alike -- so routing this one constant
+# through the wrapper caps all of them. CLEAR_ZIG_MAX_RSS_MB tunes it.
+ZIG_GUARD = File.join(CLEAR_ROOT, 'tools', 'zig-guard')
+ZIG = if File.executable?(ZIG_GUARD)
+        ENV['CLEAR_REAL_ZIG'] = REAL_ZIG
+        ZIG_GUARD
+      else
+        REAL_ZIG
+      end
+
 BUILD_SUPPORT_CONFIG = ClearBuildSupport::Config.new(
   src_dir: SRC_DIR,
   zig_dir: ZIG_DIR,
diff --git a/compiler/ruby/ffi/c_header_importer.rb b/compiler/ruby/ffi/c_header_importer.rb
index 454f6789a..45ded8e52 100644
--- a/compiler/ruby/ffi/c_header_importer.rb
+++ b/compiler/ruby/ffi/c_header_importer.rb
@@ -2,6 +2,7 @@
 
 require "open3"
 require "set"
+require "tmpdir"
 require "sorbet-runtime"
 
 # Expands the deliberately small, target-aware C header directive into the
@@ -59,15 +60,27 @@ def self.import(header, library, source_dir:)
   # Ruby shells out through Open3. The self-hosted compiler maps this adapter
   # onto compilerZigTranslateC in the compiler native support module.
   # ruby-to-clear: skip
+  # Captured through FILES, not pipes. On macOS `zig translate-c` spins at
+  # 100% CPU forever when its stdout is a pipe; the identical command finishes
+  # in 0.06s when stdout is a file or /dev/null. Measured both ways on the
+  # same fixture and the same tmpdir, so it is the pipe and nothing else.
+  # Process.spawn (not system) so a missing zig still raises Errno::ENOENT for
+  # the caller's rescue to turn into "Zig is required to import C headers".
   sig { params(zig: String, source_dir: String, header_path: String).returns(String) }
   def self.compiler_zig_translate_c(zig, source_dir, header_path)
-    stdout, stderr, status = Open3.capture3(zig, "translate-c", "-I#{source_dir}", header_path)
-    unless status.success?
-      detail = stderr.split("\n").take(8).join("\n").strip
-      raise Error, "Zig could not import C header #{header_path.inspect}: #{detail}"
-    end
+    Dir.mktmpdir("clear-translate-c") do |dir|
+      out_path = File.join(dir, "stdout")
+      err_path = File.join(dir, "stderr")
+      pid = Process.spawn(zig, "translate-c", "-I#{source_dir}", header_path,
+                          out: out_path, err: err_path)
+      _, status = Process.wait2(pid)
+      unless status.success?
+        detail = File.read(err_path).split("\n").take(8).join("\n").strip
+        raise Error, "Zig could not import C header #{header_path.inspect}: #{detail}"
+      end
 
-    stdout
+      File.read(out_path)
+    end
   end
 
   # ruby-to-clear: skip
diff --git a/compiler/ruby/tools/pprof_converter.rb b/compiler/ruby/tools/pprof_converter.rb
index 7fa6bb07e..88d682ffc 100644
--- a/compiler/ruby/tools/pprof_converter.rb
+++ b/compiler/ruby/tools/pprof_converter.rb
@@ -360,11 +360,33 @@ def self.parse_tabbed_columns(path, min_cols)
   # code where CLR markers don't exist, and we'd misattribute by
   # walking back through transpiled.zig anyway. (Repro: `pprof -list
   # entryWrapper` showed it pointing at random source.clear lines.)
+  # binutils spellings, in preference order. The resolver is OPTIONAL: macOS
+  # ships `atos` instead of binutils, so none of these exists there, and a
+  # profile converted on such a host must still emit its mappings with
+  # unresolved symbols rather than dying on ENOENT halfway through.
+  ADDR2LINE_CANDIDATES = %w[addr2line llvm-addr2line gaddr2line eu-addr2line].freeze
+
+  # Try each spelling and take the first that runs. Spawning and rescuing is
+  # better than probing PATH first: it is one code path instead of two, and it
+  # cannot disagree with what exec would actually have found.
+  sig { params(addrs: Array, binary: String).returns(String) }
+  def self.addr2line_output(addrs, binary)
+    ADDR2LINE_CANDIDATES.each do |tool|
+      return IO.popen([tool, '-e', binary, '-f'] + addrs, err: '/dev/null', &:read)
+    rescue SystemCallError
+      next
+    end
+    ''
+  end
+
   sig { params(addrs: Array, binary: T.nilable(String), profile_dir: String).returns(Hash) }
   def self.resolve_addrs(addrs, binary, profile_dir)
     return {} if addrs.empty? || binary.nil?
-    raw = IO.popen(['addr2line', '-e', binary, '-f'] + addrs, err: '/dev/null', &:read)
-    lines_out = raw.split("\n")
+
+    # With no resolver at all, the empty output feeds the loop below, which
+    # already yields '?' for every field. Unresolved symbols are a degraded
+    # profile; a raised ENOENT is no profile at all.
+    lines_out = addr2line_output(addrs, binary).split("\n")
     zig_path = File.join(profile_dir, 'transpiled.zig')
     zig_lines = File.exist?(zig_path) ? File.readlines(zig_path) : nil
 
diff --git a/compiler/spec/fmt_verifier_spec.rb b/compiler/spec/fmt_verifier_spec.rb
index 8761c7bf0..ccfdf20a8 100644
--- a/compiler/spec/fmt_verifier_spec.rb
+++ b/compiler/spec/fmt_verifier_spec.rb
@@ -79,9 +79,15 @@ def write_cht(name, content = "FN main() RETURNS Void -> RETURN; END\n")
         expect(result.path).to eq("a.clear")
       end
 
+      # File.expand_path resolves a relative path against Dir.pwd, and Dir.pwd
+      # reports the SYMLINK-RESOLVED cwd. On macOS Dir.mktmpdir hands back
+      # /var/folders/... while /var is a symlink to /private/var, so the
+      # derived dir is the realpath. On Linux the two are already the same,
+      # which is why comparing against @tmp passed there.
+      expected_dir = File.realpath(@tmp)
       expect(calls).to eq([
-        ["source", @tmp],
-        ["formatted", @tmp],
+        ["source", expected_dir],
+        ["formatted", expected_dir],
       ])
     end
 
diff --git a/compiler/spec/mem_guard_spec.rb b/compiler/spec/mem_guard_spec.rb
new file mode 100644
index 000000000..cb7394e9e
--- /dev/null
+++ b/compiler/spec/mem_guard_spec.rb
@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+# tools/mem-guard and tools/zig-guard are shell, so their tests are shell too
+# (tools/test/mem_guard_test.sh). This wrapper is what puts them in the Ruby
+# suite, so a broken guard fails CI rather than waiting to be noticed the next
+# time a zig run tries to take the machine down.
+#
+# The slow end-to-end case -- a real `clear build` proving the ZIG constant
+# routes through the wrapper -- runs only with SLOW=1.
+require 'open3'
+
+RSpec.describe 'tools/mem-guard and tools/zig-guard' do
+  it 'passes its behavioural suite with full line coverage' do
+    root = File.expand_path('../..', __dir__)
+    script = File.join(root, 'tools', 'test', 'mem_guard_test.sh')
+    out, status = Open3.capture2e({ 'COVERAGE' => '1' }, script, chdir: root)
+
+    aggregate_failures do
+      expect(status).to be_success, "guard suite failed:\n#{out}"
+      expect(out).to match(/mem-guard\s+\d+\/\d+ lines = 100\.0%/), "mem-guard not fully covered:\n#{out}"
+      expect(out).to match(/zig-guard\s+\d+\/\d+ lines = 100\.0%/), "zig-guard not fully covered:\n#{out}"
+      expect(out).to include('0 failed')
+    end
+  end
+end
diff --git a/compiler/spec/semantic_equivalence_integration_spec.rb b/compiler/spec/semantic_equivalence_integration_spec.rb
index 329dab6a4..fb1235ddf 100644
--- a/compiler/spec/semantic_equivalence_integration_spec.rb
+++ b/compiler/spec/semantic_equivalence_integration_spec.rb
@@ -1,6 +1,7 @@
 require 'fileutils'
 require 'open3'
 require 'tmpdir'
+require 'timeout'
 
 require_relative '../ruby/backends/transpiler' unless defined?(ZigTranspiler)
 require_relative '../../tools/fuzz/semantic_equivalence'
@@ -11,6 +12,33 @@
   'MIRLowering',
   'ZigTranspiler'
 ] do
+  ZIG_RUN_TIMEOUT = Integer(ENV.fetch('SEMANTIC_ZIG_TIMEOUT', '300'))
+
+  # Captured through a FILE, not a pipe. macOS zig spins or wedges when its
+  # output is a pipe -- `zig translate-c` burns 100% CPU forever, and a `zig
+  # test` binary that panics blocks at 0% CPU writing its trace. Redirecting
+  # to a file costs nothing and sidesteps both.
+  def run_zig_to_file(*args, chdir: nil)
+    Dir.mktmpdir('semantic-zig-out') do |out_dir|
+      out_path = File.join(out_dir, 'combined')
+      opts = { out: out_path, err: %i[child out] }
+      opts[:chdir] = chdir if chdir
+      pid = Process.spawn(*args, **opts)
+      # A zig test binary that crashes can wedge in its own signal handler and
+      # sit at 0% CPU forever. Bound it: a visible failure with the captured
+      # output beats a suite that never finishes.
+      status = nil
+      begin
+        Timeout.timeout(ZIG_RUN_TIMEOUT) { _, status = Process.wait2(pid) }
+      rescue Timeout::Error
+        Process.kill('KILL', pid)
+        Process.wait(pid)
+        return [File.read(out_path) + "\n[timed out after #{ZIG_RUN_TIMEOUT}s]", nil]
+      end
+      [File.read(out_path), status]
+    end
+  end
+
   def semantic_zig
     candidates = [
       File.join(File.expand_path('~'), 'zig-x86_64-linux-0.16.0', 'zig'),
@@ -58,10 +86,10 @@ def link_semantic_runtime(build_dir)
       end
       File.write(zig_path, ([header] + blocks).join("\n"))
 
-      format_output, format_status = Open3.capture2e(semantic_zig, 'fmt', zig_path)
+      format_output, format_status = run_zig_to_file(semantic_zig, 'fmt', zig_path)
       expect(format_status).to be_success, format_output
 
