@@ -0,0 +1,31 @@
+---
+kind: fixed
+title: A reading beside the work is waited on, not guessed at, and a held memory line is not lost
+pr: 952
+surface: [chat, engine]
+invalidates:
+  - "A HELD MEMORY LINE IS NO LONGER SAID INTO THE DARK. `Agent.refreshMemory` took the lines the post-turn pass had no stream for off the queue and said them onto the hub the reading had been HANDED when it started (`memoryNotice(hub, line)`). A recall rides beside the turn and is never joined, so on a busy machine it runs after that turn has ended — measured on this package's own suite beside another one, where every losing run logged `ctxErr=context canceled hubClosed=true` — and the line was taken, said to a closed stream, and never said again. Every memory line now goes through `Agent.sayMemory`, which asks the hub to say it and HOLDS IT WHEN THE HUB COULD NOT: `eventHub.send` reports whether the event landed, so a line that met a closed stream, or no stream at all, is queued for the next turn by the same door. The correctness of that no longer rests on any ordering between this door and the roads that end turns — the hub answers from under its own lock, which is the only place the answer is not already stale."
+  - "`memoryNotice` IS GONE, AND SO ARE THE CAPTURED HUBS. `Agent.routedMemory` and `Agent.runMemoryCommand` take `say func(string)` where they took `hub *eventHub`, and nil says nothing — which is a task node's reading borrowing its parent's store, exactly as silent as it was. `Agent.refreshMemory(ctx, cue)`, `Agent.importMemoryFile()` and `Agent.startRecallLocked(ctx, cue)` no longer take a hub at all; nothing in the memory pass holds one."
+  - "`eventHub.send` REPORTS WHETHER THE EVENT LANDED (`send(Event) (landed bool)`, agent.go). It answered nothing before, so a caller holding something a person is owed had to trust an ordering to know whether to keep it; only the hub's own lock can answer, since a hub reads open until the moment it closes under it. Every other caller is drawing a line that belongs to the turn it is in and correctly ignores the answer. `TestALineSaidOntoAClosedStreamIsHeldInstead` pins the property with the pointer deliberately left on a closed hub."
+  - "A READING'S LANDING IS A FACT A TEST CAN WAIT ON. `readBeside` (sidecar.go) tells a `besideWatch` carried on the work's context when each reading under it STARTS and when it has LANDED, the second after the settle closes, so whoever the watch lets go of finds the answer there to take. `besideWatch.quiet(ctx)` waits until none is in flight OR until the work those readings belong to is over — bounded by that fact and not by a clock, because `sidecar.end` cancels a reading's window without joining it. It is `desk.settled`'s bargain for the other half of that file: THE RUNNING PRODUCT CARRIES NO WATCH AND NEVER WAITS ON ONE, and `TestTheRunningProductNeverWaitsOnAReadingsLanding` reads the tree with `go/ast` — so it is on the laws gate — and fails the build on either of the two ways the product would reach for one."
+  - "THREE FIXTURES NO LONGER GUESS AT THE SCHEDULER. A scripted conversation answers in no time and never blocks, so a reading the turn has just started can sit unscheduled behind it for as many rounds as the machine is busy: in every failing run the mark's drawing was still pending at all eight remaining boundaries, the script ended in words, and `markAside.takeAtTheEnd` journalled a drawing nobody could spend. A fixture that opts in with `watchReadings(t, agent)` answers the conversation only once every reading beside its turn has landed (`answerWhenQuiet`, applied by `scriptedCompleter`, `routeCompleter` and `reflexScript` to the request that carries the belt), which is the order a real turn usually has: a real model spends seconds on a step, the readings beside it are small, and a drawing that splits cuts the step it lands in. `racingAgent`, `stewardCheckpointAgent` and the three route tests that held their first answer take it."
+  - "`routeCompleter.holdUntilRaced`, `awaitRace` AND `stopHolding` ARE DELETED. Holding the conversation until the pre-turn calls had been ENTERED — in a loop that slept a millisecond at a time — said nothing about the verdict having been parsed and settled, which is what the boundary after the first word kept failing to find. Nothing sets a hold count now; the watch is the whole of it."
+  - "A SCRIPTED ARM ORDERS ITSELF BY A SIGNAL, INCLUDING ITS FIRST TOKEN. `lanestub.Profile.FirstTokenUntil` holds a lane's first word until a channel closes, after it has waited out its TTFT as scripted — `StallUntil`'s stated rule for the one wait `StallUntil` cannot hold, since that one only takes hold after `StallAfter` deltas. It holds the whole reply on the unstreamed path, where the first token and the last arrive together. `TestARescueTheCallCouldNotPayForSaysSoOnTheRow` needed it: lane A was scripted at sixty milliseconds against a ceiling of fifty, and a starved timer spent that ten-millisecond margin, so the first token arrived before the controller acted and the row said nothing had been done at all (`action = \"\"`, once in three hundred runs of #924's own head under twelve busy cores). It now holds A's first word on `theControllersWord`, which closes on any rung of the waiting ladder — the report of either half, a rescue, a model switch — so a regression that acts differently fails on its assertion rather than hanging."
+  - "`docs/rules/ci.md` SAYS WHAT TO DO WITH A TEST THAT FAILS ONLY BESIDE ANOTHER SUITE — reproduce it under load, wait on the fact through the door that owns it, and never `t.Skip`, a retry or a wider bound. It is on that page because the known-red ledger's rules are, and because nothing may be added to that ledger."
+---
+
+Five tests were green alone and red beside another suite, a different one each
+run, none of them on the ledger. One was the product's: a memory line a person
+is owed could be taken off its queue by a reading that had outlived its turn and
+said to a stream that had already closed. The other four were tests that
+measured the scheduler and called it the road — a count of the calls a fixture
+had answered, a script long enough on a quiet machine, ten milliseconds of wall
+clock between a ceiling and a first token. What replaces all three guesses is a
+wait on the fact itself.
+
+Still true and not fixed here: a drawing that splits can miss the boundary its
+own cut opened, because `act` runs before the settle by #871's ruling and a loop
+that reaches `take` in that window finds the reading pending — it pays another
+generation for the drawing, or drops it when that generation is the turn's last.
+The same gap is there when the drawing lands between a boundary and the next
+request, where `Agent.cutGeneration` finds nothing in flight to cut.
@@ -157,6 +157,34 @@ run on 2026-08-31; #408 took the first five out. What it holds now, and which
 entries are Linux-only, is written in the file's own comments and nowhere else —
 `CLAUDE.md` no longer copies it, and neither does this page.
 
