diff --git a/lib/host/serve.sh b/lib/host/serve.sh
index 55bf96ab..1b3bc0c9 100755
--- a/lib/host/serve.sh
+++ b/lib/host/serve.sh
@@ -99,13 +99,19 @@ EPOCH=1
   for M in "${MODULES[@]}"; do
     echo "(epoch $EPOCH)"; echo "(load \"$M\")"; EPOCH=$((EPOCH+1))
   done
-  # Serving-mode JIT runs at 100% — NO host jit-exclude. The request-path SX (host
-  # app + Dream framework) miscompiles on first call in the http-listen +
-  # cek_run_with_io path (map/rest arg bug → 500, self-heals on retry via CEK
-  # fallback). That's deliberate in DEV: surfacing every miscompile (the
-  # `[jit] … first-call fallback` log lines) exercises the JIT against real traffic
-  # and feeds the bug list to the sx-vm-extensions loop. Do NOT mask it with a
-  # jit-exclude — see plans/HANDOFF-jit-miscompile.md.
+  # Serving-mode JIT: exclude the request-path SX (host app + Dream framework). The
+  # 100%-JIT experiment surfaced the key finding — the kernel miscompile isn't just
+  # 500s, it SILENTLY returns wrong results (the `drop` in host/blog-relate-options
+  # yielded an empty candidate list → broken relate picker, NO error logged). Silent
+  # corruption is worse than a crash, so these run on CEK (they're IO-bound — no perf
+  # loss) while the kernel bug is fixed upstream (sx-vm-extensions, OP_PERFORM resume
+  # — see plans/HANDOFF-jit-miscompile.md). The Datalog/relations JIT (the real win)
+  # stays on. Drop this exclude once the resume bug lands, then go 100% JIT again.
+  if [ "${SX_SERVING_JIT:-}" = "1" ]; then
+    echo "(epoch $EPOCH)"
+    echo "(eval \"(jit-exclude! \\\"host/*\\\" \\\"dream-*\\\" \\\"dr/*\\\")\")"
+    EPOCH=$((EPOCH+1))
+  fi
   # Point the blog at the DURABLE file backend (persists under $SX_PERSIST_DIR),
   # then idempotently seed a welcome post (sx_content = SX element markup, the
   # editor's content model). Re-seeding is a no-op if the slug already exists.