W14: pin S4 soft-error-page cache exclusion (test-only) — section A complete

Pre-fix, a routing-failure page was stored in the HTTP response cache as
200 and served byte-identically to every later visitor until restart
(cold 2s -> warm 0.0005s). dc7aa709 made http_render_page return
(html, is_error) and gated cache insertion on `not is_err`.

Extend scripts/test-protocol-gate.sh with an HTTP-mode case: fresh
sx_server.exe --http on a random port (timeout-bounded, own child killed),
GET the same nonexistent path twice, assert both requests re-render (two
[sx-http] render lines) and the "[cache] ... error page, not cached" gate
line appears. Standalone-worktree caveat (all docs pages render as soft
error pages, so no positive cache control) documented in the script.

5/5 protocol-gate green; 267/0 sx gate pins. All seven section-A test-debt
pins now landed (K18, K20, K09/K11/K39, K49, crit-2, C1/C1b, S4).

Test-only: no semantics edits, no push.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

plans/agent-briefings/sx-gate-loop.md

@@ -54,7 +54,9 @@ Pin each confirmed-and-fixed finding with a minimal repro. Add suites to
       sentinel across two tests; a plain assert would inherit the vacuity)
 - [x] C1/C1b [W3] — command-channel crash guards pinned
       (`scripts/test-protocol-gate.sh`, seed for section E's fuzz suite)
-- [ ] S4 [conformance] — housekeeping repro, pin
+- [x] S4 [hosts] — soft error pages not cached (HTTP-mode pin in
+      `scripts/test-protocol-gate.sh`; NB S4 lives in hosts.md, not
+      conformance — "housekeeping" was a mislabel from F-15's tag)
 
 ### B. Runner/production env unification
 - [ ] Audit runner-only bindings (`values`/`call-with-values` F7/K42, JS
@@ -81,6 +83,16 @@ Pin each confirmed-and-fixed finding with a minimal repro. Add suites to
 
 ## Progress log (newest first)
 
+- 2026-07-04 — **S4 error-page-cache pin (item A.7) — section A COMPLETE**.
+  Extended `scripts/test-protocol-gate.sh` with an HTTP-mode case: fresh
+  `sx_server.exe --http <random-port>` (timeout-bounded, own PID killed at
+  end), GET the same nonexistent path twice, assert BOTH requests re-render
+  (2 `[sx-http]` lines — pre-fix the 2nd was cache-served at 0.0005s) and
+  the `[cache] … error page, not cached` is_err gate line appears. Findings
+  from prototyping: standalone worktree renders ALL docs pages as soft error
+  pages (no content), so a positive "real page IS cached" control is not
+  assertable here — documented in the script; startup takes ~12-15s (poll
+  loop, 40s budget). 5/5 protocol-gate green + 267/0 sx pins. Test-only.
 - 2026-07-04 — **C1/C1b command-channel pins (item A.6)**. These are
   protocol-level, not .sx-suite pins: authored
   `scripts/test-protocol-gate.sh` — each case spawns its OWN timeout-bounded