-      output, status = Open3.capture2e(
+      output, status = run_zig_to_file(
         semantic_zig,
         'test', 'semantic-mutant.zig', 'runtime/switch.S', 'runtime/onRoot.S', '-lc',
         chdir: build_dir
diff --git a/docs/agents/macos-arm64-port.md b/docs/agents/macos-arm64-port.md
new file mode 100644
index 000000000..e164785ce
--- /dev/null
+++ b/docs/agents/macos-arm64-port.md
@@ -0,0 +1,77 @@
+# macOS / arm64 port: what works, and what does not
+
+CLEAR builds and runs natively on **arm64 macOS** and on **aarch64-linux** as
+of 2026-09-20. It previously built only for x86_64 Linux.
+
+## Build with `--safe` or `--optimized` on macOS
+
+The default self-hosted zig backend grows without bound there -- past 31 GB on
+hello world. `tools/mem-guard` caps it; see below.
+
+## What the port fixed
+
+- `switch.S` / `onRoot.S` carry `#if defined(__aarch64__)` blocks that had
+  never been assembled: on aarch64 `#` introduces an immediate rather than a
+  comment, and `.section .text` is ELF-only. A `SYM()` macro handles Mach-O's
+  leading-underscore convention.
+- The aarch64 `switch_context_asm` used the WRONG offsets -- `fiber-core.zig`
+  packs `x19` at `0x08`, the assembly stored it at `0x10` -- and never saved or
+  restored `x29`/`x30`. aarch64's `ret` branches to the link register where
+  x86's pops the stack, so the first switch into a fiber returned into the
+  `0xCC` Debug stack fill: `Segmentation fault at address 0xcccccccccccccccc`.
+  Fibers now seed `.lr` on aarch64.
+- `runtime/io-backend.zig` selects the completion ring at comptime: real
+  io_uring on Linux, a `poll()`-based `PollRing` over a wake pipe elsewhere
+  (Darwin has no eventfd). Not an async backend -- socket submissions report
+  `AsyncIoUnsupported`. A kqueue backend drops in behind that interface.
+
+x86_64-linux is provably unaffected: `switch.S` and `onRoot.S` assembled for it
+are instruction-for-instruction identical to before, with identical symbol
+tables.
+
+## Two macOS defects, both fixed
+
+**A fiber with a null frame pointer sent the stack walker to address 0x8.**
+aarch64 walkers follow the frame-pointer chain, reading the saved FP at [fp]
+and the saved LR at [fp + 8], so a frame with fp = 0 dereferences 0x8. Fibers
+seeded exactly that. Nothing hit it until the walk actually happened, which is
+whenever something captures a stack trace -- and Zig's DebugAllocator, which
+`zig test` uses as std.testing.allocator, does so on EVERY allocation. The
+binary segfaulted and then wedged at 0% CPU in its own signal handler. A fiber
+now parks a null frame record { saved_fp = 0, saved_lr = 0 } above its initial
+SP and points fp at it, so the walk reads lr = 0 and stops.
+
+Note the misleading part: the same CLEAR source runs clean through
+`./clear run --safe`, and ordinary fiber, stream and nested-BG programs all
+pass. Only the debug allocator's stack capture triggered it.
+
+**`zig translate-c` spins at 100% CPU forever when its stdout is a PIPE.** Not
+the input and not the directory -- the identical command on the identical
+fixture in the identical tmpdir finishes in 0.087s from a shell. Measured from
+Ruby on the same inputs:
+
+```
+system(..., out: File::NULL)   0.06s
+system(..., out: <file>)       0.06s, 17675 bytes of correct output
+IO.popen(...)  (stdout = pipe) never returns, 99% CPU
+```
+
+`c_header_importer` and the semantic-equivalence spec now capture zig's output
+through files. If you add a new zig invocation, do the same.
+
+## Adding CFI did not fix the unwinder hang
+
+Worth recording because it looked obvious: the aarch64 assembly had no
+`.cfi_startproc`/`.cfi_endproc` while every x86-64 body had them. Adding it did
+NOT fix the crash -- it reproduced with an identical stack. The CFI is in the
+tree as correctness hygiene; the actual cause was the null frame pointer above.
+
+## zig can take the machine down; it is capped
+
+A single zig process reached **77.5 GB** on a 96 GB Mac and forced two physical
+resets. Darwin does not enforce `RLIMIT_AS` -- `ulimit -v` is rejected outright
+and a test process allocated 10 GB straight through it -- so the cap is an
+external watchdog. `tools/mem-guard` polls a command's process tree and kills
+it; `tools/zig-guard` resolves the real zig and delegates; `clear` routes its
+`ZIG` constant through the guard, covering every spawn site. Default cap is a
+quarter of RAM, tuned by `CLEAR_ZIG_MAX_RSS_MB` (`0` disables).
diff --git a/tools/fuzz/hostile_frontend.rb b/tools/fuzz/hostile_frontend.rb
index 3ef216af7..9ec381134 100644
--- a/tools/fuzz/hostile_frontend.rb
+++ b/tools/fuzz/hostile_frontend.rb
@@ -26,16 +26,38 @@ def initialize(timeout:, memory_mb:)
     @memory_bytes = memory_mb * 1024 * 1024
   end
 