+## A test that fails only beside another suite
+
+It is a bug report, and it never goes on the ledger above. Reproduce it under
+load — a focused `-count=50` at `GOMAXPROCS=2` with a few `yes > /dev/null`
+beside it, **on Spark and never on the laptop**, since the point is to starve
+the machine — and fix the CAUSE, which is almost always that the test measured
+the SCHEDULER and called it the road:
+
+- **Wait on the fact, never on a figure.** A fixed number of scripted rounds, a
+  margin between two wall-clock numbers, slack "to one short of the next mark" —
+  each of those is green on a quiet machine and red beside another suite, and
+  widening one is not a fix.
+- **A reading beside the work is waited on through the door that owns it.** A
+  scripted conversation answers in no time and never blocks, so a reading the
+  turn has just started may not have been scheduled at all; `internal/session`'s
+  `besideWatch` (sidecar.go) is told by `readBeside` itself when each reading
+  under a turn's context starts and lands, and a fixture that opts in
+  (`watchReadings`) answers only once none is in flight. The product carries no
+  watch, and a law test fails the build if it ever does.
+- **A scripted arm orders itself by a signal.** `internal/lane/lanestub`'s
+  `StallUntil` holds a stalled answer on a channel and `FirstTokenUntil` holds
+  the first word the same way, both after the scripted wait is spent — so a
+  primary that must answer *after* the caller has acted says exactly that,
+  rather than being scripted a few milliseconds past a bound a busy machine
+  eats.
+- **Never `t.Skip`, never a retry, never a wider timeout.** A bound is for
+  failing honestly when the fact never arrives, not for passing.
+
 ## What blocks a merge
 
 Required today: **`check`** on `dev`, **`cross build`** on `staging` and `main`.
 
