diff --git a/.claude/skills/sigsegv/SKILL.md b/.claude/skills/sigsegv/SKILL.md
index d6eb4fdef5..dd04d3488a 100644
--- a/.claude/skills/sigsegv/SKILL.md
+++ b/.claude/skills/sigsegv/SKILL.md
@@ -189,8 +189,10 @@ The ordering traps that produce this shape:
 - **The Orleans silo is itself a hosted service**, so it stops before the mesh drains:
   `silo stops → grains deactivate → every Unload() → only THEN the mesh drains`.
   `IoPoolSiloTeardown` subscribes at `ServiceLifecycleStage.First` ⇒ **stops LAST**, and composes
-  `registry.Disposed` into **one** `.ToTask()` at the `ILifecycleObserver` boundary — the only
-  sanctioned place a Task appears.
+  `registry.Disposed` into **one** `ReactiveCompletion.ObserveCompletion(reportLateFault, ct)` at
+  the `ILifecycleObserver` boundary — the only sanctioned place a Task appears, and never Rx's
+  `.ToTask()` (forbidden repo-wide, 2026-08-30): that bridge resumes its caller INLINE on the
+  signalling thread — here, the very lifecycle thread the unload is waiting on.
 - **A blocking `Dispose()` is not the fix.** Making `IoPool.Dispose()` join first *hangs* — `using
   var pool = …` in an async method runs Dispose on a ThreadPool thread and blocks it for the whole
   `DrainTimeout`. An 18-core dev box hides it completely. The shape that works:
diff --git a/src/MeshWeaver.Documentation/Data/Architecture/AccessContextPropagation.md b/src/MeshWeaver.Documentation/Data/Architecture/AccessContextPropagation.md
index d380d2bba8..4b0eda128d 100644
--- a/src/MeshWeaver.Documentation/Data/Architecture/AccessContextPropagation.md
+++ b/src/MeshWeaver.Documentation/Data/Architecture/AccessContextPropagation.md
@@ -456,9 +456,14 @@ public async Task MeshNodeCache_Identity_CannotWrite()
 {
     using (accessService.SwitchAccessContext(new AccessContext { ObjectId = "cache/mesh-node-cache" }))
     {
-        var act = () => meshService.CreateNode(someNode).ToTask();
-        await act.Should().ThrowAsync<UnauthorizedAccessException>()
-            .Where(ex => ex.Message.Contains("Access denied"));
+        // 🚨 Materialize, not act.Should().ThrowAsync() over an Rx ToTask bridge:
+        // ToTask is forbidden repo-wide (2026-08-30), and folding OnError into a
+        // value keeps the ORIGINAL exception type assertable. The write is cold, so
+        // the assertion's Subscribe IS the write.
+        var error = await meshService.CreateNode(someNode).Take(1).Materialize()
+            .Should().Match(n => n.Kind == NotificationKind.OnError);
+        error.Exception.Should().BeOfType<UnauthorizedAccessException>();
+        error.Exception!.Message.Should().Contain("Access denied");
     }
 }
 ```
diff --git a/src/MeshWeaver.Documentation/Data/Architecture/AccessControl.md b/src/MeshWeaver.Documentation/Data/Architecture/AccessControl.md
index 86c7647b87..45af915e6b 100644
--- a/src/MeshWeaver.Documentation/Data/Architecture/AccessControl.md
+++ b/src/MeshWeaver.Documentation/Data/Architecture/AccessControl.md
@@ -1050,8 +1050,13 @@ public async Task MeshNodeCacheIdentity_CannotWrite()
 {
     using (accessService.SwitchAccessContext(new AccessContext { ObjectId = "cache/mesh-node-cache" }))
     {
-        var act = () => meshService.CreateNode(someNode).ToTask();
-        await act.Should().ThrowAsync<UnauthorizedAccessException>();
+        // 🚨 Materialize, not act.Should().ThrowAsync() over an Rx ToTask bridge:
+        // ToTask is forbidden repo-wide (2026-08-30), and folding OnError into a
+        // value keeps the ORIGINAL exception type assertable. The write is cold, so
+        // the assertion's Subscribe IS the write.
+        var error = await meshService.CreateNode(someNode).Take(1).Materialize()
+            .Should().Match(n => n.Kind == NotificationKind.OnError);
+        error.Exception.Should().BeOfType<UnauthorizedAccessException>();
     }
 }
 ```
diff --git a/src/MeshWeaver.Documentation/Data/Architecture/ActivityControlPlane.md b/src/MeshWeaver.Documentation/Data/Architecture/ActivityControlPlane.md
index 9c63eb2844..69f3b63f9f 100644
--- a/src/MeshWeaver.Documentation/Data/Architecture/ActivityControlPlane.md
+++ b/src/MeshWeaver.Documentation/Data/Architecture/ActivityControlPlane.md
@@ -465,10 +465,18 @@ The pattern inside scripts (and inside any worker hub doing long-running work):
   await Mesh.GetWorkspace()
       .GetMeshNodeStream("rbuergi/downstream-job")
       .Where(n => (n?.Content as JobContent)?.Status == JobStatus.Succeeded)
-      .Take(1)
-      .ToTask(Ct);                          // ← cancels via Activity Control Plane
+      .FirstAsync()                         // ← not .Take(1): an empty completion must FAULT
+      .ObserveCompletion(                   //   rather than settle silently
+          ex => Log.LogWarning(ex, "downstream watch faulted AFTER the wait settled"),
+          Ct);                              // ← cancels via Activity Control Plane
   ```
 
+  🚨 `ObserveCompletion` (`MeshWeaver.Messaging`, imported by default in scripts), never
+  `.ToTask(Ct)` — forbidden repo-wide as of 2026-08-30 — and never a bare `await someObservable`
+  either. Rx's bridge and Rx's own awaiter both resume the rest of the script INLINE on the mesh
+  thread that signalled; `ObserveCompletion` completes with `RunContinuationsAsynchronously`, so the
+  hub thread is released the moment it signals.
+
 - For compute-heavy steps with no natural log lines, an `Observable.Interval` heartbeat keeps the user informed:
 
   ```csharp
@@ -548,16 +556,24 @@ var md       = (src?.Content as MarkdownContent)?.Content ?? "";
 Log.LogInformation("Resolving branding");
 var branding = await Mesh.GetWorkspace()
     .GetMeshNodeStream(inputs.BrandNodePath)
-    .Where(n => n is not null).Take(1)
+    .Where(n => n is not null)
     .Select(n => (n!.Content as CorporateIdentity).ToOptions())
-    .ToTask(Ct);   // top-level await is OK in a kernel Script
+    .FirstAsync()
+    // A top-level await is fine in a kernel Script; the BRIDGE is what is constrained —
+    // ObserveCompletion, never Rx's ToTask and never a bare `await someObservable`.
+    .ObserveCompletion(
+        ex => Log.LogWarning(ex, "branding read faulted AFTER the wait settled"),
+        Ct);
 
 Log.LogInformation("Rendering");
 var doc   = new DocumentBuilder().Build(src!.Name, [(src.Name, md)], inputs.Options, branding);
 // The PDF renderer composes the document into print HTML and prints it with the headless
 // browser, so it returns a COLD IObservable<byte[]> — the work runs on subscription.
 var bytes = await Mesh.ServiceProvider.GetRequiredService<PdfDocumentRenderer>()
-    .Render(doc).FirstAsync().ToTask(Ct);
+    .Render(doc).FirstAsync()
+    .ObserveCompletion(
+        ex => Log.LogWarning(ex, "PDF render faulted AFTER the wait settled"),
+        Ct);
 
 Log.LogInformation("Writing {Bytes} bytes to content collection", bytes.Length);
 var outputPath = $"{inputs.TargetCollection}/{Sanitize(src.Name)}.pdf";
diff --git a/src/MeshWeaver.Documentation/Data/Architecture/ActorModel.md b/src/MeshWeaver.Documentation/Data/Architecture/ActorModel.md
index fdac2a44e1..61dd820963 100644
--- a/src/MeshWeaver.Documentation/Data/Architecture/ActorModel.md
+++ b/src/MeshWeaver.Documentation/Data/Architecture/ActorModel.md
@@ -143,7 +143,7 @@ This is not a timing edge case — it is a structural certainty whenever a handl
 
 ## The Fix: Reactive Streams (the Modern API)
 
-> **The `AwaitResponse` and `RegisterCallback` APIs are gone** — they no longer exist anywhere in `src/`; `hub.Observe(...)` is the only request/response surface. All hub-reachable code must use `IObservable<T>` end-to-end — no `await`, no `Task<T>`, no `TaskCompletionSource`. Tests may use `.FirstAsync().ToTask()` at the boundary; production code never does.
+> **The `AwaitResponse` and `RegisterCallback` APIs are gone** — they no longer exist anywhere in `src/`; `hub.Observe(...)` is the only request/response surface. All hub-reachable code must use `IObservable<T>` end-to-end — no `await`, no `Task<T>`, no `TaskCompletionSource`. **Tests are not exempt either**: `.FirstAsync().ToTask()` is forbidden everywhere as of 2026-08-30 (*"no ToTask ever"*). Tests assert on the observable through `MeshWeaver.Reactive.Assertions` (`await obs.Should().Match(...)`), which owns the wait; a foreign `Task`-shaped signature that genuinely needs the value uses `ReactiveCompletion.ObserveCompletion(reportLateFault, ct)`.
 
 The correct pattern for any write that produces a side effect is `stream.Update(...)`, which returns a cold `IObservable<T>`. Subscribe in the handler; the framework serialises the write through the owning hub's action block without blocking anything.
 