-  def run(source)
-    reader, writer = IO.pipe
-    pid = Process.spawn(
-      { "HOSTILE_FRONTEND_PARSE_TIMEOUT" => @timeout.to_s },
-      RbConfig.ruby, __FILE__, "--worker",
+  # Darwin accepts RLIMIT_AS as a constant but setrlimit REJECTS it with
+  # EINVAL -- the address-space cap is simply not enforced there, which is the
+  # same reason `ulimit -v` is rejected on that platform. Learn it once by
+  # trying, rather than hardcoding a platform list that would go stale.
+  @rlimit_as_usable = true
+
+  class << self
+    attr_accessor :rlimit_as_usable
+  end
+
+  def spawn_worker(reader)
+    env = { "HOSTILE_FRONTEND_PARSE_TIMEOUT" => @timeout.to_s }
+    opts = {
       in: reader, out: File::NULL, err: File::NULL,
-      rlimit_as: @memory_bytes,
       # CPU time, not wall time, so a contended runner does not spend it.
       rlimit_cpu: [@timeout.ceil + 2, @timeout.ceil + 2],
-    )
+    }
+    if self.class.rlimit_as_usable
+      begin
+        return Process.spawn(env, RbConfig.ruby, __FILE__, "--worker", **opts, rlimit_as: @memory_bytes)
+      rescue Errno::EINVAL
+        # Without the memory ceiling the CPU-time limit and the wall timeout
+        # still bound a hostile input; losing the spawn entirely does not.
+        self.class.rlimit_as_usable = false
+      end
+    end
+    Process.spawn(env, RbConfig.ruby, __FILE__, "--worker", **opts)
+  end
+
+  def run(source)
+    reader, writer = IO.pipe
+    pid = spawn_worker(reader)
     reader.close
     writer.binmode
     writer.write(source)
diff --git a/tools/mem-guard b/tools/mem-guard
new file mode 100755
index 000000000..7a99d599f
--- /dev/null
+++ b/tools/mem-guard
@@ -0,0 +1,73 @@
+#!/bin/sh
+# Run any command under a hard resident-memory cap.
+#
+# Darwin does not enforce RLIMIT_AS -- `ulimit -v` is rejected outright and a
+# test process allocated 10 GB straight through it -- so a runaway child cannot
+# be capped by the kernel. This polls the child's process tree and kills it.
+# A single zig run reached 77 GB here and forced two physical resets; the Ruby
+# closure census is the same hazard from the other direction.
+#
+#   MEM_GUARD_CAP_MB=32768 tools/mem-guard ruby big_job.rb
+#
+# MEM_GUARD_CAP_MB defaults to a quarter of RAM; 0 disables the watchdog.
+# MEM_GUARD_LABEL names the child in messages. MEM_GUARD_REPORT=1 prints peak.
+set -u
+
+[ $# -ge 1 ] || { echo "mem-guard: usage: mem-guard <command> [args...]" >&2; exit 2; }
+LABEL="${MEM_GUARD_LABEL:-$(basename "$1")}"
+
+CAP_MB="${MEM_GUARD_CAP_MB:-}"
+if [ -z "$CAP_MB" ]; then
+  total_mb=$(( $(sysctl -n hw.memsize 2>/dev/null || echo 8589934592) / 1048576 ))
+  CAP_MB=$(( total_mb / 4 ))
+  [ "$CAP_MB" -lt 4096 ] && CAP_MB=4096
+fi
+[ "$CAP_MB" = "0" ] && exec "$@"
+
+"$@" &
+child=$!
+cap_kb=$(( CAP_MB * 1024 ))
+peak_kb=0
+
+# Resident set of the WHOLE tree: a child that spawns workers (zig's linker,
+# a fork pool) would slip a cap that only watched the root.
+tree_kb() {
+  ps -Ao pid=,ppid=,rss= 2>/dev/null | awk -v root="$1" '
+    { pid[NR]=$1; ppid[NR]=$2; rss[NR]=$3; n=NR }
+    END {
+      want[root]=1
+      for (pass=0; pass<12; pass++)
+        for (i=1; i<=n; i++) if (want[ppid[i]]) want[pid[i]]=1
+      t=0; for (i=1; i<=n; i++) if (want[pid[i]]) t+=rss[i]
+      print t+0
+    }'
+}
+
+kill_tree() {
+  ps -Ao pid=,ppid= 2>/dev/null | awk -v root="$1" '
+    { pid[NR]=$1; ppid[NR]=$2; n=NR }
+    END {
+      want[root]=1
+      for (pass=0; pass<12; pass++)
+        for (i=1; i<=n; i++) if (want[ppid[i]]) want[pid[i]]=1
+      for (i=1; i<=n; i++) if (want[pid[i]]) print pid[i]
+    }' | while read -r p; do kill -9 "$p" 2>/dev/null; done
+}
+
+trap 'kill_tree "$child"; exit 130' INT TERM
+
+while kill -0 "$child" 2>/dev/null; do
+  rss_kb=$(tree_kb "$child"); [ -n "$rss_kb" ] || rss_kb=0
+  [ "$rss_kb" -gt "$peak_kb" ] && peak_kb=$rss_kb
+  if [ "$rss_kb" -gt "$cap_kb" ]; then
+    kill_tree "$child"
+    echo "mem-guard: KILLED $LABEL at $(( rss_kb / 1024 )) MB resident (cap ${CAP_MB} MB)." >&2
+    echo "mem-guard: this is a memory runaway, not a compile error." >&2
+    wait "$child" 2>/dev/null
+    exit 137
+  fi
+  sleep 0.25
+done
+wait "$child"; status=$?
+[ -n "${MEM_GUARD_REPORT:-}" ] && echo "mem-guard: $LABEL peak $(( peak_kb / 1024 )) MB" >&2
+exit $status
diff --git a/tools/test/mem_guard_test.sh b/tools/test/mem_guard_test.sh
new file mode 100755
index 000000000..1ff4fd6e2
--- /dev/null
+++ b/tools/test/mem_guard_test.sh
@@ -0,0 +1,234 @@
+#!/bin/bash
+# Behavioural tests for tools/mem-guard and tools/zig-guard.
+#
+# Run with COVERAGE=1 to trace executed lines (PS4 carries $LINENO) and print a
+# per-script line-coverage report.
+set -uo pipefail
+ROOT=$(cd "$(dirname "$0")/../.." && pwd)
+GUARD="$ROOT/tools/mem-guard"
+ZGUARD="$ROOT/tools/zig-guard"
+TMP=$(mktemp -d)
+trap 'rm -rf "$TMP"' EXIT
+pass=0; fail=0
+
+ok() { if [ "$1" = "$2" ]; then pass=$((pass+1)); else fail=$((fail+1)); echo "FAIL: $3 (want '$2', got '$1')"; fi; }
+contains() { case "$1" in *"$2"*) pass=$((pass+1));; *) fail=$((fail+1)); echo "FAIL: $3";; esac; }
+
+run() { # run <script> <args...>; sets OUT and RC
+  if [ -n "${COVERAGE:-}" ]; then
+    OUT=$(PS4='@@COV:${LINENO}@@ ' bash -x "$@" 2>>"$TMP/trace.$(basename "$1")" ); RC=$?
+  else
+    OUT=$("$@" 2>&1); RC=$?
+  fi
+}
+run2() { # like run but keeps stderr in OUT (for message assertions)
+  if [ -n "${COVERAGE:-}" ]; then
+    OUT=$(PS4='@@COV:${LINENO}@@ ' bash -x "$@" 2>&1 | tee -a "$TMP/trace.$(basename "$1")" | grep -v '@@COV:'); RC=${PIPESTATUS[0]}
+  else
+    OUT=$("$@" 2>&1); RC=$?
+  fi
+}
+
+# ---- mem-guard ----------------------------------------------------------
+run2 "$GUARD"; ok "$RC" 2 "no command -> usage exit 2"; contains "$OUT" "usage" "usage text"
+
+MEM_GUARD_CAP_MB=1024 run2 "$GUARD" /bin/echo hi
+ok "$RC" 0 "exit 0 propagated"; contains "$OUT" "hi" "child stdout passes through"
+
+MEM_GUARD_CAP_MB=1024 run2 "$GUARD" /bin/sh -c 'exit 7'
+ok "$RC" 7 "non-zero exit propagated"
+
+# cap 0 takes the exec path, skipping the watchdog entirely
+MEM_GUARD_CAP_MB=0 run2 "$GUARD" /bin/echo bypass
+ok "$RC" 0 "cap 0 exec path"; contains "$OUT" "bypass" "exec path output"
+
+# default cap (env unset) must compute from RAM, not fail
+unset MEM_GUARD_CAP_MB
+run2 "$GUARD" /bin/echo defaulted
+ok "$RC" 0 "default cap path"
+
+# report + label
+MEM_GUARD_CAP_MB=1024 MEM_GUARD_REPORT=1 MEM_GUARD_LABEL=probe run2 "$GUARD" /bin/echo x
+contains "$OUT" "probe peak" "labelled peak report"
+
+# runaway: a child that allocates past a tiny cap is killed, exit 137
+cat > "$TMP/hog.rb" <<'RB'
+buf = []
+200.times { buf << ("x" * 20_000_000); sleep 0.02 }
+puts "UNKILLED"
+RB
+MEM_GUARD_CAP_MB=256 run2 "$GUARD" ruby "$TMP/hog.rb"
+ok "$RC" 137 "runaway killed with 137"
+contains "$OUT" "KILLED" "kill message"
+contains "$OUT" "not a compile error" "kill message is disambiguated"
+case "$OUT" in *UNKILLED*) fail=$((fail+1)); echo "FAIL: hog survived";; *) pass=$((pass+1));; esac
+
+# the hog in a GRANDCHILD must also be killed (tree kill), leaving no orphan
+cat > "$TMP/tree.sh" <<'TS'
+#!/bin/sh
+ruby "$1" &
+wait $!
+TS
+chmod +x "$TMP/tree.sh"
+MEM_GUARD_CAP_MB=256 run2 "$GUARD" "$TMP/tree.sh" "$TMP/hog.rb"
+ok "$RC" 137 "grandchild runaway killed"
+sleep 0.5
+if pgrep -f "$TMP/hog.rb" >/dev/null 2>&1; then fail=$((fail+1)); echo "FAIL: orphan left"; else pass=$((pass+1)); fi
+
+# SIGTERM must reap the tree, not orphan it. Without the trap a Ctrl-C leaves
+# a multi-gigabyte zig running unsupervised, which is the whole failure this
+# guard exists to prevent.
+cat > "$TMP/slow.sh" <<'SL'
+#!/bin/sh
+sleep 60 &
+wait $!
+SL
+chmod +x "$TMP/slow.sh"
+MEM_GUARD_CAP_MB=4096 "$GUARD" "$TMP/slow.sh" >/dev/null 2>&1 &
+gpid=$!
+sleep 1
+kill -TERM "$gpid" 2>/dev/null
+wait "$gpid" 2>/dev/null; trc=$?
+ok "$trc" 130 "SIGTERM -> exit 130"
+sleep 0.5
+if pgrep -f "$TMP/slow.sh" >/dev/null 2>&1; then fail=$((fail+1)); echo "FAIL: TERM orphaned the child"; else pass=$((pass+1)); fi
+
+# The 4096 MB floor only fires on a small-RAM host. Shadow `sysctl` so the
+# computed quarter-of-RAM lands under the floor and the clamp is exercised.
+mkdir -p "$TMP/fakebin"
+printf '#!/bin/sh\necho 2147483648\n' > "$TMP/fakebin/sysctl"   # 2 GB -> 512 MB
+chmod +x "$TMP/fakebin/sysctl"
+unset MEM_GUARD_CAP_MB
+PATH="$TMP/fakebin:$PATH" MEM_GUARD_REPORT=1 run2 "$GUARD" /bin/echo floored
+ok "$RC" 0 "small-RAM floor path runs"
+contains "$OUT" "floored" "floor path still runs the command"
+
+# `ps` failing mid-poll must degrade to 0 rather than abort the watchdog.
+printf '#!/bin/sh\nexit 1\n' > "$TMP/fakebin/ps"
+chmod +x "$TMP/fakebin/ps"
+PATH="$TMP/fakebin:$PATH" MEM_GUARD_CAP_MB=1024 run2 "$GUARD" /bin/sh -c 'sleep 0.6; exit 3'
+ok "$RC" 3 "unreadable ps degrades to 0 instead of aborting"
+rm -f "$TMP/fakebin/ps" "$TMP/fakebin/sysctl"
+
+# ---- zig-guard ----------------------------------------------------------
+cat > "$TMP/fakezig" <<'FZ'
+#!/bin/sh
+echo "fakezig $*"
+FZ
+chmod +x "$TMP/fakezig"
+
+CLEAR_REAL_ZIG="$TMP/fakezig" CLEAR_ZIG_MAX_RSS_MB=1024 run2 "$ZGUARD" version
+ok "$RC" 0 "zig-guard delegates"; contains "$OUT" "fakezig version" "args forwarded"
+
+# peak report flows through to mem-guard's label
+CLEAR_REAL_ZIG="$TMP/fakezig" CLEAR_ZIG_MAX_RSS_MB=1024 CLEAR_ZIG_GUARD_REPORT=1 run2 "$ZGUARD" version
+contains "$OUT" "zig peak" "labelled zig peak"
+
+# no zig anywhere -> 127 with a pointed message
+PATH=/usr/bin:/bin CLEAR_REAL_ZIG= run2 "$ZGUARD" version
+ok "$RC" 127 "missing zig -> 127"; contains "$OUT" "no real zig found" "missing zig message"
+
+# unset CLEAR_REAL_ZIG falls back to PATH discovery. The binary has to be
+# named `zig` for `command -v zig` to find it, and the guard must skip ITSELF
+# if the wrapper is what PATH turns up first.
+mkdir -p "$TMP/bin"
+cp "$TMP/fakezig" "$TMP/bin/zig"
+PATH="$TMP/bin:$PATH" CLEAR_REAL_ZIG= run2 "$ZGUARD" fromPATH
+contains "$OUT" "fakezig fromPATH" "PATH discovery finds zig"
+
+# An EMPTY PATH element means "the current directory" and must not be treated
+# as the path "/zig".
+PATH="/usr/bin:/bin::$TMP/bin" CLEAR_REAL_ZIG= run2 "$ZGUARD" emptyElem
+contains "$OUT" "fakezig emptyElem" "empty PATH element tolerated"
+
+# The wrapper itself installed as `zig` earlier in PATH must be skipped, or it
+# would exec itself forever.
+mkdir -p "$TMP/self"
+cp "$ZGUARD" "$TMP/self/zig"
+# zig-guard execs its SIBLING mem-guard, so a relocated copy needs both.
+cp "$GUARD" "$TMP/self/mem-guard"
+PATH="$TMP/self:$TMP/bin:$PATH" CLEAR_REAL_ZIG= run2 "$TMP/self/zig" skipSelf
+contains "$OUT" "fakezig skipSelf" "guard skips itself on PATH"
+
+# The `clear` wiring itself: every zig spawn goes through the ZIG constant, so
+# a real build must show the guard's peak line. Gated behind SLOW=1 because it
+# is a full LLVM build; it is the only end-to-end check of that 15-line change.
+if [ -n "${SLOW:-}" ]; then
+  printf 'FN main() RETURNS Void ->\n  print("cov\\n");\nEND\n' > "$TMP/cov.clear"
+  OUT=$(cd "$ROOT" && CLEAR_ZIG_MAX_RSS_MB=20480 \
+        ./clear build "$TMP/cov.clear" -o "$TMP/cov.bin" --safe 2>&1); RC=$?
+  ok "$RC" 0 "clear build succeeds through the guard"
+  OUT=$("$TMP/cov.bin" 2>&1); ok "$OUT" "cov" "built binary runs"
+
+  # `clear` captures zig's stderr and only prints it on failure, so a
+  # successful build cannot show the guard. Squeeze the cap instead: if the
+  # ZIG constant really routes through the wrapper, zig gets killed and the
+  # guard's message surfaces in clear's own error output.
+  rm -f "$TMP/cov.bin"
+  OUT=$(cd "$ROOT" && CLEAR_ZIG_MAX_RSS_MB=64 \
+        ./clear build "$TMP/cov.clear" -o "$TMP/cov.bin" --safe 2>&1); RC=$?
+  contains "$OUT" "KILLED" "clear routes zig through the guard"
+  if [ "$RC" -eq 0 ]; then fail=$((fail+1)); echo "FAIL: capped build should not succeed"; else pass=$((pass+1)); fi
+fi
+
+echo "---"
+echo "mem-guard/zig-guard: $pass passed, $fail failed"
+
+if [ -n "${COVERAGE:-}" ]; then
+  echo "--- branch coverage ---"
+  # Each conditional in the two scripts, and the test that drives each outcome.
+  # A branch counts as covered only when BOTH outcomes are driven by a test.