@@ -117,6 +117,23 @@ type Profile struct {
 	// Held on a channel the test never closes in time, the primary CANNOT
 	// finish first, and the assertion is about the rule again.
 	StallUntil <-chan struct{}
+	// FirstTokenUntil is THE SAME RULE FOR THE FIRST TOKEN, which StallUntil
+	// cannot hold: it only takes hold after StallAfter deltas, so a lane whose
+	// very first word must land after something else happens has no way to say
+	// so. With this set, the lane waits out its TTFT as scripted and then waits
+	// for the channel to close as well — the arm answers no sooner than both.
+	//
+	// A primary scripted to answer "a little after" a bound the caller enforces
+	// is the shape this is for. Sixty milliseconds against a ceiling of fifty
+	// rests on ten milliseconds of wall clock, which a starved machine eats:
+	// the caller's timer fires late, the first token arrives first, and the test
+	// asserts the slack between two figures instead of the rule it was written
+	// for. Held on a signal the caller itself raises, the order cannot invert.
+	//
+	// It holds the whole answer on the unstreamed path, where the first token
+	// and the last arrive together — a knob that silently did nothing on one of
+	// the two shapes would be a fixture lying about what it staged.
+	FirstTokenUntil <-chan struct{}
 	// FailWith is an HTTP status this lane answers with instead of streaming.
 	// Zero serves normally.
 	FailWith int
@@ -1198,6 +1215,10 @@ func (s *Server) serveStream(w http.ResponseWriter, r *http.Request, clock Clock
 		s.cancelled(lane.Name)
 		return
 	}
+	if !lane.heldWord(ctx) {
+		s.cancelled(lane.Name)
+		return
+	}
 
 	total := lane.Tokens
 	if total <= 0 {
@@ -1384,6 +1405,10 @@ func (s *Server) serveWhole(w http.ResponseWriter, r *http.Request, clock Clock,
 		s.cancelled(lane.Name)
 		return
 	}
+	if !lane.heldWord(r.Context()) {
+		s.cancelled(lane.Name)
+		return
+	}
 	var answer strings.Builder
 	if lane.Answer != "" {
 		answer.WriteString(lane.Answer)
@@ -1413,6 +1438,22 @@ func (s *Server) serveWhole(w http.ResponseWriter, r *http.Request, clock Clock,
 	})
 }
 
+// heldWord waits for the signal [Profile.FirstTokenUntil] names, and reports
+// whether the lane may now speak: false is a client that went away while the
+// lane was still holding its first word, which is counted like any other
+// cancellation.
+func (lane Lane) heldWord(ctx context.Context) bool {
+	if lane.FirstTokenUntil == nil {
+		return true
+	}
+	select {
+	case <-lane.FirstTokenUntil:
+		return true
+	case <-ctx.Done():
+		return false
+	}
+}
+
 // cancelled records a client that walked away. It is counted per lane because
 // the question a hedge test asks is not "was anything cancelled" but "was the
 // LOSER cancelled", and on about twenty lanes that is what stops the bill.
 