@@ -210,7 +210,7 @@ The response arrives as an observable emission, and the subscriber runs on the *
 | Mutate a node on a different hub | Same API — `GetMeshNodeStream` auto-dispatches cross-hub |
 | Wait for a state change | `GetMeshNodeStream(path).Where(predicate).Take(1).Timeout(...).Subscribe(...)` |
 | Call a different hub and handle the reply | `hub.Observe<TResponse>(request, o => o.WithTarget(addr)).Subscribe(...)` |
-| Test boundary only | `await stream.FirstAsync().ToTask()` is acceptable |
+| Test boundary | `await stream.Should().Match(predicate)` — the assertion owns the wait. **Never** `.FirstAsync().ToTask()`, and never a bare `await stream` |
 
 ---
 
diff --git a/src/MeshWeaver.Documentation/Data/Architecture/AggregatingProviders.md b/src/MeshWeaver.Documentation/Data/Architecture/AggregatingProviders.md
index 09b6c288a6..c15f27fc11 100644
--- a/src/MeshWeaver.Documentation/Data/Architecture/AggregatingProviders.md
+++ b/src/MeshWeaver.Documentation/Data/Architecture/AggregatingProviders.md
@@ -148,16 +148,16 @@ For a request/response consumer (cross-hub `AutocompleteRequest`), take the sett
 
 ### Testing progressive-snapshot providers
 
-Tests may bridge to `await` at the test edge — but bound it, and wait for the *shape* you expect rather than the first emission (the first is the empty seed):
+Tests assert on the stream and let the assertion own the wait — but bound it, and wait for the *shape* you expect rather than the first emission (the first is the empty seed):
 
 ```csharp
 var items = await provider.GetItems("@Sys", null)
-    .Where(snapshot => snapshot.Count > 0)
-    .Timeout(10.Seconds())
-    .FirstAsync()
-    .ToTask(ct);
+    .Should().Within(10.Seconds())
+    .Match(snapshot => snapshot.Count > 0);
 ```
 
+> **🚨 Not `.FirstAsync().ToTask(ct)`.** That bridge is forbidden repo-wide as of 2026-08-30, `test/**` included, and a bare `await observable` is the same defect: both resume the test inline on the mesh thread that emitted. `.Within(t)` is the bound, which is why there is no `Timeout` operator and no `CancellationToken` left in the chain.
+
 ---
 
 ## Reactive snapshot-set providers (node menus, permission-gated panels)
@@ -222,10 +222,8 @@ Because the menu re-emits as permissions enrich, a test must **not** grab the fi
 ```csharp
 var items = await MenuStream(client, nodeAddress, NodeMenuContext)
     .CombineLatest(MenuStream(client, nodeAddress, MeshMenuContext), Merge)
-    .Where(set => set.Select(i => i.Label).ToHashSet().SetEquals(expectedLabels))
-    .Timeout(20.Seconds())
-    .FirstAsync()
-    .ToTask(ct);
+    .Should().Within(20.Seconds())
+    .Match(set => set.Select(i => i.Label).ToHashSet().SetEquals(expectedLabels));
 ```
 
 `SetEquals` waiting catches both *missing* items (role not yet propagated) and *extra* items (wrong gating) — either way the menu never reaches the expected set and the `Timeout` fails the test. See `MenuAccessControlTest`.
@@ -312,4 +310,4 @@ Any new aggregator that gathers items from multiple providers should look like o
 **Both:**
 
 - [ ] Providers are resolved via `hub.ServiceProvider.GetServices<T>()` after `TryAddEnumerable` (or, for menu delegate providers, registered via `AddNodeMenuItems`).
-- [ ] Tests bridge back to `await` via `.Where(predicate).Timeout(...).FirstAsync().ToTask(ct)` — waiting for the expected shape, never the first emission, and never `.ToTask()` on a raw hub-touching observable without a bounding `Timeout`.
+- [ ] Tests wait via `await stream.Should().Within(t).Match(predicate)` — for the expected shape, never the first emission. **No `.ToTask()` anywhere** (forbidden repo-wide, 2026-08-30) and no bare `await observable`; `.Within(t)` is the bound.
diff --git a/src/MeshWeaver.Documentation/Data/Architecture/ControlledIoPooling.md b/src/MeshWeaver.Documentation/Data/Architecture/ControlledIoPooling.md
index d1623e3171..b0f3a088fe 100644
--- a/src/MeshWeaver.Documentation/Data/Architecture/ControlledIoPooling.md
+++ b/src/MeshWeaver.Documentation/Data/Architecture/ControlledIoPooling.md
@@ -483,9 +483,18 @@ await mesh.TeardownAsync(TimeSpan.FromSeconds(15));   // MeshWeaver.Mesh.MeshTea
 var ioPools = mesh.ServiceProvider.GetService<IoPoolRegistry>();        // capture BEFORE Dispose()
 var disposeQueue = mesh.ServiceProvider.GetService<AsyncDisposeQueue>();
 mesh.Dispose();
+// 🚨 ObserveCompletion, never Rx's ToTask bridge (forbidden repo-wide, 2026-08-30) and
+//    never a bare `await disposalCompleted` either: both resume this method INLINE on the
+//    hub's own disposal thread, which then has to run phases 2 and 3 while the mesh is
+//    trying to finish tearing itself down. ObserveCompletion completes with
+//    RunContinuationsAsynchronously, so the disposing thread is released immediately.
+using var phase1Deadline = new CancellationTokenSource(TimeSpan.FromSeconds(15));
 await mesh.DisposalCompleted
     .Catch<Unit, Exception>(_ => Observable.Return(Unit.Default))
-    .FirstOrDefaultAsync().ToTask().WaitAsync(TimeSpan.FromSeconds(15));   // phase 1
+    .FirstOrDefaultAsync()
+    .ObserveCompletion(
+        ex => logger.LogWarning(ex, "disposal faulted AFTER the wait settled"),
+        phase1Deadline.Token);                                             // phase 1
 var leakedIoLeaves = ioPools?.DrainAll() ?? 0;   // phase 2 — cancel + join, NOT a polled wait
 if (disposeQueue is not null)
     await disposeQueue.DrainAsync(TimeSpan.FromSeconds(15));               // phase 3
diff --git a/src/MeshWeaver.Documentation/Data/Architecture/HubDisposalModel.md b/src/MeshWeaver.Documentation/Data/Architecture/HubDisposalModel.md
index 8dab49adaf..d58b2b0f13 100644
--- a/src/MeshWeaver.Documentation/Data/Architecture/HubDisposalModel.md
+++ b/src/MeshWeaver.Documentation/Data/Architecture/HubDisposalModel.md
@@ -113,18 +113,30 @@ awaits. The old `Task? Disposal` property is **gone** — a `Disposal is not nul
 check becomes `IsDisposing`, and an `await hub.Disposal` becomes a subscription.
 
 **At a genuine async edge** — xUnit teardown, `MessageHubGrain.OnDeactivateAsync` —
-where a `Task` is legitimately the calling convention, bridge the observable *once*:
+where a `Task` is legitimately the calling convention, bridge the observable *once*,
+through `ReactiveCompletion.ObserveCompletion`:
 
 ```csharp
 // Grain deactivation / test teardown — the ONLY place a Task appears, at the edge:
 await hub.DisposalCompleted
     .Catch<Unit, Exception>(_ => Observable.Return(Unit.Default))  // fault → "done"
     .FirstOrDefaultAsync()
-    .ToTask(ct);
+    .ObserveCompletion(
+        ex => logger.LogWarning(ex, "disposal faulted AFTER the wait settled"),
+        ct);
 ```
 
-That `.ToTask()` is the framework-lifecycle Task boundary (the same place tests
-`await`). Nowhere inside `src/` hub-reachable code does it appear.
+🚨 **Not `.ToTask(ct)`, and not a bare `await` on the observable either** — both are
+forbidden repo-wide as of 2026-08-30 (*"no ToTask ever"*), and for this signal in
+particular they are the deadlock: Rx completes its `TaskCompletionSource` without
+`RunContinuationsAsynchronously`, so the awaiter resumes INLINE on the thread that
+signalled — the hub's own disposal thread, or the grain's turn scheduler — and the
+rest of the teardown then runs there. `ObserveCompletion` queues the continuation
+instead, and keeps its error arm attached so a fault arriving after the wait settled
+is reported rather than orphaned as an `UnobservedTaskException`.
+
+That `ObserveCompletion` is the framework-lifecycle Task boundary (the same place tests
+`await`). Nowhere inside `src/` hub-reachable code does a Task appear at all.
 
 ---
 
@@ -421,8 +433,9 @@ teardown; silent on a direct `Dispose()`).
   its leaf must run on a mesh-scoped resource (the persistence layer / `IIoPool`) so
   the mesh-level teardown drain can join it.
 - **Need to wait for the hub to finish disposing?** Subscribe to
-  `hub.DisposalCompleted`. Only at the test / grain edge may you bridge it once with
-  `.FirstOrDefaultAsync().ToTask()`. To ask "is it shutting down?", read `IsDisposing`.
+  `hub.DisposalCompleted`. Only at the test / grain edge may you bridge it once, and
+  only with `.FirstOrDefaultAsync().ObserveCompletion(reportLateFault, ct)` — never
+  `.ToTask()`. To ask "is it shutting down?", read `IsDisposing`.
 - **Tempted to `await` something during disposal?** Don't — it deadlocks the action
   block. Express the wait as an `Observable` (`Interval` poll, `Timer`/`Amb` deadline,
   subscribe to a child's `DisposalCompleted`) and post the next phase from its
diff --git a/src/MeshWeaver.Documentation/Data/Architecture/LanguageServices.md b/src/MeshWeaver.Documentation/Data/Architecture/LanguageServices.md
index d2e4332cec..2d7be259af 100644
--- a/src/MeshWeaver.Documentation/Data/Architecture/LanguageServices.md
+++ b/src/MeshWeaver.Documentation/Data/Architecture/LanguageServices.md
@@ -155,7 +155,7 @@ Speculative compiles do **not** cache — every `LspCheckNode` call rebuilds the
 
 > 🚨 **Never `Observable.FromAsync` here — or anywhere in `src/`.** A bare `FromAsync` runs the function's synchronous prologue on the *subscribing* thread and applies no concurrency bound; under a blocking subscriber it deadlocks, because `SubscribeOn` moves only the subscribe, not the `await` continuation. The pool runs the leaf with `ConfigureAwait(false)` behind a gate, which is what makes it safe. See [Controlled I/O Pooling](/Doc/Architecture/ControlledIoPooling).
 
-MCP and agent tool surfaces must return `Task<string>` because their SDK signature demands it — they compose reactively and settle through `ObserveCompletion`, never `.ToTask()` (forbidden everywhere since 2026-08-30). Historically this read `.FirstAsync().ToTask()`, which was the sanctioned exception for external-protocol adapters (see [AsynchronousCalls](/Doc/Architecture/AsynchronousCalls)). No `await` anywhere in hub-reachable code.
+MCP and agent tool surfaces have a `Task<string>` signature that is not ours to change, so they bridge once at that edge — with `.FirstAsync().ObserveCompletion(reportLateFault, ct)`, never `.ToTask()` (forbidden repo-wide as of 2026-08-30) and never a bare `await someObservable`, both of which resume the adapter inline on the mesh thread that answered. Historically this read `.FirstAsync().ToTask()`, which was the sanctioned exception for external-protocol adapters (see [AsynchronousCalls](/Doc/Architecture/AsynchronousCalls)). No `await` anywhere in hub-reachable code.
 