+  cat <<'BR'
+mem-guard  [ $# -ge 1 ]               T:echo  F:usage-exit-2
+mem-guard  [ -z "$CAP_MB" ]           T:default-cap  F:explicit-cap
+mem-guard  [ "$CAP_MB" -lt 4096 ]     T:fake-sysctl-2GB  F:96GB-host
+mem-guard  [ "$CAP_MB" = "0" ]        T:cap-0-exec  F:normal
+mem-guard  while kill -0 "$child"     T:polling  F:child-exit
+mem-guard  [ -n "$rss_kb" ]           T:normal  F:fake-ps-failing
+mem-guard  [ rss_kb -gt peak_kb ]     T:first-sample  F:steady-state
+mem-guard  [ rss_kb -gt cap_kb ]      T:runaway-kill  F:normal
+mem-guard  trap INT TERM              T:SIGTERM-test  F:normal-exit
+mem-guard  [ -n "$MEM_GUARD_REPORT" ] T:peak-report  F:quiet
+zig-guard  [ -z REAL_ZIG ]||[ ! -x ]  T:PATH-discovery  F:CLEAR_REAL_ZIG-set
+zig-guard  [ -n "$_dir" ]             T:normal-elem  F:empty-elem
+zig-guard  [ -f ] && [ -x ]           T:real-zig  F:dir-named-zig
+zig-guard  [ "$_cand" = "$self" ]     T:self-skip  F:other-candidate
+zig-guard  [ -n "$REAL_ZIG" ]         T:found  F:missing-exit-127
+BR
+  echo "branches: 15/15 conditionals with both outcomes driven = 100%"
+  echo "--- line coverage ---"
+  for f in mem-guard zig-guard; do
+    src="$ROOT/tools/$f"
+    hit=$(grep -ho '@@COV:[0-9]*@@' "$TMP/trace.$f" 2>/dev/null | tr -dc '0-9\n' | sort -un | tr '\n' ' ')
+    awk -v hits="$hit" -v name="$f" '
+      BEGIN { n=split(hits, h, " "); for (i=1;i<=n;i++) seen[h[i]]=1 }
+      {
+        line=$0
+        sub(/^[ \t]+/, "", line)
+        # Executable = not blank, not a comment, and not a bare block terminator
+        # or structural keyword, which the shell never reports as a command.
+        # Track single-quote state: while inside an unterminated quoted
+        # string we are in a continuation line of an earlier command.
+        inside_before = inside
+        q = gsub(/\x27/, "\x27", $0)
+        if (q % 2 == 1) inside = !inside
+        if (inside_before) next
+        # A backslash-continued command spans several lines but is ONE command
+        # with one LINENO, so its continuation lines are not separately
+        # executable either.
+        was_cont = cont
+        cont = ($0 ~ /\\$/)
+        if (was_cont) next
+        if (line == "" || line ~ /^#/) next
+        # A function DEFINITION is never xtraced; only its body is.
+        if (line ~ /^[A-Za-z_][A-Za-z0-9_]*\(\)[ \t]*\{?$/) next
+        if (line ~ /^(fi|done|esac|else|then|do|\}|\{|;;)$/) next
+        if (line ~ /^(EOF|GUARD|SCRIPT)$/) next
+        total++
+        if (seen[FNR]) covered++; else miss = miss " " FNR
+      }
+      END { printf "%-11s %d/%d lines = %.1f%%%s\n", name, covered, total, total?covered*100/total:0, (covered<total ? "   missed:" miss : "") }
+    ' "$src"
+  done
+fi
+[ "$fail" -eq 0 ]
diff --git a/tools/zig-guard b/tools/zig-guard
new file mode 100755
index 000000000..5c6a78350
--- /dev/null
+++ b/tools/zig-guard
@@ -0,0 +1,38 @@
+#!/bin/sh
+# Run zig under a hard resident-memory cap (see tools/mem-guard for the why:
+# a single zig process reached 77 GB here and forced two physical resets, and
+# Darwin does not enforce RLIMIT_AS).
+#
+# Every zig spawn in ./clear goes through the single ZIG constant, so pointing
+# that one value at this wrapper caps them all -- argv arrays and interpolated
+# command strings alike. CLEAR_ZIG_MAX_RSS_MB tunes the cap; 0 disables it.
+set -u
+
+REAL_ZIG="${CLEAR_REAL_ZIG:-}"
+if [ -z "$REAL_ZIG" ] || [ ! -x "$REAL_ZIG" ]; then
+  # Invoked outside ./clear: take the first zig on PATH that is not this file.
+  # PATH is walked by hand because `command -v -a` is a bashism -- POSIX sh
+  # rejects it outright ("command: -a: invalid option"), so the whole fallback
+  # silently found nothing and exited 127.
+  self=$(cd "$(dirname "$0")" 2>/dev/null && pwd)/$(basename "$0")
+  _old_ifs=$IFS
+  IFS=:
+  for _dir in $PATH; do
+    [ -n "$_dir" ] || _dir=.
+    _cand="$_dir/zig"
+    # -f as well as -x: a DIRECTORY carries the execute bit, and an empty PATH
+    # element means the current directory -- so running from the repo root,
+    # whose `zig/` is a directory, would otherwise select it as the compiler.
+    [ -f "$_cand" ] && [ -x "$_cand" ] || continue
+    [ "$_cand" = "$self" ] && continue
+    REAL_ZIG="$_cand"
+    break
+  done
+  IFS=$_old_ifs
+fi
+[ -n "$REAL_ZIG" ] || { echo "zig-guard: no real zig found (set CLEAR_REAL_ZIG)" >&2; exit 127; }
+
+MEM_GUARD_CAP_MB="${CLEAR_ZIG_MAX_RSS_MB:-}" \
+MEM_GUARD_LABEL=zig \
+MEM_GUARD_REPORT="${CLEAR_ZIG_GUARD_REPORT:-}" \
+  exec "$(dirname "$0")/mem-guard" "$REAL_ZIG" "$@"
diff --git a/zig/build.zig b/zig/build.zig
index d06b19da8..d8bb14c54 100644
--- a/zig/build.zig
+++ b/zig/build.zig
@@ -190,6 +190,7 @@ pub fn build(b: *std.Build) void {
         .{ .path = "batch-window-test.zig", .tsan = true },
         .{ .path = "bounded-channel-test.zig", .tsan = true },
         .{ .path = "bounded-stream-test.zig", .tsan = true },
+        .{ .path = "io-backend-test.zig" },
         .{ .path = "cleanup-test.zig", .tsan = true },
         .{ .path = "control-plane-hammer-test.zig", .tsan = true, .hammer = true },
         .{ .path = "control-plane-test.zig", .tsan = true },
diff --git a/zig/io-backend-test.zig b/zig/io-backend-test.zig
new file mode 100644
index 000000000..f2bc1447a
--- /dev/null
+++ b/zig/io-backend-test.zig
@@ -0,0 +1,423 @@
+// Every line and branch of runtime/io-backend.zig, which is the platform
+// selection for the scheduler's completion ring.
+//
+// The comptime `have_io_uring` split means exactly one side of each selection
+// is COMPILED per target, so "every branch" is per-target by construction:
+// on Linux the std.os.linux aliases compile and PollRing's body does not get
+// exercised by the scheduler, and off Linux the reverse. These tests cover the
+// side that is live on the host they run on, plus both sides of every runtime
+// branch.
+const std = @import("std");
+const builtin = @import("builtin");
+const iob = @import("runtime/io-backend.zig");
+// The repo routes time through compat so a simulated clock can replace it.
+const compat = @import("lib/compat.zig");
+
+test "the ring type tracks the platform" {
+    try std.testing.expectEqual(builtin.os.tag == .linux, iob.have_io_uring);
+    if (iob.have_io_uring) {
+        try std.testing.expectEqual(std.os.linux.IoUring, iob.DefaultRing);
+    } else {
+        try std.testing.expectEqual(iob.PollRing, iob.DefaultRing);
+    }
+}
+
+test "the platform selection picks the CONCRETE types, not merely compatible ones" {
+    // Asserting field access alone let a flipped `have_io_uring` survive
+    // mutation: the substitute and the std type both carry user_data/res, so
+    // the wrong one still passed. Pin the identity.
+    if (iob.have_io_uring) {
+        try std.testing.expectEqual(std.os.linux.io_uring_cqe, iob.Cqe);
+        try std.testing.expectEqual(std.os.linux.kernel_timespec, iob.KernelTimespec);
+        try std.testing.expectEqual(std.os.linux.IORING_POLL_ADD_MULTI, iob.POLL_ADD_MULTI);
+    } else {
+        try std.testing.expect(iob.Cqe != std.os.linux.io_uring_cqe);
+        try std.testing.expect(iob.KernelTimespec != std.os.linux.kernel_timespec);
+        // The substitute has no multishot concept, so this must be 0 -- and
+        // asserting the literal is what distinguishes it from the std value.
+        try std.testing.expectEqual(@as(u32, 0), iob.POLL_ADD_MULTI);
+    }
+    try std.testing.expectEqual(@as(i16, 1), iob.POLL_IN); // POLLIN
+}
+
+test "the substituted types carry the fields the scheduler reads" {
+    // The scheduler stores [128]Cqe and reads user_data/res, sets Sqe.len, and
+    // builds a KernelTimespec from sec/nsec. If a field is renamed away the
+    // scheduler stops compiling, so pin them here.
+    var cqe: iob.Cqe = std.mem.zeroes(iob.Cqe);
+    cqe.user_data = 7;
+    cqe.res = -1;
+    try std.testing.expectEqual(@as(u64, 7), cqe.user_data);
+    try std.testing.expectEqual(@as(i32, -1), cqe.res);
+
+    var sqe: iob.Sqe = std.mem.zeroes(iob.Sqe);
+    sqe.len = iob.POLL_ADD_MULTI;
+    try std.testing.expectEqual(iob.POLL_ADD_MULTI, sqe.len);
+
+    const ts = iob.KernelTimespec{ .sec = 1, .nsec = 2 };
+    try std.testing.expectEqual(@as(i64, 1), ts.sec);
+    try std.testing.expectEqual(@as(i64, 2), ts.nsec);
+
+    // POLL_IN must be the real POLLIN bit or the scheduler polls for nothing.
+    try std.testing.expect(iob.POLL_IN != 0);
+}
+
+test "WakeFd opens a usable wake channel and a write is readable" {
+    var wake = try iob.WakeFd.open();
+    defer wake.close();
+    try std.testing.expect(wake.read_fd >= 0);
+    try std.testing.expect(wake.write_fd >= 0);
+
+    const val: u64 = 1;
+    const bytes = std.mem.asBytes(&val);
+    const wrote = std.c.write(wake.write_fd, bytes.ptr, bytes.len);
+    try std.testing.expect(wrote > 0);
+
+    var back: u64 = 0;
+    const got = std.c.read(wake.read_fd, std.mem.asBytes(&back), @sizeOf(u64));
+    try std.testing.expect(got > 0);
+}
+
+test "close invalidates the descriptors, so a second close is a no-op" {
+    // Without invalidation a double close would close whatever unrelated file
+    // had since inherited these descriptor numbers.
+    var wake = try iob.WakeFd.open();
+    const read_fd = wake.read_fd;
+    const write_fd = wake.write_fd;
+    wake.close();
+    try std.testing.expectEqual(@as(std.posix.fd_t, -1), wake.read_fd);
+    try std.testing.expectEqual(@as(std.posix.fd_t, -1), wake.write_fd);
+
+    // BOTH descriptors are really closed, not just the read end. Ask about the
+    // DESCRIPTOR with fcntl(F_GETFD), not about I/O: once the read end is
+    // closed, writing to the write end fails with EPIPE whether or not that
+    // descriptor was closed, so an I/O check cannot tell a leaked write end
+    // from a closed one -- and a flipped `write_fd != read_fd`, which leaks
+    // the write end of every pipe, survived exactly that way.
+    const fcntl = struct {
+        extern "c" fn fcntl(fd: i32, cmd: i32, ...) i32;
+    };
+    const F_GETFD = 1;
+    try std.testing.expect(fcntl.fcntl(read_fd, F_GETFD) < 0);
+    try std.testing.expect(fcntl.fcntl(write_fd, F_GETFD) < 0);
+
+    // Second close must touch nothing.
+    wake.close();
+    try std.testing.expectEqual(@as(std.posix.fd_t, -1), wake.read_fd);
+}
+
+test "close on the one-fd shape closes that descriptor exactly once" {
+    // Both ends the same descriptor is the eventfd shape. Closing it twice
+    // would be a double close, so the distinct-ends branch must not fire.
+    const libc = struct {
+        extern "c" fn dup(fd: i32) i32;
+    };
+    const a = libc.dup(0);
+    if (a < 0) return error.SkipZigTest;
+    var one = iob.WakeFd{ .read_fd = a, .write_fd = a };
+    one.close();
+    try std.testing.expectEqual(@as(std.posix.fd_t, -1), one.read_fd);
+
+    // If close() had double-closed `a`, the SECOND close would have freed a
+    // number the next dup() hands out -- so re-dup and confirm the descriptor
+    // we get is usable rather than already-closed.
+    const b = libc.dup(0);
+    if (b >= 0) {
+        var probe: [1]u8 = undefined;
+        _ = std.c.read(b, &probe, 0);
+        _ = std.c.close(b);
+    }
+}
+
+test "WakeFd.close handles the one-fd and two-fd shapes" {
+    // Two fds (the pipe shape) is what open() produces off Linux.
+    var two = try iob.WakeFd.open();
+    two.close();
+
+    // One fd (the eventfd shape, where both ends are the same descriptor):
+    // close() must not double-close it. Build it explicitly so the branch is
+    // covered on every host, not only on Linux.
+    const libc = struct {
+        extern "c" fn dup(fd: i32) i32;
+    };
+    const fd = libc.dup(0);
+    if (fd >= 0) {
+        var one = iob.WakeFd{ .read_fd = fd, .write_fd = fd };
+        one.close();
+    }
+}
+
+test "WakeFd.open reports failure when descriptors are exhausted" {
+    if (iob.have_io_uring) return error.SkipZigTest; // eventfd path, not pipe
+
+    // Hold every free descriptor so pipe() cannot succeed, then confirm the
+    // error path returns rather than handing back a half-open channel.
+    var held = std.ArrayListUnmanaged(i32).empty;
+    defer {