@@ -397,6 +397,51 @@ func TestAScriptedMinuteCostsNoWallTime(t *testing.T) {
 	}
 }
 
+// TestALaneHoldsItsFirstWordForASignal is [Profile.FirstTokenUntil], and what
+// it asserts is an ORDER rather than an interval: the answer cannot arrive
+// while the signal is open, however fast the machine running it is. The scripted
+// five seconds are spent on the fast clock before the hold is even reached, so
+// what keeps the stream from finishing is the channel and nothing else.
+func TestALaneHoldsItsFirstWordForASignal(t *testing.T) {
+	hold := make(chan struct{})
+	server := New(model, Lane{Name: "Held", Profile: Profile{
+		TTFT: 5 * time.Second, Rate: 1000, Tokens: 4, FirstTokenUntil: hold,
+	}})
+	defer server.Close()
+	clock := NewFast(time.Date(2026, 9, 11, 12, 0, 0, 0, time.UTC))
+	server.SetClock(clock)
+
+	done := make(chan []string, 1)
+	go func() {
+		done <- ask(t, context.Background(), server, `{"model":"`+model+`","stream":true,"messages":[]}`)
+	}()
+	deadline := time.Now().Add(5 * time.Second)
+	for server.Requests("Held") == 0 && time.Now().Before(deadline) {
+		time.Sleep(time.Millisecond)
+	}
+	if server.Requests("Held") == 0 {
+		t.Fatal("the request never reached the lane")
+	}
+
+	select {
+	case <-done:
+		t.Fatal("the stream finished while its first word was still held")
+	case <-time.After(50 * time.Millisecond):
+	}
+	close(hold)
+
+	lines := <-done
+	if lines[len(lines)-1] != "data: [DONE]" {
+		t.Fatalf("the released stream did not finish: %d lines", len(lines))
+	}
+	// A HOLD SPENDS NO SCRIPTED TIME: the ledger is still the sum of the
+	// durations the script named, so a scenario's own arithmetic is untouched
+	// by how long the signal took to arrive.
+	if clock.Elapsed() > 6*time.Second {
+		t.Fatalf("the hold spent %s of scripted time", clock.Elapsed()-5*time.Second)
+	}
+}
+
 // TestALaneMayRefuse stages the failure the endpoint ladder reads.
 func TestALaneMayRefuse(t *testing.T) {
 	server := New(model, Lane{Name: "Busy", Profile: Profile{FailWith: http.StatusTooManyRequests}})
 
@@ -14,10 +14,19 @@ import (
 // `budget`, which named a rolling process-wide allowance and therefore said
 // "some other request spent this one's rescue"; [planCannotPay] names the only
 // rail there is.
+//
+// A ANSWERS AFTER THE CONTROLLER HAS SPOKEN, by the order of events. Scripted at
+// sixty milliseconds against a ceiling of fifty, the claim rested on ten
+// milliseconds of wall clock: a loaded machine spends that before the ceiling's
+// timer fires, the first token arrives first, and the row then says nothing was
+// done at all — `action = ""`, measured one run in three hundred on this
+// commit's own parent under twelve busy cores. So the primary holds its first
+// word on the controller's own word ([theControllersWord]).
 func TestARescueTheCallCouldNotPayForSaysSoOnTheRow(t *testing.T) {
 	read := loggingTo(t)
+	spoken := theControllersWord(t)
 	rig := newLaneRig(t, "row/budget-refusal",
-		lanestub.Lane{Name: "A", Profile: lanestub.Profile{TTFT: 60 * time.Millisecond, Rate: 2000, Tokens: 24}},
+		lanestub.Lane{Name: "A", Profile: lanestub.Profile{TTFT: 60 * time.Millisecond, Rate: 2000, Tokens: 24, FirstTokenUntil: spoken}},
 		lanestub.Lane{Name: "B", Profile: lanestub.Profile{TTFT: 5 * time.Millisecond, Rate: 2000, Tokens: 24}},
 	)
 	rig.believes("A", 20, 2000)
 
@@ -192,6 +192,39 @@ func (r *laneRig) patience(_ *testing.T, ceiling time.Duration) {
 	r.ceiling.Store(int64(ceiling))
 }
 