 ## What's Deferred
 
diff --git a/src/MeshWeaver.Documentation/Data/Architecture/NegativeControls.md b/src/MeshWeaver.Documentation/Data/Architecture/NegativeControls.md
index 4fde61c015..4fb9ad7cea 100644
--- a/src/MeshWeaver.Documentation/Data/Architecture/NegativeControls.md
+++ b/src/MeshWeaver.Documentation/Data/Architecture/NegativeControls.md
@@ -101,7 +101,7 @@ The rebuilt suite makes each test single-variable, and demands a leak before bel
 ```csharp
 // ── Control: without the policy the slide MUST reach the listener. ──
 probe.Reset();
-await renderer.Render(WithoutPolicy(html)).FirstAsync().ToTask();
+await renderer.Render(WithoutPolicy(html)).Should().Emit();
 var leaked = probe.Connections;
 leaked.Should().BeGreaterThan(0,
     "the control must demonstrate the vector is real — a slide CAN otherwise make the "
@@ -110,7 +110,7 @@ leaked.Should().BeGreaterThan(0,
 
 // ── Protected: the composed document must reach nothing. ──
 probe.Reset();
-var pdf = await renderer.Render(html).FirstAsync().ToTask();
+var pdf = await renderer.Render(html).Should().Emit();
 probe.Connections.Should().Be(0, "…this is the SSRF surface…");
 ```
 
diff --git a/src/MeshWeaver.Documentation/Data/Architecture/PermissionApi.md b/src/MeshWeaver.Documentation/Data/Architecture/PermissionApi.md
index 0f0985abb6..9ccb06be18 100644
--- a/src/MeshWeaver.Documentation/Data/Architecture/PermissionApi.md
+++ b/src/MeshWeaver.Documentation/Data/Architecture/PermissionApi.md
@@ -23,7 +23,7 @@ IObservable<bool> canTheyEdit = hub.CheckPermission(nodePath, "alice", Permissio
 IObservable<Permission> theirPerms = hub.GetEffectivePermissions(nodePath, "alice");
 ```
 
-All overloads return `IObservable<T>`. Compose them with `CombineLatest`, `Select`, and `Where` as you would any other stream. In tests, bridge to `Task` at the outermost edge with `.FirstAsync().ToTask()`. Never use `await` inside `src/`.
+All overloads return `IObservable<T>`. Compose them with `CombineLatest`, `Select`, and `Where` as you would any other stream. In tests, assert on the stream and let the assertion own the wait — `await hub.GetEffectivePermissions(path).Should().Be(Permission.Read);` — never `.FirstAsync().ToTask()`, which is forbidden in `test/` as well as `src/` (2026-08-30). Never use `await` inside `src/`.
 <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 760 280" style="width:100%;max-width:760px;height:auto;display:block;margin:20px auto;">
   <defs>
     <marker id="perm-arr" markerWidth="8" markerHeight="8" refX="7" refY="3" orient="auto">
diff --git a/src/MeshWeaver.Documentation/Data/Architecture/ReactiveTestAssertions.md b/src/MeshWeaver.Documentation/Data/Architecture/ReactiveTestAssertions.md
index a64cf25b68..ff62f4e919 100644
--- a/src/MeshWeaver.Documentation/Data/Architecture/ReactiveTestAssertions.md
+++ b/src/MeshWeaver.Documentation/Data/Architecture/ReactiveTestAssertions.md
@@ -1,15 +1,17 @@
 ---
 Name: Reactive Test Assertions
 Category: Architecture
-Description: The MeshWeaver.Reactive.Assertions surface — assert on observables directly, awaiting the terminal assertion instead of hand-rolling an Rx→Task bridge. Covers the full API, why the assertion subscribes on the thread pool, error assertions via Materialize, and the equivalency/JSON helpers.
+Description: The MeshWeaver.Reactive.Assertions surface — assert on observables directly, awaiting the terminal assertion instead of hand-rolling an Rx→Task bridge (`.ToTask()` is forbidden everywhere, tests included). Covers the full API, why the assertion subscribes off xUnit's sync context and settles through its own ReactiveWait, error assertions via Materialize, and the equivalency/JSON helpers.
 Icon: <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M22 11.08V12a10 10 0 1 1-5.93-9.14"/><polyline points="22 4 12 14.01 9 11.01"/></svg>
 ---
 
 # Reactive Test Assertions
 
-MeshWeaver is reactive end-to-end: services, handlers, layout areas, and activities return `IObservable<T>` and never `await` (see [Asynchronous Calls](/Doc/Architecture/AsynchronousCalls)). Its tests follow the same principle — **you assert on the stream directly, and the Rx→Task bridge lives inside the assertion instead of in your test body**.
+MeshWeaver is reactive end-to-end: services, handlers, layout areas, and activities return `IObservable<T>` and never `await` (see [Asynchronous Calls](/Doc/Architecture/AsynchronousCalls)). Its tests follow the same principle — **you assert on the stream directly, and the assertion OWNS the wait instead of your test body**.
 
-All test assertions flow through `MeshWeaver.Reactive.Assertions`, an in-house library (it *replaced* FluentAssertions — that package is no longer referenced) wired in via a global `using` and project reference in `test/Directory.Build.props`. The names and chaining patterns (`.And` / `.Which`, trailing `because` args) are familiar. What is different is that the **observable assertions own the wait**: each terminal method returns a `Task` that the test body `await`s, so a test method is `async Task` and contains no hand-rolled `.FirstAsync().ToTask()`, `.Result`, `.Wait()` or `Task.Delay`.
+All test assertions flow through `MeshWeaver.Reactive.Assertions`, an in-house library (it *replaced* FluentAssertions — that package is no longer referenced) wired in via a global `using` and project reference in `test/Directory.Build.props`. The names and chaining patterns (`.And` / `.Which`, trailing `because` args) are familiar. What is different is that the **observable assertions own the wait**: each terminal method returns a `Task` that the test body `await`s, so a test method is `async Task` and contains no `.FirstAsync().ToTask()` — none at all, anywhere — no `.Result`, no `.Wait()` and no `Task.Delay`.
+
+> **🚨 `.ToTask()` is forbidden repo-wide, `test/**` included** (maintainer ruling, 2026-08-30: *"totask is forbidden"*, *"no totask ever"* — the earlier "tests are the one sanctioned place" carve-out is RETRACTED). Rx's bridge completes its `TaskCompletionSource` **without** `TaskCreationOptions.RunContinuationsAsynchronously`, so it resumes the awaiter *inline on the signalling thread, still inside Rx's trampoline*. In a test that thread then carries the rest of the test, its mesh teardown, and — under xUnit — the runner starting the next test class, so the green proves the wrong thing. **`await source.FirstAsync()` is not a lighter alternative**: Rx's own awaiter is an `AsyncSubject<T>` that completes its continuation from inside `OnCompleted`, and measures the same (`INLINE=True` for both spellings; only the queued completion below measures `INLINE=False`). Where an assertion genuinely cannot express the wait, the bridge is `MeshWeaver.Messaging.ReactiveCompletion.ObserveCompletion(reportLateFault, ct)`.
 
 > **🚨 The terminal assertions are `Task`-returning, not blocking.** `Emit()` / `Match()` return `Task<T>`; `Be()` / `Complete()` / `NotEmit()` return `Task<ObservableAssertions<T>>`. **Every one must be `await`ed.** An un-awaited `obs.Should().Emit();` statement compiles without a warning, subscribes, and then lets the test race on — the classic green-but-lying test. `ObservableAssertions.cs` says so in its own doc comment: the wait is *"never a thread-blocking `ManualResetEventSlim` + `Wait`"*.
 
@@ -36,7 +38,7 @@ For the surrounding test-writing rules, see [Writing Tests](/Doc/Architecture/Wr
   <line x1="160" y1="91" x2="208" y2="91" stroke="#43a047" stroke-width="1.5" marker-end="url(#arr-grn)"/>
   <rect x="210" y="72" width="160" height="38" rx="8" fill="#5c6bc0"/>
   <text x="290" y="87" text-anchor="middle" font-family="sans-serif" font-size="11" fill="#fff" font-weight="bold">await .Should().Match(…)</text>
-  <text x="290" y="101" text-anchor="middle" font-family="sans-serif" font-size="10" fill="#fff">SubscribeOn(TaskPool) + ToTask</text>
+  <text x="290" y="101" text-anchor="middle" font-family="sans-serif" font-size="10" fill="#fff">off sync-context + queued resume</text>
   <line x1="370" y1="91" x2="418" y2="91" stroke="#43a047" stroke-width="1.5" marker-end="url(#arr-grn)"/>
   <rect x="420" y="72" width="150" height="38" rx="8" fill="#26a69a"/>
   <text x="495" y="87" text-anchor="middle" font-family="sans-serif" font-size="11" fill="#fff" font-weight="bold">Hub delivers emission</text>
@@ -70,7 +72,7 @@ For the surrounding test-writing rules, see [Writing Tests](/Doc/Architecture/Wr
   <text x="390" y="302" text-anchor="middle" font-family="sans-serif" font-size="10" fill="currentColor" fill-opacity=".5" font-style="italic">maxParallelThreads: 1 — everything serialises behind the held thread</text>
 </svg>
 
-*The assertion `SubscribeOn`s the source onto `TaskPoolScheduler` and bridges with `.ToTask()`, so every mesh round-trip runs on the thread pool and only the awaited result hops back to the test. Blocking that thread yourself (`.Result` / `.Wait()`) funnels those continuations back onto xUnit's single-threaded `MaxConcurrencySyncContext` — measured at 8 s versus 3 ms on `AddressResolutionTest` (2026-06-15). Do not remove the `SubscribeOn`.*
+*The assertion subscribes **synchronously on the calling thread with the ambient `SynchronizationContext` suppressed** (`SubscribeHereOffSyncContext`), so the observer is attached in time to see a hot subject's emission while the mesh's continuations still capture `null` and land on the pool. It then waits through the package's own `ReactiveWait.First` — a `TaskCompletionSource` created with `TaskCreationOptions.RunContinuationsAsynchronously` — **not** `.ToTask()`, so the test's resume is queued instead of running on whichever mesh thread signalled. Blocking that thread yourself (`.Result` / `.Wait()`) funnels those continuations back onto xUnit's single-threaded `MaxConcurrencySyncContext` — measured at 8 s versus 3 ms on `AddressResolutionTest` (2026-06-15). Do not reintroduce `SubscribeOn`, and do not drop the suppression.*
 
 ---
 
@@ -106,11 +108,11 @@ public async Task ObserveQuery_EmitsInitialResults()            // ← async Tas
 
 (That is `ObservableQueryTests.ObserveQuery_EmitsInitialResults` in `test/MeshWeaver.Query.Test` — the role model for this shape.)
 
-`.Emit()` and `.Match()` **return** the matched value, so `var x = await obs.Should().Match(...)` replaces a hand-rolled `var x = await obs.FirstAsync().ToTask()` one-for-one.
+`.Emit()` and `.Match()` **return** the matched value, so `var x = await obs.Should().Match(...)` replaces a hand-rolled `var x = await obs.FirstAsync().ToTask()` one-for-one — and that hand-rolled shape is now a defect wherever it appears, not merely a verbose alternative.
 
-> 🚨 **There is no sanctioned Rx→Task bridge — not even at the test edge** (2026-08-30). The wait goes through `ObservableAwait.Await(ct)` / `ReactiveCompletion.ObserveCompletion`, which queue the continuation instead of resuming it inline on the signalling thread.
+> 🚨 **There is no sanctioned Rx→Task bridge — not even at the test edge** (2026-08-30). Nothing in the assertion path calls `.ToTask()`.
 >
-> **How the wait is composed.** The source is `SubscribeOn`'d onto `TaskPoolScheduler`, filtered, `Take(1)`'d, bounded with `Timeout` (throwing a private sentinel so the assertion's own timeout stays distinguishable from a `TimeoutException` raised by the *source*), and bridged via `.ToTask()`. Nothing blocks a thread. A timed-out assertion reports what the stream actually emitted — "emitted nothing at all" versus "last of N emissions was …" — because those two failures have opposite fixes.
+> **The assertion owns the wait.** The source is subscribed, filtered, `Take(1)`'d, collected with `ToList()` (so an empty completion arrives as data rather than as an exception indistinguishable from a source fault), bounded with `Timeout` (throwing a private sentinel so the assertion's own timeout stays distinguishable from a `TimeoutException` raised by the *source*), and settled through `ReactiveWait` — a `TaskCompletionSource` created with `RunContinuationsAsynchronously`, which is the line that keeps the test's continuation off the signalling thread. **The subscription is disposed when the wait settles**, so a settled assertion stops consuming a stream its siblings still need. Nothing blocks a thread. A timed-out assertion reports what the stream actually emitted — "emitted nothing at all" versus "last of N emissions was …" — because those two failures have opposite fixes.
 
 ---
 
@@ -260,7 +262,7 @@ This exercises the real control plane: the owning hub's watcher reacts to `Reque
 
 The library lives in `src/MeshWeaver.Reactive.Assertions` (`System.Reactive` only) — the observable surface in `ObservableAssertions.cs`, the value surface in `ObjectAssertions.cs` / `CollectionAssertions.cs` / `MoreAssertions.cs`, and the equivalency + JSON helpers in `Equivalency.cs` / `JsonAssertions.cs`.
 
-If a genuinely missing assertion is blocking a test, **add it to the library with a unit test in `test/MeshWeaver.Reactive.Assertions.Test` that exercises both the pass and the fail path** — do not work around it with a hand-rolled `.FirstAsync().ToTask()` in the test body.
+If a genuinely missing assertion is blocking a test, **add it to the library with a unit test in `test/MeshWeaver.Reactive.Assertions.Test` that exercises both the pass and the fail path** — do not work around it with a hand-rolled `.FirstAsync().ToTask()` in the test body. That workaround is not merely discouraged; it is the forbidden shape, and the library's `ReactiveWait.First` exists precisely so no call site ever needs it.
 
 ---
 
diff --git a/src/MeshWeaver.Documentation/Data/Architecture/SatelliteEntityPatterns.md b/src/MeshWeaver.Documentation/Data/Architecture/SatelliteEntityPatterns.md
index 3eb86c58c6..dc08bf3332 100644
--- a/src/MeshWeaver.Documentation/Data/Architecture/SatelliteEntityPatterns.md
+++ b/src/MeshWeaver.Documentation/Data/Architecture/SatelliteEntityPatterns.md
@@ -327,11 +327,13 @@ Subscribe to the node's stream **before** triggering the operation, then reactiv
 //    GetMeshNodeStream(path) is the shared per-path handle; do NOT hand-roll
 //    GetRemoteStream<MeshNode>(address) + FirstOrDefault(n => n.Path == …),
 //    which pulls the whole collection and re-opens its own subscription.
+//    The assertion subscribes SYNCHRONOUSLY on the calling thread, so arming it here
+//    really does attach the observer before step 1 sends the request. It also owns the
+//    wait: no FirstAsync + ToTask bridge, which is forbidden repo-wide (2026-08-30).
 var markersAppeared = workspace.GetMeshNodeStream(docPath)
     .Select(node => (node?.Content as MarkdownContent)?.Content ?? "")
-    .Where(content => content.Contains($"<!--insert:{markerId}"))
-    .FirstAsync()
-    .ToTask(ct);
+    .Should().Within(30.Seconds())
+    .Match(content => content.Contains($"<!--insert:{markerId}"));
 
 // 1) Send the request. In TESTS the sanctioned bridge is the test base's helper;
 //    production code subscribes to hub.Observe(...) instead of awaiting.
diff --git a/src/MeshWeaver.Documentation/Data/Architecture/ScriptExecution.md b/src/MeshWeaver.Documentation/Data/Architecture/ScriptExecution.md
index afc178e05b..e58c73c49d 100644
--- a/src/MeshWeaver.Documentation/Data/Architecture/ScriptExecution.md
+++ b/src/MeshWeaver.Documentation/Data/Architecture/ScriptExecution.md
@@ -197,8 +197,7 @@ The way through is to run the write **inside the mesh**, through the canonical s
 