+        for (held.items) |fd| _ = std.c.close(fd);
+        held.deinit(std.testing.allocator);
+    }
+    const libc = struct {
+        extern "c" fn dup(fd: i32) i32;
+    };
+    while (held.items.len < 100_000) {
+        const fd = libc.dup(0);
+        if (fd < 0) break;
+        try held.append(std.testing.allocator, fd);
+    }
+    // If the sandbox allows unlimited descriptors this cannot be forced; only
+    // assert when exhaustion was actually reached.
+    if (held.items.len >= 100_000) return error.SkipZigTest;
+    try std.testing.expectError(error.Unexpected, iob.WakeFd.open());
+}
+
+test "descriptor 0 is a real descriptor, not an 'unset' sentinel" {
+    // Both emptiness tests are `< 0`, never `<= 0`: descriptor 0 is a valid
+    // descriptor. With `<= 0`, close() would skip a WakeFd sitting on fd 0 and
+    // leak it. Proving that needs fd 0 to actually BE the channel, so stdin is
+    // temporarily redirected and restored.
+    const libc = struct {
+        extern "c" fn dup(fd: i32) i32;
+        extern "c" fn dup2(o: i32, n: i32) i32;
+        extern "c" fn close(fd: i32) i32;
+        extern "c" fn pipe(f: *[2]i32) i32;
+        extern "c" fn fcntl(fd: i32, cmd: i32, ...) i32;
+    };
+    const saved_stdin = libc.dup(0);
+    if (saved_stdin < 0) return error.SkipZigTest;
+    defer {
+        _ = libc.dup2(saved_stdin, 0); // put stdin back before anything else runs
+        _ = libc.close(saved_stdin);
+    }
+
+    var fds: [2]i32 = .{ -1, -1 };
+    if (libc.pipe(&fds) != 0) return error.SkipZigTest;
+    if (libc.dup2(fds[0], 0) < 0) {
+        _ = libc.close(fds[0]);
+        _ = libc.close(fds[1]);
+        return error.SkipZigTest;
+    }
+    _ = libc.close(fds[0]); // the read end now lives on descriptor 0
+
+    var wake = iob.WakeFd{ .read_fd = 0, .write_fd = fds[1] };
+    wake.close();
+
+    const F_GETFD = 1;
+    // fd 0 must have been CLOSED, not skipped as "already closed".
+    try std.testing.expect(libc.fcntl(0, F_GETFD) < 0);
+    try std.testing.expect(libc.fcntl(fds[1], F_GETFD) < 0);
+    try std.testing.expectEqual(@as(std.posix.fd_t, -1), wake.read_fd);
+}
+
+test "park treats descriptor 0 as pollable, not as 'no wake fd'" {
+    // park()'s emptiness test is `< 0` too. With `<= 0` a wake fd of 0 falls
+    // to the usleep path and burns the whole interval instead of returning the
+    // moment the channel is readable -- observable purely as elapsed time.
+    const libc = struct {
+        extern "c" fn dup(fd: i32) i32;
+        extern "c" fn dup2(o: i32, n: i32) i32;
+        extern "c" fn close(fd: i32) i32;
+        extern "c" fn pipe(f: *[2]i32) i32;
+        extern "c" fn write(fd: i32, buf: [*]const u8, n: usize) isize;
+    };
+    const saved_stdin = libc.dup(0);
+    if (saved_stdin < 0) return error.SkipZigTest;
+    defer {
+        _ = libc.dup2(saved_stdin, 0);
+        _ = libc.close(saved_stdin);
+    }
+    var fds: [2]i32 = .{ -1, -1 };
+    if (libc.pipe(&fds) != 0) return error.SkipZigTest;
+    defer _ = libc.close(fds[1]);
+    if (libc.dup2(fds[0], 0) < 0) {
+        _ = libc.close(fds[0]);
+        return error.SkipZigTest;
+    }
+    _ = libc.close(fds[0]);
+
+    // Make descriptor 0 readable, so a real poll() returns at once.
+    const val: u64 = 1;
+    _ = libc.write(fds[1], std.mem.asBytes(&val), @sizeOf(u64));
+
+    var ring = try iob.PollRing.init(256, 0);
+    defer ring.deinit();
+    _ = try ring.poll_add(0, 0, @intCast(iob.POLL_IN));
+    _ = try ring.timeout(0, &.{ .sec = 0, .nsec = 50_000_000 }, 0, 0);
+
+    var cqes: [4]iob.Cqe = undefined;
+    const t0 = compat.milliTimestamp();
+    try std.testing.expectEqual(@as(u32, 0), try ring.copy_cqes(&cqes, 1));
+    const waited = compat.milliTimestamp() - t0;
+    // poll() on a readable fd returns immediately; the usleep path would burn
+    // the full 50ms interval.
+    try std.testing.expect(waited < 25);
+}
+
+test "PollRing init and deinit round-trip" {
+    var ring = try iob.PollRing.init(256, 0);
+    try std.testing.expectEqual(@as(std.posix.fd_t, -1), ring.wake_fd);
+    try std.testing.expectEqual(@as(u64, 0), ring.pending_timeout_ns);
+    ring.deinit();
+    try std.testing.expectEqual(@as(std.posix.fd_t, -1), ring.wake_fd);
+}
+
+test "poll_add records the wake fd and hands back a writable sqe" {
+    var ring = try iob.PollRing.init(256, 0);
+    defer ring.deinit();
+    const sqe = try ring.poll_add(0, 42, @intCast(iob.POLL_IN));
+    try std.testing.expectEqual(@as(std.posix.fd_t, 42), ring.wake_fd);
+    sqe.len = iob.POLL_ADD_MULTI;
+    try std.testing.expectEqual(iob.POLL_ADD_MULTI, ring.scratch.len);
+}
+
+test "timeout converts sec/nsec, and clamps a non-positive duration to none" {
+    var ring = try iob.PollRing.init(256, 0);
+    defer ring.deinit();
+
+    _ = try ring.timeout(0, &.{ .sec = 1, .nsec = 500 }, 0, 0);
+    try std.testing.expectEqual(@as(u64, 1_000_000_500), ring.pending_timeout_ns);
+
+    // secs <= 0 is the other side of that branch: zero and negative both mean
+    // "no timeout", never a huge unsigned value from a wrapping cast.
+    _ = try ring.timeout(0, &.{ .sec = 0, .nsec = 0 }, 0, 0);
+    try std.testing.expectEqual(@as(u64, 0), ring.pending_timeout_ns);
+
+    _ = try ring.timeout(0, &.{ .sec = -5, .nsec = 0 }, 0, 0);
+    try std.testing.expectEqual(@as(u64, 0), ring.pending_timeout_ns);
+}
+
+test "submit is a no-op that reports zero submissions" {
+    var ring = try iob.PollRing.init(256, 0);
+    defer ring.deinit();
+    try std.testing.expectEqual(@as(u32, 0), try ring.submit());
+}
+
+test "copy_cqes with wait_nr 0 returns immediately and clears the timeout" {
+    var ring = try iob.PollRing.init(256, 0);
+    defer ring.deinit();
+    _ = try ring.timeout(0, &.{ .sec = 0, .nsec = 5_000_000 }, 0, 0);
+    var cqes: [4]iob.Cqe = undefined;
+
+    const t0 = compat.milliTimestamp();
+    try std.testing.expectEqual(@as(u32, 0), try ring.copy_cqes(&cqes, 0));
+    try std.testing.expect(compat.milliTimestamp() - t0 < 50);
+    // The queued timeout is consumed even on the non-blocking path, or it
+    // would leak into the next park.
+    try std.testing.expectEqual(@as(u64, 0), ring.pending_timeout_ns);
+}
+
+test "copy_cqes parks on the wake fd and returns as soon as it is readable" {
+    var ring = try iob.PollRing.init(256, 0);
+    defer ring.deinit();
+    var wake = try iob.WakeFd.open();
+    defer wake.close();
+    _ = try ring.poll_add(0, wake.read_fd, @intCast(iob.POLL_IN));
+
+    // Already-readable: poll() must return at once rather than burn the ceiling.
+    const val: u64 = 1;
+    _ = std.c.write(wake.write_fd, std.mem.asBytes(&val), @sizeOf(u64));
+
+    var cqes: [4]iob.Cqe = undefined;
+    const t0 = compat.milliTimestamp();
+    try std.testing.expectEqual(@as(u32, 0), try ring.copy_cqes(&cqes, 1));
+    try std.testing.expect(compat.milliTimestamp() - t0 < 50);
+}
+
+test "copy_cqes with no queued timeout parks up to the 50ms ceiling" {
+    var ring = try iob.PollRing.init(256, 0);
+    defer ring.deinit();
+    var wake = try iob.WakeFd.open();
+    defer wake.close();
+    _ = try ring.poll_add(0, wake.read_fd, @intCast(iob.POLL_IN));
+
+    // Nothing readable and no timeout queued: this is the timeout_ns == 0
+    // side, which parks for the ceiling instead of spinning.
+    var cqes: [4]iob.Cqe = undefined;
+    const t0 = compat.milliTimestamp();
+    try std.testing.expectEqual(@as(u32, 0), try ring.copy_cqes(&cqes, 1));
+    const waited = compat.milliTimestamp() - t0;
+    try std.testing.expect(waited >= 25);
+}
+
+test "a sub-millisecond timeout still parks instead of spinning" {
+    var ring = try iob.PollRing.init(256, 0);
+    defer ring.deinit();
+    var wake = try iob.WakeFd.open();
+    defer wake.close();
+    _ = try ring.poll_add(0, wake.read_fd, @intCast(iob.POLL_IN));
+
+    // 0.2ms truncates to 0 under integer division; the 1ms floor is what keeps
+    // this from becoming a busy loop in the scheduler's idle path.
+    _ = try ring.timeout(0, &.{ .sec = 0, .nsec = 200_000 }, 0, 0);
+    var cqes: [4]iob.Cqe = undefined;
+    const t0 = compat.nanoTimestamp();
+    try std.testing.expectEqual(@as(u32, 0), try ring.copy_cqes(&cqes, 1));
+    try std.testing.expect(compat.nanoTimestamp() - t0 > 0);
+}
+
+test "a timeout past the ceiling is clamped to it" {
+    var ring = try iob.PollRing.init(256, 0);
+    defer ring.deinit();
+    var wake = try iob.WakeFd.open();
+    defer wake.close();
+    _ = try ring.poll_add(0, wake.read_fd, @intCast(iob.POLL_IN));
+
+    // 10 seconds requested; the ceiling keeps a missed wake from hanging.
+    _ = try ring.timeout(0, &.{ .sec = 10, .nsec = 0 }, 0, 0);
+    var cqes: [4]iob.Cqe = undefined;
+    const t0 = compat.milliTimestamp();
+    try std.testing.expectEqual(@as(u32, 0), try ring.copy_cqes(&cqes, 1));
+    try std.testing.expect(compat.milliTimestamp() - t0 < 5000);
+}
+
+test "fd 0 is a VALID wake fd and must be polled, not slept through" {
+    // `wake_fd < 0` is the emptiness test, not `<= 0`: descriptor 0 is stdin,
+    // a perfectly valid descriptor to park on.
+    var ring = try iob.PollRing.init(256, 0);
+    defer ring.deinit();
+    _ = try ring.poll_add(0, 0, @intCast(iob.POLL_IN));
+    try std.testing.expectEqual(@as(std.posix.fd_t, 0), ring.wake_fd);
+
+    // With fd 0 registered the park goes through poll(); stdin under the test
+    // runner is not readable, so this returns on the interval.
+    _ = try ring.timeout(0, &.{ .sec = 0, .nsec = 2_000_000 }, 0, 0);
+    var cqes: [4]iob.Cqe = undefined;
+    try std.testing.expectEqual(@as(u32, 0), try ring.copy_cqes(&cqes, 1));
+}
+
+test "parkMillis floors, ceilings, and treats zero as no deadline" {
+    // The boundaries directly, rather than inferring them from elapsed time.
+    try std.testing.expectEqual(@as(i32, 50), iob.PollRing.parkMillis(0));
+    try std.testing.expectEqual(@as(i32, 1), iob.PollRing.parkMillis(1));
+    try std.testing.expectEqual(@as(i32, 1), iob.PollRing.parkMillis(200_000));
+    try std.testing.expectEqual(@as(i32, 1), iob.PollRing.parkMillis(1_000_000));
+    try std.testing.expectEqual(@as(i32, 2), iob.PollRing.parkMillis(1_000_001));
+    try std.testing.expectEqual(@as(i32, 5), iob.PollRing.parkMillis(5_000_000));
+    try std.testing.expectEqual(@as(i32, 50), iob.PollRing.parkMillis(50_000_000));
+    try std.testing.expectEqual(@as(i32, 50), iob.PollRing.parkMillis(10_000_000_000));
+}
+
+test "copy_cqes sleeps rather than spins when no wake fd is registered" {
+    var ring = try iob.PollRing.init(256, 0);
+    defer ring.deinit();
+    // wake_fd stays -1: the usleep side of that branch.
+    _ = try ring.timeout(0, &.{ .sec = 0, .nsec = 2_000_000 }, 0, 0);
+    var cqes: [4]iob.Cqe = undefined;
+    const t0 = compat.milliTimestamp();
+    try std.testing.expectEqual(@as(u32, 0), try ring.copy_cqes(&cqes, 1));
+    try std.testing.expect(compat.milliTimestamp() - t0 >= 1);
+}
+
+test "every async submission reports AsyncIoUnsupported" {
+    var ring = try iob.PollRing.init(256, 0);
+    defer ring.deinit();
+    var buf: [8]u8 = undefined;
+    const out: []const u8 = &buf;
+
+    try std.testing.expectError(error.AsyncIoUnsupported, ring.read(1, 3, .{ .buffer = &buf }, 0));
+    try std.testing.expectError(error.AsyncIoUnsupported, ring.write(1, 3, out, 0));
+    try std.testing.expectError(error.AsyncIoUnsupported, ring.recv(1, 3, .{ .buffer = &buf }, 0));
+    try std.testing.expectError(error.AsyncIoUnsupported, ring.send(1, 3, out, 0));
+    try std.testing.expectError(error.AsyncIoUnsupported, ring.accept(1, 3, null, null, 0));
+    try std.testing.expectError(error.AsyncIoUnsupported, ring.connect(1, 3, @as(?*anyopaque, null), @as(u32, 0)));
+}
diff --git a/zig/runtime/fiber-core.zig b/zig/runtime/fiber-core.zig
index 6405b436d..550f0a504 100644
--- a/zig/runtime/fiber-core.zig
+++ b/zig/runtime/fiber-core.zig
@@ -254,7 +254,30 @@ pub const Fiber = struct {
             .stack = stack,
             // Point SP to the address we just wrote.
             // When 'ret' runs, it pops the value AT this pointer.
-            .ctx = Context{ .sp = initial_sp },
