tooling: per-suite conformance filter + live-check.sh; note render-diff to vm-extensions

- conformance.sh [suite] runs ONE suite (filters the SUITES array so result-parser
  indices stay aligned; all MODULES still load). 'conformance.sh sxtp' = 0.3s vs ~8min.
- lib/host/live-check.sh: non-browser live smoke — boot ephemeral host, login, seed a
  post (exercises form-ingest write), print status|content-type|body-head per path,
  assert reads are text/sx + no JSON leak + no 5xx. The counterpart to run-picker-check.sh.
- plans/NOTE-render-diff-for-vm-ext.md: defer host_render_diff (JIT-vs-interpreter
  regression oracle) to the sx-vm-extensions loop — it's their fix's oracle, not a host
  feature; building it from loops/host would fork JIT-engine understanding.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plans/NOTE-render-diff-for-vm-ext.md

@@ -0,0 +1,41 @@
+# NOTE → the `sx-vm-extensions` loop: `host_render_diff` is yours to own
+
+**From:** the host-on-sx loop (`loops/host`). **Date:** 2026-06-30.
+
+## The ask
+
+I proposed a tool, **`host_render_diff`** — render a route **twice**, once through the
+serving JIT and once through the CEK interpreter, and **diff the HTML**. Any divergence IS a
+serving-JIT miscompile, surfaced at build time instead of live. I'm **deferring it to you**
+rather than building it solo in the host loop, because it's really **your fix's regression
+oracle**, not a host feature — and building it against `sx_vm.ml` from outside your loop would
+fork understanding of the JIT engine (which we've agreed not to do from `loops/host`).
+
+## Why it matters (the bug it targets)
+
+The host has been bitten repeatedly by the serving-JIT miscompile you own: `map`/`for-each`
+over a **function-produced list** under the `http-listen` + `cek_run_with_io` serving path
+processes only the first element and **silently returns wrong results** (blank pages, empty
+pickers) with no error logged. Conformance (CEK epoch-eval) is green while live is wrong — so
+the host currently verifies every render path **by hand** (login + curl + grep rendered HTML).
+A render-diff makes that mechanical. See `plans/HANDOFF-jit-miscompile.md` and
+`[[feedback_host_serving_jit_iteration]]`.
+
+## What it would look like
+
+- Input: a route (+ optional seed/auth), rendered once with `SX_SERVING_JIT=1` and once on
+  pure CEK. Output: a normalized-HTML diff; non-empty diff = miscompile.
+- Builds on `sx_render_trace` (already in the server's deferred toolset), plus `vm-trace` /
+  `bytecode-inspect` / `prim-check` (epoch-protocol diagnostics in CLAUDE.md).
+- The hard parts are yours-adjacent: a deterministic interpreter-only render path to diff
+  against, and HTML normalization so incidental ordering doesn't false-positive.
+
+## Host status (context for you)
+
+The host runs CEK-only in serving mode (`serve.sh` does `jit-exclude! "host/*" "dream-*"
+"dr/*"` when `SX_SERVING_JIT=1`); Datalog/relations JIT stays (the win). When your OP_PERFORM
+resume-stack-misalignment fix lands and the host can go 100% JIT again, `host_render_diff`
+would be the gate that proves it route-by-route. No action needed from you now — this is a
+marker so the tool lands in the right loop when you're ready.
+
+— host-on-sx