 ```csharp
 using System.Reactive.Linq;
-using System.Reactive.Threading.Tasks;
-using MeshWeaver.Messaging;                 // AccessService
+using MeshWeaver.Messaging;                 // AccessService, ReactiveCompletion.ObserveCompletion
 using MeshWeaver.Mesh.Services;             // IMeshService
 using Microsoft.Extensions.DependencyInjection;
 using Memex.Portal.Shared.Authentication;   // InvitationService
@@ -214,8 +213,16 @@ foreach (var (email, name) in new[]
     ("grace.hopper@example.com", "Grace Hopper"),
 })
 {
+    // 🚨 ObserveCompletion, never Rx's own observable-to-Task bridge (maintainer,
+    // 2026-08-30: "no ToTask ever") — and never a bare `await …FirstAsync()` either, because
+    // Rx's awaiter resumes the rest of this script INLINE on whichever hub thread signalled.
+    // FirstAsync (not Take(1)): the next line dereferences node.Path, so an empty completion
+    // must keep FAULTING rather than settling with null.
     var node = await svc.CreateInvitation(email, invitedBy: "rbuergi", note: name)
-        .FirstAsync().ToTask(Ct);
+        .FirstAsync()
+        .ObserveCompletion(
+            ex => Log.LogWarning(ex, "CreateInvitation faulted AFTER the wait settled"),
+            Ct);
     Log.LogInformation("Created {Path}", node.Path);
 }
 ```
@@ -241,7 +248,9 @@ Every script receives four globals (`MeshScriptGlobals`, `MeshWeaver.Kernel.Hub`
 
 `Inputs` is what makes "operation as a script" work without a side-channel node: the form or caller patches the inputs onto the request and the script reads them as typed JSON. Values are carried as `JsonElement` so any JSON shape survives serialization across hub boundaries without a type-registry entry per shape.
 
-> **Always pass `Ct` to async calls.** `Task.Delay(ms, Ct)`, `HttpClient.GetAsync(url, Ct)`, `FirstAsync(predicate).ToTask(Ct)` — every cancellable API should receive it. Without `Ct`, clicking Cancel in the Activity Control Plane sends the signal but the script can't act on it until the current await returns.
+> **Always pass `Ct` to async calls.** `Task.Delay(ms, Ct)`, `HttpClient.GetAsync(url, Ct)`, `.FirstAsync(predicate).ObserveCompletion(report, Ct)` — every cancellable API should receive it. Without `Ct`, clicking Cancel in the Activity Control Plane sends the signal but the script can't act on it until the current await returns.
+
+> **🚨 A script body is one of the few places an `await` is legitimate — the bridge it uses is not free choice.** `ObserveCompletion` (in `MeshWeaver.Messaging`, imported by default) is the only sanctioned way to take a value out of an observable here. `.ToTask(...)` is forbidden repo-wide as of the 2026-08-30 ruling (*"no ToTask ever"*), and `await someObservable` / `await source.FirstAsync()` is the same defect wearing a shorter spelling: Rx's awaiter is an `AsyncSubject<T>` that completes its continuation from inside `OnCompleted`, so the remainder of your script runs **on the mesh thread that signalled** — inside the portal, holding a hub's action block. `ObserveCompletion` completes through a `TaskCompletionSource` created with `RunContinuationsAsynchronously`, so the signalling thread is released immediately, and its `reportLateFault` arm stays attached for a fault that lands after the wait settled. Never pass an empty lambda there.
 
 ### Reactive waiting
 
@@ -253,8 +262,12 @@ Log.LogInformation("Waiting for downstream job to finish…");
 await Mesh.GetWorkspace()
     .GetMeshNodeStream("rbuergi/downstream-job")
     .Where(n => (n?.Content as JobContent)?.Status == JobStatus.Succeeded)
-    .Take(1)
-    .ToTask(Ct);                          // ← Ct propagates Cancel
+    .FirstAsync()                         // ← not .Take(1): an empty completion must FAULT,
+                                          //   or ObserveCompletion settles with null and the
+                                          //   script proceeds as though the wait had succeeded
+    .ObserveCompletion(
+        ex => Log.LogWarning(ex, "downstream watch faulted AFTER the wait settled"),
+        Ct);                              // ← Ct cancels the WAIT, so Cancel is honoured
 Log.LogInformation("Downstream finished — proceeding");
 ```
 