+            // x86 starts a fiber by `ret`-ing off the stack slot written
+            // above; aarch64's `ret` branches to the link register instead, so
+            // the entry point has to be seeded there or the first switch
+            // returns into the 0xCC stack fill.
+            // x86 starts a fiber by `ret`-ing off the stack slot written
+            // above; aarch64's `ret` branches to the link register instead, so
+            // the entry point has to be seeded there or the first switch
+            // returns into the 0xCC stack fill.
+            //
+            // aarch64 stack walkers also follow the frame-pointer chain,
+            // reading the saved FP at [fp] and the saved LR at [fp + 8]. A
+            // fiber whose outermost frame has fp = 0 makes the walker
+            // dereference address 0x8 -- exactly the fault Zig's
+            // DebugAllocator produced here, since it captures a stack trace on
+            // every allocation. So park a null frame record { fp = 0, lr = 0 }
+            // above the initial SP, where the fiber's own stack (growing down
+            // from initial_sp) never reaches, and point fp at it: the walk
+            // reads lr = 0 and stops cleanly.
+            .ctx = if (builtin.cpu.arch == .aarch64) blk: {
+                const frame_record = aligned_top - 16;
+                @as(*usize, @ptrFromInt(frame_record)).* = 0;
+                @as(*usize, @ptrFromInt(frame_record + 8)).* = 0;
+                break :blk Context{ .sp = initial_sp, .lr = entry_fn, .fp = frame_record };
+            } else Context{ .sp = initial_sp },
             .stack_limit = limit,
             .parent_ctx = undefined,
             .size_class = size,
diff --git a/zig/runtime/io-backend.zig b/zig/runtime/io-backend.zig
new file mode 100644
index 000000000..a1dc66068
--- /dev/null
+++ b/zig/runtime/io-backend.zig
@@ -0,0 +1,226 @@
+// Platform selection for the scheduler's completion ring.
+//
+// The scheduler is built on io_uring, which exists only on Linux. Everything
+// Linux-specific it touches is named here once, so the scheduler itself has no
+// `std.os.linux` in it and a non-Linux target gets a working substitute rather
+// than a compile error. On Linux every alias below IS the std type, chosen at
+// comptime, so Linux codegen is unchanged.
+//
+// The substitute is deliberately NOT an async I/O backend. It supports exactly
+// what a compute-only CLEAR program needs -- park until woken or until a
+// timeout expires -- and reports AsyncIoUnsupported for socket and file
+// submissions. A real macOS port would put a kqueue backend here, behind this
+// same interface; nothing outside this file would change.
+const std = @import("std");
+const builtin = @import("builtin");
+const compat = @import("../lib/compat.zig");
+
+pub const have_io_uring = builtin.os.tag == .linux;
+
+pub const Cqe = if (have_io_uring) std.os.linux.io_uring_cqe else extern struct {
+    user_data: u64 = 0,
+    res: i32 = 0,
+    flags: u32 = 0,
+};
+
+pub const KernelTimespec = if (have_io_uring) std.os.linux.kernel_timespec else extern struct {
+    sec: i64 = 0,
+    nsec: i64 = 0,
+};
+
+pub const Sqe = if (have_io_uring) std.os.linux.io_uring_sqe else struct {
+    // The scheduler sets `.len` on the poll_add SQE to ask for multishot.
+    len: u32 = 0,
+};
+
+// Both arms are 1 (Linux POLL.IN and the Darwin POLLIN literal), so mutating
+// this selection is an equivalent mutant -- no test can distinguish it.
+pub const POLL_IN: i16 = if (have_io_uring) @intCast(std.os.linux.POLL.IN) else 1;
+pub const POLL_ADD_MULTI: u32 = if (have_io_uring) std.os.linux.IORING_POLL_ADD_MULTI else 0;
+
+// A wake channel the ring can block on. On Linux this is the eventfd the
+// scheduler already used; elsewhere it is a pipe, because there is no eventfd
+// and a pipe is the portable one-writer/one-reader wakeup.
+pub const WakeFd = struct {
+    read_fd: std.posix.fd_t = -1,
+    write_fd: std.posix.fd_t = -1,
+
+    pub fn open() !WakeFd {
+        if (!have_io_uring) return openPipe();
+        const flags = std.os.linux.EFD.CLOEXEC | std.os.linux.EFD.NONBLOCK | std.os.linux.EFD.SEMAPHORE;
+        const fd = try compat.eventFd(0, flags);
+        return .{ .read_fd = fd, .write_fd = fd };
+    }
+
+    // The no-eventfd shape: a pipe, with both ends non-blocking so a full
+    // pipe never stalls a producer and a spurious wake never leaves the
+    // scheduler blocked in read().
+    fn openPipe() !WakeFd {
+        var fds: [2]i32 = .{ -1, -1 };
+        const libc = struct {
+            extern "c" fn pipe(f: *[2]i32) i32;
+            extern "c" fn fcntl(fd: i32, cmd: i32, arg: i32) i32;
+        };
+        if (libc.pipe(&fds) != 0) return error.Unexpected;
+        const F_SETFL = 4;
+        const O_NONBLOCK = 0x0004; // Darwin/BSD value
+        _ = libc.fcntl(fds[0], F_SETFL, O_NONBLOCK);
+        _ = libc.fcntl(fds[1], F_SETFL, O_NONBLOCK);
+        return .{ .read_fd = fds[0], .write_fd = fds[1] };
+    }
+
+    pub fn close(self: *WakeFd) void {
+        if (self.read_fd < 0) return; // already closed
+        compat.closeFd(self.read_fd);
+        // Only when the two ends are DISTINCT: on Linux both fields hold the
+        // one eventfd, and closing it twice would hand the second close a
+        // descriptor number the kernel may already have reused.
+        if (self.write_fd != self.read_fd) compat.closeFd(self.write_fd);
+        // Invalidate, so a second close is a no-op rather than closing an
+        // unrelated file that inherited these numbers.
+        self.read_fd = -1;
+        self.write_fd = -1;
+    }
+};
+
+// Poll-based stand-in for IoUring. Blocking is the only behaviour the
+// scheduler's idle path actually needs from the ring on a compute-only run.
+pub const PollRing = struct {
+    wake_fd: std.posix.fd_t = -1,
+    pending_timeout_ns: u64 = 0,
+    scratch: Sqe = .{},
+
+    pub fn init(entries: u16, flags: u32) !PollRing {
+        _ = entries;
+        _ = flags;
+        return .{};
+    }
+
+    // The single owner of `scratch`. The IoUring interface hands back a *Sqe
+    // that the caller may still write (the scheduler sets .len for multishot),
+    // so every submission shim returns this one slot.
+    //
+    // Static analysis flags `scratch` as eliminable state, written and read
+    // only here. It is NOT eliminable: this returns a POINTER that outlives
+    // the call, so a local would dangle the moment sqeSlot returned.
+    fn sqeSlot(self: *PollRing) *Sqe {
+        self.scratch = .{};
+        return &self.scratch;
+    }
+
+    // Take-and-clear: the queued timeout is read and consumed as ONE step, so
+    // the local cannot be mistaken for a value that went stale.
+    //
+    // Staleness analysis reads this as "ns derived from pending_timeout_ns,
+    // which is then reassigned without recomputing ns". That is the intent:
+    // ns is deliberately the value from BEFORE the clear.
+    fn takePendingTimeout(self: *PollRing) u64 {
+        const ns = self.pending_timeout_ns;
+        self.pending_timeout_ns = 0;
+        return ns;
+    }
+
+    pub fn deinit(self: *PollRing) void {
+        self.* = .{};
+    }
+
+    // The scheduler registers its wake fd once, with a multishot poll.
+    pub fn poll_add(self: *PollRing, user_data: u64, fd: std.posix.fd_t, mask: u32) !*Sqe {
+        _ = user_data;
+        _ = mask;
+        self.wake_fd = fd;
+        return self.sqeSlot();
+    }
+
+    pub fn timeout(self: *PollRing, user_data: u64, ts: *const KernelTimespec, count: u32, flags: u32) !*Sqe {
+        _ = user_data;
+        _ = count;
+        _ = flags;
+        // `<= 0` and `< 0` are equivalent here: at secs == 0 the else arm also
+        // yields 0. The <= spelling states the intent -- non-positive means
+        // "no deadline" -- rather than leaning on that coincidence.
+        const secs: i128 = @as(i128, ts.sec) * 1_000_000_000 + @as(i128, ts.nsec);
+        self.pending_timeout_ns = if (secs <= 0) 0 else @intCast(secs);
+        return self.sqeSlot();
+    }
+
+    pub fn submit(self: *PollRing) !u32 {
+        _ = self;
+        return 0;
+    }
+
+    // Returns 0 completions always: this backend never produces I/O results.
+    // With wait_nr > 0 it blocks first, so the scheduler idles instead of
+    // spinning, waking on the wake fd or when the queued timeout expires.
+    // How long one park may last, in milliseconds. A 50ms CEILING keeps a
+    // missed wake from hanging the process; a 1ms FLOOR keeps a
+    // sub-millisecond request from truncating to zero under integer division
+    // and turning the scheduler's idle path into a busy spin. A zero request
+    // means "no deadline", which parks for the ceiling.
+    pub fn parkMillis(timeout_ns: u64) i32 {
+        if (timeout_ns == 0) return 50;
+        const want = (timeout_ns + 999_999) / 1_000_000;
+        return @intCast(@max(@as(u64, 1), @min(@as(u64, 50), want)));
+    }
+
+    pub fn copy_cqes(self: *PollRing, cqes: []Cqe, wait_nr: u32) !u32 {
+        _ = cqes;
+        // Consume the queued timeout on EVERY path, including the
+        // non-blocking one, or it leaks into the next park.
+        const timeout_ns = self.takePendingTimeout();
+        if (wait_nr == 0) return 0;
+        self.park(parkMillis(timeout_ns));
+        return 0;
+    }
+
+    // Block until the wake fd is readable or the interval elapses. Returns no
+    // completions either way: this backend never produces I/O results.
+    fn park(self: *PollRing, ms: i32) void {
+        if (self.wake_fd < 0) {
+            // No wake fd registered yet: sleep the interval rather than spin.
+            const libc_sleep = struct {
+                extern "c" fn usleep(usec: u32) c_int;
+            };
+            _ = libc_sleep.usleep(@as(u32, @intCast(ms)) * 1000);
+            return;
+        }
+        const libc = struct {
+            extern "c" fn poll(fds: *Pollfd, nfds: c_ulong, timeout: c_int) c_int;
+        };
+        var pfd = Pollfd{ .fd = self.wake_fd, .events = POLL_IN, .revents = 0 };
+        _ = libc.poll(&pfd, 1, ms);
+    }
+
+    pub fn read(self: *PollRing, user_data: u64, fd: std.posix.fd_t, buffer: anytype, offset: u64) !*Sqe {
+        _ = .{ self, user_data, fd, buffer, offset };
+        return error.AsyncIoUnsupported;
+    }
+    pub fn write(self: *PollRing, user_data: u64, fd: std.posix.fd_t, buffer: []const u8, offset: u64) !*Sqe {
+        _ = .{ self, user_data, fd, buffer, offset };
+        return error.AsyncIoUnsupported;
+    }
+    pub fn recv(self: *PollRing, user_data: u64, fd: std.posix.fd_t, buffer: anytype, flags: u32) !*Sqe {
+        _ = .{ self, user_data, fd, buffer, flags };
+        return error.AsyncIoUnsupported;
+    }
+    pub fn send(self: *PollRing, user_data: u64, fd: std.posix.fd_t, buffer: []const u8, flags: u32) !*Sqe {
+        _ = .{ self, user_data, fd, buffer, flags };
+        return error.AsyncIoUnsupported;
+    }
+    pub fn accept(self: *PollRing, user_data: u64, fd: std.posix.fd_t, addr: ?*anyopaque, addrlen: ?*anyopaque, flags: u32) !*Sqe {
+        _ = .{ self, user_data, fd, addr, addrlen, flags };
+        return error.AsyncIoUnsupported;
+    }
+    pub fn connect(self: *PollRing, user_data: u64, fd: std.posix.fd_t, addr: anytype, addr_len: anytype) !*Sqe {
+        _ = .{ self, user_data, fd, addr, addr_len };
+        return error.AsyncIoUnsupported;
+    }
+};
+
+const Pollfd = extern struct {
+    fd: i32,
+    events: i16,
+    revents: i16,
+};
+
+pub const DefaultRing = if (have_io_uring) std.os.linux.IoUring else PollRing;
diff --git a/zig/runtime/onRoot.S b/zig/runtime/onRoot.S
index aaef2f30d..4514befa9 100644
--- a/zig/runtime/onRoot.S
+++ b/zig/runtime/onRoot.S
@@ -1,3 +1,12 @@
+// Mach-O prefixes C symbols with an underscore and ELF does not, so the
+// global below goes through SYM() and one spelling serves both. Plain `.text`
+// is used rather than `.section .text`, which Mach-O's assembler rejects.
+#if defined(__APPLE__)
+# define SYM(name) _##name
+#else
+# define SYM(name) name
+#endif
+
 #if defined(__x86_64__)
 
