From 83eaa1239347427c4e75e93328eb19227a564576 Mon Sep 17 00:00:00 2001
From: giles <giles.bradshaw@rose-ash.com>
Date: Sun, 28 Jun 2026 19:31:39 +0000
Subject: [PATCH] =?UTF-8?q?host:=20restore=20host=20jit-exclude=20?=
 =?UTF-8?q?=E2=80=94=20100%=20JIT=20silently=20CORRUPTS=20output?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 100%-JIT experiment surfaced something worse than the 500s: the kernel
miscompile also returns WRONG RESULTS with no error — blank pages (render map
yields empty) and an empty relate picker (drop in relate-options yields []).
Conformance (CEK) passes these, so the code is correct; the JIT silently
produces garbage. Silent corruption is worse than a crash, so the request path
runs on CEK again (IO-bound — no perf loss). Datalog/relations JIT stays on
(/tags 0.16s). Restoring it brought back content + the 17-candidate picker.
Go 100% JIT again once sx-vm-extensions fixes the OP_PERFORM-resume bug.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 lib/host/serve.sh | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/lib/host/serve.sh b/lib/host/serve.sh
index 55bf96ab..1b3bc0c9 100755
--- a/lib/host/serve.sh
+++ b/lib/host/serve.sh
@@ -99,13 +99,19 @@ EPOCH=1
   for M in "${MODULES[@]}"; do
     echo "(epoch $EPOCH)"; echo "(load \"$M\")"; EPOCH=$((EPOCH+1))
   done
-  # Serving-mode JIT runs at 100% — NO host jit-exclude. The request-path SX (host
-  # app + Dream framework) miscompiles on first call in the http-listen +
-  # cek_run_with_io path (map/rest arg bug → 500, self-heals on retry via CEK
-  # fallback). That's deliberate in DEV: surfacing every miscompile (the
-  # `[jit] … first-call fallback` log lines) exercises the JIT against real traffic
-  # and feeds the bug list to the sx-vm-extensions loop. Do NOT mask it with a
-  # jit-exclude — see plans/HANDOFF-jit-miscompile.md.
+  # Serving-mode JIT: exclude the request-path SX (host app + Dream framework). The
+  # 100%-JIT experiment surfaced the key finding — the kernel miscompile isn't just
+  # 500s, it SILENTLY returns wrong results (the `drop` in host/blog-relate-options
+  # yielded an empty candidate list → broken relate picker, NO error logged). Silent
+  # corruption is worse than a crash, so these run on CEK (they're IO-bound — no perf
+  # loss) while the kernel bug is fixed upstream (sx-vm-extensions, OP_PERFORM resume
+  # — see plans/HANDOFF-jit-miscompile.md). The Datalog/relations JIT (the real win)
+  # stays on. Drop this exclude once the resume bug lands, then go 100% JIT again.
+  if [ "${SX_SERVING_JIT:-}" = "1" ]; then
+    echo "(epoch $EPOCH)"
+    echo "(eval \"(jit-exclude! \\\"host/*\\\" \\\"dream-*\\\" \\\"dr/*\\\")\")"
+    EPOCH=$((EPOCH+1))
+  fi
   # Point the blog at the DURABLE file backend (persists under $SX_PERSIST_DIR),
   # then idempotently seed a welcome post (sx_content = SX element markup, the
   # editor's content model). Re-seeding is a no-op if the slug already exists.