diff --git a/src/MeshWeaver.Documentation/Data/Architecture/ScriptExecutionDemo.md b/src/MeshWeaver.Documentation/Data/Architecture/ScriptExecutionDemo.md
index 09962e54fc..df2970efd2 100644
--- a/src/MeshWeaver.Documentation/Data/Architecture/ScriptExecutionDemo.md
+++ b/src/MeshWeaver.Documentation/Data/Architecture/ScriptExecutionDemo.md
@@ -100,8 +100,10 @@ Log.LogInformation("Phase 1: pulling source data…");
 await Mesh.GetWorkspace()
     .GetMeshNodeStream("rbuergi/source-feed")
     .Where(n => (n?.Content as FeedContent)?.Status == FeedStatus.Ready)
-    .Take(1)
-    .ToTask(Ct);                               // ← cancellable
+    .FirstAsync()                              // ← not .Take(1): empty must FAULT
+    .ObserveCompletion(                        // ← never Rx's ToTask: forbidden repo-wide
+        ex => Log.LogWarning(ex, "source-feed watch faulted AFTER the wait settled"),
+        Ct);                                   // ← cancellable
 Log.LogInformation("Phase 2: crunching numbers…");
 await MyOwnWork(Ct);                           // ← your own async step, cancellable
 Log.LogInformation("Phase 3: rendering report…");
diff --git a/src/MeshWeaver.Documentation/Data/Architecture/SendingEmail.md b/src/MeshWeaver.Documentation/Data/Architecture/SendingEmail.md
index ae0297744d..689584ce19 100644
--- a/src/MeshWeaver.Documentation/Data/Architecture/SendingEmail.md
+++ b/src/MeshWeaver.Documentation/Data/Architecture/SendingEmail.md
@@ -74,7 +74,9 @@ public sealed class Inviter(IEmailSender email) { /* email.SendEmail(...).Subscr
 ```
 
 Do **not** `await`/`.ToTask()` it inside hub-reachable code — keep the chain reactive
-(see [Asynchronous Calls](/Doc/Architecture/AsynchronousCalls)). 🚨 Tests do NOT bridge either (2026-08-30): they await the observable through the fixture's `Await(ct)` wrapper — see [Asynchronous Calls](/Doc/Architecture/AsynchronousCalls). The old sentence read `.FirstAsync().ToTask()`.
+(see [Asynchronous Calls](/Doc/Architecture/AsynchronousCalls)). 🚨 **Tests are not an exception**
+(2026-08-30: *"no ToTask ever"*): assert on the observable — `await hub.SendEmail(to, subject, html).Should().Emit();`
+— and let the assertion own the wait. The old sentence read `.FirstAsync().ToTask()`.
 
 ---
 
diff --git a/src/MeshWeaver.Documentation/Data/Architecture/SyncedMeshNodeQueries.md b/src/MeshWeaver.Documentation/Data/Architecture/SyncedMeshNodeQueries.md
index 113a112797..a624aef112 100644
--- a/src/MeshWeaver.Documentation/Data/Architecture/SyncedMeshNodeQueries.md
+++ b/src/MeshWeaver.Documentation/Data/Architecture/SyncedMeshNodeQueries.md
@@ -303,15 +303,20 @@ Subscribing to a synced query registers the result-set paths in the workspace's
 In a UI that renders the list before exposing per-row buttons, the synced subscription is already established by the time the user clicks Revoke and the Update succeeds. **In tests or one-shot scripts that skip the list render**, pre-warm the synced query explicitly:
 
 ```csharp
-// Test setup mirroring UI lifecycle
+// Test setup mirroring UI lifecycle. The assertion owns the wait and subscribes
+// synchronously — the ToTask bridge is forbidden everywhere (2026-08-30), tests included.
 await service.GetTokensForUser(userId)
-    .Where(list => list.Any(t => t.NodePath == newPath))
-    .Take(1)
-    .ToTask(ct);   // synced subscription now registers newPath in the workspace
+    .Should().Within(10.Seconds())
+    .Match(list => list.Any(t => t.NodePath == newPath));
+// the synced subscription has now registered newPath in the workspace
 
 var outcome = await service.RevokeToken(newPath);   // GetMeshNodeStream(newPath).Update resolves correctly
 ```
 
+In a **script** (`.csx`), where the assertion surface is not available, the same pre-warm uses
+`ReactiveCompletion.ObserveCompletion` — `.FirstAsync(...)` so an empty completion still faults, then
+`.ObserveCompletion(ex => Log.LogWarning(ex, "…"), Ct)`.
+
 `MeshNodeStreamHandle.Update` waits up to 30 s for the initial frame and throws a precise `TimeoutException` with the path embedded if it never arrives — but the fast path is to have the synced query active.
 
 ---
@@ -339,10 +344,7 @@ public class FooSyncedQueryTest : MonolithMeshTestBase
         var snapshot = await Workspace.GetQuery(
             "test-id",
             "namespace:Agent nodeType:Agent")
-            .Where(s => s.Any())
-            .Take(1)
-            .Timeout(15.Seconds())
-            .ToTask();
+        .Should().Within(15.Seconds()).Match(s => s.Any());
 
         snapshot.Should().AllSatisfy(n =>
         {
diff --git a/src/MeshWeaver.Documentation/Data/Architecture/WritingTests.md b/src/MeshWeaver.Documentation/Data/Architecture/WritingTests.md
index 7b227d253e..a7eec3b512 100644
--- a/src/MeshWeaver.Documentation/Data/Architecture/WritingTests.md
+++ b/src/MeshWeaver.Documentation/Data/Architecture/WritingTests.md
@@ -7,7 +7,9 @@ Icon: Beaker
 
 # Writing Tests in MeshWeaver
 
-MeshWeaver is reactive end-to-end — and its tests are too. A well-written test method is **`async Task`**, contains **no hand-rolled `.FirstAsync().ToTask()` / `.Result` / `.Wait()` / `Task.Delay`**, and asserts on `IObservable<T>` directly through the `MeshWeaver.Reactive.Assertions` surface. Each terminal assertion (`Emit` / `Match` / `Be` / `Complete` / `NotEmit`) **returns a `Task` you `await`** — the Rx→Task bridge lives *inside* the assertion, never in the test body.
+MeshWeaver is reactive end-to-end — and its tests are too. A well-written test method is **`async Task`**, contains **no `.FirstAsync().ToTask()` / `.Result` / `.Wait()` / `Task.Delay`** — none at all, anywhere — and asserts on `IObservable<T>` directly through the `MeshWeaver.Reactive.Assertions` surface. Each terminal assertion (`Emit` / `Match` / `Be` / `Complete` / `NotEmit`) **returns a `Task` you `await`** — the wait lives *inside* the assertion, never in the test body, and it is **not** Rx's `.ToTask()` bridge: the assertion settles its own `TaskCompletionSource` with `RunContinuationsAsynchronously`, so the test never resumes on the mesh thread that signalled.
+
+> **🚨 `.ToTask()` is forbidden here too** (maintainer ruling, 2026-08-30: *"no totask ever"*; the old "tests are the one sanctioned place" carve-out is RETRACTED). Rx's bridge resumes the awaiter inline on the signalling thread, which in a test is the thread that then runs the rest of the test, its mesh teardown, and — under xUnit — the runner starting the next class. `await source.FirstAsync()` is the same defect in fewer characters: Rx's awaiter is an `AsyncSubject<T>` that completes its continuation from inside `OnCompleted`. Assert through `.Should()`; where an `async Task` signature genuinely must take a value out of a stream, use `MeshWeaver.Messaging.ReactiveCompletion.ObserveCompletion(reportLateFault, ct)`.
 
 > **🚨 `await` the assertion — it is not a blocking call.** `Emit()` and `Match()` return `Task<T>`; `Be()` / `Complete()` / `NotEmit()` return `Task<ObservableAssertions<T>>`. Dropping the `await` on a statement such as `NodeFactory.CreateNode(node).Should().Emit();` compiles with **no warning** and the test races on ahead without ever waiting for the write — the single easiest way to write a green-but-lying test here. (This reverses an earlier design in which the assertions blocked and test bodies were `void`; see `ObservableAssertions.cs`, which is explicit that it is *"never a thread-blocking `ManualResetEventSlim` + `Wait`"*.)
 
@@ -80,7 +82,7 @@ Before writing a test, review the invariants every test must respect:
 ## The Golden Rules
 
 > **Rule 1 — Test bodies are `async Task` and reactive.**
-> Assert on the observable: `await obs.Should().Within(10.Seconds()).Match(x => predicate)`. The assertion subscribes (on the thread pool), waits up to the timeout, and returns the matched emission. No hand-rolled `.FirstAsync().ToTask()`, no `.Result` / `.Wait()`, no `Task.Delay` anywhere in the body.
+> Assert on the observable: `await obs.Should().Within(10.Seconds()).Match(x => predicate)`. The assertion subscribes (off xUnit's sync context, so the mesh's continuations land on the pool), waits up to the timeout, and returns the matched emission. No `.FirstAsync().ToTask()` — the bridge is forbidden outright, not just "hand-rolled" — no `.Result` / `.Wait()`, no bare `await someObservable`, no `Task.Delay` anywhere in the body.
 
 > **Rule 2 — Every terminal assertion must be `await`ed.**
 > `.Emit()` / `.Match()` / `.Be()` / `.Complete()` / `.NotEmit()` return a `Task`. An un-awaited one is a fire-and-forget that the compiler will not flag in most positions, so the test proceeds before the write lands. `.Within(t)` and `.Should(t)` are the only synchronous links in the chain — they just configure the deadline. (See [Reactive Test Assertions §2](/Doc/Architecture/ReactiveTestAssertions) for the mechanics, including why the assertion subscribes on `TaskPoolScheduler` rather than xUnit's single-threaded sync context.)
@@ -182,7 +184,7 @@ From `MeshWeaver.Reactive.Assertions` (globally imported in every test project).
 | `await obs.Should().NotEmit(within: 200.Milliseconds())` | Nothing arrives — the **one** place a fixed wait is correct |
 | `obs.Should().Within(t)....` / `obs.Should(t)....` | Override the default 10 s timeout for this chain (synchronous — still `await` the terminal call) |
 
-`.Emit()` and `.Match()` **return** the matched value, replacing the hand-rolled `var x = await obs.FirstAsync().ToTask()` pattern one-for-one: `var x = await obs.Should().Within(t).Match(...)`.
+`.Emit()` and `.Match()` **return** the matched value, replacing the forbidden `var x = await obs.FirstAsync().ToTask()` pattern one-for-one: `var x = await obs.Should().Within(t).Match(...)`.
 
 **Fold the wait into the predicate.** Don't grab the first emission and hope it's the right one — describe the state you are waiting for:
 
diff --git a/src/MeshWeaver.Documentation/Data/DataMesh/NodeTypes/Testing.md b/src/MeshWeaver.Documentation/Data/DataMesh/NodeTypes/Testing.md
index f11b4a36ad..fcc7f99271 100644
--- a/src/MeshWeaver.Documentation/Data/DataMesh/NodeTypes/Testing.md
+++ b/src/MeshWeaver.Documentation/Data/DataMesh/NodeTypes/Testing.md
@@ -169,7 +169,7 @@ See `TodoViewsTest.CreateArea_WithTypeParam_ShouldRenderCreateForm` for a comple
 
 ## Archetype 2 — request/response and simulation
 
-When your node type registers a custom handler — for example `config.WithHandler<RunSimulationRequest>(HandleRunSimulation)` in `Source/MyHub.cs` — test it through the test base's `AwaitResponseAsync<TResponse>(request, o => o.WithTarget(address), hub: client)` (the sanctioned `hub.Observe(...).FirstAsync().ToTask(ct)` bridge — `AwaitResponse` itself is `[Obsolete]` and deadlocks). This exercises the real routing and serialization path, not a mocked seam.
+When your node type registers a custom handler — for example `config.WithHandler<RunSimulationRequest>(HandleRunSimulation)` in `Source/MyHub.cs` — test it through the test base's `AwaitResponseAsync<TResponse>(request, o => o.WithTarget(address), hub: client)`, or assert on the observable directly — `await client.Observe(request, o => o.WithTarget(address)).Should().Emit()`, which owns the wait. Do **not** hand-roll `hub.Observe(...).FirstAsync().ToTask(ct)`: `.ToTask()` is forbidden repo-wide as of 2026-08-30, `test/**` included, and `AwaitResponse` itself is `[Obsolete]` and deadlocks. Either sanctioned form exercises the real routing and serialization path, not a mocked seam.
 