+// theControllersWord is a signal that closes once the waiting controller has
+// spoken: said the wait out loud, reported the pace, or started a rescue. A
+// lane given it as its [lanestub.Profile.FirstTokenUntil] answers no sooner.
+//
+// IT IS THE STUB'S SIGNAL RULE APPLIED TO A FIRST TOKEN, and it exists because
+// a primary scripted to answer a little after the ceiling asserts nothing but
+// the slack between two wall-clock figures, which a starved machine eats: the
+// ceiling's timer fires late, the first token arrives first, and the row says
+// nothing was done at all. Every rung of the ladder releases it, not only the
+// one a given test is about, so a regression that acts differently fails on
+// its assertion rather than hanging here.
+func theControllersWord(t *testing.T) <-chan struct{} {
+	t.Helper()
+	spoken := make(chan struct{})
+	var once sync.Once
+	// The reader that was there is taken FIRST and only then chained, because a
+	// closure that assigns the handler it chains to is a write racing its own
+	// reads: [OnPhase] has installed it by the time the assignment happens, and
+	// a phase posted in that window reads the variable from another goroutine.
+	previous := OnPhase(nil)
+	OnPhase(func(news PhaseNews) {
+		switch news.Phase {
+		case PhaseAllSlow, PhaseBelowPace, PhaseSwitching, PhaseSwitchingModel:
+			once.Do(func() { close(spoken) })
+		}
+		if previous != nil {
+			previous(news)
+		}
+	})
+	t.Cleanup(func() { OnPhase(previous) })
+	return spoken
+}
+
 // rigScale is how much shorter every bound a scenario is judged against is than
 // the one a person is really given.
 //
 
@@ -1597,7 +1597,7 @@ func (a *Agent) startTurnLocked(ctx context.Context, user userMessage, watcher *
 	//
 	// IT IS STARTED UNDER THIS LOCK for the title's reason as well: two Submits
 	// racing to be the first must not each buy a route.
-	a.startRecallLocked(turnCtx, hub, user.text())
+	a.startRecallLocked(turnCtx, user.text())
 	// THEIR NEXT WORDS ARE WHAT CHANGED. A generation Interrupt minted waits
 	// here for the sentence that follows Esc, and that sentence is the one
 	// decision the leftover handlers and this turn's opening share.
@@ -3542,18 +3542,25 @@ func (h *eventHub) adopt(stream *eventStream) {
 // so every subscriber sees the same events in the same order, and a subscriber
 // arriving mid-fan-out lands cleanly before or after this event rather than
 // inside it.
-func (h *eventHub) send(event Event) {
+//
+// IT REPORTS WHETHER THE EVENT LANDED, because a caller holding something a
+// person is owed must be able to keep it rather than trust an ordering. Only
+// this lock can answer that: a hub reads open until the moment it closes under
+// it, so anything a caller checked beforehand is already a guess. Almost every
+// caller is drawing a line that belongs to the turn it is in and correctly
+// ignores the answer; [Agent.sayMemory] is the one that holds a line over.
+func (h *eventHub) send(event Event) (landed bool) {
 	// NOBODY WATCHING IS AN ORDINARY CASE. A completion driven without a turn
 	// around it — a test of the retry loop, a future headless caller — has no
 	// hub, and a line nobody can read is a line worth not drawing rather than a
 	// panic in the middle of a request.
 	if h == nil {
-		return
+		return false
 	}
 	h.mu.Lock()
 	defer h.mu.Unlock()
 	if h.closed {
-		return
+		return false
 	}
 	// The backlog is written BEFORE the fan-out and under the same lock, so what
 	// the next attacher is handed is exactly what the subscribers already have —
@@ -3571,6 +3578,7 @@ func (h *eventHub) send(event Event) {
 	for _, stream := range h.subscribers {
 		stream.send(event)
 	}
+	return true
 }
 
 // foldedLocked settles the accumulated run back into the backlog entry it