docs: refined serving-JIT miscompile data (3 fns, list-prim-after-perform)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plans/HANDOFF-jit-miscompile.md

@@ -62,3 +62,18 @@ Tooling: `(vm-trace "<sx>")`, `(bytecode-inspect "host/blog--edges-block")`,
 `lib/host/serve.sh`: when `SX_SERVING_JIT=1`, `(jit-exclude! "host/*" "dream-*"
 "dr/*")`. Host app + Dream framework run on CEK (they're IO-bound — no perf loss);
 Datalog (`dl-*`/`relations-*`) keeps JITting (the win). Drop this once (A)/(B) land.
+
+## Refined data (100% JIT, no exclude, 2026-06-28)
+
+Host now runs at 100% serving JIT (no jit-exclude). Out of **255 successful JIT
+compiles, only ~3 functions miscompile**, all on a multi-arg LIST PRIMITIVE with
+wrong CALL_PRIM args, all in the durable-read request path, all failing on the
+FIRST list-prim call after a `perform` (kv read):
+- `host/blog--edges-block` → `map: expected (fn list) (CALL_PRIM "map" 2 args)`
+- a fn using `rest` → `rest: 1 list arg`
+- `host/blog-relate-options` → `drop: list and number (CALL_PRIM "drop" 2 args)`
+
+Conformance (epoch eval, no http-listen/perform) is 271/271 under JIT — so it's
+NOT the data-first swap alone; the **serving/perform path** is the trigger.
+Strongly supports the OP_PERFORM-resume stack-misalignment theory: the prim that
+fails is just the first CALL_PRIM after the resume. 252+ other fns JIT clean.