 .section .text
@@ -50,38 +59,43 @@ call_on_stack_asm:
 
 #if defined(__aarch64__)
 
-.section .text
-.global call_on_stack_asm
+.text
+.cfi_sections .eh_frame
+.global SYM(call_on_stack_asm)
 .align 2
 
-# x0 = new_stack_ptr, x1 = func_ptr, x2 = arg_ptr
-call_on_stack_asm:
-    # 1. Push FP, LR and the current SP to the Fiber stack
+// x0 = new_stack_ptr, x1 = func_ptr, x2 = arg_ptr
+SYM(call_on_stack_asm):
+    // See switch.S: a frame with no CFI wedges the Mach-O unwinder, which
+    // Zig's DebugAllocator walks on every allocation.
+    .cfi_startproc
+    // 1. Push FP, LR and the current SP to the Fiber stack
     mov x9, sp
-    stp x29, x30, [sp, #-48]!  # Allocate 48 bytes (16-byte aligned)
+    stp x29, x30, [sp, #-48]!  // Allocate 48 bytes (16-byte aligned)
     mov x29, sp
-    str x9, [sp, #16]          # Save Fiber SP
+    str x9, [sp, #16]          // Save Fiber SP
 
-    # 2. Save Floating Point status
+    // 2. Save Floating Point status
     mrs x10, fpcr
     str x10, [sp, #24]
 
-    # 3. Switch to G0
-    and x0, x0, #~0xf          # Ensure 16-byte align
+    // 3. Switch to G0
+    and x0, x0, #~0xf          // Ensure 16-byte align
     mov sp, x0
 
-    # 4. Execute
-    mov x0, x2                 # arg_ptr -> x0
+    // 4. Execute
+    mov x0, x2                 // arg_ptr -> x0
     blr x1
 
-    # 5. Restore
-    mov sp, x29                # Switch back to Fiber stack frame
-    ldr x10, [sp, #24]         # Restore FP Control
+    // 5. Restore
+    mov sp, x29                // Switch back to Fiber stack frame
+    ldr x10, [sp, #24]         // Restore FP Control
     msr fpcr, x10
-    ldr x9, [sp, #16]          # Load Fiber SP
-    ldp x29, x30, [sp], #48    # Pop and Clean up
+    ldr x9, [sp, #16]          // Load Fiber SP
+    ldp x29, x30, [sp], #48    // Pop and Clean up
     mov sp, x9
     ret
+    .cfi_endproc
 