 ```csharp
 [Fact(Timeout = 15_000)]
diff --git a/src/MeshWeaver.Documentation/Data/DataMesh/SyncedQueryDataSource.md b/src/MeshWeaver.Documentation/Data/DataMesh/SyncedQueryDataSource.md
index e6baa3e749..54e0ad0524 100644
--- a/src/MeshWeaver.Documentation/Data/DataMesh/SyncedQueryDataSource.md
+++ b/src/MeshWeaver.Documentation/Data/DataMesh/SyncedQueryDataSource.md
@@ -290,18 +290,19 @@ Verification follows an observe-until-condition rhythm (mirrors `ObservableQuery
 [Fact]
 public async Task DataChangeRequestOnSubscriber_PropagatesToOwningHub()
 {
-    var ct   = TestContext.Current.CancellationToken;
     var path = $"{SubjectsNamespace}/alpha";
 
-    // Source-side state.
-    await NodeFactory.CreateNode(MakeSubject("alpha", "Original"))
-        .FirstAsync().ToTask(ct);
+    // Source-side state. The write is a COLD observable, so the assertion's
+    // Subscribe IS the write — there is nothing to bridge.
+    await NodeFactory.CreateNode(MakeSubject("alpha", "Original")).Should().Emit();
 
     // Wait for the CONDITION, never a fixed sleep: a Task.Delay races CI load —
     // too short and it flakes, too long and it wastes the suite's budget.
-    var current = await ReadNode(path)
-        .Where(n => n is not null)
-        .FirstAsync().Timeout(TimeSpan.FromSeconds(10)).ToTask(ct);
+    // 🚨 The assertion OWNS the wait. No FirstAsync + ToTask bridge — forbidden
+    // repo-wide (2026-08-30, "no ToTask ever") — and no bare `await observable`
+    // either: Rx's awaiter resumes the test inline on the signalling thread.
+    // `.Within(t)` is the deadline, which is why there is no CancellationToken here.
+    var current = await ReadNode(path).Should().Within(10.Seconds()).Match(n => n is not null);
 
     // Write at the SUBSCRIBER via DataChangeRequest. The subscriber's
     // synced data source routes the update through its cached per-node
@@ -309,13 +310,12 @@ public async Task DataChangeRequestOnSubscriber_PropagatesToOwningHub()
     await client.Observe(
             new DataChangeRequest { Updates = [current! with { Name = "Updated" }] },
             o => o.WithTarget(new Address(SubscriberPath)))
-        .FirstAsync().ToTask(ct);
+        .Should().Emit();
 
     // Source side reflects the write — again, observe until the condition holds.
     await Observable.Interval(TimeSpan.FromMilliseconds(50)).StartWith(0L)
         .SelectMany(_ => ReadNode(path))
-        .Where(n => n?.Name == "Updated")
-        .FirstAsync().Timeout(TimeSpan.FromSeconds(10)).ToTask(ct);
+        .Should().Within(10.Seconds()).Match(n => n?.Name == "Updated");
 }
 ```
 
diff --git a/src/MeshWeaver.Documentation/Data/DataMesh/UnifiedPath.md b/src/MeshWeaver.Documentation/Data/DataMesh/UnifiedPath.md
index dfcc3f2164..2630136f9d 100644
--- a/src/MeshWeaver.Documentation/Data/DataMesh/UnifiedPath.md
+++ b/src/MeshWeaver.Documentation/Data/DataMesh/UnifiedPath.md
@@ -151,10 +151,17 @@ For a binary format with no transformer, two reliable patterns:
 A note on collection resolution inside scripts: the kernel's `IContentService` does not know node-scoped collections by their plain name. Fetch the node's collection config first and register it under a qualified name — the same handshake `upload` performs:
 
 ```csharp
+// 🚨 ObserveCompletion, never Rx's ToTask bridge (forbidden repo-wide, 2026-08-30) and never a
+//    bare `await Mesh.Observe(...)`: both resume the rest of this script INLINE on the mesh
+//    thread that delivered the response. FirstAsync (not Take(1)): the next line dereferences
+//    delivery.Message, so an empty completion must FAULT rather than settle with null.
 var delivery = await Mesh.Observe(
         new GetDataRequest(new ContentCollectionReference(new[] { "content" })),
         o => o.WithTarget((Address)"MySpace"))
-    .Take(1).ToTask();
+    .FirstAsync()
+    .ObserveCompletion(
+        ex => Log.LogWarning(ex, "collection config read faulted AFTER the wait settled"),
+        Ct);
 var cfg = JsonSerializer.Deserialize<ContentCollectionConfig[]>(
         ((GetDataResponse)delivery.Message).Data is JsonElement je ? je : default,
         Mesh.JsonSerializerOptions)
diff --git a/src/MeshWeaver.Documentation/Data/GUI/Observables.md b/src/MeshWeaver.Documentation/Data/GUI/Observables.md
index 6063f20982..7ca9063591 100644
--- a/src/MeshWeaver.Documentation/Data/GUI/Observables.md
+++ b/src/MeshWeaver.Documentation/Data/GUI/Observables.md
@@ -126,7 +126,16 @@ Controls.Stack
 ```csharp
 Controls.Stack
     .WithView(async (host, ctx, ct) => {
-        var settings = await ioPool.Invoke(ct2 => LoadSettingsAsync(ct2)).ToTask(ct);
+        // 🚨 ViewDefinition's Task<UiControl?> is a signature we do not own, so an
+        //    await is legitimate here — the BRIDGE is not free choice. ObserveCompletion,
+        //    never Rx's ToTask bridge (forbidden repo-wide, 2026-08-30) and never a bare
+        //    `await someObservable`: both resume this render INLINE on the pool thread
+        //    that signalled, still inside Rx's trampoline.
+        var settings = await ioPool.Invoke(ct2 => LoadSettingsAsync(ct2))
+            .FirstAsync()
+            .ObserveCompletion(
+                ex => logger.LogWarning(ex, "settings load faulted after the wait settled"),
+                ct);
         return Controls.Label($"Hello, {settings.Name}");
     })
 ```
diff --git a/src/MeshWeaver.Documentation/Data/WhatsNew/2026-08-30-guidance-no-longer-teaches-the-forbidden-bridge.md b/src/MeshWeaver.Documentation/Data/WhatsNew/2026-08-30-guidance-no-longer-teaches-the-forbidden-bridge.md
new file mode 100644
index 0000000000..ff8764cb4a
--- /dev/null
+++ b/src/MeshWeaver.Documentation/Data/WhatsNew/2026-08-30-guidance-no-longer-teaches-the-forbidden-bridge.md
@@ -0,0 +1,35 @@
+---
+Name: Guidance no longer teaches the forbidden Rx-to-Task bridge
+Category: Fix
+Description: Documentation, agent skills and the automatic code-review instructions stopped prescribing the `.ToTask()` bridge that the platform forbids — including the copy-paste script examples an agent pastes into a mesh node — and a new ratchet keeps a C# example from reintroducing it.
+Icon: ShieldError
+Order: -20260830
+---
+
+# Guidance no longer teaches the forbidden Rx-to-Task bridge
+
+MeshWeaver is `IObservable<T>` end to end, and the Rx observable-to-`Task` bridge is forbidden
+everywhere — tests included, as of the 30 August ruling that retracted the older "tests are the one
+sanctioned place" carve-out. Rx completes its `TaskCompletionSource` without
+`RunContinuationsAsynchronously`, so it resumes the awaiter *inline on the thread that signalled*,
+which in the mesh is a hub's action block or a grain's turn scheduler.
+
+The rule was being enforced in source while the *guidance* still prescribed the shape. That is the
+worse half: a page that presents the bridge as the right thing to write generates new violations
+faster than any sweep removes them, and no code scanner ever sees a markdown file. Two categories
+mattered most. `.github/copilot-instructions.md` drives the automatic review on every pull request
+here, and it listed the bridge as "the accepted bridge" in test projects — so review was actively
+defending the banned shape. And the `.csx` script examples in the script-execution and
+activity-control-plane pages are pasted into mesh nodes, which compile at *runtime* in the portal,
+where no build and no test can catch them.
+
+Every prescriptive occurrence is converted. Where the signature is ours the example now returns
+`IObservable<T>` and subscribes; where a foreign signature genuinely hands back a `Task` it uses
+`ReactiveCompletion.ObserveCompletion`, which completes asynchronously and keeps its error arm
+attached for a fault arriving after the wait settled; and tests assert through the reactive
+assertion surface, which owns the wait. The pages that *warn* against the shape — the war stories,
+the anti-pattern blocks, the "delete on sight" checklists — are untouched on purpose: a rule stated
+without the shape it forbids is unrecognisable in review.
+
+A new ratchet keeps it that way. It counts the shape only inside a fenced C# code block, so prose
+warning against it stays free, and its seeded inventory can only shrink.
diff --git a/src/MeshWeaver.Mesh.Operations/README.md b/src/MeshWeaver.Mesh.Operations/README.md
index 52bcbab363..2239a576ab 100644
--- a/src/MeshWeaver.Mesh.Operations/README.md
+++ b/src/MeshWeaver.Mesh.Operations/README.md
@@ -27,8 +27,14 @@ platform, and this had to stop travelling with it.
 ## Everything returns `IObservable<T>`
 
 Never `Task<T>`. The mesh is an actor-hub system: `await` on hub-backed work deadlocks the
-single-threaded action block. Callers subscribe (`.Subscribe(onNext, onError)`) or bridge at an
-external boundary (`.FirstAsync().ToTask()` in an MCP/REST adapter) — never inside hub flow. See
+single-threaded action block. Callers subscribe (`.Subscribe(onNext, onError)`) — and where an
+external signature (an MCP/REST adapter) genuinely hands back a `Task<T>`, they bridge with
+`.FirstAsync().ObserveCompletion(reportLateFault, ct)`, never inside hub flow.
+
+🚨 **Never `.ToTask()`** — forbidden repo-wide as of 2026-08-30, `test/**` included — and never a
+bare `await someObservable` either: Rx's bridge and Rx's own awaiter both resume the caller inline on
+the thread that signalled. `ReactiveCompletion.ObserveCompletion` completes with
+`RunContinuationsAsynchronously` and keeps its error arm attached. See
 `Doc/Architecture/AsynchronousCalls`.
 
