[TheCryptoDonkey]

Cold joins could discard useful verified future media after the room clock passed the held first fragment. The planner then replaced that coverage and could hit its startup deadline even though the existing fourth residency slot could have provided enough contiguous headroom.

Consider that slot before retiring the useful prefix, and require both retained future fragments to contribute to coverage of the current target. The original response, eight-second/parent deadline, four-object/24 MiB cap, serial speculative requests, authority checks and fresh-target release remain intact. Documentation and generated LLM context describe the corrected behaviour.

Validation: the controlled regression failed at the original deadline before the fix and now releases at 4.65 seconds; the new fourth-slot refusal case preserves the prefix and terminates once without exceeding the budget. Full JavaScript suite: 645/645; full warm-ahead suite against the committed Core: 124/124; syntax and documentation checks pass. The existing holder-charging tests now use separate controlled-clock cases with exact branch, source-success and no-request/no-penalty assertions.

This is a bounded startup correctness fix. It does not establish the cause of a particular browser failure, a performance advantage, public-NAT operation or physical-device acceptance.