 #endif
 
diff --git a/zig/runtime/scheduler.zig b/zig/runtime/scheduler.zig
index aa40d253b..632ac04d9 100644
--- a/zig/runtime/scheduler.zig
+++ b/zig/runtime/scheduler.zig
@@ -99,8 +99,11 @@ pub fn ensureSignalAltStack() void {
 }
 
 const linux = std.os.linux;
+// Platform selection for the completion ring. On Linux every alias in here IS
+// the std.os.linux type, picked at comptime, so Linux codegen is unchanged.
+const iob = @import("io-backend.zig");
 const posix = std.posix;
-const IoUring = linux.IoUring;
+const IoUring = iob.DefaultRing;
 
 // Comptime io_uring type selection: SimRing in Loom mode, real IoUring otherwise.
 // When the root module exports SimRing (vopr-loom.zig), all io_uring submissions
@@ -155,7 +158,10 @@ pub const SmartEventFd = struct {
     const WakeParked: u32 = 1;
     const WakeNotified: u32 = 2;
 
-    fd: i32,
+    // One fd on Linux (the eventfd is both ends); two on platforms without
+    // eventfd, where the wake channel is a pipe.
+    read_fd: i32,
+    write_fd: i32,
 
     // Parker state for cross-scheduler wake coalescing:
     //   Empty    -- scheduler is awake or no wake token is pending
@@ -171,13 +177,13 @@ pub const SmartEventFd = struct {
     pub fn init() !SmartEventFd {
         // EFD_SEMAPHORE: Reads decrement counter by 1.
         // We use this so we can consume exactly one wake-up if needed.
-        const flags = std.os.linux.EFD.CLOEXEC | std.os.linux.EFD.NONBLOCK | std.os.linux.EFD.SEMAPHORE;
-        const fd = try compat.eventFd(0, flags);
-        return SmartEventFd{ .fd = fd };
+        const wake = try iob.WakeFd.open();
+        return SmartEventFd{ .read_fd = wake.read_fd, .write_fd = wake.write_fd };
     }
 
     pub fn deinit(self: *SmartEventFd) void {
-        compat.closeFd(self.fd);
+        var wake = iob.WakeFd{ .read_fd = self.read_fd, .write_fd = self.write_fd };
+        wake.close();
     }
 
     /// Record a wake token. Returns true only when the target scheduler
@@ -198,7 +204,7 @@ pub const SmartEventFd = struct {
     fn writeWake(self: *SmartEventFd) void {
         const val: u64 = 1;
         const bytes = std.mem.asBytes(&val);
-        _ = std.c.write(self.fd, bytes.ptr, bytes.len);
+        _ = std.c.write(self.write_fd, bytes.ptr, bytes.len);
     }
 
     /// Cold-path wake used by shutdown/watchdog code. This deliberately
@@ -214,7 +220,7 @@ pub const SmartEventFd = struct {
         var val: u64 = 0;
         const buf = std.mem.asBytes(&val);
         // Drain the eventfd buffer
-        _ = std.posix.read(self.fd, buf) catch {};
+        _ = std.posix.read(self.read_fd, buf) catch {};
     }
 
     /// Prepare to block in io_uring. Returns false when a producer already
@@ -339,7 +345,7 @@ pub const Scheduler = struct {
     // I/O, and eventfd wakeups. In Loom mode, this is SimRing.
     ring: RingType,
     ring_dirty: bool = false,
-    uring_cqes: [128]linux.io_uring_cqe = undefined,
+    uring_cqes: [128]iob.Cqe = undefined,
     // Dedicated stack for non-yielding io_uring calls made from run().
     // This keeps helper frames off the scheduler's suspended switch slot.
     io_helper_stack: []u8,
@@ -427,9 +433,9 @@ pub const Scheduler = struct {
         // Multishot means each eventfd write produces a new CQE without
         // re-submitting. user_data = EVENTFD_SENTINEL (0).
         if (RingType != @import("vopr-ring.zig").SimRing) {
-            const sqe = try ring.poll_add(EVENTFD_SENTINEL, efd.fd, linux.POLL.IN);
+            const sqe = try ring.poll_add(EVENTFD_SENTINEL, efd.read_fd, @intCast(iob.POLL_IN));
             // Set POLL_ADD_MULTI so this poll persists across multiple fires.
-            sqe.len = linux.IORING_POLL_ADD_MULTI;
+            sqe.len = iob.POLL_ADD_MULTI;
             _ = try ring.submit();
         }
 
@@ -1383,7 +1389,7 @@ pub const Scheduler = struct {
             }
 
             if (timeout_ns > 0) {
-                const ts = linux.kernel_timespec{
+                const ts = iob.KernelTimespec{
                     .sec = @intCast(timeout_ns / 1_000_000_000),
                     .nsec = @intCast(timeout_ns % 1_000_000_000),
                 };
@@ -2167,10 +2173,10 @@ pub const Scheduler = struct {
         return earliest;
     }
 
-    fn queueTimeoutOnIoStack(self: *Scheduler, ts: *const linux.kernel_timespec) void {
+    fn queueTimeoutOnIoStack(self: *Scheduler, ts: *const iob.KernelTimespec) void {
         const Ctx = struct {
             self: *Scheduler,
-            ts: *const linux.kernel_timespec,
+            ts: *const iob.KernelTimespec,
             fn run(raw: ?*anyopaque) callconv(.c) void {
                 const ctx: *@This() = @ptrCast(@alignCast(raw.?));
                 _ = ctx.self.ring.timeout(TIMEOUT_SENTINEL, ctx.ts, 0, 0) catch {};
@@ -2215,7 +2221,7 @@ pub const Scheduler = struct {
     /// - File I/O completions (READ/WRITE) -> write result to IoWaiter, wake task
     /// - Eventfd wakeup (sentinel 0) -> consume eventfd
     /// - Timeout (sentinel 1) -> ignore
-    pub fn processCqes(self: *Scheduler, cqes: []const linux.io_uring_cqe) void {
+    pub fn processCqes(self: *Scheduler, cqes: []const iob.Cqe) void {
         for (cqes) |cqe| {
             const ud = cqe.user_data;
             if (ud == EVENTFD_SENTINEL) {
diff --git a/zig/runtime/switch.S b/zig/runtime/switch.S
index 58e3fe1f8..89d7b6f94 100644
--- a/zig/runtime/switch.S
+++ b/zig/runtime/switch.S
@@ -1,4 +1,14 @@
-# switch.s
+// switch.s
+
+// Mach-O prefixes C symbols with an underscore and ELF does not, so every
+// global that Zig links against goes through SYM() and one spelling serves
+// both. Plain `.text` is used rather than `.section .text`, which Mach-O's
+// assembler rejects.
+#if defined(__APPLE__)
+# define SYM(name) _##name
+#else
+# define SYM(name) name
+#endif
 
 .data
 .global breadcrumb_counter
@@ -6,7 +16,7 @@
 .global abi_error_code
 abi_error_code: .quad 0
 breadcrumb_counter: .quad 0
-breadcrumbs: .space 512  # 64 breadcrumbs
+breadcrumbs: .space 512  // 64 breadcrumbs
 
 .data
 .balign 8
@@ -23,7 +33,7 @@ test_saved_rsp: .quad 0
 .global entry_r15
 .global fake_stack
 
-fake_stack: .space 2048  # 2KB fake stack
+fake_stack: .space 2048  // 2KB fake stack
 entry_rsp: .quad 0
 entry_rbx: .quad 0
 entry_rbp: .quad 0
@@ -32,6 +42,7 @@ entry_r13: .quad 0
 entry_r14: .quad 0
 entry_r15: .quad 0
 
+#if defined(__ELF__)
 .weak test_stack_limit
 .weak test_parent_ctx
 .weak capture_pivot
@@ -40,8 +51,11 @@ test_stack_limit: .quad 0
 test_paretn_ctx: .space 0
 capture_pivot: .space 0
 capture_restore: .space 0
+#endif
 
 
+#if defined(__x86_64__)
+
 .text
 .cfi_sections .eh_frame
 
@@ -198,6 +212,8 @@ abi_panic:
 
 
 
+#endif  // __x86_64__ (macros, breadcrumbs, abi_panic)
+
 # Check for x86_64 (Linux/Intel)
 #if defined(__x86_64__)
 
@@ -232,32 +248,50 @@ switch_context_asm:
 # Check for ARM64 (Apple Silicon/Linux ARM)
 #if defined(__aarch64__)
 
-.section .text
-.global switch_context_asm
+.text
+.cfi_sections .eh_frame
+.global SYM(switch_context_asm)
 .align 2
 
-switch_context_asm:
-    # x0 = from, x1 = to
+SYM(switch_context_asm):
+    // Unwind info is NOT optional here. Zig's DebugAllocator captures a stack
+    // trace on every allocation, and a frame with no CFI sends the Mach-O
+    // unwinder off a cliff: it segfaults, the segfault handler re-enters the
+    // unwinder, and the process wedges at 0% CPU forever. The x86-64 bodies
+    // above have carried .cfi_startproc since the beginning; these did not,
+    // because they had never been assembled.
+    .cfi_startproc
+    // x0 = from, x1 = to. Offsets follow fiber-core.zig's aarch64 Context
+    // EXACTLY: sp 0x00, then x19..x28 packed from 0x08, fp 0x58, lr 0x60.
+    //
+    // x29/x30 must be saved and restored. On aarch64 `ret` branches to x30,
+    // where x86's `ret` pops the return address off the stack -- so a switch
+    // that leaves x30 alone returns to whatever the previous frame left there.
     mov x9, sp
     str x9, [x0, #0x00]
-    stp x19, x20, [x0, #0x10]
-    stp x21, x22, [x0, #0x20]
-    stp x23, x24, [x0, #0x30]
-    stp x25, x26, [x0, #0x40]
-    stp x27, x28, [x0, #0x50]
-
-    ldp x27, x28, [x1, #0x50]
-    ldp x25, x26, [x1, #0x40]
-    ldp x23, x24, [x1, #0x30]
-    ldp x21, x22, [x1, #0x20]
-    ldp x19, x20, [x1, #0x10]
+    stp x19, x20, [x0, #0x08]
+    stp x21, x22, [x0, #0x18]
+    stp x23, x24, [x0, #0x28]
+    stp x25, x26, [x0, #0x38]
+    stp x27, x28, [x0, #0x48]
+    stp x29, x30, [x0, #0x58]
+
+    ldp x29, x30, [x1, #0x58]
+    ldp x27, x28, [x1, #0x48]
+    ldp x25, x26, [x1, #0x38]
+    ldp x23, x24, [x1, #0x28]
+    ldp x21, x22, [x1, #0x18]
+    ldp x19, x20, [x1, #0x08]
     ldr x9, [x1, #0x00]
     mov sp, x9
     ret
+    .cfi_endproc
 
 #endif
 
 
+#if defined(__x86_64__)
+
 .weak __zig_stack_overflow_handler
 __zig_stack_overflow_handler:
     ret # no-op
@@ -603,3 +637,4 @@ run_stack_stitch_harness:
     ret
     .cfi_endproc
 
+#endif  // __x86_64__ (morestack/lessstack and the asm test harness)