 ## Reading a node that may not be there
diff --git a/test/GuidanceBridgeSites.allow b/test/GuidanceBridgeSites.allow
new file mode 100644
index 0000000000..63851cf8a0
--- /dev/null
+++ b/test/GuidanceBridgeSites.allow
@@ -0,0 +1,71 @@
+# GuidanceBridgeSites.allow — the guidance ratchet for the forbidden Rx→Task bridge.
+#
+# Maintainer ruling, 2026-08-30: "totask is forbidden", "strictly", "no totask ever". The older
+# carve-out — "tests are the only sanctioned place" — is RETRACTED. `.ToTask(` is a defect in
+# `test/**` exactly as in `src/`.
+#
+# WHY GUIDANCE GETS ITS OWN RATCHET. A scanner can hold source to that rule. It cannot see a
+# MARKDOWN file, and a markdown file that PRESCRIBES the shape generates new violations faster
+# than a sweep removes them: every agent and every reviewer reads it as the house pattern. The
+# examples with the shortest path to production are the ones nothing compiles — a `.csx` script
+# body pasted into a mesh node, which compiles at RUNTIME in the portal, where no `dotnet build`
+# and no test ever sees it. And `.github/copilot-instructions.md` drives the automatic Copilot
+# review on every PR in this repo: until 2026-08-30 it told that reviewer the bridge was "the
+# accepted bridge" in `test/**`, so review actively DEFENDED the banned shape.
+#
+# WHAT IS COUNTED: `.ToTask(` inside a fenced code block whose info string is `csharp`, `cs` or
+# `c#`. Nothing else. Prose naming `.ToTask()` is overwhelmingly a WARNING — "never do this",
+# "this is the deadlock pattern", the war stories that explain why the rule exists — and a ratchet
+# that counted those would push people to delete the institutional memory to go green. Unlabelled
+# and ```text / ```output / ```bash fences are NOT counted either: this repo puts captured stack
+# traces, measurements and red-flag lists in those.
+#
+# WHAT THE SEEDED LINES ARE. After the 2026-08-30 guidance sweep, every remaining occurrence is an
+# ❌ ANTI-PATTERN block — the shape shown so it can be recognised and deleted:
+#
+#   * AsynchronousCalls.md   — "❌ Direct .ToTask() bridge then await", the two "← still deadlocks"
+#                              variants, the disposal-wait ❌, and the request/response ❌.
+#   * BlazorDataBinding.md   — "Anti-Patterns to Delete on Sight" → "❌ WRONG — Task bridge in
+#                              lifecycle".
+#   * InitializationGates.md — "❌ DEADLOCK — await captures the grain scheduler".
+#   * ActorModel.md          — "❌ The deleted shape", naming the hand-rolled equivalent.
+#   * /async, /sigsegv       — "❌ parks the grain turn, then races a timer".
+#
+# Those must NOT be deleted to satisfy this file: a rule stated without the shape it forbids is
+# unrecognisable in review. That is why this is a seeded ratchet and not zero tolerance.
+#
+# TO FIX A SITE (i.e. one that TEACHES rather than warns), in priority order:
+#   1. The signature is ours          → return IObservable<T>, compose, .Subscribe(onNext, onError).
+#   2. A Task-returning override whose RESULT is unused (IHostedService.StartAsync, a grain
+#      lifecycle hook, a middleware hop) → subscribe and return Task.CompletedTask.
+#   3. A foreign signature that needs the value (ASP.NET endpoint, ILifecycleObserver.OnStop, an
+#      SDK interface, an `async Task` test method, a `.csx` body) →
+#          await src.FirstAsync().ObserveCompletion(ex => log.LogWarning(ex, "…"), ct)
+#      (MeshWeaver.Messaging.ReactiveCompletion). It completes with
+#      RunContinuationsAsynchronously and keeps its error arm attached; `reportLateFault` must
+#      never be an empty lambda. In a TEST, prefer the assertion surface, which owns the wait:
+#      `await obs.Should().Match(...)`.
+#
+# 🚨 `await source.FirstAsync()` is NOT the fix. Rx's own awaiter is an AsyncSubject<T> that
+# completes its continuation from inside OnCompleted, on the signalling thread — measured
+# identical to the bridge (INLINE=True for both; only ObserveCompletion measures INLINE=False).
+# It is the plausible "simplification" that fixes nothing.
+#
+# 🚨 `.ToTask()` returns the LAST value and THROWS on an empty sequence; ObserveCompletion returns
+# the FIRST and settles with `default`. So keep an existing `.FirstAsync()` / `.LastAsync()`, and
+# where the next line dereferences the result use `.FirstAsync()` (NOT `.Take(1)`) so an empty
+# source still faults instead of silently handing back null.
+#
+# THE RATCHET MAY ONLY SHRINK. A new file, a raised count, or a raised TOTAL fails. A stale line
+# (its site was converted) is REPORTED, never failed — two PRs shrinking concurrently would
+# otherwise red main on whichever merged second. Delete the stale line and lower TotalBudget in
+# GuidanceBridgeRatchetGuard by the same amount, in the same change.
+#
+# Format: <repo-relative path>\t<count>
+
+.claude/skills/async/SKILL.md	1
+.claude/skills/sigsegv/SKILL.md	1
+src/MeshWeaver.Documentation/Data/Architecture/ActorModel.md	1
+src/MeshWeaver.Documentation/Data/Architecture/AsynchronousCalls.md	7
+src/MeshWeaver.Documentation/Data/Architecture/BlazorDataBinding.md	1
+src/MeshWeaver.Documentation/Data/Architecture/InitializationGates.md	1
diff --git a/test/MeshWeaver.Documentation.Test/GuidanceBridgeRatchetGuard.cs b/test/MeshWeaver.Documentation.Test/GuidanceBridgeRatchetGuard.cs
new file mode 100644
index 0000000000..62cb198701
--- /dev/null
+++ b/test/MeshWeaver.Documentation.Test/GuidanceBridgeRatchetGuard.cs
@@ -0,0 +1,302 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using Xunit;
+
+namespace MeshWeaver.Documentation.Test;
+
+/// <summary>
+/// Governance ratchet for GUIDANCE: a doc page, skill or review-instruction file may not gain a
+/// copyable C# example that writes <c>.ToTask(</c>.
+///
+/// <para><b>Why guidance needs its own ratchet.</b> The maintainer ruling of 2026-08-30 —
+/// <i>"totask is forbidden"</i>, <i>"no totask ever"</i> — retracted the last exemption, the one that
+/// called tests "the only sanctioned place". A code scanner can hold <c>src/</c> and <c>test/</c> to
+/// that. It cannot see a MARKDOWN file, and a markdown file that PRESCRIBES the shape generates new
+/// violations faster than a sweep removes them: every agent and every reviewer reads it as the house
+/// pattern, and the examples with the shortest path to production are the ones nothing compiles —
+/// a <c>.csx</c> script body pasted into a mesh node, which compiles at RUNTIME in the portal.
+/// <c>.github/copilot-instructions.md</c> is the sharpest case of all: until this change it told the
+/// automatic reviewer that the bridge was "the accepted bridge" in <c>test/**</c>, so review actively
+/// DEFENDED the banned shape on every PR.</para>
+///
+/// <para><b>The discriminator: a fenced code block whose language is C#.</b> Prose that names
+/// <c>.ToTask()</c> is overwhelmingly a WARNING — "never do this", "this is the deadlock pattern",
+/// the war stories that explain why the rule exists — and a ratchet that counted those would push
+/// people to delete the institutional memory in order to go green, which is the opposite of the
+/// point. A <c>```csharp</c> fence is different: it is text written to be copied. So only
+/// <c>```csharp</c> / <c>```cs</c> / <c>```c#</c> fences are counted. Unlabelled fences and
+/// <c>```text</c> / <c>```output</c> / <c>```bash</c> fences are NOT — this repo puts captured stack
+/// traces and measurements in those, and one of them (the /async skill's red-flag list) names the
+/// shape precisely because it is banned.</para>
+///
+/// <para><b>What the seeded inventory is.</b> Everything left after the 2026-08-30 guidance sweep is
+/// an ❌ ANTI-PATTERN example — <c>AsynchronousCalls.md</c>'s "❌ Direct .ToTask() bridge then await",
+/// <c>BlazorDataBinding.md</c>'s "Anti-Patterns to Delete on Sight", <c>InitializationGates.md</c>'s
+/// "❌ DEADLOCK", the /async and /sigsegv skills' "❌ parks the grain turn". Those must NOT be
+/// deleted: a rule stated without the shape it forbids is unrecognisable in review. Hence a seeded
+/// ratchet rather than zero tolerance.</para>
+///
+/// <para><b>The ratchet may only SHRINK.</b> A new file, a raised count, or a raised TOTAL is a
+/// failure. A line that has become stale is REPORTED, not failed — two PRs shrinking concurrently
+/// would otherwise red <c>main</c> on whichever merged second, and a gate that punishes the direction
+/// it is asking for teaches people to stop shrinking. Delete the stale line and lower
+/// <see cref="TotalBudget"/> in the same change.</para>
+/// </summary>
+public class GuidanceBridgeRatchetGuard(ITestOutputHelper output)
+{
+    /// <summary>
+    /// The seeded inventory's size. Per-file entries stop a new example in a file that already
+    /// carries one; this stops the list as a WHOLE from growing — including by the trick of adding a
+    /// new file's line. Lower it whenever you delete or lower an entry.
+    /// </summary>
+    private const int TotalBudget = 12;
+
+    /// <summary>
+    /// Where guidance lives: the embedded documentation tree, the agent skills, the GitHub review
+    /// instructions and workflow prose, and the repo-root instruction files (AGENTS.md, CLAUDE.md).
+    /// </summary>
+    private static readonly string[] ScannedRoots =
+        ["src/MeshWeaver.Documentation/Data", ".claude/skills", ".github"];
+
+    /// <summary>The shape, as it appears in an example. Matched with the open paren so a sentence
+    /// about "ToTask" in a comment-free code line still reads as a call.</summary>
+    private const string Marker = ".ToTask(";
+
+    /// <summary>Fence info strings that mean "this is C# you could paste".</summary>
+    private static readonly string[] CSharpFenceLanguages = ["csharp", "cs", "c#"];
+
+    private const string AllowFileName = "GuidanceBridgeSites.allow";
+
+    [Fact]
+    public void NoGuidanceFileTeachesTheForbiddenBridge()
+    {
+        var root = SourceScan.FindRepoRoot();
+        var allowed = SourceScan.ReadAllowFile(Path.Combine(root, "test", AllowFileName), AllowFileName);
+        var found = Scan(root);
+
+        var failures = new List<string>();
+
+        foreach (var (file, count) in found.OrderBy(kv => kv.Key, StringComparer.Ordinal))
+        {
+            if (!allowed.TryGetValue(file, out var budget))
+                failures.Add(
+                    $"  NEW SITE   {file} ({count}) — a C# example in guidance now writes "
+                    + $"{Marker}, which is forbidden repo-wide (2026-08-30, \"no ToTask ever\"). "
+                    + "Write what the reader should copy instead: return IObservable<T> and "
+                    + "Subscribe; or, where a foreign signature genuinely hands back a Task, "
+                    + "`.FirstAsync().ObserveCompletion(reportLateFault, ct)`. Do NOT add a line to "
+                    + AllowFileName + ".");
+            else if (count > budget)
+                failures.Add(
+                    $"  MORE       {file} ({count} > {budget} allowed) — an example was ADDED to a "
+                    + "file whose allowance covers only its existing ❌ anti-pattern blocks.");
+        }
+
+        var total = allowed.Values.Sum();
+        if (total > TotalBudget)
+            failures.Add(
+                $"  TOTAL      {total} allowances > {TotalBudget} budgeted — the inventory GREW. "
+                + "Adding a line to " + AllowFileName + " is not a fix.");
+
+        foreach (var (file, budget) in allowed.OrderBy(kv => kv.Key, StringComparer.Ordinal))
+        {
+            var count = found.GetValueOrDefault(file, 0);
+            if (count < budget)
+                output.WriteLine(
+                    $"STALE (please tidy): {file} — {count} found, {budget} allowed. "
+                    + $"{(count == 0 ? "Delete the line" : $"Lower it to {count}")} and lower "
+                    + $"TotalBudget by {budget - count}.");
+        }
+
+        Assert.True(failures.Count == 0,
+            "Guidance that PRESCRIBES the Rx→Task bridge generates new violations faster than a "
+            + "sweep removes them, and no code scanner will ever see it — a `.csx` example is "
+            + "pasted into a mesh node and compiles at RUNTIME in the portal. Prose that WARNS "
+            + "against the shape is fine and is deliberately not counted; only a ```csharp fence "
+            + "is.\n"
+            + string.Join("\n", failures));
+    }
+
+    /// <summary>
+    /// Non-vacuity, both directions, driven through the REAL counter: it must SEE the shape inside a
+    /// C# fence and must NOT see it in prose or in a non-C# fence. Without this, a scanner that had
+    /// silently stopped matching (a renamed marker, a fence parser that swallowed the file) would
+    /// report every seeded entry as STALE — which this guard only prints — and the ratchet above
+    /// would pass on no evidence.
+    /// </summary>
+    [Fact]
+    public void TheScannerCountsCSharpFencesAndIgnoresEverythingElse()
+    {
+        const string prose =
+            "Never write `.ToTask()` — it resumes the awaiter inline on the signalling thread.\n";
+        Assert.Equal(0, CountSitesInMarkdown(prose));
+
+        const string textFence =
+            "Captured stack:\n\n```text\n  -> ToTaskObserver.OnCompleted   // a .ToTask() resolves\n```\n";
+        Assert.Equal(0, CountSitesInMarkdown(textFence));
+
+        const string unlabelledFence =
+            "Red flags:\n\n```\n.ToTask() / .Result / .Wait()\n```\n";
+        Assert.Equal(0, CountSitesInMarkdown(unlabelledFence));
+
+        const string csharpFence =
+            "Do not write this:\n\n```csharp\nvar n = await hub.GetMeshNode(p).ToTask(ct);\n```\n";
+        Assert.Equal(1, CountSitesInMarkdown(csharpFence));
+
+        const string shortAlias =
+            "```cs\nvar a = await x.FirstAsync().ToTask();\nvar b = await y.FirstAsync().ToTask();\n```\n";
+        Assert.Equal(2, CountSitesInMarkdown(shortAlias));
+
+        // An indented fence inside a list item is still a fence, and its language still decides.
+        const string indentedInsideList =
+            "- For waits:\n\n  ```csharp\n  await s.FirstAsync().ToTask(Ct);\n  ```\n\n- Done.\n";
+        Assert.Equal(1, CountSitesInMarkdown(indentedInsideList));
+
+        // Everything at once, so a parser that leaks state across fences is caught too.
+        Assert.Equal(4,
+            CountSitesInMarkdown(prose + textFence + unlabelledFence + csharpFence + shortAlias
+                                 + indentedInsideList));
+    }
+
+    /// <summary>
+    /// The same non-vacuity check against the REAL tree, both directions: the seeded files must
+    /// still be seen, and a file whose only mentions are prose must still be absent. Pinned on
+    /// <c>.github/copilot-instructions.md</c> because that file is the whole reason this guard
+    /// exists — it names the shape in order to tell the reviewer to flag it, and a scanner that
+    /// counted that would ratchet against the fix itself.
+    /// </summary>
+    [Fact]
+    public void TheScannerFindsTheShapeItIsRatchetingAndNotTheWarningsAgainstIt()
+    {
+        var root = SourceScan.FindRepoRoot();
+        var found = Scan(root);
+
+        Assert.True(found.Count > 0,
+            "The scanner found no C# example writing " + Marker + " anywhere under "
+            + string.Join(", ", ScannedRoots) + " or at the repo root. Either every ❌ anti-pattern "
+            + "block was deleted — in which case empty " + AllowFileName + " and delete this "
+            + "assertion — or the fence parser is broken, which would make the ratchet above pass "
+            + "on no evidence.");
+
+        var reviewInstructions = Path.Combine(root, ".github", "copilot-instructions.md");
+        Assert.True(File.Exists(reviewInstructions),
+            "the review instructions must exist for this check to mean anything");
+        Assert.Contains(Marker, File.ReadAllText(reviewInstructions), StringComparison.Ordinal);
+        Assert.False(found.ContainsKey(".github/copilot-instructions.md"),
+            "the scanner counted PROSE as a teaching site — the fence discriminator is broken, and "
+            + "every count in the allow file is therefore unreliable. This file names the shape "
+            + "only to tell the reviewer to flag it.");
+    }
+
+    private static Dictionary<string, int> Scan(string root) =>
+        GuidanceFiles(root)
+            .Select(f => (Relative: SourceScan.Relative(root, f), Count: CountSites(f)))
+            .Where(x => x.Count > 0)
+            .ToDictionary(x => x.Relative, x => x.Count, StringComparer.Ordinal);
+
+    private static IEnumerable<string> GuidanceFiles(string root) =>
+        ScannedRoots
+            .Select(r => Path.Combine(root, r))
+            .Where(Directory.Exists)
+            .SelectMany(dir => Directory.EnumerateFiles(dir, "*.md", SearchOption.AllDirectories))
+            .Concat(Directory.EnumerateFiles(root, "*.md", SearchOption.TopDirectoryOnly))
+            .Where(f => !SourceScan.IsExcluded(root, f))
+            .Distinct(StringComparer.Ordinal);
+
+    private static int CountSites(string path)
+    {
+        string text;
+        try { text = File.ReadAllText(path); }
+        catch (IOException) { return 0; } // a file a concurrent build is writing is not evidence
+
+        return text.Contains(Marker, StringComparison.Ordinal) ? CountSitesInMarkdown(text) : 0;
+    }
+
+    /// <summary>
+    /// Occurrences of <see cref="Marker"/> that sit inside a fenced code block whose info string
+    /// names C#. Everything else in the document — prose, tables, block quotes, and fences of any
+    /// other language — is invisible to this count on purpose.
+    /// </summary>
+    internal static int CountSitesInMarkdown(string text)
+    {
+        var lines = text.Split('\n');
+        var count = 0;
+        var i = 0;
+
+        while (i < lines.Length)
+        {
+            var opening = TryReadFenceOpening(lines[i]);
+            if (opening is null)
+            {
+                i++;
+                continue;
+            }
+
+            var (fence, length, language) = opening.Value;
+            var isCSharp = CSharpFenceLanguages.Contains(language, StringComparer.Ordinal);
+            i++;
+
+            while (i < lines.Length && !IsFenceClose(lines[i], fence, length))
+            {
+                if (isCSharp) count += Occurrences(lines[i]);
+                i++;
+            }
+
+            i++; // step past the closing fence, or off the end of an unterminated one
+        }
+
+        return count;
+    }
+
+    /// <summary>CommonMark fence opening: up to three spaces of indent, three or more backticks or
+    /// tildes, then an info string whose first word is the language.</summary>
+    private static (char Fence, int Length, string Language)? TryReadFenceOpening(string rawLine)
+    {
+        var line = rawLine.TrimEnd('\r');
+        var indent = 0;
+        while (indent < line.Length && line[indent] == ' ') indent++;
+        if (indent > 3 || indent >= line.Length) return null;
+
+        var fence = line[indent];
+        if (fence is not ('`' or '~')) return null;
+
+        var length = 0;
+        while (indent + length < line.Length && line[indent + length] == fence) length++;
+        if (length < 3) return null;
+
+        var info = line[(indent + length)..].Trim();
+        // A backtick fence's info string may not contain a backtick — that is inline code, not a fence.
+        if (fence == '`' && info.Contains('`', StringComparison.Ordinal)) return null;
+
+        var language = new string(info.TakeWhile(c => c is not (' ' or '\t' or ',' or '{')).ToArray())
+            .ToLowerInvariant();
+        return (fence, length, language);
+    }
+
+    private static bool IsFenceClose(string rawLine, char fence, int openingLength)
+    {
+        var line = rawLine.TrimEnd('\r');
+        var indent = 0;
+        while (indent < line.Length && line[indent] == ' ') indent++;
+        if (indent > 3) return false;
+
+        var length = 0;
+        while (indent + length < line.Length && line[indent + length] == fence) length++;
+        return length >= openingLength && line[(indent + length)..].Trim().Length == 0;
+    }
+
+    private static int Occurrences(string line)
+    {
+        var count = 0;
+        var at = 0;
+        while ((at = line.IndexOf(Marker, at, StringComparison.Ordinal)) >= 0)
+        {
+            count++;
+            at += Marker.Length;
+        }
+
+        return count;
+    }
+}